ipsec-tools/racoon/vpn_control.h

   1 /* $Id: vpn_control.h,v 1.10 2004/12/30 13:45:49 manubsd Exp $ */
   2
   3 /*
   4  * Copyright (c) 2006 Apple Computer, Inc. All rights reserved.
   5  *
   6  * @APPLE_LICENSE_HEADER_START@
   7  *
   8  * The contents of this file constitute Original Code as defined in and
   9  * are subject to the Apple Public Source License Version 1.1 (the
  10  * "License").  You may not use this file except in compliance with the
  11  * License.  Please obtain a copy of the License at
  12  * http://www.apple.com/publicsource and read it before using this file.
  13  *
  14  * This Original Code and all software distributed under the License are
  15  * distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  16  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  17  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT.  Please see the
  19  * License for the specific language governing rights and limitations
  20  * under the License.
  21  *
  22  * @APPLE_LICENSE_HEADER_END@
  23  */
  24
  25 /*
  26  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  27  * All rights reserved.
  28  *
  29  * Redistribution and use in source and binary forms, with or without
  30  * modification, are permitted provided that the following conditions
  31  * are met:
  32  * 1. Redistributions of source code must retain the above copyright
  33  *    notice, this list of conditions and the following disclaimer.
  34  * 2. Redistributions in binary form must reproduce the above copyright
  35  *    notice, this list of conditions and the following disclaimer in the
  36  *    documentation and/or other materials provided with the distribution.
  37  * 3. Neither the name of the project nor the names of its contributors
  38  *    may be used to endorse or promote products derived from this software
  39  *    without specific prior written permission.
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  */
  53
  54 #ifndef _VPN_CONTROL_H
  55 #define _VPN_CONTROL_H
  56
  57 #include "algorithm_types.h"
  58 #include <net/if.h>
  59 #include <network/nat64.h>
  60
  61 #define VPNCONTROLSOCK_PATH ADMINPORTDIR "/vpncontrol.sock"
  62
  63 #define FROM_LOCAL      0
  64 #define FROM_REMOTE 1
  65
  66
  67 extern char *vpncontrolsock_path;
  68 extern uid_t vpncontrolsock_owner;
  69 extern gid_t vpncontrolsock_group;
  70 extern mode_t vpncontrolsock_mode;
  71
  72
  73 /*
  74  * message types
  75  */
  76 #define VPNCTL_CMD_BIND                                 0x0001
  77 #define VPNCTL_CMD_UNBIND                               0x0002
  78 #define VPNCTL_CMD_REDIRECT                             0x0003
  79 #define VPNCTL_CMD_PING                                 0x0004
  80 #define VPNCTL_CMD_CONNECT                              0x0011
  81 #define VPNCTL_CMD_DISCONNECT                   0x0012
  82 #define VPNCTL_CMD_START_PH2                    0x0013
  83 #define VPNCTL_CMD_XAUTH_INFO                   0x0014
  84 #define VPNCTL_CMD_START_DPD                    0x0015
  85 #define VPNCTL_CMD_ASSERT                               0x0016
  86 #define VPNCTL_CMD_RECONNECT                    0x0017
  87 #define VPNCTL_CMD_SET_NAT64_PREFIX             0x0018
  88 #define VPNCTL_STATUS_IKE_FAILED                0x8001
  89 #define VPNCTL_STATUS_PH1_START_US              0x8011
  90 #define VPNCTL_STATUS_PH1_START_PEER    0x8012
  91 #define VPNCTL_STATUS_PH1_ESTABLISHED   0x8013
  92 #define VPNCTL_STATUS_PH2_START                 0x8021
  93 #define VPNCTL_STATUS_PH2_ESTABLISHED   0x8022
  94 #define VPNCTL_STATUS_NEED_AUTHINFO             0x8101
  95 #define VPNCTL_STATUS_NEED_REAUTHINFO   0x8102
  96 #define VPNCTL_STATUS_PEER_RESP         0x8103
  97
  98 /*
  99  * Flags
 100  */
 101 #define VPNCTL_FLAG_MODECFG_USED                0x0001
 102 #define VPNCTL_FLAG_IKE_VERSION                 0x0002
 103 #define VPNCTL_FLAG_IKEV2                               VPNCTL_FLAG_IKE_VERSION
 104
 105 /*
