#ifndef _OPENSWAN_H /* * header file for FreeS/WAN library functions * Copyright (C) 1998, 1999, 2000 Henry Spencer. * Copyright (C) 1999, 2000, 2001 Richard Guy Briggs * * This library is free software; you can redistribute it and/or modify it * under the terms of the GNU Library General Public License as published by * the Free Software Foundation; either version 2 of the License, or (at your * option) any later version. See . * * This library is distributed in the hope that it will be useful, but * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public * License for more details. * */ #define _OPENSWAN_H /* you'd think this should be builtin to compiler... */ #ifndef TRUE #define TRUE 1 #endif #ifndef FALSE #define FALSE 0 #endif /* * We've just got to have some datatypes defined... And annoyingly, just * where we get them depends on whether we're in userland or not. */ /* things that need to come from one place or the other, depending */ #ifdef __KERNEL__ #include #include #include #include #include #include #else /* these headers are needed by this file */ #include #include /* for __u32 and friends */ /* these headers should be removed, but currently openswan needs them in here * because the files in net/ipsec/ are built by openswan ... yuck! */ #include #endif /* __KERNEL__ */ #ifndef IPPROTO_INT #define IPPROTO_INT 61 // TODO: this should probably be IPPROTO_KLIPS_INTERNAL #endif #include #include #if !defined(ESPINUDP_WITH_NON_IKE) #define ESPINUDP_DISABLED 0 #define ESPINUDP_WITH_NON_IKE 1 /* draft-ietf-ipsec-nat-t-ike-00/01 */ #define ESPINUDP_WITH_NON_ESP 2 /* draft-ietf-ipsec-nat-t-ike-02 */ #endif /* * Basic data types for the address-handling functions. * ip_address and ip_subnet are supposed to be opaque types; do not * use their definitions directly, they are subject to change! */ /* then the main types */ typedef struct { union { struct sockaddr_in v4; struct sockaddr_in6 v6; } u; } ip_address; typedef struct { ip_address addr; int maskbits; } ip_subnet; /* and the SA ID stuff */ typedef __u32 ipsec_spi_t; enum { /* Magic values for use with SA_INT */ SPI_PASS = 256, SPI_DROP = 257, SPI_REJECT = 258, SPI_HOLD = 259, SPI_TRAP = 260, SPI_TRAPSUBNET = 261, }; typedef struct { /* to identify an SA, we need: */ ip_address dst; /* A. destination host */ ipsec_spi_t spi; /* B. 32-bit SPI, assigned by dest. host */ int proto; /* C. protocol */ } ip_said; /* misc */ #ifndef __KERNEL__ typedef const char *err_t; /* error message, or NULL for success */ #endif struct prng { /* pseudo-random-number-generator guts */ unsigned char sbox[256]; int i, j; unsigned long count; }; /* * definitions for user space, taken from freeswan/ipsec_sa.h */ typedef uint32_t IPsecSAref_t; /* Translation to/from nfmark. * * use bits 16-31. Leave bit 32 as a indicate that IPsec processing * has already been done. */ #define IPSEC_SA_REF_TABLE_IDX_WIDTH 15 #define IPSEC_SA_REF_TABLE_OFFSET 16 #define IPSEC_SA_REF_MAASK ((1<> IPSEC_SA_REF_TABLE_OFFSET)&IPSEC_SA_REF_MASK) #define IPSEC_SAREF_NULL ((IPsecSAref_t)0) #define IPSEC_SAREF_NA ((IPsecSAref_t)0xffff0001) /* GCC magic for use in function definitions! */ #ifdef GCC_LINT # define PRINTF_LIKE(n) __attribute__ ((format(printf, n, n+1))) # define NEVER_RETURNS __attribute__ ((noreturn)) # define UNUSED __attribute__ ((unused)) # define BLANK_FORMAT " " /* GCC_LINT whines about empty formats */ #else # define PRINTF_LIKE(n) /* ignore */ # define NEVER_RETURNS /* ignore */ # define UNUSED /* ignore */ # define BLANK_FORMAT "" #endif #if 0 /* * function to log stuff from libraries that may be used in multiple * places. */ typedef int (*openswan_keying_debug_func_t)(const char *message, ...); #endif /* * new IPv6-compatible functions */ /* text conversions */ const char *ttoul(const char *src, size_t srclen, int format, unsigned long *dst); size_t ultot(unsigned long src, int format, char *buf, size_t buflen); #define ULTOT_BUF (22+1) /* holds 64 bits in octal */ const char *ttoaddr(const char *src, size_t srclen, int af, ip_address *dst); const char *tnatoaddr(const char *src, size_t srclen, int af, ip_address *dst); size_t addrtot(const