handler.h revision 1.15
1/* $NetBSD: handler.h,v 1.15 2008/09/19 11:01:08 tteras Exp $ */ 2 3/* Id: handler.h,v 1.19 2006/02/25 08:25:12 manubsd Exp */ 4 5/* 6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. Neither the name of the project nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34#ifndef _HANDLER_H 35#define _HANDLER_H 36 37#include <sys/queue.h> 38#include <openssl/rsa.h> 39 40#include <sys/time.h> 41 42#include "isakmp_var.h" 43#include "oakley.h" 44#include "schedule.h" 45#include "evt.h" 46 47/* Phase 1 handler */ 48/* 49 * main mode: 50 * initiator responder 51 * 0 (---) (---) 52 * 1 start start (1st msg received) 53 * 2 (---) 1st valid msg received 54 * 3 1st msg sent 1st msg sent 55 * 4 1st valid msg received 2st valid msg received 56 * 5 2nd msg sent 2nd msg sent 57 * 6 2nd valid msg received 3rd valid msg received 58 * 7 3rd msg sent 3rd msg sent 59 * 8 3rd valid msg received (---) 60 * 9 SA established SA established 61 * 62 * aggressive mode: 63 * initiator responder 64 * 0 (---) (---) 65 * 1 start start (1st msg received) 66 * 2 (---) 1st valid msg received 67 * 3 1st msg sent 1st msg sent 68 * 4 1st valid msg received 2st valid msg received 69 * 5 (---) (---) 70 * 6 (---) (---) 71 * 7 (---) (---) 72 * 8 (---) (---) 73 * 9 SA established SA established 74 * 75 * base mode: 76 * initiator responder 77 * 0 (---) (---) 78 * 1 start start (1st msg received) 79 * 2 (---) 1st valid msg received 80 * 3 1st msg sent 1st msg sent 81 * 4 1st valid msg received 2st valid msg received 82 * 5 2nd msg sent (---) 83 * 6 (---) (---) 84 * 7 (---) (---) 85 * 8 (---) (---) 86 * 9 SA established SA established 87 */ 88#define PHASE1ST_SPAWN 0 89#define PHASE1ST_START 1 90#define PHASE1ST_MSG1RECEIVED 2 91#define PHASE1ST_MSG1SENT 3 92#define PHASE1ST_MSG2RECEIVED 4 93#define PHASE1ST_MSG2SENT 5 94#define PHASE1ST_MSG3RECEIVED 6 95#define PHASE1ST_MSG3SENT 7 96#define PHASE1ST_MSG4RECEIVED 8 97#define PHASE1ST_ESTABLISHED 9 98#define PHASE1ST_EXPIRED 10 99#define PHASE1ST_MAX 11 100 101/* About address semantics in each case. 102 * initiator(addr=I) responder(addr=R) 103 * src dst src dst 104 * (local) (remote) (local) (remote) 105 * phase 1 handler I R R I 106 * phase 2 handler I R R I 107 * getspi msg R I I R 108 * acquire msg I R 109 * ID payload I R I R 110 */ 111#ifdef ENABLE_HYBRID 112struct isakmp_cfg_state; 113#endif 114struct ph1handle { 115 isakmp_index index; 116 117 int status; /* status of this SA */ 118 int side; /* INITIATOR or RESPONDER */ 119 120 struct sockaddr *remote; /* remote address to negosiate ph1 */ 121 struct sockaddr *local; /* local address to negosiate ph1 */ 122 /* XXX copy from rmconf due to anonymous configuration. 