projects / dragonfly.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | history | HEAD
Move tcpdump-3.9/ to tcpdump/. No need for a versioned dir.
[dragonfly.git] / contrib / tcpdump / isakmp.h
CommitLineData
c8cf0f94
PA		 1/*
2 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of the project nor the names of its contributors
14 * may be used to endorse or promote products derived from this software
15 * without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 */
29/* YIPS @(#)$Id: isakmp.h,v 1.10 2002/12/11 07:13:54 guy Exp $ */
30
31/* refer to RFC 2408 */
32
33/* must include <netinet/in.h> */
34
35#if !defined(_ISAKMP_H_)
36#define _ISAKMP_H_
37
38typedef u_char cookie_t[8];
39typedef u_char msgid_t[4];
40
41typedef struct { /* i_cookie + r_cookie */
42 cookie_t i_ck;
43 cookie_t r_ck;
44} isakmp_index;
45
46#define INITIATOR 1
47#define RESPONDER 2
48
49#define PORT_ISAKMP 500
50
51#define GENERATE 1
52#define VALIDATE 0
53
54/* Phase of oakley definition */
55/*
56 0000 0000 0000 0000
57 | |||| ||||
58 | |||| ++++--> negosiation number in phase
59 | ++++-------> phase number
60 +---------------> expire ?
61 */
62#define ISAKMP_PH1 0x0010
63#define ISAKMP_PH2 0x0020
64#define ISAKMP_EXPIRED 0x0100
65
66#define ISAKMP_NGP_0 0x0000
67#define ISAKMP_NGP_1 0x0001
68#define ISAKMP_NGP_2 0x0002
69#define ISAKMP_NGP_3 0x0003
70#define ISAKMP_NGP_4 0x0004
71
72#define ISAKMP_PH1_N (ISAKMP_PH1 | ISAKMP_NGP_0) /* i.e. spawn */
73#define ISAKMP_PH1_1 (ISAKMP_PH1 | ISAKMP_NGP_1)
74#define ISAKMP_PH1_2 (ISAKMP_PH1 | ISAKMP_NGP_2)
75#define ISAKMP_PH1_3 (ISAKMP_PH1 | ISAKMP_NGP_3)
76#define ISAKMP_PH2_N (ISAKMP_PH2 | ISAKMP_NGP_0)
77#define ISAKMP_PH2_1 (ISAKMP_PH2 | ISAKMP_NGP_1)
78#define ISAKMP_PH2_2 (ISAKMP_PH2 | ISAKMP_NGP_2)
79#define ISAKMP_PH2_3 (ISAKMP_PH2 | ISAKMP_NGP_3)
80
81#define ISAKMP_TIMER_DEFAULT 10 /* seconds */
82#define ISAKMP_TRY_DEFAULT 3 /* times */
83
84/* 3.1 ISAKMP Header Format
85 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
86 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
87 ! Initiator !
88 ! Cookie !
89 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
90 ! Responder !
91 ! Cookie !
92 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
93 ! Next Payload ! MjVer ! MnVer ! Exchange Type ! Flags !
94 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
95 ! Message ID !
96 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
97 ! Length !
98 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
99*/
100struct isakmp {
101 cookie_t i_ck; /* Initiator Cookie */
102 cookie_t r_ck; /* Responder Cookie */
103 u_int8_t np; /* Next Payload Type */
104 u_int8_t vers;
105#define ISAKMP_VERS_MAJOR 0xf0
106#define ISAKMP_VERS_MAJOR_SHIFT 4
107#define ISAKMP_VERS_MINOR 0x0f
108#define ISAKMP_VERS_MINOR_SHIFT 0
109 u_int8_t etype; /* Exchange Type */
110 u_int8_t flags; /* Flags */
111 msgid_t msgid;
112 u_int32_t len; /* Length */
113};
114
115/* Next Payload Type */
116#define ISAKMP_NPTYPE_NONE 0 /* NONE*/
117#define ISAKMP_NPTYPE_SA 1 /* Security Association */
118#define ISAKMP_NPTYPE_P 2 /* Proposal */
119#define ISAKMP_NPTYPE_T 3 /* Transform */
120#define ISAKMP_NPTYPE_KE 4 /* Key Exchange */
121#define ISAKMP_NPTYPE_ID 5 /* Identification */
122#define ISAKMP_NPTYPE_CERT 6 /* Certificate */
123#define ISAKMP_NPTYPE_CR 7 /* Certificate Request */
124#define ISAKMP_NPTYPE_HASH 8 /* Hash */
125#define ISAKMP_NPTYPE_SIG 9 /* Signature */
126#define ISAKMP_NPTYPE_NONCE 10 /* Nonce */
127#define ISAKMP_NPTYPE_N 11 /* Notification */
128#define ISAKMP_NPTYPE_D 12 /* Delete */
129#define ISAKMP_NPTYPE_VID 13 /* Vendor ID */
130
131#define ISAKMP_MAJOR_VERSION 1
132#define ISAKMP_MINOR_VERSION 0
133
134/* Exchange Type */
135#define ISAKMP_ETYPE_NONE 0 /* NONE */
136#define ISAKMP_ETYPE_BASE 1 /* Base */
137#define ISAKMP_ETYPE_IDENT 2 /* Identity Proteciton */
138#define ISAKMP_ETYPE_AUTH 3 /* Authentication Only */
139#define ISAKMP_ETYPE_AGG 4 /* Aggressive */
140#define ISAKMP_ETYPE_INF 5 /* Informational */
141
142/* Flags */
143#define ISAKMP_FLAG_E 0x01 /* Encryption Bit */
144#define ISAKMP_FLAG_C 0x02 /* Commit Bit */
145
146/* 3.2 Payload Generic Header
147 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
148 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
149 ! Next Payload ! RESERVED ! Payload Length !
