1 | /* |
---|
2 | * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. |
---|
3 | * All rights reserved. |
---|
4 | * |
---|
5 | * Redistribution and use in source and binary forms, with or without |
---|
6 | * modification, are permitted provided that the following conditions |
---|
7 | * are met: |
---|
8 | * 1. Redistributions of source code must retain the above copyright |
---|
9 | * notice, this list of conditions and the following disclaimer. |
---|
10 | * 2. Redistributions in binary form must reproduce the above copyright |
---|
11 | * notice, this list of conditions and the following disclaimer in the |
---|
12 | * documentation and/or other materials provided with the distribution. |
---|
13 | * 3. Neither the name of the project nor the names of its contributors |
---|
14 | * may be used to endorse or promote products derived from this software |
---|
15 | * without specific prior written permission. |
---|
16 | * |
---|
17 | * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND |
---|
18 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
---|
19 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
---|
20 | * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE |
---|
21 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
---|
22 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
---|
23 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
---|
24 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
---|
25 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
---|
26 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
---|
27 | * SUCH DAMAGE. |
---|
28 | */ |
---|
29 | /* YIPS @(#)$Id: isakmp.h,v 1.12 2007-11-24 18:13:33 mcr Exp $ */ |
---|
30 | |
---|
31 | /* refer to RFC 2408 */ |
---|
32 | |
---|
33 | /* must include <netinet/in.h> */ |
---|
34 | |
---|
35 | #if !defined(_ISAKMP_H_) |
---|
36 | #define _ISAKMP_H_ |
---|
37 | |
---|
38 | typedef u_char cookie_t[8]; |
---|
39 | typedef u_char msgid_t[4]; |
---|
40 | |
---|
41 | typedef struct { /* i_cookie + r_cookie */ |
---|
42 | cookie_t i_ck; |
---|
43 | cookie_t r_ck; |
---|
44 | } isakmp_index; |
---|
45 | |
---|
46 | #define INITIATOR 1 |
---|
47 | #define RESPONDER 2 |
---|
48 | |
---|
49 | #define PORT_ISAKMP 500 |
---|
50 | |
---|
51 | #define GENERATE 1 |
---|
52 | #define VALIDATE 0 |
---|
53 | |
---|
54 | /* Phase of oakley definition */ |
---|
55 | /* |
---|
56 | 0000 0000 0000 0000 |
---|
57 | | |||| |||| |
---|
58 | | |||| ++++--> negosiation number in phase |
---|
59 | | ++++-------> phase number |
---|
60 | +---------------> expire ? |
---|
61 | */ |
---|
62 | #define ISAKMP_PH1 0x0010 |
---|
63 | #define ISAKMP_PH2 0x0020 |
---|
64 | #define ISAKMP_EXPIRED 0x0100 |
---|
65 | |
---|
66 | #define ISAKMP_NGP_0 0x0000 |
---|
67 | #define ISAKMP_NGP_1 0x0001 |
---|
68 | #define ISAKMP_NGP_2 0x0002 |
---|
69 | #define ISAKMP_NGP_3 0x0003 |
---|
70 | #define ISAKMP_NGP_4 0x0004 |
---|
71 | |
---|
