| /* $NetBSD: proposal.h,v 1.6 2006/12/09 05:52:57 manu Exp $ */ |
| |
| /* Id: proposal.h,v 1.5 2004/06/11 16:00:17 ludvigm Exp */ |
| |
| /* |
| * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. |
| * All rights reserved. |
| * |
| * Redistribution and use in source and binary forms, with or without |
| * modification, are permitted provided that the following conditions |
| * are met: |
| * 1. Redistributions of source code must retain the above copyright |
| * notice, this list of conditions and the following disclaimer. |
| * 2. Redistributions in binary form must reproduce the above copyright |
| * notice, this list of conditions and the following disclaimer in the |
| * documentation and/or other materials provided with the distribution. |
| * 3. Neither the name of the project nor the names of its contributors |
| * may be used to endorse or promote products derived from this software |
| * without specific prior written permission. |
| * |
| * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND |
| * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
| * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE |
| * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
| * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
| * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
| * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
| * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
| * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
| * SUCH DAMAGE. |
| */ |
| |
| #ifndef _PROPOSAL_H |
| #define _PROPOSAL_H |
| |
| #include <sys/queue.h> |
| |
| /* |
| * A. chained list of transform, only for single proto_id |
| * (this is same as set of transforms in single proposal payload) |
| * B. proposal. this will point to multiple (A) items (order is important |
| * here so pointer to (A) must be ordered array, or chained list). |
| * this covers multiple proposal on a packet if proposal # is the same. |
| * C. finally, (B) needs to be connected as chained list. |
| * |
| * head ---> prop[.......] ---> prop[...] ---> prop[...] ---> ... |
| * | | | | |
| * | | | +- proto4 <== must preserve order here |
| * | | +--- proto3 |
| * | +----- proto2 |
| * +------- proto1[trans1, trans2, trans3, ...] |
| * |
| * incoming packets needs to be parsed to construct the same structure |
| * (check "prop_pair" too). |
| */ |
| /* SA proposal specification */ |
| struct saprop { |
| int prop_no; |
| time_t lifetime; |
| int lifebyte; |
| int pfs_group; /* pfs group */ |
| int claim; /* flag to send RESPONDER-LIFETIME. */ |
| /* XXX assumed DOI values are 1 or 2. */ |
| #ifdef HAVE_SECCTX |
| struct security_ctx sctx; /* security context structure */ |
| #endif |
| struct saproto *head; |
| struct saprop *next; |
| }; |
| |
| /* SA protocol specification */ |
| struct saproto { |
| int proto_id; |
| size_t spisize; /* spi size */ |
| int encmode; /* encryption mode */ |
| |
| int udp_encap; /* UDP encapsulation */ |
| |
| /* XXX should be vchar_t * */ |
| /* these are network byte order */ |
| u_int32_t spi; /* inbound. i.e. --SA-> me */ |
| u_int32_t spi_p; /* outbound. i.e. me -SA-> */ |
| |
| vchar_t *keymat; /* KEYMAT */ |
| vchar_t *keymat_p; /* peer's KEYMAT */ |
| |
| int reqid_out; /* request id (outbound) */ |
| int reqid_in; /* request id (inbound) */ |
| |
| int ok; /* if 1, success to set SA in kenrel */ |
| |
| struct satrns *head; /* header of transform */ |
| struct saproto *next; /* next protocol */ |
| }; |
| |
| /* SA algorithm specification */ |
| struct satrns { |
| int trns_no; |
| int trns_id; /* transform id */ |
| int encklen; /* key length of encryption algorithm */ |
| int authtype; /* authentication algorithm if ESP */ |
| |
| struct satrns *next; /* next transform */ |
| }; |
| |
| /* |
| * prop_pair: (proposal number, transform number) |
| * |
| * (SA (P1 (T1 T2)) (P1' (T1' T2')) (P2 (T1" T2"))) |
| * |
| * p[1] p[2] |
| * top (P1,T1) (P2",T1") |
| * | |tnext |tnext |
| * | v v |
| * | (P1, T2) (P2", T2") |
| * v next |
| * (P1', T1') |
| * |tnext |
| * v |
| * (P1', T2') |
| * |
