ipsec-tools/racoon/vpn_control.h

   1 /* $Id: vpn_control.h,v 1.10 2004/12/30 13:45:49 manubsd Exp $ */
   2
   3 /*
   4  * Copyright (c) 2006 Apple Computer, Inc. All rights reserved.
   5  *
   6  * @APPLE_LICENSE_HEADER_START@
   7  *
   8  * The contents of this file constitute Original Code as defined in and
   9  * are subject to the Apple Public Source License Version 1.1 (the
  10  * "License").  You may not use this file except in compliance with the
  11  * License.  Please obtain a copy of the License at
  12  * http://www.apple.com/publicsource and read it before using this file.
  13  *
  14  * This Original Code and all software distributed under the License are
  15  * distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  16  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  17  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT.  Please see the
  19  * License for the specific language governing rights and limitations
  20  * under the License.
  21  *
  22  * @APPLE_LICENSE_HEADER_END@
  23  */
  24
  25 /*
  26  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  27  * All rights reserved.
  28  *
  29  * Redistribution and use in source and binary forms, with or without
  30  * modification, are permitted provided that the following conditions
  31  * are met:
  32  * 1. Redistributions of source code must retain the above copyright
  33  *    notice, this list of conditions and the following disclaimer.
  34  * 2. Redistributions in binary form must reproduce the above copyright
  35  *    notice, this list of conditions and the following disclaimer in the
  36  *    documentation and/or other materials provided with the distribution.
  37  * 3. Neither the name of the project nor the names of its contributors
  38  *    may be used to endorse or promote products derived from this software
  39  *    without specific prior written permission.
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  */
  53
  54 #ifndef _VPN_CONTROL_H
  55 #define _VPN_CONTROL_H
  56
  57 #include "algorithm_types.h"
  58 #include <net/if.h>
  59
  60 #define VPNCONTROLSOCK_PATH ADMINPORTDIR "/vpncontrol.sock"
  61
  62 #define FROM_LOCAL      0
  63 #define FROM_REMOTE 1
  64
  65
  66 extern char *vpncontrolsock_path;
  67 extern uid_t vpncontrolsock_owner;
  68 extern gid_t vpncontrolsock_group;
  69 extern mode_t vpncontrolsock_mode;
  70
  71
  72 /*
  73  * message types
  74  */
  75 #define VPNCTL_CMD_BIND                                 0x0001
  76 #define VPNCTL_CMD_UNBIND                               0x0002
  77 #define VPNCTL_CMD_REDIRECT                             0x0003
  78 #define VPNCTL_CMD_PING                                 0x0004
  79 #define VPNCTL_CMD_CONNECT                              0x0011
  80 #define VPNCTL_CMD_DISCONNECT                   0x0012
  81 #define VPNCTL_CMD_START_PH2                    0x0013
  82 #define VPNCTL_CMD_XAUTH_INFO                   0x0014
  83 #define VPNCTL_CMD_START_DPD                    0x0015
  84 #define VPNCTL_CMD_ASSERT                               0x0016
  85 #define VPNCTL_CMD_RECONNECT                    0x0017
  86 #define VPNCTL_STATUS_IKE_FAILED                0x8001
  87 #define VPNCTL_STATUS_PH1_START_US              0x8011
  88 #define VPNCTL_STATUS_PH1_START_PEER    0x8012
  89 #define VPNCTL_STATUS_PH1_ESTABLISHED   0x8013
  90 #define VPNCTL_STATUS_PH2_START                 0x8021
  91 #define VPNCTL_STATUS_PH2_ESTABLISHED   0x8022
  92 #define VPNCTL_STATUS_NEED_AUTHINFO             0x8101
  93 #define VPNCTL_STATUS_NEED_REAUTHINFO   0x8102
  94 #define VPNCTL_STATUS_PEER_RESP         0x8103
  95
  96 /*
  97  * Flags
  98  */
  99 #define VPNCTL_FLAG_MODECFG_USED                0x0001
 100 #define VPNCTL_FLAG_IKE_VERSION                 0x0002
 101 #define VPNCTL_FLAG_IKEV2                               VPNCTL_FLAG_IKE_VERSION
 102
 103 /*
 104  * XAUTH Attribute Types
