156893Sfenner/* 256893Sfenner * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 356893Sfenner * All rights reserved. 4127668Sbms * 556893Sfenner * Redistribution and use in source and binary forms, with or without 656893Sfenner * modification, are permitted provided that the following conditions 756893Sfenner * are met: 856893Sfenner * 1. Redistributions of source code must retain the above copyright 956893Sfenner * notice, this list of conditions and the following disclaimer. 1056893Sfenner * 2. Redistributions in binary form must reproduce the above copyright 1156893Sfenner * notice, this list of conditions and the following disclaimer in the 1256893Sfenner * documentation and/or other materials provided with the distribution. 1356893Sfenner * 3. Neither the name of the project nor the names of its contributors 1456893Sfenner * may be used to endorse or promote products derived from this software 1556893Sfenner * without specific prior written permission. 16127668Sbms * 1756893Sfenner * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 1856893Sfenner * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 1956893Sfenner * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 2056893Sfenner * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 2156893Sfenner * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 2256893Sfenner * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 2356893Sfenner * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 2456893Sfenner * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 2556893Sfenner * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 2656893Sfenner * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 2756893Sfenner * SUCH DAMAGE. 2856893Sfenner */ 29214478Srpaulo/* YIPS @(#)$Id: isakmp.h,v 1.12 2007-11-24 18:13:33 mcr Exp $ */ 3056893Sfenner 3156893Sfenner/* refer to RFC 2408 */ 3256893Sfenner 3356893Sfenner/* must include <netinet/in.h> */ 3456893Sfenner 3556893Sfenner#if !defined(_ISAKMP_H_) 3656893Sfenner#define _ISAKMP_H_ 3756893Sfenner 3856893Sfennertypedef u_char cookie_t[8]; 3956893Sfennertypedef u_char msgid_t[4]; 4056893Sfenner 4156893Sfennertypedef struct { /* i_cookie + r_cookie */ 4256893Sfenner cookie_t i_ck; 4356893Sfenner cookie_t r_ck; 4456893Sfenner} isakmp_index; 4556893Sfenner 4656893Sfenner#define INITIATOR 1 4756893Sfenner#define RESPONDER 2 4856893Sfenner 4956893Sfenner#define PORT_ISAKMP 500 5056893Sfenner 5156893Sfenner#define GENERATE 1 5256893Sfenner#define VALIDATE 0 5356893Sfenner 5456893Sfenner/* Phase of oakley definition */ 5556893Sfenner/* 5656893Sfenner 0000 0000 0000 0000 5756893Sfenner | |||| |||| 5856893Sfenner | |||| ++++--> negosiation number in phase 5956893Sfenner | ++++-------> phase number 6056893Sfenner +---------------> expire ? 