1 /*	$NetBSD: ipsec_doi.h,v 1.9 2006/12/09 05:52:57 manu Exp $	*/
2 
3 /* Id: ipsec_doi.h,v 1.15 2006/08/11 16:06:30 vanhu Exp */
4 
5 /*
6  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. Neither the name of the project nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  */
33 
34 #ifndef _IPSEC_DOI_H
35 #define _IPSEC_DOI_H
36 
37 /* refered to RFC2407 */
38 
39 #define IPSEC_DOI 1
40 
41 /* 4.2 IPSEC Situation Definition */
42 #define IPSECDOI_SIT_IDENTITY_ONLY           0x00000001
43 #define IPSECDOI_SIT_SECRECY                 0x00000002
44 #define IPSECDOI_SIT_INTEGRITY               0x00000004
45 
46 /* 4.4.1 IPSEC Security Protocol Identifiers */
47   /* 4.4.2 IPSEC ISAKMP Transform Values */
48 #define IPSECDOI_PROTO_ISAKMP                        1
49 #define   IPSECDOI_KEY_IKE                             1
50 
51 /* 4.4.1 IPSEC Security Protocol Identifiers */
52 #define IPSECDOI_PROTO_IPSEC_AH                      2
53   /* 4.4.3 IPSEC AH Transform Values */
54 #define   IPSECDOI_AH_MD5                              2
55 #define   IPSECDOI_AH_SHA                              3
56 #define   IPSECDOI_AH_DES                              4
57 #define   IPSECDOI_AH_SHA256                           5
58 #define   IPSECDOI_AH_SHA384                           6
59 #define   IPSECDOI_AH_SHA512                           7
60 
61 /* 4.4.1 IPSEC Security Protocol Identifiers */
62 #define IPSECDOI_PROTO_IPSEC_ESP                     3
63   /* 4.4.4 IPSEC ESP Transform Identifiers */
64 #define   IPSECDOI_ESP_DES_IV64				1
65 #define   IPSECDOI_ESP_DES				2
66 #define   IPSECDOI_ESP_3DES				3
67 #define   IPSECDOI_ESP_RC5				4
68 #define   IPSECDOI_ESP_IDEA				5
69 #define   IPSECDOI_ESP_CAST				6
70 #define   IPSECDOI_ESP_BLOWFISH				7
71 #define   IPSECDOI_ESP_3IDEA				8
72 #define   IPSECDOI_ESP_DES_IV32				9
73 #define   IPSECDOI_ESP_RC4				10
74 #define   IPSECDOI_ESP_NULL				11
75 #define   IPSECDOI_ESP_AES				12
76 #define   IPSECDOI_ESP_CAMELLIA				22
77 #if 1
78   /* draft-ietf-ipsec-ciph-aes-cbc-00.txt */
79 #define   IPSECDOI_ESP_TWOFISH				253
80 #else
81   /* SSH uses these value for now */
82 #define   IPSECDOI_ESP_TWOFISH				250
83 #endif
84 
85 /* 4.4.1 IPSEC Security Protocol Identifiers */
86 #define IPSECDOI_PROTO_IPCOMP                        4
87   /* 4.4.5 IPSEC IPCOMP Transform Identifiers */
88 #define   IPSECDOI_IPCOMP_OUI				1
89 #define   IPSECDOI_IPCOMP_DEFLATE			2
90 #define   IPSECDOI_IPCOMP_LZS				3
91 
92 /* 4.5 IPSEC Security Association Attributes */
93 /* NOTE: default value is not included in a packet. */
94 #define IPSECDOI_ATTR_SA_LD_TYPE              1 /* B */
95 #define   IPSECDOI_ATTR_SA_LD_TYPE_DEFAULT      1
96 #define   IPSECDOI_ATTR_SA_LD_TYPE_SEC          1
97 #define   IPSECDOI_ATTR_SA_LD_TYPE_KB           2
98 #define   IPSECDOI_ATTR_SA_LD_TYPE_MAX          3
99 #define IPSECDOI_ATTR_SA_LD                   2 /* V */
100 #define   IPSECDOI_ATTR_SA_LD_SEC_DEFAULT      28800 /* 8 hours */
101 #define   IPSECDOI_ATTR_SA_LD_KB_MAX  (~(1 << ((sizeof(int) << 3) - 1)))
