src/charon/config/child_cfg.h

   1 /*
   2  * Copyright (C) 2008-2009 Tobias Brunner
   3  * Copyright (C) 2005-2007 Martin Willi
   4  * Copyright (C) 2005 Jan Hutter
   5  * Hochschule fuer Technik Rapperswil
   6  *
   7  * This program is free software; you can redistribute it and/or modify it
   8  * under the terms of the GNU General Public License as published by the
   9  * Free Software Foundation; either version 2 of the License, or (at your
  10  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  11  *
  12  * This program is distributed in the hope that it will be useful, but
  13  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  14  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  15  * for more details.
  16  */
  17
  18 /**
  19  * @defgroup child_cfg child_cfg
  20  * @{ @ingroup config
  21  */
  22
  23 #ifndef CHILD_CFG_H_
  24 #define CHILD_CFG_H_
  25
  26 typedef enum action_t action_t;
  27 typedef enum ipcomp_transform_t ipcomp_transform_t;
  28 typedef struct lifetime_cfg_t lifetime_cfg_t;
  29 typedef struct child_cfg_t child_cfg_t;
  30
  31 #include <library.h>
  32 #include <config/proposal.h>
  33 #include <config/traffic_selector.h>
  34 #include <kernel/kernel_ipsec.h>
  35
  36 /**
  37  * Action to take when DPD detected/connection gets closed by peer.
  38  */
  39 enum action_t {
  40         /** No action */
  41         ACTION_NONE,
  42         /** Route config to reestablish on demand */
  43         ACTION_ROUTE,
  44         /** Restart config immediately */
  45         ACTION_RESTART,
  46 };
  47
  48 /**
  49  * enum names for action_t.
  50  */
  51 extern enum_name_t *action_names;
  52
  53 /**
  54  * IPComp transform IDs, as in RFC 4306
  55  */
  56 enum ipcomp_transform_t {
  57         IPCOMP_NONE = 241,
  58         IPCOMP_OUI = 1,
  59         IPCOMP_DEFLATE = 2,
  60         IPCOMP_LZS = 3,
  61         IPCOMP_LZJH = 4,
  62 };
  63
  64 /**
  65  * enum strings for ipcomp_transform_t.
  66  */
  67 extern enum_name_t *ipcomp_transform_names;
  68
  69 /**
  70  * A lifetime_cfg_t defines the lifetime limits of a CHILD_SA.
  71  *
  72  * Set any of these values to 0 to ignore.
  73  */
  74 struct lifetime_cfg_t {
  75         /** Time in seconds before the CHILD_SA gets invalid. */
  76         u_int64_t       life_time;
  77         /** Number of bytes transmitted before the CHILD_SA gets invalid. */
  78         u_int64_t       life_bytes;
  79         /** Number of packets transmitted before the CHILD_SA gets invalid. */
  80         u_int64_t       life_packets;
  81         /** Time in seconds before the CHILD_SA gets rekeyed. */
  82         u_int64_t       rekey_time;
  83         /** Number of bytes transmitted before the CHILD_SA gets rekeyed. */
  84         u_int64_t       rekey_bytes;
  85         /** Number of packets transmitted before the CHILD_SA gets rekeyed. */
  86         u_int64_t       rekey_packets;
  87         /** The range of a random value subtracted from rekey_time */
  88         u_int64_t       jitter_time;
  89         /** The range of a random value subtracted from rekey_bytes */
  90         u_int64_t       jitter_bytes;
  91         /** The range of a random value subtracted from rekey_packets */
  92         u_int64_t       jitter_packets;
  93 };
  94
  95 /**
  96  * Helper macro to easily set all three values of a specified limit (time,
  97  * bytes, packets).
  98  */
  99 #define LIFETIME_CFG_SET(l, limit, life, rekey, jitter) do { \
 100         (l)->life_##limit = (life); \
 101         (l)->rekey_##limit = (rekey); \
 102         (l)->jitter_##limit = (jitter); \
 103 } while(0)
 104
 105 /**
 106  * Create a new lifetime_cfg_t object.
 107  */
 108 static inline lifetime_cfg_t* lifetime_cfg_create() {
 109         lifetime_cfg_t *this = malloc_thing(lifetime_cfg_t);
 110         memset(this, 0, sizeof(lifetime_cfg_t));
 111         return this;
 112 }
 113
 114 /**
 115  * Special constructor for the (currently) most common case.
