1 // SoftEther VPN Source Code - Stable Edition Repository 2 // Cedar Communication Module 3 // 4 // SoftEther VPN Server, Client and Bridge are free software under the Apache License, Version 2.0. 5 // 6 // Copyright (c) Daiyuu Nobori. 7 // Copyright (c) SoftEther VPN Project, University of Tsukuba, Japan. 8 // Copyright (c) SoftEther Corporation. 9 // Copyright (c) all contributors on SoftEther VPN project in GitHub. 10 // 11 // All Rights Reserved. 12 // 13 // http://www.softether.org/ 14 // 15 // This stable branch is officially managed by Daiyuu Nobori, the owner of SoftEther VPN Project. 16 // Pull requests should be sent to the Developer Edition Master Repository on https://github.com/SoftEtherVPN/SoftEtherVPN 17 // 18 // License: The Apache License, Version 2.0 19 // https://www.apache.org/licenses/LICENSE-2.0 20 // 21 // DISCLAIMER 22 // ========== 23 // 24 // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 25 // IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 26 // FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 27 // AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 28 // LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 29 // OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 30 // SOFTWARE. 31 // 32 // THIS SOFTWARE IS DEVELOPED IN JAPAN, AND DISTRIBUTED FROM JAPAN, UNDER 33 // JAPANESE LAWS. YOU MUST AGREE IN ADVANCE TO USE, COPY, MODIFY, MERGE, PUBLISH, 34 // DISTRIBUTE, SUBLICENSE, AND/OR SELL COPIES OF THIS SOFTWARE, THAT ANY 35 // JURIDICAL DISPUTES WHICH ARE CONCERNED TO THIS SOFTWARE OR ITS CONTENTS, 36 // AGAINST US (SOFTETHER PROJECT, SOFTETHER CORPORATION, DAIYUU NOBORI OR OTHER 37 // SUPPLIERS), OR ANY JURIDICAL DISPUTES AGAINST US WHICH ARE CAUSED BY ANY KIND 38 // OF USING, COPYING, MODIFYING, MERGING, PUBLISHING, DISTRIBUTING, SUBLICENSING, 39 // AND/OR SELLING COPIES OF THIS SOFTWARE SHALL BE REGARDED AS BE CONSTRUED AND 40 // CONTROLLED BY JAPANESE LAWS, AND YOU MUST FURTHER CONSENT TO EXCLUSIVE 41 // JURISDICTION AND VENUE IN THE COURTS SITTING IN TOKYO, JAPAN. YOU MUST WAIVE 42 // ALL DEFENSES OF LACK OF PERSONAL JURISDICTION AND FORUM NON CONVENIENS. 43 // PROCESS MAY BE SERVED ON EITHER PARTY IN THE MANNER AUTHORIZED BY APPLICABLE 44 // LAW OR COURT RULE. 45 // 46 // USE ONLY IN JAPAN. DO NOT USE THIS SOFTWARE IN ANOTHER COUNTRY UNLESS YOU HAVE 47 // A CONFIRMATION THAT THIS SOFTWARE DOES NOT VIOLATE ANY CRIMINAL LAWS OR CIVIL 48 // RIGHTS IN THAT PARTICULAR COUNTRY. USING THIS SOFTWARE IN OTHER COUNTRIES IS 49 // COMPLETELY AT YOUR OWN RISK. THE SOFTETHER VPN PROJECT HAS DEVELOPED AND 50 // DISTRIBUTED THIS SOFTWARE TO COMPLY ONLY WITH THE JAPANESE LAWS AND EXISTING 51 // CIVIL RIGHTS INCLUDING PATENTS WHICH ARE SUBJECTS APPLY IN JAPAN. OTHER 52 // COUNTRIES' LAWS OR CIVIL RIGHTS ARE NONE OF OUR CONCERNS NOR RESPONSIBILITIES. 