ip_address *src, int format, char *buf, size_t buflen); /* RFC 1886 old IPv6 reverse-lookup format is the bulkiest */ #define ADDRTOT_BUF (32*2 + 3 + 1 + 3 + 1 + 1) const char *ttosubnet(const char *src, size_t srclen, int af, ip_subnet *dst); size_t subnettot(const ip_subnet *src, int format, char *buf, size_t buflen); #define SUBNETTOT_BUF (ADDRTOT_BUF + 1 + 3) size_t subnetporttot(const ip_subnet *src, int format, char *buf, size_t buflen); #define SUBNETPROTOTOT_BUF (SUBNETTOTO_BUF + ULTOT_BUF) const char *ttosa(const char *src, size_t srclen, ip_said *dst); size_t satot(const ip_said *src, int format, char *bufptr, size_t buflen); #define SATOT_BUF (5 + ULTOA_BUF + 1 + ADDRTOT_BUF) const char *ttodata(const char *src, size_t srclen, int base, char *buf, size_t buflen, size_t *needed); const char *ttodatav(const char *src, size_t srclen, int base, char *buf, size_t buflen, size_t *needed, char *errp, size_t errlen, unsigned int flags); #define TTODATAV_BUF 40 /* ttodatav's largest non-literal message */ #define TTODATAV_IGNORESPACE (1<<1) /* ignore spaces in base64 encodings*/ #define TTODATAV_SPACECOUNTS 0 /* do not ignore spaces in base64 */ size_t datatot(const unsigned char *src, size_t srclen, int format , char *buf, size_t buflen); size_t keyblobtoid(const unsigned char *src, size_t srclen, char *dst, size_t dstlen); size_t splitkeytoid(const unsigned char *e, size_t elen, const unsigned char *m, size_t mlen, char *dst, size_t dstlen); #define KEYID_BUF 10 /* up to 9 text digits plus NUL */ const char *ttoprotoport(char *src, size_t src_len, u_int8_t *proto, u_int16_t *port, int *has_port_wildcard); /* initializations */ void initsaid(const ip_address *addr, ipsec_spi_t spi, int proto, ip_said *dst); const char *loopbackaddr(int af, ip_address *dst); const char *unspecaddr(int af, ip_address *dst); const char *anyaddr(int af, ip_address *dst); const char *initaddr(const unsigned char *src, size_t srclen, int af, ip_address *dst); const char *initsubnet(const ip_address *addr, int maskbits, int clash, ip_subnet *dst); const char *addrtosubnet(const ip_address *addr, ip_subnet *dst); /* misc. conversions and related */ const char *rangetosubnet(const ip_address *from, const ip_address *to, ip_subnet *dst); int addrtypeof(const ip_address *src); int subnettypeof(const ip_subnet *src); size_t addrlenof(const ip_address *src); size_t addrbytesptr(const ip_address *src, const unsigned char **dst); size_t addrbytesof(const ip_address *src, unsigned char *dst, size_t dstlen); int masktocount(const ip_address *src); void networkof(const ip_subnet *src, ip_address *dst); void maskof(const ip_subnet *src, ip_address *dst); /* tests */ int sameaddr(const ip_address *a, const ip_address *b); int addrcmp(const ip_address *a, const ip_address *b); int samesubnet(const ip_subnet *a, const ip_subnet *b); int addrinsubnet(const ip_address *a, const ip_subnet *s); int subnetinsubnet(const ip_subnet *a, const ip_subnet *b); int subnetishost(const ip_subnet *s); int samesaid(const ip_said *a, const ip_said *b); int sameaddrtype(const ip_address *a, const ip_address *b); int samesubnettype(const ip_subnet *a, const ip_subnet *b); int isvalidsubnet(const ip_subnet *a); int isanyaddr(const ip_address *src); int isunspecaddr(const ip_address *src); int isloopbackaddr(const ip_address *src); /* low-level grot */ int portof(const ip_address *src); void setportof(int port, ip_address *dst); struct sockaddr *sockaddrof(ip_address *src); size_t sockaddrlenof(const ip_address *src); /* PRNG */ void prng_init(struct prng *prng, const unsigned char *key, size_t keylen); void prng_bytes(struct prng *prng, unsigned char *dst, size_t dstlen); unsigned long prng_count(struct prng *prng); void prng_final(struct prng *prng); /* odds and ends */ const char *ipsec_version_code(void); const char *ipsec_version_string(void); const char **ipsec_copyright_notice(void); const char *dns_string_rr(int rr, char *buf, int bufsize); const char *dns_string_datetime(time_t seconds, char *buf, int bufsize); /* * old functions, to be deleted eventually */ /* unsigned long */ const char * /* NULL for success, else