[apple/ipsec.git] / ipsec-tools / racoon / handler.h

/*	$NetBSD: handler.h,v 1.9 2006/09/09 16:22:09 manu Exp $	*/

/* Id: handler.h,v 1.19 2006/02/25 08:25:12 manubsd Exp */

/*
 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
 * All rights reserved.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the project nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 * 
 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#ifndef _HANDLER_H
#define _HANDLER_H

#include "config.h"
#include "racoon_types.h"

#include <sys/queue.h>
#ifdef HAVE_OPENSSL
#include <openssl/rsa.h>
#endif

#include <sys/time.h>

#include "isakmp_var.h"
#include "oakley.h"
#ifndef HAVE_OPENSSL
#include <Security/SecDH.h>
#endif
#include <sys/socket.h>

#include "schedule.h"

#if __has_include(<nw/private.h>)
#include <nw/private.h>
#else
#include <network/nat64.h>
#endif

/* About address semantics in each case.
 *			initiator(addr=I)	responder(addr=R)
 *			src	dst		src	dst
 *			(local)	(remote)	(local)	(remote)
 * phase 1 handler	I	R		R	I
 * phase 2 handler	I	R		R	I
 * getspi msg		R	I		I	R
 * acquire msg		I	R
 * ID payload		I	R		I	R
 */
#ifdef ENABLE_HYBRID
struct isakmp_cfg_state;
#endif

#define INVALID_MSGID           0xFFFFFFFF

//=======================================================================
// PHASE 1
//=======================================================================

struct phase1handle {
	isakmp_index index;
    
	int status;			/* status of this SA */
	int side;			/* INITIATOR or RESPONDER */
	int started_by_api;		/* connection started by VPNControl API */

	nw_nat64_prefix_t nat64_prefix;		/* nat64 prefix to apply to addresses. */
	struct sockaddr_storage *remote;	/* remote address to negotiate ph1 */
	struct sockaddr_storage *local;		/* local address to negotiate ph1 */
    /* XXX copy from rmconf due to anonymous configuration.
     * If anonymous will be forbidden, we do delete them. */
    
	struct remoteconf *rmconf;	/* pointer to remote configuration */
    
	struct isakmpsa *approval;	/* pointer to SA(s) approved. */
    /* for example pre-shared key */
    
	u_int8_t version;		/* ISAKMP version */
	u_int8_t etype;			/* Exchange type actually for use */
	u_int8_t flags;			/* Flags */
	u_int32_t msgid;		/* message id */
	
#ifdef ENABLE_NATT
	struct ph1natt_options *natt_options;	/* Selected NAT-T IKE version */
	u_int32_t natt_flags;		/* NAT-T related flags */
#endif
#ifdef ENABLE_FRAG
	int frag;			/* IKE phase 1 fragmentation */
	struct isakmp_frag_item *frag_chain;	/* Received fragments */
#endif
    
	schedule_ref sce;		/* schedule for expire */
	schedule_ref sce_rekey; /* schedule for rekey */
    
	schedule_ref scr;		/* schedule for resend */
	int retry_counter;		/* for resend. */
	vchar_t *sendbuf;		/* buffer for re-sending */
    
#ifndef HAVE_OPENSSL
	SecDHContext dhC;		/* Context for Security Framework Diffie-Hellman calculations */
	size_t publicKeySize;
#endif
	vchar_t *dhpriv;		/* DH; private value */
	vchar_t *dhpub;			/* DH; public value */
	vchar_t *dhpub_p;		/* DH; partner's public value */
	vchar_t *dhgxy;			/* DH; shared secret */
	vchar_t *nonce;			/* nonce value */
	vchar_t *nonce_p;		/* partner's nonce value */
	vchar_t *skeyid;		/* SKEYID */
	vchar_t *skeyid_d;		/* SKEYID_d */
	vchar_t *skeyid_a;		/* SKEYID_a, i.e. integrity protection */
	vchar_t *skeyid_a_p;    /* SKEYID_a_p, i.e. integrity protection */
	vchar_t *skeyid_e;		/* SKEYID_e, i.e. encryption */
    vchar_t *skeyid_e_p;	/* peer's SKEYID_e, i.e. encryption */
	vchar_t *key;			/* cipher key */
    vchar_t *key_p;         /* peer's cipher key */
	vchar_t *hash;			/* HASH minus general header */
	vchar_t *sig;			/* SIG minus general header */
	vchar_t *sig_p;			/* peer's SIG minus general header */
	cert_t *cert;			/* CERT minus general header */
	cert_t *cert_p;			/* peer's CERT minus general header */
	cert_t *crl_p;			/* peer's CRL minus general header */
	cert_t *cr_p;			/* peer's CR not including general */
	vchar_t *id;			/* ID minus gen header */
	vchar_t *id_p;			/* partner's ID minus general header */
    /* i.e. struct ipsecdoi_id_b*. */
	struct isakmp_ivm *ivm;		/* IVs */
    
	vchar_t *sa;			/* whole SA payload to send/to be sent*/
    /* to calculate HASH */
    /* NOT INCLUDING general header. */
    
	vchar_t *sa_ret;		/* SA payload to reply/to be replyed */
    /* NOT INCLUDING general header. */
    /* NOTE: Should be release after use. */
    
	struct isakmp_pl_hash *pl_hash;	/* pointer to hash payload */
    
	time_t created;			/* timestamp for establish */
#ifdef ENABLE_STATS
	struct timeval start;
	struct timeval end;
#endif
    
