Moved host_t and host_resolver_t to a new networking subfolder
[strongswan.git] / src / libcharon / config / ike_cfg.h
1 /*
2 * Copyright (C) 2005-2007 Martin Willi
3 * Copyright (C) 2005 Jan Hutter
4 * Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 /**
18 * @defgroup ike_cfg ike_cfg
19 * @{ @ingroup config
20 */
21
22 #ifndef IKE_CFG_H_
23 #define IKE_CFG_H_
24
25 typedef enum ike_version_t ike_version_t;
26 typedef struct ike_cfg_t ike_cfg_t;
27
28 #include <library.h>
29 #include <networking/host.h>
30 #include <utils/linked_list.h>
31 #include <utils/identification.h>
32 #include <config/proposal.h>
33 #include <crypto/diffie_hellman.h>
34
35 /**
36 * IKE version.
37 */
38 enum ike_version_t {
39 /** any version */
40 IKE_ANY = 0,
41 /** IKE version 1 */
42 IKEV1 = 1,
43 /** IKE version 2 */
44 IKEV2 = 2,
45 };
46
47 /**
48 * enum strings fro ike_version_t
49 */
50 extern enum_name_t *ike_version_names;
51
52 /**
53 * An ike_cfg_t defines the rules to set up an IKE_SA.
54 *
55 * @see peer_cfg_t to get an overview over the configurations.
56 */
57 struct ike_cfg_t {
58
59 /**
60 * Get the IKE version to use with this configuration.
61 *
62 * @return IKE major version
63 */
64 ike_version_t (*get_version)(ike_cfg_t *this);
65
66 /**
67 * Get own address.
68 *
69 * @param allow_any allow any address to match
70 * @return string of address/DNS name
71 */
72 char* (*get_my_addr) (ike_cfg_t *this, bool *allow_any);
73
74 /**
75 * Get peer's address.
76 *
77 * @param allow_any allow any address to match
78 * @return string of address/DNS name
79 */
80 char* (*get_other_addr) (ike_cfg_t *this, bool *allow_any);
81
82 /**
83 * Get the port to use as our source port.
84 *
85 * @return source address port, host order
86 */
87 u_int16_t (*get_my_port)(ike_cfg_t *this);
88
89 /**
90 * Get the port to use as destination port.
91 *
92 * @return destination address, host order
93 */
94 u_int16_t (*get_other_port)(ike_cfg_t *this);
95
96 /**
97 * Adds a proposal to the list.
98 *
99 * The first added proposal has the highest priority, the last
100 * added the lowest.
101 *
102 * @param proposal proposal to add
103 */
104 void (*add_proposal) (ike_cfg_t *this, proposal_t *proposal);
105
106 /**
107 * Returns a list of all supported proposals.
108 *
109 * Returned list and its proposals must be destroyed after use.
110 *
111 * @return list containing all the proposals
112 */
113 linked_list_t* (*get_proposals) (ike_cfg_t *this);
114
115 /**
116 * Select a proposed from suggested proposals.
117 *
118 * Returned proposal must be destroyed after use.
119 *
120 * @param proposals list of proposals to select from
121 * @param private accept algorithms from a private range
122 * @return selected proposal, or NULL if none matches.
123 */
124 proposal_t *(*select_proposal) (ike_cfg_t *this, linked_list_t *proposals,
125 bool private);
126
127 /**
128 * Should we send a certificate request in IKE_SA_INIT?
129 *
130 * @return certificate request sending policy
131 */
132 bool (*send_certreq) (ike_cfg_t *this);
133
134 /**
135 * Enforce UDP encapsulation by faking NATD notifies?
136 *
137 * @return TRUE to enfoce UDP encapsulation
138 */
139 bool (*force_encap) (ike_cfg_t *this);
140
141 /**
142 * Get the DH group to use for IKE_SA setup.
143 *
144 * @return dh group to use for initialization
145 */
146 diffie_hellman_group_t (*get_dh_group)(ike_cfg_t *this);
147
148 /**
149 * Check if two IKE configs are equal.
150 *
151 * @param other other to check for equality
152 * @return TRUE if other equal to this
153 */
154 bool (*equals)(ike_cfg_t *this, ike_cfg_t *other);
155
156 /**
157 * Increase reference count.
158 *
159 * @return reference to this
160 */
161 ike_cfg_t* (*get_ref) (ike_cfg_t *this);
162
163 /**
164 * Destroys a ike_cfg_t object.
165 *
166 * Decrements the internal reference counter and
167 * destroys the ike_cfg when it reaches zero.
168 */
169 void (*destroy) (ike_cfg_t *this);
170 };
171
172 /**
173 * Creates a ike_cfg_t object.
174 *
175 * Supplied hosts become owned by ike_cfg, the name gets cloned.
176 *
177 * @param version IKE major version to use for this config
178 * @param certreq TRUE to send a certificate request
179 * @param force_encap enforce UDP encapsulation by faking NATD notify
180 * @param me address/DNS name of local peer
181 * @param my_allow_any allow override of local address by any address
182 * @param my_port IKE port to use as source, 500 uses IKEv2 port floating
183 * @param other address/DNS name of remote peer
184 * @param other_allow_any allow override of remote address by any address
185 * @param other_port IKE port to use as dest, 500 uses IKEv2 port floating
186 * @return ike_cfg_t object.
187 */
188 ike_cfg_t *ike_cfg_create(ike_version_t version, bool certreq, bool force_encap,
189 char *me, bool my_allow_any, u_int16_t my_port,
190 char *other, bool other_allow_any, u_int16_t other_port);
191
192 #endif /** IKE_CFG_H_ @}*/