1/* $NetBSD: oakley.h,v 1.5 2006/10/06 12:02:27 manu Exp $ */ 2 3/* Id: oakley.h,v 1.13 2005/05/30 20:12:43 fredsen Exp */ 4 5/* 6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. Neither the name of the project nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34#ifndef _OAKLEY_H 35#define _OAKLEY_H 36 37#include "config.h" 38#include "racoon_types.h" 39 40#include "vmbuf.h" 41#ifndef HAVE_OPENSSL 42#include <Security/SecDH.h> 43#endif 44 45 46/* refer to RFC 2409 */ 47 48/* Attribute Classes */ 49#define OAKLEY_ATTR_ENC_ALG 1 /* B */ 50#define OAKLEY_ATTR_ENC_ALG_DES 1 51#define OAKLEY_ATTR_ENC_ALG_IDEA 2 52#define OAKLEY_ATTR_ENC_ALG_BLOWFISH 3 53#define OAKLEY_ATTR_ENC_ALG_RC5 4 54#define OAKLEY_ATTR_ENC_ALG_3DES 5 55#define OAKLEY_ATTR_ENC_ALG_CAST 6 56#define OAKLEY_ATTR_ENC_ALG_AES 7 57 /* 65001 - 65535 Private Use */ 58#define OAKLEY_ATTR_HASH_ALG 2 /* B */ 59#define OAKLEY_ATTR_HASH_ALG_MD5 1 60#define OAKLEY_ATTR_HASH_ALG_SHA 2 61#define OAKLEY_ATTR_HASH_ALG_TIGER 3 62#if defined(WITH_SHA2) 63#define OAKLEY_ATTR_HASH_ALG_SHA2_256 4 64#define OAKLEY_ATTR_HASH_ALG_SHA2_384 5 65#define OAKLEY_ATTR_HASH_ALG_SHA2_512 6 66#endif 67 /* 65001 - 65535 Private Use */ 68#define OAKLEY_ATTR_AUTH_METHOD 3 /* B */ 69#define OAKLEY_ATTR_AUTH_METHOD_PSKEY 1 70#define OAKLEY_ATTR_AUTH_METHOD_DSSSIG 2 71#define OAKLEY_ATTR_AUTH_METHOD_RSASIG 3 72#define OAKLEY_ATTR_AUTH_METHOD_RSAENC 4 73#define OAKLEY_ATTR_AUTH_METHOD_RSAREV 5 74#define OAKLEY_ATTR_AUTH_METHOD_EGENC 6 75#define OAKLEY_ATTR_AUTH_METHOD_EGREV 7 76 /* Hybrid Auth */ 77#ifdef ENABLE_HYBRID 78#define OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I 64221 79#define OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R 64222 80#define OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I 64223 81#define OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R 64224 82 83 /* 65001 - 65535 Private Use */ 84 85 /* Plain Xauth */ 86#define OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I 65001 87#define OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R 65002 88#define OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I 65003 89#define OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R 65004 90#define OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I 65005 91#define OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R 65006 92#define OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I 65007 93#define OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R 65008 94#define OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I 65009 95#define OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R 65010 96#define OAKLEY_ATTR_AUTH_METHOD_EAP_PSKEY_I OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I 97#define OAKLEY_ATTR_AUTH_METHOD_EAP_PSKEY_R OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R 98#define OAKLEY_ATTR_AUTH_METHOD_EAP_DSSSIG_I OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I 99#define OAKLEY_ATTR_AUTH_METHOD_EAP_DSSSIG_R OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R 100#define OAKLEY_ATTR_AUTH_METHOD_EAP_RSASIG_I OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I 101#define OAKLEY_ATTR_AUTH_METHOD_EAP_RSASIG_R OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R 102#define OAKLEY_ATTR_AUTH_METHOD_EAP_RSAENC_I OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I 103#define OAKLEY_ATTR_AUTH_METHOD_EAP_RSAENC_R OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R 104#define