53 // WE HAVE NEVER INVESTIGATED ANY CRIMINAL REGULATIONS, CIVIL LAWS OR 54 // INTELLECTUAL PROPERTY RIGHTS INCLUDING PATENTS IN ANY OF OTHER 200+ COUNTRIES 55 // AND TERRITORIES. BY NATURE, THERE ARE 200+ REGIONS IN THE WORLD, WITH 56 // DIFFERENT LAWS. IT IS IMPOSSIBLE TO VERIFY EVERY COUNTRIES' LAWS, REGULATIONS 57 // AND CIVIL RIGHTS TO MAKE THE SOFTWARE COMPLY WITH ALL COUNTRIES' LAWS BY THE 58 // PROJECT. EVEN IF YOU WILL BE SUED BY A PRIVATE ENTITY OR BE DAMAGED BY A 59 // PUBLIC SERVANT IN YOUR COUNTRY, THE DEVELOPERS OF THIS SOFTWARE WILL NEVER BE 60 // LIABLE TO RECOVER OR COMPENSATE SUCH DAMAGES, CRIMINAL OR CIVIL 61 // RESPONSIBILITIES. NOTE THAT THIS LINE IS NOT LICENSE RESTRICTION BUT JUST A 62 // STATEMENT FOR WARNING AND DISCLAIMER. 63 // 64 // READ AND UNDERSTAND THE 'WARNING.TXT' FILE BEFORE USING THIS SOFTWARE. 65 // SOME SOFTWARE PROGRAMS FROM THIRD PARTIES ARE INCLUDED ON THIS SOFTWARE WITH 66 // LICENSE CONDITIONS WHICH ARE DESCRIBED ON THE 'THIRD_PARTY.TXT' FILE. 67 // 68 // 69 // SOURCE CODE CONTRIBUTION 70 // ------------------------ 71 // 72 // Your contribution to SoftEther VPN Project is much appreciated. 73 // Please send patches to us through GitHub. 74 // Read the SoftEther VPN Patch Acceptance Policy in advance: 75 // http://www.softether.org/5-download/src/9.patch 76 // 77 // 78 // DEAR SECURITY EXPERTS 79 // --------------------- 80 // 81 // If you find a bug or a security vulnerability please kindly inform us 82 // about the problem immediately so that we can fix the security problem 83 // to protect a lot of users around the world as soon as possible. 84 // 85 // Our e-mail address for security reports is: 86 // softether-vpn-security [at] softether.org 87 // 88 // Please note that the above e-mail address is not a technical support 89 // inquiry address. If you need technical assistance, please visit 90 // http://www.softether.org/ and ask your question on the users forum. 91 // 92 // Thank you for your cooperation. 93 // 94 // 95 // NO MEMORY OR RESOURCE LEAKS 96 // --------------------------- 97 // 98 // The memory-leaks and resource-leaks verification under the stress 99 // test has been passed before release this source code. 100 101 102 // IPsec_IKE.h 103 // Header of IPsec_IKE.c 104 105 #ifndef IPSEC_IKE_H 106 #define IPSEC_IKE_H 107 108 //// Macro 109 110 //// Constants 111 112 // State 113 #define IKE_SA_MAIN_MODE 0 // Main mode 114 #define IKE_SA_AGRESSIVE_MODE 1 // Aggressive mode 115 116 #define IKE_SA_MM_STATE_1_SA 0 // Main mode state 1 (SA exchange is complete. Wait for key exchange) 117 #define IKE_SA_MM_STATE_2_KEY 1 // Main mode state 2 (Key exchange is complete. Wait for exchange ID) 118 #define IKE_SA_MM_STATE_3_ESTABLISHED 2 // Main mode state 3 (ID exchange is complete. Established) 119 120 #define IKE_SA_AM_STATE_1_SA 0 // Aggressive mode state 1 (SA exchange is completed. Wait for hash) 121 #define IKE_SA_AM_STATE_2_ESTABLISHED 1 // Aggressive mode state 2 (Hash exchange is completed. Established) 122 123 #define IKE_SA_RESEND_INTERVAL (2 * 1000) // IKE SA packet retransmission interval 124 #define IKE_SA_RAND_SIZE 16 // Size of the random number 125 126 // ESP 127 #define IKE_ESP_HASH_SIZE 12 // The hash size for the ESP packet 128 129 // Type of UDP packet 130 #define IKE_UDP_TYPE_ISAKMP 0 // ISAKMP packet (destination 500) 131 #define IKE_UDP_TYPE_ESP 1 // ESP packet (destination 4500) 132 #define IKE_UDP_KEEPALIVE 2 // KeepAlive packet 133 #define IKE_UDP_SPECIAL 3 // Special packet 134 135 // String for Vendor ID 136 #define IKE_VENDOR_ID_RFC3947_NAT_T "0x4a131c81070358455c5728f20e95452f" 137 #define IKE_VENDOR_ID_IPSEC_NAT_T_IKE_03 "0x7d9419a65310ca6f2c179d9215529d56" 138 #define IKE_VENDOR_ID_IPSEC_NAT_T_IKE_02 "0x90cb80913ebb696e086381b5ec427b1f" 139 #define IKE_VENDOR_ID_IPSEC_NAT_T_IKE_02_2 "0xcd60464335df21f87cfdb2fc68b6a448" 140 #define IKE_VENDOR_ID_IPSEC_NAT_T_IKE_00 "0x4485152d18b6bbcd0be8a8469579ddcc" 141 #define IKE_VENDOR_ID_RFC3706_DPD "0xafcad71368a1f1c96b8696fc77570100" 142 #define IKE_VENDOR_ID_MICROSOFT_L2TP "0x4048b7d56ebce88525e7de7f00d6c2d3" 143 #define IKE_VENDOR_ID_MS_NT5_ISAKMPOAKLEY "0x1e2b516905991c7d7c96fcbfb587e461" 144 #define IKE_VENDOR_ID_MS_VID_INITIALCONTACT "0x26244d38eddb61b3172a36e3d0cfb819" 145 146 // Quota 147 #define IKE_QUOTA_MAX_NUM_CLIENTS_PER_IP 1000 // The number of IKE_CLIENT per IP address 148 #define IKE_QUOTA_MAX_NUM_CLIENTS 30000 // Limit number of IKE_CLIENT 149 #define IKE_QUOTA_MAX_SA_PER_CLIENT 100 // The limit number of SA for each IKE_CLIENT 150 151 // Time-out 152 #define IKE_TIMEOUT_FOR_IKE_CLIENT 150000 // IKE_CLIENT non-communication disconnect time 153 #define IKE_TIMEOUT_FOR_IKE_CLIENT_FOR_NOT_ESTABLISHED 10000 // IKE_CLIENT non-communication disconnect time (connection incomplete) 154 #define IKE_INTERVAL_UDP_KEEPALIVE 5000 // UDP KeepAlive transmission interval 155 #define IKE_QUICKMODE_START_INTERVAL 2000 // QuickMode start interval 156 #define IKE_QUICKMODE_FAILED_TIMEOUT 10000 // Maximum time to tolerant that to fail to establish a QuickMode 157 #define IKE_INTERVAL_DPD_KEEPALIVE 10000 // DPD KeepAlive transmission interval 158 159 // Expiration margin 160 #define IKE_SOFT_EXPIRES_MARGIN 1000 // Expiration margin 161 162 163 //// Type 164 165 // IKE SA transform data 166 struct IKE_SA_TRANSFORM_SETTING 167 { 168 IKE_CRYPTO *Crypto; 169 UINT CryptoKeySize; 170 IKE_HASH *Hash; 171 IKE_DH *Dh; 172 UINT CryptoId; 173 UINT HashId; 174 UINT DhId; 175 UINT LifeKilobytes; 176 UINT LifeSeconds; 177 }; 178 179 // IPsec SA transforms data 180 struct IPSEC_SA_TRANSFORM_SETTING 181 { 182 IKE_CRYPTO *Crypto; 183 UINT CryptoKeySize; 184 IKE_HASH *Hash; 185 IKE_DH *Dh; 186 UINT CryptoId; 187 UINT HashId; 188 UINT DhId; 189 UINT LifeKilobytes; 190 UINT LifeSeconds; 191 UINT SpiServerToClient; 192 UINT CapsuleMode; 193 bool OnlyCapsuleModeIsInvalid; 194 }; 195 196 // Function support information 197 struct IKE_CAPS 198 { 199 // Support Information 200 bool NatTraversalRfc3947; // RFC 3947 Negotiation of NAT-Traversal in the IKE 201 bool NatTraversalDraftIetf; // draft-ietf-ipsec-nat-t-ike 202 bool DpdRfc3706; // RFC 3706 A Traffic-Based Method of Detecting Dead Internet Key Exchange (IKE) Peers 203 bool MS_L2TPIPSecVPNClient; // Vendor ID: Microsoft L2TP/IPSec VPN Client 204 bool MS_NT5_ISAKMP_OAKLEY; // Vendor ID: MS NT5 ISAKMPOAKLEY 205 bool MS_Vid_InitialContact; // Vendor ID: Microsoft Vid-Initial-Contact 206 207 // Use information 208 bool UsingNatTraversalRfc3947; 209 bool UsingNatTraversalDraftIetf; 210 }; 211 212 // IKE / IPsec client 213 struct IKE_CLIENT 214 { 215 UINT Id; 216 IP ClientIP; 217 UINT ClientPort; 218 IP ServerIP; 219 UINT ServerPort; 220 IKE_SA *CurrentIkeSa; // IKE SA to be used currently 221 IPSECSA *CurrentIpSecSaRecv; // IPsec SA to be used currently (receive direction) 222 IPSECSA *CurrentIpSecSaSend; // IPsec SA to be currently in use (transmit direction) 223 UINT64 FirstCommTick; // Time the first data communication 224 UINT64 LastCommTick; // Time that made the last communication (received data) time 225 bool Deleting; // Deleting 226 UINT64 NextKeepAliveSendTick; // Time to send the next KeepAlive 227 UINT64 NextDpdSendTick; // Time to send the next DPD 228 UINT DpdSeqNo; // DPD sequence number 229 char ClientId[128]; // ID presented by the client 230 char Secret[MAX_SIZE]; // Secret value of the authentication is successful 231 232 bool IsMicrosoft; // Whether the client is Microsoft's 233 234 IPSEC_SA_TRANSFORM_SETTING CachedTransformSetting; // Cached transform attribute value 235 UINT64 CurrentExpiresSoftTick_StoC; // The maximum value of the flexible expiration date of the current (server -> client) 236 UINT64 CurrentExpiresSoftTick_CtoS; // The maximum value of the flexible expiration date of the current (client -> server) 237 UINT CurrentNumEstablishedIPsecSA_StoC; // The number of IPsec SA currently active (server -> client) 238 UINT CurrentNumEstablishedIPsecSA_CtoS; // The number of IPsec SA currently active (client -> server) 239 UINT CurrentNumHealtyIPsecSA_CtoS; // The number of currently available IPsec SA which expiration well within (client -> server) 240 UINT CurrentNumHealtyIPsecSA_StoC; // The number of currently available IPsec SA which expiration well within (server -> client) 241 bool SendID1andID2; // Whether to send the ID in QM 242 UCHAR SendID1_Type, SendID2_Type; 243 UCHAR SendID1_Protocol, SendID2_Protocol; 244 USHORT SendID1_Port, SendID2_Port; 245 BUF *SendID1_Buf, *SendID2_Buf; 246 bool SendNatOaDraft1, SendNatOaDraft2, SendNatOaRfc; // Whether to send the NAT-OA in QM 247 bool StartQuickModeAsSoon; // Flag to indicate to the start of the Quick Mode as soon as possible 248 UINT64 LastQuickModeStartTick; // Time which the last QuickMode started 249 UINT64 NeedQmBeginTick; // Time which a start-up of QuickMode is required 250 251 // L2TP related 252 L2TP_SERVER *L2TP; // L2TP server 253 UINT L2TPClientPort; // Client-side port number of L2TP 254 IP L2TPServerIP, L2TPClientIP; // IP address used by the L2TP processing 255 bool IsL2TPOnIPsecTunnelMode; // Whether the L2TP is working on IPsec tunnel mode 256 257 // EtherIP related 258 ETHERIP_SERVER *EtherIP; // EtherIP server 259 bool IsEtherIPOnIPsecTunnelMode; // Whether the EtherIP is working on IPsec tunnel mode 260 261 // Transport mode related 262 IP TransportModeServerIP; 263 IP TransportModeClientIP; 264 bool ShouldCalcChecksumForUDP; // Flag to calculate the checksum for the UDP packet 265 