The Android Open Source Project | 2949f58 | 2009-03-03 19:30:46 -0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. |
| 3 | * All rights reserved. |
| 4 | * |
| 5 | * Redistribution and use in source and binary forms, with or without |
| 6 | * modification, are permitted provided that the following conditions |
| 7 | * are met: |
| 8 | * 1. Redistributions of source code must retain the above copyright |
| 9 | * notice, this list of conditions and the following disclaimer. |
| 10 | * 2. Redistributions in binary form must reproduce the above copyright |
| 11 | * notice, this list of conditions and the following disclaimer in the |
| 12 | * documentation and/or other materials provided with the distribution. |
| 13 | * 3. Neither the name of the project nor the names of its contributors |
| 14 | * may be used to endorse or promote products derived from this software |
| 15 | * without specific prior written permission. |
| 16 | * |
| 17 | * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND |
| 18 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| 19 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
| 20 | * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE |
| 21 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
| 22 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
| 23 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
| 24 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
| 25 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
| 26 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
| 27 | * SUCH DAMAGE. |
| 28 | */ |
JP Abgrall | 53f17a9 | 2014-02-12 14:02:41 -0800 | [diff] [blame] | 29 | /* YIPS @(#)$Id: isakmp.h,v 1.12 2007-11-24 18:13:33 mcr Exp $ */ |
The Android Open Source Project | 2949f58 | 2009-03-03 19:30:46 -0800 | [diff] [blame] | 30 | |
| 31 | /* refer to RFC 2408 */ |
| 32 | |
| 33 | /* must include <netinet/in.h> */ |
| 34 | |
| 35 | #if !defined(_ISAKMP_H_) |
| 36 | #define _ISAKMP_H_ |
| 37 | |
| 38 | typedef u_char cookie_t[8]; |
| 39 | typedef u_char msgid_t[4]; |
| 40 | |
| 41 | typedef struct { /* i_cookie + r_cookie */ |
| 42 | cookie_t i_ck; |
| 43 | cookie_t r_ck; |
| 44 | } isakmp_index; |
| 45 | |
| 46 | #define INITIATOR 1 |
| 47 | #define RESPONDER 2 |
| 48 | |
| 49 | #define PORT_ISAKMP 500 |
| 50 | |
| 51 | #define GENERATE 1 |
| 52 | #define VALIDATE 0 |
| 53 | |
| 54 | /* Phase of oakley definition */ |
| 55 | /* |
| 56 | 0000 0000 0000 0000 |
| 57 | | |||| |||| |
| 58 | | |||| ++++--> negosiation number in phase |
| 59 | | ++++-------> phase number |
| 60 | +---------------> expire ? |
| 61 | */ |
| 62 | #define ISAKMP_PH1 0x0010 |
| 63 | #define ISAKMP_PH2 0x0020 |
| 64 | #define ISAKMP_EXPIRED 0x0100 |
| 65 | |
| 66 | #define ISAKMP_NGP_0 0x0000 |