 105  */
 106 #ifndef __IPSEC_BUILD__
 107 #define XAUTH_TYPE                16520
 108 #define XAUTH_USER_NAME           16521
 109 #define XAUTH_USER_PASSWORD       16522
 110 #define XAUTH_PASSCODE            16523
 111 #define XAUTH_MESSAGE             16524
 112 #define XAUTH_CHALLENGE           16525
 113 #define XAUTH_DOMAIN              16526
 114 #define XAUTH_STATUS              16527
 115 #define XAUTH_NEXT_PIN            16528
 116 #define XAUTH_ANSWER              16529
 117
 118
 119 /* Types for XAUTH_TYPE */
 120 #define XAUTH_TYPE_GENERIC      0
 121 #define XAUTH_TYPE_CHAP         1
 122 #define XAUTH_TYPE_OTP          2
 123 #define XAUTH_TYPE_SKEY         3
 124
 125
 126 /* Mode cfg Attribute types */
 127 #define INTERNAL_IP4_ADDRESS        1
 128 #define INTERNAL_IP4_NETMASK        2
 129 #define INTERNAL_IP4_DNS            3
 130 #define INTERNAL_IP4_NBNS           4
 131 #define INTERNAL_ADDRESS_EXPIRY     5
 132 #define INTERNAL_IP4_DHCP           6
 133 #define APPLICATION_VERSION         7
 134 #define INTERNAL_IP6_ADDRESS        8
 135 #define INTERNAL_IP6_NETMASK        9
 136 #define INTERNAL_IP6_DNS           10
 137 #define INTERNAL_IP6_NBNS          11
 138 #define INTERNAL_IP6_DHCP          12
 139 #define INTERNAL_IP4_SUBNET        13
 140 #define SUPPORTED_ATTRIBUTES       14
 141 #define INTERNAL_IP6_SUBNET        15
 142
 143 #define UNITY_BANNER                    28672
 144 #define UNITY_SAVE_PASSWD               28673
 145 #define UNITY_DEF_DOMAIN                28674
 146 #define UNITY_SPLITDNS_NAME             28675
 147 #define UNITY_SPLIT_INCLUDE             28676
 148 #define UNITY_NATT_PORT                 28677
 149 #define UNITY_LOCAL_LAN                 28678
 150 #define UNITY_PFS                               28679
 151 #define UNITY_FW_TYPE                   28680
 152 #define UNITY_BACKUP_SERVERS    28681
 153 #define UNITY_DDNS_HOSTNAME             28682
 154
 155 /* 3.3 Data Attributes
 156          0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 157         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 158         !A!       Attribute Type        !    AF=0  Attribute Length     !
 159         !F!                             !    AF=1  Attribute Value      !
 160         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 161         .                   AF=0  Attribute Value                       .
 162         .                   AF=1  Not Transmitted                       .
 163         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 164 */
 165 struct isakmp_data {
 166         u_int16_t type;         /* defined by DOI-spec, and Attribute Format */
 167         u_int16_t lorv;         /* if f equal 1, Attribute Length */
 168         /* if f equal 0, Attribute Value */
 169         /* if f equal 1, Attribute Value */
 170 };
 171 #endif
 172
 173 /* commands and status for vpn control. */
 174 /* network byte order. */
 175
 176 /* Packet header */
 177 struct vpnctl_hdr {
 178         u_int16_t                       msg_type;
 179         u_int16_t                       flags;
 180         u_int32_t                       cookie;
 181         u_int32_t                       reserved;
 182         u_int16_t                       result;
 183         u_int16_t                       len;                    /* payload length */
 184 };
 185
 186 /* Packet formats for commands */
 187
 188 /* bind to receive status for specified address */
 189 struct vpnctl_cmd_bind {
 190         struct vpnctl_hdr               hdr;
 191         u_int32_t                               address;        /* 0xFFFFFFFF = all */
 192         u_int16_t                               vers_len;       /* if zero - no version provided */
 193         /* name/version string of length vers_len */
 194 };
 195
 196 /* unbind to stop receiving status for specified address */
 197 struct vpnctl_cmd_unbind {