123 * If anonymous will be forbidden, we do delete them. */ 124 125 struct remoteconf *rmconf; /* pointer to remote configuration */ 126 127 struct isakmpsa *approval; /* pointer to SA(s) approved. */ 128 vchar_t *authstr; /* place holder of string for auth. */ 129 /* for example pre-shared key */ 130 131 u_int8_t version; /* ISAKMP version */ 132 u_int8_t etype; /* Exchange type actually for use */ 133 u_int8_t flags; /* Flags */ 134 u_int32_t msgid; /* message id */ 135 136#ifdef ENABLE_NATT 137 struct ph1natt_options *natt_options; /* Selected NAT-T IKE version */ 138 u_int32_t natt_flags; /* NAT-T related flags */ 139#endif 140#ifdef ENABLE_FRAG 141 int frag; /* IKE phase 1 fragmentation */ 142 struct isakmp_frag_item *frag_chain; /* Received fragments */ 143#endif 144 145 struct sched sce; /* schedule for expire */ 146 147 struct sched scr; /* schedule for resend */ 148 int retry_counter; /* for resend. */ 149 vchar_t *sendbuf; /* buffer for re-sending */ 150 151 vchar_t *dhpriv; /* DH; private value */ 152 vchar_t *dhpub; /* DH; public value */ 153 vchar_t *dhpub_p; /* DH; partner's public value */ 154 vchar_t *dhgxy; /* DH; shared secret */ 155 vchar_t *nonce; /* nonce value */ 156 vchar_t *nonce_p; /* partner's nonce value */ 157 vchar_t *skeyid; /* SKEYID */ 158 vchar_t *skeyid_d; /* SKEYID_d */ 159 vchar_t *skeyid_a; /* SKEYID_a, i.e. hash */ 160 vchar_t *skeyid_e; /* SKEYID_e, i.e. encryption */ 161 vchar_t *key; /* cipher key */ 162 vchar_t *hash; /* HASH minus general header */ 163 vchar_t *sig; /* SIG minus general header */ 164 vchar_t *sig_p; /* peer's SIG minus general header */ 165 cert_t *cert; /* CERT minus general header */ 166 cert_t *cert_p; /* peer's CERT minus general header */ 167 cert_t *crl_p; /* peer's CRL minus general header */ 168 cert_t *cr_p; /* peer's CR not including general */ 169 RSA *rsa; /* my RSA key */ 170 RSA *rsa_p; /* peer's RSA key */ 171 struct genlist *rsa_candidates; /* possible candidates for peer's RSA key */ 172 vchar_t *id; /* ID minus gen header */ 173 vchar_t *id_p; /* partner's ID minus general header */ 174 /* i.e. struct ipsecdoi_id_b*. */ 175 struct isakmp_ivm *ivm; /* IVs */ 176 177 vchar_t *sa; /* whole SA payload to send/to be sent*/ 178 /* to calculate HASH */ 179 /* NOT INCLUDING general header. */ 180 181 vchar_t *sa_ret; /* SA payload to reply/to be replyed */ 182 /* NOT INCLUDING general header. */ 183 /* NOTE: Should be release after use. */ 184 185#ifdef HAVE_GSSAPI 186 void *gssapi_state; /* GSS-API specific state. */ 187 /* Allocated when needed */ 188 vchar_t *gi_i; /* optional initiator GSS id */ 189 vchar_t *gi_r; /* optional responder GSS id */ 190#endif 191 192 struct isakmp_pl_hash *pl_hash; /* pointer to hash payload */ 193 194 time_t created; /* timestamp for establish */ 195 int initial_contact_received; /* set if initial contact received */ 196#ifdef ENABLE_STATS 197 struct timeval start; 198 struct timeval end; 199#endif 200 201#ifdef ENABLE_DPD 202 int dpd_support; /* Does remote supports DPD ? */ 203 time_t dpd_lastack; /* Last ack received */ 204 u_int16_t dpd_seq; /* DPD seq number to receive */ 205 u_int8_t dpd_fails; /* number of failures */ 206 struct sched dpd_r_u; 207#endif 208 209 u_int32_t msgid2; /* msgid counter for Phase 2 */ 210 int ph2cnt; /* the number which is negotiated by this phase 1 */ 211 LIST_HEAD(_ph2ofph1_, ph2handle) ph2tree; 212 213 LIST_ENTRY(ph1handle) chain; 214#ifdef ENABLE_HYBRID 215 struct isakmp_cfg_state *mode_cfg; /* ISAKMP mode config state */ 216#endif 217 EVT_LISTENER_LIST(evt_listeners); 218}; 219 220/* Phase 2 handler */ 221/* allocated per a SA or SA bundles of a pair of peer's IP addresses. */ 222/* 223 * initiator responder 224 * 0 (---) (---) 225 * 1 start start (1st msg received) 226 * 2 acquire msg get 1st valid msg received 227 * 3 getspi request sent getspi request sent 228 * 4 getspi done getspi done 229 * 5 1st msg sent 1st msg sent 230 * 6 1st valid msg received 2nd valid msg received 231 * 7 (commit bit) (commit bit) 232 * 8 SAs added SAs added 233 * 9 SAs established SAs established 234 * 10 SAs expired SAs expired 235 */ 236#define PHASE2ST_SPAWN 0 237#define PHASE2ST_START 1 238#define PHASE2ST_STATUS2 2 239#define PHASE2ST_GETSPISENT 3 240#define PHASE2ST_GETSPIDONE 4 241#define PHASE2ST_MSG1SENT 5 242#define PHASE2ST_STATUS6 6 243#define PHASE2ST_COMMIT 7 244#define PHASE2ST_ADDSA 8 245#define PHASE2ST_ESTABLISHED 9 246#define PHASE2ST_EXPIRED 10 247#define PHASE2ST_MAX 11 248 249struct ph2handle { 250 struct sockaddr *src; /* my address of SA. */ 251 struct sockaddr *dst; /* peer's address of SA. */ 252 253 /* 254 * copy ip address from ID payloads when ID type is ip address. 255 * In other case, they must be null. 256 */ 257 struct sockaddr *src_id; 258 struct sockaddr *dst_id; 259#ifdef ENABLE_NATT 260 struct sockaddr *natoa_src; /* peer's view of my address */ 261 struct sockaddr *natoa_dst; /* peer's view of his address */ 262#endif 263 264 u_int32_t spid; /* policy id by kernel */ 265 266 int status; /* ipsec sa status */ 267 u_int8_t side; /* INITIATOR or RESPONDER */ 268 269 struct sched sce; /* schedule for expire */ 270 struct sched scr; /* schedule for resend */ 271 int retry_counter; /* for resend. */ 272 vchar_t *sendbuf; /* buffer for re-sending */ 273 vchar_t *msg1; /* buffer for re-sending */ 274 /* used for responder's first message */ 275 276 int retry_checkph1; /* counter to wait phase 1 finished. */ 277 /* NOTE: actually it's timer. */ 278 279 u_int32_t seq; /* sequence number used by PF_KEY */ 280 /* 281 * NOTE: In responder side, we can't identify each SAs 282 * with same destination address for example, when 283 * socket based SA is required. So we set a identifier 284 * number to "seq", and sent kernel by pfkey. 285 */ 286 u_int8_t satype; /* satype in PF_KEY */ 287 /* 288 * saved satype in the original PF_KEY request from 289 * the kernel in order to reply a error. 290 */ 291 292 u_int8_t flags; /* Flags for phase 2 */ 293 u_int32_t msgid; /* msgid for phase 2 */ 294 295 struct sainfo *sainfo; /* place holder of sainfo */ 296 struct saprop *proposal; /* SA(s) proposal. */ 297 struct saprop *approval; /* SA(s) approved. */ 298 u_int32_t lifetime_secs; /* responder lifetime (seconds) */ 299 u_int32_t lifetime_kb; /* responder lifetime (kbytes) */ 300 caddr_t spidx_gen; /* policy from peer's proposal */ 301 302 struct dhgroup *pfsgrp; /* DH; prime number */ 303 vchar_t *dhpriv; /* DH; private value */ 304 vchar_t *dhpub; /* DH; public value */ 305 vchar_t *dhpub_p; /* DH; partner's public value */ 306 vchar_t *dhgxy; /* DH; shared secret */ 307 vchar_t *id; /* ID minus gen header */ 308 vchar_t *id_p; /* peer's ID minus general header */ 309 vchar_t *nonce; /* nonce value