1 /* $NetBSD: handler.h,v 1.9.6.1 2008/01/11 14:12:01 vanhu Exp $ */ 2 3 /* Id: handler.h,v 1.19 2006/02/25 08:25:12 manubsd Exp */ 4 5 /* 6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. Neither the name of the project nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #ifndef _HANDLER_H 35 #define _HANDLER_H 36 37 #include <sys/queue.h> 38 #include <openssl/rsa.h> 39 40 #include <sys/time.h> 41 42 #include "isakmp_var.h" 43 #include "oakley.h" 44 45 /* Phase 1 handler */ 46 /* 47 * main mode: 48 * initiator responder 49 * 0 (---) (---) 50 * 1 start start (1st msg received) 51 * 2 (---) 1st valid msg received 52 * 3 1st msg sent 1st msg sent 53 * 4 1st valid msg received 2st valid msg received 54 * 5 2nd msg sent 2nd msg sent 55 * 6 2nd valid msg received 3rd valid msg received 56 * 7 3rd msg sent 3rd msg sent 57 * 8 3rd valid msg received (---) 58 * 9 SA established SA established 59 * 60 * aggressive mode: 61 * initiator responder 62 * 0 (---) (---) 63 * 1 start start (1st msg received) 64 * 2 (---) 1st valid msg received 65 * 3 1st msg sent 1st msg sent 66 * 4 1st valid msg received 2st valid msg received 67 * 5 (---) (---) 68 * 6 (---) (---) 69 * 7 (---) (---) 70 * 8 (---) (---) 71 * 9 SA established SA established 72 * 73 * base mode: 74 * initiator responder 75 * 0 (---) (---) 76 * 1 start start (1st msg received) 77 * 2 (---) 1st valid msg received 78 * 3 1st msg sent 1st msg sent 79 * 4 1st valid msg received 2st valid msg received 80 * 5 2nd msg sent (---) 81 * 6 (---) (---) 82 * 7 (---) (---) 83 * 8 (---) (---) 84 * 9 SA established SA established 85 */ 86 #define PHASE1ST_SPAWN 0 87 #define PHASE1ST_START 1 88 #define PHASE1ST_MSG1RECEIVED 2 89 #define PHASE1ST_MSG1SENT 3 90 #define PHASE1ST_MSG2RECEIVED 4 91 #define PHASE1ST_MSG2SENT 5 92 #define PHASE1ST_MSG3RECEIVED 6 93 #define PHASE1ST_MSG3SENT 7 94 #define PHASE1ST_MSG4RECEIVED 8 95 #define PHASE1ST_ESTABLISHED 9 96 #define PHASE1ST_EXPIRED 10 97 #define PHASE1ST_MAX 11 98 99 /* About address semantics in each case. 100 * initiator(addr=I) responder(addr=R) 101 * src dst src dst 102 * (local) (remote) (local) (remote) 103 * phase 1 handler I R R I 104 * phase 2 handler I R R I 105 * getspi msg R I I R 106 * acquire msg I R 107 * ID payload I R I R 108 */ 109 #ifdef ENABLE_HYBRID 110 struct isakmp_cfg_state; 111 #endif 112 struct ph1handle { 113 isakmp_index index; 114 115 int status; /* status of this SA */ 116 int side; /* INITIATOR or RESPONDER */ 117 118 struct sockaddr *remote; /* remote address to negosiate ph1 */ 119 struct sockaddr *local; /* local address to negosiate ph1 */ 120 /* XXX copy from rmconf due to anonymous configuration. 121 * If anonymous will be forbidden, we do delete them. */ 122 123 struct remoteconf *rmconf; /* pointer to remote configuration */ 124 125 struct isakmpsa *approval; /* pointer to SA(s) approved. */ 126 vchar_t *authstr; /* place holder of string for auth. */ 127 /* for example pre-shared key */ 128 129 u_int8_t version; /* ISAKMP version */ 130 u_int8_t etype; /* Exchange type actually for use */ 131 u_int8_t flags; /* Flags */ 132 u_int32_t msgid; /* message id */ 133 134 #ifdef ENABLE_NATT 135 struct ph1natt_options *natt_options; /* Selected NAT-T IKE version */ 136 u_int32_t natt_flags; /* NAT-T related flags */ 137 #endif 138 #ifdef ENABLE_FRAG 139 int frag; /* IKE phase 1 fragmentation */ 140 struct isakmp_frag_item *frag_chain; /* Received fragments */ 141 #endif 142 143 struct sched *sce; /* schedule for expire */ 144 145 struct sched *scr; /* schedule for resend */ 146 int retry_counter; /* for resend. */ 147 vchar_t *sendbuf; /* buffer for re-sending */ 148 149 vchar_t *dhpriv; /* DH; private value */ 150 vchar_t *dhpub; /* DH; public value */ 151 vchar_t *dhpub_p; /* DH; partner's public value */ 152 vchar_t *dhgxy; /* DH; shared secret */ 153 vchar_t *nonce; /* nonce