1/* $KAME: isakmp.h,v 1.19 2001/04/11 06:11:55 sakane Exp $ */ 2 3/* 4 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the project nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32/* refer to RFC 2408 */ 33 34/* must include <netinet/in.h> first. */ 35/* must include "isakmp_var.h" first. */ 36 37#define INITIATOR 0 /* synonym sender */ 38#define RESPONDER 1 /* synonym receiver */ 39 40#define GENERATE 1 41#define VALIDATE 0 42 43/* 3.1 ISAKMP Header Format 44 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 45 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 46 ! Initiator ! 47 ! Cookie ! 48 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 49 ! Responder ! 50 ! Cookie ! 51 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 52 ! Next Payload ! MjVer ! MnVer ! Exchange Type ! Flags ! 53 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 54 ! Message ID ! 55 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 56 ! Length ! 57 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 58*/ 59struct isakmp { 60 cookie_t i_ck; /* Initiator Cookie */ 61 cookie_t r_ck; /* Responder Cookie */ 62 u_int8_t np; /* Next Payload Type */ 63 u_int8_t v; 64 u_int8_t etype; /* Exchange Type */ 65 u_int8_t flags; /* Flags */ 66 u_int32_t msgid; 67 u_int32_t len; /* Length */ 68} __attribute__((__packed__)); 69 70/* Next Payload Type */ 71#define ISAKMP_NPTYPE_NONE 0 /* NONE*/ 72#define ISAKMP_NPTYPE_SA 1 /* Security Association */ 73#define ISAKMP_NPTYPE_P 2 /* Proposal */ 74#define ISAKMP_NPTYPE_T 3 /* Transform */ 75#define ISAKMP_NPTYPE_KE 4 /* Key Exchange */ 76#define ISAKMP_NPTYPE_ID 5 /* Identification */ 77#define ISAKMP_NPTYPE_CERT 6 /* Certificate */ 78#define ISAKMP_NPTYPE_CR 7 /* Certificate Request */ 79#define ISAKMP_NPTYPE_HASH 8 /* Hash */ 80#define ISAKMP_NPTYPE_SIG 9 /* Signature */ 81#define ISAKMP_NPTYPE_NONCE 10 /* Nonce */ 82#define ISAKMP_NPTYPE_N 11 /* Notification */ 83#define ISAKMP_NPTYPE_D 12 /* Delete */ 84#define ISAKMP_NPTYPE_VID 13 /* Vendor ID */ 85#define ISAKMP_NPTYPE_MAX 14 86 /* 128 - 255 Private Use */ 87 88/* 89 * The following are valid when the Vendor ID is one of the 90 * following: 91 * 92 * MD5("A GSS-API Authentication Method for IKE") 93 * MD5("GSSAPI") (recognized by Windows 2000) 94 * MD5("MS NT5 ISAKMPOAKLEY") (sent by Windows 2000) 95 * 96 * See draft-ietf-ipsec-isakmp-gss-auth-06.txt. 97 */ 98#define ISAKMP_NPTYPE_GSS 129 /* GSS token */ 99 100#define ISAKMP_MAJOR_VERSION 1 101#define ISAKMP_MINOR_VERSION 0 102#define ISAKMP_VERSION_NUMBER 0x10 103#define ISAKMP_GETMAJORV(v) (((v) & 0xf0) >> 4) 104#define ISAKMP_SETMAJORV(v, m) ((v) = ((v) & 0x0f) | (((m) << 4) & 0xf0)) 105#define ISAKMP_GETMINORV(v) ((v) & 0x0f) 106#define ISAKMP_SETMINORV(v, m) ((v) = ((v) & 0xf0) | ((m) & 0x0f)) 107 108/* Exchange Type */ 109#define ISAKMP_ETYPE_NONE 0 /* NONE */ 110#define ISAKMP_ETYPE_BASE 1 /* Base */ 111#define ISAKMP_ETYPE_IDENT 2 /* Identity Proteciton */ 112#define ISAKMP_ETYPE_AUTH 3 /* Authentication Only */ 113#define ISAKMP_ETYPE_AGG 4 /* Aggressive */ 114#define ISAKMP_ETYPE_INFO 5 /* Informational */ 115/* Additional Exchange Type */ 116#define ISAKMP_ETYPE_QUICK 32 /* Quick Mode */ 117#define ISAKMP_ETYPE_NEWGRP 33 /* New group Mode */ 118#define ISAKMP_ETYPE_ACKINFO 34 /* Acknowledged Informational */ 119 120/* Flags */ 121#define ISAKMP_FLAG_E 0x01 /* Encryption Bit */ 122#define ISAKMP_FLAG_C 0x02 /* Commit Bit */ 123#define ISAKMP_FLAG_A 0x04 /* Authentication Only Bit */ 124 125/* 3.2 Payload Generic Header 126 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 127 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 128 ! Next Payload ! RESERVED ! Payload Length ! 