1 /* $OpenBSD: ipsecctl.h,v 1.58 2009/01/20 14:36:19 mpf Exp $ */ 2 /* 3 * Copyright (c) 2004, 2005 Hans-Joerg Hoexer <hshoexer@openbsd.org> 4 * 5 * Permission to use, copy, modify, and distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 */ 17 18 #ifndef _IPSECCTL_H_ 19 #define _IPSECCTL_H_ 20 21 #define IPSECCTL_OPT_DISABLE 0x0001 22 #define IPSECCTL_OPT_ENABLE 0x0002 23 #define IPSECCTL_OPT_NOACTION 0x0004 24 #define IPSECCTL_OPT_VERBOSE 0x0010 25 #define IPSECCTL_OPT_VERBOSE2 0x0020 26 #define IPSECCTL_OPT_SHOW 0x0040 27 #define IPSECCTL_OPT_SHOWALL 0x0080 28 #define IPSECCTL_OPT_FLUSH 0x0100 29 #define IPSECCTL_OPT_DELETE 0x0200 30 #define IPSECCTL_OPT_MONITOR 0x0400 31 #define IPSECCTL_OPT_SHOWKEY 0x0800 32 33 enum { 34 ACTION_ADD, ACTION_DELETE 35 }; 36 37 #define RULE_FLOW 0x01 38 #define RULE_SA 0x02 39 #define RULE_IKE 0x04 40 #define RULE_GROUP 0x08 41 42 enum { 43 DIRECTION_UNKNOWN, IPSEC_IN, IPSEC_OUT, IPSEC_INOUT 44 }; 45 enum { 46 PROTO_UNKNOWN, IPSEC_ESP, IPSEC_AH, IPSEC_IPCOMP, IPSEC_TCPMD5, 47 IPSEC_IPIP 48 }; 49 enum { 50 MODE_UNKNOWN, IPSEC_TRANSPORT, IPSEC_TUNNEL 51 }; 52 enum { 53 ID_UNKNOWN, ID_PREFIX, ID_FQDN, ID_UFQDN 54 }; 55 enum { 56 TYPE_UNKNOWN, TYPE_USE, TYPE_ACQUIRE, TYPE_REQUIRE, TYPE_DENY, 57 TYPE_BYPASS, TYPE_DONTACQ 58 }; 59 enum { 60 AUTHXF_UNKNOWN, AUTHXF_NONE, AUTHXF_HMAC_MD5, AUTHXF_HMAC_RIPEMD160, 61 AUTHXF_HMAC_SHA1, AUTHXF_HMAC_SHA2_256, AUTHXF_HMAC_SHA2_384, 62 AUTHXF_HMAC_SHA2_512 63 }; 64 enum { 65 ENCXF_UNKNOWN, ENCXF_NONE, ENCXF_3DES_CBC, ENCXF_DES_CBC, ENCXF_AES, 66 ENCXF_AES_128, ENCXF_AES_192, ENCXF_AES_256, ENCXF_AESCTR, 67 ENCXF_BLOWFISH, ENCXF_CAST128, ENCXF_NULL, ENCXF_SKIPJACK 68 }; 69 enum { 70 COMPXF_UNKNOWN, COMPXF_DEFLATE, COMPXF_LZS 71 }; 72 enum { 73 GROUPXF_UNKNOWN, GROUPXF_NONE, GROUPXF_768, GROUPXF_1024, GROUPXF_1536, 74 GROUPXF_2048, GROUPXF_3072, GROUPXF_4096, GROUPXF_6144, GROUPXF_8192, 75 }; 76 enum { 77 IKE_ACTIVE, IKE_PASSIVE, IKE_DYNAMIC 78 }; 79 enum { 80 IKE_AUTH_RSA, IKE_AUTH_PSK 81 }; 82 enum { 83 IKE_MM=0, IKE_AM, IKE_QM 84 }; 85 86 87 struct ipsec_addr { 88 union { 89 struct in_addr v4; 90 struct in6_addr v6; 91 u_int8_t addr8[16]; 92 u_int16_t addr16[8]; 93 u_int32_t addr32[4]; 94 } ipa; 95 #define v4 ipa.v4 96 #define v6 ipa.v6 97 #define addr8 ipa.addr8 98 #define addr16 ipa.addr16 99 #define addr32 ipa.addr32 100 }; 101 102 struct ipsec_addr_wrap { 103 struct ipsec_addr address; 104 struct ipsec_addr mask; 105 int netaddress; 106 sa_family_t af; 107 char *name; 108 struct ipsec_addr_wrap *next; 109 struct ipsec_addr_wrap *tail; 110 struct ipsec_addr_wrap *srcnat; 111 }; 112 113 struct ipsec_hosts { 114 struct ipsec_addr_wrap *src; 115 struct ipsec_addr_wrap *dst; 116 u_int16_t sport; 117 u_int16_t dport; 118 }; 119 120 struct ipsec_auth { 121 char *srcid; 122 char *dstid; 123 u_int8_t srcid_type; 124 u_int8_t dstid_type; 125 u_int16_t type; 126 }; 127 