denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

merged the modularization branch (credentials) back to trunk

Browse Source
This commit is contained in:
Martin Willi
2008-03-13 14:14:44 +00:00
parent 2df655134c
commit 552cc11b1f
495 changed files with 30378 additions and 23843 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/config/backend.h
+75
View File
@@ -0,0 +1,75 @@
/*
* Copyright (C) 2007-2008 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup backend backend
* @{ @ingroup config
*/
#ifndef BACKEND_H_
#define BACKEND_H_
typedef struct backend_t backend_t;
#include <library.h>
#include <config/ike_cfg.h>
#include <config/peer_cfg.h>
#include <credentials/auth_info.h>
#include <utils/linked_list.h>
/**
* The interface for a configuration backend.
*
* A configuration backend is loaded into the backend_manager. It does the actual
* configuration lookup for the method it implements. See backend_manager_t for
* more information.
*/
struct backend_t {
/**
* Create an enumerator over all IKE configs matching two hosts.
*
* Hosts may be NULL to get all.
*
* @param me address of local host
* @param other address of remote host
* @return enumerator over ike_cfg_t's
*/
enumerator_t* (*create_ike_cfg_enumerator)(backend_t *this,
host_t *me, host_t *other);
/**
* Create an enumerator over all Peer configs matching two IDs.
*
* IDs may be NULL to get all.
*
* @param me identity of ourself
* @param other identity of remote host
* @return enumerator over peer_cfg_t
*/
enumerator_t* (*create_peer_cfg_enumerator)(backend_t *this,
identification_t *me,
identification_t *other);
/**
* Get a peer_cfg identified by it's name, or a name of its child.
*
* @param name name of peer/child cfg
* @return matching peer_config, or NULL if none found
*/
peer_cfg_t *(*get_peer_cfg_by_name)(backend_t *this, char *name);
};
#endif /* BACKEND_H_ @} */
src/charon/config/backend_manager.c
+216 -141
View File
@@ -1,10 +1,3 @@
/**
* @file backend_manager.c
*
* @brief Implementation of backend_manager_t.
*
*/
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
@@ -18,18 +11,18 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include "backend_manager.h"
#include <sys/types.h>
#include <dirent.h>
#include <sys/stat.h>
#include <dlfcn.h>
#include <pthread.h>
#include <daemon.h>
#include <utils/linked_list.h>
#include <config/backends/writeable_backend.h>
#include <utils/mutex.h>
typedef struct private_backend_manager_t private_backend_manager_t;
@@ -50,49 +43,209 @@ struct private_backend_manager_t {
linked_list_t *backends;
/**
* Additional list of writable backends.
* locking mutex
*/
linked_list_t *writeable;
/**
* List of dlopen() handles we used to open backends
*/
linked_list_t *handles;
mutex_t *mutex;
};
/**
* data to pass nested IKE enumerator
*/
typedef struct {
private_backend_manager_t *this;
host_t *me;
host_t *other;
} ike_data_t;
/**
* data to pass nested peer enumerator
*/
typedef struct {
private_backend_manager_t *this;
identification_t *me;
identification_t *other;
} peer_data_t;
/**
* destroy IKE enumerator data and unlock list
*/
static void ike_enum_destroy(ike_data_t *data)
{
data->this->mutex->unlock(data->this->mutex);
free(data);
}
/**
* destroy PEER enumerator data and unlock list
*/
static void peer_enum_destroy(peer_data_t *data)
{
data->this->mutex->unlock(data->this->mutex);
free(data);
}
/**
* inner enumerator constructor for IKE cfgs
*/
static enumerator_t *ike_enum_create(backend_t *backend, ike_data_t *data)
{
return backend->create_ike_cfg_enumerator(backend, data->me, data->other);
}
/**
* inner enumerator constructor for Peer cfgs
*/
static enumerator_t *peer_enum_create(backend_t *backend, peer_data_t *data)
{
return backend->create_peer_cfg_enumerator(backend, data->me, data->other);
}
/**
* inner enumerator constructor for all Peer cfgs
*/
static enumerator_t *peer_enum_create_all(backend_t *backend)
{
return backend->create_peer_cfg_enumerator(backend, NULL, NULL);
}
/**
* implements backend_manager_t.get_ike_cfg.
*/
static ike_cfg_t *get_ike_cfg(private_backend_manager_t *this,
host_t *my_host, host_t *other_host)
host_t *me, host_t *other)
{
backend_t *backend;
ike_cfg_t *config = NULL;
iterator_t *iterator = this->backends->create_iterator(this->backends, TRUE);
while (config == NULL && iterator->iterate(iterator, (void**)&backend))
ike_cfg_t *current, *found = NULL;
enumerator_t *enumerator;
host_t *my_candidate, *other_candidate;
ike_data_t *data;
enum {
MATCH_NONE = 0x00,
MATCH_ANY = 0x01,
MATCH_ME = 0x04,
MATCH_OTHER = 0x08,
} prio, best = MATCH_ANY;
data = malloc_thing(ike_data_t);
data->this = this;
data->me = me;
data->other = other;
DBG2(DBG_CFG, "looking for a config for %H...%H", me, other);
this->mutex->lock(this->mutex);
enumerator = enumerator_create_nested(
this->backends->create_enumerator(this->backends),
(void*)ike_enum_create, data, (void*)ike_enum_destroy);
while (enumerator->enumerate(enumerator, (void**)&current))
{
config = backend->get_ike_cfg(backend, my_host, other_host);
prio = MATCH_NONE;
my_candidate = current->get_my_host(current);
other_candidate = current->get_other_host(current);
if (my_candidate->ip_equals(my_candidate, me))
{
prio += MATCH_ME;
}
else if (my_candidate->is_anyaddr(my_candidate))
{
prio += MATCH_ANY;
}
if (other_candidate->ip_equals(other_candidate, other))
{
prio += MATCH_OTHER;
}
else if (other_candidate->is_anyaddr(other_candidate))
{
prio += MATCH_ANY;
}
DBG2(DBG_CFG, " candidate: %H...%H, prio %d",
my_candidate, other_candidate, prio);
/* we require at least two MATCH_ANY */
if (prio > best)
{
best = prio;
DESTROY_IF(found);
found = current;
found->get_ref(found);
}
}
iterator->destroy(iterator);
return config;
enumerator->destroy(enumerator);
this->mutex->unlock(this->mutex);
return found;
}
static enumerator_t *create_peer_cfg_enumerator(private_backend_manager_t *this)
{
this->mutex->lock(this->mutex);
return enumerator_create_nested(
this->backends->create_enumerator(this->backends),
(void*)peer_enum_create_all, this->mutex,
(void*)this->mutex->unlock);
}
/**
* implements backend_manager_t.get_peer_cfg.
*/
static peer_cfg_t *get_peer_cfg(private_backend_manager_t *this,
identification_t *my_id, identification_t *other_id,
ca_info_t *other_ca_info)
identification_t *me, identification_t *other,
auth_info_t *auth)
{
backend_t *backend;
peer_cfg_t *config = NULL;
iterator_t *iterator = this->backends->create_iterator(this->backends, TRUE);
while (config == NULL && iterator->iterate(iterator, (void**)&backend))
peer_cfg_t *current, *found = NULL;
enumerator_t *enumerator;
identification_t *my_candidate, *other_candidate;
id_match_t best = ID_MATCH_NONE;
peer_data_t *data;
DBG2(DBG_CFG, "looking for a config for %D...%D", me, other);
data = malloc_thing(peer_data_t);
data->this = this;
data->me = me;
data->other = other;
this->mutex->lock(this->mutex);
enumerator = enumerator_create_nested(
this->backends->create_enumerator(this->backends),
(void*)peer_enum_create, data, (void*)peer_enum_destroy);
while (enumerator->enumerate(enumerator, &current))
{
config = backend->get_peer_cfg(backend, my_id, other_id, other_ca_info);
id_match_t m1, m2, sum;
my_candidate = current->get_my_id(current);
other_candidate = current->get_other_id(current);
m1 = my_candidate->matches(my_candidate, me);
m2 = other->matches(other, other_candidate);
sum = m1 + m2;
if (m1 && m2)
{
if (auth->complies(auth, current->get_auth(current)))
{
DBG2(DBG_CFG, " candidate '%s': %D...%D, prio %d",
current->get_name(current), my_candidate,
other_candidate, sum);
if (sum > best)
{
DESTROY_IF(found);
found = current;
found->get_ref(found);
best = sum;
}
}
}
}
iterator->destroy(iterator);
return config;
if (found)
{
DBG1(DBG_CFG, "found matching config \"%s\": %D...%D, prio %d",
found->get_name(found), found->get_my_id(found),
found->get_other_id(found), best);
}
enumerator->destroy(enumerator);
this->mutex->unlock(this->mutex);
return found;
}
/**
@@ -102,112 +255,37 @@ static peer_cfg_t *get_peer_cfg_by_name(private_backend_manager_t *this, char *n
{
backend_t *backend;
peer_cfg_t *config = NULL;
iterator_t *iterator = this->backends->create_iterator(this->backends, TRUE);
while (config == NULL && iterator->iterate(iterator, (void**)&backend))
enumerator_t *enumerator;
this->mutex->lock(this->mutex);
enumerator = this->backends->create_enumerator(this->backends);
while (config == NULL && enumerator->enumerate(enumerator, (void**)&backend))
{
config = backend->get_peer_cfg_by_name(backend, name);
}
iterator->destroy(iterator);
enumerator->destroy(enumerator);
this->mutex->unlock(this->mutex);
return config;
}
/**
* implements backend_manager_t.add_peer_cfg.
*/
static void add_peer_cfg(private_backend_manager_t *this, peer_cfg_t *config)
{
writeable_backend_t *backend;
if (this->writeable->get_first(this->writeable, (void**)&backend) == SUCCESS)
{
backend->add_cfg(backend, config);
}
}
/**
* implements backend_manager_t.create_iterator.
*/
static iterator_t* create_iterator(private_backend_manager_t *this)
{
writeable_backend_t *backend;
if (this->writeable->get_first(this->writeable, (void**)&backend) == SUCCESS)
{
return backend->create_iterator(backend);
}
/* give out an empty iterator if we have no writable backend*/
return this->writeable->create_iterator(this->writeable, TRUE);
}
/**
* load the configuration backend modules
* Implementation of backend_manager_t.remove_backend.
*/
static void load_backends(private_backend_manager_t *this)
static void remove_backend(private_backend_manager_t *this, backend_t *backend)
{
struct dirent* entry;
DIR* dir;
this->mutex->lock(this->mutex);
this->backends->remove(this->backends, backend, NULL);
this->mutex->unlock(this->mutex);
}
dir = opendir(IPSEC_BACKENDDIR);
if (dir == NULL)
{
DBG1(DBG_CFG, "error opening backend modules directory "IPSEC_BACKENDDIR);
return;
}
DBG1(DBG_CFG, "loading backend modules from '"IPSEC_BACKENDDIR"'");
while ((entry = readdir(dir)) != NULL)
{
char file[256];
backend_t *backend;
backend_constructor_t constructor;
void *handle;
char *ending;
snprintf(file, sizeof(file), IPSEC_BACKENDDIR"/%s", entry->d_name);
ending = entry->d_name + strlen(entry->d_name) - 3;
if (ending <= entry->d_name || !streq(ending, ".so"))
{
/* skip anything which does not look like a library */
DBG2(DBG_CFG, " skipping %s, doesn't look like a library",
entry->d_name);
continue;
}
/* try to load the library */
handle = dlopen(file, RTLD_LAZY);
if (handle == NULL)
{
DBG1(DBG_CFG, " opening backend module %s failed: %s",
entry->d_name, dlerror());
continue;
}
constructor = dlsym(handle, "backend_create");
if (constructor == NULL)
{
DBG1(DBG_CFG, " backend module %s has no backend_create() "
"function, skipped", entry->d_name);
dlclose(handle);
continue;
}
backend = constructor();
if (backend == NULL)
{
DBG1(DBG_CFG, " unable to create instance of backend "
"module %s, skipped", entry->d_name);
dlclose(handle);
continue;
}
DBG1(DBG_CFG, " loaded backend module successfully from %s", entry->d_name);
this->backends->insert_last(this->backends, backend);
if (backend->is_writeable(backend))
{
this->writeable->insert_last(this->writeable, backend);
}
this->handles->insert_last(this->handles, handle);
}
closedir(dir);
/**
* Implementation of backend_manager_t.add_backend.
