The Tcpdump Group git mirrors - tcpdump/blob - isakmp.h

   1 /*
   2  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  * 3. Neither the name of the project nor the names of its contributors
  14  *    may be used to endorse or promote products derived from this software
  15  *    without specific prior written permission.
  16  *
  17  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  27  * SUCH DAMAGE.
  28  */
  29 /* YIPS @(#)$Id: isakmp.h,v 1.3 1999-11-17 04:14:50 assar Exp $ */
  30
  31 /* refer to RFC 2408 */
  32
  33 /* must include <netinet/in.h> */
  34
  35 #if !defined(_ISAKMP_H_)
  36 #define _ISAKMP_H_
  37
  38 typedef u_char cookie_t[8];
  39 typedef u_char msgid_t[4];
  40
  41 typedef struct { /* i_cookie + r_cookie */
  42         cookie_t i_ck;
  43         cookie_t r_ck;
  44 } isakmp_index;
  45
  46 #define INITIATOR       1
  47 #define RESPONDER       2
  48
  49 #define PORT_ISAKMP 500
  50
  51 #define GENERATE  1
  52 #define VALIDATE  0
  53
  54 /* Phase of oakley definition */
  55 /*
  56   0000 0000 0000 0000
  57        |    |||| ||||
  58        |    |||| ++++--> negosiation number in phase
  59        |    ++++-------> phase number
  60        +---------------> expire ?
  61  */
  62 #define ISAKMP_PH1      0x0010
  63 #define ISAKMP_PH2      0x0020
  64 #define ISAKMP_EXPIRED  0x0100
  65
  66 #define ISAKMP_NGP_0    0x0000
  67 #define ISAKMP_NGP_1    0x0001
  68 #define ISAKMP_NGP_2    0x0002
  69 #define ISAKMP_NGP_3    0x0003
  70 #define ISAKMP_NGP_4    0x0004
  71
  72 #define ISAKMP_PH1_N    (ISAKMP_PH1 | ISAKMP_NGP_0)  /* i.e. spawn */
  73 #define ISAKMP_PH1_1    (ISAKMP_PH1 | ISAKMP_NGP_1)
  74 #define ISAKMP_PH1_2    (ISAKMP_PH1 | ISAKMP_NGP_2)
  75 #define ISAKMP_PH1_3    (ISAKMP_PH1 | ISAKMP_NGP_3)
  76 #define ISAKMP_PH2_N    (ISAKMP_PH2 | ISAKMP_NGP_0)
  77 #define ISAKMP_PH2_1    (ISAKMP_PH2 | ISAKMP_NGP_1)
  78 #define ISAKMP_PH2_2    (ISAKMP_PH2 | ISAKMP_NGP_2)
  79 #define ISAKMP_PH2_3    (ISAKMP_PH2 | ISAKMP_NGP_3)
  80
  81 #define ISAKMP_TIMER_DEFAULT     10 /* seconds */
  82 #define ISAKMP_TRY_DEFAULT        3 /* times */
  83
  84 /* 3.1 ISAKMP Header Format
  85          0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
  86         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  87         !                          Initiator                            !
  88         !                            Cookie                             !
  89         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  90         !                          Responder                            !
  91         !                            Cookie                             !
  92         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  93         !  Next Payload ! MjVer ! MnVer ! Exchange Type !     Flags     !
  94         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  95         !                          Message ID                           !
  96         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  97         !                            Length                             !
