[apple/ipsec.git] / ipsec-tools / racoon / handler.h

/*	$NetBSD: handler.h,v 1.9 2006/09/09 16:22:09 manu Exp $	*/

/* Id: handler.h,v 1.19 2006/02/25 08:25:12 manubsd Exp */

/*
 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
 * All rights reserved.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the project nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 * 
 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#ifndef _HANDLER_H
#define _HANDLER_H

#include "config.h"
#include "racoon_types.h"

#include <sys/queue.h>
#ifdef HAVE_OPENSSL
#include <openssl/rsa.h>
#endif

#include <sys/time.h>

#include "isakmp_var.h"
#include "oakley.h"
#ifndef HAVE_OPENSSL
#include <Security/SecDH.h>
#endif
#include <sys/socket.h>

#include <schedule.h>

/* About address semantics in each case.
 *			initiator(addr=I)	responder(addr=R)
 *			src	dst		src	dst
 *			(local)	(remote)	(local)	(remote)
 * phase 1 handler	I	R		R	I
 * phase 2 handler	I	R		R	I
 * getspi msg		R	I		I	R
 * acquire msg		I	R
 * ID payload		I	R		I	R
 */
#ifdef ENABLE_HYBRID
struct isakmp_cfg_state;
#endif

#define INVALID_MSGID           0xFFFFFFFF

//=======================================================================
// PHASE 1
//=======================================================================

struct phase1handle {
	isakmp_index index;
    
	int status;			/* status of this SA */
	int side;			/* INITIATOR or RESPONDER */
	int started_by_api;		/* connection started by VPNControl API */
    
	struct sockaddr_storage *remote;	/* remote address to negosiate ph1 */
	struct sockaddr_storage *local;		/* local address to negosiate ph1 */
    /* XXX copy from rmconf due to anonymous configuration.
     * If anonymous will be forbidden, we do delete them. */
    
	struct remoteconf *rmconf;	/* pointer to remote configuration */
    
	struct isakmpsa *approval;	/* pointer to SA(s) approved. */
    /* for example pre-shared key */
    
	u_int8_t version;		/* ISAKMP version */
	u_int8_t etype;			/* Exchange type actually for use */
	u_int8_t flags;			/* Flags */
	u_int32_t msgid;		/* message id */
	
#ifdef ENABLE_NATT
	struct ph1natt_options *natt_options;	/* Selected NAT-T IKE version */
	u_int32_t natt_flags;		/* NAT-T related flags */
#endif
#ifdef ENABLE_FRAG
	int frag;			/* IKE phase 1 fragmentation */
	struct isakmp_frag_item *frag_chain;	/* Received fragments */
#endif
    
	schedule_ref sce;		/* schedule for expire */
	schedule_ref sce_rekey; /* schedule for rekey */
    
	schedule_ref scr;		/* schedule for resend */
	int retry_counter;		/* for resend. */
	vchar_t *sendbuf;		/* buffer for re-sending */
    
#ifndef HAVE_OPENSSL
	SecDHContext dhC;		/* Context for Security Framework Diffie-Hellman calculations */
	size_t publicKeySize;
#endif
	vchar_t *dhpriv;		/* DH; private value */
	vchar_t *dhpub;			/* DH; public value */
	vchar_t *dhpub_p;		/* DH; partner's public value */
	vchar_t *dhgxy;			/* DH; shared secret */
	vchar_t *nonce;			/* nonce value */
	vchar_t *nonce_p;		/* partner's nonce value */
	vchar_t *skeyid;		/* SKEYID */
	vchar_t *skeyid_d;		/* SKEYID_d */
	vchar_t *skeyid_a;		/* SKEYID_a, i.e. integrity protection */
	vchar_t *skeyid_a_p;    /* SKEYID_a_p, i.e. integrity protection */
	vchar_t *skeyid_e;		/* SKEYID_e, i.e. encryption */
    vchar_t *skeyid_e_p;	/* peer's SKEYID_e, i.e. encryption */
	vchar_t *key;			/* cipher key */
    vchar_t *key_p;         /* peer's cipher key */
	vchar_t *hash;			/* HASH minus general header */
	vchar_t *sig;			/* SIG minus general header */
	vchar_t *sig_p;			/* peer's SIG minus general header */
	cert_t *cert;			/* CERT minus general header */
	cert_t *cert_p;			/* peer's CERT minus general header */
	cert_t *crl_p;			/* peer's CRL minus general header */
	cert_t *cr_p;			/* peer's CR not including general */
	vchar_t *id;			/* ID minus gen header */
	vchar_t *id_p;			/* partner's ID minus general header */
    /* i.e. struct ipsecdoi_id_b*. */
	struct isakmp_ivm *ivm;		/* IVs */
    
	vchar_t *sa;			/* whole SA payload to send/to be sent*/
    /* to calculate HASH */
    /* NOT INCLUDING general header. */
    
	vchar_t *sa_ret;		/* SA payload to reply/to be replyed */
    /* NOT INCLUDING general header. */
    /* NOTE: Should be release after use. */
    
	struct isakmp_pl_hash *pl_hash;	/* pointer to hash payload */
    
	time_t created;			/* timestamp for establish */
#ifdef ENABLE_STATS
	struct timeval start;
	struct timeval end;
#endif
    
