1/* $Id: proposal.h,v 1.5.10.1 2005/05/12 19:34:10 manubsd Exp $ */ 2 3/* 4 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the project nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32#ifndef _PROPOSAL_H 33#define _PROPOSAL_H 34 35#include <sys/queue.h> 36 37/* 38 * A. chained list of transform, only for single proto_id 39 * (this is same as set of transforms in single proposal payload) 40 * B. proposal. this will point to multiple (A) items (order is important 41 * here so pointer to (A) must be ordered array, or chained list). 42 * this covers multiple proposal on a packet if proposal # is the same. 43 * C. finally, (B) needs to be connected as chained list. 44 * 45 * head ---> prop[.......] ---> prop[...] ---> prop[...] ---> ... 46 * | | | | 47 * | | | +- proto4 <== must preserve order here 48 * | | +--- proto3 49 * | +----- proto2 50 * +------- proto1[trans1, trans2, trans3, ...] 51 * 52 * incoming packets needs to be parsed to construct the same structure 53 * (check "prop_pair" too). 54 */ 55/* SA proposal specification */ 56struct saprop { 57 int prop_no; 58 time_t lifetime; // For IKEv2 - only used to set lifetime in kernel 59 int lifebyte; // For IKEv2 - only used to set lifetime in kernel 60 int pfs_group; // For IKEv2 - also saved in transform 61 int claim; /* IKEv1 only - flag to send RESPONDER-LIFETIME. */ 62 /* XXX assumed DOI values are 1 or 2. */ 63 64 struct saproto *head; 65 struct saprop *next; 66}; 67 68/* SA protocol specification */ 69struct saproto { 70 int proto_id; 71 size_t spisize; /* spi size */ 72 int encmode; // For IKEv2 - only used to set encode mode in the kernel 73 74 int udp_encap; // For IKEv2 - only used to set kernel 75 76 /* XXX should be vchar_t * */ 77 /* these are network byte order */ 78 u_int32_t spi; /* inbound. i.e. --SA-> me */ 79 u_int32_t spi_p; /* outbound. i.e. me -SA-> */ 80 81 vchar_t *keymat; /* KEYMAT */ 82 vchar_t *keymat_p; /* peer's KEYMAT */ 83 84 int reqid_out; /* request id (outbound) */ 85 int reqid_in; /* request id (inbound) */ 86 87 int ok; /* if 1, success to set SA in kenrel */ 88 89 struct satrns *head; /* header of transform */ 90 struct saproto *next; /* next protocol */ 91}; 92 93/* SA algorithm specification */ 94struct satrns { 95 int trns_no; 96 int trns_type; /* IKEv2 only - transform type */ 97 int trns_id; /* transform id */ 98 int encklen; /* key length of encryption algorithm */ 99 int authtype; /* authentication algorithm if ESP */ 100 101 struct satrns *next; /* next transform */ 102}; 103 104/* 105 * prop_pair: (proposal number, transform number) 106 * 107 * (SA (P1 (T1 T2)) (P1' (T1' T2')) (P2 (T1" T2"))) 108 * 109 * p[1] p[2] 110 * top (P1,T1) (P2",T1") 111 * | |tnext |tnext 112 * | v v 113 * | (P1, T2) (P2", T2") 114 * v next 115 * (P1', T1') 116 * |tnext 117 * v 118 * (P1', T2') 119 * 120 * when we convert it to saprop in prop2saprop(), it should become like: 121 * 122 * (next) 123 * saprop --------------------> saprop 124 * | (head) | (head) 125 * +-> saproto +-> saproto 126 * | | (head) | (head) 127 * | +-> satrns(P1 T1) +-> satrns(P2" T1") 128 * | | (next) | (next) 129 * | v v 130 * | satrns(P1, T2) satrns(P2", T2") 131 * v (next) 132 * saproto 133 * | (head) 134 * +-> satrns(P1' T1') 135 * | (next) 136 * v 137 * satrns(P1', T2') 138 */ 139struct prop_pair { 140 struct isakmp_pl_p *prop; 141 struct isakmp_pl_t *trns; 142 struct prop_pair *next; /* next prop_pair with same proposal # */ 143 /* (bundle case) */ 144 struct prop_pair *tnext; /* next prop_pair in same proposal payload */ 145 /* (multiple tranform case) */ 146}; 147#define MAXPROPPAIRLEN 256 /* It's enough because field size is 1 octet. */ 148 149/* 150 * Lifetime length selection refered to the section 4.5.4 of RFC2407. It does 151 * not completely conform to the description of RFC. There are four types of 152 * the behavior. If the value of "proposal_check" in "remote" directive is; 153 * "obey" 154 * the responder obey the initiator anytime. 