bjayesh/m241Neelima
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

original files of m241

Browse Source
This commit is contained in:
neelimap
2026-07-30 11:19:44 +05:30
parent 170c2b3f3a
commit afc7070c1f
12254 changed files with 7655111 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/ip_net2-6.9/ipike/config/01ike.cdf
+308
View File
@@ -0,0 +1,308 @@
/* 01ike.cdf - IKE configuration file */
/*
* Copyright (c) 2006-2007 Wind River Systems, Inc.
*
* The right to copy, distribute or otherwise make use of this software
* may be licensed only pursuant to the terms of an applicable Wind River
* license agreement. No license to Wind River intellectual property rights
* is granted herein. All rights not licensed by Wind River are reserved
* by Wind River.
*/
/*
modification history
--------------------
01g,12may08,brg Removed IPIKE_ALLOW_DUPLICATE_SA. Its an internal
configuration variable.((WIND00108854))
01f,11oct07,jho Fixed bad IPIKE_NAT_PORT default value.
01e,19sep07,rme Added missing backslash
01d,07sep07,rme Replaced SELECTION_IPCOM_FS with SELECT_IPCOM_FS in INCLUDE_INTERNET_KEY_EXCHANGE
01c,06mar07,kch Added support for dynamic address, IPIKE_MAX_EXCHANGES and
IPIKE_ALLOW_DUPLICATE_SA configuration parameters
(WIND00089895).
01b,07feb07,tkf Add IPIKE dependency on SELECTION_IPCOM_FS.
01a,08jan07,kch Removed trailing ctrl-M characters.
*/
#ifdef _WRS_CONFIG_COMPONENT_IPIKE
Component INCLUDE_INTERNET_KEY_EXCHANGE
{
NAME Internet Key Exchange (IKE)
SYNOPSIS Dynamic keying for security association
CONFIGLETTES ipike_config.c
CFG_PARAMS IPIKE_SOCK_BUF_SIZE \
IPIKE_MAX_EXCHANGES \
IPIKE_PORT \
IPIKE_NAT_PORT \
IPIKE_NAT_KEEPALIVE \
IPIKE_LIVENESS_TIMER_RESOLUTION \
IPIKE_RESEND_DELAY \
IPIKE_CONFIG_FILE_NAME \
IPIKE_CONFIG_FILE_PATH \
IPIKE_NONCE_SIZE \
IPIKE_CREATE_DEFAULT_CONFIG_FILE \
IPIKE_FLUSH_STARTUP \
IPIKE_FLUSH_SHUTDOWN \
IPIKE_FLUSH_RECONFIGURE \
IPIKE_SOFT_TO_HARD_TIME \
IPIKE_DYNAMIC_ADDRESS_POOL_NETWORK4 \
IPIKE_DYNAMIC_ADDRESS_POOL_DNS4 \
IPIKE_DYNAMIC_ADDRESS_MODE \
IPIKE_DYNAMIC_ADDRESS_ANYFLOW \
IPIKE_DYNAMIC_ADDRESS_HOMEADDR \
IPIKE_REKEY_FUZZINESS \
IPIKE_USE_HASH_AND_URL \
IPIKE_HTTP_REQUEST_TIMEOUT \
IPIKE_HTTP_RESPONSE_BUF_SIZE \
IPIKE_MAX_IKE_SA_NUM \
IPIKE_MAX_IPSEC_SA_NUM \
IPIKE_MAX_MESSAGE_SIZE \
MODULES ipike.o
REQUIRES INCLUDE_IPNET_SOCKET INCLUDE_IPCRYPTO \
SELECT_IPCOM_FS INCLUDE_IP_SECURITY \
INCLUDE_IPCOM_USE_KEY_DB
}
Parameter IPIKE_SOCK_BUF_SIZE
{
NAME Socket buffer size
SYNOPSIS ISAKMP socket buffer size (in bytes), this is the largest ISAKMP message the IKE daemon can send and receive.
TYPE string
DEFAULT "10000"
}
Parameter IPIKE_MAX_EXCHANGES
{
NAME Maximum number of active exchanges
SYNOPSIS The maximum number of active exchanges, ISAKMP packets for new \
exchanges will be dropped when the maximum is reached. \
Set to 0 to allow infinite number of exchanges.
TYPE string
DEFAULT "32"
}
Parameter IPIKE_PORT
{
NAME IKE Port
SYNOPSIS Specifies the UDP port on which to listen for ISAKMP packets. Should be 500 in most cases.
TYPE string
DEFAULT "500"
}
Parameter IPIKE_NAT_PORT
{
NAME IKE NAT-T port
SYNOPSIS Specifies the UDP port on which to listen for ISAKMP NATTraversal packets. Must be 4500 to interoperate with other clients.
TYPE string
DEFAULT "0"
}
Parameter IPIKE_NAT_KEEPALIVE
{
NAME Time between NAT keepalive messages
SYNOPSIS Specifies the number of seconds between keep alive packets when NAT-Traversal is used.
TYPE string
DEFAULT "20"
}
Parameter IPIKE_RESEND_DELAY
{
NAME IKE message resend delay
SYNOPSIS The time (in seconds) the IKE daemon will wait before doing the \
first resend of a packet. IKE will wait two times this value between \
the first and second resend, three times the value until the \
third resend, etc.
TYPE string
DEFAULT "2"
}
Parameter IPIKE_LIVENESS_TIMER_RESOLUTION
{
NAME IKE liveness timer resolution
SYNOPSIS The time period (in seconds) in which the IKE daemon will traverse \
all IPsec SA entries and perform liveness check (any packets received). \
A lower value will allow faster detection of dead remote peers but use more \
CPU resources. A value of 0 will disable the timer and liveness checking.
TYPE string
DEFAULT "10"
}
Parameter IPIKE_CONFIG_FILE_NAME
{
NAME Name of the IKE config file
SYNOPSIS The name of the file that will be used to configure the IKE daemon on startup.
TYPE string
DEFAULT "ike.cfg"
}
Parameter IPIKE_CONFIG_FILE_PATH
{
NAME Path to the IKE config file
SYNOPSIS The path the IKE daemon will use to locate the configuration file.
TYPE string
DEFAULT "/ram/"
}
Parameter IPIKE_NONCE_SIZE
{
NAME Size of created nonces
SYNOPSIS The size (in bytes) of the nonce (random number) that the IKE \
daemon will generate during phase 1 exchange. Must be between \
8 and 256 (inclusive) bytes.
TYPE string
DEFAULT "64"
}
Parameter IPIKE_CREATE_DEFAULT_CONFIG_FILE
{
NAME Create IKE config file
SYNOPSIS IPIKE will create a default configuration file for acting as a \
responder using preshared secret if this variable is set to 1 \
and there is no configuration file with the name specified by \
ipike.filename present.
TYPE string
DEFAULT "1"
}
Parameter IPIKE_FLUSH_STARTUP
{
NAME Flush keys at startup
SYNOPSIS This flag is used to indicate to the IKE daemon to flush the keys at startup.
TYPE string
DEFAULT "0"
}
Parameter IPIKE_FLUSH_SHUTDOWN
{
NAME Flush keys at shutdown
SYNOPSIS This flag is used to indicate to the IKE daemon to flush the keys at shutdown.
TYPE string
DEFAULT "0"
}
Parameter IPIKE_FLUSH_RECONFIGURE
{
NAME Flush keys on reconfigure
SYNOPSIS This flag is used to indicate to the IKE daemon to flush the keys when reconfigured.
TYPE string
DEFAULT "0"
}
Parameter IPIKE_SOFT_TO_HARD_TIME
{
NAME IPSec SA soft to hard time
SYNOPSIS The IPSec SA soft timeout expires this many seconds earlier than the hard timeout.
TYPE string
DEFAULT "300"
}
Parameter IPIKE_DYNAMIC_ADDRESS_POOL_NETWORK4
{
NAME Dynamic address pool network4
SYNOPSIS This string is used to specify ip network for IPv4 dynamic address pool (responder).
TYPE string
DEFAULT "10.1.111.1/24"
}
Parameter IPIKE_DYNAMIC_ADDRESS_POOL_DNS4
{
NAME Dynamic address pool dns4
SYNOPSIS This string is used to specify dns ip address for IPv4 dynamic address pool (responder).
TYPE string
DEFAULT "10.1.1.1"
}
Parameter IPIKE_DYNAMIC_ADDRESS_MODE
{
NAME Dynamic address mode
SYNOPSIS This string is used to specify dynamic address mode for IKE version 1 protocol (initiator).
TYPE string
DEFAULT "1"
}
Parameter IPIKE_DYNAMIC_ADDRESS_ANYFLOW
{
NAME Dynamic address anyflow
SYNOPSIS Set this flag to 1 to make the responder traffic selector match any address in case of dynamic addresses with IKEv2 (responder).
TYPE string
DEFAULT "0"
}
Parameter IPIKE_DYNAMIC_ADDRESS_HOMEADDR
{
NAME Dynamic address home address
SYNOPSIS Set this flag to 1 to add the initiator's dynamic address as a home address (initiator). \
The home address is the preferred source address.
TYPE string
DEFAULT "0"
}
Parameter IPIKE_REKEY_FUZZINESS
{
NAME IKE rekey fuzziness
SYNOPSIS The rekey fuzziness is used for avoiding situations where both IKE peers initiate a rekey exchange simultaneously. \
A value of 20 will delay the rekey timer with a random amount of time between 0 and 20 seconds. The rekey fuzziness applies on \
both IKE SA and IPsec SA rekey. A value of 0 disables the fuzziness.
TYPE string
DEFAULT "20"
}
Parameter IPIKE_USE_HASH_AND_URL
{
NAME Enable Hash and URL
SYNOPSIS The Hash and URL feature allows IKEv2 peers to send and receive a hash digest of a certificate followed by a URL \
pointing out the actual location of the certificate. This allows IKE messages to be small and IP fragmentation can be avoided \
since certificates are fetched using HTTP instead. The feature is disabled by default since there is a potential \
security risk of accepting a URL from an unauthenticated peer, set this flag to 1 to enable support for it.
TYPE string
DEFAULT "0"
}
Parameter IPIKE_HTTP_REQUEST_TIMEOUT
{
NAME IKE HTTP request timeout
SYNOPSIS The maximum number of seconds the IKE daemon will wait for an HTTP response.
TYPE string
DEFAULT "5"
}
Parameter IPIKE_HTTP_RESPONSE_BUF_SIZE
{
NAME IKE HTTP response buffer size
SYNOPSIS This value controls the largest possible HTTP response the IKE dameon can receive.
TYPE string
DEFAULT "4096"
}
Parameter IPIKE_MAX_IKE_SA_NUM
{
NAME Maximum number of IKE SAs
SYNOPSIS Specifies the maximum number of concurrent IKE SAs that can be established. \
Set to 0 to allow infinite number of IKE SAs.
TYPE string
DEFAULT "0"
}
Parameter IPIKE_MAX_IPSEC_SA_NUM
{
NAME Maximum number of IPsec SAs
SYNOPSIS Specifies the maximum number of concurrent IPsec SAs that can be established. \
Set to 0 to allow infinite number of IPsec SAs.
TYPE string
DEFAULT "0"
}
Parameter IPIKE_MAX_MESSAGE_SIZE
{
NAME Maximum size of an IKE message
SYNOPSIS Specifies the maximum size of an IKE message. This restriction will be applied \
on both outgoing and incoming IKE traffic.
Set to 0 to for unlimited size (limited by the maximum UDP packet size).
TYPE string
DEFAULT "0"
}
#endif
components/ip_net2-6.9/ipike/config/common.vxconfig
+12
View File
@@ -0,0 +1,12 @@
# Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: common.vxconfig,v $ $Revision: 1.10 $
# $Source: /home/interpeak/CVSRoot/ipike/config/common.vxconfig,v $
# $Author: myakan $
# $State: Exp $ $Locker: $
#
# INTERPEAK_COPYRIGHT_STRING
#hidden option that enables IPIKE
config SUPPORTS_IKE
bool
default y
components/ip_net2-6.9/ipike/config/ipike_config.c
+250
View File
@@ -0,0 +1,250 @@
/*
******************************************************************************
* INTERPEAK CONFIGURATION SOURCE FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_config.c,v $ $Revision: 1.27.2.6 $
* $Source: /home/interpeak/CVSRoot/ipike/config/ipike_config.c,v $
* $Author: svc-cmnet $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/*
****************************************************************************
* 2 INCLUDE FILES
****************************************************************************
*/
#include "ipike_config.h"
#define IPCOM_USE_CLIB_PROTO
#include <ipcom_sysvar.h>
#include <ipcom_err.h>
#include <ipcom_sock.h>
#include <ipcom_file.h>
#include <ipcom_clib.h>
#include <ipcom_syslog.h>
/*
****************************************************************************
* 3 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 4 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 5 EXTERN PROTOTYPES
****************************************************************************
*/
/*
*===========================================================================
* ipike_configure
*===========================================================================
*/
IP_PUBLIC Ip_err
ipike_configure(void);
/*
****************************************************************************
* 6 LOCAL PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 7 DATA
****************************************************************************
*/
/*
*===========================================================================
* SYSTEM VARIABLES
*===========================================================================
*/
IP_CONST Ipcom_sysvar ipike_conf_sysvar[] = {
/* ISAKMP socket buffer size (in bytes), this is the largest ISAKMP message
the IKE daemon can send and receive */
IP_SYSVAR("ipike.isakmp_sock_buf_size", "10000", IPIKE_SOCK_BUF_SIZE),
/* The maximum number of active exchanges, ISAKMP packets for new exchanges
will be dropped when the maximum is reached. Set to 0 to allow infinite
number of exchanges. */
IP_SYSVAR("ipike.isakmp_max_exchanges", "32", IPIKE_MAX_EXCHANGES),
/* The maximum size of an ISAKMP packet. Note that all IKEv2
implementations MUST be able to send, receive, and process
IKE messages that are up to 1280 octets long, and they SHOULD be able
to send, receive, and process messages that are up to 3000 octets
long. Set to 0 for unlimited (max UDP packet size) */
IP_SYSVAR("ipike.max_message_size", "0", IPIKE_MAX_MESSAGE_SIZE),
/* The maximum number of IKE SAs that are allowed to be established
* at the same time. New negotiations will be rejected when this limit
* is reached. Set to 0 for no restrictions */
IP_SYSVAR("ipike.max_ike_sa_num", "0", IPIKE_MAX_IKE_SA_NUM),
/* The maximum number of IPsec SAs that are allowed to be established
* at the same time. New requests will be rejected when this limit
* is reached. Note that IPsec SAs are intalled in pairs, one for
* outgoing traffic and one for incomming traffic so normally two
* IPsec SA are installed for each peer. Set to 0 for no restrictions */
IP_SYSVAR("ipike.max_ipsec_sa_num", "0", IPIKE_MAX_IPSEC_SA_NUM),
/* The UDP port on which to listen for ISAKMP packets.
500 is the default IKE port */
IP_SYSVAR("ipike.port", "500", IPIKE_PORT),
/* The UDP port on which to listen for ISAKMP packets when using NAT-Traversal.
The only supported number is 4500 (limitation IPNet).*/
IP_SYSVAR("ipike.port_nat", "4500", IPIKE_NAT_PORT),
/* Number of seconds between NAT-Traversal keep-alive packets. Default
20 seconds. */
IP_SYSVAR("ipike.keepalive_nat", "20", IPIKE_NAT_KEEPALIVE),
/* Base time to wait (in seconds) before resending a ISAKMP message,
the time to wait is calulated on tWait = ipike.resend_delay * resend_count */
IP_SYSVAR("ipike.resend_delay", "2", IPIKE_RESEND_DELAY),
/* The filename where the configuration is stored */
#if defined(IP_PORT_LAS)
IP_SYSVAR("ipike.filename", IPCOM_DEFAULT_CONF_ROOT "/ike.cfg", IPIKE_CONFIG_FILE_PATH IPIKE_CONFIG_FILE_NAME),
#else
IP_SYSVAR("ipike.filename", IPCOM_FILE_ROOT "ike.cfg", IPIKE_CONFIG_FILE_PATH IPIKE_CONFIG_FILE_NAME),
#endif
/* The size (in bytes) of the created nonce (must be 8-256) */
IP_SYSVAR("ipike.nonce_size", "64", IPIKE_NONCE_SIZE),
/* Set this to 0 if IPIKE should not create a default 'ipike.filename' if
no such already exists */
IP_SYSVAR( "ipike.create_default_conf", "1", IPIKE_CREATE_DEFAULT_CONFIG_FILE),
/* Internal configuration variable. Set to 1 to allow duplicate IKE SAs */
IP_SYSVAR("ipike.allow_duplicate_ike_sa", "0", "0"),
/* Set flush to 1 if IPIKE should flush IPSec keys at startup or shutdown,
only needed when not running Interpeak IPSec */
#if !defined(IPIPSEC2) && !defined(IPIPSEC) && !defined(IP_PORT_OSE5)
IP_SYSVAR("ipike.pfkeyv2.flush_startup", "1", IPIKE_FLUSH_STARTUP),
IP_SYSVAR("ipike.pfkeyv2.flush_shutdown", "0", IPIKE_FLUSH_SHUTDOWN),
#endif
/* Enable this sysvar */
IP_SYSVAR("ipike.pfkeyv2.flush_reconfigure", "0", IPIKE_FLUSH_RECONFIGURE),
/* Number of seconds before the hard timeout the soft timeout (and the renewal
negotiation) should be */
IP_SYSVAR("ipike.pfkeyv2.soft_to_hard_time", "300", IPIKE_SOFT_TO_HARD_TIME),
/* Dynamic address pool (responder), used for test to simulate VPN gateway */
IP_SYSVAR("ipike.address_pool.network4", "10.1.111.1/24", IPIKE_DYNAMIC_ADDRESS_POOL_NETWORK4),
IP_SYSVAR("ipike.address_pool.dns4", "10.1.1.1", IPIKE_DYNAMIC_ADDRESS_POOL_DNS4),
IP_SYSVAR("ipike.address_pool.anyflow", "0", IPIKE_DYNAMIC_ADDRESS_ANYFLOW),
IP_SYSVAR("ipike.address_pool.homeaddr", "0", IPIKE_DYNAMIC_ADDRESS_HOMEADDR),
/* Dynamic address mode IKE v1 (initiator):
* 0 : Will set IPSec src flow as "any" address
* 1 : Will set IPSec src flow as retrieved address
* 2 : Will set IPSec src flow as retrieved network */
IP_SYSVAR("ipike.dynamic_address.mode", "1", IPIKE_DYNAMIC_ADDRESS_MODE),
/* Set to '1' to enable MOBIKE (RFC4555), default '0' */
IP_SYSVAR("ipike.mobike", "0", "0"),
/* Set to '1' to enable routability check for MOBIKE, default '1' */
IP_SYSVAR("ipike.mobike.routability_check", "1", "1"),
/* Set to '1' to initiate rekey for IPSec SAs for passive connections. */
IP_SYSVAR("ipike.rekey_passive", "1", "1"),
/* Rekey fuzziness in seconds, adds a random time to rekey margin */
IP_SYSVAR("ipike.rekey_fuzziness", "20", IPIKE_REKEY_FUZZINESS),
/* The liveness timer resolution in seconds */
IP_SYSVAR("ipike.liveness_timer_resolution", "10", IPIKE_LIVENESS_TIMER_RESOLUTION),
/* Allow fetching of certificates via HTTP */
IP_SYSVAR("ipike.use_hash_and_url", "0", IPIKE_USE_HASH_AND_URL),
/* Number of seconds before timing out an HTTP request */
IP_SYSVAR("ipike.http_request_timeout", "5", IPIKE_HTTP_REQUEST_TIMEOUT),
/* HTTP response buffer size in bytes */
IP_SYSVAR("ipike.http_response_buf_size", "4096", IPIKE_HTTP_RESPONSE_BUF_SIZE),
/* Set to '1' to enable strict lifetime checking when accepting proposals */
{ "ipike.strict_lifetime_policy", "0"},
/* Remove IKE SA if the negotiation of the IPsec SA fails, default '0' */
{ "ipike.policy.delete_phase1_on_phase2_failure", "0" },
/* End marker */
{ IP_NULL, IP_NULL }
};
/*
****************************************************************************
* 8 STATIC FUNCTIONS
****************************************************************************
*/
/*
****************************************************************************
* 9 GLOBAL FUNCTIONS
****************************************************************************
*/
/*
****************************************************************************
* 10 PUBLIC FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_configure
*===========================================================================
* Description: Configures IPIKE.
* Parameters:
* Returns:
*
*/
IP_PUBLIC Ip_err
ipike_configure(void)
{
/* Set IPNET system variables. */
(void)ipcom_sysvar_setv(ipike_conf_sysvar, 0);
#if defined(IP_DEBUG) && !defined(IP_PORT_VXWORKS)
(void)ipcom_setlogmask_on(IPCOM_LOG_DEBUG2, IPCOM_LOG_IPIKE);
#endif
return IPCOM_SUCCESS;
}
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/config/ipike_config.h
+407
View File
@@ -0,0 +1,407 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_config.h,v $ $Revision: 1.34.10.7 $
* $Source: /home/interpeak/CVSRoot/ipike/config/ipike_config.h,v $
* $Author: svc-cmnet $ $Date: 2013-03-13 07:45:25 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#ifndef IPIKE_CONFIG_H
#define IPIKE_CONFIG_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Defines for IPIKE */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include <ipcom_config.h>
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 CONFIGURATION
****************************************************************************
*/
/*
*===========================================================================
* IPIKE_USE_VERSION2
*===========================================================================
* Set define to enable IKE version2 protocol.
*/
#define IPIKE_USE_VERSION2
/*
*===========================================================================
* IPIKE_USE_EAP
*===========================================================================
* Set define to enable EAP authentication mechanism for IKE version2
* protocol.
*/
#if defined(IPIKE_USE_VERSION2) && defined(IPEAP)
#define IPIKE_USE_EAP
#endif
/*
*===========================================================================
* IPIKE_USE_RADIUS
*===========================================================================
* Set define to enable Radius. This define is needed for responder (EAP
* Supplicant) when running EAP authentication mechanism for IKE version2.
*/
#if defined(IPIKE_USE_EAP) && defined(IPRADIUS)
#define IPIKE_USE_RADIUS
#endif
/*
*===========================================================================
* IPIKE_USE_ROHC
*===========================================================================
* Set define to enable ROHC parameter negotiation using IKEV2.
*/
#if defined(IPIKE_USE_VERSION2) && defined(IPROHC)
#define IPIKE_USE_ROHC
#endif
/*
*===========================================================================
* IPIKE_USE_AGGRESSIVE_MODE
*===========================================================================
* Set define to enable aggressive mode negotiation for IKE version1
* protocol.
*/
#define IPIKE_USE_AGGRESSIVE_MODE
/*
*===========================================================================
* IPIKE_REAUTH_MARGIN_SEC
*===========================================================================
* The number of seconds before the IKE SA expires that reauthentication
* should take place.
*/
#define IPIKE_REAUTH_MARGIN_SEC 20
/*
*===========================================================================
* IPIKE_REKEY_MARGIN_SEC
*===========================================================================
* The number of seconds before the IKE SA expires that rekey should take
* place. Let rekey have some advantage compared to reauthentication by
* doubling the margin.
*/
#define IPIKE_REKEY_MARGIN_SEC (IPIKE_REAUTH_MARGIN_SEC + IPIKE_REAUTH_MARGIN_SEC)
/*
*===========================================================================
* IPIKE_REKEY_RETRY_TIMEOUT_MS
*===========================================================================
* The number of milliseconds to wait before retrying a rekey when the
* IKE SA is busy (exchange in progress). This timeout is also used for the
* same purpose when performing a reauhtentication.
*/
#define IPIKE_REKEY_RETRY_TIMEOUT_MS 1000
/*
*===========================================================================
* IPIKE_USE_CRYPTO_TEST
*===========================================================================
* Enable crypto self test on startup
*/
#if defined(IP_DEBUG) && defined(IPIKE_USE_VERSION2)
#define IPIKE_USE_CRYPTO_SELF_TEST
#endif
/*
*===========================================================================
* IPIKE_INFORMATIONAL_RETRY_TIMEOUT_MS
*===========================================================================
* The number of milliseconds to wait before retrying a INFORMATION exchange when the
* IKE SA is busy (exchange in progress).
*/
#define IPIKE_INFORMATIONAL_RETRY_TIMEOUT_MS 1000
/*
*===========================================================================
* IPIKE_INFORMATIONAL_RETRY_QUEUE_SIZE
*===========================================================================
* when the IKE SA is busy (exchange in progress), will queue informational exchange into a queue.
* The default size of queue is 10.
*/
#define IPIKE_INFORMATIONAL_RETRY_QUEUE_SIZE 10
/*
*===========================================================================
* IPIKE_INFORMATIONAL_RETRY_TIMEOUT_MS
*===========================================================================
* The number of milliseconds to wait before retrying a INFORMATION exchange when the
* IKE SA is busy (exchange in progress).
*/
#define IPIKE_INFORMATIONAL_RETRY_TIMEOUT_MS 1000
/*
*===========================================================================
* IPIKE_INFORMATIONAL_RETRY_QUEUE_SIZE
*===========================================================================
* when the IKE SA is busy (exchange in progress), will queue informational exchange into a queue.
* The default size of queue is 10.
*/
#define IPIKE_INFORMATIONAL_RETRY_QUEUE_SIZE 10
/*
*===========================================================================
* IPIKE_ISAKMPD_AES_KEY_LENGTH_BUG_WORKAROUND
*===========================================================================
* The ISAKMPD (on OpenBSD) will not allow that the key length is transmitted
* in the payloads during phase 1 or phase2. It will also consider the key
* length to be 256 bits during phase1 and 128 bits during phase 2.
*
* NOTE: This define will result in a bug, since there is no default for AES,
* at least not during phase 1.
*/
/*#define IPIKE_ISAKMPD_AES_KEY_LENGTH_BUG_WORKAROUND*/
/*
*===========================================================================
* IPIKE_USE_AES_MAC
*===========================================================================
*
*/
#if !defined(OPENSSL_NO_AES) && defined(IPCRYPTO)
#define IPIKE_USE_AES_MAC
#endif
/*
*===========================================================================
* IPCOM_SYSLOG_PRIORITY
*===========================================================================
* Default syslog priority.
*/
#if defined(_WRS_CONFIG_IPIKE_SYSLOG_PRIORITY)
#define IPIKE_SYSLOG_PRIORITY _WRS_CONFIG_IPIKE_SYSLOG_PRIORITY
#else
#define IPIKE_SYSLOG_PRIORITY IPCOM_SYSLOG_PRIO_DEFAULT
#endif
/*
*===========================================================================
* IPIKE_USE_PKTINFO
*===========================================================================
* Use PKTINFO processing to be able to listen on :: or 0.0.0.0.
* Can be only used if IPNET is defined
*/
#if defined(IPNET)
#define IPIKE_USE_PKTINFO
#endif
/*
*===========================================================================
* IPIKE_USE_MIGRATE
*===========================================================================
* Define to enable pfkey migrate support for MIP daemons.
* Is dependent on pfkey defines in IPIPSEC and complaint behavior
* from MIP daemons.
* Currently IKE and IPSEC does not handle the MIGRATE messages
*/
/* #define IPIKE_USE_MIGRATE */
/*
*===========================================================================
* IPIKE_USE_PERF_EVAL
*===========================================================================
* Performance evaluation code for IKEv1 and v2
*
*/
#define IPIKE_USE_PERF_EVAL
/*
*===========================================================================
* IPIKE_USE_OCSP
*===========================================================================
* Use OCSP req/responses to verify certificate validity status
*
*/
#if !defined(OPENSSL_NO_OCSP) && defined(IPCRYPTO)
#define IPIKE_USE_OCSP
#endif
/*
*===========================================================================
* IPIKE_DPD_WINDOW_SIZE
*===========================================================================
* For IKEv1 only. This setting specifies the size of the DPD window which
* contains acceptable sequence numbers.
*
*/
#define IPIKE_DPD_WINDOW_SIZE 10
/*
*===========================================================================
* IPIKE_IKEV2_MAX_EXCH_IN_NEG
*===========================================================================
* For IKEv2 only. This setting specifies the maximum number of exchanges
* that is allowed to complete an IKEv2 negotiation. An IKEv2 negotiation is
* normally completed within 2 exchanges (one INIT and one AUTH) but if EAP
* is used as authentication method more exchanges are required. One exchange
* consists of one request-response message pair.
*
*/
#define IPIKE_IKEV2_MAX_EXCH_IN_NEG 15
/*
*===========================================================================
* IPIKE_IKE_SA_SIMULTANEOUS_ESTABLISHMENT_PERIOD
*===========================================================================
* If two or more IKE SAs from the same remote peer are established within
* this period of seconds they will be treated as a simultaneous (collision)
* exchange and the IKE SA containing the smallest nonce will be removed.
*
*/
#define IPIKE_IKE_SA_SIMULTANEOUS_ESTABLISHMENT_PERIOD 1
/*
*===========================================================================
* IPIKE_DISPATCHER_RECEIVE_RETRIES
*===========================================================================
* Number of times the IKE dispatcher will tolerate receive errors before
* it reconfigures itself (re-open listening UDP sockets)
*
*/
#define IPIKE_DISPATCHER_RECEIVE_RETRIES 3
/*
*===========================================================================
* IPIKE_USE_EVENT_LOG
*===========================================================================
* IKE Event logging. Each type of log event can be explicitly be removed
* at compile time by either removing the corresponding define below or
* by adding a #undef directive. Some of these events are triggered in the
* IPsec module and some in the IPIKE module. Events triggered from IPsec
* are sent to the IKE daemon via pfkeyv2 and then relayed to registered
* event receivers
*
*/
#ifdef _WRS_CONFIG_COMPONENT_IPIKE_USE_EVENT_LOG
/* Global switch, enables event logging */
#define IPIKE_USE_EVENT_LOG
#endif
#ifdef IPIKE_USE_EVENT_LOG
/*
* Log events, enable/disable specific log events here at compile time. By
* default all is turned on.
*/
/* Phase 2 hard lifesize expired */
#define IPIKE_USE_EVENT_HARD_LIFE_SIZE_EXPIRED
/* Phase 2 hard lifetime expired */
#define IPIKE_USE_EVENT_HARD_LIFE_TIME_EXPIRED
/* An IKE packet was discarded */
#define IPIKE_USE_EVENT_IKE_PACKET_DISCARD
/* Phase 1 (IKE SA) negotiation failed */
#define IPIKE_USE_EVENT_IKE_PHASE_I_FAIL
/* Phase 1 (IKE SA) negotiation completed successfully */
#define IPIKE_USE_EVENT_IKE_PHASE_I_SUCCESS
/* Phase 2 (IPsec SA) negotiation failed */
#define IPIKE_USE_EVENT_IKE_PHASE_II_FAIL
/* Phase 2 (IPsec SA) negotiation completed */
#define IPIKE_USE_EVENT_IKE_PHASE_II_SUCCESS
/* IPsec packet was discarded */
#define IPIKE_USE_EVENT_IPSEC_PACKET_DISCARD
/* IPsec SA sequence number overflowed or rolled over */
#define IPIKE_USE_EVENT_SEQUENCE_NUM_OVERFLOW
/* Phase 2 (IPsec SA) soft lifetime in bytes expired */
#define IPIKE_USE_EVENT_SOFT_LIFE_SIZE_EXPIRED
/* Phase 2 (IPsec SA) soft lifetime in time expired */
#define IPIKE_USE_EVENT_SOFT_LIFE_TIME_EXPIRED
/* An SPD packet was discarded */
#define IPIKE_USE_EVENT_SPD_PACKET_DISCARD
#endif /* IPIKE_USE_EVENT_LOG */
/*
*===========================================================================
* IPIKE_CONFIG_ROHC_INTEG_NUM_MAX
*===========================================================================
* The maximum number of integrity algorithms that can be configured and
* proposed when ROHC is enabled
*/
#define IPIKE_CONFIG_ROHC_INTEG_NUM_MAX 7
/*
*===========================================================================
* IPIKE_CONFIG_ROHC_INTEG_NUM_MAX
*===========================================================================
* The maximum number of ROHC profiles that can be configured.
*/
#define IPIKE_CONFIG_ROHC_PROFILE_NUM_MAX 8
/*
*===========================================================================
* IPIKE_ROHC_IFNAME_SIZE
*===========================================================================
* ROHC Interface name sizes
*/
#define IPIKE_ROHC_IFNAME_SIZE 16
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/examples/ike_dsa_init.cer
+90
View File
@@ -0,0 +1,90 @@
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
b7:e5:77:db:56:88:21:c2
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=US, ST=California, O=Wind River, OU=Test, CN=WR Test CA
Validity
Not Before: Sep 29 11:53:26 2008 GMT
Not After : Nov 16 11:53:26 2016 GMT
Subject: C=SE, ST=Stockholm, L=Stockholm, O=Wind River, OU=Development, CN=Wind River IKE initiator
Subject Public Key Info:
Public Key Algorithm: dsaEncryption
DSA Public Key:
pub:
6e:45:15:e9:87:12:bb:07:f0:c7:4a:57:c1:9f:47:
09:d8:6c:16:10:81:1b:17:99:18:94:dd:69:28:01:
5d:fc:b7:43:1a:ca:e7:ab:e9:3c:94:88:3f:52:4f:
f7:be:3a:cf:36:32:2f:19:5c:72:ce:50:d8:46:99:
56:ff:ca:b0:e5:82:38:f0:84:e2:14:5a:87:5e:8d:
5c:79:89:b7:07:b6:f8:cc:a2:54:51:d3:fe:5a:1b:
a2:d4:af:31:70:46:b3:72:c1:27:7f:12:f2:2b:bf:
82:8b:6b:b2:bb:ea:cc:1c:3c:99:e6:87:46:f0:54:
fa:27:e2:02:0d:75:53:a1
P:
00:d2:e9:18:e2:2c:e3:aa:78:11:7f:32:c2:fd:e8:
d4:4f:53:df:b3:8b:65:6b:c9:fe:a1:8a:e3:36:07:
fc:9d:36:0d:36:1a:a2:95:3e:9b:ef:31:f5:98:bd:
20:17:4f:03:0c:17:60:73:52:97:41:63:fe:e5:5f:
05:a9:a2:6f:09:96:5d:12:0b:79:f3:65:1c:66:8c:
a3:e5:9c:91:89:b7:ff:7e:75:e7:2e:0c:76:6b:75:
75:f4:5e:64:c6:3f:57:2f:ba:bd:7b:86:c4:0f:58:
55:8d:87:f3:3d:f9:8c:92:c5:6f:e6:44:d9:c2:1f:
f4:83:7d:91:a2:10:29:14:35
Q:
00:87:79:b3:7a:4f:61:91:2a:df:9c:7e:df:1d:31:
f7:e2:c5:12:07:a7
G:
61:d0:86:57:5c:9b:24:82:47:90:34:fb:e5:06:75:
4e:c8:38:e4:38:55:ea:9e:47:ed:07:d6:34:b0:90:
e2:8e:08:1e:52:cc:57:d1:b5:e9:77:93:bf:2d:b4:
9b:8c:ef:d9:b2:47:31:33:5a:1b:85:f9:75:a3:75:
13:fd:51:21:74:ce:2d:59:44:cd:15:4f:70:bb:2c:
12:40:db:5d:0c:14:7b:db:54:65:7d:c7:78:f9:cc:
97:3d:36:50:dc:e4:7e:d3:1d:e4:6b:31:d3:f1:02:
c6:ed:4d:9c:7a:9d:64:f9:e1:ec:43:a3:11:7e:a8:
ec:1c:55:66:34:bf:1c:4d
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
E3:2E:04:2C:32:B4:6E:B2:C6:53:C8:75:F6:AA:D2:47:24:F8:A1:86
X509v3 Authority Key Identifier:
keyid:DD:67:77:9C:FB:BB:98:D3:66:D4:E4:D9:71:65:25:B3:7B:CC:08:82
Signature Algorithm: sha1WithRSAEncryption
4b:a2:d6:3e:84:88:00:b4:70:bf:93:3d:d3:d6:ec:19:3c:52:
dd:af:c3:b8:97:71:8f:cc:3a:81:94:38:24:e3:e9:d2:44:7b:
75:b3:86:ac:e8:f8:33:18:b6:50:d5:7c:ba:e4:49:b4:ca:7e:
df:9d:e3:02:01:fd:03:95:75:93:87:f5:6d:d6:b1:95:11:06:
91:f5:fd:49:99:1f:89:03:6a:7d:dc:64:f2:6d:3b:75:2a:2c:
fe:21:83:ee:c7:dd:01:8b:f1:7a:42:fb:07:36:72:1c:e0:35:
84:ad:02:a8:91:6e:e6:f8:4b:64:51:7c:42:08:27:37:00:d9:
8c:a3
-----BEGIN CERTIFICATE-----
MIID8TCCA1qgAwIBAgIJALfld9tWiCHCMA0GCSqGSIb3DQEBBQUAMFsxCzAJBgNV
BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQKEwpXaW5kIFJpdmVy
MQ0wCwYDVQQLEwRUZXN0MRMwEQYDVQQDEwpXUiBUZXN0IENBMB4XDTA4MDkyOTEx
NTMyNloXDTE2MTExNjExNTMyNlowgYQxCzAJBgNVBAYTAlNFMRIwEAYDVQQIEwlT
dG9ja2hvbG0xEjAQBgNVBAcTCVN0b2NraG9sbTETMBEGA1UEChMKV2luZCBSaXZl
cjEUMBIGA1UECxMLRGV2ZWxvcG1lbnQxIjAgBgNVBAMTGVdpbmQgUml2ZXIgSUtF
IGluaXRpYXRvciAwggG2MIIBKwYHKoZIzjgEATCCAR4CgYEA0ukY4izjqngRfzLC
/ejUT1Pfs4tla8n+oYrjNgf8nTYNNhqilT6b7zH1mL0gF08DDBdgc1KXQWP+5V8F
qaJvCZZdEgt582UcZoyj5ZyRibf/fnXnLgx2a3V19F5kxj9XL7q9e4bED1hVjYfz
PfmMksVv5kTZwh/0g32RohApFDUCFQCHebN6T2GRKt+cft8dMffixRIHpwKBgGHQ
hldcmySCR5A0++UGdU7IOOQ4VeqeR+0H1jSwkOKOCB5SzFfRtel3k78ttJuM79my
RzEzWhuF+XWjdRP9USF0zi1ZRM0VT3C7LBJA210MFHvbVGV9x3j5zJc9NlDc5H7T
HeRrMdPxAsbtTZx6nWT54exDoxF+qOwcVWY0vxxNA4GEAAKBgG5FFemHErsH8MdK
V8GfRwnYbBYQgRsXmRiU3WkoAV38t0Mayuer6TyUiD9ST/e+Os82Mi8ZXHLOUNhG
mVb/yrDlgjjwhOIUWodejVx5ibcHtvjMolRR0/5aG6LUrzFwRrNywSd/EvIrv4KL
a7K76swcPJnmh0bwVPon4gINdVOho3sweTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIB
DQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQU4y4E
LDK0brLGU8h19qrSRyT4oYYwHwYDVR0jBBgwFoAU3Wd3nPu7mNNm1OTZcWUls3vM
CIIwDQYJKoZIhvcNAQEFBQADgYEAS6LWPoSIALRwv5M909bsGTxS3a/DuJdxj8w6
gZQ4JOPp0kR7dbOGrOj4Mxi2UNV8uuRJtMp+353jAgH9A5V1k4f1bdaxlREGkfX9
SZkfiQNqfdxk8m07dSos/iGD7sfdAYvxekL7BzZyHOA1hK0CqJFu5vhLZFF8Qggn
NwDZjKM=
-----END CERTIFICATE-----
components/ip_net2-6.9/ipike/examples/ike_dsa_init.key
+15
View File
@@ -0,0 +1,15 @@
-----BEGIN DSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,18D400001054FC71
91jOS5cbX705QM/8UwWQR6Ne3jb07RsDyPADDPlRBFSSf8g3Hswuy30NTgSM8Xf5
DCgxrS0Q51v7X3xmveJRBuyivVS1luRyLg7B+Y1gwcVfzWvjqIOlU7pehXM3//I5
5uMFP4pN5qAN7gFlcipxT+LRqEHfAicTpBDaAuVNWwfT/1pCwnmcvHiLWjoNa3y6
FnuX+1I7sJo/G/cj9j80PkLCd1gLbuKmb8pYUXIKrytxoF0OHm454mWvyLZgpL0F
u1MjrKBowDWCMlmKPel3/M6GYOFwVNc0TCG7Y2DHPsycmcydQ7tEfZG48E3OLoJ7
qd6ULPHr1hvBit3T6k3iOZF6fMWoZRMelRQnSqWhhcPXTYE6gUT4fcDzGaJMqv0T
/v7p33VjlGqXsLD+Dmvd585q3MK+THEuAR3iy9qWSUl2Jkjc3dANvWmOhiywaDFY
+YJHVYb2xM24Ju4dYXSYi4YISWXUcco7O+YjZmLYDa9fiqFhe9UVBtvbZyg3tfFY
9u4dPceI9jq1l7Onv+tWIPqlh1qP64vFCl8nPooFlvZJNGEUeZNc5Z7BRH037e9h
xafordLZmd3ou2tb3f5gbg==
-----END DSA PRIVATE KEY-----
components/ip_net2-6.9/ipike/examples/ike_dsa_resp.cer
+90
View File
@@ -0,0 +1,90 @@
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
b7:e5:77:db:56:88:21:c5
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=US, ST=California, O=Wind River, OU=Test, CN=WR Test CA
Validity
Not Before: Sep 29 11:57:13 2008 GMT
Not After : Nov 16 11:57:13 2016 GMT
Subject: C=SE, ST=Stockholm, L=Stockholm, O=Wind River, OU=Development, CN=Wind River IKE responder
Subject Public Key Info:
Public Key Algorithm: dsaEncryption
DSA Public Key:
pub:
00:df:e6:e5:ba:53:87:07:e6:8c:3d:38:ba:7a:38:
65:1d:41:6b:bb:1c:ee:50:ed:f0:36:82:08:48:30:
3b:6a:8f:b6:e7:34:6c:e5:3d:3c:96:26:ed:25:39:
7f:e3:4e:4b:e6:82:ec:0d:cd:b8:a1:ca:dd:d7:f2:
ea:9c:88:1c:d2:99:d6:92:e9:37:19:9e:bd:bf:61:
33:72:8c:e0:da:9b:26:91:80:c5:6a:84:38:59:b2:
58:66:5e:8d:38:59:c7:b3:d1:5d:91:b8:c3:06:3d:
5e:b8:3d:3f:fd:e2:ed:eb:2e:7c:85:fc:ca:cb:4f:
f2:da:fc:b1:fa:24:9e:1b:d6
P:
00:ef:dc:80:3c:bb:69:d0:82:32:49:3d:51:65:4c:
4c:56:73:fc:db:68:6a:18:6c:c4:64:86:01:90:b4:
f3:c2:02:0b:3f:b2:f5:df:7f:5b:62:56:f8:ef:dc:
fb:71:93:04:fa:3d:ce:d0:ee:4b:78:2a:a1:0b:ab:
4c:6c:d7:49:e6:5e:90:9e:8a:6a:00:d4:66:09:f9:
3e:93:96:3c:07:6e:b3:30:bf:d4:61:89:08:af:91:
28:07:1f:f3:0a:2b:2d:15:cf:a6:11:51:93:67:c6:
9f:41:84:0c:16:83:ba:53:3a:6e:65:68:d5:d8:4d:
4e:6a:11:bb:55:c5:9e:63:5b
Q:
00:eb:f5:50:19:6f:e4:5d:1e:24:ce:d2:d8:5d:19:
b4:b6:d9:eb:03:d3
G:
00:92:39:36:20:dc:1b:74:28:e0:ac:2d:1e:94:81:
41:45:93:0c:d2:86:3f:df:dc:06:c7:7a:c3:f9:74:
2f:f4:65:f6:d1:79:fc:97:05:86:3a:fe:47:5d:5c:
fa:0b:f0:f9:ec:28:70:76:f2:97:e4:53:da:61:68:
77:55:56:ee:28:b5:3f:0c:d3:e0:12:04:7e:a2:c8:
22:76:8f:ab:93:26:ac:5f:af:4a:c3:b8:f2:a9:e0:
9f:87:5a:5c:c3:5f:48:4b:27:d0:76:f4:22:35:00:
a4:84:8a:af:ad:52:93:1b:58:34:ae:0f:0c:14:65:
55:2d:d5:ba:68:0c:4b:f2:65
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
28:70:ED:74:B6:2F:FC:C8:C7:EA:08:EF:AE:34:DA:68:36:91:7F:76
X509v3 Authority Key Identifier:
keyid:DD:67:77:9C:FB:BB:98:D3:66:D4:E4:D9:71:65:25:B3:7B:CC:08:82
Signature Algorithm: sha1WithRSAEncryption
93:45:8b:14:db:09:f0:52:9c:de:3b:d7:00:d4:f3:54:28:97:
a4:d3:19:a1:fe:ab:87:f6:62:cd:7a:92:75:ed:72:59:0a:15:
2e:37:da:44:6d:26:51:73:a6:ac:fe:dd:0c:6d:49:fb:fb:15:
53:11:73:e9:90:2a:21:79:a5:66:60:b7:0a:cf:69:fd:24:4d:
8e:1c:bb:ba:a9:32:a5:54:1f:e3:07:05:0e:8e:3c:e9:06:6e:
21:a7:e9:24:0d:78:f1:33:68:17:7e:a1:21:13:88:bf:4f:1e:
4a:6b:8a:c1:4a:a2:f9:18:5e:8e:89:e4:9f:52:fb:37:e7:34:
bc:aa
-----BEGIN CERTIFICATE-----
MIID8jCCA1ugAwIBAgIJALfld9tWiCHFMA0GCSqGSIb3DQEBBQUAMFsxCzAJBgNV
BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQKEwpXaW5kIFJpdmVy
MQ0wCwYDVQQLEwRUZXN0MRMwEQYDVQQDEwpXUiBUZXN0IENBMB4XDTA4MDkyOTEx
NTcxM1oXDTE2MTExNjExNTcxM1owgYMxCzAJBgNVBAYTAlNFMRIwEAYDVQQIEwlT
dG9ja2hvbG0xEjAQBgNVBAcTCVN0b2NraG9sbTETMBEGA1UEChMKV2luZCBSaXZl
cjEUMBIGA1UECxMLRGV2ZWxvcG1lbnQxITAfBgNVBAMTGFdpbmQgUml2ZXIgSUtF
IHJlc3BvbmRlcjCCAbgwggEsBgcqhkjOOAQBMIIBHwKBgQDv3IA8u2nQgjJJPVFl
TExWc/zbaGoYbMRkhgGQtPPCAgs/svXff1tiVvjv3PtxkwT6Pc7Q7kt4KqELq0xs
10nmXpCeimoA1GYJ+T6TljwHbrMwv9RhiQivkSgHH/MKKy0Vz6YRUZNnxp9BhAwW
g7pTOm5laNXYTU5qEbtVxZ5jWwIVAOv1UBlv5F0eJM7S2F0ZtLbZ6wPTAoGBAJI5
NiDcG3Qo4KwtHpSBQUWTDNKGP9/cBsd6w/l0L/Rl9tF5/JcFhjr+R11c+gvw+ewo
cHbyl+RT2mFod1VW7ii1PwzT4BIEfqLIInaPq5MmrF+vSsO48qngn4daXMNfSEsn
0Hb0IjUApISKr61SkxtYNK4PDBRlVS3VumgMS/JlA4GFAAKBgQDf5uW6U4cH5ow9
OLp6OGUdQWu7HO5Q7fA2gghIMDtqj7bnNGzlPTyWJu0lOX/jTkvmguwNzbihyt3X
8uqciBzSmdaS6TcZnr2/YTNyjODamyaRgMVqhDhZslhmXo04Wcez0V2RuMMGPV64
PT/94u3rLnyF/MrLT/La/LH6JJ4b1qN7MHkwCQYDVR0TBAIwADAsBglghkgBhvhC
AQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFChw
7XS2L/zIx+oI76402mg2kX92MB8GA1UdIwQYMBaAFN1nd5z7u5jTZtTk2XFlJbN7
zAiCMA0GCSqGSIb3DQEBBQUAA4GBAJNFixTbCfBSnN471wDU81Qol6TTGaH+q4f2
Ys16knXtclkKFS432kRtJlFzpqz+3QxtSfv7FVMRc+mQKiF5pWZgtwrPaf0kTY4c
u7qpMqVUH+MHBQ6OPOkGbiGn6SQNePEzaBd+oSETiL9PHkprisFKovkYXo6J5J9S
+zfnNLyq
-----END CERTIFICATE-----
components/ip_net2-6.9/ipike/examples/ike_dsa_resp.key
+15
View File
@@ -0,0 +1,15 @@
-----BEGIN DSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,D20664D973DDF430
nHp9i9jokQKY4Y5Pfi0BZdAZLyR34O5kgj5KnnSFVAcCcbH2RCO/SSu5/IXAzQDp
Qk7eVH/oxH6kYCZqt2fC3mLVwg+bBbl0zPB+zyxcg6QmZwscjct5Pc1N6f2owF/c
bve1Nr65P3TXCBDHohRneWFRLQWlAmCIoAW4IMgNmyo0fWDio7DCYAH02eOyhFHO
dkv5Z+BuUu/x4DxRf0mvrtkWNhCLzm4oFy+qTXb8ia01Q2ckk1jl1LMA1jF83nBO
tddzv9/PZBmMyEWVu396f71R9gID/62tC+IsCdxm7jtWHo30RhWZWU7q/KkJnarW
2V8HfcqKqHzwBc05H5HeiJcO41fD6Ftktfq9/kBejQwxv0oKFnxgsU7FR6dX0grO
iYczA2qsidSUBvcq6JJ40Y6m0ZyNjVDOf5JMbFPBq38tx7xTrd3bJNwfwEOtf6jd
3Hnt6iNAXMOHxNYfZk1wjbdX99Xs5DhYx7oDKc9pUsbjJtgDOeqCOaePLAKhzh0W
W8AYfN7nbyU7c6omZiCoGpQ/CqLMtEFRh0SBtnR73s01KdvCB/U33Uxbpvrab/V0
x9SErkBObVgfYukC1+ZW6TRhibNvom6J
-----END DSA PRIVATE KEY-----
components/ip_net2-6.9/ipike/examples/ike_rsa_init.cer
+62
View File
@@ -0,0 +1,62 @@
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
b7:e5:77:db:56:88:21:c3
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=US, ST=California, O=Wind River, OU=Test, CN=WR Test CA
Validity
Not Before: Sep 29 11:56:06 2008 GMT
Not After : Nov 16 11:56:06 2016 GMT
Subject: C=SE, ST=Stockholm, L=Stockholm, O=Wind River, OU=Development, CN=Wind River IKE initiator
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (1024 bit)
Modulus (1024 bit):
00:c1:b7:0d:07:fd:16:bb:21:94:5a:87:36:63:29:
46:15:a6:57:d9:e4:1e:1c:3b:b3:40:c4:5d:62:31:
a2:65:9d:4d:a7:22:a9:c4:2a:52:1f:59:6f:46:33:
75:30:9a:2f:28:a0:0c:92:a7:59:1e:5d:c7:80:26:
5e:1e:cd:e8:79:2d:5a:79:56:11:a5:cd:95:4e:cf:
36:cb:6b:a7:92:cf:0a:e1:5e:b2:ce:1f:93:3d:33:
37:64:69:72:47:9d:75:3a:e0:85:76:da:cd:b0:98:
fd:81:a2:6e:6a:b7:21:91:30:5b:e9:d1:b3:ef:87:
4e:62:dc:af:e2:8f:a1:00:55
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
C5:65:27:EC:6D:D7:44:A9:DD:7F:11:47:99:EF:10:06:46:84:53:31
X509v3 Authority Key Identifier:
keyid:DD:67:77:9C:FB:BB:98:D3:66:D4:E4:D9:71:65:25:B3:7B:CC:08:82
Signature Algorithm: sha1WithRSAEncryption
cc:f6:fc:11:00:6a:f5:b6:4a:ed:c7:8c:9c:7c:7b:4a:11:f0:
12:70:5c:9c:fb:e7:fd:49:5c:22:ff:43:dc:67:dd:d2:cc:6e:
df:b0:34:08:53:d9:72:4e:54:27:58:db:2f:12:cc:20:86:a4:
43:d4:53:e4:6f:39:58:cc:9b:ab:ce:e8:19:27:d8:22:f5:ad:
21:fa:ef:c5:c0:a6:c2:5d:a8:de:a0:ed:2a:16:3e:56:06:f4:
9c:24:34:34:10:b7:fe:f4:32:77:3c:ed:0f:a7:1d:a6:12:62:
34:bf:54:7d:14:41:d3:ac:ce:c9:35:ff:a4:ae:f1:55:44:e5:
81:e2
-----BEGIN CERTIFICATE-----
MIIC2DCCAkGgAwIBAgIJALfld9tWiCHDMA0GCSqGSIb3DQEBBQUAMFsxCzAJBgNV
BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQKEwpXaW5kIFJpdmVy
MQ0wCwYDVQQLEwRUZXN0MRMwEQYDVQQDEwpXUiBUZXN0IENBMB4XDTA4MDkyOTEx
NTYwNloXDTE2MTExNjExNTYwNlowgYMxCzAJBgNVBAYTAlNFMRIwEAYDVQQIEwlT
dG9ja2hvbG0xEjAQBgNVBAcTCVN0b2NraG9sbTETMBEGA1UEChMKV2luZCBSaXZl
cjEUMBIGA1UECxMLRGV2ZWxvcG1lbnQxITAfBgNVBAMTGFdpbmQgUml2ZXIgSUtF
IGluaXRpYXRvcjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAwbcNB/0WuyGU
Woc2YylGFaZX2eQeHDuzQMRdYjGiZZ1NpyKpxCpSH1lvRjN1MJovKKAMkqdZHl3H
gCZeHs3oeS1aeVYRpc2VTs82y2unks8K4V6yzh+TPTM3ZGlyR511OuCFdtrNsJj9
gaJuarchkTBb6dGz74dOYtyv4o+hAFUCAwEAAaN7MHkwCQYDVR0TBAIwADAsBglg
hkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0O
BBYEFMVlJ+xt10Sp3X8RR5nvEAZGhFMxMB8GA1UdIwQYMBaAFN1nd5z7u5jTZtTk
2XFlJbN7zAiCMA0GCSqGSIb3DQEBBQUAA4GBAMz2/BEAavW2Su3HjJx8e0oR8BJw
XJz75/1JXCL/Q9xn3dLMbt+wNAhT2XJOVCdY2y8SzCCGpEPUU+RvOVjMm6vO6Bkn
2CL1rSH678XApsJdqN6g7SoWPlYG9JwkNDQQt/70Mnc87Q+nHaYSYjS/VH0UQdOs
zsk1/6Su8VVE5YHi
-----END CERTIFICATE-----
components/ip_net2-6.9/ipike/examples/ike_rsa_init.key
+18
View File
@@ -0,0 +1,18 @@
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,FF2F04B8FEC650BC
XtaGhFHUx0sMQc3703tdbAaCeiZThmRcowq+6pDQfIPbAM5pou+vjszcbjfnJ5K9
ZSlcvmL8o/DyaRiDf4Bptb/jD2gy75bhcTClcj48WZdCdH/y9MQNifGmaYcYLA0G
NNk8J87eRChIPzRdkE0kutHIwZR5sXu39aXnwt57MPTrQ717gT+C/G/cLkttYfzS
eTldCugJNSJ2pY2PCW806bhqYuEJfqlq/fZo2EtasoPcKrJQB70LNQmtNp6UsZp6
2U4VGo77BPgQRUzb28OPH83YzWwZ/ieavwflXldB3H6yEPcm4L7hHLFD3YaoxZE9
BGU2DSgfwFK9lQPFBnTtA3DX+K0Xi9mifQiHx53uXGdSWcjkTHJqM/K3q+CInoCd
bvIIcTvxp8GYLYcAz3E468lXo3g+rIhZ4Hp5GvlX43wromouftvE18/E9VwFkA82
3+C4YoKo3PS0G2apQygLYspbYiZTnm+AANlKZaCN+pmVVefli+Rs8u82JhXeycVB
TsgSgRp/8rFBTVfdWI8IileTaddXqEt4rTtwloEz0IOaZc7rWfxMBOR2ygEsvwyW
38/bqj1c8SkXByiUbSLExOK5pWmVg5E7i4BKLZkLxg1+d8IHS6UeJJYxcVxoiBCZ
6BsG8/FdjHGtH4z9gEJMw3DzZeZB6dmBjS0phd8ZInH5lwzev7hdmwO1gaeJwjT1
XU4EsWgEW2YCuL8fTujvNO7S3YXi2ERVdxNN13yBb8Ad0qF7aYAxtIuedlAk5F2Y
ZkhSS0zFanuGAuhT6f5Wb2OwCBxsCQiqW2VkwfY71sjaNi7q+jy9tw==
-----END RSA PRIVATE KEY-----
components/ip_net2-6.9/ipike/examples/ike_rsa_resp.cer
+62
View File
@@ -0,0 +1,62 @@
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
b7:e5:77:db:56:88:21:c6
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=US, ST=California, O=Wind River, OU=Test, CN=WR Test CA
Validity
Not Before: Sep 29 11:57:24 2008 GMT
Not After : Nov 16 11:57:24 2016 GMT
Subject: C=SE, ST=Stockholm, L=Stockholm, O=Wind River, OU=Development, CN=Wind River IKE responder
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (1024 bit)
Modulus (1024 bit):
00:c6:24:a7:14:d9:34:8b:43:3f:0c:c9:7c:af:33:
f4:95:6a:f5:6f:8b:c9:c8:e0:f7:ab:7a:b2:8b:84:
0f:97:41:d1:c7:77:00:b7:27:57:6c:a8:b5:0e:20:
c7:8f:89:70:26:c3:21:c5:0c:83:ac:53:c2:37:f7:
16:b7:2e:a8:12:d9:48:07:c3:a6:cf:db:c0:8c:67:
fc:c3:6f:55:78:f7:fd:53:e7:91:ed:6a:fd:d3:8d:
15:fc:ef:ed:86:e3:84:5e:4f:6d:89:44:54:93:99:
b7:a5:42:4e:e0:13:7f:73:18:23:e1:e2:e5:e7:a6:
83:4e:ad:6b:85:b2:92:db:d9
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
D1:ED:0D:42:DB:A3:D0:70:DE:C0:7D:24:27:A5:DF:04:87:44:EF:4B
X509v3 Authority Key Identifier:
keyid:DD:67:77:9C:FB:BB:98:D3:66:D4:E4:D9:71:65:25:B3:7B:CC:08:82
Signature Algorithm: sha1WithRSAEncryption
19:cd:bd:69:a8:ee:7a:6f:96:05:de:2c:f4:a7:fa:f6:8f:72:
b4:ed:79:2b:39:75:99:3a:12:73:ed:39:b0:42:34:54:b7:75:
83:df:8a:b3:f3:5a:bf:7f:cd:bb:88:b2:d5:e3:cb:4e:c7:d5:
31:5d:b3:7e:05:fb:b2:16:78:b5:2f:6f:e1:8d:30:e7:75:ba:
7a:2f:72:57:63:3e:2e:d1:8e:83:d2:3a:04:ba:fd:47:54:f0:
69:ba:2b:a2:3e:82:7f:c1:3d:50:8a:8e:a9:f9:6f:b0:69:5a:
7f:fb:87:dd:44:98:e6:c6:e6:0a:c0:2e:ec:eb:1c:1d:b8:bd:
2d:93
-----BEGIN CERTIFICATE-----
MIIC2DCCAkGgAwIBAgIJALfld9tWiCHGMA0GCSqGSIb3DQEBBQUAMFsxCzAJBgNV
BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQKEwpXaW5kIFJpdmVy
MQ0wCwYDVQQLEwRUZXN0MRMwEQYDVQQDEwpXUiBUZXN0IENBMB4XDTA4MDkyOTEx
NTcyNFoXDTE2MTExNjExNTcyNFowgYMxCzAJBgNVBAYTAlNFMRIwEAYDVQQIEwlT
dG9ja2hvbG0xEjAQBgNVBAcTCVN0b2NraG9sbTETMBEGA1UEChMKV2luZCBSaXZl
cjEUMBIGA1UECxMLRGV2ZWxvcG1lbnQxITAfBgNVBAMTGFdpbmQgUml2ZXIgSUtF
IHJlc3BvbmRlcjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAxiSnFNk0i0M/
DMl8rzP0lWr1b4vJyOD3q3qyi4QPl0HRx3cAtydXbKi1DiDHj4lwJsMhxQyDrFPC
N/cWty6oEtlIB8Omz9vAjGf8w29VePf9U+eR7Wr9040V/O/thuOEXk9tiURUk5m3
pUJO4BN/cxgj4eLl56aDTq1rhbKS29kCAwEAAaN7MHkwCQYDVR0TBAIwADAsBglg
hkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0O
BBYEFNHtDULbo9Bw3sB9JCel3wSHRO9LMB8GA1UdIwQYMBaAFN1nd5z7u5jTZtTk
2XFlJbN7zAiCMA0GCSqGSIb3DQEBBQUAA4GBABnNvWmo7npvlgXeLPSn+vaPcrTt
eSs5dZk6EnPtObBCNFS3dYPfirPzWr9/zbuIstXjy07H1TFds34F+7IWeLUvb+GN
MOd1unovcldjPi7RjoPSOgS6/UdU8Gm6K6I+gn/BPVCKjqn5b7BpWn/7h91EmObG
5grALuzrHB24vS2T
-----END CERTIFICATE-----
components/ip_net2-6.9/ipike/examples/ike_rsa_resp.key
+18
View File
@@ -0,0 +1,18 @@
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,0EF49065AD10FF00
096x+gcl9Dbs4eeG+Qb6o5XdfCVJOFg5A52ogWDOvvPckQ7eDAdJ6s+NrWdrT3+M
EaB5gjdsZnl+9nOSIBzga0yLYJKr3+Er+eqVrnIq3hcWV9KqxlBuHwFbrle6AWYp
8hhTL1dXv8/5FjICsKm2ra6ZSJTkeNIXA87z0MUkYZ5F0mCY9+D//wg9QQXxT76v
BPQOz9ynVdVPh1IavWn4FwNPhnk+gshrQUGmdm2mM9lU46V2JWlZWQK0klemYGQa
xknDJ9SKLTDCWYvnExbGHgTt338jn6PWdIkYrBRMnmrtzSDoOeSDZvj9zpXPXKiw
QCMOPyTFColmYdcCuktfqIJOX+S89FQzq4aSNcn3A6554TM1sK4sQrel+sLPyfB0
SsycHTp7aDzPIrIYL05YjzTuDZUIhdQn3txagrFruIwgEqbrv4rmrvwZIeAk/Psq
zdpKEzarNEugx9W/PfN4YD6xEDdAj3xaA8yyn1mpk7V5AIugOnz1eiJDzDEwZ4sf
EsBq4RtIgOG1ooKp1eZkfRKfHwawqilKu3UwuaWSyqqTb9Q5jpsjAo1FEVvg7daU
CxdhQmNXNIS4DFYmDqXZ8J/nI8gDpSC/TDqutfHNGrM9AVRZJ2iNyGc+rDfE8/um
/aqRTIsaHBkQWXF28uRro2rSMVYafQiRQW2UC1m1JmdZwqkuRzyUaURUVstZre2E
dcgs4ro3eFY0aXmsyso8FPuO5eGb5kFsYS6gv9exYqdqRqG9fn9b7VyBp65uDi1q
EJCaf0SiFMcAhb9TICbjnVLegXkrCcNALHWj67fHMRfJz2lGJA5EXQ==
-----END RSA PRIVATE KEY-----
components/ip_net2-6.9/ipike/examples/initiator.cfg
+48
View File
@@ -0,0 +1,48 @@
# Update #INITIATOR to the ip address of the initiator system
# Update #RESPONDER to the ip address of the responder system
# Update #AUTHENTICATION_METHOD with the authentication method,
# pre_shared_key, rsa_signature or dss_signature.
# Update #CERTIFICATE to the file name of the certificiate used for
# authentication_method rsa_signature or dss_signature.
# Update #PRIVATE_KEY to the file name of the private key used for
# authentication_method rsa_signature or dss_signature.
general {
listen #INITIATOR;
exchange_max_time 30;
spi_min 100000;
spi_max 199999;
}
ike_sa address #RESPONDER {
ike_id default;
exchange_version 2,1;
passive off;
liveness 0;
initial_contact off;
lifetime 8 hours;
authentication {
method #AUTHENTICATION_METHOD;
shared_key this_should_be_secret;
certificate #CERTIFICATE;
private_key #PRIVATE_KEY;
private_key_password 1111;
trusted_ca_store trusted;
intermediate_ca_store intermediate;
}
proposal {
dh_group 2,1;
hash_algorithm sha1,md5;
encryption_algorithm 3des,des;
integrity_algorithm sha1,md5;
}
}
ipsec_sa address #INITIATOR address #RESPONDER {
ike_id default;
encapsulation_mode tunnel;
lifetime 3600 seconds;
proposal {
dh_group 2,1;
encryption_algorithm 3des,des;
integrity_algorithm sha1,md5;
}
}
components/ip_net2-6.9/ipike/examples/responder.cfg
+48
View File
@@ -0,0 +1,48 @@
# Update #INITIATOR to the ip address of the initiator system
# Update #RESPONDER to the ip address of the responder system
# Update #AUTHENTICATION_METHOD with the authentication method,
# pre_shared_key, rsa_signature or dss_signature.
# Update #CERTIFICATE to the file name of the certificiate used for
# authentication_method rsa_signature or dss_signature.
# Update #PRIVATE_KEY to the file name of the private key used for
# authentication_method rsa_signature or dss_signature.
general {
listen #RESPONDER;
exchange_max_time 30;
spi_min 100000;
spi_max 199999;
}
ike_sa address #INITIATOR {
ike_id default;
exchange_version 1,2;
passive on;
liveness 0;
initial_contact off;
lifetime 8 hours;
authentication {
method #AUTHENTICATION_METHOD;
shared_key this_should_be_secret;
certificate #CERTIFICATE;
private_key #PRIVATE_KEY;
private_key_password 1111;
trusted_ca_store trusted;
intermediate_ca_store intermediate;
}
proposal {
dh_group 2,1;
hash_algorithm sha1,md5;
encryption_algorithm 3des,des;
integrity_algorithm sha1,md5;
}
}
ipsec_sa address #RESPONDER address #INITIATOR {
ike_id default;
encapsulation_mode tunnel;
lifetime 3600 seconds;
proposal {
dh_group 2,1;
encryption_algorithm 3des,des;
integrity_algorithm sha1,md5;
}
}
components/ip_net2-6.9/ipike/examples/setup.tcl
+108
View File
@@ -0,0 +1,108 @@
#!/usr/bin/expect --
##############################################################################
# Updates the .cfg files and download
# them to the target systems
#
# Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: setup.tcl,v $ $Revision: 1.14 $
