1 // SoftEther VPN Source Code - Stable Edition Repository
2 // Cedar Communication Module
3 //
4 // SoftEther VPN Server, Client and Bridge are free software under the Apache License, Version 2.0.
5 //
6 // Copyright (c) Daiyuu Nobori.
7 // Copyright (c) SoftEther VPN Project, University of Tsukuba, Japan.
8 // Copyright (c) SoftEther Corporation.
9 // Copyright (c) all contributors on SoftEther VPN project in GitHub.
10 //
11 // All Rights Reserved.
12 //
13 // http://www.softether.org/
14 //
15 // This stable branch is officially managed by Daiyuu Nobori, the owner of SoftEther VPN Project.
16 // Pull requests should be sent to the Developer Edition Master Repository on https://github.com/SoftEtherVPN/SoftEtherVPN
17 //
18 // License: The Apache License, Version 2.0
19 // https://www.apache.org/licenses/LICENSE-2.0
20 //
21 // DISCLAIMER
22 // ==========
23 //
24 // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
25 // IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
26 // FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
27 // AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
28 // LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
29 // OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
30 // SOFTWARE.
31 //
32 // THIS SOFTWARE IS DEVELOPED IN JAPAN, AND DISTRIBUTED FROM JAPAN, UNDER
33 // JAPANESE LAWS. YOU MUST AGREE IN ADVANCE TO USE, COPY, MODIFY, MERGE, PUBLISH,
34 // DISTRIBUTE, SUBLICENSE, AND/OR SELL COPIES OF THIS SOFTWARE, THAT ANY
35 // JURIDICAL DISPUTES WHICH ARE CONCERNED TO THIS SOFTWARE OR ITS CONTENTS,
36 // AGAINST US (SOFTETHER PROJECT, SOFTETHER CORPORATION, DAIYUU NOBORI OR OTHER
37 // SUPPLIERS), OR ANY JURIDICAL DISPUTES AGAINST US WHICH ARE CAUSED BY ANY KIND
38 // OF USING, COPYING, MODIFYING, MERGING, PUBLISHING, DISTRIBUTING, SUBLICENSING,
39 // AND/OR SELLING COPIES OF THIS SOFTWARE SHALL BE REGARDED AS BE CONSTRUED AND
40 // CONTROLLED BY JAPANESE LAWS, AND YOU MUST FURTHER CONSENT TO EXCLUSIVE
41 // JURISDICTION AND VENUE IN THE COURTS SITTING IN TOKYO, JAPAN. YOU MUST WAIVE
42 // ALL DEFENSES OF LACK OF PERSONAL JURISDICTION AND FORUM NON CONVENIENS.
43 // PROCESS MAY BE SERVED ON EITHER PARTY IN THE MANNER AUTHORIZED BY APPLICABLE
44 // LAW OR COURT RULE.
45 //
46 // USE ONLY IN JAPAN. DO NOT USE THIS SOFTWARE IN ANOTHER COUNTRY UNLESS YOU HAVE
47 // A CONFIRMATION THAT THIS SOFTWARE DOES NOT VIOLATE ANY CRIMINAL LAWS OR CIVIL
48 // RIGHTS IN THAT PARTICULAR COUNTRY. USING THIS SOFTWARE IN OTHER COUNTRIES IS
49 // COMPLETELY AT YOUR OWN RISK. THE SOFTETHER VPN PROJECT HAS DEVELOPED AND
50 // DISTRIBUTED THIS SOFTWARE TO COMPLY ONLY WITH THE JAPANESE LAWS AND EXISTING
51 // CIVIL RIGHTS INCLUDING PATENTS WHICH ARE SUBJECTS APPLY IN JAPAN. OTHER
52 // COUNTRIES' LAWS OR CIVIL RIGHTS ARE NONE OF OUR CONCERNS NOR RESPONSIBILITIES.
