?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
No empty .Rs/.Re
[netbsd-mini2440.git] / crypto / dist / ipsec-tools / src / racoon / handler.h
blob621dc313a8b869c570aeabe6095a394845db854e
1 /* $NetBSD: handler.h,v 1.21 2009/07/03 06:41:46 tteras Exp $ */
2
3 /* Id: handler.h,v 1.19 2006/02/25 08:25:12 manubsd Exp */
4
5 /*
6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the project nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34 #ifndef _HANDLER_H
35 #define _HANDLER_H
36
37 #include <sys/queue.h>
38 #include <openssl/rsa.h>
39
40 #include <sys/time.h>
41
42 #include "isakmp_var.h"
43 #include "oakley.h"
44 #include "schedule.h"
45 #include "evt.h"
46
47 /* Phase 1 handler */
48 /*
49 * main mode:
50 * initiator responder
51 * 0 (---) (---)
52 * 1 start start (1st msg received)
53 * 2 (---) 1st valid msg received
54 * 3 1st msg sent 1st msg sent
55 * 4 1st valid msg received 2st valid msg received
56 * 5 2nd msg sent 2nd msg sent
57 * 6 2nd valid msg received 3rd valid msg received
58 * 7 3rd msg sent 3rd msg sent
59 * 8 3rd valid msg received (---)
60 * 9 SA established SA established
61 *
62 * aggressive mode:
63 * initiator responder
64 * 0 (---) (---)
65 * 1 start start (1st msg received)
66 * 2 (---) 1st valid msg received
67 * 3 1st msg sent 1st msg sent
68 * 4 1st valid msg received 2st valid msg received
69 * 5 (---) (---)
70 * 6 (---) (---)
71 * 7 (---) (---)
72 * 8 (---) (---)
73 * 9 SA established SA established
74 *
75 * base mode:
76 * initiator responder
77 * 0 (---) (---)
78 * 1 start start (1st msg received)
79 * 2 (---) 1st valid msg received
80 * 3 1st msg sent 1st msg sent
81 * 4 1st valid msg received 2st valid msg received
82 * 5 2nd msg sent (---)
83 * 6 (---) (---)
84 * 7 (---) (---)
85 * 8 (---) (---)
86 * 9 SA established SA established
87 */
88 #define PHASE1ST_SPAWN 0
89 #define PHASE1ST_START 1
90 #define PHASE1ST_MSG1RECEIVED 2
91 #define PHASE1ST_MSG1SENT 3
92 #define PHASE1ST_MSG2RECEIVED 4
93 #define PHASE1ST_MSG2SENT 5
94 #define PHASE1ST_MSG3RECEIVED 6
95 #define PHASE1ST_MSG3SENT 7
96 #define PHASE1ST_MSG4RECEIVED 8
97 #define PHASE1ST_ESTABLISHED 9
98 #define PHASE1ST_DYING 10
99 #define PHASE1ST_EXPIRED 11
100 #define PHASE1ST_MAX 12
101
102 /* About address semantics in each case.
103 * initiator(addr=I) responder(addr=R)
104 * src dst src dst
105 * (local) (remote) (local) (remote)
106 * phase 1 handler I R R I
107 * phase 2 handler I R R I
108 * getspi msg R I I R
109 * acquire msg I R
110 * ID payload I R I R
111 */
112 #ifdef ENABLE_HYBRID
113 struct isakmp_cfg_state;
114 #endif
115 struct ph1handle {
116 isakmp_index index;
117
118 int status; /* status of this SA */
119 int side; /* INITIATOR or RESPONDER */
120
121 struct sockaddr *remote; /* remote address to negosiate ph1 */
122 struct sockaddr *local; /* local address to negosiate ph1 */
123 /* XXX copy from rmconf due to anonymous configuration.
