ipsec_do.h

This directory contains source code for tcpdump, a tool for network monitoring and data acquisition

/*
 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
 * All rights reserved.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the project nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 * 
 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */
/* YIPS @(#)$Id: ipsec_doi.h,v 1.1 1999/10/30 05:11:09 itojun Exp $ */

/* refer to RFC 2407 */

#ifndef _IPSEC_DOI_H_
#define _IPSEC_DOI_H_

#define IPSEC_DOI 1

/* 4.2 IPSEC Situation Definition
 */
#define IPSECDOI_SIT_IDENTITY_ONLY           0x00000001
#define IPSECDOI_SIT_SECRECY                 0x00000002
#define IPSECDOI_SIT_INTEGRITY               0x00000004

/* 4.4.1 IPSEC Security Protocol Identifiers
 * 4.4.2 IPSEC ISAKMP Transform Values
 */
#define IPSECDOI_PROTO_ISAKMP                1
#define   IPSECDOI_KEY_IKE                   1

/* 4.4.1 IPSEC Security Protocol Identifiers
 */
#define IPSECDOI_PROTO_IPSEC_AH              2

/* 4.4.3 IPSEC AH Transform Values
 */
#define IPSECDOI_AH_MD5                      2
#define IPSECDOI_AH_SHA                      3
#define IPSECDOI_AH_DES                      4

/* 4.4.1 IPSEC Security Protocol Identifiers
 */
#define IPSECDOI_PROTO_IPSEC_ESP             3

/* 4.4.4 IPSEC ESP Transform Identifiers
 */
#define IPSECDOI_ESP_DES_IV64                1
#define IPSECDOI_ESP_DES                     2
#define IPSECDOI_ESP_3DES                    3
#define IPSECDOI_ESP_RC5                     4
#define IPSECDOI_ESP_IDEA                    5
#define IPSECDOI_ESP_CAST                    6
#define IPSECDOI_ESP_BLOWFISH                7
#define IPSECDOI_ESP_3IDEA                   8
#define IPSECDOI_ESP_DES_IV32                9
#define IPSECDOI_ESP_RC4                    10
#define IPSECDOI_ESP_NULL                   11

/* 4.4.1 IPSEC Security Protocol Identifiers
 */
#define IPSECDOI_PROTO_IPCOMP                4

/* 4.4.5 IPSEC IPCOMP Transform Identifiers
 */
#define IPSECDOI_IPCOMP_OUI                  1
#define IPSECDOI_IPCOMP_DEFLATE              2
#define IPSECDOI_IPCOMP_LZS                  3
#define IPSECDOI_IPCOMP_V42BIS               4

/* 4.5 IPSEC Security Association Attributes
 */
#define IPSECDOI_ATTR_SA_LTYPE               1  /* B */
#define   IPSECDOI_ATTR_SA_LTYPE_DEFAULT     1
#define   IPSECDOI_ATTR_SA_LTYPE_SEC         1
#define   IPSECDOI_ATTR_SA_LTYPE_KB          2
#define IPSECDOI_ATTR_SA_LDUR                2  /* V */
#define   IPSECDOI_ATTR_SA_LDUR_DEFAULT  28800  /* 8 hours */
#define IPSECDOI_ATTR_GRP_DESC               3  /* B */
#define IPSECDOI_ATTR_ENC_MODE               4  /* B */

/* default value: host dependent
 */
#define IPSECDOI_ATTR_ENC_MODE_TUNNEL        1
#define IPSECDOI_ATTR_ENC_MODE_TRNS          2
#define IPSECDOI_ATTR_AUTH                   5  /* B */
#define IPSECDOI_ATTR_AUTH_HMAC_MD5          1
#define IPSECDOI_ATTR_AUTH_HMAC_SHA1         2
#define IPSECDOI_ATTR_AUTH_DES_MAC           3
#define IPSECDOI_ATTR_AUTH_KPDK              4

/*
 * When negotiating ESP without authentication, the Auth
 * Algorithm attribute MUST NOT be included in the proposal.
 * When negotiating ESP without confidentiality, the Auth
 * Algorithm attribute MUST be included in the proposal and
 * the ESP transform ID must be ESP_NULL.
 */
#define IPSECDOI_ATTR_KEY_LENGTH             6  /* B */
#define IPSECDOI_ATTR_KEY_ROUNDS             7  /* B */
#define IPSECDOI_ATTR_COMP_DICT_SIZE         8  /* B */
#define IPSECDOI_ATTR_COMP_PRIVALG           9  /* V */

/* 4.6.1 Security Association Payload
 */
struct ipsecdoi_sa {
       struct isakmp_gen h;
       u_int32_t         doi;         /* Domain of Interpretation */
       u_int32_t         sit;         /* Situation */
     };

struct ipsecdoi_secrecy_h {
       u_int16_t len;
       u_int16_t reserved;
     };

/* 4.6.2.1 Identification Type Values
 */
struct ipsecdoi_id {
       struct isakmp_gen h;
       u_int8_t          type;        /* ID Type */
       u_int8_t          proto_id;    /* Protocol ID */
       u_int16_t         port;        /* Port */
       /* Identification Data */
     };

#define IPSECDOI_ID_IPV4_ADDR               1
#define IPSECDOI_ID_FQDN                    2
#define IPSECDOI_ID_USER_FQDN               3
#define IPSECDOI_ID_IPV4_ADDR_SUBNET        4
#define IPSECDOI_ID_IPV6_ADDR               5
#define IPSECDOI_ID_IPV6_ADDR_SUBNET        6
#define IPSECDOI_ID_IPV4_ADDR_RANGE         7
#define IPSECDOI_ID_IPV6_ADDR_RANGE         8
#define IPSECDOI_ID_DER_ASN1_DN             9
#define IPSECDOI_ID_DER_ASN1_GN             10
#define IPSECDOI_ID_KEY_ID                  11

/* 4.6.3 IPSEC DOI Notify Message Types
 * Notify Messages - Status Types
 */
#define IPSECDOI_NTYPE_RESPONDER_LIFETIME   24576
#define IPSECDOI_NTYPE_REPLAY_STATUS        24577
#define IPSECDOI_NTYPE_INITIAL_CONTACT      24578

#if 0
/* ipsec sa structure
 */
struct ipsec_sa {
       u_int8_t         proto_id;    /* Protocol id */
       vchar_t         *spi;         /* spi to receive, network byte order */
       vchar_t         *spi_p;       /* spi to send, network byte order */
       vchar_t         *keymat;      /* KEYMAT */
       u_int8_t         t_id;        /* transform id */
       u_int8_t         enc_t;       /* type of cipher */
       u_int8_t         mode_t;      /* tunnel or transport */
       u_int8_t         hash_t;      /* type of hash */
       u_int8_t         life_t;      /* type of duration of lifetime */
       u_int32_t        ldur;        /* life duration */
       u_int8_t         dhgrp;       /* DH; group */
       struct ipsec_sa *next;
     };
#endif

#endif