72 | #define ISAKMP_PH1_N (ISAKMP_PH1 | ISAKMP_NGP_0) /* i.e. spawn */ |
---|
73 | #define ISAKMP_PH1_1 (ISAKMP_PH1 | ISAKMP_NGP_1) |
---|
74 | #define ISAKMP_PH1_2 (ISAKMP_PH1 | ISAKMP_NGP_2) |
---|
75 | #define ISAKMP_PH1_3 (ISAKMP_PH1 | ISAKMP_NGP_3) |
---|
76 | #define ISAKMP_PH2_N (ISAKMP_PH2 | ISAKMP_NGP_0) |
---|
77 | #define ISAKMP_PH2_1 (ISAKMP_PH2 | ISAKMP_NGP_1) |
---|
78 | #define ISAKMP_PH2_2 (ISAKMP_PH2 | ISAKMP_NGP_2) |
---|
79 | #define ISAKMP_PH2_3 (ISAKMP_PH2 | ISAKMP_NGP_3) |
---|
80 | |
---|
81 | #define ISAKMP_TIMER_DEFAULT 10 /* seconds */ |
---|
82 | #define ISAKMP_TRY_DEFAULT 3 /* times */ |
---|
83 | |
---|
84 | /* 3.1 ISAKMP Header Format (IKEv1 and IKEv2) |
---|
85 | 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 |
---|
86 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
---|
87 | ! Initiator ! |
---|
88 | ! Cookie ! |
---|
89 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
---|
90 | ! Responder ! |
---|
91 | ! Cookie ! |
---|
92 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
---|
93 | ! Next Payload ! MjVer ! MnVer ! Exchange Type ! Flags ! |
---|
94 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
---|
95 | ! Message ID ! |
---|
96 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
---|
97 | ! Length ! |
---|
98 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
---|
99 | */ |
---|
100 | struct isakmp { |
---|
101 | cookie_t i_ck; /* Initiator Cookie */ |
---|
102 | cookie_t r_ck; /* Responder Cookie */ |
---|
103 | u_int8_t np; /* Next Payload Type */ |
---|
104 | u_int8_t vers; |
---|
105 | #define ISAKMP_VERS_MAJOR 0xf0 |
---|
106 | #define ISAKMP_VERS_MAJOR_SHIFT 4 |
---|
107 | #define ISAKMP_VERS_MINOR 0x0f |
---|
108 | #define ISAKMP_VERS_MINOR_SHIFT 0 |
---|
109 | u_int8_t etype; /* Exchange Type */ |
---|
110 | u_int8_t flags; /* Flags */ |
---|
111 | msgid_t msgid; |
---|
112 | u_int32_t len; /* Length */ |
---|
113 | }; |
---|
114 | |
---|
115 | /* Next Payload Type */ |
---|
116 | #define ISAKMP_NPTYPE_NONE 0 /* NONE*/ |
---|
117 | #define ISAKMP_NPTYPE_SA 1 /* Security Association */ |
---|
118 | #define ISAKMP_NPTYPE_P 2 /* Proposal */ |
---|
119 | #define ISAKMP_NPTYPE_T 3 /* Transform */ |
---|
120 | #define ISAKMP_NPTYPE_KE 4 /* Key Exchange */ |
---|
121 | #define ISAKMP_NPTYPE_ID 5 /* Identification */ |
---|
122 | #define ISAKMP_NPTYPE_CERT 6 /* Certificate */ |
---|
123 | #define ISAKMP_NPTYPE_CR 7 /* Certificate Request */ |
---|
124 | #define ISAKMP_NPTYPE_HASH 8 /* Hash */ |
---|
125 | #define ISAKMP_NPTYPE_SIG 9 /* Signature */ |
---|
126 | #define ISAKMP_NPTYPE_NONCE 10 /* Nonce */ |
---|
127 | #define ISAKMP_NPTYPE_N 11 /* Notification */ |
---|
128 | #define ISAKMP_NPTYPE_D 12 /* Delete */ |
---|
129 | #define ISAKMP_NPTYPE_VID 13 /* Vendor ID */ |
---|
130 | #define ISAKMP_NPTYPE_v2E 46 /* v2 Encrypted payload */ |
---|
131 | |
---|
132 | #define IKEv1_MAJOR_VERSION 1 |
---|
133 | #define IKEv1_MINOR_VERSION 0 |
