racoon.tproj/proposal.h

   1 /*      $KAME: proposal.h,v 1.16 2001/08/16 05:02:13 itojun Exp $       */
   2
   3 /*
   4  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. Neither the name of the project nor the names of its contributors
  16  *    may be used to endorse or promote products derived from this software
  17  *    without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGE.
  30  */
  31
  32 #include <sys/queue.h>
  33
  34 /*
  35  *   A. chained list of transform, only for single proto_id
  36  *      (this is same as set of transforms in single proposal payload)
  37  *   B. proposal.  this will point to multiple (A) items (order is important
  38  *      here so pointer to (A) must be ordered array, or chained list).
  39  *      this covers multiple proposal on a packet if proposal # is the same.
  40  *   C. finally, (B) needs to be connected as chained list.
  41  *
  42  *      head ---> prop[.......] ---> prop[...] ---> prop[...] ---> ...
  43  *                     | | | |
  44  *                     | | | +- proto4  <== must preserve order here
  45  *                     | | +--- proto3
  46  *                     | +----- proto2
  47  *                     +------- proto1[trans1, trans2, trans3, ...]
  48  *
  49  *   incoming packets needs to be parsed to construct the same structure
  50  *   (check "prop_pair" too).
  51  */
  52 /* SA proposal specification */
  53 struct saprop {
  54         int prop_no;
  55         time_t lifetime;
  56         int lifebyte;
  57         int pfs_group;                  /* pfs group */
  58         int claim;                      /* flag to send RESPONDER-LIFETIME. */
  59                                         /* XXX assumed DOI values are 1 or 2. */
  60
  61         struct saproto *head;
  62         struct saprop *next;
  63 };
  64
  65 /* SA protocol specification */
  66 struct saproto {
  67         int proto_id;
  68         size_t spisize;                 /* spi size */
  69         int encmode;                    /* encryption mode */
  70
  71         /* XXX should be vchar_t * */
  72         /* these are network byte order */
  73         u_int32_t spi;                  /* inbound. i.e. --SA-> me */
  74         u_int32_t spi_p;                /* outbound. i.e. me -SA-> */
  75
  76         vchar_t *keymat;                /* KEYMAT */
  77         vchar_t *keymat_p;              /* peer's KEYMAT */
  78
  79         int reqid_out;                  /* request id (outbound) */
  80         int reqid_in;                   /* request id (inbound) */
  81
  82         int ok;                         /* if 1, success to set SA in kenrel */
  83
  84         struct satrns *head;            /* header of transform */
  85         struct saproto *next;           /* next protocol */
  86 };
  87
  88 /* SA algorithm specification */
  89 struct satrns {
  90         int trns_no;
  91         int trns_id;                    /* transform id */
  92         int encklen;                    /* key length of encryption algorithm */
  93         int authtype;                   /* authentication algorithm if ESP */
  94
  95         struct satrns *next;            /* next transform */
  96 };
  97
  98 /*
  99  * prop_pair: (proposal number, transform number)
 100  *
 101  *      (SA (P1 (T1 T2)) (P1' (T1' T2')) (P2 (T1" T2")))
 102  *
 103  *              p[1]      p[2]
 104  *      top     (P1,T1)   (P2",T1")
 105  *               |  |tnext     |tnext
 106  *               |  v          v
 107  *               | (P1, T2)   (P2", T2")
 108  *               v next
 109  *              (P1', T1')
 110  *                  |tnext
 111  *                  v
 112  *                 (P1', T2')
 113  *
 114  * when we convert it to saprop in prop2saprop(), it should become like:
 115  *
 116  *               (next)
 117  *      saprop --------------------> saprop
 118  *       | (head)                     | (head)
 119  *       +-> saproto                  +-> saproto
 120  *            | | (head)                     | (head)
 121  *            | +-> satrns(P1 T1)            +-> satrns(P2" T1")
 122  *            |      | (next)                     | (next)
 123  *            |      v                            v
 124  *            |     satrns(P1, T2)               satrns(P2", T2")
 125  *            v (next)
 126  *           saproto
 127  *              | (head)
 128  *              +-> satrns(P1' T1')
 129  *                   | (next)
 130  *                   v
 131  *                  satrns(P1', T2')
 132  */
 133 struct prop_pair {
 134         struct isakmp_pl_p *prop;
 135         struct isakmp_pl_t *trns;
 136         struct prop_pair *next; /* next prop_pair with same proposal # */
 137                                 /* (bundle case) */
 138         struct prop_pair *tnext; /* next prop_pair in same proposal payload */
 139                                 /* (multiple tranform case) */
 140 };
 141 #define MAXPROPPAIRLEN  256     /* It's enough because field size is 1 octet. */
 142
 143 /*
 144  * Lifetime length selection refered to the section 4.5.4 of RFC2407.  It does
 145  * not completely conform to the description of RFC.  There are four types of
 146  * the behavior.  If the value of "proposal_check" in "remote" directive is;
 147  *     "obey"
 148  *         the responder obey the initiator anytime.