150 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
151*/
152struct isakmp_gen {
153 u_int8_t np; /* Next Payload */
154 u_int8_t reserved; /* RESERVED, unused, must set to 0 */
155 u_int16_t len; /* Payload Length */
156};
157
158/* 3.3 Data Attributes
159 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
160 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
161 !A! Attribute Type ! AF=0 Attribute Length !
162 !F! ! AF=1 Attribute Value !
163 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
164 . AF=0 Attribute Value .
165 . AF=1 Not Transmitted .
166 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
167*/
168struct isakmp_data {
169 u_int16_t type; /* defined by DOI-spec, and Attribute Format */
170 u_int16_t lorv; /* if f equal 1, Attribute Length */
171 /* if f equal 0, Attribute Value */
172 /* if f equal 1, Attribute Value */
173};
174#define ISAKMP_GEN_TLV 0x0000
175#define ISAKMP_GEN_TV 0x8000
176 /* mask for type of attribute format */
177#define ISAKMP_GEN_MASK 0x8000
178
179/* 3.4 Security Association Payload */
180 /* MAY NOT be used, because of being defined in ipsec-doi. */
181 /*
182 If the current payload is the last in the message,
183 then the value of the next payload field will be 0.
184 This field MUST NOT contain the
185 values for the Proposal or Transform payloads as they are considered
186 part of the security association negotiation. For example, this
187 field would contain the value "10" (Nonce payload) in the first
188 message of a Base Exchange (see Section 4.4) and the value "0" in the
189 first message of an Identity Protect Exchange (see Section 4.5).
190 */
191struct isakmp_pl_sa {
192 struct isakmp_gen h;
193 u_int32_t doi; /* Domain of Interpretation */
194 u_int32_t sit; /* Situation */
195};
196
197/* 3.5 Proposal Payload */
198 /*
199 The value of the next payload field MUST only contain the value "2"
200 or "0". If there are additional Proposal payloads in the message,
201 then this field will be 2. If the current Proposal payload is the
202 last within the security association proposal, then this field will
203 be 0.
204 */
205struct isakmp_pl_p {
206 struct isakmp_gen h;
207 u_int8_t p_no; /* Proposal # */
208 u_int8_t prot_id; /* Protocol */
209 u_int8_t spi_size; /* SPI Size */
210 u_int8_t num_t; /* Number of Transforms */
211 /* SPI */
212};
213
214/* 3.6 Transform Payload */
215 /*
216 The value of the next payload field MUST only contain the value "3"
217 or "0". If there are additional Transform payloads in the proposal,
218 then this field will be 3. If the current Transform payload is the
219 last within the proposal, then this field will be 0.
220 */
221struct isakmp_pl_t {
222 struct isakmp_gen h;
223 u_int8_t t_no; /* Transform # */
224 u_int8_t t_id; /* Transform-Id */
225 u_int16_t reserved; /* RESERVED2 */
226 /* SA Attributes */
227};
228
229/* 3.7 Key Exchange Payload */
230struct isakmp_pl_ke {
231 struct isakmp_gen h;
232 /* Key Exchange Data */
233};
234
235/* 3.8 Identification Payload */
236 /* MUST NOT to be used, because of being defined in ipsec-doi. */
237struct isakmp_pl_id {
238 struct isakmp_gen h;
239 union {
240 u_int8_t id_type; /* ID Type */
241 u_int32_t doi_data; /* DOI Specific ID Data */
242 } d;
243 /* Identification Data */
244};
245
246/* 3.9 Certificate Payload */
247struct isakmp_pl_cert {
248 struct isakmp_gen h;