#ifdef ENABLE_DPD
	int		dpd_support;	/* Does remote supports DPD ? */
	time_t		dpd_lastack;	/* Last ack received */
	u_int16_t	dpd_seq;		/* DPD seq number to receive */
	u_int8_t	dpd_fails;		/* number of failures */
    u_int8_t        peer_sent_ike;
	schedule_ref    dpd_r_u;
#endif
    
#ifdef ENABLE_VPNCONTROL_PORT
	schedule_ref ping_sched;	/* for sending pings to keep FW open */
#endif
	
	u_int32_t msgid2;		/* msgid counter for Phase 2 */
	int ph2cnt;	/* the number which is negotiated by this phase 1 */
#ifdef ENABLE_HYBRID
	struct isakmp_cfg_state *mode_cfg;	/* ISAKMP mode config state */
	u_int8_t pended_xauth_id;			/* saved id for reply from vpn control socket */
	u_int8_t xauth_awaiting_userinput;	/* indicates we are waiting for user input */
    vchar_t *xauth_awaiting_userinput_msg; /* tracks the last packet that triggered XAUTH */
#endif
	int                                     is_rekey:1;
	int                                     is_dying:1;
	ike_session_t                           *parent_session;
	LIST_HEAD(_ph2ofph1_, phase2handle)     bound_ph2tree;
	LIST_ENTRY(phase1handle)                ph1ofsession_chain;
};

#define PHASE2_TYPE_SA          0
#define PHASE2_TYPE_INFO        1
#define PHASE2_TYPE_CFG         2

//=======================================================================
// PHASE 2
//=======================================================================
struct phase2handle {
	struct sockaddr_storage *src;		/* my address of SA. */
	struct sockaddr_storage *dst;		/* peer's address of SA. */
    
    /*
     * copy ip address from ID payloads when ID type is ip address.
     * In other case, they must be null.
     */
	struct sockaddr_storage *src_id;
	struct sockaddr_storage *dst_id;
    
    int phase2_type;        /* what this phase2 struct is for - see defines for PHASE2_TYPE... */
	u_int32_t spid;			/* policy id by kernel */
    
	int status;             /* ipsec sa status */
	u_int8_t side;			/* INITIATOR or RESPONDER */
	u_int8_t version;		/* ISAKMP version */
    
	schedule_ref sce;		/* schedule for expire */
	schedule_ref scr;		/* schedule for resend */
	int retry_counter;		/* for resend. */
	vchar_t *sendbuf;		/* buffer for re-sending */
	vchar_t *msg1;			/* buffer for re-sending */
    /* used for responder's first message */
    
	int retry_checkph1;		/* counter to wait phase 1 finished. */
    /* NOTE: actually it's timer. */
    
	u_int32_t seq;			/* sequence number used by PF_KEY */
    /*
     * NOTE: In responder side, we can't identify each SAs
     * with same destination address for example, when
     * socket based SA is required.  So we set a identifier
     * number to "seq", and sent kernel by pfkey.
     */
	u_int8_t satype;		/* satype in PF_KEY */
    /*
     * saved satype in the original PF_KEY request from
     * the kernel in order to reply a error.
     */
    
	u_int8_t flags;			/* Flags for phase 2 */
	u_int32_t msgid;		/* msgid for phase 2 */
    
	struct sainfo *sainfo;		/* place holder of sainfo */
	struct saprop *proposal;	/* SA(s) proposal. */
	struct saprop *approval;	/* SA(s) approved. */
	struct policyindex * spidx_gen;		/* policy from peer's proposal */
    
#ifndef HAVE_OPENSSL
	SecDHContext dhC;		/* Context for Security Framework Diffie-Hellman calculations */
	size_t publicKeySize;
#endif	
	struct dhgroup *pfsgrp;		/* DH; prime number */
	vchar_t *dhpriv;		/* DH; private value */
	vchar_t *dhpub;			/* DH; public value */
	vchar_t *dhpub_p;		/* DH; partner's public value */
	vchar_t *dhgxy;			/* DH; shared secret */
	vchar_t *id;			/* ID minus gen header */
	vchar_t *id_p;			/* peer's ID minus general header */
	vchar_t *nonce;			/* nonce value in phase 2 */
	vchar_t *nonce_p;		/* partner's nonce value in phase 2 */
    
	vchar_t *sa;			/* whole SA payload to send/to be sent*/
    /* to calculate HASH */
    /* NOT INCLUDING general header. */
    
	vchar_t *sa_ret;		/* SA payload to reply/to be replyed */
    /* NOT INCLUDING general header. */
    /* NOTE: Should be release after use. */
    
	struct isakmp_ivm *ivm;		/* IVs */
    
	int generated_spidx;	/* mark handlers whith generated policy */
    
#ifdef ENABLE_STATS
	struct timeval start;
	struct timeval end;
#endif
	struct phase1handle *ph1;	/* back pointer to isakmp status */
	int                    is_rekey:1;
	int                    is_dying:1;
    	int		       is_defunct:1;
	ike_session_t         *parent_session;
	vchar_t               *ext_nat_id;
	vchar_t               *ext_nat_id_p;
	LIST_ENTRY(phase2handle)    ph2ofsession_chain;	
	LIST_ENTRY(phase2handle)    ph1bind_chain;	/* chain to ph1handle */
};

