handler.h revision 1.25 
1/*	$NetBSD: handler.h,v 1.25 2010/11/17 10:40:41 tteras Exp $	*/
2
3/* Id: handler.h,v 1.19 2006/02/25 08:25:12 manubsd Exp */
4
5/*
6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 *    notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 *    notice, this list of conditions and the following disclaimer in the
16 *    documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the project nor the names of its contributors
18 *    may be used to endorse or promote products derived from this software
19 *    without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34#ifndef _HANDLER_H
35#define _HANDLER_H
36
37#include <sys/queue.h>
38#include <openssl/rsa.h>
39
40#include <sys/time.h>
41
42#include "isakmp_var.h"
43#include "oakley.h"
44#include "schedule.h"
45#include "evt.h"
46
47/* Phase 1 handler */
48/*
49 * main mode:
50 *      initiator               responder
51 *  0   (---)                   (---)
52 *  1   start                   start (1st msg received)
53 *  2   (---)                   1st valid msg received
54 *  3   1st msg sent	        1st msg sent
55 *  4   1st valid msg received  2st valid msg received
56 *  5   2nd msg sent            2nd msg sent
57 *  6   2nd valid msg received  3rd valid msg received
58 *  7   3rd msg sent            3rd msg sent
59 *  8   3rd valid msg received  (---)
60 *  9   SA established          SA established
61 *
62 * aggressive mode:
63 *      initiator               responder
64 *  0   (---)                   (---)
65 *  1   start                   start (1st msg received)
66 *  2   (---)                   1st valid msg received
67 *  3   1st msg sent	        1st msg sent
68 *  4   1st valid msg received  2st valid msg received
69 *  5   (---)                   (---)
70 *  6   (---)                   (---)
71 *  7   (---)                   (---)
72 *  8   (---)                   (---)
73 *  9   SA established          SA established
74 *
75 * base mode:
76 *      initiator               responder
77 *  0   (---)                   (---)
78 *  1   start                   start (1st msg received)
79 *  2   (---)                   1st valid msg received
80 *  3   1st msg sent	        1st msg sent
81 *  4   1st valid msg received  2st valid msg received
82 *  5   2nd msg sent            (---)
83 *  6   (---)                   (---)
84 *  7   (---)                   (---)
85 *  8   (---)                   (---)
86 *  9   SA established          SA established
87 */
88#define PHASE1ST_SPAWN			0
89#define PHASE1ST_START			1
90#define PHASE1ST_MSG1RECEIVED		2
91#define PHASE1ST_MSG1SENT		3
92#define PHASE1ST_MSG2RECEIVED		4
93#define PHASE1ST_MSG2SENT		5
94#define PHASE1ST_MSG3RECEIVED		6
95#define PHASE1ST_MSG3SENT		7
96#define PHASE1ST_MSG4RECEIVED		8
97#define PHASE1ST_ESTABLISHED		9
98#define PHASE1ST_DYING			10
99#define PHASE1ST_EXPIRED		11
100#define PHASE1ST_MAX			12
101
102/* About address semantics in each case.
103 *			initiator(addr=I)	responder(addr=R)
104 *			src	dst		src	dst
105 *			(local)	(remote)	(local)	(remote)
106 * phase 1 handler	I	R		R	I
107 * phase 2 handler	I	R		R	I
108 * getspi msg		R	I		I	R
109 * acquire msg		I	R
110 * ID payload		I	R		I	R
111 */
112#ifdef ENABLE_HYBRID
113struct isakmp_cfg_state;
114#endif
115struct ph1handle {
116	isakmp_index index;
117
118	int status;			/* status of this SA */
119	int side;			/* INITIATOR or RESPONDER */
120
121	struct sockaddr *remote;	/* remote address to negosiate ph1 */
122	struct sockaddr *local;		/* local address to negosiate ph1 */
123			/* XXX copy from rmconf due to anonymous configuration.
