]> git.saurik.com Git - apple/ipsec.git/blob - ipsec-tools/racoon/handler.h
projects / apple / ipsec.git / blob
? search:


50cebd03a162b614f1cc5691036e4570fed8517e
[apple/ipsec.git] / ipsec-tools / racoon / handler.h
1 /* $NetBSD: handler.h,v 1.9 2006/09/09 16:22:09 manu Exp $ */
2
3 /* Id: handler.h,v 1.19 2006/02/25 08:25:12 manubsd Exp */
4
5 /*
6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the project nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34 #ifndef _HANDLER_H
35 #define _HANDLER_H
36
37 #include "config.h"
38
39 #include <sys/queue.h>
40 #ifdef HAVE_OPENSSL
41 #include <openssl/rsa.h>
42 #endif
43
44 #include <sys/time.h>
45
46 #include "isakmp_var.h"
47 #include "oakley.h"
48 #ifndef HAVE_OPENSSL
49 #include <Security/SecDH.h>
50 #endif
51
52 typedef struct ike_session ike_session_t;
53
54 /* Phase 1 handler */
55 /*
56 * main mode:
57 * initiator responder
58 * 0 (---) (---)
59 * 1 start start (1st msg received)
60 * 2 (---) 1st valid msg received
61 * 3 1st msg sent 1st msg sent
62 * 4 1st valid msg received 2st valid msg received
63 * 5 2nd msg sent 2nd msg sent
64 * 6 2nd valid msg received 3rd valid msg received
65 * 7 3rd msg sent 3rd msg sent
66 * 8 3rd valid msg received (---)
67 * 9 SA established SA established
68 *
69 * aggressive mode:
70 * initiator responder
71 * 0 (---) (---)
72 * 1 start start (1st msg received)
73 * 2 (---) 1st valid msg received
74 * 3 1st msg sent 1st msg sent
75 * 4 1st valid msg received 2st valid msg received
76 * 5 (---) (---)
77 * 6 (---) (---)
78 * 7 (---) (---)
79 * 8 (---) (---)
80 * 9 SA established SA established
81 *
82 * base mode:
83 * initiator responder
84 * 0 (---) (---)
85 * 1 start start (1st msg received)
86 * 2 (---) 1st valid msg received
87 * 3 1st msg sent 1st msg sent
88 * 4 1st valid msg received 2st valid msg received
89 * 5 2nd msg sent (---)
90 * 6 (---) (---)
91 * 7 (---) (---)
92 * 8 (---) (---)
93 * 9 SA established SA established
94 */
95 #define PHASE1ST_SPAWN 0
96 #define PHASE1ST_START 1
97 #define PHASE1ST_MSG1RECEIVED 2
98 #define PHASE1ST_MSG1SENT 3
99 #define PHASE1ST_MSG2RECEIVED 4
100 #define PHASE1ST_MSG2SENT 5
101 #define PHASE1ST_MSG3RECEIVED 6
102 #define PHASE1ST_MSG3SENT 7
103 #define PHASE1ST_MSG4RECEIVED 8
104 #define PHASE1ST_ESTABLISHED 9
105 #define PHASE1ST_EXPIRED 10
106 #define PHASE1ST_MAX 11
107
108 /* About address semantics in each case.
109 * initiator(addr=I) responder(addr=R)
110 * src dst src dst
111 * (local) (remote) (local) (remote)
112 * phase 1 handler I R R I
113 * phase 2 handler I R R I
114 * getspi msg R I I R
115 * acquire msg I R
116 * ID payload I R I R
117 */
118 #ifdef ENABLE_HYBRID
119 struct isakmp_cfg_state;
120 #endif
121 struct ph1handle {
122 isakmp_index index;
123
124 int status; /* status of this SA */
125 int side; /* INITIATOR or RESPONDER */
126 int started_by_api; /* connection started by VPNControl API */
127
128 struct sockaddr_storage *remote; /* remote address to negosiate ph1 */
129 struct sockaddr_storage *local; /* local address to negosiate ph1 */
130 /* XXX copy from rmconf due to anonymous configuration.
