ipsec-tools/racoon/oakley.h

   1 /*      $NetBSD: oakley.h,v 1.5 2006/10/06 12:02:27 manu Exp $  */
   2
   3 /* Id: oakley.h,v 1.13 2005/05/30 20:12:43 fredsen Exp */
   4
   5 /*
   6  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  * 3. Neither the name of the project nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #ifndef _OAKLEY_H
  35 #define _OAKLEY_H
  36
  37 #include "vmbuf.h"
  38
  39 /* refer to RFC 2409 */
  40
  41 /* Attribute Classes */
  42 #define OAKLEY_ATTR_ENC_ALG             1 /* B */
  43 #define   OAKLEY_ATTR_ENC_ALG_DES               1
  44 #define   OAKLEY_ATTR_ENC_ALG_IDEA              2
  45 #define   OAKLEY_ATTR_ENC_ALG_BLOWFISH          3
  46 #define   OAKLEY_ATTR_ENC_ALG_RC5               4
  47 #define   OAKLEY_ATTR_ENC_ALG_3DES              5
  48 #define   OAKLEY_ATTR_ENC_ALG_CAST              6
  49 #define   OAKLEY_ATTR_ENC_ALG_AES               7
  50                                         /*      65001 - 65535 Private Use */
  51 #define OAKLEY_ATTR_HASH_ALG            2 /* B */
  52 #define   OAKLEY_ATTR_HASH_ALG_MD5              1
  53 #define   OAKLEY_ATTR_HASH_ALG_SHA              2
  54 #define   OAKLEY_ATTR_HASH_ALG_TIGER            3
  55 #if defined(WITH_SHA2)
  56 #define   OAKLEY_ATTR_HASH_ALG_SHA2_256         4
  57 #define   OAKLEY_ATTR_HASH_ALG_SHA2_384         5
  58 #define   OAKLEY_ATTR_HASH_ALG_SHA2_512         6
  59 #endif
  60                                         /*      65001 - 65535 Private Use */
  61 #define OAKLEY_ATTR_AUTH_METHOD         3 /* B */
  62 #define   OAKLEY_ATTR_AUTH_METHOD_PSKEY         1
  63 #define   OAKLEY_ATTR_AUTH_METHOD_DSSSIG        2
  64 #define   OAKLEY_ATTR_AUTH_METHOD_RSASIG        3
  65 #define   OAKLEY_ATTR_AUTH_METHOD_RSAENC        4
  66 #define   OAKLEY_ATTR_AUTH_METHOD_RSAREV        5
  67 #define   OAKLEY_ATTR_AUTH_METHOD_EGENC         6
  68 #define   OAKLEY_ATTR_AUTH_METHOD_EGREV         7
  69         /* Hybrid Auth */
  70 #ifdef ENABLE_HYBRID
  71 #define   OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I  64221
  72 #define   OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R  64222
  73 #define   OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I  64223
  74 #define   OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R  64224
  75
  76                                         /*      65001 - 65535 Private Use */
  77
  78         /* Plain Xauth */
  79 #define OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I   65001
  80 #define OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R   65002
  81 #define OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I  65003
  82 #define OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R  65004
  83 #define OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I  65005
  84 #define OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R  65006
  85 #define OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I  65007
  86 #define OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R  65008
  87 #define OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I  65009
  88 #define OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R  65010
  89 #endif
  90
  91                                         /*      65500 -> still private
  92                                          * to avoid clash with GSSAPI_KRB below
  93                                          */
  94 #define FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I       65500
  95
  96
  97         /*