 116  */
 117 static inline lifetime_cfg_t* lifetime_cfg_create_time(u_int64_t life,
 118                                                                           u_int64_t rekey, u_int64_t jitter)
 119 {
 120         lifetime_cfg_t *this = lifetime_cfg_create();
 121         LIFETIME_CFG_SET(this, time, life, rekey, jitter);
 122         return this;
 123 }
 124
 125 /**
 126  * A child_cfg_t defines the config template for a CHILD_SA.
 127  *
 128  * After creation, proposals and traffic selectors may be added to the config.
 129  * A child_cfg object is referenced multiple times, and is not thread save.
 130  * Reading from the object is save, adding things is not allowed while other
 131  * threads may access the object.
 132  * A reference counter handles the number of references hold to this config.
 133  *
 134  * @see peer_cfg_t to get an overview over the configurations.
 135  */
 136 struct child_cfg_t {
 137
 138         /**
 139          * Get the name of the child_cfg.
 140          *
 141          * @return                              child_cfg's name
 142          */
 143         char *(*get_name) (child_cfg_t *this);
 144
 145         /**
 146          * Add a proposal to the list.
 147          *
 148          * The proposals are stored by priority, first added
 149          * is the most prefered.
 150          * After add, proposal is owned by child_cfg.
 151          *
 152          * @param proposal              proposal to add
 153          */
 154         void (*add_proposal) (child_cfg_t *this, proposal_t *proposal);
 155
 156         /**
 157          * Get the list of proposals for the CHILD_SA.
 158          *
 159          * Resulting list and all of its proposals must be freed after use.
 160          *
 161          * @param strip_dh              TRUE strip out diffie hellman groups
 162          * @return                              list of proposals
 163          */
 164         linked_list_t* (*get_proposals)(child_cfg_t *this, bool strip_dh);
 165
 166         /**
 167          * Select a proposal from a supplied list.
 168          *
 169          * Returned propsal is newly created and must be destroyed after usage.
 170          *
 171          * @param proposals             list from from wich proposals are selected
 172          * @param strip_dh              TRUE strip out diffie hellman groups
 173          * @return                              selected proposal, or NULL if nothing matches
 174          */
 175         proposal_t* (*select_proposal)(child_cfg_t*this, linked_list_t *proposals,
 176                                                                    bool strip_dh);
 177
 178         /**
 179          * Add a traffic selector to the config.
 180          *
 181          * Use the "local" parameter to add it for the local or the remote side.
 182          * After add, traffic selector is owned by child_cfg.
 183          *
 184          * @param local                 TRUE for local side, FALSE for remote
 185          * @param ts                    traffic_selector to add
 186          */
 187         void (*add_traffic_selector)(child_cfg_t *this, bool local,
 188                                                                  traffic_selector_t *ts);
 189
 190         /**
 191          * Get a list of traffic selectors to use for the CHILD_SA.
 192          *
 193          * The config contains two set of traffic selectors, one for the local
 194          * side, one for the remote side.
 195          * If a list with traffic selectors is supplied, these are used to narrow
 196          * down the traffic selector list to the greatest common divisor.
 197          * Some traffic selector may be "dymamic", meaning they are narrowed down
 198          * to a specific address (host-to-host or virtual-IP setups). Use
 199          * the "host" parameter to narrow such traffic selectors to that address.
 200          * Resulted list and its traffic selectors must be destroyed after use.
 201          *
 202          * @param local                 TRUE for TS on local side, FALSE for remote
 203          * @param supplied              list with TS to select from, or NULL
 204          * @param host                  address to use for narrowing "dynamic" TS', or NULL
 205          * @return                              list containing the traffic selectors
 206          */
 207         linked_list_t *(*get_traffic_selectors)(child_cfg_t *this, bool local,
 208                                                                                         linked_list_t *supplied,
 209                                                                                         host_t *host);
 210         /**
 211          * Get the updown script to run for the CHILD_SA.
 212          *
 213          * @return                              path to updown script
 214          */
 215         char* (*get_updown)(child_cfg_t *this);
 216
 217         /**
 218          * Should we allow access to the local host (gateway)?
 219          *
 220          * @return                              value of hostaccess flag
 221          */
 222         bool (*get_hostaccess) (child_cfg_t *this);
 223
 224         /**
 225          * Get the lifetime configuration of a CHILD_SA.