# $Source: /home/interpeak/CVSRoot/ipike/examples/setup.tcl,v $
# $Author: edahlber $ $Date: 2010-04-23 15:31:39 $
# $State: Exp $ $Locker: $
#
# Copyright Interpeak AB 2001 <www.interpeak.se>. All rights reserved.
# Created by Kenneth Jonsson <kenneth@interpeak.se>
##############################################################################
set prompt "(%|\#|\\$|>) ?$"
if { [llength $argv] != 5 } {
puts "Usage: setup.tcl ip_initiator ip_responder ftp_name ftp_login (pre|rsa|dss)\n"
exit
}
set auth_meth ""
if { "pre" == [lindex $argv 4] } {
set auth_meth "PRE_SHARED_KEY"
set private_key ""
set cert ""
}
if { "rsa" == [lindex $argv 4] } {
set auth_meth "RSA_SIGNATURE"
set private_key "ike_rsa_init.key ike_rsa_resp.key"
set cert "ike_rsa_init.cer ike_rsa_resp.cer"
}
if { "dss" == [lindex $argv 4] } {
set auth_meth "DSS_SIGNATURE"
set private_key "ike_dsa_init.key ike_dsa_resp.key"
set cert "ike_dsa_init.cer ike_dsa_resp.cer"
}
if { $auth_meth == "" } {
puts "The last argument must be pre, rsa or dss"
exit
}
set conffn "initiator.cfg responder.cfg"
set tempfn "initiator.bak responder.bak"
set ipaddr "#INITIATOR #RESPONDER"
set trusted_dir "trusted"
set intermediate_dir "intermediate"
for { set i 0 } {$i < 2} {incr i 1 } {
set f_handle [open [lindex $conffn $i] "r"]
set str [read $f_handle]
close $f_handle
regsub -all -- [lindex $ipaddr 0] $str [lindex $argv 0] str
regsub -all -- [lindex $ipaddr 1] $str [lindex $argv 1] str
regsub -all -- "#AUTHENTICATION_METHOD" $str $auth_meth str
if { $private_key == "" } {
regsub -all -- "#CERTIFICATE" $str "dummy" str
regsub -all -- "#PRIVATE_KEY" $str "dummy" str
} else {
regsub -all -- "#CERTIFICATE" $str [lindex $cert $i] str
regsub -all -- "#PRIVATE_KEY" $str [lindex $private_key $i] str
}
set f_handle [open [lindex $tempfn $i] "w"]
puts -nonewline $f_handle $str
close $f_handle
spawn ftp [lindex $argv $i]
expect "\): "
set user [lindex $argv 2]
send "$user\n"
expect "Password:"
set passwd [lindex $argv 3]
send "$passwd\n"
expect "ftp> "
set cfn [lindex $conffn $i]
set tfn [lindex $tempfn $i]
send "put $tfn ike.cfg\n"
expect "ftp> "
if { $private_key != "" } {
set certfn [lindex $cert $i]
set keyfn [lindex $private_key $i]
send "put $certfn\n"
expect "ftp> "
send "put $keyfn\n"
expect "ftp> "
send "mkdir $trusted_dir\n"
expect "ftp> "
send "mkdir $intermediate_dir\n"
expect "ftp> "
send "lcd $trusted_dir\n"
expect "ftp> "
send "cd $trusted_dir\n"
expect "ftp> "
send "put ca.cer\n"
expect "ftp> "
}
send "bye\n"
# Set date so that certificate verification will work
spawn telnet [lindex $argv $i] 2323
expect -re $prompt
send "date 2001-10-31\n"
expect -re $prompt
send "exit\n"
}
components/ip_net2-6.9/ipike/examples/trusted/ca.cer
+62
View File
@@ -0,0 +1,62 @@
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
b7:e5:77:db:56:88:21:ba
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=US, ST=California, O=Wind River, OU=Test, CN=WR Test CA
Validity
Not Before: Aug 5 11:29:33 2008 GMT
Not After : Aug 3 11:29:33 2018 GMT
Subject: C=US, ST=California, O=Wind River, OU=Test, CN=WR Test CA
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (1024 bit)
Modulus (1024 bit):
00:e7:03:b1:73:c2:d3:b0:b0:43:6d:54:97:c5:17:
9a:7f:90:83:72:c5:84:4a:df:b7:f5:1c:df:01:0d:
c5:ac:38:6e:d5:b6:81:e2:7a:5c:5c:7f:4b:81:49:
47:7e:2b:c0:71:cb:33:58:59:d4:4a:68:94:8a:c3:
e8:85:cd:7d:3a:8f:ad:94:74:0b:32:c8:d9:17:f2:
a7:57:0f:ed:b3:65:b5:13:81:40:a6:53:61:95:fc:
89:05:58:e1:70:70:08:e8:51:8b:1c:af:f0:88:4b:
c1:8f:d0:dd:34:ac:05:e9:28:2a:98:8b:64:aa:55:
73:8d:b0:7e:6f:46:18:6e:85
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
DD:67:77:9C:FB:BB:98:D3:66:D4:E4:D9:71:65:25:B3:7B:CC:08:82
X509v3 Authority Key Identifier:
keyid:DD:67:77:9C:FB:BB:98:D3:66:D4:E4:D9:71:65:25:B3:7B:CC:08:82
DirName:/C=US/ST=California/O=Wind River/OU=Test/CN=WR Test CA
serial:B7:E5:77:DB:56:88:21:BA
X509v3 Basic Constraints:
CA:TRUE
Signature Algorithm: sha1WithRSAEncryption
9d:a7:2c:8e:de:5d:28:15:b0:de:57:87:91:6a:81:ae:c2:6b:
73:57:d8:b6:b4:e1:27:2f:50:dc:df:3d:a7:36:69:de:65:18:
d1:79:2d:0b:53:49:f9:d7:52:1d:d1:5a:0a:92:22:52:d6:0d:
99:b6:4d:8c:86:f0:49:70:90:cd:45:ad:a2:14:80:f2:05:46:
f3:51:63:45:25:82:fd:ca:3e:46:66:a2:0e:87:30:7b:8b:60:
98:07:39:2c:f6:db:df:7a:46:02:87:ae:ad:be:68:e4:e1:2b:
50:b7:c4:0a:d4:ef:44:5c:f3:e4:aa:12:e0:f1:e5:e5:e3:59:
c6:25
-----BEGIN CERTIFICATE-----
MIIC9TCCAl6gAwIBAgIJALfld9tWiCG6MA0GCSqGSIb3DQEBBQUAMFsxCzAJBgNV
BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQKEwpXaW5kIFJpdmVy
MQ0wCwYDVQQLEwRUZXN0MRMwEQYDVQQDEwpXUiBUZXN0IENBMB4XDTA4MDgwNTEx
MjkzM1oXDTE4MDgwMzExMjkzM1owWzELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNh
bGlmb3JuaWExEzARBgNVBAoTCldpbmQgUml2ZXIxDTALBgNVBAsTBFRlc3QxEzAR
BgNVBAMTCldSIFRlc3QgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOcD
sXPC07CwQ21Ul8UXmn+Qg3LFhErft/Uc3wENxaw4btW2geJ6XFx/S4FJR34rwHHL
M1hZ1EpolIrD6IXNfTqPrZR0CzLI2Rfyp1cP7bNltROBQKZTYZX8iQVY4XBwCOhR
ixyv8IhLwY/Q3TSsBekoKpiLZKpVc42wfm9GGG6FAgMBAAGjgcAwgb0wHQYDVR0O
BBYEFN1nd5z7u5jTZtTk2XFlJbN7zAiCMIGNBgNVHSMEgYUwgYKAFN1nd5z7u5jT
ZtTk2XFlJbN7zAiCoV+kXTBbMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZv
cm5pYTETMBEGA1UEChMKV2luZCBSaXZlcjENMAsGA1UECxMEVGVzdDETMBEGA1UE
AxMKV1IgVGVzdCBDQYIJALfld9tWiCG6MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcN
AQEFBQADgYEAnacsjt5dKBWw3leHkWqBrsJrc1fYtrThJy9Q3N89pzZp3mUY0Xkt
C1NJ+ddSHdFaCpIiUtYNmbZNjIbwSXCQzUWtohSA8gVG81FjRSWC/co+RmaiDocw
e4tgmAc5LPbb33pGAoeurb5o5OErULfECtTvRFzz5KoS4PHl5eNZxiU=
-----END CERTIFICATE-----
components/ip_net2-6.9/ipike/gmake/Makefile
+10
View File
@@ -0,0 +1,10 @@
IPTARGETS := lib
ifneq ($(IPMAKEFILE),)
include $(IPMAKEFILE)
else
include $(IPCOM_ROOT)/Makefile
endif
include ipike.mk
include $(IPCOM_ROOT)/gmake/ipcom_make.mk
lib: dirs $(IPLIBFILE)
components/ip_net2-6.9/ipike/gmake/ipike.mk
+176
View File
@@ -0,0 +1,176 @@
#############################################################################
# IPIKE.MK
#
# Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike.mk,v $ $Revision: 1.16.10.2 $
# $Source: /home/interpeak/CVSRoot/ipike/gmake/ipike.mk,v $
# $Author: svc-cmnet $ $Date: 2013-03-13 07:45:25 $
# $State: Exp $ $Locker: $
#
# INTERPEAK_COPYRIGHT_STRING
#
#############################################################################
ifeq ($(IPIKE_MK_INCLUDED),)
IPIKE_MK_INCLUDED := yes
ifneq ($(IPPORT),lkm)
#############################################################################
# PRODUCT
###########################################################################
IPPROD ?= ipike
#############################################################################
# DEFINE
###########################################################################
IPDEFINE += -DIPIKE
#############################################################################
# INCLUDE
###########################################################################
IPINCLUDE += -I$(IPIKE_ROOT)/config
IPINCLUDE += -I$(IPIKE_ROOT)/include
#############################################################################
# OBJECTS
###########################################################################
# Configuration
IPLIBOBJECTS_C += ipike_config.o
# Main
IPLIBOBJECTS += ipike.o
IPLIBOBJECTS += ipike2_exchange_child_sa.o
IPLIBOBJECTS += ipike2_exchange_info.o
IPLIBOBJECTS += ipike2_exchange_sa_init.o
IPLIBOBJECTS += ipike2_payload_authentication.o
IPLIBOBJECTS += ipike2_payload_configuration.o
IPLIBOBJECTS += ipike2_payload_delete.o
IPLIBOBJECTS += ipike2_payload_eap.o
IPLIBOBJECTS += ipike2_payload_encrypted.o
IPLIBOBJECTS += ipike2_payload_identification.o
IPLIBOBJECTS += ipike2_payload_key_exchange.o
IPLIBOBJECTS += ipike2_payload_notify.o
IPLIBOBJECTS += ipike2_payload_sa.o
IPLIBOBJECTS += ipike2_payload_traffic_selector.o
IPLIBOBJECTS += ipike_attributes.o
IPLIBOBJECTS += ipike_cmd.o
IPLIBOBJECTS += ipike_configuration.o
IPLIBOBJECTS += ipike_configuration_api.o
IPLIBOBJECTS += ipike_configuration_file.o
IPLIBOBJECTS += ipike_configuration_parse.o
IPLIBOBJECTS += ipike_crypto.o
IPLIBOBJECTS += ipike_dispatcher.o
IPLIBOBJECTS += ipike_doi.o
IPLIBOBJECTS += ipike_dynamic_ip.o
IPLIBOBJECTS += ipike_exchange_aggressive_mode.o
IPLIBOBJECTS += ipike_exchange_informational.o
IPLIBOBJECTS += ipike_exchange_main_mode.o
IPLIBOBJECTS += ipike_exchange_quick_mode.o
IPLIBOBJECTS += ipike_exchange_transaction_mode.o
IPLIBOBJECTS += ipike_ipsec.o
IPLIBOBJECTS += ipike_ipsec_attributes.o
IPLIBOBJECTS += ipike_ipsec_sadb.o
IPLIBOBJECTS += ipike_isakmp.o
IPLIBOBJECTS += ipike_map.o
IPLIBOBJECTS += ipike_payload.o
IPLIBOBJECTS += ipike_payload_certificate.o
IPLIBOBJECTS += ipike_payload_delete.o
IPLIBOBJECTS += ipike_payload_hash.o
IPLIBOBJECTS += ipike_payload_identification.o
IPLIBOBJECTS += ipike_payload_key_exchange.o
IPLIBOBJECTS += ipike_payload_nat.o
IPLIBOBJECTS += ipike_payload_nonce.o
IPLIBOBJECTS += ipike_payload_notification.o
IPLIBOBJECTS += ipike_payload_proposal.o
IPLIBOBJECTS += ipike_payload_sa.o
IPLIBOBJECTS += ipike_payload_sign.o
IPLIBOBJECTS += ipike_payload_transform.o
IPLIBOBJECTS += ipike_payload_vendor_id.o
IPLIBOBJECTS += ipike_pfkeyv2.o
IPLIBOBJECTS += ipike_policy.o
IPLIBOBJECTS += ipike_radius.o
IPLIBOBJECTS += ipike_sadb.o
IPLIBOBJECTS += ipike_util.o
IPLIBOBJECTS += ipike_pfkeyv2_linux.o
IPLIBOBJECTS += ipike_http_fetcher.o
IPLIBOBJECTS += ipike_channel.o
IPLIBOBJECTS += ipike_event_server.o
IPLIBOBJECTS += ipike_system.o
# Compiles the xxx_config.o if the $SKIP_CONFIG macro is either not defined
# or set to anything other than true.
ifneq ($(SKIP_CONFIG),true)
IPLIBOBJECTS += $(IPLIBOBJECTS_C)
endif
#############################################################################
# VPATH
###########################################################################
IPSRCDIRS += $(IPIKE_ROOT)/src $(IPIKE_ROOT)/config
#############################################################################
# LIB
###########################################################################
IPLIBS += $(IPLIBROOT)/libipike.a
#############################################################################
# BINARIES
#############################################################################
ifeq ($(IPPORT),las)
# Path to binaries
IPCMDDIR := $(IPOBJDIR)/bin
IPDAEMONDIR := $(IPOBJDIR)/sbin
# List of shell commands to build
IPIKESHELLCMDS = ike
_IPIKESHELLCMDS = $(addprefix $(IPCMDDIR)/,$(IPIKESHELLCMDS))
# List of daemons to build
IPIKEDAEMONS = ipiked
_IPIKEDAEMONS = $(addprefix $(IPDAEMONDIR)/,$(IPIKEDAEMONS))
bin: $(_IPIKESHELLCMDS) $(_IPIKEDAEMONS)
$(IPOBJDIR)/ipike_cmd.o: $(IPIKE_ROOT)/src/ipike_cmd.c
@$(IPECHO) "+++ Compiling IPIKE shell command $<"
$(IPVERB)$(IPCC) -Dipike_cmd=ipcom_cmd_entry_point $(IPCFLAGS) -o $@ $<
$(IPOBJDIR)/ipike.o: $(IPIKE_ROOT)/src/ipike.c
@$(IPECHO) "+++ Compiling IPIKE daemon $<"
$(IPVERB)$(IPCC) -Dipike_proc=ipcom_daemon_entry_point -Dipike_create=ipcom_daemon_create $(IPCFLAGS) -o $@ $<
$(IPOBJDIR)/ipike_config.o: $(IPIKE_ROOT)/config/ipike_config.c
@$(IPECHO) "+++ Compiling IPIKE daemon $<"
$(IPVERB)$(IPCC) -Dipike_configure=ipcom_daemon_configure $(IPCFLAGS) -o $@ $<
# Linking shell commands and daemons
$(IPCMDDIR)/ike: $(IPOBJDIR)/ipike_cmd.o $(IPOBJDIR)/ipcom_shell_cmd_stub.o
@$(IPECHO) "+++ Linking IPIKE shell command $@"
$(IPVERB)$(IPLD) -o $@ $(IPLDFLAGS) $^ $(IPLIBS) $(IPLIBS) $(IPLIBS) $(IPLASTLIBS)
$(IPDAEMONDIR)/ipiked: $(IPOBJDIR)/ipike.o $(IPOBJDIR)/ipike_config.o $(IPOBJDIR)/ipcom_daemon_stub.o
@$(IPECHO) "+++ Linking IPIKE daemon $@"
$(IPVERB)$(IPLD) -o $@ $(IPLDFLAGS) $^ $(IPLIBS) $(IPLIBS) $(IPLIBS) $(IPLASTLIBS)
endif
endif
endif #IPIKE_MK_INCLUDED
###########################################################################
# END OF IPIKE.MK
###########################################################################
components/ip_net2-6.9/ipike/include/ipike.h
+212
View File
@@ -0,0 +1,212 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike.h,v $ $Revision: 1.35.10.6 $
* $Source: /home/interpeak/CVSRoot/ipike/include/ipike.h,v $
* $Author: hxu0 $ $Date: 2013-01-25 07:31:40 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#ifndef IPIKE_H
#define IPIKE_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_config.h"
#include <ipcom.h>
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
/*
*===========================================================================
* IPIKE_RELEASE
*===========================================================================
* IPIKE release version.
*/
#define IPIKE_RELEASE 60900
/*
*===========================================================================
* IPIKE_CMD_???
*===========================================================================
* IPIKE shell command signals
*/
#define IPIKE_CMD_LIST 0x80
#define IPIKE_CMD_STAT 0x81
#define IPIKE_CMD_CONFIG_DUMP 0x82
#define IPIKE_CMD_CONFIG_LOAD 0x83
#define IPIKE_CMD_CONFIG_ADD 0x84
#define IPIKE_CMD_CONFIG_DELETE 0x85
#define IPIKE_CMD_MOBIKE 0x86
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/* IKE errors */
typedef int Ipike_error;
#define IPIKE_SUCCESS 0
#define IPIKE_FAILED 1
#define IPIKE_OUT_OF_MEMORY 2
#define IPIKE_INVALID_VALUE 3
#define IPIKE_TRIED_TO_ADD_NULL 4
#define IPIKE_SEND_FAILED 5
#define IPIKE_RECEIVE_FAILED 6
#define IPIKE_ENCRYPTION_FAILED 7
#define IPIKE_DECRYPTION_FAILED 8
#define IPIKE_VALUE_NOT_FOUND 9
#define IPIKE_CONF_VALUE_NOT_FOUND 10
#define IPIKE_CONF_INVALID_VALUE 11
#define IPIKE_CONF_PARSE_ERROR 12
#define IPIKE_CONF_FORMAT_ERROR 13
#define IPIKE_CONF_FILE_NOT_FOUND 14
#define IPIKE_NOT_A_ISAKMP_PACKET 15
#define IPIKE_MISSING_PAYLOAD 16
#define IPIKE_ISAKMP_UNSUPPORTED_MAJOR_VERSION 17
#define IPIKE_ISAKMP_UNSUPPORTED_MINOR_VERSION 18
#define IPIKE_ISAKMP_LENGTH_ERROR 19
#define IPIKE_ISAKMP_PAYLOAD_LENGTH_ERROR 20
#define IPIKE_ISAKMP_NO_PAYLOAD 21
#define IPIKE_ISAKMP_UNSUPPORTED_PAYLOAD 22
#define IPIKE_ISAKMP_INVALID_PAYLOAD 23
#define IPIKE_ISAKMP_INVALID_MESSAGE_ID 24
#define IPIKE_ISAKMP_EXCHANGE_NOT_FOUND 25
#define IPIKE_ISAKMP_DUPLICATED_MESSAGE 26
/* Begin IKE v2 */
#define IPIKE_ISAKMP_UNSUPPORTED_CRITICAL_PAYLOAD 27
#define IPIKE_ISAKMP_INVALID_IKE_SPI 28
#define IPIKE_ISAKMP_INVALID_MAJOR_VERSION 29
#define IPIKE_ISAKMP_INVALID_SYNTAX 30
#define IPIKE_ISAKMP_INVALID_SPI 31
#define IPIKE_ISAKMP_NO_PROPOSAL_CHOSEN 32
#define IPIKE_ISAKMP_KE_PAYLOAD 33
#define IPIKE_ISAKMP_AUTHENTICATION_FAILED 34
#define IPIKE_ISAKMP_SINGLE_PAIR_REQUIRED 35
#define IPIKE_ISAKMP_NO_ADDITIONAL_SAS 36
#define IPIKE_ISAKMP_INTERNAL_ADDRESS_FAILURE 37
#define IPIKE_ISAKMP_FAILED_CP_REQUIRED 38
#define IPIKE_ISAKMP_TS_UNACCEPTABLE 39
#define IPIKE_ISAKMP_INVALID_SELECTORS 40
/* End IKE v2 */
#define IPIKE_SITUATION_UNSUPPORTED 41
#define IPIKE_SA_NOT_FOUND 42
#define IPIKE_SA_NO_PHASE_1_PARAMETERS 43
#define IPIKE_SA_NO_VALID_TRANSFORM_CONFIGURED 44
#define IPIKE_SA_ALREADY_EXISTS 45
#define IPIKE_SA_ADDRESS_MISMATCH 46
#define IPIKE_SA_NO_MATCHING_HASH_ALGORITHM 47
#define IPIKE_SA_NO_MATCHING_ENCRYPTION_ALGORITHM 48
#define IPIKE_SA_NO_ACCEPTED_PROPOSAL 49
#define IPIKE_SA_NO_ACCEPTED_TRANSFORM 50
#define IPIKE_SA_NO_PRE_SHARED_SECRET 51
#define IPIKE_SA_HASH_ALGORITHM_NOT_SUPPORTED 52
#define IPIKE_SA_ENCRYPTION_ALGORITHM_NOT_SUPPORTED 53
#define IPIKE_SA_AUTHENTICATION_ALGORITHM_NOT_SUPPORTED 54
#define IPIKE_SA_IPSEC_PROTO_MISMATCH 55
#define IPIKE_KE_DH_ERROR 56
#define IPIKE_PROPOSAL_INVALID_ID 57
#define IPIKE_NONCE_INVALID_SIZE 58
#define IPIKE_ATTRIBUTE_MUST_BE_BASIC 59
#define IPIKE_ATTRIBUTE_INVALID_TYPE 60
#define IPIKE_ATTRIBUTE_INVALID_VALUE 61
#define IPIKE_ATTRIBUTE_UNSUPPORTED_TYPE 62
#define IPIKE_ATTRIBUTE_UNSUPPORTED_VALUE 63
#define IPIKE_WRONG_PAYLOAD 64
#define IPIKE_EXCHANGE_TYPE_NOT_SUPPORTED 65
#define IPIKE_INVALID_EXCHANGE_TYPE 66
#define IPIKE_INVALID_MESSAGE_NUMBER 67
#define IPIKE_AUTHENTICATION_FAILED 68
#define IPIKE_INVALID_HASH_VALUE 69
#define IPIKE_PFKEY_ERROR 70
#define IPIKE_TIMEOUT 71
#define IPIKE_INTERNAL_ERROR 72
#define IPIKE_IPCOMCALL_ERROR 73
#define IPIKE_BIND_ERROR 74
#define IPIKE_SHUTDOWN 75
#define IPIKE_EXCH_FINNISHED 76
#define IPIKE_NOT_IMPLEMENTED 78
#define IPIKE_INVALID_COOKIE 79
#define IPIKE_DOI_UNSUPPORTED 80
#define IPIKE_BUFFER_TOO_SMALL 81
#define IPIKE_TOO_MANY_EXCHANGES 82
#define IPIKE_UNACCEPTABLE_ADDRESSES 83
#define IPIKE_UNEXPECTED_NAT_DETECTED 84
/* New error message. To be used incase of idtype mismatch */
#define IPIKE_ISAKMP_INVALID_ID_TYPE 85
#define IPIKE_CHILD_SA_NOT_FOUND 86
#define IPIKE_TEMPORARY_FAILURE 87
#define IPIKE_ISAKMP_INVALID_FLAGS 88
#define IPIKE_ISAKMP_INVALID_TRANSFORM_ID 89
#define IPIKE_ISAKMP_INVALID_SIGNATURE 90
#define IPIKE_ISAKMP_INVALID_CERT_ENCODING 91
#define IPIKE_ISAKMP_CERT_TYPE_UNSUPPORTED 92
#define IPIKE_ISAKMP_INVALID_CERT_AUTHORITY 93
#define IPIKE_ISAKMP_INVALID_PROPOSAL 94
#define IPIKE_ISAKMP_INVALID_PAYLOAD_PROPOSAL 95
#define IPIKE_ISAKMP_INVALID_LIFETIME 96
typedef struct Ipike_value_struct
{
/* binary value */
Ip_u8 *value;
/* length of the buffer pointed to by value */
Ip_size_t len;
}
Ipike_value;
/* Forward declaration */
struct Ipike_ipc_data_struct;
struct Ipcom_ipc_struct;
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/include/ipike_configuration_api.h
+864
View File
@@ -0,0 +1,864 @@
/* ipike_configuration_api.h - Public API of Wind River IKE */
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_configuration_api.h,v $ $Revision: 1.12.10.3 $
* $Source: /home/interpeak/CVSRoot/ipike/include/ipike_configuration_api.h,v $
* $Author: svc-cmnet $ $Date: 2013-03-13 07:45:25 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#ifndef IPIKE_CONFIGURATION_API_H
#define IPIKE_CONFIGURATION_API_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/*
DESCRIPTION
This file contains the API used for configuration of Wind River IKE.
*/
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
#define IPIKE_CONFIG_INVALID_VALUE -1
#define IPIKE_CONFIG_MAX_ID_LEN 64
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
typedef struct Ipike_config_api_proposal_struct
{
const char* dh_group;
const char* hash_alg;
const char* encryption_alg;
const char* integrity_alg;
const char* use_esn;
struct
{
const char* lifetime;
} v1;
const char* number;
}
Ipike_config_api_proposal;
typedef struct Ipike_config_api_rohc_struct
{
const char* max_cid;
const char* mrru;
const char* icv_len;
const char* integrity_alg;
const char* profiles;
}
Ipike_config_api_rohc;
typedef struct Ipike_config_api_general_struct
{
const char* listen;
Ip_u32 retransmits;
Ip_u32 exchange_max_time;
Ip_u32 spi_min;
Ip_u32 spi_max;
}
Ipike_config_api_general;
typedef struct Ipike_config_api_ike_sa_struct
{
const char* version;
const char* mode;
Ip_bool passive;
Ip_bool initial_contact;
Ip_bool reauth; /* IKE SA rekeying, reauthentication yes/no. Default = yes */
Ip_s32 liveness;
const char* local_address;
const char* remote_address;
const char* local_id;
const char* remote_id;
const char* lifetime;
struct
{
const char* method;
const char* psk_id;
const char* shared_key;
const char* certificate;
const char* certificate_uri;
const char* send_certificate;
const char* request_certificate;
const char* ocsp_response;
const char* remote_certificate;
const char* key_id;
const char* private_key;
const char* private_key_password;
const char* trusted_ca_store;
const char* crl_store;
const char* intermediate_ca_store;
const char* identity;
} authentication;
struct
{
const char* server_address;
const char* local_address;
const char* shared_secret;
} radius;
}
Ipike_config_api_ike_sa;
typedef struct Ipike_config_api_ipsec_flow_struct
{
const char* src_address;
const char* dst_address;
const char* src_port;
const char* dst_port;
const char* protocol;
}
Ipike_config_api_ipsec_flow;
typedef struct Ipike_config_api_ipsec_sa_struct
{
const char *ike_id;
const char *encap_mode;
const char *lifetime;
const char *use_tfc;
const char *dynamic_address;
const char *flowtype; /* flowtype: none,require,acquire */
const char *use_ecn;
const char *granularity;
Ip_u32 replay_window;
Ipike_config_api_ipsec_flow flow;
Ipike_config_api_ipsec_flow flow_end; /* Address/Port range support */
}
Ipike_config_api_ipsec_sa;
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*******************************************************************************
*
* ipike_config_api_new - create a new configuration context
*
* This routine creates a new configuration context. Depending on the value in
* the <load_current> parameter, either the current context is copied to the new
* context or the context is left empty.
*
* Parameter:
* \is
* \i <load_current>
* A boolean value, either 'IP_TRUE', in which case the current configuration is
* to be loaded into the new context, or 'IP_FALSE', in which case the context is
* left empty.
* \ie
*
* RETURNS: Returns a pointer to the configuration context or 'IP_NULL,' if the
* context could not be allocated.
*
* ERRNO:
*/
IP_PUBLIC void* ipike_config_api_new
(
Ip_bool load_current
);
/*******************************************************************************
*
* ipike_config_api_free - release resources allocated in the config context
*
* This routine releases all resources allocated in the configuration context.
* This routine must be called when finished using the context.
*
* Parameter:
* \is
* \i <conf>
* A pointer to void for an 'Ipike_config_api_ike' structure specifying the
* configuration context. The pointer is returned by the ipike_config_api_new()
* routine.
* \ie
*
* RETURNS: N/A
*
* ERRNO:
*/
IP_PUBLIC void ipike_config_api_free
(
void* conf
);
/*******************************************************************************
*
* ipike_config_api_import - import the configuration from a data buffer
*
* This routine imports the configuration from a data buffer. The data must be
* formatted according to the standard configuration file format or the output
* from the ipike_config_api_export() routine.
*
* Parameters:
* \is
* \i <conf>
* A pointer to a configuration context created by the ipike_config_api_new()
* routine.
* \i <buf>
* A pointer to the buffer with the configuration data.
* \i <buf_len>
* The size of the buffer.
* \ie
*
* RETURNS: 'IPIKE_SUCCESS', or an error listed in the file 'ipike.h'.
*
* ERRNO:
*/
IP_PUBLIC Ipike_error ipike_config_api_import
(
void* conf,
const char* buf,
Ip_size_t buf_len
);
/*******************************************************************************
*
* ipike_config_api_export - export the configuration context to a data buffer
*
* This routine exports the configuration context to a data buffer. The data is
* formatted according to the standard configuration file format and can be used
* as input to ipike_config_api_import().
*
* Parameters:
* \is
* \i <conf>
* A pointer to a configuration context created by the ipike_config_api_new()
* routine.
* \i <buf>
* A pointer to the buffer that will receive the configuration data. Set the
* pointer to 'IP_NULL,' if the buf_len parameter is to return the number of
* bytes needed.
* \i <buf_len>
* A pointer to the size, in bytes, of the configuration data buffer; on return,
* <buf_len> points to the number of bytes used for the configuration data.
* \ie
*
* RETURNS: 'IPIKE_SUCCESS', or an error listed in the file 'ipike.h'.
*
* ERRNO:
*/
IP_PUBLIC Ipike_error ipike_config_api_export
(
void* conf,
char* buf,
Ip_size_t* buf_len
);
/*******************************************************************************
*
* ipike_config_api_validate - validate the configuration context
*
* This routine validates the configuration context. Sets all needed default
* values and does error checking. This routine must complete successfully
* before the ipike_config_api_commit() routine tries to set the configuration
* context to IPIKE daemon.
*
* Parameter:
* \is
* \i <conf>
* A pointer to the configuration context to be validated.
* \ie
*
* RETURNS: 'IPIKE_SUCCESS', or an error listed in the file 'ipike.h'.
*
* ERRNO:
*/
IP_PUBLIC Ipike_error ipike_config_api_validate
(
void* conf
);
/*******************************************************************************
*
* ipike_config_api_commit - commit a new configuration context
*
* This routine commits a new configuration context; it replaces the current
* IPIKE daemon configuration with the new configuration pointed to by the <conf>
* parameter. The ipike_config_api_validate routine must complete successfully
* before the new configuration can replace the current configuration. If the new
* context has not already been validated with ipike_config_api_validate(),
* ipike_config_api_commit() calls ipike_config_api_validate() internally.
*
* Parameter:
* \is
* \i <conf>
* A pointer to the configuration context to commit.
* \ie
*
* RETURNS: 'IPIKE_SUCCESS', or an error listed in the file 'ipike.h'.
*
* ERRNO:
*/
IP_PUBLIC Ipike_error ipike_config_api_commit
(
void* conf
);
/*******************************************************************************
*
* ipike_config_api_set_general - set general-param section of a config
*
* This routine sets the general-parameters section of a configuration. Existing
* parameter values are overwritten.
*
* Parameters:
* \is
* \i <conf>
* A pointer to the configuration context.
* \i <ipike_config_api_general* general>
* A pointer to a general parameters structure ('ipike_config_api_general') to be
* copied into the configuration context.
* \ie
*
* RETURNS: 'IPIKE_SUCCESS', or an error listed in the file 'ipike.h'.
*
* ERRNO:
*/
IP_PUBLIC Ipike_error ipike_config_api_set_general
(
void* conf,
Ipike_config_api_general* general
);
/*******************************************************************************
*
* ipike_config_api_set_ike_sa - set an IKE SA in a configuration
*
* This routine sets IKE SA parameters in a configuration context. Any existing
* IKE SA parameters with the same 'ike_id' value will be overwritten.
*
* Parameters:
* \is
* \i <conf>
* A pointer to the configuration context.
* \i <ike_id>
* A string identifying the IKE SA to set. The string must not exceed
* 'IPIKE_CONFIG_MAX_ID_LEN' bytes. Enter an empty string to set the default IKE
* SA parameter values.
* \i <ike_sa>
* A pointer to an IKE SA structure to be copied into the configuration context.
* The values are copied to the configuration context, so this structure can
* safely be deleted.
* \ie
*
* RETURNS: 'IPIKE_SUCCESS', or an error listed in the file 'ipike.h'.
*
* ERRNO:
*/
IP_PUBLIC Ipike_error ipike_config_api_set_ike_sa
(
void* conf,
const char ike_id[IPIKE_CONFIG_MAX_ID_LEN],
Ipike_config_api_ike_sa* ike
);
/*******************************************************************************
*
* ipike_config_api_set_ipsec_sa - set an IPSec SA in a configuration
*
* This routine sets IPsec SA parameters in a configuration context. Any existing
* IPsec SA parameters with the same 'ipsec_id' value will be overwritten.
*
* Parameters:
* \is
* \i <conf>
* A pointer to the configuration context.
* \i <ipsec_id>
* A string identifying the IPsec SA to set. The string must not exceed
* 'IPIKE_CONFIG_MAX_ID_LEN' bytes. Enter an empty string to set the default
* IPsec SA parameter values.
* \i <ipsec_sa>
* A pointer to an IPsec SA structure to be copied into the configuration
* context. The values are copied to the configuration context, so this structure
* can safely be deleted.
* \ie
*
* RETURNS: 'IPIKE_SUCCESS', or an error listed in the file 'ipike.h'.
*
* ERRNO:
*/
IP_PUBLIC Ipike_error ipike_config_api_set_ipsec_sa
(
void* conf,
const char ipsec_id[IPIKE_CONFIG_MAX_ID_LEN],
Ipike_config_api_ipsec_sa* ipsec
);
/*******************************************************************************
*
* ipike_config_api_set_ike_sa_proposal - set an IKE SA proposal in a config
*
* This routine sets parameters for a specific proposal associated with a
* specific IKE SA in a configuration context. Any existing IKE SA proposal
* parameters with the same 'ike_id' and 'prop_id' values will be overwritten.
*
* Parameters:
* \is
* \i <conf>
* pointer to the configuration context.
* \i <ike_id>
* A string with the 'ike_sa' identifier of an existing IKE SA.
* \i <prop_id>
* A pointer to a proposal identifier. To return a proposal identifier in
* <prop_id>, set <prop_id> to 'IPIKE_CONFIG_INVALID_VALUE'.
* \i <proposal>
* pointer to an IKE SA proposal structure to be copied into the configuration
* context. The values are copied to the configuration context, so this structure
* can be safely deleted.
* \ie
*
* RETURNS: 'IPIKE_SUCCESS', or an error listed in the file 'ipike.h'.
*
* ERRNO:
*/
IP_PUBLIC Ipike_error ipike_config_api_set_ike_sa_proposal
(
void* conf,
const char ike_id[IPIKE_CONFIG_MAX_ID_LEN],
int* proposal_id,
Ipike_config_api_proposal* proposal
);
/*******************************************************************************
*
* ipike_config_api_set_ipsec_sa_proposal - set IPSEC SA proposal in a config
*
* This routine sets parameters for a specific proposal associated with a
* specific IPsec SA in a configuration context. Any existing IPsec SA proposal
* parameters with the same 'ipsec_id' and 'prop_id' values will be overwritten.
*
* Parameters:
* \is
* \i <conf>
* pointer to the configuration context.
* \i <ipsec_id>
* A string with the 'ipsec_sa' identifier for an existing IPSec SA.
* \i <prop_id>
* A pointer to a proposal identifier. To return a proposal identifier in
* <prop_id>, set <prop_id> to 'IPIKE_CONFIG_INVALID_VALUE'.
* \i <proposal>
* A pointer to an IPsec SA proposal structure to be copied into the
* configuration context. The values are copied to the configuration context, so
* this structure can be safely deleted.
* \ie
*
* RETURNS: 'IPIKE_SUCCESS', or an error listed in the file 'ipike.h'.
*
* ERRNO:
*/
IP_PUBLIC Ipike_error ipike_config_api_set_ipsec_sa_proposal
(
void* conf,
const char ipsec_id[IPIKE_CONFIG_MAX_ID_LEN],
int* proposal_id,
Ipike_config_api_proposal* proposal
);
/*******************************************************************************
*
* ipike_config_api_set_ipsec_sa_rohc - set ROHC parameters in an IPsec SA config
*
* This routine sets ROHC parameters for a specific IPsec SA in a configuration
* context. Any existing ROHC parameters in the IPsec SA configuration will be
* overwritten.
*
* Parameters:
* \is
* \i <conf>
* pointer to the configuration context.
* \i <ipsec_id>
* A string with the 'ipsec_sa' identifier for an existing IPSec SA.
* \i <rohc>
* A pointer to an IPsec SA ROHC structure to be copied into the
* configuration context. The values are copied to the configuration context, so
* this structure can be safely deleted.*
* \ie
*
* RETURNS: 'IPIKE_SUCCESS', or an error listed in the file 'ipike.h'.
*
* ERRNO:
*/
IP_PUBLIC Ipike_error
ipike_config_api_set_ipsec_sa_rohc(
void* conf,
const char ipsec_id[IPIKE_CONFIG_MAX_ID_LEN],
Ipike_config_api_rohc * rohc);
/*******************************************************************************
*
* ipike_config_api_get_ipsec_sa_rohc - get ROHC parameters from an IPsec SA config
*
* This routine gets ROHC parameters for a specific IPsec SA in a configuration
* context.
*
* Parameters:
* \is
* \i <conf>
* pointer to the configuration context.
* \i <ipsec_id>
* A string with the 'ipsec_sa' identifier for an existing IPSec SA.
* \i <rohc>
* A pointer to an Ipike_config_api_rohc' structure for receiving the fetched
* parameter values.
* \ie
*
* RETURNS: 'IPIKE_SUCCESS', or an error listed in the file 'ipike.h'.
*
* ERRNO:
*/
IP_PUBLIC Ipike_error
ipike_config_api_get_ipsec_sa_rohc(
void* p,
const char ipsec_id[IPIKE_CONFIG_MAX_ID_LEN],
Ipike_config_api_rohc * rohc);
/*******************************************************************************
*
* ipike_config_api_get_general - get the general parameters of a configuration
*
* This routine gets the general parameters of a configuration context. Call
* ipike_config_api_release_general to release the structure.
*
* Parameters:
* \is
* \i <conf>
* A pointer to the configuration context.
* \i <general>
* A pointer to an 'ipike_config_api_general' structure for receiving the fetched
* parameter values.
* \ie
*
* RETURNS: 'IPIKE_SUCCESS', or an error listed in the file 'ipike.h'.
*
* ERRNO:
*/
IP_PUBLIC Ipike_error ipike_config_api_get_general
(
void* conf,
Ipike_config_api_general* general
);
/*******************************************************************************
*
* ipike_config_api_get_next_ike_sa - get an IKE SA in a configuration
*
* Get an IKE SA in a configuration. Call ipike_config_api_release_ike_sa to
* release the structure.
*
* Parameters:
* \is
* \i <conf>
* A pointer to the configuration context.
* \i <ike_id>
* A character array for receiving the identifier of the IKE SA.
* \i <ike_sa>
* A pointer to an 'Ipike_config_api_ike_sa' structure for receiving the IKE SA.
* \i <pos>
* A pointer to the position of an IKE SA in a configuration. On return, the
* parameter references the position of the next SA in the configuration. To get
* the position of the first IKE SA, set <pos> to 'IPIKE_CONFIG_INVALID_VALUE'.
* \ie
*
* RETURNS: 'IPIKE_SUCCESS', or an error listed in the file 'ipike.h'.
*
* ERRNO:
*/
IP_PUBLIC Ipike_error ipike_config_api_get_next_ike_sa
(
void* conf,
char ike_id[IPIKE_CONFIG_MAX_ID_LEN],
Ipike_config_api_ike_sa* ike,
int* pos
);
/*******************************************************************************
*
* ipike_config_api_get_next_ipsec_sa - get an IPSec SA from a configuration
*
* Get an IPSec SA from a configuration. Call ipike_config_api_release_ipsec_sa
* to release the structure.
*
* Parameters:
* \is
* \i <conf>
* A pointer to the configuration context.
* \i <ipsec_id>
* A character array for receiving the identifier of the IPSec SA.
* \i <ipsec_sa>
* A pointer to an 'Ipike_config_api_ike_sa' structure for receiving the IPSec
* SA.
* \i <pos>
* A pointer to the position of an IKE SA in a configuration. On return, the
* parameter references the position of the next SA in the configuration. To
* get the position of the first IKE SA, set <pos> to
* 'IPIKE_CONFIG_INVALID_VALUE'.
* \ie
*
* RETURNS: 'IPIKE_SUCCESS', or an error listed in the file 'ipike.h'.
*
* ERRNO:
*/
IP_PUBLIC Ipike_error ipike_config_api_get_next_ipsec_sa
(
void* conf,
char ipsec_id[IPIKE_CONFIG_MAX_ID_LEN],
Ipike_config_api_ipsec_sa* ipsec,
int* pos
);
/*******************************************************************************
*
* ipike_config_api_get_next_ike_sa_proposal - get SA proposal from config
*
* Get an IKE SA proposal from a configuration context. Call
* ipike_config_api_release_proposal to release the structure.
*
* Parameters:
* \is
* \i <conf>
* A pointer to the configuration context.
* \i <ike_id>
* A string with the IKE SA identifier for an existing IKE SA.
* \i <prop_id>
* A pointer to 'int' for receiving the proposal ID.
* \i <proposal>
* A pointer to an 'ipike_config_api_proposal' structure for receiving the
* proposal configuration structure values.
* \i <pos>
* A pointer to the position of an IKE SA proposal in a configuration. On
* return, the parameter references the position of the next IKE SA
* proposal in the configuration. To get the position of the first proposal,
* set <pos> to 'IPIKE_CONFIG_INVALID_VALUE'.
* \ie
*
* RETURNS: 'IPIKE_SUCCESS', or an error listed in the file 'ipike.h'.
*
* ERRNO:
*/
IP_PUBLIC Ipike_error ipike_config_api_get_next_ike_sa_proposal
(
void* conf,
const char ike_id[IPIKE_CONFIG_MAX_ID_LEN],
int* proposal_id,
Ipike_config_api_proposal* proposal,
int* pos
);
/*******************************************************************************
*
* ipike_config_api_get_next_ipsec_sa_proposal - get SA proposal from config
*
* Get an IPSec SA proposal from a configuration. Call
* ipike_config_api_release_proposal to release the structure.
*
* Parameters:
* \is
* \i <conf>
* A pointer to the configuration context.
* \i <ipsec_id>
* A string containing the IPSec SA identifier for an IPSec SA.
* \i <prop_id>
* A pointer to 'int' for receiving the proposal ID.
* \i <proposal>
* A pointer to an 'Ipike_config_api_proposal' structure for receiving the
* proposal configuration structure values.
* \i <pos>
* A pointer to the position of an IPSec SA proposal in a configuration. On
* return, the parameter references the position of the next IPSec SA proposal
* in the configuration. To get the position of the first proposal, set <pos> to
* 'IPIKE_CONFIG_INVALID_VALUE'.
* \ie
*
* RETURNS: 'IPIKE_SUCCESS', or an error listed in the file 'ipike.h'.
*
* ERRNO:
*/
IP_PUBLIC Ipike_error ipike_config_api_get_next_ipsec_sa_proposal
(
void* conf,
const char ipsec_id[IPIKE_CONFIG_MAX_ID_LEN],
int* proposal_id,
Ipike_config_api_proposal* proposal,
int* pos
);
/*******************************************************************************
*
* ipike_config_api_release_general - release allocated general structure values
*
* Release memory containing general structure values allocated by
* ipike_config_api_get_general().
*
* Parameter:
* \is
* \i <general>
* A pointer to the 'ipike_config_api_general' structure to release.
* \ie
*
* RETURNS: N/A
*
* ERRNO:
*/
IP_PUBLIC void ipike_config_api_release_general
(
Ipike_config_api_general* general
);
/*******************************************************************************
*
* ipike_config_api_release_ike_sa - release 'ike_sa' structure values
*
* Release memory containing the 'ike_sa' structure values allocated by
* ipike_config_api_get_next_ike_sa.
*
* Parameter:
* \is
* \i <ike_sa>
* A pointer to the 'ipike_config_api_ike_sa' structure to be released.
* \ie
*
* RETURNS: N/A
*
* ERRNO:
*/
IP_PUBLIC void ipike_config_api_release_ike_sa
(
Ipike_config_api_ike_sa* ike
);
/*******************************************************************************
*
* ipike_config_api_release_ipsec_sa - release 'ipsec_sa' structure values
*
* Release memory containing the 'ipsec_sa' structure values allocated by
* ipike_config_api_get_next_ipsec_sa.
*
* Parameter:
* \is
* \i <ipsec_sa>
* A pointer to the 'Ipike_config_api_ipsec_sa' configuration structure to be
* released.
* \ie
*
* RETURNS: N/A
*
* ERRNO:
*/
IP_PUBLIC void ipike_config_api_release_ipsec_sa
(
Ipike_config_api_ipsec_sa* ipsec
);
/*******************************************************************************
*
* ipike_config_api_release_proposal - release sa_proposal struct values
*
* Release memory containing structure values allocated by either
* ipike_config_api_get_next_ike_sa_proposal or
* ipike_config_api_get_next_ipsec_sa_proposal.
*
* Parameter:
* \is
* \i <proposal>
* A pointer to the 'Ipike_config_api_proposal' proposal configuration structure
* to be released.
* \ie
*
* RETURNS: N/A
*
* ERRNO:
*/
IP_PUBLIC void ipike_config_api_release_proposal
(
Ipike_config_api_proposal* prop
);
/*******************************************************************************
*
* ipike_config_api_release_rohc - release rohc struct values
*
* Release memory containing structure values allocated by
* ipike_config_api_get_ipsec_sa_rohc
*
* Parameter:
* \is
* \i <proposal>
* A pointer to the 'Ipike_config_api_rohc' ROHC configuration structure
* to be released.
* \ie
*
* RETURNS: N/A
*
* ERRNO:
*/
IP_PUBLIC void
ipike_config_api_release_rohc(Ipike_config_api_rohc *rohc);
/*
*===========================================================================
* ipike_config_api_from_config
*===========================================================================
* Description: Create a new configuration context from internal
* configuration structure.
* Parameters: config - the configuration structure.
* Returns: A pointer to the new structure (else IP_NULL)
*/
IP_GLOBAL void* ipike_config_api_from_config
(
void* config
);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/include/ipike_event.h
+170
View File
@@ -0,0 +1,170 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_event.h,v $ $Revision: 1.2.2.3 $
* $Source: /home/interpeak/CVSRoot/ipike/include/ipike_event.h,v $
* $Author: jwang9 $ $Date: 2014-12-04 08:32:19 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Erik Dahlberg <erik.dahlberg@windriver.com>
******************************************************************************
*/
#ifndef IPIKE_EVENT_H_
#define IPIKE_EVENT_H_
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
#ifdef IPIKE_USE_EVENT_LOG
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
/* Needed for the Ipike_event_msg definition */
#include "../src/ipike_channel.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/* Event Types */
typedef enum Ipike_event_type_enum
{
IPIKE_EVENT_SOFT_LIFE_SIZE_EXPIRED = 0,
IPIKE_EVENT_SOFT_LIFE_TIME_EXPIRED,
IPIKE_EVENT_HARD_LIFE_SIZE_EXPIRED,
IPIKE_EVENT_HARD_LIFE_TIME_EXPIRED,
IPIKE_EVENT_IKE_PACKET_DISCARD,
IPIKE_EVENT_IKE_PHASE_I_FAIL,
IPIKE_EVENT_IKE_PHASE_I_SUCCESS,
IPIKE_EVENT_IKE_PHASE_II_FAIL,
IPIKE_EVENT_IKE_PHASE_II_SUCCESS,
IPIKE_EVENT_IPSEC_PACKET_DISCARD,
IPIKE_EVENT_SEQUENCE_NUM_OVERFLOW,
IPIKE_EVENT_SPD_PACKET_DISCARD,
IPIKE_EVENT_MAX,
} Ipike_event_type;
/* Event reasons */
typedef enum Ipike_event_reason_enum
{
IPIKE_REASON_UNDEFINED = 0,
IPIKE_REASON_AUTHENTICATION_ERROR,
IPIKE_REASON_DECRYPTION_ERROR,
IPIKE_REASON_ENCRYPTION_ERROR,
IPIKE_REASON_EXPLICIT_DISCARD_POLICY,
IPIKE_REASON_INVALID_SPI_ERROR,
IPIKE_REASON_NEGOTIATION_TIMEOUT,
IPIKE_REASON_NO_POLICY,
IPIKE_REASON_NO_PROTECTION_SUITE,
IPIKE_REASON_POLICY_ERROR,
IPIKE_REASON_REPLAY_ERROR,
IPIKE_REASON_IPSEC_INTERNAL_ERROR,
IPIKE_REASON_ISAKMP_PACKET_ERROR,
IPIKE_REASON_PROPOSAL_MISMATCH,
IPIKE_REASON_PSK_MISMATCH,
IPIKE_REASON_FLOW_MISMATCH,
IPIKE_REASON_IKE_INTERNAL_ERROR,
IPIKE_REASON_IKE_SA_OVERFLOW,
IPIKE_REASON_IPSEC_SA_OVERFLOW,
IPIKE_REASON_MAX,
} Ipike_event_reason;
/* Event structure */
typedef struct Ipike_event_struct
{
Ip_u16 type;
Ip_u16 reason;
Ip_u8 protocol;
Ip_u8 sa_family;
Ip_u16 src_port;
Ip_u16 dst_port;
Ip_u32 spi;
union Ip_sockaddr_union src_ip;
union Ip_sockaddr_union dst_ip;
} Ipike_event;
/* Event message definition, needs to be exposed so the IPsec module can
* generate complete event messages which can be relayed by IPIKE daemon */
typedef struct Ipike_event_msg_struct
{
Ipike_channel_msg hdr;
Ipike_event event;
} Ipike_event_msg;
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_event_type_str
*===========================================================================
* Description: Returns the string representation of an event type.
*
* Parameters: type - Event type
* Returns: Event string or
* "TYPE_UNKNOWN" if the event type is unrecognizable
*/
IP_PUBLIC const char *
ipike_event_type_str(Ip_u16 type);
/*
*===========================================================================
* ipike_event_reason_str
*===========================================================================
* Description: Returns the string representation of an event reason.
*
* Parameters: type - Event reason
* Returns: Event reason string or
* "REASON_UNKNOWN" if the event reason type is unrecognizable
*/
IP_PUBLIC const char *
ipike_event_reason_str(Ip_u16 reason);
#ifdef __cplusplus
}
#endif
#endif /* IPIKE_USE_EVENT_LOG */
#endif /* IPIKE_EVENT_H_ */
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/include/ipike_event_log.h
+191
View File
@@ -0,0 +1,191 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_event_log.h,v $ $Revision: 1.3.2.2 $
* $Source: /home/interpeak/CVSRoot/ipike/include/ipike_event_log.h,v $
* $Author: ulf $ $Date: 2011-11-16 10:33:30 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Erik Dahlberg <erik.dahlberg@windriver.com>
******************************************************************************
*/
#ifndef IPIKE_EVENT_LOG_H
#define IPIKE_EVENT_LOG_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/*
IKE event logging module. IPIKE_EVENT_LOG_FUNC must be set before
including this header file in order to use the IPIKE_EVENT_LOG
macro properly. The IPIKE_EVENT_LOG_FUNC specifies the function which
the IPIKE_EVENT_LOG macro eventually expands to. It's possible to
to use the extended macro IPIKE_EVENT_LOG_EXT without setting
IPIKE_EVENT_LOG_FUNC as it takes the log function to use as an
argument. The IPIKE_EVENT_LOG_EXT can also be used for
overloading the normal log function in specific calls.
The log function IPIKE_EVENT_LOG_FUNC must accept at least one log
event type (int) and one log event reason (int). The macro will expand
to a function call to IPIKE_EVENT_LOG_FUNC if and only if
IPIKE_USE_EVENT_LOG was set and the log event type was set at build time.
Turning on/off individual log events is done in ipike_config.h and no
changes are needed here.
*/
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_event.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
#if defined(IPIKE_USE_EVENT_LOG) && defined(IPIKE_EVENT_LOG_FUNC)
/* IKE/IPsec log events, do not edit. Turn on and off specific events
* in ipike_log_events.h instead */
#ifdef IPIKE_USE_EVENT_HARD_LIFE_SIZE_EXPIRED
#define IPIKE_EVENT_HARD_LIFE_SIZE_EXPIRED_LOG(_func, _r, ...) \
_func(IPIKE_EVENT_HARD_LIFE_SIZE_EXPIRED, _r, __VA_ARGS__)
#else
#define IPIKE_EVENT_HARD_LIFE_SIZE_EXPIRED_LOG(_func, _r, ...)
#endif
#ifdef IPIKE_USE_EVENT_HARD_LIFE_TIME_EXPIRED
#define IPIKE_EVENT_HARD_LIFE_TIME_EXPIRED_LOG(_func, _r, ...) \
_func(IPIKE_EVENT_HARD_LIFE_TIME_EXPIRED,_r,__VA_ARGS__)
#else
#define IPIKE_EVENT_HARD_LIFE_TIME_EXPIRED_LOG(_func, _r, ...)
#endif
#ifdef IPIKE_USE_EVENT_IKE_PACKET_DISCARD
#define IPIKE_EVENT_IKE_PACKET_DISCARD_LOG(_func, _r, ...) \
_func(IPIKE_EVENT_IKE_PACKET_DISCARD,_r,__VA_ARGS__)
#else
#define IPIKE_EVENT_IKE_PACKET_DISCARD_LOG(_func, _r, ...)
#endif
#ifdef IPIKE_USE_EVENT_IKE_PHASE_I_FAIL
#define IPIKE_EVENT_IKE_PHASE_I_FAIL_LOG(_func, _r, ...) \
_func(IPIKE_EVENT_IKE_PHASE_I_FAIL,_r,__VA_ARGS__)
#else
#define IPIKE_EVENT_IKE_PHASE_I_FAIL_LOG(_func, _r, ...)
#endif
#ifdef IPIKE_USE_EVENT_IKE_PHASE_I_SUCCESS
#define IPIKE_EVENT_IKE_PHASE_I_SUCCESS_LOG(_func, _r, ...) \
_func(IPIKE_EVENT_IKE_PHASE_I_SUCCESS,_r,__VA_ARGS__)
#else
#define IPIKE_EVENT_IKE_PHASE_I_SUCCESS_LOG(_func, _r, ...)
#endif
#ifdef IPIKE_USE_EVENT_IKE_PHASE_II_FAIL
#define IPIKE_EVENT_IKE_PHASE_II_FAIL_LOG(_func, _r, ...) \
_func(IPIKE_EVENT_IKE_PHASE_II_FAIL,_r,__VA_ARGS__)
#else
#define IPIKE_EVENT_IKE_PHASE_II_FAIL_LOG(_func, _r, ...)
#endif
#ifdef IPIKE_USE_EVENT_IKE_PHASE_II_SUCCESS
#define IPIKE_EVENT_IKE_PHASE_II_SUCCESS_LOG(_func, _r, ...) \
_func(IPIKE_EVENT_IKE_PHASE_II_SUCCESS,_r,__VA_ARGS__)
#else
#define IPIKE_EVENT_IKE_PHASE_II_SUCCESS_LOG(_func, _r, ...)
#endif
#ifdef IPIKE_USE_EVENT_IPSEC_PACKET_DISCARD
#define IPIKE_EVENT_IPSEC_PACKET_DISCARD_LOG(_func, _r, ...) \
_func(IPIKE_EVENT_IPSEC_PACKET_DISCARD,_r,__VA_ARGS__)
#else
#define IPIKE_EVENT_IPSEC_PACKET_DISCARD_LOG(_func, _r, ...)
#endif
#ifdef IPIKE_USE_EVENT_SEQUENCE_NUM_OVERFLOW
#define IPIKE_EVENT_SEQUENCE_NUM_OVERFLOW_LOG(_func, _r, ...) \
_func(IPIKE_EVENT_HARD_LIFE_SIZE_EXPIRED,_r,__VA_ARGS__)
#else
#define IPIKE_EVENT_SEQUENCE_NUM_OVERFLOW_LOG(_func, _r, ...)
#endif
#ifdef IPIKE_USE_EVENT_SOFT_LIFE_SIZE_EXPIRED
#define IPIKE_EVENT_SOFT_LIFE_SIZE_EXPIRED_LOG(_func, _r, ...) \
_func(IPIKE_EVENT_SOFT_LIFE_SIZE_EXPIRED,_r,__VA_ARGS__)
#else
#define IPIKE_EVENT_SOFT_LIFE_SIZE_EXPIRED_LOG(_func, _r, ...)
#endif
#ifdef IPIKE_USE_EVENT_SOFT_LIFE_TIME_EXPIRED
#define IPIKE_EVENT_SOFT_LIFE_TIME_EXPIRED_LOG(_func, _r, ...) \
_func(IPIKE_EVENT_SOFT_LIFE_TIME_EXPIRED,_r,__VA_ARGS__)
#else
#define IPIKE_EVENT_SOFT_LIFE_TIME_EXPIRED_LOG(_func, _r, ...)
#endif
#ifdef IPIKE_USE_EVENT_SPD_PACKET_DISCARD
#define IPIKE_EVENT_SPD_PACKET_DISCARD_LOG(_func,_r, ...) \
_func(IPIKE_EVENT_SPD_PACKET_DISCARD,_r,__VA_ARGS__)
#else
#define IPIKE_EVENT_SPD_PACKET_DISCARD_LOG(_func, _r, ...)
#endif
#define IPIKE_EVENT_LOG(_e, _reason, ...) \
IPIKE_EVENT_ ## _e ##_LOG(IPIKE_EVENT_LOG_FUNC, IPIKE_REASON_ ##_reason, __VA_ARGS__)
#define IPIKE_EVENT_LOG_EXT(_func, _e, _reason, ...) \
IPIKE_EVENT_ ## _e ##_LOG(_func, IPIKE_REASON_ ##_reason, __VA_ARGS__)
#else /* defined(IPIKE_USE_EVENT_LOG) && defined(IPIKE_EVENT_LOG_FUNC) */
#define IPIKE_EVENT_LOG(_e, _reason, ...)
#define IPIKE_EVENT_LOG_EXT(_func, _e, _reason, ...)
#endif /* defined(IPIKE_USE_EVENT_LOG) && defined(IPIKE_EVENT_LOG_FUNC) */
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
#ifdef __cplusplus
}
#endif
#endif /* IPIKE_EVENT_LOG_H */
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/include/ipike_event_receiver.h
+139
View File
@@ -0,0 +1,139 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_event_receiver.h,v $ $Revision: 1.4.2.2 $
* $Source: /home/interpeak/CVSRoot/ipike/include/ipike_event_receiver.h,v $
* $Author: ulf $ $Date: 2011-11-16 10:33:30 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Erik Dahlberg <erik.dahlberg@windriver.com>
******************************************************************************
*/
#ifndef IPIKE_EVENT_RECEIVER_H_
#define IPIKE_EVENT_RECEIVER_H_
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include <ipike_config.h>
#ifdef IPIKE_USE_EVENT_LOG
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include <ipike.h>
#include <ipike_event.h>
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/* Event Receiver callback */
typedef int (*Ipike_event_receiver_cb)(Ipike_event * event);
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*******************************************************************************
*
* ipike_event_receiver_init - initializes IKE and IPsec event receiver
* This routine initializes the event receiver library.
*
* Parameters:
* \is
* \i <event_cb>
* A user callback function which is called upon reception of an event.
*
*
* EXAMPLE
* \cs
* int event_cb(Ipike_event *event)
* {
* printf("Got event\n");
* printf(" type: %s\n", ipike_event_type_str(event->type));
* printf(" reason: %s\n", ipike_event_reason_str(event->reason));
* return 0;
* }
*
* void example_start(void)
* {
* /@ Initialize event receiver library @/
* ipike_event_receiver_init(event_cb);
* }
*
*
* void example_stop(void)
* {
* /@ Stop and destroy event receiver @/
* ipike_event_receiver_destroy();
* }
* \ce
*
* RETURNS: 0 on success, -1 on failure
*
* ERRNO:
*/
IP_PUBLIC int
ipike_event_receiver_init(
Ipike_event_receiver_cb event_cb);
/*******************************************************************************
*
* ipike_event_receiver_destroy - destroys and stops the IKE and IPsec event
* receiver
* This routine stops the event receiver task and returns allocated memory.
*
* Parameters:
*
* RETURNS:
*
* ERRNO:
*/
IP_PUBLIC void
ipike_event_receiver_destroy(void);
#ifdef __cplusplus
}
#endif
#endif /* IPIKE_USE_EVENT_LOG */
#endif /* IPIKE_EVENT_RECEIVER_H_ */
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike.c
+893
View File
@@ -0,0 +1,893 @@
/*
******************************************************************************
* SOURCE FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike.c,v $ $Revision: 1.114.10.12 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike.c,v $
* $Author: zan $ $Date: 2013-06-14 09:27:00 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_h.h"
#include "ipike.h"
#include "ipike_dispatcher.h"
#include "ipike_ipsec_sadb.h"
#include "ipike_sadb.h"
#include "ipike_configuration.h"
#include "ipike_ipc.h"
#include "ipike_map.h"
#include "ipike_pfkeyv2.h"
#include "ipike_crypto.h"
#ifdef IPIKE_USE_EVENT_LOG
#include "ipike_event_server.h"
#endif
#include <openssl/evp.h>
#include <openssl/err.h>
#include <openssl/rand.h>
#include <ipcom_os.h>
#include <ipcom_clib.h>
#include <ipcom_syslog.h>
#include <ipcom_shell.h>
/*
****************************************************************************
* 4 EXTERN PROTOTYPES
****************************************************************************
*/
/*
*===========================================================================
* ipike_proc
*===========================================================================
*/
IPCOM_PROCESS(ipike_proc);
/*
*===========================================================================
* ipike_create
*===========================================================================
*/
IP_PUBLIC Ip_err
ipike_create(void);
/*
*===========================================================================
* ipike_start
*===========================================================================
*/
IP_PUBLIC Ip_err
ipike_start(void);
/*
*===========================================================================
* ipike_version
*===========================================================================
*/
IP_PUBLIC const char *
ipike_version(void);
/*
****************************************************************************
* 5 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 6 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 7 LOCAL PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 8 DATA
****************************************************************************
*/
/* Global data used in IKE */
Ipike_data ipike;
#ifdef IPIKE_USE_PERF_EVAL
Ipike_perf ipike_perf;
#endif
/*
****************************************************************************
* 9 LOCAL FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_read_version
*===========================================================================
*/
IP_STATIC Ipike_error
ipike_read_version(void)
{
Ip_u8 version = 0;
#if defined(IPIKE_USE_VERSION1) && defined(IPIKE_USE_VERSION2)
ipike.version_min = 0x10;
ipike.version_max = 0x20;
#elif defined(IPIKE_USE_VERSION1)
ipike.version_min = 0x10;
ipike.version_max = 0x10;
#elif defined(IPIKE_USE_VERSION2)
ipike.version_min = 0x20;
ipike.version_max = 0x20;
#else
return IPIKE_FAILED; /* IKE not supported */
#endif
version = (Ip_u8)ipcom_sysvar_get_as_int("ipike.version", 0);
if (version != 0 && version != 0xff)
{
if ((version < ipike.version_min) || (version > ipike.version_max))
{
IPCOM_LOG0(ERR, "IKE protocol version not supported");
return IPIKE_CONF_INVALID_VALUE;
}
}
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_create_default_config
*===========================================================================
* Description: Creates a default configuration so that the IKE daemon will start.
* Parameters:
* Returns:
*
*/
IP_STATIC Ipike_error
ipike_create_default_config(void)
{
char ike_conf[464] = {
"general {"IP_LF
/* Must be 17 slots from 'listen ' to '"IPLF' */
"\tlisten @.@.@.@ ;"IP_LF
"}"IP_LF
"ike_sa address 0.0.0.0/0 {"IP_LF
"\tike_id default;"IP_LF
"\tauthentication {"IP_LF
"\t\tmethod pre_shared_key;"IP_LF
"\t\tshared_key this_should_be_secret;"IP_LF
"\t}"IP_LF
"\tproposal {"IP_LF
"\t\tdh_group any;"IP_LF
"\t\thash_algorithm any;"IP_LF
"\t\tencryption_algorithm any;"IP_LF
"\t\tintegrity_algorithm any;"IP_LF
"\t}"IP_LF
"}"IP_LF
"ipsec_sa address 0.0.0.0/0 address 0.0.0.0/0 {"IP_LF
"\tike_id default;"IP_LF
"\tuse_tfc off;"IP_LF
"\tproposal {"IP_LF
"\t\tdh_group any,none;"IP_LF
"\t\tencryption_algorithm any;"IP_LF
"\t\tintegrity_algorithm any;"IP_LF
"\t\tuse_esn off;"IP_LF
"\t}"IP_LF
"}"IP_LF
};
const char* filename;
char* str;
char sysvar_buf[100];
Ip_size_t sysvar_buf_len = sizeof(sysvar_buf);
IP_FILE* conf_file;
union Ip_sockaddr_union addr;
const char* str_addr;
filename = ipcom_sysvar_get("ipike.filename", sysvar_buf, &sysvar_buf_len);
if (filename == IP_NULL)
/* There must always be a filename (even if the file does not exist) */
return IPIKE_FAILED;
conf_file = ipcom_fopen(filename, "r");
if (conf_file == IP_NULL)
{
if (!ipike_get_if_addr(IP_NULL, &addr))
{
IPCOM_LOG0(ERR, "ipike_create_default_config: failed to get primary address from any interface");
return IPIKE_FAILED;
}
else
{
/* The file does not exist, create it */
conf_file = ipcom_fopen(filename, "w");
if (conf_file == IP_NULL)
return IPIKE_FAILED;
if (IP_NULL != (str = ipcom_strstr(ike_conf, "@.@.@.@")))
{
str_addr = ipike_addr_to_str(&addr);
ipcom_strncpy(str, str_addr, ipcom_strlen(str_addr));
}
}
str = ike_conf;
while (*str != '\0')
{
if (ipcom_fwrite(str, 1, 1, conf_file) != 1)
/* Failed to write */
return IPIKE_FAILED;
str++;
}
}
(void)ipcom_fclose(conf_file);
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_private_key_password_cb
*===========================================================================
* Description: Callback to give the password used to protect the token where
* the private key is stored when using X509 certificates for
* authentication.
* Parameters: [out] buf - The PIN used to protect the private key must
* be copied into this buffer.
* [in] size - The size of the buffer.
* [in] rwflags - The file flags for the token.
* [in] filename - The soft-token filename.
* Returns: The length of the PIN.
*
*/
IP_STATIC int
ipike_private_key_password_cb(char *buf, int size, int rwflag, void *filename)
{
const char* passwd;
(void) rwflag;
/* Read the PIN from the configuration file */
passwd = ipike_config_get_private_key_password(filename);
if (passwd == IP_NULL)
return 0;
ipcom_strncpy(buf, passwd, (Ip_size_t) size);
return (int) ipcom_strlen(buf);
}
/*
*===========================================================================
* ipike_reconfigure
*===========================================================================
* Description: Removes the old configuration (if any) and applies the new
* one.
* Parameters:
* Returns: IKE error code.
*/
IP_STATIC Ipike_error
ipike_reconfigure(void)
{
IP_CONST char * filename;
IP_FILE* conf_file;
char * conf_buf = IP_NULL;
char * str = IP_NULL;
const Ip_size_t chunk_size = 1000;
Ip_size_t size = 0;
Ipike_error err = IPIKE_SUCCESS;
char sysvar_buf[100];
Ip_size_t sysvar_buf_len = sizeof(sysvar_buf);
int n = 0;
IPIKE_CODE_LOCK();
IPCOM_LOG0(INFO, "Start processing reconfigure request");
/* Reconfigure pfkey may flush the existing IPSec SA, and we don't want
* any new negotiations until everything is reconfigured */
ipike.paus_init_ipsec_sa = IP_TRUE;
if (IPIKE_SUCCESS != (err = ipike_pfkeyv2_reconfigure()))
IPCOM_LOG0(ERR, "Failed to reconfigure pfkey");
ipike.paus_init_ipsec_sa = IP_FALSE;
ipike_dispatcher_trigger_flows_remove();
/* Read global system variables */
/* IKE port and NAT port */
ipike.port = (Ip_u16) ipcom_sysvar_get_as_int("ipike.port", 500);
ipike.port_nat = (Ip_u16) ipcom_sysvar_get_as_int("ipike.port_nat", 4500);
if (ipike.port_nat != 0)
{
/* Limitation in IPNET will require 4500 as NAT listen port */
if ((ipike.port == ipike.port_nat) || (4500 != ipike.port_nat))
{
IPCOM_LOG0(ERR, "NAT listen port must 4500 (and different from standard listen port)");
err = IPIKE_CONF_INVALID_VALUE;
goto cleanup;
}
}
/* NAT keep-alive, default each 20 seconds */
ipike.keepalive_nat = (Ip_u16) ipcom_sysvar_get_as_int("ipike.keepalive_nat", 20);
/* The timer resolution of the liveness timer */
n = ipcom_sysvar_get_as_int("ipike.liveness_timer_resolution", 10);
if ( n < 0 || n > 60 )
{
IPCOM_LOG2(WARNING, "\"ipike.liveness_timer_resolution=%d\", value must be"\
" between 0-60, using default value %d", n, 10);
n = 10;
}
ipike.liveness_timer_resolution = (Ip_u16) n;
/* Rekey fuzz, adds a randomness to lifetime expirations */
ipike.rekey_fuzz = (Ip_u16) ipcom_sysvar_get_as_int("ipike.rekey_fuzziness", 20);
/* IKE Configuration file */
if (IP_NULL == (filename = ipcom_sysvar_get("ipike.filename",
sysvar_buf,
&sysvar_buf_len)))
{
IPCOM_LOG0(WARNING, "Failed to read the name of the configuration file.");
err = IPIKE_CONF_FILE_NOT_FOUND;
goto cleanup;
}
IPCOM_LOG1(INFO, "Using configuration file: %s", filename);
if (IP_NULL == (conf_buf = ipcom_malloc(chunk_size + 1)))
{
IP_PANIC();
err = IPIKE_OUT_OF_MEMORY;
goto cleanup;
}
if ((conf_file = ipcom_fopen(filename, "r")) == IP_NULL)
{
IPCOM_LOG1(WARNING, "ipike_reconfigure: %s not found", filename);
err = IPIKE_CONF_FILE_NOT_FOUND;
goto cleanup;
}
for (;;)
{
Ip_size_t bytes_read = ipcom_fread(conf_buf + size, 1, chunk_size, conf_file);
size += bytes_read;
if (chunk_size != bytes_read)
break;
conf_buf = ipcom_realloc(conf_buf, size + chunk_size + 1);
}
conf_buf[size] = '\0';
(void)ipcom_fclose(conf_file);
if (size == 0)
{
IPCOM_LOG1(WARNING, "Empty configuration file: %s", filename);
}
else
{
/* Code will be locked by configuration api, so need to release lock */
IPIKE_CODE_UNLOCK();
if (IPIKE_SUCCESS != ipike_config_initialize(conf_buf))
{
IPCOM_LOG1(WARNING, "Failed to parse the configuration file %s", filename);
}
IPIKE_CODE_LOCK();
}
/* Set to '1' to initiate rekey for IPSec SAs for passive connections */
if (ipcom_sysvar_get_as_int("ipike.rekey_passive", 0) == 0)
ipike.rekey_passive = IP_FALSE;
else
ipike.rekey_passive = IP_TRUE;
/* May set require cookie, default to IP_FALSE */
str = ipcom_sysvar_get("ipike.require_cookie", sysvar_buf, &sysvar_buf_len);
if ( IP_NULL != str &&
(!ipcom_strcasecmp(str, "true") || !ipcom_strcasecmp(str, "on")))
{
ipike.require_cookie = IP_TRUE;
}
else
{
ipike.require_cookie = IP_FALSE;
}
/* Variable to allow duplicate IKE SAs to be created */
if (ipcom_sysvar_get_as_int("ipike.allow_duplicate_ike_sa", 0) == 1)
ipike.allow_duplicate_ike_sa = IP_TRUE;
else
ipike.allow_duplicate_ike_sa = IP_FALSE;
/* Dynamic IP anyflow */
if (ipcom_sysvar_get_as_int("ipike.address_pool.anyflow", 0) == 1)
ipike.dynamic_ip_anyflow = IP_TRUE;
else
ipike.dynamic_ip_anyflow = IP_FALSE;
/* Dynamic IP home address */
if (ipcom_sysvar_get_as_int("ipike.address_pool.homeaddr", 0) == 1)
ipike.dynamic_ip_homeaddr = IP_TRUE;
else
ipike.dynamic_ip_homeaddr = IP_FALSE;
/* Allow certificate fetching via HTTP */
if ( ipcom_sysvar_get_as_int("ipike.use_hash_and_url", 0) == 1 )
ipike.use_hash_and_url = IP_TRUE;
else
ipike.use_hash_and_url = IP_FALSE;
ipike.http_request_timeout = (Ip_u16) ipcom_sysvar_get_as_int("ipike.http_request_timeout", 5);
ipike.max_ike_message_size = (Ip_u32) ipcom_sysvar_get_as_int("ipike.max_message_size", 0);
ipike.max_ike_sa_num = (Ip_u32) ipcom_sysvar_get_as_int("ipike.max_ike_sa_num", 0);
ipike.max_ipsec_sa_num = (Ip_u32) ipcom_sysvar_get_as_int("ipike.max_ipsec_sa_num", 0);
/* Does not make sense to configure an odd number of IPsec SAs, so round up */
if ( ipike.max_ipsec_sa_num & 1 )
{
ipike.max_ipsec_sa_num += 1;
IPCOM_LOG1(NOTICE, "Rounding up \"ipike.max_ipsec_sa_num\" to %u",
ipike.max_ipsec_sa_num);
}
/* Variable for performance testing */
if (ipcom_sysvar_get_as_int("ipike.running_performance_test", 0) == 1)
ipike.running_performance_test = IP_TRUE;
if (ipcom_sysvar_get_as_int("ipike.strict_lifetime_policy", 0) == 1)
ipike.strict_lifetime_policy = IP_TRUE;
else
ipike.strict_lifetime_policy = IP_FALSE;
IPCOM_LOG0(INFO, "Finished processing reconfigure request");
cleanup:
ipcom_free(conf_buf);
IPIKE_CODE_UNLOCK();
return err;
}
/*
*===========================================================================
* ipike_startup
*===========================================================================
* Description: Starts up the IKE daemon.
