Print this page
Current snapshot of OpenSolaris port.
Checkpoint
Checkpoint
Merge from parent.
Merge with WIDE update.
Pull from WIDE.
Pull from WIDE.
Checkpoint
Re-update.
blah
WIDE update
Update from WIDE.
| Split |
Close |
| Expand all |
| Collapse all |
--- old/iked/ikev1/handler.h
+++ new/iked/ikev1/handler.h
1 1 /* $Id: handler.h,v 1.11 2008/02/06 08:09:00 mk Exp $ */
2 2 /* $KAME: handler.h,v 1.44 2002/07/10 23:22:03 itojun Exp $ */
3 3
4 4 /*
5 5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6 6 * All rights reserved.
7 7 *
8 8 * Redistribution and use in source and binary forms, with or without
9 9 * modification, are permitted provided that the following conditions
10 10 * are met:
11 11 * 1. Redistributions of source code must retain the above copyright
12 12 * notice, this list of conditions and the following disclaimer.
13 13 * 2. Redistributions in binary form must reproduce the above copyright
14 14 * notice, this list of conditions and the following disclaimer in the
15 15 * documentation and/or other materials provided with the distribution.
16 16 * 3. Neither the name of the project nor the names of its contributors
17 17 * may be used to endorse or promote products derived from this software
18 18 * without specific prior written permission.
19 19 *
20 20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 30 * SUCH DAMAGE.
31 31 */
32 32
33 33 #include "ike_pfkey.h"
34 34
35 35 /* Phase 1 handler */
36 36 /*
37 37 * main mode:
38 38 * initiator responder
39 39 * 0 (---) (---)
40 40 * 1 start start (1st msg received)
41 41 * 2 (---) 1st valid msg received
42 42 * 3 1st msg sent 1st msg sent
43 43 * 4 1st valid msg received 2st valid msg received
44 44 * 5 2nd msg sent 2nd msg sent
45 45 * 6 2nd valid msg received 3rd valid msg received
46 46 * 7 3rd msg sent 3rd msg sent
47 47 * 8 3rd valid msg received (---)
48 48 * 9 SA established SA established
49 49 *
50 50 * aggressive mode:
51 51 * initiator responder
52 52 * 0 (---) (---)
53 53 * 1 start start (1st msg received)
54 54 * 2 (---) 1st valid msg received
55 55 * 3 1st msg sent 1st msg sent
56 56 * 4 1st valid msg received 2st valid msg received
57 57 * 5 (---) (---)
58 58 * 6 (---) (---)
59 59 * 7 (---) (---)
60 60 * 8 (---) (---)
61 61 * 9 SA established SA established
62 62 *
63 63 * base mode:
64 64 * initiator responder
65 65 * 0 (---) (---)
66 66 * 1 start start (1st msg received)
67 67 * 2 (---) 1st valid msg received
68 68 * 3 1st msg sent 1st msg sent
69 69 * 4 1st valid msg received 2st valid msg received
70 70 * 5 2nd msg sent (---)
71 71 * 6 (---) (---)
72 72 * 7 (---) (---)
73 73 * 8 (---) (---)
74 74 * 9 SA established SA established
75 75 */
76 76 #define PHASE1ST_SPAWN 0
77 77 #define PHASE1ST_START 1
78 78 #define PHASE1ST_MSG1RECEIVED 2
79 79 #define PHASE1ST_MSG1SENT 3
80 80 #define PHASE1ST_MSG2RECEIVED 4
81 81 #define PHASE1ST_MSG2SENT 5
82 82 #define PHASE1ST_MSG3RECEIVED 6
83 83 #define PHASE1ST_MSG3SENT 7
84 84 #define PHASE1ST_MSG4RECEIVED 8
85 85 #define PHASE1ST_ESTABLISHED 9
86 86 #define PHASE1ST_EXPIRED 10
87 87 #define PHASE1ST_MAX 11
88 88
89 89 /* About address semantics in each case.
90 90 * initiator(addr=I) responder(addr=R)
91 91 * src dst src dst
92 92 * (local) (remote) (local) (remote)
93 93 * phase 1 handler I R R I
94 94 * phase 2 handler I R R I
95 95 * getspi msg R I I R
96 96 * acquire msg I R
97 97 * ID payload I R I R
98 98 */
99 99 struct ph1handle {
100 100 isakmp_index_t index;
101 101
102 102 int status; /* status of this SA */
103 103 int side; /* INITIATOR or RESPONDER */
104 104
105 105 struct sockaddr *remote; /* remote address to negosiate ph1 */
106 106 struct sockaddr *local; /* local address to negosiate ph1 */
107 107 /* XXX copy from rmconf due to anonymous configuration.