 106  * XAUTH Attribute Types
 107  */
 108 #ifndef __IPSEC_BUILD__
 109 #define XAUTH_TYPE                16520
 110 #define XAUTH_USER_NAME           16521
 111 #define XAUTH_USER_PASSWORD       16522
 112 #define XAUTH_PASSCODE            16523
 113 #define XAUTH_MESSAGE             16524
 114 #define XAUTH_CHALLENGE           16525
 115 #define XAUTH_DOMAIN              16526
 116 #define XAUTH_STATUS              16527
 117 #define XAUTH_NEXT_PIN            16528
 118 #define XAUTH_ANSWER              16529
 119
 120
 121 /* Types for XAUTH_TYPE */
 122 #define XAUTH_TYPE_GENERIC      0
 123 #define XAUTH_TYPE_CHAP         1
 124 #define XAUTH_TYPE_OTP          2
 125 #define XAUTH_TYPE_SKEY         3
 126
 127
 128 /* Mode cfg Attribute types */
 129 #define INTERNAL_IP4_ADDRESS        1
 130 #define INTERNAL_IP4_NETMASK        2
 131 #define INTERNAL_IP4_DNS            3
 132 #define INTERNAL_IP4_NBNS           4
 133 #define INTERNAL_ADDRESS_EXPIRY     5
 134 #define INTERNAL_IP4_DHCP           6
 135 #define APPLICATION_VERSION         7
 136 #define INTERNAL_IP6_ADDRESS        8
 137 #define INTERNAL_IP6_NETMASK        9
 138 #define INTERNAL_IP6_DNS           10
 139 #define INTERNAL_IP6_NBNS          11
 140 #define INTERNAL_IP6_DHCP          12
 141 #define INTERNAL_IP4_SUBNET        13
 142 #define SUPPORTED_ATTRIBUTES       14
 143 #define INTERNAL_IP6_SUBNET        15
 144
 145 #define UNITY_BANNER                    28672
 146 #define UNITY_SAVE_PASSWD               28673
 147 #define UNITY_DEF_DOMAIN                28674
 148 #define UNITY_SPLITDNS_NAME             28675
 149 #define UNITY_SPLIT_INCLUDE             28676
 150 #define UNITY_NATT_PORT                 28677
 151 #define UNITY_LOCAL_LAN                 28678
 152 #define UNITY_PFS                               28679
 153 #define UNITY_FW_TYPE                   28680
 154 #define UNITY_BACKUP_SERVERS    28681
 155 #define UNITY_DDNS_HOSTNAME             28682
 156
 157 /* 3.3 Data Attributes
 158          0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 159         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 160         !A!       Attribute Type        !    AF=0  Attribute Length     !
 161         !F!                             !    AF=1  Attribute Value      !
 162         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 163         .                   AF=0  Attribute Value                       .
 164         .                   AF=1  Not Transmitted                       .
 165         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 166 */
 167 struct isakmp_data {
 168         u_int16_t type;         /* defined by DOI-spec, and Attribute Format */
 169         u_int16_t lorv;         /* if f equal 1, Attribute Length */
 170         /* if f equal 0, Attribute Value */
 171         /* if f equal 1, Attribute Value */
 172 };
 173 #endif
 174
 175 /* commands and status for vpn control. */
 176 /* network byte order. */
 177
 178 /* Packet header */
 179 struct vpnctl_hdr {
 180         u_int16_t                       msg_type;
 181         u_int16_t                       flags;
 182         u_int32_t                       cookie;
 183         u_int32_t                       reserved;
 184         u_int16_t                       result;
 185         u_int16_t                       len;                    /* payload length */
 186 };
 187
 188 /* Packet formats for commands */
 189
 190 /* bind to receive status for specified address */
 191 struct vpnctl_cmd_bind {
 192         struct vpnctl_hdr               hdr;
 193         u_int32_t                               address;        /* 0xFFFFFFFF = all */
 194         u_int16_t                               vers_len;       /* if zero - no version provided */
 195         /* name/version string of length vers_len */
 196 };
 197
 198 /* unbind to stop receiving status for specified address */
 199 struct vpnctl_cmd_unbind {
 200         struct vpnctl_hdr               hdr;