---|
134 | |
---|
135 | #define IKEv2_MAJOR_VERSION 2 |
---|
136 | #define IKEv2_MINOR_VERSION 0 |
---|
137 | |
---|
138 | /* Exchange Type */ |
---|
139 | #define ISAKMP_ETYPE_NONE 0 /* NONE */ |
---|
140 | #define ISAKMP_ETYPE_BASE 1 /* Base */ |
---|
141 | #define ISAKMP_ETYPE_IDENT 2 /* Identity Proteciton */ |
---|
142 | #define ISAKMP_ETYPE_AUTH 3 /* Authentication Only */ |
---|
143 | #define ISAKMP_ETYPE_AGG 4 /* Aggressive */ |
---|
144 | #define ISAKMP_ETYPE_INF 5 /* Informational */ |
---|
145 | |
---|
146 | /* Flags */ |
---|
147 | #define ISAKMP_FLAG_E 0x01 /* Encryption Bit */ |
---|
148 | #define ISAKMP_FLAG_C 0x02 /* Commit Bit */ |
---|
149 | #define ISAKMP_FLAG_extra 0x04 |
---|
150 | |
---|
151 | /* IKEv2 */ |
---|
152 | #define ISAKMP_FLAG_I (1 << 3) /* (I)nitiator */ |
---|
153 | #define ISAKMP_FLAG_V (1 << 4) /* (V)ersion */ |
---|
154 | #define ISAKMP_FLAG_R (1 << 5) /* (R)esponse */ |
---|
155 | |
---|
156 | |
---|
157 | /* 3.2 Payload Generic Header |
---|
158 | 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 |
---|
159 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
---|
160 | ! Next Payload ! RESERVED ! Payload Length ! |
---|
161 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
---|
162 | */ |
---|
163 | struct isakmp_gen { |
---|
164 | u_int8_t np; /* Next Payload */ |
---|
165 | u_int8_t critical; /* bit 7 - critical, rest is RESERVED */ |
---|
166 | u_int16_t len; /* Payload Length */ |
---|
167 | }; |
---|
168 | |
---|
169 | /* 3.3 Data Attributes |
---|
170 | 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 |
---|
171 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
---|
172 | !A! Attribute Type ! AF=0 Attribute Length ! |
---|
173 | !F! ! AF=1 Attribute Value ! |
---|
174 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
---|
175 | . AF=0 Attribute Value . |
---|
176 | . AF=1 Not Transmitted . |
---|
177 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
---|
178 | */ |
---|
179 | struct isakmp_data { |
---|
180 | u_int16_t type; /* defined by DOI-spec, and Attribute Format */ |
---|
181 | u_int16_t lorv; /* if f equal 1, Attribute Length */ |
---|
182 | /* if f equal 0, Attribute Value */ |
---|
183 | /* if f equal 1, Attribute Value */ |
---|
184 | }; |
---|
185 | #define ISAKMP_GEN_TLV 0x0000 |
---|
186 | #define ISAKMP_GEN_TV 0x8000 |
---|
187 | /* mask for type of attribute format */ |
---|
188 | #define ISAKMP_GEN_MASK 0x8000 |
---|
189 | |
---|
190 | /* 3.4 Security Association Payload */ |
---|
191 | /* MAY NOT be used, because of being defined in ipsec-doi. */ |
---|
192 | /* |
---|
193 | If the current payload is the last in the message, |
---|
194 | then the value of the next payload field will be 0. |
---|
195 | This field MUST NOT contain the |
---|
196 | values for the Proposal or Transform payloads as they are considered |
---|
197 | part of the security association negotiation. For example, this |