6156893Sfenner */ 6256893Sfenner#define ISAKMP_PH1 0x0010 6356893Sfenner#define ISAKMP_PH2 0x0020 6456893Sfenner#define ISAKMP_EXPIRED 0x0100 6556893Sfenner 6656893Sfenner#define ISAKMP_NGP_0 0x0000 6756893Sfenner#define ISAKMP_NGP_1 0x0001 6856893Sfenner#define ISAKMP_NGP_2 0x0002 6956893Sfenner#define ISAKMP_NGP_3 0x0003 7056893Sfenner#define ISAKMP_NGP_4 0x0004 7156893Sfenner 7256893Sfenner#define ISAKMP_PH1_N (ISAKMP_PH1 | ISAKMP_NGP_0) /* i.e. spawn */ 7356893Sfenner#define ISAKMP_PH1_1 (ISAKMP_PH1 | ISAKMP_NGP_1) 7456893Sfenner#define ISAKMP_PH1_2 (ISAKMP_PH1 | ISAKMP_NGP_2) 7556893Sfenner#define ISAKMP_PH1_3 (ISAKMP_PH1 | ISAKMP_NGP_3) 7656893Sfenner#define ISAKMP_PH2_N (ISAKMP_PH2 | ISAKMP_NGP_0) 7756893Sfenner#define ISAKMP_PH2_1 (ISAKMP_PH2 | ISAKMP_NGP_1) 7856893Sfenner#define ISAKMP_PH2_2 (ISAKMP_PH2 | ISAKMP_NGP_2) 7956893Sfenner#define ISAKMP_PH2_3 (ISAKMP_PH2 | ISAKMP_NGP_3) 8056893Sfenner 8156893Sfenner#define ISAKMP_TIMER_DEFAULT 10 /* seconds */ 8256893Sfenner#define ISAKMP_TRY_DEFAULT 3 /* times */ 8356893Sfenner 84190207Srpaulo/* 3.1 ISAKMP Header Format (IKEv1 and IKEv2) 8556893Sfenner 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 8656893Sfenner +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 8756893Sfenner ! Initiator ! 8856893Sfenner ! Cookie ! 8956893Sfenner +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 9056893Sfenner ! Responder ! 9156893Sfenner ! Cookie ! 9256893Sfenner +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 9356893Sfenner ! Next Payload ! MjVer ! MnVer ! Exchange Type ! Flags ! 9456893Sfenner +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 9556893Sfenner ! Message ID ! 9656893Sfenner +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 9756893Sfenner ! Length ! 9856893Sfenner +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 9956893Sfenner*/ 10056893Sfennerstruct isakmp { 10156893Sfenner cookie_t i_ck; /* Initiator Cookie */ 10256893Sfenner cookie_t r_ck; /* Responder Cookie */ 10356893Sfenner u_int8_t np; /* Next Payload Type */ 10456893Sfenner u_int8_t vers; 10556893Sfenner#define ISAKMP_VERS_MAJOR 0xf0 10656893Sfenner#define ISAKMP_VERS_MAJOR_SHIFT 4 10756893Sfenner#define ISAKMP_VERS_MINOR 0x0f 10856893Sfenner#define ISAKMP_VERS_MINOR_SHIFT 0 10956893Sfenner u_int8_t etype; /* Exchange Type */ 11056893Sfenner u_int8_t flags; /* Flags */ 11156893Sfenner msgid_t msgid; 11256893Sfenner u_int32_t len; /* Length */ 11356893Sfenner}; 11456893Sfenner 11556893Sfenner/* Next Payload Type */ 11656893Sfenner#define ISAKMP_NPTYPE_NONE 0 /* NONE*/ 11756893Sfenner#define ISAKMP_NPTYPE_SA 1 /* Security Association */ 11856893Sfenner#define ISAKMP_NPTYPE_P 2 /* Proposal */ 11956893Sfenner#define ISAKMP_NPTYPE_T 3 /* Transform */ 12056893Sfenner#define ISAKMP_NPTYPE_KE 4 /* Key Exchange */ 12156893Sfenner#define ISAKMP_NPTYPE_ID 5 /* Identification */ 12256893Sfenner#define ISAKMP_NPTYPE_CERT 6 /* Certificate */ 12356893Sfenner#define ISAKMP_NPTYPE_CR 7 /* Certificate Request */ 12456893Sfenner#define ISAKMP_NPTYPE_HASH 8 /* Hash */ 12556893Sfenner#define ISAKMP_NPTYPE_SIG 9 /* Signature */ 12656893Sfenner#define ISAKMP_NPTYPE_NONCE 10 /* Nonce */ 12756893Sfenner#define ISAKMP_NPTYPE_N 11 /* Notification */ 12856893Sfenner#define ISAKMP_NPTYPE_D 12 /* Delete */ 12956893Sfenner#define ISAKMP_NPTYPE_VID 13 /* Vendor ID */ 130214478Srpaulo#define ISAKMP_NPTYPE_v2E 46 /* v2 Encrypted payload */ 13156893Sfenner 132190207Srpaulo#define IKEv1_MAJOR_VERSION 1 133190207Srpaulo#define IKEv1_MINOR_VERSION 0 13456893Sfenner 