1/* $Id: vpn_control.h,v 1.10 2004/12/30 13:45:49 manubsd Exp $ */ 2 3/* 4 * Copyright (c) 2006 Apple Computer, Inc. All rights reserved. 5 * 6 * @APPLE_LICENSE_HEADER_START@ 7 * 8 * The contents of this file constitute Original Code as defined in and 9 * are subject to the Apple Public Source License Version 1.1 (the 10 * "License"). You may not use this file except in compliance with the 11 * License. Please obtain a copy of the License at 12 * http://www.apple.com/publicsource and read it before using this file. 13 * 14 * This Original Code and all software distributed under the License are 15 * distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, EITHER 16 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 17 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 18 * FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT. Please see the 19 * License for the specific language governing rights and limitations 20 * under the License. 21 * 22 * @APPLE_LICENSE_HEADER_END@ 23 */ 24 25/* 26 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 27 * All rights reserved. 28 * 29 * Redistribution and use in source and binary forms, with or without 30 * modification, are permitted provided that the following conditions 31 * are met: 32 * 1. Redistributions of source code must retain the above copyright 33 * notice, this list of conditions and the following disclaimer. 34 * 2. Redistributions in binary form must reproduce the above copyright 35 * notice, this list of conditions and the following disclaimer in the 36 * documentation and/or other materials provided with the distribution. 37 * 3. Neither the name of the project nor the names of its contributors 38 * may be used to endorse or promote products derived from this software 39 * without specific prior written permission. 40 * 41 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 44 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 51 * SUCH DAMAGE. 52 */ 53 54#ifndef _VPN_CONTROL_H 55#define _VPN_CONTROL_H 56 57#include "algorithm_types.h" 58#include <net/if.h> 59 60#define VPNCONTROLSOCK_PATH ADMINPORTDIR "/vpncontrol.sock" 61 62#define FROM_LOCAL 0 63#define FROM_REMOTE 1 64 65 66extern char *vpncontrolsock_path; 67extern uid_t vpncontrolsock_owner; 68extern gid_t vpncontrolsock_group; 69extern mode_t vpncontrolsock_mode; 70 71 72/* 73 * message types 74 */ 75#define VPNCTL_CMD_BIND 0x0001 76#define VPNCTL_CMD_UNBIND 0x0002 77#define VPNCTL_CMD_REDIRECT 0x0003 78#define VPNCTL_CMD_PING 0x0004 79#define VPNCTL_CMD_CONNECT 0x0011 80#define VPNCTL_CMD_DISCONNECT 0x0012 81#define VPNCTL_CMD_START_PH2 0x0013 82#define VPNCTL_CMD_XAUTH_INFO 0x0014 83#define VPNCTL_CMD_START_DPD 0x0015 84#define VPNCTL_CMD_ASSERT 0x0016 85#define VPNCTL_CMD_RECONNECT 0x0017 86#define VPNCTL_STATUS_IKE_FAILED 0x8001 87#define VPNCTL_STATUS_PH1_START_US 0x8011 88#define VPNCTL_STATUS_PH1_START_PEER 0x8012 89#define VPNCTL_STATUS_PH1_ESTABLISHED 0x8013 90#define VPNCTL_STATUS_PH2_START 0x8021 91#define VPNCTL_STATUS_PH2_ESTABLISHED 0x8022 92#define VPNCTL_STATUS_NEED_AUTHINFO 0x8101 93#define VPNCTL_STATUS_NEED_REAUTHINFO 0x8102 94#define VPNCTL_STATUS_PEER_RESP 0x8103 95 96/* 97 * Flags 98 */ 99#define VPNCTL_FLAG_MODECFG_USED 0x0001 100 101/* 102 * XAUTH Attribute Types 103 */ 104#ifndef __IPSEC_BUILD__ 105#define XAUTH_TYPE 16520 106#define XAUTH_USER_NAME 16521 107#define XAUTH_USER_PASSWORD 16522 108#define XAUTH_PASSCODE 16523 109#define XAUTH_MESSAGE 16524 110#define XAUTH_CHALLENGE 16525 111#define XAUTH_DOMAIN 16526 112#define XAUTH_STATUS 16527 113#define XAUTH_NEXT_PIN 16528 114#define XAUTH_ANSWER 16529 115 116 117/* Types for XAUTH_TYPE */ 