/*****************************************************************************
* Copyright (c) 2005 Digi International Inc., All Rights Reserved
*
* This software contains proprietary and confidential information of Digi
* International Inc.  By accepting transfer of this copy, Recipient agrees
* to retain this software in confidence, to prevent disclosure to others,
* and to make no use of this software other than that for which it was
* delivered.  This is an unpublished copyrighted work of Digi International
* Inc.  Except as permitted by federal law, 17 USC 117, copying is strictly
* prohibited.
*
* Restricted Rights Legend
*
* Use, duplication, or disclosure by the Government is subject to
* restrictions set forth in sub-paragraph (c)(1)(ii) of The Rights in
* Technical Data and Computer Software clause at DFARS 252.227-7031 or
* subparagraphs (c)(1) and (2) of the Commercial Computer Software -
* Restricted Rights at 48 CFR 52.227-19, as applicable.
*
* Digi International Inc. 11001 Bren Road East, Minnetonka, MN 55343
*
*****************************************************************************/

#ifndef vpn_h

#define vpn_h


#include "ipsec/naipsec.h"

/*
 * The test program is going to create a VPN tunnel between a local network and
 * a remote network.  You determine the local and remote networks by setting
 * REMOTE_IP_SUBNET, REMOTE_IP_SUBNET_MASK, LOCAL_IP_SUBNET, LOCAL_IP_SUBNET_MASK.
 *
 * Set REMOTE_IP_SUBNET to the address of the network at the remote side of the
 * VPN tunnel.
 */
#define REMOTE_IP_SUBNET        "192.168.1.0"

/*
 * Set this to the subnet used on the remote network.
 */
#define REMOTE_IP_SUBNET_MASK   "255.255.255.0"

/*
 * Set this to the address of the network on the local side of the tunnel.
 */
#define LOCAL_IP_SUBNET         "192.168.3.0"

/*
 * Set this to the subnet mask of the local network.
 */
#define LOCAL_IP_SUBNET_MASK    "255.255.255.0"

/*
 * Set REMOTE_VPN_PEER_ADDRESS to the address of the remote VPN gateway
 * at the far end of the VPN tunnel.  This will be VPN peer that IPSEC
 * will communicate with to establish the tunnel
 */
#define REMOTE_VPN_PEER_ADDRESS     "192.168.2.1"

/*
 * Set LOCAL_VPN_ADDRESS to the address of the local VPN peer.  This is
 * the address bound to the network interface used to communicate with
 * the remote VPN peer. If you are using a single network interface the
 * the 2nd multi-home address is set to LOCAL_VPN_ADDRESS, eth0:0 for
 * Ethernet or wln0:0 for wireless.
 *
 * If you are using two network interfaces, IP address of 2nd interface could be
 * set to LOCAL_VPN_ADDRESS instead of eth0:0 address, but this example uses
 * eth0:0 instead.
 */
#define LOCAL_VPN_ADDRESS           "192.168.2.2"

/*
 * This is the address of the unit on the local VPN subnet.  It is used to
 * communicate with devices on the local subnet.  Devices on the local
 * subnet use this address as their gateway.
 */
#define OUR_ADDRESS_ON_LOCAL_SUBNET "192.168.3.1"

/*
 * Subnet mask of VPN tunnel.
 */
#define VPN_SUBNET_MASK             "255.255.255.0"

/*
 * A preshared key is used to authenticate with the remote VPN peer.  This
 * key be set to the same value on both VPN peers.
 */
#define SHARED_KEY                  "ThePresharedKey123"

/*
 * Set PHASE1_ENCRYPTION_ALGORITHM to the encryption algorithm to be
 * used during the IKE phase 1 negotiation.  A list of algorithms is
 * contained in naipsec.h.
 */
#define PHASE1_ENCRYPTION_ALGORITHM         NA_IPSEC_ENCRYPTION_DES

/*
 * PHASE1_ENCRYPTION_KEY_LENGTH should be set to the encryption key length
 * to be used for IKE phase 1 negotiations.  If you selected an algorithm
 * with a fixed keylength, like DES or triple-DES, then set
 * PHASE1_ENCRYPTION_KEY_LENGTH to 0 to use the default keylength.
 */
#define PHASE1_ENCRYPTION_KEY_LENGTH        (0)