53 // WE HAVE NEVER INVESTIGATED ANY CRIMINAL REGULATIONS, CIVIL LAWS OR
54 // INTELLECTUAL PROPERTY RIGHTS INCLUDING PATENTS IN ANY OF OTHER 200+ COUNTRIES
55 // AND TERRITORIES. BY NATURE, THERE ARE 200+ REGIONS IN THE WORLD, WITH
56 // DIFFERENT LAWS. IT IS IMPOSSIBLE TO VERIFY EVERY COUNTRIES' LAWS, REGULATIONS
57 // AND CIVIL RIGHTS TO MAKE THE SOFTWARE COMPLY WITH ALL COUNTRIES' LAWS BY THE
58 // PROJECT. EVEN IF YOU WILL BE SUED BY A PRIVATE ENTITY OR BE DAMAGED BY A
59 // PUBLIC SERVANT IN YOUR COUNTRY, THE DEVELOPERS OF THIS SOFTWARE WILL NEVER BE
60 // LIABLE TO RECOVER OR COMPENSATE SUCH DAMAGES, CRIMINAL OR CIVIL
61 // RESPONSIBILITIES. NOTE THAT THIS LINE IS NOT LICENSE RESTRICTION BUT JUST A
62 // STATEMENT FOR WARNING AND DISCLAIMER.
63 //
64 // READ AND UNDERSTAND THE 'WARNING.TXT' FILE BEFORE USING THIS SOFTWARE.
65 // SOME SOFTWARE PROGRAMS FROM THIRD PARTIES ARE INCLUDED ON THIS SOFTWARE WITH
66 // LICENSE CONDITIONS WHICH ARE DESCRIBED ON THE 'THIRD_PARTY.TXT' FILE.
67 //
68 //
69 // SOURCE CODE CONTRIBUTION
70 // ------------------------
71 //
72 // Your contribution to SoftEther VPN Project is much appreciated.
73 // Please send patches to us through GitHub.
74 // Read the SoftEther VPN Patch Acceptance Policy in advance:
75 // http://www.softether.org/5-download/src/9.patch
76 //
77 //
78 // DEAR SECURITY EXPERTS
79 // ---------------------
80 //
81 // If you find a bug or a security vulnerability please kindly inform us
82 // about the problem immediately so that we can fix the security problem
83 // to protect a lot of users around the world as soon as possible.
84 //
85 // Our e-mail address for security reports is:
86 // softether-vpn-security [at] softether.org
87 //
88 // Please note that the above e-mail address is not a technical support
89 // inquiry address. If you need technical assistance, please visit
90 // http://www.softether.org/ and ask your question on the users forum.
91 //
92 // Thank you for your cooperation.
93 //
94 //
95 // NO MEMORY OR RESOURCE LEAKS
96 // ---------------------------
97 //
98 // The memory-leaks and resource-leaks verification under the stress
99 // test has been passed before release this source code.
100 
101 
102 // IPsec_IKE.h
103 // Header of IPsec_IKE.c
104 
105 #ifndef	IPSEC_IKE_H
106 #define	IPSEC_IKE_H
107 
108 //// Macro
109 
110 //// Constants
111 
112 // State
113 #define	IKE_SA_MAIN_MODE					0	// Main mode
114 #define	IKE_SA_AGRESSIVE_MODE				1	// Aggressive mode
115 
116 #define	IKE_SA_MM_STATE_1_SA				0	// Main mode state 1 (SA exchange is complete. Wait for key exchange)
117 #define	IKE_SA_MM_STATE_2_KEY				1	// Main mode state 2 (Key exchange is complete. Wait for exchange ID)
118 #define	IKE_SA_MM_STATE_3_ESTABLISHED		2	// Main mode state 3 (ID exchange is complete. Established)
119 
120 #define	IKE_SA_AM_STATE_1_SA				0	// Aggressive mode state 1 (SA exchange is completed. Wait for hash)
121 #define	IKE_SA_AM_STATE_2_ESTABLISHED		1	// Aggressive mode state 2 (Hash exchange is completed. Established)
122 
123 #define	IKE_SA_RESEND_INTERVAL				(2 * 1000)	// IKE SA packet retransmission interval
124 #define	IKE_SA_RAND_SIZE					16	// Size of the random number
125 
126 // ESP