 198         struct vpnctl_hdr               hdr;
 199         u_int32_t                               address;        /* 0xFFFFFFFF = all */
 200 };
 201
 202
 203 /* connect to specified address */
 204 struct vpnctl_cmd_connect{
 205         struct vpnctl_hdr               hdr;
 206         u_int32_t                               address;
 207 };
 208
 209 struct vpnctl_sa_selector {
 210         u_int32_t               src_tunnel_address;
 211         u_int32_t               src_tunnel_mask;
 212         u_int32_t               dst_tunnel_address;
 213         u_int32_t               dst_tunnel_mask;
 214         u_int16_t               src_tunnel_port;
 215         u_int16_t               dst_tunnel_port;
 216         u_int16_t               ul_protocol;
 217         u_int16_t               reserved;
 218 };
 219
 220 struct vpnctl_algo {
 221         u_int16_t       algo_class;
 222         u_int16_t       algo;
 223         u_int16_t       key_len;        /* for enc algorithms only */
 224         u_int16_t       reserved;
 225 };
 226
 227 /* start phase 2 */
 228 struct vpnctl_cmd_start_ph2 {
 229         struct vpnctl_hdr               hdr;
 230         u_int32_t                               address;
 231         u_int32_t                               lifetime;  /* seconds */
 232         u_int16_t                               pfs_group;      /* defined in algorithm_types.h */
 233         u_int16_t                               selector_count;
 234         u_int16_t                               algo_count;
 235         u_int16_t                               reserved;
 236         /* array of struct vpnctl_sa_selector */
 237         /* array of struct vpnctl_algo */
 238 };
 239
 240 /* assert connection (after network change) */
 241 struct vpnctl_cmd_assert {
 242         struct vpnctl_hdr               hdr;
 243         u_int32_t                               src_address;
 244         u_int32_t                               dst_address;
 245 };
 246
 247 /* set xauth info */
 248 struct vpnctl_cmd_xauth_info {
 249         struct vpnctl_hdr               hdr;
 250         u_int32_t                               address;
 251         /* packed array of variable sized struct isakmp_data */
 252 };
 253
 254 /* redirect client to specified address */
 255 struct vpnctl_cmd_redirect {
 256         struct vpnctl_hdr               hdr;
 257         u_int32_t                               address;
 258         u_int32_t                               redirect_address;
 259         u_int16_t                               force;
 260 };
 261
 262 /* start dpd */
 263 struct vpnctl_cmd_start_dpd {
 264         struct vpnctl_hdr               hdr;
 265         u_int32_t               address;
 266 };
 267
 268 /*
 269  * IKE Notify codes - mirrors codes in isakmp.h
 270  */
 271 #define VPNCTL_NTYPE_INVALID_PAYLOAD_TYPE               1
 272 #define VPNCTL_NTYPE_DOI_NOT_SUPPORTED                  2
 273 #define VPNCTL_NTYPE_SITUATION_NOT_SUPPORTED    3
 274 #define VPNCTL_NTYPE_INVALID_COOKIE                             4
 275 #define VPNCTL_NTYPE_INVALID_MAJOR_VERSION              5
 276 #define VPNCTL_NTYPE_INVALID_MINOR_VERSION              6
 277 #define VPNCTL_NTYPE_INVALID_EXCHANGE_TYPE              7
 278 #define VPNCTL_NTYPE_INVALID_FLAGS                              8
 279 #define VPNCTL_NTYPE_INVALID_MESSAGE_ID                 9
 280 #define VPNCTL_NTYPE_INVALID_PROTOCOL_ID                10
 281 #define VPNCTL_NTYPE_INVALID_SPI                                11
 282 #define VPNCTL_NTYPE_INVALID_TRANSFORM_ID               12
 283 #define VPNCTL_NTYPE_ATTRIBUTES_NOT_SUPPORTED   13
 284 #define VPNCTL_NTYPE_NO_PROPOSAL_CHOSEN                 14
 285 #define VPNCTL_NTYPE_BAD_PROPOSAL_SYNTAX                15
 286 #define VPNCTL_NTYPE_PAYLOAD_MALFORMED                  16
 287 #define VPNCTL_NTYPE_INVALID_KEY_INFORMATION    17
 288 #define VPNCTL_NTYPE_INVALID_ID_INFORMATION             18