131 * If anonymous will be forbidden, we do delete them. */
132
133 struct remoteconf *rmconf; /* pointer to remote configuration */
134
135 struct isakmpsa *approval; /* pointer to SA(s) approved. */
136 vchar_t *authstr; /* place holder of string for auth. */
137 /* for example pre-shared key */
138
139 u_int8_t version; /* ISAKMP version */
140 u_int8_t etype; /* Exchange type actually for use */
141 u_int8_t flags; /* Flags */
142 u_int32_t msgid; /* message id */
143
144 #ifdef ENABLE_NATT
145 struct ph1natt_options *natt_options; /* Selected NAT-T IKE version */
146 u_int32_t natt_flags; /* NAT-T related flags */
147 #endif
148 #ifdef ENABLE_FRAG
149 int frag; /* IKE phase 1 fragmentation */
150 struct isakmp_frag_item *frag_chain; /* Received fragments */
151 #endif
152
153 struct sched *sce; /* schedule for expire */
154 struct sched *sce_rekey; /* schedule for rekey */
155
156 struct sched *scr; /* schedule for resend */
157 int retry_counter; /* for resend. */
158 vchar_t *sendbuf; /* buffer for re-sending */
159
160 #ifndef HAVE_OPENSSL
161 SecDHContext dhC; /* Context for Security Framework Diffie-Hellman calculations */
162 size_t publicKeySize;
163 #endif
164 vchar_t *dhpriv; /* DH; private value */
165 vchar_t *dhpub; /* DH; public value */
166 vchar_t *dhpub_p; /* DH; partner's public value */
167 vchar_t *dhgxy; /* DH; shared secret */
168 vchar_t *nonce; /* nonce value */
169 vchar_t *nonce_p; /* partner's nonce value */
170 vchar_t *skeyid; /* SKEYID */
171 vchar_t *skeyid_d; /* SKEYID_d */
172 vchar_t *skeyid_a; /* SKEYID_a, i.e. hash */
173 vchar_t *skeyid_e; /* SKEYID_e, i.e. encryption */
174 vchar_t *key; /* cipher key */
175 vchar_t *hash; /* HASH minus general header */
176 vchar_t *sig; /* SIG minus general header */
177 vchar_t *sig_p; /* peer's SIG minus general header */
178 cert_t *cert; /* CERT minus general header */
179 cert_t *cert_p; /* peer's CERT minus general header */
180 cert_t *crl_p; /* peer's CRL minus general header */
181 cert_t *cr_p; /* peer's CR not including general */
182 vchar_t *id; /* ID minus gen header */
183 vchar_t *id_p; /* partner's ID minus general header */
184 /* i.e. struct ipsecdoi_id_b*. */
185 struct isakmp_ivm *ivm; /* IVs */
186
187 vchar_t *sa; /* whole SA payload to send/to be sent*/
188 /* to calculate HASH */
189 /* NOT INCLUDING general header. */
190
191 vchar_t *sa_ret; /* SA payload to reply/to be replyed */
192 /* NOT INCLUDING general header. */
193 /* NOTE: Should be release after use. */
194
195 #ifdef HAVE_GSSAPI
196 void *gssapi_state; /* GSS-API specific state. */
197 /* Allocated when needed */
198 vchar_t *gi_i; /* optional initiator GSS id */
199 vchar_t *gi_r; /* optional responder GSS id */
200 #endif
201
202 struct isakmp_pl_hash *pl_hash; /* pointer to hash payload */
203
204 time_t created; /* timestamp for establish */
205 #ifdef ENABLE_STATS
206 struct timeval start;
207 struct timeval end;
208 #endif
209
210 #ifdef ENABLE_DPD
211 int dpd_support; /* Does remote supports DPD ? */
212 time_t dpd_lastack; /* Last ack received */
213 u_int16_t dpd_seq; /* DPD seq number to receive */
214 u_int8_t dpd_fails; /* number of failures */
215 u_int8_t peer_sent_ike;
216 struct sched *dpd_r_u;
217 #endif
218
219 #ifdef ENABLE_VPNCONTROL_PORT
220 struct sched *ping_sched; /* for sending pings to keep FW open */
221 #endif
222
223 u_int32_t msgid2; /* msgid counter for Phase 2 */
224 int ph2cnt; /* the number which is negotiated by this phase 1 */
225 LIST_HEAD(_ph2ofph1_, ph2handle) ph2tree;
226
227 LIST_ENTRY(ph1handle) chain;
228 #ifdef ENABLE_HYBRID
229 struct isakmp_cfg_state *mode_cfg; /* ISAKMP mode config state */
230 u_int8_t pended_xauth_id; /* saved id for reply from vpn control socket */
231 u_int8_t xauth_awaiting_userinput; /* indicates we are waiting for user input */
232 vchar_t *xauth_awaiting_userinput_msg; /* tracks the last packet that triggered XAUTH */
233 #endif
234 int is_rekey:1;
235 int is_dying:1;
236 ike_session_t *parent_session;
237 LIST_ENTRY(ph1handle) ph1ofsession_chain;
