1 /* information about connections between hosts and clients
2 * Copyright (C) 1998-2001 D. Hugh Redelmeier
4 * This program is free software; you can redistribute it and/or modify it
5 * under the terms of the GNU General Public License as published by the
6 * Free Software Foundation; either version 2 of the License, or (at your
7 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 * This program is distributed in the hope that it will be useful, but
10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
11 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
17 #ifndef _CONNECTIONS_H
18 #define _CONNECTIONS_H
20 #include <sys/queue.h>
25 #include "smartcard.h"
28 /* There are two kinds of connections:
29 * - ISAKMP connections, between hosts (for IKE communication)
30 * - IPsec connections, between clients (for secure IP communication)
32 * An ISAKMP connection looks like:
35 * An IPsec connection looks like:
36 * client-subnet<-->host<->nexthop<--->nexthop<->host<-->client-subnet
38 * For the connection to be relevant to this instance of Pluto,
39 * exactly one of the hosts must be a public interface of our machine
40 * known to this instance.
42 * The client subnet might simply be the host -- this is a
43 * representation of "host mode".
45 * Each nexthop defaults to the neighbouring host's IP address.
46 * The nexthop is a property of the pair of hosts, not each
47 * individually. It is only needed for IPsec because of the
48 * way IPsec is mixed into the kernel routing logic. Furthermore,
49 * only this end's nexthop is actually used. Eventually, nexthop
50 * will be unnecessary.
52 * Other information represented:
53 * - each connection has a name: a chunk of uninterpreted text
54 * that is unique for each connection.
55 * - security requirements (currently just the "policy" flags from
56 * the whack command to initiate the connection, but eventually
57 * much more. Different for ISAKMP and IPsec connections.
58 * - rekeying parameters:
59 * + time an SA may live
60 * + time before SA death that a rekeying should be attempted
61 * (only by the initiator)
62 * + number of times to attempt rekeying
63 * - With the current KLIPS, we must route packets for a client
64 * subnet through the ipsec interface (ipsec0). Only one
65 * gateway can get traffic for a specific (client) subnet.
66 * Furthermore, if the routing isn't in place, packets will
67 * be sent in the clear.
68 * "routing" indicates whether the routing has been done for
69 * this connection. Note that several connections may claim
70 * the same routing, as long as they agree about where the
71 * packets are to be sent.
72 * - With the current KLIPS, only one outbound IPsec SA bundle can be
73 * used for a particular client. This is due to a limitation
74 * of using only routing for selection. So only one IPsec state (SA)
75 * may "own" the eroute. "eroute_owner" is the serial number of
76 * this state, SOS_NOBODY if there is none. "routing" indicates
77 * what kind of erouting has been done for this connection, if any.
79 * Details on routing is in constants.h
81 * Operations on Connections:
83 * - add a new connection (with all details) [whack command]
84 * - delete a connection (by name) [whack command]
85 * - initiate a connection (by name) [whack command]
86 * - find a connection (by IP addresses of hosts)
87 * [response to peer request; finding ISAKMP connection for IPsec connection]
89 * Some connections are templates, missing the address of the peer
90 * (represented by INADDR_ANY). These are always arranged so that the
91 * missing end is "that" (there can only be one missing end). These can
92 * be instantiated (turned into real connections) by Pluto in one of two
93 * different ways: Road Warrior Instantiation or Opportunistic
94 * Instantiation. A template connection is marked for Opportunistic
95 * Instantiation by specifying the peer client as 0.0.0.0/32 (or the IPV6
96 * equivalent). Otherwise, it is suitable for Road Warrior Instantiation.
98 * Instantiation creates a new temporary connection, with the missing
99 * details filled in. The resulting template lasts only as long as there
100 * is a state that uses it.
103 /* connection policy priority: how important this policy is
104 * - used to implement eroute-like precedence (augmented by a small
105 * bonus for a routed connection).
107 * - larger is more important
108 * - three subcomponents. In order of decreasing significance:
109 * + length of source subnet mask (8 bits)
110 * + length of destination subnet mask (8 bits)
112 * - a bias of 1 is added to allow prio BOTTOM_PRIO to be less than all
114 * - other bias values are created on the fly to give mild preference
115 * to certaion conditions (eg. routedness)
116 * - priority is inherited -- an instance of a policy has the same priority
117 * as the original policy, even though its subnets might be smaller.
