1/* $KAME: handler.h,v 1.43 2001/12/13 17:13:02 sakane Exp $ */ 2 3/* 4 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the project nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32/* Phase 1 handler */ 33/* 34 * main mode: 35 * initiator responder 36 * 0 (---) (---) 37 * 1 start start (1st msg received) 38 * 2 (---) 1st valid msg received 39 * 3 1st msg sent 1st msg sent 40 * 4 1st valid msg received 2st valid msg received 41 * 5 2nd msg sent 2nd msg sent 42 * 6 2nd valid msg received 3rd valid msg received 43 * 7 3rd msg sent 3rd msg sent 44 * 8 3rd valid msg received (---) 45 * 9 SA established SA established 46 * 47 * aggressive mode: 48 * initiator responder 49 * 0 (---) (---) 50 * 1 start start (1st msg received) 51 * 2 (---) 1st valid msg received 52 * 3 1st msg sent 1st msg sent 53 * 4 1st valid msg received 2st valid msg received 54 * 5 (---) (---) 55 * 6 (---) (---) 56 * 7 (---) (---) 57 * 8 (---) (---) 58 * 9 SA established SA established 59 * 60 * base mode: 61 * initiator responder 62 * 0 (---) (---) 63 * 1 start start (1st msg received) 64 * 2 (---) 1st valid msg received 65 * 3 1st msg sent 1st msg sent 66 * 4 1st valid msg received 2st valid msg received 67 * 5 2nd msg sent (---) 68 * 6 (---) (---) 69 * 7 (---) (---) 70 * 8 (---) (---) 71 * 9 SA established SA established 72 */ 73#define PHASE1ST_SPAWN 0 74#define PHASE1ST_START 1 75#define PHASE1ST_MSG1RECEIVED 2 76#define PHASE1ST_MSG1SENT 3 77#define PHASE1ST_MSG2RECEIVED 4 78#define PHASE1ST_MSG2SENT 5 79#define PHASE1ST_MSG3RECEIVED 6 80#define PHASE1ST_MSG3SENT 7 81#define PHASE1ST_MSG4RECEIVED 8 82#define PHASE1ST_ESTABLISHED 9 83#define PHASE1ST_EXPIRED 10 84#define PHASE1ST_MAX 11 85 86/* About address semantics in each case. 87 * initiator(addr=I) responder(addr=R) 88 * src dst src dst 89 * (local) (remote) (local) (remote) 90 * phase 1 handler I R R I 91 * phase 2 handler I R R I 92 * getspi msg R I I R 93 * aquire msg I R 94 * ID payload I R I R 95 */ 96struct ph1handle { 97 isakmp_index index; 98 99 int status; /* status of this SA */ 100 int side; /* INITIATOR or RESPONDER */ 101 102 struct sockaddr *remote; /* remote address to negosiate ph1 */ 103 struct sockaddr *local; /* local address to negosiate ph1 */ 104 105 struct remoteconf *rmconf; /* pointer to remote configuration */ 106 107 struct isakmpsa *approval; /* pointer to SA(s) approved. */ 108 vchar_t *authstr; /* place holder of string for auth. */ 109 /* for example pre-shared key */ 110 111 u_int8_t version; /* ISAKMP version */ 112 u_int8_t etype; /* Exchange type actually for use */ 113 u_int8_t flags; /* Flags */ 114 u_int32_t msgid; /* message id */ 115 116 struct sched *sce; /* schedule for expire */ 117 118 struct sched *scr; /* schedule for resend */ 119 int retry_counter; /* for resend. */ 120 vchar_t *sendbuf; /* buffer for re-sending */ 121 122 vchar_t *dhpriv; /* DH; private value */ 123 vchar_t *dhpub; /* DH; public value */ 124 vchar_t *dhpub_p; /* DH; partner's public value */ 125 vchar_t *dhgxy; /* DH; shared secret */ 126 vchar_t *nonce; /* nonce value */ 127 vchar_t *nonce_p; /* partner's nonce value */ 128 vchar_t *skeyid; /* SKEYID */ 129 vchar_t *skeyid_d; /* SKEYID_d */ 130 vchar_t *skeyid_a; /* SKEYID_a, i.e. hash */ 131 vchar_t *skeyid_e; /* SKEYID_e, i.e. encryption */ 132 vchar_t *key; /* cipher