ipsec-tools/racoon/proposal.h

   1 /* $Id: proposal.h,v 1.5.10.1 2005/05/12 19:34:10 manubsd Exp $ */
   2
   3 /*
   4  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. Neither the name of the project nor the names of its contributors
  16  *    may be used to endorse or promote products derived from this software
  17  *    without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGE.
  30  */
  31
  32 #ifndef _PROPOSAL_H
  33 #define _PROPOSAL_H
  34
  35 #include <sys/queue.h>
  36
  37 /*
  38  *   A. chained list of transform, only for single proto_id
  39  *      (this is same as set of transforms in single proposal payload)
  40  *   B. proposal.  this will point to multiple (A) items (order is important
  41  *      here so pointer to (A) must be ordered array, or chained list).
  42  *      this covers multiple proposal on a packet if proposal # is the same.
  43  *   C. finally, (B) needs to be connected as chained list.
  44  *
  45  *      head ---> prop[.......] ---> prop[...] ---> prop[...] ---> ...
  46  *                     | | | |
  47  *                     | | | +- proto4  <== must preserve order here
  48  *                     | | +--- proto3
  49  *                     | +----- proto2
  50  *                     +------- proto1[trans1, trans2, trans3, ...]
  51  *
  52  *   incoming packets needs to be parsed to construct the same structure
  53  *   (check "prop_pair" too).
  54  */
  55 /* SA proposal specification */
  56 struct saprop {
  57         int prop_no;
  58         time_t lifetime;    // For IKEv2 - only used to set lifetime in kernel
  59         int lifebyte;       // For IKEv2 - only used to set lifetime in kernel
  60         int pfs_group;          // For IKEv2 - also saved in transform
  61         int claim;                      /* IKEv1 only - flag to send RESPONDER-LIFETIME. */
  62                                         /* XXX assumed DOI values are 1 or 2. */
  63
  64         struct saproto *head;
  65         struct saprop *next;
  66 };
  67
  68 /* SA protocol specification */
  69 struct saproto {
  70         int proto_id;
  71         size_t spisize;                 /* spi size */
  72         int encmode;                    // For IKEv2 - only used to set encode mode in the kernel
  73
  74         int udp_encap;          // For IKEv2 - only used to set kernel
  75
  76         /* XXX should be vchar_t * */
  77         /* these are network byte order */
  78         u_int32_t spi;                  /* inbound. i.e. --SA-> me */
  79         u_int32_t spi_p;                /* outbound. i.e. me -SA-> */
  80
  81         vchar_t *keymat;                /* KEYMAT */
  82         vchar_t *keymat_p;              /* peer's KEYMAT */
  83
  84         int reqid_out;                  /* request id (outbound) */
  85         int reqid_in;                   /* request id (inbound) */
  86
  87         int ok;                 /* if 1, success to set SA in kenrel */
  88
  89         struct satrns *head;            /* header of transform */
  90         struct saproto *next;           /* next protocol */
  91 };
  92
  93 /* SA algorithm specification */
  94 struct satrns {
  95         int trns_no;
  96     int trns_id;                        /* transform id */
  97         int encklen;                    /* key length of encryption algorithm */
  98         int authtype;                   /* authentication algorithm if ESP */
  99
 100         struct satrns *next;            /* next transform */
 101 };
 102
 103 /*
 104  * prop_pair: (proposal number, transform number)
 105  *
 106  *      (SA (P1 (T1 T2)) (P1' (T1' T2')) (P2 (T1" T2")))
 107  *
 108  *              p[1]      p[2]
 109  *      top     (P1,T1)   (P2",T1")
 110  *               |  |tnext     |tnext
 111  *               |  v          v
 112  *               | (P1, T2)   (P2", T2")
 113  *               v next
 114  *              (P1', T1')
 115  *                  |tnext
 116  *                  v
 117  *                 (P1', T2')
 118  *
 119  * when we convert it to saprop in prop2saprop(), it should become like:
 120  *
 121  *               (next)
 122  *      saprop --------------------> saprop
 123  *       | (head)                     | (head)
 124  *       +-> saproto                  +-> saproto
 125  *            | | (head)                     | (head)
 126  *            | +-> satrns(P1 T1)            +-> satrns(P2" T1")
 127  *            |      | (next)                     | (next)
 128  *            |      v                            v
 129  *            |     satrns(P1, T2)               satrns(P2", T2")
 130  *            v (next)
 131  *           saproto
 132  *              | (head)
 133  *              +-> satrns(P1' T1')
 134  *                   | (next)
 135  *                   v
 136  *                  satrns(P1', T2')
 137  */
 138 struct prop_pair {
 139         struct isakmp_pl_p *prop;
 140         struct isakmp_pl_t *trns;
 141         struct prop_pair *next; /* next prop_pair with same proposal # */
 142                                 /* (bundle case) */
 143         struct prop_pair *tnext; /* next prop_pair in same proposal payload */
 144                                 /* (multiple tranform case) */
 145 };
 146 #define MAXPROPPAIRLEN  256     /* It's enough because field size is 1 octet. */
 147
 148 /*
 149  * Lifetime length selection refered to the section 4.5.4 of RFC2407.  It does
 150  * not completely conform to the description of RFC.  There are four types of
 151  * the behavior.  If the value of "proposal_check" in "remote" directive is;
 152  *     "obey"
 153  *         the responder obey the initiator anytime.
