407 lines
15 KiB
C
407 lines
15 KiB
C
/* $KAME: handler.h,v 1.38 2001/03/05 18:37:07 thorpej Exp $ */
|
|
|
|
/*
|
|
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
|
|
* All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
* 3. Neither the name of the project nor the names of its contributors
|
|
* may be used to endorse or promote products derived from this software
|
|
* without specific prior written permission.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
* SUCH DAMAGE.
|
|
*/
|
|
|
|
/* Phase 1 handler */
|
|
/*
|
|
* main mode:
|
|
* initiator responder
|
|
* 0 (---) (---)
|
|
* 1 start start (1st msg received)
|
|
* 2 (---) 1st valid msg received
|
|
* 3 1st msg sent 1st msg sent
|
|
* 4 1st valid msg received 2st valid msg received
|
|
* 5 2nd msg sent 2nd msg sent
|
|
* 6 2nd valid msg received 3rd valid msg received
|
|
* 7 3rd msg sent 3rd msg sent
|
|
* 8 3rd valid msg received (---)
|
|
* 9 SA established SA established
|
|
*
|
|
* aggressive mode:
|
|
* initiator responder
|
|
* 0 (---) (---)
|
|
* 1 start start (1st msg received)
|
|
* 2 (---) 1st valid msg received
|
|
* 3 1st msg sent 1st msg sent
|
|
* 4 1st valid msg received 2st valid msg received
|
|
* 5 (---) (---)
|
|
* 6 (---) (---)
|
|
* 7 (---) (---)
|
|
* 8 (---) (---)
|
|
* 9 SA established SA established
|
|
*
|
|
* base mode:
|
|
* initiator responder
|
|
* 0 (---) (---)
|
|
* 1 start start (1st msg received)
|
|
* 2 (---) 1st valid msg received
|
|
* 3 1st msg sent 1st msg sent
|
|
* 4 1st valid msg received 2st valid msg received
|
|
* 5 2nd msg sent (---)
|
|
* 6 (---) (---)
|
|
* 7 (---) (---)
|
|
* 8 (---) (---)
|
|
* 9 SA established SA established
|
|
*/
|
|
#define PHASE1ST_SPAWN 0
|
|
#define PHASE1ST_START 1
|
|
#define PHASE1ST_MSG1RECEIVED 2
|
|
#define PHASE1ST_MSG1SENT 3
|
|
#define PHASE1ST_MSG2RECEIVED 4
|
|
#define PHASE1ST_MSG2SENT 5
|
|
#define PHASE1ST_MSG3RECEIVED 6
|
|
#define PHASE1ST_MSG3SENT 7
|
|
#define PHASE1ST_MSG4RECEIVED 8
|
|
#define PHASE1ST_ESTABLISHED 9
|
|
#define PHASE1ST_EXPIRED 10
|
|
#define PHASE1ST_MAX 11
|
|
|
|
/* About address semantics in each case.
|
|
* initiator(addr=I) responder(addr=R)
|
|
* src dst src dst
|
|
* (local) (remote) (local) (remote)
|
|
* phase 1 handler I R R I
|
|
* phase 2 handler I R R I
|
|
* getspi msg R I I R
|
|
* aquire msg I R
|
|
* ID payload I R I R
|
|
*/
|
|
struct ph1handle {
|
|
isakmp_index index;
|
|
|
|
int status; /* status of this SA */
|
|
int side; /* INITIATOR or RESPONDER */
|
|
|
|
struct sockaddr *remote; /* remote address to negosiate ph1 */
|
|
struct sockaddr *local; /* local address to negosiate ph1 */
|
|
/* XXX copy from rmconf due to anonymous configuration.