#ifdef ENABLE_DPD
	int		dpd_support;	/* Does remote supports DPD ? */
	time_t		dpd_lastack;	/* Last ack received */
	u_int16_t	dpd_seq;		/* DPD seq number to receive */
	u_int8_t	dpd_fails;		/* number of failures */
    u_int8_t        peer_sent_ike;
	schedule_ref    dpd_r_u;
#endif
    
#ifdef ENABLE_VPNCONTROL_PORT
	schedule_ref ping_sched;	/* for sending pings to keep FW open */
#endif
	
	u_int32_t msgid2;		/* msgid counter for Phase 2 */
	int ph2cnt;	/* the number which is negotiated by this phase 1 */
#ifdef ENABLE_HYBRID
	struct isakmp_cfg_state *mode_cfg;	/* ISAKMP mode config state */
	u_int8_t pended_xauth_id;			/* saved id for reply from vpn control socket */
	u_int8_t xauth_awaiting_userinput;	/* indicates we are waiting for user input */
    vchar_t *xauth_awaiting_userinput_msg; /* tracks the last packet that triggered XAUTH */
#endif
	int                                     is_rekey:1;
	int                                     is_dying:1;
	ike_session_t                           *parent_session;
	LIST_HEAD(_ph2ofph1_, phase2handle)     bound_ph2tree;
	LIST_ENTRY(phase1handle)                ph1ofsession_chain;
};

#define PHASE2_TYPE_SA          0
#define PHASE2_TYPE_INFO        1
#define PHASE2_TYPE_CFG         2

//=======================================================================
// PHASE 2
//=======================================================================
struct phase2handle {
	struct sockaddr_storage *src;		/* my address of SA. */
	struct sockaddr_storage *dst;		/* peer's address of SA. */
    nw_nat64_prefix_t nat64_prefix;		/* nat64 prefix to apply to addresses. */

    /*
     * copy ip address from ID payloads when ID type is ip address.
     * In other case, they must be null.
     */
	struct sockaddr_storage *src_id;
	struct sockaddr_storage *dst_id;
    
    int phase2_type;        /* what this phase2 struct is for - see defines for PHASE2_TYPE... */
	u_int32_t spid;			/* policy id by kernel */
    
	int status;             /* ipsec sa status */
	u_int8_t side;			/* INITIATOR or RESPONDER */
	u_int8_t version;		/* ISAKMP version */
    
	schedule_ref sce;		/* schedule for expire */
	schedule_ref scr;		/* schedule for resend */
	int retry_counter;		/* for resend. */
	vchar_t *sendbuf;		/* buffer for re-sending */
	vchar_t *msg1;			/* buffer for re-sending */
    /* used for responder's first message */
    
	int retry_checkph1;		/* counter to wait phase 1 finished. */
    /* NOTE: actually it's timer. */
    
	u_int32_t seq;			/* sequence number used by PF_KEY */
    /*
     * NOTE: In responder side, we can't identify each SAs
     * with same destination address for example, when
     * socket based SA is required.  So we set a identifier
     * number to "seq", and sent kernel by pfkey.
     */
	u_int8_t satype;		/* satype in PF_KEY */
    /*
     * saved satype in the original PF_KEY request from
     * the kernel in order to reply a error.
     */
    
	u_int8_t flags;			/* Flags for phase 2 */
	u_int32_t msgid;		/* msgid for phase 2 */
    
	struct sainfo *sainfo;		/* place holder of sainfo */
	struct saprop *proposal;	/* SA(s) proposal. */
	struct saprop *approval;	/* SA(s) approved. */
	struct policyindex * spidx_gen;		/* policy from peer's proposal */
    
#ifndef HAVE_OPENSSL
	SecDHContext dhC;		/* Context for Security Framework Diffie-Hellman calculations */
	size_t publicKeySize;
#endif	
	struct dhgroup *pfsgrp;		/* DH; prime number */
	vchar_t *dhpriv;		/* DH; private value */
	vchar_t *dhpub;			/* DH; public value */
	vchar_t *dhpub_p;		/* DH; partner's public value */
	vchar_t *dhgxy;			/* DH; shared secret */
	vchar_t *id;			/* ID minus gen header */
	vchar_t *id_p;			/* peer's ID minus general header */
	vchar_t *nonce;			/* nonce value in phase 2 */
	vchar_t *nonce_p;		/* partner's nonce value in phase 2 */
    
	vchar_t *sa;			/* whole SA payload to send/to be sent*/
    /* to calculate HASH */
    /* NOT INCLUDING general header. */
    
	vchar_t *sa_ret;		/* SA payload to reply/to be replyed */
    /* NOT INCLUDING general header. */
    /* NOTE: Should be release after use. */
    
	struct isakmp_ivm *ivm;		/* IVs */
    
	int generated_spidx;	/* mark handlers whith generated policy */
    
#ifdef ENABLE_STATS
	struct timeval start;
	struct timeval end;
#endif
	struct phase1handle *ph1;	/* back pointer to isakmp status */
	int                    is_rekey:1;
	int                    is_dying:1;
    	int		       is_defunct:1;
	ike_session_t         *parent_session;
	vchar_t               *ext_nat_id;
	vchar_t               *ext_nat_id_p;
	LIST_ENTRY(phase2handle)    ph2ofsession_chain;	
	LIST_ENTRY(phase2handle)    ph1bind_chain;	/* chain to ph1handle */
};