108 108 * If anonymous will be forbidden, we do delete them. */
109 109
110 110 struct rcf_remote *rmconf; /* pointer to remote configuration */
111 111 struct isakmpsa *proposal;
112 112
113 113 struct isakmpsa *approval; /* pointer to SA(s) approved. */
114 114 rc_vchar_t *authstr; /* place holder of string for auth. */
115 115 /* for example pre-shared key */
116 116
117 117 uint8_t version; /* ISAKMP version */
118 118 uint8_t etype; /* Exchange type actually for use */
119 119 uint8_t flags; /* Flags */
120 120 uint32_t msgid; /* message id */
121 121
122 122 #ifdef ENABLE_NATT
123 123 struct ph1natt_options *natt_options; /* Selected NAT-T IKE version */
124 124 uint32_t natt_flags; /* NAT-T related flags */
125 125 #ifdef ENABLE_FRAG
126 126 int frag; /* IKE phase 1 fragmentation */
127 127 struct isakmp_frag_item *frag_chain; /* Received fragments */
128 128 #endif
129 129 #endif
130 130
131 131 int dpd_support; /* Does remote supports DPD ? */
132 132 time_t dpd_lastack; /* Last ack received */
133 133 uint16_t dpd_seq; /* DPD seq number to receive */
134 134 uint8_t dpd_fails; /* number of failures */
135 135 struct sched *dpd_r_u;
136 136
137 137 struct sched *sce; /* schedule for expire */
138 138
139 139 struct sched *scr; /* schedule for resend */
140 140 int retry_counter; /* for resend. */
141 141 rc_vchar_t *sendbuf; /* buffer for re-sending */
142 142
143 143 rc_vchar_t *dhpriv; /* DH; private value */
144 144 rc_vchar_t *dhpub; /* DH; public value */
145 145 rc_vchar_t *dhpub_p; /* DH; partner's public value */
146 146 rc_vchar_t *dhgxy; /* DH; shared secret */
147 147 rc_vchar_t *nonce; /* nonce value */
148 148 rc_vchar_t *nonce_p; /* partner's nonce value */
149 149 rc_vchar_t *skeyid; /* SKEYID */
150 150 rc_vchar_t *skeyid_d; /* SKEYID_d */
151 151 rc_vchar_t *skeyid_a; /* SKEYID_a, i.e. hash */
152 152 rc_vchar_t *skeyid_e; /* SKEYID_e, i.e. encryption */
153 153 rc_vchar_t *key; /* cipher key */
154 154 rc_vchar_t *hash; /* HASH minus general header */
155 155 rc_vchar_t *sig; /* SIG minus general header */
156 156 rc_vchar_t *sig_p; /* peer's SIG minus general header */
157 157 cert_t *cert; /* CERT minus general header */
158 158 cert_t *cert_p; /* peer's CERT minus general header */
159 159 cert_t *crl_p; /* peer's CRL minus general header */
160 160 cert_t *cr_p; /* peer's CR not including general */
161 161 rc_vchar_t *id; /* ID minus gen header */
162 162 rc_vchar_t *id_p; /* partner's ID minus general header */
163 163 /* i.e. strut ipsecdoi_id_b*. */
164 164 struct isakmp_ivm *ivm; /* IVs */
165 165
166 166 rc_vchar_t *sa; /* whole SA payload to send/to be sent */
167 167 /* to calculate HASH */
168 168 /* NOT INCLUDING general header. */
169 169
170 170 rc_vchar_t *sa_ret; /* SA payload to reply/to be replyed */
171 171 /* NOT INCLUDING general header. */
172 172 /* NOTE: Should be release after use. */
173 173
174 174 #ifdef HAVE_GSSAPI
175 175 void *gssapi_state; /* GSS-API specific state. */
176 176 /* Allocated when needed */
177 177 rc_vchar_t *gi_i; /* optional initiator GSS id */
178 178 rc_vchar_t *gi_r; /* optional responder GSS id */
179 179 #endif
180 180
181 181 struct isakmp_pl_hash *pl_hash; /* pointer to hash payload */