*/
static void add_backend(private_backend_manager_t *this, backend_t *backend)
{
this->mutex->lock(this->mutex);
this->backends->insert_last(this->backends, backend);
this->mutex->unlock(this->mutex);
}
/**
@@ -215,9 +293,8 @@ static void load_backends(private_backend_manager_t *this)
*/
static void destroy(private_backend_manager_t *this)
{
this->backends->destroy_offset(this->backends, offsetof(backend_t, destroy));
this->writeable->destroy(this->writeable);
this->handles->destroy_function(this->handles, (void*)dlclose);
this->backends->destroy(this->backends);
this->mutex->destroy(this->mutex);
free(this);
}
@@ -229,17 +306,15 @@ backend_manager_t *backend_manager_create()
private_backend_manager_t *this = malloc_thing(private_backend_manager_t);
this->public.get_ike_cfg = (ike_cfg_t* (*)(backend_manager_t*, host_t*, host_t*))get_ike_cfg;
this->public.get_peer_cfg = (peer_cfg_t* (*)(backend_manager_t*,identification_t*,identification_t*,ca_info_t*))get_peer_cfg;
this->public.get_peer_cfg = (peer_cfg_t* (*)(backend_manager_t*,identification_t*,identification_t*,auth_info_t*))get_peer_cfg;
this->public.get_peer_cfg_by_name = (peer_cfg_t* (*)(backend_manager_t*,char*))get_peer_cfg_by_name;
this->public.add_peer_cfg = (void (*)(backend_manager_t*,peer_cfg_t*))add_peer_cfg;
this->public.create_iterator = (iterator_t* (*)(backend_manager_t*))create_iterator;
this->public.create_peer_cfg_enumerator = (enumerator_t* (*)(backend_manager_t*))create_peer_cfg_enumerator;
this->public.add_backend = (void(*)(backend_manager_t*, backend_t *backend))add_backend;
this->public.remove_backend = (void(*)(backend_manager_t*, backend_t *backend))remove_backend;
this->public.destroy = (void (*)(backend_manager_t*))destroy;
this->backends = linked_list_create();
this->writeable = linked_list_create();
this->handles = linked_list_create();
load_backends(this);
this->mutex = mutex_create(MUTEX_RECURSIVE);
return &this->public;
}
src/charon/config/backend_manager.h
+31 -44
View File
@@ -1,10 +1,3 @@
/**
* @file backend_manager.h
*
* @brief Interface backend_manager_t.
*
*/
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
@@ -18,6 +11,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup backend_manager backend_manager
* @{ @ingroup config
*/
#ifndef BACKEND_MANAGER_H_
@@ -30,20 +30,15 @@ typedef struct backend_manager_t backend_manager_t;
#include <utils/identification.h>
#include <config/ike_cfg.h>
#include <config/peer_cfg.h>
#include <config/backends/backend.h>
#include <config/backend.h>
/**
* @brief A loader and multiplexer to use multiple backends.
* A loader and multiplexer to use multiple backends.
*
* Charon allows the use of multiple configuration backends simultaneously. To
* access all this backends by a single call, this class wraps multiple
* backends behind a single object. It is also responsible for loading
* the backend modules and cleaning them up.
* A backend may be writeable or not. All backends implement the backend_t
* interface, those who are writeable additionally implement the
* writeable_backend_t interface. Adding configs to the backend_manager will
* be redirected to the first writeable backend.
* backends behind a single object.
* @verbatim
+---------+ +-----------+ +--------------+ |
@@ -55,18 +50,12 @@ typedef struct backend_manager_t backend_manager_t;
+---------+ +-----------+ |
@endverbatim
*
* @b Constructors:
* - backend_manager_create()
*
* @ingroup config
*/
struct backend_manager_t {
/**
* @brief Get an ike_config identified by two hosts.
* Get an ike_config identified by two hosts.
*
* @param this calling object
* @param my_host address of own host
* @param other_host address of remote host
* @return matching ike_config, or NULL if none found
@@ -75,59 +64,57 @@ struct backend_manager_t {
host_t *my_host, host_t *other_host);
/**
* @brief Get a peer_config identified by two IDs and the peer's certificate issuer
* Get a peer_config identified by two IDs and authorization info.
*
* @param this calling object
* @param my_id own ID
* @param other_id peer ID
* @param other_ca_info info record on issuer of peer certificate
* @param auth_info authorization info
* @return matching peer_config, or NULL if none found
*/
peer_cfg_t* (*get_peer_cfg)(backend_manager_t *this,
identification_t *my_id, identification_t *other_id,
ca_info_t *other_ca_info);
peer_cfg_t* (*get_peer_cfg)(backend_manager_t *this, identification_t *my_id,
identification_t *other_id, auth_info_t *auth);
/**
* @brief Get a peer_config identified by it's name.
* Get a peer_config identified by it's name.
*
* @param this calling object
* @param name name of the peer_config
* @return matching peer_config, or NULL if none found
*/
peer_cfg_t* (*get_peer_cfg_by_name)(backend_manager_t *this, char *name);
/**
* @brief Add a peer_config to the first found writable backend.
* Create an enumerator over all peer configs.
*
* @param this calling object
* @param config peer_config to add to the backend
* @return enumerator over peer configs
*/
void (*add_peer_cfg)(backend_manager_t *this, peer_cfg_t *config);
enumerator_t* (*create_peer_cfg_enumerator)(backend_manager_t *this);
/**
* @brief Create an iterator over all peer configs of the writable backend.
* Register a backend on the manager.
*
* @param this calling object
* @return iterator over peer configs
* @param backend backend to register
*/
iterator_t* (*create_iterator)(backend_manager_t *this);
void (*add_backend)(backend_manager_t *this, backend_t *backend);
/**
* @brief Destroys a backend_manager_t object.
* Unregister a backend.
*
* @param this calling object
* @param backend backend to unregister
*/
void (*remove_backend)(backend_manager_t *this, backend_t *backend);
/**
* Destroys a backend_manager_t object.
*/
void (*destroy) (backend_manager_t *this);
};
/**
* @brief Creates a new instance of the manager and loads all backends.
* Create an instance of the backend manager
*
* @return backend_manager instance
*
* @ingroup config
*/
backend_manager_t* backend_manager_create(void);
#endif /*BACKEND_MANAGER_H_*/
#endif /*BACKEND_MANAGER_H_ @} */
src/charon/config/backends/backend.h
-105
View File
@@ -1,105 +0,0 @@
/**
* @file backend.h
*
* @brief Interface backend_t.
*
*/
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#ifndef BACKEND_H_
#define BACKEND_H_
typedef struct backend_t backend_t;
#include <library.h>
#include <config/ike_cfg.h>
#include <config/peer_cfg.h>
#include <utils/linked_list.h>
/**
* @brief The interface for a configuration backend.
*
* A configuration backend is loaded by the backend_manager. It does the actual
* configuration lookup for the method it implements. See backend_manager_t for
* more information.
*
* @b Constructors:
* - implementations constructors
*
* @ingroup backends
*/
struct backend_t {
/**
* @brief Get an ike_cfg identified by two hosts.
*
* @param this calling object
* @param my_host address of own host
* @param other_host address of remote host
* @return matching ike_config, or NULL if none found
*/
ike_cfg_t *(*get_ike_cfg)(backend_t *this,
host_t *my_host, host_t *other_host);
/**
* @brief Get a peer_cfg identified by two IDs.
*
* Select a config based on the two IDs and the other's certificate issuer
*
* @param this calling object
* @param my_id own ID
* @param other_id peer ID
* @param other_ca_info info record on issuer of peer certificate
* @return matching peer_config, or NULL if none found
*/
peer_cfg_t *(*get_peer_cfg)(backend_t *this,
identification_t *my_id, identification_t *other_id,
ca_info_t *other_ca_info);
/**
* @brief Get a peer_cfg identified by it's name, or a name of its child.
*
* @param this calling object
* @param name
* @return matching peer_config, or NULL if none found
*/
peer_cfg_t *(*get_peer_cfg_by_name)(backend_t *this, char *name);
/**
* @brief Check if a backend is writable and implements writable_backend_t.
*
* @param this calling object
* @return TRUE if backend implements writable_backend_t.
*/
bool (*is_writeable)(backend_t *this);
/**
* @brief Destroy a backend.
*
* @param this calling object
*/
void (*destroy)(backend_t *this);
};
/**
* Construction to create a backend.
*/
typedef backend_t*(*backend_constructor_t)(void);
#endif /* BACKEND_H_ */
src/charon/config/backends/local_backend.c
-322
View File
@@ -1,322 +0,0 @@
/**
* @file local_backend.c
*
* @brief Implementation of local_backend_t.
*
*/
/*
* Copyright (C) 2006 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include <string.h>
#include "local_backend.h"
#include <daemon.h>
#include <utils/linked_list.h>
#include <crypto/ca.h>
typedef struct private_local_backend_t private_local_backend_t;
/**
* Private data of an local_backend_t object
*/
struct private_local_backend_t {
/**
* Public part
*/
local_backend_t public;
/**
* list of configs
*/
linked_list_t *cfgs;
/**
* Mutex to exclusivly access list
*/
pthread_mutex_t mutex;
};
/**
* implements backen_t.get_ike_cfg.
*/
static ike_cfg_t *get_ike_cfg(private_local_backend_t *this,
host_t *my_host, host_t *other_host)
{
peer_cfg_t *peer;
ike_cfg_t *current, *found = NULL;
iterator_t *iterator;
host_t *my_candidate, *other_candidate;
enum {
MATCH_NONE = 0x00,
MATCH_ANY = 0x01,
MATCH_ME = 0x04,
MATCH_OTHER = 0x08,
} prio, best = MATCH_ANY;
DBG2(DBG_CFG, "looking for a config for %H...%H",
my_host, other_host);
iterator = this->cfgs->create_iterator_locked(this->cfgs, &this->mutex);
while (iterator->iterate(iterator, (void**)&peer))
{
prio = MATCH_NONE;
current = peer->get_ike_cfg(peer);
my_candidate = current->get_my_host(current);
other_candidate = current->get_other_host(current);
if (my_candidate->ip_equals(my_candidate, my_host))
{
prio += MATCH_ME;
}
else if (my_candidate->is_anyaddr(my_candidate))
{
prio += MATCH_ANY;
}
if (other_candidate->ip_equals(other_candidate, other_host))
{
prio += MATCH_OTHER;
}
else if (other_candidate->is_anyaddr(other_candidate))
{
prio += MATCH_ANY;
}
DBG2(DBG_CFG, " candidate '%s': %H...%H, prio %d",
peer->get_name(peer), my_candidate, other_candidate, prio);
/* we require at least two MATCH_ANY */
if (prio > best)
{
best = prio;
found = current;
}
}
if (found)
{
found->get_ref(found);
}
iterator->destroy(iterator);
return found;
}
#define PRIO_NO_MATCH_FOUND 256
/**
* implements backend_t.get_peer.