124			 * If anonymous will be forbidden, we do delete them. */
125
126	struct remoteconf *rmconf;	/* pointer to remote configuration */
127
128	struct isakmpsa *approval;	/* pointer to SA(s) approved. */
129	vchar_t *authstr;		/* place holder of string for auth. */
130					/* for example pre-shared key */
131
132	u_int8_t version;		/* ISAKMP version */
133	u_int8_t etype;			/* Exchange type actually for use */
134	u_int8_t flags;			/* Flags */
135	u_int32_t msgid;		/* message id */
136
137	u_int32_t vendorid_mask;	/* bitmask of received supported vendor ids*/
138#ifdef ENABLE_NATT
139	struct ph1natt_options *natt_options;	/* Selected NAT-T IKE version */
140	u_int32_t natt_flags;		/* NAT-T related flags */
141#endif
142#ifdef ENABLE_FRAG
143	int frag;			/* IKE phase 1 fragmentation */
144	struct isakmp_frag_item *frag_chain;	/* Received fragments */
145#endif
146
147	struct sched sce;		/* schedule for expire */
148
149	struct sched scr;		/* schedule for resend */
150	int retry_counter;		/* for resend. */
151	vchar_t *sendbuf;		/* buffer for re-sending */
152
153	vchar_t *dhpriv;		/* DH; private value */
154	vchar_t *dhpub;			/* DH; public value */
155	vchar_t *dhpub_p;		/* DH; partner's public value */
156	vchar_t *dhgxy;			/* DH; shared secret */
157	vchar_t *nonce;			/* nonce value */
158	vchar_t *nonce_p;		/* partner's nonce value */
159	vchar_t *skeyid;		/* SKEYID */
160	vchar_t *skeyid_d;		/* SKEYID_d */
161	vchar_t *skeyid_a;		/* SKEYID_a, i.e. hash */
162	vchar_t *skeyid_e;		/* SKEYID_e, i.e. encryption */
163	vchar_t *key;			/* cipher key */
164	vchar_t *hash;			/* HASH minus general header */
165	vchar_t *sig;			/* SIG minus general header */
166	vchar_t *sig_p;			/* peer's SIG minus general header */
167	vchar_t *cert;			/* CERT minus general header */
168	vchar_t *cert_p;		/* peer's CERT minus general header */
169	vchar_t *crl_p;			/* peer's CRL minus general header */
170	vchar_t *cr_p;			/* peer's CR not including general */
171	RSA *rsa;			/* my RSA key */
172	RSA *rsa_p;			/* peer's RSA key */
173	struct genlist *rsa_candidates;	/* possible candidates for peer's RSA key */
174	vchar_t *id;			/* ID minus gen header */
175	vchar_t *id_p;			/* partner's ID minus general header */
176					/* i.e. struct ipsecdoi_id_b*. */
177	struct isakmp_ivm *ivm;		/* IVs */
178
179	vchar_t *sa;			/* whole SA payload to send/to be sent*/
180					/* to calculate HASH */
181					/* NOT INCLUDING general header. */
182
183	vchar_t *sa_ret;		/* SA payload to reply/to be replyed */
184					/* NOT INCLUDING general header. */
185					/* NOTE: Should be release after use. */
186
187#ifdef HAVE_GSSAPI
188	void *gssapi_state;		/* GSS-API specific state. */
189					/* Allocated when needed */
190	vchar_t *gi_i;			/* optional initiator GSS id */
191	vchar_t *gi_r;			/* optional responder GSS id */
192#endif
193
194	struct isakmp_pl_hash *pl_hash;	/* pointer to hash payload */
195
196	time_t created;			/* timestamp for establish */
197	int initial_contact_received;	/* set if initial contact received */
198#ifdef ENABLE_STATS
199	struct timeval start;
200	struct timeval end;
201#endif
202
203#ifdef ENABLE_DPD
204	int		dpd_support;	/* Does remote supports DPD ? */
205	u_int32_t	dpd_last_ack;
206	u_int32_t	dpd_seq;		/* DPD seq number to receive */
207	u_int8_t	dpd_fails;		/* number of failures */
208	struct sched	dpd_r_u;
209#endif
210
211	u_int32_t msgid2;		/* msgid counter for Phase 2 */
212	int ph2cnt;	/* the number which is negotiated by this phase 1 */
213	LIST_HEAD(_ph2ofph1_, ph2handle) ph2tree;
214
215	LIST_ENTRY(ph1handle) chain;
216#ifdef ENABLE_HYBRID
217	struct isakmp_cfg_state *mode_cfg;	/* ISAKMP mode config state */
218#endif
