1/* $Id: proposal.h,v 1.5.10.1 2005/05/12 19:34:10 manubsd Exp $ */
2
3/*
4 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 * 3. Neither the name of the project nor the names of its contributors
16 *    may be used to endorse or promote products derived from this software
17 *    without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 */
31
32#ifndef _PROPOSAL_H
33#define _PROPOSAL_H
34
35#include <sys/queue.h>
36
37/*
38 *   A. chained list of transform, only for single proto_id
39 *      (this is same as set of transforms in single proposal payload)
40 *   B. proposal.  this will point to multiple (A) items (order is important
41 *      here so pointer to (A) must be ordered array, or chained list).
42 *      this covers multiple proposal on a packet if proposal # is the same.
43 *   C. finally, (B) needs to be connected as chained list.
44 *
45 * 	head ---> prop[.......] ---> prop[...] ---> prop[...] ---> ...
46 * 	               | | | |
47 * 	               | | | +- proto4  <== must preserve order here
48 * 	               | | +--- proto3
49 * 	               | +----- proto2
50 * 	               +------- proto1[trans1, trans2, trans3, ...]
51 *
52 *   incoming packets needs to be parsed to construct the same structure
53 *   (check "prop_pair" too).
54 */
55/* SA proposal specification */
56struct saprop {
57	int prop_no;
58	time_t lifetime;    // For IKEv2 - only used to set lifetime in kernel
59	int lifebyte;       // For IKEv2 - only used to set lifetime in kernel
60	int pfs_group;		// For IKEv2 - also saved in transform
61	int claim;			/* IKEv1 only - flag to send RESPONDER-LIFETIME. */
62					/* XXX assumed DOI values are 1 or 2. */
63
64	struct saproto *head;
65	struct saprop *next;
66};
67
68/* SA protocol specification */
69struct saproto {
70	int proto_id;
71	size_t spisize;			/* spi size */
72	int encmode;			// For IKEv2 - only used to set encode mode in the kernel
73
74	int udp_encap;          // For IKEv2 - only used to set kernel
75
76	/* XXX should be vchar_t * */
77	/* these are network byte order */
78	u_int32_t spi;			/* inbound. i.e. --SA-> me */
79	u_int32_t spi_p;		/* outbound. i.e. me -SA-> */
80
81	vchar_t *keymat;		/* KEYMAT */
82	vchar_t *keymat_p;		/* peer's KEYMAT */
83
84	int reqid_out;			/* request id (outbound) */
85	int reqid_in;			/* request id (inbound) */
86
87	int ok;                 /* if 1, success to set SA in kenrel */
88
89	struct satrns *head;		/* header of transform */
90	struct saproto *next;		/* next protocol */
91};
92
93/* SA algorithm specification */
94struct satrns {
95	int trns_no;
96	int trns_type;          /* IKEv2 only - transform type */
97    int trns_id;			/* transform id */
98	int encklen;			/* key length of encryption algorithm */
99	int authtype;			/* authentication algorithm if ESP */
100
101	struct satrns *next;		/* next transform */
102};
103
104/*
105 * prop_pair: (proposal number, transform number)
106 *
107 *	(SA (P1 (T1 T2)) (P1' (T1' T2')) (P2 (T1" T2")))
108 *
109 *              p[1]      p[2]
110 *      top     (P1,T1)   (P2",T1")
111 *		 |  |tnext     |tnext
112 *		 |  v          v
113 *		 | (P1, T2)   (P2", T2")
114 *		 v next
115 *		(P1', T1')
116 *		    |tnext
117 *		    v
118 *		   (P1', T2')
119 *
120 * when we convert it to saprop in prop2saprop(), it should become like:
121 *
122 * 		 (next)
123 * 	saprop --------------------> saprop
124 * 	 | (head)                     | (head)
125 * 	 +-> saproto                  +-> saproto
126 * 	      | | (head)                     | (head)
127 * 	      | +-> satrns(P1 T1)            +-> satrns(P2" T1")
128 * 	      |      | (next)                     | (next)
129 * 	      |      v                            v
130 * 	      |     satrns(P1, T2)               satrns(P2", T2")
131 * 	      v (next)
132 * 	     saproto
133 * 		| (head)
134 * 		+-> satrns(P1' T1')
135 * 		     | (next)
136 * 		     v
137 * 		    satrns(P1', T2')
138 */
139struct prop_pair {
140	struct isakmp_pl_p *prop;
141	struct isakmp_pl_t *trns;
142	struct prop_pair *next;	/* next prop_pair with same proposal # */
143				/* (bundle case) */
144	struct prop_pair *tnext; /* next prop_pair in same proposal payload */
145				/* (multiple tranform case) */
146};
147#define MAXPROPPAIRLEN	256	/* It's enough because field size is 1 octet. */
148
149/*
150 * Lifetime length selection refered to the section 4.5.4 of RFC2407.  It does
151 * not completely conform to the description of RFC.  There are four types of
152 * the behavior.  If the value of "proposal_check" in "remote" directive is;
153 *     "obey"
154 *         the responder obey the initiator anytime.