key */ 133 vchar_t *hash; /* HASH minus general header */ 134 vchar_t *sig; /* SIG minus general header */ 135 vchar_t *sig_p; /* peer's SIG minus general header */ 136 cert_t *cert; /* CERT minus general header */ 137 cert_t *cert_p; /* peer's CERT minus general header */ 138 cert_t *crl_p; /* peer's CRL minus general header */ 139 cert_t *cr_p; /* peer's CR not including general */ 140 vchar_t *id; /* ID minus gen header */ 141 vchar_t *id_p; /* partner's ID minus general header */ 142 /* i.e. strut ipsecdoi_id_b*. */ 143 struct isakmp_ivm *ivm; /* IVs */ 144 145 vchar_t *sa; /* whole SA payload to send/to be sent*/ 146 /* to calculate HASH */ 147 /* NOT INCLUDING general header. */ 148 149 vchar_t *sa_ret; /* SA payload to reply/to be replyed */ 150 /* NOT INCLUDING general header. */ 151 /* NOTE: Should be release after use. */ 152 153#ifdef HAVE_GSSAPI 154 void *gssapi_state; /* GSS-API specific state. */ 155 /* Allocated when needed */ 156 vchar_t *gi_i; /* optional initiator GSS id */ 157 vchar_t *gi_r; /* optional responder GSS id */ 158#endif 159 160 struct isakmp_pl_hash *pl_hash; /* pointer to hash payload */ 161 162 time_t created; /* timestamp for establish */ 163#ifdef ENABLE_STATS 164 struct timeval start; 165 struct timeval end; 166#endif 167 168 u_int32_t msgid2; /* msgid counter for Phase 2 */ 169 int ph2cnt; /* the number which is negotiated by this phase 1 */ 170 LIST_HEAD(_ph2ofph1_, ph2handle) ph2tree; 171 172 LIST_ENTRY(ph1handle) chain; 173}; 174 175/* Phase 2 handler */ 176/* allocated per a SA or SA bundles of a pair of peer's IP addresses. */ 177/* 178 * initiator responder 179 * 0 (---) (---) 180 * 1 start start (1st msg received) 181 * 2 acquire msg get 1st valid msg received 182 * 3 getspi request sent getspi request sent 183 * 4 getspi done getspi done 184 * 5 1st msg sent 1st msg sent 185 * 6 1st valid msg received 2nd valid msg received 186 * 7 (commit bit) (commit bit) 187 * 8 SAs added SAs added 188 * 9 SAs established SAs established 189 * 10 SAs expired SAs expired 190 */ 191#define PHASE2ST_SPAWN 0 192#define PHASE2ST_START 1 193#define PHASE2ST_STATUS2 2 194#define PHASE2ST_GETSPISENT 3 195#define PHASE2ST_GETSPIDONE 4 196#define PHASE2ST_MSG1SENT 5 197#define PHASE2ST_STATUS6 6 198#define PHASE2ST_COMMIT 7 199#define PHASE2ST_ADDSA 8 200#define PHASE2ST_ESTABLISHED 9 201#define PHASE2ST_EXPIRED 10 202#define PHASE2ST_MAX 11 203 204struct ph2handle { 205 struct sockaddr *src; /* my address of SA. */ 206 struct sockaddr *dst; /* peer's address of SA. */ 207 208 /* 209 * copy ip address from ID payloads when ID type is ip address. 210 * In other case, they must be null. 211 */ 212 struct sockaddr *src_id; 213 struct sockaddr *dst_id; 214 215 u_int32_t spid; /* policy id by kernel */ 216 217 int status; /* ipsec sa status */ 218 u_int8_t side; /* INITIATOR or RESPONDER */ 219 220 struct sched *sce; /* schedule for expire */ 221 struct sched *scr; /* schedule for resend */ 222 int retry_counter; /* for resend. */ 223 vchar_t *sendbuf; /* buffer for re-sending */ 224 vchar_t *msg1; /* buffer for re-sending */ 225 /* used for responder's first message */ 226 227 int retry_checkph1; /* counter to wait phase 1 finished. */ 228 /* NOTE: actually it's timer. */ 229 230 u_int32_t seq; /* sequence number used by PF_KEY */ 231 /* 232 * NOTE: In responder side, we can't identify each SAs 233 * with same destination address for example, when 234 * socket based SA is required. So we set a identifier 235 * number to "seq", and sent kernel by pfkey. 