| 1 | /* |
| 2 | * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. |
| 3 | * All rights reserved. |
| 4 | * |
| 5 | * Redistribution and use in source and binary forms, with or without |
| 6 | * modification, are permitted provided that the following conditions |
| 7 | * are met: |
| 8 | * 1. Redistributions of source code must retain the above copyright |
| 9 | * notice, this list of conditions and the following disclaimer. |
| 10 | * 2. Redistributions in binary form must reproduce the above copyright |
| 11 | * notice, this list of conditions and the following disclaimer in the |
| 12 | * documentation and/or other materials provided with the distribution. |
| 13 | * 3. Neither the name of the project nor the names of its contributors |
| 14 | * may be used to endorse or promote products derived from this software |
| 15 | * without specific prior written permission. |
| 16 | * |
| 17 | * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND |
| 18 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| 19 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
| 20 | * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE |
| 21 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
| 22 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
| 23 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
| 24 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
| 25 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
| 26 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
| 27 | * SUCH DAMAGE. |
| 28 | */ |
| 29 | /* YIPS @(#)$Id: isakmp.h,v 1.10 2002/12/11 07:13:54 guy Exp $ */ |
| 30 | |
| 31 | /* refer to RFC 2408 */ |
| 32 | |
| 33 | /* must include <netinet/in.h> */ |
| 34 | |
| 35 | #if !defined(_ISAKMP_H_) |
| 36 | #define _ISAKMP_H_ |
| 37 | |
| 38 | typedef u_char cookie_t[8]; |
| 39 | typedef u_char msgid_t[4]; |
| 40 | |
| 41 | typedef struct { /* i_cookie + r_cookie */ |
| 42 | cookie_t i_ck; |
| 43 | cookie_t r_ck; |
| 44 | } isakmp_index; |
| 45 | |
| 46 | #define INITIATOR 1 |
| 47 | #define RESPONDER 2 |
| 48 | |
| 49 | #define PORT_ISAKMP 500 |
| 50 | |
| 51 | #define GENERATE 1 |
| 52 | #define VALIDATE 0 |
| 53 | |
| 54 | /* Phase of oakley definition */ |
| 55 | /* |
| 56 | 0000 0000 0000 0000 |
| 57 | | |||| |||| |
| 58 | | |||| ++++--> negosiation number in phase |
| 59 | | ++++-------> phase number |
| 60 | +---------------> expire ? |
| 61 | */ |
| 62 | #define ISAKMP_PH1 0x0010 |
| 63 | #define ISAKMP_PH2 0x0020 |
| 64 | #define ISAKMP_EXPIRED 0x0100 |
| 65 | |
| 66 | #define ISAKMP_NGP_0 0x0000 |
| 67 | #define ISAKMP_NGP_1 0x0001 |
| 68 | #define ISAKMP_NGP_2 0x0002 |
| 69 | #define ISAKMP_NGP_3 0x0003 |
| 70 | #define ISAKMP_NGP_4 0x0004 |
| 71 | |
| 72 | #define ISAKMP_PH1_N (ISAKMP_PH1 | ISAKMP_NGP_0) /* i.e. spawn */ |
| 73 | #define ISAKMP_PH1_1 (ISAKMP_PH1 | ISAKMP_NGP_1) |
| 74 | #define ISAKMP_PH1_2 (ISAKMP_PH1 | ISAKMP_NGP_2) |
| 75 | #define ISAKMP_PH1_3 (ISAKMP_PH1 | ISAKMP_NGP_3) |
| 76 | #define ISAKMP_PH2_N (ISAKMP_PH2 | ISAKMP_NGP_0) |