/*
 * for handling initial contact.
 */
struct contacted {
	struct sockaddr_storage *remote;	/* remote address to negotiate ph1 */
	LIST_ENTRY(contacted) chain;
};

/*
 * for checking if a packet is retransmited.
 */
struct recvdpkt {
	struct sockaddr_storage *remote;	/* the remote address */
	struct sockaddr_storage *local;		/* the local address */
	vchar_t *hash;			/* hash of the received packet */
	vchar_t *sendbuf;		/* buffer for the response */
	int retry_counter;		/* how many times to send */
	time_t time_send;		/* timestamp to send a packet */
	time_t created;			/* timestamp to create a queue */
	time_t retry_interval;
#ifdef ENABLE_FRAG
	u_int32_t frag_flags;            /* IKE phase 1 fragmentation */
#endif

	schedule_ref scr;		/* schedule for resend, may not used */

	LIST_ENTRY(recvdpkt) chain;
};

/* for parsing ISAKMP header. */
struct isakmp_parse_t {
	u_char type;		/* payload type of mine */
	int len;		/* ntohs(ptr->len) */
	struct isakmp_gen *ptr;
};

/*
 * for IV management.
 *
 * - normal case
 * initiator                                     responder
 * -------------------------                     --------------------------
 * initialize iv(A), ive(A).                     initialize iv(A), ive(A).
 * encode by ive(A).
 * save to iv(B).            ---[packet(B)]-->   save to ive(B).
 *                                               decode by iv(A).
 *                                               packet consistency.
 *                                               sync iv(B) with ive(B).
 *                                               check auth, integrity.
 *                                               encode by ive(B).
 * save to ive(C).          <--[packet(C)]---    save to iv(C).
 * decoded by iv(B).
 *      :
 *
 * - In the case that a error is found while cipher processing,
 * initiator                                     responder
 * -------------------------                     --------------------------
 * initialize iv(A), ive(A).                     initialize iv(A), ive(A).
 * encode by ive(A).
 * save to iv(B).            ---[packet(B)]-->   save to ive(B).
 *                                               decode by iv(A).
 *                                               packet consistency.
 *                                               sync iv(B) with ive(B).
 *                                               check auth, integrity.
 *                                               error found.
 *                                               create notify.
 *                                               get ive2(X) from iv(B).
 *                                               encode by ive2(X).
 * get iv2(X) from iv(B).   <--[packet(Y)]---    save to iv2(Y).
 * save to ive2(Y).
 * decoded by iv2(X).
 *      :
 *
 * The reason why the responder synchronizes iv with ive after checking the
 * packet consistency is that it is required to leave the IV for decoding
 * packet.  Because there is a potential of error while checking the packet
 * consistency.  Also the reason why that is before authentication and
 * integirty check is that the IV for informational exchange has to be made
 * by the IV which is after packet decoded and checking the packet consistency.
 * Otherwise IV mismatched happens between the intitiator and the responder.
 */
struct isakmp_ivm {
	vchar_t *iv;	/* for decoding packet */
			/* if phase 1, it's for computing phase2 iv */
	vchar_t *ive;	/* for encoding packet */
};

/* for dumping */
struct ph1dump {
	isakmp_index index;
	int status;
	int side;
	struct sockaddr_storage remote;
	struct sockaddr_storage local;
	u_int8_t version;
	u_int8_t etype;	
	time_t created;
	int ph2cnt;
};

struct sockaddr_storage;
struct policyindex;

extern int                  ike_session_check_recvdpkt (struct sockaddr_storage *, struct sockaddr_storage *, vchar_t *);

extern void                 ike_session_flush_all_phase1_for_session(ike_session_t *, int);
extern void                 ike_session_flush_all_phase1 (int);

extern phase1_handle_t      *ike_session_getph1byindex (ike_session_t *, isakmp_index *);
extern phase1_handle_t      *ike_session_getph1byindex0 (ike_session_t *, isakmp_index *);
extern phase1_handle_t      *ike_session_getph1byaddr (ike_session_t *, struct sockaddr_storage *,
                                                            struct sockaddr_storage *);
extern phase1_handle_t      *ike_session_getph1byaddrwop (ike_session_t *, struct sockaddr_storage *,
                                                            struct sockaddr_storage *);
extern phase1_handle_t      *ike_session_getph1bydstaddrwop (ike_session_t *, struct sockaddr_storage *);
extern int                  ike_session_islast_ph1 (phase1_handle_t *);

extern int                  ike_session_expire_session(ike_session_t *session);
extern int                  ike_session_purgephXbydstaddrwop (struct sockaddr_storage *);
extern void                 ike_session_purgephXbyspid (u_int32_t, int);

extern phase1_handle_t      *ike_session_newph1 (unsigned int);
extern void                 ike_session_delph1 (phase1_handle_t *);