| 67 | #define ISAKMP_NGP_1 0x0001 |
| 68 | #define ISAKMP_NGP_2 0x0002 |
| 69 | #define ISAKMP_NGP_3 0x0003 |
| 70 | #define ISAKMP_NGP_4 0x0004 |
| 71 | |
| 72 | #define ISAKMP_PH1_N (ISAKMP_PH1 | ISAKMP_NGP_0) /* i.e. spawn */ |
| 73 | #define ISAKMP_PH1_1 (ISAKMP_PH1 | ISAKMP_NGP_1) |
| 74 | #define ISAKMP_PH1_2 (ISAKMP_PH1 | ISAKMP_NGP_2) |
| 75 | #define ISAKMP_PH1_3 (ISAKMP_PH1 | ISAKMP_NGP_3) |
| 76 | #define ISAKMP_PH2_N (ISAKMP_PH2 | ISAKMP_NGP_0) |
| 77 | #define ISAKMP_PH2_1 (ISAKMP_PH2 | ISAKMP_NGP_1) |
| 78 | #define ISAKMP_PH2_2 (ISAKMP_PH2 | ISAKMP_NGP_2) |
| 79 | #define ISAKMP_PH2_3 (ISAKMP_PH2 | ISAKMP_NGP_3) |
| 80 | |
| 81 | #define ISAKMP_TIMER_DEFAULT 10 /* seconds */ |
| 82 | #define ISAKMP_TRY_DEFAULT 3 /* times */ |
| 83 | |
JP Abgrall | 53f17a9 | 2014-02-12 14:02:41 -0800 | [diff] [blame] | 84 | /* 3.1 ISAKMP Header Format (IKEv1 and IKEv2) |
The Android Open Source Project | 2949f58 | 2009-03-03 19:30:46 -0800 | [diff] [blame] | 85 | 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 |
| 86 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| 87 | ! Initiator ! |
| 88 | ! Cookie ! |
| 89 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| 90 | ! Responder ! |
| 91 | ! Cookie ! |
| 92 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| 93 | ! Next Payload ! MjVer ! MnVer ! Exchange Type ! Flags ! |
| 94 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| 95 | ! Message ID ! |
| 96 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| 97 | ! Length ! |
| 98 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| 99 | */ |
| 100 | struct isakmp { |
| 101 | cookie_t i_ck; /* Initiator Cookie */ |
| 102 | cookie_t r_ck; /* Responder Cookie */ |
| 103 | u_int8_t np; /* Next Payload Type */ |
| 104 | u_int8_t vers; |
| 105 | #define ISAKMP_VERS_MAJOR 0xf0 |
| 106 | #define ISAKMP_VERS_MAJOR_SHIFT 4 |
| 107 | #define ISAKMP_VERS_MINOR 0x0f |
| 108 | #define ISAKMP_VERS_MINOR_SHIFT 0 |
| 109 | u_int8_t etype; /* Exchange Type */ |
| 110 | u_int8_t flags; /* Flags */ |
| 111 | msgid_t msgid; |
| 112 | u_int32_t len; /* Length */ |
| 113 | }; |
| 114 | |
| 115 | /* Next Payload Type */ |
| 116 | #define ISAKMP_NPTYPE_NONE 0 /* NONE*/ |
| 117 | #define ISAKMP_NPTYPE_SA 1 /* Security Association */ |
| 118 | #define ISAKMP_NPTYPE_P 2 /* Proposal */ |
| 119 | #define ISAKMP_NPTYPE_T 3 /* Transform */ |
| 120 | #define ISAKMP_NPTYPE_KE 4 /* Key Exchange */ |
| 121 | #define ISAKMP_NPTYPE_ID 5 /* Identification */ |
| 122 | #define ISAKMP_NPTYPE_CERT 6 /* Certificate */ |
| 123 | #define ISAKMP_NPTYPE_CR 7 /* Certificate Request */ |
| 124 | #define ISAKMP_NPTYPE_HASH 8 /* Hash */ |
| 125 | #define ISAKMP_NPTYPE_SIG 9 /* Signature */ |
| 126 | #define ISAKMP_NPTYPE_NONCE 10 /* Nonce */ |
| 127 | #define ISAKMP_NPTYPE_N 11 /* Notification */ |
