1/* $Id: vpn_control.h,v 1.10 2004/12/30 13:45:49 manubsd Exp $ */ 2 3/* 4 * Copyright (c) 2006 Apple Computer, Inc. All rights reserved. 5 * 6 * @APPLE_LICENSE_HEADER_START@ 7 * 8 * The contents of this file constitute Original Code as defined in and 9 * are subject to the Apple Public Source License Version 1.1 (the 10 * "License"). You may not use this file except in compliance with the 11 * License. Please obtain a copy of the License at 12 * http://www.apple.com/publicsource and read it before using this file. 13 * 14 * This Original Code and all software distributed under the License are 15 * distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, EITHER 16 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 17 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 18 * FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT. Please see the 19 * License for the specific language governing rights and limitations 20 * under the License. 21 * 22 * @APPLE_LICENSE_HEADER_END@ 23 */ 24 25/* 26 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 27 * All rights reserved. 28 * 29 * Redistribution and use in source and binary forms, with or without 30 * modification, are permitted provided that the following conditions 31 * are met: 32 * 1. Redistributions of source code must retain the above copyright 33 * notice, this list of conditions and the following disclaimer. 34 * 2. Redistributions in binary form must reproduce the above copyright 35 * notice, this list of conditions and the following disclaimer in the 36 * documentation and/or other materials provided with the distribution. 37 * 3. Neither the name of the project nor the names of its contributors 38 * may be used to endorse or promote products derived from this software 39 * without specific prior written permission. 40 * 41 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 44 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 51 * SUCH DAMAGE. 52 */ 53 54#ifndef _VPN_CONTROL_H 55#define _VPN_CONTROL_H 56 57#include "algorithm_types.h" 58#include <net/if.h> 59 60#define VPNCONTROLSOCK_PATH ADMINPORTDIR "/vpncontrol.sock" 61 62#define FROM_LOCAL 0 63#define FROM_REMOTE 1 64 65 66extern char *vpncontrolsock_path; 67extern uid_t vpncontrolsock_owner; 68extern gid_t vpncontrolsock_group; 69extern mode_t vpncontrolsock_mode; 70 71 72/* 73 * message types 74 */ 75#define VPNCTL_CMD_BIND 0x0001 76#define VPNCTL_CMD_UNBIND 0x0002 77#define VPNCTL_CMD_REDIRECT 0x0003 78#define VPNCTL_CMD_PING 0x0004 79#define VPNCTL_CMD_CONNECT 0x0011 80#define VPNCTL_CMD_DISCONNECT 0x0012 81#define VPNCTL_CMD_START_PH2 0x0013 82#define VPNCTL_CMD_XAUTH_INFO 0x0014 83#define VPNCTL_CMD_START_DPD 0x0015 84#define VPNCTL_CMD_ASSERT 0x0016 85#define VPNCTL_CMD_RECONNECT 0x0017 86#define VPNCTL_STATUS_IKE_FAILED 0x8001 87#define VPNCTL_STATUS_PH1_START_US 0x8011 88#define VPNCTL_STATUS_PH1_START_PEER 0x8012 89#define VPNCTL_STATUS_PH1_ESTABLISHED 0x8013 90#define VPNCTL_STATUS_PH2_START 0x8021 91#define VPNCTL_STATUS_PH2_ESTABLISHED 0x8022 92#define VPNCTL_STATUS_NEED_AUTHINFO 0x8101 93#define VPNCTL_STATUS_NEED_REAUTHINFO 0x8102 94#define VPNCTL_STATUS_PEER_RESP 0x8103 95 96/* 97 * Flags 98 */ 99#define VPNCTL_FLAG_MODECFG_USED 0x0001 100#define VPNCTL_FLAG_IKE_VERSION 0x0002 101#define VPNCTL_FLAG_IKEV2 VPNCTL_FLAG_IKE_VERSION 102 103/* 104 * XAUTH Attribute Types 105 */ 106#ifndef __IPSEC_BUILD__ 107#define XAUTH_TYPE 16520 108#define XAUTH_USER_NAME 16521 109#define XAUTH_USER_PASSWORD 16522 110#define XAUTH_PASSCODE 16523 111#define XAUTH_MESSAGE 16524 112#define XAUTH_CHALLENGE 16525 113#define XAUTH_DOMAIN 16526 114#define XAUTH_STATUS 16527 115#define XAUTH_NEXT_PIN 16528 116#define XAUTH_ANSWER 16529 117 118 119/* Types for XAUTH_TYPE */ 120#define XAUTH_TYPE_GENERIC 0 121#define