/*
 * for handling initial contact.
 */
struct contacted {
	struct sockaddr_storage *remote;	/* remote address to negotiate ph1 */
	LIST_ENTRY(contacted) chain;
};

/*
 * for checking if a packet is retransmited.
 */
struct recvdpkt {
	struct sockaddr_storage *remote;	/* the remote address */
	struct sockaddr_storage *local;		/* the local address */
	vchar_t *hash;			/* hash of the received packet */
	vchar_t *sendbuf;		/* buffer for the response */
	int retry_counter;		/* how many times to send */
	time_t time_send;		/* timestamp to send a packet */
	time_t created;			/* timestamp to create a queue */
	time_t retry_interval;
#ifdef ENABLE_FRAG
	u_int32_t frag_flags;            /* IKE phase 1 fragmentation */
#endif

	schedule_ref scr;		/* schedule for resend, may not used */

	LIST_ENTRY(recvdpkt) chain;
};

/* for parsing ISAKMP header. */
struct isakmp_parse_t {
	u_char type;		/* payload type of mine */
	int len;		/* ntohs(ptr->len) */
	struct isakmp_gen *ptr;
};

/*
 * for IV management.
 *
 * - normal case
 * initiator                                     responder
 * -------------------------                     --------------------------
 * initialize iv(A), ive(A).                     initialize iv(A), ive(A).
 * encode by ive(A).
 * save to iv(B).            ---[packet(B)]-->   save to ive(B).
 *                                               decode by iv(A).
 *                                               packet consistency.
 *                                               sync iv(B) with ive(B).
 *                                               check auth, integrity.
 *                                               encode by ive(B).
 * save to ive(C).          <--[packet(C)]---    save to iv(C).
 * decoded by iv(B).
 *      :
 *
 * - In the case that a error is found while cipher processing,
 * initiator                                     responder
 * -------------------------                     --------------------------
 * initialize iv(A), ive(A).                     initialize iv(A), ive(A).
 * encode by ive(A).
 * save to iv(B).            ---[packet(B)]-->   save to ive(B).
 *                                               decode by iv(A).
 *                                               packet consistency.
 *                                               sync iv(B) with ive(B).
 *                                               check auth, integrity.
 *                                               error found.
 *                                               create notify.
 *                                               get ive2(X) from iv(B).
 *                                               encode by ive2(X).
 * get iv2(X) from iv(B).   <--[packet(Y)]---    save to iv2(Y).
 * save to ive2(Y).
 * decoded by iv2(X).
 *      :
 *
 * The reason why the responder synchronizes iv with ive after checking the
 * packet consistency is that it is required to leave the IV for decoding
 * packet.  Because there is a potential of error while checking the packet
 * consistency.  Also the reason why that is before authentication and
 * integirty check is that the IV for informational exchange has to be made
 * by the IV which is after packet decoded and checking the packet consistency.
 * Otherwise IV mismatched happens between the intitiator and the responder.
 */
struct isakmp_ivm {
	vchar_t *iv;	/* for decoding packet */
			/* if phase 1, it's for computing phase2 iv */
	vchar_t *ive;	/* for encoding packet */
};

/* for dumping */
struct ph1dump {
	isakmp_index index;
	int status;
	int side;
	struct sockaddr_storage remote;
	struct sockaddr_storage local;
	u_int8_t version;
	u_int8_t etype;	
	time_t created;
	int ph2cnt;
};

struct sockaddr_storage;
struct policyindex;

extern int                  ike_session_check_recvdpkt (struct sockaddr_storage *, struct sockaddr_storage *, vchar_t *);

extern void                 ike_session_flush_all_phase1_for_session(ike_session_t *, int);
extern void                 ike_session_flush_all_phase1 (int);

extern phase1_handle_t      *ike_session_getph1byindex (ike_session_t *, isakmp_index *);
extern phase1_handle_t      *ike_session_getph1byindex0 (ike_session_t *, isakmp_index *);
extern phase1_handle_t      *ike_session_getph1byaddr (ike_session_t *, struct sockaddr_storage *,
                                                            struct sockaddr_storage *);
extern phase1_handle_t      *ike_session_getph1byaddrwop (ike_session_t *, struct sockaddr_storage *,
                                                            struct sockaddr_storage *);
extern phase1_handle_t      *ike_session_getph1bydstaddrwop (ike_session_t *, struct sockaddr_storage *);
extern int                  ike_session_islast_ph1 (phase1_handle_t *);

extern int                  ike_session_expire_session(ike_session_t *session);
extern int                  ike_session_purgephXbydstaddrwop (struct sockaddr_storage *);
extern void                 ike_session_purgephXbyspid (u_int32_t, int);