* Parameters:
* Returns: IKE error code.
*/
IP_STATIC Ipike_error
ipike_startup(void)
{
Ipike_error err;
IPCOM_LOG1(DEBUG, "IPIKE %s starting...", ipike_version_number());
#ifdef IPIKE_USE_PERF_EVAL
/* Reset stats */
ipcom_memset(&ipike_perf,0, sizeof(ipike_perf));
#endif
/* Setup callbacks */
ipike.key_password_cb = ipike_private_key_password_cb;
ipike.pfkeyv2.sa_expire_cb = ipike_ipsec_sadb_sa_expire_cb;
ipike.pfkeyv2.sa_acquire_cb = ipike_ipsec_sadb_sa_acquire_cb;
ipike.pfkeyv2.sa_remove_cb = ipike_ipsec_sadb_sa_remove_cb;
ipike.pfkeyv2.sa_flush_cb = ipike_ipsec_sadb_sa_flush_cb;
ipike.tmo_head = ipcom_tmo2_new();
if (ipike.tmo_head == IP_NULL)
{
IP_PANIC();
return IPIKE_OUT_OF_MEMORY;
}
(void)EVP_add_cipher_alias(SN_des_ede3_cbc, "3DES-CBC");
if (ipcom_shell_add_cmd(IPIKE_CMD_NAME,
IPIKE_CMD_NAME " [ options ] command",
"IPIKE daemon control",
ipike_cmd,
IPCOM_PRIORITY_DEFAULT,
IPCOM_PROC_STACK_DEFAULT) != IPCOM_SUCCESS)
{
IP_PANIC();
return IPIKE_OUT_OF_MEMORY;
}
if (IPIKE_SUCCESS != (err = ipike_read_version()))
{
IPCOM_LOG0(ERR, "Bad version number");
return err;
}
if (ipcom_sysvar_get_as_int("ipike.create_default_conf", 0))
{
if (IPIKE_SUCCESS != (err = ipike_create_default_config()))
{
IPCOM_LOG0(ERR, "Failed to create default configuration IPIKE");
return err;
}
}
if (IPIKE_SUCCESS != (err = ipike_map_startup()))
{
IPCOM_LOG0(ERR, "Failed to initialize static map:s");
return err;
}
if (IPIKE_SUCCESS != (err = ipike_sadb_startup()))
{
IPCOM_LOG0(ERR, "Failed to initialize the IKE SA database");
return err;
}
if (IPIKE_SUCCESS != (err = ipike_ipsec_sadb_startup()))
{
IPCOM_LOG0(ERR, "Failed to initialize the IPSec SA database");
return err;
}
if (IPIKE_SUCCESS != (err = ipike_isakmp_startup()))
{
IPCOM_LOG0(ERR, "Failed to initialize exchange structures");
return err;
}
if (IPIKE_SUCCESS != (err = ipike_pfkeyv2_startup()))
{
IPCOM_LOG0(ERR, "Failed to initialize IPSec communication");
return err;
}
if (IPIKE_SUCCESS != (err = ipike_dispatcher_startup()))
{
IPCOM_LOG0(ERR, "Failed to initialize the dispatcher");
return err;
}
#ifdef IPIKE_USE_EVENT_LOG
if (IPIKE_SUCCESS != (err = ipike_event_server_startup()))
{
IPCOM_LOG0(ERR, "Failed to initialize event server");
return err;
}
#endif
/* IKE is now up and running */
ipcom_atomic_set(&ipike.initialized, 1);
if (IPIKE_SUCCESS != (err = ipike_reconfigure()))
{
IPCOM_LOG0(ERR, "Failed to configure IPIKE");
return err;
}
ipcom_microtime(&ipike.start);
IPCOM_LOG0(INFO, "IPIKE is now running");
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_shutdown
*===========================================================================
* Description: Runs all shutdown functions when the IKE daemon is exiting.
* Parameters:
* Returns:
*
*/
IP_STATIC void
ipike_shutdown(void)
{
ipcom_atomic_set(&ipike.initialized, 0);
IPIKE_CODE_LOCK();
IPCOM_LOG0(INFO, "IPIKE is shutting down");
#ifdef IPIKE_USE_RADIUS
ipike_radius_shutdown();
#endif
ipike_ipsec_sadb_shutdown();
ipike_sadb_shutdown();
ipike_isakmp_shutdown();
ipike_pfkeyv2_shutdown();
ipike_dispatcher_shutdown();
ipike_config_finalize();
ipike_map_shutdown();
ipcom_tmo2_delete(ipike.tmo_head);
ipike.tmo_head = IP_NULL;
#ifdef IPIKE_USE_EVENT_LOG
ipike_event_server_shutdown();
#endif
(void)ipcom_shell_remove_cmd(IPIKE_CMD_NAME, ipike_cmd);
(void)ipcom_sysvar_unset("ipike.added_addresses.*");
(void)ipcom_sysvar_unset("ipike.address_pool.used*");
ERR_remove_state(0);
ipcom_memset((void*)&ipike.start, 0, sizeof(ipike.start));
IPCOM_LOG0(DEBUG, "IPIKE stopped");
IPIKE_CODE_UNLOCK();
IPIKE_CODE_LOCK_DESTROY();
}
/*
*===========================================================================
* ipike_proc
*===========================================================================
*/
IPCOM_PROCESS(ipike_proc)
{
Ipike_message msg;
Ipike_error err;
ipike.ipd = IP_INVALID_SOCKET;
ipike.pid = ipcom_getpid();
ipcom_proc_init();
ipcom_openlog("ipike", 0, IPCOM_LOG_IPIKE);
/* Register ike instance with ipcom_call. */
/* Clear all sysvars containing added addresses. */
(void)ipcom_sysvar_unset("ipike.added_addresses.*");
(void)ipcom_sysvar_unset("ipike.address_pool.used*");
if (IPIKE_SUCCESS != (err = ipike_startup()))
goto err;
if (ipcom_ipd_init(IPIKE_IPD_NAME, IPCOM_SUCCESS, &ipike.ipd) != IPCOM_SUCCESS)
{
IPCOM_LOG0(CRIT, "Failed to initialize IPD");
goto cleanup;
}
/* IKE main loop */
for (;;)
{
err = ipike_receive_message(&msg);
if (err == IPIKE_SHUTDOWN)
break;
else if (err != IPIKE_SUCCESS)
IPCOM_LOG1(ERR, "Failed to receive message (%d)", err);
/* Always lock/unlock, eventual receive failure may be caused of someone
* else is processing */
IPIKE_CODE_LOCK();
if (err == IPIKE_SUCCESS)
{
(void)ipike_isakmp_process_message(&msg, IP_TRUE);
ipike_free_message(&msg);
}
/* We should handle all errors, but the following is added just in
* case some error is missed (will cause memory leak if missed) */
(void)ipike_get_crypto_error_string(&err);
IPIKE_CODE_UNLOCK();
}
cleanup:
ipike_shutdown();
ipcom_closelog();
(void)ipcom_ipd_exit("ipike", ipike.ipd);
ipcom_proc_exit();
err:
(void)ipcom_ipd_init("ipike", IPCOM_ERR_FAILED, &ipike.ipd);
goto cleanup;
}
/*
****************************************************************************
* 10 PUBLIC FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_process_ipd_msg
*===========================================================================
* Description: Allocates global memory used by IPIKE.
* Parameters:
* Returns:
*
*/
IP_GLOBAL Ipike_error
ipike_process_ipd_msg(Ip_fd ipd_sock)
{
Ipike_error err = IPIKE_SUCCESS;
int event;
int len;
Ip_u8 *buf;
ipcom_memset(ipike.disp.recv_buf,0,ipike.disp.recv_buf_len);
len = ipcom_ipd_read(ipd_sock, ipike.disp.recv_buf, ipike.disp.recv_buf_len-1, &event);
if (len >= 0)
{
buf=ipike.disp.recv_buf;
buf[len]='\0';
switch (event)
{
case IPCOM_IPD_EVENT_NONE:
break;
case IPCOM_IPD_EVENT_RECONFIGURE:
/**/
#ifdef IP_PORT_LAS
IPCOM_LOG0(INFO, "Start processing IPD reconfigure request in flush mode");
ipike_shutdown();
(void)ipike_startup();
#else
IPCOM_LOG0(INFO, "Start processing IPD reconfigure request");
(void)ipike_reconfigure();
#endif
break;
case IPCOM_IPD_EVENT_KILL:
err = IPIKE_SHUTDOWN;
break;
case IPIKE_CMD_MOBIKE:
if ((unsigned int)len > sizeof(Ipcom_ipd_msg))
{
buf = (Ip_u8*)ipike.disp.recv_buf + sizeof(Ipcom_ipd_msg);
len -= (int) sizeof(Ipcom_ipd_msg);
/* IPD is currently not handling any responses, so implemented shell
* commands must handle no response socket. Ignore eventual errors. */
(void)ipike_shell_cmd((Ip_u8)event, IP_INVALID_SOCKET, buf, (Ip_u32)len);
}
else
{
IPCOM_LOG0(INFO, "Bad IPD shell command message");
}
break;
case IPIKE_CMD_LIST:
case IPIKE_CMD_STAT:
case IPIKE_CMD_CONFIG_DUMP:
case IPIKE_CMD_CONFIG_LOAD:
case IPIKE_CMD_CONFIG_ADD:
case IPIKE_CMD_CONFIG_DELETE:
default:
IPCOM_LOG1(INFO, "Unsupported IPD shell command message (%d)", event);
break;
}
}
return err;
}
/*
*===========================================================================
* ipike_version_number
*===========================================================================
* Description: Returns the version number string for IPIKE.
* Parameters:
* Returns:
*
*/
IP_GLOBAL const char *
ipike_version_number(void)
{
static char version[10] = {0};
if (version[0] == 0)
{
ipcom_sprintf(version, "%d.%d.%d",
(IPIKE_RELEASE/10000)%100,
(IPIKE_RELEASE/100)%100,
(IPIKE_RELEASE/1)%100);
}
return version;
}
/*
*===========================================================================
* ipike_create
*===========================================================================
* Description: Allocates global memory used by IPIKE.
* Parameters:
* Returns:
*
*/
IP_PUBLIC Ip_err
ipike_create(void)
{
ipcom_memset(&ipike, 0, sizeof(ipike));
#ifdef IPIKE_USE_PERF_EVAL
ipcom_memset(&ipike_perf,0, sizeof(ipike_perf));
#endif
IPIKE_CODE_LOCK_INIT();
if (!IPIKE_CODE_LOCK_INITIALIZED())
{
IPCOM_LOG0(ERR, "Failed to create the code lock mutex");
return -IP_ERRNO_ENOMEM;
}
return IPCOM_SUCCESS;
}
/*
*===========================================================================
* ipike_start
*===========================================================================
* Description: Starts IPIKE
* Parameters:
* Returns:
*
*/
IP_PUBLIC Ip_err
ipike_start(void)
{
Ipcom_proc_attr proc_attr;
ipcom_proc_attr_init(&proc_attr);
proc_attr.flags |= IPCOM_PROC_FLAG_FP;
proc_attr.stacksize = IPCOM_PROC_STACK_MAX;
return ipcom_proc_acreate(IPIKE_PROC_NAME,
(Ipcom_proc_func) ipike_proc,
&proc_attr,
IP_NULL);
}
/*
*===========================================================================
* ipike_version
*===========================================================================
* Description: Returns the version string for IPIKE.
* Parameters:
* Returns:
*
*/
IP_PUBLIC const char *
ipike_version(void)
{
return "@(#) IPIKE $Name: VXWORKS_ITER40_2019102207 $ - INTERPEAK_COPYRIGHT_STRING";
}
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike2_exchange_child_sa.c
+2770
View File
File diff suppressed because it is too large Load Diff
components/ip_net2-6.9/ipike/src/ipike2_exchange_child_sa.h
+264
View File
@@ -0,0 +1,264 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike2_exchange_child_sa.h,v $ $Revision: 1.5.16.1 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike2_exchange_child_sa.h,v $
* $Author: ulf $ $Date: 2011-11-16 10:33:31 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#if !defined(IPIKE_EXCHANGE_CHILD_SA_H) && defined(IPIKE_USE_VERSION2)
#define IPIKE_EXCHANGE_CHILD_SA_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* CREATE CHILD SA exchange (phase 2 for IKE version 2) */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_config.h"
#include "ipike.h"
#include "ipike_isakmp.h"
#include "ipike_payload.h"
#include "ipike_sadb.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_exchange_child_sa_set_peer_spi
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_exchange_child_sa_set_peer_spi(Ipike_sadb_entry* sa);
/*
*===========================================================================
* ipike_exchange_child_sa_select_param
*===========================================================================
* Description: Select SA parameters for child sa.
* Parameters: ie - the state of this exchange (this pointer).
* Returns: Ipike standard error code.
*/
IP_GLOBAL Ipike_error
ipike_exchange_child_sa_select_param(Ipike_isakmp_exchange *ie);
/*
*===========================================================================
* ipike_exchange_child_sa_on_new
*===========================================================================
* Description: Creates a new ipsec sa.
* Parameters: ie - the state of this exchange (this pointer).
* Returns: Ipike standard error code.
*/
IP_GLOBAL Ipike_error
ipike_exchange_child_sa_on_new(Ipike_isakmp_exchange* ie);
/*
*===========================================================================
* ipike_exchange_child_sa_on_new_initiator
*===========================================================================
* Description: Creates a new ipsec sa and creates a initiator cookie.
* Parameters: ie - the state of this exchange (this pointer).
* not_used1 - parameter not used.
* not_used2 - parameter not used.
* Returns: Ipike standard error code.
*/
IP_PUBLIC Ipike_error
ipike_exchange_child_sa_on_new_initiator(
Ipike_isakmp_exchange* ie,
Ipike_sadb_entry* ike_sa,
const void* not_used1,
const void* not_used2);
IP_PUBLIC Ipike_error
ipike_exchange_child_sa_on_new_initiator_ike(
Ipike_isakmp_exchange* ie,
Ipike_sadb_entry* ike_sa,
const void* not_used1,
const void* not_used2);
/*
*===========================================================================
* ipike_exchange_child_sa_on_new_responder
*===========================================================================
* Description: Creates a new IKE SA.
* Parameters: ie - the state of this exchange (this pointer).
* first_isakmp - the first message (and only) that was/will be
* sent in this exchange.
* local_addr - The local address the peer send messages to.
* peer_addr - The address of the peer IKE daemon.
* Returns: Ipike standard error code.
*/
IP_PUBLIC Ipike_error
ipike_exchange_child_sa_on_new_responder(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header* first_isakmp,
union Ip_sockaddr_union* local_addr,
union Ip_sockaddr_union* peer_addr);
IP_PUBLIC Ipike_error
ipike_exchange_child_sa_on_new_responder_ike(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header* first_isakmp,
union Ip_sockaddr_union* local_addr,
union Ip_sockaddr_union* peer_addr);
/*
*===========================================================================
* ipike_exchange_child_sa_on_delete
*===========================================================================
* Description: Updates the base initialization vector if the exchange
* was compleated successfully.
* Parameters: ie - the state of this exchange (this pointer).
* Returns:
*/
IP_PUBLIC void
ipike_exchange_child_sa_on_delete(Ipike_isakmp_exchange* ie);
IP_PUBLIC void
ipike_exchange_child_sa_on_delete_ike(Ipike_isakmp_exchange* ie);
/*
*===========================================================================
* ipike_exchange_child_sa_get_payload_order
*===========================================================================
* Description: Returns a IPIKE_PAYLOAD_NONE terminated array of payload
* id:s that the ike sa init exchange message must contain.
* Parameters: ie - the state of this exchange.
* Returns: An array containing the payload IDs in the low byte
* and flags in the high byte.
*/
IP_PUBLIC const Ip_u16 *
ipike_exchange_child_sa_get_payload_order(Ipike_isakmp_exchange* ie);
IP_PUBLIC const Ip_u16 *
ipike_exchange_child_sa_get_payload_order_ike(Ipike_isakmp_exchange* ie);
/*
*===========================================================================
* ipike_exchange_child_sa_process_payloads
*===========================================================================
* Description: Updates the SA structure bound to this exchange.
* Parameters: ie - the state of this exchange.
* isakmp - the ISAKMP message.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
* IPIKE_SA_NO_ACCEPTED_TRANSFORM
* IPIKE_DOI_UNSUPPORTED
* IPIKE_SITUATION_UNSUPPORTED
*/
IP_PUBLIC Ipike_error
ipike_exchange_child_sa_process_payloads(Ipike_isakmp_exchange* ie,
Ipike_isakmp_header* isakmp);
IP_PUBLIC Ipike_error
ipike_exchange_child_sa_process_payloads_ike(Ipike_isakmp_exchange* ie,
Ipike_isakmp_header* isakmp);
/*
*===========================================================================
* ipike_exchange_child_sa_add_reply_payloads
*===========================================================================
* Description: Adds all payloads that should part of the response.
* Parameters: ie - the state of this exchange (this pointer).
* reply_payloads - pointer to an array of payload pointers.
* The array will be allocated by this function.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
* IPIKE_ISAKMP_UNSUPPORTED_PAYLOAD
*
*/
IP_PUBLIC Ipike_error
ipike_exchange_child_sa_add_reply_payloads(
Ipike_isakmp_exchange* ie,
Ipike_payload_header*** reply_payloads);
IP_PUBLIC Ipike_error
ipike_exchange_child_sa_add_reply_payloads_ike(
Ipike_isakmp_exchange* ie,
Ipike_payload_header*** reply_payloads);
/*
*===========================================================================
* ipike_exchange_child_sa_cleartext_outgoing_message
*===========================================================================
* Description: Does nothing (not needed in main mode)
* Parameters: ie - the state of this exchange.
* outgoing_isakmp - the outgoing ISAKMP message.
* Returns: IPIKE_SUCCESS
*/
IP_PUBLIC Ipike_error
ipike_exchange_child_sa_cleartext_outgoing_message(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header** outgoing_isakmp);
IP_PUBLIC Ipike_error
ipike_exchange_child_sa_cleartext_outgoing_message_ike(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header** outgoing_isakmp);
/*
*===========================================================================
* ipike_exchange_child_sa_done
*===========================================================================
* Description: Stores the final IV.
* Parameters: ie - the parameters for the finished exchange.
* Returns: IPIKE_SUCCESS
* OUT_OF_MEMORY
*/
IP_PUBLIC Ipike_error
ipike_exchange_child_sa_done(Ipike_isakmp_exchange *ie);
IP_PUBLIC Ipike_error
ipike_exchange_child_sa_done_ike(Ipike_isakmp_exchange *ie);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike2_exchange_info.c
+694
View File
@@ -0,0 +1,694 @@
/*
******************************************************************************
* SOURCE FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike2_exchange_info.c,v $ $Revision: 1.28.12.8 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike2_exchange_info.c,v $
* $Author: edahlber $ $Date: 2012-03-13 12:45:52 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#ifdef IPIKE_USE_VERSION2
#include "ipike_h.h"
#include "ipike2_exchange_info.h"
#include "ipike2_exchange_sa_init.h"
#include "ipike2_payload_delete.h"
#include "ipike2_payload_notify.h"
#include "ipike_crypto.h"
#include "ipike_util.h"
#include <openssl/hmac.h>
#include <openssl/rand.h>
#include <ipcom_clib.h>
#include <ipcom_syslog.h>
/*
****************************************************************************
* 4 EXTERN PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 5 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 6 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 7 LOCAL PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 8 DATA
****************************************************************************
*/
/*
****************************************************************************
* 9 LOCAL FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_exchange_info_on_new
*===========================================================================
*/
IP_STATIC Ipike_error
ipike_exchange_info_on_new(Ipike_isakmp_exchange *ie)
{
if ((IP_NULL != ie->ike_sa) && ie->ike_sa->is_initiator)
ie->isakmp_flags |= IPIKE_ISAKMP_INITIATOR;
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_exchange_info_add_mobike_reply_payloads
*===========================================================================
*/
IP_STATIC Ipike_error
ipike_exchange_info_add_mobike_reply_payloads(
Ipike_isakmp_exchange* ie,
Ipike_payload_header*** reply_payloads)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike_payload_header* reply_payload = IP_NULL;
Ipike2_notify_payload* notify = IP_NULL;
if (reply_payloads[0] == IP_NULL)
return IPIKE_SUCCESS;
/* We may need to add some extra payloads for mobike */
reply_payload = *(reply_payloads[0]);
notify = (Ipike2_notify_payload*)reply_payload;
/* Also add eventual extra payloads depending on type */
if ( reply_payload != IP_NULL &&
reply_payload->next_payload == IPIKE2_PAYLOAD_NOTIFY &&
((ip_ntohs(notify->message_type) == IPIKE_NOTI_INF_UPDATE_SA_ADDRESSES) ||
(ip_ntohs(notify->message_type) == IPIKE_NOTI_INF_COOKIE2)))
{
/* We will send the message to the new address, so update local/peer
* address for the exchange */
if (ie->ike_sa->mobike.update.local_addr.sa.sa_family != 0)
(void)ipike_addr_copy(&ie->msg.local_addr, &ie->ike_sa->mobike.update.local_addr);
else
(void)ipike_addr_copy(&ie->msg.local_addr, &ie->ike_sa->local_addr);
if (ie->ike_sa->mobike.update.peer_addr.sa.sa_family != 0)
(void)ipike_addr_copy(&ie->msg.peer_addr, &ie->ike_sa->mobike.update.peer_addr);
else
(void)ipike_addr_copy(&ie->msg.peer_addr, &ie->ike_sa->peer_addr);
/* No NATs allowed payload must be sent for MOBIKE if not NAT Traversal */
if ( ipcom_sysvar_get_as_int("ipike.port_nat", 0) == 0 )
{
err = ipike_payload_notify_no_nats_allowed(&ie->msg.local_addr,
&ie->msg.peer_addr,
(Ipike2_notify_payload**)&reply_payload);
if (IPIKE_SUCCESS == err)
{
err = ipike_array_add((void***) reply_payloads, reply_payload);
if (IPIKE_SUCCESS != err)
{
ipcom_free(reply_payload);
reply_payload = IP_NULL;
}
}
}
}
return err;
}
/*
*===========================================================================
* ipike_exchange_info_add_nat_reply_payloads
*===========================================================================
*/
IP_STATIC Ipike_error
ipike_exchange_info_add_nat_reply_payloads(
Ipike_isakmp_exchange* ie,
Ipike_payload_header*** reply_payloads)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike_payload_header* reply_payload = IP_NULL;
if (ipike.port_nat != 0)
{
/* Always two payloads (local and peer) */
if (IPIKE_SUCCESS == err)
{
err = ipike_payload_notify_nat_detection(ie, IP_TRUE, (Ipike2_notify_payload**)&reply_payload);
if (IPIKE_SUCCESS == err)
{
err = ipike_array_add((void***) reply_payloads, reply_payload);
if (IPIKE_SUCCESS != err)
ipcom_free(reply_payload);
}
}
if (IPIKE_SUCCESS == err)
{
err = ipike_payload_notify_nat_detection(ie, IP_FALSE, (Ipike2_notify_payload**)&reply_payload);
if (IPIKE_SUCCESS == err)
{
err = ipike_array_add((void***) reply_payloads, reply_payload);
if (IPIKE_SUCCESS != err)
ipcom_free(reply_payload);
}
}
}
return err;
}
/*
****************************************************************************
* 10 PUBLIC FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_exchange_info_on_new_initiator
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_exchange_info_on_new_initiator(
Ipike_isakmp_exchange* ie,
Ipike_sadb_entry *ike_sa,
const void* payload,
const void* not_used2)
{
IPCOM_UNUSED_ARG(not_used2);
ipcom_microtime(&ie->start);
ie->ike_sa = ike_sa;
ipike_sadb_lock(ie->ike_sa);
ie->phase2.notify_or_delete = (Ipike_payload_header*) payload;
ie->is_phase1 = IP_FALSE;
ie->version = ie->ike_sa->version;
ie->exchange_initiator = IP_TRUE;
ie->message_id = ie->ike_sa->v2.message_id++;
ie->isakmp_flags = 0;
return ipike_exchange_info_on_new(ie);
}
/*
*===========================================================================
* ipike_exchange_info_on_new_responder
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_exchange_info_on_new_responder(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header* first_isakmp,
union Ip_sockaddr_union* local_addr,
union Ip_sockaddr_union* peer_addr)
{
(void) local_addr;
(void) peer_addr;
ipcom_microtime(&ie->start);
if (IP_NULL != first_isakmp)
{
if (IPIKE_SUCCESS != ipike_sadb_get(
first_isakmp->initiator_cookie,
first_isakmp->responder_cookie,
IPIKE_SA_ACTIVE,
&ie->ike_sa))
{
IPCOM_LOG0(WARNING, "ipike_exchange_info_on_new_responder: IKE SA not found");
IPCOM_LOG1(WARNING, "initiator_cookie: %s",
ipike_cookie_to_string(first_isakmp->initiator_cookie));
IPCOM_LOG1(WARNING, "responder_cookie: %s",
ipike_cookie_to_string(first_isakmp->responder_cookie));
return IPIKE_ISAKMP_INVALID_IKE_SPI;
}
}
ie->version = ie->ike_sa->version;
ie->isakmp_flags = IPIKE_ISAKMP_RESPONSE;
return ipike_exchange_info_on_new(ie);
}
/*
*===========================================================================
* ipike_exchange_info_on_delete
*===========================================================================
*/
IP_PUBLIC void
ipike_exchange_info_on_delete(Ipike_isakmp_exchange* ie)
{
if (ie->phase2.notify_or_delete)
IPIKE_FREEP(ie->phase2.notify_or_delete);
}
/*
*===========================================================================
* ipike_exchange_info_get_payload_order
*===========================================================================
*/
IP_PUBLIC const Ip_u16*
ipike_exchange_info_get_payload_order(Ipike_isakmp_exchange* ie)
{
static Ip_u16 info_order[] =
{
IPIKE2_PAYLOAD_NOTIFY,
IPIKE2_PAYLOAD_DELETE,
IPIKE2_PAYLOAD_CONFIGURATION,
IPIKE_PAYLOAD_NONE
};
IPCOM_UNUSED_ARG(ie);
return info_order;
}
/*
*===========================================================================
* ipike_exchange_info_process_payloads
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_exchange_info_process_payloads(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header* isakmp)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike_payload_header* payload;
Ip_u8 this_payload;
Ipike_payload_enum ctx;
if (((isakmp->flags & IPIKE_ISAKMP_RESPONSE) && ((ie->message_number % 2) != 0)) ||
(!(isakmp->flags & IPIKE_ISAKMP_RESPONSE) && ((ie->message_number % 2) == 0)))
{
IPCOM_LOG0(ERR, "ipike_exchange_info_process_payloads() :: "\
"exchange collision, abort and hope for retry later");
return IPIKE_FAILED;
}
ie->message_id = ip_ntohl(isakmp->message_id);
/* Peer is alive so reset liveness sent counter */
ie->ike_sa->liveness.sent = 0;
/* Process payloads */
this_payload = isakmp->next_payload;
payload = ipike_first_payload(isakmp, &ctx);
while ((IPIKE_SUCCESS == err) &&
(IPIKE_PAYLOAD_NONE != this_payload) &&
(IP_NULL != payload))
{
switch (this_payload)
{
case IPIKE2_PAYLOAD_NOTIFY:
err = ipike_payload_notify_process(ie, (Ipike2_notify_payload*) payload);
break;
case IPIKE2_PAYLOAD_DELETE:
err = ipike2_payload_delete_process(ie, (Ipike2_del_payload*) payload);
break;
case IPIKE2_PAYLOAD_CONFIGURATION:
break;
default:
err = ipike_payload_handle_unsupported_payload(&ie->ike_sa->notify_data,
payload, this_payload);
break;
}
this_payload = payload->next_payload;
payload = ipike_next_payload(&ctx);
}
ipike_free_payload_enumerator(&ctx);
if (IPIKE_SUCCESS != err)
{
IPIKE_EVENT_LOG(IKE_PACKET_DISCARD, ISAKMP_PACKET_ERROR,
&ie->ike_sa->peer_addr, &ie->ike_sa->local_addr,
0, IP_NULL);
/* Can we handle the error?
* Errors that are handled will be reported* back in the response */
err = ipike_exchange_handle_error(ie, ie->ike_sa, err);
}
return err;
}
/*
*===========================================================================
* ipike_exchange_info_add_reply_payloads
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_exchange_info_add_reply_payloads(
Ipike_isakmp_exchange* ie,
Ipike_payload_header*** reply_payloads)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike_payload_header* reply_payload = IP_NULL;
ip_assert(ie->ike_sa != IP_NULL);
/* Should we handle a error response */
if (IPIKE_SUCCESS != ie->ike_sa->error)
{
ie->send_and_destroy = IP_TRUE;
return ipike_payload_notify_add_error_reply(ie, reply_payloads);
}
/* Messages must be protected */
ie->isakmp_flags |= IPIKE_ISAKMP_ENCRYPTION;
/* Generate iv if needed */
err = ipike_crypto_generate_iv(ie->ike_sa, &ie->iv);
if (err != IPIKE_SUCCESS)
return err;
/* Only a single notify or delete payload, specified in the exchange */
reply_payload = ie->phase2.notify_or_delete;
ie->phase2.notify_or_delete = IP_NULL;
/* Add payload if any specified */
if (IP_NULL != reply_payload)
{
if (IPIKE_SUCCESS != (err = ipike_array_add((void***)reply_payloads, reply_payload)))
{
ipcom_free(reply_payload);
reply_payload = IP_NULL;
}
}
/* Also add eventual extra payloads for MOBIKE */
if (IPIKE_SUCCESS == err)
err = ipike_exchange_info_add_mobike_reply_payloads(ie, reply_payloads);
/* Also add eventual extra payload for NAT Traversal */
if (IPIKE_SUCCESS == err)
err = ipike_exchange_info_add_nat_reply_payloads(ie, reply_payloads);
return err;
}
/*
*===========================================================================
* ipike_exchange_info_cleartext_outgoing_message
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_exchange_info_cleartext_outgoing_message(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header** outgoing_isakmp)
{
(void)ie;
(void)outgoing_isakmp;
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_exchange_info_done
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_exchange_info_done(Ipike_isakmp_exchange* ie)
{
ipcom_microtime(&ie->stop);
IPCOM_LOG0(INFO, "informational exchange done");
/* Did we just get a address update using MOBIKE */
if ( ipike_addr_is_valid(&ie->ike_sa->mobike.update.peer_addr) )
{
/* Eventually send a cookie2 request to initiator to verify the address */
if (ipcom_sysvar_get_as_int("ipike.mobike.routability_check", 1) != 0)
{
/* Check new address */
if (IPIKE_SUCCESS != ipike_isakmp_initiate_cookie2(ie->ike_sa) )
{
IPCOM_LOG0(ERR, "ipike_exchange_info_done() ::"\
" initiate exchange failed");
}
}
else
{
/* No check, so commit change */
if (IPIKE_SUCCESS != ipike_dispatch_commit_address_update(ie->ike_sa) )
{
IPCOM_LOG0(ERR, "ipike_exchange_info_done() ::"\
" commit update failed");
}
/* Address updated, clear it */
ipcom_memset(&ie->ike_sa->mobike.update.peer_addr,
0,
sizeof(ie->ike_sa->mobike.update.peer_addr));
}
}
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_exchange_info_report_error
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_exchange_info_report_error(
Ipike_sadb_entry* ike_sa,
Ipike_ipsec_sa_param* ipsec_sa,
Ipike_error error_code)
{
Ipike_error err;
Ip_u16 msg_type;
Ipike_value spi = { IP_NULL, 0 };
Ip_u8 isakmp_spi[IPIKE_ISAKMP_COOKIE_SIZE * 2];
Ip_u8 proto_id = IPIKE_PROTO_ISAKMP;
Ipike2_notify_payload* notify;
Ipike_sa* inbound;
if (IPIKE_SUCCESS != (err = ipike_payload_notify_error_to_message_type(
error_code,
&msg_type)))
{
return err;
}
if (ike_sa->state == IPIKE_SA_CONSTRUCTING)
{
spi.value = isakmp_spi;
spi.len = sizeof(isakmp_spi);
ipcom_memcpy(isakmp_spi, ike_sa->initiator_cookie, IPIKE_ISAKMP_COOKIE_SIZE);
ipcom_memcpy(isakmp_spi + IPIKE_ISAKMP_COOKIE_SIZE,
ike_sa->responder_cookie,
IPIKE_ISAKMP_COOKIE_SIZE);
}
else if (ipsec_sa != IP_NULL)
{
/* we are in phase 2 */
inbound = &ipsec_sa->inbound_sa;
if (inbound->proposals && inbound->selected_proposal >= 0)
{
proto_id = inbound->proposals[inbound->selected_proposal]->proto_id;
spi = inbound->proposals[inbound->selected_proposal]->spi;
}
}
if (IPIKE_SUCCESS != (err = ipike_payload_notify_create(proto_id,
msg_type,
&spi,
&ike_sa->notify_data,
&notify)))
{
IPCOM_LOG0(CRIT, "ipike_exchange_info_report_error() :: out of memory");
return err;
}
return ipike_isakmp_initiate_informational_exchange(ike_sa, &notify->header);
}
/*
*===========================================================================
* ipike_exchange_info_report_error
*===========================================================================
*/
IP_PUBLIC void
ipike_exchange_info_report_sa_delete(
Ipike_sadb_entry* ike_sa,
Ip_u8 proto_id,
Ipike_value* spi)
{
Ipike2_del_payload *del;
del = ipike2_payload_delete_new(proto_id, spi);
if (IP_NULL == del)
{
IP_PANIC();
return;
}
(void)ipike_isakmp_initiate_informational_exchange(ike_sa, &del->header);
}
/*
*===========================================================================
* ipike_exchange_info_liveness
*===========================================================================
*/
IP_PUBLIC Ip_bool
ipike_exchange_info_liveness(Ipike_sadb_entry* ike_sa)
{
Ipike_payload_header* payload;
payload = ipcom_calloc(1, sizeof(*payload));
if (IP_NULL != payload)
{
if (ipike.port_nat != 0)
payload->next_payload = IPIKE2_PAYLOAD_NOTIFY;
else
payload->next_payload = IPIKE_PAYLOAD_NONE;
(void)ipike_isakmp_initiate_informational_exchange(ike_sa, payload);
return IP_TRUE;
}
return IP_FALSE;
}
/*
*===========================================================================
* ipike_exchange_info_update_address
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_exchange_info_update_address(
Ipike_sadb_entry* ike_sa)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike2_notify_payload* payload = IP_NULL;
err = ipike_payload_notify_update_sa_addresses(&payload);
if (IPIKE_SUCCESS != err)
{
IPCOM_LOG0(ERR, "ipike_exchange_info_update_address() ::"\
" failed to create payload");
return err;
}
err = ipike_dispatch_commit_address_update(ike_sa);
if (IPIKE_SUCCESS != err)
{
IPCOM_LOG0(ERR, "ipike_exchange_info_update_address() ::"\
" failed to commit address change");
ipcom_free(payload);
return err;
}
err = ipike_isakmp_initiate_informational_exchange(ike_sa,
&payload->header);
if (IPIKE_SUCCESS != err)
{
IPCOM_LOG0(ERR, "ipike_exchange_info_update_address() ::"\
" failed to initiate exchange");
}
return err;
}
/*
*===========================================================================
* ipike_exchange_info_cookie2
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_exchange_info_cookie2(
Ipike_sadb_entry* ike_sa)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike2_notify_payload* payload = IP_NULL;
IPIKE_FREEP(ike_sa->mobike.cookie2.value);
err = ipike_payload_notify_cookie2(&ike_sa->mobike.cookie2, &payload);
if (IPIKE_SUCCESS != err)
{
IPCOM_LOG0(ERR, "ipike_exchange_info_cookie2() ::"\
" failed to create payload");
return err;
}
err = ipike_isakmp_initiate_informational_exchange(ike_sa, &payload->header);
if (IPIKE_SUCCESS != err)
{
IPCOM_LOG0(ERR, "ipike_exchange_info_cookie2() ::"\
" failed to initiate exchange");
}
return err;
}
#else
int ipike_exchange_info_empty_file = 0;
#endif /* IPIKE_USE_VERSION2 */
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike2_exchange_info.h
+269
View File
@@ -0,0 +1,269 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike2_exchange_info.h,v $ $Revision: 1.6.16.1 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike2_exchange_info.h,v $
* $Author: ulf $ $Date: 2011-11-16 10:33:31 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#if !defined(IPIKE_EXCHANGE_INFO_H) && defined(IPIKE_USE_VERSION2)
#define IPIKE_EXCHANGE_INFO_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* IKE INFORMATIONAL exchange (for IKE version 2) */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike.h"
#include "ipike_isakmp.h"
#include "ipike_payload.h"
#include "ipike_sadb.h"
#include "ipike_ipsec_sadb.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_exchange_info_on_new_initiator
*===========================================================================
* Description: Creates a new IKE SA and creates a initiator cookie.
* Parameters: ie - the state of this exchange (this pointer).
* ike_sa - The IKE SA to be used to protect the communication.
* payload - The payload that should be sent.
* Returns: Ipike standard error code.
*/
IP_PUBLIC Ipike_error
ipike_exchange_info_on_new_initiator(
Ipike_isakmp_exchange* ie,
Ipike_sadb_entry* ike_sa,
const void* payload,
const void* not_used2);
/*
*===========================================================================
* ipike_exchange_info_on_new_responder
*===========================================================================
* Description: Creates a new IKE SA.
* Parameters: ie - the state of this exchange (this pointer).
* first_isakmp - the first message (and only) that was/will be sent
* in this exchange.
* local_addr - The local address the peer send messages to.
* peer_addr - The address of the peer IKE daemon.
* Returns: Ipike standard error code.
*/
IP_PUBLIC Ipike_error
ipike_exchange_info_on_new_responder(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header* first_isakmp,
union Ip_sockaddr_union* local_addr,
union Ip_sockaddr_union* peer_addr);
/*
*===========================================================================
* ipike_exchange_info_on_delete
*===========================================================================
* Description: Updates the base initialization vector if the exchange
* was compleated successfully.
* Parameters: ie - the state of this exchange (this pointer).
* Returns:
*/
IP_PUBLIC void
ipike_exchange_info_on_delete(Ipike_isakmp_exchange* ie);
/*
*===========================================================================
* ipike_exchange_info_get_payload_order
*===========================================================================
* Description: Returns a IPIKE_PAYLOAD_NONE terminated array of payload
* id:s that the ike sa init exchange message must contain.
* Parameters: ie - the state of this exchange.
* Returns: An array containing the payload IDs in the low byte
* and flags in the high byte.
*/
IP_PUBLIC const Ip_u16*
ipike_exchange_info_get_payload_order(Ipike_isakmp_exchange* ie);
/*
*===========================================================================
* ipike_exchange_info_process_payloads
*===========================================================================
* Description: Updates the SA structure bound to this exchange.
* Parameters: ie - the state of this exchange.
* isakmp - the ISAKMP message.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
* IPIKE_SA_NO_ACCEPTED_TRANSFORM
* IPIKE_DOI_UNSUPPORTED
* IPIKE_SITUATION_UNSUPPORTED
*/
IP_PUBLIC Ipike_error
ipike_exchange_info_process_payloads(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header* isakmp);
/*
*===========================================================================
* ipike_exchange_info_add_reply_payloads
*===========================================================================
* Description: Adds all payloads that should part of the response.
* Parameters: ie - the state of this exchange (this pointer).
* reply_payloads - pointer to an array of payload pointers.
* The array will be allocated by this function.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
* IPIKE_ISAKMP_UNSUPPORTED_PAYLOAD
*/
IP_PUBLIC Ipike_error
ipike_exchange_info_add_reply_payloads(
Ipike_isakmp_exchange* ie,
Ipike_payload_header*** reply_payloads);
/*
*===========================================================================
* ipike_exchange_info_cleartext_outgoing_message
*===========================================================================
* Description: Does nothing (not needed in main mode)
* Parameters: ie - the state of this exchange.
* outgoing_isakmp - the outgoing ISAKMP message.
* Returns: IPIKE_SUCCESS
*/
IP_PUBLIC Ipike_error
ipike_exchange_info_cleartext_outgoing_message(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header** outgoing_isakmp);
/*
*===========================================================================
* ipike_exchange_info_done
*===========================================================================
* Description: Stores the final IV.
* Parameters: ie - the parameters for the finished exchange.
* Returns: IPIKE_SUCCESS
* OUT_OF_MEMORY
*/
IP_PUBLIC Ipike_error
ipike_exchange_info_done(Ipike_isakmp_exchange* ie);
/*
*===========================================================================
* ipike_exchange_info_report_error
*===========================================================================
* Description: Creates a new informational exchange from a standard ipike
* error code. The message is sent to the address in the IKE SA.
* Parameters: ike_sa - The IKE SA that should protect the traffic.
* ipsec_sa - The IPSec SA, can be IP_NULL.
* error_code - The error to report.
* Returns: IPIKE_SUCCESS
* OUT_OF_MEMORY
*/
IP_PUBLIC Ipike_error
ipike_exchange_info_report_error(
Ipike_sadb_entry* ike_sa,
Ipike_ipsec_sa_param* ipsec_sa,
Ipike_error error_code);
/*
*===========================================================================
* ipike_exchange_info_report_sa_delete
*===========================================================================
* Description: Report to the IKE peer that this IKE daemon has deleted
* or detected deletion of a SA.
* Parameters: ike_sa - The IKE SA that should protect the traffic.
* proto_id - The protocol id of the SA.
* spi - The SPI of the deleted SA.
* Returns:
*/
IP_PUBLIC void
ipike_exchange_info_report_sa_delete(
Ipike_sadb_entry* ike_sa,
Ip_u8 proto_id,
Ipike_value* spi);
/*
*===========================================================================
* ipike_exchange_info_liveness
*===========================================================================
* Description: Initiate empty information exchange, to validate that the
* peer is live and kicking.
* Parameters: ike_sa - The IKE SA that should protect the traffic.
* Returns: TRUE if successfully executed or FALSE if failure.
*/
IP_PUBLIC Ip_bool
ipike_exchange_info_liveness(Ipike_sadb_entry* ike_sa);
/*
*===========================================================================
* ipike_exchange_info_update_address
*===========================================================================
* Description: Initiate update address exchange for the IKE peer
* Parameters: ike_sa - The IKE SA that should protect the traffic.
* Returns: Ipike standard error code.
*/
IP_GLOBAL Ipike_error
ipike_exchange_info_update_address(
Ipike_sadb_entry* ike_sa);
/*
*===========================================================================
* ipike_exchange_info_cookie2
*===========================================================================
* Description: Initiate cookie2 exchange for the IKE peer
* Parameters: ike_sa - The IKE SA that should protect the traffic.
* Returns: Ipike standard error code.
*/
IP_GLOBAL Ipike_error
ipike_exchange_info_cookie2(
Ipike_sadb_entry* ike_sa);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike2_exchange_sa_init.c
+3393
View File
File diff suppressed because it is too large Load Diff
components/ip_net2-6.9/ipike/src/ipike2_exchange_sa_init.h
+264
View File
@@ -0,0 +1,264 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike2_exchange_sa_init.h,v $ $Revision: 1.5.16.2 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike2_exchange_sa_init.h,v $
* $Author: edahlber $ $Date: 2011-12-06 15:25:27 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#if !defined(IPIKE_EXCHANGE_SA_INIT_H) && defined(IPIKE_USE_VERSION2)
#define IPIKE_EXCHANGE_SA_INIT_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* IKE SA INIT and AUTH exchange (IKE version 2) */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike.h"
#include "ipike_isakmp.h"
#include "ipike_sadb.h"
#include "ipike_payload.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_exchange_sa_init_print_keys
*===========================================================================
* Description:
* Parameters:
* Returns:
*/
IP_GLOBAL void
ipike_exchange_sa_init_print_keys(Ipike_keys *keys);
/*
*===========================================================================
* ipike_exchange_sa_init_on_new_initiator
*===========================================================================
* Description: Creates a new IKE SA and creates a initiator cookie.
* Parameters: ie - the state of this exchange (this pointer).
* ike_sa - IKE SA (optional)
* not_used1 - parameter not used.
* not_used2 - parameter not used.
* Returns: Ipike standard error code.
*/
IP_PUBLIC Ipike_error
ipike_exchange_sa_init_on_new_initiator(
Ipike_isakmp_exchange* ie,
Ipike_sadb_entry* ike_sa,
const void* not_used1,
const void* not_used2);
/*
*===========================================================================
* ipike_exchange_sa_init_on_new_responder
*===========================================================================
* Description: Creates a new IKE SA.
* Parameters: ie - the state of this exchange (this pointer).
* first_isakmp - the first message that was/will be sent in
* this exchange.
* local_addr - The local address the peer send messages to.
* peer_addr - The address of the peer IKE daemon.
* Returns: Ipike standard error code.
*/
IP_PUBLIC Ipike_error
ipike_exchange_sa_init_on_new_responder(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header* first_isakmp,
union Ip_sockaddr_union* local_addr,
union Ip_sockaddr_union* peer_addr);
/*
*===========================================================================
* ipike_exchange_sa_init_on_delete
*===========================================================================
* Description: Updates the base initialization vector if the exchange
* was compleated successfully.
* Parameters: ie - the state of this exchange (this pointer).
* Returns:
*/
IP_PUBLIC void
ipike_exchange_sa_init_on_delete(Ipike_isakmp_exchange* ie);
/*
*===========================================================================
* ipike_exchange_sa_init_get_payload_order
*===========================================================================
* Description: Returns a IPIKE_PAYLOAD_NONE terminated array of payload
* id:s that the ike sa init exchange message must contain.
* Parameters: ie - the state of this exchange.
* Returns: An array containing the payload IDs in the low byte
* and flags in the high byte.
*/
IP_PUBLIC const Ip_u16*
ipike_exchange_sa_init_get_payload_order(Ipike_isakmp_exchange* ie);
/*
*===========================================================================
* ipike_exchange_sa_init_select_param
*===========================================================================
* Description:
* Parameters:
* Returns:
*/
IP_GLOBAL Ipike_error
ipike_exchange_sa_init_select_param(Ipike_isakmp_exchange *ie, struct Ipike_sadb_entry_struct *ike_sa);
/*
*===========================================================================
* ipike_exchange_sa_init_process_payloads
*===========================================================================
* Description: Updates the SA structure bound to this exchange.
* Parameters: ie - the state of this exchange.
* isakmp - the ISAKMP message.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_PUBLIC Ipike_error
ipike_exchange_sa_init_process_payloads(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header* isakmp);
/*
*===========================================================================
* ipike_exchange_sa_init_add_reply_payloads
*===========================================================================
* Description: Adds all payloads that should part of the response.
* Parameters: ie - the state of this exchange (this pointer).
* reply_payloads - pointer to an array of payload pointers.
* The array will be allocated by this function.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
* IPIKE_ISAKMP_UNSUPPORTED_PAYLOAD
*/
IP_PUBLIC Ipike_error
ipike_exchange_sa_init_add_reply_payloads(
Ipike_isakmp_exchange* ie,
Ipike_payload_header*** reply_payloads);
/*
*===========================================================================
* ipike_exchange_sa_init_cleartext_outgoing_message
*===========================================================================
* Description: Does nothing (not needed in main mode)
* Parameters: ie - the state of this exchange.
* isakmp - the outgoing ISAKMP message.
* Returns: IPIKE_SUCCESS
*/
IP_PUBLIC Ipike_error
ipike_exchange_sa_init_cleartext_outgoing_message(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header** isakmp);
/*
*===========================================================================
* ipike_exchange_sa_init_done
*===========================================================================
* Description: Stores the final IV.
* Parameters: ie - the parameters for the finished exchange.
* Returns: IPIKE_SUCCESS
* OUT_OF_MEMORY
*/
IP_PUBLIC Ipike_error
ipike_exchange_sa_init_done(Ipike_isakmp_exchange* ie);
/*
*===========================================================================
* ipike_exchange_handle_error
*===========================================================================
* Description: Handle error codes for exchanges. The SA will be updated with
* the error if it may be handled.
* Parameters: ie - the state of this exchange.
* sa - the security association.
* err - the error code.
* Returns: IPIKE_SUCCESS
* err (same as input)
*/
IP_PUBLIC Ipike_error
ipike_exchange_handle_error(
Ipike_isakmp_exchange* ie,
Ipike_sadb_entry* sa,
Ipike_error err);
/*
*===========================================================================
* ipike_exchange_generate_dh_key
*===========================================================================
* Description: Generate a diffie hellman key for the exchange.
* Parameters: ie - the state of this exchange.
* group - the diffie hellman group.
* Returns: IPIKE_SUCCESS
* IPIKE_ISAKMP_NO_PROPOSAL_CHOSEN
*/
IP_PUBLIC Ipike_error
ipike_exchange_generate_dh_key(
Ipike_isakmp_exchange *ie,
Ipike_sadb_entry *sa,
Ip_u16 group);
/*
*===========================================================================
* ipike_exchange_merge_traffic_selectors
*===========================================================================
* Description: Merge initiator and responder traffic selectors.
* Parameters: ie - the state of this exchange.
* Returns:
*/
IP_GLOBAL Ipike_error
ipike_exchange_merge_traffic_selectors(Ipike_isakmp_exchange* ie);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike2_payload_authentication.c
+863
View File
@@ -0,0 +1,863 @@
/*
******************************************************************************
* SOURCE FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike2_payload_authentication.c,v $ $Revision: 1.26.10.7 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike2_payload_authentication.c,v $
* $Author: zan $ $Date: 2013-08-05 10:04:01 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Authentication payload (IKE version 2) */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#ifdef IPIKE_USE_VERSION2
#include "ipike_h.h"
#include "ipike_attributes.h"
#include "ipike2_payload_authentication.h"
#include "ipike_util.h"
#include "ipike_sadb.h"
#include "ipike_crypto.h"
#include <ipcom_clib.h>
#include <ipcom_syslog.h>
#include <ipcom_key_db.h>
/*
****************************************************************************
* 4 EXTERN PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 5 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 6 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 7 LOCAL PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 8 DATA
****************************************************************************
*/
/*
****************************************************************************
* 9 LOCAL FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_payload_authentication_data
*===========================================================================
* Description: Returns a pointer to the authentication data in the payload.
* Parameters: auth - a authentication payload.
* Returns: A pointer to the authentication data.
*/
IP_STATIC Ip_u8*
ipike_payload_authentication_data(Ipike2_auth_payload* auth)
{
return (Ip_u8*)auth + sizeof(Ipike2_auth_payload);
}
/*
*===========================================================================
* ipike_payload_authentication_data_length
*===========================================================================
* Description: Returns the length of the authentication data.
* Parameters: auth - authentication payload.
* Returns: The length of the authentication data (in bytes).
*/
IP_STATIC Ip_u16
ipike_payload_authentication_data_length(Ipike2_auth_payload* auth)
{
return IPIKE_PAYLOAD_DATA_LENGTH(auth->header.length, sizeof(Ipike2_auth_payload));
}
/*
*===========================================================================
* ipike_payload_authentication_get_digest_info
*===========================================================================
*/
IP_STATIC Ipike_error
ipike_payload_authentication_get_digest_info(
Ipike_config_auth* conf,
Ipike_value* msg,
Ipike_value* digest)
{
Ipike_error err;
Ipike_value data;
Ipike_value hash;
Ip_u8 alg;
digest->value = IP_NULL;
data.value = IP_NULL;
hash.value = IP_NULL;
alg = ipike_crypto_hash_algorithm_from_cert(conf->certificate);
if (IPIKE_SUCCESS != (err = ipike_crypto_hash(alg, msg, &hash)))
{
IPCOM_LOG0(ERR, "ipike_payload_authentication_get_digest_info() :: failed generate hash");
}
else if (IPIKE_SUCCESS != (err = ipike_crypto_create_digest_info(alg, &hash, digest)))
{
IPCOM_LOG0(ERR, "ipike_payload_authentication_get_digest_info() :: failed encode digest info");
}
if (IP_NULL != data.value)
ipcom_free(data.value);
if (IP_NULL != hash.value)
ipcom_free(hash.value);
return err;
}
/*
*===========================================================================
* ipike_payload_authentication_verify_certificate
*===========================================================================
*/
IP_STATIC Ipike_error
ipike_payload_authentication_verify_certificate(
Ipike_config_auth* conf,
Ipike_cert* cert)
{
Ipike_error err = IPIKE_SUCCESS;
X509** trusted = IP_NULL;
X509** ca = IP_NULL;
X509_CRL** crls = IP_NULL;
trusted = ipike_crypto_get_trusted_certs(conf->trusted_ca_store);
ca = ipike_crypto_get_intermediate_ca_certs(cert, conf->intermediate_ca_store);
if (trusted == IP_NULL)
{
IPCOM_LOG0(ERR, "ipike_payload_authentication_verify_certificate() :: failed to read trusted certificate");
err = IPIKE_INVALID_VALUE;
}
else
{
#ifdef IPIKE_USE_OCSP
err = ipike_crypto_verify_certificate_ocsp(trusted, ca, cert->peer, cert->crls, cert->resp_peer);
#else
err = ipike_crypto_verify_certificate(trusted, ca, cert->peer, cert->crls);
#endif
}
ipike_array_free((void**) trusted, (void(*)(void*)) X509_free);
ipike_array_free((void**) ca, (void(*)(void*)) X509_free);
ipike_array_free((void**) crls, (void(*)(void*)) X509_CRL_free);
return err;
}
/*
*===========================================================================
* ipike_payload_authentication_generate_pre_shared
*===========================================================================
*/
IP_STATIC Ipike_error
ipike_payload_authentication_generate_pre_shared(Ip_u16 prf_alg,
Ipike_config_auth* conf,
Ipike_value* msg,
Ipike_value* auth)
{
Ipike_error err = IPIKE_SUCCESS;
Ip_u8* psk_buf = IP_NULL;
int psk_buf_len = 0;
const char* psk_id = conf->psk_id;
Ip_u8* shared_key = (Ip_u8 *) conf->shared_key;
Ip_size_t shared_key_len = shared_key ? ipcom_strlen(conf->shared_key) : 0;
if (psk_id)
{
if (ipcom_key_db_buf_get(psk_id, IP_NULL, &psk_buf_len) != IPCOM_SUCCESS)
{
IPCOM_LOG1(ERR, "ipike_payload_authentication_generate_pre_shared()"\
" :: failed to get psk_id: %s, from secure key db", psk_id);
}
psk_buf = ipcom_malloc((Ip_size_t)psk_buf_len);
if (psk_buf == IP_NULL)
return IPIKE_OUT_OF_MEMORY;
if (ipcom_key_db_buf_get(psk_id, psk_buf, &psk_buf_len) != IPCOM_SUCCESS)
{
IPCOM_LOG1(ERR, "ipike_payload_authentication_generate_pre_shared()"\
" :: failed to get psk_id: %s, from secure key db", psk_id);
}
shared_key = psk_buf;
shared_key_len = (Ip_size_t) psk_buf_len;
}
else if ( ipike_util_str_is_hex(conf->shared_key) )
{
psk_buf = ipike_util_str_hex2bin(conf->shared_key, &shared_key_len);
if (psk_buf == IP_NULL)
return IPIKE_OUT_OF_MEMORY;
shared_key = psk_buf;
}
err = ipike_crypto_compute_auth_pre_shared_secret(prf_alg,
shared_key,
shared_key_len,
msg,
auth);
if (IPIKE_SUCCESS != err)
{
IPCOM_LOG0(ERR, "ipike_payload_authentication_generate_pre_shared() ::"\
" failed to generate eap auth");
err = IPIKE_ISAKMP_AUTHENTICATION_FAILED;
}
#ifdef IP_DEBUG
(void)ipike_print_memory(IPCOM_LOG_DEBUG, "Auth:\n", auth->value, auth->len);
#endif
if (psk_buf != IP_NULL)
ipcom_free(psk_buf);
return err;
}
/*
*===========================================================================
* ipike_payload_authentication_verify_pre_shared
*===========================================================================
*/
IP_STATIC Ipike_error
ipike_payload_authentication_verify_pre_shared(
Ip_u16 prf_alg,
Ipike_config_auth* conf,
Ipike_value* msg,
Ipike_value* auth)
{
Ipike_error err;
Ipike_value auth2;
auth2.value = IP_NULL;
err = ipike_payload_authentication_generate_pre_shared(prf_alg,
conf,
msg,
&auth2);
if (IPIKE_SUCCESS != err)
return err;
if (auth->len != auth2.len ||
ipcom_memcmp(auth->value, auth2.value, auth2.len))
err = IPIKE_ISAKMP_AUTHENTICATION_FAILED;
ipcom_free(auth2.value);
return err;
}
/*
*===========================================================================
* ipike_payload_authentication_generate_rsa_signature
*===========================================================================
*/
IP_STATIC Ipike_error
ipike_payload_authentication_generate_rsa_signature(
Ipike_config_auth* conf,
Ipike_value* msg,
Ipike_value* auth)
{
Ipike_error err;
Ipike_value digest;
digest.value = IP_NULL;
err = ipike_payload_authentication_get_digest_info(conf,
msg,
&digest);
if (IPIKE_SUCCESS != err)
{
IPCOM_LOG0(ERR, "ipike_payload_authentication_generate_rsa_signature() :: failed to generate digest");
}
else if (IPIKE_SUCCESS != (err = ipike_crypto_compute_rsa_sign(conf->key_id,
conf->private_key,
&digest,
auth)))
{
IPCOM_LOG0(ERR, "ipike_payload_authentication_generate_rsa_signature() :: failed to compute signature");
}
if (IP_NULL != digest.value)
ipcom_free(digest.value);
return err;
}
/*
*===========================================================================
* ipike_payload_authentication_verify_rsa_signature
*===========================================================================
*/
IP_STATIC Ipike_error
ipike_payload_authentication_verify_rsa_signature(
Ipike_config_auth* conf,
Ipike_value* msg,
Ipike_cert* cert,
Ipike_value* auth)
{
Ipike_error err;
Ipike_value digest;
digest.value = IP_NULL;
digest.len = 0;
if (IPIKE_SUCCESS != (err = ipike_crypto_verify_recover_rsa_sign(
cert->peer,
auth,
&digest)))
{
IPCOM_LOG0(ERR, "Failed to recover digest from signature");
err = IPIKE_ISAKMP_AUTHENTICATION_FAILED;
}
else if (IPIKE_SUCCESS != (err = ipike_crypto_verify_data(msg, &digest)))
{
IPCOM_LOG0(ERR, "Failed to verify signature");
err = IPIKE_ISAKMP_AUTHENTICATION_FAILED;
}
else if (IPIKE_SUCCESS != (err = ipike_payload_authentication_verify_certificate(
conf,
cert)))
{
IPCOM_LOG0(ERR, "Failed to verify certificate");
err = IPIKE_ISAKMP_AUTHENTICATION_FAILED;
}
if (IP_NULL != digest.value)
ipcom_free(digest.value);
return err;
}
/*
*===========================================================================
* ipike_payload_authentication_generate_dsa_signature
*===========================================================================
*/
IP_STATIC Ipike_error
ipike_payload_authentication_generate_dsa_signature(
Ipike_config_auth* conf,
Ipike_value* msg,
Ipike_value* auth)
{
Ipike_error err;
Ip_u8 alg;
Ipike_value hash;
alg = IPIKE_ATTR_HASH_SHA1; /* always */
hash.value = IP_NULL;
if (IPIKE_SUCCESS != (err = ipike_crypto_hash(alg, msg, &hash)))
{
IPCOM_LOG0(ERR, "ipike_payload_authentication_generate_dsa_signature() :: failed generate hash");
}
else if (IPIKE_SUCCESS != (err = ipike_crypto_compute_dsa_sign(conf->key_id,
conf->private_key,
&hash,
auth)))
{
IPCOM_LOG0(ERR, "ipike_payload_authentication_generate_dsa_signature() :: failed to compute signature");
}
if (IP_NULL != hash.value)
ipcom_free(hash.value);
return err;
}
/*
*===========================================================================
* ipike_payload_authentication_verify_dsa_signature
*===========================================================================
*/
IP_STATIC Ipike_error
ipike_payload_authentication_verify_dsa_signature(
Ipike_config_auth* conf,
Ipike_value* msg,
Ipike_cert* cert,
Ipike_value* auth)
{
Ipike_error err;
Ip_u8 alg;
Ipike_value hash;
hash.value = IP_NULL;
alg = IPIKE_ATTR_HASH_SHA1; /* always */
if (IPIKE_SUCCESS != (err = ipike_crypto_hash(alg, msg, &hash)))
{
IPCOM_LOG0(ERR, "ipike_payload_authentication_verify_dsa_signature() :: failed generate hash");
}
else if (IPIKE_SUCCESS != (err = ipike_crypto_verify_dsa_sign(
cert->peer,
&hash,
auth)))
{
IPCOM_LOG0(ERR, "Failed to verify signature");
err = IPIKE_ISAKMP_AUTHENTICATION_FAILED;
}
else if (IPIKE_SUCCESS != (err = ipike_payload_authentication_verify_certificate(
conf,
cert)))
{
IPCOM_LOG0(ERR, "Failed to verify certificate");
err = IPIKE_ISAKMP_AUTHENTICATION_FAILED;
}
if (IP_NULL != hash.value)
ipcom_free(hash.value);
return err;
}
/*
****************************************************************************
* 10 PUBLIC FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_payload_authentication_create
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_authentication_create(
Ipike2_auth* auth,
Ipike2_auth_payload** payload)
{
Ipike2_auth_payload* auth_payload;
if ((auth->data.value == IP_NULL) || (auth->data.len == 0))
{
*payload = IP_NULL;
}
else
{
if (IP_NULL == (auth_payload = ipcom_calloc(1, sizeof(Ipike2_auth_payload) + auth->data.len)))
{
IP_PANIC();
return IPIKE_OUT_OF_MEMORY;
}
auth_payload->header.length = ip_htons((Ip_u16)(sizeof(*auth_payload) + auth->data.len));
auth_payload->header.next_payload = IPIKE2_PAYLOAD_AUTHENTICATION;
auth_payload->method = auth->method;
ipcom_memcpy(ipike_payload_authentication_data(auth_payload), auth->data.value, auth->data.len);
*payload = auth_payload;
}
/* Free auth, so it may not be resued */
ipike_payload_authentication_free(auth);
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_payload_authentication_free
*===========================================================================
*/
IP_GLOBAL void
ipike_payload_authentication_free(Ipike2_auth* auth)
{
IPIKE_FREEP(auth->data.value);
ipcom_memset(auth, 0, sizeof(*auth));
return;
}
/*
*===========================================================================
* ipike_payload_authentication_check
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_authentication_check(Ipike2_auth_payload* auth)
{
switch (auth->method)
{
case IPIKE2_AUTH_PRE_SHARED_KEY:
case IPIKE2_AUTH_DSS_SIGNATURE:
case IPIKE2_AUTH_RSA_SIGNATURE:
return IPIKE_SUCCESS;
}
IPCOM_LOG2(ERR,
"ipike_payload_authentication_check() :: %s (%d) is a unsupported authentication method",
ipike_attribute_auth_method_to_string(auth->method),
auth->method);
return IPIKE_INVALID_VALUE;
}
/*
*===========================================================================
* ipike_payload_authentication_print
*===========================================================================
*/
IP_GLOBAL void
ipike_payload_authentication_print(Ipike2_auth_payload* auth)
{
IPCOM_LOG1(DEBUG2, " method: '%s'",
ipike_attribute_auth_method_to_string_v2(auth->method));
(void)ipike_print_memory(IPCOM_LOG_DEBUG2, " data: \n",
ipike_payload_authentication_data(auth),
ipike_payload_authentication_data_length(auth));
}
/*
*===========================================================================
* ipike_payload_authentication_extract
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_authentication_extract(
Ipike2_auth_payload* payload,
Ipike2_auth* auth)
{
auth->method = payload->method;
auth->data.len = ipike_payload_authentication_data_length(payload);
ipcom_free(auth->data.value);
if (IP_NULL == (auth->data.value = ipcom_malloc(auth->data.len)))
{
IP_PANIC();
return IPIKE_OUT_OF_MEMORY;
}
ipcom_memcpy(auth->data.value, ipike_payload_authentication_data(payload), auth->data.len);
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_payload_authentication_generate_message
*===========================================================================
*/
IP_STATIC Ipike_error
ipike_payload_authentication_generate_message(
Ipike2_id* id,
Ipike_value* key,
Ipike_value* nonce,
Ipike_value* data,
Ipike_value* msg,
Ip_u16 prf_alg)
{
Ipike_value tmp;
#ifdef IP_DEBUG
(void)ipike_print_memory(IPCOM_LOG_DEBUG2, "Id:\n", id->data.value, id->data.len);
(void)ipike_print_memory(IPCOM_LOG_DEBUG2, "Key:\n", key->value, key->len);
(void)ipike_print_memory(IPCOM_LOG_DEBUG2, "Nonce:\n", nonce->value, nonce->len);
#endif
(void)ipike_set_value(msg, data);
(void)ipike_append_value(msg, nonce);
tmp.len = 4;
tmp.value = ipcom_malloc(tmp.len);
if (tmp.value ==IP_NULL)
return IPIKE_FAILED;
ipcom_memset(tmp.value, 0, tmp.len);
tmp.value[0] = id->info.id_type;
ipcom_memcpy(tmp.value + 1, id->info.reserved, 3);
(void)ipike_append_value(&tmp, &id->data);
(void)ipike_crypto_compute_prf(prf_alg, key, &tmp, IP_NULL, IP_NULL, &tmp);
(void)ipike_append_value(msg, &tmp);
IPIKE_FREEP(tmp.value);
(void)ipike_print_memory(IPCOM_LOG_DEBUG2, "Message:\n", msg->value, msg->len);
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_payload_authentication_generate
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_authentication_generate(
Ip_u8 auth_method,
Ip_u16 prf_alg,
Ipike_config_auth* conf,
Ipike2_id* id,
Ipike_value* key,
Ipike_value* nonce,
Ipike_value* msg,
Ipike2_auth* auth)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike_value data = {0};
if (IPIKE_SUCCESS != (err = ipike_payload_authentication_generate_message(
id, key, nonce, msg, &data, prf_alg)))
return err;
msg = &data;
auth->method = auth_method;
ipcom_free(auth->data.value);
auth->data.value = IP_NULL;
auth->data.len = 0;
switch (auth->method)
{
case IPIKE2_AUTH_PRE_SHARED_KEY:
err = ipike_payload_authentication_generate_pre_shared(prf_alg,
conf,
msg,
&auth->data);
break;
case IPIKE2_AUTH_RSA_SIGNATURE:
err = ipike_payload_authentication_generate_rsa_signature(
conf,
msg,
&auth->data);
break;
case IPIKE2_AUTH_DSS_SIGNATURE:
err = ipike_payload_authentication_generate_dsa_signature(
conf,
msg,
&auth->data);
break;
default:
IPCOM_LOG1(ERR,
"ipike_payload_authentication_generate() :: Unsupported authentication method %d",
auth->method);
err = IPIKE_ISAKMP_AUTHENTICATION_FAILED;
break;
}
ipcom_free(data.value);
return err;
}
/*
*===========================================================================
* ipike_payload_authentication_generate_eap
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_authentication_generate_eap(
Ip_u8* shared_key,
Ip_u32 shared_key_len,
Ip_u16 prf_alg,
Ipike2_id* id,
Ipike_value* key,
Ipike_value* nonce,
Ipike_value* msg,
Ipike2_auth* auth)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike_value data;
if (shared_key == IP_NULL || shared_key_len == 0)
{
shared_key = key->value;
shared_key_len = (Ip_u32) key->len;
}
err = ipike_payload_authentication_generate_message(id, key, nonce,
msg, &data, prf_alg);
if (IPIKE_SUCCESS != err)
return err;
msg = &data;
auth->method = IPIKE2_AUTH_PRE_SHARED_KEY;
ipcom_free(auth->data.value);
auth->data.value = IP_NULL;
auth->data.len = 0;
err = ipike_crypto_compute_auth_pre_shared_secret(prf_alg,
shared_key,
shared_key_len,
msg,
&auth->data);
if (IPIKE_SUCCESS != err)
{
IPCOM_LOG0(ERR, "ipike_payload_authentication_generate_eap() ::"\
" failed to generate eap auth");
err = IPIKE_ISAKMP_AUTHENTICATION_FAILED;
}
IPIKE_FREEP(data.value);
return err;
}
/*
*===========================================================================
* ipike_payload_accept_authentication_method
*===========================================================================
*/
IP_STATIC Ip_bool
ipike_payload_accept_authentication_method(
const char* str_methods,
Ip_u8 method)
{
char* str = IP_NULL;
Ip_u8 n = 0xff;
while ((n != method) &&
(str_methods[0] != 0) &&
(ipike_parse_get_string(&str_methods, ',', &str) == IPIKE_SUCCESS))
{
if (IPIKE_SUCCESS != ipike_attribute_auth_method_from_string_v2(str, &n))
n = 0xff;
ipcom_free(str);
}
return (n == method);
}
/*
*===========================================================================
* ipike_payload_authentication_verify
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_authentication_verify(
Ip_u16 prf_alg,
Ipike_config_auth* conf,
Ipike2_id* id,
Ipike_value* key,
Ipike_value* nonce,
Ipike_value* msg,
Ipike_cert* cert,
Ipike2_auth* auth)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike_value data;
if (!ipike_payload_accept_authentication_method(conf->method, auth->method))
{
IPCOM_LOG0(ERR, "ipike_payload_authentication_verify() :: Authentication method not accepted");
return IPIKE_ISAKMP_AUTHENTICATION_FAILED;
}
if (IPIKE_SUCCESS != (err = ipike_payload_authentication_generate_message(
id, key, nonce, msg, &data, prf_alg)))
return err;
msg = &data;
switch (auth->method)
{
case IPIKE2_AUTH_PRE_SHARED_KEY:
err = ipike_payload_authentication_verify_pre_shared(prf_alg, conf, msg, &auth->data);
break;
case IPIKE2_AUTH_RSA_SIGNATURE:
err = ipike_payload_authentication_verify_rsa_signature(conf, msg, cert, &auth->data);
break;
case IPIKE2_AUTH_DSS_SIGNATURE:
err = ipike_payload_authentication_verify_dsa_signature(conf, msg, cert, &auth->data);
break;
default:
IPCOM_LOG1(ERR,
"ipike_payload_authentication_verify() :: Unsupported authentication method %d",
auth->method);
err = IPIKE_ISAKMP_AUTHENTICATION_FAILED;
break;
}
IPIKE_FREEP(data.value);
/* Free auth, so it may not be resued */
ipike_payload_authentication_free(auth);
return err;
}
/*
*===========================================================================
* ipike_payload_authentication_verify_eap
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_authentication_verify_eap(
Ip_u8* shared_key,
Ip_u32 shared_key_len,
Ip_u16 prf_alg,
Ipike2_id* id,
Ipike_value* key,
Ipike_value* nonce,
Ipike_value* msg,
Ipike2_auth* auth)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike2_auth auth2 = {0};
err = ipike_payload_authentication_generate_eap(shared_key,
shared_key_len,
prf_alg,
id,
key,
nonce,
msg,
&auth2);
if (err != IPIKE_SUCCESS)
{
IPCOM_LOG0(ERR, "ipike_payload_authentication_verify() :: Failed to generate AUTH payload");
err = IPIKE_ISAKMP_AUTHENTICATION_FAILED;
}
else
{
if ((auth->method != auth2.method) ||
(auth->data.len != auth2.data.len) ||
(memcmp(auth->data.value, auth2.data.value, auth->data.len) != 0))
{
IPCOM_LOG0(ERR, "ipike_payload_authentication_verify() :: Failed to verify AUTH payload");
err = IPIKE_ISAKMP_AUTHENTICATION_FAILED;
}
ipike_payload_authentication_free(&auth2);
}
/* Free auth, so it may not be resued */
ipike_payload_authentication_free(auth);
return err;
}
#else
int ipike_payload_authentication_empty_file = 0;
#endif /* IPIKE_USE_VERSION2 */
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike2_payload_authentication.h
+301
View File
@@ -0,0 +1,301 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike2_payload_authentication.h,v $ $Revision: 1.6 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike2_payload_authentication.h,v $
* $Author: edahlber $ $Date: 2010-04-23 15:31:40 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#if !defined(IPIKE2_PAYLOAD_AUTHENTICATION_H) && defined(IPIKE_USE_VERSION2)
#define IPIKE2_PAYLOAD_AUTHENTICATION_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Authentication payload (IKE version 2) */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_payload.h"
#include "ipike_payload_certificate.h"
#include "ipike2_payload_identification.h"
#include "ipike2_payload_sa.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
#define IPIKE2_AUTH_RSA_SIGNATURE 1
#define IPIKE2_AUTH_PRE_SHARED_KEY 2
#define IPIKE2_AUTH_DSS_SIGNATURE 3
#define IPIKE2_AUTH_EAP 4
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
Authentication Payload Format
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Next Payload !C! RESERVED ! Payload Length !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Auth Method ! RESERVED ! !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! !
