5235746325be268d3b79dd397ad79faedd107123
[strongswan.git] / src / charon / config / connections / connection.h
1 /**
2 * @file connection.h
3 *
4 * @brief Interface of connection_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005 Jan Hutter, Martin Willi
10 * Hochschule fuer Technik Rapperswil
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * for more details.
21 */
22
23 #ifndef CONNECTION_H_
24 #define CONNECTION_H_
25
26 #include <types.h>
27 #include <utils/host.h>
28 #include <utils/linked_list.h>
29 #include <utils/identification.h>
30 #include <config/proposal.h>
31 #include <crypto/diffie_hellman.h>
32
33
34 typedef enum auth_method_t auth_method_t;
35
36 /**
37 * AUTH Method to use.
38 *
39 * @ingroup config
40 */
41 enum auth_method_t {
42 /**
43 * Computed as specified in section 2.15 of RFC using
44 * an RSA private key over a PKCS#1 padded hash.
45 */
46 RSA_DIGITAL_SIGNATURE = 1,
47
48 /**
49 * Computed as specified in section 2.15 of RFC using the
50 * shared key associated with the identity in the ID payload
51 * and the negotiated prf function
52 */
53 SHARED_KEY_MESSAGE_INTEGRITY_CODE = 2,
54
55 /**
56 * Computed as specified in section 2.15 of RFC using a
57 * DSS private key over a SHA-1 hash.
58 */
59 DSS_DIGITAL_SIGNATURE = 3,
60 };
61
62 /**
63 * string mappings for auth method.
64 *
65 * @ingroup config
66 */
67 extern mapping_t auth_method_m[];
68
69
70 typedef struct connection_t connection_t;
71
72 /**
73 * @brief A connection_t defines the rules to set up an IKE_SA.
74 *
75 *
76 * @b Constructors:
77 * - connection_create()
78 *
79 * @ingroup config
80 */
81 struct connection_t {
82
83 /**
84 * @brief Get my address as host_t object.
85 *
86 * Object is NOT getting cloned.
87 *
88 * @param this calling object
89 * @return host information as host_t object
90 */
91 host_t *(*get_my_host) (connection_t *this);
92
93 /**
94 * @brief Get others address as host_t object.
95 *
96 * Object is NOT getting cloned.
97 *
98 * @param this calling object
99 * @return host information as host_t object
100 */
101 host_t *(*get_other_host) (connection_t *this);
102
103 /**
104 * @brief Update address of my host.
105 *
106 * It may be necessary to uptdate own address, as it
107 * is set to the default route (0.0.0.0) in some cases.
108 * Old host is destroyed, new one NOT cloned.
109 *
110 * @param this calling object
111 * @param my_host new host to set as my_host
112 */
113 void (*update_my_host) (connection_t *this, host_t *my_host);
114
115 /**
116 * @brief Update address of remote host.
117 *
118 * It may be necessary to uptdate remote address, as a
119 * connection may define %any (0.0.0.0) or a subnet.
120 * Old host is destroyed, new one NOT cloned.
121 *
122 * @param this calling object
123 * @param my_host new host to set as other_host
124 */
125 void (*update_other_host) (connection_t *this, host_t *other_host);
126
127 /**
128 * @brief Returns a list of all supported proposals.
129 *
130 * Returned list is still owned by connection and MUST NOT
131 * modified or destroyed.
132 *
133 * @param this calling object
134 * @return list containing all the proposals
135 */
136 linked_list_t *(*get_proposals) (connection_t *this);
137
138 /**
139 * @brief Adds a proposal to the list.
140 *
141 * The first added proposal has the highest priority, the last
142 * added the lowest.
143 *
144 * @param this calling object
145 * @param proposal proposal to add
146 */
147 void (*add_proposal) (connection_t *this, proposal_t *proposal);
148
149 /**
150 * @brief Select a proposed from suggested proposals.
151 *
152 * Returned proposal must be destroyed after usage.
153 *
154 * @param this calling object
155 * @param proposals list of proposals to select from
156 * @return selected proposal, or NULL if none matches.
157 */
158 proposal_t *(*select_proposal) (connection_t *this, linked_list_t *proposals);
159
160 /**
161 * @brief Get the authentication method to use
162 *
163 * @param this calling object
164 * @return authentication method
165 */
166 auth_method_t (*get_auth_method) (connection_t *this);
167
168 /**
169 * @brief Get the connection name.
170 *
171 * Name must not be freed, since it points to
172 * internal data.
173 *
174 * @param this calling object
175 * @return name of the connection
176 */
177 char* (*get_name) (connection_t *this);
178
179 /**
180 * @brief Check if the connection is marked as an IKEv2 connection.
181 *
182 * Since all connections (IKEv1+2) are loaded, but charon handles
183 * only those marked with IKEv2, this flag can tell us if we must
184 * ignore a connection on initiaton. Then pluto will do it for us.
185 *
186 * @param this calling object
187 * @return - TRUE, if this is an IKEv2 connection
188 */
189 bool (*is_ikev2) (connection_t *this);
190
191 /**
192 * @brief Get the DH group to use for connection initialization.
193 *
194 * @param this calling object
195 * @return dh group to use for initialization
196 */
197 diffie_hellman_group_t (*get_dh_group) (connection_t *this);
198
199 /**
200 * @brief Check if a suggested dh group is acceptable.
201 *
202 * If we guess a wrong DH group for IKE_SA_INIT, the other
203 * peer will send us a offer. But is this acceptable for us?
204 *
205 * @param this calling object
206 * @return TRUE if group acceptable
207 */
208 bool (*check_dh_group) (connection_t *this, diffie_hellman_group_t dh_group);
209
210 /**
211 * @brief Clone a connection_t object.
212 *
213 * @param this connection to clone
214 * @return clone of it
215 */
216 connection_t *(*clone) (connection_t *this);
217
218 /**
219 * @brief Destroys a connection_t object.
220 *
221 * @param this calling object
222 */
223 void (*destroy) (connection_t *this);
224 };
225
226 /**
227 * @brief Creates a connection_t object.
228 *
229 * Supplied hosts become owned by connection, so
230 * do not modify or destroy them after a call to
231 * connection_create(). Name gets cloned internally.
232 *
233 * @param name connection identifier
234 * @param ikev2 TRUE if this is an IKEv2 connection
235 * @param my_host host_t representing local address
236 * @param other_host host_t representing remote address
237 * @param auth_method Authentication method to use for our(!) auth data
238 * @return connection_t object.
239 *
240 * @ingroup config
241 */
242 connection_t * connection_create(char *name,
243 bool ikev2,
244 host_t *my_host, host_t *other_host,
245 auth_method_t auth_method);
246
247 #endif /* CONNECTION_H_ */