| 128 | #define ISAKMP_NPTYPE_D 12 /* Delete */ |
| 129 | #define ISAKMP_NPTYPE_VID 13 /* Vendor ID */ |
JP Abgrall | 53f17a9 | 2014-02-12 14:02:41 -0800 | [diff] [blame] | 130 | #define ISAKMP_NPTYPE_v2E 46 /* v2 Encrypted payload */ |
The Android Open Source Project | 2949f58 | 2009-03-03 19:30:46 -0800 | [diff] [blame] | 131 | |
JP Abgrall | 53f17a9 | 2014-02-12 14:02:41 -0800 | [diff] [blame] | 132 | #define IKEv1_MAJOR_VERSION 1 |
| 133 | #define IKEv1_MINOR_VERSION 0 |
| 134 | |
| 135 | #define IKEv2_MAJOR_VERSION 2 |
| 136 | #define IKEv2_MINOR_VERSION 0 |
The Android Open Source Project | 2949f58 | 2009-03-03 19:30:46 -0800 | [diff] [blame] | 137 | |
| 138 | /* Exchange Type */ |
| 139 | #define ISAKMP_ETYPE_NONE 0 /* NONE */ |
| 140 | #define ISAKMP_ETYPE_BASE 1 /* Base */ |
| 141 | #define ISAKMP_ETYPE_IDENT 2 /* Identity Proteciton */ |
| 142 | #define ISAKMP_ETYPE_AUTH 3 /* Authentication Only */ |
| 143 | #define ISAKMP_ETYPE_AGG 4 /* Aggressive */ |
| 144 | #define ISAKMP_ETYPE_INF 5 /* Informational */ |
| 145 | |
| 146 | /* Flags */ |
| 147 | #define ISAKMP_FLAG_E 0x01 /* Encryption Bit */ |
| 148 | #define ISAKMP_FLAG_C 0x02 /* Commit Bit */ |
JP Abgrall | 53f17a9 | 2014-02-12 14:02:41 -0800 | [diff] [blame] | 149 | #define ISAKMP_FLAG_extra 0x04 |
| 150 | |
| 151 | /* IKEv2 */ |
| 152 | #define ISAKMP_FLAG_I (1 << 3) /* (I)nitiator */ |
| 153 | #define ISAKMP_FLAG_V (1 << 4) /* (V)ersion */ |
| 154 | #define ISAKMP_FLAG_R (1 << 5) /* (R)esponse */ |
| 155 | |
The Android Open Source Project | 2949f58 | 2009-03-03 19:30:46 -0800 | [diff] [blame] | 156 | |
| 157 | /* 3.2 Payload Generic Header |
| 158 | 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 |
| 159 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| 160 | ! Next Payload ! RESERVED ! Payload Length ! |
| 161 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| 162 | */ |
| 163 | struct isakmp_gen { |
| 164 | u_int8_t np; /* Next Payload */ |
JP Abgrall | 53f17a9 | 2014-02-12 14:02:41 -0800 | [diff] [blame] | 165 | u_int8_t critical; /* bit 7 - critical, rest is RESERVED */ |
The Android Open Source Project | 2949f58 | 2009-03-03 19:30:46 -0800 | [diff] [blame] | 166 | u_int16_t len; /* Payload Length */ |
| 167 | }; |
| 168 | |
| 169 | /* 3.3 Data Attributes |
| 170 | 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 |
| 171 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| 172 | !A! Attribute Type ! AF=0 Attribute Length ! |
| 173 | !F! ! AF=1 Attribute Value ! |
| 174 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| 175 | . AF=0 Attribute Value . |
| 176 | . AF=1 Not Transmitted . |
| 177 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| 178 | */ |
| 179 | struct isakmp_data { |
| 180 | u_int16_t type; /* defined by DOI-spec, and Attribute Format */ |