XAUTH_TYPE_CHAP 1 122#define XAUTH_TYPE_OTP 2 123#define XAUTH_TYPE_SKEY 3 124 125 126/* Mode cfg Attribute types */ 127#define INTERNAL_IP4_ADDRESS 1 128#define INTERNAL_IP4_NETMASK 2 129#define INTERNAL_IP4_DNS 3 130#define INTERNAL_IP4_NBNS 4 131#define INTERNAL_ADDRESS_EXPIRY 5 132#define INTERNAL_IP4_DHCP 6 133#define APPLICATION_VERSION 7 134#define INTERNAL_IP6_ADDRESS 8 135#define INTERNAL_IP6_NETMASK 9 136#define INTERNAL_IP6_DNS 10 137#define INTERNAL_IP6_NBNS 11 138#define INTERNAL_IP6_DHCP 12 139#define INTERNAL_IP4_SUBNET 13 140#define SUPPORTED_ATTRIBUTES 14 141#define INTERNAL_IP6_SUBNET 15 142 143#define UNITY_BANNER 28672 144#define UNITY_SAVE_PASSWD 28673 145#define UNITY_DEF_DOMAIN 28674 146#define UNITY_SPLITDNS_NAME 28675 147#define UNITY_SPLIT_INCLUDE 28676 148#define UNITY_NATT_PORT 28677 149#define UNITY_LOCAL_LAN 28678 150#define UNITY_PFS 28679 151#define UNITY_FW_TYPE 28680 152#define UNITY_BACKUP_SERVERS 28681 153#define UNITY_DDNS_HOSTNAME 28682 154 155/* 3.3 Data Attributes 156 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 157 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 158 !A! Attribute Type ! AF=0 Attribute Length ! 159 !F! ! AF=1 Attribute Value ! 160 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 161 . AF=0 Attribute Value . 162 . AF=1 Not Transmitted . 163 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 164*/ 165struct isakmp_data { 166 u_int16_t type; /* defined by DOI-spec, and Attribute Format */ 167 u_int16_t lorv; /* if f equal 1, Attribute Length */ 168 /* if f equal 0, Attribute Value */ 169 /* if f equal 1, Attribute Value */ 170}; 171#endif 172 173/* commands and status for vpn control. */ 174/* network byte order. */ 175 176/* Packet header */ 177struct vpnctl_hdr { 178 u_int16_t msg_type; 179 u_int16_t flags; 180 u_int32_t cookie; 181 u_int32_t reserved; 182 u_int16_t result; 183 u_int16_t len; /* payload length */ 184}; 185 186/* Packet formats for commands */ 187 188/* bind to receive status for specified address */ 189struct vpnctl_cmd_bind { 190 struct vpnctl_hdr hdr; 191 u_int32_t address; /* 0xFFFFFFFF = all */ 192 u_int16_t vers_len; /* if zero - no version provided */ 193 /* name/version string of length vers_len */ 194}; 195 196/* unbind to stop receiving status for specified address */ 197struct vpnctl_cmd_unbind { 198 struct vpnctl_hdr hdr; 199 u_int32_t address; /* 0xFFFFFFFF = all */ 200}; 201 202 203/* connect to specified address */ 204struct vpnctl_cmd_connect{ 205 struct vpnctl_hdr hdr; 206 u_int32_t address; 207}; 208 209struct vpnctl_sa_selector { 210 u_int32_t src_tunnel_address; 211 u_int32_t src_tunnel_mask; 212 u_int32_t dst_tunnel_address; 213 u_int32_t dst_tunnel_mask; 214 u_int16_t src_tunnel_port; 215 u_int16_t dst_tunnel_port; 216 u_int16_t ul_protocol; 217 u_int16_t reserved; 218}; 219 220struct vpnctl_algo { 221 u_int16_t algo_class; 222 u_int16_t algo; 223 u_int16_t key_len; /* for enc algorithms only */ 224 u_int16_t reserved; 225}; 226 227/* start phase 2 */ 228struct vpnctl_cmd_start_ph2 { 229 struct vpnctl_hdr hdr; 230 u_int32_t address; 231 u_int32_t lifetime; /* seconds */ 232 u_int16_t pfs_group; /* defined in algorithm_types.h */ 233 u_int16_t selector_count; 234 u_int16_t algo_count; 235 u_int16_t reserved; 236 /* array of struct vpnctl_sa_selector */ 237 /* array of struct vpnctl_algo */ 238}; 239 240/* assert connection (after network change) */ 241struct vpnctl_cmd_assert { 242 struct vpnctl_hdr hdr; 243 u_int32_t src_address; 244 u_int32_t dst_address; 245}; 246 247/* set xauth info */ 248struct vpnctl_cmd_xauth_info { 249 struct vpnctl_hdr hdr; 250 u_int32_t address; 251 /* packed array of variable sized struct isakmp_data */ 252}; 253 254/* redirect client to specified address */ 255struct vpnctl_cmd_redirect { 256 struct