extern phase1_handle_t      *ike_session_newph1 (unsigned int);
extern void                 ike_session_delph1 (phase1_handle_t *);

extern phase2_handle_t      *ike_session_getph2byspidx (ike_session_t *, struct policyindex *);
extern phase2_handle_t      *ike_session_getph2byspid (u_int32_t);
extern phase2_handle_t      *ike_session_getph2byseq (u_int32_t);
//extern phase2_handle_t      *ike_session_getph2bysaddr (struct sockaddr_storage *, struct sockaddr_storage *);
extern phase2_handle_t      *ike_session_getph2bymsgid (phase1_handle_t *, u_int32_t);
extern phase2_handle_t      *ike_session_getonlyph2(phase1_handle_t *iph1);
extern phase2_handle_t      *ike_session_getph2byid (struct sockaddr_storage *, struct sockaddr_storage *, u_int32_t);
extern phase2_handle_t      *ike_session_getph2bysaidx (struct sockaddr_storage *, struct sockaddr_storage *, u_int, u_int32_t);
extern phase2_handle_t      *ike_session_getph2bysaidx2(struct sockaddr_storage *src, struct sockaddr_storage *dst, u_int proto_id, u_int32_t spi, u_int32_t *opposite_spi);
extern phase2_handle_t      *ike_session_newph2 (unsigned int, int);
extern void                 ike_session_initph2 (phase2_handle_t *);
extern void                 ike_session_delph2 (phase2_handle_t *);
extern void                 ike_session_flush_all_phase2_for_session(ike_session_t *, int);
extern void                 ike_session_flush_all_phase2 (int);
extern void                 ike_session_deleteallph2 (struct sockaddr_storage *, struct sockaddr_storage *, u_int);
extern void                 ike_session_deleteallph1 (struct sockaddr_storage *, struct sockaddr_storage *);

#ifdef ENABLE_DPD
extern int                  ike_session_ph1_force_dpd (struct sockaddr_storage *);
#endif

//%%%%%%%%%%% don't know where the following will go yet - all these below could change
extern struct contacted     *ike_session_getcontacted (struct sockaddr_storage *);
extern int                  ike_session_inscontacted (struct sockaddr_storage *);
extern void                 ike_session_clear_contacted (void);
extern void                 ike_session_initctdtree (void);

extern time_t               ike_session_get_exp_retx_interval (int num_retries, int fixed_retry_interval);

extern int                  ike_session_add_recvdpkt (struct sockaddr_storage *, struct sockaddr_storage *,
                                                      vchar_t *, vchar_t *, size_t, u_int32_t);
extern void                 ike_session_clear_recvdpkt (void);
extern void                 ike_session_init_recvdpkt (void);

#ifdef ENABLE_HYBRID
//extern int                  ike_session_exclude_cfg_addr (const struct sockaddr_storage *);
#endif

extern void                 sweep_sleepwake (void);

