1 /* 2 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. Neither the name of the project nor the names of its contributors 14 * may be used to endorse or promote products derived from this software 15 * without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 */ 29 /* YIPS @(#)$Id: isakmp.h,v 1.12 2007-11-24 18:13:33 mcr Exp $ */ 30 31 /* refer to RFC 2408 */ 32 33 /* must include <netinet/in.h> */ 34 35 #if !defined(_ISAKMP_H_) 36 #define _ISAKMP_H_ 37 38 typedef u_char cookie_t[8]; 39 typedef u_char msgid_t[4]; 40 41 typedef struct { /* i_cookie + r_cookie */ 42 cookie_t i_ck; 43 cookie_t r_ck; 44 } isakmp_index; 45 46 #define INITIATOR 1 47 #define RESPONDER 2 48 49 #define PORT_ISAKMP 500 50 51 #define GENERATE 1 52 #define VALIDATE 0 53 54 /* Phase of oakley definition */ 55 /* 56 0000 0000 0000 0000 57 | |||| |||| 58 | |||| ++++--> negosiation number in phase 59 | ++++-------> phase number 60 +---------------> expire ? 61 */ 62 #define ISAKMP_PH1 0x0010 63 #define ISAKMP_PH2 0x0020 64 #define ISAKMP_EXPIRED 0x0100 65 66 #define ISAKMP_NGP_0 0x0000 67 #define ISAKMP_NGP_1 0x0001 68 #define ISAKMP_NGP_2 0x0002 69 #define ISAKMP_NGP_3 0x0003 70 #define ISAKMP_NGP_4 0x0004 71 72 #define ISAKMP_PH1_N (ISAKMP_PH1 | ISAKMP_NGP_0) /* i.e. spawn */ 73 #define ISAKMP_PH1_1 (ISAKMP_PH1 | ISAKMP_NGP_1) 74 #define ISAKMP_PH1_2 (ISAKMP_PH1 | ISAKMP_NGP_2) 75 #define ISAKMP_PH1_3 (ISAKMP_PH1 | ISAKMP_NGP_3) 76 #define ISAKMP_PH2_N (ISAKMP_PH2 | ISAKMP_NGP_0) 77 #define ISAKMP_PH2_1 (ISAKMP_PH2 | ISAKMP_NGP_1) 78 #define ISAKMP_PH2_2 (ISAKMP_PH2 | ISAKMP_NGP_2) 79 #define ISAKMP_PH2_3 (ISAKMP_PH2 | ISAKMP_NGP_3) 80 81 #define ISAKMP_TIMER_DEFAULT 10 /* seconds */ 82 #define ISAKMP_TRY_DEFAULT 3 /* times */ 83 84 /* 3.1 ISAKMP Header Format (IKEv1 and IKEv2) 85 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 86 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 87 ! Initiator ! 88 ! Cookie ! 89 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 90 ! Responder ! 91 ! Cookie ! 92 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 93 ! Next Payload ! MjVer ! MnVer ! Exchange Type ! Flags ! 94 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 95 ! Message ID ! 96 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 97 ! Length ! 98 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 99 */ 100 struct isakmp { 101 cookie_t i_ck; /* Initiator Cookie */ 102 cookie_t r_ck; /* Responder Cookie */ 103 u_int8_t np; /* Next Payload Type */ 104 u_int8_t vers; 105 #define ISAKMP_VERS_MAJOR 0xf0 106 #define ISAKMP_VERS_MAJOR_SHIFT 4 107 #define ISAKMP_VERS_MINOR 0x0f 108 #define ISAKMP_VERS_MINOR_SHIFT 0 109 u_int8_t etype; /* Exchange Type */ 110 u_int8_t flags; /* Flags */ 111 msgid_t msgid; 112 u_int32_t len; /* Length */ 113 }; 114 115 /* Next Payload Type */ 116 #define ISAKMP_NPTYPE_NONE 0 /* NONE*/ 117 #define ISAKMP_NPTYPE_SA 1 /* Security Association */ 118 #define ISAKMP_NPTYPE_P 2 /* Proposal */ 119 #define ISAKMP_NPTYPE_T 3 /* Transform */ 