extern phase2_handle_t      *ike_session_getph2byspidx (ike_session_t *, struct policyindex *);
extern phase2_handle_t      *ike_session_getph2byspid (u_int32_t);
extern phase2_handle_t      *ike_session_getph2byseq (u_int32_t);
//extern phase2_handle_t      *ike_session_getph2bysaddr (struct sockaddr_storage *, struct sockaddr_storage *);
extern phase2_handle_t      *ike_session_getph2bymsgid (phase1_handle_t *, u_int32_t);
extern phase2_handle_t      *ike_session_getonlyph2(phase1_handle_t *iph1);
extern phase2_handle_t      *ike_session_getph2byid (struct sockaddr_storage *, struct sockaddr_storage *, u_int32_t);
extern phase2_handle_t      *ike_session_getph2bysaidx (struct sockaddr_storage *, struct sockaddr_storage *, u_int, u_int32_t);
extern phase2_handle_t      *ike_session_getph2bysaidx2(struct sockaddr_storage *src, struct sockaddr_storage *dst, u_int proto_id, u_int32_t spi, u_int32_t *opposite_spi);
extern phase2_handle_t      *ike_session_newph2 (unsigned int, int);
extern void                 ike_session_initph2 (phase2_handle_t *);
extern void                 ike_session_delph2 (phase2_handle_t *);
extern void                 ike_session_flush_all_phase2_for_session(ike_session_t *, int);
extern void                 ike_session_flush_all_phase2 (int);
extern void                 ike_session_deleteallph2 (struct sockaddr_storage *, struct sockaddr_storage *, u_int);
extern void                 ike_session_deleteallph1 (struct sockaddr_storage *, struct sockaddr_storage *);

#ifdef ENABLE_DPD
extern int                  ike_session_ph1_force_dpd (struct sockaddr_storage *);
#endif

//%%%%%%%%%%% don't know where the following will go yet - all these below could change
extern struct contacted     *ike_session_getcontacted (struct sockaddr_storage *);
extern int                  ike_session_inscontacted (struct sockaddr_storage *);
extern void                 ike_session_clear_contacted (void);
extern void                 ike_session_initctdtree (void);

extern time_t               ike_session_get_exp_retx_interval (int num_retries, int fixed_retry_interval);

extern int                  ike_session_add_recvdpkt (struct sockaddr_storage *, struct sockaddr_storage *,
                                                      vchar_t *, vchar_t *, size_t, u_int32_t);
extern void                 ike_session_clear_recvdpkt (void);
extern void                 ike_session_init_recvdpkt (void);

#ifdef ENABLE_HYBRID
//extern int                  ike_session_exclude_cfg_addr (const struct sockaddr_storage *);
#endif

extern void                 sweep_sleepwake (void);

extern uint32_t             iph1_get_remote_v4_address(phase1_handle_t *iph1);

extern uint32_t             iph2_get_remote_v4_address(phase2_handle_t *iph2);