182 182
183 183 time_t created; /* timestamp for establish */
184 184 #ifdef ENABLE_STATS
185 185 struct timeval start;
186 186 struct timeval end;
187 187 #endif
188 188
189 189 uint32_t msgid2; /* msgid counter for Phase 2 */
190 190 int ph2cnt; /* the number which is negotiated by this phase 1 */
191 191 LIST_HEAD(_ph2ofph1_, ph2handle) ph2tree;
192 192
193 193 LIST_ENTRY(ph1handle) chain;
194 194 };
195 195
196 196 /* Phase 2 handler */
197 197 /* allocated per a SA or SA bundles of a pair of peer's IP addresses. */
198 198 /*
199 199 * initiator responder
200 200 * 0 (---) (---)
201 201 * 1 start start (1st msg received)
202 202 * 2 acquire msg get 1st valid msg received
203 203 * 3 getspi request sent getspi request sent
204 204 * 4 getspi done getspi done
205 205 * 5 1st msg sent 1st msg sent
206 206 * 6 1st valid msg received 2nd valid msg received
207 207 * 7 (commit bit) (commit bit)
208 208 * 8 SAs added SAs added
209 209 * 9 SAs established SAs established
210 210 * 10 SAs expired SAs expired
211 211 */
212 212 #define PHASE2ST_SPAWN 0
213 213 #define PHASE2ST_START 1
214 214 #define PHASE2ST_STATUS2 2
215 215 #define PHASE2ST_GETSPISENT 3
216 216 #define PHASE2ST_GETSPIDONE 4
217 217 #define PHASE2ST_MSG1SENT 5
218 218 #define PHASE2ST_STATUS6 6
219 219 #define PHASE2ST_COMMIT 7
220 220 #define PHASE2ST_ADDSA 8
221 221 #define PHASE2ST_ESTABLISHED 9
222 222 #define PHASE2ST_EXPIRED 10
223 223 #define PHASE2ST_MAX 11
224 224
|
↓ open down ↓ |
224 lines elided |
↑ open up ↑ |
225 225 struct ph2handle {
226 226 struct sockaddr *src; /* my address of SA. */
227 227 struct sockaddr *dst; /* peer's address of SA. */
228 228
229 229 /*
230 230 * copy ip address from ID payloads when ID type is ip address.
231 231 * In other case, they must be null.
232 232 */
233 233 struct sockaddr *src_id;
234 234 struct sockaddr *dst_id;
235 +#ifdef ENABLE_NATT
236 + struct sockaddr *natoa_src; /* peer's view of my address */
237 + struct sockaddr *natoa_dst; /* peer's view of his address */
238 +#endif
235 239
240 +
236 241 struct sadb_request sadb_request;
237 242 #if 0
238 243 uint32_t spid; /* policy id by kernel */
239 244 #endif
240 245 struct rcf_selector *selector;
241 246
242 247 int status; /* ipsec sa status */
243 248 uint8_t side; /* INITIATOR or RESPONDER */
244 249
245 250 struct sched *sce; /* schedule for expire */
246 251 struct sched *scr; /* schedule for resend */
247 252 int retry_counter; /* for resend. */
248 253 rc_vchar_t *sendbuf; /* buffer for re-sending */
249 254 rc_vchar_t *msg1; /* buffer for re-sending */
250 255 /* used for responder's first message */
251 256
252 257 int retry_checkph1; /* counter to wait phase 1 finished. */
253 258 /* NOTE: actually it's timer. */
254 259
255 260 uint32_t seq; /* sequence number used by PF_KEY */
256 261 /*
257 262 * NOTE: In responder side, we can't identify each SAs
258 263 * with same destination address for example, when
259 264 * socket based SA is required. So we set a identifier
260 265 * number to "seq", and sent kernel by pfkey.
261 266 */
262 267 rc_type satype; /* satype in rc_type */
263 268 /*
264 269 * saved satype in the original PF_KEY request from
265 270 * the kernel in order to reply a error.