118#define XAUTH_TYPE_GENERIC 0 119#define XAUTH_TYPE_CHAP 1 120#define XAUTH_TYPE_OTP 2 121#define XAUTH_TYPE_SKEY 3 122 123 124/* Mode cfg Attribute types */ 125#define INTERNAL_IP4_ADDRESS 1 126#define INTERNAL_IP4_NETMASK 2 127#define INTERNAL_IP4_DNS 3 128#define INTERNAL_IP4_NBNS 4 129#define INTERNAL_ADDRESS_EXPIRY 5 130#define INTERNAL_IP4_DHCP 6 131#define APPLICATION_VERSION 7 132#define INTERNAL_IP6_ADDRESS 8 133#define INTERNAL_IP6_NETMASK 9 134#define INTERNAL_IP6_DNS 10 135#define INTERNAL_IP6_NBNS 11 136#define INTERNAL_IP6_DHCP 12 137#define INTERNAL_IP4_SUBNET 13 138#define SUPPORTED_ATTRIBUTES 14 139#define INTERNAL_IP6_SUBNET 15 140 141 142/* 3.3 Data Attributes 143 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 144 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 145 !A! Attribute Type ! AF=0 Attribute Length ! 146 !F! ! AF=1 Attribute Value ! 147 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 148 . AF=0 Attribute Value . 149 . AF=1 Not Transmitted . 150 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 151 */ 152struct isakmp_data { 153 u_int16_t type; /* defined by DOI-spec, and Attribute Format */ 154 u_int16_t lorv; /* if f equal 1, Attribute Length */ 155 /* if f equal 0, Attribute Value */ 156 /* if f equal 1, Attribute Value */ 157}; 158#endif 159 160/* commands and status for vpn control. */ 161/* network byte order. */ 162 163/* Packet header */ 164struct vpnctl_hdr { 165 u_int16_t msg_type; 166 u_int16_t flags; 167 u_int32_t cookie; 168 u_int32_t reserved; 169 u_int16_t result; 170 u_int16_t len; /* payload length */ 171}; 172 173/* Packet formats for commands */ 174 175/* bind to receive status for specified address */ 176struct vpnctl_cmd_bind { 177 struct vpnctl_hdr hdr; 178 u_int32_t address; /* 0xFFFFFFFF = all */ 179 u_int16_t vers_len; /* if zero - no version provided */ 180 /* name/version string of length vers_len */ 181}; 182 183/* unbind to stop receiving status for specified address */ 184struct vpnctl_cmd_unbind { 185 struct vpnctl_hdr hdr; 186 u_int32_t address; /* 0xFFFFFFFF = all */ 187}; 188 189 190/* connect/reconnect to specified address */ 191struct vpnctl_cmd_connect{ 192 struct vpnctl_hdr hdr; 193 u_int32_t address; 194}; 195 196struct vpnctl_sa_selector { 197 u_int32_t src_tunnel_address; 198 u_int32_t src_tunnel_mask; 199 u_int32_t dst_tunnel_address; 200 u_int32_t dst_tunnel_mask; 201 u_int16_t src_tunnel_port; 202 u_int16_t dst_tunnel_port; 203 u_int16_t ul_protocol; 204 u_int16_t reserved; 205}; 206 207struct vpnctl_algo { 208 u_int16_t algo_class; 209 u_int16_t algo; 210 u_int16_t key_len; /* for enc algorithms only */ 211 u_int16_t reserved; 212}; 213 214/* start phase 2 */ 215struct vpnctl_cmd_start_ph2 { 216 struct vpnctl_hdr hdr; 217 u_int32_t address; 218 u_int32_t lifetime; /* seconds */ 219 u_int16_t pfs_group; /* defined in algorithm_types.h */ 220 u_int16_t selector_count; 221 u_int16_t algo_count; 222 u_int16_t reserved; 223 /* array of struct vpnctl_sa_selector */ 224 /* array of struct vpnctl_algo */ 225}; 226 227/* assert connection (after network change) */ 228struct vpnctl_cmd_assert { 229 struct vpnctl_hdr hdr; 230 u_int32_t src_address; 231 u_int32_t dst_address; 232}; 233 234/* set xauth info */ 235struct vpnctl_cmd_xauth_info { 236 struct vpnctl_hdr hdr; 237 u_int32_t address; 238 /* packed array of variable sized struct isakmp_data */ 239}; 240 241/* redirect client to specified address */ 242struct vpnctl_cmd_redirect { 243 struct vpnctl_hdr hdr; 244 u_int32_t address; 245 u_int32_t redirect_address; 246 u_int16_t force; 247}; 248 249/* start dpd */ 250struct vpnctl_cmd_start_dpd { 251 struct