129 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 130*/ 131struct isakmp_gen { 132 u_int8_t np; /* Next Payload */ 133 u_int8_t reserved; /* RESERVED, unused, must set to 0 */ 134 u_int16_t len; /* Payload Length */ 135} __attribute__((__packed__)); 136 137/* 3.3 Data Attributes 138 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 139 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 140 !A! Attribute Type ! AF=0 Attribute Length ! 141 !F! ! AF=1 Attribute Value ! 142 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 143 . AF=0 Attribute Value . 144 . AF=1 Not Transmitted . 145 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 146*/ 147struct isakmp_data { 148 u_int16_t type; /* defined by DOI-spec, and Attribute Format */ 149 u_int16_t lorv; /* if f equal 1, Attribute Length */ 150 /* if f equal 0, Attribute Value */ 151 /* if f equal 1, Attribute Value */ 152} __attribute__((__packed__)); 153#define ISAKMP_GEN_TLV 0x0000 154#define ISAKMP_GEN_TV 0x8000 155 /* mask for type of attribute format */ 156#define ISAKMP_GEN_MASK 0x8000 157 158 159/* 3.5 Proposal Payload */ 160 /* 161 The value of the next payload field MUST only contain the value "2" 162 or "0". If there are additional Proposal payloads in the message, 163 then this field will be 2. If the current Proposal payload is the 164 last within the security association proposal, then this field will 165 be 0. 166 */ 167struct isakmp_pl_p { 168 struct isakmp_gen h; 169 u_int8_t p_no; /* Proposal # */ 170 u_int8_t proto_id; /* Protocol */ 171 u_int8_t spi_size; /* SPI Size */ 172 u_int8_t num_t; /* Number of Transforms */ 173 /* SPI */ 174} __attribute__((__packed__)); 175 176/* 3.6 Transform Payload */ 177 /* 178 The value of the next payload field MUST only contain the value "3" 179 or "0". If there are additional Transform payloads in the proposal, 180 then this field will be 3. If the current Transform payload is the 181 last within the proposal, then this field will be 0. 182 */ 183struct isakmp_pl_t { 184 struct isakmp_gen h; 185 u_int8_t t_no; /* Transform # */ 186 u_int8_t t_id; /* Transform-Id */ 187 u_int16_t reserved; /* RESERVED2 */ 188 /* SA Attributes */ 189} __attribute__((__packed__)); 190 191/* 3.7 Key Exchange Payload */ 192struct isakmp_pl_ke { 193 struct isakmp_gen h; 194 /* Key Exchange Data */ 195} __attribute__((__packed__)); 196 197 198/* 3.9 Certificate Payload */ 199struct isakmp_pl_cert { 200 struct isakmp_gen h; 201 /* 202 * Encoding type of 1 octet follows immediately, 203 * variable length CERT data follows encoding type. 204 */ 205} __attribute__((__packed__)); 206 207/* Certificate Type */ 208#define ISAKMP_CERT_NONE 0 209#define ISAKMP_CERT_PKCS7 1 210#define ISAKMP_CERT_PGP 2 211#define ISAKMP_CERT_DNS 3 212#define ISAKMP_CERT_X509SIGN 4 213#define ISAKMP_CERT_X509KE 5 214#define ISAKMP_CERT_KERBEROS 6 215#define ISAKMP_CERT_CRL 7 216#define ISAKMP_CERT_ARL 8 217#define ISAKMP_CERT_SPKI 9 218#define ISAKMP_CERT_X509ATTR 10 219 220/* the method to get peers certificate */ 221#define ISAKMP_GETCERT_PAYLOAD 1 222#define ISAKMP_GETCERT_LOCALFILE 2 223#define ISAKMP_GETCERT_DNS 3 224 225/* 3.10 Certificate Request Payload */ 226struct isakmp_pl_cr { 227 struct isakmp_gen h; 228 u_int8_t num_cert; /* # Cert. Types */ 229 /* 230 Certificate Types (variable length) 231 -- Contains a list of the types of certificates requested, 232 sorted in order of preference. Each individual certificate 233 type is 1 octet. This field is NOT required. 