1 /* $NetBSD: handler.h,v 1.22 2009/09/03 09:29:07 tteras Exp $ */ 2 3 /* Id: handler.h,v 1.19 2006/02/25 08:25:12 manubsd Exp */ 4 5 /* 6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. Neither the name of the project nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #ifndef _HANDLER_H 35 #define _HANDLER_H 36 37 #include <sys/queue.h> 38 #include <openssl/rsa.h> 39 40 #include <sys/time.h> 41 42 #include "isakmp_var.h" 43 #include "oakley.h" 44 #include "schedule.h" 45 #include "evt.h" 46 47 /* Phase 1 handler */ 48 /* 49 * main mode: 50 * initiator responder 51 * 0 (---) (---) 52 * 1 start start (1st msg received) 53 * 2 (---) 1st valid msg received 54 * 3 1st msg sent 1st msg sent 55 * 4 1st valid msg received 2st valid msg received 56 * 5 2nd msg sent 2nd msg sent 57 * 6 2nd valid msg received 3rd valid msg received 58 * 7 3rd msg sent 3rd msg sent 59 * 8 3rd valid msg received (---) 60 * 9 SA established SA established 61 * 62 * aggressive mode: 63 * initiator responder 64 * 0 (---) (---) 65 * 1 start start (1st msg received) 66 * 2 (---) 1st valid msg received 67 * 3 1st msg sent 1st msg sent 68 * 4 1st valid msg received 2st valid msg received 69 * 5 (---) (---) 70 * 6 (---) (---) 71 * 7 (---) (---) 72 * 8 (---) (---) 73 * 9 SA established SA established 74 * 75 * base mode: 76 * initiator responder 77 * 0 (---) (---) 78 * 1 start start (1st msg received) 79 * 2 (---) 1st valid msg received 80 * 3 1st msg sent 1st msg sent 81 * 4 1st valid msg received 2st valid msg received 82 * 5 2nd msg sent (---) 83 * 6 (---) (---) 84 * 7 (---) (---) 85 * 8 (---) (---) 86 * 9 SA established SA established 87 */ 88 #define PHASE1ST_SPAWN 0 89 #define PHASE1ST_START 1 90 #define PHASE1ST_MSG1RECEIVED 2 91 #define PHASE1ST_MSG1SENT 3 92 #define PHASE1ST_MSG2RECEIVED 4 93 #define PHASE1ST_MSG2SENT 5 94 #define PHASE1ST_MSG3RECEIVED 6 95 #define PHASE1ST_MSG3SENT 7 96 #define PHASE1ST_MSG4RECEIVED 8 97 #define PHASE1ST_ESTABLISHED 9 98 #define PHASE1ST_DYING 10 99 #define PHASE1ST_EXPIRED 11 100 #define PHASE1ST_MAX 12 101 102 /* About address semantics in each case. 103 * initiator(addr=I) responder(addr=R) 104 * src dst src dst 105 * (local) (remote) (local) (remote) 106 * phase 1 handler I R R I 107 * phase 2 handler I R R I 108 * getspi msg R I I R 109 * acquire msg I R 110 * ID payload I R I R 111 */ 112 #ifdef ENABLE_HYBRID 113 struct isakmp_cfg_state; 114 #endif 115 struct ph1handle { 116 isakmp_index index; 117 118 int status; /* status of this SA */ 119 int side; /* INITIATOR or RESPONDER */ 120 121 struct sockaddr *remote; /* remote address to negosiate ph1 */ 122 struct sockaddr *local; /* local address to negosiate ph1 */ 123 /* XXX copy from rmconf due to anonymous configuration. 124 * If anonymous will be forbidden, we do delete them. */ 125 126 struct remoteconf *rmconf; /* pointer to remote configuration */ 127 128 struct isakmpsa *approval; /* pointer to SA(s) approved. */ 129 vchar_t *authstr; /* place holder of string for auth. */ 130 /* for example pre-shared key */ 131 132 u_int8_t version; /* ISAKMP version */ 133 u_int8_t etype; /* Exchange type actually for use */ 134 u_int8_t flags; /* Flags */ 135 u_int32_t msgid; /* message id */ 136 137 u_int32_t vendorid_mask; /* bitmask of received supported vendor ids*/ 138 #ifdef ENABLE_NATT 139 struct ph1natt_options *natt_options; /* Selected NAT-T IKE version */ 140 u_int32_t natt_flags; /* NAT-T related flags */ 141 #endif 142 #ifdef ENABLE_FRAG 143 int frag; /* IKE