---|
198 | field would contain the value "10" (Nonce payload) in the first |
---|
199 | message of a Base Exchange (see Section 4.4) and the value "0" in the |
---|
200 | first message of an Identity Protect Exchange (see Section 4.5). |
---|
201 | */ |
---|
202 | struct ikev1_pl_sa { |
---|
203 | struct isakmp_gen h; |
---|
204 | u_int32_t doi; /* Domain of Interpretation */ |
---|
205 | u_int32_t sit; /* Situation */ |
---|
206 | }; |
---|
207 | |
---|
208 | /* 3.5 Proposal Payload */ |
---|
209 | /* |
---|
210 | The value of the next payload field MUST only contain the value "2" |
---|
211 | or "0". If there are additional Proposal payloads in the message, |
---|
212 | then this field will be 2. If the current Proposal payload is the |
---|
213 | last within the security association proposal, then this field will |
---|
214 | be 0. |
---|
215 | */ |
---|
216 | struct ikev1_pl_p { |
---|
217 | struct isakmp_gen h; |
---|
218 | u_int8_t p_no; /* Proposal # */ |
---|
219 | u_int8_t prot_id; /* Protocol */ |
---|
220 | u_int8_t spi_size; /* SPI Size */ |
---|
221 | u_int8_t num_t; /* Number of Transforms */ |
---|
222 | /* SPI */ |
---|
223 | }; |
---|
224 | |
---|
225 | /* 3.6 Transform Payload */ |
---|
226 | /* |
---|
227 | The value of the next payload field MUST only contain the value "3" |
---|
228 | or "0". If there are additional Transform payloads in the proposal, |
---|
229 | then this field will be 3. If the current Transform payload is the |
---|
230 | last within the proposal, then this field will be 0. |
---|
231 | */ |
---|
232 | struct ikev1_pl_t { |
---|
233 | struct isakmp_gen h; |
---|
234 | u_int8_t t_no; /* Transform # */ |
---|
235 | u_int8_t t_id; /* Transform-Id */ |
---|
236 | u_int16_t reserved; /* RESERVED2 */ |
---|
237 | /* SA Attributes */ |
---|
238 | }; |
---|
239 | |
---|
240 | /* 3.7 Key Exchange Payload */ |
---|
241 | struct ikev1_pl_ke { |
---|
242 | struct isakmp_gen h; |
---|
243 | /* Key Exchange Data */ |
---|
244 | }; |
---|
245 | |
---|
246 | /* 3.8 Identification Payload */ |
---|
247 | /* MUST NOT to be used, because of being defined in ipsec-doi. */ |
---|
248 | struct ikev1_pl_id { |
---|
249 | struct isakmp_gen h; |
---|
250 | union { |
---|
251 | u_int8_t id_type; /* ID Type */ |
---|
252 | u_int32_t doi_data; /* DOI Specific ID Data */ |
---|
253 | } d; |
---|
254 | /* Identification Data */ |
---|
255 | }; |
---|
256 | |
---|
257 | /* 3.9 Certificate Payload */ |
---|
258 | struct ikev1_pl_cert { |
---|
259 | struct isakmp_gen h; |
---|
260 | u_int8_t encode; /* Cert Encoding */ |
---|
261 | char cert; /* Certificate Data */ |
---|
262 | /* |
---|
263 | This field indicates the type of |
---|
264 | certificate or certificate-related information contained in the |
---|
265 | Certificate Data field. |
---|
266 | */ |
---|
267 | }; |
---|
268 | |
---|
269 | /* Certificate Type */ |
---|
270 | #define ISAKMP_CERT_NONE 0 |
---|
