1/* $Id: proposal.h,v 1.5.10.1 2005/05/12 19:34:10 manubsd Exp $ */ 2 3/* 4 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the project nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32#ifndef _PROPOSAL_H 33#define _PROPOSAL_H 34 35#include <sys/queue.h> 36 37/* 38 * A. chained list of transform, only for single proto_id 39 * (this is same as set of transforms in single proposal payload) 40 * B. proposal. this will point to multiple (A) items (order is important 41 * here so pointer to (A) must be ordered array, or chained list). 42 * this covers multiple proposal on a packet if proposal # is the same. 43 * C. finally, (B) needs to be connected as chained list. 44 * 45 * head ---> prop[.......] ---> prop[...] ---> prop[...] ---> ... 46 * | | | | 47 * | | | +- proto4 <== must preserve order here 48 * | | +--- proto3 49 * | +----- proto2 50 * +------- proto1[trans1, trans2, trans3, ...] 51 * 52 * incoming packets needs to be parsed to construct the same structure 53 * (check "prop_pair" too). 54 */ 55/* SA proposal specification */ 56struct saprop { 57 int prop_no; 58 time_t lifetime; // For IKEv2 - only used to set lifetime in kernel 59 int lifebyte; // For IKEv2 - only used to set lifetime in kernel 60 int pfs_group; // For IKEv2 - also saved in transform 61 int claim; /* IKEv1 only - flag to send RESPONDER-LIFETIME. */ 62 /* XXX assumed DOI values are 1 or 2. */ 63 64 struct saproto *head; 65 struct saprop *next; 66}; 67 68/* SA protocol specification */ 69struct saproto { 70 int proto_id; 71 size_t spisize; /* spi size */ 72 int encmode; // For IKEv2 - only used to set encode mode in the kernel 73 74 int udp_encap; // For IKEv2 - only used to set kernel 75 76 /* XXX should be vchar_t * */ 77 /* these are network byte order */ 78 u_int32_t spi; /* inbound. i.e. --SA-> me */ 79 u_int32_t spi_p; /* outbound. i.e. me -SA-> */ 80 81 vchar_t *keymat; /* KEYMAT */ 82 vchar_t *keymat_p; /* peer's KEYMAT */ 83 84 int reqid_out; /* request id (outbound) */ 85 int reqid_in; /* request id (inbound) */ 86 87 int ok; /* if 1, success to set SA in kenrel */ 88 89 struct satrns *head; /* header of transform */ 90 struct saproto *next; /* next protocol */ 91}; 92 93/* SA algorithm specification */ 94struct satrns { 95 int trns_no; 96 int trns_id; /* transform id */ 97 int encklen; /* key length of encryption algorithm */ 98 int authtype; /* authentication algorithm if ESP */ 99 100 struct satrns *next; /* next transform */ 101}; 102 103/* 104 * prop_pair: (proposal number, transform number) 105 * 106 * (SA (P1 (T1 T2)) (P1' (T1' T2')) (P2 (T1" T2"))) 107 * 108 * p[1] p[2] 109 * top (P1,T1) (P2",T1") 110 * | |tnext |tnext 111 * | v v 112 * | (P1, T2) (P2", T2") 113 * v next 114 * (P1', T1') 115 * |tnext 116 * v 117 * (P1', T2') 118 * 119 * when we convert it to saprop in prop2saprop(), it should become like: 120 * 121 * (next) 122 * saprop --------------------> saprop 123 * | (head) | (head) 124 * +-> saproto +-> saproto 125 * | | (head) | (head) 126 * | +-> satrns(P1 T1) +-> satrns(P2" T1") 127 * | | (next) | (next) 128 * | v v 129 * | satrns(P1, T2) satrns(P2", T2") 130 * v (next) 131 * saproto 132 * | (head) 133 * +-> satrns(P1' T1') 134 * | (next) 135 * v 136 * satrns(P1', T2') 137 */ 138struct prop_pair { 139 struct isakmp_pl_p *prop; 140 struct isakmp_pl_t *trns; 141 struct prop_pair *next; /* next prop_pair with same proposal # */ 142 /* (bundle case) */ 143 struct prop_pair *tnext; /* next prop_pair in same proposal payload */ 144 /* (multiple tranform case) */ 145}; 146#define MAXPROPPAIRLEN 256 /* It's enough because field size is 1 octet. */ 147 148/* 149 * Lifetime length selection refered to the section 4.5.4 of RFC2407. It does 150 * not completely conform to the description of RFC. There are four types of 151 * the behavior. If the value of "proposal_check" in "remote" directive is; 152 * "obey" 153 * the responder obey the initiator anytime. 