| 181 | u_int16_t lorv; /* if f equal 1, Attribute Length */ |
| 182 | /* if f equal 0, Attribute Value */ |
| 183 | /* if f equal 1, Attribute Value */ |
| 184 | }; |
| 185 | #define ISAKMP_GEN_TLV 0x0000 |
| 186 | #define ISAKMP_GEN_TV 0x8000 |
| 187 | /* mask for type of attribute format */ |
| 188 | #define ISAKMP_GEN_MASK 0x8000 |
| 189 | |
| 190 | /* 3.4 Security Association Payload */ |
| 191 | /* MAY NOT be used, because of being defined in ipsec-doi. */ |
| 192 | /* |
| 193 | If the current payload is the last in the message, |
| 194 | then the value of the next payload field will be 0. |
| 195 | This field MUST NOT contain the |
| 196 | values for the Proposal or Transform payloads as they are considered |
| 197 | part of the security association negotiation. For example, this |
| 198 | field would contain the value "10" (Nonce payload) in the first |
| 199 | message of a Base Exchange (see Section 4.4) and the value "0" in the |
| 200 | first message of an Identity Protect Exchange (see Section 4.5). |
| 201 | */ |
JP Abgrall | 53f17a9 | 2014-02-12 14:02:41 -0800 | [diff] [blame] | 202 | struct ikev1_pl_sa { |
The Android Open Source Project | 2949f58 | 2009-03-03 19:30:46 -0800 | [diff] [blame] | 203 | struct isakmp_gen h; |
| 204 | u_int32_t doi; /* Domain of Interpretation */ |
| 205 | u_int32_t sit; /* Situation */ |
| 206 | }; |
| 207 | |
| 208 | /* 3.5 Proposal Payload */ |
| 209 | /* |
| 210 | The value of the next payload field MUST only contain the value "2" |
| 211 | or "0". If there are additional Proposal payloads in the message, |
| 212 | then this field will be 2. If the current Proposal payload is the |
| 213 | last within the security association proposal, then this field will |
| 214 | be 0. |
| 215 | */ |
JP Abgrall | 53f17a9 | 2014-02-12 14:02:41 -0800 | [diff] [blame] | 216 | struct ikev1_pl_p { |
The Android Open Source Project | 2949f58 | 2009-03-03 19:30:46 -0800 | [diff] [blame] | 217 | struct isakmp_gen h; |
| 218 | u_int8_t p_no; /* Proposal # */ |
| 219 | u_int8_t prot_id; /* Protocol */ |
| 220 | u_int8_t spi_size; /* SPI Size */ |
| 221 | u_int8_t num_t; /* Number of Transforms */ |
| 222 | /* SPI */ |
| 223 | }; |
| 224 | |
| 225 | /* 3.6 Transform Payload */ |
| 226 | /* |
| 227 | The value of the next payload field MUST only contain the value "3" |
| 228 | or "0". If there are additional Transform payloads in the proposal, |
| 229 | then this field will be 3. If the current Transform payload is the |
| 230 | last within the proposal, then this field will be 0. |
| 231 | */ |
JP Abgrall | 53f17a9 | 2014-02-12 14:02:41 -0800 | [diff] [blame] | 232 | struct ikev1_pl_t { |
The Android Open Source Project | 2949f58 | 2009-03-03 19:30:46 -0800 | [diff] [blame] | 233 | struct isakmp_gen h; |