  98         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  99 */
 100 struct isakmp {
 101         cookie_t i_ck;     /* Initiator Cookie */
 102         cookie_t r_ck;     /* Responder Cookie */
 103         u_int8_t   np;       /* Next Payload Type */
 104 #if defined(WORDS_BIGENDIAN) || (defined(BYTE_ORDER) && (BYTE_ORDER == BIG_ENDIAN))
 105         u_int   v_maj:4,  /* MnVer */
 106                  v_min:4;  /* MjVer */
 107 #else
 108         u_int   v_min:4,  /* MnVer */
 109                  v_maj:4;  /* MjVer */
 110 #endif
 111         u_int8_t   etype;    /* Exchange Type */
 112         u_int8_t   flags;    /* Flags */
 113         msgid_t  msgid;
 114         u_int32_t  len;      /* Length */
 115 };
 116
 117 /* Next Payload Type */
 118 #define ISAKMP_NPTYPE_NONE   0 /* NONE*/
 119 #define ISAKMP_NPTYPE_SA     1 /* Security Association */
 120 #define ISAKMP_NPTYPE_P      2 /* Proposal */
 121 #define ISAKMP_NPTYPE_T      3 /* Transform */
 122 #define ISAKMP_NPTYPE_KE     4 /* Key Exchange */
 123 #define ISAKMP_NPTYPE_ID     5 /* Identification */
 124 #define ISAKMP_NPTYPE_CERT   6 /* Certificate */
 125 #define ISAKMP_NPTYPE_CR     7 /* Certificate Request */
 126 #define ISAKMP_NPTYPE_HASH   8 /* Hash */
 127 #define ISAKMP_NPTYPE_SIG    9 /* Signature */
 128 #define ISAKMP_NPTYPE_NONCE 10 /* Nonce */
 129 #define ISAKMP_NPTYPE_N     11 /* Notification */
 130 #define ISAKMP_NPTYPE_D     12 /* Delete */
 131 #define ISAKMP_NPTYPE_VID   13 /* Vendor ID */
 132
 133 #define ISAKMP_MAJOR_VERSION  1
 134 #define ISAKMP_MINOR_VERSION  0
 135
 136 /* Exchange Type */
 137 #define ISAKMP_ETYPE_NONE   0 /* NONE */
 138 #define ISAKMP_ETYPE_BASE   1 /* Base */
 139 #define ISAKMP_ETYPE_IDENT  2 /* Identity Proteciton */
 140 #define ISAKMP_ETYPE_AUTH   3 /* Authentication Only */
 141 #define ISAKMP_ETYPE_AGG    4 /* Aggressive */
 142 #define ISAKMP_ETYPE_INF    5 /* Informational */
 143
 144 /* Flags */
 145 #define ISAKMP_FLAG_E 0x01 /* Encryption Bit */
 146 #define ISAKMP_FLAG_C 0x02 /* Commit Bit */
 147
 148 /* 3.2 Payload Generic Header
 149          0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 150         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 151         ! Next Payload  !   RESERVED    !         Payload Length        !
 152         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 153 */
 154 struct isakmp_gen {
 155         u_int8_t  np;       /* Next Payload */
 156         u_int8_t  reserved; /* RESERVED, unused, must set to 0 */
 157         u_int16_t len;      /* Payload Length */
 158 };
 159
 160 /* 3.3 Data Attributes
 161          0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 162         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 163         !A!       Attribute Type        !    AF=0  Attribute Length     !
 164         !F!                             !    AF=1  Attribute Value      !
 165         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 166         .                   AF=0  Attribute Value                       .
 167         .                   AF=1  Not Transmitted                       .
 168         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 169 */
 170 struct isakmp_data {
 171         u_int16_t type;     /* defined by DOI-spec, and Attribute Format */
 172         u_int16_t lorv;     /* if f equal 1, Attribute Length */
 173                           /* if f equal 0, Attribute Value */
 174         /* if f equal 1, Attribute Value */
 175 };
 176 #define ISAKMP_GEN_TLV 0x0000
 177 #define ISAKMP_GEN_TV  0x8000
 178         /* mask for type of attribute format */
 179 #define ISAKMP_GEN_MASK 0x8000
 180
 181 /* 3.4 Security Association Payload */
 182         /* MAY NOT be used, because of being defined in ipsec-doi. */
 183         /*
 184         If the current payload is the last in the message,
 185         then the value of the next payload field will be 0.
 186         This field MUST NOT contain the
 187         values for the Proposal or Transform payloads as they are considered
 188         part of the security association negotiation.  For example, this
 189         field would contain the value "10" (Nonce payload) in the first
 190         message of a Base Exchange (see Section 4.4) and the value "0" in the
 191         first message of an Identity Protect Exchange (see Section 4.5).