219	EVT_LISTENER_LIST(evt_listeners);
220};
221
222/* For limiting enumeration of ph1 tree */
223struct ph1selector {
224	struct sockaddr *local;
225	struct sockaddr *remote;
226};
227
228/* Phase 2 handler */
229/* allocated per a SA or SA bundles of a pair of peer's IP addresses. */
230/*
231 *      initiator               responder
232 *  0   (---)                   (---)
233 *  1   start                   start (1st msg received)
234 *  2   acquire msg get         1st valid msg received
235 *  3   getspi request sent     getspi request sent
236 *  4   getspi done             getspi done
237 *  5   1st msg sent            1st msg sent
238 *  6   1st valid msg received  2nd valid msg received
239 *  7   (commit bit)            (commit bit)
240 *  8   SAs added               SAs added
241 *  9   SAs established         SAs established
242 * 10   SAs expired             SAs expired
243 */
244#define PHASE2ST_SPAWN		0
245#define PHASE2ST_START		1
246#define PHASE2ST_STATUS2	2
247#define PHASE2ST_GETSPISENT	3
248#define PHASE2ST_GETSPIDONE	4
249#define PHASE2ST_MSG1SENT	5
250#define PHASE2ST_STATUS6	6
251#define PHASE2ST_COMMIT		7
252#define PHASE2ST_ADDSA		8
253#define PHASE2ST_ESTABLISHED	9
254#define PHASE2ST_EXPIRED	10
255#define PHASE2ST_MAX		11
256
257struct ph2handle {
258	/* source and destination addresses used for IKE exchange. Might
259	 * differ from source and destination of SA. On the initiator,
260	 * they are tweaked if a hint is available in the SPD (set by
261	 * MIGRATE for instance). Otherwise they are the source and
262	 * destination of SA for transport mode and the tunnel endpoints
263	 * for tunnel mode */
264	struct sockaddr *src;
265	struct sockaddr *dst;
266
267	/* source and destination addresses of the SA in the case addresses
268	 * used for IKE exchanges (src and dst) do differ. On the initiator,
269	 * they are set (if needed) in pk_recvacquire(). On the responder,
270	 * they are _derived_ from the local and remote parameters of the
271	 * SP, if available. */
272	struct sockaddr *sa_src;
273	struct sockaddr *sa_dst;
274
275	/* Store our Phase 2 ID and the peer ID (ID minus general header).
276	 * On the initiator, they are set during ACQUIRE processing.
277	 * On the responder, they are set from the content of ID payload
278	 * in quick_r1recv(). Then, if they are of type address or
279	 * tunnel, they are compared to sainfo selectors.
280	 */
281	vchar_t *id;			/* ID minus gen header */
282	vchar_t *id_p;			/* peer's ID minus general header */
283
284#ifdef ENABLE_NATT
285	struct sockaddr *natoa_src;	/* peer's view of my address */
286	struct sockaddr *natoa_dst;	/* peer's view of his address */
287#endif
288
289	u_int32_t spid;			/* policy id by kernel */
290
291	int status;			/* ipsec sa status */
292	u_int8_t side;			/* INITIATOR or RESPONDER */
293
294	struct sched sce;		/* schedule for expire */
295	struct sched scr;		/* schedule for resend */
296	int retry_counter;		/* for resend. */
297	vchar_t *sendbuf;		/* buffer for re-sending */
298	vchar_t *msg1;			/* buffer for re-sending */
299				/* used for responder's first message */
300
301	int retry_checkph1;		/* counter to wait phase 1 finished. */
302					/* NOTE: actually it's timer. */
303
304	u_int32_t seq;			/* sequence number used by PF_KEY */
305			/*
306			 * NOTE: In responder side, we can't identify each SAs
307			 * with same destination address for example, when
308			 * socket based SA is required.  So we set a identifier
309			 * number to "seq", and sent kernel by pfkey.
310			 */
311	u_int8_t satype;		/* satype in PF_KEY */
312			/*
313			 * saved satype in the original PF_KEY request from
314			 * the kernel in order to reply a error.
