/* * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. Neither the name of the project nor the names of its contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. */ /* YIPS @(#)$Id: ipsec_doi.h,v 1.1 1999-10-30 05:11:09 itojun Exp $ */ /* refer to RFC 2407 */ #if !defined(_IPSEC_DOI_H_) #define _IPSEC_DOI_H_ #define IPSEC_DOI 1 /* 4.2 IPSEC Situation Definition */ #define IPSECDOI_SIT_IDENTITY_ONLY 0x00000001 #define IPSECDOI_SIT_SECRECY 0x00000002 #define IPSECDOI_SIT_INTEGRITY 0x00000004 /* 4.4.1 IPSEC Security Protocol Identifiers */ /* 4.4.2 IPSEC ISAKMP Transform Values */ #define IPSECDOI_PROTO_ISAKMP 1 #define IPSECDOI_KEY_IKE 1 /* 4.4.1 IPSEC Security Protocol Identifiers */ #define IPSECDOI_PROTO_IPSEC_AH 2 /* 4.4.3 IPSEC AH Transform Values */ #define IPSECDOI_AH_MD5 2 #define IPSECDOI_AH_SHA 3 #define IPSECDOI_AH_DES 4 /* 4.4.1 IPSEC Security Protocol Identifiers */ #define IPSECDOI_PROTO_IPSEC_ESP 3 /* 4.4.4 IPSEC ESP Transform Identifiers */ #define IPSECDOI_ESP_DES_IV64 1 #define IPSECDOI_ESP_DES 2 #define IPSECDOI_ESP_3DES 3 #define IPSECDOI_ESP_RC5 4 #define IPSECDOI_ESP_IDEA 5 #define IPSECDOI_ESP_CAST 6 #define IPSECDOI_ESP_BLOWFISH 7 #define IPSECDOI_ESP_3IDEA 8 #define IPSECDOI_ESP_DES_IV32 9 #define IPSECDOI_ESP_RC4 10 #define IPSECDOI_ESP_NULL 11 /* 4.4.1 IPSEC Security Protocol Identifiers */ #define IPSECDOI_PROTO_IPCOMP 4 /* 4.4.5 IPSEC IPCOMP Transform Identifiers */ #define IPSECDOI_IPCOMP_OUI 1 #define IPSECDOI_IPCOMP_DEFLATE 2 #define IPSECDOI_IPCOMP_LZS 3 #define IPSECDOI_IPCOMP_V42BIS 4 /* 4.5 IPSEC Security Association Attributes */ #define IPSECDOI_ATTR_SA_LTYPE 1 /* B */ #define IPSECDOI_ATTR_SA_LTYPE_DEFAULT 1 #define IPSECDOI_ATTR_SA_LTYPE_SEC 1 #define IPSECDOI_ATTR_SA_LTYPE_KB 2 #define IPSECDOI_ATTR_SA_LDUR 2 /* V */ #define IPSECDOI_ATTR_SA_LDUR_DEFAULT 28800 /* 8 hours */ #define IPSECDOI_ATTR_GRP_DESC 3 /* B */ #define IPSECDOI_ATTR_ENC_MODE 4 /* B */ /* default value: host dependent */ #define IPSECDOI_ATTR_ENC_MODE_TUNNEL 1 #define IPSECDOI_ATTR_ENC_MODE_TRNS 2 #define IPSECDOI_ATTR_AUTH 5 /* B */ #define IPSECDOI_ATTR_AUTH_HMAC_MD5 1 #define IPSECDOI_ATTR_AUTH_HMAC_SHA1 2 #define IPSECDOI_ATTR_AUTH_DES_MAC 3 #define IPSECDOI_ATTR_AUTH_KPDK 4 /* When negotiating ESP without authentication, the Auth Algorithm attribute MUST NOT be included in the proposal. When negotiating ESP without confidentiality, the Auth Algorithm attribute MUST be included in the proposal and the ESP transform ID must be ESP_NULL. */ #define IPSECDOI_ATTR_KEY_LENGTH 6 /* B */ #define IPSECDOI_ATTR_KEY_ROUNDS 7 /* B */ #define IPSECDOI_ATTR_COMP_DICT_SIZE 8 /* B */ #define IPSECDOI_ATTR_COMP_PRIVALG 9 /* V */ /* 4.6.1 Security Association Payload */ struct ipsecdoi_sa { struct isakmp_gen h; u_int32_t doi; /* Domain of Interpretation */ u_int32_t sit; /* Situation */ }; struct ipsecdoi_secrecy_h { u_int16_t len; u_int16_t reserved; }; /* 4.6.2.1 Identification Type Values */ struct ipsecdoi_id { struct isakmp_gen h; u_int8_t type; /* ID Type */ u_int8_t proto_id; /* Protocol ID */ u_int16_t port; /* Port */ /* Identification Data */ }; #define IPSECDOI_ID_IPV4_ADDR 1 #define IPSECDOI_ID_FQDN 2 #define IPSECDOI_ID_USER_FQDN 3 #define IPSECDOI_ID_IPV4_ADDR_SUBNET 4 #define IPSECDOI_ID_IPV6_ADDR 5 #define IPSECDOI_ID_IPV6_ADDR_SUBNET 6 #define IPSECDOI_ID_IPV4_ADDR_RANGE 7 #define IPSECDOI_ID_IPV6_ADDR_RANGE 8 #define IPSECDOI_ID_DER_ASN1_DN 9 #define IPSECDOI_ID_DER_ASN1_GN 10 #define IPSECDOI_ID_KEY_ID 11 /* 4.6.3 IPSEC DOI Notify Message Types */ /* Notify Messages - Status Types */ #define IPSECDOI_NTYPE_RESPONDER_LIFETIME 24576 #define IPSECDOI_NTYPE_REPLAY_STATUS 24577 #define IPSECDOI_NTYPE_INITIAL_CONTACT 24578 #if 0 /* ipsec sa structure */ struct ipsec_sa { u_int8_t proto_id; /* Protocol id */ vchar_t *spi; /* spi to receive, network byte order */ vchar_t *spi_p; /* spi to send, network byte order */ vchar_t *keymat; /* KEYMAT */ u_int8_t t_id; /* transform id */ u_int8_t enc_t; /* type of cipher */ u_int8_t mode_t; /* tunnel or transport */ u_int8_t hash_t; /* type of hash */ u_int8_t life_t; /* type of duration of lifetime */ u_int32_t ldur; /* life duration */ u_int8_t dhgrp; /* DH; group */ struct ipsec_sa *next; }; #endif #endif /* !defined(_IPSEC_DOI_H_) */