phase 1 fragmentation */ 144 struct isakmp_frag_item *frag_chain; /* Received fragments */ 145 #endif 146 147 struct sched sce; /* schedule for expire */ 148 149 struct sched scr; /* schedule for resend */ 150 int retry_counter; /* for resend. */ 151 vchar_t *sendbuf; /* buffer for re-sending */ 152 153 vchar_t *dhpriv; /* DH; private value */ 154 vchar_t *dhpub; /* DH; public value */ 155 vchar_t *dhpub_p; /* DH; partner's public value */ 156 vchar_t *dhgxy; /* DH; shared secret */ 157 vchar_t *nonce; /* nonce value */ 158 vchar_t *nonce_p; /* partner's nonce value */ 159 vchar_t *skeyid; /* SKEYID */ 160 vchar_t *skeyid_d; /* SKEYID_d */ 161 vchar_t *skeyid_a; /* SKEYID_a, i.e. hash */ 162 vchar_t *skeyid_e; /* SKEYID_e, i.e. encryption */ 163 vchar_t *key; /* cipher key */ 164 vchar_t *hash; /* HASH minus general header */ 165 vchar_t *sig; /* SIG minus general header */ 166 vchar_t *sig_p; /* peer's SIG minus general header */ 167 vchar_t *cert; /* CERT minus general header */ 168 vchar_t *cert_p; /* peer's CERT minus general header */ 169 vchar_t *crl_p; /* peer's CRL minus general header */ 170 vchar_t *cr_p; /* peer's CR not including general */ 171 RSA *rsa; /* my RSA key */ 172 RSA *rsa_p; /* peer's RSA key */ 173 struct genlist *rsa_candidates; /* possible candidates for peer's RSA key */ 174 vchar_t *id; /* ID minus gen header */ 175 vchar_t *id_p; /* partner's ID minus general header */ 176 /* i.e. struct ipsecdoi_id_b*. */ 177 struct isakmp_ivm *ivm; /* IVs */ 178 179 vchar_t *sa; /* whole SA payload to send/to be sent*/ 180 /* to calculate HASH */ 181 /* NOT INCLUDING general header. */ 182 183 vchar_t *sa_ret; /* SA payload to reply/to be replyed */ 184 /* NOT INCLUDING general header. */ 185 /* NOTE: Should be release after use. */ 186 187 #ifdef HAVE_GSSAPI 188 void *gssapi_state; /* GSS-API specific state. */ 189 /* Allocated when needed */ 190 vchar_t *gi_i; /* optional initiator GSS id */ 191 vchar_t *gi_r; /* optional responder GSS id */ 192 #endif 193 194 struct isakmp_pl_hash *pl_hash; /* pointer to hash payload */ 195 196 time_t created; /* timestamp for establish */ 197 int initial_contact_received; /* set if initial contact received */ 198 #ifdef ENABLE_STATS 199 struct timeval start; 200 struct timeval end; 201 #endif 202 203 #ifdef ENABLE_DPD 204 int dpd_support; /* Does remote supports DPD ? */ 205 u_int16_t dpd_seq; /* DPD seq number to receive */ 206 u_int8_t dpd_fails; /* number of failures */ 207 struct sched dpd_r_u; 208 #endif 209 210 u_int32_t msgid2; /* msgid counter for Phase 2 */ 211 int ph2cnt; /* the number which is negotiated by this phase 1 */ 212 LIST_HEAD(_ph2ofph1_, ph2handle) ph2tree; 213 214 LIST_ENTRY(ph1handle) chain; 215 #ifdef ENABLE_HYBRID 216 struct isakmp_cfg_state *mode_cfg; /* ISAKMP mode config state */ 217 #endif 218 EVT_LISTENER_LIST(evt_listeners); 219 }; 220 221 /* For limiting enumeration of ph1 tree */ 222 struct ph1selector { 223 struct sockaddr *local; 224 struct sockaddr *remote; 225 }; 226 227 /* Phase 2 handler */ 228 /* allocated per a SA or SA bundles of a pair of peer's IP addresses. */ 229 /* 230 * initiator responder 231 * 0 (---) (---) 232 * 1 start start (1st msg received) 233 * 2 acquire msg get 1st valid msg received 234 * 3 getspi request sent getspi request sent 235 * 4 getspi done getspi done 236 * 5 1st msg sent 1st msg sent 237 * 6 1st valid msg received 2nd valid msg received 238 * 7 (commit bit) (commit bit) 239 * 8 SAs added SAs added 240 * 9 SAs