| 234 | u_int8_t t_no; /* Transform # */ |
| 235 | u_int8_t t_id; /* Transform-Id */ |
| 236 | u_int16_t reserved; /* RESERVED2 */ |
| 237 | /* SA Attributes */ |
| 238 | }; |
| 239 | |
| 240 | /* 3.7 Key Exchange Payload */ |
JP Abgrall | 53f17a9 | 2014-02-12 14:02:41 -0800 | [diff] [blame] | 241 | struct ikev1_pl_ke { |
The Android Open Source Project | 2949f58 | 2009-03-03 19:30:46 -0800 | [diff] [blame] | 242 | struct isakmp_gen h; |
| 243 | /* Key Exchange Data */ |
| 244 | }; |
| 245 | |
| 246 | /* 3.8 Identification Payload */ |
| 247 | /* MUST NOT to be used, because of being defined in ipsec-doi. */ |
JP Abgrall | 53f17a9 | 2014-02-12 14:02:41 -0800 | [diff] [blame] | 248 | struct ikev1_pl_id { |
The Android Open Source Project | 2949f58 | 2009-03-03 19:30:46 -0800 | [diff] [blame] | 249 | struct isakmp_gen h; |
| 250 | union { |
| 251 | u_int8_t id_type; /* ID Type */ |
| 252 | u_int32_t doi_data; /* DOI Specific ID Data */ |
| 253 | } d; |
| 254 | /* Identification Data */ |
| 255 | }; |
| 256 | |
| 257 | /* 3.9 Certificate Payload */ |
JP Abgrall | 53f17a9 | 2014-02-12 14:02:41 -0800 | [diff] [blame] | 258 | struct ikev1_pl_cert { |
The Android Open Source Project | 2949f58 | 2009-03-03 19:30:46 -0800 | [diff] [blame] | 259 | struct isakmp_gen h; |
| 260 | u_int8_t encode; /* Cert Encoding */ |
| 261 | char cert; /* Certificate Data */ |
| 262 | /* |
| 263 | This field indicates the type of |
| 264 | certificate or certificate-related information contained in the |
| 265 | Certificate Data field. |
| 266 | */ |
| 267 | }; |
| 268 | |
| 269 | /* Certificate Type */ |
| 270 | #define ISAKMP_CERT_NONE 0 |
| 271 | #define ISAKMP_CERT_PKCS 1 |
| 272 | #define ISAKMP_CERT_PGP 2 |
| 273 | #define ISAKMP_CERT_DNS 3 |
| 274 | #define ISAKMP_CERT_SIGN 4 |
| 275 | #define ISAKMP_CERT_KE 5 |
| 276 | #define ISAKMP_CERT_KT 6 |
| 277 | #define ISAKMP_CERT_CRL 7 |
| 278 | #define ISAKMP_CERT_ARL 8 |
| 279 | #define ISAKMP_CERT_SPKI 9 |
| 280 | |
| 281 | /* 3.10 Certificate Request Payload */ |
JP Abgrall | 53f17a9 | 2014-02-12 14:02:41 -0800 | [diff] [blame] | 282 | struct ikev1_pl_cr { |
The Android Open Source Project | 2949f58 | 2009-03-03 19:30:46 -0800 | [diff] [blame] | 283 | struct isakmp_gen h; |
| 284 | u_int8_t num_cert; /* # Cert. Types */ |
| 285 | /* |
| 286 | Certificate Types (variable length) |
| 287 | -- Contains a list of the types of certificates requested, |
| 288 | sorted in order of preference. Each individual certificate |
| 289 | type is 1 octet. This field is NOT requiredo |
| 290 | */ |
| 291 | /* # Certificate Authorities (1 octet) */ |
| 292 | /* Certificate Authorities (variable length) */ |
| 293 | }; |
| 294 | |
| 295 | /* 3.11 Hash Payload */ |
| 296 | /* may not be used, because of having only data. */ |