127 #define	IKE_ESP_HASH_SIZE					12	// The hash size for the ESP packet
128 
129 // Type of UDP packet
130 #define	IKE_UDP_TYPE_ISAKMP					0	// ISAKMP packet (destination 500)
131 #define	IKE_UDP_TYPE_ESP					1	// ESP packet (destination 4500)
132 #define	IKE_UDP_KEEPALIVE					2	// KeepAlive packet
133 #define	IKE_UDP_SPECIAL						3	// Special packet
134 
135 // String for Vendor ID
136 #define	IKE_VENDOR_ID_RFC3947_NAT_T			"0x4a131c81070358455c5728f20e95452f"
137 #define	IKE_VENDOR_ID_IPSEC_NAT_T_IKE_03	"0x7d9419a65310ca6f2c179d9215529d56"
138 #define	IKE_VENDOR_ID_IPSEC_NAT_T_IKE_02	"0x90cb80913ebb696e086381b5ec427b1f"
139 #define	IKE_VENDOR_ID_IPSEC_NAT_T_IKE_02_2	"0xcd60464335df21f87cfdb2fc68b6a448"
140 #define	IKE_VENDOR_ID_IPSEC_NAT_T_IKE_00	"0x4485152d18b6bbcd0be8a8469579ddcc"
141 #define	IKE_VENDOR_ID_RFC3706_DPD			"0xafcad71368a1f1c96b8696fc77570100"
142 #define	IKE_VENDOR_ID_MICROSOFT_L2TP		"0x4048b7d56ebce88525e7de7f00d6c2d3"
143 #define	IKE_VENDOR_ID_MS_NT5_ISAKMPOAKLEY	"0x1e2b516905991c7d7c96fcbfb587e461"
144 #define	IKE_VENDOR_ID_MS_VID_INITIALCONTACT	"0x26244d38eddb61b3172a36e3d0cfb819"
145 
146 // Quota
147 #define	IKE_QUOTA_MAX_NUM_CLIENTS_PER_IP	1000			// The number of IKE_CLIENT per IP address
148 #define	IKE_QUOTA_MAX_NUM_CLIENTS			30000			// Limit number of IKE_CLIENT
149 #define	IKE_QUOTA_MAX_SA_PER_CLIENT			100				// The limit number of SA for each IKE_CLIENT
150 
151 // Time-out
152 #define	IKE_TIMEOUT_FOR_IKE_CLIENT			150000			// IKE_CLIENT non-communication disconnect time
153 #define	IKE_TIMEOUT_FOR_IKE_CLIENT_FOR_NOT_ESTABLISHED		10000 // IKE_CLIENT non-communication disconnect time (connection incomplete)
154 #define	IKE_INTERVAL_UDP_KEEPALIVE			5000			// UDP KeepAlive transmission interval
155 #define	IKE_QUICKMODE_START_INTERVAL		2000			// QuickMode start interval
156 #define	IKE_QUICKMODE_FAILED_TIMEOUT		10000			// Maximum time to tolerant that to fail to establish a QuickMode
157 #define	IKE_INTERVAL_DPD_KEEPALIVE			10000			// DPD KeepAlive transmission interval
158 
159 // Expiration margin
160 #define	IKE_SOFT_EXPIRES_MARGIN				1000			// Expiration margin
161 
162 
163 //// Type
164 
165 // IKE SA transform data
166 struct IKE_SA_TRANSFORM_SETTING
167 {
168 	IKE_CRYPTO *Crypto;
169 	UINT CryptoKeySize;
170 	IKE_HASH *Hash;
171 	IKE_DH *Dh;
172 	UINT CryptoId;
173 	UINT HashId;
174 	UINT DhId;
175 	UINT LifeKilobytes;
176 	UINT LifeSeconds;
177 };
178 
179 // IPsec SA transforms data
180 struct IPSEC_SA_TRANSFORM_SETTING
181 {
182 	IKE_CRYPTO *Crypto;
183 	UINT CryptoKeySize;
184 	IKE_HASH *Hash;
185 	IKE_DH *Dh;
186 	UINT CryptoId;
187 	UINT HashId;
188 	UINT DhId;
189 	UINT LifeKilobytes;
190 	UINT LifeSeconds;
191 	UINT SpiServerToClient;
192 	UINT CapsuleMode;
193 	bool OnlyCapsuleModeIsInvalid;
194 };
195 
196 // Function support information
197 struct IKE_CAPS
198 {
199 	// Support Information
200 	bool NatTraversalRfc3947;		// RFC 3947 Negotiation of NAT-Traversal in the IKE
201 	bool NatTraversalDraftIetf;		// draft-ietf-ipsec-nat-t-ike
202 	bool DpdRfc3706;				// RFC 3706 A Traffic-Based Method of Detecting Dead Internet Key Exchange (IKE) Peers
203 	bool MS_L2TPIPSecVPNClient;		// Vendor ID: Microsoft L2TP/IPSec VPN Client
