/* * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright *    notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright *    notice, this list of conditions and the following disclaimer in the *    documentation and/or other materials provided with the distribution. * 3. Neither the name of the project nor the names of its contributors *    may be used to endorse or promote products derived from this software *    without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. *//* YIPS @(#)$Id: isakmp.h,v 1.11 2007-08-29 02:38:14 mcr Exp $ *//* refer to RFC 2408 *//* must include <netinet/in.h> */#if !defined(_ISAKMP_H_)#define _ISAKMP_H_typedef u_char cookie_t[8];typedef u_char msgid_t[4];typedef struct { /* i_cookie + r_cookie */	cookie_t i_ck;	cookie_t r_ck;} isakmp_index;#define INITIATOR       1#define RESPONDER       2#define PORT_ISAKMP 500#define GENERATE  1#define VALIDATE  0/* Phase of oakley definition *//*  0000 0000 0000 0000       |    |||| ||||       |    |||| ++++--> negosiation number in phase       |    ++++-------> phase number       +---------------> expire ? */#define ISAKMP_PH1      0x0010#define ISAKMP_PH2      0x0020#define ISAKMP_EXPIRED  0x0100#define ISAKMP_NGP_0    0x0000#define ISAKMP_NGP_1    0x0001#define ISAKMP_NGP_2    0x0002#define ISAKMP_NGP_3    0x0003#define ISAKMP_NGP_4    0x0004#define ISAKMP_PH1_N    (ISAKMP_PH1 | ISAKMP_NGP_0)  /* i.e. spawn */#define ISAKMP_PH1_1    (ISAKMP_PH1 | ISAKMP_NGP_1)#define ISAKMP_PH1_2    (ISAKMP_PH1 | ISAKMP_NGP_2)#define ISAKMP_PH1_3    (ISAKMP_PH1 | ISAKMP_NGP_3)#define ISAKMP_PH2_N    (ISAKMP_PH2 | ISAKMP_NGP_0)#define ISAKMP_PH2_1    (ISAKMP_PH2 | ISAKMP_NGP_1)#define ISAKMP_PH2_2    (ISAKMP_PH2 | ISAKMP_NGP_2)#define ISAKMP_PH2_3    (ISAKMP_PH2 | ISAKMP_NGP_3)#define ISAKMP_TIMER_DEFAULT     10 /* seconds */#define ISAKMP_TRY_DEFAULT        3 /* times *//* 3.1 ISAKMP Header Format (IKEv1 and IKEv2)         0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+        !                          Initiator                            !        !                            Cookie                             !        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+        !                          Responder                            !        !                            Cookie                             !        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+        !  Next Payload ! MjVer ! MnVer ! Exchange Type !     Flags     !        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+        !                          Message ID                           !        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+        !                            Length                             !        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+*/struct isakmp {	cookie_t i_ck;		/* Initiator Cookie */	cookie_t r_ck;		/* Responder Cookie */	u_int8_t np;		/* Next Payload Type */	u_int8_t vers;#define ISAKMP_VERS_MAJOR	0xf0#define ISAKMP_VERS_MAJOR_SHIFT	4#define ISAKMP_VERS_MINOR	0x0f#define ISAKMP_VERS_MINOR_SHIFT	0	u_int8_t etype;		/* Exchange Type */	u_int8_t flags;		/* Flags */	msgid_t msgid;	u_int32_t len;		/* Length */};/* Next Payload Type */#define ISAKMP_NPTYPE_NONE   0 /* NONE*/#define ISAKMP_NPTYPE_SA     1 /* Security Association */#define ISAKMP_NPTYPE_P      2 /* Proposal */#define ISAKMP_NPTYPE_T      3 /* Transform */#define ISAKMP_NPTYPE_KE     4 /* Key Exchange */#define ISAKMP_NPTYPE_ID     5 /* Identification */#define ISAKMP_NPTYPE_CERT   6 /* Certificate */#define ISAKMP_NPTYPE_CR     7 /* Certificate Request */#define ISAKMP_NPTYPE_HASH   8 /* Hash */#define ISAKMP_NPTYPE_SIG    9 /* Signature */#define ISAKMP_NPTYPE_NONCE 10 /* Nonce */#define ISAKMP_NPTYPE_N     11 /* Notification */#define ISAKMP_NPTYPE_D     