 154  *     "strict"
 155  *         If the responder's length is longer than the initiator's one, the
 156  *         responder uses the intitiator's one.  Otherwise rejects the proposal.
 157  *         If PFS is not required by the responder, the responder obeys the
 158  *         proposal.  If PFS is required by both sides and if the responder's
 159  *         group is not equal to the initiator's one, then the responder reject
 160  *         the proposal.
 161  *     "claim"
 162  *         If the responder's length is longer than the initiator's one, the
 163  *         responder use the intitiator's one.  If the responder's length is
 164  *         shorter than the initiator's one, the responder uses own length
 165  *         AND send RESPONDER-LIFETIME notify message to a initiator in the
 166  *         case of lifetime.
 167  *         About PFS, this directive is same as "strict".
 168  *     "exact"
 169  *         If the initiator's length is not equal to the responder's one, the
 170  *         responder rejects the proposal.
 171  *         If PFS is required and if the responder's group is not equal to
 172  *         the initiator's one, then the responder reject the proposal.
 173  * XXX should be defined the behavior of key length.
 174  */
 175 #define PROP_CHECK_OBEY         1
 176 #define PROP_CHECK_STRICT       2
 177 #define PROP_CHECK_CLAIM        3
 178 #define PROP_CHECK_EXACT        4
 179
 180 struct sainfo;
 181 struct secpolicy;
 182 extern struct saprop *newsaprop (void);
 183 extern struct saproto *newsaproto (void);
 184 extern void inssaprop (struct saprop **, struct saprop *);
 185 extern void inssaproto (struct saprop *, struct saproto *);
 186 extern void inssaprotorev (struct saprop *, struct saproto *);
 187 extern struct satrns *newsatrns (void);
 188 extern void inssatrns (struct saproto *, struct satrns *);
 189 extern int satrns_remove_from_list(struct satrns **, struct satrns *);
 190 extern struct saprop *cmpsaprop_alloc (phase1_handle_t *,
 191         const struct saprop *, const struct saprop *, int);
 192 extern int cmpsaprop (const struct saprop *, const struct saprop *);
 193 extern int cmpsatrns (int, const struct satrns *, const struct satrns *);
 194 extern int set_satrnsbysainfo (struct saproto *, struct sainfo *, u_int8_t, int);
 195 extern struct saprop *aproppair2saprop (struct prop_pair *);
 196 extern void free_proppair (struct prop_pair **);
 197 extern void flushsaprop (struct saprop *);
 198 extern void flushsaproto (struct saproto *);
 199 extern void flushsatrns (struct satrns *);
 200 extern void printsaprop (const int, const struct saprop *);
 201 extern void printsaprop0 (const int, const struct saprop *);
 202 extern void printsaproto (const int, const struct saproto *);
 203 extern void printsatrns (const int, const int, const struct satrns *);
 204 extern void print_proppair0 (int, struct prop_pair *, int);
 205 extern void print_proppair (int, struct prop_pair *);
 206 extern int set_proposal_from_policy (phase2_handle_t *,
 207         struct secpolicy *, struct secpolicy *);
 208 extern int set_proposal_from_proposal (phase2_handle_t *);
 209 extern int tunnel_mode_prop (struct saprop *);
 210 extern struct saprop *dupsaprop (struct saprop *, int);
 211 extern struct satrns *dupsatrns_1(struct satrns *);
 212
 213 #endif /* _PROPOSAL_H */