~ Authentication Data ~
! !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
*/
typedef struct Ipike2_auth_payload_struct
{
/* The generic ISAKMP payload header, the length includes the length
of all transforms associated with the proposal */
Ipike_payload_header header;
/* Authentication method */
Ip_u8 method;
/* Reserved */
Ip_u8 reserved;
Ip_u16 reserved2;
/* Authentication data follows */
}
Ipike2_auth_payload;
typedef struct Ipike2_auth_struct
{
/* Authentication method */
Ip_u8 method;
/* Authentication data */
Ipike_value data;
}
Ipike2_auth;
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_payload_authentication_create
*===========================================================================
* Description: Creates a new authentication payload from the information
* created in the exchange.
* Parameters: auth - The authentication struct to encode to payload.
* payload - Will point to a new authentication payload if the
* call was successful.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_authentication_create(
Ipike2_auth* auth,
Ipike2_auth_payload** payload);
/*
*===========================================================================
* ipike_payload_authentication_free
*===========================================================================
* Description: Free all the values associated with the authentication
* structure created in the exchange.
* Parameters: auth - The authentication struct to free.
* Returns:
*/
IP_GLOBAL void
ipike_payload_authentication_free(Ipike2_auth* auth);
/*
*===========================================================================
* ipike_payload_authentication_check
*===========================================================================
* Description: Verifies that the authentication payload is sane.
* Parameters: auth - a pointer to a authentication payload.
* Returns: IPIKE_SUCCESS
*/
IP_GLOBAL Ipike_error
ipike_payload_authentication_check(Ipike2_auth_payload* auth);
/*
*===========================================================================
* ipike_payload_authentication_print
*===========================================================================
* Description: Prints the content of the authentication payload to the
* system log.
* Parameters: auth - a pointer to a authentication payload.
* Returns:
*/
IP_GLOBAL void
ipike_payload_authentication_print(Ipike2_auth_payload* auth);
/*
*===========================================================================
* ipike_payload_authentication_extract
*===========================================================================
* Description: Extracts the authentication data from the payload.
* Parameters: payload - a authentication payload.
* auth - will be updated with the authentication data if the
* call was successful.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_authentication_extract(
Ipike2_auth_payload* payload,
Ipike2_auth* auth);
/*
*===========================================================================
* ipike_payload_authentication_generate
*===========================================================================
* Description: Generates a new authentication data from the information
* created in the exchange.
* Parameters: auth_method - The used authentication method.
* prf_alg - The used prf algorithm (or 0 if not used).
* conf - The configuration structure.
* id - The id of the authenticator
* key - The key that may be used to generate the authentication
* data.
* msg - The first message, may be used to generate the data.
* auth - The generated authentication data
* call was successful.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
* IPIKE_SA_AUTHENTICATION_ALGORITHM_NOT_SUPPORTED
*/
IP_GLOBAL Ipike_error
ipike_payload_authentication_generate(
Ip_u8 auth_method,
Ip_u16 prf_alg,
Ipike_config_auth* conf,
Ipike2_id* id,
Ipike_value* key,
Ipike_value* nonce,
Ipike_value* msg,
Ipike2_auth* auth);
/*
*===========================================================================
* ipike_payload_authentication_generate_eap
*===========================================================================
* Description: Generates a new authentication data from EAP exchange key.
* Parameters: shared_key - Buffer with key froam EAP exchange.
* shared_key_len - Length of shared key buffer.
* prf_alg - The used prf algorithm (or 0 if not used).
* id - The id of the authenticator
* key - The key that may be used to generate the authentication
* data.
* msg - The first message, may be used to generate the data.
* auth - The generated authentication data
* call was successful.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
* IPIKE_SA_AUTHENTICATION_ALGORITHM_NOT_SUPPORTED
*/
IP_GLOBAL Ipike_error
ipike_payload_authentication_generate_eap(
Ip_u8* shared_key,
Ip_u32 shared_key_len,
Ip_u16 prf_alg,
Ipike2_id* id,
Ipike_value* key,
Ipike_value* nonce,
Ipike_value* msg,
Ipike2_auth* auth);
/*
*===========================================================================
* ipike_payload_authentication_verify
*===========================================================================
* Description: Verify authentication data generated by the function above.
* Parameters: prf_alg - The prf algorithm used (or 0 if not used).
* conf - The configuration structure.
* id - The id of the authenticator
* key - The key that may be used to generate the authentication
* data.
* msg - The first message, may be used to generate the data.
* cert - The certificate that should be used to verify the
* message in case RSA/DSA signature.
* auth - The authentication data.
* Returns: IPIKE_SUCCESS
* IPIKE_ISAKMP_AUTHENTICATION_FAILED
*/
IP_GLOBAL Ipike_error
ipike_payload_authentication_verify(
Ip_u16 prf_alg,
Ipike_config_auth* conf,
Ipike2_id* id,
Ipike_value* key,
Ipike_value* nonce,
Ipike_value* msg,
Ipike_cert* cert,
Ipike2_auth* auth);
/*
*===========================================================================
* ipike_payload_authentication_verify_eap
*===========================================================================
* Description: Verify EAP authentication data generated by the function above.
* Parameters: shared_key - Buffer with key froam EAP exchange.
* shared_key_len - Length of shared key buffer.
* prf_alg - The prf algorithm used (or 0 if not used).
* id - The id of the authenticator
* key - The key that may be used to generate the authentication
* data.
* msg - The first message, may be used to generate the data.
* auth - The authentication data.
* Returns: IPIKE_SUCCESS
* IPIKE_ISAKMP_AUTHENTICATION_FAILED
*/
IP_GLOBAL Ipike_error
ipike_payload_authentication_verify_eap(
Ip_u8* shared_key,
Ip_u32 shared_key_len,
Ip_u16 prf_alg,
Ipike2_id* id,
Ipike_value* key,
Ipike_value* nonce,
Ipike_value* msg,
Ipike2_auth* auth);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike2_payload_configuration.c
+962
View File
@@ -0,0 +1,962 @@
/*
******************************************************************************
* SOURCE FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike2_payload_configuration.c,v $ $Revision: 1.22.10.6 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike2_payload_configuration.c,v $
* $Author: svc-cmnet $ $Date: 2013-03-13 07:45:26 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Configuration payload (IKE version 2), will also be used as attributes
payload (draft-ietf-ipsec-isakmp-mode-cfg-05.txt) */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_h.h"
#include "ipike_attributes.h"
#include "ipike2_payload_configuration.h"
#include "ipike_util.h"
#include "ipike_sadb.h"
#include "ipike_dynamic_ip.h"
#include <ipcom_clib.h>
#include <ipcom_syslog.h>
/*
****************************************************************************
* 4 EXTERN PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 5 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 6 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 7 LOCAL PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 8 DATA
****************************************************************************
*/
/*
****************************************************************************
* 9 LOCAL FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_payload_configuration_data
*===========================================================================
* Description: Returns a pointer to the configuration data in the payload.
* Parameters: cp - a configuration payload.
* Returns: A pointer to the configuration data.
*/
IP_STATIC Ip_u8*
ipike_payload_configuration_data(Ipike2_cp_payload* cp)
{
return (Ip_u8*)cp + sizeof(Ipike2_cp_payload);
}
/*
*===========================================================================
* ipike_payload_configuration_data_length
*===========================================================================
* Description: Returns the length of the configuration data.
* Parameters: cp - configuration payload.
* Returns: The length of the configuration data (in bytes).
*/
IP_STATIC Ip_u16
ipike_payload_configuration_data_length(Ipike2_cp_payload* cp)
{
return IPIKE_PAYLOAD_DATA_LENGTH(cp->header.length, sizeof(Ipike2_cp_payload));
}
/*
*===========================================================================
* ipike_attribute_cp_type_to_string
*===========================================================================
* Description: Returns a string representation of the configuration type.
* Parameters: type - configuration type.
* Returns: A string.
*/
IP_STATIC const char*
ipike_attribute_cp_type_to_string(Ip_u8 type)
{
const char* s;
if ((ipike_map_string(ipike.cp_type_map, type, &s)))
return "Invalid configuration type";
return s;
}
/*
*===========================================================================
* ipike_attribute_cp_attr_to_string
*===========================================================================
* Description: Returns a string representation of the configuration
* attribute.
* Parameters: type - configuration attribute.
* Returns: A string.
*/
IP_STATIC const char*
ipike_attribute_cp_attr_to_string(Ip_u16 type)
{
const char* s;
if ((ipike_map_string(ipike.cp_attr_map, type, &s)))
return "Invalid configuration attribute";
return s;
}
/*
*===========================================================================
* ipike_payload_configuration_get_dhcp_info
*===========================================================================
* Description: Get dhcp information.
* Parameters: ie - the exchange.
* Returns:
*/
IP_STATIC Ipike_error
ipike_payload_configuration_get_dhcp_info(Ipike_isakmp_exchange* ie, Ip_bool v4)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike_value id = {0};
if (!ie->ike_sa->dhcp.has_info)
{
#ifdef IPIKE_USE_VERSION1
if (ie->ike_sa->idii.id_data.len != 0)
id = ie->ike_sa->idii.id_data;
#endif
#ifdef IPIKE_USE_VERSION2
if (ie->ike_sa->v2.id_i.data.len != 0)
id = ie->ike_sa->v2.id_i.data;
#endif
err = ipike_get_interface_addresses(v4,
&id,
ie->ike_sa->dhcp.counter,
&ie->ike_sa->dhcp.address,
&ie->ike_sa->dhcp.netmask,
&ie->ike_sa->dhcp.dns,
&ie->ike_sa->dhcp.nbns);
if (IPIKE_SUCCESS == err)
ie->ike_sa->dhcp.has_info = IP_TRUE;
}
return err;
}
/*
*===========================================================================
* ipike_payload_configuration_set_dhcp_info
*===========================================================================
* Description: Set dhcp information.
* Parameters: ie - the exchange.
* Returns:
*/
IP_STATIC Ipike_error
ipike_payload_configuration_set_dhcp_info(Ipike_isakmp_exchange* ie)
{
Ipike_error err = IPIKE_SUCCESS;
char** vec = IP_NULL;
if (ie->ike_sa->dhcp.has_info)
{
if (IP_NULL == (vec = ipike_strvec(ie->ipsec_conf->dynamic_address, ", ")))
return IPIKE_CONF_INVALID_VALUE;
err = ipike_update_interface_addresses(ie->ipsec_conf->ipsec_id,
vec[0],
&ie->ike_sa->dhcp.address,
&ie->ike_sa->dhcp.netmask,
ie->ike_sa->dhcp.dns,
ie->ike_sa->dhcp.nbns);
ipike_array_free((void**)vec, ipcom_free);
}
return err;
}
/*
*===========================================================================
* ipike_payload_configuration_set_app_version
*===========================================================================
* Description: Set application version for the configuration structure.
* Parameters: ie - the exchange
* Returns:
*/
IP_STATIC Ipike_error
ipike_payload_configuration_set_app_version(Ipike_isakmp_exchange* ie)
{
static char info[32] = {0};
#ifdef IP_DEBUG
if (info[0] == 0)
ipcom_sprintf(info, "IPIKE %s", ipike_version_number());
#endif
(void)ipike_payload_configuration_set(
&ie->ike_sa->cp_response,
IPIKE_CFG_ATTR_APPLICATION_VERSION,
(Ip_u8*)info,
(Ip_u16)ipcom_strlen(info));
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_payload_configuration_process_app_version
*===========================================================================
* Description: Process application version for the configuration structure.
* Parameters: ie - the exchange
* Returns:
*/
IP_STATIC Ipike_error
ipike_payload_configuration_process_app_version(Ip_u8* data, Ip_size_t length)
{
char* str = IP_NULL;
if (length > 0)
{
str = ipcom_malloc(length+1);
if (str != IP_NULL)
{
ipcom_memcpy((void*)str, (void*)data, length);
str[length] = 0;
IPCOM_LOG1(INFO, "Peer application: '%s'", str);
ipcom_free(str);
}
}
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_payload_configuration_set_address
*===========================================================================
* Description: Set address for the configuration structure.
* Parameters: ie - the exchange
* Returns:
*/
IP_STATIC Ipike_error
ipike_payload_configuration_set_address(Ipike_isakmp_exchange* ie, Ip_bool v4)
{
Ipike_error err = IPIKE_SUCCESS;
Ip_u16 type = 0;
ipike_array_free((void **)ie->ike_sa->dhcp.dns, ipcom_free);
ipike_array_free((void **)ie->ike_sa->dhcp.nbns, ipcom_free);
ipcom_memset(&ie->ike_sa->dhcp, 0, sizeof(ie->ike_sa->dhcp));
if (v4)
type = IPIKE_CFG_ATTR_INTERNAL_IP4_ADDRESS;
else
type = IPIKE_CFG_ATTR_INTERNAL_IP6_ADDRESS;
err = ipike_payload_configuration_get_dhcp_info(ie, v4);
if ( err != IPIKE_SUCCESS )
return err;
if ( ie->ike_sa->dhcp.address.sa.sa_family != 0 )
{
err = ipike_payload_configuration_set(&ie->ike_sa->cp_response,
type,
ipike_addr_get_ptr(&ie->ike_sa->dhcp.address),
ipike_addr_get_len(&ie->ike_sa->dhcp.address));
}
if (IPIKE_SUCCESS == err)
ie->ike_sa->dhcp.counter++;
return err;
}
/*
*===========================================================================
* ipike_payload_configuration_set_netmask
*===========================================================================
* Description: Set netmask for the configuration structure.
* Parameters: ie - the exchange
* Returns:
*/
IP_STATIC Ipike_error
ipike_payload_configuration_set_netmask(Ipike_isakmp_exchange* ie, Ip_bool v4)
{
Ipike_error err = IPIKE_SUCCESS;
Ip_u16 type = 0;
if (v4)
type = IPIKE_CFG_ATTR_INTERNAL_IP4_NETMASK;
else
type = IPIKE_CFG_ATTR_INTERNAL_IP6_NETMASK;
err = ipike_payload_configuration_get_dhcp_info(ie, v4);
if ((IPIKE_SUCCESS == err) && (ie->ike_sa->dhcp.netmask.sa.sa_family != 0))
err = ipike_payload_configuration_set(
&ie->ike_sa->cp_response,
type,
ipike_addr_get_ptr(&ie->ike_sa->dhcp.netmask),
ipike_addr_get_len(&ie->ike_sa->dhcp.netmask));
return err;
}
/*
*===========================================================================
* ipike_payload_configuration_set_subnet
*===========================================================================
* Description: Set netmask for the configuration structure.
* Parameters: ie - the exchange
* Returns:
*/
IP_STATIC Ipike_error
ipike_payload_configuration_set_subnet(Ipike_isakmp_exchange* ie, Ip_bool v4)
{
Ipike_error err = IPIKE_SUCCESS;
Ip_u16 type = 0;
if (v4)
type = IPIKE_CFG_ATTR_INTERNAL_IP4_SUBNET;
else
type = IPIKE_CFG_ATTR_INTERNAL_IP6_SUBNET;
err = ipike_payload_configuration_get_dhcp_info(ie, v4);
if ((IPIKE_SUCCESS == err) && (ie->ike_sa->dhcp.subnet.sa.sa_family != 0))
err = ipike_payload_configuration_set(
&ie->ike_sa->cp_response,
type,
ipike_addr_get_ptr(&ie->ike_sa->dhcp.subnet),
ipike_addr_get_len(&ie->ike_sa->dhcp.subnet));
return err;
}
/*
*===========================================================================
* ipike_payload_configuration_set_dns
*===========================================================================
* Description: Set dns for the configuration structure.
* Parameters: ie - the exchange
* Returns:
*/
IP_STATIC Ipike_error
ipike_payload_configuration_set_dns(Ipike_isakmp_exchange* ie, Ip_bool v4)
{
Ipike_error err = IPIKE_SUCCESS;
Ip_u16 type = 0;
Ip_u32 i = 0;
if (v4)
type = IPIKE_CFG_ATTR_INTERNAL_IP4_DNS;
else
type = IPIKE_CFG_ATTR_INTERNAL_IP6_DNS;
err = ipike_payload_configuration_get_dhcp_info(ie, v4);
if ((IPIKE_SUCCESS == err) && (IP_NULL != ie->ike_sa->dhcp.dns))
{
while ((IPIKE_SUCCESS == err) && (IP_NULL != ie->ike_sa->dhcp.dns[i]))
{
err = ipike_payload_configuration_set(
&ie->ike_sa->cp_response,
type,
ipike_addr_get_ptr(ie->ike_sa->dhcp.dns[i]),
ipike_addr_get_len(ie->ike_sa->dhcp.dns[i]));
i++;
}
}
return err;
}
/*
*===========================================================================
* ipike_payload_configuration_set_nbns
*===========================================================================
* Description: Set nbns for the configuration structure.
* Parameters: ie - the exchange
* Returns:
*/
IP_STATIC Ipike_error
ipike_payload_configuration_set_nbns(Ipike_isakmp_exchange* ie, Ip_bool v4)
{
Ipike_error err = IPIKE_SUCCESS;
Ip_u16 type = 0;
Ip_u32 i = 0;
if (v4)
type = IPIKE_CFG_ATTR_INTERNAL_IP4_NBNS;
else
type = IPIKE_CFG_ATTR_INTERNAL_IP6_NBNS;
err = ipike_payload_configuration_get_dhcp_info(ie, v4);
if ((IPIKE_SUCCESS == err) && (IP_NULL != ie->ike_sa->dhcp.nbns))
{
while ((IPIKE_SUCCESS == err) && (IP_NULL != ie->ike_sa->dhcp.nbns[i]))
{
err = ipike_payload_configuration_set(
&ie->ike_sa->cp_response,
type,
ipike_addr_get_ptr(ie->ike_sa->dhcp.nbns[i]),
ipike_addr_get_len(ie->ike_sa->dhcp.nbns[i]));
i++;
}
}
return err;
}
/*
*===========================================================================
* ipike_payload_configuration_process_request
*===========================================================================
*/
IP_STATIC Ipike_error
ipike_payload_configuration_process_request(
Ipike_isakmp_exchange* ie,
Ipike2_cp* cp)
{
Ipike_error err = IPIKE_SUCCESS;
int i = 0;
ipike_payload_configuration_free(&ie->ike_sa->cp_response);
while (cp->values[i] != IP_NULL)
{
switch (ip_ntohs(cp->values[i]->type))
{
case IPIKE_CFG_ATTR_APPLICATION_VERSION:
err = ipike_payload_configuration_set_app_version(ie);
break;
case IPIKE_CFG_ATTR_INTERNAL_IP4_ADDRESS:
err = ipike_payload_configuration_set_address(ie, IP_TRUE);
break;
case IPIKE_CFG_ATTR_INTERNAL_IP6_ADDRESS:
err = ipike_payload_configuration_set_address(ie, IP_FALSE);
break;
case IPIKE_CFG_ATTR_INTERNAL_IP4_NETMASK:
err = ipike_payload_configuration_set_netmask(ie, IP_TRUE);
break;
case IPIKE_CFG_ATTR_INTERNAL_IP6_NETMASK:
err = ipike_payload_configuration_set_netmask(ie, IP_FALSE);
break;
case IPIKE_CFG_ATTR_INTERNAL_IP4_SUBNET:
err = ipike_payload_configuration_set_subnet(ie, IP_TRUE);
break;
case IPIKE_CFG_ATTR_INTERNAL_IP6_SUBNET:
err = ipike_payload_configuration_set_subnet(ie, IP_FALSE);
break;
case IPIKE_CFG_ATTR_INTERNAL_IP4_DNS:
err = ipike_payload_configuration_set_dns(ie, IP_TRUE);
break;
case IPIKE_CFG_ATTR_INTERNAL_IP6_DNS:
err = ipike_payload_configuration_set_dns(ie, IP_FALSE);
break;
case IPIKE_CFG_ATTR_INTERNAL_IP4_NBNS:
err = ipike_payload_configuration_set_nbns(ie, IP_TRUE);
break;
case IPIKE_CFG_ATTR_INTERNAL_IP6_NBNS:
err = ipike_payload_configuration_set_nbns(ie, IP_FALSE);
break;
case IPIKE_CFG_ATTR_INTERNAL_ADDRESS_EXPIRY:
/* Ignoring the payload, should only be present in responses,
* it has been removed in IKEv2 RFC5996 */
break;
default:
IPCOM_LOG1(DEBUG, "ipike_payload_configuration_process() ::"\
" unsupported attribute (%u)",
ip_ntohs(cp->values[i]->type));
/* Just ignore unsupported attriubutes */
break;
}
i++;
}
ie->ike_sa->cp_response.info.type = IPIKE_CFG_RESPONSE;
return err;
}
/*
*===========================================================================
* ipike_payload_configuration_process_response
*===========================================================================
*/
IP_STATIC Ipike_error
ipike_payload_configuration_process_response(
Ipike_isakmp_exchange* ie,
Ipike2_cp* cp)
{
Ip_u8* data = IP_NULL;
Ip_u32 len = 0;
Ipike_error err = IPIKE_SUCCESS;
int i = 0;
while (cp->values[i] && err == IPIKE_SUCCESS)
{
data = ((Ip_u8*)cp->values[i]) + sizeof(*cp->values[i]);
len = ip_ntohs(cp->values[i]->value);
switch (ip_ntohs(cp->values[i]->type))
{
case IPIKE_CFG_ATTR_APPLICATION_VERSION:
err = ipike_payload_configuration_process_app_version(data, len);
break;
case IPIKE_CFG_ATTR_INTERNAL_IP4_ADDRESS:
case IPIKE_CFG_ATTR_INTERNAL_IP6_ADDRESS:
err = ipike_addr_set_from_data(data, len, &ie->ike_sa->dhcp.address);
if (err == IPIKE_SUCCESS)
ie->ike_sa->dhcp.has_info = IP_TRUE;
break;
case IPIKE_CFG_ATTR_INTERNAL_IP4_NETMASK:
case IPIKE_CFG_ATTR_INTERNAL_IP6_NETMASK:
err = ipike_addr_set_from_data(data, len, &ie->ike_sa->dhcp.netmask);
break;
case IPIKE_CFG_ATTR_INTERNAL_IP4_SUBNET:
case IPIKE_CFG_ATTR_INTERNAL_IP6_SUBNET:
err = ipike_addr_set_from_data(data, len, &ie->ike_sa->dhcp.subnet);
break;
case IPIKE_CFG_ATTR_INTERNAL_IP4_DNS:
case IPIKE_CFG_ATTR_INTERNAL_IP6_DNS:
err = ipike_addr_append_from_data(data, len, &ie->ike_sa->dhcp.dns);
break;
case IPIKE_CFG_ATTR_INTERNAL_IP4_NBNS:
case IPIKE_CFG_ATTR_INTERNAL_IP6_NBNS:
err = ipike_addr_append_from_data(data, len, &ie->ike_sa->dhcp.nbns);
break;
case IPIKE_CFG_ATTR_INTERNAL_ADDRESS_EXPIRY:
/* Ignoring payload, this has been removed in RFC5996 */
break;
default:
break;
}
i++;
}
if (IPIKE_SUCCESS == err)
if (ie->ike_sa->dhcp.has_info)
err = ipike_payload_configuration_set_dhcp_info(ie);
return err;
}
/*
****************************************************************************
* 10 PUBLIC FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_payload_configuration_create
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_configuration_create(
Ipike2_cp* cp,
Ipike2_cp_payload** payload)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike2_cp_payload* cp_payload = IP_NULL;
Ip_ssize_t size = 0;
Ipike_attribute* attr = IP_NULL;
Ip_u16 i = 0;
Ip_u8* data = IP_NULL;
Ip_u16 length = 0;
*payload = IP_NULL;
if (cp->values != IP_NULL)
{
size = (Ip_ssize_t)ipike_attribute_array_size(cp->values);
data = (Ip_u8*)ipcom_malloc((Ip_size_t)size + sizeof(Ipike2_cp_payload));
if (data == IP_NULL)
{
IP_PANIC();
err = IPIKE_OUT_OF_MEMORY;
}
else
{
cp_payload = (Ipike2_cp_payload*)data;
*payload = cp_payload;
data += sizeof(Ipike2_cp_payload);
/* Set payload info */
cp_payload->header.next_payload = IPIKE2_PAYLOAD_CONFIGURATION;
cp_payload->header.flags = 0;
cp_payload->header.length = ip_htons((Ip_size_t)size + sizeof(Ipike2_cp_payload));
cp_payload->type = cp->info.type;
cp_payload->reserved = 0;
cp_payload->reserved2 = 0;
/* Add attributes */
while (size > 0 && cp->values[i] != IP_NULL)
{
attr = (Ipike_attribute*)data;
attr->type = cp->values[i]->type;
attr->value = cp->values[i]->value;
length = ip_ntohs(attr->value);
data += sizeof(*attr);
size -= (Ip_ssize_t) sizeof(*attr);
if (size >= 0 && size >= length)
{
ipcom_memcpy(data, ((Ip_u8*)cp->values[i])+sizeof(*attr), length);
data += length;
size -= length;
}
else
{
IPCOM_LOG1(ERR, "ipike_payload_configuration_create() ::"\
" bad attribute value for %s",
ipike_attribute_cp_attr_to_string(attr->type));
err = IPIKE_ATTRIBUTE_INVALID_VALUE;
break;
}
i++;
}
}
}
ipike_payload_configuration_free(cp);
return err;
}
/*
*===========================================================================
* ipike_payload_configuration_free
*===========================================================================
*/
IP_GLOBAL void
ipike_payload_configuration_free(Ipike2_cp* cp)
{
Ip_u32 i = 0;
if (cp->values != IP_NULL)
{
for (i=0; cp->values[i] != IP_NULL; i++)
ipcom_free(cp->values[i]);
ipcom_free(cp->values);
}
ipcom_memset(cp, 0, sizeof(*cp));
return;
}
/*
*===========================================================================
* ipike_payload_configuration_check
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_configuration_check(Ipike2_cp_payload* cp)
{
switch (cp->type)
{
case IPIKE_CFG_REQUEST:
case IPIKE_CFG_RESPONSE:
case IPIKE_CFG_SET:
case IPIKE_CFG_ACK:
break;
default:
IPCOM_LOG1(DEBUG2, "ipike_payload_configuration_check: Unsupported type %d",
cp->type);
return IPIKE_ISAKMP_INVALID_SYNTAX;
}
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_payload_configuration_extract
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_configuration_extract(
Ipike2_cp_payload* payload,
Ipike2_cp* cp)
{
Ipike_error err = IPIKE_SUCCESS;
Ip_u8* data = 0;
Ip_size_t length = 0;
ipike_payload_configuration_free(cp);
cp->info.header.next_payload = 0;
cp->info.header.flags = payload->header.flags;
cp->info.header.length = ip_ntohs(payload->header.length);
cp->info.type = payload->type;
data = ipike_payload_configuration_data(payload);
length = ipike_payload_configuration_data_length(payload);
cp->values = ipike_attributes_extract(data, length);
if ( cp->values == IP_NULL)
{
IPCOM_LOG0(ERR, "ipike_payload_configuration_extract() ::"\
" failed to extract all attributes");
err = IPIKE_ATTRIBUTE_INVALID_VALUE;
}
return err;
}
/*
*===========================================================================
* ipike_payload_configuration_process
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_configuration_process(
Ipike_isakmp_exchange* ie,
Ipike2_cp_payload* payload)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike2_cp cp;
ipcom_memset(&cp, 0, sizeof(cp));
err = ipike_payload_configuration_extract(payload, &cp);
if ( IPIKE_SUCCESS != err )
{
IPCOM_LOG0(ERR, "ipike_payload_configuration_process() ::"\
" failed to extract");
return err;
}
switch (cp.info.type)
{
case IPIKE_CFG_REQUEST:
err = ipike_payload_configuration_process_request(ie, &cp);
break;
case IPIKE_CFG_RESPONSE:
err = ipike_payload_configuration_process_response(ie, &cp);
break;
default:
IPCOM_LOG1(ERR, "ipike_payload_configuration_process() ::"\
" unknown type %u", cp.info.type);
break;
}
ipike_payload_configuration_free(&cp);
return err;
}
/*
*===========================================================================
* ipike_payload_configuration_print
*===========================================================================
*/
IP_GLOBAL void
ipike_payload_configuration_print(Ipike2_cp_payload* cp)
{
const char* str = IP_NULL;
Ipike_attribute* attr = IP_NULL;
Ip_ssize_t size = 0;
/* lint */
(void)str;
/* Print type */
str = ipike_attribute_cp_type_to_string(cp->type);
IPCOM_LOG1(DEBUG2, " type: '%s'", str);
/* Print all attributes */
attr = (Ipike_attribute*)ipike_payload_configuration_data(cp);
size = (Ip_ssize_t)ipike_payload_configuration_data_length(cp);
while (attr != IP_NULL)
{
str = ipike_attribute_cp_attr_to_string(ip_ntohs(attr->type));
IPCOM_LOG2(DEBUG2, " attribute: '%s' (%u)", str, ip_ntohs(attr->type));
if (!IPIKE_ATTR_AF(ip_ntohs(attr->type)))
{
(void)ipike_print_memory(IPCOM_LOG_DEBUG2, " data: ",
((Ip_u8*)attr)+sizeof(*attr),
ip_ntohs(attr->value));
}
attr = ipike_next_attribute(attr, &size);
}
return;
}
/*
*===========================================================================
* ipike_payload_configuration_set
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_configuration_set(
Ipike2_cp* cp,
Ip_u16 type,
Ip_u8* data,
Ip_size_t length)
{
Ipike_error err = IPIKE_SUCCESS;
Ip_u32 count = 0;
Ip_u8* buf = IP_NULL;
cp->info.type = IPIKE_CFG_REQUEST;
if (cp->values != IP_NULL)
while (cp->values[count] != IP_NULL)
count++;
count += 2;
cp->values = ipcom_realloc(cp->values, sizeof(*cp->values) * count);
if (cp->values == IP_NULL)
{
IP_PANIC();
err = IPIKE_OUT_OF_MEMORY;
}
else
{
count--;
cp->values[count] = IP_NULL;
count--;
cp->values[count] = ipcom_malloc(sizeof(Ipike_attribute) + length);
if (cp->values[count] == IP_NULL)
{
IP_PANIC();
err = IPIKE_OUT_OF_MEMORY;
}
else
{
cp->values[count]->type = ip_htons(type);
cp->values[count]->value = ip_htons((Ip_u16)length);
buf = ((Ip_u8*)cp->values[count])+sizeof(Ipike_attribute);
if (data == IP_NULL)
ipcom_memset(buf, 0, length);
else
ipcom_memcpy(buf, data, length);
}
}
return err;
}
/*
*===========================================================================
* ipike_payload_configuration_request_address
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_configuration_request_address(
Ipike2_cp* cp,
const char* type,
union Ip_sockaddr_union* address)
{
Ipike_error err = IPIKE_SUCCESS;
Ip_u8 * addr_ptr = IP_NULL;
Ip_size_t addr_len = 0;
if ( address != IP_NULL )
{
addr_ptr = ipike_addr_get_ptr(address);
addr_len = ipike_addr_get_len(address);
}
if ( type == IP_NULL )
return IPIKE_SUCCESS;
if (ipcom_strstr(type, "ip4") != IP_NULL)
{
err = ipike_payload_configuration_set(cp,
IPIKE_CFG_ATTR_INTERNAL_IP4_ADDRESS,
addr_ptr,
addr_len);
if ( err != IPIKE_SUCCESS )
goto errout;
err = ipike_payload_configuration_set(cp,
IPIKE_CFG_ATTR_INTERNAL_IP4_NETMASK,
IP_NULL,
0);
if ( err != IPIKE_SUCCESS )
goto errout;
err = ipike_payload_configuration_set(cp,
IPIKE_CFG_ATTR_INTERNAL_IP4_DNS,
IP_NULL,
0);
}
else if (ipcom_strstr(type, "ip6") != IP_NULL)
{
err = ipike_payload_configuration_set(cp,
IPIKE_CFG_ATTR_INTERNAL_IP6_ADDRESS,
addr_ptr,
addr_len);
if ( err != IPIKE_SUCCESS )
goto errout;
err = ipike_payload_configuration_set(cp,
IPIKE_CFG_ATTR_INTERNAL_IP6_NETMASK,
IP_NULL,
0);
if ( err != IPIKE_SUCCESS )
goto errout;
err = ipike_payload_configuration_set(cp,
IPIKE_CFG_ATTR_INTERNAL_IP6_DNS,
IP_NULL,
0);
}
else
{
IPCOM_LOG0(DEBUG, "ipike_payload_configuration_request_address() ::"\
" bad IP type (neither ip6 or ip4)");
err = IPIKE_CONF_INVALID_VALUE;
}
errout:
if ( err != IPIKE_SUCCESS )
{
IPCOM_LOG0(DEBUG, "ipike_payload_configuration_request_address()"\
" :: failed to set info");
}
return err;
}
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike2_payload_configuration.h
+254
View File
@@ -0,0 +1,254 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike2_payload_configuration.h,v $ $Revision: 1.6.16.1 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike2_payload_configuration.h,v $
* $Author: svc-cmnet $ $Date: 2013-03-13 07:45:26 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#if !defined(IPIKE2_PAYLOAD_CONFIGURATION_H)
#define IPIKE2_PAYLOAD_CONFIGURATION_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Configuration payload (IKE version 2) */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_payload.h"
#include "ipike_attributes.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
#define IPIKE_CFG_REQUEST 1
#define IPIKE_CFG_RESPONSE 2
#define IPIKE_CFG_SET 3
#define IPIKE_CFG_ACK 4
#define IPIKE_CFG_ATTR_INTERNAL_IP4_ADDRESS 1 /* 0 or 4 octets */
#define IPIKE_CFG_ATTR_INTERNAL_IP4_NETMASK 2 /* 0 or 4 octets */
#define IPIKE_CFG_ATTR_INTERNAL_IP4_DNS 3 /* 0 or 4 octets */
#define IPIKE_CFG_ATTR_INTERNAL_IP4_NBNS 4 /* 0 or 4 octets */
#define IPIKE_CFG_ATTR_INTERNAL_ADDRESS_EXPIRY 5 /* 0 or 4 octets */
#define IPIKE_CFG_ATTR_INTERNAL_IP4_DHCP 6 /* 0 or 4 octets */
#define IPIKE_CFG_ATTR_APPLICATION_VERSION 7 /* 0 or more */
#define IPIKE_CFG_ATTR_INTERNAL_IP6_ADDRESS 8 /* 0 or 17 octets */
#define IPIKE_CFG_ATTR_INTERNAL_IP6_NETMASK 9 /* 0 or 16 octets (only draft) */
#define IPIKE_CFG_ATTR_INTERNAL_IP6_DNS 10 /* 0 or 16 octets */
#define IPIKE_CFG_ATTR_INTERNAL_IP6_NBNS 11 /* 0 or 16 octets */
#define IPIKE_CFG_ATTR_INTERNAL_IP6_DHCP 12 /* 0 or 16 octets */
#define IPIKE_CFG_ATTR_INTERNAL_IP4_SUBNET 13 /* 0 or 8 octets */
#define IPIKE_CFG_ATTR_SUPPORTED_ATTRIBUTES 14 /* Multiple of 2 */
#define IPIKE_CFG_ATTR_INTERNAL_IP6_SUBNET 15 /* 17 octets */
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
Configuration Payload Format
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Next Payload ! RESERVED ! Payload Length !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! CFG Type ! RESERVED ! !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! !
~ Configuration Attributes ~
! !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
*/
typedef struct Ipike2_cp_payload_struct
{
/* The generic ISAKMP payload header, the length includes the length
of all transforms associated with the proposal */
Ipike_payload_header header;
/* Configuration type */
Ip_u8 type;
/* Reserved */
Ip_u8 reserved;
Ip_u16 reserved2;
/* Configuration attributes follows */
}
Ipike2_cp_payload;
typedef struct Ipike2_cp_struct
{
/* Configuration info */
Ipike2_cp_payload info;
/* Configuration attribute values */
Ipike_attribute** values;
}
Ipike2_cp;
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_payload_configuration_create
*===========================================================================
* Description: Creates a new configuration payload from the information
* created in the exchange.
* Parameters: cp - The configuration struct to encode to payload.
* payload - Will point to a new configuration payload if the
* call was successful.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_configuration_create(
Ipike2_cp* cp,
Ipike2_cp_payload** payload);
/*
*===========================================================================
* ipike_payload_configuration_free
*===========================================================================
* Description: Frees all resource allocated by the CP structure.
* Parameters: sa - The CP structure to free.
* Returns:
*
*/
IP_GLOBAL void
ipike_payload_configuration_free(Ipike2_cp* cp);
/*
*===========================================================================
* ipike_payload_configuration_check
*===========================================================================
* Description: Verifies that the configuration payload is sane.
* Parameters: cp - a pointer to a configuration payload.
* Returns: IPIKE_SUCCESS
*/
IP_GLOBAL Ipike_error
ipike_payload_configuration_check(Ipike2_cp_payload* cp);
/*
*===========================================================================
* ipike_payload_configuration_extract
*===========================================================================
* Description: Extracts the configuration data from the payload.
* Parameters: payload - a configuration payload.
* cp - will be updated with the configuration data if the call
* was successful.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*
*/
IP_GLOBAL Ipike_error
ipike_payload_configuration_extract(
Ipike2_cp_payload* payload,
Ipike2_cp* cp);
/*
*===========================================================================
* ipike_payload_configuration_process
*===========================================================================
* Description: Process the configuration payload
* Parameters: ie - the exchange
* payload - a configuration payload.
* Returns: IPIKE_SUCCESS
*/
IP_GLOBAL Ipike_error
ipike_payload_configuration_process(
Ipike_isakmp_exchange* ie,
Ipike2_cp_payload* payload);
/*
*===========================================================================
* ipike_payload_configuration_print
*===========================================================================
* Description: Prints the content of the configuration payload to the
* system log.
* Parameters: cp - a pointer to a configuration payload.
* Returns:
*
*
*/
IP_GLOBAL void
ipike_payload_configuration_print(Ipike2_cp_payload* cp);
/*
*===========================================================================
* ipike_payload_configuration_set
*===========================================================================
* Description: Set a configuration attribute for cp structure.
* Parameters: cp - the configuration structure.
* type - type of attribute.
* data - data buffer for attribute.
* length - length of data buffer.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_configuration_set(
Ipike2_cp* cp,
Ip_u16 type,
Ip_u8* data,
Ip_size_t length);
/*
*===========================================================================
* ipike_payload_configuration_request_address
*===========================================================================
* Description: Set configuration attributes for cp structure to request
* address.
* Parameters: type - type of address to request.
* cp - the configuration structure.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_configuration_request_address(
Ipike2_cp* cp,
const char* type,
union Ip_sockaddr_union* address);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike2_payload_delete.c
+379
View File
@@ -0,0 +1,379 @@
/*
******************************************************************************
* SOURCE FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike2_payload_delete.c,v $ $Revision: 1.16.16.2 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike2_payload_delete.c,v $
* $Author: edahlber $ $Date: 2012-03-13 12:45:52 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Delete payload (RFC 2408, chapter 3.15) */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#ifdef IPIKE_USE_VERSION2
#include "ipike_h.h"
#include "ipike2_payload_delete.h"
#include "ipike_payload_proposal.h"
#include "ipike_util.h"
#include "ipike_ipsec_sadb.h"
#include "ipike_pfkeyv2.h"
#include "ipike_sadb.h"
#include <ipcom_clib.h>
#include <ipcom_syslog.h>
/*
****************************************************************************
* 4 EXTERN PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 5 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 6 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 7 LOCAL PROTOTYPES
****************************************************************************
*/
/*
*===========================================================================
* ipike2_payload_delete_spi_data
*===========================================================================
* Description: Returns a pointer to the first SPI in the payload.
* Parameters: del - A delete payload.
* Returns: A pointer to the SPI data.
*
*/
IP_STATIC Ip_u8*
ipike2_payload_delete_spi_data(Ipike2_del_payload* del);
/*
****************************************************************************
* 8 DATA
****************************************************************************
*/
/*
****************************************************************************
* 9 LOCAL FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike2_payload_delete_spi_data
*===========================================================================
*/
IP_STATIC Ip_u8*
ipike2_payload_delete_spi_data(Ipike2_del_payload* del)
{
return (Ip_u8 *) del + IPIKE2_DELETE_HEADER_LENGTH;
}
/*
*===========================================================================
* ipike2_payload_delete_ike_sa
*===========================================================================
*/
IP_STATIC Ipike_error
ipike2_payload_delete_ike_sa(Ipike_sadb_entry *ike_sa, Ipike_payload_header *payload_out)
{
(void)ipike_sadb_set_state(IP_NULL, ike_sa, IPIKE_SA_DYING);
/* The payload may be updated with the data that should be sent in
* the response. For IKE SA's is there no response, so update with
* a none payload */
if (IP_NULL != payload_out)
{
payload_out->length = ip_htons(sizeof(*payload_out));
payload_out->next_payload = IPIKE_PAYLOAD_NONE;
}
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike2_payload_delete_ipsec_sa
*===========================================================================
*/
IP_STATIC Ipike_error
ipike2_payload_delete_ipsec_sa(
Ipike_sadb_entry* ike_sa,
Ipike2_del_payload* payload_in,
Ipike_payload_header* payload_out_header) /* allocated outside */
{
Ipike_ipsec_sadb_entry* ipsec_sa;
Ip_u8* spi;
Ip_u8* spi_out = IP_NULL;
int i;
Ipike2_del_payload* payload_out;
payload_out = (Ipike2_del_payload*)payload_out_header;
/* Each SPI is 4 bytes */
if ((payload_in->spi_size % 4) != 0)
return IPIKE_INVALID_VALUE;
/* The payload may be updated with the data that should be sent in
* the response. For IPSEC SA's should the corresponding SA be sent (if
* still available, since may already have been deleted).
*/
if (IP_NULL != payload_out)
{
ipcom_memcpy((void*)payload_out, (void*)payload_in, sizeof(*payload_in));
payload_out->spi_count = 0;
spi_out = ipike2_payload_delete_spi_data(payload_out);
}
/* Loop threw all SPI:s */
for (i = 0; i < ip_ntohs(payload_in->spi_count); i++)
{
spi = ipike2_payload_delete_spi_data(payload_in) + i * 4;
/* The spi is for the outbound SA */
if (IPIKE_SUCCESS == ipike_ipsec_sadb_hash_get(
spi,
payload_in->proto_id,
&ike_sa->peer_addr,
&ike_sa->local_addr,
&ipsec_sa))
{
/* Add corresponding spi to response list */
if ((IP_NULL != ipsec_sa->other) && (IP_NULL != payload_out))
{
ipcom_memcpy(spi_out + (payload_out->spi_count * 4), ipsec_sa->other->spi, 4);
payload_out->spi_count++;
}
/* Delete corresponding from SA store */
if (IP_NULL != ipsec_sa->other)
ipike_ipsec_sadb_delete_sa(ipsec_sa->other);
/* Delete from SA store */
/* Recheck because the delete of the inbound SA
* might have a pfkeyv2 response which deletes the
original outbound ipsec SA */
if (IPIKE_SUCCESS == ipike_ipsec_sadb_hash_get(spi,
payload_in->proto_id,
&ike_sa->peer_addr,
&ike_sa->local_addr,
&ipsec_sa))
ipike_ipsec_sadb_delete_sa(ipsec_sa);
}
}
/* Set returning payload as none if no spi:s available */
if (IP_NULL != payload_out)
{
if (payload_out->spi_count == 0)
{
payload_out->header.next_payload = IPIKE_PAYLOAD_NONE;
payload_out->header.length = ip_htons(sizeof(payload_out->header));
}
else
{
payload_out->header.next_payload = IPIKE2_PAYLOAD_DELETE;
payload_out->header.length = sizeof(*payload_out);
payload_out->header.length = (Ip_u16)(payload_out->header.length +
payload_out->spi_count*4);
payload_out->header.length = ip_htons(payload_out->header.length);
payload_out->spi_count = ip_htons(payload_out->spi_count);
}
}
return IPIKE_SUCCESS;
}
/*
****************************************************************************
* 10 PUBLIC FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike2_payload_delete_new
*===========================================================================
*/
IP_GLOBAL Ipike2_del_payload *
ipike2_payload_delete_new(Ip_u8 proto_id, Ipike_value* spi)
{
Ipike2_del_payload *del;
del = ipcom_calloc(1, IPIKE2_DELETE_HEADER_LENGTH + spi->len);
if (IP_NULL == del)
{
IP_PANIC();
return IP_NULL;
}
del->header.next_payload = IPIKE2_PAYLOAD_DELETE;
del->proto_id = proto_id;
switch (proto_id)
{
case IPIKE_PROTO_ISAKMP:
del->spi_count = ip_htons(0);
del->spi_size = (Ip_u8) 0;
del->header.length = (Ip_u16)(IPIKE2_DELETE_HEADER_LENGTH);
break;
default:
del->spi_count = ip_htons(1);
del->spi_size = (Ip_u8) spi->len;
del->header.length = (Ip_u16)(IPIKE2_DELETE_HEADER_LENGTH + spi->len);
}
del->header.length = ip_htons(del->header.length);
ipcom_memcpy(ipike2_payload_delete_spi_data(del), spi->value, del->spi_size);
return del;
}
/*
*===========================================================================
* ipike2_payload_delete_check
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike2_payload_delete_check(Ipike2_del_payload* del)
{
if (ip_ntohs(del->header.length) != IPIKE2_DELETE_HEADER_LENGTH +
(Ip_u32) ip_ntohs(del->spi_count) * (Ip_u32) del->spi_size)
return IPIKE_ISAKMP_INVALID_SYNTAX;
switch (del->proto_id)
{
case IPIKE_PROTO_ISAKMP:
/* If we are deleting a IKE_SA, there should be no SPI:s, but if
* there are we should be forgiving and just ignore them. */
break;
default:
if (del->spi_size == 0)
{
IPCOM_LOG0(ERR, "ipike2_payload_delete_check_payload: SPI size is zero");
return IPIKE_ISAKMP_INVALID_SYNTAX;
}
}
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike2_payload_delete_process
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike2_payload_delete_process(
Ipike_isakmp_exchange* ie,
Ipike2_del_payload* payload)
{
/* If this is a request then should the response contain the
* corresponding SA(s) */
ipcom_free(ie->phase2.notify_or_delete);
ie->phase2.notify_or_delete = IP_NULL;
if (ie->message_number == 1)
{
/* Same size as incoming should be enough */
ie->phase2.notify_or_delete = ipcom_calloc(1, ip_htons(payload->header.length));
if (IP_NULL == ie->phase2.notify_or_delete)
{
IP_PANIC();
return IPIKE_OUT_OF_MEMORY;
}
}
if (payload->proto_id == IPIKE_PROTO_ISAKMP)
/* IKE SA */
return ipike2_payload_delete_ike_sa(ie->ike_sa, ie->phase2.notify_or_delete);
else if (payload->proto_id == IPIKE_PROTO_IPSEC_AH || payload->proto_id == IPIKE_PROTO_IPSEC_ESP)
/* Child SA */
return ipike2_payload_delete_ipsec_sa(ie->ike_sa, payload, ie->phase2.notify_or_delete);
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike2_payload_delete_print
*===========================================================================
*/
IP_GLOBAL void
ipike2_payload_delete_print(Ipike2_del_payload* del)
{
Ip_u8* data;
int i;
char* spi_hex;
IPCOM_LOG1(DEBUG2, " protocol ID: %s",
ipike_proposal_proto_id_to_string(del->proto_id));
data = ipike2_payload_delete_spi_data(del);
for (i = 0; i < ip_ntohs(del->spi_count); i++)
{
spi_hex = ipike_memory_to_string(data + i * del->spi_size,
del->spi_size,
del->spi_size);
if (IP_NULL == spi_hex)
{
IPCOM_LOG0(CRIT, "ipike2_payload_delete_print_payload: out of memory");
return;
}
IPCOM_LOG2(DEBUG2, " SPI %d: %s", i + 1, spi_hex);
ipcom_free(spi_hex);
}
return;
}
#else
int ipike2_payload_delete_empty_file = 0;
#endif /* IPIKE_USE_VERSION2 */
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike2_payload_delete.h
+187
View File
@@ -0,0 +1,187 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike2_payload_delete.h,v $ $Revision: 1.4 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike2_payload_delete.h,v $
* $Author: edahlber $ $Date: 2010-04-23 15:31:40 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#if !defined(IPIKE2_PAYLOAD_DELETE_H) && defined(IPIKE_USE_VERSION2)
#define IPIKE2_PAYLOAD_DELETE_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Delete payload (IKE version 2) */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_payload.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
#define IPIKE2_DELETE_HEADER_LENGTH sizeof(Ipike2_del_payload)
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
Delete Payload Format
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Next Payload ! RESERVED ! Payload Length !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Protocol-Id ! SPI Size ! # of SPIs !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! !
~ Security Parameter Index(es) (SPI) ~
! !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
*/
/* All fields in this struct must be in network byte order */
typedef struct Ipike2_del_payload_struct
{
/* The generic ISAKMP payload header, the length includes the length
of all transforms associated with the proposal */
Ipike_payload_header header;
/* The protocol ID (ISAKMP, IPSec ESP, IPSec AH) */
Ip_u8 proto_id;
/* The size, in bytes, of each SPI */
Ip_u8 spi_size;
/* Number of SPIs, each 'spi_size' bytes long */
Ip_u16 spi_count;
}
Ipike2_del_payload;
typedef struct Ipike2_del_struct
{
/* the delete payload header */
Ipike2_del_payload info;
/* Spi data */
Ip_u8* spi_data;
}
Ipike2_del;
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike2_payload_delete_new
*===========================================================================
* Description: Creates a new delete payload.
* Parameters: proto_id - The protocol id for the deleted SA.
* spi - The spi buffer.
* Returns: A new delete payload or IP_NULL if out of memory.
*/
IP_GLOBAL Ipike2_del_payload*
ipike2_payload_delete_new(Ip_u8 proto_id, Ipike_value* spi);
/*
*===========================================================================
* ipike2_payload_delete_create
*===========================================================================
* Description: Creates a new delete payload from the information
* created in the exchange.
* Parameters: del - the delete structure to encode into a ISAKMP
* payload.
* payload - will point to a new delete payload.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike2_payload_delete_create(Ipike2_del* del, Ipike2_del_payload** payload);
/*
*===========================================================================
* ipike2_payload_delete_check
*===========================================================================
* Description: Verifies that the delete payload is sane.
* Parameters: del - A pointer to a delete payload.
* Returns: IPIKE_SUCCESS
* IPIKE_ISAKMP_PAYLOAD_LENGTH_ERROR
*
*/
IP_GLOBAL Ipike_error
ipike2_payload_delete_check(Ipike2_del_payload* del);
/*
*===========================================================================
* ipike2_payload_delete_print
*===========================================================================
* Description: Prints the content of the delete payload to the system log.
* Parameters: del - A pointer to delete payload.
* Returns:
*
*
*/
IP_GLOBAL void
ipike2_payload_delete_print(Ipike2_del_payload* del);
/*
*===========================================================================
* ipike2_payload_delete_process
*===========================================================================
* Description: Process the delete message, the affected SA will be deleted
* Invalid delete messages will be dropped.
* Parameters: sa - The SA used to protect the traffic.
* payload - A delete payload.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*
*/
IP_GLOBAL Ipike_error
ipike2_payload_delete_process(
Ipike_isakmp_exchange* ie,
Ipike2_del_payload* payload);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike2_payload_eap.c
+251
View File
@@ -0,0 +1,251 @@
/*
******************************************************************************
* SOURCE FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike2_payload_eap.c,v $ $Revision: 1.7.16.1 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike2_payload_eap.c,v $
* $Author: edahlber $ $Date: 2011-12-22 09:29:34 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* EAP payload (IKE version 2) */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#ifdef IPIKE_USE_VERSION2
#include "ipike_h.h"
#include "ipike_attributes.h"
#include "ipike2_payload_eap.h"
/*
****************************************************************************
* 4 EXTERN PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 5 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 6 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 7 LOCAL PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 8 DATA
****************************************************************************
*/
/*
****************************************************************************
* 9 LOCAL FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_payload_eap_data
*===========================================================================
* Description: Returns a pointer to the eap data in the payload.
* Parameters: eap - a eap payload.
* Returns: A pointer to the eap data.
*/
IP_STATIC Ip_u8*
ipike_payload_eap_data(Ipike2_eap_payload* eap)
{
return (Ip_u8*)eap + IPIKE_EAP_HEADER_LENGTH;
}
/*
*===========================================================================
* ipike_payload_eap_data_length
*===========================================================================
* Description: Returns the length of the eap data.
* Parameters: eap - eap payload.
* Returns: The length of the eap data (in bytes).
*/
IP_STATIC Ip_u16
ipike_payload_eap_data_length(Ipike2_eap_payload* eap)
{
return IPIKE_PAYLOAD_DATA_LENGTH(eap->header.length, IPIKE_EAP_HEADER_LENGTH);
}
/*
*===========================================================================
* ipike_attribute_eap_code_to_string
*===========================================================================
* Description: Returns the length of the eap data.
* Parameters: code - eap code.
* Returns: A string representation of the code.
*/
IP_STATIC const char*
ipike_attribute_eap_code_to_string(Ip_u8 code)
{
const char* s;
if ((ipike_map_string(ipike.eap_code_map, code, &s)))
return "Invalid EAP code";
return s;
}
/*
****************************************************************************
* 10 PUBLIC FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_payload_eap_create
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_eap_create(
Ipike_value* eap,
Ipike2_eap_payload** payload)
{
Ipike2_eap_payload* eap_payload;
Ip_u8* buf;
Ip_u16 size;
if ((eap->value == IP_NULL) || (eap->len == 0))
{
*payload = IP_NULL;
}
else
{
size = sizeof((*payload)->header);
if (IP_NULL == (buf = ipcom_calloc(1, size + eap->len)))
{
IP_PANIC();
return IPIKE_OUT_OF_MEMORY;
}
ipcom_memcpy(buf+size, eap->value, eap->len);
eap_payload = (Ipike2_eap_payload*)buf;
eap_payload->header.next_payload = IPIKE2_PAYLOAD_EAP;
eap_payload->header.length = ip_htons((Ip_u16)(size + eap->len));
*payload = eap_payload;
/* Clear eap buffer, so we never reuse it */
ipcom_free(eap->value);
eap->value = IP_NULL;
eap->len = 0;
}
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_payload_eap_check
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_eap_check(Ipike2_eap_payload* eap)
{
if ((ip_ntohs(eap->length) + sizeof(eap->header)) != ip_ntohs(eap->header.length))
{
IPCOM_LOG0(CRIT, "ipike_payload_eap_check: bad payload length");
return IPIKE_ISAKMP_PAYLOAD_LENGTH_ERROR;
}
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_payload_eap_extract
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_eap_extract(
Ipike2_eap_payload* payload,
Ipike_value* eap)
{
eap->len = ip_htons(payload->header.length) - IPIKE_PAYLOAD_HEADER_LENGTH;
ipcom_free(eap->value);
if (IP_NULL == (eap->value = ipcom_malloc(eap->len)))
{
IP_PANIC();
return IPIKE_OUT_OF_MEMORY;
}
ipcom_memcpy(eap->value,
(Ip_u8*)payload + IPIKE_PAYLOAD_HEADER_LENGTH,
eap->len);
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_payload_eap_print
*===========================================================================
*/
IP_GLOBAL void
ipike_payload_eap_print(Ipike2_eap_payload* eap)
{
const char* type = IP_NULL;
/* lint */
(void)type;
type = ipike_attribute_eap_code_to_string(eap->code);
IPCOM_LOG1(DEBUG2, " code: '%s'", type);
IPCOM_LOG1(DEBUG2, " id: %d", eap->id);
IPCOM_LOG1(DEBUG2, " length: %d", ip_htons(eap->length));
if (ipike_payload_eap_data_length(eap) > 0)
{
(void)ipike_print_memory(IPCOM_LOG_DEBUG2, " data:\n",
ipike_payload_eap_data(eap),
ipike_payload_eap_data_length(eap));
}
return;
}
#else
int ipike_payload_eap_empty_file = 0;
#endif /* IPIKE_USE_VERSION2 */
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike2_payload_eap.h
+165
View File
@@ -0,0 +1,165 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike2_payload_eap.h,v $ $Revision: 1.3 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike2_payload_eap.h,v $
* $Author: edahlber $ $Date: 2010-04-23 15:31:40 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#if !defined(IPIKE2_PAYLOAD_EAP_H) && defined(IPIKE_USE_VERSION2)
#define IPIKE2_PAYLOAD_EAP_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* EAP payload (IKE version 2) */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_payload.h"
#ifdef IPIKE_USE_EAP
#include <ipeap.h>
#endif
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
#define IPIKE_EAP_HEADER_LENGTH 8
#define IPIKE_EAP_REQUEST 1
#define IPIKE_EAP_RESPONSE 2
#define IPIKE_EAP_SUCCESS 3
#define IPIKE_EAP_FAILURE 4
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
EAP Payload Format
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Next Payload ! RESERVED ! Payload Length !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Code ! Identifier ! Length !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Type ! Type_Data...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
*/
typedef struct Ipike2_eap_payload_struct
{
/* The generic ISAKMP payload header, the length includes the length
* of all information that follows. */
Ipike_payload_header header;
/* EAP type, id, length and type */
Ip_u8 code;
Ip_u8 id;
Ip_u16 length;
/* Type and type data follows */
}
Ipike2_eap_payload;
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_payload_eap_create
*===========================================================================
* Description: Creates a new eap payload from the information created in the
* exchange.
* Parameters: eap - The eap struct to encode to payload.
* payload - Will point to a new eap payload if the call was
* successful.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_eap_create(
Ipike_value* eap,
Ipike2_eap_payload** payload);
/*
*===========================================================================
* ipike_payload_eap_check
*===========================================================================
* Description: Verifies that the eap payload is sane.
* Parameters: eap - a pointer to a eap payload.
* Returns: IPIKE_SUCCESS
*/
IP_GLOBAL Ipike_error
ipike_payload_eap_check(Ipike2_eap_payload* eap);
/*
*===========================================================================
* ipike_payload_eap_print
*===========================================================================
* Description: Prints the content of the eap payload to the
* system log.
* Parameters: eap - a pointer to a eap payload.
* Returns:
*/
IP_GLOBAL void
ipike_payload_eap_print(Ipike2_eap_payload* eap);
/*
*===========================================================================
* ipike_payload_eap_extract
*===========================================================================
* Description: Extracts the eap data from the payload.
* Parameters: payload - a eap payload.
* eap - will be updated with the eap data if the call was
* successful.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_eap_extract(
Ipike2_eap_payload* payload,
Ipike_value* eap);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike2_payload_encrypted.c
+357
View File
@@ -0,0 +1,357 @@
/*
******************************************************************************
* SOURCE FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_RCPL8_2024030303 $ $RCSfile: ipike2_payload_encrypted.c,v $ $Revision: 1.15.10.7 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike2_payload_encrypted.c,v $
* $Author: jren $ $Date: 2022-01-15 07:11:43 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Encrypted payload (IKE version 2) */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#ifdef IPIKE_USE_VERSION2
#include "ipike_h.h"
#include "ipike_attributes.h"
#include "ipike2_payload_encrypted.h"
#include "ipike_util.h"
#include "ipike_crypto.h"
#include "ipike_sadb.h"
#include <ipcom_clib.h>
#include <ipcom_syslog.h>
/*
****************************************************************************
* 4 EXTERN PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 5 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 6 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 7 LOCAL PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 8 DATA
****************************************************************************
*/
/*
****************************************************************************
* 9 LOCAL FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_payload_encrypted_data
*===========================================================================
* Description: Returns a pointer to the encrypted data in the payload.
* Parameters: e - a encrypted payload.
* Returns: A pointer to the encrypted data.
*/
IP_STATIC Ip_u8*
ipike_payload_encrypted_data(Ipike2_e_payload* e)
{
return (Ip_u8*)e + sizeof(Ipike2_e_payload);
}
/*
*===========================================================================
* ipike_payload_encrypted_data_length
*===========================================================================
* Description: Returns the length of the encrypted data.
* Parameters: e - encrypted payload.
* Returns: The length of the encrypted data (in bytes).
*/
IP_STATIC Ip_u16
ipike_payload_encrypted_data_length(Ipike2_e_payload* e)
{
return IPIKE_PAYLOAD_DATA_LENGTH(e->header.length, sizeof(Ipike2_e_payload));
}
/*
****************************************************************************
* 10 PUBLIC FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_payload_encrypted_create
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_encrypted_create(
Ipike_isakmp_exchange* ie,
Ipike_message *msg,
Ip_u32 offset)
{
Ipike_error err;
Ipike2_sa* sa;
Ipike_value* enc_key;
Ipike_value* auth_key;
Ip_u16 block_size;
Ip_u16 checksum_size;
Ip_u8 pad_length;
Ip_u32 length;
Ip_u8* buffer;
Ipike2_e_payload* payload;
Ipike_isakmp_header* msghdr_out;
Ipike_value org_data;
Ip_u8* data;
Ip_u8* iv;
Ip_u8* checksum;
sa = &ie->ike_sa->v2.sa;
if (ie->ike_sa->is_initiator)
{
enc_key = &ie->ike_sa->v2.keys.SK_ei;
auth_key = &ie->ike_sa->v2.keys.SK_ai;
}
else
{
enc_key = &ie->ike_sa->v2.keys.SK_er;
auth_key = &ie->ike_sa->v2.keys.SK_ar;
}
/* Get the data to be encrypted, skip header and any offset (non-ESP marker) */
org_data.len = msg->data.len - sizeof(Ipike_isakmp_header) - offset;
org_data.value = msg->data.value + sizeof(Ipike_isakmp_header) + offset;
/* Get block size */
block_size = ipike_attribute_get_cipher_block_size_v2(sa->selected_encr,
sa->selected_key_length);
ip_assert(block_size == ie->iv.len);
/* Calculate the encrypted data size */
checksum_size = ipike_crypto_hmac_size(sa->selected_integ);
pad_length = (Ip_u8)(block_size - (org_data.len % block_size));
length = sizeof(Ipike_isakmp_header) + sizeof(Ipike2_e_payload);
length += block_size + (Ip_u32)org_data.len + pad_length + checksum_size;
/* Create a new buffer for the encrypted message */
if ( IP_NULL == (buffer = ipcom_malloc(length + offset)) )
{
IP_PANIC();
return IPIKE_OUT_OF_MEMORY;
}
/* Copy the header to the new buffer */
ipcom_memcpy((void*)buffer, (void*)msg->data.value, (sizeof(Ipike_isakmp_header) + offset));
msghdr_out = (Ipike_isakmp_header *) (buffer + offset);
payload = (Ipike2_e_payload *)(msghdr_out + 1);
iv = (Ip_u8 *)(payload + 1);
data = iv + block_size;
checksum = data + org_data.len + pad_length;
/* Update isakmp and encrypted header with correct data */
payload->header.next_payload = msghdr_out->next_payload;
msghdr_out->next_payload = IPIKE2_PAYLOAD_ENCRYPTED;
payload->header.length = (Ip_u16)(length - sizeof(Ipike_isakmp_header));
msghdr_out->length = (Ip_u32)(payload->header.length + sizeof(*msghdr_out));
payload->header.length = ip_htons(payload->header.length);
msghdr_out->length = ip_htonl(msghdr_out->length);
payload->header.flags = 0;
/* Copy iv, data and pad to new buffer */
ipcom_memcpy(iv, ie->iv.value, ie->iv.len);
ipcom_memcpy(data, org_data.value, org_data.len);
data[org_data.len+pad_length-1] = (Ip_u8)(pad_length - 1);
/* Encrypt the data (plus padding chars) */
if (IPIKE_SUCCESS != (err = ipike_crypto_encrypt_buffer(
sa->selected_encr,
enc_key->value,
(Ip_u16)enc_key->len,
iv,
data,
(Ip_u32)org_data.len + pad_length)))
{
ipcom_free(buffer);
return IPIKE_FAILED; /* Should never happen */
}
/* Calculate checksum */
if (IPIKE_SUCCESS != (err = ipike_crypto_calculate_checksum(
sa->selected_integ,
auth_key,
(Ip_u8*)msghdr_out,
ip_htonl(msghdr_out->length) - checksum_size,
checksum)))
{
ipcom_free(buffer);
return IPIKE_FAILED; /* Should never happen */
}
/* All success, free old plaintext data and replace it
with the encrypted data */
ipcom_free(msg->data.value);
msg->data.value = buffer;
msg->data.len = length + offset;
return err;
}
/*
*===========================================================================
* ipike_payload_encrypted_extract
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_encrypted_extract(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header* msg)
{
Ipike_error err;
Ip_u16 block_size;
Ip_u16 checksum_size;
Ipike2_e_payload* payload;
Ip_u8* iv;
Ip_u8* checksum;
Ip_u8* data;
Ip_size_t data_len;
Ipike2_sa* sa;
Ipike_value* enc_key;
Ipike_value* auth_key;
sa = &ie->ike_sa->v2.sa;
if (ie->ike_sa->is_initiator)
{
enc_key = &ie->ike_sa->v2.keys.SK_er;
auth_key = &ie->ike_sa->v2.keys.SK_ar;
}
else
{
enc_key = &ie->ike_sa->v2.keys.SK_ei;
auth_key = &ie->ike_sa->v2.keys.SK_ai;
}
block_size = ipike_attribute_get_cipher_block_size_v2(sa->selected_encr,
sa->selected_key_length);
checksum_size = ipike_crypto_hmac_size(sa->selected_integ);
payload = (Ipike2_e_payload*)(msg + 1);
if ((sizeof(Ipike_payload_header) + IPIKE_ISAKMP_HEADER_LENGTH) > (ip_htonl(msg->length)))
{
return IPIKE_ISAKMP_INVALID_PAYLOAD;
}
if ((ip_htons(payload->header.length) + IPIKE_ISAKMP_HEADER_LENGTH) > (ip_htonl(msg->length)))
{
return IPIKE_ISAKMP_INVALID_PAYLOAD;
}
/* At least one block of iv, one block of encrypted data and one
* checksum */
if (ip_htons(payload->header.length) <
(2u * block_size + checksum_size + sizeof(Ipike_payload_header)))
{
return IPIKE_ISAKMP_INVALID_PAYLOAD;
}
data_len = (ip_htons(payload->header.length) - sizeof(*payload) - checksum_size - block_size);
iv = (Ip_u8*)(payload + 1);
data = iv + block_size;
checksum = data + data_len;
err = ipike_crypto_verify_checksum(sa->selected_integ,
auth_key,
(Ip_u8*)msg,
ip_htonl(msg->length) - checksum_size,
checksum);
if (IPIKE_SUCCESS != err)
return IPIKE_ISAKMP_INVALID_PAYLOAD;
err = ipike_crypto_decrypt_buffer(sa->selected_encr,
enc_key->value,
(Ip_u16)enc_key->len,
iv,
data,
data_len);
if (IPIKE_SUCCESS != err)
return err;
/* Remove padding */
if ((data[data_len-1] > 0) ||
(data[data_len-1] < block_size))
data_len -= data[data_len-1] + 1u;
/* Update the msg structure to reflect the decoded values */
msg->next_payload = payload->header.next_payload;
msg->length = ip_htonl(data_len + sizeof(*msg));
/* Move decrypted data to begining of buffer */
ipcom_memmove(payload, data, data_len);
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_payload_encrypted_print
*===========================================================================
*/
IP_GLOBAL void
ipike_payload_encrypted_print(Ipike2_e_payload* e)
{
(void)ipike_print_memory(IPCOM_LOG_DEBUG2, " Encrypted data:\n",
ipike_payload_encrypted_data(e),
ipike_payload_encrypted_data_length(e));
return;
}
#else
int ipike_payload_encrypted_empty_file = 0;
#endif /* IPIKE_USE_VERSION2 */
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike2_payload_encrypted.h
+175
View File
@@ -0,0 +1,175 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike2_payload_encrypted.h,v $ $Revision: 1.5 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike2_payload_encrypted.h,v $
* $Author: edahlber $ $Date: 2010-04-23 15:31:40 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#if !defined(IPIKE2_PAYLOAD_ENCRYPTED_H) && defined(IPIKE_USE_VERSION2)
#define IPIKE2_PAYLOAD_ENCRYPTED_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Encrypted payload (IKE version 2) */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_payload.h"
#include "ipike2_payload_sa.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
Encryption Payload Format
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Next Payload !C! RESERVED ! Payload Length !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Initialization Vector !