135190207Srpaulo#define IKEv2_MAJOR_VERSION 2 136190207Srpaulo#define IKEv2_MINOR_VERSION 0 137190207Srpaulo 13856893Sfenner/* Exchange Type */ 13956893Sfenner#define ISAKMP_ETYPE_NONE 0 /* NONE */ 14056893Sfenner#define ISAKMP_ETYPE_BASE 1 /* Base */ 14156893Sfenner#define ISAKMP_ETYPE_IDENT 2 /* Identity Proteciton */ 14256893Sfenner#define ISAKMP_ETYPE_AUTH 3 /* Authentication Only */ 14356893Sfenner#define ISAKMP_ETYPE_AGG 4 /* Aggressive */ 14456893Sfenner#define ISAKMP_ETYPE_INF 5 /* Informational */ 14556893Sfenner 14656893Sfenner/* Flags */ 14756893Sfenner#define ISAKMP_FLAG_E 0x01 /* Encryption Bit */ 14856893Sfenner#define ISAKMP_FLAG_C 0x02 /* Commit Bit */ 149190207Srpaulo#define ISAKMP_FLAG_extra 0x04 15056893Sfenner 151190207Srpaulo/* IKEv2 */ 152190207Srpaulo#define ISAKMP_FLAG_I (1 << 3) /* (I)nitiator */ 153190207Srpaulo#define ISAKMP_FLAG_V (1 << 4) /* (V)ersion */ 154190207Srpaulo#define ISAKMP_FLAG_R (1 << 5) /* (R)esponse */ 155190207Srpaulo 156190207Srpaulo 15756893Sfenner/* 3.2 Payload Generic Header 15856893Sfenner 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 15956893Sfenner +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 16056893Sfenner ! Next Payload ! RESERVED ! Payload Length ! 16156893Sfenner +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 16256893Sfenner*/ 16356893Sfennerstruct isakmp_gen { 16456893Sfenner u_int8_t np; /* Next Payload */ 165190207Srpaulo u_int8_t critical; /* bit 7 - critical, rest is RESERVED */ 16656893Sfenner u_int16_t len; /* Payload Length */ 16756893Sfenner}; 16856893Sfenner 16956893Sfenner/* 3.3 Data Attributes 17056893Sfenner 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 17156893Sfenner +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 17256893Sfenner !A! Attribute Type ! AF=0 Attribute Length ! 17356893Sfenner !F! ! AF=1 Attribute Value ! 17456893Sfenner +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 17556893Sfenner . AF=0 Attribute Value . 17656893Sfenner . AF=1 Not Transmitted . 17756893Sfenner +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 17856893Sfenner*/ 17956893Sfennerstruct isakmp_data { 18056893Sfenner u_int16_t type; /* defined by DOI-spec, and Attribute Format */ 18156893Sfenner u_int16_t lorv; /* if f equal 1, Attribute Length */ 18256893Sfenner /* if f equal 0, Attribute Value */ 18356893Sfenner /* if f equal 1, Attribute Value */ 18456893Sfenner}; 18556893Sfenner#define ISAKMP_GEN_TLV 0x0000 18656893Sfenner#define ISAKMP_GEN_TV 0x8000 18756893Sfenner /* mask for type of attribute format */ 18856893Sfenner#define ISAKMP_GEN_MASK 0x8000 18956893Sfenner 19056893Sfenner/* 3.4 Security Association Payload */ 19156893Sfenner /* MAY NOT be used, because of being defined in ipsec-doi. */ 19256893Sfenner /* 19356893Sfenner If the current payload is the last in the message, 19456893Sfenner then the value of the next payload field will be 0. 19556893Sfenner This field MUST NOT contain the 19656893Sfenner values for the Proposal or Transform payloads as they are considered 19756893Sfenner part of the security association negotiation. For example, this 19856893Sfenner field would contain the value "10" (Nonce payload) in the first 19956893Sfenner message of a Base Exchange (see Section 4.4) and the value "0" in the 20056893Sfenner first message of an Identity Protect Exchange (see Section 4.5). 