in phase 2 */ 310 vchar_t *nonce_p; /* partner's nonce value in phase 2 */ 311 312 vchar_t *sa; /* whole SA payload to send/to be sent*/ 313 /* to calculate HASH */ 314 /* NOT INCLUDING general header. */ 315 316 vchar_t *sa_ret; /* SA payload to reply/to be replyed */ 317 /* NOT INCLUDING general header. */ 318 /* NOTE: Should be release after use. */ 319 320 struct isakmp_ivm *ivm; /* IVs */ 321 322 int generated_spidx; /* mark handlers whith generated policy */ 323 324#ifdef ENABLE_STATS 325 struct timeval start; 326 struct timeval end; 327#endif 328 struct ph1handle *ph1; /* back pointer to isakmp status */ 329 330 LIST_ENTRY(ph2handle) chain; 331 LIST_ENTRY(ph2handle) ph1bind; /* chain to ph1handle */ 332 EVT_LISTENER_LIST(evt_listeners); 333}; 334 335/* 336 * for handling initial contact. 337 */ 338struct contacted { 339 struct sockaddr *remote; /* remote address to negosiate ph1 */ 340 LIST_ENTRY(contacted) chain; 341}; 342 343/* 344 * for checking a packet retransmited. 345 */ 346struct recvdpkt { 347 struct sockaddr *remote; /* the remote address */ 348 struct sockaddr *local; /* the local address */ 349 vchar_t *hash; /* hash of the received packet */ 350 vchar_t *sendbuf; /* buffer for the response */ 351 int retry_counter; /* how many times to send */ 352 time_t time_send; /* timestamp to send a packet */ 353 time_t created; /* timestamp to create a queue */ 354 355 LIST_ENTRY(recvdpkt) chain; 356}; 357 358/* for parsing ISAKMP header. */ 359struct isakmp_parse_t { 360 u_char type; /* payload type of mine */ 361 int len; /* ntohs(ptr->len) */ 362 struct isakmp_gen *ptr; 363}; 364 365/* 366 * for IV management. 367 * 368 * - normal case 369 * initiator responder 370 * ------------------------- -------------------------- 371 * initialize iv(A), ive(A). initialize iv(A), ive(A). 372 * encode by ive(A). 373 * save to iv(B). ---[packet(B)]--> save to ive(B). 374 * decode by iv(A). 375 * packet consistency. 376 * sync iv(B) with ive(B). 377 * check auth, integrity. 378 * encode by ive(B). 379 * save to ive(C). <--[packet(C)]--- save to iv(C). 380 * decoded by iv(B). 381 * : 382 * 383 * - In the case that a error is found while cipher processing, 384 * initiator responder 385 * ------------------------- -------------------------- 386 * initialize iv(A), ive(A). initialize iv(A), ive(A). 387 * encode by ive(A). 388 * save to iv(B). ---[packet(B)]--> save to ive(B). 389 * decode by iv(A). 390 * packet consistency. 391 * sync iv(B) with ive(B). 392 * check auth, integrity. 393 * error found. 394 * create notify. 395 * get ive2(X) from iv(B). 396 * encode by ive2(X). 397 * get iv2(X) from iv(B). <--[packet(Y)]--- save to iv2(Y). 398 * save to ive2(Y). 399 * decoded by iv2(X). 400 * : 401 * 402 * The reason why the responder synchronizes iv with ive after checking the 403 * packet consistency is that it is required to leave the IV for decoding 404 * packet. Because there is a potential of error while checking the packet 405 * consistency. Also the reason why that is before authentication and 406 * integirty check is that the IV for informational exchange has to be made 407 * by the IV which is after packet decoded and checking the packet consistency. 