236 */ 237 u_int8_t satype; /* satype in PF_KEY */ 238 /* 239 * saved satype in the original PF_KEY request from 240 * the kernel in order to reply a error. 241 */ 242 243 u_int8_t flags; /* Flags for phase 2 */ 244 u_int32_t msgid; /* msgid for phase 2 */ 245 246 struct sainfo *sainfo; /* place holder of sainfo */ 247 struct saprop *proposal; /* SA(s) proposal. */ 248 struct saprop *approval; /* SA(s) approved. */ 249 caddr_t spidx_gen; /* policy from peer's proposal */ 250 251 struct dhgroup *pfsgrp; /* DH; prime number */ 252 vchar_t *dhpriv; /* DH; private value */ 253 vchar_t *dhpub; /* DH; public value */ 254 vchar_t *dhpub_p; /* DH; partner's public value */ 255 vchar_t *dhgxy; /* DH; shared secret */ 256 vchar_t *id; /* ID minus gen header */ 257 vchar_t *id_p; /* peer's ID minus general header */ 258 vchar_t *nonce; /* nonce value in phase 2 */ 259 vchar_t *nonce_p; /* partner's nonce value in phase 2 */ 260 261 vchar_t *sa; /* whole SA payload to send/to be sent*/ 262 /* to calculate HASH */ 263 /* NOT INCLUDING general header. */ 264 265 vchar_t *sa_ret; /* SA payload to reply/to be replyed */ 266 /* NOT INCLUDING general header. */ 267 /* NOTE: Should be release after use. */ 268 269 struct isakmp_ivm *ivm; /* IVs */ 270 271#ifdef ENABLE_STATS 272 struct timeval start; 273 struct timeval end; 274#endif 275 struct ph1handle *ph1; /* back pointer to isakmp status */ 276 277 LIST_ENTRY(ph2handle) chain; 278 LIST_ENTRY(ph2handle) ph1bind; /* chain to ph1handle */ 279}; 280 281/* 282 * for handling initial contact. 283 */ 284struct contacted { 285 struct sockaddr *remote; /* remote address to negosiate ph1 */ 286 LIST_ENTRY(contacted) chain; 287}; 288 289/* 290 * for checking a packet retransmited. 291 */ 292struct recvdpkt { 293 struct sockaddr *remote; /* the remote address */ 294 struct sockaddr *local; /* the local address */ 295 vchar_t *hash; /* hash of the received packet */ 296 vchar_t *sendbuf; /* buffer for the response */ 297 int retry_counter; /* how many times to send */ 298 time_t time_send; /* timestamp to send a packet */ 299 time_t created; /* timestamp to create a queue */ 300 301 struct sched *scr; /* schedule for resend, may not used */ 302 303 LIST_ENTRY(recvdpkt) chain; 304}; 305 306/* for parsing ISAKMP header. */ 307struct isakmp_parse_t { 308 u_char type; /* payload type of mine */ 309 int len; /* ntohs(ptr->len) */ 310 struct isakmp_gen *ptr; 311}; 312 313/* 314 * for IV management. 315 * 316 * - normal case 317 * initiator responder 318 * ------------------------- -------------------------- 319 * initialize iv(A), ive(A). initialize iv(A), ive(A). 320 * encode by ive(A). 321 * save to iv(B). ---[packet(B)]--> save to ive(B). 322 * decode by iv(A). 323 * packet consistency. 324 * sync iv(B) with ive(B). 325 * check auth, integrity. 326 * encode by ive(B). 327 * save to ive(C). <--[packet(C)]--- save to iv(C). 328 * decoded by iv(B). 329 * : 330 * 331 * - In the case that a error is found while cipher processing, 332 * initiator responder 333 * ------------------------- -------------------------- 334 * initialize iv(A), ive(A). initialize iv(A), ive(A). 