#endif /* _HANDLER_H */
Commit	Line	Data
d1e348cf A	1	/* $NetBSD: handler.h,v 1.9 2006/09/09 16:22:09 manu Exp $ */
	2
	3	/* Id: handler.h,v 1.19 2006/02/25 08:25:12 manubsd Exp */
52b7d2ce A	4
	5	/*
	6	* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
	7	* All rights reserved.
	8	*
	9	* Redistribution and use in source and binary forms, with or without
	10	* modification, are permitted provided that the following conditions
	11	* are met:
	12	* 1. Redistributions of source code must retain the above copyright
	13	* notice, this list of conditions and the following disclaimer.
	14	* 2. Redistributions in binary form must reproduce the above copyright
	15	* notice, this list of conditions and the following disclaimer in the
	16	* documentation and/or other materials provided with the distribution.
	17	* 3. Neither the name of the project nor the names of its contributors
	18	* may be used to endorse or promote products derived from this software
	19	* without specific prior written permission.
	20	*
	21	* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
	22	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	23	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	24	* ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
	25	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	26	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	27	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	28	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	29	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	30	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	31	* SUCH DAMAGE.
	32	*/
	33
	34	#ifndef _HANDLER_H
	35	#define _HANDLER_H
	36
e8d9021d	37	#include "config.h"
65c25746	38	#include "racoon_types.h"
e8d9021d	39
52b7d2ce	40	#include <sys/queue.h>
e8d9021d	41	#ifdef HAVE_OPENSSL
52b7d2ce	42	#include <openssl/rsa.h>
e8d9021d	43	#endif
52b7d2ce A	44
	45	#include <sys/time.h>
	46
	47	#include "isakmp_var.h"
	48	#include "oakley.h"
e8d9021d A	49	#ifndef HAVE_OPENSSL
	50	#include <Security/SecDH.h>
	51	#endif
65c25746	52	#include <sys/socket.h>
52b7d2ce	53
65c25746	54	#include <schedule.h>
d1e348cf	55
52b7d2ce A	56	/* About address semantics in each case.
	57	* initiator(addr=I) responder(addr=R)
	58	* src dst src dst
	59	* (local) (remote) (local) (remote)
	60	* phase 1 handler I R R I
	61	* phase 2 handler I R R I
	62	* getspi msg R I I R
	63	* acquire msg I R
	64	* ID payload I R I R
	65	*/
	66	#ifdef ENABLE_HYBRID
	67	struct isakmp_cfg_state;
	68	#endif
52b7d2ce	69
65c25746 A	70	#define INVALID_MSGID 0xFFFFFFFF
	71
	72	//=======================================================================
	73	// PHASE 1
	74	//=======================================================================
	75
	76	struct phase1handle {
	77	isakmp_index index;
	78
52b7d2ce A	79	int status; /* status of this SA */
52b7d2ce A	80	int side; /* INITIATOR or RESPONDER */
d1e348cf	81	int started_by_api; /* connection started by VPNControl API */
65c25746	82
85f41bec A	83	struct sockaddr_storage remote; / remote address to negosiate ph1 */
85f41bec A	84	struct sockaddr_storage local; / local address to negosiate ph1 */
65c25746 A	85	/* XXX copy from rmconf due to anonymous configuration.
	86	* If anonymous will be forbidden, we do delete them. */
	87
52b7d2ce	88	struct remoteconf rmconf; / pointer to remote configuration */
65c25746	89
52b7d2ce	90	struct isakmpsa approval; / pointer to SA(s) approved. */
65c25746 A	91	/* for example pre-shared key */
65c25746 A	92
52b7d2ce A	93	u_int8_t version; /* ISAKMP version */
	94	u_int8_t etype; /* Exchange type actually for use */
	95	u_int8_t flags; /* Flags */
	96	u_int32_t msgid; /* message id */
d1e348cf A	97
d1e348cf A	98	#ifdef ENABLE_NATT
52b7d2ce A	99	struct ph1natt_options natt_options; / Selected NAT-T IKE version */
52b7d2ce A	100	u_int32_t natt_flags; /* NAT-T related flags */
d1e348cf	101	#endif
52b7d2ce A	102	#ifdef ENABLE_FRAG
	103	int frag; /* IKE phase 1 fragmentation */
	104	struct isakmp_frag_item frag_chain; / Received fragments */
	105	#endif
65c25746 A	106
	107	schedule_ref sce; /* schedule for expire */
	108	schedule_ref sce_rekey; /* schedule for rekey */
	109
	110	schedule_ref scr; /* schedule for resend */
52b7d2ce A	111	int retry_counter; /* for resend. */
52b7d2ce A	112	vchar_t sendbuf; / buffer for re-sending */
65c25746	113
e8d9021d A	114	#ifndef HAVE_OPENSSL
	115	SecDHContext dhC; /* Context for Security Framework Diffie-Hellman calculations */
	116	size_t publicKeySize;
	117	#endif
52b7d2ce A	118	vchar_t dhpriv; / DH; private value */
	119	vchar_t dhpub; / DH; public value */
	120	vchar_t dhpub_p; / DH; partner's public value */
	121	vchar_t dhgxy; / DH; shared secret */
