projects / apple / ipsec.git / blame
| Commit | Line | Data |
|---|---|---|
| 52b7d2ce A |
1 | /* $Id: proposal.h,v 1.5.10.1 2005/05/12 19:34:10 manubsd Exp $ */ |
| 2 | ||
| 3 | /* | |
| 4 | * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. | |
| 5 | * All rights reserved. | |
| 6 | * | |
| 7 | * Redistribution and use in source and binary forms, with or without | |
| 8 | * modification, are permitted provided that the following conditions | |
| 9 | * are met: | |
| 10 | * 1. Redistributions of source code must retain the above copyright | |
| 11 | * notice, this list of conditions and the following disclaimer. | |
| 12 | * 2. Redistributions in binary form must reproduce the above copyright | |
| 13 | * notice, this list of conditions and the following disclaimer in the | |
| 14 | * documentation and/or other materials provided with the distribution. | |
| 15 | * 3. Neither the name of the project nor the names of its contributors | |
| 16 | * may be used to endorse or promote products derived from this software | |
| 17 | * without specific prior written permission. | |
| 18 | * | |
| 19 | * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND | |
| 20 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | |
| 21 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | |
| 22 | * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE | |
| 23 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | |
| 24 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | |
| 25 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | |
| 26 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | |
| 27 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | |
| 28 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | |
| 29 | * SUCH DAMAGE. | |
| 30 | */ | |
| 31 | ||
| 32 | #ifndef _PROPOSAL_H | |
| 33 | #define _PROPOSAL_H | |
| 34 | ||
| 35 | #include <sys/queue.h> | |
| 36 | ||
| 37 | /* | |
| 38 | * A. chained list of transform, only for single proto_id | |
| 39 | * (this is same as set of transforms in single proposal payload) | |
| 40 | * B. proposal. this will point to multiple (A) items (order is important | |
| 41 | * here so pointer to (A) must be ordered array, or chained list). | |
| 42 | * this covers multiple proposal on a packet if proposal # is the same. | |
| 43 | * C. finally, (B) needs to be connected as chained list. | |
| 44 | * | |
| 45 | * head ---> prop[.......] ---> prop[...] ---> prop[...] ---> ... | |
| 46 | * | | | | | |
| 47 | * | | | +- proto4 <== must preserve order here | |
| 48 | * | | +--- proto3 | |
| 49 | * | +----- proto2 | |
| 50 | * +------- proto1[trans1, trans2, trans3, ...] | |
| 51 | * | |
| 52 | * incoming packets needs to be parsed to construct the same structure | |
| 53 | * (check "prop_pair" too). | |
| 54 | */ | |
| 55 | /* SA proposal specification */ | |
| 56 | struct saprop { | |
| 57 | int prop_no; | |
| 58 | time_t lifetime; | |
| 59 | int lifebyte; | |
| 60 | int pfs_group; /* pfs group */ | |
| 61 | int claim; /* flag to send RESPONDER-LIFETIME. */ | |
| 62 | /* XXX assumed DOI values are 1 or 2. */ | |
| 63 | ||
| 64 | struct saproto *head; | |
| 65 | struct saprop *next; | |
| 66 | }; | |
| 67 | ||
| 68 | /* SA protocol specification */ | |
| 69 | struct saproto { | |
| 70 | int proto_id; | |
| 71 | size_t spisize; /* spi size */ | |
| 72 | int encmode; /* encryption mode */ | |
| 73 | ||
| 74 | int udp_encap; /* UDP encapsulation */ | |
| 75 | ||
| 76 | /* XXX should be vchar_t * */ | |
| 77 | /* these are network byte order */ | |
| 78 | u_int32_t spi; /* inbound. i.e. --SA-> me */ | |
| 79 | u_int32_t spi_p; /* outbound. i.e. me -SA-> */ | |
| 80 | ||
| 81 | vchar_t *keymat; /* KEYMAT */ | |
| 82 | vchar_t *keymat_p; /* peer's KEYMAT */ | |
| 83 | ||
| 84 | int reqid_out; /* request id (outbound) */ | |
| 85 | int reqid_in; /* request id (inbound) */ | |
| 86 | ||
| 87 | int ok; /* if 1, success to set SA in kenrel */ | |
| 88 | ||
| 89 | struct satrns *head; /* header of transform */ | |
| 90 | struct saproto *next; /* next protocol */ | |
| 91 | }; | |
| 92 | ||
| 93 | /* SA algorithm specification */ | |
| 94 | struct satrns { | |
| 95 | int trns_no; | |
| 96 | int trns_id; /* transform id */ | |
| 97 | int encklen; /* key length of encryption algorithm */ | |
| 98 | int authtype; /* authentication algorithm if ESP */ | |
| 99 | ||
| 100 | struct satrns *next; /* next transform */ | |
| 101 | }; | |
| 102 | ||
| 103 | /* | |
| 104 | * prop_pair: (proposal number, transform number) | |
| 105 | * | |
| 106 | * (SA (P1 (T1 T2)) (P1' (T1' T2')) (P2 (T1" T2"))) | |
| 107 | * | |
| 108 | * p[1] p[2] | |
| 109 | * top (P1,T1) (P2",T1") | |
| 110 | * | |tnext |tnext | |
| 111 | * | v v | |
| 112 | * | (P1, T2) (P2", T2") | |
| 113 | * v next | |
| 114 | * (P1', T1') | |
| 115 | * |tnext | |
| 116 | * v | |
| 117 | * (P1', T2') | |
| 118 | * | |