JP Abgrall | 53f17a9 | 2014-02-12 14:02:41 -0800 | [diff] [blame] | 297 | struct ikev1_pl_hash { |
The Android Open Source Project | 2949f58 | 2009-03-03 19:30:46 -0800 | [diff] [blame] | 298 | struct isakmp_gen h; |
| 299 | /* Hash Data */ |
| 300 | }; |
| 301 | |
| 302 | /* 3.12 Signature Payload */ |
| 303 | /* may not be used, because of having only data. */ |
JP Abgrall | 53f17a9 | 2014-02-12 14:02:41 -0800 | [diff] [blame] | 304 | struct ikev1_pl_sig { |
The Android Open Source Project | 2949f58 | 2009-03-03 19:30:46 -0800 | [diff] [blame] | 305 | struct isakmp_gen h; |
| 306 | /* Signature Data */ |
| 307 | }; |
| 308 | |
| 309 | /* 3.13 Nonce Payload */ |
| 310 | /* may not be used, because of having only data. */ |
JP Abgrall | 53f17a9 | 2014-02-12 14:02:41 -0800 | [diff] [blame] | 311 | struct ikev1_pl_nonce { |
The Android Open Source Project | 2949f58 | 2009-03-03 19:30:46 -0800 | [diff] [blame] | 312 | struct isakmp_gen h; |
| 313 | /* Nonce Data */ |
| 314 | }; |
| 315 | |
| 316 | /* 3.14 Notification Payload */ |
JP Abgrall | 53f17a9 | 2014-02-12 14:02:41 -0800 | [diff] [blame] | 317 | struct ikev1_pl_n { |
The Android Open Source Project | 2949f58 | 2009-03-03 19:30:46 -0800 | [diff] [blame] | 318 | struct isakmp_gen h; |
| 319 | u_int32_t doi; /* Domain of Interpretation */ |
| 320 | u_int8_t prot_id; /* Protocol-ID */ |
| 321 | u_int8_t spi_size; /* SPI Size */ |
| 322 | u_int16_t type; /* Notify Message Type */ |
| 323 | /* SPI */ |
| 324 | /* Notification Data */ |
| 325 | }; |
| 326 | |
| 327 | /* 3.14.1 Notify Message Types */ |
| 328 | /* NOTIFY MESSAGES - ERROR TYPES */ |
| 329 | #define ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE 1 |
| 330 | #define ISAKMP_NTYPE_DOI_NOT_SUPPORTED 2 |
| 331 | #define ISAKMP_NTYPE_SITUATION_NOT_SUPPORTED 3 |
| 332 | #define ISAKMP_NTYPE_INVALID_COOKIE 4 |
| 333 | #define ISAKMP_NTYPE_INVALID_MAJOR_VERSION 5 |
| 334 | #define ISAKMP_NTYPE_INVALID_MINOR_VERSION 6 |
| 335 | #define ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE 7 |
| 336 | #define ISAKMP_NTYPE_INVALID_FLAGS 8 |
| 337 | #define ISAKMP_NTYPE_INVALID_MESSAGE_ID 9 |
| 338 | #define ISAKMP_NTYPE_INVALID_PROTOCOL_ID 10 |
| 339 | #define ISAKMP_NTYPE_INVALID_SPI 11 |
| 340 | #define ISAKMP_NTYPE_INVALID_TRANSFORM_ID 12 |
| 341 | #define ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED 13 |
| 342 | #define ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN 14 |
| 343 | #define ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX 15 |
| 344 | #define ISAKMP_NTYPE_PAYLOAD_MALFORMED 16 |
| 345 | #define ISAKMP_NTYPE_INVALID_KEY_INFORMATION 17 |
| 346 | #define ISAKMP_NTYPE_INVALID_ID_INFORMATION 18 |
| 347 | #define ISAKMP_NTYPE_INVALID_CERT_ENCODING 19 |
| 348 | #define ISAKMP_NTYPE_INVALID_CERTIFICATE 20 |