271 | #define ISAKMP_CERT_PKCS 1 |
---|
272 | #define ISAKMP_CERT_PGP 2 |
---|
273 | #define ISAKMP_CERT_DNS 3 |
---|
274 | #define ISAKMP_CERT_SIGN 4 |
---|
275 | #define ISAKMP_CERT_KE 5 |
---|
276 | #define ISAKMP_CERT_KT 6 |
---|
277 | #define ISAKMP_CERT_CRL 7 |
---|
278 | #define ISAKMP_CERT_ARL 8 |
---|
279 | #define ISAKMP_CERT_SPKI 9 |
---|
280 | |
---|
281 | /* 3.10 Certificate Request Payload */ |
---|
282 | struct ikev1_pl_cr { |
---|
283 | struct isakmp_gen h; |
---|
284 | u_int8_t num_cert; /* # Cert. Types */ |
---|
285 | /* |
---|
286 | Certificate Types (variable length) |
---|
287 | -- Contains a list of the types of certificates requested, |
---|
288 | sorted in order of preference. Each individual certificate |
---|
289 | type is 1 octet. This field is NOT requiredo |
---|
290 | */ |
---|
291 | /* # Certificate Authorities (1 octet) */ |
---|
292 | /* Certificate Authorities (variable length) */ |
---|
293 | }; |
---|
294 | |
---|
295 | /* 3.11 Hash Payload */ |
---|
296 | /* may not be used, because of having only data. */ |
---|
297 | struct ikev1_pl_hash { |
---|
298 | struct isakmp_gen h; |
---|
299 | /* Hash Data */ |
---|
300 | }; |
---|
301 | |
---|
302 | /* 3.12 Signature Payload */ |
---|
303 | /* may not be used, because of having only data. */ |
---|
304 | struct ikev1_pl_sig { |
---|
305 | struct isakmp_gen h; |
---|
306 | /* Signature Data */ |
---|
307 | }; |
---|
308 | |
---|
309 | /* 3.13 Nonce Payload */ |
---|
310 | /* may not be used, because of having only data. */ |
---|
311 | struct ikev1_pl_nonce { |
---|
312 | struct isakmp_gen h; |
---|
313 | /* Nonce Data */ |
---|
314 | }; |
---|
315 | |
---|
316 | /* 3.14 Notification Payload */ |
---|
317 | struct ikev1_pl_n { |
---|
318 | struct isakmp_gen h; |
---|
319 | u_int32_t doi; /* Domain of Interpretation */ |
---|
320 | u_int8_t prot_id; /* Protocol-ID */ |
---|
321 | u_int8_t spi_size; /* SPI Size */ |
---|
322 | u_int16_t type; /* Notify Message Type */ |
---|
323 | /* SPI */ |
---|
324 | /* Notification Data */ |
---|
325 | }; |
---|
326 | |
---|
327 | /* 3.14.1 Notify Message Types */ |
---|
328 | /* NOTIFY MESSAGES - ERROR TYPES */ |
---|
329 | #define ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE 1 |
---|
330 | #define ISAKMP_NTYPE_DOI_NOT_SUPPORTED 2 |
---|
331 | #define ISAKMP_NTYPE_SITUATION_NOT_SUPPORTED 3 |
---|
332 | #define ISAKMP_NTYPE_INVALID_COOKIE 4 |
---|
333 | #define ISAKMP_NTYPE_INVALID_MAJOR_VERSION 5 |
---|
334 | #define ISAKMP_NTYPE_INVALID_MINOR_VERSION 6 |
---|
335 | #define ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE 7 |
---|
336 | #define ISAKMP_NTYPE_INVALID_FLAGS 8 |
---|
337 | #define ISAKMP_NTYPE_INVALID_MESSAGE_ID 9 |
---|
338 | #define ISAKMP_NTYPE_INVALID_PROTOCOL_ID 10 |
---|
339 | #define ISAKMP_NTYPE_INVALID_SPI 11 |
---|
340 | #define ISAKMP_NTYPE_INVALID_TRANSFORM_ID 12 |
---|
341 | #define ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED 13 |
---|