OAKLEY_ATTR_AUTH_METHOD_EAP_RSAREV_I OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I 105#define OAKLEY_ATTR_AUTH_METHOD_EAP_RSAREV_R OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R 106#endif 107 108 /* 65500 -> still private 109 * to avoid clash with GSSAPI_KRB below 110 */ 111#define FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I 65500 112#define FICTIVE_AUTH_METHOD_EAP_PSKEY_I FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I 113 114 115 /* 116 * The following are valid when the Vendor ID is one of 117 * the following: 118 * 119 * MD5("A GSS-API Authentication Method for IKE") 120 * MD5("GSSAPI") (recognized by Windows 2000) 121 * MD5("MS NT5 ISAKMPOAKLEY") (sent by Windows 2000) 122 */ 123#define OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB 65001 124#define OAKLEY_ATTR_GRP_DESC 4 /* B */ 125#define OAKLEY_ATTR_GRP_DESC_MODP768 1 126#define OAKLEY_ATTR_GRP_DESC_MODP1024 2 127#define OAKLEY_ATTR_GRP_DESC_EC2N155 3 128#define OAKLEY_ATTR_GRP_DESC_EC2N185 4 129#define OAKLEY_ATTR_GRP_DESC_MODP1536 5 130#define OAKLEY_ATTR_GRP_DESC_MODP2048 14 131#define OAKLEY_ATTR_GRP_DESC_MODP3072 15 132#define OAKLEY_ATTR_GRP_DESC_MODP4096 16 133#define OAKLEY_ATTR_GRP_DESC_MODP6144 17 134#define OAKLEY_ATTR_GRP_DESC_MODP8192 18 135 /* 32768 - 65535 Private Use */ 136#define OAKLEY_ATTR_GRP_TYPE 5 /* B */ 137#define OAKLEY_ATTR_GRP_TYPE_MODP 1 138#define OAKLEY_ATTR_GRP_TYPE_ECP 2 139#define OAKLEY_ATTR_GRP_TYPE_EC2N 3 140 /* 65001 - 65535 Private Use */ 141#define OAKLEY_ATTR_GRP_PI 6 /* V */ 142#define OAKLEY_ATTR_GRP_GEN_ONE 7 /* V */ 143#define OAKLEY_ATTR_GRP_GEN_TWO 8 /* V */ 144#define OAKLEY_ATTR_GRP_CURVE_A 9 /* V */ 145#define OAKLEY_ATTR_GRP_CURVE_B 10 /* V */ 146#define OAKLEY_ATTR_SA_LD_TYPE 11 /* B */ 147#define OAKLEY_ATTR_SA_LD_TYPE_DEFAULT 1 148#define OAKLEY_ATTR_SA_LD_TYPE_SEC 1 149#define OAKLEY_ATTR_SA_LD_TYPE_KB 2 150#define OAKLEY_ATTR_SA_LD_TYPE_MAX 3 151 /* 65001 - 65535 Private Use */ 152#define OAKLEY_ATTR_SA_LD 12 /* V */ 153#define OAKLEY_ATTR_SA_LD_SEC_DEFAULT 28800 /* 8 hours */ 154#define OAKLEY_ATTR_PRF 13 /* B */ 155#define OAKLEY_ATTR_KEY_LEN 14 /* B */ 156#define OAKLEY_ATTR_FIELD_SIZE 15 /* B */ 157#define OAKLEY_ATTR_GRP_ORDER 16 /* V */ 158#define OAKLEY_ATTR_BLOCK_SIZE 17 /* B */ 159 /* 16384 - 32767 Private Use */ 160 161 /* 162 * The following are valid when the Vendor ID is one of 163 * the following: 164 * 165 * MD5("A GSS-API Authentication Method for IKE") 166 * MD5("GSSAPI") (recognized by Windows 2000) 167 * MD5("MS NT5 ISAKMPOAKLEY") (sent by Windows 2000) 168 */ 169#define OAKLEY_ATTR_GSS_ID 16384 170 171#define MAXPADLWORD 20 172 173struct dhgroup { 174#ifndef HAVE_OPENSSL 175 int desc; 176#endif 177 int type; 178 vchar_t *prime; 179 int gen1; 180 int gen2; 181 vchar_t *curve_a; 182 vchar_t *curve_b; 183 vchar_t *order; 184}; 185 186typedef enum cert_status { 187 CERT_STATUS_OK = 0, 188 CERT_STATUS_PREMATURE, 189 CERT_STATUS_EXPIRED, 190 CERT_STATUS_INVALID_SUBJNAME, 191 CERT_STATUS_INVALID_SUBJALTNAME, 192 CERT_STATUS_INVALID, 193} cert_status_t; 194 195#define IS_CERT_STATUS_ERROR(status) (status > CERT_STATUS_OK && status < CERT_STATUS_INVALID) 196 197/* certificate holder */ 198typedef struct cert_t_tag { 199 u_int8_t type; /* type of CERT, must be same to pl->v[0]*/ 200 vchar_t cert; /* pointer to the CERT */ 201 vchar_t *pl; /* CERT payload minus isakmp general header */ 202 cert_status_t status; 203 struct cert_t_tag *chain; 204} cert_t; 205 206struct isakmp_ivm; 