| 77 | #define ISAKMP_PH2_1 (ISAKMP_PH2 | ISAKMP_NGP_1) |
| 78 | #define ISAKMP_PH2_2 (ISAKMP_PH2 | ISAKMP_NGP_2) |
| 79 | #define ISAKMP_PH2_3 (ISAKMP_PH2 | ISAKMP_NGP_3) |
| 80 | |
| 81 | #define ISAKMP_TIMER_DEFAULT 10 /* seconds */ |
| 82 | #define ISAKMP_TRY_DEFAULT 3 /* times */ |
| 83 | |
| 84 | /* 3.1 ISAKMP Header Format |
| 85 | 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 |
| 86 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| 87 | ! Initiator ! |
| 88 | ! Cookie ! |
| 89 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| 90 | ! Responder ! |
| 91 | ! Cookie ! |
| 92 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| 93 | ! Next Payload ! MjVer ! MnVer ! Exchange Type ! Flags ! |
| 94 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| 95 | ! Message ID ! |
| 96 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| 97 | ! Length ! |
| 98 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| 99 | */ |
| 100 | struct isakmp { |
| 101 | cookie_t i_ck; /* Initiator Cookie */ |
| 102 | cookie_t r_ck; /* Responder Cookie */ |
| 103 | u_int8_t np; /* Next Payload Type */ |
| 104 | u_int8_t vers; |
| 105 | #define ISAKMP_VERS_MAJOR 0xf0 |
| 106 | #define ISAKMP_VERS_MAJOR_SHIFT 4 |
| 107 | #define ISAKMP_VERS_MINOR 0x0f |
| 108 | #define ISAKMP_VERS_MINOR_SHIFT 0 |
| 109 | u_int8_t etype; /* Exchange Type */ |
| 110 | u_int8_t flags; /* Flags */ |
| 111 | msgid_t msgid; |
| 112 | u_int32_t len; /* Length */ |
| 113 | }; |
| 114 | |
| 115 | /* Next Payload Type */ |
| 116 | #define ISAKMP_NPTYPE_NONE 0 /* NONE*/ |
| 117 | #define ISAKMP_NPTYPE_SA 1 /* Security Association */ |
| 118 | #define ISAKMP_NPTYPE_P 2 /* Proposal */ |
| 119 | #define ISAKMP_NPTYPE_T 3 /* Transform */ |
| 120 | #define ISAKMP_NPTYPE_KE 4 /* Key Exchange */ |
| 121 | #define ISAKMP_NPTYPE_ID 5 /* Identification */ |
| 122 | #define ISAKMP_NPTYPE_CERT 6 /* Certificate */ |
| 123 | #define ISAKMP_NPTYPE_CR 7 /* Certificate Request */ |
| 124 | #define ISAKMP_NPTYPE_HASH 8 /* Hash */ |
| 125 | #define ISAKMP_NPTYPE_SIG 9 /* Signature */ |
| 126 | #define ISAKMP_NPTYPE_NONCE 10 /* Nonce */ |
| 127 | #define ISAKMP_NPTYPE_N 11 /* Notification */ |
| 128 | #define ISAKMP_NPTYPE_D 12 /* Delete */ |
| 129 | #define ISAKMP_NPTYPE_VID 13 /* Vendor ID */ |
| 130 | |
| 131 | #define ISAKMP_MAJOR_VERSION 1 |
| 132 | #define ISAKMP_MINOR_VERSION 0 |
| 133 | |
| 134 | /* Exchange Type */ |
| 135 | #define ISAKMP_ETYPE_NONE 0 /* NONE */ |
| 136 | #define ISAKMP_ETYPE_BASE 1 /* Base */ |
| 137 | #define ISAKMP_ETYPE_IDENT 2 /* Identity Proteciton */ |
| 138 | #define ISAKMP_ETYPE_AUTH 3 /* Authentication Only */ |
| 139 | #define ISAKMP_ETYPE_AGG 4 /* Aggressive */ |
| 140 | #define ISAKMP_ETYPE_INF 5 /* Informational */ |
| 141 | |
| 142 | /* Flags */ |
| 143 | #define ISAKMP_FLAG_E 0x01 /* Encryption Bit */ |
| 144 | #define ISAKMP_FLAG_C 0x02 /* Commit Bit */ |
| 145 | |
| 146 | /* 3.2 Payload Generic Header |