342 | #define ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN 14 |
---|
343 | #define ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX 15 |
---|
344 | #define ISAKMP_NTYPE_PAYLOAD_MALFORMED 16 |
---|
345 | #define ISAKMP_NTYPE_INVALID_KEY_INFORMATION 17 |
---|
346 | #define ISAKMP_NTYPE_INVALID_ID_INFORMATION 18 |
---|
347 | #define ISAKMP_NTYPE_INVALID_CERT_ENCODING 19 |
---|
348 | #define ISAKMP_NTYPE_INVALID_CERTIFICATE 20 |
---|
349 | #define ISAKMP_NTYPE_BAD_CERT_REQUEST_SYNTAX 21 |
---|
350 | #define ISAKMP_NTYPE_INVALID_CERT_AUTHORITY 22 |
---|
351 | #define ISAKMP_NTYPE_INVALID_HASH_INFORMATION 23 |
---|
352 | #define ISAKMP_NTYPE_AUTHENTICATION_FAILED 24 |
---|
353 | #define ISAKMP_NTYPE_INVALID_SIGNATURE 25 |
---|
354 | #define ISAKMP_NTYPE_ADDRESS_NOTIFICATION 26 |
---|
355 | /* NOTIFY MESSAGES - STATUS TYPES */ |
---|
356 | #define ISAKMP_NTYPE_CONNECTED 16384 |
---|
357 | /* using only to log */ |
---|
358 | #define ISAKMP_LOG_RETRY_LIMIT_REACHED 65530 |
---|
359 | |
---|
360 | /* 3.15 Delete Payload */ |
---|
361 | struct ikev1_pl_d { |
---|
362 | struct isakmp_gen h; |
---|
363 | u_int32_t doi; /* Domain of Interpretation */ |
---|
364 | u_int8_t prot_id; /* Protocol-Id */ |
---|
365 | u_int8_t spi_size; /* SPI Size */ |
---|
366 | u_int16_t num_spi; /* # of SPIs */ |
---|
367 | /* SPI(es) */ |
---|
368 | }; |
---|
369 | |
---|
370 | |
---|
371 | struct ikev1_ph1tab { |
---|
372 | struct ikev1_ph1 *head; |
---|
373 | struct ikev1_ph1 *tail; |
---|
374 | int len; |
---|
375 | }; |
---|
376 | |
---|
377 | struct isakmp_ph2tab { |
---|
378 | struct ikev1_ph2 *head; |
---|
379 | struct ikev1_ph2 *tail; |
---|
380 | int len; |
---|
381 | }; |
---|
382 | |
---|
383 | #define EXCHANGE_PROXY 1 |
---|
384 | #define EXCHANGE_MYSELF 0 |
---|
385 | |
---|
386 | #define PFS_NEED 1 |
---|
387 | #define PFS_NONEED 0 |
---|
388 | |
---|
389 | /* IKEv2 (RFC4306) */ |
---|
390 | |
---|
391 | /* 3.3 Security Association Payload -- generic header */ |
---|
392 | /* 3.3.1. Proposal Substructure */ |
---|
393 | struct ikev2_p { |
---|
394 | struct isakmp_gen h; |
---|
395 | u_int8_t p_no; /* Proposal # */ |
---|
396 | u_int8_t prot_id; /* Protocol */ |
---|
397 | u_int8_t spi_size; /* SPI Size */ |
---|
398 | u_int8_t num_t; /* Number of Transforms */ |
---|
399 | }; |
---|
400 | |
---|
401 | /* 3.3.2. Transform Substructure */ |
---|
402 | struct ikev2_t { |
---|
403 | struct isakmp_gen h; |
---|
404 | u_int8_t t_type; /* Transform Type (ENCR,PRF,INTEG,etc.*/ |
---|
405 | u_int8_t res2; /* reserved byte */ |
---|
406 | u_int16_t t_id; /* Transform ID */ |
---|
407 | }; |
---|
408 | |
---|
409 | enum ikev2_t_type { |
---|
410 | IV2_T_ENCR = 1, |
---|
411 | IV2_T_PRF = 2, |
---|
412 | IV2_T_INTEG= 3, |
---|
413 | IV2_T_DH = 4, |
---|
414 | IV2_T_ESN = 5, |
---|
415 | }; |
---|
416 | |
---|
417 | /* 3.4. Key Exchange Payload */ |
---|
418 | struct ikev2_ke { |
---|
419 | struct isakmp_gen h; |