 201         u_int32_t                               address;        /* 0xFFFFFFFF = all */
 202 };
 203
 204
 205 /* connect to specified address */
 206 struct vpnctl_cmd_connect {
 207         struct vpnctl_hdr               hdr;
 208         u_int32_t                               address;
 209 };
 210
 211 struct vpnctl_cmd_set_nat64_prefix {
 212         struct vpnctl_hdr               hdr;
 213         nw_nat64_prefix_t               nat64_prefix;
 214 };
 215
 216 struct vpnctl_sa_selector {
 217         u_int32_t               src_tunnel_address;
 218         u_int32_t               src_tunnel_mask;
 219         u_int32_t               dst_tunnel_address;
 220         u_int32_t               dst_tunnel_mask;
 221         u_int16_t               src_tunnel_port;
 222         u_int16_t               dst_tunnel_port;
 223         u_int16_t               ul_protocol;
 224         u_int16_t               reserved;
 225 };
 226
 227 struct vpnctl_algo {
 228         u_int16_t       algo_class;
 229         u_int16_t       algo;
 230         u_int16_t       key_len;        /* for enc algorithms only */
 231         u_int16_t       reserved;
 232 };
 233
 234 /* start phase 2 */
 235 struct vpnctl_cmd_start_ph2 {
 236         struct vpnctl_hdr               hdr;
 237         u_int32_t                               address;
 238         u_int32_t                               lifetime;  /* seconds */
 239         u_int16_t                               pfs_group;      /* defined in algorithm_types.h */
 240         u_int16_t                               selector_count;
 241         u_int16_t                               algo_count;
 242         u_int16_t                               reserved;
 243         /* array of struct vpnctl_sa_selector */
 244         /* array of struct vpnctl_algo */
 245 };
 246
 247 /* assert connection (after network change) */
 248 struct vpnctl_cmd_assert {
 249         struct vpnctl_hdr               hdr;
 250         u_int32_t                               src_address;
 251         u_int32_t                               dst_address;
 252 };
 253
 254 /* set xauth info */
 255 struct vpnctl_cmd_xauth_info {
 256         struct vpnctl_hdr               hdr;
 257         u_int32_t                               address;
 258         /* packed array of variable sized struct isakmp_data */
 259 };
 260
 261 /* redirect client to specified address */
 262 struct vpnctl_cmd_redirect {
 263         struct vpnctl_hdr               hdr;
 264         u_int32_t                               address;
 265         u_int32_t                               redirect_address;
 266         u_int16_t                               force;
 267 };
 268
 269 /* start dpd */
 270 struct vpnctl_cmd_start_dpd {
 271         struct vpnctl_hdr               hdr;
 272         u_int32_t               address;
 273 };
 274
 275 /*
 276  * IKE Notify codes - mirrors codes in isakmp.h
 277  */
 278 #define VPNCTL_NTYPE_INVALID_PAYLOAD_TYPE               1
 279 #define VPNCTL_NTYPE_DOI_NOT_SUPPORTED                  2
 280 #define VPNCTL_NTYPE_SITUATION_NOT_SUPPORTED    3
 281 #define VPNCTL_NTYPE_INVALID_COOKIE                             4
 282 #define VPNCTL_NTYPE_INVALID_MAJOR_VERSION              5
 283 #define VPNCTL_NTYPE_INVALID_MINOR_VERSION              6
 284 #define VPNCTL_NTYPE_INVALID_EXCHANGE_TYPE              7
 285 #define VPNCTL_NTYPE_INVALID_FLAGS                              8
 286 #define VPNCTL_NTYPE_INVALID_MESSAGE_ID                 9
 287 #define VPNCTL_NTYPE_INVALID_PROTOCOL_ID                10
 288 #define VPNCTL_NTYPE_INVALID_SPI                                11
 289 #define VPNCTL_NTYPE_INVALID_TRANSFORM_ID               12
 290 #define VPNCTL_NTYPE_ATTRIBUTES_NOT_SUPPORTED   13
 291 #define VPNCTL_NTYPE_NO_PROPOSAL_CHOSEN                 14
 292 #define VPNCTL_NTYPE_BAD_PROPOSAL_SYNTAX                15
 293 #define VPNCTL_NTYPE_PAYLOAD_MALFORMED                  16
 294 #define VPNCTL_NTYPE_INVALID_KEY_INFORMATION    17