value */ 154 vchar_t *nonce_p; /* partner's nonce value */ 155 vchar_t *skeyid; /* SKEYID */ 156 vchar_t *skeyid_d; /* SKEYID_d */ 157 vchar_t *skeyid_a; /* SKEYID_a, i.e. hash */ 158 vchar_t *skeyid_e; /* SKEYID_e, i.e. encryption */ 159 vchar_t *key; /* cipher key */ 160 vchar_t *hash; /* HASH minus general header */ 161 vchar_t *sig; /* SIG minus general header */ 162 vchar_t *sig_p; /* peer's SIG minus general header */ 163 cert_t *cert; /* CERT minus general header */ 164 cert_t *cert_p; /* peer's CERT minus general header */ 165 cert_t *crl_p; /* peer's CRL minus general header */ 166 cert_t *cr_p; /* peer's CR not including general */ 167 RSA *rsa; /* my RSA key */ 168 RSA *rsa_p; /* peer's RSA key */ 169 struct genlist *rsa_candidates; /* possible candidates for peer's RSA key */ 170 vchar_t *id; /* ID minus gen header */ 171 vchar_t *id_p; /* partner's ID minus general header */ 172 /* i.e. struct ipsecdoi_id_b*. */ 173 struct isakmp_ivm *ivm; /* IVs */ 174 175 vchar_t *sa; /* whole SA payload to send/to be sent*/ 176 /* to calculate HASH */ 177 /* NOT INCLUDING general header. */ 178 179 vchar_t *sa_ret; /* SA payload to reply/to be replyed */ 180 /* NOT INCLUDING general header. */ 181 /* NOTE: Should be release after use. */ 182 183 #ifdef HAVE_GSSAPI 184 void *gssapi_state; /* GSS-API specific state. */ 185 /* Allocated when needed */ 186 vchar_t *gi_i; /* optional initiator GSS id */ 187 vchar_t *gi_r; /* optional responder GSS id */ 188 #endif 189 190 struct isakmp_pl_hash *pl_hash; /* pointer to hash payload */ 191 192 time_t created; /* timestamp for establish */ 193 #ifdef ENABLE_STATS 194 struct timeval start; 195 struct timeval end; 196 #endif 197 198 #ifdef ENABLE_DPD 199 int dpd_support; /* Does remote supports DPD ? */ 200 time_t dpd_lastack; /* Last ack received */ 201 u_int16_t dpd_seq; /* DPD seq number to receive */ 202 u_int8_t dpd_fails; /* number of failures */ 203 struct sched *dpd_r_u; 204 #endif 205 206 u_int32_t msgid2; /* msgid counter for Phase 2 */ 207 int ph2cnt; /* the number which is negotiated by this phase 1 */ 208 LIST_HEAD(_ph2ofph1_, ph2handle) ph2tree; 209 210 LIST_ENTRY(ph1handle) chain; 211 #ifdef ENABLE_HYBRID 212 struct isakmp_cfg_state *mode_cfg; /* ISAKMP mode config state */ 213 #endif 214 215 }; 216 217 /* Phase 2 handler */ 218 /* allocated per a SA or SA bundles of a pair of peer's IP addresses. */ 219 /* 220 * initiator responder 221 * 0 (---) (---) 222 * 1 start start (1st msg received) 223 * 2 acquire msg get 1st valid msg received 224 * 3 getspi request sent getspi request sent 225 * 4 getspi done getspi done 226 * 5 1st msg sent 1st msg sent 227 * 6 1st valid msg received 2nd valid msg received 228 * 7 (commit bit) (commit bit) 229 * 8 SAs added SAs added 230 * 9 SAs established SAs established 231 * 10 SAs expired SAs expired 232 */ 233 #define PHASE2ST_SPAWN 0 234 #define PHASE2ST_START 1 235 #define PHASE2ST_STATUS2 2 236 #define PHASE2ST_GETSPISENT 3 237 #define PHASE2ST_GETSPIDONE 4 238 #define PHASE2ST_MSG1SENT 5 239 #define PHASE2ST_STATUS6 6 240 #define PHASE2ST_COMMIT 7 241 #define PHASE2ST_ADDSA 8 242 #define PHASE2ST_ESTABLISHED 9 243 #define PHASE2ST_EXPIRED 10 244 #define PHASE2ST_MAX 11 245 246 struct ph2handle { 247 struct sockaddr *src; /* my address of SA. */ 248 struct sockaddr *dst; /* peer's address of SA. */ 249 250 /* 251 * copy ip address from ID payloads when ID type is ip address. 