string literal */ atoul( const char *src, size_t srclen, /* 0 means strlen(src) */ int base, /* 0 means figure it out */ unsigned long *resultp ); size_t /* space needed for full conversion */ ultoa( unsigned long n, int base, char *dst, size_t dstlen ); #define ULTOA_BUF 21 /* just large enough for largest result, */ /* assuming 64-bit unsigned long! */ /* Internet addresses */ const char * /* NULL for success, else string literal */ atoaddr( const char *src, size_t srclen, /* 0 means strlen(src) */ struct in_addr *addr ); size_t /* space needed for full conversion */ addrtoa( struct in_addr addr, int format, /* character; 0 means default */ char *dst, size_t dstlen ); #define ADDRTOA_BUF 16 /* just large enough for largest result */ /* subnets */ const char * /* NULL for success, else string literal */ atosubnet( const char *src, size_t srclen, /* 0 means strlen(src) */ struct in_addr *addr, struct in_addr *mask ); size_t /* space needed for full conversion */ subnettoa( struct in_addr addr, struct in_addr mask, int format, /* character; 0 means default */ char *dst, size_t dstlen ); #define SUBNETTOA_BUF 32 /* large enough for worst case result */ /* ranges */ const char * /* NULL for success, else string literal */ atoasr( const char *src, size_t srclen, /* 0 means strlen(src) */ char *type, /* 'a', 's', 'r' */ struct in_addr *addrs /* two-element array */ ); size_t /* space needed for full conversion */ rangetoa( struct in_addr *addrs, /* two-element array */ int format, /* character; 0 means default */ char *dst, size_t dstlen ); #define RANGETOA_BUF 34 /* large enough for worst case result */ /* data types for SA conversion functions */ /* generic data, e.g. keys */ const char * /* NULL for success, else string literal */ atobytes( const char *src, size_t srclen, /* 0 means strlen(src) */ char *dst, size_t dstlen, size_t *lenp /* NULL means don't bother telling me */ ); size_t /* 0 failure, else true size */ bytestoa( const unsigned char *src, size_t srclen, int format, /* character; 0 means default */ char *dst, size_t dstlen ); /* old versions of generic-data functions; deprecated */ size_t /* 0 failure, else true size */ atodata( const char *src, size_t srclen, /* 0 means strlen(src) */ char *dst, size_t dstlen ); size_t /* 0 failure, else true size */ datatoa( const unsigned char *src, size_t srclen, int format, /* character; 0 means default */ char *dst, size_t dstlen ); /* part extraction and special addresses */ struct in_addr subnetof( struct in_addr addr, struct in_addr mask ); struct in_addr hostof( struct in_addr addr, struct in_addr mask ); struct in_addr broadcastof( struct in_addr addr, struct in_addr mask ); /* mask handling */ int goodmask( struct in_addr mask ); int masktobits( struct in_addr mask ); struct in_addr bitstomask( int n ); /* * ENUM of klips debugging values. Not currently used in klips. * debug flag is actually 32 -bits, but only one bit is ever used, * so we can actually pack it all into a single 32-bit word. */ enum klips_debug_flags { KDF_VERBOSE = 0, KDF_XMIT = 1, KDF_NETLINK = 2, /* obsolete */ KDF_XFORM = 3, KDF_EROUTE = 4, KDF_SPI = 5, KDF_RADIJ = 6, KDF_ESP = 7, KDF_AH = 8, /* obsolete */ KDF_RCV = 9, KDF_TUNNEL = 10, KDF_PFKEY = 11, KDF_COMP = 12 }; /* * Debugging levels for pfkey_lib_debug */ #define PF_KEY_DEBUG_PARSE_NONE 0 #define PF_KEY_DEBUG_PARSE_PROBLEM 1 #define PF_KEY_DEBUG_PARSE_STRUCT 2 #define PF_KEY_DEBUG_PARSE_FLOW 4 #define PF_KEY_DEBUG_BUILD 8 #define PF_KEY_DEBUG_PARSE_MAX 15 extern unsigned int pfkey_lib_debug; /* bits selecting what to report */ /* * pluto and lwdnsq need to know the maximum size of the commands to, * and replies from lwdnsq. */ #define LWDNSQ_CMDBUF_LEN 1024 #define LWDNSQ_RESULT_LEN_MAX 4096 /* syntax for passthrough SA */ #ifndef PASSTHROUGHNAME #define PASSTHROUGHNAME "%passthrough" #define PASSTHROUGH4NAME "%passthrough4" #define PASSTHROUGH6NAME "%passthrough6" #define PASSTHROUGHIS "tun0@0.0.0.0" #define PASSTHROUGH4IS "tun0@0.0.0.0" #define PASSTHROUGH6IS "tun0@::" #define PASSTHROUGHTYPE "tun" #define PASSTHROUGHSPI 0 #define PASSTHROUGHDST 0 #endif #endif /* _OPENSWAN_H */