238 };
239
240 /* Phase 2 handler */
241 /* allocated per a SA or SA bundles of a pair of peer's IP addresses. */
242 /*
243 * initiator responder
244 * 0 (---) (---)
245 * 1 start start (1st msg received)
246 * 2 acquire msg get 1st valid msg received
247 * 3 getspi request sent getspi request sent
248 * 4 getspi done getspi done
249 * 5 1st msg sent 1st msg sent
250 * 6 1st valid msg received 2nd valid msg received
251 * 7 (commit bit) (commit bit)
252 * 8 SAs added SAs added
253 * 9 SAs established SAs established
254 * 10 SAs expired SAs expired
255 */
256 #define PHASE2ST_SPAWN 0
257 #define PHASE2ST_START 1
258 #define PHASE2ST_STATUS2 2
259 #define PHASE2ST_GETSPISENT 3
260 #define PHASE2ST_GETSPIDONE 4
261 #define PHASE2ST_MSG1SENT 5
262 #define PHASE2ST_STATUS6 6
263 #define PHASE2ST_COMMIT 7
264 #define PHASE2ST_ADDSA 8
265 #define PHASE2ST_ESTABLISHED 9
266 #define PHASE2ST_EXPIRED 10
267 #define PHASE2ST_MAX 11
268
269 struct ph2handle {
270 struct sockaddr_storage *src; /* my address of SA. */
271 struct sockaddr_storage *dst; /* peer's address of SA. */
272
273 /*
274 * copy ip address from ID payloads when ID type is ip address.
275 * In other case, they must be null.
276 */
277 struct sockaddr_storage *src_id;
278 struct sockaddr_storage *dst_id;
279
280 u_int32_t spid; /* policy id by kernel */
281
282 int status; /* ipsec sa status */
283 u_int8_t side; /* INITIATOR or RESPONDER */
284
285 struct sched *sce; /* schedule for expire */
286 struct sched *scr; /* schedule for resend */
287 int retry_counter; /* for resend. */
288 vchar_t *sendbuf; /* buffer for re-sending */
289 vchar_t *msg1; /* buffer for re-sending */
290 /* used for responder's first message */
291
292 int retry_checkph1; /* counter to wait phase 1 finished. */
293 /* NOTE: actually it's timer. */
294
295 u_int32_t seq; /* sequence number used by PF_KEY */
296 /*
297 * NOTE: In responder side, we can't identify each SAs
298 * with same destination address for example, when
299 * socket based SA is required. So we set a identifier
300 * number to "seq", and sent kernel by pfkey.
301 */
302 u_int8_t satype; /* satype in PF_KEY */
303 /*
304 * saved satype in the original PF_KEY request from
305 * the kernel in order to reply a error.
306 */
307
308 u_int8_t flags; /* Flags for phase 2 */
309 u_int32_t msgid; /* msgid for phase 2 */
310
311 struct sainfo *sainfo; /* place holder of sainfo */
312 struct saprop *proposal; /* SA(s) proposal. */
313 struct saprop *approval; /* SA(s) approved. */
314 struct policyindex * spidx_gen; /* policy from peer's proposal */
315
316 #ifndef HAVE_OPENSSL
317 SecDHContext dhC; /* Context for Security Framework Diffie-Hellman calculations */
318 size_t publicKeySize;
319 #endif
320 struct dhgroup *pfsgrp; /* DH; prime number */
321 vchar_t *dhpriv; /* DH; private value */
322 vchar_t *dhpub; /* DH; public value */
323 vchar_t *dhpub_p; /* DH; partner's public value */
324 vchar_t *dhgxy; /* DH; shared secret */
325 vchar_t *id; /* ID minus gen header */
326 vchar_t *id_p; /* peer's ID minus general header */
327 vchar_t *nonce; /* nonce value in phase 2 */
328 vchar_t *nonce_p; /* partner's nonce value in phase 2 */
329
330 vchar_t *sa; /* whole SA payload to send/to be sent*/
331 /* to calculate HASH */
332 /* NOT INCLUDING general header. */
333
334 vchar_t *sa_ret; /* SA payload to reply/to be replyed */
335 /* NOT INCLUDING general header. */
336 /* NOTE: Should be release after use. */
337
338 struct isakmp_ivm *ivm; /* IVs */
339
340 int generated_spidx; /* mark handlers whith generated policy */
341
342 #ifdef ENABLE_STATS
343 struct timeval start;
344 struct timeval end;
345 #endif
346 struct ph1handle *ph1; /* back pointer to isakmp status */
347 int is_rekey:1;
348 int is_dying:1;
349 ike_session_t *parent_session;
350 LIST_ENTRY(ph2handle) ph2ofsession_chain;
351 vchar_t *ext_nat_id;
352 vchar_t *ext_nat_id_p;
353
354 LIST_ENTRY(ph2handle) chain;
355 LIST_ENTRY(ph2handle) ph1bind; /* chain to ph1handle */
356 };
357
358 /*
359 * for handling initial contact.