266 271 */
267 272
268 273 uint8_t flags; /* Flags for phase 2 */
269 274 uint32_t msgid; /* msgid for phase 2 */
270 275
271 276 #if 0
272 277 struct sainfo *sainfo; /* place holder of sainfo */
273 278 #endif
274 279 struct saprop *proposal; /* SA(s) proposal. */
275 280 struct saprop *approval; /* SA(s) approved. */
276 281 #ifdef notyet
277 282 caddr_t spidx_gen; /* policy from peer's proposal */
278 283 #endif
279 284
280 285 struct dhgroup *pfsgrp; /* DH; prime number */
281 286 rc_vchar_t *dhpriv; /* DH; private value */
282 287 rc_vchar_t *dhpub; /* DH; public value */
283 288 rc_vchar_t *dhpub_p; /* DH; partner's public value */
284 289 rc_vchar_t *dhgxy; /* DH; shared secret */
285 290 rc_vchar_t *id; /* ID minus gen header */
286 291 rc_vchar_t *id_p; /* peer's ID minus general header */
287 292 rc_vchar_t *nonce; /* nonce value in phase 2 */
288 293 rc_vchar_t *nonce_p; /* partner's nonce value in phase 2 */
289 294
290 295 rc_vchar_t *sa; /* whole SA payload to send/to be sent */
291 296 /* to calculate HASH */
292 297 /* NOT INCLUDING general header. */
293 298
294 299 rc_vchar_t *sa_ret; /* SA payload to reply/to be replyed */
295 300 /* NOT INCLUDING general header. */
296 301 /* NOTE: Should be release after use. */
297 302
298 303 struct isakmp_ivm *ivm; /* IVs */
299 304
300 305 #ifdef ENABLE_STATS
301 306 struct timeval start;
302 307 struct timeval end;
303 308 #endif
304 309
305 310 /* byte counts for peer/self during current and previous cycle */
306 311 uint64_t prev_peercount;
307 312 uint64_t cur_peercount;
308 313 uint64_t prev_selfcount;
309 314 uint64_t cur_selfcount;
310 315
311 316 struct ph1handle *ph1; /* back pointer to isakmp status */
312 317
313 318 LIST_ENTRY(ph2handle) chain;
314 319 LIST_ENTRY(ph2handle) ph1bind; /* chain to ph1handle */
315 320 };
316 321
317 322 /*
318 323 * for handling initial contact.
319 324 */
320 325 struct contacted {
321 326 struct sockaddr *remote; /* remote address to negosiate ph1 */
322 327 LIST_ENTRY(contacted) chain;
323 328 };
324 329
325 330 /*
326 331 * for checking a packet retransmited.
327 332 */
328 333 struct recvdpkt {
329 334 struct sockaddr *remote; /* the remote address */
330 335 struct sockaddr *local; /* the local address */
331 336 rc_vchar_t *hash; /* hash of the received packet */
332 337 rc_vchar_t *sendbuf; /* buffer for the response */
333 338 int retry_counter; /* max retry to send */
334 339 int lifetime; /* max duration of retransmission */
335 340 time_t time_send; /* timestamp to send a packet */
336 341 time_t created; /* timestamp to create a queue */
337 342
338 343 struct sched *scr; /* schedule for resend, may not used */
339 344
340 345 LIST_ENTRY(recvdpkt) chain;
341 346 };
342 347
343 348 /* for parsing ISAKMP header. */
344 349 struct isakmp_parse_t {
345 350 unsigned char type; /* payload type of mine */
346 351 int len; /* ntohs(ptr->len) */
347 352 struct isakmp_gen *ptr;
348 353 };
349 354
350 355 /*
351 356 * for IV management.
352 357 *
353 358 * - normal case
354 359 * initiator responder
355 360 * ------------------------- --------------------------
356 361 * initialize iv(A), ive(A). initialize iv(A), ive(A).
357 362 * encode by ive(A).
358 363 * save to iv(B). ---[packet(B)]--> save to ive(B).
359 364 * decode by iv(A).
360 365 * packet consistency.
361 366 * sync iv(B) with ive(B).
362 367 * check auth, integrity.
363 368 * encode by ive(B).
364 369 * save to ive(C). <--[packet(C)]--- save to iv(C).
365 370 * decoded by iv(B).
366 371 * :
367 372 *
368 373 * - In the case that a error is found while cipher processing,
369 374 * initiator responder
370 375 * ------------------------- --------------------------
371 376 * initialize iv(A), ive(A). initialize iv(A), ive(A).
372 377 * encode by ive(A).