*/
static peer_cfg_t *get_peer_cfg(private_local_backend_t *this,
identification_t *my_id, identification_t *other_id,
ca_info_t *other_ca_info)
{
peer_cfg_t *current, *found = NULL;
iterator_t *iterator;
identification_t *my_candidate, *other_candidate;
int best = PRIO_NO_MATCH_FOUND;
DBG2(DBG_CFG, "looking for a config for %D...%D", my_id, other_id);
iterator = this->cfgs->create_iterator_locked(this->cfgs, &this->mutex);
while (iterator->iterate(iterator, (void**)&current))
{
int wc1, wc2;
my_candidate = current->get_my_id(current);
other_candidate = current->get_other_id(current);
if (my_candidate->matches(my_candidate, my_id, &wc1)
&& other_id->matches(other_id, other_candidate, &wc2))
{
int prio = (wc1 + wc2) * (MAX_CA_PATH_LEN + 1);
int pathlen = 0;
identification_t *other_candidate_ca = current->get_other_ca(current);
linked_list_t *groups = current->get_groups(current);
/* is a group membership required? */
if (groups->get_count(groups) > 0)
{
DBG1(DBG_CFG, " group membership required");
}
/* are there any ca constraints? */
if (other_candidate_ca->get_type(other_candidate_ca) != ID_ANY)
{
ca_info_t *ca_info = other_ca_info;
for (pathlen = 0; pathlen < MAX_CA_PATH_LEN; pathlen++)
{
if (ca_info == NULL)
{
prio = PRIO_NO_MATCH_FOUND;
break;
}
else
{
x509_t *cacert = ca_info->get_certificate(ca_info);
identification_t *other_ca = cacert->get_subject(cacert);
if (other_candidate_ca->equals(other_candidate_ca, other_ca))
{
/* found a ca match */
break;
}
if (cacert->is_self_signed(cacert))
{
/* reached the root ca without a match */
prio = PRIO_NO_MATCH_FOUND;
break;
}
/* move a level upward in the trust path hierarchy */
ca_info = charon->credentials->get_issuer(charon->credentials, cacert);
}
}
if (pathlen == MAX_CA_PATH_LEN)
{
DBG1(DBG_CFG, "maximum ca path length of %d levels reached", MAX_CA_PATH_LEN);
prio = PRIO_NO_MATCH_FOUND;
}
}
if (prio == PRIO_NO_MATCH_FOUND)
{
DBG2(DBG_CFG, " candidate '%s': %D...%D, no ca match",
current->get_name(current), my_candidate, other_candidate);
}
else
{
prio += pathlen;
DBG2(DBG_CFG, " candidate '%s': %D...%D, prio %d",
current->get_name(current), my_candidate, other_candidate, prio);
if (prio < best)
{
found = current;
best = prio;
}
}
}
}
if (found)
{
DBG1(DBG_CFG, "found matching config \"%s\": %D...%D, prio %d",
found->get_name(found),
found->get_my_id(found),
found->get_other_id(found),
best);
found->get_ref(found);
}
iterator->destroy(iterator);
return found;
}
/**
* implements backend_t.get_peer_cfg_by_name.
*/
static peer_cfg_t *get_peer_cfg_by_name(private_local_backend_t *this, char *name)
{
iterator_t *i1, *i2;
peer_cfg_t *current, *found = NULL;
child_cfg_t *child;
i1 = this->cfgs->create_iterator(this->cfgs, TRUE);
while (i1->iterate(i1, (void**)&current))
{
/* compare peer_cfgs name first */
if (streq(current->get_name(current), name))
{
found = current;
found->get_ref(found);
break;
}
/* compare all child_cfg names otherwise */
i2 = current->create_child_cfg_iterator(current);
while (i2->iterate(i2, (void**)&child))
{
if (streq(child->get_name(child), name))
{
found = current;
found->get_ref(found);
break;
}
}
i2->destroy(i2);
if (found)
{
break;
}
}
i1->destroy(i1);
return found;
}
/**
* Implementation of backend_t.is_writable.
*/
static bool is_writeable(private_local_backend_t *this)
{
return TRUE;
}
/**
* Implementation of writable_backend_t.create_iterator.
*/
static iterator_t* create_iterator(private_local_backend_t *this)
{
return this->cfgs->create_iterator_locked(this->cfgs, &this->mutex);
}
/**
* Implementation of writable_backend_t.add_peer_cfg.
*/
static void add_cfg(private_local_backend_t *this, peer_cfg_t *config)
{
pthread_mutex_lock(&this->mutex);
this->cfgs->insert_last(this->cfgs, config);
pthread_mutex_unlock(&this->mutex);
}
/**
* Implementation of backend_t.destroy.
*/
static void destroy(private_local_backend_t *this)
{
this->cfgs->destroy_offset(this->cfgs, offsetof(peer_cfg_t, destroy));
free(this);
}
/**
* Described in header.
*/
backend_t *backend_create(void)
{
private_local_backend_t *this = malloc_thing(private_local_backend_t);
this->public.backend.backend.get_ike_cfg = (ike_cfg_t* (*)(backend_t*, host_t*, host_t*))get_ike_cfg;
this->public.backend.backend.get_peer_cfg = (peer_cfg_t* (*)(backend_t*,identification_t*,identification_t*,ca_info_t*))get_peer_cfg;
this->public.backend.backend.get_peer_cfg_by_name = (peer_cfg_t* (*)(backend_t*,char*))get_peer_cfg_by_name;
this->public.backend.backend.is_writeable = (bool(*) (backend_t*))is_writeable;
this->public.backend.backend.destroy = (void (*)(backend_t*))destroy;
this->public.backend.create_iterator = (iterator_t* (*)(writeable_backend_t*))create_iterator;
this->public.backend.add_cfg = (void (*)(writeable_backend_t*,peer_cfg_t*))add_cfg;
/* private variables */
this->cfgs = linked_list_create();
pthread_mutex_init(&this->mutex, NULL);
return &this->public.backend.backend;
}
src/charon/config/backends/local_backend.h
-60
View File
@@ -1,60 +0,0 @@
/**
* @file local_backend.h
*
* @brief Interface of local_backend_t.
*
*/
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#ifndef LOCAL_BACKEND_H_
#define LOCAL_BACKEND_H_
typedef struct local_backend_t local_backend_t;
#include <library.h>
#include <config/backends/writeable_backend.h>
/**
* @brief An in-memory backend to store configurations.
*
* The local_backend_t stores the configuration in a simple list. It
* implements both, backend_t and writeable_backend_t.
*
* @b Constructors:
* - local_backend_create()
*
* @ingroup backends
*/
struct local_backend_t {
/**
* Implements writable_backend_t interface
*/
writeable_backend_t backend;
};
/**
* @brief Create a backend_t instance implemented as local backend.
*
* @return backend instance
*
* @ingroup backends
*/
backend_t *backend_create(void);
#endif /* LOCAL_BACKEND_H_ */
src/charon/config/backends/sqlite_backend.c
-309
View File
@@ -1,309 +0,0 @@
/**
* @file sqlite_backend.c
*
* @brief Implementation of sqlite_backend_t.
*
*/
/*
* Copyright (C) 2006 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include <string.h>
#include <sqlite3.h>
#include "sqlite_backend.h"
#include <daemon.h>
typedef struct private_sqlite_backend_t private_sqlite_backend_t;
/**
* Private data of an sqlite_backend_t object
*/
struct private_sqlite_backend_t {
/**
* Public part
*/
sqlite_backend_t public;
/**
* SQLite database handle
*/
sqlite3 *db;
};
/**
* implements backen_t.get_ike_cfg.
*/
static ike_cfg_t *get_ike_cfg(private_sqlite_backend_t *this,
host_t *my_host, host_t *other_host)
{
return NULL;
}
/**
* add TS with child "id" to "child_cfg"
*/
static void add_ts(private_sqlite_backend_t *this, child_cfg_t *child_cfg, int id)
{
sqlite3_stmt *stmt;
if (sqlite3_prepare_v2(this->db,
"SELECT type, protocol, start_addr, end_addr, start_port, end_port, kind "
"FROM traffic_selectors, child_config_traffic_selector "
"ON traffic_selectors.oid = child_config_traffic_selector.traffic_selector "
"WHERE child_config_traffic_selector.child_cfg = ?;",
-1, &stmt, NULL) == SQLITE_OK &&
sqlite3_bind_int(stmt, 1, id) == SQLITE_OK)
{
while (sqlite3_step(stmt) == SQLITE_ROW)
{
traffic_selector_t *ts;
bool local = FALSE;
enum {
TS_LOCAL = 0,
TS_REMOTE = 1,
TS_LOCAL_DYNAMIC = 2,
TS_REMOTE_DYNAMIC = 3,
} kind;
kind = sqlite3_column_int(stmt, 6);
switch (kind)
{
case TS_LOCAL:
local = TRUE;
/* FALL */
case TS_REMOTE:
ts = traffic_selector_create_from_string(
sqlite3_column_int(stmt, 1), /* protocol */
sqlite3_column_int(stmt, 0), /* type */
(char*)sqlite3_column_text(stmt, 2), /* from addr */
sqlite3_column_int(stmt, 4), /* from port */
(char*)sqlite3_column_text(stmt, 3), /* to addr */
sqlite3_column_int(stmt, 5)); /* to port */
break;
case TS_LOCAL_DYNAMIC:
local = TRUE;
/* FALL */
case TS_REMOTE_DYNAMIC:
ts = traffic_selector_create_dynamic(
sqlite3_column_int(stmt, 1), /* protocol */
sqlite3_column_int(stmt, 0), /* type */
sqlite3_column_int(stmt, 4), /* from port */
sqlite3_column_int(stmt, 5)); /* to port */
break;
default:
continue;
}
if (ts)
{
child_cfg->add_traffic_selector(child_cfg, local, ts);
}
}
}
sqlite3_finalize(stmt);
}
/**
* add childrens belonging to config with "id" to "peer_cfg"
*/
static void add_children(private_sqlite_backend_t *this, peer_cfg_t *peer_cfg, int id)
{
sqlite3_stmt *stmt;
child_cfg_t *child_cfg;
if (sqlite3_prepare_v2(this->db,
"SELECT child_configs.oid, name, updown, hostaccess, mode, "
"lifetime, rekeytime, jitter "
"FROM child_configs, peer_config_child_config "
"ON child_configs.oid = peer_config_child_config.child_cfg "
"WHERE peer_config_child_config.peer_cfg = ?;",
-1, &stmt, NULL) == SQLITE_OK &&
sqlite3_bind_int(stmt, 1, id) == SQLITE_OK)
{
while (sqlite3_step(stmt) == SQLITE_ROW)
{
child_cfg = child_cfg_create(
(char*)sqlite3_column_text(stmt, 1), /* name */
sqlite3_column_int(stmt, 5), /* lifetime */
sqlite3_column_int(stmt, 6), /* rekeytime */
sqlite3_column_int(stmt, 7), /* jitter */
(char*)sqlite3_column_text(stmt, 2), /* updown */
sqlite3_column_int(stmt, 3), /* hostaccess */
sqlite3_column_int(stmt, 4)); /* mode */
add_ts(this, child_cfg, sqlite3_column_int(stmt, 0));
child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
peer_cfg->add_child_cfg(peer_cfg, child_cfg);
}
}
sqlite3_finalize(stmt);
}
/**
* processing function for get_peer_cfg and get_peer_cfg_by_name
*/
static peer_cfg_t *process_peer_cfg_row(private_sqlite_backend_t *this,
sqlite3_stmt *stmt)
{
host_t *local_host, *remote_host, *local_vip = NULL, *remote_vip = NULL;
identification_t *local_id, *remote_id;
peer_cfg_t *peer_cfg;
ike_cfg_t *ike_cfg;
local_host = host_create_from_string((char*)sqlite3_column_text(stmt, 17), IKEV2_UDP_PORT);
remote_host = host_create_from_string((char*)sqlite3_column_text(stmt, 18), IKEV2_UDP_PORT);
if (sqlite3_column_text(stmt, 15))
{
local_vip = host_create_from_string((char*)sqlite3_column_text(stmt, 15), 0);
}
if (sqlite3_column_text(stmt, 16))
{
remote_vip = host_create_from_string((char*)sqlite3_column_text(stmt, 16), 0);
}
local_id = identification_create_from_string((char*)sqlite3_column_text(stmt, 2));
remote_id = identification_create_from_string((char*)sqlite3_column_text(stmt, 3));
if (local_host && remote_host && local_id && remote_id)
{
ike_cfg = ike_cfg_create(sqlite3_column_int(stmt, 19), FALSE,
local_host, remote_host);
ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
peer_cfg = peer_cfg_create(
(char*)sqlite3_column_text(stmt, 1), /* name */
2, ike_cfg, local_id, remote_id, NULL, NULL, linked_list_create(),
sqlite3_column_int(stmt, 4), /* cert_policy */
sqlite3_column_int(stmt, 5), /* auth_method */
sqlite3_column_int(stmt, 6), 0 /* eap_type, vendor */
sqlite3_column_int(stmt, 7), /* keyingtries */
sqlite3_column_int(stmt, 8), /* rekey_time */
sqlite3_column_int(stmt, 9), /* reauth_time */
sqlite3_column_int(stmt, 10), /* jitter_time */
sqlite3_column_int(stmt, 11), /* over_time */
sqlite3_column_int(stmt, 14), /* mobike */
sqlite3_column_int(stmt, 12), /* dpd_delay */
sqlite3_column_int(stmt, 13), /* dpd_action */
local_vip, remote_vip, FALSE, NULL, NULL);
add_children(this, peer_cfg, sqlite3_column_int(stmt, 0));
return peer_cfg;
}
DESTROY_IF(local_host);
DESTROY_IF(remote_host);
DESTROY_IF(local_id);
DESTROY_IF(remote_id);
DESTROY_IF(local_vip);
DESTROY_IF(remote_vip);
return NULL;
}
/**
* implements backend_t.get_peer_cfg.