360 */
361 struct contacted {
362 struct sockaddr_storage *remote; /* remote address to negotiate ph1 */
363 LIST_ENTRY(contacted) chain;
364 };
365
366 /*
367 * for checking if a packet is retransmited.
368 */
369 struct recvdpkt {
370 struct sockaddr_storage *remote; /* the remote address */
371 struct sockaddr_storage *local; /* the local address */
372 vchar_t *hash; /* hash of the received packet */
373 vchar_t *sendbuf; /* buffer for the response */
374 int retry_counter; /* how many times to send */
375 time_t time_send; /* timestamp to send a packet */
376 time_t created; /* timestamp to create a queue */
377 time_t retry_interval;
378 #ifdef ENABLE_FRAG
379 u_int32_t frag_flags; /* IKE phase 1 fragmentation */
380 #endif
381
382 struct sched *scr; /* schedule for resend, may not used */
383
384 LIST_ENTRY(recvdpkt) chain;
385 };
386
387 /* for parsing ISAKMP header. */
388 struct isakmp_parse_t {
389 u_char type; /* payload type of mine */
390 int len; /* ntohs(ptr->len) */
391 struct isakmp_gen *ptr;
392 };
393
394 /*
395 * for IV management.
396 *
397 * - normal case
398 * initiator responder
399 * ------------------------- --------------------------
400 * initialize iv(A), ive(A). initialize iv(A), ive(A).
401 * encode by ive(A).
402 * save to iv(B). ---[packet(B)]--> save to ive(B).
403 * decode by iv(A).
404 * packet consistency.
405 * sync iv(B) with ive(B).
406 * check auth, integrity.
407 * encode by ive(B).
408 * save to ive(C). <--[packet(C)]--- save to iv(C).
409 * decoded by iv(B).
410 * :
411 *
412 * - In the case that a error is found while cipher processing,
413 * initiator responder
414 * ------------------------- --------------------------
415 * initialize iv(A), ive(A). initialize iv(A), ive(A).
416 * encode by ive(A).
417 * save to iv(B). ---[packet(B)]--> save to ive(B).
418 * decode by iv(A).
419 * packet consistency.
420 * sync iv(B) with ive(B).
421 * check auth, integrity.
422 * error found.
423 * create notify.
424 * get ive2(X) from iv(B).
425 * encode by ive2(X).
426 * get iv2(X) from iv(B). <--[packet(Y)]--- save to iv2(Y).
427 * save to ive2(Y).
428 * decoded by iv2(X).
429 * :
430 *
431 * The reason why the responder synchronizes iv with ive after checking the
432 * packet consistency is that it is required to leave the IV for decoding
433 * packet. Because there is a potential of error while checking the packet
434 * consistency. Also the reason why that is before authentication and
435 * integirty check is that the IV for informational exchange has to be made
436 * by the IV which is after packet decoded and checking the packet consistency.
437 * Otherwise IV mismatched happens between the intitiator and the responder.