373 378 * save to iv(B). ---[packet(B)]--> save to ive(B).
374 379 * decode by iv(A).
375 380 * packet consistency.
376 381 * sync iv(B) with ive(B).
377 382 * check auth, integrity.
378 383 * error found.
379 384 * create notify.
380 385 * get ive2(X) from iv(B).
381 386 * encode by ive2(X).
382 387 * get iv2(X) from iv(B). <--[packet(Y)]--- save to iv2(Y).
383 388 * save to ive2(Y).
384 389 * decoded by iv2(X).
385 390 * :
386 391 *
387 392 * The reason why the responder synchronizes iv with ive after checking the
388 393 * packet consistency is that it is required to leave the IV for decoding
389 394 * packet. Because there is a potential of error while checking the packet
390 395 * consistency. Also the reason why that is before authentication and
391 396 * integirty check is that the IV for informational exchange has to be made
392 397 * by the IV which is after packet decoded and checking the packet consistency.
393 398 * Otherwise IV mismatched happens between the intitiator and the responder.
394 399 */
395 400 struct isakmp_ivm {
396 401 rc_vchar_t *iv; /* for decoding packet */
397 402 /* if phase 1, it's for computing phase2 iv */
398 403 rc_vchar_t *ive; /* for encoding packet */
399 404 };
400 405
401 406 /* for dumping */
402 407 struct ph1dump {
403 408 isakmp_index_t index;
404 409 int status;
405 410 int side;
406 411 struct sockaddr_storage remote;
407 412 struct sockaddr_storage local;
408 413 uint8_t version;
409 414 uint8_t etype;
410 415 time_t created;
411 416 int ph2cnt;
412 417 };
413 418
414 419 struct sockaddr;
415 420 struct ph1handle;
416 421 struct ph2handle;
417 422 struct policyindex;
418 423
419 424 extern struct ph1handle *getph1byindex (isakmp_index_t *);
420 425 extern struct ph1handle *getph1byindex0 (isakmp_index_t *);
421 426 extern struct ph1handle *getph1byaddr (struct sockaddr *,
422 427 struct sockaddr *);
423 428 extern struct ph1handle *getph1byaddrwop (struct sockaddr *,
424 429 struct sockaddr *);
425 430 extern rc_vchar_t *dumpph1 (void);
426 431 extern struct ph1handle *newph1 (void);
427 432 extern void delph1 (struct ph1handle *);
428 433 extern int insph1 (struct ph1handle *);
429 434 extern void remph1 (struct ph1handle *);
430 435 extern void flushph1 (void);
431 436 extern void initph1tree (void);
432 437
433 438 extern struct ph2handle *getph2byspidx (struct policyindex *);
434 439 extern struct ph2handle *getph2byspid (uint32_t);
435 440 extern struct ph2handle *getph2byseq (uint32_t);
436 441 extern struct ph2handle *getph2bymsgid (struct ph1handle *, uint32_t);
437 442 extern struct ph2handle *getph2bysaidx (struct sockaddr *,
438 443 struct sockaddr *, unsigned int,
439 444 uint32_t);
440 445 extern struct ph2handle *newph2 (void);
441 446 extern void initph2 (struct ph2handle *);
442 447 extern void delph2 (struct ph2handle *);
443 448 extern int insph2 (struct ph2handle *);
444 449 extern void remph2 (struct ph2handle *);
445 450 extern void flushph2 (void);
446 451 extern void deleteallph2 (struct sockaddr *, struct sockaddr *, unsigned int);
447 452 extern void initph2tree (void);
448 453
449 454 extern void bindph12 (struct ph1handle *, struct ph2handle *);
450 455 extern void unbindph12 (struct ph2handle *);
451 456
452 457 extern struct contacted *getcontacted (struct sockaddr *);
453 458 extern int inscontacted (struct sockaddr *);
454 459 extern void initctdtree (void);
455 460
456 461 extern int check_recvdpkt (struct sockaddr *,
457 462 struct sockaddr *, rc_vchar_t *);
458 463 extern int add_recvdpkt (struct sockaddr *, struct sockaddr *,
459 464 rc_vchar_t *, rc_vchar_t *, struct rcf_remote *);
460 465 extern void init_recvdpkt (void);
|
↓ open down ↓ |
215 lines elided |
↑ open up ↑ |
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX