src/whack/whack.h

   1 /* Structure of messages from whack to Pluto proper.
   2  * Copyright (C) 1998-2001  D. Hugh Redelmeier.
   3  *
   4  * This program is free software; you can redistribute it and/or modify it
   5  * under the terms of the GNU General Public License as published by the
   6  * Free Software Foundation; either version 2 of the License, or (at your
   7  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   8  *
   9  * This program is distributed in the hope that it will be useful, but
  10  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  11  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  12  * for more details.
  13  *
  14  * RCSID $Id$
  15  */
  16
  17 #ifndef _WHACK_H
  18 #define _WHACK_H
  19
  20 #include <freeswan.h>
  21
  22 /* copy of smartcard operations, defined in smartcard.h */
  23 #ifndef SC_OP_T
  24 #define SC_OP_T
  25 typedef enum {
  26         SC_OP_NONE =    0,
  27         SC_OP_ENCRYPT = 1,
  28         SC_OP_DECRYPT = 2,
  29         SC_OP_SIGN =    3,
  30 } sc_op_t;
  31 #endif /* SC_OP_T */
  32
  33 /* Since the message remains on one host, native representation is used.
  34  * Think of this as horizontal microcode: all selected operations are
  35  * to be done (in the order declared here).
  36  *
  37  * MAGIC is used to help detect version mismatches between whack and Pluto.
  38  * Whenever the interface (i.e. this struct) changes in form or
  39  * meaning, change this value (probably by changing the last number).
  40  *
  41  * If the command only requires basic actions (status or shutdown),
  42  * it is likely that the relevant part of the message changes less frequently.
  43  * Whack uses WHACK_BASIC_MAGIC in those cases.
  44  *
  45  * NOTE: no value of WHACK_BASIC_MAGIC may equal any value of WHACK_MAGIC.
  46  * Otherwise certain version mismatches will not be detected.
  47  */
  48
  49 #define WHACK_BASIC_MAGIC (((((('w' << 8) + 'h') << 8) + 'k') << 8) + 24)
  50 #define WHACK_MAGIC (((((('w' << 8) + 'h') << 8) + 'k') << 8) + 26)
  51
  52 typedef struct whack_end whack_end_t;
  53
  54 /* struct whack_end is a lot like connection.h's struct end
  55  * It differs because it is going to be shipped down a socket
  56  * and because whack is a separate program from pluto.
  57  */
  58 struct whack_end {
  59         char *id;           /* id string (if any) -- decoded by pluto */
  60         char *cert;         /* path string (if any) -- loaded by pluto  */
  61         char *ca;           /* distinguished name string (if any) -- parsed by pluto */
  62         char *groups;       /* access control groups (if any) -- parsed by pluto */
  63         ip_address
  64                 host_addr,
  65                 host_nexthop,
  66                 host_srcip;
  67         ip_subnet client;
  68
  69         bool key_from_DNS_on_demand;
  70         bool has_client;
  71         bool has_client_wildcard;
  72         bool has_port_wildcard;
  73         bool has_srcip;
  74         bool has_natip;
  75         bool modecfg;
  76         bool hostaccess;
  77         bool allow_any;
  78         certpolicy_t sendcert;
  79         char *updown;               /* string */
  80         u_int16_t host_port;        /* host order */
  81         u_int16_t port;             /* host order */
  82         u_int8_t protocol;
  83         char *virt;
  84  };
  85
  86 typedef struct whack_message whack_message_t;
  87
  88 struct whack_message {
  89         unsigned int magic;
  90
  91         /* for WHACK_STATUS: */
  92         bool whack_status;
  93         bool whack_statusall;
  94
  95
  96         /* for WHACK_SHUTDOWN */
  97         bool whack_shutdown;
  98
  99         /* END OF BASIC COMMANDS
 100          * If you change anything earlier in this struct, update WHACK_BASIC_MAGIC.