 192         */
 193 struct isakmp_pl_sa {
 194         struct isakmp_gen h;
 195         u_int32_t doi; /* Domain of Interpretation */
 196         u_int32_t sit; /* Situation */
 197 };
 198
 199 /* 3.5 Proposal Payload */
 200         /*
 201         The value of the next payload field MUST only contain the value "2"
 202         or "0".  If there are additional Proposal payloads in the message,
 203         then this field will be 2.  If the current Proposal payload is the
 204         last within the security association proposal, then this field will
 205         be 0.
 206         */
 207 struct isakmp_pl_p {
 208         struct isakmp_gen h;
 209         u_int8_t p_no;      /* Proposal # */
 210         u_int8_t prot_id;   /* Protocol */
 211         u_int8_t spi_size;  /* SPI Size */
 212         u_int8_t num_t;     /* Number of Transforms */
 213         /* SPI */
 214 };
 215
 216 /* 3.6 Transform Payload */
 217         /*
 218         The value of the next payload field MUST only contain the value "3"
 219         or "0".  If there are additional Transform payloads in the proposal,
 220         then this field will be 3.  If the current Transform payload is the
 221         last within the proposal, then this field will be 0.
 222         */
 223 struct isakmp_pl_t {
 224         struct isakmp_gen h;
 225         u_int8_t  t_no;     /* Transform # */
 226         u_int8_t  t_id;     /* Transform-Id */
 227         u_int16_t reserved; /* RESERVED2 */
 228         /* SA Attributes */
 229 };
 230
 231 /* 3.7 Key Exchange Payload */
 232 struct isakmp_pl_ke {
 233         struct isakmp_gen h;
 234         /* Key Exchange Data */
 235 };
 236
 237 /* 3.8 Identification Payload */
 238         /* MUST NOT to be used, because of being defined in ipsec-doi. */
 239 struct isakmp_pl_id {
 240         struct isakmp_gen h;
 241         union {
 242                 u_int8_t  id_type;   /* ID Type */
 243                 u_int32_t doi_data;  /* DOI Specific ID Data */
 244         } d;
 245         /* Identification Data */
 246 };
 247
 248 /* 3.9 Certificate Payload */
 249 struct isakmp_pl_cert {
 250         struct isakmp_gen h;
 251         u_int8_t encode; /* Cert Encoding */
 252         char   cert;   /* Certificate Data */
 253                 /*
 254                 This field indicates the type of
 255                 certificate or certificate-related information contained in the
 256                 Certificate Data field.
 257                 */
 258 };
 259
 260 /* Certificate Type */
 261 #define ISAKMP_CERT_NONE   0
 262 #define ISAKMP_CERT_PKCS   1
 263 #define ISAKMP_CERT_PGP    2
 264 #define ISAKMP_CERT_DNS    3
 265 #define ISAKMP_CERT_SIGN   4
 266 #define ISAKMP_CERT_KE     5
 267 #define ISAKMP_CERT_KT     6
 268 #define ISAKMP_CERT_CRL    7
 269 #define ISAKMP_CERT_ARL    8
 270 #define ISAKMP_CERT_SPKI   9
 271
 272 /* 3.10 Certificate Request Payload */
 273 struct isakmp_pl_cr {
 274         struct isakmp_gen h;
 275         u_int8_t num_cert; /* # Cert. Types */
 276         /*
 277         Certificate Types (variable length)
 278           -- Contains a list of the types of certificates requested,
 279           sorted in order of preference.  Each individual certificate
 280           type is 1 octet.  This field is NOT requiredo
 281         */
 282         /* # Certificate Authorities (1 octet) */
 283         /* Certificate Authorities (variable length) */
 284 };
 285
 286 /* 3.11 Hash Payload */
 287         /* may not be used, because of having only data. */
 288 struct isakmp_pl_hash {
 289         struct isakmp_gen h;
 290         /* Hash Data */
 291 };
 292
 293 /* 3.12 Signature Payload */
 294         /* may not be used, because of having only data. */