---|
420 | u_int16_t ke_group; |
---|
421 | u_int16_t ke_res1; |
---|
422 | /* KE data */ |
---|
423 | }; |
---|
424 | |
---|
425 | |
---|
426 | /* 3.5. Identification Payloads */ |
---|
427 | enum ikev2_id_type { |
---|
428 | ID_IPV4_ADDR=1, |
---|
429 | ID_FQDN=2, |
---|
430 | ID_RFC822_ADDR=3, |
---|
431 | ID_IPV6_ADDR=5, |
---|
432 | ID_DER_ASN1_DN=9, |
---|
433 | ID_DER_ASN1_GN=10, |
---|
434 | ID_KEY_ID=11, |
---|
435 | }; |
---|
436 | struct ikev2_id { |
---|
437 | struct isakmp_gen h; |
---|
438 | u_int8_t type; /* ID type */ |
---|
439 | u_int8_t res1; |
---|
440 | u_int16_t res2; |
---|
441 | /* SPI */ |
---|
442 | /* Notification Data */ |
---|
443 | }; |
---|
444 | |
---|
445 | /* 3.10 Notification Payload */ |
---|
446 | struct ikev2_n { |
---|
447 | struct isakmp_gen h; |
---|
448 | u_int8_t prot_id; /* Protocol-ID */ |
---|
449 | u_int8_t spi_size; /* SPI Size */ |
---|
450 | u_int16_t type; /* Notify Message Type */ |
---|
451 | }; |
---|
452 | |
---|
453 | enum ikev2_n_type { |
---|
454 | IV2_NOTIFY_UNSUPPORTED_CRITICAL_PAYLOAD = 1, |
---|
455 | IV2_NOTIFY_INVALID_IKE_SPI = 4, |
---|
456 | IV2_NOTIFY_INVALID_MAJOR_VERSION = 5, |
---|
457 | IV2_NOTIFY_INVALID_SYNTAX = 7, |
---|
458 | IV2_NOTIFY_INVALID_MESSAGE_ID = 9, |
---|
459 | IV2_NOTIFY_INVALID_SPI =11, |
---|
460 | IV2_NOTIFY_NO_PROPOSAL_CHOSEN =14, |
---|
461 | IV2_NOTIFY_INVALID_KE_PAYLOAD =17, |
---|
462 | IV2_NOTIFY_AUTHENTICATION_FAILED =24, |
---|
463 | IV2_NOTIFY_SINGLE_PAIR_REQUIRED =34, |
---|
464 | IV2_NOTIFY_NO_ADDITIONAL_SAS =35, |
---|
465 | IV2_NOTIFY_INTERNAL_ADDRESS_FAILURE =36, |
---|
466 | IV2_NOTIFY_FAILED_CP_REQUIRED =37, |
---|
467 | IV2_NOTIFY_INVALID_SELECTORS =39, |
---|
468 | IV2_NOTIFY_INITIAL_CONTACT =16384, |
---|
469 | IV2_NOTIFY_SET_WINDOW_SIZE =16385, |
---|
470 | IV2_NOTIFY_ADDITIONAL_TS_POSSIBLE =16386, |
---|
471 | IV2_NOTIFY_IPCOMP_SUPPORTED =16387, |
---|
472 | IV2_NOTIFY_NAT_DETECTION_SOURCE_IP =16388, |
---|
473 | IV2_NOTIFY_NAT_DETECTION_DESTINATION_IP =16389, |
---|
474 | IV2_NOTIFY_COOKIE =16390, |
---|
475 | IV2_NOTIFY_USE_TRANSPORT_MODE =16391, |
---|
476 | IV2_NOTIFY_HTTP_CERT_LOOKUP_SUPPORTED =16392, |
---|
477 | IV2_NOTIFY_REKEY_SA =16393, |
---|
478 | IV2_NOTIFY_ESP_TFC_PADDING_NOT_SUPPORTED =16394, |
---|
479 | IV2_NOTIFY_NON_FIRST_FRAGMENTS_ALSO =16395 |
---|
480 | }; |
---|
481 | |
---|
482 | struct notify_messages { |
---|
483 | u_int16_t type; |
---|
484 | char *msg; |
---|
485 | }; |
---|
486 | |
---|
487 | /* 3.8 Notification Payload */ |
---|
488 | struct ikev2_auth { |
---|
489 | struct isakmp_gen h; |
---|
490 | u_int8_t auth_method; /* Protocol-ID */ |
---|
491 | u_int8_t reserved[3]; |
---|
492 | /* authentication data */ |
---|
493 | }; |
---|
494 | |
---|
495 | enum ikev2_auth_type { |
---|
496 | IV2_RSA_SIG = 1, |
---|
497 | IV2_SHARED = 2, |
---|
498 | IV2_DSS_SIG = 3, |
---|
499 | }; |
---|
500 | |
---|
501 | #endif /* !defined(_ISAKMP_H_) */ |
---|