| 147 | 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 |
| 148 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| 149 | ! Next Payload ! RESERVED ! Payload Length ! |
| 150 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| 151 | */ |
| 152 | struct isakmp_gen { |
| 153 | u_int8_t np; /* Next Payload */ |
| 154 | u_int8_t reserved; /* RESERVED, unused, must set to 0 */ |
| 155 | u_int16_t len; /* Payload Length */ |
| 156 | }; |
| 157 | |
| 158 | /* 3.3 Data Attributes |
| 159 | 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 |
| 160 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| 161 | !A! Attribute Type ! AF=0 Attribute Length ! |
| 162 | !F! ! AF=1 Attribute Value ! |
| 163 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| 164 | . AF=0 Attribute Value . |
| 165 | . AF=1 Not Transmitted . |
| 166 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| 167 | */ |
| 168 | struct isakmp_data { |
| 169 | u_int16_t type; /* defined by DOI-spec, and Attribute Format */ |
| 170 | u_int16_t lorv; /* if f equal 1, Attribute Length */ |
| 171 | /* if f equal 0, Attribute Value */ |
| 172 | /* if f equal 1, Attribute Value */ |
| 173 | }; |
| 174 | #define ISAKMP_GEN_TLV 0x0000 |
| 175 | #define ISAKMP_GEN_TV 0x8000 |
| 176 | /* mask for type of attribute format */ |
| 177 | #define ISAKMP_GEN_MASK 0x8000 |
| 178 | |
| 179 | /* 3.4 Security Association Payload */ |
| 180 | /* MAY NOT be used, because of being defined in ipsec-doi. */ |
| 181 | /* |
| 182 | If the current payload is the last in the message, |
| 183 | then the value of the next payload field will be 0. |
| 184 | This field MUST NOT contain the |
| 185 | values for the Proposal or Transform payloads as they are considered |
| 186 | part of the security association negotiation. For example, this |
| 187 | field would contain the value "10" (Nonce payload) in the first |
| 188 | message of a Base Exchange (see Section 4.4) and the value "0" in the |
| 189 | first message of an Identity Protect Exchange (see Section 4.5). |
| 190 | */ |
| 191 | struct isakmp_pl_sa { |
| 192 | struct isakmp_gen h; |
| 193 | u_int32_t doi; /* Domain of Interpretation */ |
| 194 | u_int32_t sit; /* Situation */ |
| 195 | }; |
| 196 | |
| 197 | /* 3.5 Proposal Payload */ |
| 198 | /* |
| 199 | The value of the next payload field MUST only contain the value "2" |
| 200 | or "0". If there are additional Proposal payloads in the message, |
| 201 | then this field will be 2. If the current Proposal payload is the |
| 202 | last within the security association proposal, then this field will |
| 203 | be 0. |
| 204 | */ |
| 205 | struct isakmp_pl_p { |
| 206 | struct isakmp_gen h; |
| 207 | u_int8_t p_no; /* Proposal # */ |
| 208 | u_int8_t prot_id; /* Protocol */ |
| 209 | u_int8_t spi_size; /* SPI Size */ |
| 210 | u_int8_t num_t; /* Number of Transforms */ |
| 211 | /* SPI */ |
| 212 | }; |
| 213 | |
| 214 | /* 3.6 Transform Payload */ |
| 215 | /* |
| 216 | The value of the next payload field MUST only contain the value "3" |