252 * In other case, they must be null. 253 */ 254 struct sockaddr *src_id; 255 struct sockaddr *dst_id; 256 257 u_int32_t spid; /* policy id by kernel */ 258 259 int status; /* ipsec sa status */ 260 u_int8_t side; /* INITIATOR or RESPONDER */ 261 262 struct sched *sce; /* schedule for expire */ 263 struct sched *scr; /* schedule for resend */ 264 int retry_counter; /* for resend. */ 265 vchar_t *sendbuf; /* buffer for re-sending */ 266 vchar_t *msg1; /* buffer for re-sending */ 267 /* used for responder's first message */ 268 269 int retry_checkph1; /* counter to wait phase 1 finished. */ 270 /* NOTE: actually it's timer. */ 271 272 u_int32_t seq; /* sequence number used by PF_KEY */ 273 /* 274 * NOTE: In responder side, we can't identify each SAs 275 * with same destination address for example, when 276 * socket based SA is required. So we set a identifier 277 * number to "seq", and sent kernel by pfkey. 278 */ 279 u_int8_t satype; /* satype in PF_KEY */ 280 /* 281 * saved satype in the original PF_KEY request from 282 * the kernel in order to reply a error. 283 */ 284 285 u_int8_t flags; /* Flags for phase 2 */ 286 u_int32_t msgid; /* msgid for phase 2 */ 287 288 struct sainfo *sainfo; /* place holder of sainfo */ 289 struct saprop *proposal; /* SA(s) proposal. */ 290 struct saprop *approval; /* SA(s) approved. */ 291 caddr_t spidx_gen; /* policy from peer's proposal */ 292 293 struct dhgroup *pfsgrp; /* DH; prime number */ 294 vchar_t *dhpriv; /* DH; private value */ 295 vchar_t *dhpub; /* DH; public value */ 296 vchar_t *dhpub_p; /* DH; partner's public value */ 297 vchar_t *dhgxy; /* DH; shared secret */ 298 vchar_t *id; /* ID minus gen header */ 299 vchar_t *id_p; /* peer's ID minus general header */ 300 vchar_t *nonce; /* nonce value in phase 2 */ 301 vchar_t *nonce_p; /* partner's nonce value in phase 2 */ 302 303 vchar_t *sa; /* whole SA payload to send/to be sent*/ 304 /* to calculate HASH */ 305 /* NOT INCLUDING general header. */ 306 307 vchar_t *sa_ret; /* SA payload to reply/to be replyed */ 308 /* NOT INCLUDING general header. */ 309 /* NOTE: Should be release after use. */ 310 311 struct isakmp_ivm *ivm; /* IVs */ 312 313 int generated_spidx; /* mark handlers whith generated policy */ 314 315 #ifdef ENABLE_STATS 316 struct timeval start; 317 struct timeval end; 318 #endif 319 struct ph1handle *ph1; /* back pointer to isakmp status */ 320 321 LIST_ENTRY(ph2handle) chain; 322 LIST_ENTRY(ph2handle) ph1bind; /* chain to ph1handle */ 323 }; 324 325 /* 326 * for handling initial contact. 327 */ 328 struct contacted { 329 struct sockaddr *remote; /* remote address to negosiate ph1 */ 330 LIST_ENTRY(contacted) chain; 331 }; 332 333 /* 334 * for checking a packet retransmited. 335 */ 336 struct recvdpkt { 337 struct sockaddr *remote; /* the remote address */ 338 struct sockaddr *local; /* the local address */ 339 vchar_t *hash; /* hash of the received packet */ 340 vchar_t *sendbuf; /* buffer for the response */ 341 int retry_counter; /* how many times to send */ 342 time_t time_send; /* timestamp to send a packet */ 343 time_t created; /* timestamp to create a queue */ 344 345 struct sched *scr; /* schedule for resend, may not used */ 346 347 LIST_ENTRY(recvdpkt) chain; 348 }; 349 350 /* for parsing ISAKMP header. */ 351 struct isakmp_parse_t { 352 u_char type; /* payload type of mine */ 353 int len; /* ntohs(ptr->len) */ 354 struct isakmp_gen *ptr; 355 }; 356 357 /* 358 * for IV management. 359 * 360 * - normal case 361 * initiator responder 362 * ------------------------- -------------------------- 363 * initialize iv(A), ive(A). initialize iv(A), ive(A). 364 * encode by ive(A). 365 * save to iv(B). ---[packet(B)]--> save to ive(B). 366 * decode by iv(A). 367 * packet consistency. 368 * sync iv(B) with ive(B). 369 * check auth, integrity. 370 * encode by ive(B). 371 * save to ive(C). <--[packet(C)]--- save to iv(C). 372 * decoded by iv(B). 373 * : 374 * 375 * - In the case that a error is found while cipher processing, 376 * initiator responder 377 * ------------------------- -------------------------- 378 * initialize iv(A), ive(A). initialize iv(A), ive(A). 379 * encode by ive(A). 380 * save to iv(B). ---[packet(B)]--> save to ive(B). 381 * decode by iv(A). 382 * packet consistency. 383 * sync iv(B) with ive(B). 