118 * - display format: n,m
120 typedef unsigned long policy_prio_t
;
121 #define BOTTOM_PRIO ((policy_prio_t)0) /* smaller than any real prio */
122 #define set_policy_prio(c) { (c)->prio = \
123 ((policy_prio_t)(c)->spd.this.client.maskbits << 16) \
124 | ((policy_prio_t)(c)->spd.that.client.maskbits << 8) \
125 | (policy_prio_t)1; }
126 #define POLICY_PRIO_BUF (3+1+3+1)
127 extern void fmt_policy_prio(policy_prio_t pp
, char buf
[POLICY_PRIO_BUF
]);
139 bool key_from_DNS_on_demand
;
141 bool has_client_wildcard
;
142 bool has_port_wildcard
;
143 bool has_id_wildcards
;
146 u_int16_t host_port
; /* host order */
147 u_int16_t port
; /* host order */
149 cert_t cert
; /* end certificate */
150 chunk_t ca
; /* CA distinguished name */
151 struct ietfAttrList
*groups
;/* access control groups */
152 smartcard_t
*sc
; /* smartcard reader and key info */
153 struct virtual_t
*virt
;
154 bool modecfg
; /* this end: request local address from server */
155 /* that end: give local addresses to clients */
156 bool hostaccess
; /* allow access to host via iptables INPUT/OUTPUT */
157 /* rules if client behind host is a subnet */
158 bool allow_any
; /* IP address is subject to change */
159 certpolicy_t sendcert
; /* whether or not to send the certificate */
163 struct spd_route
*next
;
166 so_serial_t eroute_owner
;
167 enum routing_t routing
; /* level of routing in place */
176 time_t sa_ike_life_seconds
;
177 time_t sa_ipsec_life_seconds
;
178 time_t sa_rekey_margin
;
179 unsigned long sa_rekey_fuzz
;
180 unsigned long sa_keying_tries
;
185 dpd_action_t dpd_action
;
187 char *log_file_name
; /* name of log file */
188 FILE *log_file
; /* possibly open FILE */
189 TAILQ_ENTRY(connection
) log_link
; /* linked list of open conns */
190 bool log_file_err
; /* only bitch once */
192 struct spd_route spd
;
194 /* internal fields: */
196 unsigned long instance_serial
;
198 bool instance_initiation_ok
; /* this is an instance of a policy that mandates initiate */
199 enum connection_kind kind
;
200 const struct iface
*interface
; /* filled in iff oriented */
202 so_serial_t
/* state object serial number */
208 lset_t extra_debugging
;
211 /* note: if the client is the gateway, the following must be equal */
212 sa_family_t addr_family
; /* between gateways */
213 sa_family_t tunnel_addr_family
; /* between clients */
215 struct connection
*policy_next
; /* if multiple policies,
218 struct gw_info
*gw_info
;
219 struct alg_info_esp
*alg_info_esp
;
220 struct alg_info_ike
*alg_info_ike
;
222 struct host_pair
*host_pair
;
223 struct connection
*hp_next
; /* host pair list link */
225 struct connection
*ac_next
; /* all connections list link */
227 generalName_t
*requested_ca
; /* collected certificate requests */
228 bool got_certrequest
;
231 #define oriented(c) ((c).interface != NULL)
232 extern bool orient(struct connection
*c
);
234 extern bool same_peer_ids(const struct connection
*c
235 , const struct connection
*d
, const struct id
*his_id
);
237 /* Format the topology of a connection end, leaving out defaults.