#endif /* _HANDLER_H */
Commit	Line	Data
d1e348cf A	1	/* $NetBSD: handler.h,v 1.9 2006/09/09 16:22:09 manu Exp $ */
	2
	3	/* Id: handler.h,v 1.19 2006/02/25 08:25:12 manubsd Exp */
52b7d2ce A	4
	5	/*
	6	* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
	7	* All rights reserved.
	8	*
	9	* Redistribution and use in source and binary forms, with or without
	10	* modification, are permitted provided that the following conditions
	11	* are met:
	12	* 1. Redistributions of source code must retain the above copyright
	13	* notice, this list of conditions and the following disclaimer.
	14	* 2. Redistributions in binary form must reproduce the above copyright
	15	* notice, this list of conditions and the following disclaimer in the
	16	* documentation and/or other materials provided with the distribution.
	17	* 3. Neither the name of the project nor the names of its contributors
	18	* may be used to endorse or promote products derived from this software
	19	* without specific prior written permission.
	20	*
	21	* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
	22	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	23	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	24	* ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
	25	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	26	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	27	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	28	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	29	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	30	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	31	* SUCH DAMAGE.
	32	*/
	33
	34	#ifndef _HANDLER_H
	35	#define _HANDLER_H
	36
e8d9021d	37	#include "config.h"
65c25746	38	#include "racoon_types.h"
e8d9021d	39
52b7d2ce	40	#include <sys/queue.h>
e8d9021d	41	#ifdef HAVE_OPENSSL
52b7d2ce	42	#include <openssl/rsa.h>
e8d9021d	43	#endif
52b7d2ce A	44
	45	#include <sys/time.h>
	46
	47	#include "isakmp_var.h"
	48	#include "oakley.h"
e8d9021d A	49	#ifndef HAVE_OPENSSL
	50	#include <Security/SecDH.h>
	51	#endif
65c25746	52	#include <sys/socket.h>
52b7d2ce	53
4aae5213	54	#include "schedule.h"
bd966c25 A	55
	56	#if __has_include(<nw/private.h>)
	57	#include <nw/private.h>
	58	#else
d06a7ccb	59	#include <network/nat64.h>
bd966c25	60	#endif
d1e348cf	61
52b7d2ce A	62	/* About address semantics in each case.
	63	* initiator(addr=I) responder(addr=R)
	64	* src dst src dst
	65	* (local) (remote) (local) (remote)
	66	* phase 1 handler I R R I
	67	* phase 2 handler I R R I
	68	* getspi msg R I I R
	69	* acquire msg I R
	70	* ID payload I R I R
	71	*/
	72	#ifdef ENABLE_HYBRID
	73	struct isakmp_cfg_state;
	74	#endif
52b7d2ce	75
65c25746 A	76	#define INVALID_MSGID 0xFFFFFFFF
	77
	78	//=======================================================================
	79	// PHASE 1
	80	//=======================================================================
	81
	82	struct phase1handle {
	83	isakmp_index index;
	84
52b7d2ce A	85	int status; /* status of this SA */
52b7d2ce A	86	int side; /* INITIATOR or RESPONDER */
d1e348cf	87	int started_by_api; /* connection started by VPNControl API */
d06a7ccb A	88
	89	nw_nat64_prefix_t nat64_prefix; /* nat64 prefix to apply to addresses. */
	90	struct sockaddr_storage remote; / remote address to negotiate ph1 */
	91	struct sockaddr_storage local; / local address to negotiate ph1 */
65c25746 A	92	/* XXX copy from rmconf due to anonymous configuration.
	93	* If anonymous will be forbidden, we do delete them. */
	94
52b7d2ce	95	struct remoteconf rmconf; / pointer to remote configuration */
65c25746	96
52b7d2ce	97	struct isakmpsa approval; / pointer to SA(s) approved. */
65c25746 A	98	/* for example pre-shared key */
65c25746 A	99
52b7d2ce A	100	u_int8_t version; /* ISAKMP version */
	101	u_int8_t etype; /* Exchange type actually for use */
	102	u_int8_t flags; /* Flags */
	103	u_int32_t msgid; /* message id */
d1e348cf A	104
d1e348cf A	105	#ifdef ENABLE_NATT
52b7d2ce A	106	struct ph1natt_options natt_options; / Selected NAT-T IKE version */
52b7d2ce A	107	u_int32_t natt_flags; /* NAT-T related flags */
d1e348cf	108	#endif
52b7d2ce A	109	#ifdef ENABLE_FRAG
	110	int frag; /* IKE phase 1 fragmentation */
	111	struct isakmp_frag_item frag_chain; / Received fragments */
	112	#endif
65c25746 A	113
	114	schedule_ref sce; /* schedule for expire */
	115	schedule_ref sce_rekey; /* schedule for rekey */
	116
	117	schedule_ref scr; /* schedule for resend */
52b7d2ce A	118	int retry_counter; /* for resend. */
52b7d2ce A	119	vchar_t sendbuf; / buffer for re-sending */
65c25746	120
e8d9021d A	121	#ifndef HAVE_OPENSSL
	122	SecDHContext dhC; /* Context for Security Framework Diffie-Hellman calculations */
	123	size_t publicKeySize;
	124	#endif
52b7d2ce A	125	vchar_t dhpriv; / DH; private value */
	126	vchar_t dhpub; / DH; public value */