20156893Sfenner */ 202190207Srpaulostruct ikev1_pl_sa { 20356893Sfenner struct isakmp_gen h; 20456893Sfenner u_int32_t doi; /* Domain of Interpretation */ 20556893Sfenner u_int32_t sit; /* Situation */ 20656893Sfenner}; 20756893Sfenner 20856893Sfenner/* 3.5 Proposal Payload */ 20956893Sfenner /* 21056893Sfenner The value of the next payload field MUST only contain the value "2" 21156893Sfenner or "0". If there are additional Proposal payloads in the message, 21256893Sfenner then this field will be 2. If the current Proposal payload is the 21356893Sfenner last within the security association proposal, then this field will 21456893Sfenner be 0. 21556893Sfenner */ 216190207Srpaulostruct ikev1_pl_p { 21756893Sfenner struct isakmp_gen h; 21856893Sfenner u_int8_t p_no; /* Proposal # */ 21956893Sfenner u_int8_t prot_id; /* Protocol */ 22056893Sfenner u_int8_t spi_size; /* SPI Size */ 22156893Sfenner u_int8_t num_t; /* Number of Transforms */ 22256893Sfenner /* SPI */ 22356893Sfenner}; 22456893Sfenner 22556893Sfenner/* 3.6 Transform Payload */ 22656893Sfenner /* 22756893Sfenner The value of the next payload field MUST only contain the value "3" 22856893Sfenner or "0". If there are additional Transform payloads in the proposal, 22956893Sfenner then this field will be 3. If the current Transform payload is the 23056893Sfenner last within the proposal, then this field will be 0. 23156893Sfenner */ 232190207Srpaulostruct ikev1_pl_t { 23356893Sfenner struct isakmp_gen h; 23456893Sfenner u_int8_t t_no; /* Transform # */ 23556893Sfenner u_int8_t t_id; /* Transform-Id */ 23656893Sfenner u_int16_t reserved; /* RESERVED2 */ 23756893Sfenner /* SA Attributes */ 23856893Sfenner}; 23956893Sfenner 24056893Sfenner/* 3.7 Key Exchange Payload */ 241190207Srpaulostruct ikev1_pl_ke { 24256893Sfenner struct isakmp_gen h; 24356893Sfenner /* Key Exchange Data */ 24456893Sfenner}; 24556893Sfenner 24656893Sfenner/* 3.8 Identification Payload */ 24756893Sfenner /* MUST NOT to be used, because of being defined in ipsec-doi. */ 248190207Srpaulostruct ikev1_pl_id { 24956893Sfenner struct isakmp_gen h; 25056893Sfenner union { 25156893Sfenner u_int8_t id_type; /* ID Type */ 25256893Sfenner u_int32_t doi_data; /* DOI Specific ID Data */ 25356893Sfenner } d; 25456893Sfenner /* Identification Data */ 25556893Sfenner}; 25656893Sfenner 25756893Sfenner/* 3.9 Certificate Payload */ 258190207Srpaulostruct ikev1_pl_cert { 25956893Sfenner struct isakmp_gen h; 26056893Sfenner u_int8_t encode; /* Cert Encoding */ 26156893Sfenner char cert; /* Certificate Data */ 26256893Sfenner /* 26356893Sfenner This field indicates the type of 26456893Sfenner certificate or certificate-related information contained in the 26556893Sfenner Certificate Data field. 