| 349 | #define ISAKMP_NTYPE_BAD_CERT_REQUEST_SYNTAX 21 |
| 350 | #define ISAKMP_NTYPE_INVALID_CERT_AUTHORITY 22 |
| 351 | #define ISAKMP_NTYPE_INVALID_HASH_INFORMATION 23 |
| 352 | #define ISAKMP_NTYPE_AUTHENTICATION_FAILED 24 |
| 353 | #define ISAKMP_NTYPE_INVALID_SIGNATURE 25 |
| 354 | #define ISAKMP_NTYPE_ADDRESS_NOTIFICATION 26 |
| 355 | /* NOTIFY MESSAGES - STATUS TYPES */ |
| 356 | #define ISAKMP_NTYPE_CONNECTED 16384 |
| 357 | /* using only to log */ |
| 358 | #define ISAKMP_LOG_RETRY_LIMIT_REACHED 65530 |
| 359 | |
| 360 | /* 3.15 Delete Payload */ |
JP Abgrall | 53f17a9 | 2014-02-12 14:02:41 -0800 | [diff] [blame] | 361 | struct ikev1_pl_d { |
The Android Open Source Project | 2949f58 | 2009-03-03 19:30:46 -0800 | [diff] [blame] | 362 | struct isakmp_gen h; |
| 363 | u_int32_t doi; /* Domain of Interpretation */ |
| 364 | u_int8_t prot_id; /* Protocol-Id */ |
| 365 | u_int8_t spi_size; /* SPI Size */ |
| 366 | u_int16_t num_spi; /* # of SPIs */ |
| 367 | /* SPI(es) */ |
| 368 | }; |
| 369 | |
| 370 | |
JP Abgrall | 53f17a9 | 2014-02-12 14:02:41 -0800 | [diff] [blame] | 371 | struct ikev1_ph1tab { |
| 372 | struct ikev1_ph1 *head; |
| 373 | struct ikev1_ph1 *tail; |
The Android Open Source Project | 2949f58 | 2009-03-03 19:30:46 -0800 | [diff] [blame] | 374 | int len; |
| 375 | }; |
| 376 | |
| 377 | struct isakmp_ph2tab { |
JP Abgrall | 53f17a9 | 2014-02-12 14:02:41 -0800 | [diff] [blame] | 378 | struct ikev1_ph2 *head; |
| 379 | struct ikev1_ph2 *tail; |
The Android Open Source Project | 2949f58 | 2009-03-03 19:30:46 -0800 | [diff] [blame] | 380 | int len; |
| 381 | }; |
| 382 | |
| 383 | #define EXCHANGE_PROXY 1 |
| 384 | #define EXCHANGE_MYSELF 0 |
| 385 | |
| 386 | #define PFS_NEED 1 |
| 387 | #define PFS_NONEED 0 |
| 388 | |
JP Abgrall | 53f17a9 | 2014-02-12 14:02:41 -0800 | [diff] [blame] | 389 | /* IKEv2 (RFC4306) */ |
| 390 | |
| 391 | /* 3.3 Security Association Payload -- generic header */ |
| 392 | /* 3.3.1. Proposal Substructure */ |
| 393 | struct ikev2_p { |
| 394 | struct isakmp_gen h; |
| 395 | u_int8_t p_no; /* Proposal # */ |
| 396 | u_int8_t prot_id; /* Protocol */ |
| 397 | u_int8_t spi_size; /* SPI Size */ |
| 398 | u_int8_t num_t; /* Number of Transforms */ |
| 399 | }; |
| 400 | |
| 401 | /* 3.3.2. Transform Substructure */ |
| 402 | struct ikev2_t { |
| 403 | struct isakmp_gen h; |
| 404 | u_int8_t t_type; /* Transform Type (ENCR,PRF,INTEG,etc.*/ |
| 405 | u_int8_t res2; /* reserved byte */ |
| 406 | u_int16_t t_id; /* Transform ID */ |
| 407 | }; |
| 408 | |
| 409 | enum ikev2_t_type { |
| 410 | IV2_T_ENCR = 1, |
| 411 | IV2_T_PRF = 2, |
| 412 | IV2_T_INTEG= 3, |
| 413 | IV2_T_DH = 4, |
| 414 | IV2_T_ESN = 5, |
| 415 | }; |
| 416 | |
| 417 | /* 3.4. Key Exchange Payload */ |
| 418 | struct ikev2_ke { |