/*
 * Set PHASE1_AUTHENTICATION_ALGORITHM to the IKE phase 1 authentication
 * algorithm.  A list of algorithms can be found in naipsec.h.
 */
#define PHASE1_AUTHENTICATION_ALGORITHM     NA_IPSEC_AUTHENTICATION_MD5

/*
 * Set PHASE1_LIFETIME_SECONDS to the maximum lifetime of the phase 1
 * SA in seconds.
 */
#define PHASE1_LIFETIME_SECONDS             (86400)

/*
 * Set PHASE1_LIFETIME_KILOBYTES to the maximum lifetime of the phase 1 SA
 * in kilobytes of data transfered.
 */
#define PHASE1_LIFETIME_KILOBYTES           (32768)

/*
 * Set PHASE1_MODE to either NA_IKE_MAIN_MODE or NA_IKE_AGGRESSIVE_MODE.
 */
#define PHASE1_MODE                         NA_IKE_MAIN_MODE

/*
 * Set PHASE2_ENCRYPTION_ALGORITHM to the encryption algorithm to be
 * used during the IKE phase 2 negotiation.  A list of algorithms is
 * contained in naipsec.h.
 */
#define PHASE2_ENCRYPTION_ALGORITHM         NA_IPSEC_ENCRYPTION_DES

/*
 * Set PHASE2_AUTHENTICATION_ALGORITHM to the IKE phase 2 authentication
 * algorithm.  A list of algorithms can be found in naipsec.h.
 */
#define PHASE2_ENCRYPTION_KEY_LENGTH        (0)

/*
 * Set PHASE2_AUTHENTICATION_ALGORITHM to the IKE phase 2 authentication
 * algorithm.  A list of algorithms can be found in naipsec.h.
 */
#define PHASE2_AUTHENTICATION_ALGORITHM     NA_IPSEC_AUTHENTICATION_MD5

/*
 * Set PHASE2_LIFETIME_SECONDS to the maximum lifetime of the phase 2
 * SA in seconds.
 */
#define PHASE2_LIFETIME_SECONDS             (86400)

/*
 * Set PHASE2_MODE to either NA_IKE_MAIN_MODE or NA_IKE_AGGRESSIVE_MODE.
 */
#define PHASE2_LIFETIME_KILOBYTES           (32768)

/*
 * Set OUR_ID to the ID we should use when authenticating ourselves with the
 * remote VPN peer.  This may be an IP address, a fully qualified domain name
 * (FQDN), or an user FQDN (email address).
 */
#define OUR_ID                  LOCAL_VPN_ADDRESS

/*
 * Set PEER_ID to the ID of the remote VPN peer.  This may be an IP address,
 * a fully qualified domain name (FQDN), or an user FQDN (email address).
 *
 */
#define PEER_ID                 REMOTE_VPN_PEER_ADDRESS

/*
 * Set VPN_ID_TYPE to indicate what type of ID is being used.  There is a
 * list of possible values in naipsec.h.
 */
#define VPN_ID_TYPE             IPSEC_ID_IPADDRESS

/*
 * USE_ANTI_REPLAY should be set to the same value as used on the remote VPN peer.
 * Anti-replay protects against attackers that record a session and then try to
 * replay it later.  Anti-replay forces the system to negotiate a new SA when the
 * SA's sequence number wraps.
 */
#define USE_ANTI_REPLAY         FALSE

/*
 * Set DIFFIE_HELMAN_GROUP to the same value as used at the remote VPN peer.  The
 * Diffie-Hellman group is used in generating random seeds for encryption keys.
 * larger values generate better keys, but slow down the negotiation process.
 * Groups 1, 2, and 5 are supported.
 */
#define DIFFIE_HELMAN_GROUP     (2)

/*
 * Set WANT_PFS to the same value as used at the remote VPN peer.  Perfect
 * Forward Secrecy (PFS) ensures that if one key is compromised, data protected
 * by other keys is not compromised.  That is, breaking one key does not help
 * an attacker to break another key.  PFS improves security, but slows down
 * the negotiation.
 */
#define WANT_PFS                TRUE



void createVpn(void);




#endif