102 #define IPSECDOI_ATTR_GRP_DESC                3 /* B */
103 #define IPSECDOI_ATTR_ENC_MODE                4 /* B */
104 	/* default value: host dependent */
105 #define   IPSECDOI_ATTR_ENC_MODE_ANY            0	/* NOTE:internal use */
106 #define   IPSECDOI_ATTR_ENC_MODE_TUNNEL         1
107 #define   IPSECDOI_ATTR_ENC_MODE_TRNS           2
108 
109 /* NAT-T draft-ietf-ipsec-nat-t-ike-05 and later */
110 #define   IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC	3
111 #define   IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC	4
112 
113 /* NAT-T up to draft-ietf-ipsec-nat-t-ike-04 */
114 #define   IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT	61443
115 #define   IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT		61444
116 
117 #define IPSECDOI_ATTR_AUTH                    5 /* B */
118 	/* 0 means not to use authentication. */
119 #define   IPSECDOI_ATTR_AUTH_HMAC_MD5           1
120 #define   IPSECDOI_ATTR_AUTH_HMAC_SHA1          2
121 #define   IPSECDOI_ATTR_AUTH_DES_MAC            3
122 #define   IPSECDOI_ATTR_AUTH_KPDK               4 /*RFC-1826(Key/Pad/Data/Key)*/
123 #define   IPSECDOI_ATTR_AUTH_HMAC_SHA2_256      5
124 #define   IPSECDOI_ATTR_AUTH_HMAC_SHA2_384      6
125 #define   IPSECDOI_ATTR_AUTH_HMAC_SHA2_512      7
126 #define   IPSECDOI_ATTR_AUTH_NONE               254	/* NOTE:internal use */
127 	/*
128 	 * When negotiating ESP without authentication, the Auth
129 	 * Algorithm attribute MUST NOT be included in the proposal.
130 	 * When negotiating ESP without confidentiality, the Auth
131 	 * Algorithm attribute MUST be included in the proposal and
132 	 * the ESP transform ID must be ESP_NULL.
133 	*/
134 #define IPSECDOI_ATTR_KEY_LENGTH              6 /* B */
135 #define IPSECDOI_ATTR_KEY_ROUNDS              7 /* B */
136 #define IPSECDOI_ATTR_COMP_DICT_SIZE          8 /* B */
137 #define IPSECDOI_ATTR_COMP_PRIVALG            9 /* V */
138 
139 #ifdef HAVE_SECCTX
140 #define IPSECDOI_ATTR_SECCTX		     10 /* V */
141 #endif
142 
143 /* 4.6.1 Security Association Payload */
144 struct ipsecdoi_pl_sa {
145 	struct isakmp_gen h;
146 	struct ipsecdoi_sa_b {
147 		u_int32_t doi; /* Domain of Interpretation */
148 		u_int32_t sit; /* Situation */
149 	} b;
150 	/* followed by Leveled Domain Identifier and so on. */
151 } __attribute__((__packed__));
152 
153 struct ipsecdoi_secrecy_h {
154 	u_int16_t len;
155 	u_int16_t reserved;
156 	/* followed by the value */
157 } __attribute__((__packed__));
158 
159 /* 4.6.2 Identification Payload Content */
160 struct ipsecdoi_pl_id {
161 	struct isakmp_gen h;
162 	struct ipsecdoi_id_b {
163 		u_int8_t type;		/* ID Type */
164 		u_int8_t proto_id;	/* Protocol ID */
165 		u_int16_t port;		/* Port */
166 	} b;
167 	/* followed by Identification Data */
168 } __attribute__((__packed__));
169 
170 #define IPSECDOI_ID_IPV4_ADDR                        1
171 #define IPSECDOI_ID_FQDN                             2
172 #define IPSECDOI_ID_USER_FQDN                        3
173 #define IPSECDOI_ID_IPV4_ADDR_SUBNET                 4
