src/charon/config/connections/connection.h

   1 /**
   2  * @file connection.h
   3  *
   4  * @brief Interface of connection_t.
   5  *
   6  */
   7
   8 /*
   9  * Copyright (C) 2005 Jan Hutter, Martin Willi
  10  * Hochschule fuer Technik Rapperswil
  11  *
  12  * This program is free software; you can redistribute it and/or modify it
  13  * under the terms of the GNU General Public License as published by the
  14  * Free Software Foundation; either version 2 of the License, or (at your
  15  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  16  *
  17  * This program is distributed in the hope that it will be useful, but
  18  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  19  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  20  * for more details.
  21  */
  22
  23 #ifndef CONNECTION_H_
  24 #define CONNECTION_H_
  25
  26 #include <types.h>
  27 #include <utils/host.h>
  28 #include <utils/linked_list.h>
  29 #include <utils/identification.h>
  30 #include <config/proposal.h>
  31 #include <crypto/diffie_hellman.h>
  32
  33
  34 typedef enum auth_method_t auth_method_t;
  35
  36 /**
  37  * AUTH Method to use.
  38  *
  39  * @ingroup config
  40  */
  41 enum auth_method_t {
  42         /**
  43          * Computed as specified in section 2.15 of RFC using
  44          * an RSA private key over a PKCS#1 padded hash.
  45          */
  46         RSA_DIGITAL_SIGNATURE = 1,
  47
  48         /**
  49          * Computed as specified in section 2.15 of RFC using the
  50          * shared key associated with the identity in the ID payload
  51          * and the negotiated prf function
  52          */
  53         SHARED_KEY_MESSAGE_INTEGRITY_CODE = 2,
  54
  55         /**
  56          * Computed as specified in section 2.15 of RFC using a
  57          * DSS private key over a SHA-1 hash.
  58          */
  59         DSS_DIGITAL_SIGNATURE = 3,
  60 };
  61
  62 /**
  63  * string mappings for auth method.
  64  *
  65  * @ingroup config
  66  */
  67 extern mapping_t auth_method_m[];
  68
  69
  70 typedef enum cert_policy_t cert_policy_t;
  71
  72 /**
  73  * Certificate sending policy. This is also used for certificate
  74  * requests when using this definition for the other peer. If
  75  * it is CERT_NEVER_SEND, a certreq is ommited, otherwise its
  76  * included.
  77  *
  78  * @ingroup config
  79  *
  80  * @warning These definitions must be the same as in pluto/starter,
  81  * as they are sent over the stroke socket.
  82  */
  83 enum cert_policy_t {
  84         /** always send certificates, even when not requested */
  85         CERT_ALWAYS_SEND   = 0,
  86         /** send certificate upon cert request */
  87         CERT_SEND_IF_ASKED = 1,
  88         /** never send a certificate, even when requested */
  89         CERT_NEVER_SEND    = 2,
  90 };
  91
  92 /**
  93  * string mappings for certpolicy_t.
  94  *
  95  * @ingroup config
  96  */
  97 extern mapping_t cert_policy_m[];
  98
  99
 100 typedef struct connection_t connection_t;
 101
 102 /**
 103  * @brief A connection_t defines the rules to set up an IKE_SA.
 104  *
 105  *
 106  * @b Constructors:
 107  *  - connection_create()
 108  *
 109  * @ingroup config
 110  */
 111 struct connection_t {
 112
 113         /**
 114          * @brief Get my address as host_t object.
 115          *
 116          * Object is NOT getting cloned.
 117          *
 118          * @param this  calling object
 119          * @return              host information as host_t object
 120          */
 121         host_t *(*get_my_host) (connection_t *this);
 122
 123         /**
 124          * @brief Get others address as host_t object.
 125          *
 126          * Object is NOT getting cloned.
 127          *
 128          * @param this  calling object
 129          * @return              host information as host_t object
 130          */
 131         host_t *(*get_other_host) (connection_t *this);
 132
 133         /**
 134          * @brief Update address of my host.
 135          *
 136          * It may be necessary to uptdate own address, as it
 137          * is set to the default route (0.0.0.0) in some cases.
 138          * Old host is destroyed, new one NOT cloned.
 139          *
 140          * @param this          calling object
 141          * @param my_host       new host to set as my_host
 142          */
 143         void (*update_my_host) (connection_t *this, host_t *my_host);
 144
 145         /**
 146          * @brief Update address of remote host.
 147          *
 148          * It may be necessary to uptdate remote address, as a
 149          * connection may define %any (0.0.0.0) or a subnet.
 150          * Old host is destroyed, new one NOT cloned.
 151          *
 152          * @param this          calling object
 153          * @param my_host       new host to set as other_host
 154          */
 155         void (*update_other_host) (connection_t *this, host_t *other_host);
 156
 157         /**
 158          * @brief Returns a list of all supported proposals.