! (length is block size for encryption algorithm) !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Encrypted IKE payloads !
! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! ! Padding 0-255 octets !
+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
! ! Pad length !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
~ Integrity Checksum Data ~
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
*/
typedef struct Ipike2_e_payload_struct
{
/* The generic ISAKMP payload header, the length includes the length
of all transforms associated with the proposal */
Ipike_payload_header header;
/* Encryption data follows */
}
Ipike2_e_payload;
typedef struct Ipike2_e_struct
{
/* Initialization vector */
Ipike_value iv;
/* Encrypted payloads */
Ipike_value data;
/* Integrity checksum */
Ipike_value checksum;
}
Ipike2_e;
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_payload_encrypted_create
*===========================================================================
* Description: Creates a new encrypted payload from the information
* created in the exchange.
* Parameters: ie - IKE exchange information containing the SA used to
* encrypt the payloads.
* msg - IKE message containing the the original payload list
* that will be encrypted. The plaintext data will be replaced
* by the encrypted data if the call is successful.
* offset - offset to real message value.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_encrypted_create(
Ipike_isakmp_exchange* ie,
Ipike_message *msg,
Ip_u32 offset);
/*
*===========================================================================
* ipike_payload_encrypted_check
*===========================================================================
* Description: Verifies that the encrypted payload is sane.
* Parameters: e - a pointer to a key exchange payload.
* Returns: IPIKE_SUCCESS
*
*
*/
IP_GLOBAL Ipike_error
ipike_payload_encrypted_check(Ipike2_e_payload* e);
/*
*===========================================================================
* ipike_payload_encrypted_print
*===========================================================================
* Description: Prints the content of the encrypted payload to the
* system log.
* Parameters: ke - a pointer to a encrypted payload.
* Returns:
*/
IP_GLOBAL void
ipike_payload_encrypted_print(Ipike2_e_payload* e);
/*
*===========================================================================
* ipike_payload_encrypted_extract
*===========================================================================
* Description: Extracts the encrypted data from the encrypted payload and
* store the decrypted data in the original encrypted buffer.
* Parameters: ie - the exchange
* data - stores encrypted data and will store decrypted data if
* call is successful.
* Returns: IPIKE_SUCCESS
*/
IP_GLOBAL Ipike_error
ipike_payload_encrypted_extract(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header* msg);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike2_payload_identification.c
+309
View File
@@ -0,0 +1,309 @@
/*
******************************************************************************
* SOURCE FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_RCPL8_2024030303 $ $RCSfile: ipike2_payload_identification.c,v $ $Revision: 1.10.16.4 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike2_payload_identification.c,v $
* $Author: wdeng $ $Date: 2021-11-05 09:51:39 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Identification payload (IKE version 2) */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#ifdef IPIKE_USE_VERSION2
#include "ipike_h.h"
#include "ipike_payload_identification.h"
#include "ipike2_payload_identification.h"
#include "ipike_util.h"
#include "ipike_configuration.h"
#include <ipcom_sock2.h>
/*
****************************************************************************
* 4 EXTERN PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 5 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 6 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 7 LOCAL PROTOTYPES
****************************************************************************
*/
/*
*===========================================================================
* ipike_payload_identification_data
*===========================================================================
* Description: Returns a pointer to the id data in the payload.
* Parameters: id - a id payload.
* Returns: A pointer to the id data.
*/
IP_STATIC Ip_u8 *
ipike_payload_identification_data(Ipike2_id_payload* id);
/*
*===========================================================================
* ipike_payload_identification_data_length
*===========================================================================
* Description: Returns the length of the indetification data.
* Parameters: id - a id payload.
* Returns: The length of the id data.
*/
IP_STATIC Ip_u16
ipike_payload_identification_data_length(Ipike2_id_payload* id);
/*
****************************************************************************
* 8 DATA
****************************************************************************
*/
/*
****************************************************************************
* 9 LOCAL FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_payload_identification_data
*===========================================================================
*/
IP_STATIC Ip_u8 *
ipike_payload_identification_data(Ipike2_id_payload* id)
{
return (Ip_u8*) id + sizeof(Ipike2_id_payload);
}
/*
*===========================================================================
* ipike_payload_identification_data_length
*===========================================================================
*/
IP_STATIC Ip_u16
ipike_payload_identification_data_length(Ipike2_id_payload* id)
{
return IPIKE_PAYLOAD_DATA_LENGTH(id->header.length, sizeof(Ipike2_id_payload));
}
/*
****************************************************************************
* 10 PUBLIC FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_payload_identification_generate
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_identification_generate(
const char* value,
Ip_bool initiator,
Ipike2_id* id)
{
Ipike_error err;
char* type = IP_NULL;
ipcom_memset(id, 0, sizeof(*id));
if (IPIKE_SUCCESS != (err = ipike_parse_get_string(&value, ' ', &type)))
{
IPCOM_LOG0(ERR, "ipike_payload_identification_generate: failed to get id type");
}
else if (IPIKE_SUCCESS != (err = ipike_attribute_id_type_from_string(type, &id->info.id_type)))
{
IPCOM_LOG1(ERR, "ipike_payload_identification_generate: failed to get id type from string (%s)", type);
}
else
{
switch (id->info.id_type)
{
case IPIKE_ID_IPV4_ADDR:
case IPIKE_ID_IPV6_ADDR:
err = ipike_identification_init_ip_address(value, &id->info.id_type, &id->data);
break;
case IPIKE_ID_FQDN:
case IPIKE_ID_USER_FQDN:
case IPIKE_ID_KEY_ID:
err = ipike_identification_init_value(value, &id->data);
break;
case IPIKE_ID_DER_ASN1_DN:
err = ipike_identification_init_asn1_dn(value, &id->data);
break;
default:
IPCOM_LOG1(ERR, "ipike_payload_identification_generate: Type %s is not supported", type);
err = IPIKE_CONF_INVALID_VALUE;
}
}
id->initiator = initiator;
ipcom_free(type);
return err;
}
/*
*===========================================================================
* ipike_payload_identification_create
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_identification_create(
Ipike2_id* id,
Ipike2_id_payload** payload)
{
Ipike2_id_payload *id_payload;
if (IP_NULL == (id_payload = ipcom_calloc(1, sizeof(Ipike2_id_payload) + id->data.len)))
{
IP_PANIC();
return IPIKE_OUT_OF_MEMORY;
}
id_payload->header.length = (Ip_u16)(ip_htons(sizeof(Ipike2_id_payload) + id->data.len));
if (id->initiator)
id_payload->header.next_payload = IPIKE2_PAYLOAD_IDENTIFICATION_I;
else
id_payload->header.next_payload = IPIKE2_PAYLOAD_IDENTIFICATION_R;
id_payload->id_type = id->info.id_type;
ipcom_memcpy(ipike_payload_identification_data(id_payload), id->data.value, id->data.len);
*payload = id_payload;
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_payload_identification_free
*===========================================================================
*/
IP_GLOBAL void
ipike_payload_identification_free(Ipike2_id* id)
{
if ( id->data.value )
{
ipcom_free(id->data.value);
ipcom_memset(id, 0, sizeof(*id));
}
return;
}
/*
*===========================================================================
* ipike_payload_identification_check
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_identification_check(Ipike2_id_payload* id)
{
if (ip_ntohs(id->header.length) < sizeof(Ipike2_id_payload))
{
IPCOM_LOG2(ERR,
"The length of the id payload must be at least %d, this was %d",
sizeof(Ipike2_id_payload), ip_ntohs(id->header.length));
return IPIKE_ISAKMP_PAYLOAD_LENGTH_ERROR;
}
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_payload_identification_print
*===========================================================================
*/
IP_GLOBAL void
ipike_payload_identification_print(Ipike2_id_payload* id)
{
IPCOM_LOG1(DEBUG2, " id type: %s", ipike_attribute_id_type_to_string(id->id_type));
(void)ipike_print_memory(IPCOM_LOG_DEBUG2, " id data: ",
ipike_payload_identification_data(id),
ipike_payload_identification_data_length(id));
return;
}
/*
*===========================================================================
* ipike_payload_identification_extract
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_identification_extract(
Ipike2_id_payload* payload,
Ipike2_id* id)
{
Ip_u16 size;
IPIKE_FREEP(id->data.value);
size = ipike_payload_identification_data_length(payload);
if (0 == size)
{
IPCOM_LOG0(CRIT, "ipike_payload_identification_extract: no identification data");
return IPIKE_ISAKMP_INVALID_SYNTAX;
}
else if (IP_NULL == (id->data.value = ipcom_malloc(size)))
{
IP_PANIC();
return IPIKE_OUT_OF_MEMORY;
}
id->data.len = ipike_payload_identification_data_length(payload);
ipcom_memcpy(id->data.value, ipike_payload_identification_data(payload), id->data.len);
if (payload->header.next_payload == IPIKE2_PAYLOAD_IDENTIFICATION_I)
id->initiator = IP_TRUE;
else
id->initiator = IP_FALSE;
ipcom_memcpy((void*)&id->info, (void*)payload, sizeof(id->info));
return IPIKE_SUCCESS;
}
#else
int ipike_payload_identification_empty_file = 0;
#endif /* IPIKE_USE_VERSION2 */
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike2_payload_identification.h
+224
View File
@@ -0,0 +1,224 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike2_payload_identification.h,v $ $Revision: 1.6.16.2 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike2_payload_identification.h,v $
* $Author: edahlber $ $Date: 2012-02-03 08:46:46 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#if !defined(IPIKE2_PAYLOAD_IDENTIFICATION_H) && defined(IPIKE_USE_VERSION2)
#define IPIKE2_PAYLOAD_IDENTIFICATION_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Identification payload (IKE version 2) */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_payload.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
/* The ID_IPV4_ADDR type specifies a single four (4) octet IPv4 address. */
#define IPIKE_ID_IPV4_ADDR 1
/* The ID_FQDN type specifies a fully-qualified domain name string. */
#define IPIKE_ID_FQDN 2
/* The IPIKE_ID_RFC822_ADDR type specifies a fully-qualified RFC822
email address string. */
#define IPIKE_ID_RFC822_ADDR 3
/* The ID_IPV6_ADDR type specifies a single sixteen (16) octet IPv6 address.*/
#define IPIKE_ID_IPV6_ADDR 5
/* The ID_IPV6_ADDR_SUBNET type specifies a range of IPv6 addresses,
represented by two sixteen (16) octet values. The first value is an
IPv6 address. The second is an IPv6 network mask. */
#define IPIKE_ID_DER_ASN1_DN 9
/* The ID_DER_ASN1_GN type specifies the binary DER encoding of an ASN.1
X.500 GeneralName of the principal whose certificates are
being exchanged to establish the SA. */
#define IPIKE_ID_DER_ASN1_GN 10
/* The ID_KEY_ID type specifies an opaque byte stream which may be used
to pass vendor-specific information necessary to identify which pre-
shared key should be used to authenticate Aggressive mode
negotiations. */
#define IPIKE_ID_KEY_ID 11
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
Identification Payload Format
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Next Payload ! RESERVED ! Payload Length !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! ID Type ! RESERVED !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! !
~ Identification Data ~
! !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
*/
typedef struct Ipike2_identification_payload_struct
{
/* The generic ISAKMP payload header, the length includes the length
of all transforms associated with the proposal */
Ipike_payload_header header;
/* Value describing the identity information found in the
Identification Data field. */
Ip_u8 id_type;
/* Reserved */
Ip_u8 reserved[3];
}
Ipike2_id_payload;
typedef struct Ipike2_identification_struct
{
/* The id payload struct */
Ipike2_id_payload info;
/* Initiator or responder id */
Ip_bool initiator;
/* The identification data */
Ipike_value data;
}
Ipike2_id;
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_payload_identification_generate
*===========================================================================
* Description: Generate an id structure from the configuration.
* Parameters: value - configuration value specifying the id.
* initiator - TRUE if the structure is for the initiator.
* id - the id that will get the values.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
* IPIKE_CONF_VALUE_NOT_FOUND
*/
IP_GLOBAL Ipike_error
ipike_payload_identification_generate(
const char* value,
Ip_bool initiator,
Ipike2_id* id);
/*
*===========================================================================
* ipike_payload_identification_free
*===========================================================================
* Description: Free memory allocated for id structure.
* Parameters: id - the structure to be released.
* Returns:
*/
IP_GLOBAL void
ipike_payload_identification_free(Ipike2_id* id);
/*
*===========================================================================
* ipike_payload_identification_create
*===========================================================================
* Description: Creates a new identification payload from the information
* created in the exchange.
* Parameters: id - the identification structure to encode into a ISAKMP
* payload.
* payload - will point to a new identification payload.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_identification_create(
Ipike2_id* id,
Ipike2_id_payload** payload);
/*
*===========================================================================
* ipike_payload_identification_check
*===========================================================================
* Description: Verifies that the identification payload is sane.
* Parameters: id - a pointer to a identification payload.
* Returns: IPIKE_SUCCESS
* IPIKE_ISAKMP_INVALID_SYNTAX
*/
IP_GLOBAL Ipike_error
ipike_payload_identification_check(Ipike2_id_payload* id);
/*
*===========================================================================
* ipike_payload_identification_print
*===========================================================================
* Description: Prints the content of the identification payload to the
* system log.
* Parameters: id - a pointer to identification payload.
* Returns:
*/
IP_GLOBAL void
ipike_payload_identification_print(Ipike2_id_payload* id);
/*
*===========================================================================
* ipike_payload_identification_extract
*===========================================================================
* Description: Extracts the identification data from the payload.
* Parameters: payload - a identification payload.
* identification - will be updated with the identification data
* if the call was successful.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_identification_extract(
Ipike2_id_payload* payload,
Ipike2_id* id);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike2_payload_key_exchange.c
+253
View File
@@ -0,0 +1,253 @@
/*
******************************************************************************
* SOURCE FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike2_payload_key_exchange.c,v $ $Revision: 1.8.16.2 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike2_payload_key_exchange.c,v $
* $Author: edahlber $ $Date: 2012-02-03 08:46:46 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Key exchange payload (IKE version 2) */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#ifdef IPIKE_USE_VERSION2
#include "ipike_h.h"
#include "ipike_attributes.h"
#include "ipike2_payload_key_exchange.h"
#include "ipike_util.h"
#include "ipike_crypto.h"
#include "ipike_sadb.h"
#include <ipcom_clib.h>
#include <ipcom_syslog.h>
/*
****************************************************************************
* 4 EXTERN PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 5 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 6 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 7 LOCAL PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 8 DATA
****************************************************************************
*/
/*
****************************************************************************
* 9 LOCAL FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_payload_key_exchange_data
*===========================================================================
* Description: Returns a pointer to the key exchange data in the payload.
* Parameters: ke - a key exchange payload.
* Returns: A pointer to the key exchange data.
*/
IP_STATIC Ip_u8*
ipike_payload_key_exchange_data(Ipike2_ke_payload* ke)
{
return (Ip_u8*)ke + sizeof(Ipike2_ke_payload);
}
/*
*===========================================================================
* ipike_payload_key_exchange_data_length
*===========================================================================
* Description: Returns the length of the key exchange data.
* Parameters: ke - key exchange payload.
* Returns: The length of the key exchange data (in bytes).
*/
IP_STATIC Ip_u16
ipike_payload_key_exchange_data_length(Ipike2_ke_payload* ke)
{
return IPIKE_PAYLOAD_DATA_LENGTH(ke->header.length, sizeof(Ipike2_ke_payload));
}
/*
****************************************************************************
* 10 PUBLIC FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_payload_key_exchange_create
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_key_exchange_create(
Ip_u16 group,
Ipike_value* key,
Ipike2_ke_payload** payload)
{
Ipike2_ke_payload* ke_payload;
/* Return null if no dh group specified/wanted */
if ((group == 0) || (key->len == 0))
{
*payload = IP_NULL;
return IPIKE_SUCCESS;
}
if (IP_NULL == (ke_payload = ipcom_calloc(1, sizeof(Ipike2_ke_payload) + key->len)))
{
IP_PANIC();
return IPIKE_OUT_OF_MEMORY;
}
ke_payload->header.length = (Ip_u16)(sizeof(*ke_payload) + key->len);
ke_payload->header.length = ip_htons(ke_payload->header.length);
ke_payload->header.next_payload = IPIKE2_PAYLOAD_KEY_EXCHANGE;
ke_payload->dh_group = ip_htons(group);
ipcom_memcpy(ipike_payload_key_exchange_data(ke_payload), key->value, key->len);
*payload = ke_payload;
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_payload_key_exchange_check
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_key_exchange_check(Ipike2_ke_payload* ke)
{
(void)ke;
/* Nothing to check for this payload */
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_payload_key_exchange_extract
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_key_exchange_extract(
Ipike2_ke_payload* payload,
Ip_u16* group,
Ipike_value* key)
{
key->len = ipike_payload_key_exchange_data_length(payload);
ipcom_free(key->value);
key->value = ipcom_malloc(key->len);
if (key->value == IP_NULL)
{
IP_PANIC();
return IPIKE_OUT_OF_MEMORY;
}
ipcom_memcpy(key->value, ipike_payload_key_exchange_data(payload), key->len);
*group = ip_htons(payload->dh_group);
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_payload_key_exchange_print
*===========================================================================
*/
IP_GLOBAL void
ipike_payload_key_exchange_print(Ipike2_ke_payload* ke)
{
IPCOM_LOG1(DEBUG2, " dh group: '%s'",
ipike_attribute_dh_group_to_string(ip_htons(ke->dh_group)));
(void)ipike_print_memory(IPCOM_LOG_DEBUG2, " data:\n",
ipike_payload_key_exchange_data(ke),
ipike_payload_key_exchange_data_length(ke));
}
/*
*===========================================================================
* ipike_payload_key_exchange_generate
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_key_exchange_generate(Ip_u16 group, DH **dh, Ipike_value *pub)
{
Ipike_error err;
const Ipike_value* dh_prime;
Ip_u32 dh_generator;
/* Diffie-Hellman group must be specified */
if (group == 0 || group == IPIKE_ATTR_INVALID)
return IPIKE_FAILED; /* Should never happen */
/* Get static values for this group */
dh_prime = ipike_attribute_get_dh_prime(group);
dh_generator = ipike_attribute_get_dh_generator(group);
if (IP_NULL == dh_prime || IP_NULL == dh_prime)
return IPIKE_FAILED; /* Should never happen */
/* Generate a new key */
err = ipike_crypto_generate_dh_key(dh_prime, dh_generator, dh, pub);
if (err != IPIKE_SUCCESS)
{
IPCOM_LOG0(CRIT, "ipike_payload_key_exchange_generate: failed to generate diffie hellman key");
}
return err;
}
#else
int ipike_payload_key_exchange_empty_file = 0;
#endif /* IPIKE_USE_VERSION2 */
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike2_payload_key_exchange.h
+184
View File
@@ -0,0 +1,184 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike2_payload_key_exchange.h,v $ $Revision: 1.4.16.1 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike2_payload_key_exchange.h,v $
* $Author: edahlber $ $Date: 2012-02-03 08:46:46 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#if !defined(IPIKE2_PAYLOAD_KEY_EXCHANGE_H) && defined(IPIKE_USE_VERSION2)
#define IPIKE2_PAYLOAD_KEY_EXCHANGE_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Key Exchange payload (IKE version 2) */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_payload.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
Key Exchange Payload Format
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Next Payload ! RESERVED ! Payload Length !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! DH Group # ! RESERVED ! !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! !
~ Key Exchange Data ~
! !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
*/
typedef struct Ipike2_ke_payload_struct
{
/* The generic ISAKMP payload header, the length includes the length
of all transforms associated with the proposal */
Ipike_payload_header header;
/* DH Group */
Ip_u16 dh_group;
/* Reserved */
Ip_u16 reserved;
/* Key exchange data follows */
}
Ipike2_ke_payload;
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_payload_key_exchange_create
*===========================================================================
* Description: Creates a new key exchange payload from the information
* created in the exchange.
* Parameters: group - the diffie-hellman group used to generate the key
* key - the public part of the diffie-hellman key.
* payload - Will point to a new key exchange payload if the call
* was successful.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*
*/
IP_GLOBAL Ipike_error
ipike_payload_key_exchange_create(
Ip_u16 group,
Ipike_value* key,
Ipike2_ke_payload** payload);
/*
*===========================================================================
* ipike_payload_key_exchange_check
*===========================================================================
* Description: Verifies that the key exchange payload is sane.
* Parameters: ke - a pointer to a key exchange payload.
* Returns: IPIKE_SUCCESS
*
*
*/
IP_GLOBAL Ipike_error
ipike_payload_key_exchange_check(Ipike2_ke_payload* ke);
/*
*===========================================================================
* ipike_payload_key_exchange_print
*===========================================================================
* Description: Prints the content of the key exchange payload to the
* system log.
* Parameters: ke - a pointer to a key exchange payload.
* Returns:
*
*
*/
IP_GLOBAL void
ipike_payload_key_exchange_print(Ipike2_ke_payload* ke);
/*
*===========================================================================
* ipike_payload_key_exchange_extract
*===========================================================================
* Description: Extracts the key exchange data from the payload.
* Parameters: payload - a key exchange payload.
* group - will be updated with the diffie-hellman group if the
* call was successful.
* key - will be updated with the public key data if the call
* was successful.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*
*/
IP_GLOBAL Ipike_error
ipike_payload_key_exchange_extract(
Ipike2_ke_payload* payload,
Ip_u16* group,
Ipike_value* key);
/*
*===========================================================================
* ipike_payload_key_exchange_generate
*===========================================================================
* Description: Generate key exchange data.
* Parameters: group - the diffie-hellman group that should be used.
* dh - pointer to the generated key
* pub - the public part of the generated key.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*
*/
IP_GLOBAL Ipike_error
ipike_payload_key_exchange_generate(Ip_u16 group, DH** dh, Ipike_value* pub);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike2_payload_notify.c
+1923
View File
File diff suppressed because it is too large Load Diff
components/ip_net2-6.9/ipike/src/ipike2_payload_notify.h
+510
View File
@@ -0,0 +1,510 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike2_payload_notify.h,v $ $Revision: 1.12.10.1 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike2_payload_notify.h,v $
* $Author: svc-cmnet $ $Date: 2013-03-13 07:45:26 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#if !defined(IPIKE2_PAYLOAD_NOTIFICATION_H) && defined(IPIKE_USE_VERSION2)
#define IPIKE2_PAYLOAD_NOTIFICATION_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Notification payload (IKE version 2) */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_payload.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
#define IPIKE_NOTIFY_HEADER_LENGTH sizeof(Ipike2_notify_payload)
#define IPIKE_NOTI_ERR_UNSUPPORTED_CRITICAL_PAYLOAD 1
#define IPIKE_NOTI_ERR_INVALID_IKE_SPI 4
#define IPIKE_NOTI_ERR_INVALID_MAJOR_VERSION 5
#define IPIKE_NOTI_ERR_INVALID_SYNTAX 7
#define IPIKE_NOTI_ERR_INVALID_MESSAGE_ID 9
#define IPIKE_NOTI_ERR_INVALID_SPI 11
#define IPIKE_NOTI_ERR_NO_PROPOSAL_CHOSEN 14
#define IPIKE_NOTI_ERR_KE_PAYLOAD 17
#define IPIKE_NOTI_ERR_INVALID_ID_INFORMATION 18
#define IPIKE_NOTI_ERR_AUTHENTICATION_FAILED 24
#define IPIKE_NOTI_ERR_SINGLE_PAIR_REQUIRED 34
#define IPIKE_NOTI_ERR_NO_ADDITIONAL_SAS 35
#define IPIKE_NOTI_ERR_INTERNAL_ADDRESS_FAILURE 36
#define IPIKE_NOTI_ERR_FAILED_CP_REQUIRED 37
#define IPIKE_NOTI_ERR_TS_UNACCEPTABLE 38
#define IPIKE_NOTI_ERR_INVALID_SELECTORS 39
#define IPIKE_NOTI_ERR_UNACCEPTABLE_ADDRESSES 40
#define IPIKE_NOTI_ERR_UNEXPECTED_NAT_DETECTED 41
#define IPIKE_NOTI_ERR_TEMPORARY_FAILURE 43
#define IPIKE_NOTI_ERR_CHILD_SA_NOT_FOUND 44
#define IPIKE_NOTI_ERR_PRIVATE_USE_LOW 8191
#define IPIKE_NOTI_ERR_PRIVATE_USE_HIGH 16383
#define IPIKE_NOTI_INF_INITIAL_CONTACT 16384
#define IPIKE_NOTI_INF_SET_WINDOW_SIZE 16385
#define IPIKE_NOTI_INF_ADDITIONAL_TS_POSSIBLE 16386
#define IPIKE_NOTI_INF_IPCOMP_SUPPORTED 16387
#define IPIKE_NOTI_INF_NAT_DETECTION_SOURCE_IP 16388
#define IPIKE_NOTI_INF_NAT_DETECTION_DESTINATION_IP 16389
#define IPIKE_NOTI_INF_COOKIE 16390
#define IPIKE_NOTI_INF_USE_TRANSPORT_MODE 16391
#define IPIKE_NOTI_INF_HTTP_CERT_LOOKUP_SUPPORTED 16392
#define IPIKE_NOTI_INF_REKEY_SA 16393
#define IPIKE_NOTI_INF_ESP_TFC_PADDING_NOT_SUPPORTED 16394
#define IPIKE_NOTI_INF_NON_FIRST_FRAGMENTS_ALSO 16395
#define IPIKE_NOTI_INF_MOBIKE_SUPPORTED 16396
#define IPIKE_NOTI_INF_ADDITIONAL_IP4_ADDRESS 16397
#define IPIKE_NOTI_INF_ADDITIONAL_IP6_ADDRESS 16398
#define IPIKE_NOTI_INF_NO_ADDITIONAL_ADDRESSES 16399
#define IPIKE_NOTI_INF_UPDATE_SA_ADDRESSES 16400
#define IPIKE_NOTI_INF_COOKIE2 16401
#define IPIKE_NOTI_INF_NO_NATS_ALLOWED 16402
#define IPIKE_NOTI_INF_ROHC_SUPPORTED 16416
#define IPIKE_NOTI_INF_PRIVATE_USE_LOW 40960
#define IPIKE_NOTI_INF_PRIVATE_USE_HIGH 65535
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
Notify Payload Format
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Next Payload ! RESERVED ! Payload Length !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Protocol-ID ! SPI Size ! Notify Message Type !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! !
~ Security Parameter Index (SPI) ~
! !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! !
~ Notification Data ~
! !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
*/
typedef struct Ipike2_notify_payload_struct
{
/* The generic ISAKMP payload header, the length includes the length
of all transforms associated with the proposal */
Ipike_payload_header header;
/* Specifies the protocol identifier for the current notification.
Examples might include ISAKMP, IPSEC ESP, IPSEC AH, OSPF, TLS, etc. */
Ip_u8 protocol_id;
/* Length in octets of the SPI as defined by the Protocol-Id. */
Ip_u8 spi_size;
/* Specifies the type of notification message. Additional text, if
specified by the DOI, is placed in the Notification Data field. */
Ip_u16 message_type;
/* SPI and notification data follows */
}
Ipike2_notify_payload;
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_payload_notify_message_type_to_string
*===========================================================================
* Description: Returns a string representation of the notify message type.
* Parameters: message_type - a message type.
* Returns: A string representation of the notify message type.
*
*/
IP_PUBLIC const char*
ipike_payload_notify_message_type_to_string(Ip_u16 message_type);
/*
*===========================================================================
* ipike_payload_notify_error_to_message_type
*===========================================================================
* Description: Converts an ipike error code to a notification message type.
* Parameters: err - a standard ipike error code.
* message_type - a message type.
* Returns: IPIKE_SUCCESS
* IPIKE_INVALID_VALUE
*
*/
IP_PUBLIC Ipike_error
ipike_payload_notify_error_to_message_type(
Ipike_error err,
Ip_u16* message_type);
/*
*===========================================================================
* ipike_payload_notify_add_error_reply
*===========================================================================
* Description: Adds all payloads that should part of the response.
* Parameters: ie - the state of this exchange (this pointer).
* reply_payloads - pointer to an array of payload pointers.
* The array will be allocated by this function.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
* IPIKE_ISAKMP_UNSUPPORTED_PAYLOAD
*/
IP_PUBLIC Ipike_error
ipike_payload_notify_add_error_reply(
Ipike_isakmp_exchange* ie,
Ipike_payload_header*** reply_payloads);
/*
*===========================================================================
* ipike_payload_notify_new
*===========================================================================
* Description: Creates a new hash payload.
* Parameters: protocol_id - the protocol identifier.
* message_type - specifies the type of the notification
* message.
* spi - the SPI data.
* spi_len - the length of the SPI data.
* data - additional notification data.
* data_len - the length of the notification data.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_notify_create(
Ip_u8 protocol_id,
Ip_u16 message_type,
Ipike_value* spi,
Ipike_value* data,
Ipike2_notify_payload** payload);
/*
*===========================================================================
* ipike_payload_notify_check
*===========================================================================
* Description: Verifies that the notification payload is sane.
* Parameters: notify - a pointer to a notification payload.
* Returns: IPIKE_SUCCESS
*
*/
IP_GLOBAL Ipike_error
ipike_payload_notify_check(Ipike2_notify_payload* notify);
/*
*===========================================================================
* Ipike_payload_notify_print
*===========================================================================
* Description: Prints the content of the notification payload to the
* system log.
* Parameters: hash - a pointer to notification payload.
* Returns:
*
*
*/
IP_GLOBAL void
Ipike_payload_notify_print(Ipike2_notify_payload* notify);
/*
*===========================================================================
* ipike_payload_notify_process
*===========================================================================
* Description: Process the notification message, the affected exchange may
* be aborted. Invalid notification messages will be dropped.
* Parameters: ie - the exchange
* payload - a notification payload.
* Returns: IPIKE_SUCCESS
* IPIKE_EXCH_FINNISHED
*
*/
IP_GLOBAL Ipike_error
ipike_payload_notify_process(
Ipike_isakmp_exchange* ie,
Ipike2_notify_payload* payload);
/*
*===========================================================================
* ipike_payload_notify_process
*===========================================================================
* Description: Process the cookie notification message.
* Parameters: ie - the exchange
* payload - a notification payload.
* Returns: IPIKE_SUCCESS
* IPIKE_EXCH_FINNISHED
*
*/
IP_GLOBAL Ipike_error
ipike_payload_notify_process_cookie(
Ipike_isakmp_exchange* ie,
Ipike2_notify_payload* payload);
/*
*===========================================================================
* ipike_payload_notify_process
*===========================================================================
* Description: Process the rekey notification message.
* Parameters: ie - the exchange
* payload - a notification payload.
* Returns: IPIKE_SUCCESS
* IPIKE_EXCH_FINNISHED
*
*/
IP_GLOBAL Ipike_error
ipike_payload_notify_process_rekey(
Ipike_isakmp_exchange* ie,
Ipike2_notify_payload* payload);
/*
*===========================================================================
* ipike_payload_notify_transport_mode
*===========================================================================
* Description: Create a notify payload that request transport mode.
* Parameters: payload - a notification payload.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_notify_transport_mode(Ipike2_notify_payload** payload);
/*
*===========================================================================
* ipike_payload_notify_dont_use_tfc
*===========================================================================
* Description: Create a notify payload that disables tfc(send direction)
* Parameters: payload - a notification payload.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_notify_dont_use_tfc(Ipike2_notify_payload** payload);
/*
*===========================================================================
* ipike_payload_notify_rekey_sa
*===========================================================================
* Description: Create a notify payload that request transport mode.
* Parameters: payload - a notification payload.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_notify_rekey_sa(
Ip_u16 proto_id,
Ipike_value* spi,
Ipike2_notify_payload** payload);
/*
*===========================================================================
* ipike_payload_notify_nat_detection
*===========================================================================
* Description: Create a notify payload for nat detection.
* Parameters: ie - the exchange
* source - TRUE if the address is a source address. FALSE if
* address is a destionation address.
* payload - a generated notification payload.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_notify_nat_detection(
Ipike_isakmp_exchange* ie,
Ip_bool source,
Ipike2_notify_payload** payload);
/*
*===========================================================================
* ipike_payload_notify_cookie
*===========================================================================
* Description: Create a notify payload for cookie payload.
* Parameters: payload - a notification payload.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_notify_cookie(
Ipike_isakmp_exchange* ie,
Ipike_value* cookie,
Ipike2_notify_payload** payload);
/*
*===========================================================================
* ipike_payload_notify_initial_contact
*===========================================================================
* Description: Create a notify payload for initial contact payload.
* Parameters: payload - a notification payload.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_notify_initial_contact(
Ipike2_notify_payload** payload);
/*
*===========================================================================
* ipike_payload_notify_mobike_supported
*===========================================================================
* Description: Create a notify payload for mobike supported payload.
* Parameters: payload - a notification payload.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_notify_mobike_supported(
Ipike2_notify_payload** payload);
/*
*===========================================================================
* ipike_payload_notify_additional_ip_address
*===========================================================================
* Description: Create a notify payload for additional ip address payload.
* Parameters: addr - additional ip address
* payload - a notification payload.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_notify_additional_ip_address(
union Ip_sockaddr_union* addr,
Ipike2_notify_payload** payload);
/*
*===========================================================================
* ipike_payload_notify_no_additional_addresses
*===========================================================================
* Description: Create a notify payload for no additional address payload.
* Parameters: payload - a notification payload.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_notify_no_additional_addresses(
Ipike2_notify_payload** payload);
/*
*===========================================================================
* ipike_payload_notify_update_sa_addresses
*===========================================================================
* Description: Create a notify payload for update sa addresses payload.
* Parameters: payload - a notification payload.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_notify_update_sa_addresses(
Ipike2_notify_payload** payload);
/*
*===========================================================================
* ipike_payload_notify_cookie2
*===========================================================================
* Description: Create a notify payload for cookie2 payload.
* Parameters: cookie2 - the cookie2 data
* payload - a notification payload.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_notify_cookie2(
Ipike_value* cookie2,
Ipike2_notify_payload** payload);
/*
*===========================================================================
* ipike_payload_notify_no_nats_allowed
*===========================================================================
* Description: Create a notify payload for no nats allowed payload.
* Parameters: src_addr - source ip address
* dst_addr - destination ip address
* payload - a notification payload.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_notify_no_nats_allowed(
union Ip_sockaddr_union* src_addr,
union Ip_sockaddr_union* dst_addr,
Ipike2_notify_payload** payload);
/*
*===========================================================================
* ipike_payload_notify_http_cert_lookup_support
*===========================================================================
* Description: Creates a notify payload notifying support for "Hash and URL"
* Parameters: payload - a notification payload.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_notify_http_cert_lookup_support(
Ipike2_notify_payload** payload);
#ifdef IPIKE_USE_ROHC
/*
*===========================================================================
* ipike_payload_notify_rohc
*===========================================================================
* Description: Creates a notify payload containing ROHC parameters
* Parameters: payload - a notification payload.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_notify_rohc(
Ipike2_notify_payload** payload,
Ipike_isakmp_exchange* ie);
#endif /* IPIKE_USE_ROHC */
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike2_payload_sa.c
+2405
View File
File diff suppressed because it is too large Load Diff
components/ip_net2-6.9/ipike/src/ipike2_payload_sa.h
+489
View File
@@ -0,0 +1,489 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike2_payload_sa.h,v $ $Revision: 1.10.16.1 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike2_payload_sa.h,v $
* $Author: svc-cmnet $ $Date: 2013-03-13 07:45:26 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#if !defined(IPIKE2_PAYLOAD_SA_H) && defined(IPIKE_USE_VERSION2)
#define IPIKE2_PAYLOAD_SA_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* IKE Security Association Payload (IKE version 2) */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_payload.h"
#include "ipike_payload_sa.h"
#include "ipike_attributes.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/* Transform types */
#define IPIKE_TRANSFORM_TYPE_ENCR 1
#define IPIKE_TRANSFORM_TYPE_PRF 2
#define IPIKE_TRANSFORM_TYPE_INTEG 3
#define IPIKE_TRANSFORM_TYPE_DH 4
#define IPIKE_TRANSFORM_TYPE_ESN 5
/* Transform IDs for IPIKE_TRANSFORM_TYPE_ENCR */
#define IPIKE_ENCR_DES_IV64 1
#define IPIKE_ENCR_DES 2
#define IPIKE_ENCR_3DES 3
#define IPIKE_ENCR_RC5 4
#define IPIKE_ENCR_IDEA 5
#define IPIKE_ENCR_CAST 6
#define IPIKE_ENCR_BLOWFISH 7
#define IPIKE_ENCR_3IDEA 8
#define IPIKE_ENCR_DES_IV32 9
#define IPIKE_ENCR_NULL 11
#define IPIKE_ENCR_AES_CBC 12
#define IPIKE_ENCR_AES_CTR 13
/* Transform IDs for IPIKE_TRANSFORM_TYPE_PRF */
#define IPIKE_PRF_HMAC_MD5 1
#define IPIKE_PRF_HMAC_SHA1 2
#define IPIKE_PRF_HMAC_TIGER 3
#define IPIKE_PRF_AES128_CBC 4
#define IPIKE_PRF_HMAC_SHA2_256 5
#define IPIKE_PRF_HMAC_SHA2_384 6
#define IPIKE_PRF_HMAC_SHA2_512 7
/* Transform IDs for IPIKE_TRANSFORM_TYPE_INTEG */
#define IPIKE_AUTH_NONE 0
#define IPIKE_AUTH_HMAC_MD5_96 1
#define IPIKE_AUTH_HMAC_SHA1_96 2
#define IPIKE_AUTH_DES_MAC 3
#define IPIKE_AUTH_KPDK_MD5 4
#define IPIKE_AUTH_AES_XCBC_96 5
#define IPIKE_AUTH_HMAC_SHA2_256_128 12
#define IPIKE_AUTH_HMAC_SHA2_384_192 13
#define IPIKE_AUTH_HMAC_SHA2_512_256 14
/* Transform IDs for IPIKE_TRANSFORM_TYPE_DH */
#define IPIKE_DH_GROUP_1 1
#define IPIKE_DH_GROUP_2 2
#define IPIKE_DH_GROUP_5 5
#define IPIKE_DH_GROUP_14 14
#define IPIKE_DH_GROUP_15 15
#define IPIKE_DH_GROUP_16 16
#define IPIKE_DH_GROUP_17 17
#define IPIKE_DH_GROUP_18 18
/* Transform IDs for IPIKE_TRANSFORM_TYPE_ESN */
#define IPIKE_ESN_OFF 0
#define IPIKE_ESN_ON 1
/* Tranform ID values */
#define IPIKE_TRANSFORM_UNKNOWN 0x8000
#define IPIKE_TRANSFORM_IGNORE 0x8001
#define IPIKE_TRANSFORM_INVALID 0xFFFF
/*
Transform struct
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! 0 (last) or 3 ! RESERVED ! Transform Length !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
!Transform Type ! RESERVED ! Transform ID !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! !
~ Transform Attributes ~
! !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
*/
typedef struct Ipike2_transform_info_struct
{
/* 0 (last or 3 if more) */
Ip_u8 more;
/* Reserved */
Ip_u8 reserved;
/* Transform length */
Ip_u16 length;
/* Tranform type */
Ip_u8 type;
/* Reserved */
Ip_u8 reserved2;
/* Transform identifier */
Ip_u16 id;
}
Ipike2_transform_info;
typedef struct Ipike2_transform_struct
{
/* The tranform info struct */
Ipike2_transform_info info;
/* Attributes(s) for this transform */
Ipike_attribute** attributes;
}
Ipike2_transform;
/*
Proposal struct
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! 0 (last) or 2 ! RESERVED ! Proposal Length !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Proposal # ! Protocol-ID ! SPI Size !# of Transforms!
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
~ SPI (variable) ~
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! !
~ Transforms ~
! !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
*/
typedef struct Ipike2_proposal_info_struct
{
/* 0 (last or 2 if more) */
Ip_u8 more;
/* Reserved */
Ip_u8 reserved;
/* Length of the proposal struct */
Ip_u16 length;
/* The number of the selected proposal */
Ip_u8 number;
/* Specifies the protocol identifier for the current negotiation.
Examples might include IKE, ESP, AH, etc.*/
Ip_u8 proto_id;
/* SPI size */
Ip_u8 spi_size;
/* # of transforms */
Ip_u8 transform_count;
/* SPI and Tranform data */
}
Ipike2_proposal_info;
typedef struct Ipike2_proposal_struct
{
/* The proposal info struct */
Ipike2_proposal_info info;
/* The Security Parameter Index (SPI) as defined by the Protocol-ID. */
Ip_u8 spi[8];
/* Transform(s) for this proposal */
Ipike2_transform** transforms;
}
Ipike2_proposal;
/*
Security Association Payload
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Next Payload ! RESERVED ! Payload Length !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! !
~ Proposals ~
! !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
*/
typedef struct Ipike2_sa_payload_struct
{
/* The generic payload header, the length includes the length of the
proposal and transform payloads */
Ipike_payload_header header;
/* Proposals follows */
}
Ipike2_sa_payload;
/* Holds the parameters from the SA payload */
typedef struct Ipike2_sa_struct
{
/* More than 1 proposal can be selected (ex. AH + ESP is two different
proposals that can be active at the same time). All proposal in the
selected set (must) have the same proposal number */
/* The index of the first selected proposal */
int selected_proposal;
/* The number of proposal in this SA */
int proposal_count;
/* Proposal(s) for this SA */
Ipike2_proposal** proposals;
/* Selected transforms */
Ip_u16 selected_encr;
Ip_u16 selected_prf;
Ip_u16 selected_integ;
Ip_u16 selected_dh;
Ip_u16 selected_esn;
/* Selected attributes */
Ip_u16 selected_key_length;
/* Selected protocol id */
Ip_u8 proto_id;
}
Ipike2_sa;
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_sa_transform_id_available
*===========================================================================
* Description: Return true/false depending of availability of transform.
* Parameters: type - type of transfrom.
* id - id of transforn
* Returns: IP_TRUE if available (else IP_FALSE)
*
*/
IP_GLOBAL Ip_bool
ipike_sa_transform_id_available(Ip_u8 type, Ip_u16 id);
/*
*===========================================================================
* ipike_sa_transform_id_from_string
*===========================================================================
* Description: Return transfrom if from a string representation.
* Parameters: type - type of transfrom.
* s - string representation of transfrom.
* Returns: Transform id or IPIKE_ATTR_INVALID if not found
*
*/
IP_GLOBAL Ip_u16
ipike_sa_transform_id_from_string(Ip_u8 type, const char * s);
/*
*===========================================================================
* ipike_payload_sa_create
*===========================================================================
* Description: Creates a new SA payload from the information collected
* in the exchange.
* Parameters: sa - the SA to encode in to a ISAKMP payload.
* payload - will point to a new SA payload if the call was
* successful.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*
*/
IP_GLOBAL Ipike_error
ipike_payload_sa_create(Ipike2_sa* sa, Ipike2_sa_payload** payload);
/*
*===========================================================================
* ipike_payload_sa_free
*===========================================================================
* Description: Frees all resource allocated by the SA structure.
* Parameters: sa - The SA structure to free.
* free_func - The function to use when freeing the 'sa'.
* Pass IP_NULL if 'sa' is located on the stack.
* Returns:
*
*/
IP_GLOBAL void
ipike_payload_sa_free(Ipike2_sa* sa, void(*free_func)(void*));
/*
*===========================================================================
* ipike_payload_sa_initialize
*===========================================================================
* Description: Creates a new IKE/IPSec SA from the proposals for the peer
* host.
* Parameters: is_ike - TRUE if IKE SA (otherwise IPSec SA)
* proposals - The configuration where information about the
* exchange can be found.
* sa - Will contain a initilized IKE SA if the call was
* successful.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
* IPIKE_CONF_VALUE_NOT_FOUND
*/
IP_GLOBAL Ipike_error
ipike_payload_sa_initialize(
Ip_bool is_ike,
Ipike_config_proposal** proposals,
Ipike2_sa* sa);
/*
*===========================================================================
* ipike_payload_sa_check
*===========================================================================
* Description: Verifies that the security association payload is sane.
* Parameters: sa - a pointer to a SA payload.
* Returns: IPIKE_SUCCESS
* IPIKE_ISAKMP_PAYLOAD_LENGTH_ERROR
* IPIKE_ISAKMP_INVALID_SYNTAX
*/
IP_GLOBAL Ipike_error
ipike_payload_sa_check(Ipike2_sa_payload* sa);
/*
*===========================================================================
* ipike_payload_sa_print
*===========================================================================
* Description: Prints the content of a SA payload to the system log.
* Parameters: sa - a pointer to a SA payload.
* Returns:
*/
IP_GLOBAL void
ipike_payload_sa_print(Ipike2_sa_payload* sa);
/*
*===========================================================================
* ipike_payload_sa_extract
*===========================================================================
* Description: Extracts the SA from the payload.
* Parameters: payload - A SA payload.
* sa - Will be updated with the parameters from the SA payload
* if the call was successful.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_sa_extract(Ipike2_sa_payload *payload, Ipike2_sa *sa);
/*
*===========================================================================
* ipike_payload_sa_set_spi
*===========================================================================
* Description: Set spi value for all SA proposals.
* Parameters: sa - Will be updated with the new spi value if the call was
* successful.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_sa_set_spi(Ipike2_sa* sa, Ip_u8* spi_data, Ip_u16 spi_len);
/*
*===========================================================================
* ipike_transform_???_to_string
*===========================================================================
* Description: Get description for the specified algorithm id.
* id - Algorithm id
* Returns: The description
*/
IP_GLOBAL const char *
ipike_transform_encryption_to_string(Ip_u16 id);
IP_GLOBAL const char *
ipike_transform_integrity_to_string(Ip_u16 id);
IP_GLOBAL const char *
ipike_transform_hash_to_string(Ip_u16 id);
IP_GLOBAL const char *
ipike_transform_dh_group_to_string(Ip_u16 id);
IP_GLOBAL const char *
ipike_transform_esn_to_string(Ip_u16 id);
/*
*===========================================================================
* ipike_proposal_get_first_transform
*===========================================================================
* Description: Get next transform id of specified type from the SA structure
* sa - the SA
* type - type of transform, i.e. encr, prf, integ, dh
* old_id - last returned id or 0 if first.
* Returns: The found id or 0xffff
*/
IP_GLOBAL Ip_u16
ipike_proposal_get_next_transform(Ipike2_sa* sa, Ip_u16 type, Ip_u16 old_id);
/*
*===========================================================================
* ipike_proposal_has_transform
*===========================================================================
* Description: Get next transform id of specified type from the proposal
* structure.
* proposal - the proposal
* type - type of transform, i.e. encr, prf, integ, dh
* id - the id of the transform.
* Returns: TRUE if found else FALSE
*/
IP_GLOBAL Ip_bool
ipike_proposal_has_transform(Ipike2_proposal* proposal, Ip_u16 type, Ip_u16 id);
/*
*===========================================================================
* ipike_proposal_has_transform_type
*===========================================================================
* Description: Verify that the transform type is present in the proposal
* proposal - the proposal
* type - type of transform, i.e. encr, prf, integ, dh
* Returns: TRUE if found else FALSE
*/
IP_GLOBAL Ip_bool
ipike_proposal_has_transform_type(Ipike2_proposal* proposal, Ip_u16 type);
/*
*===========================================================================
* ipike_proposal_remove_transform_type
*===========================================================================
* Description: Remove all transforms of a specified type in the proposals
* for the sa.
* sa - the sa
* type - type of transform, i.e. encr, prf, integ, dh
* Returns:
*/
IP_GLOBAL void
ipike_proposal_remove_transform_type(Ipike2_sa* sa, Ip_u16 type);
/*
*===========================================================================
* ipike_transform_get_key_length
*===========================================================================
* Description: Get key length of specified (encryption) transform from
* attributes list.
* transform - the transfrom
* Returns: key length if specified else 0
*/
IP_GLOBAL Ip_u16
ipike_transform_get_key_length(Ipike2_transform* transform);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike2_payload_traffic_selector.c
+955
View File
@@ -0,0 +1,955 @@
/*
******************************************************************************
* SOURCE FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike2_payload_traffic_selector.c,v $ $Revision: 1.24.16.6 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike2_payload_traffic_selector.c,v $
* $Author: zan $ $Date: 2013-08-08 10:08:20 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Traffic selector payload (IKE version 2) */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#ifdef IPIKE_USE_VERSION2
#include "ipike_h.h"
#include "ipike_configuration.h"
#include "ipike_attributes.h"
#include "ipike2_payload_traffic_selector.h"
#include "ipike_util.h"
#include "ipike_sadb.h"
#include <ipcom_clib.h>
#include <ipcom_syslog.h>
/*
****************************************************************************
* 4 EXTERN PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 5 DEFINES
****************************************************************************
*/
#ifndef min
#define min(a,b) ((a) < (b) ? (a) : (b))
#endif
#ifndef max
#define max(a,b) ((a) > (b) ? (a) : (b))
#endif
/*
****************************************************************************
* 6 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 7 LOCAL PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 8 DATA
****************************************************************************
*/
/*
****************************************************************************
* 9 LOCAL FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_payload_traffic_selector_data
*===========================================================================
* Description: Returns a pointer to the traffic selector data in the
* payload.
* Parameters: ts - a traffic selector payload.
* Returns: A pointer to the traffic selector data.
*/
IP_STATIC Ip_u8*
ipike_payload_traffic_selector_data(Ipike2_ts_payload* ts)
{
return (Ip_u8*)ts + sizeof(Ipike2_ts_payload);
}
/*
*===========================================================================
* ipike_payload_traffic_selector_data_length
*===========================================================================
* Description: Returns the length of the traffic selector data.
* Parameters: ts - traffic selector payload.
* Returns: The length of the traffic selector data (in bytes).
*/
IP_STATIC Ip_u16
ipike_payload_traffic_selector_data_length(Ipike2_ts_payload* ts)
{
return IPIKE_PAYLOAD_DATA_LENGTH(ts->header.length, sizeof(Ipike2_ts_payload));
}
/*
*===========================================================================
* ipike_payload_traffic_selector_next
*===========================================================================
*/
IP_STATIC Ip_size_t
ipike_payload_traffic_selector_next(
Ip_u8* data,
Ip_size_t size,
Ip_u8* type,
Ip_u8* proto)
{
Ip_size_t length = 0;
*type = 0;
*proto = 0;
if (size > 4)
{
/* Return type of selector and the protocol id*/
*type = data[0];
*proto = data[1];
/* return length */
length = (Ip_size_t)((data[2] << 8) + data[3]);
/* Check valid length */
if (length > size)
length = 0;
}
return length;
}
/*
*===========================================================================
* ipike_payload_traffic_selector_size
*===========================================================================
*/
IP_STATIC Ip_size_t
ipike_payload_traffic_selector_size(Ipike2_ts *ts)
{
Ip_size_t size = 0;
Ip_u8 i = 0;
size = IPIKE_TS_HEADER_LENGTH;
for (i = 0; i < ts->info.count; i++)
{
ip_assert(ts->list != IP_NULL);
switch (ts->list[i]->type)
{
#ifdef IPCOM_USE_INET
case IPIKE_TS_IPV4_ADDR_RANGE:
size += sizeof(Ipike2_ts_range_ipv4);
break;
#endif
#ifdef IPCOM_USE_INET6
case IPIKE_TS_IPV6_ADDR_RANGE:
size += sizeof(Ipike2_ts_range_ipv6);
break;
#endif
default:
/* Should never happen */
IPCOM_LOG0(CRIT, "ipike_payload_traffic_selector_size: unknown type");
break;
}
}
return size;
}
/*
*===========================================================================
* ipike_payload_traffic_selector_copy_elem
*===========================================================================
*/
IP_STATIC Ip_size_t
ipike_payload_traffic_selector_copy_elem(
Ipike2_ts_elem* elem,
Ip_u8* data,
Ip_size_t size)
{
Ip_u16 n = 0;
Ipike2_ts_header* header;
(void)size; /* remove warning */
switch (elem->type)
{
#ifdef IPCOM_USE_INET
case IPIKE_TS_IPV4_ADDR_RANGE:
{
Ipike2_ts_range_ipv4* ipv4;
ip_assert(size >= sizeof(Ipike2_ts_range_ipv4));
n = sizeof(Ipike2_ts_range_ipv4);
ipv4 = (Ipike2_ts_range_ipv4*)data;
ipv4->port_start = elem->addr_start.sin.sin_port;
ipv4->port_end = elem->addr_end.sin.sin_port;
ipv4->addr_start = elem->addr_start.sin.sin_addr.s_addr;
ipv4->addr_end = elem->addr_end.sin.sin_addr.s_addr;
break;
}
#endif
#ifdef IPCOM_USE_INET6
case IPIKE_TS_IPV6_ADDR_RANGE:
{
Ipike2_ts_range_ipv6* ipv6;
Ip_s8 i;
ip_assert(size >= sizeof(Ipike2_ts_range_ipv6));
n = sizeof(Ipike2_ts_range_ipv6);
ipv6 = (Ipike2_ts_range_ipv6*)data;
ipv6->port_start = elem->addr_start.sin6.sin6_port;
ipv6->port_end = elem->addr_end.sin6.sin6_port;
for (i=0; i<4; i++)
{
ipv6->addr_start[i] = elem->addr_start.sin6.sin6_addr.in6.addr32[i];
ipv6->addr_end[i] = elem->addr_end.sin6.sin6_addr.in6.addr32[i];
}
break;
}
#endif
default:
/* Should never happen */
IPCOM_LOG0(CRIT, "ipike_payload_traffic_selector_copy_elem: unknown type");
break;
}
header = (Ipike2_ts_header*)data;
header->type = elem->type;
header->protocol_id = elem->protocol_id;
header->length = ip_htons(n);
return n;
}
/*
*===========================================================================
* ipike_payload_traffic_selector_init_protocol_port
*===========================================================================
*/
IP_STATIC Ipike_error
ipike_payload_traffic_selector_init_protocol_port(
Ip_u16 port,
Ip_u16 port_end,
Ip_u8 protocol,
Ipike2_ts_elem* elem)
{
if (port != 0 && port_end != 0)
{
(void)ipike_addr_set_port(&elem->addr_start, port);
(void)ipike_addr_set_port(&elem->addr_end, port_end);
}
else
{
(void)ipike_addr_set_port(&elem->addr_start, 0);
(void)ipike_addr_set_port(&elem->addr_end, 0xffff);
}
elem->protocol_id = protocol;
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_payload_traffic_selector_init_subnet
*===========================================================================
*/
IP_STATIC Ipike_error
ipike_payload_traffic_selector_init_subnet(
union Ip_sockaddr_union* addr,
union Ip_sockaddr_union* mask,
Ipike2_ts_elem* elem)
{
Ipike_error err;
if ((IPIKE_SUCCESS != (err = ipike_addr_copy(&elem->addr_start, addr))) ||
(IPIKE_SUCCESS != (err = ipike_addr_copy(&elem->addr_end, mask))))
{
IPCOM_LOG0(ERR, "ipike_payload_traffic_selector_init_address: bad network");
return err;
}
if (elem->addr_start.sa.sa_family == IP_AF_INET)
elem->type = IPIKE_TS_IPV4_ADDR_RANGE;
else if (elem->addr_start.sa.sa_family == IP_AF_INET6)
elem->type = IPIKE_TS_IPV6_ADDR_RANGE;
else
return IPIKE_FAILED; /* Should never happen */
/* Convert from network/netmask to address range */
if (IPIKE_SUCCESS != (err = ipike_addr_mask_to_range(&elem->addr_start,
&elem->addr_end)))
return err;
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_payload_traffic_selector_init_range
*===========================================================================
*/
IP_STATIC Ipike_error
ipike_payload_traffic_selector_init_range(
union Ip_sockaddr_union* addr,
union Ip_sockaddr_union* addr2,
Ipike2_ts_elem* elem)
{
Ipike_error err;
if ((IPIKE_SUCCESS != (err = ipike_addr_copy(&elem->addr_start, addr))) ||
(IPIKE_SUCCESS != (err = ipike_addr_copy(&elem->addr_end, addr2))))
{
IPCOM_LOG0(ERR, "ipike_payload_traffic_selector_init_address: bad network");
return err;
}
if (elem->addr_start.sa.sa_family == IP_AF_INET)
elem->type = IPIKE_TS_IPV4_ADDR_RANGE;
else if (elem->addr_start.sa.sa_family == IP_AF_INET6)
elem->type = IPIKE_TS_IPV6_ADDR_RANGE;
else
return IPIKE_FAILED; /* Should never happen */
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_payload_traffic_selector_narrow_elem
*===========================================================================
*/
IP_STATIC Ipike2_ts_elem *
ipike_payload_traffic_selector_narrow_elem(
Ipike2_ts_elem* e1,
Ipike2_ts_elem* e2)
{
Ipike2_ts_elem * narrowed = IP_NULL;
int cmp;
Ip_u16 port_start1;
Ip_u16 port_start2;
Ip_u16 port_end1;
Ip_u16 port_end2;
/* Sanity check */
if ( IP_NULL == e1 || IP_NULL == e2 )
return IP_NULL;
/* Address must be within same range */
cmp = ipike_addr_compare(&e1->addr_start, &e2->addr_end);
if (cmp > 0)
return IP_NULL;
cmp = ipike_addr_compare(&e1->addr_end, &e2->addr_start);
if (cmp < 0)
return IP_NULL;
if ( e2->protocol_id != 0 && e1->protocol_id != 0 &&
e1->protocol_id != e2->protocol_id )
return IP_NULL;
/* Ports must be within same range, the values are stored in network
* order */
port_start1 = ipike_addr_get_port(&e1->addr_start);
port_end1 = ipike_addr_get_port(&e1->addr_end);
port_start2 = ipike_addr_get_port(&e2->addr_start);
port_end2 = ipike_addr_get_port(&e2->addr_end);
if ( port_start1 > port_end2 || port_end1 < port_start2 )
return IP_NULL;
narrowed = ipcom_calloc(1, sizeof(Ipike2_ts_elem));
if (narrowed == IP_NULL)
return IP_NULL;
ipcom_memcpy(narrowed, e1, sizeof(Ipike2_ts_elem));
/******************** Start narrowing **********************/
cmp = ipike_addr_compare(&narrowed->addr_start, &e2->addr_start);
if (cmp < 0)
ipcom_memcpy(ipike_addr_get_ptr(&narrowed->addr_start),
ipike_addr_get_ptr(&e2->addr_start),
ipike_addr_get_len(&narrowed->addr_start));
cmp = ipike_addr_compare(&narrowed->addr_end, &e2->addr_end);
if (cmp > 0)
ipcom_memcpy(ipike_addr_get_ptr(&narrowed->addr_end),
ipike_addr_get_ptr(&e2->addr_end),
ipike_addr_get_len(&narrowed->addr_end));
if (port_start1 < port_start2)
(void)ipike_addr_set_port(&narrowed->addr_start, port_start2);
if (port_end1 > port_end2)
(void)ipike_addr_set_port(&narrowed->addr_end, port_end2);
/* Protocol id */
if ( e1->protocol_id == 0 && e2->protocol_id != 0 )
narrowed->protocol_id = e2->protocol_id;
return narrowed;
}
/*
*===========================================================================
* ipike_payload_traffic_selector_contains
*===========================================================================
*/
IP_STATIC Ip_bool
ipike_payload_traffic_selector_contains(
Ipike2_ts* ts,
Ipike_config_netobj* netobj,
Ip_u8 protocol)
{
Ipike2_ts_elem * elem;
union Ip_sockaddr_union start_addr;
union Ip_sockaddr_union end_addr;
int i;
(void)ipike_addr_copy(&start_addr, &netobj->addr);
(void)ipike_addr_copy(&end_addr, &netobj->high_or_mask);
/* Convert to range if it's not already a range */
if ( !ipike_config_netobj_is_range(netobj) )
(void)ipike_addr_mask_to_range(&start_addr, &end_addr);
for (i = 0; i < ts->info.count; i++)
{
elem = ts->list[i];
if ( ipike_addr_are_equal_port(&start_addr, &elem->addr_start) &&
ipike_addr_are_equal_port(&end_addr, &elem->addr_end) &&
elem->protocol_id == protocol)
return IP_TRUE;
}
return IP_FALSE;
}
/*
****************************************************************************
* 10 PUBLIC FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_payload_traffic_selector_element_add
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_traffic_selector_element_add(
Ipike_config_netobj* netobj,
Ip_u8 protocol,
Ipike2_ts* ts)
{
Ipike_error err;
Ipike2_ts_elem * elem;
/* Don't add duplicates */
if ( ipike_payload_traffic_selector_contains(ts, netobj, protocol) )
return IPIKE_SUCCESS;
elem = ipcom_calloc(1, sizeof(*elem));
if (elem == IP_NULL)
{
IP_PANIC();
return IPIKE_OUT_OF_MEMORY;
}
switch (netobj->type)
{
case IPIKE_CONFIG_NETOBJ_HOST:
case IPIKE_CONFIG_NETOBJ_NET:
err = ipike_payload_traffic_selector_init_subnet(&netobj->addr,
&netobj->high_or_mask,
elem);
break;
case IPIKE_CONFIG_NETOBJ_RANGE:
err = ipike_payload_traffic_selector_init_range(&netobj->addr,
&netobj->high_or_mask,
elem);
break;
default:
/* Should never happen */
err = IPIKE_FAILED;
break;
}
if (IPIKE_SUCCESS == err)
{
(void)ipike_payload_traffic_selector_init_protocol_port(
ipike_config_netobj_get_port_low(netobj),
ipike_config_netobj_get_port_high(netobj),
protocol,
elem);
err = ipike_array_add((void***)&ts->list, elem);
}
if (IPIKE_SUCCESS != err)
ipcom_free(elem);
else
ts->info.count = (Ip_u8)(ts->info.count + 1);
return err;
}
/*
*===========================================================================
* ipike_payload_traffic_selector_initialize
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_traffic_selector_initialize(
Ipike_config_flow* flow,
Ip_bool is_initiator,
Ipike2_ts* ts_i,
Ipike2_ts* ts_r)
{
Ipike_error err;
Ipike2_ts* ts_local;
Ipike2_ts* ts_remote;
int i = 0;
ipcom_memset(ts_i, 0, sizeof(Ipike2_ts));
ipcom_memset(ts_r, 0, sizeof(Ipike2_ts));
if (is_initiator)
{
ts_local = ts_i;
ts_remote = ts_r;
}
else
{
ts_local = ts_r;
ts_remote = ts_i;
}
/* Loop through the flow selectors */
for ( i = 0; flow->src[i] != IP_NULL; i++)
{
/* Generate local traffic selector */
err = ipike_payload_traffic_selector_element_add(flow->src[i],
flow->protocol,
ts_local);
if (IPIKE_SUCCESS != err)
return err;
}
for ( i = 0; flow->dst[i] != IP_NULL; i++)
{
/* Generate remote traffic selector */
err = ipike_payload_traffic_selector_element_add(flow->dst[i],
flow->protocol,
ts_remote);
if (IPIKE_SUCCESS != err)
return err;
}
ts_i->initiator = IP_TRUE;
ts_r->initiator = IP_FALSE;
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_payload_traffic_selector_create
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_traffic_selector_create(
Ipike2_ts* ts,
Ipike2_ts_payload** payload)
{
Ipike2_ts_payload *ts_payload;
Ip_u16 size;
Ip_u8 i;
Ip_u8* data;
Ip_size_t n;
size = (Ip_u16) ipike_payload_traffic_selector_size(ts);
if (IP_NULL == (ts_payload = ipcom_calloc(1, size)))
{
IP_PANIC();
return IPIKE_OUT_OF_MEMORY;
}
ts_payload->header.length = ip_htons(size);
if (ts->initiator)
ts_payload->header.next_payload = IPIKE2_PAYLOAD_TRAFFIC_SELECTOR_I;
else
ts_payload->header.next_payload = IPIKE2_PAYLOAD_TRAFFIC_SELECTOR_R;
ts_payload->count = ts->info.count;
data = ipike_payload_traffic_selector_data(ts_payload);
size = ipike_payload_traffic_selector_data_length(ts_payload);
for (i = 0; i < ts_payload->count; i++)
{
ip_assert(ts->list != IP_NULL);
n = ipike_payload_traffic_selector_copy_elem(ts->list[i], data, size);
data += n;
size = (Ip_u16)(size - n);
}
*payload = ts_payload;
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_payload_traffic_selector_copy
*===========================================================================
* Description:
* Parameters:
* Returns:
*
*/
IP_GLOBAL Ipike_error
ipike_payload_traffic_selector_copy(Ipike2_ts *ts_dst, Ipike2_ts *ts_src)
{
Ipike_error err;
Ipike2_ts_payload *payload = IP_NULL;
err = ipike_payload_traffic_selector_create(ts_src, &payload);
if (err != IPIKE_SUCCESS)
{
IPCOM_LOG0(ERR, "ipike_payload_traffic_selector_copy: failed to create payload");
goto errout;
}
err = ipike_payload_traffic_selector_extract(ts_src->initiator, payload, ts_dst);
if (err != IPIKE_SUCCESS)
{
IPCOM_LOG0(ERR, "ipike_payload_traffic_selector_copy: failed to extract payload");
goto errout;
}
/* Success */
errout:
if (payload != IP_NULL)
ipcom_free(payload);
return err;
}
/*
*===========================================================================
* ipike_payload_traffic_selector_free
*===========================================================================
*/
IP_GLOBAL void
ipike_payload_traffic_selector_free(Ipike2_ts* ts)
{
ipike_array_free((void**)ts->list, ipcom_free);
ipcom_memset(ts, 0, sizeof(*ts));
}
/*
*===========================================================================
* ipike_payload_traffic_selector_check
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_traffic_selector_check(Ipike2_ts_payload* ts)
{
Ip_u8* data;
Ip_size_t size;
Ip_size_t length;
Ip_u8 type;
Ip_u8 proto;
/* Enumerate all selectors and validate length and also that they are of
* supported type */
size = ipike_payload_traffic_selector_data_length(ts);
data = ipike_payload_traffic_selector_data(ts);
while (size > 0)
{
length = ipike_payload_traffic_selector_next(data, size, &type, &proto);
if (length == 0)
{
IPCOM_LOG0(DEBUG, "ipike_payload_traffic_selector_check() ::"\
" Invalid payload");
return IPIKE_ISAKMP_INVALID_SYNTAX;
}
switch (type)
{
#ifdef IPCOM_USE_INET
case IPIKE_TS_IPV4_ADDR_RANGE:
break;
#endif
#ifdef IPCOM_USE_INET6
case IPIKE_TS_IPV6_ADDR_RANGE:
break;
#endif
default:
IPCOM_LOG1(DEBUG, "ipike_payload_traffic_selector_check: Unsupported type %d", type);
return IPIKE_ISAKMP_TS_UNACCEPTABLE;
}
data += length;
size -= length;
}
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_payload_traffic_selector_extract
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_traffic_selector_extract(
Ip_bool is_initiator,
Ipike2_ts_payload* payload,
Ipike2_ts* ts)
{
Ip_u8* data;
Ipike2_ts_elem* elem;
Ip_size_t size;
Ip_size_t length;
Ipike_error err;
ipike_payload_traffic_selector_free(ts);
/* Enumerate all selectors, assumes that check already have been run */
size = ipike_payload_traffic_selector_data_length(payload);
data = ipike_payload_traffic_selector_data(payload);
while (size > 0)
{
if (IP_NULL == (elem = ipcom_calloc(1, sizeof(Ipike2_ts_elem))))
{
IP_PANIC();
ipike_payload_traffic_selector_free(ts);
return IPIKE_OUT_OF_MEMORY;
}
length = ipike_payload_traffic_selector_next(data,
size,
&elem->type,
&elem->protocol_id);
ip_assert(length > 0);
switch (elem->type)
{
#ifdef IPCOM_USE_INET
case IPIKE_TS_IPV4_ADDR_RANGE:
{
Ipike2_ts_range_ipv4* ipv4 = (Ipike2_ts_range_ipv4*)data;
elem->addr_start.sa.sa_family = IP_AF_INET;
IPCOM_SA_LEN_SET(&elem->addr_start.sa, sizeof (struct Ip_sockaddr_in));
elem->addr_start.sin.sin_addr.s_addr = ipv4->addr_start;
elem->addr_end.sa.sa_family = IP_AF_INET;
IPCOM_SA_LEN_SET(&elem->addr_end.sa, sizeof (struct Ip_sockaddr_in));
elem->addr_end.sin.sin_addr.s_addr = ipv4->addr_end;
elem->addr_start.sin.sin_port = ipv4->port_start;
elem->addr_end.sin.sin_port = ipv4->port_end;
break;
}
#endif
#ifdef IPCOM_USE_INET6
case IPIKE_TS_IPV6_ADDR_RANGE:
{
Ip_u8 i;
Ipike2_ts_range_ipv6* ipv6 = (Ipike2_ts_range_ipv6*)data;
elem->addr_start.sa.sa_family = IP_AF_INET6;
IPCOM_SA_LEN_SET(&elem->addr_start.sa, sizeof (struct Ip_sockaddr_in6));
elem->addr_end.sa.sa_family = IP_AF_INET6;
IPCOM_SA_LEN_SET(&elem->addr_end.sa, sizeof (struct Ip_sockaddr_in6));
for (i=0; i<4; i++)
{
elem->addr_start.sin6.sin6_addr.in6.addr32[i] = ipv6->addr_start[i];
elem->addr_end.sin6.sin6_addr.in6.addr32[i] = ipv6->addr_end[i];
}
elem->addr_start.sin6.sin6_port = ipv6->port_start;
elem->addr_end.sin6.sin6_port = ipv6->port_end;
break;
}
#endif
}
if (IPIKE_SUCCESS != (err = ipike_array_add((void***)&ts->list, elem)))
{
IPCOM_LOG0(CRIT, "ipike_payload_traffic_selector_extract: failed to add array");
ipike_payload_traffic_selector_free(ts);
return err;
}
data += length;
size -= length;
}
ipcom_memcpy((void*)&ts->info, (void*)payload, sizeof(ts->info));
ts->initiator = is_initiator;
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_payload_traffic_selector_print
*===========================================================================
*/
IP_GLOBAL void
ipike_payload_traffic_selector_print(Ipike2_ts_payload* ts)
{
Ip_u8* data;
const char* s = IP_NULL;
Ip_size_t size;
Ip_size_t length;
Ip_u8 type;
Ip_u8 proto;
union Ip_sockaddr_union addr_start;
union Ip_sockaddr_union addr_end;
Ip_u16 port_start = 0;
Ip_u16 port_end = 0;
/* lint */
(void)port_start;
(void)port_end;
(void)s;
/* Enumerate all selectors, assumes that check already have been run */
size = ipike_payload_traffic_selector_data_length(ts);
data = ipike_payload_traffic_selector_data(ts);
while (size > 0 &&
((length = ipike_payload_traffic_selector_next(data, size, &type, &proto)) > 0))
{
s = ipike_attribute_protocol_id_to_string(proto);
IPCOM_LOG1(DEBUG2, " Protocol: %s", s);
ipcom_memset(&addr_start, 0, sizeof(addr_start));
ipcom_memset(&addr_end, 0, sizeof(addr_end));
port_start = 0;
port_end = 0;
switch (type)
{
#ifdef IPCOM_USE_INET
case IPIKE_TS_IPV4_ADDR_RANGE:
{
Ipike2_ts_range_ipv4* ipv4 = (Ipike2_ts_range_ipv4*)data;
port_start = ipv4->port_start;
port_end = ipv4->port_end;
addr_start.sa.sa_family = IP_AF_INET;
addr_start.sin.sin_addr.s_addr = ipv4->addr_start;
addr_end.sa.sa_family = IP_AF_INET;
addr_end.sin.sin_addr.s_addr = ipv4->addr_end;
break;
}
#endif
#ifdef IPCOM_USE_INET6
case IPIKE_TS_IPV6_ADDR_RANGE:
{
Ip_u8 i;
Ipike2_ts_range_ipv6* ipv6 = (Ipike2_ts_range_ipv6*)data;
port_start = ipv6->port_start;
port_end = ipv6->port_end;
addr_start.sa.sa_family = IP_AF_INET6;
addr_end.sa.sa_family = IP_AF_INET6;
for (i=0; i<4; i++)
{
addr_start.sin6.sin6_addr.in6.addr32[i] = ipv6->addr_start[i];
addr_end.sin6.sin6_addr.in6.addr32[i] = ipv6->addr_end[i];
}
break;
}
#endif
}
IPCOM_LOG1(DEBUG2, " Address start: %s", ipike_addr_to_str(&addr_start));
IPCOM_LOG1(DEBUG2, " Address end: %s", ipike_addr_to_str(&addr_end));
IPCOM_LOG1(DEBUG2, " Port start: %d", ip_htons(port_start));
IPCOM_LOG1(DEBUG2, " Port end: %d", ip_htons(port_end));
data += length;
size -= length;
}
return;
}
/*
*===========================================================================
* ipike_payload_traffic_selector_merge
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_traffic_selector_merge(
Ipike2_ts * remote_ts,
Ipike2_ts * local_ts)
{
int i, j, count;
Ipike2_ts_elem** accepted_list = IP_NULL;
Ipike2_ts_elem* narrowed = IP_NULL;
count = 0;
/* Loop all elements in the remote ts list and narrow with all elements
* in in the local ts list */
for (i = 0; i < (int)remote_ts->info.count; i++)
{
for (j = 0; j < (int)local_ts->info.count; j++)
{
narrowed = ipike_payload_traffic_selector_narrow_elem(
remote_ts->list[i], local_ts->list[j]);
/* Add to the accepted list */
if (narrowed != IP_NULL)
{
(void)ipike_array_add((void***)&accepted_list, narrowed);
count++;
}
}
}
/* We must have at least one entry in the list */
if ( accepted_list == IP_NULL )
return IPIKE_ISAKMP_TS_UNACCEPTABLE;
/* Replace the original traffic selector list with accepted and narrowed
* list */
(void)ipike_array_free((void**)remote_ts->list, ipcom_free);
remote_ts->list = accepted_list;
remote_ts->info.count = (Ip_u8)count;
return IPIKE_SUCCESS;
}
#else
int ipike_payload_traffic_selector_empty_file = 0;
#endif /* IPIKE_USE_VERSION2 */
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike2_payload_traffic_selector.h
+335
View File
@@ -0,0 +1,335 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike2_payload_traffic_selector.h,v $ $Revision: 1.7.16.2 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike2_payload_traffic_selector.h,v $
* $Author: edahlber $ $Date: 2012-04-18 08:59:46 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#if !defined(IPIKE2_PAYLOAD_TRAFFIC_SELECTOR_H) && defined(IPIKE_USE_VERSION2)
#define IPIKE2_PAYLOAD_TRAFFIC_SELECTOR_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Traffic selector payload (IKE version 2) */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_payload.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
#define IPIKE_TS_HEADER_LENGTH sizeof(Ipike2_ts_payload)
#define IPIKE_TS_IPV4_ADDR_RANGE 7
#define IPIKE_TS_IPV6_ADDR_RANGE 8
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
Traffic selector Payload Format
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Next Payload ! RESERVED ! Payload Length !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Number of TSs ! RESERVED !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! !