| * when we convert it to saprop in prop2saprop(), it should become like: |
| * |
| * (next) |
| * saprop --------------------> saprop |
| * | (head) | (head) |
| * +-> saproto +-> saproto |
| * | | (head) | (head) |
| * | +-> satrns(P1 T1) +-> satrns(P2" T1") |
| * | | (next) | (next) |
| * | v v |
| * | satrns(P1, T2) satrns(P2", T2") |
| * v (next) |
| * saproto |
| * | (head) |
| * +-> satrns(P1' T1') |
| * | (next) |
| * v |
| * satrns(P1', T2') |
| */ |
| struct prop_pair { |
| struct isakmp_pl_p *prop; |
| struct isakmp_pl_t *trns; |
| struct prop_pair *next; /* next prop_pair with same proposal # */ |
| /* (bundle case) */ |
| struct prop_pair *tnext; /* next prop_pair in same proposal payload */ |
| /* (multiple tranform case) */ |
| }; |
| #define MAXPROPPAIRLEN 256 /* It's enough because field size is 1 octet. */ |
| |
| /* |
| * Lifetime length selection refered to the section 4.5.4 of RFC2407. It does |
| * not completely conform to the description of RFC. There are four types of |
| * the behavior. If the value of "proposal_check" in "remote" directive is; |
| * "obey" |
| * the responder obey the initiator anytime. |
| * "strict" |
| * If the responder's length is longer than the initiator's one, the |
| * responder uses the intitiator's one. Otherwise rejects the proposal. |
| * If PFS is not required by the responder, the responder obeys the |
| * proposal. If PFS is required by both sides and if the responder's |
| * group is not equal to the initiator's one, then the responder reject |
| * the proposal. |
| * "claim" |
| * If the responder's length is longer than the initiator's one, the |
| * responder use the intitiator's one. If the responder's length is |
| * shorter than the initiator's one, the responder uses own length |
| * AND send RESPONDER-LIFETIME notify message to a initiator in the |
| * case of lifetime. |
| * About PFS, this directive is same as "strict". |
| * "exact" |
| * If the initiator's length is not equal to the responder's one, the |
| * responder rejects the proposal. |
| * If PFS is required and if the responder's group is not equal to |
| * the initiator's one, then the responder reject the proposal. |
| * XXX should be defined the behavior of key length. |
| */ |
| #define PROP_CHECK_OBEY 1 |
| #define PROP_CHECK_STRICT 2 |
| #define PROP_CHECK_CLAIM 3 |
| #define PROP_CHECK_EXACT 4 |
| |
| struct sainfo; |
| struct ph1handle; |
| struct secpolicy; |
| extern struct saprop *newsaprop __P((void)); |
| extern struct saproto *newsaproto __P((void)); |
| extern void inssaprop __P((struct saprop **, struct saprop *)); |
| extern void inssaproto __P((struct saprop *, struct saproto *)); |
| extern void inssaprotorev __P((struct saprop *, struct saproto *)); |
| extern struct satrns *newsatrns __P((void)); |
| extern void inssatrns __P((struct saproto *, struct satrns *)); |
| extern struct saprop *cmpsaprop_alloc __P((struct ph1handle *, |
| const struct saprop *, const struct saprop *, int)); |
| extern int cmpsaprop __P((const struct saprop *, const struct saprop *)); |
| extern int cmpsatrns __P((int, const struct satrns *, const struct satrns *, int)); |
| extern int set_satrnsbysainfo __P((struct saproto *, struct sainfo *)); |
| extern struct saprop *aproppair2saprop __P((struct prop_pair *)); |
| extern void free_proppair __P((struct prop_pair **)); |
| extern void flushsaprop __P((struct saprop *)); |
| extern void flushsaproto __P((struct saproto *)); |
| extern void flushsatrns __P((struct satrns *)); |
| extern void printsaprop __P((const int, const struct saprop *)); |
| extern void printsaprop0 __P((const int, const struct saprop *)); |
| extern void printsaproto __P((const int, const struct saproto *)); |
| extern void printsatrns __P((const int, const int, const struct satrns *)); |
| extern void print_proppair0 __P((int, struct prop_pair *, int)); |
| extern void print_proppair __P((int, struct prop_pair *)); |
| extern int set_proposal_from_policy __P((struct ph2handle *, |
| struct secpolicy *, struct secpolicy *)); |
| extern int set_proposal_from_proposal __P((struct ph2handle *)); |
| |
| #endif /* _PROPOSAL_H */ |