438 */
439 struct isakmp_ivm {
440 vchar_t *iv; /* for decoding packet */
441 /* if phase 1, it's for computing phase2 iv */
442 vchar_t *ive; /* for encoding packet */
443 };
444
445 /* for dumping */
446 struct ph1dump {
447 isakmp_index index;
448 int status;
449 int side;
450 struct sockaddr_storage remote;
451 struct sockaddr_storage local;
452 u_int8_t version;
453 u_int8_t etype;
454 time_t created;
455 int ph2cnt;
456 };
457
458 struct sockaddr_storage;
459 struct ph1handle;
460 struct ph2handle;
461 struct policyindex;
462
463 extern struct ph1handle *getph1byindex __P((isakmp_index *));
464 extern struct ph1handle *getph1byindex0 __P((isakmp_index *));
465 extern struct ph1handle *getph1byaddr __P((struct sockaddr_storage *,
466 struct sockaddr_storage *));
467 extern struct ph1handle *getph1byaddrwop __P((struct sockaddr_storage *,
468 struct sockaddr_storage *));
469 extern struct ph1handle *getph1bydstaddrwop __P((struct sockaddr_storage *));
470 extern int islast_ph1 __P((struct ph1handle *));
471 struct ph1handle *ph1;
472 #ifdef ENABLE_HYBRID
473 struct ph1handle *getph1bylogin __P((char *));
474 int purgeph1bylogin __P((char *));
475 #endif
476 extern int purgephXbydstaddrwop __P((struct sockaddr_storage *));
477 extern void purgephXbyspid __P((u_int32_t, int));
478
479 extern vchar_t *dumpph1 __P((void));
480 extern struct ph1handle *newph1 __P((void));
481 extern void delph1 __P((struct ph1handle *));
482 extern int insph1 __P((struct ph1handle *));
483 extern void remph1 __P((struct ph1handle *));
484 extern void flushph1 __P((int));
485 extern void initph1tree __P((void));
486
487 extern struct ph2handle *getph2byspidx __P((struct policyindex *));
488 extern struct ph2handle *getph2byspid __P((u_int32_t));
489 extern struct ph2handle *getph2byseq __P((u_int32_t));
490 extern struct ph2handle *getph2bysaddr __P((struct sockaddr_storage *,
491 struct sockaddr_storage *));
492 extern struct ph2handle *getph2bymsgid __P((struct ph1handle *, u_int32_t));
493 extern struct ph2handle *getph2byid __P((struct sockaddr_storage *,
494 struct sockaddr_storage *, u_int32_t));
495 extern struct ph2handle *getph2bysaidx __P((struct sockaddr_storage *,
496 struct sockaddr_storage *, u_int, u_int32_t));
497 extern struct ph2handle *newph2 __P((void));
498 extern void initph2 __P((struct ph2handle *));
499 extern void delph2 __P((struct ph2handle *));
500 extern int insph2 __P((struct ph2handle *));
501 extern void remph2 __P((struct ph2handle *));
502 extern void flushph2 __P((int));
503 extern void deleteallph2 __P((struct sockaddr_storage *, struct sockaddr_storage *, u_int));
504 extern void deleteallph1 __P((struct sockaddr_storage *, struct sockaddr_storage *));
505 extern void initph2tree __P((void));
506
507 extern void bindph12 __P((struct ph1handle *, struct ph2handle *));
508 extern void unbindph12 __P((struct ph2handle *));
509 extern void rebindph12 __P((struct ph1handle *, struct ph2handle *));
510
511 extern struct contacted *getcontacted __P((struct sockaddr_storage *));
512 extern int inscontacted __P((struct sockaddr_storage *));
513 extern void clear_contacted __P((void));
514 extern void initctdtree __P((void));
515
516 extern time_t get_exp_retx_interval __P((int num_retries, int fixed_retry_interval));
517
518 extern int check_recvdpkt __P((struct sockaddr_storage *,
519 struct sockaddr_storage *, vchar_t *));
520 extern int add_recvdpkt __P((struct sockaddr_storage *, struct sockaddr_storage *,
521 vchar_t *, vchar_t *, size_t, u_int32_t));
522 extern void clear_recvdpkt __P((void));
523 extern void init_recvdpkt __P((void));
524
525 #ifdef ENABLE_HYBRID
526 extern int exclude_cfg_addr __P((const struct sockaddr_storage *));
527 #endif
528
529 #ifdef ENABLE_DPD
530 extern int ph1_force_dpd __P((struct sockaddr_storage *));
531 #endif
532 extern void sweep_sleepwake __P((void));
533
534 #endif /* _HANDLER_H */
mirror of ipsec