~ Traffic selectors ~
! !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Traffic selector Format
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! TS Type !IP Protocol ID ! Selector Length !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Start Port ! End port !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! !
~ Starting Address ~
! !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! !
~ Ending Address ~
! !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
*/
typedef struct Ipike2_traffic_selector_payload_struct
{
/* The generic ISAKMP payload header, the length includes the length
of all transforms associated with the proposal */
Ipike_payload_header header;
/* Traffic selector count. */
Ip_u8 count;
/* Reserved */
Ip_u8 reserved;
Ip_u16 reserved2;
/* Traffic selectors follows */
}
Ipike2_ts_payload;
typedef struct Ipike2_traffic_selector_header_struct
{
/* Value describing the traffic selector. */
Ip_u8 type;
/* Protocol id for the traffic selector */
Ip_u8 protocol_id;
/* Length of traffic selector data */
Ip_u16 length;
/* Traffic selector data follows */
}
Ipike2_ts_header;
typedef struct Ipike2_ts_range_ipv4_struct
{
/* Traffic selector header */
Ipike2_ts_header header;
/* Starting port */
Ip_u16 port_start;
/* Ending port */
Ip_u16 port_end;
/* Starting address */
Ip_u32 addr_start;
/* Ending address */
Ip_u32 addr_end;
} Ipike2_ts_range_ipv4;
typedef struct Ipike2_ts_range_ipv6_struct
{
/* Traffic selector header */
Ipike2_ts_header header;
/* Starting port */
Ip_u16 port_start;
/* Ending port */
Ip_u16 port_end;
/* Starting address */
Ip_u32 addr_start[4];
/* Ending address */
Ip_u32 addr_end[4];
} Ipike2_ts_range_ipv6;
typedef struct Ipike2_traffic_selector_elem_struct
{
/* Type of traffic selector */
Ip_u8 type;
/* Protocol ID */
Ip_u8 protocol_id;
/* Starting address */
union Ip_sockaddr_union addr_start;
/* Ending address */
union Ip_sockaddr_union addr_end;
}
Ipike2_ts_elem;
typedef struct Ipike2_traffic_selector_struct
{
/* The traffic selector info */
Ipike2_ts_payload info;
/* Is this selector for initiator? (else responder) */
Ip_bool initiator;
/* List of traffic selector elements */
Ipike2_ts_elem** list;
}
Ipike2_ts;
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_payload_traffic_selector_element_add
*===========================================================================
* Description: Generates and adds traffic selector element based on the
* net object and protocol. If ts already contains a
* corresponding netobject it will not add another one.
* Parameters: netobj - Net object (address, network, address range)
* protocol - a string representing the protocol.
* ts - the new traffic selector if call is successful.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_traffic_selector_element_add(
Ipike_config_netobj* netobj,
Ip_u8 protocol,
Ipike2_ts* ts);
/*
*===========================================================================
* ipike_payload_traffic_selector_initialize
*===========================================================================
* Description: Creates initiator and responder traffic selectors from
* information in the configuration section.
* Parameters: config - configuration section that have information about
* the traffic selectors.
* is_inititaor - is this side the initiator
* ts_i - will get the initiator traffic selector if call is
* succesfull.
* ts_r - will get the responder traffic selector if call is
* succesfull.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_traffic_selector_initialize(
Ipike_config_flow* flow,
Ip_bool is_initiator,
Ipike2_ts* ts_i,
Ipike2_ts* ts_r);
/*
*===========================================================================
* ipike_payload_traffic_selector_create
*===========================================================================
* Description: Creates a traffic selector payload from the information
* created in the exchange.
* Parameters: ts - the traffic selector structure to encode into
* a ISAKMP payload.
* payload - will point to a new traffic selector payload.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_traffic_selector_create(
Ipike2_ts* ts,
Ipike2_ts_payload** payload);
/*
*===========================================================================
* ipike_payload_traffic_selector_copy
*===========================================================================
* Description: Make a new copy of the traffic selector. The old will be
* freed.
* Parameters: ts_dst - the new traffic selector (destination).
* ts_src - the old traffic selector (source).
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_traffic_selector_copy(Ipike2_ts* ts_dst, Ipike2_ts* ts_src);
/*
*===========================================================================
* ipike_payload_traffic_selector_free
*===========================================================================
* Description: Frees all resource allocated by the traffic selector
* structure.
* Parameters: ts - The traffic selector structure to free.
* Returns:
*/
IP_GLOBAL void
ipike_payload_traffic_selector_free(Ipike2_ts* ts);
/*
*===========================================================================
* ipike_payload_traffic_selector_check
*===========================================================================
* Description: Verifies that the traffic selector payload is sane.
* Parameters: ts - a pointer to a traffic selector payload.
* Returns: IPIKE_SUCCESS
* IPIKE_ISAKMP_INVALID_SYNTAX
* IPIKE_ISAKMP_TS_UNACCEPTABLE
*/
IP_GLOBAL Ipike_error
ipike_payload_traffic_selector_check(Ipike2_ts_payload* ts);
/*
*===========================================================================
* ipike_payload_traffic_selector_print
*===========================================================================
* Description: Prints the content of the traffic selector payload to the
* system log.
* Parameters: ts - a pointer to traffic selector payload.
* Returns:
*/
IP_GLOBAL void
ipike_payload_traffic_selector_print(Ipike2_ts_payload* ts);
/*
*===========================================================================
* ipike_payload_traffic_selector_extract
*===========================================================================
* Description: Extracts the traffic selector data from the payload.
* Parameters: is_initiator - initiator payload
* payload - a traffic selector payload.
* ts - will be updated with the traffic selector data if the
* call was successful.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_traffic_selector_extract(
Ip_bool is_initiator,
Ipike2_ts_payload* payload,
Ipike2_ts* ts);
/*
*===========================================================================
* ipike_payload_traffic_selector_merge
*===========================================================================
* Description: Merge two traffic selectors. The resulting traffic selector
* will contain those areas covered in both selectors. The first
* selector will be updated with the new value.
* Parameters: ts1 - the first traffic selector.
* ts2 - the second traffic selector.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_payload_traffic_selector_merge(Ipike2_ts* ts1, Ipike2_ts* ts2);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_attributes.c
+1580
View File
File diff suppressed because it is too large Load Diff
components/ip_net2-6.9/ipike/src/ipike_attributes.h
+698
View File
@@ -0,0 +1,698 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_attributes.h,v $ $Revision: 1.14.10.4 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_attributes.h,v $
* $Author: jsheng $ $Date: 2014-10-09 09:26:00 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#ifndef IPIKE_ATTRIBUTE_H
#define IPIKE_ATTRIBUTE_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Attibutes from Appendix A in RFC 2409 */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_config.h"
#include "ipike.h"
#include "ipike_util.h"
#include <openssl/evp.h>
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
#define IPIKE_VALUE_ANY (0x8181)
#define IPIKE_VALUE_NONE (0)
#define IPIKE_ATTR_BASIC (0x8000)
#define IPIKE_ATTR_VARIABLE (0)
#define IPIKE_ATTR_INVALID ((Ip_u16)-1)
#define IPIKE_ATTR_CLS_ENCRYPTION_ALGORITHM 1 /* Basic */
#define IPIKE_ATTR_CLS_HASH_ALGORITHM 2 /* Basic */
#define IPIKE_ATTR_CLS_AUTHENTICATION_METHOD 3 /* Basic */
#define IPIKE_ATTR_CLS_GROUP_DESCRIPTION 4 /* Basic */
#define IPIKE_ATTR_CLS_GROUP_TYPE 5 /* Basic */
#define IPIKE_ATTR_CLS_GROUP_PRIME 6 /* Variable */
#define IPIKE_ATTR_CLS_GROUP_GENERATOR_ONE 7 /* Variable */
#define IPIKE_ATTR_CLS_GROUP_GENERATOR_TWO 8 /* Variable */
#define IPIKE_ATTR_CLS_GROUP_CURVE_A 9 /* Variable */
#define IPIKE_ATTR_CLS_GROUP_CURVE_B 10 /* Variable */
#define IPIKE_ATTR_CLS_LIFE_TYPE 11 /* Basic */
#define IPIKE_ATTR_CLS_LIFE_DURATION 12 /* Variable */
#define IPIKE_ATTR_CLS_PRF 13 /* Basic */
#define IPIKE_ATTR_CLS_KEY_LENGTH 14 /* Basic */
#define IPIKE_ATTR_CLS_FIELD_SIZE 15 /* Basic */
#define IPIKE_ATTR_CLS_GROUP_ORDER 16 /* Variable */
#define IPIKE_ATTR_CLS_COUNT 16
#define IPIKE_ATTR_AUTH_PRE_SHARED_KEY 1
#define IPIKE_ATTR_AUTH_DSS_SIGNATURES 2
#define IPIKE_ATTR_AUTH_RSA_SIGNATURES 3
#define IPIKE_ATTR_AUTH_RSA_ENCRYPTION 4
#define IPIKE_ATTR_AUTH_RSA_REVISED_ENCRYPTION 5
#define IPIKE_ATTR_AUTH_COUNT 5
#define IPIKE_ATTR_ENCRYPTION_DES 1
#define IPIKE_ATTR_ENCRYPTION_IDEA 2
#define IPIKE_ATTR_ENCRYPTION_BLOWFISH 3
#define IPIKE_ATTR_ENCRYPTION_RC5_R16_B64 4
#define IPIKE_ATTR_ENCRYPTION_3DES 5
#define IPIKE_ATTR_ENCRYPTION_CAST 6
#define IPIKE_ATTR_ENCRYPTION_AESCBC 7
#define IPIKE_ATTR_ENCRYPTION_AESCTR 8
#define IPIKE_ATTR_ENCRYPTION_COUNT 7
#define IPIKE_ATTR_HASH_MD5 1
#define IPIKE_ATTR_HASH_SHA1 2
#define IPIKE_ATTR_HASH_TIGER 3
#define IPIKE_ATTR_HASH_SHA2_256 4
#define IPIKE_ATTR_HASH_SHA2_384 5
#define IPIKE_ATTR_HASH_SHA2_512 6
#define IPIKE_ATTR_HASH_COUNT 6
#define IPIKE_ATTR_GROUP_DESC_768_MODP 1
#define IPIKE_ATTR_GROUP_DESC_1024_MODP 2
#define IPIKE_ATTR_GROUP_DESC_155_EC2N 3
#define IPIKE_ATTR_GROUP_DESC_185_EC2N 4
#define IPIKE_ATTR_GROUP_DESC_1536_MODP 5
#define IPIKE_ATTR_GROUP_DESC_2048_MODP 14
#define IPIKE_ATTR_GROUP_DESC_3072_MODP 15
#define IPIKE_ATTR_GROUP_DESC_4096_MODP 16
#define IPIKE_ATTR_GROUP_DESC_6144_MODP 17
#define IPIKE_ATTR_GROUP_DESC_8192_MODP 18
#define IPIKE_ATTR_GROUP_DESC_MAX IPIKE_ATTR_GROUP_DESC_8192_MODP
#define IPIKE_ATTR_GROUP_TYPE_MODP 1
#define IPIKE_ATTR_GROUP_TYPE_ECP 2
#define IPIKE_ATTR_GROUP_TYPE_EC2N 3
#define IPIKE_ATTR_GROUP_TYPE_COUNT 3
#define IPIKE_ATTR_LIFE_TYPE_SECONDS 1
#define IPIKE_ATTR_LIFE_TYPE_KBYTES 2
/* ROHC Attributes, RFC5857 */
#define IPIKE_ATTR_ROHC_MAX_CID 1
#define IPIKE_ATTR_ROHC_PROFILE 2
#define IPIKE_ATTR_ROHC_INTEG 3
#define IPIKE_ATTR_ROHC_ICV_LEN 4
#define IPIKE_ATTR_ROHC_MRRU 5
/* Maximum number of ROHC attributes */
#define IPIKE_ATTR_ROHC_NUM_MAX 16
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
Data Attributes
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
!A! Attribute Type ! AF=0 Attribute Length !
!F! ! AF=1 Attribute Value !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. AF=0 Attribute Value .
. AF=1 Not Transmitted .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
*/
typedef struct Ipike_attribute_struct
{
#define IPIKE_ATTR_AF(type) (Ip_u16) (type & IPIKE_ATTR_BASIC)
#define IPIKE_ATTR_TYPE(type) (Ip_u16) (type & ~IPIKE_ATTR_BASIC)
/* Unique identifier for each type of attribute.*/
Ip_u16 type;
/* AF=0 attribute length, AF=1 attribute value */
Ip_u16 value;
/* Attribute value follows if AF=0 */
}
Ipike_attribute;
/*
*===========================================================================
* ipike_attribute_value_to_string
*===========================================================================
* Description: Returns a string representation of the attribute value.
* Parameters: 1:st arg - the attribute type.
* 2:nd arg - the attribute value.
* Returns: A string representation of the attribute value.
*/
typedef const char* Ipike_attr_to_str_ptr(Ip_u16, Ip_u16);
/*
*===========================================================================
* Ipike_attr_cls_to_str_ptr
*===========================================================================
* Description: Returns a string representation of the attribute type.
* Parameters: 1:st arg - the attribute type.
* Returns: A string representation of the attribute type.
*/
typedef const char* Ipike_attr_cls_to_str_ptr(Ip_u16);
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_check_basic_attr
*===========================================================================
* Description: Checks an attribute that has basic encoding and that the
* value is within the specified limit.
* Parameters: attr - the attribute to check.
* value_range - the highest value that is allowed in this
* attribute
* Returns: IPIKE_SUCCESS
* IPIKE_ATTRIBUTE_MUST_BE_BASIC
* IPIKE_ATTRIBUTE_INVALID_VALUE
*/
IP_GLOBAL Ipike_error
ipike_check_basic_attr(Ipike_attribute* attr, Ip_u16 value_range);
/*
*===========================================================================
* ipike_check_attribute
*===========================================================================
* Description: Returns a string representation of the attribute type.
* Parameters: attribute_type - the attribute type.
* Returns: A string representation of the attribute type.
*/
IP_GLOBAL const char*
ipike_attribute_class_to_string(Ip_u16 attribute_type);
/*
*===========================================================================
* ipike_attribute_value_to_string
*===========================================================================
* Description: Returns a string representation of the IPSec attribute value.
* Parameters: type - the attribute type.
* value - the attribute value.
* Returns: A string representation of the attribute value.
*/
IP_GLOBAL const char*
ipike_attribute_value_to_string(Ip_u16 type, Ip_u16 value);
/*
*===========================================================================
* ipike_attribute_size
*===========================================================================
* Description: Returns the size (in bytes) of the attribute.
* Parameters: attr - an attribute.
* Returns: the size in bytes of the attribute.
*/
IP_GLOBAL Ip_size_t
ipike_attribute_size(Ipike_attribute* attr);
/*
*===========================================================================
* ipike_attribute_array_size
*===========================================================================
* Description: Returns the sum of the the attributes in the array.
* Parameters: attrs - an IP_NULL terminated array of attributes.
* Returns: the size in bytes of the attributes.
*/
IP_GLOBAL Ip_size_t
ipike_attribute_array_size(Ipike_attribute** attrs);
/*
*===========================================================================
* ipike_attribute_array_count
*===========================================================================
* Description: Returns the number of elements in the attribute array buffer.
* Parameters: data - the attribute array buffer.
* length - length of buffer
* Returns: the number of elements.
*/
IP_GLOBAL Ip_size_t
ipike_attribute_array_count(Ip_u8* data, Ip_size_t length);
/*
*===========================================================================
* ipike_attributes_extract
*===========================================================================
* Description: Extract an array of attributes from a data buffer.
* Parameters: data - the data buffer.
* length - length of the data buffer.
* Returns: A null terminated list of attributes. Will return null if
* fail to extract attributes.
*/
IP_GLOBAL Ipike_attribute**
ipike_attributes_extract(Ip_u8* data, Ip_size_t length);
/*
*===========================================================================
* ipike_attribute_copy
*===========================================================================
* Description: Makes a deep copy of the attribute.
* Parameters: attr - the attribute to copy.
* Returns: A copy of the attribute that must be freed with ipcom_free
* or IP_NULL if out of memory.
*/
IP_GLOBAL Ipike_attribute*
ipike_attribute_copy(Ipike_attribute* attr);
/*
*===========================================================================
* ipike_attribute_new
*===========================================================================
* Description: Creates a attribute, the attribute will be basic if the value
* can be fitted into a Ip_u16.
* Parameters: type - the attribute type.
* value - the attribute value.
* Returns: An attribute pointer that must be freed with ipcom_free or
* IP_NULL if out of memory.
*/
IP_GLOBAL Ipike_attribute*
ipike_attribute_new(Ip_u16 type, Ip_u32 value);
IP_GLOBAL Ipike_attribute*
ipike_attribute_new2(Ip_u16 type, Ip_u64 value);
/*
*===========================================================================
* ipike_next_attribute
*===========================================================================
* Description: Checks that the attribute is correctly encoded and that
* the type and value is within the valid range.
* Parameters: attr - the current attribute.
* bytes_left - size of the remaining attribute buffer. This
* value is updated subtracting the size of the current attribute.
* The value can become negative if to few bytes are remaining.
* Returns: A pointer to the next attribute or IP_NULL if to few bytes
* are remaining to advance the pointer.
*/
IP_GLOBAL Ipike_attribute*
ipike_next_attribute(Ipike_attribute* attr, Ip_ssize_t* bytes_left);
/*
*===========================================================================
* ipike_attribute_check
*===========================================================================
* Description: Checks that no duplicated attributes.
* Parameters: attr - the current attribute.
* attr_length - size of the attribute buffer.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
* IPIKE_ATTRIBUTE_INVALID_TYPE
*/
IP_GLOBAL Ipike_error
ipike_attribute_check(Ipike_attribute* attr, Ip_ssize_t attr_length, Ip_bool phase1);
/*
*===========================================================================
* ipike_print_attribute
*===========================================================================
* Description: Prints the attribute to the system log.
* Parameters: payload - a pointer to the ISAKMP header for the payload.
* attr_cls_to_string - function that can convert an attribute
* class to a string.
* attr_to_string - function that can convert an attribute
* class / attribute value pair to a string.
* Returns:
*
*
*/
IP_GLOBAL void
ipike_print_attribute(Ipike_attribute* attribute,
Ipike_attr_cls_to_str_ptr attr_cls_to_string,
Ipike_attr_to_str_ptr attr_to_string);
/*
*===========================================================================
* ipike_attribute_process_encryption
*===========================================================================
* Description: Verifies that the suggested crypto-algorithm is supported,
* if it is, set enc_name.
* Parameters: attr - the encryption attribute.
* enc_alg - is set to the id of the selected crypto if the
* call is successfull.
* Returns: IPIKE_SUCCESS
* IPIKE_SA_NO_MATCHING_ENCRYPTION_ALGORITHM
*
*/
IP_GLOBAL Ipike_error
ipike_attribute_process_encryption(Ipike_attribute* attr, Ip_u16* enc_alg);
/*
*===========================================================================
* ipike_attribute_get_default_key_length
*===========================================================================
* Description: Returns the default key length for the specified IKE supported
* encryption algorithm.
* Parameters: encryption_alg - the encryption algorithm.
* Returns: The default size of the key in bytes.
*
*/
IP_GLOBAL Ip_u16
ipike_attribute_get_default_key_length(Ip_u16 encryption_alg);
IP_GLOBAL Ip_u16
ipike_attribute_get_default_key_length_v2(Ip_u16 encryption_alg);
/*
*===========================================================================
* ipike_attribute_get_cipher_block_size
*===========================================================================
* Description: Returns the block size for the specified encryption algorithm.
* Parameters: encryption_alg - the encryption algorithm, 0 is interpreted as
* null-cipher with block size 1.
* Returns: The block size in bytes.
*
*/
IP_GLOBAL Ip_u16
ipike_attribute_get_cipher_block_size(Ip_u16 encryption_alg, Ip_u16 key_length);
IP_GLOBAL Ip_u16
ipike_attribute_get_cipher_block_size_v2(Ip_u16 encryption_alg, Ip_u16 key_length);
/*
*===========================================================================
* ipike_attribute_get_digest_size
*===========================================================================
* Description: Returns the digest size produced by the specified hash algorithm.
* Parameters: hash_alg - the hash algorithm.
* Returns: The block size in bytes.
*
*/
IP_GLOBAL Ip_u16
ipike_attribute_get_digest_size(Ip_u16 hash_alg);
/*
*===========================================================================
* ipike_get_evp_hash
*===========================================================================
* Description: Translates the IKE hash attribute number to a EVP_MD* pointer.
* Parameters: hash_attr - a IKE hash attribute number.
* Returns: A pointer to a valid EVP_MD structure or IP_NULL if the hash
* algorithm was invalid.
*
*/
IP_GLOBAL const EVP_MD*
ipike_attribute_get_evp_hash(Ip_u16 hash_attr);
/*
*===========================================================================
* ipike_get_evp_cipher
*===========================================================================
* Description: Translates the IKE cipher attribute number to a EVP_CIPHER*
* pointer.
* Parameters: cipher_attr - a IKE cipher attribute number.
* key_length - size of key for attribute number (in bits)
* Returns: A pointer to a valid EVP_CIPHER structure or IP_NULL if the
* encryption algorithm was invalid.
*
*/
IP_GLOBAL const EVP_CIPHER*
ipike_attribute_get_evp_cipher(Ip_u16 cipher_attr, Ip_u16 key_length);
IP_GLOBAL const EVP_CIPHER*
ipike_attribute_get_evp_cipher_v2(Ip_u16 cipher_attr, Ip_u16 key_length);
/*
*===========================================================================
* ipike_attribute_process_hash
*===========================================================================
* Description: Verifies that the suggested hash-algorithm is supported,
* if it is, set hash_name.
* Parameters: attr - the hash attribute.
* hash_alg - is set to id of the selected hash if the
* call is successfull.
* Returns: IPIKE_SUCCESS
* IPIKE_SA_NO_MATCHING_HASH_ALGORITHM
*
*/
IP_GLOBAL Ipike_error
ipike_attribute_process_hash(Ipike_attribute* attr, Ip_u16* hash_alg);
/*
*===========================================================================
* ipike_attribute_process_authentication_method
*===========================================================================
* Description: Verifies that the suggested authentication algorithm is
* supported, if it is, set auth_alg.
* Parameters: attr - the authentication attribute.
* auth_alg - points to the DH group if the call was successful.
* Returns: IPIKE_SUCCESS
* IPIKE_ATTRIBUTE_UNSUPPORTED_VALUE
*
*/
IP_GLOBAL Ipike_error
ipike_attribute_process_authentication_method(Ipike_attribute* attr, Ip_u16* auth_meth);
/*
*===========================================================================
* ipike_attribute_process_dh_group
*===========================================================================
* Description: Verifies that the suggested DH group description is supported,
* if it is set the dh_group parameter to point to the correct
* data.
* Parameters: attr - the DH group attribute.
* dh_group - is set to the DH group if the call is successful.
* Returns: IPIKE_SUCCESS
* IPIKE_ATTRIBUTE_UNSUPPORTED_VALUE
*
*/
IP_GLOBAL Ipike_error
ipike_attribute_process_dh_group_desc(Ipike_attribute* attr, Ip_u16* dh_group);
/*
*===========================================================================
* ipike_attribute_process_key_length
*===========================================================================
* Description: Verifies that the suggested key length is supported,
* if it is set the dh_group parameter to point to the correct
* data.
* Parameters: attr - the key length attribute.
* key_length - is set to the key length if the call is successful.
* Returns: IPIKE_SUCCESS
* IPIKE_ATTRIBUTE_UNSUPPORTED_VALUE
*
*/
IP_GLOBAL Ipike_error
ipike_attribute_process_key_length(Ipike_attribute* attr, Ip_u16* key_length);
/*
*===========================================================================
* ipike_attribute_get_dh_prime
*===========================================================================
* Description: Returns the prime number corresponding to the specified DH
* group.
* Parameters: dh_group - a ISAKMP DH group id.
* Returns: A pointer to the DH prime number or IP_NULL if the specifed
* group is not supported.
*
*/
IP_GLOBAL const Ipike_value*
ipike_attribute_get_dh_prime(Ip_u16 dh_group);
/*
*===========================================================================
* ipike_attribute_get_dh_generator
*===========================================================================
* Description: Returns the generator number corresponding to the specified DH
* group.
* Parameters: dh_group - a ISAKMP DH group id.
* Returns: The DH generator number or 0 if the specifed
* group is not supported.
*
*/
IP_GLOBAL Ip_u32
ipike_attribute_get_dh_generator(Ip_u16 dh_group);
/*
*===========================================================================
* ipike_attribute_process_life_type
*===========================================================================
* Description: Verifies that the suggested life type is supported, if it is
* set life_type.
* Parameters: attr - the IKE SA life type attribute.
* life_type - is set to the passed life type if the call is
* successfull.
* Returns: IPIKE_SUCCESS
*
*/
IP_GLOBAL Ipike_error
ipike_attribute_process_life_type(Ipike_attribute* attr, Ip_u16* life_type);
/*
*===========================================================================
* ipike_attribute_process_life_duration
*===========================================================================
* Description: All durations is currently accepted.
* Parameters: attr - the IKE SA life duration in seconds or kbytes.
* life_duration - is set to the passed duration type if the call is
* successfull.
* Returns: IPIKE_SUCCESS
* IPIKE_ATTRIBUTE_UNSUPPORTED_VALUE
*
*/
IP_GLOBAL Ipike_error
ipike_attribute_process_life_duration(Ipike_attribute* attr, Ip_u64* life_duration);
/*
*===========================================================================
* ipike_attribute_xxx_to_string
*===========================================================================
* Description: Converts the numberical representation of a attribute to its
* string form.
* Parameters: s - The string representation of the value.
* Returns: The string representation of the value.
*
*/
IP_GLOBAL const char*
ipike_attribute_encryption_alg_to_string(Ip_u16 v);
IP_GLOBAL const char*
ipike_attribute_encryption_alg_to_string_v2(Ip_u16 v);
IP_GLOBAL const char *
ipike_attribute_encryption_alg_key_length_to_string(Ip_u16 v1, Ip_u16 v2);
IP_GLOBAL const char *
ipike_attribute_encryption_alg_key_length_to_string_v2(Ip_u16 v1, Ip_u16 v2);
IP_GLOBAL const char*
ipike_attribute_hash_alg_to_string(Ip_u16 v);
IP_GLOBAL const char*
ipike_attribute_auth_method_to_string(Ip_u16 v);
IP_GLOBAL const char*
ipike_attribute_auth_method_to_string_v2(Ip_u16 v);
IP_GLOBAL const char*
ipike_attribute_dh_group_to_string(Ip_u16 v);
IP_GLOBAL const char*
ipike_attribute_life_type_to_string(Ip_u16 v);
IP_GLOBAL const char *
ipike_attribute_id_type_to_string(Ip_u8 v);
IP_GLOBAL const char *
ipike_attribute_protocol_id_to_string(Ip_u8 v);
IP_GLOBAL const char *
ipike_attribute_rohc_to_string(Ip_u16 v);
IP_GLOBAL const char *
ipike_attribute_prf_alg_to_string_v2(Ip_u16 v);
/*
*===========================================================================
* ipike_attribute_xxx_from_string
*===========================================================================
* Description: Converts the string representation of a attribute to its
* numerical form.
* Parameters: s - The string representation of the value.
* v - Will hold the value if the call is successful.
* Returns: IPIKE_SUCCESS
* IPIKE_VALUE_NOT_FOUND
* IPIKE_INVALID_VALUE
*
*/
IP_GLOBAL Ipike_error
ipike_attribute_encryption_alg_from_string(const char* s, Ip_u16* v);
IP_GLOBAL Ipike_error
ipike_attribute_encryption_alg_from_string_v2(const char* s, Ip_u16* v);
IP_GLOBAL Ipike_error
ipike_attribute_hash_alg_from_string(const char* s, Ip_u16* v);
IP_GLOBAL Ipike_error
ipike_attribute_auth_method_from_string(const char* s, Ip_u16* v);
IP_GLOBAL Ipike_error
ipike_attribute_auth_method_from_string_v2(const char* s, Ip_u8* v);
IP_GLOBAL Ipike_error
ipike_attribute_dh_group_from_string(const char* s, Ip_u16* v);
IP_GLOBAL Ipike_error
ipike_attribute_life_type_from_string(const char* s, Ip_u16* v);
IP_GLOBAL Ipike_error
ipike_attribute_key_length_from_enc_alg_string(const char* s, Ip_u16* v);
IP_GLOBAL Ipike_error
ipike_attribute_key_length_from_enc_alg_string_v2(const char* s, Ip_u16* v);
IP_GLOBAL Ipike_error
ipike_attribute_id_type_from_string(const char* s, Ip_u8* v);
IP_GLOBAL Ipike_error
ipike_attribute_protocol_id_from_string(const char* s, Ip_u8* v);
/*
*===========================================================================
* ipike_attribute_map_Ip_u16
*===========================================================================
* Description: Helper function that uses Ip_u16 values instead of int values.
* Parameters: attr - the attribute to check.
* Returns: IPIKE_SUCCESS
* IPIKE_VALUE_NOT_FOUND
*/
IP_GLOBAL Ipike_error
ipike_attribute_map_Ip_u16(const Ipike_string_int_map map[], const char* key, Ip_u16* value);
IP_GLOBAL Ipike_error
ipike_attribute_map_Ip_u8(const Ipike_string_int_map map[], const char* key, Ip_u8* value);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_channel.c
+866
View File
@@ -0,0 +1,866 @@
/*
******************************************************************************
* SOURCE FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_channel.c,v $ $Revision: 1.6.2.6 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_channel.c,v $
* $Author: zan $ $Date: 2013-08-02 07:52:29 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Erik Dahlberg <erik.dahlberg@windriver.com>
******************************************************************************
*/
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* A message channel framework */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#define IPCOM_USE_CLIB_PROTO
#include "ipike_config.h"
#ifdef IPIKE_USE_EVENT_LOG
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_h.h"
#include "ipike_channel.h"
/*
****************************************************************************
* 4 EXTERN PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 5 DEFINES
****************************************************************************
*/
#define IPIKE_CHANNEL_ADDRESS_MAX_LEN 32
#define IPIKE_CHANNEL_USE_TCP
#define for_each_channel_in_server(_chan, _server) \
for (_chan = (Ipike_channel *) ipcom_list_first(&_server->channel_list);\
_chan != IP_NULL; \
_chan = (Ipike_channel *) ipcom_list_next(&_chan->list) )
/*
****************************************************************************
* 6 TYPES
****************************************************************************
*/
typedef enum Ipike_channel_state_enum
{
IPIKE_CHANNEL_STATE_CLOSED = 0,
IPIKE_CHANNEL_STATE_LISTEN = 1,
IPIKE_CHANNEL_STATE_OPEN = 2,
} Ipike_channel_state;
struct Ipike_channel_struct
{
Ipcom_list list;
Ip_fd fd;
Ipike_channel_state state;
Ipcom_mutex mutex;
};
struct Ipike_channel_server_struct
{
Ipcom_list channel_list;
Ipike_channel_server_cb on_open_cb;
Ipike_channel_server_cb on_close_cb;
Ipike_channel_server_receive_cb on_receive_cb;
};
enum Ipike_channel_msg_type_enum
{
IPIKE_CHANNEL_REGISTER = 0,
IPIKE_CHANNEL_UNREGISTER = 1,
IPIKE_CHANNEL_MESSAGE = 2,
};
#define MSG_HDR(_msg) ((Ipike_channel_msg_header *)_msg - 1);
struct Ipike_channel_addr_struct
{
union Ip_sockaddr_union addr;
};
/*
****************************************************************************
* 7 LOCAL PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 8 DATA
****************************************************************************
*/
/*
****************************************************************************
* 9 LOCAL FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_channel_set_state
*===========================================================================
*/
IP_INLINE void
ipike_channel_set_state(
Ipike_channel * channel,
Ipike_channel_state state)
{
channel->state = state;
}
/*
*===========================================================================
* ipike_channel_is_open
*===========================================================================
*/
IP_INLINE Ip_bool
ipike_channel_is_open(
const Ipike_channel * channel)
{
return (channel->state == IPIKE_CHANNEL_STATE_OPEN);
}
/*
*===========================================================================
* ipike_channel_lock
*===========================================================================
*/
IP_INLINE void
ipike_channel_lock(
const Ipike_channel * channel)
{
IPCOM_LOG1(DEBUG2, "locking channel %p", channel);
ipcom_mutex_lock(channel->mutex);
}
/*
*===========================================================================
* ipike_channel_unlock
*===========================================================================
*/
IP_INLINE void
ipike_channel_unlock(
const Ipike_channel * channel)
{
IPCOM_LOG1(DEBUG2, "Unlocking channel %p", channel);
ipcom_mutex_unlock(channel->mutex);
}
/*
*===========================================================================
* ipike_channel_destroy
*===========================================================================
*/
IP_PUBLIC void
ipike_channel_destroy(
Ipike_channel * channel)
{
ip_assert(channel != IP_NULL);
IPCOM_LOG1(DEBUG2, "Destroying channel %p", channel);
ipike_channel_close(channel);
(void)ipcom_mutex_delete(&channel->mutex);
ipcom_free(channel);
}
/*
*===========================================================================
* ipike_channel_server_destroy
*===========================================================================
*/
IP_GLOBAL void
ipike_channel_server_destroy(
Ipike_channel_server * cserver)
{
Ipike_channel * channel;
ip_assert(cserver != IP_NULL);
IPCOM_LOG1(DEBUG2, "Destroying channel server %p", cserver);
for ( channel = (Ipike_channel *) ipcom_list_first(&cserver->channel_list);
channel != IP_NULL;
channel = (Ipike_channel *) ipcom_list_first(&cserver->channel_list))
{
ipcom_list_remove(&channel->list);
ipike_channel_destroy(channel);
}
ipcom_free(cserver);
}
/*
*===========================================================================
* ipike_channel_create
*===========================================================================
*/
IP_STATIC Ipike_channel *
ipike_channel_create()
{
Ipike_channel *channel;
channel = ipcom_malloc(sizeof(Ipike_channel));
if ( IP_NULL == channel )
return IP_NULL;
ipcom_memset(channel, 0, sizeof(Ipike_channel));
channel->fd = IP_INVALID_SOCKET;
ipike_channel_set_state(channel, IPIKE_CHANNEL_STATE_CLOSED);
/* Create channel mutex */
if ( ipcom_mutex_create(&channel->mutex) != IPCOM_SUCCESS )
{
ipcom_free(channel);
return IP_NULL;
}
return channel;
}
/*
*===========================================================================
* ipike_channel_server_accept_new_channel
*===========================================================================
*/
IP_STATIC Ipike_channel_status
ipike_channel_server_accept_new_channel(
Ipike_channel_server * cserver,
Ipike_channel * channel)
{
Ipike_channel * new_channel;
Ip_fd fd;
ip_assert(channel->state == IPIKE_CHANNEL_STATE_LISTEN);
IPCOM_LOG0(DEBUG2, "ipike_channel_server_accept_new_channel() :: "\
"received new connection attempt");
fd = ipcom_accept(channel->fd, IP_NULL, 0 );
if ( fd < 0 )
{
IPCOM_LOG1(ERR, "ipike_channel_server_accept_new_channel() :: "\
"failed to accept new connection (%s)",
ipcom_strerror(ipcom_errno));
return IPIKE_CHANNEL_ERROR;
}
/* Create a new channel */
new_channel = ipike_channel_create();
if ( new_channel == NULL )
{
IP_PANIC();
return IPIKE_CHANNEL_ERROR;
}
/* Set channel state and add it to the channel list */
new_channel->fd = fd;
ipike_channel_set_state(new_channel, IPIKE_CHANNEL_STATE_OPEN);
ipcom_list_insert_last(&cserver->channel_list, &new_channel->list);
/* Notify user with the new channel */
if ( cserver->on_open_cb )
cserver->on_open_cb(new_channel);
IPCOM_LOG0(DEBUG, "ipike_channel_server_accept_new_channel() :: "\
"new channel established");
return IPIKE_CHANNEL_OK;
}
/*
****************************************************************************
* 10 PUBLIC FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_channel_addr_create
*===========================================================================
*/
IP_GLOBAL Ipike_channel_addr *
ipike_channel_addr_create(
const char * caddr_str)
{
Ipike_channel_addr * caddr;
char tmp[IPIKE_CHANNEL_ADDRESS_MAX_LEN];
char * ip_str;
char * port_str;
Ip_u16 port;
caddr = ipcom_malloc(sizeof(Ipike_channel_addr));
if ( caddr == IP_NULL )
return IP_NULL;
ipcom_memset(caddr, 0, sizeof(Ipike_channel_addr));
ipcom_memset(tmp, 0, sizeof(tmp));
ipcom_strncpy(tmp, caddr_str, sizeof(tmp) - 1);
port_str = ipcom_strchr(tmp, '@');
if ( port_str == IP_NULL )
{
ipcom_free(caddr);
return IP_NULL;
}
ip_str = tmp;
*port_str = '\0';
port_str++;
port = (Ip_u16)ipcom_atoi(port_str);
#ifdef IPCOM_USE_INET
if ( 1 == ipcom_inet_pton(IP_AF_INET,
ip_str,
&caddr->addr.sin.sin_addr))
{
caddr->addr.sa.sa_family = IP_AF_INET;
caddr->addr.sin.sin_port = ip_htons(port);
IPCOM_SA_LEN_SET(&caddr->addr.sa, sizeof(struct Ip_sockaddr_in));
return caddr;
}
#endif
#ifdef IPCOM_USE_INET6
if ( 1 == ipcom_inet_pton(IP_AF_INET6,
ip_str,
&caddr->addr.sin6.sin6_addr) )
{
caddr->addr.sa.sa_family = IP_AF_INET6;
caddr->addr.sin6.sin6_port = ip_htons(port);
IPCOM_SA_LEN_SET(&caddr->addr.sa, sizeof(struct Ip_sockaddr_in6));
return caddr;
}
#endif
return caddr;
}
/*
*===========================================================================
* ipike_channel_addr_destroy
*===========================================================================
*/
IP_GLOBAL void
ipike_channel_addr_destroy(
Ipike_channel_addr * caddr)
{
ipcom_free(caddr);
}
/*
*===========================================================================
* ipike_channel_msg_create
*===========================================================================
*/
IP_GLOBAL Ipike_channel_msg *
ipike_channel_msg_create(Ip_u16 len)
{
Ipike_channel_msg * msg;
Ip_size_t msg_len;
msg_len = sizeof(Ipike_channel_msg) + len;
msg = ipcom_malloc(msg_len);
if ( msg == IP_NULL )
return IP_NULL;
ipcom_memset(msg, 0, msg_len);
msg->type = IPIKE_CHANNEL_MESSAGE;
msg->len = (Ip_u16)msg_len;
return msg;
}
/*
*===========================================================================
* ike_channel_msg_destroy(
*===========================================================================
*/
IP_GLOBAL void
ipike_channel_msg_destroy(
Ipike_channel_msg *msg)
{
ip_assert(msg);
ipcom_free(msg);
}
/*
*===========================================================================
* ipike_channel_server_add_fds
*===========================================================================
*/
IP_GLOBAL int
ipike_channel_server_add_fds(
Ipike_channel_server * cserver,
Ip_fd_set * read_fds,
Ip_fd_set * write_fds)
{
Ipike_channel * channel;
int max = -1;
IPCOM_UNUSED_ARG(write_fds);
for_each_channel_in_server(channel, cserver)
{
switch (channel->state)
{
case IPIKE_CHANNEL_STATE_LISTEN:
case IPIKE_CHANNEL_STATE_OPEN:
IP_FD_SET(channel->fd, read_fds);
break;
default:
IPCOM_LOG1(ERR, "ipike_channel_server_add_fds() :: "\
"invalid fd state (%u)",
channel->state);
break;
}
max = IP_MAX(channel->fd, max);
}
return max;
}
/*
*===========================================================================
* ipike_channel_server_broadcast_msg
*===========================================================================
*/
IP_GLOBAL void
ipike_channel_server_broadcast_msg(
Ipike_channel_server * channel_server,
Ipike_channel_msg * msg)
{
Ipike_channel *channel;
/* Broadcast message on all open channels */
for_each_channel_in_server(channel, channel_server)
{
if ( ipike_channel_is_open(channel) )
{
ipike_channel_send_msg(channel, msg);
}
}
}
/*
*===========================================================================
* ipike_channel_server_create
*===========================================================================
*/
IP_GLOBAL Ipike_channel_server *
ipike_channel_server_create(
Ipike_channel_addr * caddr,
Ipike_channel_server_cb on_open_cb,
Ipike_channel_server_cb on_close_cb,
Ipike_channel_server_receive_cb on_receive_cb)
{
Ipike_channel_server * cserver;
Ipike_channel * channel;
cserver = ipcom_malloc(sizeof(Ipike_channel_server));
if ( IP_NULL == cserver )
return IP_NULL;
ipcom_memset(cserver, 0, sizeof(Ipike_channel_server));
ipcom_list_init(&cserver->channel_list);
/* Set user callbacks */
cserver->on_open_cb = on_open_cb;
cserver->on_close_cb = on_close_cb;
cserver->on_receive_cb = on_receive_cb;
channel = ipike_channel_create();
if ( channel == IP_NULL )
goto errout;
ipcom_list_insert_last(&cserver->channel_list, &channel->list);
/* Open socket */
#if defined(IPCOM_USE_INET)
channel->fd = ipcom_socket(IP_AF_INET, IP_SOCK_STREAM, IP_IPPROTO_TCP);
#elif defined(IPCOM_USE_INET6)
channel->fd = ipcom_socket(IP_AF_INET6, IP_SOCK_STREAM, IP_IPPROTO_TCP);
#endif
if ( channel->fd < 0 )
goto errout;
/* Bind channel server */
if ( ipcom_bind(channel->fd,
(struct Ip_sockaddr *) &caddr->addr,
IPCOM_SA_LEN_GET(&caddr->addr)) < 0 )
goto errout;
/* Start listen for new connections */
if (ipcom_listen(channel->fd, 1) != 0)
{
IPCOM_LOG1(WARNING, "ipike_event_channel_bind() :: failed to set socket to"\
" listen state (%s)",
ipcom_strerror(ipcom_errno));
goto errout;
}
/* The channel is listen state */
ipike_channel_set_state(channel, IPIKE_CHANNEL_STATE_LISTEN);
return cserver;
errout:
if ( cserver )
ipike_channel_server_destroy(cserver);
return IP_NULL;
}
/*
*===========================================================================
* ipike_channel_open
*===========================================================================
*/
IP_GLOBAL Ipike_channel *
ipike_channel_open(
Ipike_channel_addr * caddr)
{
Ipike_channel * channel;
/* Create channel */
channel = ipike_channel_create();
if ( channel == IP_NULL )
goto errout;
/* Open socket */
#if defined(IPCOM_USE_INET)
channel->fd = ipcom_socket(IP_AF_INET, IP_SOCK_STREAM, IP_IPPROTO_TCP);
#elif defined(IPCOM_USE_INET6)
channel->fd = ipcom_socket(IP_AF_INET6, IP_SOCK_STREAM, IP_IPPROTO_TCP);
#endif
if ( channel->fd < 0 )
goto errout;
/* Connect to IKE Daemon */
if ( ipcom_connect(channel->fd,
(struct Ip_sockaddr *) &caddr->addr,
IPCOM_SA_LEN_GET(&caddr->addr)) < 0 )
goto errout;
/* The channel is established */
ipike_channel_set_state(channel, IPIKE_CHANNEL_STATE_OPEN);
return channel;
errout:
if (channel)
ipike_channel_destroy(channel);
return IP_NULL;
}
/*
*===========================================================================
* ipike_channel_close
*===========================================================================
*/
IP_GLOBAL void
ipike_channel_close(
Ipike_channel * channel)
{
ipike_channel_lock(channel);
/* Close channel socket */
if ( channel->fd != IP_INVALID_SOCKET )
{
(void)ipcom_socketclose(channel->fd);
channel->fd = IP_INVALID_SOCKET;
}
ipike_channel_set_state(channel, IPIKE_CHANNEL_STATE_CLOSED);
ipike_channel_unlock(channel);
}
/*
*===========================================================================
* ipike_channel_receive_msg
*===========================================================================
*/
IP_GLOBAL Ipike_channel_status
ipike_channel_receive_msg(
Ipike_channel * channel,
Ipike_channel_msg ** msg)
{
Ipike_channel_msg hdr;
Ipike_channel_msg * msg_out = IP_NULL;
Ipike_channel_status err = IPIKE_CHANNEL_ERROR;
Ip_ssize_t ret = 0;
Ip_size_t len;
Ip_fd fd;
ipike_channel_lock(channel);
fd = channel->fd;
ipike_channel_unlock(channel);
/* Read header information */
ret = ipcom_recv(fd, &hdr, sizeof(hdr), 0);
/* Receive error */
if ( ret < 0 )
{
IPCOM_LOG2(DEBUG, "ipike_channel_receive_msg() :: "\
"failed to receive (%ld) (%s)",
ret,
ipcom_strerror(ipcom_errno));
goto errout;
}
/* Socket closed */
if ( ret == 0 )
{
IPCOM_LOG0(DEBUG, "ipike_channel_receive_msg() :: channel closed");
err = IPIKE_CHANNEL_CLOSED;
goto errout;
}
/* Expect the same size as specified in header */
if ( (Ip_ssize_t) ret != sizeof(hdr) )
{
IPCOM_LOG2(DEBUG, "ipike_channel_receive_msg() :: "\
"bad message, got %ld , expected %ld",
hdr.len, sizeof(hdr));
goto errout;
}
IPCOM_LOG1(DEBUG2, "ipike_channel_receive_msg() :: "\
"received message header of length %d\n", hdr.len);
/* If no message buffer was provided, create one dynamically */
if ( *msg == IP_NULL )
{
/* Allocate message space */
/* packet is sent by target itself, it is not vulnerable to attack */
/* coverity[tainted_data] : INTENTIONAL */
msg_out = ipike_channel_msg_create(hdr.len);
if ( msg_out == IP_NULL )
{
IP_PANIC();
goto errout;
}
*msg = msg_out;
}
else
{
/* Make sure the provided buffer has enough space for this message */
if ( (*msg)->len < hdr.len )
{
IPCOM_LOG0(DEBUG, "ipike_channel_receive_msg() :: "
"not enough memory in provided message");
goto errout;
}
}
/* Set message length to the size of the received message */
(*msg)->len = hdr.len;
/* Read the rest of the message */
len = (*msg)->len - sizeof(Ipike_channel_msg);
ret = ipcom_recv(fd, (*msg) + 1, len , 0);
if ( ret == 0 )
{
IPCOM_LOG0(DEBUG, "ipike_channel_receive_msg() :: channel closed");
err = IPIKE_CHANNEL_CLOSED;
goto errout;
}
if ( ret != (Ip_ssize_t) len )
{
IPCOM_LOG2(DEBUG, "ipike_channel_receive_msg() :: "\
"failed to receive message (%ld) (%s)",
ret,
ipcom_strerror(ipcom_errno));
goto errout;
}
IPCOM_LOG1(DEBUG, "ipike_channel_receive_msg() :: "\
"Successfully received message (%d)",
hdr.len);
return IPIKE_CHANNEL_OK;
errout:
if ( msg_out )
ipike_channel_msg_destroy(msg_out);
return err;
}
/*
*===========================================================================
* ipike_channel_send_msg
*===========================================================================
*/
IP_GLOBAL Ipike_channel_status
ipike_channel_send_msg(
Ipike_channel * channel,
Ipike_channel_msg * msg)
{
ip_assert(channel);
ip_assert(msg);
/* We need an open channel */
if ( !ipike_channel_is_open(channel) )
{
IPCOM_LOG0(DEBUG, "ipike_channel_send_msg() :: "\
"channel is not open");
return IPIKE_CHANNEL_CLOSED;
}
/* Send message */
if ( ipcom_send(channel->fd, (void *) msg, msg->len, 0) != msg->len )
{
IPCOM_LOG1(ERR, "ipike_channel_send_msg() :: "\
"failed to send message (%s)",
ipcom_strerror(ipcom_errno));
return IPIKE_CHANNEL_ERROR;
}
/* Message has been sent */
return IPIKE_CHANNEL_OK;
}
/*
*===========================================================================
* ipike_channel_server_process
*===========================================================================
*/
IP_GLOBAL int
ipike_channel_server_process(
Ipike_channel_server * cserver,
Ip_fd_set * read_fds,
Ip_fd_set * write_fds)
{
Ipike_channel * channel;
Ipike_channel * next;
int num_processed = 0;
IPCOM_UNUSED_ARG(write_fds);
/* Get first channel */
channel = (Ipike_channel * )ipcom_list_first(&cserver->channel_list);
if (channel==IP_NULL)
{
return 0;
}
/* This is the master channel where new connection can arrive on */
if ( IP_FD_ISSET(channel->fd, read_fds) )
{
/* Accept new channel connection */
(void)ipike_channel_server_accept_new_channel(cserver, channel);
num_processed++;
}
/* Continue to check if there are messages on other channels */
channel = (Ipike_channel *) ipcom_list_next(&channel->list);
while ( channel )
{
/* Receive data */
Ipike_channel_msg * msg = IP_NULL;
/* Store next pointer so we can remote the channel object if is needed */
next = (Ipike_channel *) ipcom_list_next(&channel->list);
if ( IP_FD_ISSET(channel->fd, read_fds) )
{
/* Receive message */
if ( ipike_channel_receive_msg(channel, &msg) != IPIKE_CHANNEL_OK )
{
IPCOM_LOG0(DEBUG, "ipike_channel_server_process():: "\
"closing channel");
ipcom_list_remove(&channel->list);
/* Notify user that channel is closed */
if ( cserver->on_close_cb )
cserver->on_close_cb(channel);
/* Destroy the channel on errors */
ipike_channel_destroy(channel);
}
else
{
/* Send message to user receive callback */
if (cserver->on_receive_cb)
cserver->on_receive_cb(channel, msg);
/* Destroy message */
ipike_channel_msg_destroy(msg);
}
num_processed++;
}
channel = next;
}
return num_processed;
}
#else
int ipike_channel_empty_file = 0;
#endif /* IPIKE_USE_EVENT_LOG */
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_channel.h
+339
View File
@@ -0,0 +1,339 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_channel.h,v $ $Revision: 1.3.2.2 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_channel.h,v $
* $Author: ulf $ $Date: 2011-11-16 10:33:31 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Erik Dahlberg <erik.dahlberg@windriver.com>
******************************************************************************
*/
#ifndef IPIKE_CHANNEL_H_
#define IPIKE_CHANNEL_H_
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
#ifdef IPIKE_USE_EVENT_LOG
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
/* Static initialization of a channel message */
#define IPIKE_CHANNEL_MSG_INIT_STATIC(_msg, _buf) \
do { \
ipcom_memset(&_buf, 0, sizeof(_buf)); \
_msg = (Ipike_channel_msg *) &_buf; \
_msg->len = (Ip_u16) sizeof(_buf); \
} while(0)
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/* Channel status */
typedef enum Ipike_channel_status_enum
{
IPIKE_CHANNEL_OK = 0,
IPIKE_CHANNEL_CLOSED = 1,
IPIKE_CHANNEL_ERROR = 2,
} Ipike_channel_status;
/* IKE channel object */
typedef struct Ipike_channel_struct Ipike_channel;
/* IKE channel server object */
typedef struct Ipike_channel_server_struct Ipike_channel_server;
/* IKE channel address object */
typedef struct Ipike_channel_addr_struct Ipike_channel_addr;
/* Channel message header which all type of messages must include */
typedef struct Ipike_channel_msg_struct
{
Ip_u16 type;
Ip_u16 len;
} Ipike_channel_msg;
/* Channel server callback for channel state updates */
typedef int (*Ipike_channel_server_cb) (Ipike_channel *channel);
/* Channel server callback for receiving messages */
typedef int (*Ipike_channel_server_receive_cb)
(
Ipike_channel * channel,
Ipike_channel_msg * msg
);
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_channel_msg_create
*===========================================================================
* Description: Creates and allocates a channel message of size 'len'
* dynamically.
* Parameters: len - desired length of message.
* Returns: A pointer to a new channel message or
* IP_NULL on failure
*/
IP_GLOBAL Ipike_channel_msg *
ipike_channel_msg_create(
Ip_u16 len);
/*
*===========================================================================
* Ipike_channel_msg_destroy
*===========================================================================
* Description: Creates and allocates a channel message of size 'len'
* dynamically.
* Parameters: len - desired length of message.
* Returns: A pointer to a new channel message or
* IP_NULL on failure
*/
IP_GLOBAL void
ipike_channel_msg_destroy(
Ipike_channel_msg *msg);
/*
*===========================================================================
* ipike_channel_addr_create
*===========================================================================
* Description: Creates a new channel address from a string.
* Parameters: caddr_str - String representation of a channel address.
* Returns: The new channel address or
* IP_NULL on failure
*/
IP_GLOBAL Ipike_channel_addr *
ipike_channel_addr_create(
const char * caddr_str);
/*
*===========================================================================
* ipike_channel_addr_destroy
*===========================================================================
* Description: Creates and allocates a channel message of size 'len'
* dynamically.
* Parameters: len - desired length of message.
* Returns: A pointer to a new channel message or
* IP_NULL on failure
*/
IP_GLOBAL void
ipike_channel_addr_destroy(
Ipike_channel_addr * caddr);
/*
*===========================================================================
* ipike_channel_open
*===========================================================================
* Description: Creates and opens up a channel to the endpoint specified by
* the channel address.
* Parameters: caddr - Channel address
* Returns: A new channel object of IP_NULL on failure
*/
IP_GLOBAL Ipike_channel *
ipike_channel_open(
Ipike_channel_addr * caddr);
/*
*===========================================================================
* ipike_channel_close
*===========================================================================
* Description: Creates and allocates a channel message of size 'len'
* dynamically.
* Parameters: len - desired length of message.
* Returns: A pointer to a new channel message or
* IP_NULL on failure
*/
IP_GLOBAL void
ipike_channel_close(
Ipike_channel * channel);
/*
*===========================================================================
* ipike_channel_destroy
*===========================================================================
* Description: Destroys and closes a channel.
* Parameters: channel - Channel
* Returns:
*/
IP_PUBLIC void
ipike_channel_destroy(
Ipike_channel * channel);
/*
*===========================================================================
* ipike_channel_send_msg
*===========================================================================
* Description: Sends a message on a channel.
*
* Parameters: channel - Channel
* msg - Channel message
* Returns: IPIKE_CHANNEL_OK - Message was sent successfully.
* IPIKE_CHANNEL_CLOSED
* IPIKE_CHANNEL_ERROR
*/
IP_GLOBAL Ipike_channel_status
ipike_channel_send_msg(
Ipike_channel * channel,
Ipike_channel_msg * msg);
/*
*===========================================================================
* ipike_channel_receive_msg
*===========================================================================
* Description: Receive a message on a channel, will block until a message
* is received or the channel is closed. If *msg is IP_NULL a
* new message will be dynamically allocated and used as storage
* for the received message, otherwise it will use the message
* buffer *msg.
*
* Parameters: channel - Channel
* msg - Channel message
*
* Returns: IPIKE_CHANNEL_OK - Message was received successfully.
* IPIKE_CHANNEL_CLOSED
* IPIKE_CHANNEL_ERROR
*/
IP_GLOBAL Ipike_channel_status
ipike_channel_receive_msg(
Ipike_channel * channel,
Ipike_channel_msg ** msg);
/*
*===========================================================================
* ipike_channel_server_create
*===========================================================================
* Description: Creates a channel server which are listening on the provided
* channel server address.
* Parameters: caddr - Channel server address.
* on_connect_cb - Callback which is called when a new channel
* is opened.
* on_close_cb - Callback which is called when a channel is
* closed.
* on_receive_cb - Callback which is called when a message is
* received on a channel.
*
* Returns: Channel server object
*/
IP_GLOBAL Ipike_channel_server *
ipike_channel_server_create(
Ipike_channel_addr * caddr,
Ipike_channel_server_cb on_open_cb,
Ipike_channel_server_cb on_close_cb,
Ipike_channel_server_receive_cb on_receive_cb);
/*
*===========================================================================
* ipike_channel_server_destroy
*===========================================================================
* Description: Closes all channels and destroys the channel server object.
* Parameters: cserver - Channel server object.
* Returns:
*/
IP_GLOBAL void
ipike_channel_server_destroy(
Ipike_channel_server * cserver);
/*
*===========================================================================
* ipike_channel_server_broadcast_msg
*===========================================================================
* Description: Broadcasts a message on all channels that are managed by
* the channel server.
*
* Parameters: cserver - Channel server object.
* msg - Message to broadcast
* Returns:
*/
IP_GLOBAL void
ipike_channel_server_broadcast_msg(
Ipike_channel_server * cserver,
Ipike_channel_msg * msg);
/*
*===========================================================================
* ipike_channel_server_add_fds
*===========================================================================
* Description: Adds any internal sockets held be the channel server into the
* file descriptor set.
*
* Parameters: cserver - Channel server object.
* read_fds - Read file descriptor set.
* write_fds - Write file descriptor set.
* Returns: The largest file descriptor that was added, or
* -1 if no file descriptor was added.
*/
IP_GLOBAL int
ipike_channel_server_add_fds(
Ipike_channel_server * cserver,
Ip_fd_set * read_fds,
Ip_fd_set * write_fds);
/*
*===========================================================================
* ipike_channel_server_process
*===========================================================================
* Description: Process internal sockets inside the channel server which has
* been added with ipike_channel_server_add_fds.
*
* Parameters: cserver - Channel server object.
* read_fds - Read file descriptor set.
* write_fds - Write file descriptor set.
* Returns: The number of processed file descriptors, 0 if no file
* descriptors were processed.
*/
IP_GLOBAL int
ipike_channel_server_process(
Ipike_channel_server * cserver,
Ip_fd_set * read_fds,
Ip_fd_set * write_fds);
#ifdef __cplusplus
}
#endif
#endif /* IPIKE_CHANNEL_H_ */
#endif /* IPIKE_USE_EVENT_LOG */
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_cmd.c
+940
View File
@@ -0,0 +1,940 @@
/*
******************************************************************************
* INTERPEAK SOURCE FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_RCPL8_2024030303 $ $RCSfile: ipike_cmd.c,v $ $Revision: 1.43.10.4 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_cmd.c,v $
* $Author: jren $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_h.h"
#include "ipike.h"
#include "ipike_configuration_api.h"
#include "ipike_ipc.h"
#include "ipike_map.h"
#include <ipcom_type.h>
#include <ipcom_cstyle.h>
#include <ipcom_os.h>
#include <ipcom_getopt.h>
#ifdef IPIKE_USE_EVENT_LOG_TEST
#include <ipike_event_receiver.h>
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
#define IPIKE_CMD_PRINTF(statement, silent) do { if (!silent) statement; } while (0)
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
typedef struct Ipike_cmd_param_struct
{
Ip_bool silent;
}
Ipike_cmd_param;
/*
****************************************************************************
* 6 EXTERN PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 7 LOCAL PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 8 DATA
****************************************************************************
*/
#ifdef IPIKE_USE_EVENT_LOG_TEST
IP_STATIC Ip_u16 event_log_stats[IPIKE_EVENT_MAX] = {0};
#endif
/*
****************************************************************************
* 9 STATIC FUNCTIONS
****************************************************************************
*/
#ifdef IPIKE_USE_PERF_EVAL
IP_STATIC void
ipike_print_perf_stats(Ip_u32 uptime, Ip_u32 exchanges, Ip_u32 entries, Ipike_perf *stat_ptr);
#endif
/*
*===========================================================================
* ipike_cmd_create_socket
*===========================================================================
* Description: Create cmd socket.
* Parameters:
* Returns:
*
*/
IP_STATIC Ip_fd
ipike_cmd_create_socket(void)
{
return ipike_dispath_open_cmd_socket(IP_FALSE);
}
/*
*===========================================================================
* ipike_cmd_readn
*===========================================================================
* Description: Read 'len' bytes from a blocking socket.
* Parameters:
* Returns:
*
*/
IP_STATIC Ip_ssize_t
ipike_cmd_readn(Ip_fd fd, void *buf, Ip_size_t len)
{
Ip_ssize_t ret;
Ip_size_t read = 0;
while (read < len)
{
ret = ipcom_socketread(fd, (Ip_u8 *)buf + read, len - read);
if (ret <= 0)
/* Socket error or closed. */
return -1;
read += (Ip_size_t)ret;
}
ip_assert(read == len);
return (Ip_ssize_t)len;
}
/*
*===========================================================================
* ipike_cmd_send
*===========================================================================
* Description: Send a command to IPIKE
* Parameters:
* Returns:
*
*/
IP_STATIC int
ipike_cmd_send(Ip_u8 cmd, Ip_u8* buf, Ip_u32 len, Ip_fd* fd)
{
Ip_err err = 0;
Ip_u32 n = 0;
if (ipcom_ipd_send(IPIKE_IPD_NAME, IPCOM_IPD_MSGTYPE_PING) != IPCOM_SUCCESS)
{
ipcom_printf("The IPIKE daemon is not started" IP_LF);
return IP_ERRNO_ESRCH;
}
if (IP_INVALID_SOCKET == (*fd = ipike_cmd_create_socket()))
{
ipcom_printf("Failed to create shell command socket"IP_LF);
err = ipcom_errno;
}
else
{
n = ip_htonl(len);
if (ipcom_socketwrite(*fd, &cmd, sizeof(cmd)) < 0)
{
ipcom_printf("Failed to write command"IP_LF);
err = ipcom_errno;
}
else if (ipcom_socketwrite(*fd, &n, sizeof(n)) < 0)
{
ipcom_printf("Failed to write command data length"IP_LF);
err = ipcom_errno;
}
else if ((len > 0) &&
(ipcom_socketwrite(*fd, buf, len) < 0))
{
ipcom_printf("Failed to write command data length"IP_LF);
err = ipcom_errno;
}
if (IPCOM_SUCCESS != err)
{
ipcom_socketclose(*fd);
*fd = IP_INVALID_SOCKET;
}
}
return err;
}
/*
*===========================================================================
* ipike_cmd_send_string
*===========================================================================
* Description: Send a command with a string as only argument
* Parameters: arg - the argument.
* Returns:
*/
IP_STATIC int
ipike_cmd_send_string(Ip_u8 type, const char* arg)
{
Ip_fd fd = IP_INVALID_SOCKET;
Ip_u8* buf = IP_NULL;
Ip_u32 len = 0;
buf = (Ip_u8*)arg;
len = (Ip_u32) ipcom_strlen(arg) + 1;
if (ipike_cmd_send(type, buf, len, &fd) != IPCOM_SUCCESS)
{
ipcom_printf("Send string command failed"IP_LF);
}
else
{
buf = IP_NULL;
if ((ipike_cmd_readn(fd, &len, sizeof(len)) < 0) ||
((len = ip_ntohl(len)) == 0) ||
((buf = ipcom_malloc(len)) == IP_NULL) ||
(ipike_cmd_readn(fd, buf, len) < 0) ||
(buf[len-1] != 0))
{
ipcom_printf("Receive string command failed"IP_LF);
}
else
{
ipcom_printf("%s"IP_LF, buf);
}
ipcom_free(buf);
ipcom_socketclose(fd);
}
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_cmd_send_string
*===========================================================================
* Description: Send a command with a string as only argument
* Parameters: arg1 - the first argument.
* arg2 - the second argument.
* Returns:
*/
IP_STATIC int
ipike_cmd_send_string2(Ip_u8 type, const char* arg1, const char* arg2)
{
int err = IPIKE_SUCCESS;
char* arg = IP_NULL;
arg = ipcom_malloc(ipcom_strlen(arg1) + ipcom_strlen(arg2) + 2);
if (IP_NULL == arg)
{
IP_PANIC();
err = IPIKE_OUT_OF_MEMORY;
}
else
{
ipcom_sprintf(arg, "%s %s", arg1, arg2);
err = ipike_cmd_send_string(type, arg);
ipcom_free(arg);
}
return err;
}
/*
*===========================================================================
* ipike_cmd_list
*===========================================================================
* Description: Lists all IKE SA to the console.