	127	vchar_t dhpub_p; / DH; partner's public value */
	128	vchar_t dhgxy; / DH; shared secret */
	129	vchar_t nonce; / nonce value */
	130	vchar_t nonce_p; / partner's nonce value */
	131	vchar_t skeyid; / SKEYID */
	132	vchar_t skeyid_d; / SKEYID_d */
65c25746 A	133	vchar_t skeyid_a; / SKEYID_a, i.e. integrity protection */
65c25746 A	134	vchar_t skeyid_a_p; / SKEYID_a_p, i.e. integrity protection */
52b7d2ce	135	vchar_t skeyid_e; / SKEYID_e, i.e. encryption */
65c25746	136	vchar_t skeyid_e_p; / peer's SKEYID_e, i.e. encryption */
52b7d2ce	137	vchar_t key; / cipher key */
65c25746	138	vchar_t key_p; / peer's cipher key */
52b7d2ce A	139	vchar_t hash; / HASH minus general header */
	140	vchar_t sig; / SIG minus general header */
	141	vchar_t sig_p; / peer's SIG minus general header */
	142	cert_t cert; / CERT minus general header */
	143	cert_t cert_p; / peer's CERT minus general header */
	144	cert_t crl_p; / peer's CRL minus general header */
	145	cert_t cr_p; / peer's CR not including general */
52b7d2ce A	146	vchar_t id; / ID minus gen header */
52b7d2ce A	147	vchar_t id_p; / partner's ID minus general header */
65c25746	148	/* i.e. struct ipsecdoi_id_b. /
52b7d2ce	149	struct isakmp_ivm ivm; / IVs */
65c25746	150
52b7d2ce	151	vchar_t sa; / whole SA payload to send/to be sent*/
65c25746 A	152	/* to calculate HASH */
	153	/* NOT INCLUDING general header. */
	154
52b7d2ce	155	vchar_t sa_ret; / SA payload to reply/to be replyed */
65c25746 A	156	/* NOT INCLUDING general header. */
	157	/* NOTE: Should be release after use. */
	158
52b7d2ce	159	struct isakmp_pl_hash pl_hash; / pointer to hash payload */
65c25746	160
52b7d2ce A	161	time_t created; /* timestamp for establish */
	162	#ifdef ENABLE_STATS
	163	struct timeval start;
	164	struct timeval end;
	165	#endif
65c25746	166
d1e348cf	167	#ifdef ENABLE_DPD
52b7d2ce A	168	int dpd_support; /* Does remote supports DPD ? */
	169	time_t dpd_lastack; /* Last ack received */
	170	u_int16_t dpd_seq; /* DPD seq number to receive */
	171	u_int8_t dpd_fails; /* number of failures */
65c25746 A	172	u_int8_t peer_sent_ike;
65c25746 A	173	schedule_ref dpd_r_u;
d1e348cf	174	#endif
65c25746	175
d1e348cf	176	#ifdef ENABLE_VPNCONTROL_PORT
65c25746	177	schedule_ref ping_sched; /* for sending pings to keep FW open */
d1e348cf A	178	#endif
d1e348cf A	179
52b7d2ce A	180	u_int32_t msgid2; /* msgid counter for Phase 2 */
52b7d2ce A	181	int ph2cnt; /* the number which is negotiated by this phase 1 */
52b7d2ce A	182	#ifdef ENABLE_HYBRID
52b7d2ce A	183	struct isakmp_cfg_state mode_cfg; / ISAKMP mode config state */
d1e348cf A	184	u_int8_t pended_xauth_id; /* saved id for reply from vpn control socket */
d1e348cf A	185	u_int8_t xauth_awaiting_userinput; /* indicates we are waiting for user input */
65c25746	186	vchar_t xauth_awaiting_userinput_msg; / tracks the last packet that triggered XAUTH */
d1e348cf	187	#endif
65c25746 A	188	int is_rekey:1;
	189	int is_dying:1;
	190	ike_session_t *parent_session;
	191	LIST_HEAD(_ph2ofph1_, phase2handle) bound_ph2tree;
	192	LIST_ENTRY(phase1handle) ph1ofsession_chain;
52b7d2ce A	193	};
52b7d2ce A	194
65c25746 A	195	#define PHASE2_TYPE_SA 0
	196	#define PHASE2_TYPE_INFO 1
	197	#define PHASE2_TYPE_CFG 2
	198
	199	//=======================================================================
	200	// PHASE 2
	201	//=======================================================================
	202	struct phase2handle {
85f41bec A	203	struct sockaddr_storage src; / my address of SA. */
85f41bec A	204	struct sockaddr_storage dst; / peer's address of SA. */
d06a7ccb A	205	nw_nat64_prefix_t nat64_prefix; /* nat64 prefix to apply to addresses. */
d06a7ccb A	206
65c25746 A	207	/*
	208	* copy ip address from ID payloads when ID type is ip address.
	209	* In other case, they must be null.
	210	*/
85f41bec A	211	struct sockaddr_storage *src_id;
85f41bec A	212	struct sockaddr_storage *dst_id;
65c25746 A	213
65c25746 A	214	int phase2_type; /* what this phase2 struct is for - see defines for PHASE2_TYPE... */
52b7d2ce	215	u_int32_t spid; /* policy id by kernel */
65c25746 A	216
65c25746 A	217	int status; /* ipsec sa status */
52b7d2ce	218	u_int8_t side; /* INITIATOR or RESPONDER */
65c25746 A	219	u_int8_t version; /* ISAKMP version */
	220
	221	schedule_ref sce; /* schedule for expire */
	222	schedule_ref scr; /* schedule for resend */
52b7d2ce A	223	int retry_counter; /* for resend. */
	224	vchar_t sendbuf; / buffer for re-sending */
	225	vchar_t msg1; / buffer for re-sending */
65c25746 A	226	/* used for responder's first message */
65c25746 A	227
52b7d2ce	228	int retry_checkph1; /* counter to wait phase 1 finished. */
65c25746 A	229	/* NOTE: actually it's timer. */
65c25746 A	230
52b7d2ce	231	u_int32_t seq; /* sequence number used by PF_KEY */
65c25746 A	232	/*
	233	* NOTE: In responder side, we can't identify each SAs