 101          */
 102
 103         /* name is used in connection, ca and initiate */
 104         size_t name_len;    /* string 1 */
 105         char *name;
 106
 107         /* for WHACK_OPTIONS: */
 108
 109         bool whack_options;
 110
 111         lset_t debugging;   /* only used #ifdef DEBUG, but don't want layout to change */
 112
 113         /* for WHACK_CONNECTION */
 114
 115         bool whack_connection;
 116         bool whack_async;
 117         bool ikev1;
 118
 119         lset_t policy;
 120         time_t sa_ike_life_seconds;
 121         time_t sa_ipsec_life_seconds;
 122         time_t sa_rekey_margin;
 123         unsigned long sa_rekey_fuzz;
 124         unsigned long sa_keying_tries;
 125
 126         /* For DPD 3706 - Dead Peer Detection */
 127         time_t dpd_delay;
 128         time_t dpd_timeout;
 129         dpd_action_t dpd_action;
 130
 131         /*  note that each end contains string 2/5.id, string 3/6 cert,
 132          *  and string 4/7 updown
 133          */
 134         whack_end_t left;
 135         whack_end_t right;
 136
 137         /* note: if the client is the gateway, the following must be equal */
 138         sa_family_t addr_family;    /* between gateways */
 139         sa_family_t tunnel_addr_family;     /* between clients */
 140
 141         char *ike;          /* ike algo string (separated by commas) */
 142         char *pfsgroup;     /* pfsgroup will be "encapsulated" in esp string for pluto */
 143         char *esp;          /* esp algo string (separated by commas) */
 144
 145         /* for WHACK_KEY: */
 146         bool whack_key;
 147         bool whack_addkey;
 148         char *keyid;        /* string 8 */
 149         enum pubkey_alg pubkey_alg;
 150         chunk_t keyval;     /* chunk */
 151
 152         /* for WHACK_MYID: */
 153         bool whack_myid;
 154         char *myid; /* string 7 */
 155
 156         /* for WHACK_ROUTE: */
 157         bool whack_route;
 158
 159         /* for WHACK_UNROUTE: */
 160         bool whack_unroute;
 161
 162         /* for WHACK_INITIATE: */
 163         bool whack_initiate;
 164
 165         /* for WHACK_OPINITIATE */
 166         bool whack_oppo_initiate;
 167         ip_address oppo_my_client, oppo_peer_client;
 168
 169         /* for WHACK_TERMINATE: */
 170         bool whack_terminate;
 171
 172         /* for WHACK_DELETE: */
 173         bool whack_delete;
 174
 175         /* for WHACK_DELETESTATE: */
 176         bool whack_deletestate;
 177         so_serial_t whack_deletestateno;
 178
 179         /* for WHACK_LISTEN: */
 180         bool whack_listen, whack_unlisten;
 181
 182         /* for WHACK_CRASH - note if a remote peer is known to have rebooted */
 183         bool whack_crash;
 184         ip_address whack_crash_peer;
 185
 186         /* for WHACK_LIST */
 187         bool whack_utc;
 188         lset_t whack_list;
 189
 190         /* for WHACK_PURGEOCSP */
 191         bool whack_purgeocsp;
 192
 193         /* for WHACK_REREAD */
 194         u_char whack_reread;
 195
 196         /* for WHACK_CA */
 197         bool whack_ca;
 198         bool whack_strict;
 199
 200         char *cacert;
 201         char *ldaphost;
 202         char *ldapbase;
 203         char *crluri;
 204         char *crluri2;
 205         char *ocspuri;
 206
 207         /* for WHACK_SC_OP */
 208         sc_op_t whack_sc_op;
 209         int inbase, outbase;
 210         char *sc_data;
 211
 212         /* space for strings (hope there is enough room):
 213          * Note that pointers don't travel on wire.
 214          *  1 connection name [name_len]
 215          *  2 left's name [left.host.name.len]
 216          *  3 left's cert
 217          *  4 left's ca
 218          *  5 left's groups
 219          *  6 left's updown
 220          *  7 right's name [left.host.name.len]
 221          *  8 right's cert
 222          *  9 right's ca
 223          * 10 right's groups
 224          * 11 right's updown
 225          * 12 keyid
 226          * 13 myid
 227          * 14 cacert
 228          * 15 ldaphost
 229          * 16 ldapbase
 230          * 17 crluri
 231          * 18 crluri2
 232          * 19 ocspuri
 233          * 20 ike
 234          " 21 esp
 235          * 22 rsa_data
 236          * plus keyval (limit: 8K bits + overhead), a chunk.
 237          */
 238         size_t str_size;
 239         char string[2048];
 240 };
 241
 242 /* Codes for status messages returned to whack.
 243  * These are 3 digit decimal numerals.  The structure
 244  * is inspired by section 4.2 of RFC959 (FTP).
 245  * Since these will end up as the exit status of whack, they
 246  * must be less than 256.
 247  * NOTE: ipsec_auto(8) knows about some of these numbers -- change carefully.