* Parameters:
* Returns:
*
*/
IP_STATIC int
ipike_cmd_list(void)
{
Ip_err err = 0;
int i;
char str_addr[IPIKE_ADDRSTRLEN];
int cmd_sock = IP_INVALID_SOCKET;
int num_sas;
struct Ipike_ipd_sa_info sa;
const char* str = IP_NULL;
if (ipike_cmd_send(IPIKE_CMD_LIST, IP_NULL, 0, &cmd_sock) != IPCOM_SUCCESS)
return IP_ERRNO_ESRCH;
if (ipike_cmd_readn(cmd_sock, &num_sas, sizeof(num_sas)) < 0)
{
ipcom_printf("failed to recv shell command socket: %s"IP_LF,
ipcom_strerror(ipcom_errno));
err = ipcom_errno;
goto cleanup;
}
for (i = 0; i < num_sas; i++)
{
if (ipike_cmd_readn(cmd_sock, &sa, sizeof(sa)) < 0)
{
ipcom_printf("failed to recv shell command socket: %s"IP_LF,
ipcom_strerror(ipcom_errno));
err = ipcom_errno;
goto cleanup;
}
ipcom_printf("[%d] initiator cookie: %s ",
i, ipike_cookie_to_string(sa.initiator_cookie));
ipcom_printf("responder cookie: %s" IP_LF,
ipike_cookie_to_string(sa.responder_cookie));
#ifdef _WRS_CONFIG_TIME_T_LONG_LONG
ipcom_printf("\tcreated %lld seconds ago as %s, ref.count: %d, state: ",
ipike_time() - sa.created,
sa.is_initiator ? "initiator" : "responder",
sa.ref_count);
#else
ipcom_printf("\tcreated %ld seconds ago as %s, ref.count: %d, state: ",
ipike_time() - sa.created,
sa.is_initiator ? "initiator" : "responder",
sa.ref_count);
#endif
switch (sa.state)
{
case IPIKE_SA_CONSTRUCTING:
ipcom_printf("CONSTRUCTING");
break;
case IPIKE_SA_ACTIVE:
ipcom_printf("ACTIVE");
break;
case IPIKE_SA_DYING:
ipcom_printf("DYING");
break;
default:
ipcom_printf("* UNKNOWN STATE *");
break;
}
ipcom_printf(IP_LF "\tpeer addr: %s",
ipcom_inet_ntop(sa.peer_addr.sa.sa_family,
ipike_addr_get_ptr(&sa.peer_addr),
str_addr,
sizeof(str_addr)));
ipcom_printf(", local addr: %s" IP_LF,
ipcom_inet_ntop(sa.local_addr.sa.sa_family,
ipike_addr_get_ptr(&sa.local_addr),
str_addr,
sizeof(str_addr)));
ipcom_printf("\tsent bytes: %d, received bytes: %d" IP_LF,
sa.bytes_sent, sa.bytes_received);
if (sa.state > IPIKE_SA_CONSTRUCTING)
{
#if defined(IPIKE_USE_VERSION2)
if (sa.version >= 0x20)
str = ipike_attribute_encryption_alg_to_string_v2(sa.encryption_algorithm);
#endif
#if defined(IPIKE_USE_VERSION1)
if (sa.version < 0x20)
str = ipike_attribute_encryption_alg_to_string(sa.encryption_algorithm);
#endif
ipcom_printf("\tencryption algorithm: %s", str);
#if defined(IPIKE_USE_VERSION2)
if (sa.version >= 0x20)
str = ipike_attribute_prf_alg_to_string_v2(sa.hash_algorithm);
else
#endif
str = ipike_attribute_hash_alg_to_string(sa.hash_algorithm);
ipcom_printf(", hash algorithm: %s" IP_LF, str);
if (sa.version >= 0x20)
str = ipike_attribute_auth_method_to_string_v2(sa.authentication_method);
else
str = ipike_attribute_auth_method_to_string(sa.authentication_method);
ipcom_printf("\tauthentication method: %s" IP_LF, str);
str = ipike_attribute_life_type_to_string(sa.life_type);
ipcom_printf("\tlife type: %s", str);
/* Make some special treatment when printing u64 */
if ( sizeof(long) == sizeof(sa.life_duration) )
ipcom_printf(", life duration: %lu" IP_LF, sa.life_duration);
#ifdef IPCOM_USE_LONGLONG_TYPE
else
ipcom_printf(", life duration: %llu" IP_LF, sa.life_duration);
#else
else /* Just print the lower 32bit if all other fails */
ipcom_printf(", life duration: %u" IP_LF, IP_U64_GETLO(sa.life_duration));
#endif
ipcom_printf("\tdh group: %s",
ipike_attribute_dh_group_to_string(sa.dh_group));
ipcom_printf(", generator: %d" IP_LF, sa.dh_generator);
ipcom_printf("\tprotocol version %d.%d" IP_LF,
((sa.version >> 4) & 0x0f),
(sa.version & 0x0f));
}
}
cleanup:
if (cmd_sock != IP_INVALID_SOCKET)
ipcom_socketclose(cmd_sock);
return err;
}
#ifdef IPIKE_USE_PERF_EVAL
/*
*===========================================================================
* ipike_cmd_new_stat
*===========================================================================
* Description: Print usage statistics to console.
* Parameters:
* Returns:
*/
IP_STATIC int
ipike_cmd_stat(void)
{
Ip_fd fd;
Ipike_perf stats;
Ip_u32 uptime;
Ip_u32 exchanges;
Ip_u32 entries;
if (ipike_cmd_send(IPIKE_CMD_STAT, IP_NULL, 0, &fd) != IPCOM_SUCCESS)
{
ipcom_printf("Send stat command failed"IP_LF);
}
else
{
if ((ipike_cmd_readn(fd, &uptime, sizeof(uptime)) < 0)
|| (ipike_cmd_readn(fd, &exchanges, sizeof(exchanges)) < 0)
|| (ipike_cmd_readn(fd, &entries, sizeof(entries)) < 0)
|| (ipike_cmd_readn(fd, &stats, sizeof(Ipike_perf)) < 0))
{
ipcom_printf("Receive stat command failed"IP_LF);
}
else
{
ipike_print_perf_stats(uptime, exchanges, entries, &stats);
}
ipcom_socketclose(fd);
}
return IPIKE_SUCCESS;
}
/*
*===========================================================================
*
*===========================================================================
* Description: Prints performance stats to stdout
* Parameters:
* Returns:
*
*/
IP_STATIC void
ipike_print_perf_stats(Ip_u32 uptime, Ip_u32 exchanges, Ip_u32 entries, Ipike_perf *stat_ptr)
{
int i,j;
Ipike_exchange_stats *ptr;
Ip_double rate = 0.0f;
char *str_a[2][5] = { { "ID PROT","AGGRESSIVE","QUICK MODE","TRANSACTION","INFORMATIONAL"},
{ "SA INIT/AUTH", "CHILD SA","INFORMATIONAL","NA","NA"} };
ipcom_printf("---------------------------------------------------------------------------------------------\n");
for (i = 0; i < 2; i++)
{
ipcom_printf("IKE version %d"IP_LF, i+1);
for (j = 0; j < 5; j++)
{
if (i > 0 && j > 2)
continue;
ptr = (i==0) ? &stat_ptr->v1_stat[j] : &stat_ptr->v2_stat[j];
if (ptr->ok_count > 0)
rate = (( (Ip_double) ptr->ok_time.tv_sec * 1000.0) + ( (Ip_double) ptr->ok_time.tv_usec / 1000.0)) / ptr->ok_count;
else
rate = 0.0f;
#ifdef _WRS_CONFIG_TIME_T_LONG_LONG
ipcom_printf("%15s -----------> OK secs: %5lld usecs: %10d count: %5d rate(ms): %3.2f\n"
,str_a[i][j],ptr->ok_time.tv_sec, ptr->ok_time.tv_usec, ptr->ok_count, rate);
#else
ipcom_printf("%15s -----------> OK secs: %5d usecs: %10d count: %5d rate(ms): %3.2f\n"
,str_a[i][j],ptr->ok_time.tv_sec, ptr->ok_time.tv_usec, ptr->ok_count, rate);
#endif
if (ptr->nok_count > 0)
rate = (( (Ip_double) ptr->nok_time.tv_sec * 1000.0) + ( (Ip_double) ptr->nok_time.tv_usec / 1000.0)) / ptr->nok_count;
else
rate = 0.0f;
#ifdef _WRS_CONFIG_TIME_T_LONG_LONG
ipcom_printf("%15s -----------> NOK secs: %5lld usecs: %10d count: %5d rate(ms): %3.2f\n"
, str_a[i][j],ptr->nok_time.tv_sec, ptr->nok_time.tv_usec, ptr->nok_count, rate);
#else
ipcom_printf("%15s -----------> NOK secs: %5d usecs: %10d count: %5d rate(ms): %3.2f\n"
, str_a[i][j],ptr->nok_time.tv_sec, ptr->nok_time.tv_usec, ptr->nok_count, rate);
#endif
}
ptr = (i==0) ? &stat_ptr->v1_rekey[IPIKE_PHASE2] : &stat_ptr->v2_rekey[IPIKE_PHASE2];
if (ptr->ok_count > 0)
rate = (( (Ip_double) ptr->ok_time.tv_sec * 1000.0) + ( (Ip_double)ptr->ok_time.tv_usec / 1000.0)) / ptr->ok_count;
else
rate = 0.0f;
#ifdef _WRS_CONFIG_TIME_T_LONG_LONG
ipcom_printf("%15s -----------> OK secs: %5lld usecs: %10d count: %5d rate(ms): %3.2f\n"
,"REKEY",ptr->ok_time.tv_sec, ptr->ok_time.tv_usec, ptr->ok_count, rate);
#else
ipcom_printf("%15s -----------> OK secs: %5d usecs: %10d count: %5d rate(ms): %3.2f\n"
,"REKEY",ptr->ok_time.tv_sec, ptr->ok_time.tv_usec, ptr->ok_count, rate);
#endif
if (ptr->nok_count > 0)
rate = (( (Ip_double) ptr->nok_time.tv_sec * 1000.0) + ( (Ip_double)ptr->nok_time.tv_usec / 1000.0)) / ptr->nok_count;
else
rate = 0.0f;
#ifdef _WRS_CONFIG_TIME_T_LONG_LONG
ipcom_printf("%15s -----------> NOK secs: %5lld usecs: %10d count: %5d rate(ms): %3.2f\n"
,"REKEY",ptr->nok_time.tv_sec, ptr->nok_time.tv_usec, ptr->nok_count, rate);
#else
ipcom_printf("%15s -----------> NOK secs: %5d usecs: %10d count: %5d rate(ms): %3.2f\n"
,"REKEY",ptr->nok_time.tv_sec, ptr->nok_time.tv_usec, ptr->nok_count, rate);
#endif
ipcom_printf("---------------------------------------------------------------------------------------------\n");
}
ipcom_printf("Uptime %d seconds"IP_LF, uptime);
ipcom_printf("Number of active exchanges: %d"IP_LF, exchanges);
ipcom_printf("Number of active IKE SA: %d"IP_LF, entries);
ipcom_printf("---------------------------------------------------------------------------------------------\n");
}
#endif
#ifdef IPIKE_USE_EVENT_LOG_TEST
/*
*===========================================================================
* ipike_cmd_event_cb
*===========================================================================
* Description: Log event callback
* Parameters: event - Event
* Returns: 0 - Continue to to receive events
* < 0 - Stop receiving events (unregister)
*/
IP_STATIC int
ipike_cmd_event_cb(
Ipike_event *event)
{
ip_assert(event->type < IPIKE_EVENT_MAX);
event_log_stats[event->type]++;
/* Keep us registered */
return 0;
}
/*
*===========================================================================
* ipike_cmd_event_log_start
*===========================================================================
* Description: Starts the log event receiver and reset log statistics.
* Parameters:
* Returns:
*/
IP_STATIC void
ipike_cmd_event_log_start(void)
{
/* This will spawn a "receiver task" which will listen for events
* triggered inside IPsec and IKE module and then dispatch them
* to the 'event_cb' function. The receiver task will continuously try to
* keep its channel open to the IKE daemon (ipiked) until it is successful
* or until ipike_event_receiver_destroy() is called.
*/
ipcom_memset(event_log_stats, 0 , sizeof(event_log_stats));
ipike_event_receiver_init(ipike_cmd_event_cb);
}
/*
*===========================================================================
* ipike_cmd_event_log_stop
*===========================================================================
* Description: Stops the log event receiver.
* Parameters:
* Returns:
*/
IP_STATIC void
ipike_cmd_event_log_stop(void)
{
/* This will signal the "receiver task" to stop receiving events.
* The function will block until the "receiver task" has
* terminated properly */
ipike_event_receiver_destroy();
}
/*
*===========================================================================
* ipike_cmd_event_log_stat
*===========================================================================
* Description: Prints out log events statistics
* Parameters:
* Returns:
*/
IP_STATIC void
ipike_cmd_event_log_stat(void)
{
int i;
/* Print out the log event counters */
for (i = 0; i < IPIKE_EVENT_MAX; i++)
{
ipcom_printf("%-32s %d"IP_LF,
ipike_event_type_str((Ip_u16)i), event_log_stats[i]);
}
}
/*
*===========================================================================
* ipike_cmd_log
*===========================================================================
* Description: Controls an IKE/IPsec event receiver
* Parameters:
* Returns:
*/
IP_STATIC int
ipike_cmd_log(const char *cmd)
{
if (cmd == IP_NULL)
return IP_ERRNO_EINVAL;
if ( ipcom_strcmp("start", cmd) == 0 )
ipike_cmd_event_log_start();
else if ( ipcom_strcmp("stop", cmd) == 0 )
ipike_cmd_event_log_stop();
else if ( ipcom_strcmp("stat", cmd) == 0 )
ipike_cmd_event_log_stat();
else
return IP_ERRNO_EINVAL;
return IPIKE_SUCCESS;
}
#endif /* IPIKE_USE_EVENT_LOG_TEST */
/*
*===========================================================================
* ipike_cmd_config_dump
*===========================================================================
* Description: Dump current configuration to specified file
* Parameters: filename - file to dump cinfiguration.
* Returns:
*/
IP_STATIC int
ipike_cmd_config_dump(const char* filename)
{
return ipike_cmd_send_string(IPIKE_CMD_CONFIG_DUMP, filename);
}
/*
*===========================================================================
* ipike_cmd_config_load
*===========================================================================
* Description: Load configuration from the specified file
* Parameters: filename - file to load configuration from.
* Returns:
*/
IP_STATIC int
ipike_cmd_config_load(const char* filename)
{
return ipike_cmd_send_string(IPIKE_CMD_CONFIG_LOAD, filename);
}
/*
*===========================================================================
* ipike_cmd_config_add
*===========================================================================
* Description: Add/Update configuration from the specified content
* Parameters: content - content to load configuration from.
* Returns:
*/
IP_STATIC int
ipike_cmd_config_add(const char* content)
{
return ipike_cmd_send_string(IPIKE_CMD_CONFIG_ADD, content);
}
/*
*===========================================================================
* ipike_cmd_config_delete
*===========================================================================
* Description: Delete configuration from the specified content
* Parameters: content - content to load configuration from.
* Returns:
*/
IP_STATIC int
ipike_cmd_config_delete(const char* content)
{
return ipike_cmd_send_string(IPIKE_CMD_CONFIG_DELETE, content);
}
/*
*===========================================================================
* ipike_cmd_mobike
*===========================================================================
* Description: Update ip address for an IKE SA (MOBIKE)
* Parameters: old_addr - the old ip address
* new_addr - the new ip address
* Returns:
*/
IP_STATIC int
ipike_cmd_mobike(const char* old_addr, const char* new_addr)
{
return ipike_cmd_send_string2(IPIKE_CMD_MOBIKE, old_addr, new_addr);
}
/*
*===========================================================================
* ipike_cmd_print_usage
*===========================================================================
* Description:
* Parameters:
* Returns:
*
*/
IP_STATIC void
ipike_cmd_print_usage(void)
{
ipcom_printf("NAME"IP_LF);
ipcom_printf(" " IPIKE_CMD_NAME " - control function for IPIKE"IP_LF);
ipcom_printf(IP_LF);
ipcom_printf("VERSION"IP_LF);
ipcom_printf(" %s"IP_LF, ipike_version_number());
ipcom_printf(IP_LF);
ipcom_printf("SYNOPSIS"IP_LF);
ipcom_printf(" " IPIKE_CMD_NAME " list"IP_LF);
#ifdef IPIKE_USE_PERF_EVAL
ipcom_printf(" " IPIKE_CMD_NAME " stat"IP_LF);
#endif
ipcom_printf(" " IPIKE_CMD_NAME " config dump|load <file name>"IP_LF);
ipcom_printf(" " IPIKE_CMD_NAME " config add|delete \"<content>\""IP_LF);
ipcom_printf(" " IPIKE_CMD_NAME " mobike <old address> <new address>"IP_LF);
#ifdef IPIKE_USE_EVENT_LOG_TEST
ipcom_printf(" " IPIKE_CMD_NAME " log start|stop|stat"IP_LF);
#endif /* IPIKE_USE_EVENT_LOG_TEST */
ipcom_printf(IP_LF);
ipcom_printf("DESCRIPTION"IP_LF);
ipcom_printf(" The " IPIKE_CMD_NAME " command controls the Internet Key Exchange (IKE) daemon."IP_LF);
ipcom_printf(IP_LF);
ipcom_printf(" Commands:"IP_LF);
ipcom_printf(" list Prints all IKE SA(s)."IP_LF);
#ifdef IPIKE_USE_PERF_EVAL
ipcom_printf(" stat Prints statistics."IP_LF);
#endif
ipcom_printf(" config Load/dump configuration from/to file."IP_LF);
ipcom_printf(" config Add/delete configuration with command content."IP_LF);
ipcom_printf(" mobike Update local address for active IKE SA."IP_LF);
#ifdef IPIKE_USE_EVENT_LOG_TEST
ipcom_printf(" log Start/stop IKE/IPsec event logging."IP_LF);
#endif /* IPIKE_USE_EVENT_LOG_TEST */
}
/*
****************************************************************************
* 10 GLOBAL FUNCTIONS
****************************************************************************
*/
/*
****************************************************************************
* 11 PUBLIC FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_cmd
*===========================================================================
* Description: CLI control command for IPIKE.
* Parameters:
* Returns:
*/
IP_GLOBAL int
ipike_cmd(int argc, char** argv)
{
Ipcom_getopt opt;
Ipike_cmd_param param;
const char* cmd;
int tkn;
ipcom_memset(&param, 0, sizeof(param));
ipcom_getopt_clear_r(&opt);
while ((tkn = ipcom_getopt_r(argc, argv, "f:hp:s", &opt)) != -1)
{
switch(tkn)
{
case 'h':
ipike_cmd_print_usage();
return 0;
case 's':
param.silent = IP_TRUE;
break;
default:
IPIKE_CMD_PRINTF(ipcom_printf("-%c is an unknown option" IP_LF, (char) tkn),
param.silent);
return IP_ERRNO_EINVAL;
}
}
if ((argc - opt.optind) == 0)
{
IPIKE_CMD_PRINTF(ipcom_printf("No command specified" IP_LF), param.silent);
ipike_cmd_print_usage();
return IP_ERRNO_EINVAL;
}
if (IPIKE_SUCCESS != ipike_map_startup())
{
IPIKE_CMD_PRINTF(ipcom_printf("Failed to initialize string map" IP_LF), param.silent);
return IP_ERRNO_ENOMEM;
}
cmd = argv[opt.optind];
if (ipcom_strcmp("list", cmd) == 0)
{
if (argc - opt.optind > 1)
IPIKE_CMD_PRINTF(ipcom_printf("Only one command can be specified" IP_LF), param.silent);
if (ipcom_strcmp("list", cmd) == 0)
return ipike_cmd_list();
}
else if (ipcom_strcmp("stat", cmd) == 0)
{
if (argc - opt.optind > 1)
IPIKE_CMD_PRINTF(ipcom_printf("Only one command can be specified" IP_LF), param.silent);
#ifdef IPIKE_USE_PERF_EVAL
return ipike_cmd_stat();
#else
IPIKE_CMD_PRINTF(ipcom_printf("'%s' is not a valid config command" IP_LF, cmd), param.silent);
#endif
}
else if (ipcom_strcmp("config", cmd) == 0)
{
if ((argc - opt.optind) != 3)
{
IPIKE_CMD_PRINTF(ipcom_printf("Must specify dump/load followed by file name" IP_LF), param.silent);
}
else
{
cmd = argv[opt.optind + 1];
if (ipcom_strcmp("dump", cmd) == 0)
{
return ipike_cmd_config_dump(argv[opt.optind + 2]);
}
else if (ipcom_strcmp("load", cmd) == 0)
{
return ipike_cmd_config_load(argv[opt.optind + 2]);
}
else if (ipcom_strcmp("add", cmd) == 0)
{
return ipike_cmd_config_add(argv[opt.optind + 2]);
}
else if (ipcom_strcmp("delete", cmd) == 0)
{
return ipike_cmd_config_delete(argv[opt.optind + 2]);
}
else
{
IPIKE_CMD_PRINTF(ipcom_printf("'%s' is not a valid config command" IP_LF, cmd), param.silent);
}
}
}
else if (ipcom_strcmp("mobike", cmd) == 0)
{
if ((argc - opt.optind) == 3)
{
return ipike_cmd_mobike(argv[opt.optind + 1], argv[opt.optind + 2]);
}
else
{
IPIKE_CMD_PRINTF(ipcom_printf("Must specify old address followed by new address" IP_LF), param.silent);
}
}
#ifdef IPIKE_USE_EVENT_LOG_TEST
else if (ipcom_strcmp("log", cmd) == 0)
{
int err = IP_ERRNO_EINVAL;
if ( (argc - opt.optind) == 2)
{
cmd = argv[opt.optind + 1];
err = ipike_cmd_log(cmd);
}
if ( err != IPIKE_SUCCESS)
{
IPIKE_CMD_PRINTF(ipcom_printf("Must specify 'start', 'stop' or stat" IP_LF), param.silent);
}
return err;
}
#endif /* IPIKE_USE_EVENT_LOG_TEST */
else
{
IPIKE_CMD_PRINTF(ipcom_printf("'%s' is not a valid command" IP_LF, cmd), param.silent);
}
return IP_ERRNO_EINVAL;
}
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_configuration.c
+4962
View File
File diff suppressed because it is too large Load Diff
components/ip_net2-6.9/ipike/src/ipike_configuration.h
+1133
View File
File diff suppressed because it is too large Load Diff
components/ip_net2-6.9/ipike/src/ipike_configuration_api.c
+841
View File
@@ -0,0 +1,841 @@
/*
******************************************************************************
* SOURCE FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_configuration_api.c,v $ $Revision: 1.21.16.5 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_configuration_api.c,v $
* $Author: svc-cmnet $ $Date: 2013-03-13 07:45:26 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_h.h"
#include "ipike_configuration.h"
#include "ipike_configuration_api.h"
#include "ipike_configuration_file.h"
#include "ipike_util.h"
/*
****************************************************************************
* 4 EXTERN PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 5 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 6 TYPES
****************************************************************************
*/
typedef struct Ipike_config_api_ike_struct
{
Ipike_config_ike conf;
Ip_bool validated;
Ip_bool no_free_config;
}
Ipike_config_api_ike;
/*
****************************************************************************
* 7 LOCAL PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 8 DATA
****************************************************************************
*/
/*
****************************************************************************
* 9 LOCAL FUNCTIONS
****************************************************************************
*/
/*
****************************************************************************
* 10 PUBLIC FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_config_api_new
*===========================================================================
*/
IP_PUBLIC void *
ipike_config_api_new(Ip_bool load_current)
{
Ipike_config_api_ike *ctx;
Ip_size_t buf_len = 0;
IPIKE_CODE_LOCK();
ctx = (Ipike_config_api_ike*)ipcom_calloc(1, sizeof(*ctx));
if (ctx != IP_NULL && load_current)
{
if (ipike_config_file_export_content(&ipike.config, IP_NULL, &buf_len) == IPIKE_SUCCESS && buf_len != 0)
{
char *buf;
buf = ipcom_calloc(1, buf_len);
if (buf == IP_NULL
|| ipike_config_file_export_content(&ipike.config, buf, &buf_len) != IPIKE_SUCCESS
|| ipike_config_file_import_content(&ctx->conf, buf, buf_len) != IPIKE_SUCCESS)
{
ipcom_free(ctx);
ctx = IP_NULL;
}
else
{
/* Reset updated status for initial SAs */
int i;
if (ctx->conf.ike_sa != IP_NULL)
for (i = 0; ctx->conf.ike_sa[i] != IP_NULL; i++)
ctx->conf.ike_sa[i]->updated = IP_FALSE;
if (ctx->conf.ipsec_sa != IP_NULL)
for (i = 0; ctx->conf.ipsec_sa[i] != IP_NULL; i++)
ctx->conf.ipsec_sa[i]->updated = IP_FALSE;
}
ipcom_free(buf);
}
}
IPIKE_CODE_UNLOCK();
return ctx;
}
/*
*===========================================================================
* ipike_config_api_free
*===========================================================================
*/
IP_PUBLIC void
ipike_config_api_free(void* p)
{
Ipike_config_api_ike* ctx = (Ipike_config_api_ike*)p;
if (IP_NULL != ctx)
{
if (!ctx->no_free_config)
ipike_config_free(&ctx->conf);
ipcom_free(ctx);
}
return;
}
/*
*===========================================================================
* ipike_config_api_import
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_config_api_import(void* p, const char* buf, Ip_size_t buf_len)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike_config_api_ike* ctx = (Ipike_config_api_ike*)p;
if (IP_NULL == ctx)
{
err = IPIKE_FAILED; /* Should never happen */
}
else if (IPIKE_SUCCESS != (err = ipike_config_set(&ctx->conf, buf, buf_len)))
{
IPCOM_LOG0(ERR, "ipike_config_api_import - Failed to set");
}
return err;
}
/*
*===========================================================================
* ipike_config_api_export
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_config_api_export(void* p, char* buf, Ip_size_t* buf_len)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike_config_api_ike* ctx = (Ipike_config_api_ike*)p;
if (IP_NULL == ctx)
{
err = IPIKE_FAILED; /* Should never happen */
}
else if (IPIKE_SUCCESS != (err = ipike_config_get(&ctx->conf, buf, buf_len)))
{
IPCOM_LOG0(ERR, "ipike_config_api_export - Failed to get");
}
return err;
}
/*
*===========================================================================
* ipike_config_api_validate
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_config_api_validate(void* p)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike_config_api_ike* ctx = (Ipike_config_api_ike*)p;
if (IP_NULL == ctx)
{
err = IPIKE_FAILED; /* Should never happen */
}
else if (IPIKE_SUCCESS != (err = ipike_config_validate(&ctx->conf)))
{
IPCOM_LOG0(ERR, "ipike_config_api_validate - Failed");
}
else
{
ctx->validated = IP_TRUE;
}
return err;
}
/*
*===========================================================================
* ipike_config_api_commit
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_config_api_commit(void* p)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike_config_api_ike* ctx = (Ipike_config_api_ike*)p;
/* Make sure we have the IKE daemon up and running */
if ( ipcom_atomic_get(&ipike.initialized) == 0 )
{
IPCOM_LOG0(ERR, "ipike_config_api_commit - IKE daemon is not running");
return IPIKE_FAILED;
}
IPIKE_CODE_LOCK();
if (IP_NULL == ctx)
{
err = IPIKE_FAILED; /* Should never happen */
}
else
{
if (!ctx->validated
&& (IPIKE_SUCCESS != (err = ipike_config_api_validate(ctx))))
{
IPCOM_LOG0(ERR, "ipike_config_api_commit - Failed to validate");
}
else if (IPIKE_SUCCESS != (err = ipike_config_commit(&ctx->conf)))
{
IPCOM_LOG0(ERR, "ipike_config_api_commit - Failed");
}
else
{
IPCOM_LOG0(INFO, "Configuration successfully committed");
}
}
IPIKE_CODE_UNLOCK();
if (IPIKE_SUCCESS == err && ipike.disp.initialized)
{
/* Reconfigure the dispatcher */
ipike_dispatcher_reconfigure();
/* Initiate eventual new exchanges (if running) */
(void)ipike_dispatch_start_sa_negotiation(IP_NULL);
}
return err;
}
/*
*===========================================================================
* ipike_config_api_set_general
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_config_api_set_general(void* p, Ipike_config_api_general* general)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike_config_api_ike* ctx = (Ipike_config_api_ike*)p;
if (IP_NULL == ctx)
{
err = IPIKE_FAILED; /* Should never happen */
}
else if (IPIKE_SUCCESS != (err = ipike_config_set_general(&ctx->conf.general,
general)))
{
IPCOM_LOG0(ERR, "ipike_config_api_set_general - Failed to set");
}
return err;
}
/*
*===========================================================================
* ipike_config_api_set_ike_sa
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_config_api_set_ike_sa(
void* p,
const char ike_id[IPIKE_CONFIG_MAX_ID_LEN],
Ipike_config_api_ike_sa* ike)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike_config_api_ike* ctx = (Ipike_config_api_ike*)p;
if (IP_NULL == ctx)
{
err = IPIKE_FAILED; /* Should never happen */
}
else if (IP_NULL == ike)
{
ipike_config_remove_ike_sa(&ctx->conf, ike_id);
}
else if (IPIKE_SUCCESS != (err = ipike_config_set_ike_sa(&ctx->conf.ike_sa,
ike_id,
ike)))
{
IPCOM_LOG0(ERR, "ipike_config_api_set_ike_sa - Failed to set");
}
return err;
}
/*
*===========================================================================
* ipike_config_api_set_ipsec_sa
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_config_api_set_ipsec_sa(
void* p,
const char ipsec_id[IPIKE_CONFIG_MAX_ID_LEN],
Ipike_config_api_ipsec_sa* ipsec)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike_config_api_ike* ctx = (Ipike_config_api_ike*)p;
if (IP_NULL == ctx)
{
err = IPIKE_FAILED; /* Should never happen */
}
else if (IP_NULL == ipsec)
{
ipike_config_remove_ipsec_sa(&ctx->conf, ipsec_id);
}
else if (IPIKE_SUCCESS != (err = ipike_config_set_ipsec_sa(&ctx->conf.ipsec_sa,
ipsec_id,
ipsec)))
{
IPCOM_LOG0(ERR, "ipike_config_api_set_ike_sa - Failed to set");
}
return err;
}
/*
*===========================================================================
* ipike_config_api_set_ike_sa_proposal
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_config_api_set_ike_sa_proposal(
void* p,
const char ike_id[IPIKE_CONFIG_MAX_ID_LEN],
int* proposal_id,
Ipike_config_api_proposal* proposal)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike_config_api_ike* ctx = (Ipike_config_api_ike*)p;
if (IP_NULL == ctx)
{
err = IPIKE_FAILED; /* Should never happen */
}
else if (IPIKE_SUCCESS != (err = ipike_config_set_ike_sa_proposal(&ctx->conf.ike_sa,
ike_id,
proposal_id,
proposal)))
{
IPCOM_LOG0(ERR, "ipike_config_api_set_ike_sa_proposal - Failed to set");
}
return err;
}
/*
*===========================================================================
* ipike_config_api_set_ipsec_sa_proposal
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_config_api_set_ipsec_sa_proposal(
void* p,
const char ipsec_id[IPIKE_CONFIG_MAX_ID_LEN],
int* proposal_id,
Ipike_config_api_proposal* proposal)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike_config_api_ike* ctx = (Ipike_config_api_ike*)p;
if (IP_NULL == ctx)
{
err = IPIKE_FAILED; /* Should never happen */
}
else if (IPIKE_SUCCESS != (err = ipike_config_set_ipsec_sa_proposal(&ctx->conf.ipsec_sa,
ipsec_id,
proposal_id,
proposal)))
{
IPCOM_LOG0(ERR, "ipike_config_api_set_ipsec_sa_proposal - Failed to set");
}
return err;
}
/*
*===========================================================================
* ipike_config_api_set_ipsec_sa_rohc
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_config_api_set_ipsec_sa_rohc(
void* p,
const char ipsec_id[IPIKE_CONFIG_MAX_ID_LEN],
Ipike_config_api_rohc * rohc)
{
Ipike_error err = IPIKE_SUCCESS;
#ifdef IPIKE_USE_ROHC
Ipike_config_api_ike* ctx = (Ipike_config_api_ike*)p;
if (IP_NULL == ctx)
return IPIKE_FAILED; /* Should never happen */
err = ipike_config_set_ipsec_sa_rohc(&ctx->conf.ipsec_sa,
ipsec_id,
rohc);
if (err != IPIKE_SUCCESS)
IPCOM_LOG0(ERR, "ipike_config_api_set_ipsec_sa_rohc() :: failed to set");
#else
IPCOM_UNUSED_ARG(p);
IPCOM_UNUSED_ARG(ipsec_id);
IPCOM_UNUSED_ARG(rohc);
IPCOM_LOG0(WARNING, "ipike_config_api_set_ipsec_sa_rohc() :: ROHC not enabled");
#endif
return err;
}
/*
*===========================================================================
* ipike_config_api_get_general
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_config_api_get_general(void* p, Ipike_config_api_general* general)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike_config_api_ike* ctx = (Ipike_config_api_ike*)p;
ipcom_memset(general, 0, sizeof(*general));
if (IP_NULL == ctx)
{
err = IPIKE_FAILED; /* Should never happen */
}
else if (IPIKE_SUCCESS != (err = ipike_config_get_general(&ctx->conf.general,
general)))
{
ipike_config_api_release_general(general);
}
return err;
}
/*
*===========================================================================
* ipike_config_api_get_next_ike_sa
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_config_api_get_next_ike_sa(
void* p,
char ike_id[IPIKE_CONFIG_MAX_ID_LEN],
Ipike_config_api_ike_sa* ike,
int* pos)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike_config_api_ike* ctx = (Ipike_config_api_ike*)p;
ipcom_memset(ike, 0, sizeof(*ike));
if (IP_NULL == ctx)
{
err = IPIKE_FAILED; /* Should never happen */
}
else if (IPIKE_SUCCESS != (err = ipike_config_get_next_ike_sa(ctx->conf.general.def_ike_sa,
ctx->conf.ike_sa,
ike_id,
ike,
pos)))
{
ipike_config_api_release_ike_sa(ike);
}
return err;
}
/*
*===========================================================================
* ipike_config_api_get_next_ipsec_sa
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_config_api_get_next_ipsec_sa(
void* p,
char ipsec_id[IPIKE_CONFIG_MAX_ID_LEN],
Ipike_config_api_ipsec_sa* ipsec,
int* pos)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike_config_api_ike* ctx = (Ipike_config_api_ike*)p;
ipcom_memset(ipsec, 0, sizeof(*ipsec));
if (IP_NULL == ctx)
{
err = IPIKE_FAILED; /* Should never happen */
}
else if (IPIKE_SUCCESS != (err = ipike_config_get_next_ipsec_sa(ctx->conf.general.def_ipsec_sa,
ctx->conf.ipsec_sa,
ipsec_id,
ipsec,
pos)))
{
ipike_config_api_release_ipsec_sa(ipsec);
}
return err;
}
/*
*===========================================================================
* ipike_config_api_get_next_ike_sa_proposal
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_config_api_get_next_ike_sa_proposal(
void* p,
const char ike_id[IPIKE_CONFIG_MAX_ID_LEN],
int* proposal_id,
Ipike_config_api_proposal* proposal,
int* pos)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike_config_api_ike* ctx = (Ipike_config_api_ike*)p;
ipcom_memset(proposal, 0, sizeof(*proposal));
if (IP_NULL == ctx)
{
err = IPIKE_FAILED; /* Should never happen */
}
else if (IPIKE_SUCCESS != (err = ipike_config_get_next_ike_sa_proposal(ctx->conf.general.def_ike_sa,
ctx->conf.ike_sa,
ike_id,
proposal_id,
proposal,
pos)))
{
ipike_config_api_release_proposal(proposal);
}
return err;
}
/*
*===========================================================================
* ipike_config_api_get_next_ipsec_sa_proposal
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_config_api_get_next_ipsec_sa_proposal(
void* p,
const char ipsec_id[IPIKE_CONFIG_MAX_ID_LEN],
int* proposal_id,
Ipike_config_api_proposal* proposal,
int* pos)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike_config_api_ike* ctx = (Ipike_config_api_ike*)p;
ipcom_memset(proposal, 0, sizeof(*proposal));
if (IP_NULL == ctx)
{
/* Should never happen */
return IPIKE_FAILED;
}
err = ipike_config_get_next_ipsec_sa_proposal(ctx->conf.general.def_ipsec_sa,
ctx->conf.ipsec_sa,
ipsec_id,
proposal_id,
proposal,
pos);
if (IPIKE_SUCCESS != err)
ipike_config_api_release_proposal(proposal);
return err;
}
/*
*===========================================================================
* ipike_config_api_set_ipsec_sa_rohc
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_config_api_get_ipsec_sa_rohc(
void* p,
const char ipsec_id[IPIKE_CONFIG_MAX_ID_LEN],
Ipike_config_api_rohc * rohc)
{
Ipike_error err = IPIKE_SUCCESS;
#ifdef IPIKE_USE_ROHC
Ipike_config_api_ike* ctx = (Ipike_config_api_ike*)p;
if (IP_NULL == ctx)
return IPIKE_FAILED; /* Should never happen */
err = ipike_config_get_ipsec_sa_rohc(ctx->conf.general.def_ipsec_sa,
&ctx->conf.ipsec_sa,
ipsec_id,
rohc);
if (err != IPIKE_SUCCESS)
ipike_config_api_release_rohc(rohc);
#else
IPCOM_UNUSED_ARG(p);
IPCOM_UNUSED_ARG(ipsec_id);
IPCOM_UNUSED_ARG(rohc);
IPCOM_LOG0(WARNING, "ipike_config_api_get_ipsec_sa_rohc() :: ROHC not enabled");
#endif
return err;
}
/*
*===========================================================================
* ipike_config_api_release_general
*===========================================================================
*/
IP_PUBLIC void
ipike_config_api_release_general(Ipike_config_api_general *general)
{
if (IP_NULL != general)
{
ipike_parse_delete_string(general->listen);
ipcom_memset(general, 0, sizeof(*general));
}
}
/*
*===========================================================================
* ipike_config_api_release_ike_sa
*===========================================================================
*/
IP_PUBLIC void
ipike_config_api_release_ike_sa(Ipike_config_api_ike_sa *sa)
{
if (sa == IP_NULL)
return;
ipike_parse_delete_string(sa->version);
ipike_parse_delete_string(sa->mode);
ipike_parse_delete_string(sa->local_address);
ipike_parse_delete_string(sa->remote_address);
ipike_parse_delete_string(sa->local_id);
ipike_parse_delete_string(sa->remote_id);
ipike_parse_delete_string(sa->lifetime);
ipike_parse_delete_string(sa->authentication.method);
ipike_parse_delete_string(sa->authentication.psk_id);
ipike_parse_delete_string(sa->authentication.shared_key);
ipike_parse_delete_string(sa->authentication.certificate);
ipike_parse_delete_string(sa->authentication.certificate_uri);
ipike_parse_delete_string(sa->authentication.send_certificate);
ipike_parse_delete_string(sa->authentication.request_certificate);
ipike_parse_delete_string(sa->authentication.ocsp_response);
ipike_parse_delete_string(sa->authentication.remote_certificate);
ipike_parse_delete_string(sa->authentication.key_id);
ipike_parse_delete_string(sa->authentication.private_key);
ipike_parse_delete_string(sa->authentication.private_key_password);
ipike_parse_delete_string(sa->authentication.trusted_ca_store);
ipike_parse_delete_string(sa->authentication.crl_store);
ipike_parse_delete_string(sa->authentication.intermediate_ca_store);
ipike_parse_delete_string(sa->authentication.identity);
ipike_parse_delete_string(sa->radius.shared_secret);
ipike_parse_delete_string(sa->radius.server_address);
ipike_parse_delete_string(sa->radius.local_address);
ipcom_memset(sa, 0, sizeof(*sa));
}
/*
*===========================================================================
* ipike_config_api_release_ipsec_sa
*===========================================================================
*/
IP_PUBLIC void
ipike_config_api_release_ipsec_sa(Ipike_config_api_ipsec_sa *sa)
{
if (sa == IP_NULL)
return;
ipike_parse_delete_string(sa->ike_id);
ipike_parse_delete_string(sa->encap_mode);
ipike_parse_delete_string(sa->use_tfc);
ipike_parse_delete_string(sa->lifetime);
ipike_parse_delete_string(sa->flowtype);
ipike_parse_delete_string(sa->granularity);
ipike_parse_delete_string(sa->dynamic_address);
ipike_parse_delete_string(sa->flow.src_address);
ipike_parse_delete_string(sa->flow.src_port);
ipike_parse_delete_string(sa->flow.dst_address);
ipike_parse_delete_string(sa->flow.dst_port);
ipike_parse_delete_string(sa->flow.protocol);
ipike_parse_delete_string(sa->flow_end.src_address);
ipike_parse_delete_string(sa->flow_end.src_port);
ipike_parse_delete_string(sa->flow_end.dst_address);
ipike_parse_delete_string(sa->flow_end.dst_port);
ipike_parse_delete_string(sa->flow_end.protocol);
ipcom_memset(sa, 0, sizeof(*sa));
}
/*
*===========================================================================
* ipike_config_api_release_proposal
*===========================================================================
*/
IP_PUBLIC void
ipike_config_api_release_proposal(Ipike_config_api_proposal *proposal)
{
if (proposal == IP_NULL)
return;
ipike_parse_delete_string(proposal->dh_group);
ipike_parse_delete_string(proposal->encryption_alg);
ipike_parse_delete_string(proposal->hash_alg);
ipike_parse_delete_string(proposal->integrity_alg);
ipike_parse_delete_string(proposal->use_esn);
ipike_parse_delete_string(proposal->number);
ipike_parse_delete_string(proposal->v1.lifetime);
ipcom_memset(proposal, 0, sizeof(*proposal));
}
/*
*===========================================================================
* ipike_config_api_release_rohc
*===========================================================================
*/
IP_PUBLIC void
ipike_config_api_release_rohc(Ipike_config_api_rohc *rohc)
{
if (rohc == IP_NULL)
return;
ipike_parse_delete_string(rohc->max_cid);
ipike_parse_delete_string(rohc->mrru);
ipike_parse_delete_string(rohc->profiles);
ipike_parse_delete_string(rohc->integrity_alg);
ipike_parse_delete_string(rohc->icv_len);
ipcom_memset(rohc, 0, sizeof(Ipike_config_api_rohc));
}
/*
*===========================================================================
* ipike_config_api_from_config
*===========================================================================
*/
IP_GLOBAL void *
ipike_config_api_from_config(void* conf)
{
Ipike_config_ike *config = (Ipike_config_ike*)conf;
Ipike_config_api_ike *ctx;
ctx = ipcom_calloc(1, sizeof(*ctx));
if (IP_NULL != ctx)
{
ipcom_memcpy((void*)&ctx->conf, (void*)config, sizeof(*config));
ctx->no_free_config = IP_TRUE;
}
return ctx;
}
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_configuration_file.c
+2234
View File
File diff suppressed because it is too large Load Diff
components/ip_net2-6.9/ipike/src/ipike_configuration_file.h
+100
View File
@@ -0,0 +1,100 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_configuration_file.h,v $ $Revision: 1.3 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_configuration_file.h,v $
* $Author: edahlber $ $Date: 2010-05-06 14:34:47 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#ifndef IPIKE_CONFIGURATION_FILE_H
#define IPIKE_CONFIGURATION_FILE_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_config_file_import_content
*===========================================================================
* Description: Load config file content to config context.
* Parameters: config - The config context.
* data - The config data.
* Returns: Standard IPIKE error code.
*/
IP_GLOBAL Ipike_error
ipike_config_file_import_content(
Ipike_config_ike* config,
const char* buf,
Ip_size_t buf_len);
/*
*===========================================================================
* ipike_config_file_export_content
*===========================================================================
* Description:Export config context to config file content.
* Parameters: config - The config context.
* buf - Buffer that will receive the config data.
* buf_len - Length of buffer and will receive used length.
* Returns: Standard IPIKE error code.
*/
IP_GLOBAL Ipike_error
ipike_config_file_export_content(
Ipike_config_ike* config,
char* buf,
Ip_size_t* buf_len);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_configuration_parse.c
+908
View File
@@ -0,0 +1,908 @@
/*
******************************************************************************
* INTERPEAK SOURCE FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_configuration_parse.c,v $ $Revision: 1.18.10.6 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_configuration_parse.c,v $
* $Author: svc-cmnet $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_h.h"
#include "ipike_util.h"
#include "ipike_configuration_parse.h"
/*
****************************************************************************
* 4 EXTERN PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 5 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 6 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 7 LOCAL PROTOTYPES
****************************************************************************
*/
/*
*===========================================================================
* ipike_parse_clean
*===========================================================================
*/
IP_STATIC void
ipike_parse_clean(char* parse);
/*
*===========================================================================
* ipike_parse_ignore_white_space
*===========================================================================
*/
IP_STATIC void
ipike_parse_ignore_white_space(const char** str);
/*
*===========================================================================
* ipike_parse_is_string_stop
*===========================================================================
*/
IP_STATIC Ip_bool
ipike_parse_is_string_stop(char end);
/*
*===========================================================================
* ipike_parse_stop
*===========================================================================
*/
IP_STATIC Ipike_error
ipike_parse_stop(const char** parse_str, char stop);
/*
*===========================================================================
* ipike_parse_name
*===========================================================================
* <name> ::= <string> [ ' ' ]
*/
IP_STATIC Ipike_error
ipike_parse_name(Ipike_config* config, const char** parse_str);
/*
*===========================================================================
* ipike_parse_entry_value
*===========================================================================
* <entryvalue> ::= <string> ';'
*/
IP_STATIC Ipike_error
ipike_parse_entry_value(Ipike_config* config, const char** parse_str);
/*
*===========================================================================
* ipike_parse_section_value
*===========================================================================
* <sectionvalue> ::= null | <string> '{'
*/
IP_STATIC Ipike_error
ipike_parse_section_value(Ipike_config* config, const char** parse_str);
/*
*===========================================================================
* ipike_parse_section
*===========================================================================
* <section> ::= <name> <sectionvalue> { <list> }
*/
IP_STATIC Ipike_error
ipike_parse_section(Ipike_config* config, const char** parse_str);
/*
*===========================================================================
* ipike_parse_entry
*===========================================================================
*/
IP_STATIC Ipike_error
ipike_parse_entry(Ipike_config* config, const char** parse_str);
/*
*===========================================================================
* ipike_parse_list
*===========================================================================
* <list> ::= ARRAY OF ( <entry> | <section> )
*/
IP_STATIC Ipike_error
ipike_parse_list(Ipike_config* config, const char** parse_str);
/*
****************************************************************************
* 8 DATA
****************************************************************************
*/
/*
****************************************************************************
* 9 LOCAL FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_parse_clean
*===========================================================================
*/
IP_STATIC void
ipike_parse_clean(char* parse)
{
Ip_size_t i;
Ip_size_t j = 0;
Ip_size_t len;
/* Remove all comments and replace all '\t', '\r' and '\n' with ' '. */
len = ipcom_strlen(parse);
for (i=0; i<len; i++)
{
/* For comments remove to next new line */
if (parse[i] == '#')
while ((i < len) && (parse[i] != '\n'))
i++;
else if ((parse[i] == '\t') || (parse[i] == '\n') || (parse[i] == '\r'))
parse[j++] = ' ';
else
parse[j++] = parse[i];
}
parse[j] = '\0';
}
/*
*===========================================================================
* ipike_parse_get_next
*===========================================================================
*/
IP_STATIC int
ipike_parse_get_next(const char* config)
{
while (*config != 0)
{
if (*config == '{')
return IPIKE_CONFIG_SECTION;
if (*config == ';')
return IPIKE_CONFIG_ENTRY;
if (*config == '}')
return IPIKE_CONFIG_NONE; /* section end */
config++;
}
return IPIKE_CONFIG_NONE;
}
/*
*===========================================================================
* ipike_parse_ignore_white_space
*===========================================================================
*/
IP_STATIC void
ipike_parse_ignore_white_space(const char** str)
{
/* Skip all beginning white space */
if (IP_NULL != *str)
while (*(*str) == ' ')
(*str)++;
}
/*
*===========================================================================
* ipike_parse_is_string_stop
*===========================================================================
*/
IP_STATIC Ip_bool
ipike_parse_is_string_stop(char end)
{
/* Stop on our configuration format demlimiters */
if ((end == ';') || (end == '{') || (end == '}') || (end == '\0'))
return IP_TRUE;
return IP_FALSE;
}
/*
*===========================================================================
* ipike_parse_stop
*===========================================================================
*/
IP_STATIC Ipike_error
ipike_parse_stop(const char** parse_str, char stop)
{
ipike_parse_ignore_white_space(parse_str);
/* Next character must be the stop character */
if (*(*parse_str) != stop)
{
IPCOM_LOG2(ERR, "Expecting '%c', not '%c'", stop, *(*parse_str));
return IPIKE_CONF_FORMAT_ERROR;
}
(*parse_str)++;
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_parse_name
*===========================================================================
* <name> ::= <string> [ ' ' ]
*/
IP_STATIC Ipike_error
ipike_parse_name(Ipike_config* config, const char** parse_str)
{
Ipike_error err;
char* str;
err = ipike_parse_get_string(parse_str, ' ', &str);
if (err != IPIKE_SUCCESS)
{
IPCOM_LOG0(ERR, "Failed to get config name");
return err;
}
/* Zero length not accepted */
if (*str == 0)
{
ipcom_free(str);
IPCOM_LOG0(ERR, "Zero length not accepted for config name");
return IPIKE_CONF_FORMAT_ERROR;
}
config->name = str;
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_parse_entry_value
*===========================================================================
* <entryvalue> ::= <string> ';'
*/
IP_STATIC Ipike_error
ipike_parse_entry_value(Ipike_config* config, const char** parse_str)
{
Ipike_error err;
char* str;
err = ipike_parse_get_string(parse_str, ';', &str);
if (err != IPIKE_SUCCESS)
{
IPCOM_LOG1(ERR, "Failed to get value for '%s'", config->name);
return err;
}
/* Zero length not accepted */
if (*str == 0)
{
ipcom_free(str);
IPCOM_LOG1(ERR, "Zero length value not accepted for '%s'", config->name);
return IPIKE_CONF_FORMAT_ERROR;
}
config->value = str;
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_parse_section_value
*===========================================================================
* <sectionvalue> ::= null | <string> '{'
*/
IP_STATIC Ipike_error
ipike_parse_section_value(Ipike_config* config, const char** parse_str)
{
Ipike_error err;
char* str;
err = ipike_parse_get_string(parse_str, '{', &str);
if (err != IPIKE_SUCCESS)
{
IPCOM_LOG0(ERR, "Failed to get section value");
return err;
}
config->value = str;
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_parse_section
*===========================================================================
* <section> ::= <name> <sectionvalue> { <list> }
*/
IP_STATIC Ipike_error
ipike_parse_section(Ipike_config* config, const char** parse_str)
{
Ipike_error err;
Ipike_config* tmp;
if (IP_NULL == (tmp = ipcom_calloc(1, sizeof(Ipike_config))))
{
IP_PANIC();
err = IPIKE_OUT_OF_MEMORY;
}
else
{
tmp->root = config->root;
tmp->type = IPIKE_CONFIG_SECTION;
err = ipike_parse_name(tmp, parse_str);
if (err == IPIKE_SUCCESS)
err = ipike_parse_section_value(tmp, parse_str);
if (err == IPIKE_SUCCESS)
err = ipike_parse_list(tmp, parse_str);
if (err == IPIKE_SUCCESS)
err = ipike_parse_stop(parse_str, '}');
if (err == IPIKE_SUCCESS)
err = ipike_array_add((void***)&config->sections, tmp);
if (err != IPIKE_SUCCESS)
ipcom_free(tmp);
}
return err;
}
/*
*===========================================================================
* ipike_parse_entry
*===========================================================================
*/
IP_STATIC Ipike_error
ipike_parse_entry(Ipike_config* config, const char** parse_str)
{
Ipike_error err;
Ipike_config* tmp;
if (IP_NULL == (tmp = ipcom_calloc(1, sizeof(Ipike_config))))
{
IP_PANIC();
err = IPIKE_OUT_OF_MEMORY;
}
else
{
tmp->root = config->root;
tmp->type = IPIKE_CONFIG_ENTRY;
err = ipike_parse_name(tmp, parse_str);
if (err == IPIKE_SUCCESS)
err = ipike_parse_entry_value(tmp, parse_str);
if (err == IPIKE_SUCCESS)
err = ipike_array_add((void***)&config->entries, tmp);
if (err != IPIKE_SUCCESS)
ipcom_free(tmp);
}
return err;
}
/*
*===========================================================================
* ipike_parse_list
*===========================================================================
* <list> ::= ARRAY OF ( <entry> | <section> )
*/
IP_STATIC Ipike_error
ipike_parse_list(Ipike_config* config, const char** parse_str)
{
Ipike_error err = IPIKE_SUCCESS;
int type;
const char* tmp;
tmp = *parse_str;
while (err == IPIKE_SUCCESS)
{
ipike_parse_ignore_white_space(parse_str);
type = ipike_parse_get_next(*parse_str);
switch (type)
{
case IPIKE_CONFIG_SECTION:
err = ipike_parse_section(config, parse_str);
break;
case IPIKE_CONFIG_ENTRY:
err = ipike_parse_entry(config, parse_str);
break;
default:
return IPIKE_SUCCESS; /* The end */
}
}
/* Rollback */
*parse_str = tmp;
return err;
}
/*
*===========================================================================
* ipike_parse_range_string
*===========================================================================
*/
IP_STATIC void
ipike_parse_range_string(char* str, char** low, char** high)
{
char* p;
*low = str;
/* Find first '-' separator or termination */
for (p = str; *p != '\0' && *p != '-'; p++);
/* Found separator, got a range */
if (*p == '-')
{
*p = '\0';
p++;
}
if (*p == '\0')
*high = IP_NULL;
else
*high = p;
}
/*
****************************************************************************
* 10 PUBLIC FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_parse_get_string
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_parse_get_string(const char** src, char stop, char** dst)
{
Ip_size_t size;
ipike_parse_ignore_white_space(src);
/* Find stop character */
size = 0;
while (!ipike_parse_is_string_stop(*((*src)+size)) &&
(*((*src)+size) != stop))
size++;
*dst = IP_NULL;
if (IP_NULL == ((*dst) = ipcom_malloc(size + 1)))
{
IP_PANIC();
return IPIKE_OUT_OF_MEMORY;
}
ipcom_memcpy((void*)*dst, (void*)*src, size);
(*src) += size;
if (*(*src) == stop)
(*src)++;
/* Remove trailing white space */
while ((size > 0) && (*((*dst)+size-1) == ' '))
size--;
*((*dst)+size) = 0;
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_parse_get_first_string
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_parse_get_first_string(const char* src, char stop, char** dst)
{
return ipike_parse_get_string(&src, stop, dst);
}
/*
*===========================================================================
* ipike_parse_bool
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_parse_bool(const char* str, Ip_bool* value)
{
if ( ipcom_strcasecmp(str, "on") == 0 ||
ipcom_strcasecmp(str, "true") == 0 ||
ipcom_strcasecmp(str, "yes") == 0)
{
*value = IP_TRUE;
}
else if ( ipcom_strcasecmp(str, "off") == 0 ||
ipcom_strcasecmp(str, "false") == 0 ||
ipcom_strcasecmp(str, "no") == 0)
{
*value = IP_FALSE;
}
else
return IPIKE_CONF_INVALID_VALUE;
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_parse_int
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_parse_int(const char* str, int *value)
{
char *end;
ipcom_errno = 0;
*value = (int) ipcom_strtol(str, &end, 10);
if ( ipcom_errno != 0 || str == end )
return IPIKE_CONF_INVALID_VALUE;
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_parse_string
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_parse_string(const char *str, const char **value)
{
if (IP_NULL != *value)
{
IPCOM_LOG2(DEBUG2, "ipike_parse_string() :: configuration value"\
" already set, will be overwritten (%s > %s)",
*value, str);
ipike_parse_delete_string(*value);
*value = IP_NULL;
}
if ( str != IP_NULL )
{
*value = ipcom_strdup(str);
if (IP_NULL == *value)
{
IP_PANIC();
return IPIKE_OUT_OF_MEMORY;
}
}
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_parse_delete_string
*===========================================================================
*/
IP_GLOBAL void
ipike_parse_delete_string(const char* str)
{
if (IP_NULL != str)
ipcom_free((char*)str);
}
/*
*===========================================================================
* ipike_parse_number
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_parse_number(const char* str, Ip_u32* value)
{
Ipike_error err;
int int_value = 0;
err = ipike_parse_int(str, &int_value);
if ( IPIKE_SUCCESS == err )
{
/* Do not accept negative values here */
if ( int_value < 0 )
return IPIKE_CONF_INVALID_VALUE;
*value = (Ip_u32) int_value;
}
return err;
}
/*
*===========================================================================
* ipike_parse_number_default
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_parse_number_default(
const char* str,
Ip_u32* value,
Ip_u32 default_value)
{
/* If str isn't set, use default value */
if ( str == IP_NULL )
{
*value = default_value;
return IPIKE_SUCCESS;
}
return ipike_parse_number(str, value);
}
/*
*===========================================================================
* ipike_parse_number_range
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_parse_number_range(const char* str, Ip_u32* low, Ip_u32* high)
{
char *low_str;
char *high_str;
char tmp[32];
Ipike_error err;
*low = 0;
*high = 0;
/* Make sure we have buffer space */
if ( ipcom_strlen(str) > sizeof(tmp) - 1)
return IPIKE_CONF_INVALID_VALUE;
ipcom_strcpy(tmp, str);
ipike_parse_range_string(tmp, &low_str, &high_str);
err = ipike_parse_number(low_str, low);
if ( IPIKE_SUCCESS != err )
return err;
if (high_str != IP_NULL)
{
err = ipike_parse_number(high_str, high);
if ( IPIKE_SUCCESS != err )
return err;
if (*low > *high)
return IPIKE_CONF_INVALID_VALUE;
}
else
{
*high = *low;
}
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_configuration_new
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_configuration_new(
const char* parse_str,
Ip_size_t parse_str_len,
Ipike_config** config)
{
Ipike_error err;
char* tmp;
/* Allocate a new data buffer, so we may change it */
tmp = ipcom_malloc(parse_str_len+1);
if (IP_NULL == tmp)
{
IP_PANIC();
err = IPIKE_OUT_OF_MEMORY;
}
else
{
/* Allocate config root */
*config = ipcom_calloc(1, sizeof(Ipike_config));
if (IP_NULL == *config)
{
IP_PANIC();
err = IPIKE_OUT_OF_MEMORY;
}
else
{
/* Remove comments and bad characters */
ipcom_memcpy((void*)tmp, (void*)parse_str, parse_str_len);
tmp[parse_str_len] = 0;
parse_str = tmp;
ipike_parse_clean((char*)parse_str);
/* Set root info */
(*config)->root = *config;
(*config)->type = IPIKE_CONFIG_SECTION;
(*config)->name = IP_NULL;
(*config)->value = IP_NULL;
err = ipike_parse_list(*config, (const char**)&parse_str);
if (IPIKE_SUCCESS != err)
{
ipike_configuration_free(*config);
*config = IP_NULL;
if (ipcom_strlen(parse_str) > 64)
ipcom_strcpy((char*)(parse_str+(64-3)), "...");
IPCOM_LOG0(ERR, "Error parsning configuration file, around:");
IPCOM_LOG1(ERR, " ...%s)", parse_str);
}
}
ipcom_free(tmp);
}
return err;
}
/*
*===========================================================================
* ipike_configuration_free
*===========================================================================
*/
IP_GLOBAL void
ipike_configuration_free(Ipike_config* config)
{
if (IP_NULL != config)
{
ipike_array_free((void**)config->sections, (void(*)(void*))ipike_configuration_free);
ipike_array_free((void**)config->entries, (void(*)(void*))ipike_configuration_free);
ipcom_free(config->name);
ipcom_free(config->value);
ipcom_free(config);
}
}
/*
*===========================================================================
* ipike_configuration_get
*===========================================================================
* Description: Get a section/entry from the configuration. Separate with '/'
* to get sublevel section/entry.
* Parameters: name - name of the configuration section/entry.
* config - will retrieved the configuration structure.
* Returns: IPIKE_SUCCESS, IPIKE_OUT_OF_MEMORY, IPIKE_CONF_PARSE_ERROR
*/
IP_GLOBAL Ipike_config*
ipike_configuration_get(const char* name, Ipike_config* config)
{
Ipike_config* entry;
const char* psz;
Ip_size_t n;
int pos;
if (IP_NULL != (psz = strchr(name, '/')))
n = (Ip_size_t)(psz - name);
else
n = ipcom_strlen(name);
entry = IP_NULL;
/* Search all sections */
pos = 0;
if (IP_NULL != config->sections)
{
while ((IP_NULL == entry) && (IP_NULL != config->sections[pos]))
if ((ipcom_strncasecmp(config->sections[pos]->name, name, n) == 0) &&
(config->sections[pos]->name[n] == 0))
entry = config->sections[pos];
else
pos++;
}
/* Search all entries */
pos = 0;
if (IP_NULL != config->entries)
{
while ((IP_NULL == entry) && (IP_NULL != config->entries[pos]))
if ((ipcom_strncasecmp(config->entries[pos]->name, name, n) == 0) &&
(config->entries[pos]->name[n] == 0))
entry = config->entries[pos];
else
pos++;
}
/* Recursive call if supposed to get sublevel entry */
if ((IP_NULL != entry) && (IP_NULL != psz))
entry = ipike_configuration_get(psz+1, entry);
return entry;
}
/*
*===========================================================================
* ipike_configuration_enum
*===========================================================================
*/
IP_GLOBAL Ipike_config*
ipike_configuration_enum(Ipike_config* config, Ipike_config* last)
{
Ipike_config* entry;
int pos;
entry = IP_NULL;
/* Enum all entries */
pos = 0;
if (IP_NULL != config->entries)
{
while ((IP_NULL == entry) && (IP_NULL != config->entries[pos]))
if (last == IP_NULL)
{
entry = config->entries[pos];
}
else
{
if (last == config->entries[pos])
last = IP_NULL;
pos++;
}
}
/* Enum all sections */
pos = 0;
if (IP_NULL != config->sections)
{
while ((IP_NULL == entry) && (IP_NULL != config->sections[pos]))
if (last == IP_NULL)
{
entry = config->sections[pos];
}
else
{
if (last == config->sections[pos])
last = IP_NULL;
pos++;
}
}
return entry;
}
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_configuration_parse.h
+296
View File
@@ -0,0 +1,296 @@
/*
******************************************************************************
* INTERPEAK HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_configuration_parse.h,v $ $Revision: 1.5.12.3 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_configuration_parse.h,v $
* $Author: svc-cmnet $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#ifndef _IPIKE_CONFIGURATION_PARSE_H
#define _IPIKE_CONFIGURATION_PARSE_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Generic parsning of a the IKE configuration format. The format consists
* of a list of sections and entries.
*
* Format:
*
* <section> ::= <name> [<value>] {
* <entry>/<section>
* ...
* <entry>/<section>
* }
*
* <entry> ::= <name> <value>;
*/
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
#define IPIKE_CONFIG_NONE 0
#define IPIKE_CONFIG_SECTION 1
#define IPIKE_CONFIG_ENTRY 2
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
typedef struct Ipike_config_struct
{
int type; /* Config type */
char* name; /* IP_NULL terminated string */
char* value; /* IP_NULL terminated string */
struct Ipike_config_struct** entries; /* IP_NULL terminated array of entries */
struct Ipike_config_struct** sections; /* IP_NULL terminated array of sections */
struct Ipike_config_struct* root; /* Pointer to top configuration root */
}
Ipike_config;
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_parse_get_string
*===========================================================================
* Description: Get next string and increase string pointer. The strings are
* separated with stop character. The destination string will
* be allocated with ipcom_malloc.
* Parameters: src - source string.
* stop - separator character.
* dst - destination string.
* Returns: IPIKE_SUCCESS, IPIKE_OUT_OF_MEMORY, IPIKE_CONF_PARSE_ERROR
*/
IP_GLOBAL Ipike_error
ipike_parse_get_string(const char** src, char stop, char** dst);
/*
*===========================================================================
* ipike_parse_get_first_string
*===========================================================================
* Description: Get next string. The strings are separated with stop
* character. The destination string will be allocated with
* ipcom_malloc.
* Parameters: src - source string.
* stop - separator character.
* dst - destination string.
* Returns: IPIKE_SUCCESS, IPIKE_OUT_OF_MEMORY, IPIKE_CONF_PARSE_ERROR
*/
IP_GLOBAL Ipike_error
ipike_parse_get_first_string(const char* src, char stop, char** dst);
/*
*===========================================================================
* ipike_parse_bool
*===========================================================================
* Description: Parse boolean value.
* Parameters: str - string representation of bool value.
* value - will receive bool value (TRUE/FALSE)
* Returns: IPIKE_SUCCESS
*/
IP_GLOBAL Ipike_error
ipike_parse_bool(const char* str, Ip_bool* value);
/*
*===========================================================================
* ipike_parse_int
*===========================================================================
* Description: Parse int value.
* Parameters: str - string representation of intgear value.
* value - will receive integear value.
* Returns: IPIKE_SUCCESS, IPIKE_CONF_INVALID_VALUE
*/
IP_GLOBAL Ipike_error
ipike_parse_int(const char* str, int *value);
/*
*===========================================================================
* ipike_parse_string
*===========================================================================
* Description: Parse string value.
* Parameters: str - string representation of value.
* value - will receive string value
* Returns: IPIKE_SUCCESS, IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_parse_string(const char* str, const char** value);
/*
*===========================================================================
* ipike_parse_delete_string
*===========================================================================
* Description: Delete string allocated above.
* Parameters: str - the string to delete.
* Returns:
*/
IP_GLOBAL void
ipike_parse_delete_string(const char* str);
/*
*===========================================================================
* ipike_parse_number
*===========================================================================
* Description: Parse Ip_u32 value. Will return IPIKE_CONF_INVALID_VALUE if
* the string is invalid or a negative number.
*
* Parameters: str - string representation of Ip_u32 value.
* value - will receive Ip_u32 value.
* Returns: IPIKE_SUCCESS, IPIKE_CONF_INVALID_VALUE
*/
IP_GLOBAL Ipike_error
ipike_parse_number(const char* str, Ip_u32* value);
/*
*===========================================================================
* ipike_parse_number_default
*===========================================================================
* Description: Parse Ip_u32 value. The value will receive the default_value
* if it str is a NULL pointer otherwise it will return
* IPIKE_CONF_INVALID_VALUE if the string is invalid or
* a negative number.
*
* Parameters: str - string representation of Ip_u32 value.
* value - will receive Ip_u32 value.
* default_value - Default value
* Returns: IPIKE_SUCCESS, IPIKE_CONF_INVALID_VALUE
*/
IP_GLOBAL Ipike_error
ipike_parse_number_default(
const char* str,
Ip_u32* value,
Ip_u32 default_value);
/*
*===========================================================================
* ipike_parse_number_range
*===========================================================================
* Description: Parses a range of Ip_u32 values in the form 'X-Y' and places
* them in the 'low' and 'high' parameters.
* If the string only contains a single number it will be placed
* in both 'low' and high.
* Will return IPIKE_CONF_INVALID_VALUE if the string is invalid
* ,if it contains a negative number or if X > Y.
*
* Parameters: str - string representation of Ip_u32 value.
* low - will receive lower Ip_u32 value.
* high - will receive lower Ip_u32 value.
* Returns: IPIKE_SUCCESS, IPIKE_CONF_INVALID_VALUE
*/
IP_GLOBAL Ipike_error
ipike_parse_number_range(const char* str, Ip_u32* low, Ip_u32* high);
/*
*===========================================================================
* ipike_configuration_new
*===========================================================================
* Description: Parse the configuration data to a configuration structure.
* Free the configuration structure with ipike_parse_config.
* Parameters: parse_str - a string with the configuration.
* parse_str_len - Length of string.
* config - will retrieved the configuration structure.
* Returns: IPIKE_SUCCESS, IPIKE_OUT_OF_MEMORY, IPIKE_CONF_PARSE_ERROR
*/
IP_GLOBAL Ipike_error
ipike_configuration_new(
const char* parse_str,
Ip_size_t parse_str_len,
Ipike_config** config);
/*
*===========================================================================
* ipike_configuration_free
*===========================================================================
* Description: Free the configuration structure, generated by
* ipike_parse_config.
* Parameters: config - the configuration structure.
* Returns:
*/
IP_GLOBAL void
ipike_configuration_free(Ipike_config* config);
/*
*===========================================================================
* ipike_configuration_from_file
*===========================================================================
* Description: Parse the configuration file to a configuration structure.
* Free the configuration structure with ipike_parse_config.
* Parameters: filename - name of the configuration file.
* config - will retrieved the configuration structure.
* Returns: IPIKE_SUCCESS, IPIKE_OUT_OF_MEMORY, IPIKE_CONF_PARSE_ERROR
*/
IP_GLOBAL Ipike_error
ipike_configuration_from_file(const char* filename, Ipike_config** config);
/*
*===========================================================================
* ipike_configuration_get
*===========================================================================
* Description: Get a section/entry from the configuration. Separate with '/'
* to get sublevel section/entry.
* Parameters: name - name of the configuration section/entry.
* config - the configuration to search.
* Returns: IP_NULL or the found entry/section
*/
IP_GLOBAL Ipike_config*
ipike_configuration_get(const char* name, Ipike_config* config);
/*
*===========================================================================
* ipike_configuration_enum
*===========================================================================
* Description: Enumerate all entries/sections in the given config section.
* Parameters: config - the configuration to search.
* last - the last returned section or IP_NULL if first call.
* Returns: IP_NULL or the next entry/section
*/
IP_GLOBAL Ipike_config*
ipike_configuration_enum(Ipike_config* config, Ipike_config* last);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_crypto.c
+4284
View File
File diff suppressed because it is too large Load Diff
components/ip_net2-6.9/ipike/src/ipike_crypto.h
+1078
View File
File diff suppressed because it is too large Load Diff
components/ip_net2-6.9/ipike/src/ipike_dispatcher.c
+2778
View File
File diff suppressed because it is too large Load Diff
components/ip_net2-6.9/ipike/src/ipike_dispatcher.h
+293
View File
@@ -0,0 +1,293 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_dispatcher.h,v $ $Revision: 1.15.14.4 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_dispatcher.h,v $
* $Author: edahlber $ $Date: 2012-06-20 08:06:21 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#ifndef IPIKE_DISPATCHER_H
#define IPIKE_DISPATCHER_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Sends and receives raw messages from remote peers. */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_config.h"
#include "ipike.h"
#include "ipike_configuration.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
typedef struct Ipike_message_struct
{
/* the local address this packet was sent to */
union Ip_sockaddr_union local_addr;
/* the sender address of the incomming packages */
union Ip_sockaddr_union peer_addr;
/* the raw data read from the socket */
Ipike_value data;
}
Ipike_message;
struct Ipike_sadb_entry_struct;
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_receive_message
*===========================================================================
* Description: Receives the next message, the function blocks until at least
* one message can be read.