 295 struct isakmp_pl_sig {
 296         struct isakmp_gen h;
 297         /* Signature Data */
 298 };
 299
 300 /* 3.13 Nonce Payload */
 301         /* may not be used, because of having only data. */
 302 struct isakmp_pl_nonce {
 303         struct isakmp_gen h;
 304         /* Nonce Data */
 305 };
 306
 307 /* 3.14 Notification Payload */
 308 struct isakmp_pl_n {
 309         struct isakmp_gen h;
 310         u_int32_t doi;      /* Domain of Interpretation */
 311         u_int8_t  prot_id;  /* Protocol-ID */
 312         u_int8_t  spi_size; /* SPI Size */
 313         u_int16_t type;     /* Notify Message Type */
 314         /* SPI */
 315         /* Notification Data */
 316 };
 317
 318 /* 3.14.1 Notify Message Types */
 319 /* NOTIFY MESSAGES - ERROR TYPES */
 320 #define ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE           1
 321 #define ISAKMP_NTYPE_DOI_NOT_SUPPORTED              2
 322 #define ISAKMP_NTYPE_SITUATION_NOT_SUPPORTED        3
 323 #define ISAKMP_NTYPE_INVALID_COOKIE                 4
 324 #define ISAKMP_NTYPE_INVALID_MAJOR_VERSION          5
 325 #define ISAKMP_NTYPE_INVALID_MINOR_VERSION          6
 326 #define ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE          7
 327 #define ISAKMP_NTYPE_INVALID_FLAGS                  8
 328 #define ISAKMP_NTYPE_INVALID_MESSAGE_ID             9
 329 #define ISAKMP_NTYPE_INVALID_PROTOCOL_ID            10
 330 #define ISAKMP_NTYPE_INVALID_SPI                    11
 331 #define ISAKMP_NTYPE_INVALID_TRANSFORM_ID           12
 332 #define ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED       13
 333 #define ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN             14
 334 #define ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX            15
 335 #define ISAKMP_NTYPE_PAYLOAD_MALFORMED              16
 336 #define ISAKMP_NTYPE_INVALID_KEY_INFORMATION        17
 337 #define ISAKMP_NTYPE_INVALID_ID_INFORMATION         18
 338 #define ISAKMP_NTYPE_INVALID_CERT_ENCODING          19
 339 #define ISAKMP_NTYPE_INVALID_CERTIFICATE            20
 340 #define ISAKMP_NTYPE_BAD_CERT_REQUEST_SYNTAX        21
 341 #define ISAKMP_NTYPE_INVALID_CERT_AUTHORITY         22
 342 #define ISAKMP_NTYPE_INVALID_HASH_INFORMATION       23
 343 #define ISAKMP_NTYPE_AUTHENTICATION_FAILED          24
 344 #define ISAKMP_NTYPE_INVALID_SIGNATURE              25
 345 #define ISAKMP_NTYPE_ADDRESS_NOTIFICATION           26
 346 /* NOTIFY MESSAGES - STATUS TYPES */
 347 #define ISAKMP_NTYPE_CONNECTED                   16384
 348 /* using only to log */
 349 #define ISAKMP_LOG_RETRY_LIMIT_REACHED           65530
 350
 351 /* 3.15 Delete Payload */
 352 struct isakmp_pl_d {
 353         struct isakmp_gen h;
 354         u_int32_t doi;      /* Domain of Interpretation */
 355         u_int8_t  prot_id;  /* Protocol-Id */
 356         u_int8_t  spi_size; /* SPI Size */
 357         u_int16_t num_spi;  /* # of SPIs */
 358         /* SPI(es) */
 359 };
 360
 361 \f
 362 struct isakmp_ph1tab {
 363         struct isakmp_ph1 *head;
 364         struct isakmp_ph1 *tail;
 365         int len;
 366 };
 367
 368 struct isakmp_ph2tab {
 369         struct isakmp_ph2 *head;
 370         struct isakmp_ph2 *tail;
 371         int len;
 372 };
 373
 374 #if 0
 375 /* isakmp status structure */
 376 struct isakmp_ph1 {
 377         isakmp_index index;
 378         u_int8_t  dir;                 /* INITIATOR or RESPONDER */
 379         u_int16_t status;              /* status of this SA */
 380         u_int16_t etype;
 381         u_int32_t doi;
 382         u_int32_t sit;
 383         vchar_t   *dhp;                /* DH; prime, static value */
 384         vchar_t   *dhpriv;             /* DH; private value */