12 /* Delete */#define ISAKMP_NPTYPE_VID   13 /* Vendor ID */#define IKEv1_MAJOR_VERSION  1#define IKEv1_MINOR_VERSION  0#define IKEv2_MAJOR_VERSION  2#define IKEv2_MINOR_VERSION  0/* Exchange Type */#define ISAKMP_ETYPE_NONE   0 /* NONE */#define ISAKMP_ETYPE_BASE   1 /* Base */#define ISAKMP_ETYPE_IDENT  2 /* Identity Proteciton */#define ISAKMP_ETYPE_AUTH   3 /* Authentication Only */#define ISAKMP_ETYPE_AGG    4 /* Aggressive */#define ISAKMP_ETYPE_INF    5 /* Informational *//* Flags */#define ISAKMP_FLAG_E 0x01 /* Encryption Bit */#define ISAKMP_FLAG_C 0x02 /* Commit Bit */#define ISAKMP_FLAG_extra 0x04/* IKEv2 */#define ISAKMP_FLAG_I (1 << 3)  /* (I)nitiator */#define ISAKMP_FLAG_V (1 << 4)  /* (V)ersion   */#define ISAKMP_FLAG_R (1 << 5)  /* (R)esponse  *//* 3.2 Payload Generic Header         0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+        ! Next Payload  !   RESERVED    !         Payload Length        !        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+*/struct isakmp_gen {	u_int8_t  np;       /* Next Payload */	u_int8_t  critical; /* bit 7 - critical, rest is RESERVED */	u_int16_t len;      /* Payload Length */};/* 3.3 Data Attributes         0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+        !A!       Attribute Type        !    AF=0  Attribute Length     !        !F!                             !    AF=1  Attribute Value      !        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+        .                   AF=0  Attribute Value                       .        .                   AF=1  Not Transmitted                       .        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+*/struct isakmp_data {	u_int16_t type;     /* defined by DOI-spec, and Attribute Format */	u_int16_t lorv;     /* if f equal 1, Attribute Length */	                  /* if f equal 0, Attribute Value */	/* if f equal 1, Attribute Value */};#define ISAKMP_GEN_TLV 0x0000#define ISAKMP_GEN_TV  0x8000	/* mask for type of attribute format */#define ISAKMP_GEN_MASK 0x8000/* 3.4 Security Association Payload */	/* MAY NOT be used, because of being defined in ipsec-doi. */	/*	If the current payload is the last in the message,	then the value of the next payload field will be 0.	This field MUST NOT contain the	values for the Proposal or Transform payloads as they are considered	part of the security association negotiation.  For example, this	field would contain the value "10" (Nonce payload) in the first	message of a Base Exchange (see Section 4.4) and the value "0" in the	first message of an Identity Protect Exchange (see Section 4.5).	*/struct ikev1_pl_sa {	struct isakmp_gen h;	u_int32_t doi; /* Domain of Interpretation */	u_int32_t sit; /* Situation */};/* 3.5 Proposal Payload */	/*	The value of the next payload field MUST only contain the value "2"	or "0".  If there are additional Proposal payloads in the message,	then this field will be 2.  If the current Proposal payload is the	last within the security association proposal, then this field will	be 0.	*/struct ikev1_pl_p {	struct isakmp_gen h;	u_int8_t p_no;      /* Proposal # */	u_int8_t prot_id;   /* Protocol */	u_int8_t spi_size;  /* SPI Size */	u_int8_t num_t;     /* Number of Transforms */	/* SPI */};/* 3.6 Transform Payload */	/*	The value of the next payload field MUST only contain the value "3"	or "0".  If there are additional Transform payloads in the proposal,	then this field will be 3.  If the current Transform payload is the	last within the proposal, then this field will be 0.	*/struct ikev1_pl_t {	struct isakmp_gen h;	u_int8_t  t_no;     /* Transform # */	u_int8_t  t_id;     /* Transform-Id */	u_int16_t reserved; /* RESERVED2 */	/* SA Attributes */};/* 3.7 Key Exchange Payload */struct ikev1_pl_ke {	struct isakmp_gen h;	/* Key Exchange Data */