124 * If anonymous will be forbidden, we do delete them. */
125
126 struct remoteconf *rmconf; /* pointer to remote configuration */
127
128 struct isakmpsa *approval; /* pointer to SA(s) approved. */
129 vchar_t *authstr; /* place holder of string for auth. */
130 /* for example pre-shared key */
131
132 u_int8_t version; /* ISAKMP version */
133 u_int8_t etype; /* Exchange type actually for use */
134 u_int8_t flags; /* Flags */
135 u_int32_t msgid; /* message id */
136
137 u_int32_t vendorid_mask; /* bitmask of received supported vendor ids*/
138 #ifdef ENABLE_NATT
139 struct ph1natt_options *natt_options; /* Selected NAT-T IKE version */
140 u_int32_t natt_flags; /* NAT-T related flags */
141 #endif
142 #ifdef ENABLE_FRAG
143 int frag; /* IKE phase 1 fragmentation */
144 struct isakmp_frag_item *frag_chain; /* Received fragments */
145 #endif
146
147 struct sched sce; /* schedule for expire */
148
149 struct sched scr; /* schedule for resend */
150 int retry_counter; /* for resend. */
151 vchar_t *sendbuf; /* buffer for re-sending */
152
153 vchar_t *dhpriv; /* DH; private value */
154 vchar_t *dhpub; /* DH; public value */
155 vchar_t *dhpub_p; /* DH; partner's public value */
156 vchar_t *dhgxy; /* DH; shared secret */
157 vchar_t *nonce; /* nonce value */
158 vchar_t *nonce_p; /* partner's nonce value */
159 vchar_t *skeyid; /* SKEYID */
160 vchar_t *skeyid_d; /* SKEYID_d */
161 vchar_t *skeyid_a; /* SKEYID_a, i.e. hash */
162 vchar_t *skeyid_e; /* SKEYID_e, i.e. encryption */
163 vchar_t *key; /* cipher key */
164 vchar_t *hash; /* HASH minus general header */
165 vchar_t *sig; /* SIG minus general header */
166 vchar_t *sig_p; /* peer's SIG minus general header */
167 vchar_t *cert; /* CERT minus general header */
168 vchar_t *cert_p; /* peer's CERT minus general header */
169 vchar_t *crl_p; /* peer's CRL minus general header */
170 vchar_t *cr_p; /* peer's CR not including general */
171 RSA *rsa; /* my RSA key */
172 RSA *rsa_p; /* peer's RSA key */
173 struct genlist *rsa_candidates; /* possible candidates for peer's RSA key */
174 vchar_t *id; /* ID minus gen header */
175 vchar_t *id_p; /* partner's ID minus general header */
176 /* i.e. struct ipsecdoi_id_b*. */
177 struct isakmp_ivm *ivm; /* IVs */
178
179 vchar_t *sa; /* whole SA payload to send/to be sent*/
180 /* to calculate HASH */
181 /* NOT INCLUDING general header. */
182
183 vchar_t *sa_ret; /* SA payload to reply/to be replyed */
184 /* NOT INCLUDING general header. */
185 /* NOTE: Should be release after use. */
186
187 #ifdef HAVE_GSSAPI
188 void *gssapi_state; /* GSS-API specific state. */
189 /* Allocated when needed */
190 vchar_t *gi_i; /* optional initiator GSS id */
191 vchar_t *gi_r; /* optional responder GSS id */
192 #endif
193
194 struct isakmp_pl_hash *pl_hash; /* pointer to hash payload */
195
196 time_t created; /* timestamp for establish */
197 int initial_contact_received; /* set if initial contact received */
198 #ifdef ENABLE_STATS
199 struct timeval start;
200 struct timeval end;
201 #endif
202
203 #ifdef ENABLE_DPD
204 int dpd_support; /* Does remote supports DPD ? */
205 u_int16_t dpd_seq; /* DPD seq number to receive */
206 u_int8_t dpd_fails; /* number of failures */
207 struct sched dpd_r_u;
208 #endif
209
210 u_int32_t msgid2; /* msgid counter for Phase 2 */
211 int ph2cnt; /* the number which is negotiated by this phase 1 */
212 LIST_HEAD(_ph2ofph1_, ph2handle) ph2tree;
213
214 LIST_ENTRY(ph1handle) chain;
215 #ifdef ENABLE_HYBRID
216 struct isakmp_cfg_state *mode_cfg; /* ISAKMP mode config state */