204 	bool MS_NT5_ISAKMP_OAKLEY;		// Vendor ID: MS NT5 ISAKMPOAKLEY
205 	bool MS_Vid_InitialContact;		// Vendor ID: Microsoft Vid-Initial-Contact
206 
207 	// Use information
208 	bool UsingNatTraversalRfc3947;
209 	bool UsingNatTraversalDraftIetf;
210 };
211 
212 // IKE / IPsec client
213 struct IKE_CLIENT
214 {
215 	UINT Id;
216 	IP ClientIP;
217 	UINT ClientPort;
218 	IP ServerIP;
219 	UINT ServerPort;
220 	IKE_SA *CurrentIkeSa;						// IKE SA to be used currently
221 	IPSECSA *CurrentIpSecSaRecv;				// IPsec SA to be used currently (receive direction)
222 	IPSECSA *CurrentIpSecSaSend;				// IPsec SA to be currently in use (transmit direction)
223 	UINT64 FirstCommTick;						// Time the first data communication
224 	UINT64 LastCommTick;						// Time that made the last communication (received data) time
225 	bool Deleting;								// Deleting
226 	UINT64 NextKeepAliveSendTick;				// Time to send the next KeepAlive
227 	UINT64 NextDpdSendTick;						// Time to send the next DPD
228 	UINT DpdSeqNo;								// DPD sequence number
229 	char ClientId[128];							// ID presented by the client
230 	char Secret[MAX_SIZE];						// Secret value of the authentication is successful
231 
232 	bool IsMicrosoft;							// Whether the client is Microsoft's
233 
234 	IPSEC_SA_TRANSFORM_SETTING CachedTransformSetting;	// Cached transform attribute value
235 	UINT64 CurrentExpiresSoftTick_StoC;			// The maximum value of the flexible expiration date of the current (server -> client)
236 	UINT64 CurrentExpiresSoftTick_CtoS;			// The maximum value of the flexible expiration date of the current (client -> server)
237 	UINT CurrentNumEstablishedIPsecSA_StoC;		// The number of IPsec SA currently active (server -> client)
238 	UINT CurrentNumEstablishedIPsecSA_CtoS;		// The number of IPsec SA currently active (client -> server)
239 	UINT CurrentNumHealtyIPsecSA_CtoS;			// The number of currently available IPsec SA which expiration well within (client -> server)
240 	UINT CurrentNumHealtyIPsecSA_StoC;			// The number of currently available IPsec SA which expiration well within (server -> client)
241 	bool SendID1andID2;							// Whether to send the ID in QM
242 	UCHAR SendID1_Type, SendID2_Type;
243 	UCHAR SendID1_Protocol, SendID2_Protocol;
244 	USHORT SendID1_Port, SendID2_Port;
245 	BUF *SendID1_Buf, *SendID2_Buf;
246 	bool SendNatOaDraft1, SendNatOaDraft2, SendNatOaRfc;	// Whether to send the NAT-OA in QM
247 	bool StartQuickModeAsSoon;					// Flag to indicate to the start of the Quick Mode as soon as possible
248 	UINT64 LastQuickModeStartTick;				// Time which the last QuickMode started
249 	UINT64 NeedQmBeginTick;						// Time which a start-up of QuickMode is required
250 
251 	// L2TP related
252 	L2TP_SERVER *L2TP;							// L2TP server
253 	UINT L2TPClientPort;						// Client-side port number of L2TP
254 	IP L2TPServerIP, L2TPClientIP;				// IP address used by the L2TP processing
255 	bool IsL2TPOnIPsecTunnelMode;				// Whether the L2TP is working on IPsec tunnel mode
256 
257 	// EtherIP related
258 	ETHERIP_SERVER *EtherIP;					// EtherIP server
259 	bool IsEtherIPOnIPsecTunnelMode;			// Whether the EtherIP is working on IPsec tunnel mode
260 
261 	// Transport mode related
262 	IP TransportModeServerIP;