| 217 | or "0". If there are additional Transform payloads in the proposal, |
| 218 | then this field will be 3. If the current Transform payload is the |
| 219 | last within the proposal, then this field will be 0. |
| 220 | */ |
| 221 | struct isakmp_pl_t { |
| 222 | struct isakmp_gen h; |
| 223 | u_int8_t t_no; /* Transform # */ |
| 224 | u_int8_t t_id; /* Transform-Id */ |
| 225 | u_int16_t reserved; /* RESERVED2 */ |
| 226 | /* SA Attributes */ |
| 227 | }; |
| 228 | |
| 229 | /* 3.7 Key Exchange Payload */ |
| 230 | struct isakmp_pl_ke { |
| 231 | struct isakmp_gen h; |
| 232 | /* Key Exchange Data */ |
| 233 | }; |
| 234 | |
| 235 | /* 3.8 Identification Payload */ |
| 236 | /* MUST NOT to be used, because of being defined in ipsec-doi. */ |
| 237 | struct isakmp_pl_id { |
| 238 | struct isakmp_gen h; |
| 239 | union { |
| 240 | u_int8_t id_type; /* ID Type */ |
| 241 | u_int32_t doi_data; /* DOI Specific ID Data */ |
| 242 | } d; |
| 243 | /* Identification Data */ |
| 244 | }; |
| 245 | |
| 246 | /* 3.9 Certificate Payload */ |
| 247 | struct isakmp_pl_cert { |
| 248 | struct isakmp_gen h; |
| 249 | u_int8_t encode; /* Cert Encoding */ |
| 250 | char cert; /* Certificate Data */ |
| 251 | /* |
| 252 | This field indicates the type of |
| 253 | certificate or certificate-related information contained in the |
| 254 | Certificate Data field. |
| 255 | */ |
| 256 | }; |
| 257 | |
| 258 | /* Certificate Type */ |
| 259 | #define ISAKMP_CERT_NONE 0 |
| 260 | #define ISAKMP_CERT_PKCS 1 |
| 261 | #define ISAKMP_CERT_PGP 2 |
| 262 | #define ISAKMP_CERT_DNS 3 |
| 263 | #define ISAKMP_CERT_SIGN 4 |
| 264 | #define ISAKMP_CERT_KE 5 |
| 265 | #define ISAKMP_CERT_KT 6 |
| 266 | #define ISAKMP_CERT_CRL 7 |
| 267 | #define ISAKMP_CERT_ARL 8 |
| 268 | #define ISAKMP_CERT_SPKI 9 |
| 269 | |
| 270 | /* 3.10 Certificate Request Payload */ |
| 271 | struct isakmp_pl_cr { |
| 272 | struct isakmp_gen h; |
| 273 | u_int8_t num_cert; /* # Cert. Types */ |
| 274 | /* |
| 275 | Certificate Types (variable length) |
| 276 | -- Contains a list of the types of certificates requested, |
| 277 | sorted in order of preference. Each individual certificate |
| 278 | type is 1 octet. This field is NOT requiredo |
| 279 | */ |
| 280 | /* # Certificate Authorities (1 octet) */ |
| 281 | /* Certificate Authorities (variable length) */ |
| 282 | }; |
| 283 | |
| 284 | /* 3.11 Hash Payload */ |
| 285 | /* may not be used, because of having only data. */ |
| 286 | struct isakmp_pl_hash { |
| 287 | struct isakmp_gen h; |
| 288 | /* Hash Data */ |
| 289 | }; |
| 290 | |
| 291 | /* 3.12 Signature Payload */ |
| 292 | /* may not be used, because of having only data. */ |
| 293 | struct isakmp_pl_sig { |
| 294 | struct isakmp_gen h; |
| 295 | /* Signature Data */ |
| 296 | }; |
| 297 | |
| 298 | /* 3.13 Nonce Payload */ |
| 299 | /* may not be used, because of having only data. */ |
| 300 | struct isakmp_pl_nonce { |
| 301 | struct isakmp_gen h; |
| 302 | /* Nonce Data */ |
| 303 | }; |
| 304 | |