266 // Tunnel mode related 267 IP TunnelModeServerIP; // Server-side internal IP address 268 IP TunnelModeClientIP; // Client-side internal IP address 269 USHORT TunnelSendIpId; // ID of the transmission IP header 270 }; 271 272 // IKE SA 273 struct IKE_SA 274 { 275 UINT Id; 276 IKE_CLIENT *IkeClient; // Pointer to the IKE client 277 UINT64 InitiatorCookie, ResponderCookie; // Cookie 278 UINT Mode; // Mode 279 UINT State; // State 280 BUF *SendBuffer; // Buffer during transmission 281 UINT64 NextSendTick; // Next transmission time 282 UINT64 FirstCommTick; // Time that the first data communication 283 UINT64 EstablishedTick; // Time that the SA has been established 284 UINT64 LastCommTick; // Time that made the last communication (received data) time 285 IKE_SA_TRANSFORM_SETTING TransformSetting; // Transform Configuration 286 IKE_CAPS Caps; // IKE Caps 287 BUF *InitiatorRand, *ResponderRand; // Random number 288 BUF *DhSharedKey; // DH common key 289 BUF *GXi, *GXr; // DH exchange data 290 BUF *SAi_b; // Data needed for authentication 291 BUF *YourIDPayloadForAM; // Copy the ID payload of the client-side 292 UCHAR SKEYID[IKE_MAX_HASH_SIZE]; // Key set 293 UCHAR SKEYID_d[IKE_MAX_HASH_SIZE]; 294 UCHAR SKEYID_a[IKE_MAX_HASH_SIZE]; 295 UCHAR SKEYID_e[IKE_MAX_HASH_SIZE]; 296 UCHAR InitiatorHashForAM[IKE_MAX_HASH_SIZE]; 297 IKE_CRYPTO_KEY *CryptoKey; // Common encryption key 298 UINT HashSize; // Hash size 299 UINT KeySize; // Key size 300 UINT BlockSize; // Block size 301 UCHAR Iv[IKE_MAX_BLOCK_SIZE]; // IV 302 bool IsIvExisting; // Whether an IV exists 303 bool Established; // Established flag 304 bool Deleting; // Deleting 305 UINT NumResends; // The number of retransmissions 306 char Secret[MAX_SIZE]; // Secret value of the authentication is successful 307 }; 308 309 // IPsec SA 310 struct IPSECSA 311 { 312 UINT Id; 313 IKE_CLIENT *IkeClient; // Pointer to the IKE client 314 IKE_SA *IkeSa; // Pointer to IKE_SA to use for transmission 315 UCHAR Iv[IKE_MAX_BLOCK_SIZE]; // IV used in the Quick Mode exchange 316 bool IsIvExisting; // Whether the IV exists 317 UINT MessageId; // Message ID used in Quick Mode exchange 318 UINT Spi; // SPI 319 UINT CurrentSeqNo; // Send sequence number 320 BUF *SendBuffer; // Buffer during transmission 321 UINT NumResends; // The number of retransmissions 322 UINT64 NextSendTick; // Next transmission date and time 323 UINT64 FirstCommTick; // Time the last data sent 324 UINT64 EstablishedTick; // Time that the SA has been established 325 UINT64 LastCommTick; // Time that made the last communication (received data) time 326 UINT64 ExpiresHardTick; // Exact expiration time 327 UINT64 ExpiresSoftTick; // Flexible expiration time 328 UINT64 TotalSize; // Size sent to and received 329 IPSEC_SA_TRANSFORM_SETTING TransformSetting; // Transform Configuration 330 bool ServerToClient; // Whether is upload direction 331 IPSECSA *PairIPsecSa; // IPsec SA that are paired 332 bool Established; // Established flag 333 BUF *InitiatorRand, *ResponderRand; // Random number 334 BUF *SharedKey; // PFS shared key 335 UCHAR