26656893Sfenner */ 26756893Sfenner}; 26856893Sfenner 26956893Sfenner/* Certificate Type */ 27056893Sfenner#define ISAKMP_CERT_NONE 0 27156893Sfenner#define ISAKMP_CERT_PKCS 1 27256893Sfenner#define ISAKMP_CERT_PGP 2 27356893Sfenner#define ISAKMP_CERT_DNS 3 27456893Sfenner#define ISAKMP_CERT_SIGN 4 27556893Sfenner#define ISAKMP_CERT_KE 5 27656893Sfenner#define ISAKMP_CERT_KT 6 27756893Sfenner#define ISAKMP_CERT_CRL 7 27856893Sfenner#define ISAKMP_CERT_ARL 8 27956893Sfenner#define ISAKMP_CERT_SPKI 9 28056893Sfenner 28156893Sfenner/* 3.10 Certificate Request Payload */ 282190207Srpaulostruct ikev1_pl_cr { 28356893Sfenner struct isakmp_gen h; 28456893Sfenner u_int8_t num_cert; /* # Cert. Types */ 28556893Sfenner /* 28656893Sfenner Certificate Types (variable length) 28756893Sfenner -- Contains a list of the types of certificates requested, 28856893Sfenner sorted in order of preference. Each individual certificate 28956893Sfenner type is 1 octet. This field is NOT requiredo 29056893Sfenner */ 29156893Sfenner /* # Certificate Authorities (1 octet) */ 29256893Sfenner /* Certificate Authorities (variable length) */ 29356893Sfenner}; 29456893Sfenner 29556893Sfenner/* 3.11 Hash Payload */ 29656893Sfenner /* may not be used, because of having only data. */ 297190207Srpaulostruct ikev1_pl_hash { 29856893Sfenner struct isakmp_gen h; 29956893Sfenner /* Hash Data */ 30056893Sfenner}; 30156893Sfenner 30256893Sfenner/* 3.12 Signature Payload */ 30356893Sfenner /* may not be used, because of having only data. */ 304190207Srpaulostruct ikev1_pl_sig { 30556893Sfenner struct isakmp_gen h; 30656893Sfenner /* Signature Data */ 30756893Sfenner}; 30856893Sfenner 30956893Sfenner/* 3.13 Nonce Payload */ 31056893Sfenner /* may not be used, because of having only data. */ 311190207Srpaulostruct ikev1_pl_nonce { 31256893Sfenner struct isakmp_gen h; 31356893Sfenner /* Nonce Data */ 31456893Sfenner}; 31556893Sfenner 31656893Sfenner/* 3.14 Notification Payload */ 317190207Srpaulostruct ikev1_pl_n { 31856893Sfenner struct isakmp_gen h; 31956893Sfenner u_int32_t doi; /* Domain of Interpretation */ 32056893Sfenner u_int8_t prot_id; /* Protocol-ID */ 32156893Sfenner u_int8_t spi_size; /* SPI Size */ 32256893Sfenner u_int16_t type; /* Notify Message Type */ 32356893Sfenner /* SPI */ 32456893Sfenner /* Notification Data */ 32556893Sfenner}; 32656893Sfenner 32756893Sfenner/* 3.14.1 Notify Message Types */ 32856893Sfenner/* NOTIFY MESSAGES - ERROR TYPES */ 32956893Sfenner#define ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE 1 33056893Sfenner#define ISAKMP_NTYPE_DOI_NOT_SUPPORTED 2 33156893Sfenner#define ISAKMP_NTYPE_SITUATION_NOT_SUPPORTED 3 33256893Sfenner#define ISAKMP_NTYPE_INVALID_COOKIE 4 33356893Sfenner#define ISAKMP_NTYPE_INVALID_MAJOR_VERSION 5 33456893Sfenner#define ISAKMP_NTYPE_INVALID_MINOR_VERSION 6 33556893Sfenner#define ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE 7 33656893Sfenner#define ISAKMP_NTYPE_INVALID_FLAGS 8 33756893Sfenner#define ISAKMP_NTYPE_INVALID_MESSAGE_ID 9 33856893Sfenner#define ISAKMP_NTYPE_INVALID_PROTOCOL_ID 10 33956893Sfenner#define ISAKMP_NTYPE_INVALID_SPI 11 34056893Sfenner#define ISAKMP_NTYPE_INVALID_TRANSFORM_ID 12 34156893Sfenner#define ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED 13 34256893Sfenner#define ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN 14 34356893Sfenner#define ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX 15 34456893Sfenner#define ISAKMP_NTYPE_PAYLOAD_MALFORMED 16 34556893Sfenner#define ISAKMP_NTYPE_INVALID_KEY_INFORMATION 17 34656893Sfenner#define ISAKMP_NTYPE_INVALID_ID_INFORMATION 18 34756893Sfenner#define ISAKMP_NTYPE_INVALID_CERT_ENCODING 19 34856893Sfenner#define ISAKMP_NTYPE_INVALID_CERTIFICATE 20 34956893Sfenner#define ISAKMP_NTYPE_BAD_CERT_REQUEST_SYNTAX 21 35056893Sfenner#define ISAKMP_NTYPE_INVALID_CERT_AUTHORITY 22 35156893Sfenner#define ISAKMP_NTYPE_INVALID_HASH_INFORMATION 23 35256893Sfenner#define ISAKMP_NTYPE_AUTHENTICATION_FAILED 24 35356893Sfenner#define ISAKMP_NTYPE_INVALID_SIGNATURE 25 35456893Sfenner#define ISAKMP_NTYPE_ADDRESS_NOTIFICATION 26 35556893Sfenner/* NOTIFY MESSAGES - STATUS TYPES */ 35656893Sfenner#define ISAKMP_NTYPE_CONNECTED 16384 35756893Sfenner/* using only to log */ 35856893Sfenner#define ISAKMP_LOG_RETRY_LIMIT_REACHED 65530 35956893Sfenner 36056893Sfenner/* 3.15 Delete Payload */ 361190207Srpaulostruct ikev1_pl_d { 36256893Sfenner struct isakmp_gen h; 36356893Sfenner u_int32_t doi; /* Domain of Interpretation */ 36456893Sfenner u_int8_t prot_id; /* Protocol-Id */ 36556893Sfenner u_int8_t spi_size; /* SPI Size */ 36656893Sfenner u_int16_t num_spi; /* # of SPIs */ 36756893Sfenner /* SPI(es) */ 36856893Sfenner}; 36956893Sfenner 37056893Sfenner 371190207Srpaulostruct ikev1_ph1tab { 372190207Srpaulo struct ikev1_ph1 *head; 373190207Srpaulo struct ikev1_ph1 *tail; 37456893Sfenner int len; 37556893Sfenner}; 37656893Sfenner 37756893Sfennerstruct isakmp_ph2tab { 378190207Srpaulo struct ikev1_ph2 *head; 379190207Srpaulo struct ikev1_ph2 *tail; 38056893Sfenner int len; 38156893Sfenner}; 38256893Sfenner 38356893Sfenner#define EXCHANGE_PROXY 1 38456893Sfenner#define EXCHANGE_MYSELF 0 38556893Sfenner 38656893Sfenner#define PFS_NEED 1 38756893Sfenner#define PFS_NONEED 0 38856893Sfenner 389190207Srpaulo/* IKEv2 (RFC4306) */ 390190207Srpaulo 391190207Srpaulo/* 3.3 Security Association Payload -- generic header */ 392190207Srpaulo/* 3.3.1. Proposal Substructure */ 393190207Srpaulostruct ikev2_p { 394190207Srpaulo struct isakmp_gen h; 395190207Srpaulo u_int8_t p_no; /* Proposal # */ 396190207Srpaulo u_int8_t prot_id; /* Protocol */ 397190207Srpaulo u_int8_t spi_size; /* SPI Size */ 398190207Srpaulo u_int8_t num_t; /* Number of Transforms */ 399190207Srpaulo}; 400190207Srpaulo 401190207Srpaulo/* 3.3.2. Transform Substructure */ 402190207Srpaulostruct ikev2_t { 403190207Srpaulo struct isakmp_gen h; 404190207Srpaulo u_int8_t t_type; /* Transform Type (ENCR,PRF,INTEG,etc.*/ 405190207Srpaulo u_int8_t res2; /* reserved byte */ 406190207Srpaulo u_int16_t t_id; /* Transform ID */ 407190207Srpaulo}; 408190207Srpaulo 409190207Srpauloenum ikev2_t_type { 410190207Srpaulo IV2_T_ENCR = 1, 411190207Srpaulo IV2_T_PRF = 2, 412190207Srpaulo IV2_T_INTEG= 3, 413190207Srpaulo IV2_T_DH = 4, 414190207Srpaulo IV2_T_ESN = 5, 415190207Srpaulo}; 416190207Srpaulo 417190207Srpaulo/* 3.4. Key Exchange Payload */ 418190207Srpaulostruct ikev2_ke { 419190207Srpaulo struct isakmp_gen h; 420190207Srpaulo u_int16_t ke_group; 421190207Srpaulo u_int16_t ke_res1; 