207 208extern int oakley_get_defaultlifetime (void); 209 210extern int oakley_dhinit (void); 211extern void oakley_dhgrp_free (struct dhgroup *); 212#ifdef HAVE_OPENSSL 213extern int oakley_dh_compute (const struct dhgroup *, vchar_t *, vchar_t *, vchar_t *, vchar_t **); 214extern int oakley_dh_generate (const struct dhgroup *, vchar_t **, vchar_t **); 215#else 216extern int oakley_dh_compute (const struct dhgroup *, vchar_t *, size_t, vchar_t **, SecDHContext*); 217extern int oakley_dh_generate (const struct dhgroup *, vchar_t **, size_t *, SecDHContext*); 218#endif 219extern int oakley_setdhgroup (int, struct dhgroup **); 220 221extern vchar_t *oakley_prf (vchar_t *, vchar_t *, phase1_handle_t *); 222extern vchar_t *oakley_hash (vchar_t *, phase1_handle_t *); 223 224extern int oakley_compute_keymat (phase2_handle_t *, int); 225extern int oakley_compute_ikev2_keymat (phase2_handle_t *); 226 227#if notyet 228extern vchar_t *oakley_compute_hashx (void); 229#endif 230extern vchar_t *oakley_compute_hash3 (phase1_handle_t *, u_int32_t, vchar_t *); 231extern vchar_t *oakley_compute_hash1 (phase1_handle_t *, u_int32_t, vchar_t *); 232extern vchar_t *oakley_ph1hash_common (phase1_handle_t *, int); 233extern vchar_t *oakley_ph1hash_base_i (phase1_handle_t *, int); 234extern vchar_t *oakley_ph1hash_base_r (phase1_handle_t *, int); 235 236extern int oakley_validate_auth (phase1_handle_t *); 237extern int oakley_getmycert (phase1_handle_t *); 238extern int oakley_getsign (phase1_handle_t *); 239extern cert_t * oakley_get_peer_cert_from_certchain (phase1_handle_t *); 240extern int oakley_find_status_in_certchain (cert_t *, cert_status_t); 241extern void oakley_verify_certid (phase1_handle_t *); 242extern vchar_t *oakley_getcr (phase1_handle_t *); 243extern int oakley_checkcr (phase1_handle_t *); 244extern int oakley_needcr (int); 245struct isakmp_gen; 246extern int oakley_savecert (phase1_handle_t *, struct isakmp_gen *); 247extern int oakley_savecr (phase1_handle_t *, struct isakmp_gen *); 248 249extern vchar_t * oakley_getpskall (phase1_handle_t *); 250extern int oakley_skeyid (phase1_handle_t *); 251extern int oakley_skeyid_dae (phase1_handle_t *); 252 253extern int oakley_compute_enckey (phase1_handle_t *); 254extern cert_t *oakley_newcert (void); 255extern void oakley_delcert (cert_t *); 256extern int oakley_newiv (phase1_handle_t *); 257extern struct isakmp_ivm *oakley_newiv2 (phase1_handle_t *, u_int32_t); 258extern int oakley_newiv_ikev2(phase1_handle_t *iph1); 259extern void oakley_delivm (struct isakmp_ivm *); 260extern vchar_t *oakley_do_decrypt (phase1_handle_t *, vchar_t *, vchar_t *, vchar_t *); 261extern vchar_t *oakley_do_encrypt (phase1_handle_t *, vchar_t *, vchar_t *, vchar_t *); 262 263#ifdef ENABLE_HYBRID 264#define AUTHMETHOD(iph1) \ 265 (((iph1)->rmconf->xauth && \ 266 (iph1)->approval->authmethod == OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I) ? \ 267 FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I : (iph1)->approval->authmethod) 268#define RMAUTHMETHOD(iph1) \ 269 (((iph1)->rmconf->xauth && \ 270 (iph1)->rmconf->proposal->authmethod == \ 271 OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I) ? \ 272 FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I : \ 273 (iph1)->rmconf->proposal->authmethod) 274#else 275#define AUTHMETHOD(iph1) (iph1)->approval->authmethod 276#define RMAUTHMETHOD(iph1) (iph1)->rmconf->proposal->authmethod 277#endif /* ENABLE_HYBRID */ 278 279#endif /* _OAKLEY_H */ 280