120 #define ISAKMP_NPTYPE_KE 4 /* Key Exchange */ 121 #define ISAKMP_NPTYPE_ID 5 /* Identification */ 122 #define ISAKMP_NPTYPE_CERT 6 /* Certificate */ 123 #define ISAKMP_NPTYPE_CR 7 /* Certificate Request */ 124 #define ISAKMP_NPTYPE_HASH 8 /* Hash */ 125 #define ISAKMP_NPTYPE_SIG 9 /* Signature */ 126 #define ISAKMP_NPTYPE_NONCE 10 /* Nonce */ 127 #define ISAKMP_NPTYPE_N 11 /* Notification */ 128 #define ISAKMP_NPTYPE_D 12 /* Delete */ 129 #define ISAKMP_NPTYPE_VID 13 /* Vendor ID */ 130 #define ISAKMP_NPTYPE_v2E 46 /* v2 Encrypted payload */ 131 132 #define IKEv1_MAJOR_VERSION 1 133 #define IKEv1_MINOR_VERSION 0 134 135 #define IKEv2_MAJOR_VERSION 2 136 #define IKEv2_MINOR_VERSION 0 137 138 /* Exchange Type */ 139 #define ISAKMP_ETYPE_NONE 0 /* NONE */ 140 #define ISAKMP_ETYPE_BASE 1 /* Base */ 141 #define ISAKMP_ETYPE_IDENT 2 /* Identity Proteciton */ 142 #define ISAKMP_ETYPE_AUTH 3 /* Authentication Only */ 143 #define ISAKMP_ETYPE_AGG 4 /* Aggressive */ 144 #define ISAKMP_ETYPE_INF 5 /* Informational */ 145 146 /* Flags */ 147 #define ISAKMP_FLAG_E 0x01 /* Encryption Bit */ 148 #define ISAKMP_FLAG_C 0x02 /* Commit Bit */ 149 #define ISAKMP_FLAG_extra 0x04 150 151 /* IKEv2 */ 152 #define ISAKMP_FLAG_I (1 << 3) /* (I)nitiator */ 153 #define ISAKMP_FLAG_V (1 << 4) /* (V)ersion */ 154 #define ISAKMP_FLAG_R (1 << 5) /* (R)esponse */ 155 156 157 /* 3.2 Payload Generic Header 158 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 159 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 160 ! Next Payload ! RESERVED ! Payload Length ! 161 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 162 */ 163 struct isakmp_gen { 164 u_int8_t np; /* Next Payload */ 165 u_int8_t critical; /* bit 7 - critical, rest is RESERVED */ 166 u_int16_t len; /* Payload Length */ 167 }; 168 169 /* 3.3 Data Attributes 170 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 171 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 172 !A! Attribute Type ! AF=0 Attribute Length ! 173 !F! ! AF=1 Attribute Value ! 174 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 175 . AF=0 Attribute Value . 176 . AF=1 Not Transmitted . 177 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 178 */ 179 struct isakmp_data { 180 u_int16_t type; /* defined by DOI-spec, and Attribute Format */ 181 u_int16_t lorv; /* if f equal 1, Attribute Length */ 182 /* if f equal 0, Attribute Value */ 183 /* if f equal 1, Attribute Value */ 184 }; 185 #define ISAKMP_GEN_TLV 0x0000 186 #define ISAKMP_GEN_TV 0x8000 187 /* mask for type of attribute format */ 188 #define ISAKMP_GEN_MASK 0x8000 189 190 /* 3.4 Security Association Payload */ 191 /* MAY NOT be used, because of being defined in ipsec-doi. */ 192 /* 193 If the current payload is the last in the message, 194 then the value of the next payload field will be 0. 