established SAs established 241 * 10 SAs expired SAs expired 242 */ 243 #define PHASE2ST_SPAWN 0 244 #define PHASE2ST_START 1 245 #define PHASE2ST_STATUS2 2 246 #define PHASE2ST_GETSPISENT 3 247 #define PHASE2ST_GETSPIDONE 4 248 #define PHASE2ST_MSG1SENT 5 249 #define PHASE2ST_STATUS6 6 250 #define PHASE2ST_COMMIT 7 251 #define PHASE2ST_ADDSA 8 252 #define PHASE2ST_ESTABLISHED 9 253 #define PHASE2ST_EXPIRED 10 254 #define PHASE2ST_MAX 11 255 256 struct ph2handle { 257 /* source and destination addresses used for IKE exchange. Might 258 * differ from source and destination of SA. On the initiator, 259 * they are tweaked if a hint is available in the SPD (set by 260 * MIGRATE for instance). Otherwise they are the source and 261 * destination of SA for transport mode and the tunnel endpoints 262 * for tunnel mode */ 263 struct sockaddr *src; 264 struct sockaddr *dst; 265 266 /* source and destination addresses of the SA in the case addresses 267 * used for IKE exchanges (src and dst) do differ. On the initiator, 268 * they are set (if needed) in pk_recvacquire(). On the responder, 269 * they are _derived_ from the local and remote parameters of the 270 * SP, if available. */ 271 struct sockaddr *sa_src; 272 struct sockaddr *sa_dst; 273 274 /* Store our Phase 2 ID and the peer ID (ID minus general header). 275 * On the initiator, they are set during ACQUIRE processing. 276 * On the responder, they are set from the content of ID payload 277 * in quick_r1recv(). Then, if they are of type address or 278 * tunnel, they are compared to sainfo selectors. 279 */ 280 vchar_t *id; /* ID minus gen header */ 281 vchar_t *id_p; /* peer's ID minus general header */ 282 283 #ifdef ENABLE_NATT 284 struct sockaddr *natoa_src; /* peer's view of my address */ 285 struct sockaddr *natoa_dst; /* peer's view of his address */ 286 #endif 287 288 u_int32_t spid; /* policy id by kernel */ 289 290 int status; /* ipsec sa status */ 291 u_int8_t side; /* INITIATOR or RESPONDER */ 292 293 struct sched sce; /* schedule for expire */ 294 struct sched scr; /* schedule for resend */ 295 int retry_counter; /* for resend. */ 296 vchar_t *sendbuf; /* buffer for re-sending */ 297 vchar_t *msg1; /* buffer for re-sending */ 298 /* used for responder's first message */ 299 300 int retry_checkph1; /* counter to wait phase 1 finished. */ 301 /* NOTE: actually it's timer. */ 302 303 u_int32_t seq; /* sequence number used by PF_KEY */ 304 /* 305 * NOTE: In responder side, we can't identify each SAs 306 * with same destination address for example, when 307 * socket based SA is required. So we set a identifier 308 * number to "seq", and sent kernel by pfkey. 309 */ 310 u_int8_t satype; /* satype in PF_KEY */ 311 /* 312 * saved satype in the original PF_KEY request from 313 * the kernel in order to reply a error. 314 */ 315 316 u_int8_t flags; /* Flags for phase 2 */ 317 u_int32_t msgid; /* msgid for phase 2 */ 318 319 struct sainfo *sainfo; /* place holder of sainfo */ 320 struct saprop *proposal; /* SA(s) proposal. */ 321 struct saprop *approval; /* SA(s) approved. */ 322 u_int32_t lifetime_secs; /* responder lifetime (seconds) */ 323 u_int32_t lifetime_kb; /* responder lifetime (kbytes) */ 324 caddr_t spidx_gen; /* policy from peer's proposal */ 325 326 struct dhgroup *pfsgrp; /* DH; prime number */ 327 vchar_t *dhpriv; /* DH; private value */ 328 vchar_t *dhpub; /* DH; public value */ 329 vchar_t *dhpub_p; /* DH; partner's public value */ 330 vchar_t *dhgxy; /* DH; shared secret */ 331 vchar_t *nonce; /* nonce value in phase 2 */ 332 vchar_t *nonce_p; /* partner's nonce value in phase 2 */ 333 334 vchar_t *sa; /* whole SA payload to send/to be sent*/ 335 /* to calculate HASH */ 336 /* NOT INCLUDING general header. */ 337 338 vchar_t *sa_ret; /* SA payload to reply/to be replyed */ 339 /* NOT INCLUDING general header. */ 340 /* NOTE: Should be release after use. */ 341 342 struct isakmp_ivm *ivm; /* IVs */ 343 344 int generated_spidx; /* mark handlers whith generated policy */ 345 346 #ifdef ENABLE_STATS 347 struct timeval start; 348 struct timeval end; 349 #endif 350 struct ph1handle *ph1; /* back pointer to isakmp status */ 351 352 LIST_ENTRY(ph2handle) chain; 353 LIST_ENTRY(ph2handle) ph1bind; /* chain to ph1handle */ 354 EVT_LISTENER_LIST(evt_listeners); 355 }; 356 357 /* For limiting enumeration of ph2 tree */ 358 struct ph2selector { 359 u_int32_t spid; 360 struct sockaddr *src; 361 struct sockaddr *dst; 362 }; 363 364 /* 365 * for handling initial contact. 366 */ 367 struct contacted { 368 struct sockaddr *remote; /* remote address to negosiate ph1 */ 369 LIST_ENTRY(contacted) chain; 370 }; 371 372 /* 373 * for checking a packet retransmited. 374 */ 375 struct recvdpkt { 376 struct sockaddr *remote; /* the remote address */ 377 struct sockaddr *local; /* the local address */ 378 vchar_t *hash; /* hash of the received packet */ 379 vchar_t *sendbuf; /* buffer for the response */ 380 int retry_counter; /* how many times to send */ 381 struct timeval time_send; /* timestamp of previous send */ 382 383 LIST_ENTRY(recvdpkt) chain; 384 }; 385 386 /* for parsing ISAKMP header. */ 387 struct isakmp_parse_t { 388 u_char type; /* payload type of mine */ 389 int len; /* ntohs(ptr->len) */ 390 struct isakmp_gen *ptr; 391 }; 392 393 /* 394 * for IV management. 395 * 396 * - normal case 397 * initiator responder 398 * ------------------------- -------------------------- 399 * initialize iv(A), ive(A). initialize iv(A), ive(A). 400 * encode by ive(A). 401 * save to iv(B). ---[packet(B)]--> save to ive(B). 402 * decode by iv(A). 403 * packet consistency. 404 * sync iv(B) with ive(B). 405 * check auth, integrity. 406 * encode by ive(B). 407 * save to ive(C). <--[packet(C)]--- save to iv(C). 408 * decoded by iv(B). 409 * : 410 * 411 * - In the case that a error is found while cipher processing, 412 * initiator responder 413 * ------------------------- -------------------------- 414 * initialize iv(A), ive(A). initialize iv(A), ive(A). 415 * encode by ive(A). 416 * save to iv(B). ---[packet(B)]--> save to ive(B). 417 * decode by iv(A). 418 * packet consistency. 419 * sync iv(B) with ive(B). 420 * check auth, integrity. 421 * error found. 422 * create notify. 423 * get ive2(X) from iv(B). 424 * encode by ive2(X). 425 * get iv2(X) from iv(B). <--[packet(Y)]--- save to iv2(Y). 426 * save to ive2(Y). 427 * decoded by iv2(X). 428 * : 429 * 430 * The reason why the responder synchronizes iv with ive after checking the 431 * packet consistency is that it is required to leave the IV for decoding 432 * packet. Because there is a potential of error while checking the packet 433 * consistency. Also the reason why that is before authentication and 434 * integirty check is that the IV for informational exchange has to be made 435 * by the IV which is after packet decoded and checking the packet consistency. 436 * Otherwise IV mismatched happens between the intitiator and the responder. 