1 /* $NetBSD: handler.h,v 1.25 2010/11/17 10:40:41 tteras Exp $ */ 2 3 /* Id: handler.h,v 1.19 2006/02/25 08:25:12 manubsd Exp */ 4 5 /* 6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. Neither the name of the project nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #ifndef _HANDLER_H 35 #define _HANDLER_H 36 37 #include <sys/queue.h> 38 #include <openssl/rsa.h> 39 40 #include <sys/time.h> 41 42 #include "isakmp_var.h" 43 #include "oakley.h" 44 #include "schedule.h" 45 #include "evt.h" 46 47 /* Phase 1 handler */ 48 /* 49 * main mode: 50 * initiator responder 51 * 0 (---) (---) 52 * 1 start start (1st msg received) 53 * 2 (---) 1st valid msg received 54 * 3 1st msg sent 1st msg sent 55 * 4 1st valid msg received 2st valid msg received 56 * 5 2nd msg sent 2nd msg sent 57 * 6 2nd valid msg received 3rd valid msg received 58 * 7 3rd msg sent 3rd msg sent 59 * 8 3rd valid msg received (---) 60 * 9 SA established SA established 61 * 62 * aggressive mode: 63 * initiator responder 64 * 0 (---) (---) 65 * 1 start start (1st msg received) 66 * 2 (---) 1st valid msg received 67 * 3 1st msg sent 1st msg sent 68 * 4 1st valid msg received 2st valid msg received 69 * 5 (---) (---) 70 * 6 (---) (---) 71 * 7 (---) (---) 72 * 8 (---) (---) 73 * 9 SA established SA established 74 * 75 * base mode: 76 * initiator responder 77 * 0 (---) (---) 78 * 1 start start (1st msg received) 79 * 2 (---) 1st valid msg received 80 * 3 1st msg sent 1st msg sent 81 * 4 1st valid msg received 2st valid msg received 82 * 5 2nd msg sent (---) 83 * 6 (---) (---) 84 * 7 (---) (---) 85 * 8 (---) (---) 86 * 9 SA established SA established 87 */ 88 #define PHASE1ST_SPAWN 0 89 #define PHASE1ST_START 1 90 #define PHASE1ST_MSG1RECEIVED 2 91 #define PHASE1ST_MSG1SENT 3 92 #define PHASE1ST_MSG2RECEIVED 4 93 #define PHASE1ST_MSG2SENT 5 94 #define PHASE1ST_MSG3RECEIVED 6 95 #define PHASE1ST_MSG3SENT 7 96 #define PHASE1ST_MSG4RECEIVED 8 97 #define PHASE1ST_ESTABLISHED 9 98 #define PHASE1ST_DYING 10 99 #define PHASE1ST_EXPIRED 11 100 #define PHASE1ST_MAX 12 101 102 /* About address semantics in each case. 103 * initiator(addr=I) responder(addr=R) 104 * src dst src dst 105 * (local) (remote) (local) (remote) 106 * phase 1 handler I R R I 107 * phase 2 handler I R R I 108 * getspi msg R I I R 109 * acquire msg I R 110 * ID payload I R I R 111 */ 112 #ifdef ENABLE_HYBRID 113 struct isakmp_cfg_state; 114 #endif 115 struct ph1handle { 116 isakmp_index index; 117 118 int status; /* status of this SA */ 119 int side; /* INITIATOR or RESPONDER */ 120 121 struct sockaddr *remote; /* remote address to negosiate ph1 */ 122 struct sockaddr *local; /* local address to negosiate ph1 */ 123 /* XXX copy from rmconf due to anonymous configuration. 124 * If anonymous will be forbidden, we do delete them. */ 125 126 struct remoteconf *rmconf; /* pointer to remote configuration */ 127 128 struct isakmpsa *approval; /* pointer to SA(s) approved. */ 129 vchar_t *authstr; /* place holder of string for auth. */ 130 /* for example pre-shared key */ 131 132 u_int8_t version; /* ISAKMP version */ 133 u_int8_t etype; /* Exchange type actually for use */ 134 u_int8_t flags; /* Flags */ 135 u_int32_t msgid; /* message id */ 136 137 u_int32_t vendorid_mask; /* bitmask of received supported vendor ids*/ 138 #ifdef ENABLE_NATT 139 struct ph1natt_options *natt_options; /* Selected NAT-T IKE version */ 140 u_int32_t natt_flags; /* NAT-T related flags */ 141 #endif 142 #ifdef ENABLE_FRAG 143 int frag; /* IKE phase 1 fragmentation */ 144 