335 * encode by ive(A). 336 * save to iv(B). ---[packet(B)]--> save to ive(B). 337 * decode by iv(A). 338 * packet consistency. 339 * sync iv(B) with ive(B). 340 * check auth, integrity. 341 * error found. 342 * create notify. 343 * get ive2(X) from iv(B). 344 * encode by ive2(X). 345 * get iv2(X) from iv(B). <--[packet(Y)]--- save to iv2(Y). 346 * save to ive2(Y). 347 * decoded by iv2(X). 348 * : 349 * 350 * The reason why the responder synchronizes iv with ive after checking the 351 * packet consistency is that it is required to leave the IV for decoding 352 * packet. Because there is a potential of error while checking the packet 353 * consistency. Also the reason why that is before authentication and 354 * integirty check is that the IV for informational exchange has to be made 355 * by the IV which is after packet decoded and checking the packet consistency. 356 * Otherwise IV mismatched happens between the intitiator and the responder. 357 */ 358struct isakmp_ivm { 359 vchar_t *iv; /* for decoding packet */ 360 /* if phase 1, it's for computing phase2 iv */ 361 vchar_t *ive; /* for encoding packet */ 362}; 363 364/* for dumping */ 365struct ph1dump { 366 isakmp_index index; 367 int status; 368 int side; 369 struct sockaddr_storage remote; 370 struct sockaddr_storage local; 371 u_int8_t version; 372 u_int8_t etype; 373 time_t created; 374 int ph2cnt; 375}; 376 377struct sockaddr; 378struct ph1handle; 379struct ph2handle; 380struct policyindex; 381 382extern struct ph1handle *getph1byindex __P((isakmp_index *)); 383extern struct ph1handle *getph1byindex0 __P((isakmp_index *)); 384extern struct ph1handle *getph1byaddr __P((struct sockaddr *, 385 struct sockaddr *)); 386extern vchar_t *dumpph1 __P((void)); 387extern struct ph1handle *newph1 __P((void)); 388extern void delph1 __P((struct ph1handle *)); 389extern int insph1 __P((struct ph1handle *)); 390extern void remph1 __P((struct ph1handle *)); 391extern void flushph1 __P((void)); 392extern void initph1tree __P((void)); 393 394extern struct ph2handle *getph2byspidx __P((struct policyindex *)); 395extern struct ph2handle *getph2byspid __P((u_int32_t)); 396extern struct ph2handle *getph2byseq __P((u_int32_t)); 397extern struct ph2handle *getph2bymsgid __P((struct ph1handle *, u_int32_t)); 398extern struct ph2handle *getph2bysaidx __P((struct sockaddr *, 399 struct sockaddr *, u_int, u_int32_t)); 400extern struct ph2handle *newph2 __P((void)); 401extern void initph2 __P((struct ph2handle *)); 402extern void delph2 __P((struct ph2handle *)); 403extern int insph2 __P((struct ph2handle *)); 404extern void remph2 __P((struct ph2handle *)); 405extern void flushph2 __P((void)); 406extern void deleteallph2 __P((struct sockaddr *, struct sockaddr *, u_int)); 407extern void initph2tree __P((void)); 408 409extern void bindph12 __P((struct ph1handle *, struct ph2handle *)); 410extern void unbindph12 __P((struct ph2handle *)); 411 412extern struct contacted *getcontacted __P((struct sockaddr *)); 413extern int inscontacted __P((struct sockaddr *)); 414extern void initctdtree __P((void)); 415 416extern int check_recvdpkt __P((struct sockaddr *, 417 struct sockaddr *, vchar_t *)); 418extern int add_recvdpkt __P((struct sockaddr *, struct sockaddr *, 419 vchar_t *, vchar_t *)); 420extern void init_recvdpkt __P((void)); 421