249 u_int8_t encode; /* Cert Encoding */
250 char cert; /* Certificate Data */
251 /*
252 This field indicates the type of
253 certificate or certificate-related information contained in the
254 Certificate Data field.
255 */
256};
257
258/* Certificate Type */
259#define ISAKMP_CERT_NONE 0
260#define ISAKMP_CERT_PKCS 1
261#define ISAKMP_CERT_PGP 2
262#define ISAKMP_CERT_DNS 3
263#define ISAKMP_CERT_SIGN 4
264#define ISAKMP_CERT_KE 5
265#define ISAKMP_CERT_KT 6
266#define ISAKMP_CERT_CRL 7
267#define ISAKMP_CERT_ARL 8
268#define ISAKMP_CERT_SPKI 9
269
270/* 3.10 Certificate Request Payload */
271struct isakmp_pl_cr {
272 struct isakmp_gen h;
273 u_int8_t num_cert; /* # Cert. Types */
274 /*
275 Certificate Types (variable length)
276 -- Contains a list of the types of certificates requested,
277 sorted in order of preference. Each individual certificate
278 type is 1 octet. This field is NOT requiredo
279 */
280 /* # Certificate Authorities (1 octet) */
281 /* Certificate Authorities (variable length) */
282};
283
284/* 3.11 Hash Payload */
285 /* may not be used, because of having only data. */
286struct isakmp_pl_hash {
287 struct isakmp_gen h;
288 /* Hash Data */
289};
290
291/* 3.12 Signature Payload */
292 /* may not be used, because of having only data. */
293struct isakmp_pl_sig {
294 struct isakmp_gen h;
295 /* Signature Data */
296};
297
298/* 3.13 Nonce Payload */
299 /* may not be used, because of having only data. */
300struct isakmp_pl_nonce {
301 struct isakmp_gen h;
302 /* Nonce Data */
303};
304
305/* 3.14 Notification Payload */
306struct isakmp_pl_n {
307 struct isakmp_gen h;
308 u_int32_t doi; /* Domain of Interpretation */
309 u_int8_t prot_id; /* Protocol-ID */
310 u_int8_t spi_size; /* SPI Size */
311 u_int16_t type; /* Notify Message Type */
312 /* SPI */
313 /* Notification Data */
314};
315
316/* 3.14.1 Notify Message Types */
317/* NOTIFY MESSAGES - ERROR TYPES */
318#define ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE 1
319#define ISAKMP_NTYPE_DOI_NOT_SUPPORTED 2
320#define ISAKMP_NTYPE_SITUATION_NOT_SUPPORTED 3
321#define ISAKMP_NTYPE_INVALID_COOKIE 4
322#define ISAKMP_NTYPE_INVALID_MAJOR_VERSION 5
323#define ISAKMP_NTYPE_INVALID_MINOR_VERSION 6
324#define ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE 7
325#define ISAKMP_NTYPE_INVALID_FLAGS 8
326#define ISAKMP_NTYPE_INVALID_MESSAGE_ID 9
327#define ISAKMP_NTYPE_INVALID_PROTOCOL_ID 10
328#define ISAKMP_NTYPE_INVALID_SPI 11
329#define ISAKMP_NTYPE_INVALID_TRANSFORM_ID 12
330#define ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED 13
331#define ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN 14
332#define ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX 15
333#define ISAKMP_NTYPE_PAYLOAD_MALFORMED 16
334#define ISAKMP_NTYPE_INVALID_KEY_INFORMATION 17
335#define ISAKMP_NTYPE_INVALID_ID_INFORMATION 18
336#define ISAKMP_NTYPE_INVALID_CERT_ENCODING 19
337#define ISAKMP_NTYPE_INVALID_CERTIFICATE 20
338#define ISAKMP_NTYPE_BAD_CERT_REQUEST_SYNTAX 21
339#define ISAKMP_NTYPE_INVALID_CERT_AUTHORITY 22
340#define ISAKMP_NTYPE_INVALID_HASH_INFORMATION 23
341#define ISAKMP_NTYPE_AUTHENTICATION_FAILED 24
342#define ISAKMP_NTYPE_INVALID_SIGNATURE 25
343#define ISAKMP_NTYPE_ADDRESS_NOTIFICATION 26
344/* NOTIFY MESSAGES - STATUS TYPES */
345#define ISAKMP_NTYPE_CONNECTED 16384
346/* using only to log */
347#define ISAKMP_LOG_RETRY_LIMIT_REACHED 65530
348
349/* 3.15 Delete Payload */
350struct isakmp_pl_d {
351 struct isakmp_gen h;
352 u_int32_t doi; /* Domain of Interpretation */
353 u_int8_t prot_id; /* Protocol-Id */
354 u_int8_t spi_size; /* SPI Size */
355 u_int16_t num_spi; /* # of SPIs */
356 /* SPI(es) */
357};
358
359\f
360struct isakmp_ph1tab {
361 struct isakmp_ph1 *head;
362 struct isakmp_ph1 *tail;
363 int len;
364};
365
366struct isakmp_ph2tab {
367 struct isakmp_ph2 *head;
368 struct isakmp_ph2 *tail;
369 int len;
370};
371
372#define EXCHANGE_PROXY 1
373#define EXCHANGE_MYSELF 0
374
375#define PFS_NEED 1
376#define PFS_NONEED 0
377
378#endif /* !defined(_ISAKMP_H_) */
DragonFly Project GIT Source repo