234 */ 235 /* # Certificate Authorities (1 octet) */ 236 /* Certificate Authorities (variable length) */ 237} __attribute__((__packed__)); 238 239/* 3.11 Hash Payload */ 240struct isakmp_pl_hash { 241 struct isakmp_gen h; 242 /* Hash Data */ 243} __attribute__((__packed__)); 244 245/* 3.12 Signature Payload */ 246struct isakmp_pl_sig { 247 struct isakmp_gen h; 248 /* Signature Data */ 249} __attribute__((__packed__)); 250 251/* 3.13 Nonce Payload */ 252struct isakmp_pl_nonce { 253 struct isakmp_gen h; 254 /* Nonce Data */ 255} __attribute__((__packed__)); 256 257/* 3.14 Notification Payload */ 258struct isakmp_pl_n { 259 struct isakmp_gen h; 260 u_int32_t doi; /* Domain of Interpretation */ 261 u_int8_t proto_id; /* Protocol-ID */ 262 u_int8_t spi_size; /* SPI Size */ 263 u_int16_t type; /* Notify Message Type */ 264 /* SPI */ 265 /* Notification Data */ 266} __attribute__((__packed__)); 267 268/* 3.14.1 Notify Message Types */ 269/* NOTIFY MESSAGES - ERROR TYPES */ 270#define ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE 1 271#define ISAKMP_NTYPE_DOI_NOT_SUPPORTED 2 272#define ISAKMP_NTYPE_SITUATION_NOT_SUPPORTED 3 273#define ISAKMP_NTYPE_INVALID_COOKIE 4 274#define ISAKMP_NTYPE_INVALID_MAJOR_VERSION 5 275#define ISAKMP_NTYPE_INVALID_MINOR_VERSION 6 276#define ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE 7 277#define ISAKMP_NTYPE_INVALID_FLAGS 8 278#define ISAKMP_NTYPE_INVALID_MESSAGE_ID 9 279#define ISAKMP_NTYPE_INVALID_PROTOCOL_ID 10 280#define ISAKMP_NTYPE_INVALID_SPI 11 281#define ISAKMP_NTYPE_INVALID_TRANSFORM_ID 12 282#define ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED 13 283#define ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN 14 284#define ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX 15 285#define ISAKMP_NTYPE_PAYLOAD_MALFORMED 16 286#define ISAKMP_NTYPE_INVALID_KEY_INFORMATION 17 287#define ISAKMP_NTYPE_INVALID_ID_INFORMATION 18 288#define ISAKMP_NTYPE_INVALID_CERT_ENCODING 19 289#define ISAKMP_NTYPE_INVALID_CERTIFICATE 20 290#define ISAKMP_NTYPE_BAD_CERT_REQUEST_SYNTAX 21 291#define ISAKMP_NTYPE_INVALID_CERT_AUTHORITY 22 292#define ISAKMP_NTYPE_INVALID_HASH_INFORMATION 23 293#define ISAKMP_NTYPE_AUTHENTICATION_FAILED 24 294#define ISAKMP_NTYPE_INVALID_SIGNATURE 25 295#define ISAKMP_NTYPE_ADDRESS_NOTIFICATION 26 296#define ISAKMP_NTYPE_NOTIFY_SA_LIFETIME 27 297#define ISAKMP_NTYPE_CERTIFICATE_UNAVAILABLE 28 298#define ISAKMP_NTYPE_UNSUPPORTED_EXCHANGE_TYPE 29 299#define ISAKMP_NTYPE_UNEQUAL_PAYLOAD_LENGTHS 30 300/* NOTIFY MESSAGES - STATUS TYPES */ 301#define ISAKMP_NTYPE_CONNECTED 16384 302/* 4.6.3 IPSEC DOI Notify Message Types */ 303#define ISAKMP_NTYPE_RESPONDER_LIFETIME 24576 304#define ISAKMP_NTYPE_REPLAY_STATUS 24577 305#define ISAKMP_NTYPE_INITIAL_CONTACT 24578 306 307/* using only to log */ 308#define ISAKMP_LOG_RETRY_LIMIT_REACHED 65530 309 310#define ISAKMP_INTERNAL_ERROR -1 311 312/* 3.15 Delete Payload */ 313struct isakmp_pl_d { 314 struct isakmp_gen h; 315 u_int32_t doi; /* Domain of Interpretation */ 316 u_int8_t proto_id; /* Protocol-Id */ 317 u_int8_t spi_size; /* SPI Size */ 318 u_int16_t num_spi; /* # of SPIs */ 319 /* SPI(es) */ 320} __attribute__((__packed__)); 321