| 119 | * when we convert it to saprop in prop2saprop(), it should become like: | |
| 120 | * | |
| 121 | * (next) | |
| 122 | * saprop --------------------> saprop | |
| 123 | * | (head) | (head) | |
| 124 | * +-> saproto +-> saproto | |
| 125 | * | | (head) | (head) | |
| 126 | * | +-> satrns(P1 T1) +-> satrns(P2" T1") | |
| 127 | * | | (next) | (next) | |
| 128 | * | v v | |
| 129 | * | satrns(P1, T2) satrns(P2", T2") | |
| 130 | * v (next) | |
| 131 | * saproto | |
| 132 | * | (head) | |
| 133 | * +-> satrns(P1' T1') | |
| 134 | * | (next) | |
| 135 | * v | |
| 136 | * satrns(P1', T2') | |
| 137 | */ | |
| 138 | struct prop_pair { | |
| 139 | struct isakmp_pl_p *prop; | |
| 140 | struct isakmp_pl_t *trns; | |
| 141 | struct prop_pair *next; /* next prop_pair with same proposal # */ | |
| 142 | /* (bundle case) */ | |
| 143 | struct prop_pair *tnext; /* next prop_pair in same proposal payload */ | |
| 144 | /* (multiple tranform case) */ | |
| 145 | }; | |
| 146 | #define MAXPROPPAIRLEN 256 /* It's enough because field size is 1 octet. */ | |
| 147 | ||
| 148 | /* | |
| 149 | * Lifetime length selection refered to the section 4.5.4 of RFC2407. It does | |
| 150 | * not completely conform to the description of RFC. There are four types of | |
| 151 | * the behavior. If the value of "proposal_check" in "remote" directive is; | |
| 152 | * "obey" | |
| 153 | * the responder obey the initiator anytime. | |
| 154 | * "strict" | |
| 155 | * If the responder's length is longer than the initiator's one, the | |
| 156 | * responder uses the intitiator's one. Otherwise rejects the proposal. | |
| 157 | * If PFS is not required by the responder, the responder obeys the | |
| 158 | * proposal. If PFS is required by both sides and if the responder's | |
| 159 | * group is not equal to the initiator's one, then the responder reject | |
| 160 | * the proposal. | |
| 161 | * "claim" | |
| 162 | * If the responder's length is longer than the initiator's one, the | |
| 163 | * responder use the intitiator's one. If the responder's length is | |
| 164 | * shorter than the initiator's one, the responder uses own length | |
| 165 | * AND send RESPONDER-LIFETIME notify message to a initiator in the | |
| 166 | * case of lifetime. | |
| 167 | * About PFS, this directive is same as "strict". | |
| 168 | * "exact" | |
| 169 | * If the initiator's length is not equal to the responder's one, the | |
| 170 | * responder rejects the proposal. | |
| 171 | * If PFS is required and if the responder's group is not equal to | |
| 172 | * the initiator's one, then the responder reject the proposal. | |
| 173 | * XXX should be defined the behavior of key length. | |
| 174 | */ | |
| 175 | #define PROP_CHECK_OBEY 1 | |
| 176 | #define PROP_CHECK_STRICT 2 | |
| 177 | #define PROP_CHECK_CLAIM 3 | |
| 178 | #define PROP_CHECK_EXACT 4 | |
| 179 | ||
| 180 | struct sainfo; | |
| 181 | struct ph1handle; | |
| 182 | struct secpolicy; | |
| 183 | extern struct saprop *newsaprop __P((void)); | |
| 184 | extern struct saproto *newsaproto __P((void)); | |
| 185 | extern void inssaprop __P((struct saprop **, struct saprop *)); | |
| 186 | extern void inssaproto __P((struct saprop *, struct saproto *)); | |
| 187 | extern void inssaprotorev __P((struct saprop *, struct saproto *)); | |
| 188 | extern struct satrns *newsatrns __P((void)); | |
| 189 | extern void inssatrns __P((struct saproto *, struct satrns *)); | |
| 190 | extern struct saprop *cmpsaprop_alloc __P((struct ph1handle *, | |
| 191 | const struct saprop *, const struct saprop *, int)); | |
| 192 | extern int cmpsaprop __P((const struct saprop *, const struct saprop *)); | |
| 193 | extern int cmpsatrns __P((int, const struct satrns *, const struct satrns *)); | |
| 194 | extern int set_satrnsbysainfo __P((struct saproto *, struct sainfo *)); | |
| 195 | extern struct saprop *aproppair2saprop __P((struct prop_pair *)); | |
| 196 | extern void free_proppair __P((struct prop_pair **)); | |
| 197 | extern void flushsaprop __P((struct saprop *)); | |
| 198 | extern void flushsaproto __P((struct saproto *)); | |
| 199 | extern void flushsatrns __P((struct satrns *)); | |
| 200 | extern void printsaprop __P((const int, const struct saprop *)); | |
| 201 | extern void printsaprop0 __P((const int, const struct saprop *)); | |
| 202 | extern void printsaproto __P((const int, const struct saproto *)); | |
| 203 | extern void printsatrns __P((const int, const int, const struct satrns *)); | |
| 204 | extern void print_proppair0 __P((int, struct prop_pair *, int)); | |
| 205 | extern void print_proppair __P((int, struct prop_pair *)); | |
| 206 | extern int set_proposal_from_policy __P((struct ph2handle *, | |
| 207 | struct secpolicy *, struct secpolicy *)); | |
| 208 | extern int set_proposal_from_proposal __P((struct ph2handle *)); | |
| 209 | extern int tunnel_mode_prop __P((struct saprop *p)); | |
| 210 | ||
| 211 | #endif /* _PROPOSAL_H */ |