263 	IP TransportModeClientIP;
264 	bool ShouldCalcChecksumForUDP;				// Flag to calculate the checksum for the UDP packet
265 
266 	// Tunnel mode related
267 	IP TunnelModeServerIP;						// Server-side internal IP address
268 	IP TunnelModeClientIP;						// Client-side internal IP address
269 	USHORT TunnelSendIpId;						// ID of the transmission IP header
270 };
271 
272 // IKE SA
273 struct IKE_SA
274 {
275 	UINT Id;
276 	IKE_CLIENT *IkeClient;						// Pointer to the IKE client
277 	UINT64 InitiatorCookie, ResponderCookie;	// Cookie
278 	UINT Mode;									// Mode
279 	UINT State;									// State
280 	BUF *SendBuffer;							// Buffer during transmission
281 	UINT64 NextSendTick;						// Next transmission time
282 	UINT64 FirstCommTick;						// Time that the first data communication
283 	UINT64 EstablishedTick;						// Time that the SA has been established
284 	UINT64 LastCommTick;						// Time that made the last communication (received data) time
285 	IKE_SA_TRANSFORM_SETTING TransformSetting;	// Transform Configuration
286 	IKE_CAPS Caps;								// IKE Caps
287 	BUF *InitiatorRand, *ResponderRand;			// Random number
288 	BUF *DhSharedKey;							// DH common key
289 	BUF *GXi, *GXr;								// DH exchange data
290 	BUF *SAi_b;									// Data needed for authentication
291 	BUF *YourIDPayloadForAM;					// Copy the ID payload of the client-side
292 	UCHAR SKEYID[IKE_MAX_HASH_SIZE];			// Key set
293 	UCHAR SKEYID_d[IKE_MAX_HASH_SIZE];
294 	UCHAR SKEYID_a[IKE_MAX_HASH_SIZE];
295 	UCHAR SKEYID_e[IKE_MAX_HASH_SIZE];
296 	UCHAR InitiatorHashForAM[IKE_MAX_HASH_SIZE];
297 	IKE_CRYPTO_KEY *CryptoKey;					// Common encryption key
298 	UINT HashSize;								// Hash size
299 	UINT KeySize;								// Key size
300 	UINT BlockSize;								// Block size
301 	UCHAR Iv[IKE_MAX_BLOCK_SIZE];				// IV
302 	bool IsIvExisting;							// Whether an IV exists
303 	bool Established;							// Established flag
304 	bool Deleting;								// Deleting
305 	UINT NumResends;							// The number of retransmissions
306 	char Secret[MAX_SIZE];						// Secret value of the authentication is successful
307 };
308 
309 // IPsec SA
310 struct IPSECSA
311 {
312 	UINT Id;
313 	IKE_CLIENT *IkeClient;						// Pointer to the IKE client
314 	IKE_SA *IkeSa;								// Pointer to IKE_SA to use for transmission
315 	UCHAR Iv[IKE_MAX_BLOCK_SIZE];				// IV used in the Quick Mode exchange
316 	bool IsIvExisting;							// Whether the IV exists
317 	UINT MessageId;								// Message ID used in Quick Mode exchange
318 	UINT Spi;									// SPI
319 	UINT CurrentSeqNo;							// Send sequence number
320 	BUF *SendBuffer;							// Buffer during transmission
321 	UINT NumResends;							// The number of retransmissions
322 	UINT64 NextSendTick;						// Next transmission date and time
323 	UINT64 FirstCommTick;						// Time the last data sent
324 	UINT64 EstablishedTick;						// Time that the SA has been established
325 	UINT64 LastCommTick;						// Time that made the last communication (received data) time
326 	UINT64 ExpiresHardTick;						// Exact expiration time
327 	UINT64 ExpiresSoftTick;						// Flexible expiration time
328 	UINT64 TotalSize;							// Size sent to and received
329 	IPSEC_SA_TRANSFORM_SETTING TransformSetting;	// Transform Configuration