128 struct ipsec_key { 129 size_t len; 130 u_int8_t *data; 131 }; 132 133 struct ike_auth { 134 u_int8_t type; 135 char *string; 136 }; 137 138 struct ipsec_xf { 139 char *name; 140 u_int16_t id; 141 size_t keymin; 142 size_t keymax; 143 }; 144 145 struct ipsec_transforms { 146 const struct ipsec_xf *authxf; 147 const struct ipsec_xf *encxf; 148 const struct ipsec_xf *compxf; 149 const struct ipsec_xf *groupxf; 150 }; 151 152 struct ipsec_life { 153 int lifetime; 154 int lifevolume; 155 }; 156 157 struct ike_mode { 158 struct ipsec_transforms *xfs; 159 struct ipsec_life *life; 160 u_int8_t ike_exch; 161 }; 162 163 extern const struct ipsec_xf authxfs[]; 164 extern const struct ipsec_xf encxfs[]; 165 extern const struct ipsec_xf compxfs[]; 166 167 TAILQ_HEAD(dst_group_queue, ipsec_rule); 168 169 /* Complete state of one rule. */ 170 struct ipsec_rule { 171 u_int8_t type; 172 173 struct ipsec_addr_wrap *src; 174 struct ipsec_addr_wrap *dst; 175 struct ipsec_addr_wrap *dst2; 176 struct ipsec_addr_wrap *local; 177 struct ipsec_addr_wrap *peer; 178 struct ipsec_auth *auth; 179 struct ike_auth *ikeauth; 180 struct ipsec_transforms *xfs; 181 struct ipsec_transforms *p1xfs; 182 struct ipsec_life *p1life; 183 struct ipsec_transforms *p2xfs; 184 struct ipsec_life *p2life; 185 struct ipsec_key *authkey; 186 struct ipsec_key *enckey; 187 188 char *tag; /* pf tag for SAs */ 189 char *p1name; /* Phase 1 Name */ 190 char *p2name; /* Phase 2 Name (IPsec-XX) */ 191 char *p2lid; /* Phase 2 source ID */ 192 char *p2rid; /* Phase 2 destination ID */ 193 char *p2nid; /* Phase 2 source NAT-ID */ 194 u_int8_t satype; /* encapsulating prococol */ 195 u_int8_t proto; /* encapsulated protocol */ 196 u_int8_t proto2; 197 u_int8_t tmode; 198 u_int8_t direction; 199 u_int8_t flowtype; 200 u_int8_t ikemode; 201 u_int8_t p1ie; 202 u_int8_t p2ie; 203 u_int16_t sport; 204 u_int16_t dport; 205 u_int32_t spi; 206 u_int32_t spi2; 207 u_int32_t nr; 208 209 TAILQ_ENTRY(ipsec_rule) rule_entry; 210 TAILQ_ENTRY(ipsec_rule) group_entry; 211 TAILQ_ENTRY(ipsec_rule) dst_group_entry; 212 213 struct dst_group_queue dst_group_queue; 214 }; 215 216 TAILQ_HEAD(ipsec_rule_queue, ipsec_rule); 217 TAILQ_HEAD(ipsec_group_queue, ipsec_rule); 218 219 struct ipsecctl { 220 u_int32_t rule_nr; 221 int opts; 222 struct ipsec_rule_queue rule_queue; 223 struct ipsec_group_queue group_queue; 224 }; 225 226 int parse_rules(const char *, struct ipsecctl *); 227 int cmdline_symset(char *); 228 int ipsecctl_add_rule(struct ipsecctl *, struct ipsec_rule *); 229 void ipsecctl_free_rule(struct ipsec_rule *); 230 void ipsecctl_get_rules(struct ipsecctl *); 231 void ipsecctl_print_rule(struct ipsec_rule *, int); 232 int ike_print_config(struct ipsec_rule *, int); 233 int ike_ipsec_establish(int, struct ipsec_rule *); 234 void set_ipmask(struct ipsec_addr_wrap *, u_int8_t); 235 236 #endif /* _IPSECCTL_H_ */ 237