422190207Srpaulo /* KE data */ 423190207Srpaulo}; 424190207Srpaulo 425190207Srpaulo 426214478Srpaulo/* 3.5. Identification Payloads */ 427214478Srpauloenum ikev2_id_type { 428214478Srpaulo ID_IPV4_ADDR=1, 429214478Srpaulo ID_FQDN=2, 430214478Srpaulo ID_RFC822_ADDR=3, 431214478Srpaulo ID_IPV6_ADDR=5, 432214478Srpaulo ID_DER_ASN1_DN=9, 433214478Srpaulo ID_DER_ASN1_GN=10, 434214478Srpaulo ID_KEY_ID=11, 435214478Srpaulo}; 436214478Srpaulostruct ikev2_id { 437214478Srpaulo struct isakmp_gen h; 438214478Srpaulo u_int8_t type; /* ID type */ 439214478Srpaulo u_int8_t res1; 440214478Srpaulo u_int16_t res2; 441214478Srpaulo /* SPI */ 442214478Srpaulo /* Notification Data */ 443214478Srpaulo}; 444214478Srpaulo 445190207Srpaulo/* 3.10 Notification Payload */ 446190207Srpaulostruct ikev2_n { 447190207Srpaulo struct isakmp_gen h; 448190207Srpaulo u_int8_t prot_id; /* Protocol-ID */ 449190207Srpaulo u_int8_t spi_size; /* SPI Size */ 450190207Srpaulo u_int16_t type; /* Notify Message Type */ 451190207Srpaulo}; 452190207Srpaulo 453190207Srpauloenum ikev2_n_type { 454190207Srpaulo IV2_NOTIFY_UNSUPPORTED_CRITICAL_PAYLOAD = 1, 455190207Srpaulo IV2_NOTIFY_INVALID_IKE_SPI = 4, 456190207Srpaulo IV2_NOTIFY_INVALID_MAJOR_VERSION = 5, 457190207Srpaulo IV2_NOTIFY_INVALID_SYNTAX = 7, 458190207Srpaulo IV2_NOTIFY_INVALID_MESSAGE_ID = 9, 459190207Srpaulo IV2_NOTIFY_INVALID_SPI =11, 460190207Srpaulo IV2_NOTIFY_NO_PROPOSAL_CHOSEN =14, 461190207Srpaulo IV2_NOTIFY_INVALID_KE_PAYLOAD =17, 462190207Srpaulo IV2_NOTIFY_AUTHENTICATION_FAILED =24, 463190207Srpaulo IV2_NOTIFY_SINGLE_PAIR_REQUIRED =34, 464190207Srpaulo IV2_NOTIFY_NO_ADDITIONAL_SAS =35, 465190207Srpaulo IV2_NOTIFY_INTERNAL_ADDRESS_FAILURE =36, 466190207Srpaulo IV2_NOTIFY_FAILED_CP_REQUIRED =37, 467190207Srpaulo IV2_NOTIFY_INVALID_SELECTORS =39, 468190207Srpaulo IV2_NOTIFY_INITIAL_CONTACT =16384, 469190207Srpaulo IV2_NOTIFY_SET_WINDOW_SIZE =16385, 470190207Srpaulo IV2_NOTIFY_ADDITIONAL_TS_POSSIBLE =16386, 471190207Srpaulo IV2_NOTIFY_IPCOMP_SUPPORTED =16387, 472190207Srpaulo IV2_NOTIFY_NAT_DETECTION_SOURCE_IP =16388, 473190207Srpaulo IV2_NOTIFY_NAT_DETECTION_DESTINATION_IP =16389, 474190207Srpaulo IV2_NOTIFY_COOKIE =16390, 475190207Srpaulo IV2_NOTIFY_USE_TRANSPORT_MODE =16391, 476190207Srpaulo IV2_NOTIFY_HTTP_CERT_LOOKUP_SUPPORTED =16392, 477190207Srpaulo IV2_NOTIFY_REKEY_SA =16393, 478190207Srpaulo IV2_NOTIFY_ESP_TFC_PADDING_NOT_SUPPORTED =16394, 479190207Srpaulo IV2_NOTIFY_NON_FIRST_FRAGMENTS_ALSO =16395 480190207Srpaulo}; 481190207Srpaulo 482190207Srpaulostruct notify_messages { 483190207Srpaulo u_int16_t type; 484190207Srpaulo char *msg; 485190207Srpaulo}; 486190207Srpaulo 487190207Srpaulo/* 3.8 Notification Payload */ 488190207Srpaulostruct ikev2_auth { 489190207Srpaulo struct isakmp_gen h; 490190207Srpaulo u_int8_t auth_method; /* Protocol-ID */ 491190207Srpaulo u_int8_t reserved[3]; 492190207Srpaulo /* authentication data */ 493190207Srpaulo}; 494190207Srpaulo 495190207Srpauloenum ikev2_auth_type { 496190207Srpaulo IV2_RSA_SIG = 1, 497190207Srpaulo IV2_SHARED = 2, 498190207Srpaulo IV2_DSS_SIG = 3, 499190207Srpaulo}; 500190207Srpaulo 50156893Sfenner#endif /* !defined(_ISAKMP_H_) */ 502