pki: Add pki --signcrl man page
[strongswan.git] / src / starter / confread.h
1 /* strongSwan IPsec config file parser
2 * Copyright (C) 2001-2002 Mathieu Lafon
3 * Arkoon Network Security
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #ifndef _IPSEC_CONFREAD_H_
17 #define _IPSEC_CONFREAD_H_
18
19 #include <kernel/kernel_ipsec.h>
20
21 #include "ipsec-parser.h"
22
23 /** to mark seen keywords */
24 typedef u_int64_t seen_t;
25 #define SEEN_NONE 0;
26 #define SEEN_KW(kw, base) ((seen_t)1 << ((kw) - (base)))
27
28 typedef enum {
29 STARTUP_NO,
30 STARTUP_ADD,
31 STARTUP_ROUTE,
32 STARTUP_START
33 } startup_t;
34
35 typedef enum {
36 STATE_IGNORE,
37 STATE_TO_ADD,
38 STATE_ADDED,
39 STATE_REPLACED,
40 STATE_INVALID
41 } starter_state_t;
42
43 typedef enum {
44 /* shared with ike_version_t */
45 KEY_EXCHANGE_IKE = 0,
46 KEY_EXCHANGE_IKEV1 = 1,
47 KEY_EXCHANGE_IKEV2 = 2,
48 } keyexchange_t;
49
50 typedef enum {
51 STRICT_NO,
52 STRICT_YES,
53 STRICT_IFURI,
54 } strict_t;
55
56 typedef enum {
57 CERT_ALWAYS_SEND,
58 CERT_SEND_IF_ASKED,
59 CERT_NEVER_SEND,
60 CERT_YES_SEND, /* synonym for CERT_ALWAYS_SEND */
61 CERT_NO_SEND, /* synonym for CERT_NEVER_SEND */
62 } certpolicy_t;
63
64 typedef enum {
65 DPD_ACTION_NONE,
66 DPD_ACTION_CLEAR,
67 DPD_ACTION_HOLD,
68 DPD_ACTION_RESTART,
69 DPD_ACTION_UNKNOW,
70 } dpd_action_t;
71
72 typedef enum {
73 /* same as in ike_cfg.h */
74 FRAGMENTATION_NO,
75 FRAGMENTATION_YES,
76 FRAGMENTATION_FORCE,
77 } fragmentation_t;
78
79 typedef enum {
80 /* IPsec options */
81 SA_OPTION_AUTHENTICATE = 1 << 0, /* use AH instead of ESP? */
82 SA_OPTION_COMPRESS = 1 << 1, /* use IPComp */
83
84 /* IKE and other other options */
85 SA_OPTION_DONT_REKEY = 1 << 2, /* don't rekey state either Phase */
86 SA_OPTION_DONT_REAUTH = 1 << 3, /* don't reauthenticate on rekeying, IKEv2 only */
87 SA_OPTION_MODECFG_PUSH = 1 << 4, /* is modecfg pushed by server? */
88 SA_OPTION_XAUTH_SERVER = 1 << 5, /* are we an XAUTH server? */
89 SA_OPTION_MOBIKE = 1 << 6, /* enable MOBIKE for IKEv2 */
90 SA_OPTION_FORCE_ENCAP = 1 << 7, /* force UDP encapsulation */
91 } sa_option_t;
92
93 typedef struct starter_end starter_end_t;
94
95 struct starter_end {
96 seen_t seen;
97 char *auth;
98 char *auth2;
99 char *id;
100 char *id2;
101 char *rsakey;
102 char *cert;
103 char *cert2;
104 char *ca;
105 char *ca2;
106 char *groups;
107 char *groups2;
108 char *cert_policy;
109 char *host;
110 u_int ikeport;
111 char *subnet;
112 bool modecfg;
113 certpolicy_t sendcert;
114 bool firewall;
115 bool hostaccess;
116 bool allow_any;
117 char *updown;
118 u_int16_t from_port;
119 u_int16_t to_port;
120 u_int8_t protocol;
121 char *sourceip;
122 char *dns;
123 };
124
125 typedef struct also also_t;
126
127 struct also {
128 char *name;
129 bool included;
130 also_t *next;
131 };
132
133 typedef struct starter_conn starter_conn_t;
134
135 struct starter_conn {
136 seen_t seen;
137 char *name;
138 also_t *also;
139 kw_list_t *kw;
140 u_int visit;
141 startup_t startup;
142 starter_state_t state;
143
144 keyexchange_t keyexchange;
145 char *eap_identity;
146 char *aaa_identity;
147 char *xauth_identity;
148 char *authby;
149 ipsec_mode_t mode;
150 bool proxy_mode;
151 fragmentation_t fragmentation;
152 u_int ikedscp;
153 sa_option_t options;
154 time_t sa_ike_life_seconds;
155 time_t sa_ipsec_life_seconds;
156 time_t sa_rekey_margin;
157 u_int64_t sa_ipsec_life_bytes;
158 u_int64_t sa_ipsec_margin_bytes;
159 u_int64_t sa_ipsec_life_packets;
160 u_int64_t sa_ipsec_margin_packets;
161 unsigned long sa_keying_tries;
162 unsigned long sa_rekey_fuzz;
163 u_int32_t reqid;
164 mark_t mark_in;
165 mark_t mark_out;
166 u_int32_t tfc;
167 bool install_policy;
168 bool aggressive;
169 starter_end_t left, right;
170
171 unsigned long id;
172
173 char *esp;
174 char *ike;
175
176 time_t dpd_delay;
177 time_t dpd_timeout;
178 dpd_action_t dpd_action;
179 int dpd_count;
180
181 dpd_action_t close_action;
182
183 time_t inactivity;
184
185 bool me_mediation;
186 char *me_mediated_by;
187 char *me_peerid;
188
189 starter_conn_t *next;
190 };
191
192 typedef struct starter_ca starter_ca_t;
193
194 struct starter_ca {
195 seen_t seen;
196 char *name;
197 also_t *also;
198 kw_list_t *kw;
199 u_int visit;
200 startup_t startup;
201 starter_state_t state;
202
203 char *cacert;
204 char *crluri;
205 char *crluri2;
206 char *ocspuri;
207 char *ocspuri2;
208 char *certuribase;
209
210 bool strict;
211
212 starter_ca_t *next;
213 };
214
215 typedef struct starter_config starter_config_t;
216
217 struct starter_config {
218 struct {
219 seen_t seen;
220 bool charonstart;
221 char *charondebug;
222 bool uniqueids;
223 bool cachecrls;
224 strict_t strictcrlpolicy;
225 } setup;
226
227 /* number of encountered parsing errors */
228 u_int err;
229 u_int non_fatal_err;
230
231 /* do we parse also statements */
232 bool parse_also;
233
234 /* ca %default */
235 starter_ca_t ca_default;
236
237 /* connections list (without %default) */
238 starter_ca_t *ca_first, *ca_last;
239
240 /* conn %default */
241 starter_conn_t conn_default;
242
243 /* connections list (without %default) */
244 starter_conn_t *conn_first, *conn_last;
245 };
246
247 extern starter_config_t *confread_load(const char *file);
248 extern void confread_free(starter_config_t *cfg);
249
250 #endif /* _IPSEC_CONFREAD_H_ */