*/
static peer_cfg_t *get_peer_cfg(private_sqlite_backend_t *this,
identification_t *my_id, identification_t *other_id,
ca_info_t *other_ca_info)
{
sqlite3_stmt *stmt;
char local[256], remote[256];
peer_cfg_t *peer_cfg = NULL;
snprintf(local, sizeof(local), "%D", my_id);
snprintf(remote, sizeof(remote), "%D", other_id);
if (sqlite3_prepare_v2(this->db,
"SELECT peer_configs.oid, name, local_id, remote_id, cert_policy, "
"auth_method, eap_type, keyingtries, "
"rekey_time, reauth_time, jitter_time, over_time, "
"dpd_delay, dpd_action, mobike, local_vip, remote_vip, "
"local, remote, certreq "
"FROM peer_configs, ike_configs "
"ON peer_configs.ike_cfg = ike_configs.oid "
"WHERE local_id = ? and remote_id = ?;", -1, &stmt, NULL) == SQLITE_OK &&
sqlite3_bind_text(stmt, 1, local, -1, SQLITE_STATIC) == SQLITE_OK &&
sqlite3_bind_text(stmt, 2, remote, -1, SQLITE_STATIC) == SQLITE_OK &&
sqlite3_step(stmt) == SQLITE_ROW)
{
peer_cfg = process_peer_cfg_row(this, stmt);
}
sqlite3_finalize(stmt);
return peer_cfg;
}
/**
* implements backend_t.get_peer_cfg_by_name.
*/
static peer_cfg_t *get_peer_cfg_by_name(private_sqlite_backend_t *this, char *name)
{
sqlite3_stmt *stmt;
peer_cfg_t *peer_cfg = NULL;
if (sqlite3_prepare_v2(this->db,
"SELECT peer_configs.oid, name, local_id, remote_id, cert_policy, "
"auth_method, eap_type, keyingtries, lifetime, rekeytime, jitter, "
"dpd_delay, dpd_action, reauth, mobike, local_vip, remote_vip, "
"local, remote, certreq "
"FROM peer_configs, ike_configs "
"ON peer_configs.ike_cfg = ike_configs.oid "
"WHERE name = ? ;", -1, &stmt, NULL) == SQLITE_OK &&
sqlite3_bind_text(stmt, 1, name, -1, SQLITE_STATIC) == SQLITE_OK &&
sqlite3_step(stmt) == SQLITE_ROW)
{
peer_cfg = process_peer_cfg_row(this, stmt);
}
sqlite3_finalize(stmt);
return peer_cfg;
}
/**
* Implementation of backend_t.is_writable.
*/
static bool is_writeable(private_sqlite_backend_t *this)
{
return FALSE;
}
/**
* Implementation of backend_t.destroy.
*/
static void destroy(private_sqlite_backend_t *this)
{
sqlite3_close(this->db);
free(this);
}
/**
* Described in header.
*/
backend_t *backend_create(void)
{
private_sqlite_backend_t *this = malloc_thing(private_sqlite_backend_t);
this->public.backend.get_ike_cfg = (ike_cfg_t* (*)(backend_t*, host_t*, host_t*))get_ike_cfg;
this->public.backend.get_peer_cfg = (peer_cfg_t* (*)(backend_t*,identification_t*,identification_t*,ca_info_t*))get_peer_cfg;
this->public.backend.get_peer_cfg_by_name = (peer_cfg_t* (*)(backend_t*,char*))get_peer_cfg_by_name;
this->public.backend.is_writeable = (bool(*) (backend_t*))is_writeable;
this->public.backend.destroy = (void (*)(backend_t*))destroy;
if (sqlite3_open(IPSEC_DIR "/manager.db", &this->db) != SQLITE_OK)
{
DBG1(DBG_CFG, "opening SQLite database '" IPSEC_DIR "/manager.db' failed.");
destroy(this);
return NULL;
}
return &this->public.backend;
}
src/charon/config/backends/sqlite_backend.h
-58
View File
@@ -1,58 +0,0 @@
/**
* @file sqlite_backend.h
*
* @brief Interface of sqlite_backend_t.
*
*/
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#ifndef SQLITE_BACKEND_H_
#define SQLITE_BACKEND_H_
typedef struct sqlite_backend_t sqlite_backend_t;
#include <library.h>
#include "backend.h"
/**
* @brief An SQLite based configuration backend.
*
* @b Constructors:
* - sqlite_backend_create()
*
* @ingroup backends
*/
struct sqlite_backend_t {
/**
* Implements backend_t interface
*/
backend_t backend;
};
/**
* @brief Create a backend_t instance implemented as sqlite backend.
*
* @return backend instance
*
* @ingroup backends
*/
backend_t *backend_create(void);
#endif /* SQLITE_BACKEND_H_ */
src/charon/config/backends/writeable_backend.h
-64
View File
@@ -1,64 +0,0 @@
/**
* @file writeable_backend.h
*
* @brief Interface of writeable_backend_t.
*
*/
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#ifndef WRITEABLE_BACKEND_H_
#define WRITEABLE_BACKEND_H_
typedef struct writeable_backend_t writeable_backend_t;
#include <library.h>
#include <config/backends/backend.h>
/**
* @brief A writeable backend extends backend_t by modification functions.
*
* @b Constructors:
* - writeable_backend_create()
*
* @ingroup backends
*/
struct writeable_backend_t {
/**
* Implements backend_t interface
*/
backend_t backend;
/**
* @brief Add a peer_config to the backend.
*
* @param this calling object
* @param config peer_config to add to the backend
*/
void (*add_cfg)(writeable_backend_t *this, peer_cfg_t *config);
/**
* @brief Create an iterator over all peer configs.
*
* @param this calling object
* @return iterator over peer configs
*/
iterator_t* (*create_iterator)(writeable_backend_t *this);
};
#endif /* WRITEABLE_BACKEND_H_ */
src/charon/config/child_cfg.c
+2 -8
View File
@@ -1,10 +1,3 @@
/**
* @file child_cfg.c
*
* @brief Implementation of child_cfg_t.
*
*/
/*
* Copyright (C) 2005-2007 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,9 +12,10 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include "child_cfg.h"
#include <daemon.h>
src/charon/config/child_cfg.h
+25 -49
View File
@@ -1,10 +1,3 @@
/**
* @file child_cfg.h
*
* @brief Interface of child_cfg_t.
*
*/
/*
* Copyright (C) 2005-2007 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup child_cfg child_cfg
* @{ @ingroup config
*/
#ifndef CHILD_CFG_H_
@@ -32,11 +32,9 @@ typedef struct child_cfg_t child_cfg_t;
#include <config/traffic_selector.h>
/**
* @brief Mode of an CHILD_SA.
* Mode of an CHILD_SA.
*
* These are equal to those defined in XFRM, so don't change.
*
* @ingroup config
*/
enum mode_t {
/** transport mode, no inner address */
@@ -53,7 +51,7 @@ enum mode_t {
extern enum_name_t *mode_names;
/**
* @brief A child_cfg_t defines the config template for a CHILD_SA.
* A child_cfg_t defines the config template for a CHILD_SA.
*
* After creation, proposals and traffic selectors may be added to the config.
* A child_cfg object is referenced multiple times, and is not thread save.
@@ -62,51 +60,42 @@ extern enum_name_t *mode_names;
* A reference counter handles the number of references hold to this config.
*
* @see peer_cfg_t to get an overview over the configurations.
*
* @b Constructors:
* - child_cfg_create()
*
* @ingroup config
*/
struct child_cfg_t {
/**
* @brief Get the name of the child_cfg.
* Get the name of the child_cfg.
*
* @param this calling object
* @return child_cfg's name
*/
char *(*get_name) (child_cfg_t *this);
/**
* @brief Add a proposal to the list.
* Add a proposal to the list.
*
* The proposals are stored by priority, first added
* is the most prefered.
* After add, proposal is owned by child_cfg.
*
* @param this calling object
* @param proposal proposal to add
*/
void (*add_proposal) (child_cfg_t *this, proposal_t *proposal);
/**
* @brief Get the list of proposals for the CHILD_SA.
* Get the list of proposals for the CHILD_SA.
*
* Resulting list and all of its proposals must be freed after use.
*
* @param this calling object
* @param strip_dh TRUE strip out diffie hellman groups
* @return list of proposals
*/
linked_list_t* (*get_proposals)(child_cfg_t *this, bool strip_dh);
/**
* @brief Select a proposal from a supplied list.
* Select a proposal from a supplied list.
*
* Returned propsal is newly created and must be destroyed after usage.
*
* @param this calling object
* @param proposals list from from wich proposals are selected
* @param strip_dh TRUE strip out diffie hellman groups
* @return selected proposal, or NULL if nothing matches
@@ -115,12 +104,11 @@ struct child_cfg_t {
bool strip_dh);
/**
* @brief Add a traffic selector to the config.
* Add a traffic selector to the config.
*
* Use the "local" parameter to add it for the local or the remote side.
* After add, traffic selector is owned by child_cfg.
*
* @param this calling object
* @param local TRUE for local side, FALSE for remote
* @param ts traffic_selector to add
*/
@@ -128,7 +116,7 @@ struct child_cfg_t {
traffic_selector_t *ts);
/**
* @brief Get a list of traffic selectors to use for the CHILD_SA.