struct isakmp_frag_item *frag_chain; /* Received fragments */ 145 #endif 146 147 struct sched sce; /* schedule for expire */ 148 149 struct sched scr; /* schedule for resend */ 150 int retry_counter; /* for resend. */ 151 vchar_t *sendbuf; /* buffer for re-sending */ 152 153 vchar_t *dhpriv; /* DH; private value */ 154 vchar_t *dhpub; /* DH; public value */ 155 vchar_t *dhpub_p; /* DH; partner's public value */ 156 vchar_t *dhgxy; /* DH; shared secret */ 157 vchar_t *nonce; /* nonce value */ 158 vchar_t *nonce_p; /* partner's nonce value */ 159 vchar_t *skeyid; /* SKEYID */ 160 vchar_t *skeyid_d; /* SKEYID_d */ 161 vchar_t *skeyid_a; /* SKEYID_a, i.e. hash */ 162 vchar_t *skeyid_e; /* SKEYID_e, i.e. encryption */ 163 vchar_t *key; /* cipher key */ 164 vchar_t *hash; /* HASH minus general header */ 165 vchar_t *sig; /* SIG minus general header */ 166 vchar_t *sig_p; /* peer's SIG minus general header */ 167 vchar_t *cert; /* CERT minus general header */ 168 vchar_t *cert_p; /* peer's CERT minus general header */ 169 vchar_t *crl_p; /* peer's CRL minus general header */ 170 vchar_t *cr_p; /* peer's CR not including general */ 171 RSA *rsa; /* my RSA key */ 172 RSA *rsa_p; /* peer's RSA key */ 173 struct genlist *rsa_candidates; /* possible candidates for peer's RSA key */ 174 vchar_t *id; /* ID minus gen header */ 175 vchar_t *id_p; /* partner's ID minus general header */ 176 /* i.e. struct ipsecdoi_id_b*. */ 177 struct isakmp_ivm *ivm; /* IVs */ 178 179 vchar_t *sa; /* whole SA payload to send/to be sent*/ 180 /* to calculate HASH */ 181 /* NOT INCLUDING general header. */ 182 183 vchar_t *sa_ret; /* SA payload to reply/to be replyed */ 184 /* NOT INCLUDING general header. */ 185 /* NOTE: Should be release after use. */ 186 187 #ifdef HAVE_GSSAPI 188 void *gssapi_state; /* GSS-API specific state. */ 189 /* Allocated when needed */ 190 vchar_t *gi_i; /* optional initiator GSS id */ 191 vchar_t *gi_r; /* optional responder GSS id */ 192 #endif 193 194 struct isakmp_pl_hash *pl_hash; /* pointer to hash payload */ 195 196 time_t created; /* timestamp for establish */ 197 int initial_contact_received; /* set if initial contact received */ 198 #ifdef ENABLE_STATS 199 struct timeval start; 200 struct timeval end; 201 #endif 202 203 #ifdef ENABLE_DPD 204 int dpd_support; /* Does remote supports DPD ? */ 205 u_int32_t dpd_last_ack; 206 u_int32_t dpd_seq; /* DPD seq number to receive */ 207 u_int8_t dpd_fails; /* number of failures */ 208 struct sched dpd_r_u; 209 #endif 210 211 u_int32_t msgid2; /* msgid counter for Phase 2 */ 212 int ph2cnt; /* the number which is negotiated by this phase 1 */ 213 LIST_HEAD(_ph2ofph1_, ph2handle) ph2tree; 214 215 LIST_ENTRY(ph1handle) chain; 216 #ifdef ENABLE_HYBRID 217 struct isakmp_cfg_state *mode_cfg; /* ISAKMP mode config state */ 218 #endif 219 EVT_LISTENER_LIST(evt_listeners); 220 }; 221 222 /* For limiting enumeration of ph1 tree */ 223 struct ph1selector { 224 struct sockaddr *local; 225 struct sockaddr *remote; 226 }; 227 228 /* Phase 2 handler */ 229 /* allocated per a SA or SA bundles of a pair of peer's IP addresses. */ 230 /* 231 * initiator responder 232 * 0 (---) (---) 233 * 1 start start (1st msg received) 234 * 2 acquire msg get 1st valid msg received 235 * 3 getspi request sent getspi request sent 236 * 4 getspi done getspi done 237 * 5 1st msg sent 1st msg sent 238 * 6 1st valid msg received 2nd valid msg received 239 * 7 (commit bit) (commit bit) 240 * 8 SAs added SAs added 241 * 9 SAs established SAs established 242 * 10 SAs expired SAs expired 243 */ 244 #define PHASE2ST_SPAWN 0 245 #define PHASE2ST_START 1 246 #define PHASE2ST_STATUS2 2 247 #define PHASE2ST_GETSPISENT 3 248 #define PHASE2ST_GETSPIDONE 4 249 #define PHASE2ST_MSG1SENT 5 250 #define PHASE2ST_STATUS6 6 251 #define PHASE2ST_COMMIT 7 252 #define PHASE2ST_ADDSA 8 253 #define PHASE2ST_ESTABLISHED 9 254 #define PHASE2ST_EXPIRED 10 255 #define PHASE2ST_MAX 11 256 257 struct ph2handle { 258 /* source and destination addresses used for IKE exchange. Might 259 * differ from source and destination of SA. On the initiator, 260 * they are tweaked if a hint is available in the SPD (set by 261 * MIGRATE for instance). Otherwise they are the source and 262 * destination of SA for transport mode and the tunnel endpoints 263 * for tunnel mode */ 264 struct sockaddr *src; 265 struct sockaddr *dst; 266 267 /* source and destination addresses of the SA in the case addresses 268 * used for IKE exchanges (src and dst) do differ. On the initiator, 269 * they are set (if needed) in pk_recvacquire(). On the responder, 270 * they are _derived_ from the local and remote parameters of the 271 * SP, if available. */ 272 struct sockaddr *sa_src; 273 struct sockaddr *sa_dst; 274 275 /* Store our Phase 2 ID and the peer ID (ID minus general header). 276 * On the initiator, they are set during ACQUIRE processing. 277 * On the responder, they are set from the content of ID payload 278 * in quick_r1recv(). Then, if they are of type address or 279 * tunnel, they are compared to sainfo selectors. 280 */ 281 vchar_t *id; /* ID minus gen header */ 282 vchar_t *id_p; /* peer's ID minus general header */ 283 284 #ifdef ENABLE_NATT 285 struct sockaddr *natoa_src; /* peer's view of my address */ 286 struct sockaddr *natoa_dst; /* peer's view of his address */ 287 #endif 288 289 u_int32_t spid; /* policy id by kernel */ 290 291 int status; /* ipsec sa status */ 292 u_int8_t side; /* INITIATOR or RESPONDER */ 293 294 struct sched sce; /* schedule for expire */ 295 struct sched scr; /* schedule for resend */ 296 int retry_counter; /* for resend. */ 297 vchar_t *sendbuf; /* buffer for re-sending */ 298 vchar_t *msg1; /* buffer for re-sending */ 299 /* used for responder's first message */ 300 301 int retry_checkph1; /* counter to wait phase 1 finished. */ 302 /* NOTE: actually it's timer. */ 303 304 u_int32_t seq; /* sequence number used by PF_KEY */ 305 /* 306 * NOTE: In responder side, we can't identify each SAs 307 * with same destination address for example, when 308 * socket based SA is required. So we set a identifier 309 * number to "seq", and sent kernel by pfkey. 310 */ 311 u_int8_t satype; /* satype in PF_KEY */ 312 /* 313 * saved satype in the original PF_KEY request from 314 * the kernel in order to reply a error. 315 */ 316 317 u_int8_t flags; /* Flags for phase 2 */ 318 u_int32_t msgid; /* msgid for phase 2 */ 319 320 struct sainfo *sainfo; /* place holder of sainfo */ 321 struct saprop *proposal; /* SA(s) proposal. */ 322 struct saprop *approval; /* SA(s) approved. */ 323 u_int32_t lifetime_secs; /* responder lifetime (seconds) */ 324 u_int32_t lifetime_kb; /* responder lifetime (kbytes) */ 325 caddr_t spidx_gen; /* policy from peer's proposal */ 326 327 struct dhgroup *pfsgrp; /* DH; prime number */ 328 vchar_t *dhpriv; /* DH; private value */ 329 vchar_t *dhpub; /* DH; public value */ 330 vchar_t *dhpub_p; /* DH; partner's public value */ 331 vchar_t *dhgxy; /* DH; shared secret */ 332 vchar_t *nonce; /* nonce value in phase 2 */ 333 vchar_t *nonce_p; /* partner's nonce value in phase 2 */ 334 335 vchar_t *sa; /* whole SA payload to send/to be sent*/ 336 /* to calculate HASH */ 337 /* NOT INCLUDING general header. */ 338 339 vchar_t *sa_ret; /* SA payload to reply/to be replyed */ 340 /* NOT INCLUDING general header. */ 341 /* NOTE: Should be release after use. */ 342 343 struct isakmp_ivm *ivm; /* IVs */ 344 345 int generated_spidx; /* mark handlers whith generated policy */ 346 347 #ifdef ENABLE_STATS 348 struct timeval start; 349 struct timeval end; 350 #endif 351 struct ph1handle *ph1; /* back pointer to isakmp status */ 352 353 LIST_ENTRY(ph2handle) chain; 354 LIST_ENTRY(ph2handle) ph1bind; /* chain to ph1handle */ 355 EVT_LISTENER_LIST(evt_listeners); 356 }; 357 358 /* For limiting enumeration of ph2 tree */ 359 struct ph2selector { 360 u_int32_t spid; 361 struct sockaddr *src; 362 struct sockaddr *dst; 363 }; 364 365 /* 366 * for handling initial contact. 367 */ 368 struct contacted { 369 struct sockaddr *remote; /* remote address to negosiate ph1 */ 370 LIST_ENTRY(contacted) chain; 371 }; 372 373 /* 374 * for checking a packet retransmited. 375 */ 376 struct recvdpkt { 377 struct sockaddr *remote; /* the remote address */ 378 struct sockaddr *local; /* the local address */ 379 vchar_t *hash; /* hash of the received packet */ 380 vchar_t *sendbuf; /* buffer for the response */ 381 int retry_counter; /* how many times to send */ 382 struct timeval time_send; /* timestamp of previous send */ 383 384 LIST_ENTRY(recvdpkt) chain; 385 }; 386 387 /* for parsing ISAKMP header. */ 388 struct isakmp_parse_t { 389 u_char type; /* payload type of mine */ 390 int len; /* ntohs(ptr->len) */ 391 struct isakmp_gen *ptr; 392 }; 393 394 /* 395 * for IV management. 396 * 397 * - normal case 398 * initiator responder 399 * ------------------------- -------------------------- 400 * initialize iv(A), ive(A). initialize iv(A), ive(A). 401 * encode by ive(A). 402 * save to iv(B). ---[packet(B)]--> save to ive(B). 403 * decode by iv(A). 404 * packet consistency. 405 * sync iv(B) with ive(B). 406 * check auth, integrity. 407 * encode by ive(B). 408 * save to ive(C). <--[packet(C)]--- save to iv(C). 409 * decoded by iv(B). 410 * : 411 * 412 * - In the case that a error is found while cipher processing, 413 * initiator responder 414 * ------------------------- -------------------------- 415 * initialize iv(A), ive(A). initialize iv(A), ive(A). 416 * encode by ive(A). 417 * save to iv(B). ---[packet(B)]--> save to ive(B). 418 * decode by iv(A). 419 * packet consistency. 420 * sync iv(B) with ive(B). 421 * check auth, integrity. 422 * error found. 423 * create notify. 424 * get ive2(X) from iv(B). 425 * encode by ive2(X). 426 * get iv2(X) from iv(B). <--[packet(Y)]--- save to iv2(Y). 427 * save to ive2(Y). 428 * decoded by iv2(X). 429 * : 430 * 431 * The reason why the responder synchronizes iv with ive after checking the 432 * packet consistency is that it is required to leave the IV for decoding 433 * packet. Because there is a potential of error while checking the packet 434 * consistency. Also the reason why that is before authentication and 435 * integirty check is that the IV for informational exchange has to be made 436 * by the IV which is after packet decoded and checking the packet consistency. 437 * Otherwise IV mismatched happens between the intitiator and the responder. 