ipsec-tools/racoon/proposal.h

   1 /* $Id: proposal.h,v 1.5.10.1 2005/05/12 19:34:10 manubsd Exp $ */
   2
   3 /*
   4  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. Neither the name of the project nor the names of its contributors
  16  *    may be used to endorse or promote products derived from this software
  17  *    without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGE.
  30  */
  31
  32 #ifndef _PROPOSAL_H
  33 #define _PROPOSAL_H
  34
  35 #include <sys/queue.h>
  36
  37 /*
  38  *   A. chained list of transform, only for single proto_id
  39  *      (this is same as set of transforms in single proposal payload)
  40  *   B. proposal.  this will point to multiple (A) items (order is important
  41  *      here so pointer to (A) must be ordered array, or chained list).
  42  *      this covers multiple proposal on a packet if proposal # is the same.
  43  *   C. finally, (B) needs to be connected as chained list.
  44  *
  45  *      head ---> prop[.......] ---> prop[...] ---> prop[...] ---> ...
  46  *                     | | | |
  47  *                     | | | +- proto4  <== must preserve order here
  48  *                     | | +--- proto3
  49  *                     | +----- proto2
  50  *                     +------- proto1[trans1, trans2, trans3, ...]
  51  *
  52  *   incoming packets needs to be parsed to construct the same structure
  53  *   (check "prop_pair" too).
  54  */
  55 /* SA proposal specification */
  56 struct saprop {
  57         int prop_no;
  58         time_t lifetime;    // For IKEv2 - only used to set lifetime in kernel
  59         int lifebyte;       // For IKEv2 - only used to set lifetime in kernel
  60         int pfs_group;          // For IKEv2 - also saved in transform
  61         int claim;                      /* IKEv1 only - flag to send RESPONDER-LIFETIME. */
  62                                         /* XXX assumed DOI values are 1 or 2. */
  63
  64         struct saproto *head;
  65         struct saprop *next;
  66 };
  67
  68 /* SA protocol specification */
  69 struct saproto {
  70         int proto_id;
  71         size_t spisize;                 /* spi size */
  72         int encmode;                    // For IKEv2 - only used to set encode mode in the kernel
  73
  74         int udp_encap;          // For IKEv2 - only used to set kernel
  75
  76         /* XXX should be vchar_t * */
  77         /* these are network byte order */
  78         u_int32_t spi;                  /* inbound. i.e. --SA-> me */
  79         u_int32_t spi_p;                /* outbound. i.e. me -SA-> */
  80
  81         vchar_t *keymat;                /* KEYMAT */
  82         vchar_t *keymat_p;              /* peer's KEYMAT */
  83
  84         int reqid_out;                  /* request id (outbound) */
  85         int reqid_in;                   /* request id (inbound) */
  86
  87         int ok;                 /* if 1, success to set SA in kenrel */
  88
  89         struct satrns *head;            /* header of transform */
  90         struct saproto *next;           /* next protocol */
  91 };
  92
  93 /* SA algorithm specification */
  94 struct satrns {
  95         int trns_no;
  96         int trns_type;          /* IKEv2 only - transform type */
  97     int trns_id;                        /* transform id */
  98         int encklen;                    /* key length of encryption algorithm */
  99         int authtype;                   /* authentication algorithm if ESP */
 100
 101         struct satrns *next;            /* next transform */
 102 };
 103
 104 /*
 105  * prop_pair: (proposal number, transform number)
 106  *
 107  *      (SA (P1 (T1 T2)) (P1' (T1' T2')) (P2 (T1" T2")))
 108  *
 109  *              p[1]      p[2]
 110  *      top     (P1,T1)   (P2",T1")
 111  *               |  |tnext     |tnext
 112  *               |  v          v
 113  *               | (P1, T2)   (P2", T2")
 114  *               v next
 115  *              (P1', T1')
 116  *                  |tnext
 117  *                  v
 118  *                 (P1', T2')
 119  *
 120  * when we convert it to saprop in prop2saprop(), it should become like:
 121  *
 122  *               (next)
 123  *      saprop --------------------> saprop
 124  *       | (head)                     | (head)
 125  *       +-> saproto                  +-> saproto
 126  *            | | (head)                     | (head)
 127  *            | +-> satrns(P1 T1)            +-> satrns(P2" T1")
 128  *            |      | (next)                     | (next)
 129  *            |      v                            v
 130  *            |     satrns(P1, T2)               satrns(P2", T2")
 131  *            v (next)
 132  *           saproto
 133  *              | (head)
 134  *              +-> satrns(P1' T1')
 135  *                   | (next)
 136  *                   v
 137  *                  satrns(P1', T2')
 138  */
 139 struct prop_pair {
 140         struct isakmp_pl_p *prop;
 141         struct isakmp_pl_t *trns;
 142         struct prop_pair *next; /* next prop_pair with same proposal # */
 143                                 /* (bundle case) */
 144         struct prop_pair *tnext; /* next prop_pair in same proposal payload */
 145                                 /* (multiple tranform case) */
 146 };
 147 #define MAXPROPPAIRLEN  256     /* It's enough because field size is 1 octet. */
 148
 149 /*
 150  * Lifetime length selection refered to the section 4.5.4 of RFC2407.  It does
 151  * not completely conform to the description of RFC.  There are four types of
 152  * the behavior.  If the value of "proposal_check" in "remote" directive is;
 153  *     "obey"
 154  *         the responder obey the initiator anytime.