217 #endif
218 EVT_LISTENER_LIST(evt_listeners);
219 };
220
221 /* For limiting enumeration of ph1 tree */
222 struct ph1selector {
223 struct sockaddr *local;
224 struct sockaddr *remote;
225 };
226
227 /* Phase 2 handler */
228 /* allocated per a SA or SA bundles of a pair of peer's IP addresses. */
229 /*
230 * initiator responder
231 * 0 (---) (---)
232 * 1 start start (1st msg received)
233 * 2 acquire msg get 1st valid msg received
234 * 3 getspi request sent getspi request sent
235 * 4 getspi done getspi done
236 * 5 1st msg sent 1st msg sent
237 * 6 1st valid msg received 2nd valid msg received
238 * 7 (commit bit) (commit bit)
239 * 8 SAs added SAs added
240 * 9 SAs established SAs established
241 * 10 SAs expired SAs expired
242 */
243 #define PHASE2ST_SPAWN 0
244 #define PHASE2ST_START 1
245 #define PHASE2ST_STATUS2 2
246 #define PHASE2ST_GETSPISENT 3
247 #define PHASE2ST_GETSPIDONE 4
248 #define PHASE2ST_MSG1SENT 5
249 #define PHASE2ST_STATUS6 6
250 #define PHASE2ST_COMMIT 7
251 #define PHASE2ST_ADDSA 8
252 #define PHASE2ST_ESTABLISHED 9
253 #define PHASE2ST_EXPIRED 10
254 #define PHASE2ST_MAX 11
255
256 struct ph2handle {
257 /* source and destination addresses used for IKE exchange. Might
258 * differ from source and destination of SA. On the initiator,
259 * they are tweaked if a hint is available in the SPD (set by
260 * MIGRATE for instance). Otherwise they are the source and
261 * destination of SA for transport mode and the tunnel endpoints
262 * for tunnel mode */
263 struct sockaddr *src;
264 struct sockaddr *dst;
265
266 /* source and destination addresses of the SA in the case addresses
267 * used for IKE exchanges (src and dst) do differ. On the initiator,
268 * they are set (if needed) in pk_recvacquire(). On the responder,
269 * they are _derived_ from the local and remote parameters of the
270 * SP, if available. */
271 struct sockaddr *sa_src;
272 struct sockaddr *sa_dst;
273
274 /* Store our Phase 2 ID and the peer ID (ID minus general header).
275 * On the initiator, they are set during ACQUIRE processing.
276 * On the responder, they are set from the content of ID payload
277 * in quick_r1recv(). Then, if they are of type address or
278 * tunnel, they are compared to sainfo selectors.
279 */
280 vchar_t *id; /* ID minus gen header */
281 vchar_t *id_p; /* peer's ID minus general header */
282
283 #ifdef ENABLE_NATT
284 struct sockaddr *natoa_src; /* peer's view of my address */
285 struct sockaddr *natoa_dst; /* peer's view of his address */
286 #endif
287
288 u_int32_t spid; /* policy id by kernel */
289
290 int status; /* ipsec sa status */
291 u_int8_t side; /* INITIATOR or RESPONDER */
292
293 struct sched sce; /* schedule for expire */
294 struct sched scr; /* schedule for resend */
295 int retry_counter; /* for resend. */
296 vchar_t *sendbuf; /* buffer for re-sending */
297 vchar_t *msg1; /* buffer for re-sending */
298 /* used for responder's first message */
299
300 int retry_checkph1; /* counter to wait phase 1 finished. */
301 /* NOTE: actually it's timer. */
302
303 u_int32_t seq; /* sequence number used by PF_KEY */
304 /*
305 * NOTE: In responder side, we can't identify each SAs
306 * with same destination address for example, when
307 * socket based SA is required. So we set a identifier
308 * number to "seq", and sent kernel by pfkey.
309 */
310 u_int8_t satype; /* satype in PF_KEY */
311 /*
312 * saved satype in the original PF_KEY request from
313 * the kernel in order to reply a error.