330 	bool ServerToClient;						// Whether is upload direction
331 	IPSECSA *PairIPsecSa;						// IPsec SA that are paired
332 	bool Established;							// Established flag
333 	BUF *InitiatorRand, *ResponderRand;			// Random number
334 	BUF *SharedKey;								// PFS shared key
335 	UCHAR Hash3[IKE_MAX_HASH_SIZE];				// Hash 3
336 	UCHAR KeyMat[IKE_MAX_KEY_SIZE + IKE_MAX_HASH_SIZE];	// Encryption key
337 	UCHAR HashKey[IKE_MAX_HASH_SIZE];			// Hash key
338 	IKE_CRYPTO_KEY *CryptoKey;					// Key data
339 	bool Deleting;								// Deleting
340 	UCHAR EspIv[IKE_MAX_BLOCK_SIZE];			// IV for ESP communication
341 	bool Initiated;								// The server-side is initiator
342 	DH_CTX *Dh;									// DH (only if the server-side is initiator)
343 	bool StartQM_FlagSet;						// Whether the flag to indicate to do the QM is set to the IKE_CLIENT
344 	UCHAR SKEYID_d[IKE_MAX_HASH_SIZE];
345 	UCHAR SKEYID_a[IKE_MAX_HASH_SIZE];
346 	IKE_HASH *SKEYID_Hash;
347 };
348 
349 // IKE server
350 struct IKE_SERVER
351 {
352 	CEDAR *Cedar;
353 	IPSEC_SERVER *IPsec;
354 	UINT64 Now;									// Current time
355 	LIST *SendPacketList;						// Transmission packet
356 	INTERRUPT_MANAGER *Interrupts;				// Interrupt manager
357 	SOCK_EVENT *SockEvent;						// SockEvent
358 	IKE_ENGINE *Engine;							// Encryption engine
359 	LIST *ClientList;							// Client list
360 	LIST *IkeSaList;							// SA list
361 	LIST *IPsecSaList;							// IPsec SA list
362 	LIST *ThreadList;							// L2TP thread list
363 	bool StateHasChanged;						// Flag whether the state has changed
364 	UINT CurrentIkeSaId, CurrentIPsecSaId, CurrentIkeClientId, CurrentEtherId;	// Serial number ID
365 
366 	// Setting data
367 	char Secret[MAX_SIZE];						// Pre-shared key
368 };
369 
370 
371 //// Function prototype
372 IKE_SERVER *NewIKEServer(CEDAR *cedar, IPSEC_SERVER *ipsec);
373 void FreeIKEServer(IKE_SERVER *ike);
374 void SetIKEServerSockEvent(IKE_SERVER *ike, SOCK_EVENT *e);
375 void ProcIKEPacketRecv(IKE_SERVER *ike, UDPPACKET *p);
376 void StopIKEServer(IKE_SERVER *ike);
377 void ProcessIKEInterrupts(IKE_SERVER *ike);
378 IKE_PACKET *ParseIKEPacketHeader(UDPPACKET *p);
379 void ProcIkeMainModePacketRecv(IKE_SERVER *ike, UDPPACKET *p, IKE_PACKET *header);
380 void ProcIkeQuickModePacketRecv(IKE_SERVER *ike, UDPPACKET *p, IKE_PACKET *header);
381 void ProcIkeAggressiveModePacketRecv(IKE_SERVER *ike, UDPPACKET *p, IKE_PACKET *header);
382 void ProcIkeInformationalExchangePacketRecv(IKE_SERVER *ike, UDPPACKET *p, IKE_PACKET *header);
383 void FreeIkeSa(IKE_SA *sa);
384 void FreeIkeClient(IKE_SERVER *ike, IKE_CLIENT *c);
385 UINT64 GenerateNewResponserCookie(IKE_SERVER *ike);
386 bool GetBestTransformSettingForIkeSa(IKE_SERVER *ike, IKE_PACKET *pr, IKE_SA_TRANSFORM_SETTING *setting);
387 bool TransformPayloadToTransformSettingForIkeSa(IKE_SERVER *ike, IKE_PACKET_TRANSFORM_PAYLOAD *transform, IKE_SA_TRANSFORM_SETTING *setting);
388 IKE_CLIENT *SearchIkeClientForIkePacket(IKE_SERVER *ike, IP *client_ip, UINT client_port, IP *server_ip, UINT server_port, IKE_PACKET *pr);
389 IKE_CLIENT *SearchOrCreateNewIkeClientForIkePacket(IKE_SERVER *ike, IP *client_ip, UINT client_port, IP *server_ip, UINT server_port, IKE_PACKET *pr);