* Get a list of traffic selectors to use for the CHILD_SA.
*
* The config contains two set of traffic selectors, one for the local
* side, one for the remote side.
@@ -139,7 +127,6 @@ struct child_cfg_t {
* the "host" parameter to narrow such traffic selectors to that address.
* Resulted list and its traffic selectors must be destroyed after use.
*
* @param this calling object
* @param local TRUE for TS on local side, FALSE for remote
* @param supplied list with TS to select from, or NULL
* @param host address to use for narrowing "dynamic" TS', or NULL
@@ -150,23 +137,21 @@ struct child_cfg_t {
host_t *host);
/**
* @brief Get the updown script to run for the CHILD_SA.
* Get the updown script to run for the CHILD_SA.
*
* @param this calling object
* @return path to updown script
*/
char* (*get_updown)(child_cfg_t *this);
/**
* @brief Should we allow access to the local host (gateway)?
* Should we allow access to the local host (gateway)?
*
* @param this calling object
* @return value of hostaccess flag
*/
bool (*get_hostaccess) (child_cfg_t *this);
/**
* @brief Get the lifetime of a CHILD_SA.
* Get the lifetime of a CHILD_SA.
*
* If "rekey" is set to TRUE, a lifetime is returned before the first
* rekeying should be started. If it is FALSE, the actual lifetime is
@@ -174,57 +159,50 @@ struct child_cfg_t {
* The rekey time automatically contains a jitter to avoid simlutaneous
* rekeying.
*
* @param this child_cfg
* @param rekey TRUE to get rekey time
* @return lifetime in seconds
*/
u_int32_t (*get_lifetime) (child_cfg_t *this, bool rekey);
/**
* @brief Get the mode to use for the CHILD_SA.
* Get the mode to use for the CHILD_SA.
*
* The mode is either tunnel, transport or BEET. The peer must agree
* on the method, fallback is tunnel mode.
*
* @param this child_cfg
* @return lifetime in seconds
*/
mode_t (*get_mode) (child_cfg_t *this);
/**
* @brief Get the DH group to use for CHILD_SA setup.
* Get the DH group to use for CHILD_SA setup.
*
* @param this calling object
* @return dh group to use
* @return dh group to use
*/
diffie_hellman_group_t (*get_dh_group)(child_cfg_t *this);
/**
* @brief Get a new reference.
* Get a new reference.
*
* Get a new reference to this child_cfg by increasing
* it's internal reference counter.
* Do not call get_ref or any other function until you
* already have a reference. Otherwise the object may get
* destroyed while calling get_ref(),
*
* @param this calling object
*/
void (*get_ref) (child_cfg_t *this);
/**
* @brief Destroys the child_cfg object.
* Destroys the child_cfg object.
*
* Decrements the internal reference counter and
* destroys the child_cfg when it reaches zero.
*
* @param this calling object
*/
void (*destroy) (child_cfg_t *this);
};
/**
* @brief Create a configuration template for CHILD_SA setup.
* Create a configuration template for CHILD_SA setup.
*
* The "name" string gets cloned.
* Lifetimes are in seconds. To prevent to peers to start rekeying at the
@@ -241,11 +219,9 @@ struct child_cfg_t {
* @param hostaccess TRUE to allow access to the local host
* @param mode mode to propose for CHILD_SA, transport, tunnel or BEET
* @return child_cfg_t object
*
* @ingroup config
*/
child_cfg_t *child_cfg_create(char *name, u_int32_t lifetime,
u_int32_t rekeytime, u_int32_t jitter,
char *updown, bool hostaccess, mode_t mode);
#endif /* CHILD_CFG_H_ */
#endif /* CHILD_CFG_H_ @} */
src/charon/config/credentials/local_credential_store.c
-1620
View File
File diff suppressed because it is too large Load Diff
src/charon/config/credentials/local_credential_store.h
-63
View File
@@ -1,63 +0,0 @@
/**
* @file local_credential_store.h
*
* @brief Interface of local_credential_store_t.
*
*/
/*
* Copyright (C) 2006 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#ifndef LOCAL_CREDENTIAL_H_
#define LOCAL_CREDENTIAL_H_
typedef struct local_credential_store_t local_credential_store_t;
#include <library.h>
#include <credential_store.h>
#include <daemon.h>
/**
* @brief A credential_store_t implementation using simple credentail lists.
*
* The local_credential_store_t class implements the credential_store_t interface
* as simple as possible. The credentials are stored in lists, and are loaded from
* files on the disk.
* Shared secret are not handled yet, so get_shared_secret always returns NOT_FOUND.
*
* @b Constructors:
* - local_credential_store_create(bool strict)
*
* @ingroup config
*/
struct local_credential_store_t {
/**
* Implements credential_store_t interface
*/
credential_store_t credential_store;
};
/**
* @brief Creates a local_credential_store_t instance.
*
* @return credential store instance.
*
* @ingroup config
*/
local_credential_store_t *local_credential_store_create(void);
#endif /* LOCAL_CREDENTIAL_H_ */
src/charon/config/ike_cfg.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file ike_cfg.c
*
* @brief Implementation of ike_cfg_t.
*
*/
/*
* Copyright (C) 2005-2007 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include "ike_cfg.h"
src/charon/config/ike_cfg.h
+20 -39
View File
@@ -1,10 +1,3 @@
/**
* @file ike_cfg.h
*
* @brief Interface of ike_cfg_t.
*
*/
/*
* Copyright (C) 2005-2007 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup ike_cfg ike_cfg
* @{ @ingroup config
*/
#ifndef IKE_CFG_H_
@@ -34,115 +34,98 @@ typedef struct ike_cfg_t ike_cfg_t;
#include <crypto/diffie_hellman.h>
/**
* @brief An ike_cfg_t defines the rules to set up an IKE_SA.
* An ike_cfg_t defines the rules to set up an IKE_SA.
*
* @see peer_cfg_t to get an overview over the configurations.
*
* @b Constructors:
* - ike_cfg_create()
*
* @ingroup config
*/
struct ike_cfg_t {
/**
* @brief Get own address.
* Get own address.
*
* @param this calling object
* @return host information as host_t object
*/
host_t* (*get_my_host) (ike_cfg_t *this);
/**
* @brief Get peers address.
* Get peers address.
*
* @param this calling object
* @return host information as host_t object
*/
host_t* (*get_other_host) (ike_cfg_t *this);
/**
* @brief Adds a proposal to the list.
* Adds a proposal to the list.
*
* The first added proposal has the highest priority, the last
* added the lowest.
*
* @param this calling object
* @param proposal proposal to add
*/
void (*add_proposal) (ike_cfg_t *this, proposal_t *proposal);
/**
* @brief Returns a list of all supported proposals.
* Returns a list of all supported proposals.
*
* Returned list and its proposals must be destroyed after use.
*
* @param this calling object
* @return list containing all the proposals
*/
linked_list_t* (*get_proposals) (ike_cfg_t *this);
/**
* @brief Select a proposed from suggested proposals.
* Select a proposed from suggested proposals.
*
* Returned proposal must be destroyed after use.
*
* @param this calling object
* @param proposals list of proposals to select from
* @return selected proposal, or NULL if none matches.
*/
proposal_t *(*select_proposal) (ike_cfg_t *this, linked_list_t *proposals);
/**
* @brief Should we send a certificate request in IKE_SA_INIT?
* Should we send a certificate request in IKE_SA_INIT?
*
* @param this calling object
* @return certificate request sending policy
*/
bool (*send_certreq) (ike_cfg_t *this);
/**
* @brief Enforce UDP encapsulation by faking NATD notifies?
* Enforce UDP encapsulation by faking NATD notifies?
*
* @param this calling object
* @return TRUE to enfoce UDP encapsulation
*/
bool (*force_encap) (ike_cfg_t *this);
/**
* @brief Get the DH group to use for IKE_SA setup.
* Get the DH group to use for IKE_SA setup.
*
* @param this calling object
* @return dh group to use for initialization
*/
diffie_hellman_group_t (*get_dh_group)(ike_cfg_t *this);
/**
* @brief Get a new reference to this ike_cfg.
* Get a new reference to this ike_cfg.
*
* Get a new reference to this ike_cfg by increasing
* it's internal reference counter.
* Do not call get_ref or any other function until you
* already have a reference. Otherwise the object may get
* destroyed while calling get_ref(),
*
* @param this calling object
*/
void (*get_ref) (ike_cfg_t *this);
/**
* @brief Destroys a ike_cfg_t object.
* Destroys a ike_cfg_t object.
*
* Decrements the internal reference counter and
* destroys the ike_cfg when it reaches zero.
*
* @param this calling object
*/
void (*destroy) (ike_cfg_t *this);
};
/**
* @brief Creates a ike_cfg_t object.
* Creates a ike_cfg_t object.
*
* Supplied hosts become owned by ike_cfg, the name gets cloned.
*
@@ -152,10 +135,8 @@ struct ike_cfg_t {
* @param my_host host_t representing local address
* @param other_host host_t representing remote address
* @return ike_cfg_t object.
*
* @ingroup config
*/
ike_cfg_t *ike_cfg_create(bool certreq, bool force_encap,
host_t *my_host, host_t *other_host);
#endif /* IKE_CFG_H_ */
#endif /* IKE_CFG_H_ @} */
src/charon/config/peer_cfg.c
+46 -67
View File
@@ -1,10 +1,3 @@
/**
* @file peer_cfg.c
*
* @brief Implementation of peer_cfg_t.
*
*/
/*
* Copyright (C) 2007 Tobias Brunner
* Copyright (C) 2005-2007 Martin Willi
@@ -20,6 +13,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <string.h>
@@ -29,7 +24,6 @@
#include <utils/linked_list.h>
#include <utils/identification.h>
#include <crypto/ietf_attr_list.h>
ENUM(cert_policy_names, CERT_ALWAYS_SEND, CERT_NEVER_SEND,
"CERT_ALWAYS_SEND",
@@ -96,21 +90,6 @@ struct private_peer_cfg_t {
*/
identification_t *other_id;
/**
* we have a cert issued by this CA
*/
identification_t *my_ca;
/**
* we require the other end to have a cert issued by this CA
*/
identification_t *other_ca;
/**
* we require the other end to belong to at least one group
*/
linked_list_t *groups;
/**
* should we send a certificate
*/
@@ -180,6 +159,11 @@ struct private_peer_cfg_t {
* virtual IP to use remotly
*/
host_t *other_virtual_ip;
/**
* required authorization constraints
*/
auth_info_t *auth;
#ifdef P2P
/**
@@ -235,12 +219,26 @@ static void add_child_cfg(private_peer_cfg_t *this, child_cfg_t *child_cfg)
}
/**
* Implementation of peer_cfg_t.create_child_cfg_iterator.
* Implementation of peer_cfg_t.remove_child_cfg.
*/
static iterator_t* create_child_cfg_iterator(private_peer_cfg_t *this)
static void remove_child_cfg(private_peer_cfg_t *this, enumerator_t *enumerator)
{
return this->child_cfgs->create_iterator_locked(this->child_cfgs,
&this->mutex);
pthread_mutex_lock(&this->mutex);
this->child_cfgs->remove_at(this->child_cfgs, enumerator);
pthread_mutex_unlock(&this->mutex);
}
/**
* Implementation of peer_cfg_t.create_child_cfg_enumerator.