 159          *
 160          * Returned list is still owned by connection and MUST NOT
 161          * modified or destroyed.
 162          *
 163          * @param this          calling object
 164          * @return                      list containing all the proposals
 165          */
 166         linked_list_t *(*get_proposals) (connection_t *this);
 167
 168         /**
 169          * @brief Adds a proposal to the list.
 170          *
 171          * The first added proposal has the highest priority, the last
 172          * added the lowest.
 173          *
 174          * @param this          calling object
 175          * @param proposal      proposal to add
 176          */
 177         void (*add_proposal) (connection_t *this, proposal_t *proposal);
 178
 179         /**
 180          * @brief Select a proposed from suggested proposals.
 181          *
 182          * Returned proposal must be destroyed after usage.
 183          *
 184          * @param this          calling object
 185          * @param proposals     list of proposals to select from
 186          * @return                      selected proposal, or NULL if none matches.
 187          */
 188         proposal_t *(*select_proposal) (connection_t *this, linked_list_t *proposals);
 189
 190         /**
 191          * @brief Get the authentication method to use
 192          *
 193          * @param this          calling object
 194          * @return                      authentication method
 195          */
 196         auth_method_t (*get_auth_method) (connection_t *this);
 197
 198         /**
 199          * @brief Get the connection name.
 200          *
 201          * Name must not be freed, since it points to
 202          * internal data.
 203          *
 204          * @param this          calling object
 205          * @return                      name of the connection
 206          */
 207         char* (*get_name) (connection_t *this);
 208
 209         /**
 210          * @brief Check if the connection is marked as an IKEv2 connection.
 211          *
 212          * Since all connections (IKEv1+2) are loaded, but charon handles
 213          * only those marked with IKEv2, this flag can tell us if we must
 214          * ignore a connection on initiaton. Then pluto will do it for us.
 215          *
 216          * @param this          calling object
 217          * @return                      - TRUE, if this is an IKEv2 connection
 218          */
 219         bool (*is_ikev2) (connection_t *this);
 220
 221         /**
 222          * @brief Should be sent a certificate request for this connection?
 223          *
 224          * A certificate request contains serials of our trusted CA certificates.
 225          * This flag says if such a request is sent on connection setup to
 226          * the peer. It should be ommited when CERT_SEND_NEVER, sended otherwise.
 227          *
 228          * @param this          calling object
 229          * @return                      - TRUE, if certificate request should be sent
 230          */
 231         cert_policy_t (*get_cert_req_policy) (connection_t *this);
 232
 233         /**
 234          * @brief Should be sent a certificate for this connection?
 235          *
 236          * Return the policy used to send the certificate.
 237          *
 238          * @param this          calling object
 239          * @return                      certificate sending policy
 240          */
 241         cert_policy_t (*get_cert_policy) (connection_t *this);
 242
 243         /**
 244          * @brief Get the DH group to use for connection initialization.
 245          *
 246          * @param this          calling object
 247          * @return                      dh group to use for initialization
 248          */
 249         diffie_hellman_group_t (*get_dh_group) (connection_t *this);
 250
 251         /**
 252          * @brief Check if a suggested dh group is acceptable.
 253          *
 254          * If we guess a wrong DH group for IKE_SA_INIT, the other
 255          * peer will send us a offer. But is this acceptable for us?
 256          *
 257          * @param this          calling object
 258          * @return                      TRUE if group acceptable
 259          */
 260         bool (*check_dh_group) (connection_t *this, diffie_hellman_group_t dh_group);
 261
 262         /**
 263          * @brief Clone a connection_t object.
 264          *
 265          * @param this          connection to clone
 266          * @return                      clone of it
 267          */
 268         connection_t *(*clone) (connection_t *this);
 269
 270         /**
 271          * @brief Destroys a connection_t object.
 272          *
 273          * @param this          calling object
 274          */
 275         void (*destroy) (connection_t *this);
 276 };
 277
 278 /**
 279  * @brief Creates a connection_t object.
 280  *
 281  * Supplied hosts become owned by connection, so
 282  * do not modify or destroy them after a call to
 283  * connection_create(). Name gets cloned internally.
 284  *
 285  * @param name                          connection identifier
 286  * @param ikev2                         TRUE if this is an IKEv2 connection
 287  * @param cert_policy           certificate send policy
 288  * @param cert_req_policy       certificate request send policy
 289  * @param my_host                       host_t representing local address
 290  * @param other_host            host_t representing remote address
 291  * @param auth_method           Authentication method to use for our(!) auth data
 292  * @return                                      connection_t object.
 293  *
 294  * @ingroup config
 295  */
 296 connection_t * connection_create(char *name, bool ikev2,
 297                                                                  cert_policy_t cert_pol, cert_policy_t req_pol,
 298                                                                  host_t *my_host, host_t *other_host,
 299                                                                  auth_method_t auth_method);
 300
 301 #endif /* CONNECTION_H_ */