	234	* with same destination address for example, when
	235	* socket based SA is required. So we set a identifier
	236	* number to "seq", and sent kernel by pfkey.
	237	*/
52b7d2ce	238	u_int8_t satype; /* satype in PF_KEY */
65c25746 A	239	/*
	240	* saved satype in the original PF_KEY request from
	241	* the kernel in order to reply a error.
	242	*/
	243
52b7d2ce A	244	u_int8_t flags; /* Flags for phase 2 */
52b7d2ce A	245	u_int32_t msgid; /* msgid for phase 2 */
65c25746	246
52b7d2ce A	247	struct sainfo sainfo; / place holder of sainfo */
	248	struct saprop proposal; / SA(s) proposal. */
	249	struct saprop approval; / SA(s) approved. */
85f41bec	250	struct policyindex * spidx_gen; /* policy from peer's proposal */
65c25746	251
e8d9021d A	252	#ifndef HAVE_OPENSSL
	253	SecDHContext dhC; /* Context for Security Framework Diffie-Hellman calculations */
	254	size_t publicKeySize;
	255	#endif
52b7d2ce A	256	struct dhgroup pfsgrp; / DH; prime number */
	257	vchar_t dhpriv; / DH; private value */
	258	vchar_t dhpub; / DH; public value */
	259	vchar_t dhpub_p; / DH; partner's public value */
	260	vchar_t dhgxy; / DH; shared secret */
	261	vchar_t id; / ID minus gen header */
	262	vchar_t id_p; / peer's ID minus general header */
	263	vchar_t nonce; / nonce value in phase 2 */
	264	vchar_t nonce_p; / partner's nonce value in phase 2 */
65c25746	265
52b7d2ce	266	vchar_t sa; / whole SA payload to send/to be sent*/
65c25746 A	267	/* to calculate HASH */
	268	/* NOT INCLUDING general header. */
	269
52b7d2ce	270	vchar_t sa_ret; / SA payload to reply/to be replyed */
65c25746 A	271	/* NOT INCLUDING general header. */
	272	/* NOTE: Should be release after use. */
	273
52b7d2ce	274	struct isakmp_ivm ivm; / IVs */
65c25746	275
52b7d2ce	276	int generated_spidx; /* mark handlers whith generated policy */
65c25746	277
52b7d2ce A	278	#ifdef ENABLE_STATS
	279	struct timeval start;
	280	struct timeval end;
	281	#endif
65c25746	282	struct phase1handle ph1; / back pointer to isakmp status */
d1e348cf A	283	int is_rekey:1;
d1e348cf A	284	int is_dying:1;
d9c572c0	285	int is_defunct:1;
d1e348cf	286	ike_session_t *parent_session;
47612122 A	287	vchar_t *ext_nat_id;
47612122 A	288	vchar_t *ext_nat_id_p;
65c25746 A	289	LIST_ENTRY(phase2handle) ph2ofsession_chain;
65c25746 A	290	LIST_ENTRY(phase2handle) ph1bind_chain; /* chain to ph1handle */
52b7d2ce A	291	};
	292
	293	/*
	294	* for handling initial contact.
	295	*/
	296	struct contacted {
85f41bec	297	struct sockaddr_storage remote; / remote address to negotiate ph1 */
52b7d2ce A	298	LIST_ENTRY(contacted) chain;
	299	};
	300
	301	/*
	302	* for checking if a packet is retransmited.
	303	*/
	304	struct recvdpkt {
85f41bec A	305	struct sockaddr_storage remote; / the remote address */
85f41bec A	306	struct sockaddr_storage local; / the local address */
52b7d2ce A	307	vchar_t hash; / hash of the received packet */
	308	vchar_t sendbuf; / buffer for the response */
	309	int retry_counter; /* how many times to send */
	310	time_t time_send; /* timestamp to send a packet */
	311	time_t created; /* timestamp to create a queue */
e8d9021d A	312	time_t retry_interval;
	313	#ifdef ENABLE_FRAG
	314	u_int32_t frag_flags; /* IKE phase 1 fragmentation */
	315	#endif
52b7d2ce	316
65c25746	317	schedule_ref scr; /* schedule for resend, may not used */
52b7d2ce A	318
	319	LIST_ENTRY(recvdpkt) chain;
	320	};
	321
	322	/* for parsing ISAKMP header. */
	323	struct isakmp_parse_t {
	324	u_char type; /* payload type of mine */
	325	int len; /* ntohs(ptr->len) */
	326	struct isakmp_gen *ptr;
	327	};
	328
	329	/*
	330	* for IV management.
	331	*
	332	* - normal case
	333	* initiator responder
	334	* ------------------------- --------------------------
	335	* initialize iv(A), ive(A). initialize iv(A), ive(A).
	336	* encode by ive(A).
	337	* save to iv(B). ---[packet(B)]--> save to ive(B).
	338	* decode by iv(A).
	339	* packet consistency.
	340	* sync iv(B) with ive(B).
	341	* check auth, integrity.
	342	* encode by ive(B).
	343	* save to ive(C). <--[packet(C)]--- save to iv(C).
	344	* decoded by iv(B).
	345	* :
	346	*
	347	* - In the case that a error is found while cipher processing,
	348	* initiator responder
	349	* ------------------------- --------------------------
	350	* initialize iv(A), ive(A). initialize iv(A), ive(A).
	351	* encode by ive(A).
	352	* save to iv(B). ---[packet(B)]--> save to ive(B).
	353	* decode by iv(A).
	354	* packet consistency.
	355	* sync iv(B) with ive(B).
	356	* check auth, integrity.
	357	* error found.
	358	* create notify.
	359	* get ive2(X) from iv(B).
	360	* encode by ive2(X).
	361	* get iv2(X) from iv(B). <--[packet(Y)]--- save to iv2(Y).
	362	* save to ive2(Y).
	363	* decoded by iv2(X).
	364	* :
	365	*
	366	* The reason why the responder synchronizes iv with ive after checking the
	367	* packet consistency is that it is required to leave the IV for decoding