*/
static enumerator_t* create_child_cfg_enumerator(private_peer_cfg_t *this)
{
enumerator_t *enumerator;
pthread_mutex_lock(&this->mutex);
enumerator = this->child_cfgs->create_enumerator(this->child_cfgs);
return enumerator_create_cleaner(enumerator,
(void*)pthread_mutex_unlock, &this->mutex);
}
/**
@@ -267,10 +265,10 @@ static child_cfg_t* select_child_cfg(private_peer_cfg_t *this,
host_t *my_host, host_t *other_host)
{
child_cfg_t *current, *found = NULL;
iterator_t *iterator;
enumerator_t *enumerator;
iterator = create_child_cfg_iterator(this);
while (iterator->iterate(iterator, (void**)&current))
enumerator = create_child_cfg_enumerator(this);
while (enumerator->enumerate(enumerator, &current))
{
if (contains_ts(current, TRUE, my_ts, my_host) &&
contains_ts(current, FALSE, other_ts, other_host))
@@ -280,7 +278,7 @@ static child_cfg_t* select_child_cfg(private_peer_cfg_t *this,
break;
}
}
iterator->destroy(iterator);
enumerator->destroy(enumerator);
return found;
}
@@ -300,30 +298,6 @@ static identification_t *get_other_id(private_peer_cfg_t *this)
return this->other_id;
}
/**
* Implementation of peer_cfg_t.get_my_ca
*/
static identification_t *get_my_ca(private_peer_cfg_t *this)
{
return this->my_ca;
}
/**
* Implementation of peer_cfg_t.get_other_ca
*/
static identification_t *get_other_ca(private_peer_cfg_t *this)
{
return this->other_ca;
}
/**
* Implementation of peer_cfg_t.get_groups
*/
static linked_list_t *get_groups(private_peer_cfg_t *this)
{
return this->groups;
}
/**
* Implementation of peer_cfg_t.get_cert_policy.
*/
@@ -452,6 +426,14 @@ static host_t* get_other_virtual_ip(private_peer_cfg_t *this, host_t *suggestion
}
return suggestion->clone(suggestion);
}
/**
* Implementation of peer_cfg_t.get_auth.
*/
static auth_info_t* get_auth(private_peer_cfg_t *this)
{
return this->auth;
}
#ifdef P2P
/**
@@ -502,15 +484,13 @@ static void destroy(private_peer_cfg_t *this)
this->child_cfgs->destroy_offset(this->child_cfgs, offsetof(child_cfg_t, destroy));
this->my_id->destroy(this->my_id);
this->other_id->destroy(this->other_id);
DESTROY_IF(this->my_ca);
DESTROY_IF(this->other_ca);
DESTROY_IF(this->my_virtual_ip);
DESTROY_IF(this->other_virtual_ip);
this->auth->destroy(this->auth);
#ifdef P2P
DESTROY_IF(this->p2p_mediated_by);
DESTROY_IF(this->peer_id);
#endif /* P2P */
ietfAttr_list_destroy(this->groups);
free(this->name);
free(this);
}
@@ -521,8 +501,7 @@ static void destroy(private_peer_cfg_t *this)
*/
peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
identification_t *my_id, identification_t *other_id,
identification_t *my_ca, identification_t *other_ca,
linked_list_t *groups, cert_policy_t cert_policy,
cert_policy_t cert_policy,
auth_method_t auth_method, eap_type_t eap_type,
u_int32_t eap_vendor,
u_int32_t keyingtries, u_int32_t rekey_time,
@@ -540,13 +519,11 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
this->public.get_ike_version = (u_int(*) (peer_cfg_t *))get_ike_version;
this->public.get_ike_cfg = (ike_cfg_t* (*) (peer_cfg_t *))get_ike_cfg;
this->public.add_child_cfg = (void (*) (peer_cfg_t *, child_cfg_t*))add_child_cfg;
this->public.create_child_cfg_iterator = (iterator_t* (*) (peer_cfg_t *))create_child_cfg_iterator;
this->public.remove_child_cfg = (void(*)(peer_cfg_t*, enumerator_t*))remove_child_cfg;
this->public.create_child_cfg_enumerator = (enumerator_t* (*) (peer_cfg_t *))create_child_cfg_enumerator;
this->public.select_child_cfg = (child_cfg_t* (*) (peer_cfg_t *,linked_list_t*,linked_list_t*,host_t*,host_t*))select_child_cfg;
this->public.get_my_id = (identification_t* (*)(peer_cfg_t*))get_my_id;
this->public.get_other_id = (identification_t* (*)(peer_cfg_t *))get_other_id;
this->public.get_my_ca = (identification_t* (*)(peer_cfg_t *))get_my_ca;
this->public.get_other_ca = (identification_t* (*)(peer_cfg_t *))get_other_ca;
this->public.get_groups = (linked_list_t* (*)(peer_cfg_t *))get_groups;
this->public.get_cert_policy = (cert_policy_t (*) (peer_cfg_t *))get_cert_policy;
this->public.get_auth_method = (auth_method_t (*) (peer_cfg_t *))get_auth_method;
this->public.get_eap_type = (eap_type_t (*) (peer_cfg_t *,u_int32_t*))get_eap_type;
@@ -559,6 +536,7 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
this->public.get_dpd_action = (dpd_action_t (*) (peer_cfg_t *))get_dpd_action;
this->public.get_my_virtual_ip = (host_t* (*) (peer_cfg_t *))get_my_virtual_ip;
this->public.get_other_virtual_ip = (host_t* (*) (peer_cfg_t *, host_t *))get_other_virtual_ip;
this->public.get_auth = (auth_info_t*(*)(peer_cfg_t*))get_auth;
this->public.get_ref = (void(*)(peer_cfg_t *))get_ref;
this->public.destroy = (void(*)(peer_cfg_t *))destroy;
#ifdef P2P
@@ -575,9 +553,6 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
pthread_mutex_init(&this->mutex, NULL);
this->my_id = my_id;
this->other_id = other_id;
this->my_ca = my_ca;
this->other_ca = other_ca;
this->groups = groups;
this->cert_policy = cert_policy;
this->auth_method = auth_method;
this->eap_type = eap_type;
@@ -600,11 +575,15 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
this->dpd_action = dpd_action;
this->my_virtual_ip = my_virtual_ip;
this->other_virtual_ip = other_virtual_ip;
this->auth = auth_info_create();
this->refcount = 1;
#ifdef P2P
this->p2p_mediation = p2p_mediation;
this->p2p_mediated_by = p2p_mediated_by;
this->peer_id = peer_id;
#else /* P2P */
DESTROY_IF(p2p_mediated_by);
DESTROY_IF(peer_id);
#endif /* P2P */
return &this->public;
src/charon/config/peer_cfg.h
+67 -110
View File
@@ -1,10 +1,3 @@
/**
* @file peer_cfg.h
*
* @brief Interface of peer_cfg_t.
*
*/
/*
* Copyright (C) 2007 Tobias Brunner
* Copyright (C) 2005-2007 Martin Willi
@@ -20,6 +13,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup peer_cfg peer_cfg
* @{ @ingroup config
*/
#ifndef PEER_CFG_H_
@@ -31,21 +31,20 @@ typedef struct peer_cfg_t peer_cfg_t;
#include <library.h>
#include <utils/identification.h>
#include <utils/linked_list.h>
#include <utils/enumerator.h>
#include <config/traffic_selector.h>
#include <config/proposal.h>
#include <config/ike_cfg.h>
#include <config/child_cfg.h>
#include <sa/authenticators/authenticator.h>
#include <sa/authenticators/eap/eap_method.h>
#include <credentials/auth_info.h>
/**
* Certificate sending policy. This is also used for certificate
* requests when using this definition for the other peer. If
* it is CERT_NEVER_SEND, a certreq is omitted, otherwise its
* included.
*
* @ingroup config
*
* @warning These definitions must be the same as in pluto/starter,
* as they are sent over the stroke socket.
@@ -61,17 +60,13 @@ enum cert_policy_t {
/**
* enum strings for cert_policy_t
*
* @ingroup config
*/
extern enum_name_t *cert_policy_names;
/**
* @brief Actions to take when a peer does not respond (dead peer detected).
* Actions to take when a peer does not respond (dead peer detected).
*
* These values are the same as in pluto/starter, so do not modify them!
*
* @ingroup config
*/
enum dpd_action_t {
/** DPD disabled */
@@ -90,7 +85,7 @@ enum dpd_action_t {
extern enum_name_t *dpd_action_names;
/**
* @brief Configuration of a peer, specified by IDs.
* Configuration of a peer, specified by IDs.
*
* The peer config defines a connection between two given IDs. It contains
* exactly one ike_cfg_t, which is use for initiation. Additionally, it contains
@@ -106,61 +101,67 @@ extern enum_name_t *dpd_action_names;
| - ... | | - dpd config | | - ... |-+
+---------------+ | - ... | +---------------+
+-------------------+
^
|
+-------------------+
| auth_info |
+-------------------+
| auth_items |
+-------------------+
@endverbatim
*
* @b Constructors:
* - peer_cfg_create()
*
* @ingroup config
* The auth_info_t object associated to the peer_cfg holds additional
* authorization constraints. A peer who wants to use a config needs to fullfil
* the requirements defined in auth_info.
*/
struct peer_cfg_t {
/**
* @brief Get the name of the peer_cfg.
* Get the name of the peer_cfg.
*
* Returned object is not getting cloned.
*
* @param this calling object
* @return peer_cfg's name
*/
char* (*get_name) (peer_cfg_t *this);
/**
* @brief Get the IKE version to use for initiating.
* Get the IKE version to use for initiating.
*
* @param this calling object
* @return IKE major version
*/
u_int (*get_ike_version)(peer_cfg_t *this);
/**
* @brief Get the IKE config to use for initiaton.
* Get the IKE config to use for initiaton.
*
* @param this calling object
* @return the IKE config to use
*/
ike_cfg_t* (*get_ike_cfg) (peer_cfg_t *this);
/**
* @brief Attach a CHILD config.
* Attach a CHILD config.
*
* @param this calling object
* @param child_cfg CHILD config to add
*/
void (*add_child_cfg) (peer_cfg_t *this, child_cfg_t *child_cfg);
/**
* @brief Create an iterator for all attached CHILD configs.
*
* @param this calling object
* @return an iterator over all CHILD configs.
* Detach a CHILD config, pointed to by an enumerator.
*
* @param enumerator enumerator indicating element position
*/
iterator_t* (*create_child_cfg_iterator) (peer_cfg_t *this);
void (*remove_child_cfg)(peer_cfg_t *this, enumerator_t *enumerator);
/**
* @brief Select a CHILD config from traffic selectors.
* Create an enumerator for all attached CHILD configs.
*
* @return an enumerator over all CHILD configs.
*/
enumerator_t* (*create_child_cfg_enumerator) (peer_cfg_t *this);
/**
* Select a CHILD config from traffic selectors.
*
* @param this calling object
* @param my_ts TS for local side
* @param other_ts TS for remote side
* @param my_host host to narrow down dynamic TS for local side
@@ -172,213 +173,175 @@ struct peer_cfg_t {
host_t *other_host);
/**
* @brief Get own ID.
* Get the authentication constraint items.
*
* @return auth_info object to manipulate requirements
*/
auth_info_t* (*get_auth)(peer_cfg_t *this);
/**
* Get own ID.
*
* @param this calling object
* @return own id
*/
identification_t* (*get_my_id)(peer_cfg_t *this);
/**
* @brief Get peers ID.
* Get peers ID.
*
* @param this calling object
* @return other id
*/
identification_t* (*get_other_id)(peer_cfg_t *this);
/**
* @brief Get own CA.
*
* @param this calling object
* @return own ca
*/
identification_t* (*get_my_ca)(peer_cfg_t *this);
/**
* @brief Get peer CA.
*
* @param this calling object
* @return other ca
*/
identification_t* (*get_other_ca)(peer_cfg_t *this);
/**
* @brief Get list of group attributes.