315			 */
316
317	u_int8_t flags;			/* Flags for phase 2 */
318	u_int32_t msgid;		/* msgid for phase 2 */
319
320	struct sainfo *sainfo;		/* place holder of sainfo */
321	struct saprop *proposal;	/* SA(s) proposal. */
322	struct saprop *approval;	/* SA(s) approved. */
323	u_int32_t lifetime_secs;	/* responder lifetime (seconds) */
324	u_int32_t lifetime_kb;		/* responder lifetime (kbytes) */
325	caddr_t spidx_gen;		/* policy from peer's proposal */
326
327	struct dhgroup *pfsgrp;		/* DH; prime number */
328	vchar_t *dhpriv;		/* DH; private value */
329	vchar_t *dhpub;			/* DH; public value */
330	vchar_t *dhpub_p;		/* DH; partner's public value */
331	vchar_t *dhgxy;			/* DH; shared secret */
332	vchar_t *nonce;			/* nonce value in phase 2 */
333	vchar_t *nonce_p;		/* partner's nonce value in phase 2 */
334
335	vchar_t *sa;			/* whole SA payload to send/to be sent*/
336					/* to calculate HASH */
337					/* NOT INCLUDING general header. */
338
339	vchar_t *sa_ret;		/* SA payload to reply/to be replyed */
340					/* NOT INCLUDING general header. */
341					/* NOTE: Should be release after use. */
342
343	struct isakmp_ivm *ivm;		/* IVs */
344
345	int generated_spidx;	/* mark handlers whith generated policy */
346
347#ifdef ENABLE_STATS
348	struct timeval start;
349	struct timeval end;
350#endif
351	struct ph1handle *ph1;	/* back pointer to isakmp status */
352
353	LIST_ENTRY(ph2handle) chain;
354	LIST_ENTRY(ph2handle) ph1bind;	/* chain to ph1handle */
355	EVT_LISTENER_LIST(evt_listeners);
356};
357
358/* For limiting enumeration of ph2 tree */
359struct ph2selector {
360	u_int32_t spid;
361	struct sockaddr *src;
362	struct sockaddr *dst;
363};
364
365/*
366 * for handling initial contact.
367 */
368struct contacted {
369	struct sockaddr *remote;	/* remote address to negosiate ph1 */
370	LIST_ENTRY(contacted) chain;
371};
372
373/*
374 * for checking a packet retransmited.
375 */
376struct recvdpkt {
377	struct sockaddr *remote;	/* the remote address */
378	struct sockaddr *local;		/* the local address */
379	vchar_t *hash;			/* hash of the received packet */
380	vchar_t *sendbuf;		/* buffer for the response */
381	int retry_counter;		/* how many times to send */
382	struct timeval time_send;	/* timestamp of previous send */
383
384	LIST_ENTRY(recvdpkt) chain;
385};
386
387/* for parsing ISAKMP header. */
388struct isakmp_parse_t {
389	u_char type;		/* payload type of mine */
390	int len;		/* ntohs(ptr->len) */
391	struct isakmp_gen *ptr;
392};
393
394/*
395 * for IV management.
396 *
397 * - normal case
398 * initiator                                     responder
399 * -------------------------                     --------------------------
400 * initialize iv(A), ive(A).                     initialize iv(A), ive(A).
401 * encode by ive(A).
402 * save to iv(B).            ---[packet(B)]-->   save to ive(B).
403 *                                               decode by iv(A).
404 *                                               packet consistency.
405 *                                               sync iv(B) with ive(B).
406 *                                               check auth, integrity.
407 *                                               encode by ive(B).
408 * save to ive(C).          <--[packet(C)]---    save to iv(C).
409 * decoded by iv(B).
410 *      :
411 *
412 * - In the case that a error is found while cipher processing,
413 * initiator                                     responder
414 * -------------------------                     --------------------------
415 * initialize iv(A), ive(A).                     initialize iv(A), ive(A).
416 * encode by ive(A).
417 * save to iv(B).            ---[packet(B)]-->   save to ive(B).
418 *                                               decode by iv(A).
419 *                                               packet consistency.
420 *                                               sync iv(B) with ive(B).
421 *                                               check auth, integrity.
422 *                                               error found.
423 *                                               create notify.
424 *                                               get ive2(X) from iv(B).
425 *                                               encode by ive2(X).
426 * get iv2(X) from iv(B).   <--[packet(Y)]---    save to iv2(Y).
427 * save to ive2(Y).
428 * decoded by iv2(X).
429 *      :
430 *
431 * The reason why the responder synchronizes iv with ive after checking the
432 * packet consistency is that it is required to leave the IV for decoding
433 * packet.  Because there is a potential of error while checking the packet
434 * consistency.  Also the reason why that is before authentication and
435 * integirty check is that the IV for informational exchange has to be made
436 * by the IV which is after packet decoded and checking the packet consistency.