|
|
* If anonymous will be forbidden, we do delete them. */
|
|
|
|
struct remoteconf *rmconf; /* pointer to remote configuration */
|
|
|
|
struct isakmpsa *approval; /* pointer to SA(s) approved. */
|
|
vchar_t *authstr; /* place holder of string for auth. */
|
|
/* for example pre-shared key */
|
|
|
|
u_int8_t version; /* ISAKMP version */
|
|
u_int8_t etype; /* Exchange type actually for use */
|
|
u_int8_t flags; /* Flags */
|
|
u_int32_t msgid; /* message id */
|
|
|
|
struct sched *sce; /* schedule for expire */
|
|
struct sched *scr; /* schedule for resend */
|
|
int retry_counter; /* for resend. */
|
|
vchar_t *sendbuf; /* buffer for re-sending */
|
|
struct recvedpkt *rlist; /* list of all packets received. */
|
|
time_t time_sent; /* timestamp to sent packet */
|
|
|
|
vchar_t *dhpriv; /* DH; private value */
|
|
vchar_t *dhpub; /* DH; public value */
|
|
vchar_t *dhpub_p; /* DH; partner's public value */
|
|
vchar_t *dhgxy; /* DH; shared secret */
|
|
vchar_t *nonce; /* nonce value */
|
|
vchar_t *nonce_p; /* partner's nonce value */
|
|
vchar_t *skeyid; /* SKEYID */
|
|
vchar_t *skeyid_d; /* SKEYID_d */
|
|
vchar_t *skeyid_a; /* SKEYID_a, i.e. hash */
|
|
vchar_t *skeyid_e; /* SKEYID_e, i.e. encryption */
|
|
vchar_t *key; /* cipher key */
|
|
vchar_t *hash; /* HASH minus general header */
|
|
vchar_t *sig; /* SIG minus general header */
|
|
vchar_t *sig_p; /* peer's SIG minus general header */
|
|
cert_t *cert; /* CERT minus general header */
|
|
cert_t *cert_p; /* peer's CERT not including general *
|
|
* header and certificate type. */
|
|
cert_t *crl_p; /* peer's CRL not including general *
|
|
* header and certificate type. */
|
|
cert_t *cr_p; /* peer's CR not including general */
|
|
vchar_t *id; /* ID minus gen header */
|
|
vchar_t *id_p; /* partner's ID minus general header */
|
|
/* i.e. strut ipsecdoi_id_b*. */
|
|
struct isakmp_ivm *ivm; /* IVs */
|
|
|
|
vchar_t *sa; /* whole SA payload to send/to be sent*/
|
|
/* to calculate HASH */
|
|
/* NOT INCLUDING general header. */
|
|
|
|
vchar_t *sa_ret; /* SA payload to reply/to be replyed */
|
|
/* NOT INCLUDING general header. */
|
|
/* NOTE: Should be release after use. */
|
|
|
|
#ifdef HAVE_GSSAPI
|
|
void *gssapi_state; /* GSS-API specific state. */
|
|
/* Allocated when needed */
|
|
vchar_t *gi_i; /* optional initiator GSS id */
|
|
vchar_t *gi_r; /* optional responder GSS id */
|
|
#endif
|
|
|
|
struct isakmp_pl_hash *pl_hash; /* pointer to hash payload */
|
|
|
|
time_t created; /* timestamp for establish */
|
|
|
|
u_int32_t msgid2; /* msgid counter for Phase 2 */
|
|
int ph2cnt; /* count to negotiate phase 2. */
|
|
LIST_HEAD(_ph2ofph1_, ph2handle) ph2tree;
|
|
|
|
LIST_ENTRY(ph1handle) chain;
|
|
};
|
|
|
|
/* Phase 2 handler */
|
|
/* allocated per a SA or SA bundles of a pair of peer's IP addresses. */
|
|
/*
|
|
* initiator responder
|
|
* 0 (---) (---)
|
|
* 1 start start (1st msg received)
|
|
* 2 acquire msg get 1st valid msg received
|
|
* 3 getspi request sent getspi request sent
|
|
* 4 getspi done getspi done
|
|
* 5 1st msg sent 1st msg sent
|
|
* 6 1st valid msg received 2nd valid msg received
|
|
* 7 (commit bit) (commit bit)
|
|
* 8 SAs added SAs added
|
|
* 9 SAs established SAs established
|
|
* 10 SAs expired SAs expired
|
|
*/
|
|
#define PHASE2ST_SPAWN 0
|
|
#define PHASE2ST_START 1
|
|
#define PHASE2ST_STATUS2 2
|
|
#define PHASE2ST_GETSPISENT 3
|
|
#define PHASE2ST_GETSPIDONE 4
|
|
#define PHASE2ST_MSG1SENT 5
|
|
#define PHASE2ST_STATUS6 6
|
|
#define PHASE2ST_COMMIT 7
|
|
#define PHASE2ST_ADDSA 8
|
|
#define PHASE2ST_ESTABLISHED 9
|
|
#define PHASE2ST_EXPIRED 10
|
|
#define PHASE2ST_MAX 11
|
|
|
|
struct ph2handle {
|
|
struct sockaddr *src; /* my address of SA. */
|
|
struct sockaddr *dst; /* peer's address of SA. */
|
|
|
|
/*
|
|
* copy ip address from ID payloads when ID type is ip address.