*
* @param this calling object
* @return linked list of group attributes
*/
linked_list_t* (*get_groups)(peer_cfg_t *this);
/**
* @brief Should be sent a certificate for this connection?
* Should be sent a certificate for this connection?
*
* @param this calling object
* @return certificate sending policy
*/
cert_policy_t (*get_cert_policy) (peer_cfg_t *this);
/**
* @brief Get the authentication method to use to authenticate us.
* Get the authentication method to use to authenticate us.
*
* @param this calling object
* @return authentication method
*/
auth_method_t (*get_auth_method) (peer_cfg_t *this);
/**
* @brief Get the EAP type to use for peer authentication.
* Get the EAP type to use for peer authentication.
*
* If vendor specific types are used, a vendor ID != 0 is returned to
* to vendor argument. Then the returned type is specific for that
* vendor ID.
*
* @param this calling object
* @param vendor receives vendor specifier, 0 for predefined EAP types
* @return authentication method
*/
eap_type_t (*get_eap_type) (peer_cfg_t *this, u_int32_t *vendor);
/**
* @brief Get the max number of retries after timeout.
* Get the max number of retries after timeout.
*
* @param this calling object
* @return max number retries
*/
u_int32_t (*get_keyingtries) (peer_cfg_t *this);
/**
* @brief Get a time to start rekeying (is randomized with jitter).
* Get a time to start rekeying (is randomized with jitter).
*
* @param this calling object
* @return time in s when to start rekeying, 0 disables rekeying
*/
u_int32_t (*get_rekey_time)(peer_cfg_t *this);
/**
* @brief Get a time to start reauthentication (is randomized with jitter).
* Get a time to start reauthentication (is randomized with jitter).
*
* @param this calling object
* @return time in s when to start reauthentication, 0 disables it
*/
u_int32_t (*get_reauth_time)(peer_cfg_t *this);
/**
* @brief Get the timeout of a rekeying/reauthenticating SA.
* Get the timeout of a rekeying/reauthenticating SA.
*
* @param thsi calling object
* @return timeout in s
*/
u_int32_t (*get_over_time)(peer_cfg_t *this);
/**
* @brief Use MOBIKE (RFC4555) if peer supports it?
* Use MOBIKE (RFC4555) if peer supports it?
*
* @param this calling object
* @return TRUE to enable MOBIKE support
*/
bool (*use_mobike) (peer_cfg_t *this);
/**
* @brief Get the DPD check interval.
* Get the DPD check interval.
*
* @param this calling object
* @return dpd_delay in seconds
*/
u_int32_t (*get_dpd_delay) (peer_cfg_t *this);
/**
* @brief What should be done with a CHILD_SA, when other peer does not respond.
* What should be done with a CHILD_SA, when other peer does not respond.
*
* @param this calling object
* @return dpd action
*/
dpd_action_t (*get_dpd_action) (peer_cfg_t *this);
/**
* @brief Get a virtual IP for the local peer.
* Get a virtual IP for the local peer.
*
* If no virtual IP should be used, NULL is returned. %any means to request
* a virtual IP using configuration payloads. A specific address is also
* used for a request and may be changed by the server.
*
* @param this peer_cfg
* @param suggestion NULL, %any or specific
* @return clone of an IP, %any or NULL
*/
host_t* (*get_my_virtual_ip) (peer_cfg_t *this);
/**
* @brief Get a virtual IP for the remote peer.
* Get a virtual IP for the remote peer.
*
* An IP may be supplied, if one was requested by the initiator. However,
* the suggestion is not more as it says, any address may be returned, even
* NULL to not use virtual IPs.
*
* @param this peer_cfg
* @param suggestion NULL, %any or specific
* @return clone of an IP to use
*/
host_t* (*get_other_virtual_ip) (peer_cfg_t *this, host_t *suggestion);
#ifdef P2P
/**
* @brief Is this a mediation connection?
* Is this a mediation connection?
*
* @param this peer_cfg
* @return TRUE, if this is a mediation connection
*/
bool (*is_mediation) (peer_cfg_t *this);
/**
* @brief Get peer_cfg of the connection this one is mediated through.
* Get peer_cfg of the connection this one is mediated through.
*
* @param this peer_cfg
* @return reference to peer_cfg of the mediation connection
*/
peer_cfg_t* (*get_mediated_by) (peer_cfg_t *this);
/**
* @brief Get the id of the other peer at the mediation server.
* Get the id of the other peer at the mediation server.
*
* This is the leftid of the peer's connection with the mediation server.
*
* If it is not configured, it is assumed to be the same as the right id
* of this connection.
*
* @param this peer_cfg
* @return the id of the other peer
*/
identification_t* (*get_peer_id) (peer_cfg_t *this);
#endif /* P2P */
/**
* @brief Get a new reference.
* Get a new reference.
*
* Get a new reference to this peer_cfg by increasing
* it's internal reference counter.
* Do not call get_ref or any other function until you
* already have a reference. Otherwise the object may get
* destroyed while calling get_ref(),
*
* @param this calling object
*/
void (*get_ref) (peer_cfg_t *this);
/**
* @brief Destroys the peer_cfg object.
* Destroys the peer_cfg object.
*
* Decrements the internal reference counter and
* destroys the peer_cfg when it reaches zero.
*
* @param this calling object
*/
void (*destroy) (peer_cfg_t *this);
};
/**
* @brief Create a configuration object for IKE_AUTH and later.
* Create a configuration object for IKE_AUTH and later.
*
* name-string gets cloned, ID's not.
* Virtual IPs are used if they are != NULL. A %any host means the virtual
@@ -392,9 +355,6 @@ struct peer_cfg_t {
* @param ike_cfg IKE config to use when acting as initiator
* @param my_id identification_t for ourselves
* @param other_id identification_t for the remote guy
* @param my_ca CA to use for us
* @param other_ca CA to use for other
* @param groups list of group memberships
* @param cert_policy should we send a certificate payload?
* @param auth_method auth method to use to authenticate us
* @param eap_type EAP type to use for peer authentication
@@ -414,13 +374,10 @@ struct peer_cfg_t {
* @param p2p_mediated_by name of the mediation connection to mediate through
* @param peer_id ID that identifies our peer at the mediation server
* @return peer_cfg_t object
*
* @ingroup config
*/
peer_cfg_t *peer_cfg_create(char *name, u_int ikev_version, ike_cfg_t *ike_cfg,
identification_t *my_id, identification_t *other_id,
identification_t *my_ca, identification_t *other_ca,
linked_list_t *groups, cert_policy_t cert_policy,
cert_policy_t cert_policy,
auth_method_t auth_method, eap_type_t eap_type,
u_int32_t eap_vendor,
u_int32_t keyingtries, u_int32_t rekey_time,
@@ -431,4 +388,4 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ikev_version, ike_cfg_t *ike_cfg,
bool p2p_mediation, peer_cfg_t *p2p_mediated_by,
identification_t *peer_id);
#endif /* PEER_CFG_H_ */
#endif /* PEER_CFG_H_ @} */
src/charon/config/proposal.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file proposal.c
*
* @brief Implementation of proposal_t.
*
*/
/*
* Copyright (C) 2006 Martin Willi
* Hochschule fuer Technik Rapperswil
@@ -18,6 +11,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <string.h>
src/charon/config/proposal.h
+38 -76
View File
@@ -1,10 +1,3 @@
/**
* @file proposal.h
*
* @brief Interface of proposal_t.
*
*/
/*
* Copyright (C) 2006 Martin Willi
* Hochschule fuer Technik Rapperswil
@@ -18,6 +11,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup proposal proposal
* @{ @ingroup config
*/
#ifndef PROPOSAL_H_
@@ -40,8 +40,6 @@ typedef struct proposal_t proposal_t;
/**
* Protocol ID of a proposal.
*
* @ingroup config
*/
enum protocol_id_t {
PROTO_NONE = 0,
@@ -52,16 +50,12 @@ enum protocol_id_t {
/**
* enum names for protocol_id_t
*
* @ingroup config
*/
extern enum_name_t *protocol_id_names;
/**
* Type of a transform, as in IKEv2 RFC 3.3.2.
*
* @ingroup config
*/
enum transform_type_t {
UNDEFINED_TRANSFORM_TYPE = 241,
@@ -74,16 +68,12 @@ enum transform_type_t {
/**
* enum names for transform_type_t.
*
* @ingroup config
*/
extern enum_name_t *transform_type_names;
/**
* Extended sequence numbers, as in IKEv2 RFC 3.3.2.
*
* @ingroup config
*/
enum extended_sequence_numbers_t {
NO_EXT_SEQ_NUMBERS = 0,
@@ -92,8 +82,6 @@ enum extended_sequence_numbers_t {
/**
* enum strings for extended_sequence_numbers_t.
*
* @ingroup config
*/
extern enum_name_t *extended_sequence_numbers_names;
@@ -102,8 +90,6 @@ extern enum_name_t *extended_sequence_numbers_names;
/**
* Struct used to store different kinds of algorithms. The internal
* lists of algorithms contain such structures.
*
* @ingroup config
*/
struct algorithm_t {
/**
@@ -118,22 +104,17 @@ struct algorithm_t {
};
/**
* @brief Stores a set of algorithms used for an SA.
* Stores a set of algorithms used for an SA.
*
* A proposal stores algorithms for a specific
* protocol. It can store algorithms for one protocol.
* Proposals with multiple protocols are not supported,
* as it's not specified in RFC4301 anymore.
*
* @b Constructors:
* - proposal_create()
*
* @ingroup config
*/
struct proposal_t {
/**
* @brief Add an algorithm to the proposal.
* Add an algorithm to the proposal.
*
* The algorithms are stored by priority, first added
* is the most preferred.
@@ -144,120 +125,103 @@ struct proposal_t {
* integrity_algorithm_t, dh_group_number_t and
* extended_sequence_numbers_t.
*
* @param this calling object
* @param type kind of algorithm
* @param alg identifier for algorithm
* @param key_size key size to use
* @param type kind of algorithm
* @param alg identifier for algorithm
* @param key_size key size to use
*/
void (*add_algorithm) (proposal_t *this, transform_type_t type, u_int16_t alg, size_t key_size);
/**
* @brief Get an iterator over algorithms for a specifc algo type.
* Get an iterator over algorithms for a specifc algo type.
*
* @param this calling object
* @param type kind of algorithm
* @return iterator over algorithm_t's
* @param type kind of algorithm
* @return iterator over algorithm_t's
*/
iterator_t *(*create_algorithm_iterator) (proposal_t *this, transform_type_t type);
/**
* @brief Get the algorithm for a type to use.
* Get the algorithm for a type to use.
*
* If there are multiple algorithms, only the first is returned.
*
* @param this calling object
* @param type kind of algorithm
* @param[out] algo pointer which receives algorithm and key size
* @return TRUE if algorithm of this kind available
* @param type kind of algorithm
* @param algo pointer which receives algorithm and key size
* @return TRUE if algorithm of this kind available
*/
bool (*get_algorithm) (proposal_t *this, transform_type_t type, algorithm_t** algo);
/**
* @brief Check if the proposal has a specific DH group.
* Check if the proposal has a specific DH group.
*
* @param this calling object
* @param group group to check for
* @return TRUE if algorithm included
* @param group group to check for
* @return TRUE if algorithm included
*/
bool (*has_dh_group) (proposal_t *this, diffie_hellman_group_t group);
/**
* @brief Compare two proposal, and select a matching subset.
* Compare two proposal, and select a matching subset.
*
* If the proposals are for the same protocols (AH/ESP), they are
* compared. If they have at least one algorithm of each type
* in common, a resulting proposal of this kind is created.