408 * Otherwise IV mismatched happens between the intitiator and the responder. 409 */ 410struct isakmp_ivm { 411 vchar_t *iv; /* for decoding packet */ 412 /* if phase 1, it's for computing phase2 iv */ 413 vchar_t *ive; /* for encoding packet */ 414}; 415 416/* for dumping */ 417struct ph1dump { 418 isakmp_index index; 419 int status; 420 int side; 421 struct sockaddr_storage remote; 422 struct sockaddr_storage local; 423 u_int8_t version; 424 u_int8_t etype; 425 time_t created; 426 int ph2cnt; 427}; 428 429struct sockaddr; 430struct ph1handle; 431struct ph2handle; 432struct policyindex; 433 434extern struct ph1handle *getph1byindex __P((isakmp_index *)); 435extern struct ph1handle *getph1byindex0 __P((isakmp_index *)); 436extern struct ph1handle *getph1byaddr __P((struct sockaddr *, 437 struct sockaddr *, int)); 438extern struct ph1handle *getph1byaddrwop __P((struct sockaddr *, 439 struct sockaddr *)); 440extern struct ph1handle *getph1bydstaddrwop __P((struct sockaddr *)); 441#ifdef ENABLE_HYBRID 442struct ph1handle *getph1bylogin __P((char *)); 443int purgeph1bylogin __P((char *)); 444#endif 445extern vchar_t *dumpph1 __P((void)); 446extern struct ph1handle *newph1 __P((void)); 447extern void delph1 __P((struct ph1handle *)); 448extern int insph1 __P((struct ph1handle *)); 449extern void remph1 __P((struct ph1handle *)); 450extern void flushph1 __P((void)); 451extern void initph1tree __P((void)); 452 453extern struct ph2handle *getph2byspidx __P((struct policyindex *)); 454extern struct ph2handle *getph2byspid __P((u_int32_t)); 455extern struct ph2handle *getph2byseq __P((u_int32_t)); 456extern struct ph2handle *getph2bysaddr __P((struct sockaddr *, 457 struct sockaddr *)); 458extern struct ph2handle *getph2bymsgid __P((struct ph1handle *, u_int32_t)); 459extern struct ph2handle *getph2byid __P((struct sockaddr *, 460 struct sockaddr *, u_int32_t)); 461extern struct ph2handle *getph2bysaidx __P((struct sockaddr *, 462 struct sockaddr *, u_int, u_int32_t)); 463extern struct ph2handle *newph2 __P((void)); 464extern void initph2 __P((struct ph2handle *)); 465extern void delph2 __P((struct ph2handle *)); 466extern int insph2 __P((struct ph2handle *)); 467extern void remph2 __P((struct ph2handle *)); 468extern void flushph2 __P((void)); 469extern void deleteallph2 __P((struct sockaddr *, struct sockaddr *, u_int)); 470extern void initph2tree __P((void)); 471 472extern void bindph12 __P((struct ph1handle *, struct ph2handle *)); 473extern void unbindph12 __P((struct ph2handle *)); 474 475extern struct contacted *getcontacted __P((struct sockaddr *)); 476extern int inscontacted __P((struct sockaddr *)); 477extern void initctdtree __P((void)); 478 479extern int check_recvdpkt __P((struct sockaddr *, 480 struct sockaddr *, vchar_t *)); 481extern int add_recvdpkt __P((struct sockaddr *, struct sockaddr *, 482 vchar_t *, vchar_t *)); 483extern void init_recvdpkt __P((void)); 484 485#ifdef ENABLE_HYBRID 486extern int exclude_cfg_addr __P((const struct sockaddr *)); 487#endif 488 489extern int revalidate_ph12(void); 490 491#endif /* _HANDLER_H */ 492