 226          *
 227          * The rekey limits automatically contain a jitter to avoid simultaneous
 228          * rekeying. These values will change with each call to this function.
 229          *
 230          * @return                              lifetime_cfg_t (has to be freed)
 231          */
 232         lifetime_cfg_t* (*get_lifetime) (child_cfg_t *this);
 233
 234         /**
 235          * Get the mode to use for the CHILD_SA.
 236          *
 237          * The mode is either tunnel, transport or BEET. The peer must agree
 238          * on the method, fallback is tunnel mode.
 239          *
 240          * @return                              ipsec mode
 241          */
 242         ipsec_mode_t (*get_mode) (child_cfg_t *this);
 243
 244         /**
 245          * Action to take on DPD.
 246          *
 247          * @return                              DPD action
 248          */
 249         action_t (*get_dpd_action) (child_cfg_t *this);
 250
 251         /**
 252          * Action to take if CHILD_SA gets closed.
 253          *
 254          * @return                              close action
 255          */
 256         action_t (*get_close_action) (child_cfg_t *this);
 257
 258         /**
 259          * Get the DH group to use for CHILD_SA setup.
 260          *
 261          * @return                              dh group to use
 262          */
 263         diffie_hellman_group_t (*get_dh_group)(child_cfg_t *this);
 264
 265         /**
 266          * Check whether IPComp should be used, if the other peer supports it.
 267          *
 268          * @return                              TRUE, if IPComp should be used
 269          *                                              FALSE, otherwise
 270          */
 271         bool (*use_ipcomp)(child_cfg_t *this);
 272
 273         /**
 274          * Sets two options needed for Mobile IPv6 interoperability
 275          *
 276          * @param proxy_mode    use IPsec transport proxy mode (default FALSE)
 277          * @param install_policy install IPsec kernel policies (default TRUE)
 278          */
 279         void (*set_mipv6_options)(child_cfg_t *this, bool proxy_mode,
 280                                                                                                  bool install_policy);
 281
 282         /**
 283          * Check whether IPsec transport SA should be set up in proxy mode
 284          *
 285          * @return                              TRUE, if proxy mode should be used
 286          *                                              FALSE, otherwise
 287          */
 288         bool (*use_proxy_mode)(child_cfg_t *this);
 289
 290         /**
 291          * Check whether IPsec policies should be installed in the kernel
 292          *
 293          * @return                              TRUE, if IPsec kernel policies should be installed
 294          *                                              FALSE, otherwise
 295          */
 296         bool (*install_policy)(child_cfg_t *this);
 297
 298         /**
 299          * Increase the reference count.
 300          *
 301          * @return                              reference to this
 302          */
 303         child_cfg_t* (*get_ref) (child_cfg_t *this);
 304
 305         /**
 306          * Destroys the child_cfg object.
 307          *
 308          * Decrements the internal reference counter and
 309          * destroys the child_cfg when it reaches zero.
 310          */
 311         void (*destroy) (child_cfg_t *this);
 312 };
 313
 314 /**
 315  * Create a configuration template for CHILD_SA setup.
 316  *
 317  * The "name" string gets cloned.
 318  *
 319  * The lifetime_cfg_t object gets adopted by this config.
 320  * To prevent two peers to start rekeying at the same time, a jitter may be
 321  * specified. Rekeying of an SA starts at (rekey_xxx - random(0, jitter_xxx)).
 322  *
 323  * After a call to create, a reference is obtained (refcount = 1).
 324  *
 325  * @param name                          name of the child_cfg
 326  * @param lifetime                      lifetime_cfg_t for this child_cfg
 327  * @param updown                        updown script to execute on up/down event
 328  * @param hostaccess            TRUE to allow access to the local host
 329  * @param mode                          mode to propose for CHILD_SA, transport, tunnel or BEET
 330  * @param dpd_action            DPD action
 331  * @param close_action          close action
 332  * @param ipcomp                        use IPComp, if peer supports it
 333  * @return                                      child_cfg_t object
 334  */
 335 child_cfg_t *child_cfg_create(char *name, lifetime_cfg_t *lifetime,
 336                                                           char *updown, bool hostaccess,
 337                                                           ipsec_mode_t mode, action_t dpd_action,
 338                                                           action_t close_action, bool ipcomp);
 339
 340 #endif /** CHILD_CFG_H_ @}*/