 295 #define VPNCTL_NTYPE_INVALID_ID_INFORMATION             18
 296 #define VPNCTL_NTYPE_INVALID_CERT_ENCODING              19
 297 #define VPNCTL_NTYPE_INVALID_CERTIFICATE                20
 298 #define VPNCTL_NTYPE_BAD_CERT_REQUEST_SYNTAX    21
 299 #define VPNCTL_NTYPE_INVALID_CERT_AUTHORITY             22
 300 #define VPNCTL_NTYPE_INVALID_HASH_INFORMATION   23
 301 #define VPNCTL_NTYPE_AUTHENTICATION_FAILED              24
 302 #define VPNCTL_NTYPE_INVALID_SIGNATURE                  25
 303 #define VPNCTL_NTYPE_ADDRESS_NOTIFICATION               26
 304 #define VPNCTL_NTYPE_NOTIFY_SA_LIFETIME                 27
 305 #define VPNCTL_NTYPE_CERTIFICATE_UNAVAILABLE    28
 306 #define VPNCTL_NTYPE_UNSUPPORTED_EXCHANGE_TYPE  29
 307 #define VPNCTL_NTYPE_UNEQUAL_PAYLOAD_LENGTHS    30
 308 #define VPNCTL_NTYPE_LOAD_BALANCE                               40501
 309 #define VPNCTL_NTYPE_PEER_DEAD                                  50001   /* detected by DPD */
 310 #define VPNCTL_NTYPE_PH1_DELETE                                 50002   /* received a delete payload leaving no PH1 SA for the remote address */
 311 #define VPNCTL_NTYPE_IDLE_TIMEOUT                               50003
 312 #define VPNCTL_NTYPE_LOCAL_CERT_PREMATURE               50004   /* certificate is premature */
 313 #define VPNCTL_NTYPE_LOCAL_CERT_EXPIRED                 50005   /* certificate has expired */
 314 #define VPNCTL_NTYPE_PEER_CERT_PREMATURE                50006   /* peer's certificate is premature */
 315 #define VPNCTL_NTYPE_PEER_CERT_EXPIRED                  50007   /* peer's certificate has expired */
 316 #define VPNCTL_NTYPE_PEER_CERT_INVALID_SUBJNAME         50008   /* peer's certificate has an invalid subjname */
 317 #define VPNCTL_NTYPE_PEER_CERT_INVALID_SUBJALTNAME      50009   /* peer's certificate has an invalid subjaltname */
 318 #define VPNCTL_NTYPE_INTERNAL_ERROR                             -1
 319
 320
 321 /* packet format for phase change status */
 322 struct vpnctl_status_phase_change {
 323         struct vpnctl_hdr                       hdr;
 324         u_int32_t                                       address;
 325         /* The following is included when VPNCTL_FLAG_MODECFG_USED flag set */
 326         // struct vpnctl_modecfg_params mode_cfg;
 327
 328 };
 329
 330
 331 /* packet format for auth needed status */
 332 struct vpnctl_status_need_authinfo {
 333         struct vpnctl_hdr                       hdr;
 334         u_int32_t                                       address;
 335         /* packed array of variable sized struct isakmp_data */
 336 };
 337
 338
 339 struct split_address {
 340         u_int32_t       splitaddr;
 341         u_int32_t       splitmask;
 342 };
 343
 344 struct vpnctl_modecfg_params {
 345         u_int32_t                                       outer_local_addr;
 346         u_int16_t                                       outer_remote_port;
 347         u_int16_t                                       outer_local_port;
 348         u_int8_t                                        ifname[IFNAMSIZ];
 349         /*
 350          *      ifname for outer_local_addr (not null terminated)
 351          *      followed by packed array of attributes (struct isakmp_data)
 352          */
 353 };
 354
 355
 356 /* Packet formats for failed status */
 357 struct vpnctl_status_failed {
 358         struct vpnctl_hdr                       hdr;
 359         u_int32_t                                       address;
 360         u_int16_t                                       ike_code;
 361         u_int16_t                                       from;
 362         u_int8_t                                        data[0];
 363 };
 364
 365 struct vpnctl_status_peer_resp {
 366         struct vpnctl_hdr                       hdr;
 367         u_int32_t                                       address;
 368         u_int16_t                                       ike_code;
 369 };
 370
 371 #endif /* _VPN_CONTROL_H */