 385         vchar_t   *dhpub;              /* DH; public value */
 386         vchar_t   *dhpub_p;            /* DH; partner's public value */
 387         vchar_t   *dhgxy;              /* DH; shared secret */
 388         vchar_t   *nonce;              /* nonce value */
 389         vchar_t   *nonce_p;            /* partner's nonce value */
 390         vchar_t   *skeyid;             /* SKEYID */
 391         vchar_t   *skeyid_d;           /* SKEYID_d */
 392         vchar_t   *skeyid_a;           /* SKEYID_a, i.e. hash */
 393         vchar_t   *skeyid_e;           /* SKEYID_e, i.e. encryption */
 394         vchar_t   *key;                /* cipher key */
 395         vchar_t   *hash;               /* HASH minus general header */
 396         vchar_t   *iv;                 /* IV */
 397         vchar_t   *ive;                /* new IV to encrypt next packet */
 398         vchar_t   *ivd;                /* new IV to decrypt next packet */
 399         vchar_t   *sa;                 /* SA minus general header including p,t.*/
 400         vchar_t   *id;                 /* ID minus general header */
 401         vchar_t   *id_p;               /* partner's ID minus general header */
 402         struct sockaddr  *local;       /* pointer to the my sockaddr */
 403         struct sockaddr  *remote;      /* partner's sockaddr */
 404         struct oakley_sa *isa;         /* Is it good that caddr_t ? */
 405         struct sched *sc;              /* back pointer to the record in schedule
 406                                         used to resend. */
 407         struct isakmp_ph1 *next;
 408         struct isakmp_ph1 *prev;
 409         struct isakmp_conf *cfp;     /* pointer to isakmp configuration */
 410         struct isakmp_ph2tab ph2tab; /* list on negotiating Phase 2 */
 411         u_int32_t msgid2;              /* XXX: msgid counter for Phase 2 */
 412 };
 413
 414 struct isakmp_ph2 {
 415         msgid_t msgid;
 416         u_int8_t  dir;             /* INITIATOR or RESPONDER */
 417         u_int16_t status;          /* status of this SA */
 418         vchar_t *dhp;            /* DH; prime, static value */
 419         vchar_t *dhpriv;         /* DH; private value */
 420         vchar_t *dhpub;          /* DH; public value */
 421         vchar_t *dhpub_p;        /* DH; partner's public value */
 422         vchar_t *dhgxy;          /* DH; shared secret */
 423         vchar_t *id;             /* ID */
 424         vchar_t *id_p;           /* ID for peer */
 425         vchar_t *nonce;          /* nonce value in phase 2 */
 426         vchar_t *nonce_p;        /* partner's nonce value in phase 2 */
 427         vchar_t *hash;           /* HASH2 minus general header */
 428         vchar_t *iv;             /* IV for Phase 2 */
 429         vchar_t *ive;            /* new IV to encrypt next packet */
 430         vchar_t *ivd;            /* new IV to decrypt next packet */
 431         struct isakmp_ph1 *ph1;  /* back pointer to isakmp status */
 432         struct sched *sc;        /* back pointer to the schedule using resend */
 433         struct pfkey_st *pst;    /* pointer to the pfkey status record.
 434                                     is only used by initiator. */
 435         u_int8_t proxy;            /* is proxy or not ?. */
 436         vchar_t *sa;             /* SA payload */
 437         struct ipsec_sa *isa;    /* values of SA to use, same SA in use. */
 438         struct isakmp_ph2 *next;
 439         struct isakmp_ph2 *prev;
 440 };
 441 #endif
 442
 443 #define EXCHANGE_PROXY   1
 444 #define EXCHANGE_MYSELF  0
 445
 446 #define PFS_NEED        1
 447 #define PFS_NONEED      0
 448
 449 #endif /* !defined(_ISAKMP_H_) */