  98          * The following are valid when the Vendor ID is one of
  99          * the following:
 100          *
 101          *      MD5("A GSS-API Authentication Method for IKE")
 102          *      MD5("GSSAPI") (recognized by Windows 2000)
 103          *      MD5("MS NT5 ISAKMPOAKLEY") (sent by Windows 2000)
 104          */
 105 #define   OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB    65001
 106 #define OAKLEY_ATTR_GRP_DESC            4 /* B */
 107 #define   OAKLEY_ATTR_GRP_DESC_MODP768          1
 108 #define   OAKLEY_ATTR_GRP_DESC_MODP1024         2
 109 #define   OAKLEY_ATTR_GRP_DESC_EC2N155          3
 110 #define   OAKLEY_ATTR_GRP_DESC_EC2N185          4
 111 #define   OAKLEY_ATTR_GRP_DESC_MODP1536         5
 112 #define   OAKLEY_ATTR_GRP_DESC_MODP2048         14
 113 #define   OAKLEY_ATTR_GRP_DESC_MODP3072         15
 114 #define   OAKLEY_ATTR_GRP_DESC_MODP4096         16
 115 #define   OAKLEY_ATTR_GRP_DESC_MODP6144         17
 116 #define   OAKLEY_ATTR_GRP_DESC_MODP8192         18
 117                                         /*      32768 - 65535 Private Use */
 118 #define OAKLEY_ATTR_GRP_TYPE            5 /* B */
 119 #define   OAKLEY_ATTR_GRP_TYPE_MODP             1
 120 #define   OAKLEY_ATTR_GRP_TYPE_ECP              2
 121 #define   OAKLEY_ATTR_GRP_TYPE_EC2N             3
 122                                         /*      65001 - 65535 Private Use */
 123 #define OAKLEY_ATTR_GRP_PI              6 /* V */
 124 #define OAKLEY_ATTR_GRP_GEN_ONE         7 /* V */
 125 #define OAKLEY_ATTR_GRP_GEN_TWO         8 /* V */
 126 #define OAKLEY_ATTR_GRP_CURVE_A         9 /* V */
 127 #define OAKLEY_ATTR_GRP_CURVE_B         10 /* V */
 128 #define OAKLEY_ATTR_SA_LD_TYPE          11 /* B */
 129 #define   OAKLEY_ATTR_SA_LD_TYPE_DEFAULT        1
 130 #define   OAKLEY_ATTR_SA_LD_TYPE_SEC            1
 131 #define   OAKLEY_ATTR_SA_LD_TYPE_KB             2
 132 #define   OAKLEY_ATTR_SA_LD_TYPE_MAX            3
 133                                         /*      65001 - 65535 Private Use */
 134 #define OAKLEY_ATTR_SA_LD               12 /* V */
 135 #define   OAKLEY_ATTR_SA_LD_SEC_DEFAULT         28800 /* 8 hours */
 136 #define OAKLEY_ATTR_PRF                 13 /* B */
 137 #define OAKLEY_ATTR_KEY_LEN             14 /* B */
 138 #define OAKLEY_ATTR_FIELD_SIZE          15 /* B */
 139 #define OAKLEY_ATTR_GRP_ORDER           16 /* V */
 140 #define OAKLEY_ATTR_BLOCK_SIZE          17 /* B */
 141                                 /*      16384 - 32767 Private Use */
 142
 143         /*
 144          * The following are valid when the Vendor ID is one of
 145          * the following:
 146          *
 147          *      MD5("A GSS-API Authentication Method for IKE")
 148          *      MD5("GSSAPI") (recognized by Windows 2000)
 149          *      MD5("MS NT5 ISAKMPOAKLEY") (sent by Windows 2000)
 150          */
 151 #define OAKLEY_ATTR_GSS_ID              16384
 152
 153 #define MAXPADLWORD     20
 154
 155 struct dhgroup {
 156         int type;
 157         vchar_t *prime;
 158         int gen1;
 159         int gen2;
 160         vchar_t *curve_a;
 161         vchar_t *curve_b;
 162         vchar_t *order;
 163 };
 164
 165 /* certificate holder */
 166 typedef struct cert_t_tag {
 167         u_int8_t type;          /* type of CERT, must be same to pl->v[0]*/
 168         vchar_t cert;           /* pointer to the CERT */
 169         vchar_t *pl;            /* CERT payload minus isakmp general header */
 170 } cert_t;
 171
 172 struct ph1handle;
 173 struct ph2handle;
 174 struct isakmp_ivm;
 175
