racoon.tproj/proposal.h

   1 /*      $KAME: proposal.h,v 1.16 2001/08/16 05:02:13 itojun Exp $       */
   2
   3 /*
   4  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. Neither the name of the project nor the names of its contributors
  16  *    may be used to endorse or promote products derived from this software
  17  *    without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGE.
  30  */
  31
  32 #ifndef __PROPOSAL_H__
  33 #define __PROPOSAL_H__
  34
  35 #include <sys/queue.h>
  36
  37 /*
  38  *   A. chained list of transform, only for single proto_id
  39  *      (this is same as set of transforms in single proposal payload)
  40  *   B. proposal.  this will point to multiple (A) items (order is important
  41  *      here so pointer to (A) must be ordered array, or chained list).
  42  *      this covers multiple proposal on a packet if proposal # is the same.
  43  *   C. finally, (B) needs to be connected as chained list.
  44  *
  45  *      head ---> prop[.......] ---> prop[...] ---> prop[...] ---> ...
  46  *                     | | | |
  47  *                     | | | +- proto4  <== must preserve order here
  48  *                     | | +--- proto3
  49  *                     | +----- proto2
  50  *                     +------- proto1[trans1, trans2, trans3, ...]
  51  *
  52  *   incoming packets needs to be parsed to construct the same structure
  53  *   (check "prop_pair" too).
  54  */
  55 /* SA proposal specification */
  56 struct saprop {
  57         int prop_no;
  58         time_t lifetime;
  59         int lifebyte;
  60         int pfs_group;                  /* pfs group */
  61         int claim;                      /* flag to send RESPONDER-LIFETIME. */
  62                                         /* XXX assumed DOI values are 1 or 2. */
  63
  64         struct saproto *head;
  65         struct saprop *next;
  66 };
  67
  68 /* SA protocol specification */
  69 struct saproto {
  70         int proto_id;
  71         size_t spisize;                 /* spi size */
  72         int encmode;                    /* encryption mode */
  73
  74         /* XXX should be vchar_t * */
  75         /* these are network byte order */
  76         u_int32_t spi;                  /* inbound. i.e. --SA-> me */
  77         u_int32_t spi_p;                /* outbound. i.e. me -SA-> */
  78
  79         vchar_t *keymat;                /* KEYMAT */
  80         vchar_t *keymat_p;              /* peer's KEYMAT */
  81
  82         int reqid_out;                  /* request id (outbound) */
  83         int reqid_in;                   /* request id (inbound) */
  84
  85         int ok;                         /* if 1, success to set SA in kenrel */
  86
  87         struct satrns *head;            /* header of transform */
  88         struct saproto *next;           /* next protocol */
  89 };
  90
  91 /* SA algorithm specification */
  92 struct satrns {
  93         int trns_no;
  94         int trns_id;                    /* transform id */
  95         int encklen;                    /* key length of encryption algorithm */
  96         int authtype;                   /* authentication algorithm if ESP */
  97
  98         struct satrns *next;            /* next transform */
  99 };
 100
 101 /*
 102  * prop_pair: (proposal number, transform number)
 103  *
 104  *      (SA (P1 (T1 T2)) (P1' (T1' T2')) (P2 (T1" T2")))
 105  *
 106  *              p[1]      p[2]
 107  *      top     (P1,T1)   (P2",T1")
 108  *               |  |tnext     |tnext
 109  *               |  v          v
 110  *               | (P1, T2)   (P2", T2")
 111  *               v next
 112  *              (P1', T1')
 113  *                  |tnext
 114  *                  v
 115  *                 (P1', T2')
 116  *
 117  * when we convert it to saprop in prop2saprop(), it should become like:
 118  *
 119  *               (next)
 120  *      saprop --------------------> saprop
 121  *       | (head)                     | (head)
 122  *       +-> saproto                  +-> saproto
 123  *            | | (head)                     | (head)
 124  *            | +-> satrns(P1 T1)            +-> satrns(P2" T1")
 125  *            |      | (next)                     | (next)
 126  *            |      v                            v
 127  *            |     satrns(P1, T2)               satrns(P2", T2")
 128  *            v (next)
 129  *           saproto
 130  *              | (head)
 131  *              +-> satrns(P1' T1')
 132  *                   | (next)
 133  *                   v
 134  *                  satrns(P1', T2')
 135  */
 136 struct prop_pair {
 137         struct isakmp_pl_p *prop;
 138         struct isakmp_pl_t *trns;
 139         struct prop_pair *next; /* next prop_pair with same proposal # */
 140                                 /* (bundle case) */
 141         struct prop_pair *tnext; /* next prop_pair in same proposal payload */
 142                                 /* (multiple tranform case) */
 143 };
 144 #define MAXPROPPAIRLEN  256     /* It's enough because field size is 1 octet. */
 145
 146 /*
 147  * Lifetime length selection refered to the section 4.5.4 of RFC2407.  It does
 148  * not completely conform to the description of RFC.  There are four types of
 149  * the behavior.  If the value of "proposal_check" in "remote" directive is;
 150  *     "obey"
 151  *         the responder obey the initiator anytime.