	122	vchar_t nonce; / nonce value */
	123	vchar_t nonce_p; / partner's nonce value */
	124	vchar_t skeyid; / SKEYID */
	125	vchar_t skeyid_d; / SKEYID_d */
65c25746 A	126	vchar_t skeyid_a; / SKEYID_a, i.e. integrity protection */
65c25746 A	127	vchar_t skeyid_a_p; / SKEYID_a_p, i.e. integrity protection */
52b7d2ce	128	vchar_t skeyid_e; / SKEYID_e, i.e. encryption */
65c25746	129	vchar_t skeyid_e_p; / peer's SKEYID_e, i.e. encryption */
52b7d2ce	130	vchar_t key; / cipher key */
65c25746	131	vchar_t key_p; / peer's cipher key */
52b7d2ce A	132	vchar_t hash; / HASH minus general header */
	133	vchar_t sig; / SIG minus general header */
	134	vchar_t sig_p; / peer's SIG minus general header */
	135	cert_t cert; / CERT minus general header */
	136	cert_t cert_p; / peer's CERT minus general header */
	137	cert_t crl_p; / peer's CRL minus general header */
	138	cert_t cr_p; / peer's CR not including general */
52b7d2ce A	139	vchar_t id; / ID minus gen header */
52b7d2ce A	140	vchar_t id_p; / partner's ID minus general header */
65c25746	141	/* i.e. struct ipsecdoi_id_b. /
52b7d2ce	142	struct isakmp_ivm ivm; / IVs */
65c25746	143
52b7d2ce	144	vchar_t sa; / whole SA payload to send/to be sent*/
65c25746 A	145	/* to calculate HASH */
	146	/* NOT INCLUDING general header. */
	147
52b7d2ce	148	vchar_t sa_ret; / SA payload to reply/to be replyed */
65c25746 A	149	/* NOT INCLUDING general header. */
	150	/* NOTE: Should be release after use. */
	151
52b7d2ce	152	struct isakmp_pl_hash pl_hash; / pointer to hash payload */
65c25746	153
52b7d2ce A	154	time_t created; /* timestamp for establish */
	155	#ifdef ENABLE_STATS
	156	struct timeval start;
	157	struct timeval end;
	158	#endif
65c25746	159
d1e348cf	160	#ifdef ENABLE_DPD
52b7d2ce A	161	int dpd_support; /* Does remote supports DPD ? */
	162	time_t dpd_lastack; /* Last ack received */
	163	u_int16_t dpd_seq; /* DPD seq number to receive */
	164	u_int8_t dpd_fails; /* number of failures */
65c25746 A	165	u_int8_t peer_sent_ike;
65c25746 A	166	schedule_ref dpd_r_u;
d1e348cf	167	#endif
65c25746	168
d1e348cf	169	#ifdef ENABLE_VPNCONTROL_PORT
65c25746	170	schedule_ref ping_sched; /* for sending pings to keep FW open */
d1e348cf A	171	#endif
d1e348cf A	172
52b7d2ce A	173	u_int32_t msgid2; /* msgid counter for Phase 2 */
52b7d2ce A	174	int ph2cnt; /* the number which is negotiated by this phase 1 */
52b7d2ce A	175	#ifdef ENABLE_HYBRID
52b7d2ce A	176	struct isakmp_cfg_state mode_cfg; / ISAKMP mode config state */
d1e348cf A	177	u_int8_t pended_xauth_id; /* saved id for reply from vpn control socket */
d1e348cf A	178	u_int8_t xauth_awaiting_userinput; /* indicates we are waiting for user input */
65c25746	179	vchar_t xauth_awaiting_userinput_msg; / tracks the last packet that triggered XAUTH */
d1e348cf	180	#endif
65c25746 A	181	int is_rekey:1;
	182	int is_dying:1;
	183	ike_session_t *parent_session;
	184	LIST_HEAD(_ph2ofph1_, phase2handle) bound_ph2tree;
	185	LIST_ENTRY(phase1handle) ph1ofsession_chain;
52b7d2ce A	186	};
52b7d2ce A	187
65c25746 A	188	#define PHASE2_TYPE_SA 0
	189	#define PHASE2_TYPE_INFO 1
	190	#define PHASE2_TYPE_CFG 2
	191
	192	//=======================================================================
	193	// PHASE 2
	194	//=======================================================================
	195	struct phase2handle {
85f41bec A	196	struct sockaddr_storage src; / my address of SA. */
85f41bec A	197	struct sockaddr_storage dst; / peer's address of SA. */
65c25746 A	198
	199	/*
	200	* copy ip address from ID payloads when ID type is ip address.
	201	* In other case, they must be null.
	202	*/
85f41bec A	203	struct sockaddr_storage *src_id;
85f41bec A	204	struct sockaddr_storage *dst_id;
65c25746 A	205
65c25746 A	206	int phase2_type; /* what this phase2 struct is for - see defines for PHASE2_TYPE... */
52b7d2ce	207	u_int32_t spid; /* policy id by kernel */
65c25746 A	208
65c25746 A	209	int status; /* ipsec sa status */
52b7d2ce	210	u_int8_t side; /* INITIATOR or RESPONDER */
65c25746 A	211	u_int8_t version; /* ISAKMP version */
	212
	213	schedule_ref sce; /* schedule for expire */
	214	schedule_ref scr; /* schedule for resend */
52b7d2ce A	215	int retry_counter; /* for resend. */
	216	vchar_t sendbuf; / buffer for re-sending */
	217	vchar_t msg1; / buffer for re-sending */
65c25746 A	218	/* used for responder's first message */
65c25746 A	219
52b7d2ce	220	int retry_checkph1; /* counter to wait phase 1 finished. */
65c25746 A	221	/* NOTE: actually it's timer. */
65c25746 A	222
52b7d2ce	223	u_int32_t seq; /* sequence number used by PF_KEY */
65c25746 A	224	/*
	225	* NOTE: In responder side, we can't identify each SAs
	226	* with same destination address for example, when
	227	* socket based SA is required. So we set a identifier