 289 #define VPNCTL_NTYPE_INVALID_CERT_ENCODING              19
 290 #define VPNCTL_NTYPE_INVALID_CERTIFICATE                20
 291 #define VPNCTL_NTYPE_BAD_CERT_REQUEST_SYNTAX    21
 292 #define VPNCTL_NTYPE_INVALID_CERT_AUTHORITY             22
 293 #define VPNCTL_NTYPE_INVALID_HASH_INFORMATION   23
 294 #define VPNCTL_NTYPE_AUTHENTICATION_FAILED              24
 295 #define VPNCTL_NTYPE_INVALID_SIGNATURE                  25
 296 #define VPNCTL_NTYPE_ADDRESS_NOTIFICATION               26
 297 #define VPNCTL_NTYPE_NOTIFY_SA_LIFETIME                 27
 298 #define VPNCTL_NTYPE_CERTIFICATE_UNAVAILABLE    28
 299 #define VPNCTL_NTYPE_UNSUPPORTED_EXCHANGE_TYPE  29
 300 #define VPNCTL_NTYPE_UNEQUAL_PAYLOAD_LENGTHS    30
 301 #define VPNCTL_NTYPE_LOAD_BALANCE                               40501
 302 #define VPNCTL_NTYPE_PEER_DEAD                                  50001   /* detected by DPD */
 303 #define VPNCTL_NTYPE_PH1_DELETE                                 50002   /* received a delete payload leaving no PH1 SA for the remote address */
 304 #define VPNCTL_NTYPE_IDLE_TIMEOUT                               50003
 305 #define VPNCTL_NTYPE_LOCAL_CERT_PREMATURE               50004   /* certificate is premature */
 306 #define VPNCTL_NTYPE_LOCAL_CERT_EXPIRED                 50005   /* certificate has expired */
 307 #define VPNCTL_NTYPE_PEER_CERT_PREMATURE                50006   /* peer's certificate is premature */
 308 #define VPNCTL_NTYPE_PEER_CERT_EXPIRED                  50007   /* peer's certificate has expired */
 309 #define VPNCTL_NTYPE_PEER_CERT_INVALID_SUBJNAME         50008   /* peer's certificate has an invalid subjname */
 310 #define VPNCTL_NTYPE_PEER_CERT_INVALID_SUBJALTNAME      50009   /* peer's certificate has an invalid subjaltname */
 311 #define VPNCTL_NTYPE_INTERNAL_ERROR                             -1
 312
 313
 314 /* packet format for phase change status */
 315 struct vpnctl_status_phase_change {
 316         struct vpnctl_hdr                       hdr;
 317         u_int32_t                                       address;
 318         /* The following is included when VPNCTL_FLAG_MODECFG_USED flag set */
 319         // struct vpnctl_modecfg_params mode_cfg;
 320
 321 };
 322
 323
 324 /* packet format for auth needed status */
 325 struct vpnctl_status_need_authinfo {
 326         struct vpnctl_hdr                       hdr;
 327         u_int32_t                                       address;
 328         /* packed array of variable sized struct isakmp_data */
 329 };
 330
 331
 332 struct split_address {
 333         u_int32_t       splitaddr;
 334         u_int32_t       splitmask;
 335 };
 336
 337 struct vpnctl_modecfg_params {
 338         u_int32_t                                       outer_local_addr;
 339         u_int16_t                                       outer_remote_port;
 340         u_int16_t                                       outer_local_port;
 341         u_int8_t                                        ifname[IFNAMSIZ];
 342         /*
 343          *      ifname for outer_local_addr (not null terminated)
 344          *      followed by packed array of attributes (struct isakmp_data)
 345          */
 346 };
 347
 348
 349 /* Packet formats for failed status */
 350 struct vpnctl_status_failed {
 351         struct vpnctl_hdr                       hdr;
 352         u_int32_t                                       address;
 353         u_int16_t                                       ike_code;
 354         u_int16_t                                       from;
 355         u_int8_t                                        data[0];
 356 };
 357
 358 struct vpnctl_status_peer_resp {
 359         struct vpnctl_hdr                       hdr;
 360         u_int32_t                                       address;
 361         u_int16_t                                       ike_code;
 362 };
 363
 364 #endif /* _VPN_CONTROL_H */