155 * "strict" 156 * If the responder's length is longer than the initiator's one, the 157 * responder uses the intitiator's one. Otherwise rejects the proposal. 158 * If PFS is not required by the responder, the responder obeys the 159 * proposal. If PFS is required by both sides and if the responder's 160 * group is not equal to the initiator's one, then the responder reject 161 * the proposal. 162 * "claim" 163 * If the responder's length is longer than the initiator's one, the 164 * responder use the intitiator's one. If the responder's length is 165 * shorter than the initiator's one, the responder uses own length 166 * AND send RESPONDER-LIFETIME notify message to a initiator in the 167 * case of lifetime. 168 * About PFS, this directive is same as "strict". 169 * "exact" 170 * If the initiator's length is not equal to the responder's one, the 171 * responder rejects the proposal. 172 * If PFS is required and if the responder's group is not equal to 173 * the initiator's one, then the responder reject the proposal. 174 * XXX should be defined the behavior of key length. 175 */ 176#define PROP_CHECK_OBEY 1 177#define PROP_CHECK_STRICT 2 178#define PROP_CHECK_CLAIM 3 179#define PROP_CHECK_EXACT 4 180#define PROP_CHECK_IKEV2 5 181 182struct sainfo; 183struct secpolicy; 184extern struct saprop *newsaprop (void); 185extern struct saproto *newsaproto (void); 186extern void inssaprop (struct saprop **, struct saprop *); 187extern void inssaproto (struct saprop *, struct saproto *); 188extern void inssaprotorev (struct saprop *, struct saproto *); 189extern struct satrns *newsatrns (void); 190extern void inssatrns (struct saproto *, struct satrns *); 191extern int satrns_remove_from_list(struct satrns **, struct satrns *); 192extern struct saprop *cmpsaprop_alloc (phase1_handle_t *, 193 const struct saprop *, const struct saprop *, int); 194extern int cmpsaprop (const struct saprop *, const struct saprop *); 195extern int cmpsatrns (int, const struct satrns *, const struct satrns *); 196extern int set_satrnsbysainfo (struct saproto *, struct sainfo *, u_int8_t, int); 197extern struct saprop *aproppair2saprop (struct prop_pair *); 198extern void free_proppair (struct prop_pair **); 199extern void flushsaprop (struct saprop *); 200extern void flushsaproto (struct saproto *); 201extern void flushsatrns (struct satrns *); 202extern void printsaprop (const int, const struct saprop *); 203extern void printsaprop0 (const int, const struct saprop *); 204extern void printsaproto (const int, const struct saproto *); 205extern void printsatrns (const int, const int, const struct satrns *); 206extern void print_proppair0 (int, struct prop_pair *, int); 207extern void print_proppair (int, struct prop_pair *); 208extern int set_proposal_from_policy (phase2_handle_t *, 209 struct secpolicy *, struct secpolicy *); 210extern int set_proposal_from_proposal (phase2_handle_t *); 211extern int tunnel_mode_prop (struct saprop *); 212extern struct saprop *dupsaprop (struct saprop *, int); 213extern struct satrns *dupsatrns_1(struct satrns *); 214 215#endif /* _PROPOSAL_H */ 216