 176 extern int oakley_get_defaultlifetime __P((void));
 177
 178 extern int oakley_dhinit __P((void));
 179 extern void oakley_dhgrp_free __P((struct dhgroup *));
 180 extern int oakley_dh_compute __P((const struct dhgroup *,
 181         vchar_t *, vchar_t *, vchar_t *, vchar_t **));
 182 extern int oakley_dh_generate __P((const struct dhgroup *,
 183         vchar_t **, vchar_t **));
 184 extern int oakley_setdhgroup __P((int, struct dhgroup **));
 185
 186 extern vchar_t *oakley_prf __P((vchar_t *, vchar_t *, struct ph1handle *));
 187 extern vchar_t *oakley_hash __P((vchar_t *, struct ph1handle *));
 188
 189 extern int oakley_compute_keymat __P((struct ph2handle *, int));
 190
 191 #if notyet
 192 extern vchar_t *oakley_compute_hashx __P((void));
 193 #endif
 194 extern vchar_t *oakley_compute_hash3 __P((struct ph1handle *,
 195         u_int32_t, vchar_t *));
 196 extern vchar_t *oakley_compute_hash1 __P((struct ph1handle *,
 197         u_int32_t, vchar_t *));
 198 extern vchar_t *oakley_ph1hash_common __P((struct ph1handle *, int));
 199 extern vchar_t *oakley_ph1hash_base_i __P((struct ph1handle *, int));
 200 extern vchar_t *oakley_ph1hash_base_r __P((struct ph1handle *, int));
 201
 202 extern int oakley_validate_auth __P((struct ph1handle *));
 203 extern int oakley_getmycert __P((struct ph1handle *));
 204 extern int oakley_getsign __P((struct ph1handle *));
 205 extern vchar_t *oakley_getcr __P((struct ph1handle *));
 206 extern int oakley_checkcr __P((struct ph1handle *));
 207 extern int oakley_needcr __P((int));
 208 struct isakmp_gen;
 209 extern int oakley_savecert __P((struct ph1handle *, struct isakmp_gen *));
 210 extern int oakley_savecr __P((struct ph1handle *, struct isakmp_gen *));
 211
 212 extern int oakley_skeyid __P((struct ph1handle *));
 213 extern int oakley_skeyid_dae __P((struct ph1handle *));
 214
 215 extern int oakley_compute_enckey __P((struct ph1handle *));
 216 extern cert_t *oakley_newcert __P((void));
 217 extern void oakley_delcert __P((cert_t *));
 218 extern int oakley_newiv __P((struct ph1handle *));
 219 extern struct isakmp_ivm *oakley_newiv2 __P((struct ph1handle *, u_int32_t));
 220 extern void oakley_delivm __P((struct isakmp_ivm *));
 221 extern vchar_t *oakley_do_decrypt __P((struct ph1handle *,
 222         vchar_t *, vchar_t *, vchar_t *));
 223 extern vchar_t *oakley_do_encrypt __P((struct ph1handle *,
 224         vchar_t *, vchar_t *, vchar_t *));
 225
 226 #ifdef ENABLE_HYBRID
 227 #define AUTHMETHOD(iph1)                                                     \
 228     (((iph1)->rmconf->xauth &&                                               \
 229     (iph1)->approval->authmethod == OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I) ? \
 230         FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I : (iph1)->approval->authmethod)
 231 #define RMAUTHMETHOD(iph1)                                                   \
 232     (((iph1)->rmconf->xauth &&                                               \
 233     (iph1)->rmconf->proposal->authmethod ==                                  \
 234         OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I) ?                             \
 235         FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I :                                  \
 236         (iph1)->rmconf->proposal->authmethod)
 237 #else
 238 #define AUTHMETHOD(iph1) (iph1)->approval->authmethod
 239 #define RMAUTHMETHOD(iph1) (iph1)->rmconf->proposal->authmethod
 240 #endif /* ENABLE_HYBRID */
 241
 242 #endif /* _OAKLEY_H */