 152  *     "strict"
 153  *         If the responder's length is longer than the initiator's one, the
 154  *         responder uses the intitiator's one.  Otherwise rejects the proposal.
 155  *         If PFS is not required by the responder, the responder obeys the
 156  *         proposal.  If PFS is required by both sides and if the responder's
 157  *         group is not equal to the initiator's one, then the responder reject
 158  *         the proposal.
 159  *     "claim"
 160  *         If the responder's length is longer than the initiator's one, the
 161  *         responder use the intitiator's one.  If the responder's length is
 162  *         shorter than the initiator's one, the responder uses own length
 163  *         AND send RESPONDER-LIFETIME notify message to a initiator in the
 164  *         case of lifetime.
 165  *         About PFS, this directive is same as "strict".
 166  *     "exact"
 167  *         If the initiator's length is not equal to the responder's one, the
 168  *         responder rejects the proposal.
 169  *         If PFS is required and if the responder's group is not equal to
 170  *         the initiator's one, then the responder reject the proposal.
 171  * XXX should be defined the behavior of key length.
 172  */
 173 #define PROP_CHECK_OBEY         1
 174 #define PROP_CHECK_STRICT       2
 175 #define PROP_CHECK_CLAIM        3
 176 #define PROP_CHECK_EXACT        4
 177
 178 struct sainfo;
 179 struct ph1handle;
 180 struct secpolicy;
 181 extern struct saprop *newsaprop __P((void));
 182 extern struct saproto *newsaproto __P((void));
 183 extern void inssaprop __P((struct saprop **, struct saprop *));
 184 extern void inssaproto __P((struct saprop *, struct saproto *));
 185 extern void inssaprotorev __P((struct saprop *, struct saproto *));
 186 extern struct satrns *newsatrns __P((void));
 187 extern void inssatrns __P((struct saproto *, struct satrns *));
 188 extern struct saprop *cmpsaprop_alloc __P((struct ph1handle *,
 189         const struct saprop *, const struct saprop *, int));
 190 extern int cmpsaprop __P((const struct saprop *, const struct saprop *));
 191 extern int cmpsatrns __P((const struct satrns *, const struct satrns *));
 192 extern int set_satrnsbysainfo __P((struct saproto *, struct sainfo *));
 193 extern struct saprop *aproppair2saprop __P((struct prop_pair *));
 194 extern void free_proppair __P((struct prop_pair **));
 195 extern void flushsaprop __P((struct saprop *));
 196 extern void flushsaproto __P((struct saproto *));
 197 extern void flushsatrns __P((struct satrns *));
 198 extern void printsaprop __P((const int, const struct saprop *));
 199 extern void printsaprop0 __P((const int, const struct saprop *));
 200 extern void printsaproto __P((const int, const struct saproto *));
 201 extern void printsatrns __P((const int, const int, const struct satrns *));
 202 extern void print_proppair0 __P((int, struct prop_pair *, int));
 203 extern void print_proppair __P((int, struct prop_pair *));
 204 extern int set_proposal_from_policy __P((struct ph2handle *,
 205         struct secpolicy *, struct secpolicy *));
 206 extern int set_proposal_from_proposal __P((struct ph2handle *));
 207
 208 #endif /* __PROPOSAL_H__ */
 209