437 */ 438 struct isakmp_ivm { 439 vchar_t *iv; /* for decoding packet */ 440 /* if phase 1, it's for computing phase2 iv */ 441 vchar_t *ive; /* for encoding packet */ 442 }; 443 444 /* for dumping */ 445 struct ph1dump { 446 isakmp_index index; 447 int status; 448 int side; 449 struct sockaddr_storage remote; 450 struct sockaddr_storage local; 451 u_int8_t version; 452 u_int8_t etype; 453 time_t created; 454 int ph2cnt; 455 }; 456 457 struct sockaddr; 458 struct ph1handle; 459 struct ph2handle; 460 struct policyindex; 461 462 extern struct ph1handle *getph1byindex __P((isakmp_index *)); 463 extern struct ph1handle *getph1byindex0 __P((isakmp_index *)); 464 465 extern int enumph1 __P((struct ph1selector *ph1sel, 466 int (* enum_func)(struct ph1handle *iph1, void *arg), 467 void *enum_arg)); 468 469 #define GETPH1_F_ESTABLISHED 0x0001 470 471 extern struct ph1handle *getph1 __P((struct ph1handle *ph1hint, 472 struct sockaddr *local, 473 struct sockaddr *remote, 474 int flags)); 475 476 #define getph1byaddr(local, remote, est) \ 477 getph1(NULL, local, remote, est ? GETPH1_F_ESTABLISHED : 0) 478 #define getph1bydstaddr(remote) \ 479 getph1(NULL, NULL, remote, 0) 480 481 #ifdef ENABLE_HYBRID 482 struct ph1handle *getph1bylogin __P((char *)); 483 int purgeph1bylogin __P((char *)); 484 #endif 485 extern void migrate_ph12 __P((struct ph1handle *old_iph1, struct ph1handle *new_iph1)); 486 extern void migrate_dying_ph12 __P((struct ph1handle *iph1)); 487 extern vchar_t *dumpph1 __P((void)); 488 extern struct ph1handle *newph1 __P((void)); 489 extern void delph1 __P((struct ph1handle *)); 490 extern int insph1 __P((struct ph1handle *)); 491 extern void remph1 __P((struct ph1handle *)); 492 extern int resolveph1rmconf __P((struct ph1handle *)); 493 extern void flushph1 __P((void)); 494 extern void initph1tree __P((void)); 495 496 extern int enumph2 __P((struct ph2selector *ph2sel, 497 int (* enum_func)(struct ph2handle *iph2, void *arg), 498 void *enum_arg)); 499 extern struct ph2handle *getph2byseq __P((u_int32_t)); 500 extern struct ph2handle *getph2bysaddr __P((struct sockaddr *, 501 struct sockaddr *)); 502 extern struct ph2handle *getph2bymsgid __P((struct ph1handle *, u_int32_t)); 503 extern struct ph2handle *getph2byid __P((struct sockaddr *, 504 struct sockaddr *, u_int32_t)); 505 extern struct ph2handle *getph2bysaidx __P((struct sockaddr *, 506 struct sockaddr *, u_int, u_int32_t)); 507 extern struct ph2handle *newph2 __P((void)); 508 extern void initph2 __P((struct ph2handle *)); 509 extern void delph2 __P((struct ph2handle *)); 510 extern int insph2 __P((struct ph2handle *)); 511 extern void remph2 __P((struct ph2handle *)); 512 extern void flushph2 __P((void)); 513 extern void deleteallph2 __P((struct sockaddr *, struct sockaddr *, u_int)); 514 extern void initph2tree __P((void)); 515 516 extern void bindph12 __P((struct ph1handle *, struct ph2handle *)); 517 extern void unbindph12 __P((struct ph2handle *)); 518 519 extern struct contacted *getcontacted __P((struct sockaddr *)); 520 extern int inscontacted __P((struct sockaddr *)); 521 extern void initctdtree __P((void)); 522 523 extern int check_recvdpkt __P((struct sockaddr *, 524 struct sockaddr *, vchar_t *)); 525 extern int add_recvdpkt __P((struct sockaddr *, struct sockaddr *, 526 vchar_t *, vchar_t *)); 527 extern void init_recvdpkt __P((void)); 528 529 #ifdef ENABLE_HYBRID 530 extern int exclude_cfg_addr __P((const struct sockaddr *)); 531 #endif 532 533 extern int revalidate_ph12(void); 534 535 #endif /* _HANDLER_H */ 536