195 This field MUST NOT contain the 196 values for the Proposal or Transform payloads as they are considered 197 part of the security association negotiation. For example, this 198 field would contain the value "10" (Nonce payload) in the first 199 message of a Base Exchange (see Section 4.4) and the value "0" in the 200 first message of an Identity Protect Exchange (see Section 4.5). 201 */ 202 struct ikev1_pl_sa { 203 struct isakmp_gen h; 204 u_int32_t doi; /* Domain of Interpretation */ 205 u_int32_t sit; /* Situation */ 206 }; 207 208 /* 3.5 Proposal Payload */ 209 /* 210 The value of the next payload field MUST only contain the value "2" 211 or "0". If there are additional Proposal payloads in the message, 212 then this field will be 2. If the current Proposal payload is the 213 last within the security association proposal, then this field will 214 be 0. 215 */ 216 struct ikev1_pl_p { 217 struct isakmp_gen h; 218 u_int8_t p_no; /* Proposal # */ 219 u_int8_t prot_id; /* Protocol */ 220 u_int8_t spi_size; /* SPI Size */ 221 u_int8_t num_t; /* Number of Transforms */ 222 /* SPI */ 223 }; 224 225 /* 3.6 Transform Payload */ 226 /* 227 The value of the next payload field MUST only contain the value "3" 228 or "0". If there are additional Transform payloads in the proposal, 229 then this field will be 3. If the current Transform payload is the 230 last within the proposal, then this field will be 0. 231 */ 232 struct ikev1_pl_t { 233 struct isakmp_gen h; 234 u_int8_t t_no; /* Transform # */ 235 u_int8_t t_id; /* Transform-Id */ 236 u_int16_t reserved; /* RESERVED2 */ 237 /* SA Attributes */ 238 }; 239 240 /* 3.7 Key Exchange Payload */ 241 struct ikev1_pl_ke { 242 struct isakmp_gen h; 243 /* Key Exchange Data */ 244 }; 245 246 /* 3.8 Identification Payload */ 247 /* MUST NOT to be used, because of being defined in ipsec-doi. */ 248 struct ikev1_pl_id { 249 struct isakmp_gen h; 250 union { 251 u_int8_t id_type; /* ID Type */ 252 u_int32_t doi_data; /* DOI Specific ID Data */ 253 } d; 254 /* Identification Data */ 255 }; 256 257 /* 3.9 Certificate Payload */ 258 struct ikev1_pl_cert { 259 struct isakmp_gen h; 260 u_int8_t encode; /* Cert Encoding */ 261 char cert; /* Certificate Data */ 262 /* 263 This field indicates the type of 264 certificate or certificate-related information contained in the 265 Certificate Data field. 266 */ 267 }; 268 269 /* Certificate Type */ 270 #define ISAKMP_CERT_NONE 0 271 #define ISAKMP_CERT_PKCS 1 272 #define ISAKMP_CERT_PGP 2 273 #define ISAKMP_CERT_DNS 3 274 #define ISAKMP_CERT_SIGN 4 275 #define ISAKMP_CERT_KE 5 276 #define ISAKMP_CERT_KT 6 277 #define ISAKMP_CERT_CRL 7 278 #define ISAKMP_CERT_ARL 8 279 #define ISAKMP_CERT_SPKI 9 280 281 /* 3.10 Certificate Request Payload */ 282 struct ikev1_pl_cr { 283 struct isakmp_gen h; 284 u_int8_t num_cert; /* # Cert. Types */ 285 /* 286 Certificate Types (variable length) 287 -- Contains a list of the types of certificates requested, 288 sorted in order of preference. Each individual certificate 289 type is 1 octet. This field is NOT requiredo 290 */ 291 /* # Certificate Authorities (1 octet) */ 292 /* Certificate Authorities (variable length) */ 293 }; 294 295 /* 3.11 Hash Payload */ 296 /* may not be used, because of having only data. */ 297 struct ikev1_pl_hash { 298 struct isakmp_gen h; 299 /* Hash Data */ 300 }; 301 302 /* 3.12 Signature Payload */ 303 /* may not be used, because of having only data. */ 304 struct ikev1_pl_sig { 305 struct isakmp_gen h; 306 /* Signature Data */ 307 }; 308 309 /* 3.13 Nonce Payload */ 310 /* may not be used, because of having only data. */ 311 struct ikev1_pl_nonce { 312 struct isakmp_gen h; 313 /* Nonce Data */ 314 }; 315 316 /* 3.14 Notification Payload */ 317 struct ikev1_pl_n { 318 struct isakmp_gen h; 319 u_int32_t doi; /* Domain of Interpretation */ 320 u_int8_t prot_id; /* Protocol-ID */ 321 u_int8_t spi_size; /* SPI Size */ 322 u_int16_t type; /* Notify Message Type */ 323 /* SPI */ 324 /* Notification Data */ 325 }; 326 327 /* 3.14.1 Notify Message Types */ 328 /* NOTIFY MESSAGES - ERROR TYPES */ 329 #define ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE 1 330 #define ISAKMP_NTYPE_DOI_NOT_SUPPORTED 2 331 #define ISAKMP_NTYPE_SITUATION_NOT_SUPPORTED 3 332 #define ISAKMP_NTYPE_INVALID_COOKIE 4 333 #define ISAKMP_NTYPE_INVALID_MAJOR_VERSION 5 334 #define ISAKMP_NTYPE_INVALID_MINOR_VERSION 6 335 #define ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE 7 336 #define ISAKMP_NTYPE_INVALID_FLAGS 8 337 #define ISAKMP_NTYPE_INVALID_MESSAGE_ID 9 338 #define ISAKMP_NTYPE_INVALID_PROTOCOL_ID 10 339 #define ISAKMP_NTYPE_INVALID_SPI 11 340 #define ISAKMP_NTYPE_INVALID_TRANSFORM_ID 12 341 #define ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED 13 342 #define ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN 14 343 #define ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX 15 344 #define ISAKMP_NTYPE_PAYLOAD_MALFORMED 16 345 #define ISAKMP_NTYPE_INVALID_KEY_INFORMATION 17 346 #define ISAKMP_NTYPE_INVALID_ID_INFORMATION 18 347 #define ISAKMP_NTYPE_INVALID_CERT_ENCODING 19 348 #define ISAKMP_NTYPE_INVALID_CERTIFICATE 20 349 #define ISAKMP_NTYPE_BAD_CERT_REQUEST_SYNTAX 21 350 #define ISAKMP_NTYPE_INVALID_CERT_AUTHORITY 22 351 #define ISAKMP_NTYPE_INVALID_HASH_INFORMATION 23 352 #define ISAKMP_NTYPE_AUTHENTICATION_FAILED 24 353 #define ISAKMP_NTYPE_INVALID_SIGNATURE 25 354 #define ISAKMP_NTYPE_ADDRESS_NOTIFICATION 26 355 /* NOTIFY MESSAGES - STATUS TYPES */ 356 #define ISAKMP_NTYPE_CONNECTED 16384 357 /* using only to log */ 358 #define ISAKMP_LOG_RETRY_LIMIT_REACHED 65530 359 360 /* 3.15 Delete Payload */ 361 struct ikev1_pl_d { 362 struct isakmp_gen h; 363 u_int32_t doi; /* Domain of Interpretation */ 364 u_int8_t prot_id; /* Protocol-Id */ 365 u_int8_t spi_size; /* SPI Size */ 366 u_int16_t num_spi; /* # of SPIs */ 367 /* SPI(es) */ 368 }; 369 370 371 struct ikev1_ph1tab { 372 struct ikev1_ph1 *head; 373 struct ikev1_ph1 *tail; 374 int len; 375 }; 376 377 struct isakmp_ph2tab { 378 struct ikev1_ph2 *head; 379 struct ikev1_ph2 *tail; 380 int len; 381 }; 382 383 #define EXCHANGE_PROXY 1 384 #define EXCHANGE_MYSELF 0 385 386 #define PFS_NEED 1 387 #define