vpnctl_hdr hdr; 257 u_int32_t address; 258 u_int32_t redirect_address; 259 u_int16_t force; 260}; 261 262/* start dpd */ 263struct vpnctl_cmd_start_dpd { 264 struct vpnctl_hdr hdr; 265 u_int32_t address; 266}; 267 268/* 269 * IKE Notify codes - mirrors codes in isakmp.h 270 */ 271#define VPNCTL_NTYPE_INVALID_PAYLOAD_TYPE 1 272#define VPNCTL_NTYPE_DOI_NOT_SUPPORTED 2 273#define VPNCTL_NTYPE_SITUATION_NOT_SUPPORTED 3 274#define VPNCTL_NTYPE_INVALID_COOKIE 4 275#define VPNCTL_NTYPE_INVALID_MAJOR_VERSION 5 276#define VPNCTL_NTYPE_INVALID_MINOR_VERSION 6 277#define VPNCTL_NTYPE_INVALID_EXCHANGE_TYPE 7 278#define VPNCTL_NTYPE_INVALID_FLAGS 8 279#define VPNCTL_NTYPE_INVALID_MESSAGE_ID 9 280#define VPNCTL_NTYPE_INVALID_PROTOCOL_ID 10 281#define VPNCTL_NTYPE_INVALID_SPI 11 282#define VPNCTL_NTYPE_INVALID_TRANSFORM_ID 12 283#define VPNCTL_NTYPE_ATTRIBUTES_NOT_SUPPORTED 13 284#define VPNCTL_NTYPE_NO_PROPOSAL_CHOSEN 14 285#define VPNCTL_NTYPE_BAD_PROPOSAL_SYNTAX 15 286#define VPNCTL_NTYPE_PAYLOAD_MALFORMED 16 287#define VPNCTL_NTYPE_INVALID_KEY_INFORMATION 17 288#define VPNCTL_NTYPE_INVALID_ID_INFORMATION 18 289#define VPNCTL_NTYPE_INVALID_CERT_ENCODING 19 290#define VPNCTL_NTYPE_INVALID_CERTIFICATE 20 291#define VPNCTL_NTYPE_BAD_CERT_REQUEST_SYNTAX 21 292#define VPNCTL_NTYPE_INVALID_CERT_AUTHORITY 22 293#define VPNCTL_NTYPE_INVALID_HASH_INFORMATION 23 294#define VPNCTL_NTYPE_AUTHENTICATION_FAILED 24 295#define VPNCTL_NTYPE_INVALID_SIGNATURE 25 296#define VPNCTL_NTYPE_ADDRESS_NOTIFICATION 26 297#define VPNCTL_NTYPE_NOTIFY_SA_LIFETIME 27 298#define VPNCTL_NTYPE_CERTIFICATE_UNAVAILABLE 28 299#define VPNCTL_NTYPE_UNSUPPORTED_EXCHANGE_TYPE 29 300#define VPNCTL_NTYPE_UNEQUAL_PAYLOAD_LENGTHS 30 301#define VPNCTL_NTYPE_LOAD_BALANCE 40501 302#define VPNCTL_NTYPE_PEER_DEAD 50001 /* detected by DPD */ 303#define VPNCTL_NTYPE_PH1_DELETE 50002 /* received a delete payload leaving no PH1 SA for the remote address */ 304#define VPNCTL_NTYPE_IDLE_TIMEOUT 50003 305#define VPNCTL_NTYPE_LOCAL_CERT_PREMATURE 50004 /* certificate is premature */ 306#define VPNCTL_NTYPE_LOCAL_CERT_EXPIRED 50005 /* certificate has expired */ 307#define VPNCTL_NTYPE_PEER_CERT_PREMATURE 50006 /* peer's certificate is premature */ 308#define VPNCTL_NTYPE_PEER_CERT_EXPIRED 50007 /* peer's certificate has expired */ 309#define VPNCTL_NTYPE_PEER_CERT_INVALID_SUBJNAME 50008 /* peer's certificate has an invalid subjname */ 310#define VPNCTL_NTYPE_PEER_CERT_INVALID_SUBJALTNAME 50009 /* peer's certificate has an invalid subjaltname */ 311#define VPNCTL_NTYPE_INTERNAL_ERROR -1 312 313 314/* packet format for phase change status */ 315struct vpnctl_status_phase_change { 316 struct vpnctl_hdr hdr; 317 u_int32_t address; 318 /* The following is included when VPNCTL_FLAG_MODECFG_USED flag set */ 319 // struct vpnctl_modecfg_params mode_cfg; 320 321}; 322 323 324/* packet format for auth needed status */ 325struct vpnctl_status_need_authinfo { 326 struct vpnctl_hdr hdr; 327 u_int32_t address; 328 /* packed array of variable sized struct isakmp_data */ 329}; 330 331 332struct split_address { 333 u_int32_t splitaddr; 334 u_int32_t splitmask; 335}; 336 337struct vpnctl_modecfg_params { 338 u_int32_t outer_local_addr; 339 u_int16_t outer_remote_port; 340 u_int16_t outer_local_port; 341 u_int8_t ifname[IFNAMSIZ]; 342 /* 343 * ifname for outer_local_addr (not null terminated) 344 * followed by packed array of attributes (struct isakmp_data) 345 */ 346}; 347 348 349/* Packet formats for failed status */ 350struct vpnctl_status_failed { 351 struct vpnctl_hdr hdr; 352 u_int32_t address; 353 u_int16_t ike_code; 354 u_int16_t from; 355 u_int8_t data[0]; 356}; 357 358struct vpnctl_status_peer_resp { 359 struct vpnctl_hdr hdr; 360 u_int32_t address; 361 u_int16_t ike_code; 362}; 363 364#endif /* _VPN_CONTROL_H */ 365