| 419 | struct isakmp_gen h; |
| 420 | u_int16_t ke_group; |
| 421 | u_int16_t ke_res1; |
| 422 | /* KE data */ |
| 423 | }; |
| 424 | |
| 425 | |
| 426 | /* 3.5. Identification Payloads */ |
| 427 | enum ikev2_id_type { |
| 428 | ID_IPV4_ADDR=1, |
| 429 | ID_FQDN=2, |
| 430 | ID_RFC822_ADDR=3, |
| 431 | ID_IPV6_ADDR=5, |
| 432 | ID_DER_ASN1_DN=9, |
| 433 | ID_DER_ASN1_GN=10, |
| 434 | ID_KEY_ID=11, |
| 435 | }; |
| 436 | struct ikev2_id { |
| 437 | struct isakmp_gen h; |
| 438 | u_int8_t type; /* ID type */ |
| 439 | u_int8_t res1; |
| 440 | u_int16_t res2; |
| 441 | /* SPI */ |
| 442 | /* Notification Data */ |
| 443 | }; |
| 444 | |
| 445 | /* 3.10 Notification Payload */ |
| 446 | struct ikev2_n { |
| 447 | struct isakmp_gen h; |
| 448 | u_int8_t prot_id; /* Protocol-ID */ |
| 449 | u_int8_t spi_size; /* SPI Size */ |
| 450 | u_int16_t type; /* Notify Message Type */ |
| 451 | }; |
| 452 | |
| 453 | enum ikev2_n_type { |
| 454 | IV2_NOTIFY_UNSUPPORTED_CRITICAL_PAYLOAD = 1, |
| 455 | IV2_NOTIFY_INVALID_IKE_SPI = 4, |
| 456 | IV2_NOTIFY_INVALID_MAJOR_VERSION = 5, |
| 457 | IV2_NOTIFY_INVALID_SYNTAX = 7, |
| 458 | IV2_NOTIFY_INVALID_MESSAGE_ID = 9, |
| 459 | IV2_NOTIFY_INVALID_SPI =11, |
| 460 | IV2_NOTIFY_NO_PROPOSAL_CHOSEN =14, |
| 461 | IV2_NOTIFY_INVALID_KE_PAYLOAD =17, |
| 462 | IV2_NOTIFY_AUTHENTICATION_FAILED =24, |
| 463 | IV2_NOTIFY_SINGLE_PAIR_REQUIRED =34, |
| 464 | IV2_NOTIFY_NO_ADDITIONAL_SAS =35, |
| 465 | IV2_NOTIFY_INTERNAL_ADDRESS_FAILURE =36, |
| 466 | IV2_NOTIFY_FAILED_CP_REQUIRED =37, |
| 467 | IV2_NOTIFY_INVALID_SELECTORS =39, |
| 468 | IV2_NOTIFY_INITIAL_CONTACT =16384, |
| 469 | IV2_NOTIFY_SET_WINDOW_SIZE =16385, |
| 470 | IV2_NOTIFY_ADDITIONAL_TS_POSSIBLE =16386, |
| 471 | IV2_NOTIFY_IPCOMP_SUPPORTED =16387, |
| 472 | IV2_NOTIFY_NAT_DETECTION_SOURCE_IP =16388, |
| 473 | IV2_NOTIFY_NAT_DETECTION_DESTINATION_IP =16389, |
| 474 | IV2_NOTIFY_COOKIE =16390, |
| 475 | IV2_NOTIFY_USE_TRANSPORT_MODE =16391, |
| 476 | IV2_NOTIFY_HTTP_CERT_LOOKUP_SUPPORTED =16392, |
| 477 | IV2_NOTIFY_REKEY_SA =16393, |
| 478 | IV2_NOTIFY_ESP_TFC_PADDING_NOT_SUPPORTED =16394, |
| 479 | IV2_NOTIFY_NON_FIRST_FRAGMENTS_ALSO =16395 |
| 480 | }; |
| 481 | |
| 482 | struct notify_messages { |
| 483 | u_int16_t type; |
| 484 | char *msg; |
| 485 | }; |
| 486 | |
| 487 | /* 3.8 Notification Payload */ |
| 488 | struct ikev2_auth { |
| 489 | struct isakmp_gen h; |
| 490 | u_int8_t auth_method; /* Protocol-ID */ |
| 491 | u_int8_t reserved[3]; |
| 492 | /* authentication data */ |
| 493 | }; |
| 494 | |
| 495 | enum ikev2_auth_type { |
| 496 | IV2_RSA_SIG = 1, |
| 497 | IV2_SHARED = 2, |
| 498 | IV2_DSS_SIG = 3, |
| 499 | }; |
| 500 | |
The Android Open Source Project | 2949f58 | 2009-03-03 19:30:46 -0800 | [diff] [blame] | 501 | #endif /* !defined(_ISAKMP_H_) */ |