390 UINT GetNumberOfIkeClientsFromIP(IKE_SERVER *ike, IP *client_ip);
391 UINT GetNumberOfIPsecSaOfIkeClient(IKE_SERVER *ike, IKE_CLIENT *c);
392 UINT GetNumberOfIkeSaOfIkeClient(IKE_SERVER *ike, IKE_CLIENT *c);
393 int CmpIkeClient(void *p1, void *p2);
394 int CmpIkeSa(void *p1, void *p2);
395 int CmpIPsecSa(void *p1, void *p2);
396 IKE_SA *FindIkeSaByEndPointAndInitiatorCookie(IKE_SERVER *ike, IP *client_ip, UINT client_port, IP *server_ip, UINT server_port, UINT64 init_cookie, UINT mode);
397 IKE_SA *FindIkeSaByResponderCookie(IKE_SERVER *ike, UINT64 responder_cookie);
398 IKE_SA *FindIkeSaByResponderCookieAndClient(IKE_SERVER *ike, UINT64 responder_cookie, IKE_CLIENT *c);
399 IKE_CLIENT *NewIkeClient(IKE_SERVER *ike, IP *client_ip, UINT client_port, IP *server_ip, UINT server_port);
400 IKE_CLIENT *SetIkeClientEndpoint(IKE_SERVER *ike, IKE_CLIENT *c, IP *client_ip, UINT client_port, IP *server_ip, UINT server_port);
401 IKE_SA *NewIkeSa(IKE_SERVER *ike, IKE_CLIENT *c, UINT64 init_cookie, UINT mode, IKE_SA_TRANSFORM_SETTING *setting);
402 IKE_PACKET_PAYLOAD *TransformSettingToTransformPayloadForIke(IKE_SERVER *ike, IKE_SA_TRANSFORM_SETTING *setting);
403 void IkeSaSendPacket(IKE_SERVER *ike, IKE_SA *sa, IKE_PACKET *p);
404 IKE_PACKET *IkeSaRecvPacket(IKE_SERVER *ike, IKE_SA *sa, void *data, UINT size);
405 void IkeSendUdpPacket(IKE_SERVER *ike, UINT type, IP *server_ip, UINT server_port, IP *client_ip, UINT client_port, void *data, UINT size);
406 void IkeAddVendorIdPayloads(IKE_PACKET *p);
407 BUF *IkeStrToVendorId(char *str);
408 void IkeAddVendorId(IKE_PACKET *p, char *str);
409 bool IkeIsVendorIdExists(IKE_PACKET *p, char *str);
410 void IkeCheckCaps(IKE_CAPS *caps, IKE_PACKET *p);
411 BUF *IkeCalcNatDetectHash(IKE_SERVER *ike, IKE_HASH *hash, UINT64 initiator_cookie, UINT64 responder_cookie, IP *ip, UINT port);
412 void IkeCalcSaKeySet(IKE_SERVER *ike, IKE_SA *sa, char *secret);
413 IKE_CRYPTO_KEY *IkeNewCryptoKeyFromK(IKE_SERVER *ike, void *k, UINT k_size, IKE_HASH *h, IKE_CRYPTO *c, UINT crypto_key_size);
414 BUF *IkeExpandKeySize(IKE_HASH *h, void *k, UINT k_size, UINT target_size);
415 void IkeSaUpdateIv(IKE_SA *sa, void *iv, UINT iv_size);
416 IPSECSA *NewIPsecSa(IKE_SERVER *ike, IKE_CLIENT *c, IKE_SA *ike_sa, bool initiate, UINT message_id, bool server_to_client, void *iv, UINT spi, void *init_rand_data, UINT init_rand_size, void *res_rand_data, UINT res_rand_size, IPSEC_SA_TRANSFORM_SETTING *setting, void *shared_key_data, UINT shared_key_size);
417 void IkeCalcPhase2InitialIv(void *iv, IKE_SA *sa, UINT message_id);
418 bool GetBestTransformSettingForIPsecSa(IKE_SERVER *ike, IKE_PACKET *pr, IPSEC_SA_TRANSFORM_SETTING *setting, IP *server_ip);
419 bool TransformPayloadToTransformSettingForIPsecSa(IKE_SERVER *ike, IKE_PACKET_TRANSFORM_PAYLOAD *transform, IPSEC_SA_TRANSFORM_SETTING *setting, IP *server_ip);
420 IKE_PACKET_PAYLOAD *TransformSettingToTransformPayloadForIPsec(IKE_SERVER *ike, IPSEC_SA_TRANSFORM_SETTING *setting);
421 UINT GenerateNewIPsecSaSpi(IKE_SERVER *ike, UINT counterpart_spi);
422 IPSECSA *SearchClientToServerIPsecSaBySpi(IKE_SERVER *ike, UINT spi);
423 IPSECSA *SearchIPsecSaBySpi(IKE_SERVER *ike, IKE_CLIENT *c, UINT spi);