	368	* packet. Because there is a potential of error while checking the packet
	369	* consistency. Also the reason why that is before authentication and
	370	* integirty check is that the IV for informational exchange has to be made
	371	* by the IV which is after packet decoded and checking the packet consistency.
	372	* Otherwise IV mismatched happens between the intitiator and the responder.
	373	*/
	374	struct isakmp_ivm {
	375	vchar_t iv; / for decoding packet */
	376	/* if phase 1, it's for computing phase2 iv */
	377	vchar_t ive; / for encoding packet */
	378	};
	379
	380	/* for dumping */
	381	struct ph1dump {
382	isakmp_index index;
383	int status;
384	int side;
385	struct sockaddr_storage remote;
386	struct sockaddr_storage local;
387	u_int8_t version;
388	u_int8_t etype;
389	time_t created;
390	int ph2cnt;
391	};
392
85f41bec	393	struct sockaddr_storage;
52b7d2ce A	394	struct policyindex;
52b7d2ce A	395
65c25746 A	396	extern int ike_session_check_recvdpkt (struct sockaddr_storage , struct sockaddr_storage , vchar_t *);
	397
	398	extern void ike_session_flush_all_phase1_for_session(ike_session_t *, int);
	399	extern void ike_session_flush_all_phase1 (int);
	400
	401	extern phase1_handle_t ike_session_getph1byindex (ike_session_t , isakmp_index *);
	402	extern phase1_handle_t ike_session_getph1byindex0 (ike_session_t , isakmp_index *);
	403	extern phase1_handle_t ike_session_getph1byaddr (ike_session_t , struct sockaddr_storage *,
	404	struct sockaddr_storage *);
	405	extern phase1_handle_t ike_session_getph1byaddrwop (ike_session_t , struct sockaddr_storage *,
	406	struct sockaddr_storage *);
	407	extern phase1_handle_t ike_session_getph1bydstaddrwop (ike_session_t , struct sockaddr_storage *);
	408	extern int ike_session_islast_ph1 (phase1_handle_t *);
	409
	410	extern int ike_session_expire_session(ike_session_t *session);
	411	extern int ike_session_purgephXbydstaddrwop (struct sockaddr_storage *);
	412	extern void ike_session_purgephXbyspid (u_int32_t, int);
	413
	414	extern phase1_handle_t *ike_session_newph1 (unsigned int);
	415	extern void ike_session_delph1 (phase1_handle_t *);
	416
	417	extern phase2_handle_t ike_session_getph2byspidx (ike_session_t , struct policyindex *);
	418	extern phase2_handle_t *ike_session_getph2byspid (u_int32_t);
	419	extern phase2_handle_t *ike_session_getph2byseq (u_int32_t);
	420	//extern phase2_handle_t ike_session_getph2bysaddr (struct sockaddr_storage , struct sockaddr_storage *);
	421	extern phase2_handle_t ike_session_getph2bymsgid (phase1_handle_t , u_int32_t);
	422	extern phase2_handle_t ike_session_getonlyph2(phase1_handle_t iph1);
	423	extern phase2_handle_t ike_session_getph2byid (struct sockaddr_storage , struct sockaddr_storage *, u_int32_t);
	424	extern phase2_handle_t ike_session_getph2bysaidx (struct sockaddr_storage , struct sockaddr_storage *, u_int, u_int32_t);
	425	extern phase2_handle_t ike_session_getph2bysaidx2(struct sockaddr_storage src, struct sockaddr_storage dst, u_int proto_id, u_int32_t spi, u_int32_t opposite_spi);
	426	extern phase2_handle_t *ike_session_newph2 (unsigned int, int);
	427	extern void ike_session_initph2 (phase2_handle_t *);
	428	extern void ike_session_delph2 (phase2_handle_t *);
	429	extern void ike_session_flush_all_phase2_for_session(ike_session_t *, int);
	430	extern void ike_session_flush_all_phase2 (int);
	431	extern void ike_session_deleteallph2 (struct sockaddr_storage , struct sockaddr_storage , u_int);
	432	extern void ike_session_deleteallph1 (struct sockaddr_storage , struct sockaddr_storage );
	433
	434	#ifdef ENABLE_DPD
	435	extern int ike_session_ph1_force_dpd (struct sockaddr_storage *);
d1e348cf	436	#endif
65c25746 A	437
	438	//%%%%%%%%%%% don't know where the following will go yet - all these below could change
	439	extern struct contacted ike_session_getcontacted (struct sockaddr_storage );
	440	extern int ike_session_inscontacted (struct sockaddr_storage *);
	441	extern void ike_session_clear_contacted (void);
	442	extern void ike_session_initctdtree (void);
	443
	444	extern time_t ike_session_get_exp_retx_interval (int num_retries, int fixed_retry_interval);
	445
	446	extern int ike_session_add_recvdpkt (struct sockaddr_storage , struct sockaddr_storage ,
	447	vchar_t , vchar_t , size_t, u_int32_t);
	448	extern void ike_session_clear_recvdpkt (void);
	449	extern void ike_session_init_recvdpkt (void);
52b7d2ce A	450
52b7d2ce A	451	#ifdef ENABLE_HYBRID
65c25746	452	//extern int ike_session_exclude_cfg_addr (const struct sockaddr_storage *);
52b7d2ce A	453	#endif
52b7d2ce A	454
65c25746	455	extern void sweep_sleepwake (void);
d1e348cf	456
d06a7ccb A	457	extern uint32_t iph1_get_remote_v4_address(phase1_handle_t *iph1);
	458
	459	extern uint32_t iph2_get_remote_v4_address(phase2_handle_t *iph2);
	460
52b7d2ce	461	#endif /* _HANDLER_H */