Hash3[IKE_MAX_HASH_SIZE]; // Hash 3 336 UCHAR KeyMat[IKE_MAX_KEY_SIZE + IKE_MAX_HASH_SIZE]; // Encryption key 337 UCHAR HashKey[IKE_MAX_HASH_SIZE]; // Hash key 338 IKE_CRYPTO_KEY *CryptoKey; // Key data 339 bool Deleting; // Deleting 340 UCHAR EspIv[IKE_MAX_BLOCK_SIZE]; // IV for ESP communication 341 bool Initiated; // The server-side is initiator 342 DH_CTX *Dh; // DH (only if the server-side is initiator) 343 bool StartQM_FlagSet; // Whether the flag to indicate to do the QM is set to the IKE_CLIENT 344 UCHAR SKEYID_d[IKE_MAX_HASH_SIZE]; 345 UCHAR SKEYID_a[IKE_MAX_HASH_SIZE]; 346 IKE_HASH *SKEYID_Hash; 347 }; 348 349 // IKE server 350 struct IKE_SERVER 351 { 352 CEDAR *Cedar; 353 IPSEC_SERVER *IPsec; 354 UINT64 Now; // Current time 355 LIST *SendPacketList; // Transmission packet 356 INTERRUPT_MANAGER *Interrupts; // Interrupt manager 357 SOCK_EVENT *SockEvent; // SockEvent 358 IKE_ENGINE *Engine; // Encryption engine 359 LIST *ClientList; // Client list 360 LIST *IkeSaList; // SA list 361 LIST *IPsecSaList; // IPsec SA list 362 LIST *ThreadList; // L2TP thread list 363 bool StateHasChanged; // Flag whether the state has changed 364 UINT CurrentIkeSaId, CurrentIPsecSaId, CurrentIkeClientId, CurrentEtherId; // Serial number ID 365 366 // Setting data 367 char Secret[MAX_SIZE]; // Pre-shared key 368 }; 369 370 371 //// Function prototype 372 IKE_SERVER *NewIKEServer(CEDAR *cedar, IPSEC_SERVER *ipsec); 373 void FreeIKEServer(IKE_SERVER *ike); 374 void SetIKEServerSockEvent(IKE_SERVER *ike, SOCK_EVENT *e); 375 void ProcIKEPacketRecv(IKE_SERVER *ike, UDPPACKET *p); 376 void StopIKEServer(IKE_SERVER *ike); 377 void ProcessIKEInterrupts(IKE_SERVER *ike); 378 IKE_PACKET *ParseIKEPacketHeader(UDPPACKET *p); 379 void ProcIkeMainModePacketRecv(IKE_SERVER *ike, UDPPACKET *p, IKE_PACKET *header); 380 void ProcIkeQuickModePacketRecv(IKE_SERVER *ike, UDPPACKET *p, IKE_PACKET *header); 381 void ProcIkeAggressiveModePacketRecv(IKE_SERVER *ike, UDPPACKET *p, IKE_PACKET *header); 382 void ProcIkeInformationalExchangePacketRecv(IKE_SERVER *ike, UDPPACKET *p, IKE_PACKET *header); 383 void FreeIkeSa(IKE_SA *sa); 384 void FreeIkeClient(IKE_SERVER *ike, IKE_CLIENT *c); 385 UINT64 GenerateNewResponserCookie(IKE_SERVER *ike); 386 bool GetBestTransformSettingForIkeSa(IKE_SERVER *ike, IKE_PACKET *pr, IKE_SA_TRANSFORM_SETTING *setting); 387 bool TransformPayloadToTransformSettingForIkeSa(IKE_SERVER *ike, IKE_PACKET_TRANSFORM_PAYLOAD *transform, IKE_SA_TRANSFORM_SETTING *setting); 388 IKE_CLIENT *SearchIkeClientForIkePacket(IKE_SERVER *ike, IP *client_ip, UINT client_port, IP *server_ip, UINT server_port, IKE_PACKET *pr); 389 IKE_CLIENT *SearchOrCreateNewIkeClientForIkePacket(IKE_SERVER *ike, IP *client_ip, UINT client_port, IP *server_ip, UINT server_port, IKE_PACKET *pr); 390 UINT GetNumberOfIkeClientsFromIP(IKE_SERVER *ike, IP *client_ip); 391 UINT GetNumberOfIPsecSaOfIkeClient(IKE_SERVER *ike, IKE_CLIENT *c); 392 UINT GetNumberOfIkeSaOfIkeClient(IKE_SERVER *ike, IKE_CLIENT *c); 393 int CmpIkeClient(void *p1, void *p2); 394 int CmpIkeSa(void *p1, void *p2); 