384 * check auth, integrity. 385 * error found. 386 * create notify. 387 * get ive2(X) from iv(B). 388 * encode by ive2(X). 389 * get iv2(X) from iv(B). <--[packet(Y)]--- save to iv2(Y). 390 * save to ive2(Y). 391 * decoded by iv2(X). 392 * : 393 * 394 * The reason why the responder synchronizes iv with ive after checking the 395 * packet consistency is that it is required to leave the IV for decoding 396 * packet. Because there is a potential of error while checking the packet 397 * consistency. Also the reason why that is before authentication and 398 * integirty check is that the IV for informational exchange has to be made 399 * by the IV which is after packet decoded and checking the packet consistency. 400 * Otherwise IV mismatched happens between the intitiator and the responder. 401 */ 402 struct isakmp_ivm { 403 vchar_t *iv; /* for decoding packet */ 404 /* if phase 1, it's for computing phase2 iv */ 405 vchar_t *ive; /* for encoding packet */ 406 }; 407 408 /* for dumping */ 409 struct ph1dump { 410 isakmp_index index; 411 int status; 412 int side; 413 struct sockaddr_storage remote; 414 struct sockaddr_storage local; 415 u_int8_t version; 416 u_int8_t etype; 417 time_t created; 418 int ph2cnt; 419 }; 420 421 struct sockaddr; 422 struct ph1handle; 423 struct ph2handle; 424 struct policyindex; 425 426 extern struct ph1handle *getph1byindex __P((isakmp_index *)); 427 extern struct ph1handle *getph1byindex0 __P((isakmp_index *)); 428 extern struct ph1handle *getph1byaddr __P((struct sockaddr *, 429 struct sockaddr *, int)); 430 extern struct ph1handle *getph1byaddrwop __P((struct sockaddr *, 431 struct sockaddr *)); 432 extern struct ph1handle *getph1bydstaddrwop __P((struct sockaddr *)); 433 #ifdef ENABLE_HYBRID 434 struct ph1handle *getph1bylogin __P((char *)); 435 int purgeph1bylogin __P((char *)); 436 #endif 437 extern vchar_t *dumpph1 __P((void)); 438 extern struct ph1handle *newph1 __P((void)); 439 extern void delph1 __P((struct ph1handle *)); 440 extern int insph1 __P((struct ph1handle *)); 441 extern void remph1 __P((struct ph1handle *)); 442 extern void flushph1 __P((void)); 443 extern void initph1tree __P((void)); 444 445 extern struct ph2handle *getph2byspidx __P((struct policyindex *)); 446 extern struct ph2handle *getph2byspid __P((u_int32_t)); 447 extern struct ph2handle *getph2byseq __P((u_int32_t)); 448 extern struct ph2handle *getph2bysaddr __P((struct sockaddr *, 449 struct sockaddr *)); 450 extern struct ph2handle *getph2bymsgid __P((struct ph1handle *, u_int32_t)); 451 extern struct ph2handle *getph2byid __P((struct sockaddr *, 452 struct sockaddr *, u_int32_t)); 453 extern struct ph2handle *getph2bysaidx __P((struct sockaddr *, 454 struct sockaddr *, u_int, u_int32_t)); 455 extern struct ph2handle *newph2 __P((void)); 456 extern void initph2 __P((struct ph2handle *)); 457 extern void delph2 __P((struct ph2handle *)); 458 extern int insph2 __P((struct ph2handle *)); 459 extern void remph2 __P((struct ph2handle *)); 460 extern void flushph2 __P((void)); 461 extern void deleteallph2 __P((struct sockaddr *, struct sockaddr *, u_int)); 462 extern void initph2tree __P((void)); 463 464 extern void bindph12 __P((struct ph1handle *, struct ph2handle *)); 465 extern void unbindph12 __P((struct ph2handle *)); 466 467 extern struct contacted *getcontacted __P((struct sockaddr *)); 468 extern int inscontacted __P((struct sockaddr *)); 469 extern void initctdtree __P((void)); 470 471 extern int check_recvdpkt __P((struct sockaddr *, 472 struct sockaddr *, vchar_t *)); 473 extern int add_recvdpkt __P((struct sockaddr *, struct sockaddr *, 474 vchar_t *, vchar_t *)); 475 extern void init_recvdpkt __P((void)); 476 477 #ifdef ENABLE_HYBRID 478 extern int exclude_cfg_addr __P((const struct sockaddr *)); 479 #endif 480 481 extern int revalidate_ph12(void); 482 483 #endif /* _HANDLER_H */ 484