155 *     "strict"
156 *         If the responder's length is longer than the initiator's one, the
157 *         responder uses the intitiator's one.  Otherwise rejects the proposal.
158 *         If PFS is not required by the responder, the responder obeys the
159 *         proposal.  If PFS is required by both sides and if the responder's
160 *         group is not equal to the initiator's one, then the responder reject
161 *         the proposal.
162 *     "claim"
163 *         If the responder's length is longer than the initiator's one, the
164 *         responder use the intitiator's one.  If the responder's length is
165 *         shorter than the initiator's one, the responder uses own length
166 *         AND send RESPONDER-LIFETIME notify message to a initiator in the
167 *         case of lifetime.
168 *         About PFS, this directive is same as "strict".
169 *     "exact"
170 *         If the initiator's length is not equal to the responder's one, the
171 *         responder rejects the proposal.
172 *         If PFS is required and if the responder's group is not equal to
173 *         the initiator's one, then the responder reject the proposal.
174 * XXX should be defined the behavior of key length.
175 */
176#define PROP_CHECK_OBEY		1
177#define PROP_CHECK_STRICT	2
178#define PROP_CHECK_CLAIM	3
179#define PROP_CHECK_EXACT	4
180#define PROP_CHECK_IKEV2	5
181
182struct sainfo;
183struct secpolicy;
184extern struct saprop *newsaprop (void);
185extern struct saproto *newsaproto (void);
186extern void inssaprop (struct saprop **, struct saprop *);
187extern void inssaproto (struct saprop *, struct saproto *);
188extern void inssaprotorev (struct saprop *, struct saproto *);
189extern struct satrns *newsatrns (void);
190extern void inssatrns (struct saproto *, struct satrns *);
191extern int satrns_remove_from_list(struct satrns **, struct satrns *);
192extern struct saprop *cmpsaprop_alloc (phase1_handle_t *,
193	const struct saprop *, const struct saprop *, int);
194extern int cmpsaprop (const struct saprop *, const struct saprop *);
195extern int cmpsatrns (int, const struct satrns *, const struct satrns *);
196extern int set_satrnsbysainfo (struct saproto *, struct sainfo *, u_int8_t, int);
197extern struct saprop *aproppair2saprop (struct prop_pair *);
198extern void free_proppair (struct prop_pair **);
199extern void flushsaprop (struct saprop *);
200extern void flushsaproto (struct saproto *);
201extern void flushsatrns (struct satrns *);
202extern void printsaprop (const int, const struct saprop *);
203extern void printsaprop0 (const int, const struct saprop *);
204extern void printsaproto (const int, const struct saproto *);
205extern void printsatrns (const int, const int, const struct satrns *);
206extern void print_proppair0 (int, struct prop_pair *, int);
207extern void print_proppair (int, struct prop_pair *);
208extern int set_proposal_from_policy (phase2_handle_t *,
209	struct secpolicy *, struct secpolicy *);
210extern int set_proposal_from_proposal (phase2_handle_t *);
211extern int tunnel_mode_prop (struct saprop *);
212extern struct saprop *dupsaprop (struct saprop *, int);
213extern struct satrns *dupsatrns_1(struct satrns *);
214
215#endif /* _PROPOSAL_H */
216