437 * Otherwise IV mismatched happens between the intitiator and the responder.
438 */
439struct isakmp_ivm {
440	vchar_t *iv;	/* for decoding packet */
441			/* if phase 1, it's for computing phase2 iv */
442	vchar_t *ive;	/* for encoding packet */
443};
444
445/* for dumping */
446struct ph1dump {
447	isakmp_index index;
448	int status;
449	int side;
450	struct sockaddr_storage remote;
451	struct sockaddr_storage local;
452	u_int8_t version;
453	u_int8_t etype;
454	time_t created;
455	int ph2cnt;
456};
457
458struct sockaddr;
459struct ph1handle;
460struct ph2handle;
461struct policyindex;
462
463extern struct ph1handle *getph1byindex __P((isakmp_index *));
464extern struct ph1handle *getph1byindex0 __P((isakmp_index *));
465
466extern int enumph1 __P((struct ph1selector *ph1sel,
467			int (* enum_func)(struct ph1handle *iph1, void *arg),
468			void *enum_arg));
469
470#define GETPH1_F_ESTABLISHED		0x0001
471
472extern struct ph1handle *getph1 __P((struct ph1handle *ph1hint,
473				     struct sockaddr *local,
474				     struct sockaddr *remote,
475				     int flags));
476
477#define getph1byaddr(local, remote, est) \
478	getph1(NULL, local, remote, est ? GETPH1_F_ESTABLISHED : 0)
479#define getph1bydstaddr(remote) \
480	getph1(NULL, NULL, remote, 0)
481
482#ifdef ENABLE_HYBRID
483struct ph1handle *getph1bylogin __P((char *));
484int purgeph1bylogin __P((char *));
485#endif
486extern void migrate_ph12 __P((struct ph1handle *old_iph1, struct ph1handle *new_iph1));
487extern void migrate_dying_ph12 __P((struct ph1handle *iph1));
488extern vchar_t *dumpph1 __P((void));
489extern struct ph1handle *newph1 __P((void));
490extern void delph1 __P((struct ph1handle *));
491extern int insph1 __P((struct ph1handle *));
492extern void remph1 __P((struct ph1handle *));
493extern int resolveph1rmconf __P((struct ph1handle *));
494extern void flushph1 __P((void));
495extern void initph1tree __P((void));
496extern int ph1_rekey_enabled __P((struct ph1handle *));
497
498extern int enumph2 __P((struct ph2selector *ph2sel,
499			int (* enum_func)(struct ph2handle *iph2, void *arg),
500			void *enum_arg));
501extern struct ph2handle *getph2byseq __P((u_int32_t));
502extern struct ph2handle *getph2bysaddr __P((struct sockaddr *,
503	struct sockaddr *));
504extern struct ph2handle *getph2bymsgid __P((struct ph1handle *, u_int32_t));
505extern struct ph2handle *getph2byid __P((struct sockaddr *,
506	struct sockaddr *, u_int32_t));
507extern struct ph2handle *getph2bysaidx __P((struct sockaddr *,
508	struct sockaddr *, u_int, u_int32_t));
509extern struct ph2handle *newph2 __P((void));
510extern void initph2 __P((struct ph2handle *));
511extern void delph2 __P((struct ph2handle *));
512extern int insph2 __P((struct ph2handle *));
513extern void remph2 __P((struct ph2handle *));
514extern void flushph2 __P((void));
515extern void deleteallph2 __P((struct sockaddr *, struct sockaddr *, u_int));
516extern void initph2tree __P((void));
517
518extern void bindph12 __P((struct ph1handle *, struct ph2handle *));
519extern void unbindph12 __P((struct ph2handle *));
520
521extern struct contacted *getcontacted __P((struct sockaddr *));
522extern int inscontacted __P((struct sockaddr *));
523extern void remcontacted __P((struct sockaddr *));
524extern void initctdtree __P((void));
525
526extern int check_recvdpkt __P((struct sockaddr *,
527	struct sockaddr *, vchar_t *));
528extern int add_recvdpkt __P((struct sockaddr *, struct sockaddr *,
529	vchar_t *, vchar_t *));
530extern void init_recvdpkt __P((void));
531
532#ifdef ENABLE_HYBRID
533extern int exclude_cfg_addr __P((const struct sockaddr *));
534#endif
535
536extern int revalidate_ph12(void);
537
538#endif /* _HANDLER_H */
539