238 * Largest left end looks like: client === host : port [ host_id ] --- hop
239 * Note: if that==NULL, skip nexthop
241 #define END_BUF (SUBNETTOT_BUF + ADDRTOT_BUF + IDTOA_BUF + ADDRTOT_BUF + 10)
242 extern size_t format_end(char *buf
, size_t buf_len
243 , const struct end
*this, const struct end
*that
244 , bool is_left
, lset_t policy
);
246 extern void add_connection(const whack_message_t
*wm
);
247 extern void initiate_connection(const char *name
, int whackfd
);
248 extern void initiate_opportunistic(const ip_address
*our_client
249 , const ip_address
*peer_client
, int transport_proto
, bool held
, int whackfd
);
250 extern void terminate_connection(const char *nm
);
251 extern void release_connection(struct connection
*c
, bool relations
);
252 extern void delete_connection(struct connection
*c
, bool relations
);
253 extern void delete_connections_by_name(const char *name
, bool strict
);
254 extern void delete_every_connection(void);
255 extern char *add_group_instance(struct connection
*group
, const ip_subnet
*target
);
256 extern void remove_group_instance(const struct connection
*group
, const char *name
);
257 extern void release_dead_interfaces(void);
258 extern void check_orientations(void);
259 extern struct connection
*route_owner(struct connection
*c
260 , struct spd_route
**srp
261 , struct connection
**erop
262 , struct spd_route
**esrp
);
263 extern struct connection
*shunt_owner(const ip_subnet
*ours
264 , const ip_subnet
*his
);
266 extern bool uniqueIDs
; /* --uniqueids? */
267 extern void ISAKMP_SA_established(struct connection
*c
, so_serial_t serial
);
269 #define his_id_was_instantiated(c) ((c)->kind == CK_INSTANCE \
270 && (id_is_ipaddr(&(c)->spd.that.id)? \
271 sameaddr(&(c)->spd.that.id.ip_addr, &(c)->spd.that.host_addr) : TRUE))
273 struct state
; /* forward declaration of tag (defined in state.h) */
274 extern struct connection
275 *con_by_name(const char *nm
, bool strict
),
276 *find_host_connection(const ip_address
*me
, u_int16_t my_port
277 , const ip_address
*him
, u_int16_t his_port
, lset_t policy
),
278 *refine_host_connection(const struct state
*st
, const struct id
*id
280 *find_client_connection(struct connection
*c
281 , const ip_subnet
*our_net
282 , const ip_subnet
*peer_net
283 , const u_int8_t our_protocol
284 , const u_int16_t out_port
285 , const u_int8_t peer_protocol
286 , const u_int16_t peer_port
),
287 *find_connection_by_reqid(uint32_t reqid
);
289 extern struct connection
*
290 find_connection_for_clients(struct spd_route
**srp
291 , const ip_address
*our_client
292 , const ip_address
*peer_client
293 , int transport_proto
);
295 extern chunk_t
get_peer_ca_and_groups(struct connection
*c
296 , const ietfAttrList_t
**peer_list
);
298 /* instantiating routines
299 * Note: connection_discard() is in state.h because all its work
300 * is looking through state objects.
302 struct gw_info
; /* forward declaration of tag (defined in dnskey.h) */
303 struct alg_info
; /* forward declaration of tag (defined in alg_info.h) */
304 extern struct connection
*rw_instantiate(struct connection
*c
305 , const ip_address
*him
307 , const ip_subnet
*his_net
308 , const struct id
*his_id
);
310 extern struct connection
*oppo_instantiate(struct connection
*c
311 , const ip_address
*him
312 , const struct id
*his_id
314 , const ip_address
*our_client
315 , const ip_address
*peer_client
);
317 extern struct connection
318 *build_outgoing_opportunistic_connection(struct gw_info
*gw
319 , const ip_address
*our_client
320 , const ip_address
*peer_client
);
322 /* worst case: "[" serial "] " myclient "=== ..." peer "===" hisclient '\0' */
323 #define CONN_INST_BUF \
324 (2 + 10 + 1 + SUBNETTOT_BUF + 7 + ADDRTOT_BUF + 3 + SUBNETTOT_BUF + 1)
326 extern void fmt_conn_instance(const struct connection
*c
327 , char buf
[CONN_INST_BUF
]);
329 /* operations on "pending", the structure representing Quick Mode
330 * negotiations delayed until a Keying Channel has been negotiated.
333 struct pending
; /* forward declaration (opaque outside connections.c) */
335 extern void add_pending(int whack_sock
336 , struct state
*isakmp_sa
337 , struct connection
*c
340 , so_serial_t replacing
);
342 extern void release_pending_whacks(struct state
*st
, err_t story
);
343 extern void unpend(struct state
*st
);
344 extern void update_pending(struct state
*os
, struct state
*ns
);
345 extern void flush_pending_by_state(struct state
*st
);
346 extern void show_pending_phase2(const struct host_pair
*hp
, const struct state
*st
);
348 extern void connection_discard(struct connection
*c
);
350 /* A template connection's eroute can be eclipsed by
351 * either a %hold or an eroute for an instance iff
352 * the template is a /32 -> /32. This requires some special casing.
354 #define eclipsable(sr) (subnetishost(&(sr)->this.client) && subnetishost(&(sr)->that.client))
355 extern long eclipse_count
;
356 extern struct connection
*eclipsed(struct connection
*c
, struct spd_route
**);
359 /* print connection status */
361 extern void show_connections_status(bool all
, const char *name
);
362 extern int connection_compare(const struct connection
*ca
363 , const struct connection
*cb
);
364 extern void update_host_pair(const char *why
, struct connection
*c
365 , const ip_address
*myaddr
, u_int16_t myport
366 , const ip_address
*hisaddr
, u_int16_t hisport
);
368 #endif /* _CONNECTIONS_H */