	228	* number to "seq", and sent kernel by pfkey.
	229	*/
52b7d2ce	230	u_int8_t satype; /* satype in PF_KEY */
65c25746 A	231	/*
	232	* saved satype in the original PF_KEY request from
	233	* the kernel in order to reply a error.
	234	*/
	235
52b7d2ce A	236	u_int8_t flags; /* Flags for phase 2 */
52b7d2ce A	237	u_int32_t msgid; /* msgid for phase 2 */
65c25746	238
52b7d2ce A	239	struct sainfo sainfo; / place holder of sainfo */
	240	struct saprop proposal; / SA(s) proposal. */
	241	struct saprop approval; / SA(s) approved. */
85f41bec	242	struct policyindex * spidx_gen; /* policy from peer's proposal */
65c25746	243
e8d9021d A	244	#ifndef HAVE_OPENSSL
	245	SecDHContext dhC; /* Context for Security Framework Diffie-Hellman calculations */
	246	size_t publicKeySize;
	247	#endif
52b7d2ce A	248	struct dhgroup pfsgrp; / DH; prime number */
	249	vchar_t dhpriv; / DH; private value */
	250	vchar_t dhpub; / DH; public value */
	251	vchar_t dhpub_p; / DH; partner's public value */
	252	vchar_t dhgxy; / DH; shared secret */
	253	vchar_t id; / ID minus gen header */
	254	vchar_t id_p; / peer's ID minus general header */
	255	vchar_t nonce; / nonce value in phase 2 */
	256	vchar_t nonce_p; / partner's nonce value in phase 2 */
65c25746	257
52b7d2ce	258	vchar_t sa; / whole SA payload to send/to be sent*/
65c25746 A	259	/* to calculate HASH */
	260	/* NOT INCLUDING general header. */
	261
52b7d2ce	262	vchar_t sa_ret; / SA payload to reply/to be replyed */
65c25746 A	263	/* NOT INCLUDING general header. */
	264	/* NOTE: Should be release after use. */
	265
52b7d2ce	266	struct isakmp_ivm ivm; / IVs */
65c25746	267
52b7d2ce	268	int generated_spidx; /* mark handlers whith generated policy */
65c25746	269
52b7d2ce A	270	#ifdef ENABLE_STATS
	271	struct timeval start;
	272	struct timeval end;
	273	#endif
65c25746	274	struct phase1handle ph1; / back pointer to isakmp status */
d1e348cf A	275	int is_rekey:1;
d1e348cf A	276	int is_dying:1;
d9c572c0	277	int is_defunct:1;
d1e348cf	278	ike_session_t *parent_session;
47612122 A	279	vchar_t *ext_nat_id;
47612122 A	280	vchar_t *ext_nat_id_p;
65c25746 A	281	LIST_ENTRY(phase2handle) ph2ofsession_chain;
65c25746 A	282	LIST_ENTRY(phase2handle) ph1bind_chain; /* chain to ph1handle */
52b7d2ce A	283	};
	284
	285	/*
	286	* for handling initial contact.
	287	*/
	288	struct contacted {
85f41bec	289	struct sockaddr_storage remote; / remote address to negotiate ph1 */
52b7d2ce A	290	LIST_ENTRY(contacted) chain;
	291	};
	292
	293	/*
	294	* for checking if a packet is retransmited.
	295	*/
	296	struct recvdpkt {
85f41bec A	297	struct sockaddr_storage remote; / the remote address */
85f41bec A	298	struct sockaddr_storage local; / the local address */
52b7d2ce A	299	vchar_t hash; / hash of the received packet */
	300	vchar_t sendbuf; / buffer for the response */
	301	int retry_counter; /* how many times to send */
	302	time_t time_send; /* timestamp to send a packet */
	303	time_t created; /* timestamp to create a queue */
e8d9021d A	304	time_t retry_interval;
	305	#ifdef ENABLE_FRAG
	306	u_int32_t frag_flags; /* IKE phase 1 fragmentation */
	307	#endif
52b7d2ce	308
65c25746	309	schedule_ref scr; /* schedule for resend, may not used */
52b7d2ce A	310
	311	LIST_ENTRY(recvdpkt) chain;
	312	};
	313
	314	/* for parsing ISAKMP header. */
	315	struct isakmp_parse_t {
	316	u_char type; /* payload type of mine */
	317	int len; /* ntohs(ptr->len) */
	318	struct isakmp_gen *ptr;
	319	};
	320
	321	/*
	322	* for IV management.
	323	*
	324	* - normal case
	325	* initiator responder
	326	* ------------------------- --------------------------
	327	* initialize iv(A), ive(A). initialize iv(A), ive(A).
	328	* encode by ive(A).
	329	* save to iv(B). ---[packet(B)]--> save to ive(B).
	330	* decode by iv(A).
	331	* packet consistency.
	332	* sync iv(B) with ive(B).
	333	* check auth, integrity.
	334	* encode by ive(B).
	335	* save to ive(C). <--[packet(C)]--- save to iv(C).
	336	* decoded by iv(B).
	337	* :
	338	*
	339	* - In the case that a error is found while cipher processing,
	340	* initiator responder
	341	* ------------------------- --------------------------
	342	* initialize iv(A), ive(A). initialize iv(A), ive(A).
	343	* encode by ive(A).
	344	* save to iv(B). ---[packet(B)]--> save to ive(B).
	345	* decode by iv(A).
	346	* packet consistency.
	347	* sync iv(B) with ive(B).
	348	* check auth, integrity.
	349	* error found.
	350	* create notify.
	351	* get ive2(X) from iv(B).
	352	* encode by ive2(X).
	353	* get iv2(X) from iv(B). <--[packet(Y)]--- save to iv2(Y).
	354	* save to ive2(Y).
	355	* decoded by iv2(X).
	356	* :
	357	*
	358	* The reason why the responder synchronizes iv with ive after checking the