314 */
315
316 u_int8_t flags; /* Flags for phase 2 */
317 u_int32_t msgid; /* msgid for phase 2 */
318
319 struct sainfo *sainfo; /* place holder of sainfo */
320 struct saprop *proposal; /* SA(s) proposal. */
321 struct saprop *approval; /* SA(s) approved. */
322 u_int32_t lifetime_secs; /* responder lifetime (seconds) */
323 u_int32_t lifetime_kb; /* responder lifetime (kbytes) */
324 caddr_t spidx_gen; /* policy from peer's proposal */
325
326 struct dhgroup *pfsgrp; /* DH; prime number */
327 vchar_t *dhpriv; /* DH; private value */
328 vchar_t *dhpub; /* DH; public value */
329 vchar_t *dhpub_p; /* DH; partner's public value */
330 vchar_t *dhgxy; /* DH; shared secret */
331 vchar_t *nonce; /* nonce value in phase 2 */
332 vchar_t *nonce_p; /* partner's nonce value in phase 2 */
333
334 vchar_t *sa; /* whole SA payload to send/to be sent*/
335 /* to calculate HASH */
336 /* NOT INCLUDING general header. */
337
338 vchar_t *sa_ret; /* SA payload to reply/to be replyed */
339 /* NOT INCLUDING general header. */
340 /* NOTE: Should be release after use. */
341
342 struct isakmp_ivm *ivm; /* IVs */
343
344 int generated_spidx; /* mark handlers whith generated policy */
345
346 #ifdef ENABLE_STATS
347 struct timeval start;
348 struct timeval end;
349 #endif
350 struct ph1handle *ph1; /* back pointer to isakmp status */
351
352 LIST_ENTRY(ph2handle) chain;
353 LIST_ENTRY(ph2handle) ph1bind; /* chain to ph1handle */
354 EVT_LISTENER_LIST(evt_listeners);
355 };
356
357 /* For limiting enumeration of ph2 tree */
358 struct ph2selector {
359 u_int32_t spid;
360 struct sockaddr *src;
361 struct sockaddr *dst;
362 };
363
364 /*
365 * for handling initial contact.
366 */
367 struct contacted {
368 struct sockaddr *remote; /* remote address to negosiate ph1 */
369 LIST_ENTRY(contacted) chain;
370 };
371
372 /*
373 * for checking a packet retransmited.
374 */
375 struct recvdpkt {
376 struct sockaddr *remote; /* the remote address */
377 struct sockaddr *local; /* the local address */
378 vchar_t *hash; /* hash of the received packet */
379 vchar_t *sendbuf; /* buffer for the response */
380 int retry_counter; /* how many times to send */
381 struct timeval time_send; /* timestamp of previous send */
382
383 LIST_ENTRY(recvdpkt) chain;
384 };
385
386 /* for parsing ISAKMP header. */
387 struct isakmp_parse_t {
388 u_char type; /* payload type of mine */
389 int len; /* ntohs(ptr->len) */
390 struct isakmp_gen *ptr;
391 };
392
393 /*
394 * for IV management.
395 *
396 * - normal case
397 * initiator responder
398 * ------------------------- --------------------------
399 * initialize iv(A), ive(A). initialize iv(A), ive(A).
400 * encode by ive(A).
401 * save to iv(B). ---[packet(B)]--> save to ive(B).
402 * decode by iv(A).
403 * packet consistency.
404 * sync iv(B) with ive(B).
405 * check auth, integrity.
406 * encode by ive(B).
407 * save to ive(C). <--[packet(C)]--- save to iv(C).
408 * decoded by iv(B).
409 * :
410 *
411 * - In the case that a error is found while cipher processing,
412 * initiator responder
413 * ------------------------- --------------------------
414 * initialize iv(A), ive(A). initialize iv(A), ive(A).
415 * encode by ive(A).
416 * save to iv(B). ---[packet(B)]--> save to ive(B).
417 * decode by iv(A).
418 * packet consistency.
419 * sync iv(B) with ive(B).
420 * check auth, integrity.
421 * error found.
422 * create notify.
423 * get ive2(X) from iv(B).
424 * encode by ive2(X).
425 * get iv2(X) from iv(B). <--[packet(Y)]--- save to iv2(Y).
426 * save to ive2(Y).
427 * decoded by iv2(X).
428 * :
429 *
430 * The reason why the responder synchronizes iv with ive after checking the
431 * packet consistency is that it is required to leave the IV for decoding
432 * packet. Because there is a potential of error while checking the packet
433 * consistency. Also the reason why that is before authentication and
434 * integirty check is that the IV for informational exchange has to be made
435 * by the IV which is after packet decoded and checking the packet consistency.
436 * Otherwise IV mismatched happens between the intitiator and the responder.