|
|
* In other case, they must be null.
|
|
*/
|
|
struct sockaddr *src_id;
|
|
struct sockaddr *dst_id;
|
|
|
|
u_int32_t spid; /* policy id by kernel */
|
|
|
|
int status; /* ipsec sa status */
|
|
u_int8_t side; /* INITIATOR or RESPONDER */
|
|
|
|
struct sched *sce; /* schedule for expire */
|
|
struct sched *scr; /* schedule for resend */
|
|
vchar_t *sendbuf; /* buffer for re-sending */
|
|
struct recvedpkt *rlist; /* list of all packets received. */
|
|
int retry_counter;
|
|
time_t sent; /* timestamp to sent packet */
|
|
|
|
int retry_checkph1; /* counter to wait phase 1 finished. */
|
|
/* NOTE: actually it's timer. */
|
|
|
|
u_int32_t seq; /* sequence number used by PF_KEY */
|
|
/*
|
|
* NOTE: In responder side, we can't identify each SAs
|
|
* with same destination address for example, when
|
|
* socket based SA is required. So we set a identifier
|
|
* number to "seq", and sent kernel by pfkey.
|
|
*/
|
|
u_int8_t satype; /* satype in PF_KEY */
|
|
/*
|
|
* saved satype in the original PF_KEY request from
|
|
* the kernel in order to reply a error.
|
|
*/
|
|
|
|
u_int8_t flags; /* Flags for phase 2 */
|
|
u_int32_t msgid; /* msgid for phase 2 */
|
|
|
|
struct sainfo *sainfo; /* place holder of sainfo */
|
|
struct saprop *proposal; /* SA(s) proposal. */
|
|
struct saprop *approval; /* SA(s) approved. */
|
|
|
|
struct dhgroup *pfsgrp; /* DH; prime number */
|
|
vchar_t *dhpriv; /* DH; private value */
|
|
vchar_t *dhpub; /* DH; public value */
|
|
vchar_t *dhpub_p; /* DH; partner's public value */
|
|
vchar_t *dhgxy; /* DH; shared secret */
|
|
vchar_t *id; /* ID minus gen header */
|
|
vchar_t *id_p; /* peer's ID minus general header */
|
|
vchar_t *nonce; /* nonce value in phase 2 */
|
|
vchar_t *nonce_p; /* partner's nonce value in phase 2 */
|
|
vchar_t *hash; /* HASH2 minus general header */
|
|
|
|
vchar_t *sa; /* whole SA payload to send/to be sent*/
|
|
/* to calculate HASH */
|
|
/* NOT INCLUDING general header. */
|
|
|
|
vchar_t *sa_ret; /* SA payload to reply/to be replyed */
|
|
/* NOT INCLUDING general header. */
|
|
/* NOTE: Should be release after use. */
|
|
|
|
struct isakmp_ivm *ivm; /* IVs */
|
|
|
|
struct ph1handle *ph1; /* back pointer to isakmp status */
|
|
|
|
LIST_ENTRY(ph2handle) chain;
|
|
LIST_ENTRY(ph2handle) ph1bind; /* chain to ph1handle */
|
|
};
|
|
|
|
/*
|
|
* for handling initial contact.
|
|
*/
|
|
struct contacted {
|
|
struct sockaddr *remote; /* remote address to negosiate ph1 */
|
|
LIST_ENTRY(contacted) chain;
|
|
};
|
|
|
|
/*
|
|
* for checking a packet retransmited.
|
|
*/
|
|
struct recvedpkt {
|
|
struct recvedpkt *next;
|
|
vchar_t *hash;
|
|
};
|
|
|
|
/* for parsing ISAKMP header. */
|
|
struct isakmp_parse_t {
|
|
u_char type; /* payload type of mine */
|
|
int len; /* ntohs(ptr->len) */
|
|
struct isakmp_gen *ptr;
|
|
};
|
|
|
|
/*
|
|
* for IV management.
|
|
*
|
|
* - normal case
|
|
* initiator responder
|
|
* ------------------------- --------------------------
|
|
* initialize iv(A), ive(A). initialize iv(A), ive(A).
|
|
* encode by ive(A).
|
|
* save to iv(B). ---[packet(B)]--> save to ive(B).
|
|
* decode by iv(A).
|
|
* packet consistency.
|
|
* sync iv(B) with ive(B).
|
|
* check auth, integrity.
|
|
* encode by ive(B).