 155  *     "strict"
 156  *         If the responder's length is longer than the initiator's one, the
 157  *         responder uses the intitiator's one.  Otherwise rejects the proposal.
 158  *         If PFS is not required by the responder, the responder obeys the
 159  *         proposal.  If PFS is required by both sides and if the responder's
 160  *         group is not equal to the initiator's one, then the responder reject
 161  *         the proposal.
 162  *     "claim"
 163  *         If the responder's length is longer than the initiator's one, the
 164  *         responder use the intitiator's one.  If the responder's length is
 165  *         shorter than the initiator's one, the responder uses own length
 166  *         AND send RESPONDER-LIFETIME notify message to a initiator in the
 167  *         case of lifetime.
 168  *         About PFS, this directive is same as "strict".
 169  *     "exact"
 170  *         If the initiator's length is not equal to the responder's one, the
 171  *         responder rejects the proposal.
 172  *         If PFS is required and if the responder's group is not equal to
 173  *         the initiator's one, then the responder reject the proposal.
 174  * XXX should be defined the behavior of key length.
 175  */
 176 #define PROP_CHECK_OBEY         1
 177 #define PROP_CHECK_STRICT       2
 178 #define PROP_CHECK_CLAIM        3
 179 #define PROP_CHECK_EXACT        4
 180 #define PROP_CHECK_IKEV2        5
 181
 182 struct sainfo;
 183 struct secpolicy;
 184 extern struct saprop *newsaprop (void);
 185 extern struct saproto *newsaproto (void);
 186 extern void inssaprop (struct saprop **, struct saprop *);
 187 extern void inssaproto (struct saprop *, struct saproto *);
 188 extern void inssaprotorev (struct saprop *, struct saproto *);
 189 extern struct satrns *newsatrns (void);
 190 extern void inssatrns (struct saproto *, struct satrns *);
 191 extern int satrns_remove_from_list(struct satrns **, struct satrns *);
 192 extern struct saprop *cmpsaprop_alloc (phase1_handle_t *,
 193         const struct saprop *, const struct saprop *, int);
 194 extern int cmpsaprop (const struct saprop *, const struct saprop *);
 195 extern int cmpsatrns (int, const struct satrns *, const struct satrns *);
 196 extern int set_satrnsbysainfo (struct saproto *, struct sainfo *, u_int8_t, int);
 197 extern struct saprop *aproppair2saprop (struct prop_pair *);
 198 extern void free_proppair (struct prop_pair **);
 199 extern void flushsaprop (struct saprop *);
 200 extern void flushsaproto (struct saproto *);
 201 extern void flushsatrns (struct satrns *);
 202 extern void printsaprop (const int, const struct saprop *);
 203 extern void printsaprop0 (const int, const struct saprop *);
 204 extern void printsaproto (const int, const struct saproto *);
 205 extern void printsatrns (const int, const int, const struct satrns *);
 206 extern void print_proppair0 (int, struct prop_pair *, int);
 207 extern void print_proppair (int, struct prop_pair *);
 208 extern int set_proposal_from_policy (phase2_handle_t *,
 209         struct secpolicy *, struct secpolicy *);
 210 extern int set_proposal_from_proposal (phase2_handle_t *);
 211 extern int tunnel_mode_prop (struct saprop *);
 212 extern struct saprop *dupsaprop (struct saprop *, int);
 213 extern struct satrns *dupsatrns_1(struct satrns *);
 214
 215 #endif /* _PROPOSAL_H */