	359	* packet consistency is that it is required to leave the IV for decoding
	360	* packet. Because there is a potential of error while checking the packet
	361	* consistency. Also the reason why that is before authentication and
	362	* integirty check is that the IV for informational exchange has to be made
	363	* by the IV which is after packet decoded and checking the packet consistency.
	364	* Otherwise IV mismatched happens between the intitiator and the responder.
	365	*/
	366	struct isakmp_ivm {
	367	vchar_t iv; / for decoding packet */
	368	/* if phase 1, it's for computing phase2 iv */
	369	vchar_t ive; / for encoding packet */
	370	};
	371
	372	/* for dumping */
	373	struct ph1dump {
374	isakmp_index index;
375	int status;
376	int side;
377	struct sockaddr_storage remote;
378	struct sockaddr_storage local;
379	u_int8_t version;
380	u_int8_t etype;
381	time_t created;
382	int ph2cnt;
383	};
384
85f41bec	385	struct sockaddr_storage;
52b7d2ce A	386	struct policyindex;
52b7d2ce A	387
65c25746 A	388	extern int ike_session_check_recvdpkt (struct sockaddr_storage , struct sockaddr_storage , vchar_t *);
	389
	390	extern void ike_session_flush_all_phase1_for_session(ike_session_t *, int);
	391	extern void ike_session_flush_all_phase1 (int);
	392
	393	extern phase1_handle_t ike_session_getph1byindex (ike_session_t , isakmp_index *);
	394	extern phase1_handle_t ike_session_getph1byindex0 (ike_session_t , isakmp_index *);
	395	extern phase1_handle_t ike_session_getph1byaddr (ike_session_t , struct sockaddr_storage *,
	396	struct sockaddr_storage *);
	397	extern phase1_handle_t ike_session_getph1byaddrwop (ike_session_t , struct sockaddr_storage *,
	398	struct sockaddr_storage *);
	399	extern phase1_handle_t ike_session_getph1bydstaddrwop (ike_session_t , struct sockaddr_storage *);
	400	extern int ike_session_islast_ph1 (phase1_handle_t *);
	401
	402	extern int ike_session_expire_session(ike_session_t *session);
	403	extern int ike_session_purgephXbydstaddrwop (struct sockaddr_storage *);
	404	extern void ike_session_purgephXbyspid (u_int32_t, int);
	405
	406	extern phase1_handle_t *ike_session_newph1 (unsigned int);
	407	extern void ike_session_delph1 (phase1_handle_t *);
	408
	409	extern phase2_handle_t ike_session_getph2byspidx (ike_session_t , struct policyindex *);
	410	extern phase2_handle_t *ike_session_getph2byspid (u_int32_t);
	411	extern phase2_handle_t *ike_session_getph2byseq (u_int32_t);
	412	//extern phase2_handle_t ike_session_getph2bysaddr (struct sockaddr_storage , struct sockaddr_storage *);
	413	extern phase2_handle_t ike_session_getph2bymsgid (phase1_handle_t , u_int32_t);
	414	extern phase2_handle_t ike_session_getonlyph2(phase1_handle_t iph1);
	415	extern phase2_handle_t ike_session_getph2byid (struct sockaddr_storage , struct sockaddr_storage *, u_int32_t);
	416	extern phase2_handle_t ike_session_getph2bysaidx (struct sockaddr_storage , struct sockaddr_storage *, u_int, u_int32_t);
	417	extern phase2_handle_t ike_session_getph2bysaidx2(struct sockaddr_storage src, struct sockaddr_storage dst, u_int proto_id, u_int32_t spi, u_int32_t opposite_spi);
	418	extern phase2_handle_t *ike_session_newph2 (unsigned int, int);
	419	extern void ike_session_initph2 (phase2_handle_t *);
	420	extern void ike_session_delph2 (phase2_handle_t *);
	421	extern void ike_session_flush_all_phase2_for_session(ike_session_t *, int);
	422	extern void ike_session_flush_all_phase2 (int);
	423	extern void ike_session_deleteallph2 (struct sockaddr_storage , struct sockaddr_storage , u_int);
	424	extern void ike_session_deleteallph1 (struct sockaddr_storage , struct sockaddr_storage );
	425
	426	#ifdef ENABLE_DPD
	427	extern int ike_session_ph1_force_dpd (struct sockaddr_storage *);
d1e348cf	428	#endif
65c25746 A	429
	430	//%%%%%%%%%%% don't know where the following will go yet - all these below could change
	431	extern struct contacted ike_session_getcontacted (struct sockaddr_storage );
	432	extern int ike_session_inscontacted (struct sockaddr_storage *);
	433	extern void ike_session_clear_contacted (void);
	434	extern void ike_session_initctdtree (void);
	435
	436	extern time_t ike_session_get_exp_retx_interval (int num_retries, int fixed_retry_interval);
	437
	438	extern int ike_session_add_recvdpkt (struct sockaddr_storage , struct sockaddr_storage ,
	439	vchar_t , vchar_t , size_t, u_int32_t);
	440	extern void ike_session_clear_recvdpkt (void);
	441	extern void ike_session_init_recvdpkt (void);
52b7d2ce A	442
52b7d2ce A	443	#ifdef ENABLE_HYBRID
65c25746	444	//extern int ike_session_exclude_cfg_addr (const struct sockaddr_storage *);
52b7d2ce A	445	#endif
52b7d2ce A	446
65c25746	447	extern void sweep_sleepwake (void);
d1e348cf	448
52b7d2ce	449	#endif /* _HANDLER_H */