395 int CmpIPsecSa(void *p1, void *p2); 396 IKE_SA *FindIkeSaByEndPointAndInitiatorCookie(IKE_SERVER *ike, IP *client_ip, UINT client_port, IP *server_ip, UINT server_port, UINT64 init_cookie, UINT mode); 397 IKE_SA *FindIkeSaByResponderCookie(IKE_SERVER *ike, UINT64 responder_cookie); 398 IKE_SA *FindIkeSaByResponderCookieAndClient(IKE_SERVER *ike, UINT64 responder_cookie, IKE_CLIENT *c); 399 IKE_CLIENT *NewIkeClient(IKE_SERVER *ike, IP *client_ip, UINT client_port, IP *server_ip, UINT server_port); 400 IKE_CLIENT *SetIkeClientEndpoint(IKE_SERVER *ike, IKE_CLIENT *c, IP *client_ip, UINT client_port, IP *server_ip, UINT server_port); 401 IKE_SA *NewIkeSa(IKE_SERVER *ike, IKE_CLIENT *c, UINT64 init_cookie, UINT mode, IKE_SA_TRANSFORM_SETTING *setting); 402 IKE_PACKET_PAYLOAD *TransformSettingToTransformPayloadForIke(IKE_SERVER *ike, IKE_SA_TRANSFORM_SETTING *setting); 403 void IkeSaSendPacket(IKE_SERVER *ike, IKE_SA *sa, IKE_PACKET *p); 404 IKE_PACKET *IkeSaRecvPacket(IKE_SERVER *ike, IKE_SA *sa, void *data, UINT size); 405 void IkeSendUdpPacket(IKE_SERVER *ike, UINT type, IP *server_ip, UINT server_port, IP *client_ip, UINT client_port, void *data, UINT size); 406 void IkeAddVendorIdPayloads(IKE_PACKET *p); 407 BUF *IkeStrToVendorId(char *str); 408 void IkeAddVendorId(IKE_PACKET *p, char *str); 409 bool IkeIsVendorIdExists(IKE_PACKET *p, char *str); 410 void IkeCheckCaps(IKE_CAPS *caps, IKE_PACKET *p); 411 BUF *IkeCalcNatDetectHash(IKE_SERVER *ike, IKE_HASH *hash, UINT64 initiator_cookie, UINT64 responder_cookie, IP *ip, UINT port); 412 void IkeCalcSaKeySet(IKE_SERVER *ike, IKE_SA *sa, char *secret); 413 IKE_CRYPTO_KEY *IkeNewCryptoKeyFromK(IKE_SERVER *ike, void *k, UINT k_size, IKE_HASH *h, IKE_CRYPTO *c, UINT crypto_key_size); 414 BUF *IkeExpandKeySize(IKE_HASH *h, void *k, UINT k_size, UINT target_size); 415 void IkeSaUpdateIv(IKE_SA *sa, void *iv, UINT iv_size); 416 IPSECSA *NewIPsecSa(IKE_SERVER *ike, IKE_CLIENT *c, IKE_SA *ike_sa, bool initiate, UINT message_id, bool server_to_client, void *iv, UINT spi, void *init_rand_data, UINT init_rand_size, void *res_rand_data, UINT res_rand_size, IPSEC_SA_TRANSFORM_SETTING *setting, void *shared_key_data, UINT shared_key_size); 417 void IkeCalcPhase2InitialIv(void *iv, IKE_SA *sa, UINT message_id); 418 bool GetBestTransformSettingForIPsecSa(IKE_SERVER *ike, IKE_PACKET *pr, IPSEC_SA_TRANSFORM_SETTING *setting, IP *server_ip); 419 bool TransformPayloadToTransformSettingForIPsecSa(IKE_SERVER *ike, IKE_PACKET_TRANSFORM_PAYLOAD *transform, IPSEC_SA_TRANSFORM_SETTING *setting, IP *server_ip); 420 IKE_PACKET_PAYLOAD *TransformSettingToTransformPayloadForIPsec(IKE_SERVER *ike, IPSEC_SA_TRANSFORM_SETTING *setting); 421 UINT GenerateNewIPsecSaSpi(IKE_SERVER *ike, UINT counterpart_spi); 422 IPSECSA *SearchClientToServerIPsecSaBySpi(IKE_SERVER *ike, UINT spi); 423 IPSECSA *SearchIPsecSaBySpi(IKE_SERVER *ike, IKE_CLIENT *c, UINT spi); 424 IPSECSA *SearchIPsecSaByMessageId(IKE_SERVER *ike, IKE_CLIENT *c, UINT message_id); 425 void IPsecSaSendPacket(IKE_SERVER *ike, IPSECSA *sa, IKE_PACKET *p); 426 