 149  *     "strict"
 150  *         If the responder's length is longer than the initiator's one, the
 151  *         responder uses the intitiator's one.  Otherwise rejects the proposal.
 152  *         If PFS is not required by the responder, the responder obeys the
 153  *         proposal.  If PFS is required by both sides and if the responder's
 154  *         group is not equal to the initiator's one, then the responder reject
 155  *         the proposal.
 156  *     "claim"
 157  *         If the responder's length is longer than the initiator's one, the
 158  *         responder use the intitiator's one.  If the responder's length is
 159  *         shorter than the initiator's one, the responder uses own length
 160  *         AND send RESPONDER-LIFETIME notify message to a initiator in the
 161  *         case of lifetime.
 162  *         About PFS, this directive is same as "strict".
 163  *     "exact"
 164  *         If the initiator's length is not equal to the responder's one, the
 165  *         responder rejects the proposal.
 166  *         If PFS is required and if the responder's group is not equal to
 167  *         the initiator's one, then the responder reject the proposal.
 168  * XXX should be defined the behavior of key length.
 169  */
 170 #define PROP_CHECK_OBEY         1
 171 #define PROP_CHECK_STRICT       2
 172 #define PROP_CHECK_CLAIM        3
 173 #define PROP_CHECK_EXACT        4
 174
 175 struct sainfo;
 176 struct ph1handle;
 177 struct secpolicy;
 178 extern struct saprop *newsaprop __P((void));
 179 extern struct saproto *newsaproto __P((void));
 180 extern void inssaprop __P((struct saprop **, struct saprop *));
 181 extern void inssaproto __P((struct saprop *, struct saproto *));
 182 extern void inssaprotorev __P((struct saprop *, struct saproto *));
 183 extern struct satrns *newsatrns __P((void));
 184 extern void inssatrns __P((struct saproto *, struct satrns *));
 185 extern struct saprop *cmpsaprop_alloc __P((struct ph1handle *,
 186         const struct saprop *, const struct saprop *, int));
 187 extern int cmpsaprop __P((const struct saprop *, const struct saprop *));
 188 extern int cmpsatrns __P((const struct satrns *, const struct satrns *));
 189 extern int set_satrnsbysainfo __P((struct saproto *, struct sainfo *));
 190 extern struct saprop *aproppair2saprop __P((struct prop_pair *));
 191 extern void free_proppair __P((struct prop_pair **));
 192 extern void flushsaprop __P((struct saprop *));
 193 extern void flushsaproto __P((struct saproto *));
 194 extern void flushsatrns __P((struct satrns *));
 195 extern void printsaprop __P((const int, const struct saprop *));
 196 extern void printsaprop0 __P((const int, const struct saprop *));
 197 extern void printsaproto __P((const int, const struct saproto *));
 198 extern void printsatrns __P((const int, const int, const struct satrns *));
 199 extern void print_proppair0 __P((int, struct prop_pair *, int));
 200 extern void print_proppair __P((int, struct prop_pair *));
 201 extern int set_proposal_from_policy __P((struct ph2handle *,
 202         struct secpolicy *, struct secpolicy *));
 203 extern int set_proposal_from_proposal __P((struct ph2handle *));