PFS_NONEED 0 388 389 /* IKEv2 (RFC4306) */ 390 391 /* 3.3 Security Association Payload -- generic header */ 392 /* 3.3.1. Proposal Substructure */ 393 struct ikev2_p { 394 struct isakmp_gen h; 395 u_int8_t p_no; /* Proposal # */ 396 u_int8_t prot_id; /* Protocol */ 397 u_int8_t spi_size; /* SPI Size */ 398 u_int8_t num_t; /* Number of Transforms */ 399 }; 400 401 /* 3.3.2. Transform Substructure */ 402 struct ikev2_t { 403 struct isakmp_gen h; 404 u_int8_t t_type; /* Transform Type (ENCR,PRF,INTEG,etc.*/ 405 u_int8_t res2; /* reserved byte */ 406 u_int16_t t_id; /* Transform ID */ 407 }; 408 409 enum ikev2_t_type { 410 IV2_T_ENCR = 1, 411 IV2_T_PRF = 2, 412 IV2_T_INTEG= 3, 413 IV2_T_DH = 4, 414 IV2_T_ESN = 5, 415 }; 416 417 /* 3.4. Key Exchange Payload */ 418 struct ikev2_ke { 419 struct isakmp_gen h; 420 u_int16_t ke_group; 421 u_int16_t ke_res1; 422 /* KE data */ 423 }; 424 425 426 /* 3.5. Identification Payloads */ 427 enum ikev2_id_type { 428 ID_IPV4_ADDR=1, 429 ID_FQDN=2, 430 ID_RFC822_ADDR=3, 431 ID_IPV6_ADDR=5, 432 ID_DER_ASN1_DN=9, 433 ID_DER_ASN1_GN=10, 434 ID_KEY_ID=11, 435 }; 436 struct ikev2_id { 437 struct isakmp_gen h; 438 u_int8_t type; /* ID type */ 439 u_int8_t res1; 440 u_int16_t res2; 441 /* SPI */ 442 /* Notification Data */ 443 }; 444 445 /* 3.10 Notification Payload */ 446 struct ikev2_n { 447 struct isakmp_gen h; 448 u_int8_t prot_id; /* Protocol-ID */ 449 u_int8_t spi_size; /* SPI Size */ 450 u_int16_t type; /* Notify Message Type */ 451 }; 452 453 enum ikev2_n_type { 454 IV2_NOTIFY_UNSUPPORTED_CRITICAL_PAYLOAD = 1, 455 IV2_NOTIFY_INVALID_IKE_SPI = 4, 456 IV2_NOTIFY_INVALID_MAJOR_VERSION = 5, 457 IV2_NOTIFY_INVALID_SYNTAX = 7, 458 IV2_NOTIFY_INVALID_MESSAGE_ID = 9, 459 IV2_NOTIFY_INVALID_SPI =11, 460 IV2_NOTIFY_NO_PROPOSAL_CHOSEN =14, 461 IV2_NOTIFY_INVALID_KE_PAYLOAD =17, 462 IV2_NOTIFY_AUTHENTICATION_FAILED =24, 463 IV2_NOTIFY_SINGLE_PAIR_REQUIRED =34, 464 IV2_NOTIFY_NO_ADDITIONAL_SAS =35, 465 IV2_NOTIFY_INTERNAL_ADDRESS_FAILURE =36, 466 IV2_NOTIFY_FAILED_CP_REQUIRED =37, 467 IV2_NOTIFY_INVALID_SELECTORS =39, 468 IV2_NOTIFY_INITIAL_CONTACT =16384, 469 IV2_NOTIFY_SET_WINDOW_SIZE =16385, 470 IV2_NOTIFY_ADDITIONAL_TS_POSSIBLE =16386, 471 IV2_NOTIFY_IPCOMP_SUPPORTED =16387, 472 IV2_NOTIFY_NAT_DETECTION_SOURCE_IP =16388, 473 IV2_NOTIFY_NAT_DETECTION_DESTINATION_IP =16389, 474 IV2_NOTIFY_COOKIE =16390, 475 IV2_NOTIFY_USE_TRANSPORT_MODE =16391, 476 IV2_NOTIFY_HTTP_CERT_LOOKUP_SUPPORTED =16392, 477 IV2_NOTIFY_REKEY_SA =16393, 478 IV2_NOTIFY_ESP_TFC_PADDING_NOT_SUPPORTED =16394, 479 IV2_NOTIFY_NON_FIRST_FRAGMENTS_ALSO =16395 480 }; 481 482 struct notify_messages { 483 u_int16_t type; 484 char *msg; 485 }; 486 487 /* 3.8 Notification Payload */ 488 struct ikev2_auth { 489 struct isakmp_gen h; 490 u_int8_t auth_method; /* Protocol-ID */ 491 u_int8_t reserved[3]; 492 /* authentication data */ 493 }; 494 495 enum ikev2_auth_type { 496 IV2_RSA_SIG = 1, 497 IV2_SHARED = 2, 498 IV2_DSS_SIG = 3, 499 }; 500 501 #endif /* !defined(_ISAKMP_H_) */ 502