|
|
* save to ive(C). <--[packet(C)]--- save to iv(C).
|
|
* decoded by iv(B).
|
|
* :
|
|
*
|
|
* - In the case that a error is found while cipher processing,
|
|
* initiator responder
|
|
* ------------------------- --------------------------
|
|
* initialize iv(A), ive(A). initialize iv(A), ive(A).
|
|
* encode by ive(A).
|
|
* save to iv(B). ---[packet(B)]--> save to ive(B).
|
|
* decode by iv(A).
|
|
* packet consistency.
|
|
* sync iv(B) with ive(B).
|
|
* check auth, integrity.
|
|
* error found.
|
|
* create notify.
|
|
* get ive2(X) from iv(B).
|
|
* encode by ive2(X).
|
|
* get iv2(X) from iv(B). <--[packet(Y)]--- save to iv2(Y).
|
|
* save to ive2(Y).
|
|
* decoded by iv2(X).
|
|
* :
|
|
*
|
|
* The reason why the responder synchronizes iv with ive after checking the
|
|
* packet consistency is that it is required to leave the IV for decoding
|
|
* packet. Because there is a potential of error while checking the packet
|
|
* consistency. Also the reason why that is before authentication and
|
|
* integirty check is that the IV for informational exchange has to be made
|
|
* by the IV which is after packet decoded and checking the packet consistency.
|
|
* Otherwise IV mismatched happens between the intitiator and the responder.
|
|
*/
|
|
struct isakmp_ivm {
|
|
vchar_t *iv; /* for decoding packet */
|
|
/* if phase 1, it's for computing phase2 iv */
|
|
vchar_t *ive; /* for encoding packet */
|
|
};
|
|
|
|
/* for dumping */
|
|
struct ph1dump {
|
|
isakmp_index index;
|
|
int status;
|
|
int side;
|
|
struct sockaddr_storage remote;
|
|
struct sockaddr_storage local;
|
|
u_int8_t version;
|
|
u_int8_t etype;
|
|
time_t created;
|
|
int ph2cnt;
|
|
};
|
|
|
|
struct sockaddr;
|
|
struct ph1handle;
|
|
struct ph2handle;
|
|
struct policyindex;
|
|
|
|
extern struct ph1handle *getph1byindex __P((isakmp_index *));
|
|
extern struct ph1handle *getph1byindex0 __P((isakmp_index *));
|
|
extern struct ph1handle *getph1byaddr __P((struct sockaddr *,
|
|
struct sockaddr *));
|
|
extern vchar_t *dumpph1 __P((void));
|
|
extern struct ph1handle *newph1 __P((void));
|
|
extern void delph1 __P((struct ph1handle *));
|
|
extern int insph1 __P((struct ph1handle *));
|
|
extern void remph1 __P((struct ph1handle *));
|
|
extern void flushph1 __P((void));
|
|
extern void initph1tree __P((void));
|
|
|
|
extern struct ph2handle *getph2byspidx __P((struct policyindex *));
|
|
extern struct ph2handle *getph2byspid __P((u_int32_t));
|
|
extern struct ph2handle *getph2byseq __P((u_int32_t));
|
|
extern struct ph2handle *getph2bymsgid __P((struct ph1handle *, u_int32_t));
|
|
extern struct ph2handle *getph2bysaidx __P((struct sockaddr *,
|
|
struct sockaddr *, u_int, u_int32_t));
|
|
extern struct ph2handle *newph2 __P((void));
|
|
extern void initph2 __P((struct ph2handle *));
|
|
extern void delph2 __P((struct ph2handle *));
|
|
extern int insph2 __P((struct ph2handle *));
|
|
extern void remph2 __P((struct ph2handle *));
|
|
extern void flushph2 __P((void));
|
|
extern void deleteallph2 __P((struct sockaddr *, struct sockaddr *, u_int));
|
|
extern void initph2tree __P((void));
|
|
|
|
extern void bindph12 __P((struct ph1handle *, struct ph2handle *));
|
|
extern void unbindph12 __P((struct ph2handle *));
|
|
|
|
extern struct contacted *getcontacted __P((struct sockaddr *));
|
|
extern int inscontacted __P((struct sockaddr *));
|
|
extern void initctdtree __P((void));
|
|
|
|
extern int check_recvedpkt __P((vchar_t *, struct recvedpkt *));
|
|
extern int add_recvedpkt __P((vchar_t *, struct recvedpkt **));
|
|
extern void flush_recvedpkt __P((struct recvedpkt *));
|