vpnctl_hdr hdr; 252 u_int32_t address; 253}; 254 255/* 256 * IKE Notify codes - mirrors codes in isakmp.h 257 */ 258#define VPNCTL_NTYPE_INVALID_PAYLOAD_TYPE 1 259#define VPNCTL_NTYPE_DOI_NOT_SUPPORTED 2 260#define VPNCTL_NTYPE_SITUATION_NOT_SUPPORTED 3 261#define VPNCTL_NTYPE_INVALID_COOKIE 4 262#define VPNCTL_NTYPE_INVALID_MAJOR_VERSION 5 263#define VPNCTL_NTYPE_INVALID_MINOR_VERSION 6 264#define VPNCTL_NTYPE_INVALID_EXCHANGE_TYPE 7 265#define VPNCTL_NTYPE_INVALID_FLAGS 8 266#define VPNCTL_NTYPE_INVALID_MESSAGE_ID 9 267#define VPNCTL_NTYPE_INVALID_PROTOCOL_ID 10 268#define VPNCTL_NTYPE_INVALID_SPI 11 269#define VPNCTL_NTYPE_INVALID_TRANSFORM_ID 12 270#define VPNCTL_NTYPE_ATTRIBUTES_NOT_SUPPORTED 13 271#define VPNCTL_NTYPE_NO_PROPOSAL_CHOSEN 14 272#define VPNCTL_NTYPE_BAD_PROPOSAL_SYNTAX 15 273#define VPNCTL_NTYPE_PAYLOAD_MALFORMED 16 274#define VPNCTL_NTYPE_INVALID_KEY_INFORMATION 17 275#define VPNCTL_NTYPE_INVALID_ID_INFORMATION 18 276#define VPNCTL_NTYPE_INVALID_CERT_ENCODING 19 277#define VPNCTL_NTYPE_INVALID_CERTIFICATE 20 278#define VPNCTL_NTYPE_BAD_CERT_REQUEST_SYNTAX 21 279#define VPNCTL_NTYPE_INVALID_CERT_AUTHORITY 22 280#define VPNCTL_NTYPE_INVALID_HASH_INFORMATION 23 281#define VPNCTL_NTYPE_AUTHENTICATION_FAILED 24 282#define VPNCTL_NTYPE_INVALID_SIGNATURE 25 283#define VPNCTL_NTYPE_ADDRESS_NOTIFICATION 26 284#define VPNCTL_NTYPE_NOTIFY_SA_LIFETIME 27 285#define VPNCTL_NTYPE_CERTIFICATE_UNAVAILABLE 28 286#define VPNCTL_NTYPE_UNSUPPORTED_EXCHANGE_TYPE 29 287#define VPNCTL_NTYPE_UNEQUAL_PAYLOAD_LENGTHS 30 288#define VPNCTL_NTYPE_LOAD_BALANCE 40501 289#define VPNCTL_NTYPE_PEER_DEAD 50001 /* detected by DPD */ 290#define VPNCTL_NTYPE_PH1_DELETE 50002 /* received a delete payload leaving no PH1 SA for the remote address */ 291#define VPNCTL_NTYPE_IDLE_TIMEOUT 50003 /* idle timeout */ 292#define VPNCTL_NTYPE_LOCAL_CERT_PREMATURE 50004 /* certificate is premature */ 293#define VPNCTL_NTYPE_LOCAL_CERT_EXPIRED 50005 /* certificate has expired */ 294#define VPNCTL_NTYPE_PEER_CERT_PREMATURE 50006 /* peer's certificate is premature */ 295#define VPNCTL_NTYPE_PEER_CERT_EXPIRED 50007 /* peer's certificate has expired */ 296#define VPNCTL_NTYPE_PEER_CERT_INVALID_SUBJNAME 50008 /* peer's certificate has an invalid subjname */ 297#define VPNCTL_NTYPE_PEER_CERT_INVALID_SUBJALTNAME 50009 /* peer's certificate has an invalid subjaltname */ 298#define VPNCTL_NTYPE_INTERNAL_ERROR -1 299 300 301/* packet format for phase change status */ 302struct vpnctl_status_phase_change { 303 struct vpnctl_hdr hdr; 304 u_int32_t address; 305 /* The following is included when VPNCTL_FLAG_MODECFG_USED flag set */ 306 // struct vpnctl_modecfg_params mode_cfg; 307 308}; 309 310 311/* packet format for auth needed status */ 312struct vpnctl_status_need_authinfo { 313 struct vpnctl_hdr hdr; 314 u_int32_t address; 315 /* packed array of variable sized struct isakmp_data */ 316}; 317 318 319struct split_address { 320 u_int32_t splitaddr; 321 u_int32_t splitmask; 322}; 323 324struct vpnctl_modecfg_params { 325 u_int32_t outer_local_addr; 326 u_int16_t outer_remote_port; 327 u_int16_t outer_local_port; 328 u_int8_t ifname[IFNAMSIZ]; 329 /* 330 * ifname for outer_local_addr (not null terminated) 331 * followed by packed array of attributes (struct isakmp_data) 332 */ 333}; 334 335 336/* Packet formats for failed status */ 337struct vpnctl_status_failed { 338 struct vpnctl_hdr hdr; 339 u_int32_t address; 340 u_int16_t ike_code; 341 u_int16_t from; 342 u_int8_t data[0]; 343}; 344 345struct vpnctl_status_peer_resp { 346 struct vpnctl_hdr hdr; 347 u_int32_t address; 348 u_int16_t ike_code; 349}; 350 351#endif /* _VPN_CONTROL_H */ 352