438 */ 439 struct isakmp_ivm { 440 vchar_t *iv; /* for decoding packet */ 441 /* if phase 1, it's for computing phase2 iv */ 442 vchar_t *ive; /* for encoding packet */ 443 }; 444 445 /* for dumping */ 446 struct ph1dump { 447 isakmp_index index; 448 int status; 449 int side; 450 struct sockaddr_storage remote; 451 struct sockaddr_storage local; 452 u_int8_t version; 453 u_int8_t etype; 454 time_t created; 455 int ph2cnt; 456 }; 457 458 struct sockaddr; 459 struct ph1handle; 460 struct ph2handle; 461 struct policyindex; 462 463 extern struct ph1handle *getph1byindex __P((isakmp_index *)); 464 extern struct ph1handle *getph1byindex0 __P((isakmp_index *)); 465 466 extern int enumph1 __P((struct ph1selector *ph1sel, 467 int (* enum_func)(struct ph1handle *iph1, void *arg), 468 void *enum_arg)); 469 470 #define GETPH1_F_ESTABLISHED 0x0001 471 472 extern struct ph1handle *getph1 __P((struct ph1handle *ph1hint, 473 struct sockaddr *local, 474 struct sockaddr *remote, 475 int flags)); 476 477 #define getph1byaddr(local, remote, est) \ 478 getph1(NULL, local, remote, est ? GETPH1_F_ESTABLISHED : 0) 479 #define getph1bydstaddr(remote) \ 480 getph1(NULL, NULL, remote, 0) 481 482 #ifdef ENABLE_HYBRID 483 struct ph1handle *getph1bylogin __P((char *)); 484 int purgeph1bylogin __P((char *)); 485 #endif 486 extern void migrate_ph12 __P((struct ph1handle *old_iph1, struct ph1handle *new_iph1)); 487 extern void migrate_dying_ph12 __P((struct ph1handle *iph1)); 488 extern vchar_t *dumpph1 __P((void)); 489 extern struct ph1handle *newph1 __P((void)); 490 extern void delph1 __P((struct ph1handle *)); 491 extern int insph1 __P((struct ph1handle *)); 492 extern void remph1 __P((struct ph1handle *)); 493 extern int resolveph1rmconf __P((struct ph1handle *)); 494 extern void flushph1 __P((void)); 495 extern void initph1tree __P((void)); 496 extern int ph1_rekey_enabled __P((struct ph1handle *)); 497 498 extern int enumph2 __P((struct ph2selector *ph2sel, 499 int (* enum_func)(struct ph2handle *iph2, void *arg), 500 void *enum_arg)); 501 extern struct ph2handle *getph2byseq __P((u_int32_t)); 502 extern struct ph2handle *getph2bysaddr __P((struct sockaddr *, 503 struct sockaddr *)); 504 extern struct ph2handle *getph2bymsgid __P((struct ph1handle *, u_int32_t)); 505 extern struct ph2handle *getph2byid __P((struct sockaddr *, 506 struct sockaddr *, u_int32_t)); 507 extern struct ph2handle *getph2bysaidx __P((struct sockaddr *, 508 struct sockaddr *, u_int, u_int32_t)); 509 extern struct ph2handle *newph2 __P((void)); 510 extern void initph2 __P((struct ph2handle *)); 511 extern void delph2 __P((struct ph2handle *)); 512 extern int insph2 __P((struct ph2handle *)); 513 extern void remph2 __P((struct ph2handle *)); 514 extern void flushph2 __P((void)); 515 extern void deleteallph2 __P((struct sockaddr *, struct sockaddr *, u_int)); 516 extern void initph2tree __P((void)); 517 518 extern void bindph12 __P((struct ph1handle *, struct ph2handle *)); 519 extern void unbindph12 __P((struct ph2handle *)); 520 521 extern struct contacted *getcontacted __P((struct sockaddr *)); 522 extern int inscontacted __P((struct sockaddr *)); 523 extern void remcontacted __P((struct sockaddr *)); 524 extern void initctdtree __P((void)); 525 526 extern int check_recvdpkt __P((struct sockaddr *, 527 struct sockaddr *, vchar_t *)); 528 extern int add_recvdpkt __P((struct sockaddr *, struct sockaddr *, 529 vchar_t *, vchar_t *)); 530 extern void init_recvdpkt __P((void)); 531 532 #ifdef ENABLE_HYBRID 533 extern int exclude_cfg_addr __P((const struct sockaddr *)); 534 #endif 535 536 extern int revalidate_ph12(void); 537 538 #endif /* _HANDLER_H */ 539