154 * "strict" 155 * If the responder's length is longer than the initiator's one, the 156 * responder uses the intitiator's one. Otherwise rejects the proposal. 157 * If PFS is not required by the responder, the responder obeys the 158 * proposal. If PFS is required by both sides and if the responder's 159 * group is not equal to the initiator's one, then the responder reject 160 * the proposal. 161 * "claim" 162 * If the responder's length is longer than the initiator's one, the 163 * responder use the intitiator's one. If the responder's length is 164 * shorter than the initiator's one, the responder uses own length 165 * AND send RESPONDER-LIFETIME notify message to a initiator in the 166 * case of lifetime. 167 * About PFS, this directive is same as "strict". 168 * "exact" 169 * If the initiator's length is not equal to the responder's one, the 170 * responder rejects the proposal. 171 * If PFS is required and if the responder's group is not equal to 172 * the initiator's one, then the responder reject the proposal. 173 * XXX should be defined the behavior of key length. 174 */ 175#define PROP_CHECK_OBEY 1 176#define PROP_CHECK_STRICT 2 177#define PROP_CHECK_CLAIM 3 178#define PROP_CHECK_EXACT 4 179 180struct sainfo; 181struct secpolicy; 182extern struct saprop *newsaprop (void); 183extern struct saproto *newsaproto (void); 184extern void inssaprop (struct saprop **, struct saprop *); 185extern void inssaproto (struct saprop *, struct saproto *); 186extern void inssaprotorev (struct saprop *, struct saproto *); 187extern struct satrns *newsatrns (void); 188extern void inssatrns (struct saproto *, struct satrns *); 189extern int satrns_remove_from_list(struct satrns **, struct satrns *); 190extern struct saprop *cmpsaprop_alloc (phase1_handle_t *, 191 const struct saprop *, const struct saprop *, int); 192extern int cmpsaprop (const struct saprop *, const struct saprop *); 193extern int cmpsatrns (int, const struct satrns *, const struct satrns *); 194extern int set_satrnsbysainfo (struct saproto *, struct sainfo *, u_int8_t, int); 195extern struct saprop *aproppair2saprop (struct prop_pair *); 196extern void free_proppair (struct prop_pair **); 197extern void flushsaprop (struct saprop *); 198extern void flushsaproto (struct saproto *); 199extern void flushsatrns (struct satrns *); 200extern void printsaprop (const int, const struct saprop *); 201extern void printsaprop0 (const int, const struct saprop *); 202extern void printsaproto (const int, const struct saproto *); 203extern void printsatrns (const int, const int, const struct satrns *); 204extern void print_proppair0 (int, struct prop_pair *, int); 205extern void print_proppair (int, struct prop_pair *); 206extern int set_proposal_from_policy (phase2_handle_t *, 207 struct secpolicy *, struct secpolicy *); 208extern int set_proposal_from_proposal (phase2_handle_t *); 209extern int tunnel_mode_prop (struct saprop *); 210extern struct saprop *dupsaprop (struct saprop *, int); 211extern struct satrns *dupsatrns_1(struct satrns *); 212 213#endif /* _PROPOSAL_H */ 214