IKE_PACKET *IPsecSaRecvPacket(IKE_SERVER *ike, IPSECSA *sa, void *data, UINT size); 427 void IPsecSaUpdateIv(IPSECSA *sa, void *iv, UINT iv_size); 428 void ProcDeletePayload(IKE_SERVER *ike, IKE_CLIENT *c, IKE_PACKET_DELETE_PAYLOAD *d); 429 void MarkIPsecSaAsDeleted(IKE_SERVER *ike, IPSECSA *sa); 430 void MarkIkeSaAsDeleted(IKE_SERVER *ike, IKE_SA *sa); 431 void PurgeDeletingSAsAndClients(IKE_SERVER *ike); 432 void PurgeIPsecSa(IKE_SERVER *ike, IPSECSA *sa); 433 void PurgeIkeSa(IKE_SERVER *ike, IKE_SA *sa); 434 void PurgeIkeClient(IKE_SERVER *ike, IKE_CLIENT *c); 435 void FreeIPsecSa(IPSECSA *sa); 436 void MarkIkeClientAsDeleted(IKE_SERVER *ike, IKE_CLIENT *c); 437 IKE_SA *GetOtherLatestIkeSa(IKE_SERVER *ike, IKE_SA *sa); 438 IPSECSA *GetOtherLatestIPsecSa(IKE_SERVER *ike, IPSECSA *sa); 439 void SendInformationalExchangePacket(IKE_SERVER *ike, IKE_CLIENT *c, IKE_PACKET_PAYLOAD *payload); 440 void SendInformationalExchangePacketEx(IKE_SERVER *ike, IKE_CLIENT *c, IKE_PACKET_PAYLOAD *payload, bool force_plain, UINT64 init_cookie, UINT64 resp_cookie); 441 void SendDeleteIkeSaPacket(IKE_SERVER *ike, IKE_CLIENT *c, UINT64 init_cookie, UINT64 resp_cookie); 442 void SendDeleteIPsecSaPacket(IKE_SERVER *ike, IKE_CLIENT *c, UINT spi); 443 void IPsecCalcKeymat(IKE_SERVER *ike, IKE_HASH *h, void *dst, UINT dst_size, void *skeyid_d_data, UINT skeyid_d_size, UCHAR protocol, UINT spi, void *rand_init_data, UINT rand_init_size, 444 void *rand_resp_data, UINT rand_resp_size, void *df_key_data, UINT df_key_size); 445 446 void ProcIPsecEspPacketRecv(IKE_SERVER *ike, UDPPACKET *p); 447 void ProcIPsecUdpPacketRecv(IKE_SERVER *ike, IKE_CLIENT *c, UCHAR *data, UINT data_size); 448 void IPsecSendPacketByIPsecSa(IKE_SERVER *ike, IPSECSA *sa, UCHAR *data, UINT data_size, UCHAR protocol_id); 449 void IPsecSendPacketByIPsecSaInner(IKE_SERVER *ike, IPSECSA *sa, UCHAR *data, UINT data_size, UCHAR protocol_id); 450 void IPsecSendPacketByIkeClient(IKE_SERVER *ike, IKE_CLIENT *c, UCHAR *data, UINT data_size, UCHAR protocol_id); 451 void IPsecSendUdpPacket(IKE_SERVER *ike, IKE_CLIENT *c, UINT src_port, UINT dst_port, UCHAR *data, UINT data_size); 452 void IPsecIkeClientManageL2TPServer(IKE_SERVER *ike, IKE_CLIENT *c); 453 void IPsecIkeClientSendL2TPPackets(IKE_SERVER *ike, IKE_CLIENT *c, L2TP_SERVER *l2tp); 454 void IPsecIkeSendUdpForDebug(UINT dst_port, UINT dst_ip, void *data, UINT size); 455 void StartQuickMode(IKE_SERVER *ike, IKE_CLIENT *c); 456 UINT GenerateNewMessageId(IKE_SERVER *ike); 457 458 void IPsecIkeClientManageEtherIPServer(IKE_SERVER *ike, IKE_CLIENT *c); 459 void IPsecIkeClientSendEtherIPPackets(IKE_SERVER *ike, IKE_CLIENT *c, ETHERIP_SERVER *s); 460 void ProcIPsecEtherIPPacketRecv(IKE_SERVER *ike, IKE_CLIENT *c, UCHAR *data, UINT data_size, bool is_tunnel_mode); 461 bool IsIPsecSaTunnelMode(IPSECSA *sa); 462 void ProcL2TPv3PacketRecv(IKE_SERVER *ike, IKE_CLIENT *c, UCHAR *data, UINT data_size, bool is_tunnel_mode); 463 464 IKE_SA *SearchIkeSaByCookie(IKE_SERVER *ike, UINT64 init_cookie, UINT64 resp_cookie); 465 466 #endif // IPSEC_IKE_H 467 468