437 */
438 struct isakmp_ivm {
439 vchar_t *iv; /* for decoding packet */
440 /* if phase 1, it's for computing phase2 iv */
441 vchar_t *ive; /* for encoding packet */
442 };
443
444 /* for dumping */
445 struct ph1dump {
446 isakmp_index index;
447 int status;
448 int side;
449 struct sockaddr_storage remote;
450 struct sockaddr_storage local;
451 u_int8_t version;
452 u_int8_t etype;
453 time_t created;
454 int ph2cnt;
455 };
456
457 struct sockaddr;
458 struct ph1handle;
459 struct ph2handle;
460 struct policyindex;
461
462 extern struct ph1handle *getph1byindex __P((isakmp_index *));
463 extern struct ph1handle *getph1byindex0 __P((isakmp_index *));
464
465 extern int enumph1 __P((struct ph1selector *ph1sel,
466 int (* enum_func)(struct ph1handle *iph1, void *arg),
467 void *enum_arg));
468
469 #define GETPH1_F_ESTABLISHED 0x0001
470
471 extern struct ph1handle *getph1 __P((struct ph1handle *ph1hint,
472 struct sockaddr *local,
473 struct sockaddr *remote,
474 int flags));
475
476 #define getph1byaddr(local, remote, est) \
477 getph1(NULL, local, remote, est ? GETPH1_F_ESTABLISHED : 0)
478 #define getph1bydstaddr(remote) \
479 getph1(NULL, NULL, remote, 0)
480
481 #ifdef ENABLE_HYBRID
482 struct ph1handle *getph1bylogin __P((char *));
483 int purgeph1bylogin __P((char *));
484 #endif
485 extern void migrate_ph12 __P((struct ph1handle *old_iph1, struct ph1handle *new_iph1));
486 extern void migrate_dying_ph12 __P((struct ph1handle *iph1));
487 extern vchar_t *dumpph1 __P((void));
488 extern struct ph1handle *newph1 __P((void));
489 extern void delph1 __P((struct ph1handle *));
490 extern int insph1 __P((struct ph1handle *));
491 extern void remph1 __P((struct ph1handle *));
492 extern int resolveph1rmconf __P((struct ph1handle *));
493 extern void flushph1 __P((void));
494 extern void initph1tree __P((void));
495
496 extern int enumph2 __P((struct ph2selector *ph2sel,
497 int (* enum_func)(struct ph2handle *iph2, void *arg),
498 void *enum_arg));
499 extern struct ph2handle *getph2byseq __P((u_int32_t));
500 extern struct ph2handle *getph2bysaddr __P((struct sockaddr *,
501 struct sockaddr *));
502 extern struct ph2handle *getph2bymsgid __P((struct ph1handle *, u_int32_t));
503 extern struct ph2handle *getph2byid __P((struct sockaddr *,
504 struct sockaddr *, u_int32_t));
505 extern struct ph2handle *getph2bysaidx __P((struct sockaddr *,
506 struct sockaddr *, u_int, u_int32_t));
507 extern struct ph2handle *newph2 __P((void));
508 extern void initph2 __P((struct ph2handle *));
509 extern void delph2 __P((struct ph2handle *));
510 extern int insph2 __P((struct ph2handle *));
511 extern void remph2 __P((struct ph2handle *));
512 extern void flushph2 __P((void));
513 extern void deleteallph2 __P((struct sockaddr *, struct sockaddr *, u_int));
514 extern void initph2tree __P((void));
515
516 extern void bindph12 __P((struct ph1handle *, struct ph2handle *));
517 extern void unbindph12 __P((struct ph2handle *));
518
519 extern struct contacted *getcontacted __P((struct sockaddr *));
520 extern int inscontacted __P((struct sockaddr *));
521 extern void initctdtree __P((void));
522
523 extern int check_recvdpkt __P((struct sockaddr *,
524 struct sockaddr *, vchar_t *));
525 extern int add_recvdpkt __P((struct sockaddr *, struct sockaddr *,
526 vchar_t *, vchar_t *));
527 extern void init_recvdpkt __P((void));
528
529 #ifdef ENABLE_HYBRID
530 extern int exclude_cfg_addr __P((const struct sockaddr *));
531 #endif
532
533 extern int revalidate_ph12(void);
534
535 #endif /* _HANDLER_H */
NetBSD on the FriendlyARM MINI2440