174 #define IPSECDOI_ID_IPV6_ADDR                        5
175 #define IPSECDOI_ID_IPV6_ADDR_SUBNET                 6
176 #define IPSECDOI_ID_IPV4_ADDR_RANGE                  7
177 #define IPSECDOI_ID_IPV6_ADDR_RANGE                  8
178 #define IPSECDOI_ID_DER_ASN1_DN                      9
179 #define IPSECDOI_ID_DER_ASN1_GN                      10
180 #define IPSECDOI_ID_KEY_ID                           11
181 
182 /* compressing doi type, it's internal use. */
183 #define IDTYPE_UNDEFINED	0
184 #define IDTYPE_FQDN		1
185 #define IDTYPE_USERFQDN		2
186 #define IDTYPE_KEYID		3
187 #define IDTYPE_ADDRESS		4
188 #define IDTYPE_ASN1DN		5
189 #define IDTYPE_SUBNET		6
190 
191 /* qualifiers for KEYID (and maybe others) */
192 #define IDQUAL_UNSPEC		0
193 #define IDQUAL_FILE		1
194 #define IDQUAL_TAG		2
195 
196 /* The use for checking proposal payload. This is not exchange type. */
197 #define IPSECDOI_TYPE_PH1	0
198 #define IPSECDOI_TYPE_PH2	1
199 
200 struct isakmpsa;
201 struct ipsecdoi_pl_sa;
202 struct saprop;
203 struct saproto;
204 struct satrns;
205 struct prop_pair;
206 
207 extern int ipsecdoi_checkph1proposal __P((vchar_t *, struct ph1handle *));
208 extern int ipsecdoi_selectph2proposal __P((struct ph2handle *));
209 extern int ipsecdoi_checkph2proposal __P((struct ph2handle *));
210 
211 extern struct prop_pair **get_proppair __P((vchar_t *, int));
212 extern vchar_t *get_sabyproppair __P((struct prop_pair *, struct ph1handle *));
213 extern int ipsecdoi_updatespi __P((struct ph2handle *iph2));
214 extern vchar_t *get_sabysaprop __P((struct saprop *, vchar_t *));
215 extern int ipsecdoi_chkcmpids( const vchar_t *, const vchar_t *, int );
216 extern int ipsecdoi_checkid1 __P((struct ph1handle *));
217 extern int ipsecdoi_setid1 __P((struct ph1handle *));
218 extern int set_identifier __P((vchar_t **, int, vchar_t *));
219 extern int set_identifier_qual __P((vchar_t **, int, vchar_t *, int));
220 extern int ipsecdoi_setid2 __P((struct ph2handle *));
221 extern vchar_t *ipsecdoi_sockaddr2id __P((struct sockaddr *, u_int, u_int));
222 extern int ipsecdoi_id2sockaddr __P((vchar_t *, struct sockaddr *,
223 	u_int8_t *, u_int16_t *));
224 extern char *ipsecdoi_id2str __P((const vchar_t *));
225 extern vchar_t *ipsecdoi_sockrange2id __P((	struct sockaddr *,
226 	struct sockaddr *, u_int));
227 
228 extern vchar_t *ipsecdoi_setph1proposal __P((struct isakmpsa *));
229 extern int ipsecdoi_setph2proposal __P((struct ph2handle *));
230 extern int ipsecdoi_transportmode __P((struct saprop *));
231 extern int ipsecdoi_get_defaultlifetime __P((void));
232 extern int ipsecdoi_checkalgtypes __P((int, int, int, int));
233 extern int ipproto2doi __P((int));
234 extern int doi2ipproto __P((int));
235 
236 extern int ipsecdoi_t2satrns __P((struct isakmp_pl_t *,
237 	struct saprop *, struct saproto *, struct satrns *));
238 extern int ipsecdoi_authalg2trnsid __P((int));
239 extern int idtype2doi __P((int));
240 extern int doi2idtype __P((int));
241 
242 
243 #endif /* _IPSEC_DOI_H */
244