424 IPSECSA *SearchIPsecSaByMessageId(IKE_SERVER *ike, IKE_CLIENT *c, UINT message_id);
425 void IPsecSaSendPacket(IKE_SERVER *ike, IPSECSA *sa, IKE_PACKET *p);
426 IKE_PACKET *IPsecSaRecvPacket(IKE_SERVER *ike, IPSECSA *sa, void *data, UINT size);
427 void IPsecSaUpdateIv(IPSECSA *sa, void *iv, UINT iv_size);
428 void ProcDeletePayload(IKE_SERVER *ike, IKE_CLIENT *c, IKE_PACKET_DELETE_PAYLOAD *d);
429 void MarkIPsecSaAsDeleted(IKE_SERVER *ike, IPSECSA *sa);
430 void MarkIkeSaAsDeleted(IKE_SERVER *ike, IKE_SA *sa);
431 void PurgeDeletingSAsAndClients(IKE_SERVER *ike);
432 void PurgeIPsecSa(IKE_SERVER *ike, IPSECSA *sa);
433 void PurgeIkeSa(IKE_SERVER *ike, IKE_SA *sa);
434 void PurgeIkeClient(IKE_SERVER *ike, IKE_CLIENT *c);
435 void FreeIPsecSa(IPSECSA *sa);
436 void MarkIkeClientAsDeleted(IKE_SERVER *ike, IKE_CLIENT *c);
437 IKE_SA *GetOtherLatestIkeSa(IKE_SERVER *ike, IKE_SA *sa);
438 IPSECSA *GetOtherLatestIPsecSa(IKE_SERVER *ike, IPSECSA *sa);
439 void SendInformationalExchangePacket(IKE_SERVER *ike, IKE_CLIENT *c, IKE_PACKET_PAYLOAD *payload);
440 void SendInformationalExchangePacketEx(IKE_SERVER *ike, IKE_CLIENT *c, IKE_PACKET_PAYLOAD *payload, bool force_plain, UINT64 init_cookie, UINT64 resp_cookie);
441 void SendDeleteIkeSaPacket(IKE_SERVER *ike, IKE_CLIENT *c, UINT64 init_cookie, UINT64 resp_cookie);
442 void SendDeleteIPsecSaPacket(IKE_SERVER *ike, IKE_CLIENT *c, UINT spi);
443 void IPsecCalcKeymat(IKE_SERVER *ike, IKE_HASH *h, void *dst, UINT dst_size, void *skeyid_d_data, UINT skeyid_d_size, UCHAR protocol, UINT spi, void *rand_init_data, UINT rand_init_size,
444 					 void *rand_resp_data, UINT rand_resp_size, void *df_key_data, UINT df_key_size);
445 
446 void ProcIPsecEspPacketRecv(IKE_SERVER *ike, UDPPACKET *p);
447 void ProcIPsecUdpPacketRecv(IKE_SERVER *ike, IKE_CLIENT *c, UCHAR *data, UINT data_size);
448 void IPsecSendPacketByIPsecSa(IKE_SERVER *ike, IPSECSA *sa, UCHAR *data, UINT data_size, UCHAR protocol_id);
449 void IPsecSendPacketByIPsecSaInner(IKE_SERVER *ike, IPSECSA *sa, UCHAR *data, UINT data_size, UCHAR protocol_id);
450 void IPsecSendPacketByIkeClient(IKE_SERVER *ike, IKE_CLIENT *c, UCHAR *data, UINT data_size, UCHAR protocol_id);
451 void IPsecSendUdpPacket(IKE_SERVER *ike, IKE_CLIENT *c, UINT src_port, UINT dst_port, UCHAR *data, UINT data_size);
452 void IPsecIkeClientManageL2TPServer(IKE_SERVER *ike, IKE_CLIENT *c);
453 void IPsecIkeClientSendL2TPPackets(IKE_SERVER *ike, IKE_CLIENT *c, L2TP_SERVER *l2tp);
454 void IPsecIkeSendUdpForDebug(UINT dst_port, UINT dst_ip, void *data, UINT size);
455 void StartQuickMode(IKE_SERVER *ike, IKE_CLIENT *c);
456 UINT GenerateNewMessageId(IKE_SERVER *ike);
457 
458 void IPsecIkeClientManageEtherIPServer(IKE_SERVER *ike, IKE_CLIENT *c);
459 void IPsecIkeClientSendEtherIPPackets(IKE_SERVER *ike, IKE_CLIENT *c, ETHERIP_SERVER *s);
460 void ProcIPsecEtherIPPacketRecv(IKE_SERVER *ike, IKE_CLIENT *c, UCHAR *data, UINT data_size, bool is_tunnel_mode);
461 bool IsIPsecSaTunnelMode(IPSECSA *sa);
462 void ProcL2TPv3PacketRecv(IKE_SERVER *ike, IKE_CLIENT *c, UCHAR *data, UINT data_size, bool is_tunnel_mode);
463 
464 IKE_SA *SearchIkeSaByCookie(IKE_SERVER *ike, UINT64 init_cookie, UINT64 resp_cookie);
465 
466 #endif	// IPSEC_IKE_H
467 
468