| 305 | /* 3.14 Notification Payload */ |
| 306 | struct isakmp_pl_n { |
| 307 | struct isakmp_gen h; |
| 308 | u_int32_t doi; /* Domain of Interpretation */ |
| 309 | u_int8_t prot_id; /* Protocol-ID */ |
| 310 | u_int8_t spi_size; /* SPI Size */ |
| 311 | u_int16_t type; /* Notify Message Type */ |
| 312 | /* SPI */ |
| 313 | /* Notification Data */ |
| 314 | }; |
| 315 | |
| 316 | /* 3.14.1 Notify Message Types */ |
| 317 | /* NOTIFY MESSAGES - ERROR TYPES */ |
| 318 | #define ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE 1 |
| 319 | #define ISAKMP_NTYPE_DOI_NOT_SUPPORTED 2 |
| 320 | #define ISAKMP_NTYPE_SITUATION_NOT_SUPPORTED 3 |
| 321 | #define ISAKMP_NTYPE_INVALID_COOKIE 4 |
| 322 | #define ISAKMP_NTYPE_INVALID_MAJOR_VERSION 5 |
| 323 | #define ISAKMP_NTYPE_INVALID_MINOR_VERSION 6 |
| 324 | #define ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE 7 |
| 325 | #define ISAKMP_NTYPE_INVALID_FLAGS 8 |
| 326 | #define ISAKMP_NTYPE_INVALID_MESSAGE_ID 9 |
| 327 | #define ISAKMP_NTYPE_INVALID_PROTOCOL_ID 10 |
| 328 | #define ISAKMP_NTYPE_INVALID_SPI 11 |
| 329 | #define ISAKMP_NTYPE_INVALID_TRANSFORM_ID 12 |
| 330 | #define ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED 13 |
| 331 | #define ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN 14 |
| 332 | #define ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX 15 |
| 333 | #define ISAKMP_NTYPE_PAYLOAD_MALFORMED 16 |
| 334 | #define ISAKMP_NTYPE_INVALID_KEY_INFORMATION 17 |
| 335 | #define ISAKMP_NTYPE_INVALID_ID_INFORMATION 18 |
| 336 | #define ISAKMP_NTYPE_INVALID_CERT_ENCODING 19 |
| 337 | #define ISAKMP_NTYPE_INVALID_CERTIFICATE 20 |
| 338 | #define ISAKMP_NTYPE_BAD_CERT_REQUEST_SYNTAX 21 |
| 339 | #define ISAKMP_NTYPE_INVALID_CERT_AUTHORITY 22 |
| 340 | #define ISAKMP_NTYPE_INVALID_HASH_INFORMATION 23 |
| 341 | #define ISAKMP_NTYPE_AUTHENTICATION_FAILED 24 |
| 342 | #define ISAKMP_NTYPE_INVALID_SIGNATURE 25 |
| 343 | #define ISAKMP_NTYPE_ADDRESS_NOTIFICATION 26 |
| 344 | /* NOTIFY MESSAGES - STATUS TYPES */ |
| 345 | #define ISAKMP_NTYPE_CONNECTED 16384 |
| 346 | /* using only to log */ |
| 347 | #define ISAKMP_LOG_RETRY_LIMIT_REACHED 65530 |
| 348 | |
| 349 | /* 3.15 Delete Payload */ |
| 350 | struct isakmp_pl_d { |
| 351 | struct isakmp_gen h; |
| 352 | u_int32_t doi; /* Domain of Interpretation */ |
| 353 | u_int8_t prot_id; /* Protocol-Id */ |
| 354 | u_int8_t spi_size; /* SPI Size */ |
| 355 | u_int16_t num_spi; /* # of SPIs */ |
| 356 | /* SPI(es) */ |
| 357 | }; |
| 358 | |
| 359 | \f |
| 360 | struct isakmp_ph1tab { |
| 361 | struct isakmp_ph1 *head; |
| 362 | struct isakmp_ph1 *tail; |
| 363 | int len; |
| 364 | }; |
| 365 | |
| 366 | struct isakmp_ph2tab { |
| 367 | struct isakmp_ph2 *head; |
| 368 | struct isakmp_ph2 *tail; |
| 369 | int len; |
| 370 | }; |
| 371 | |
| 372 | #define EXCHANGE_PROXY 1 |
| 373 | #define EXCHANGE_MYSELF 0 |
| 374 | |
| 375 | #define PFS_NEED 1 |
| 376 | #define PFS_NONEED 0 |
| 377 | |
| 378 | #endif /* !defined(_ISAKMP_H_) */ |