 248  */
 249 enum rc_type {
 250         RC_COMMENT,         /* non-commital utterance (does not affect exit status) */
 251         RC_WHACK_PROBLEM,   /* whack-detected problem */
 252         RC_LOG,             /* message aimed at log (does not affect exit status) */
 253         RC_LOG_SERIOUS,     /* serious message aimed at log (does not affect exit status) */
 254         RC_SUCCESS,         /* success (exit status 0) */
 255
 256         /* failure, but not definitive */
 257
 258         RC_RETRANSMISSION = 10,
 259
 260         /* improper request */
 261
 262         RC_DUPNAME = 20,    /* attempt to reuse a connection name */
 263         RC_UNKNOWN_NAME,    /* connection name unknown or state number */
 264         RC_ORIENT,          /* cannot orient connection: neither end is us */
 265         RC_CLASH,           /* clash between two Road Warrior connections OVERLOADED */
 266         RC_DEAF,            /* need --listen before --initiate */
 267         RC_ROUTE,           /* cannot route */
 268         RC_RTBUSY,          /* cannot unroute: route busy */
 269         RC_BADID,           /* malformed --id */
 270         RC_NOKEY,           /* no key found through DNS */
 271         RC_NOPEERIP,        /* cannot initiate when peer IP is unknown */
 272         RC_INITSHUNT,       /* cannot initiate a shunt-oly connection */
 273         RC_WILDCARD,        /* cannot initiate when ID has wildcards */
 274         RC_NOVALIDPIN,      /* cannot initiate without valid PIN */
 275
 276         /* permanent failure */
 277
 278         RC_BADWHACKMESSAGE = 30,
 279         RC_NORETRANSMISSION,
 280         RC_INTERNALERR,
 281         RC_OPPOFAILURE,     /* Opportunism failed */
 282
 283         /* entry of secrets */
 284         RC_ENTERSECRET = 40,
 285
 286         /* progress: start of range for successful state transition.
 287          * Actual value is RC_NEW_STATE plus the new state code.
 288          */
 289         RC_NEW_STATE = 100,
 290
 291         /* start of range for notification.
 292          * Actual value is RC_NOTIFICATION plus code for notification
 293          * that should be generated by this Pluto.
 294          */
 295         RC_NOTIFICATION = 200       /* as per IKE notification messages */
 296 };
 297
 298 /* options of whack --list*** command */
 299
 300 #define LIST_NONE       0x0000  /* don't list anything */
 301 #define LIST_ALGS       0x0001  /* list all registered IKE algorithms */
 302 #define LIST_PUBKEYS    0x0002  /* list all public keys */
 303 #define LIST_CERTS      0x0004  /* list all host/user certs */
 304 #define LIST_CACERTS    0x0008  /* list all ca certs */
 305 #define LIST_ACERTS     0x0010  /* list all attribute certs */
 306 #define LIST_AACERTS    0x0020  /* list all aa certs */
 307 #define LIST_OCSPCERTS  0x0040  /* list all ocsp certs */
 308 #define LIST_GROUPS     0x0080  /* list all access control groups */
 309 #define LIST_CAINFOS    0x0100  /* list all ca information records */
 310 #define LIST_CRLS       0x0200  /* list all crls */
 311 #define LIST_OCSP       0x0400  /* list all ocsp cache entries */
 312 #define LIST_CARDS      0x0800  /* list all smartcard records */
 313
 314 #define LIST_ALL        LRANGES(LIST_ALGS, LIST_CARDS)  /* all list options */
 315
 316 /* options of whack --reread*** command */
 317
 318 #define REREAD_NONE       0x00  /* don't reread anything */
 319 #define REREAD_SECRETS    0x01  /* reread /etc/ipsec.secrets */
 320 #define REREAD_CACERTS    0x02  /* reread certs in /etc/ipsec.d/cacerts */
 321 #define REREAD_AACERTS    0x04  /* reread certs in /etc/ipsec.d/aacerts */
 322 #define REREAD_OCSPCERTS  0x08  /* reread certs in /etc/ipsec.d/ocspcerts */
 323 #define REREAD_ACERTS     0x10  /* reread certs in /etc/ipsec.d/acerts */
 324 #define REREAD_CRLS       0x20  /* reread crls in /etc/ipsec.d/crls */
 325
 326 #define REREAD_ALL      LRANGES(REREAD_SECRETS, REREAD_CRLS)  /* all reread options */
 327
 328 #endif /* _WHACK_H */