*
* @param this calling object
* @param other proposal to compair agains
* @return
* - selected proposal, if possible
* - NULL, if proposals don't match
* @param other proposal to compair agains
* @return selected proposal, NULL if proposals don't match
*/
proposal_t *(*select) (proposal_t *this, proposal_t *other);
/**
* @brief Get the protocol ID of the proposal.
* Get the protocol ID of the proposal.
*
* @param this calling object
* @return protocol of the proposal
* @return protocol of the proposal
*/
protocol_id_t (*get_protocol) (proposal_t *this);
/**
* @brief Get the SPI of the proposal.
* Get the SPI of the proposal.
*
* @param this calling object
* @return spi for proto
* @return spi for proto
*/
u_int64_t (*get_spi) (proposal_t *this);
/**
* @brief Set the SPI of the proposal.
* Set the SPI of the proposal.
*
* @param this calling object
* @param spi spi to set for proto
* @param spi spi to set for proto
*/
void (*set_spi) (proposal_t *this, u_int64_t spi);
/**
* @brief Clone a proposal.
* Clone a proposal.
*
* @param this proposal to clone
* @return clone of it
* @return clone of proposal
*/
proposal_t *(*clone) (proposal_t *this);
/**
* @brief Destroys the proposal object.
*
* @param this calling object
* Destroys the proposal object.
*/
void (*destroy) (proposal_t *this);
};
/**
* @brief Create a child proposal for AH, ESP or IKE.
* Create a child proposal for AH, ESP or IKE.
*
* @param protocol protocol, such as PROTO_ESP
* @return proposal_t object
*
* @ingroup config
*/
proposal_t *proposal_create(protocol_id_t protocol);
/**
* @brief Create a default proposal if nothing further specified.
* Create a default proposal if nothing further specified.
*
* @param protocol protocol, such as PROTO_ESP
* @return proposal_t object
*
* @ingroup config
*/
proposal_t *proposal_create_default(protocol_id_t protocol);
/**
* @brief Create a proposal from a string identifying the algorithms.
* Create a proposal from a string identifying the algorithms.
*
* The string is in the same form as a in the ipsec.conf file.
* E.g.: aes128-sha2_256-modp2048
@@ -268,9 +232,7 @@ proposal_t *proposal_create_default(protocol_id_t protocol);
* @param protocol protocol, such as PROTO_ESP
* @param algs algorithms as string
* @return proposal_t object
*
* @ingroup config
*/
proposal_t *proposal_create_from_string(protocol_id_t protocol, const char *algs);
#endif /* PROPOSAL_H_ */
#endif /* PROPOSAL_H_ @} */
src/charon/config/traffic_selector.c
+19 -10
View File
@@ -1,10 +1,3 @@
/**
* @file traffic_selector.c
*
* @brief Implementation of traffic_selector_t.
*
*/
/*
* Copyright (C) 2007 Tobias Brunner
* Copyright (C) 2005-2007 Martin Willi
@@ -20,6 +13,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <arpa/inet.h>
@@ -276,11 +271,25 @@ static int print(FILE *stream, const struct printf_info *info,
}
/**
* register printf() handlers
* arginfo handler for printf() traffic selector
*/
static void __attribute__ ((constructor))print_register()
static int arginfo(const struct printf_info *info, size_t n, int *argtypes)
{
register_printf_function(PRINTF_TRAFFIC_SELECTOR, print, arginfo_ptr);
if (n > 0)
{
argtypes[0] = PA_POINTER;
}
return 1;
}
/**
* return printf hook functions for a chunk
*/
printf_hook_functions_t traffic_selector_get_printf_hooks()
{
printf_hook_functions_t hooks = {print, arginfo};
return hooks;
}
/**
src/charon/config/traffic_selector.h
+38 -63
View File
@@ -1,10 +1,3 @@
/**
* @file traffic_selector.h
*
* @brief Interface of traffic_selector_t.
*
*/
/*
* Copyright (C) 2007 Tobias Brunner
* Copyright (C) 2005-2006 Martin Willi
@@ -20,6 +13,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup traffic_selector traffic_selector
* @{ @ingroup config
*/
#ifndef TRAFFIC_SELECTOR_H_
@@ -33,8 +33,6 @@ typedef struct traffic_selector_t traffic_selector_t;
/**
* Traffic selector types.
*
* @ingroup config
*/
enum ts_type_t {
@@ -63,29 +61,20 @@ enum ts_type_t {
extern enum_name_t *ts_type_name;
/**
* @brief Object representing a traffic selector entry.
* Object representing a traffic selector entry.
*
* A traffic selector defines an range of addresses
* and a range of ports. IPv6 is not fully supported yet.
*
* @b Constructors:
* - traffic_selector_create_from_bytes()
* - traffic_selector_create_from_string()
*
* @todo Add IPv6 support
*
* @ingroup config
*/
struct traffic_selector_t {
/**
* @brief Compare two traffic selectors, and create a new one
* Compare two traffic selectors, and create a new one
* which is the largest subset of both (subnet & port).
*
* Resulting traffic_selector is newly created and must be destroyed.
*
* @param this first to compare
* @param other second to compare
* @param other traffic selector to compare
* @return
* - created subset of them
* - or NULL if no match between this and other
@@ -94,73 +83,66 @@ struct traffic_selector_t {
traffic_selector_t *other);
/**
* @brief Clone a traffic selector.
* Clone a traffic selector.
*
* @param this traffic selector to clone
* @return clone of it
*/
traffic_selector_t *(*clone) (traffic_selector_t *this);
/**
* @brief Get starting address of this ts as a chunk.
* Get starting address of this ts as a chunk.
*
* Chunk is in network order gets allocated.
*
* @param this called object
* @return chunk containing the address
*/
chunk_t (*get_from_address) (traffic_selector_t *this);
/**
* @brief Get ending address of this ts as a chunk.
* Get ending address of this ts as a chunk.
*
* Chunk is in network order gets allocated.
*
* @param this called object
* @return chunk containing the address
*/
chunk_t (*get_to_address) (traffic_selector_t *this);
/**
* @brief Get starting port of this ts.
* Get starting port of this ts.
*
* Port is in host order, since the parser converts it.
* Size depends on protocol.
*
* @param this called object
* @return port
*/
u_int16_t (*get_from_port) (traffic_selector_t *this);
/**
* @brief Get ending port of this ts.
* Get ending port of this ts.
*
* Port is in host order, since the parser converts it.
* Size depends on protocol.
*
* @param this called object
* @return port
*/
u_int16_t (*get_to_port) (traffic_selector_t *this);
/**
* @brief Get the type of the traffic selector.
* Get the type of the traffic selector.
*
* @param this called object
* @return ts_type_t specifying the type
*/
ts_type_t (*get_type) (traffic_selector_t *this);
/**
* @brief Get the protocol id of this ts.
* Get the protocol id of this ts.
*
* @param this called object
* @return protocol id
*/
u_int8_t (*get_protocol) (traffic_selector_t *this);
/**
* @brief Check if the traffic selector is for a single host.
* Check if the traffic selector is for a single host.
*
* Traffic selector may describe the end of *-to-host tunnel. In this
* case, the address range is a single address equal to the hosts
@@ -168,61 +150,54 @@ struct traffic_selector_t {
* If host is NULL, the traffic selector is checked if it is a single host,
* but not a specific one.
*
* @param this called object
* @param host host_t specifying the address range
*/
bool (*is_host) (traffic_selector_t *this, host_t* host);
/**
* @brief Update the address of a traffic selector.
* Update the address of a traffic selector.
*
* Update the address range of a traffic selector, if it is
* constructed with the traffic_selector_create_dynamic().
*
* @param this called object
* @param host host_t specifying the address
*/
void (*set_address) (traffic_selector_t *this, host_t* host);
/**
* @brief Compare two traffic selectors for equality.
* Compare two traffic selectors for equality.
*
* @param this first to compare
* @param other second to compare with first
* @param other ts to compare with this
* @return pointer to a string.
*/
bool (*equals) (traffic_selector_t *this, traffic_selector_t *other);
/**
* @brief Check if a traffic selector is contained completly in another.
* Check if a traffic selector is contained completly in another.
*
* contains() allows to check if multiple traffic selectors are redundant.
*
* @param this ts that is contained in another
* @param other ts that contains this
* @return TRUE if other contains this completly, FALSE otherwise
*/
bool (*is_contained_in) (traffic_selector_t *this, traffic_selector_t *other);
/**
* @brief Check if a specific host is included in the address range of
* Check if a specific host is included in the address range of
* this traffic selector.
*
* @param this called object
* @param host the host to check
*/
bool (*includes) (traffic_selector_t *this, host_t *host);
/**
* @brief Destroys the ts object
*
* @param this called object
* Destroys the ts object
*/
void (*destroy) (traffic_selector_t *this);
};
/**
* @brief Create a new traffic selector using human readable params.
* Create a new traffic selector using human readable params.
*
* @param protocol protocol for this ts, such as TCP or UDP
* @param type type of following addresses, such as TS_IPV4_ADDR_RANGE
@@ -233,8 +208,6 @@ struct traffic_selector_t {
* @return
* - traffic_selector_t object
* - NULL if invalid address strings/protocol
*
* @ingroup config
*/
traffic_selector_t *traffic_selector_create_from_string(
u_int8_t protocol, ts_type_t type,
@@ -242,7 +215,7 @@ traffic_selector_t *traffic_selector_create_from_string(
char *to_addr, u_int16_t to_port);
/**
* @brief Create a new traffic selector using data read from the net.
* Create a new traffic selector using data read from the net.
*
* There exists a mix of network and host order in the params.
* But the parser gives us this data in this format, so we
@@ -255,8 +228,6 @@ traffic_selector_t *traffic_selector_create_from_string(
* @param to_address end of address range as string, network
* @param to_port port number, host order
* @return traffic_selector_t object
*
* @ingroup config
*/
traffic_selector_t *traffic_selector_create_from_bytes(
u_int8_t protocol, ts_type_t type,
@@ -264,7 +235,7 @@ traffic_selector_t *traffic_selector_create_from_bytes(
chunk_t to_address, u_int16_t to_port);
/**
* @brief Create a new traffic selector defining a whole subnet.
* Create a new traffic selector defining a whole subnet.
*
* In most cases, definition of a traffic selector for full subnets
* is sufficient. This constructor creates a traffic selector for
@@ -278,15 +249,13 @@ traffic_selector_t *traffic_selector_create_from_bytes(
* @return
* - traffic_selector_t object
* - NULL if address family of net not supported
*
* @ingroup config
*/
traffic_selector_t *traffic_selector_create_from_subnet(
host_t *net, u_int8_t netbits,
u_int8_t protocol, u_int16_t port);
/**
* @brief Create a traffic selector for host-to-host cases.
* Create a traffic selector for host-to-host cases.
*
* For host2host or virtual IP setups, the traffic selectors gets
* created at runtime using the external/virtual IP. Using this constructor,
@@ -300,13 +269,19 @@ traffic_selector_t *traffic_selector_create_from_subnet(
* @return
* - traffic_selector_t object
* - NULL if type not supported
*
* @ingroup config
*/
traffic_selector_t *traffic_selector_create_dynamic(
u_int8_t protocol, ts_type_t type,
u_int16_t from_port, u_int16_t to_port);
#endif /* TRAFFIC_SELECTOR_H_ */
/**
* Get printf hooks for a traffic selector.
*
* Arguments are:
* traffic_selector_t *ts
* With the #-specifier, arguments are:
* linked_list_t *list containing traffic_selector_t*
*/
printf_hook_functions_t traffic_selector_get_printf_hooks();
/* vim: set ts=4 sw=4 noet: */
#endif /* TRAFFIC_SELECTOR_H_ @} */