* Parameters: msg - a message from any of the ports that the IKE daemon is
* listing on.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*
*/
IP_GLOBAL Ipike_error
ipike_receive_message(Ipike_message *msg);
/*
*===========================================================================
* ipike_send_message
*===========================================================================
* Description: Send a message to the peer stored in the Ipike_message struct.
* Parameters: msg - a message containg the data and the address to recipient
* of the data.
* Returns: IPIKE_SUCCESS
* IPIKE_SEND_FAILED
*
*/
IP_GLOBAL Ipike_error
ipike_send_message(Ipike_message *msg);
/*
*===========================================================================
* ipike_free_message
*===========================================================================
* Description: Frees all resources allocated by the message.
* Parameters: msg - a message from a successful call to ipike_get_message.
* Returns:
*
*/
IP_GLOBAL void
ipike_free_message(Ipike_message *msg);
/*
*===========================================================================
* ipike_dispatcher_flows_add
*===========================================================================
* Description: Adds the necessary bypass flows for the listening sockets
* plus any additional IPsec 'require' or 'acquire' flows.
* This is usually called when all flows been flushed and the
* flows needs to be reinstalled.
* Parameters:
* Returns:
*/
IP_GLOBAL void
ipike_dispatcher_flows_add(void);
/*
*===========================================================================
* ipike_dispatch_start_sa_negotiation
*===========================================================================
* Description: Initiates SA negotiation for all IPSec SA that currenly
* are missing active SAs.
* Parameters: exception - IPsec SA configuration to skip, IP_NULL means
* try to establish all.
*
* Returns: Standard error code.
*
*/
IP_GLOBAL Ipike_error
ipike_dispatch_start_sa_negotiation(
Ipike_config_ipsec_sa * exception);
/*
*===========================================================================
* ipike_dispatch_add_radius_socket
*===========================================================================
* Description: Add a radius socket to the listen list
* Parameters:
* Returns: Standard error code.
*
*/
IP_GLOBAL Ipike_error
ipike_dispatch_add_radius_socket(Ip_fd sock);
/*
*===========================================================================
* ipike_dispatch_remove_radius_socket
*===========================================================================
* Description: Remove a radius socket from the listen list
* Parameters:
* Returns: Standard error code.
*
*/
IP_GLOBAL void
ipike_dispatch_remove_radius_socket(Ip_fd sock);
/*
*===========================================================================
* ipike_dispatch_remove_radius_socket
*===========================================================================
* Description: Enumerate all radius socket.
* Parameters: last - Will keep track on whcih socket to get, set to zero for
* first call and will be updated for the following calls.
* Returns: Socket value or IP_INVALID_SOCKET if no more sockets.
*/
IP_GLOBAL Ip_fd
ipike_dispatch_enum_radius_socket(Ip_u32* last);
/*
*===========================================================================
* ipike_dispath_open_cmd_socket
*===========================================================================
* Description: Open cmd socket for listen or connect.
* Parameters: listen - IP_FALSE if connect, IP_TRUE if listen
* Returns: Socket value or IP_INVALID_SOCKET if failure
*/
IP_GLOBAL Ip_fd
ipike_dispath_open_cmd_socket(Ip_bool listen);
/*
*===========================================================================
* ipike_dispatch_commit_address_update
*===========================================================================
* Description: Commit an address update
* Parameters: ike_sa - the IKE SA that should get a new address
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_dispatch_commit_address_update(struct Ipike_sadb_entry_struct *ike_sa);
/*
*===========================================================================
* ipike_dispath_handle_ipd_command
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_dispath_handle_ipd_command(Ip_u8 cmd, Ip_fd fd, Ip_u8* buf, Ip_u32 len);
/*
*===========================================================================
* ipike_shell_cmd
*===========================================================================
* Description: Handle shell command buffer and send response to specified
* socket.
* Parameters: cmd - shell command
* fd - socket to send response
* buf - buffer with shell command data
* len - length of shell command data buffer
* Returns: IPIKE_SUCCESS
* IPIKE_FAILED
*/
IP_GLOBAL Ipike_error
ipike_shell_cmd(Ip_u8 cmd, Ip_fd fd, Ip_u8 *data, Ip_u32 len);
/*
*===========================================================================
* ipike_dispatcher_startup
*===========================================================================
* Description: Initializes the dispatcher module.
* Parameters:
* Returns: IPIKE_SUCCESS
* IPIKE_BIND_ERROR
* IPIKE_CONF_VALUE_NOT_FOUND
* IPIKE_IPCOMCALL_ERROR
*
*/
IP_GLOBAL Ipike_error
ipike_dispatcher_startup(void);
/*
*===========================================================================
* ipike_dispatcher_shutdown
*===========================================================================
* Description: Frees all resources allocated by the dispatcher.
* Parameters:
* Returns:
*
*/
IP_GLOBAL void
ipike_dispatcher_shutdown(void);
/*
*===========================================================================
* ipike_dispatcher_reconfigure
*===========================================================================
* Description: Do reconfigure for dispatcher.
* Parameters: -
* Returns: Standard IPIKE error code.
*/
IP_GLOBAL void
ipike_dispatcher_reconfigure(void);
/*
*===========================================================================
* ipike_dispatcher_socket_local_addr_get
*===========================================================================
* Description: Get the local address which will be used when communicating
* with the remote address. The result will be stored in the
* local address argument.
*
* Parameters: local - Local address
* remote - Remote peer address
* Returns: Standard IPIKE error code.
*/
IP_GLOBAL Ipike_error
ipike_dispatcher_socket_local_addr_get(
union Ip_sockaddr_union* local,
union Ip_sockaddr_union* dst);
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_doi.c
+147
View File
@@ -0,0 +1,147 @@
/*
******************************************************************************
* SOURCE FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_doi.c,v $ $Revision: 1.11 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_doi.c,v $
* $Author: edahlber $ $Date: 2010-12-13 09:23:13 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_doi.h"
#include "ipike_payload.h"
#include "ipike_payload_sa.h"
#include "ipike_util.h"
#include "ipike_h.h"
/*
****************************************************************************
* 4 EXTERN PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 5 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 6 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 7 LOCAL PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 8 DATA
****************************************************************************
*/
/*
****************************************************************************
* 9 LOCAL FUNCTIONS
****************************************************************************
*/
/*
****************************************************************************
* 10 PUBLIC FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_doi_to_string
*===========================================================================
*/
IP_GLOBAL const char*
ipike_doi_to_string(Ip_u32 doi)
{
const char* s;
if ((ipike_map_string(ipike.doi_map, (int) doi, &s)))
return "invalid domain of interpretation";
return s;
}
/*
*===========================================================================
* ipike_doi_from_string
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_doi_from_string(const char* str_doi, Ip_u32* doi)
{
Ipike_error err;
int t_doi;
err = ipike_map_int(ipike.doi_map, str_doi, &t_doi);
*doi = (Ip_u32) t_doi;
return err;
}
/*
*===========================================================================
* ipike_get_doi
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_get_doi(Ipike_isakmp_header* isakmp, Ip_u32* doi)
{
Ipike_payload_header* payload;
Ip_u8 this_payload;
Ipike_payload_enum ctx;
this_payload = isakmp->next_payload;
payload = ipike_first_payload(isakmp, &ctx);
while (payload != IP_NULL && this_payload != IPIKE_PAYLOAD_SECURITY_ASSOCIATION)
{
this_payload = payload->next_payload;
payload = ipike_next_payload(&ctx);
}
ipike_free_payload_enumerator(&ctx);
if (payload == IP_NULL)
return IPIKE_FAILED;
if (this_payload == IPIKE_PAYLOAD_SECURITY_ASSOCIATION)
*doi = ip_ntohl(((Ipike_sa_payload*) payload)->doi);
return IPIKE_SUCCESS;
}
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_doi.h
+118
View File
@@ -0,0 +1,118 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_doi.h,v $ $Revision: 1.2 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_doi.h,v $
* $Author: edahlber $ $Date: 2010-04-23 15:31:40 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#ifndef IPIKE_DOI_H
#define IPIKE_DOI_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Constants and 'to_string' functions releated to domain of interpretation
(DOI) */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_config.h"
#include "ipike.h"
#include "ipike_isakmp.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
#define IPIKE_DOI_ISAKMP 0
#define IPIKE_DOI_IPSEC 1
#define IPIKE_DOI_COUNT 2
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_doi_to_string
*===========================================================================
* Description: Returns the string represenation of the DOI.
* Parameters: doi - the domain of interpretation.
* Returns: The string represenation of the DOI.
*/
IP_GLOBAL const char*
ipike_doi_to_string(Ip_u32 doi);
/*
*===========================================================================
* ipike_doi_from_string
*===========================================================================
* Description: Returns the numeric represenation of the DOI, given the string
* representation.
* Parameters: str_doi - The string representation of the DOI.
* doi - Will hold the domain of interpretation.
* Returns: IPIKE_SUCCESS
* IPIKE_VALUE_NOT_FOUND
*/
IP_GLOBAL Ipike_error
ipike_doi_from_string(const char* str_doi, Ip_u32* doi);
/*
*===========================================================================
* ipike_get_doi
*===========================================================================
* Description: Gets the DOI from the SA payload in the ISAKMP message,
* the function succeeds even if no SA payload was found (the
* doi paramter is left unchanged in that case.
* Parameters: isakmp - a valid ISAKMP message.
* doi - will hold the DOI if the call was successful.
* Returns: IPIKE_SUCCESS
*/
IP_GLOBAL Ipike_error
ipike_get_doi(Ipike_isakmp_header* isakmp, Ip_u32* doi);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_dynamic_ip.c
+588
View File
@@ -0,0 +1,588 @@
/*
******************************************************************************
* SOURCE FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_dynamic_ip.c,v $ $Revision: 1.23.10.7 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_dynamic_ip.c,v $
* $Author: zan $ $Date: 2013-08-08 09:53:45 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_h.h"
#include "ipike.h"
#include "ipike_util.h"
#include "ipike_dynamic_ip.h"
/*
****************************************************************************
* 4 EXTERN PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 5 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 6 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 7 LOCAL PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 8 DATA
****************************************************************************
*/
/*
****************************************************************************
* 9 LOCAL FUNCTIONS
****************************************************************************
*/
/*
****************************************************************************
* 10 PUBLIC FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_initiate_address_reference
*===========================================================================
*/
IP_GLOBAL void
ipike_initiate_address_reference(
const char *id,
const char *ifname,
union Ip_sockaddr_union *addr,
union Ip_sockaddr_union *netmask)
{
char entry[64] = {0};
char value[16] = {0};
const char* name = IP_NULL;
int count = 0;
/* Format:
*
* ipike.added_addresses.id.<id>=<addr>
* ipike.added_addresses.<addr>.id=<id>
* ipike.added_addresses.<addr>.interface=<ifname>
* ipike.added_addresses.<addr>.count=0
* ipike.added_addresses.<addr>.netmask=<netmask>
*/
name = ipike_addr_to_str(addr);
if (name==IP_NULL)
return IP_NULL;
if (ipcom_strlen(name) < (sizeof(entry)-32))
{
ipcom_sprintf(entry, "ipike.added_addresses.id.%s", id);
(void)ipcom_sysvar_set(entry, name, IPCOM_SYSVAR_FLAG_OVERWRITE);
ipcom_sprintf(entry, "ipike.added_addresses.%s.id", name);
(void)ipcom_sysvar_set(entry, id, IPCOM_SYSVAR_FLAG_OVERWRITE);
ipcom_sprintf(entry, "ipike.added_addresses.%s.interface", name);
(void)ipcom_sysvar_set(entry, ifname, IPCOM_SYSVAR_FLAG_OVERWRITE);
ipcom_sprintf(entry, "ipike.added_addresses.%s.count", name);
/* Read old if renew got same address */
count = ipcom_sysvar_get_as_int(entry, 0);
ipcom_sprintf(value, "%d", count);
(void)ipcom_sysvar_set(entry, value, IPCOM_SYSVAR_FLAG_OVERWRITE);
ipcom_sprintf(entry, "ipike.added_addresses.%s.netmask", name);
name = ipike_addr_to_str(netmask);
if (name != IP_NULL)
(void)ipcom_sysvar_set(entry, name, IPCOM_SYSVAR_FLAG_OVERWRITE);
}
return;
}
/*
*===========================================================================
* ipike_has_valid_address_reference
*===========================================================================
*/
IP_GLOBAL Ip_bool
ipike_has_valid_address_reference(const char *id)
{
Ip_bool has = IP_FALSE;
char entry[64] = {0};
char value[64] = {0};
Ip_size_t len = 0;
union Ip_sockaddr_union addr;
if (ipcom_strlen(id) < (sizeof(entry)-25))
{
ipcom_sprintf(entry, "ipike.added_addresses.id.%s", id);
len = sizeof(value);
if ( ipcom_sysvar_get(entry, value, &len) != IP_NULL && value[0] != 0 )
{
if ( ipike_addr_set(&addr,value) != IPIKE_SUCCESS ||
ipike_addr_is_zero(&addr))
{
IPCOM_LOG0(DEBUG, "ipike_has_valid_address_reference: bad address");
(void)ipcom_sysvar_unset(entry);
}
else
{
IPCOM_LOG1(DEBUG2, "ipike_has_valid_address_reference: got address %s", value);
has = IP_TRUE;
}
}
}
return has;
}
/*
*===========================================================================
* ipike_remove_address_reference
*===========================================================================
*/
IP_GLOBAL void
ipike_remove_address_reference(const char *id)
{
char entry[64] = {0};
if (ipcom_strlen(id) < (sizeof(entry)-25))
{
ipcom_sprintf(entry, "ipike.added_addresses.id.%s", id);
(void)ipcom_sysvar_unset(entry);
}
return;
}
/*
*===========================================================================
* ipike_increase_address_reference
*===========================================================================
*/
IP_GLOBAL void
ipike_increase_address_reference(union Ip_sockaddr_union *addr)
{
char entry[64] = {0};
char value[64] = {0};
const char* name = IP_NULL;
Ip_size_t len = 0;
int count = 0;
union Ip_sockaddr_union netmask;
name = ipike_addr_to_str(addr);
if (name==IP_NULL)
return;
if (ipcom_strlen(name) < (sizeof(entry)-32))
{
ipcom_sprintf(entry, "ipike.added_addresses.%s.count", name);
count = ipcom_sysvar_get_as_int(entry, 0);
count++;
ipcom_sprintf(value, "%d", count);
(void)ipcom_sysvar_set(entry, value, IPCOM_SYSVAR_FLAG_OVERWRITE);
if (count == 1)
{
ipcom_sprintf(entry, "ipike.added_addresses.%s.netmask", name);
len = sizeof(value);
if (((ipcom_sysvar_get(entry, value, &len)) != IP_NULL) &&
(value[0] != 0))
{
(void)ipike_addr_set(&netmask,value);
}
ipcom_sprintf(entry, "ipike.added_addresses.%s.interface", name);
len = sizeof(value);
if (((ipcom_sysvar_get(entry, value, &len)) == IP_NULL) ||
(value[0] == 0) ||
ipike_add_delete_address(IP_TRUE, value, addr, &netmask))
{
IPCOM_LOG0(DEBUG, "ipike_increase_address_reference: failed to add address");
}
}
}
return;
}
/*
*===========================================================================
* ipike_decrease_address_reference
*===========================================================================
*/
IP_GLOBAL void
ipike_decrease_address_reference(union Ip_sockaddr_union *addr)
{
char entry[64] = {0};
char value[64] = {0};
const char* id = IP_NULL;
const char* name = IP_NULL;
int count = 0;
Ip_size_t len = 0;
name = ipike_addr_to_str(addr);
if (name==IP_NULL)
return;
if (ipcom_strlen(name) < (sizeof(entry)-32))
{
ipcom_sprintf(entry, "ipike.added_addresses.%s.count", name);
count = ipcom_sysvar_get_as_int(entry, 0);
if (count == 1)
{
/* Do cleanup and delete dynamic ip address */
(void)ipcom_sysvar_unset(entry);
ipcom_sprintf(entry, "ipike.added_addresses.%s.id", name);
len = sizeof(value);
id = ipcom_sysvar_get(entry, value, &len);
(void)ipcom_sysvar_unset(entry);
ipcom_sprintf(entry, "ipike.added_addresses.id.%s", id);
(void)ipcom_sysvar_unset(entry);
ipcom_sprintf(entry, "ipike.added_addresses.%s.netmask", name);
(void)ipcom_sysvar_unset(entry);
ipcom_sprintf(entry, "ipike.added_addresses.%s.interface", name);
len = sizeof(value);
name = ipcom_sysvar_get(entry, value, &len);
(void)ipcom_sysvar_unset(entry);
if (ipike_add_delete_address(IP_FALSE, name, addr, IP_NULL))
{
IPCOM_LOG0(DEBUG, "ipike_decrease_address_reference: failed to delete address");
}
}
else if (count > 1)
{
count--;
ipcom_sprintf(value, "%d", count);
(void)ipcom_sysvar_set(entry, value, IPCOM_SYSVAR_FLAG_OVERWRITE);
}
}
return;
}
/*
*===========================================================================
* ipike_update_interface_addresses
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_update_interface_addresses(
const char *id,
const char *ifname,
union Ip_sockaddr_union *addr,
union Ip_sockaddr_union *netmask,
union Ip_sockaddr_union **dns,
union Ip_sockaddr_union **nbns)
{
Ipike_error err = IPIKE_SUCCESS;
const char *str = IP_NULL;
(void)nbns; /* not supported */
/* Set dns server if specified */
if (dns != IP_NULL)
{
if (dns[0] != IP_NULL)
{
if (dns[0]->sa.sa_family != 0)
{
str = ipike_addr_to_str(dns[0]);
if (ipcom_sysvar_set("ipdnsc.primaryns", str, IPCOM_SYSVAR_FLAG_OVERWRITE))
err = IPIKE_FAILED;
}
if ( dns[1] != IP_NULL && err == IPIKE_SUCCESS )
{
if (dns[1]->sa.sa_family != 0)
{
str = ipike_addr_to_str(dns[1]);
if (ipcom_sysvar_set("ipdnsc.secondaryns", str, IPCOM_SYSVAR_FLAG_OVERWRITE))
err = IPIKE_FAILED;
}
}
}
}
/* Initiate the reference counter for ip address */
if (err == IPIKE_SUCCESS)
ipike_initiate_address_reference(id, ifname, addr, netmask);
return err;
}
/*
*===========================================================================
* ipike_get_interface_addresses
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_get_interface_addresses(
Ip_bool ip4,
Ipike_value *peer_id,
Ip_u32 counter,
union Ip_sockaddr_union *addr,
union Ip_sockaddr_union *netmask,
union Ip_sockaddr_union ***dns,
union Ip_sockaddr_union ***nbns)
{
Ipike_error err = IPIKE_SUCCESS;
char *name = IP_NULL;
char str[128] = {0};
Ip_size_t len = 0;
Ip_u32 n = 0;
char **vec = IP_NULL;
union Ip_sockaddr_union *tmp = IP_NULL;
char *addrstr = IP_NULL;
/* This is a sample implementation to get dynamic addresses. This
* implementation only support IPv4 and does not support multiple
* addresses and expire (infinite). */
if (!ip4)
{
#ifdef IPCOM_USE_INET6
char *prefixptr = IP_NULL;
int n1;
int prefixlen = 128;
name = (char*)ipcom_malloc(peer_id->len*2+1+28+4);
if (name == IP_NULL)
{
IP_PANIC();
err = IPIKE_OUT_OF_MEMORY;
}
else
{
ipcom_strcpy(name, "ipike.address_pool.used.ip6.");
ipike_bin2hex(peer_id->value, peer_id->len, &name[ipcom_strlen(name)]);
ipcom_sprintf(&name[ipcom_strlen(name)], "%.2x", (Ip_u16)counter);
/* Possible to reuse old? */
len = sizeof(str);
if ((ipcom_sysvar_get(name, str, &len) == IP_NULL) ||
(ipike_addr_load_subnet(str, addr, netmask) != IPIKE_SUCCESS))
{
/* Allocate new */
len = sizeof(str);
if (ipcom_sysvar_get("ipike.address_pool.network6", str, &len) == IP_NULL)
{
IPCOM_LOG0(ERR, "Dynamic address: No pool available, set sysvar ipike.address_pool.network6");
err = IPIKE_FAILED;
}
/* Find prefix len before all processing if configured*/
if (IP_NULL != (prefixptr = ipcom_strchr(str, '/')))
{
n1 = atoi(prefixptr+1);
if( (n1 / 8) > 16)
{
IPCOM_LOG1(ERR, "Dynamic address: Invalid pool: bad netmask (%d)", n1);
}
prefixlen = n1;
}
if ( (err == IPIKE_SUCCESS) &&
( (ipike_addr_load_subnet(str, addr, netmask) != IPIKE_SUCCESS) ||
(ipcom_sysvar_set(name, str, IPCOM_SYSVAR_FLAG_OVERWRITE) != IPCOM_SUCCESS)
)
)
{
IPCOM_LOG0(ERR, "Dynamic address: Invalid pool, check sysvar ipike.address_pool.network6");
err = IPIKE_FAILED;
}
if (err == IPIKE_SUCCESS)
{
if ( (err = ipike_addr_increment_v6(addr, prefixlen) != IPIKE_SUCCESS) )
{
IPCOM_LOG0(ERR, "Dynamic address: Failed to increment IPv6 address");
}
else
{
addrstr=ipike_addr_subnet_to_str(addr, netmask);
if (addrstr==IP_NULL)
{
IPCOM_LOG0(ERR, "Failed to update dynamic address pool");
err = IPIKE_FAILED;
}
else
{
ipcom_strncpy(str, addrstr,127);
if (ipcom_sysvar_set("ipike.address_pool.network6", str, IPCOM_SYSVAR_FLAG_OVERWRITE))
{
IPCOM_LOG0(ERR, "Dynamic address: Failed to update dynamic address pool");
err = IPIKE_FAILED;
}
}
}
}
}
}
#endif
}
else
{
#ifdef IPCOM_USE_INET
name = (char*)ipcom_malloc(peer_id->len*2+1+28+4);
if (name == IP_NULL)
{
IP_PANIC();
err = IPIKE_OUT_OF_MEMORY;
}
else
{
ipcom_strcpy(name, "ipike.address_pool.used.ip4.");
ipike_bin2hex(peer_id->value, peer_id->len, &name[ipcom_strlen(name)]);
ipcom_sprintf(&name[ipcom_strlen(name)], "%.2x", (Ip_u16)counter);
/* Possible to reuse old? */
len = sizeof(str);
if ((ipcom_sysvar_get(name, str, &len) == IP_NULL) ||
(ipike_addr_load_subnet(str, addr, netmask) != IPIKE_SUCCESS))
{
/* Allocate new */
len = sizeof(str);
if ((ipcom_sysvar_get("ipike.address_pool.network4", str, &len) == IP_NULL) ||
(ipike_addr_load_subnet(str, addr, netmask) != IPIKE_SUCCESS) ||
(ipcom_sysvar_set(name, str, IPCOM_SYSVAR_FLAG_OVERWRITE) != IPCOM_SUCCESS))
{
IPCOM_LOG0(ERR, "No dynamic address pool available, set sysvar ipike.address_pool.network4");
err = IPIKE_FAILED;
}
else
{
n = addr->sin.sin_addr.s_addr;
addr->sin.sin_addr.s_addr = ip_ntohl(addr->sin.sin_addr.s_addr);
if ((++addr->sin.sin_addr.s_addr & 0xff) == 0)
addr->sin.sin_addr.s_addr++;
addr->sin.sin_addr.s_addr = ip_htonl(addr->sin.sin_addr.s_addr);
addrstr=ipike_addr_subnet_to_str(addr, netmask);
if (addrstr==IP_NULL)
{
IPCOM_LOG0(ERR, "Failed to update dynamic address pool");
err = IPIKE_FAILED;
}
else
{
ipcom_strncpy(str, addrstr,127);
if (ipcom_sysvar_set("ipike.address_pool.network4", str, IPCOM_SYSVAR_FLAG_OVERWRITE))
{
IPCOM_LOG0(ERR, "Failed to update dynamic address pool");
err = IPIKE_FAILED;
}
}
addr->sin.sin_addr.s_addr = n;
}
}
}
if ((IPIKE_SUCCESS == err) && (IP_NULL != dns))
{
len = sizeof(str);
if (ipcom_sysvar_get("ipike.address_pool.dns4", str, &len) != IP_NULL)
{
if (IP_NULL == (vec = ipike_strvec(str, ", ")))
{
IP_PANIC();
err = IPIKE_OUT_OF_MEMORY;
}
else
{
n = 0;
while ((err == IPIKE_SUCCESS) && (vec[n] != IP_NULL))
{
if (IP_NULL == (tmp = ipcom_calloc(1, sizeof(*tmp))))
{
IP_PANIC();
err = IPIKE_OUT_OF_MEMORY;
}
else
{
err = ipike_addr_set(tmp, vec[n]);
if (err == IPIKE_SUCCESS)
err = ipike_array_add((void***)dns, tmp);
if (err != IPIKE_SUCCESS)
ipcom_free(tmp);
}
n++;
}
ipike_array_free((void**)vec, ipcom_free);
}
}
}
if ((IPIKE_SUCCESS == err) && (IP_NULL != nbns))
{
len = sizeof(str);
if (ipcom_sysvar_get("ipike.address_pool.nbns4", str, &len) != IP_NULL)
{
if (IP_NULL == (vec = ipike_strvec(str, ", ")))
{
IP_PANIC();
err = IPIKE_OUT_OF_MEMORY;
}
else
{
n = 0;
while ((err == IPIKE_SUCCESS) && (vec[n] != IP_NULL))
{
if (IP_NULL == (tmp = ipcom_calloc(1, sizeof(*tmp))))
{
IP_PANIC();
err = IPIKE_OUT_OF_MEMORY;
}
else
{
err = ipike_addr_set(tmp, vec[n]);
if (err == IPIKE_SUCCESS)
err = ipike_array_add((void***)nbns, tmp);
if (err != IPIKE_SUCCESS)
ipcom_free(tmp);
}
n++;
}
ipike_array_free((void**)vec, ipcom_free);
}
}
}
#endif
}
if ( name != IP_NULL )
ipcom_free(name);
return err;
}
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_dynamic_ip.h
+183
View File
@@ -0,0 +1,183 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_dynamic_ip.h,v $ $Revision: 1.7.16.1 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_dynamic_ip.h,v $
* $Author: svc-cmnet $ $Date: 2013-03-13 07:45:26 $
* $State: Exp $ $Locker: $
*
* Copyright Interpeak AB <www.interpeak.se>. All rights reserved.
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#ifndef IPIKE_DYNAMIC_IP_H
#define IPIKE_DYNAMIC_IP_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Dynamic IP address handling */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_config.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_initiate_address_reference
*===========================================================================
* Description: Initiate reference counter for specified address.
* Parameters: id - id of interface
* ifname - name of interface
* addr - ip address.
* netmask - ip netmask.
* expire - number of seconds until address expire.
* Returns:
*/
IP_GLOBAL void
ipike_initiate_address_reference(
const char *id,
const char *ifname,
union Ip_sockaddr_union *netmask,
union Ip_sockaddr_union *addr);
/*
*===========================================================================
* ipike_has_valid_address_reference
*===========================================================================
* Description: Ask if a reference counter is available for specified address.
* Parameters: id - id of interface
* Returns: IP_TRUE if available (else IP_FALSE)
*/
IP_GLOBAL Ip_bool
ipike_has_valid_address_reference(const char *id);
/*
*===========================================================================
* ipike_remove_address_reference
*===========================================================================
* Description: Remove a reference counter if available for specified address.
* Parameters: id - id of interface
* Returns:
*/
IP_GLOBAL void
ipike_remove_address_reference(const char *id);
/*
*===========================================================================
* ipike_increase_address_reference
*===========================================================================
* Description: Increase reference counter for specified address. Will create
* a new reference if ifname not null (initialize to zero).
* Parameters: ifname - name of interface
* addr - ip address.
* Returns:
*/
IP_GLOBAL void
ipike_increase_address_reference(union Ip_sockaddr_union *addr);
/*
*===========================================================================
* ipike_decrease_address_reference
*===========================================================================
* Description: Decrease reference counter for specified address, delete from
* interface when reach zero references.
* Parameters: addr - ip address.
* Returns:
*/
IP_GLOBAL void
ipike_decrease_address_reference(union Ip_sockaddr_union *addr);
/*
*===========================================================================
* ipike_update_interface_addresses
*===========================================================================
* Description: Update ip addresses on specified interface.
* Parameters: id - The id to be used (ipsec_sa id)
* ifname - Interface name, set to IP_NULL to get first available
* interface.
* addr - new ip address.
* netmask - new ip netmask.
* dns - new dns address.
* nbns - new nbns address.
* Returns: IPIKE_SUCCESS, IPIKE_FAILED
*/
IP_GLOBAL Ipike_error
ipike_update_interface_addresses(
const char *id,
const char *ifname,
union Ip_sockaddr_union *addr,
union Ip_sockaddr_union *netmask,
union Ip_sockaddr_union **dns,
union Ip_sockaddr_union **nbns);
/*
*===========================================================================
* ipike_get_interface_addresses
*===========================================================================
* Description: Get ip addresses for specified interface.
* Parameters: ip4 - Set to IP_TRUE to get Ipv4 address (IP_FALSE for IPv6)
* peer_id - Id of peer that will get the address
* addr - will get ip address.
* netmask - will get ip netmask.
* dns - will get dns address (set to IP_NULL if not wanted).
* nbns - will get nbns address (set to IP_NULL if not wanted).
* Returns: IPIKE_SUCCESS, IPIKE_FAILED
*/
IP_GLOBAL Ipike_error
ipike_get_interface_addresses(
Ip_bool ip4,
Ipike_value *peer_id,
Ip_u32 counter,
union Ip_sockaddr_union *addr,
union Ip_sockaddr_union *netmask,
union Ip_sockaddr_union ***dns,
union Ip_sockaddr_union ***nbns);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_event_server.c
+639
View File
@@ -0,0 +1,639 @@
/*
******************************************************************************
* SOURCE FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_event_server.c,v $ $Revision: 1.5.2.4 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_event_server.c,v $
* $Author: zan $ $Date: 2013-07-31 08:17:04 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Erik Dahlberg <erik.dahlberg@windriver.com>
******************************************************************************
*/
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* IKE event receiver (client) and server implementation. The event server
* will send event messages to each registered receiver. All communication
* relies on IKE channels */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#define IPCOM_USE_CLIB_PROTO
#include "ipike_config.h"
#ifdef IPIKE_USE_EVENT_LOG
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_h.h"
#include "ipike_event.h"
#include "ipike_event_server.h"
#include "ipike_event_receiver.h"
#include "ipike_channel.h"
/*
****************************************************************************
* 4 EXTERN PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 5 DEFINES
****************************************************************************
*/
/* Retry time period for an IKE event receiver */
#define IPIKE_EVENT_RECEIVER_RETRY_TIME_SEC 1
/* Process name */
#define IPIKE_EVENT_RECEIVER_PROC_NAME "tIKEEventReceiver"
/* Channel address */
#if defined(IPCOM_USE_INET)
#define IPIKE_EVENT_CHANNEL_IP "127.0.0.1"
#else
#define IPIKE_EVENT_CHANNEL_IP "::1"
#endif
/* Channel port */
#define IPIKE_EVENT_CHANNEL_PORT "50150"
/* Full channel address */
#define IPIKE_EVENT_CHANNEL_ADDRESS \
IPIKE_EVENT_CHANNEL_IP "@" IPIKE_EVENT_CHANNEL_PORT
/*
****************************************************************************
* 6 TYPES
****************************************************************************
*/
/* Event receiver context */
typedef struct Ipike_event_receiver_ctx_struct
{
/* Semaphore for synchronized termination */
Ipcom_sem sem;
Ipcom_mutex mutex;
/* Variables protected by mutex - start */
Ipike_event_receiver_cb event_cb;
Ipike_channel *channel;
/* variables protected by mutex - end */
} Ipike_event_receiver_ctx;
/*
****************************************************************************
* 7 LOCAL PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 8 DATA
****************************************************************************
*/
/* Event receiver context, use one static global for now */
IP_STATIC Ipike_event_receiver_ctx ctx_store;
IP_STATIC Ipike_event_receiver_ctx * libctx;
/* String representation of events, must be aligned with the event table */
IP_STATIC const char * Ipike_event_strings[] =
{
"SOFT_LIFE_SIZE_EXPIRED",
"SOFT_LIFE_TIME_EXPIRED",
"HARD_LIFE_SIZE_EXPIRED",
"HARD_LIFE_TIME_EXPIRED",
"IKE_PACKET_DISCARD",
"IKE_PHASE_I_FAIL",
"IKE_PHASE_I_SUCCESS",
"IKE_PHASE_II_FAIL",
"IKE_PHASE_II_SUCCESS",
"IPSEC_PACKET_DISCARD",
"SEQUENCE_NUM_OVERFLOW",
"SPD_PACKET_DISCARD"
};
/* String representation of event reasons, must be aligned with
* the event reason table */
IP_STATIC const char * Ipike_event_reason_strings[] =
{
"UNDEFINED",
"AUTHENTICATION_ERROR",
"DECRYPTION_ERROR",
"ENCRYPTION_ERROR",
"EXPLICIT_DISCARD_POLICY",
"INVALID_SPI_ERROR",
"NEGOTIATION_TIMEOUT",
"NO_POLICY",
"NO_PROTECTION_SUITE",
"POLICY_ERROR",
"REPLAY_ERROR",
"INTERNAL_ERROR",
"ISAKMP_PACKET_ERROR",
"PROPOSAL_MISMATCH",
"PSK_MISMATCH",
"FLOW_MISMATCH",
"IKE_INTERNAL_ERROR",
"IKE_SA_OVERFLOW",
"IPSEC_SA_OVERFLOW"
};
/*
****************************************************************************
* 9 LOCAL FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_event_receiver_callback_set
*===========================================================================
*/
IP_STATIC void
ipike_event_receiver_callback_set(
Ipike_event_receiver_ctx * ctx,
Ipike_event_receiver_cb event_cb)
{
ip_assert(ctx != IP_NULL);
ipcom_mutex_lock(ctx->mutex);
ctx->event_cb = event_cb;
ipcom_mutex_unlock(ctx->mutex);
}
/*
*===========================================================================
* ipike_event_receiver_callback_get
*===========================================================================
*/
IP_STATIC Ipike_event_receiver_cb
ipike_event_receiver_callback_get(
Ipike_event_receiver_ctx * ctx)
{
Ipike_event_receiver_cb cb;
ip_assert(ctx != IP_NULL);
ipcom_mutex_lock(ctx->mutex);
cb = ctx->event_cb;
ipcom_mutex_unlock(ctx->mutex);
return cb;
}
/*
*===========================================================================
* ipike_event_receiver_process_msg
*===========================================================================
*/
IP_STATIC int
ipike_event_receiver_process_msg(
Ipike_event_receiver_ctx * ctx,
Ipike_channel_msg * msg)
{
Ipike_event_msg * emsg = (Ipike_event_msg *) msg;
Ipike_event_receiver_cb cb = IP_NULL;
cb = ipike_event_receiver_callback_get(ctx);
emsg->event.spi = ip_ntohl(emsg->event.spi);
emsg->event.reason = ip_ntohs(emsg->event.reason);
emsg->event.type = ip_ntohs(emsg->event.type);
emsg->event.src_port = ip_ntohs(emsg->event.src_port);
emsg->event.dst_port = ip_ntohs(emsg->event.dst_port);
if ( cb )
return cb(&emsg->event);
return -1;
}
/*
*===========================================================================
* ipike_event_receiver_proc
*===========================================================================
*/
IP_STATIC
IPCOM_PROCESS(ipike_event_receiver_proc)
{
Ipike_channel_addr * caddr = IP_NULL;
Ipike_channel_msg * msg = IP_NULL;
Ipike_channel * channel = IP_NULL;
Ipike_event_msg emsg;
Ipike_channel_status ret;
ip_assert(libctx != IP_NULL);
/* Register process */
ipcom_proc_init();
/* Register log in ipike facility */
ipcom_openlog("ipike", 0, IPCOM_LOG_IPIKE);
/* Get IKE daemon's channel address */
caddr = ipike_channel_addr_create(IPIKE_EVENT_CHANNEL_ADDRESS);
if ( caddr == IP_NULL )
{
IPCOM_LOG0(ERR, "ipike_event_receiver_proc() :: "\
"failed to create address");
goto errout;
}
/* Try keep us connected as long we have callback */
while ( ipike_event_receiver_callback_get(libctx) )
{
IPCOM_LOG1(DEBUG2, "ipike_event_receiver_proc() ::"\
" opening channel, retrying in %d seconds",
IPIKE_EVENT_RECEIVER_RETRY_TIME_SEC);
/* We are reestablishing an existing channel */
if ( channel != IP_NULL )
{
ipcom_mutex_lock(libctx->mutex);
libctx->channel = IP_NULL;
ipcom_mutex_unlock(libctx->mutex);
/* Destroy channel */
ipike_channel_destroy(channel);
}
/* Open channel to IKE daemon */
channel = ipike_channel_open(caddr);
if ( channel == IP_NULL )
{
IPCOM_LOG1(DEBUG2, "ipike_event_receiver_proc() :: failed to"\
" open channel, retrying in %d seconds",
IPIKE_EVENT_RECEIVER_RETRY_TIME_SEC);
ipcom_sleep(IPIKE_EVENT_RECEIVER_RETRY_TIME_SEC);
continue;
}
ipcom_mutex_lock(libctx->mutex);
libctx->channel = channel;
ipcom_mutex_unlock(libctx->mutex);
/* Loop forever and process channel messages */
for (;;)
{
IPIKE_CHANNEL_MSG_INIT_STATIC(msg, emsg);
/* Block until we get a message */
ret = ipike_channel_receive_msg(channel, &msg);
if ( ret != IPIKE_CHANNEL_OK )
{
IPCOM_LOG0(DEBUG, "ipike_event_receiver_proc() :: "\
"closing channel");
/* Something is wrong with the channel, break and
* reestablish the channel */
break;
}
/* We got a message, process it */
if ( ipike_event_receiver_process_msg(libctx, msg) < 0 )
{
IPCOM_LOG0(DEBUG, "ipike_event_receiver_proc() :: "\
"user callback signaled stop");
goto errout;
}
}
}
errout:
IPCOM_LOG0(DEBUG, "ipike_event_receiver_proc() :: cleaning up before exit");
ipcom_mutex_lock(libctx->mutex);
if (libctx->channel)
{
ipike_channel_destroy(libctx->channel);
libctx->channel = IP_NULL;
}
ipcom_mutex_unlock(libctx->mutex);
if (caddr)
ipike_channel_addr_destroy(caddr);
ipcom_closelog();
/* Notify exit */
ipcom_sem_post(libctx->sem);
/* Not allowed to reference libctx from now */
ipcom_proc_exit();
}
/*
****************************************************************************
* 10 PUBLIC FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_event_server_log
*===========================================================================
*/
IP_GLOBAL void
ipike_event_server_log(
int type,
int reason,
union Ip_sockaddr_union * src_ip,
union Ip_sockaddr_union * dst_ip,
int protocol,
Ip_u8 spi[4])
{
Ipike_event_msg emsg;
Ipike_channel_msg * msg;
Ipike_event * event;
event = &emsg.event;
if ( ipike.event_server != IP_NULL )
{
/* Set channel message header */
IPIKE_CHANNEL_MSG_INIT_STATIC(msg, emsg);
/* Set event data */
event->type = ip_htons((Ip_u16) type);
event->reason = ip_htons((Ip_u16) reason);
event->protocol = (Ip_u8) protocol;
if ( src_ip != IP_NULL )
(void)ipike_addr_copy(&event->src_ip, src_ip);
if ( dst_ip != IP_NULL )
(void)ipike_addr_copy(&event->dst_ip, dst_ip);
if ( spi != IP_NULL )
ipcom_memcpy(&event->spi, spi, 4);
IPCOM_LOG1(DEBUG2, "ipike_event_server_log() :: broadcasting event (%s) "\
"on all channels", ipike_event_type_str((Ip_u16) type));
ipike_channel_server_broadcast_msg(ipike.event_server,
(Ipike_channel_msg *) &emsg);
}
}
/*
*===========================================================================
* ipike_event_server_relay
*===========================================================================
*/
IP_GLOBAL void
ipike_event_server_relay(Ipike_event_msg *emsg)
{
if ( ipike.event_server )
{
IPCOM_LOG0(DEBUG2, "ipike_event_relay() :: relaying event "\
"message on all channels");
ipike_channel_server_broadcast_msg(ipike.event_server,
(Ipike_channel_msg *) emsg);
}
}
/*
*===========================================================================
* ipike_event_server_startup
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_event_server_startup(void)
{
Ipike_channel_addr * caddr;
/* Create IKE daemon's channel address */
caddr = ipike_channel_addr_create(IPIKE_EVENT_CHANNEL_ADDRESS);
if ( caddr == IP_NULL )
return IPIKE_FAILED;
/* Create a channel server */
ipike.event_server = ipike_channel_server_create(caddr,
IP_NULL,
IP_NULL,
IP_NULL);
/* We only needed the channel address to create the channel server */
ipike_channel_addr_destroy(caddr);
if ( ipike.event_server == IP_NULL )
{
IPCOM_LOG0(ERR, "ipike_event_server_startup() :: "\
"failed to create event server");
return IPIKE_FAILED;
}
IPCOM_LOG0(DEBUG2, "ipike_event_server_startup() :: "\
"event channel server is running started");
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_event_server_shutdown
*===========================================================================
*/
IP_GLOBAL void
ipike_event_server_shutdown(void)
{
if ( ipike.event_server != IP_NULL )
{
ipike_channel_server_destroy(ipike.event_server);
ipike.event_server = IP_NULL;
}
}
/*
*===========================================================================
* ipike_event_server_add_fds
*===========================================================================
*/
IP_GLOBAL int
ipike_event_server_add_fds(
Ip_fd_set * read_fds,
Ip_fd_set * write_fds)
{
return ipike_channel_server_add_fds(ipike.event_server,
read_fds,
write_fds);
}
/*
*===========================================================================
* ipike_event_server_process
*===========================================================================
*/
IP_GLOBAL int
ipike_event_server_process(
Ip_fd_set * read_fds,
Ip_fd_set * write_fds)
{
return ipike_channel_server_process(ipike.event_server,
read_fds,
write_fds);
}
/*
*===========================================================================
* ipike_event_type_str
*===========================================================================
*/
IP_GLOBAL const char *
ipike_event_type_str(
Ip_u16 type)
{
if ( type >= IPIKE_EVENT_MAX )
return "TYPE_UNKNOWN";
return Ipike_event_strings[type];
}
/*
*===========================================================================
* ipike_event_type_str
*===========================================================================
*/
IP_GLOBAL const char *
ipike_event_reason_str(
Ip_u16 type)
{
if ( type >= IPIKE_REASON_MAX )
return "REASON_UNKNOWN";
return Ipike_event_reason_strings[type];
}
/*
****************************************************************************
* Event receiver (client) functionality
****************************************************************************
*/
/*
*===========================================================================
* ipike_event_receiver_init
*===========================================================================
*/
IP_PUBLIC int
ipike_event_receiver_init(
Ipike_event_receiver_cb event_cb)
{
Ipcom_proc_attr proc_attr;
Ip_err err;
/* Make sure that library isn't initialized yet */
if ( libctx != IP_NULL )
return -1;
/* Get context, (replace with malloc to allow multiple instances */
libctx = &ctx_store;
ipcom_memset(libctx, 0, sizeof(Ipike_event_receiver_ctx));
/* Create mutex */
if ( ipcom_mutex_create(&libctx->mutex) != IPCOM_SUCCESS )
goto errout;
/* Create mutex */
if ( ipcom_sem_create(&libctx->sem, 0) != IPCOM_SUCCESS )
{
ipcom_mutex_delete(&libctx->mutex);
goto errout;
}
ipike_event_receiver_callback_set(libctx, event_cb);
ipcom_proc_attr_init(&proc_attr);
proc_attr.flags |= IPCOM_PROC_FLAG_FP;
proc_attr.stacksize = IPCOM_PROC_STACK_DEFAULT;
/* Spawn a new task/thread for handling events */
err = ipcom_proc_acreate(IPIKE_EVENT_RECEIVER_PROC_NAME,
(Ipcom_proc_func) ipike_event_receiver_proc,
&proc_attr,
IP_NULL);
if ( err != IPCOM_SUCCESS )
{
ipcom_mutex_delete(&libctx->mutex);
ipcom_sem_delete(&libctx->sem);
goto errout;
}
return 0;
errout:
libctx = IP_NULL;
return -1;
}
/*
*===========================================================================
* ipike_event_receiver_destroy
*===========================================================================
*/
IP_PUBLIC void
ipike_event_receiver_destroy(void)
{
/* Make sure we are initialized */
if ( libctx == IP_NULL )
return;
/* Protect shared data */
ipcom_mutex_lock(libctx->mutex);
libctx->event_cb = IP_NULL;
if ( libctx->channel != IP_NULL )
{
/* This will wake up the receiver task/thread */
ipike_channel_close(libctx->channel);
}
ipcom_mutex_unlock(libctx->mutex);
/* Wait for the receiver thread to finish */
ipcom_sem_wait(libctx->sem);
/* Receiver thread has finished, do clean up */
ipcom_mutex_delete(&libctx->mutex);
ipcom_sem_delete(&libctx->sem);
ipcom_memset(libctx, 0, sizeof(Ipike_event_receiver_ctx));
libctx = IP_NULL;
}
#else
int ipike_channel_empty_file = 0;
#endif /* IPIKE_USE_EVENT_LOG */
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_event_server.h
+171
View File
@@ -0,0 +1,171 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_event_server.h,v $ $Revision: 1.2.2.2 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_event_server.h,v $
* $Author: ulf $ $Date: 2011-11-16 10:33:32 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Erik Dahlberg <erik.dahlberg@windriver.com>
******************************************************************************
*/
#ifndef IPIKE_EVENT_SERVER_H_
#define IPIKE_EVENT_SERVER_H_
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
#ifdef IPIKE_USE_EVENT_LOG
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_h.h"
#include "ipike_event.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_event_server_log
*===========================================================================
* Description: Creates an event message and sends it to all registered
* event receivers. This function is used to send event messages
* from the IKE daemon.
*
* Parameters: type - Event type
* reason - Event reason
* src_ip - Source IP Address
* dst_ip - Destination IP Address
* sa_proto - SA Protocol (AH or ESP)
spi - IPsec SA SPI
* Returns:
*/
IP_GLOBAL void
ipike_event_server_log(int type, int reason,
union Ip_sockaddr_union * src_ip,
union Ip_sockaddr_union * dst_ip,
int sa_proto,
Ip_u8 spi[4]);
/*
*===========================================================================
* ipike_event_server_relay
*===========================================================================
* Description: Relays the event message to all registered receivers.
*
* Parameters: emsg - Event message
* Returns:
*/
IP_GLOBAL void
ipike_event_server_relay(Ipike_event_msg *emsg);
/*
*===========================================================================
* ipike_event_server_shutdown
*===========================================================================
* Description: Shutdowns the event server and closes all channels to
* registered receivers.
* Parameters:
* Returns:
*/
IP_GLOBAL void
ipike_event_server_shutdown(void);
/*
*===========================================================================
* ipike_event_server_add_fds
*===========================================================================
* Description: Adds internal sockets held be the event server into the
* file descriptor set.
*
* Parameters: read_fds - Read file descriptor set.
* write_fds - Write file descriptor set.
* Returns: The largest file descriptor that was added, or
* -1 if no file descriptor was added.
*/
IP_GLOBAL Ipike_error
ipike_event_server_startup(void);
/*
*===========================================================================
* ipike_event_server_add_fds
*===========================================================================
* Description: Adds internal sockets held be the event server into the
* file descriptor set.
*
* Parameters: read_fds - Read file descriptor set.
* write_fds - Write file descriptor set.
* Returns: The largest file descriptor that was added, or
* -1 if no file descriptor was added.
*/
IP_GLOBAL int
ipike_event_server_add_fds(
Ip_fd_set * read_fds,
Ip_fd_set * write_fds);
/*
*===========================================================================
* ipike_channel_server_process
*===========================================================================
* Description: Process internal sockets inside the event server which has
* been added with ipike_event_server_add_fds.
*
* Parameters: read_fds - Read file descriptor set.
* write_fds - Write file descriptor set.
* Returns: The number of processed file descriptors, 0 if no file
* descriptors were processed.
*/
IP_GLOBAL int
ipike_event_server_process(
Ip_fd_set * read_fds,
Ip_fd_set * write_fds);
#ifdef __cplusplus
}
#endif
#endif /* IPIKE_USE_EVENT_LOG */
#endif /* IPIKE_EVENT_SERVER_H_ */
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_exchange_aggressive_mode.c
+1238
View File
File diff suppressed because it is too large Load Diff
components/ip_net2-6.9/ipike/src/ipike_exchange_aggressive_mode.h
+200
View File
@@ -0,0 +1,200 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_exchange_aggressive_mode.h,v $ $Revision: 1.3.16.1 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_exchange_aggressive_mode.h,v $
* $Author: ulf $ $Date: 2011-11-16 10:33:33 $
* $State: Exp $ $Locker: $
*
* Copyright Interpeak AB <www.interpeak.se>. All rights reserved.
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#ifndef IPIKE_AGGRESSIVE_MODE_H
#define IPIKE_AGGRESSIVE_MODE_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* IKE aggressive mode exchange */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_config.h"
#include "ipike.h"
#include "ipike_isakmp.h"
#include "ipike_payload.h"
#include "ipike_sadb.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_aggressive_mode_on_new_exchange_initiator
*===========================================================================
* Description: Creates a new IKE SA and creates a initiator cookie.
* Parameters: ie - the state of this exchange (this pointer).
* ike_sa - IKE SA (optional)
* conf_section - The name of the configuration section that
* contatins information about how to initialize this exchange.
* Returns: Ipike standard error code.
*/
IP_PUBLIC Ipike_error
ipike_aggressive_mode_on_new_exchange_initiator(
Ipike_isakmp_exchange* ie,
Ipike_sadb_entry* ike_sa,
const void* option1,
const void* flow_option);
/*
*===========================================================================
* ipike_aggressive_mode_on_new_exchange_responder
*===========================================================================
* Description: Creates a new IKE SA.
* Parameters: ie - the state of this exchange (this pointer).
* first_isakmp - the first message (and only) that was/will be sent
* in this exchange.
* local_addr - The local address the peer send messages to.
* peer_addr - The address of the peer IKE daemon.
* Returns: Ipike standard error code.
*/
IP_PUBLIC Ipike_error
ipike_aggressive_mode_on_new_exchange_responder(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header* first_isakmp,
union Ip_sockaddr_union* local_addr,
union Ip_sockaddr_union* peer_addr);
/*
*===========================================================================
* ipike_aggressive_mode_on_delete_exchange
*===========================================================================
* Description: Updates the base initialization vector if the exchange
* was compleated successfully.
* Parameters: ie - the state of this exchange (this pointer).
* Returns:
*/
IP_PUBLIC void
ipike_aggressive_mode_on_delete_exchange(Ipike_isakmp_exchange* ie);
/*
*===========================================================================
* ipike_aggressive_mode_get_payload_order
*===========================================================================
* Description: Returns a IPIKE_PAYLOAD_NONE terminated array of payload
* id:s that the aggressive mode exchange message must contain.
* Parameters: ie - the state of this exchange.
* Returns: An array containing the payload IDs in the low byte
* and flags in the high byte.
*/
IP_PUBLIC const Ip_u16*
ipike_aggressive_mode_get_payload_order(Ipike_isakmp_exchange* ie);
/*
*===========================================================================
* ipike_aggressive_mode_process_payloads
*===========================================================================
* Description: Updates the SA structure bound to this exchange.
* Parameters: ie - the state of this exchange.
* isakmp - the ISAKMP message.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
* IPIKE_SA_NO_ACCEPTED_TRANSFORM
* IPIKE_DOI_UNSUPPORTED
* IPIKE_SITUATION_UNSUPPORTED
*/
IP_PUBLIC Ipike_error
ipike_aggressive_mode_process_payloads(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header *isakmp);
/*
*===========================================================================
* ipike_aggressive_mode_add_reply_payloads
*===========================================================================
* Description: Adds all payloads that should part of the response.
* Parameters: ie - the state of this exchange (this pointer).
* reply_payloads - pointer to an array of payload pointers.
* The array will be allocated by this function.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
* IPIKE_ISAKMP_UNSUPPORTED_PAYLOAD
*
*/
IP_PUBLIC Ipike_error
ipike_aggressive_mode_add_reply_payloads(
Ipike_isakmp_exchange* ie,
Ipike_payload_header*** reply_payloads);
/*
*===========================================================================
* ipike_aggressive_mode_cleartext_outgoing_message
*===========================================================================
* Description: Does nothing (not needed in aggressive mode)
* Parameters: ie - the state of this exchange.
* outgoing_isakmp - the outgoing ISAKMP message.
* Returns: IPIKE_SUCCESS
*/
IP_PUBLIC Ipike_error
ipike_aggressive_mode_cleartext_outgoing_message(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header** outgoing_isakmp);
/*
*===========================================================================
* ipike_aggressive_mode_exchange_done
*===========================================================================
* Description: Stores the final IV.
* Parameters: ie - the paramtes for the finnished exchange.
* Returns: IPIKE_SUCCESS
* OUT_OF_MEMORY
*/
IP_PUBLIC Ipike_error
ipike_aggressive_mode_exchange_done(Ipike_isakmp_exchange* ie);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_exchange_informational.c
+590
View File
@@ -0,0 +1,590 @@
/*
******************************************************************************
* SOURCE FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_exchange_informational.c,v $ $Revision: 1.20.10.7 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_exchange_informational.c,v $
* $Author: svc-cmnet $ $Date: 2013-10-30 23:37:40 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_h.h"
#include "ipike_exchange_informational.h"
#include "ipike_crypto.h"
#include "ipike_payload_delete.h"
#include "ipike_payload_hash.h"
#include "ipike_payload_notification.h"
#include "ipike_util.h"
#include <openssl/hmac.h>
#include <openssl/rand.h>
#include <ipcom_clib.h>
#include <ipcom_syslog.h>
/*
****************************************************************************
* 4 EXTERN PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 5 DEFINES
****************************************************************************
*/
/*
* Checks if the DPD counter is in the window _base + IPIKE_DPD_WINDOW_SIZE
*/
#define IPIKE_IS_IN_DPD_WINDOW(_base, _counter) \
(((((_base) + IPIKE_DPD_WINDOW_SIZE) >= (_counter)) && \
((_base) < (_counter) )) || \
((((_base) + IPIKE_DPD_WINDOW_SIZE) < (_base)) && \
(((_counter) < (IPIKE_DPD_WINDOW_SIZE - (0xffffffffu-(_base)))) || \
((_base) < (_counter)))))
/*
****************************************************************************
* 6 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 7 LOCAL PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 8 DATA
****************************************************************************
*/
/*
****************************************************************************
* 9 LOCAL FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_informational_on_new_exchange
*===========================================================================
*/
IP_STATIC Ipike_error
ipike_informational_on_new_exchange(Ipike_isakmp_exchange* ie)
{
Ipike_error err;
Ipike_transform_ike *transform_ike;
/* IKE v1 */
ie->version = 1 << 4;
ipcom_microtime(&ie->start);
if (ie->ike_sa->state == IPIKE_SA_ACTIVE)
{
/* Messages must be protected */
ie->isakmp_flags = IPIKE_ISAKMP_ENCRYPTION;
transform_ike = ipike_transform_ike_from_exch(ie);
if (transform_ike==IP_NULL)
return IPIKE_FAILED;
if (IPIKE_SUCCESS != (err = ipike_crypto_compute_phase2_iv(
transform_ike->hash_algorithm,
&ie->ike_sa->base_iv, ip_htonl(ie->message_id), &ie->iv)))
return err;
}
return IPIKE_SUCCESS;
}
/*
****************************************************************************
* 10 PUBLIC FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_informational_on_new_exchange
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_informational_on_new_exchange_initiator(
Ipike_isakmp_exchange* ie,
Ipike_sadb_entry* ike_sa,
const void* payload,
const void* not_used)
{
IPCOM_UNUSED_ARG(not_used);
ie->ike_sa = ike_sa;
ipike_sadb_lock(ie->ike_sa);
ie->phase2.notify_or_delete = (Ipike_payload_header*) payload;
ie->is_phase1 = IP_FALSE;
ie->exchange_initiator = IP_TRUE;
return ipike_informational_on_new_exchange(ie);
}
/*
*===========================================================================
* ipike_informational_on_new_exchange
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_informational_on_new_exchange_responder(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header* first_isakmp,
union Ip_sockaddr_union* local_addr,
union Ip_sockaddr_union* peer_addr)
{
(void) local_addr;
(void) peer_addr;
if (ipike_sadb_get( first_isakmp->initiator_cookie,
first_isakmp->responder_cookie,
IPIKE_SA_ACTIVE | IPIKE_SA_CONSTRUCTING,
&ie->ike_sa) != IPIKE_SUCCESS)
{
IPCOM_LOG0(WARNING, "ipike_informational_on_new_exchange: IKE SA not found");
IPCOM_LOG1(WARNING, "initiator_cookie: %s",
ipike_cookie_to_string(first_isakmp->initiator_cookie));
IPCOM_LOG1(WARNING, "responder_cookie: %s",
ipike_cookie_to_string(first_isakmp->responder_cookie));
IPIKE_EVENT_LOG(IKE_PACKET_DISCARD, INVALID_SPI_ERROR,
peer_addr, local_addr, 0, IP_NULL);
return IPIKE_SA_NOT_FOUND;
}
return ipike_informational_on_new_exchange(ie);
}
/*
*===========================================================================
* ipike_informational_on_delete_exchange
*===========================================================================
*/
IP_PUBLIC void
ipike_informational_on_delete_exchange(Ipike_isakmp_exchange* ie)
{
if (ie->phase2.notify_or_delete)
IPIKE_FREEP(ie->phase2.notify_or_delete);
}
/*
*===========================================================================
* ipike_informational_get_payload_order
*===========================================================================
*/
IP_PUBLIC const Ip_u16 *
ipike_informational_get_payload_order(Ipike_isakmp_exchange *ie)
{
/* The hash payload must be included if a IKE SA
is established with the recipient.
The ISAKMP message must contain one notification payload
or one delete payload */
static Ip_u16 informational_exchange[] = {
IPIKE_PAYLOAD_OPT | IPIKE_PAYLOAD_HASH,
IPIKE_PAYLOAD_OPT | IPIKE_PAYLOAD_NOTIFICATION,
IPIKE_PAYLOAD_OPT | IPIKE_PAYLOAD_DELETE,
IPIKE_PAYLOAD_NONE,
};
(void) ie;
return informational_exchange;
}
/*
*===========================================================================
* ipike_informational_process_payloads
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_informational_process_payloads(Ipike_isakmp_exchange *ie, Ipike_isakmp_header *isakmp)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike_payload_header* payload;
Ip_u8 this_payload;
Ipike_payload_enum ctx;
/* Process payloads */
this_payload = isakmp->next_payload;
payload = ipike_first_payload(isakmp, &ctx);
while (payload != IP_NULL)
{
switch (this_payload)
{
case IPIKE_PAYLOAD_HASH:
if(!(err = ipike_hash_extract((Ipike_hash_payload*) payload, &ie->hash)))
err = ipike_crypto_verify_hash(ie, isakmp);
break;
case IPIKE_PAYLOAD_NOTIFICATION:
err = ipike_notification_process_message(ie, (Ipike_notification_payload*) payload);
break;
case IPIKE_PAYLOAD_DELETE:
err = ipike_payload_delete_process_message(ie->ike_sa, (Ipike_delete_payload*) payload);
break;
default:
IPCOM_LOG2(ERR,
"ipike_informational_process_payloads: '%s' (%d) is an unsupported payload type",
ipike_payload_type_to_string(this_payload), this_payload);
err = IPIKE_ISAKMP_UNSUPPORTED_PAYLOAD;
break;
}
if (err != IPIKE_SUCCESS)
break;
this_payload = payload->next_payload;
payload = ipike_next_payload(&ctx);
}
ipike_free_payload_enumerator(&ctx);
if (err != IPIKE_SUCCESS)
{
IPIKE_EVENT_LOG(IKE_PACKET_DISCARD, ISAKMP_PACKET_ERROR,
&ie->msg.peer_addr, &ie->msg.local_addr,
0, IP_NULL);
return err;
}
/* We do not need this exchange anymore */
return IPIKE_EXCH_FINNISHED;
}
/*
*===========================================================================
* ipike_informational_add_reply_payloads
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_informational_add_reply_payloads(
Ipike_isakmp_exchange* ie,
Ipike_payload_header*** reply_payload)
{
Ipike_error err;
Ipike_transform_ike* transform;
if (ie->ike_sa->state != IPIKE_SA_CONSTRUCTING)
{
/* We have a IKE SA, so the payloads should be encrypted and
a hash payload is needed.
The hash value will be calculated later, just add it so
enough memory will be allocated */
Ip_u8 hash_buffer[HMAC_MAX_MD_CBLOCK];
Ipike_value dummy_hash;
Ipike_hash_payload* hash_payload = IP_NULL;
transform = ipike_transform_ike_from_exch(ie);
if (transform==IP_NULL)
return IPIKE_FAILED;
dummy_hash.value = hash_buffer;
dummy_hash.len = ipike_attribute_get_digest_size(transform->hash_algorithm);
if (IPIKE_SUCCESS != (err = ipike_hash_create(&dummy_hash, &hash_payload)))
goto error;
if (IPIKE_SUCCESS != (err = ipike_array_add((void***) reply_payload, hash_payload)))
{
ipcom_free(hash_payload);
goto error;
}
}
if (IPIKE_SUCCESS != (err = ipike_array_add((void***) reply_payload, ie->phase2.notify_or_delete)))
goto error;
/* To avoid multiple releases of the memory for the delete/notify payload */
ie->phase2.notify_or_delete = IP_NULL;
error:
return err;
}
/*
*===========================================================================
* ipike_informational_cleartext_outgoing_message
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_informational_cleartext_outgoing_message(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header** outgoing_isakmp)
{
Ipike_error err;
Ipike_isakmp_header *reply = *outgoing_isakmp;
if (ie->ike_sa->state != IPIKE_SA_CONSTRUCTING)
{
Ipike_value hash = { IP_NULL, 0};
Ipike_payload_header* hash_payload;
if (reply->next_payload != IPIKE_PAYLOAD_HASH)
{
IPCOM_LOG1(ERR,
"ipike_informational_cleartext_outgoing_message: malformed quick mode message, "
"the first payload must be a hash payload (not %s)",
ipike_payload_type_to_string(reply->next_payload));
return IPIKE_ISAKMP_INVALID_PAYLOAD;
}
if (IPIKE_SUCCESS != (err = ipike_crypto_compute_hash_1(ie->ike_sa, reply, &hash)))
return err;
hash_payload = (Ipike_payload_header *) ((Ip_u8*) reply + sizeof(Ipike_isakmp_header));
ip_assert(ip_ntohs(hash_payload->length) == IPIKE_HASH_HEADER_LENGTH + hash.len);
ipcom_memcpy((Ip_u8*) hash_payload + IPIKE_HASH_HEADER_LENGTH, hash.value, hash.len);
ipcom_free(hash.value);
}
else
{
if (reply->next_payload != IPIKE_PAYLOAD_NOTIFICATION &&
reply->next_payload != IPIKE_PAYLOAD_DELETE)
{
IPCOM_LOG1(ERR,
"ipike_informational_cleartext_outgoing_message: malformed quick mode message, "
"the second payload must be a notification or delete payload (not %s)",
ipike_payload_type_to_string(reply->next_payload));
return IPIKE_ISAKMP_INVALID_PAYLOAD;
}
}
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_informational_exchange_done
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_informational_exchange_done(Ipike_isakmp_exchange* ie)
{
ipcom_microtime(&ie->stop);
IPCOM_LOG0(INFO, "informational exchange done");
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_informational_report_error
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_informational_report_error(
Ipike_sadb_entry* ike_sa,
Ipike_ipsec_sa_param* ipsec_sa,
Ipike_error error_code)
{
Ipike_error err;
Ip_u16 msg_type;
Ipike_value spi = { IP_NULL, 0 };
Ip_u8 isakmp_spi[IPIKE_ISAKMP_COOKIE_SIZE * 2];
Ip_u8 proto_id = IPIKE_PROTO_ISAKMP;
Ipike_notification_payload* notification;
if (IPIKE_SUCCESS != (err = ipike_notification_error_code_to_message_type(error_code, &msg_type)))
return err;
if (ike_sa->state == IPIKE_SA_CONSTRUCTING)
{
spi.value = isakmp_spi;
spi.len = sizeof(isakmp_spi);
ipcom_memcpy(isakmp_spi, ike_sa->initiator_cookie, IPIKE_ISAKMP_COOKIE_SIZE);
ipcom_memcpy(isakmp_spi + IPIKE_ISAKMP_COOKIE_SIZE, ike_sa->responder_cookie,
IPIKE_ISAKMP_COOKIE_SIZE);
}
else if (ipsec_sa)
{
/* we are in phase 2 (quick mode) IPSec DOI */
Ipike_sa* inbound;
/* Even if ESP+AH accepted only report first transform SPI in
error message. ignore the second ! */
inbound = &ipsec_sa->inbound_sa;
if (inbound->proposals && inbound->selected_proposal >= 0)
{
proto_id = inbound->proposals[inbound->selected_proposal]->proto_id;
spi = inbound->proposals[inbound->selected_proposal]->spi;
}
}
notification = ipike_notification_new(IPIKE_DOI_IPSEC,
proto_id,
msg_type,
spi.value,
(Ip_u8) spi.len,
IP_NULL,
0);
if (IP_NULL == notification)
{
IP_PANIC();
return IPIKE_OUT_OF_MEMORY;
}
return ipike_isakmp_initiate_informational_exchange(ike_sa, &notification->header);
}
/*
*===========================================================================
* ipike_informational_liveness
*===========================================================================
*/
IP_PUBLIC Ip_bool
ipike_informational_liveness(Ipike_sadb_entry* ike_sa, Ip_u32 counter)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike_notification_payload* notification = IP_NULL;
Ip_u16 type = 0;
Ip_u8 spi_data[IPIKE_ISAKMP_COOKIE_SIZE * 2];
if (ike_sa->liveness.enabled)
{
if (counter == 0)
{
if (ike_sa->liveness.local_counter == 0)
{
(void)RAND_bytes((Ip_u8*)&ike_sa->liveness.local_counter, sizeof(ike_sa->liveness.local_counter));
ike_sa->liveness.local_counter &= 0x00ffffff;
}
/* Increase seqeuence number for each DPD R-U-THERE message */
ike_sa->liveness.local_counter++;
type = IPIKE_NOTI_R_U_THERE;
counter = ike_sa->liveness.local_counter;
}
else
{
/* Counter always incremented with one */
if (ike_sa->liveness.peer_counter == 0 ||
IPIKE_IS_IN_DPD_WINDOW(ike_sa->liveness.peer_counter, counter))
{
type = IPIKE_NOTI_R_U_THERE_ACK;
ike_sa->liveness.peer_counter = counter;
}
else
{
IPCOM_LOG1(WARNING, "ipike_informational_liveness() :: Received"\
" DPD sequence number '%d' is not acceptable",
counter);
}
}
/* Initiate exchange if not rejected */
if (type != 0)
{
counter = ip_htonl(counter);
ipcom_memcpy(spi_data, ike_sa->initiator_cookie, IPIKE_ISAKMP_COOKIE_SIZE);
ipcom_memcpy(spi_data + IPIKE_ISAKMP_COOKIE_SIZE, ike_sa->responder_cookie, IPIKE_ISAKMP_COOKIE_SIZE);
notification = ipike_notification_new(IPIKE_DOI_IPSEC,
IPIKE_PROTO_ISAKMP,
type,
spi_data,
sizeof(spi_data),
(Ip_u8*)&counter,
sizeof(counter));
if (IP_NULL == notification)
{
IP_PANIC();
err = IPIKE_OUT_OF_MEMORY;
}
else
{
err = ipike_isakmp_initiate_informational_exchange(ike_sa,
&notification->header);
}
}
}
return (err == IPIKE_SUCCESS);
}
/*
*===========================================================================
* ipike_informational_report_sa_delete
*===========================================================================
*/
IP_PUBLIC void
ipike_informational_report_sa_delete(
Ipike_sadb_entry* ike_sa,
Ip_u8 proto_id,
Ipike_value* spi)
{
Ipike_delete_payload *del;
del = ipike_payload_delete_new(IPIKE_DOI_IPSEC, proto_id, (Ip_u8) spi->len, spi->value);
if (IP_NULL == del)
{
IP_PANIC();
return;
}
(void) ipike_isakmp_initiate_informational_exchange(ike_sa, &del->header);
}
/*
*===========================================================================
* ipike_informational_report_initial_contact
*===========================================================================
*/
IP_PUBLIC void
ipike_informational_report_initial_contact(Ipike_sadb_entry* ike_sa)
{
Ipike_notification_payload* notify;
Ip_u8 spi_data[IPIKE_ISAKMP_COOKIE_SIZE * 2];
ipcom_memcpy(spi_data, ike_sa->initiator_cookie, IPIKE_ISAKMP_COOKIE_SIZE);
ipcom_memcpy(spi_data + IPIKE_ISAKMP_COOKIE_SIZE, ike_sa->responder_cookie, IPIKE_ISAKMP_COOKIE_SIZE);
notify = ipike_notification_new(IPIKE_DOI_IPSEC,
IPIKE_PROTO_ISAKMP,
IPIKE_NOTI_INITIAL_CONTACT,
spi_data,
sizeof(spi_data),
IP_NULL,
0);
if (IP_NULL == notify)
{
IP_PANIC();
return;
}
(void) ipike_isakmp_initiate_informational_exchange(ike_sa, &notify->header);
}
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_exchange_informational.h
+262
View File
@@ -0,0 +1,262 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_exchange_informational.h,v $ $Revision: 1.5.16.1 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_exchange_informational.h,v $
* $Author: ulf $ $Date: 2011-11-16 10:33:33 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#ifndef IPIKE_INFORMATIONAL_H
#define IPIKE_INFORMATIONAL_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* IKE informational exchange */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_config.h"
#include "ipike.h"
#include "ipike_isakmp.h"
#include "ipike_payload.h"
#include "ipike_sadb.h"
#include "ipike_ipsec_sadb.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_informational_on_new_exchange_initiator
*===========================================================================
* Description:
* Parameters: ie - the state of this exchange (this pointer).
* ike_sa - The IKE SA to be used to protect the communication.
* payload - The payload that should be sent.
* Returns: Ipike standard error code.
*/
IP_PUBLIC Ipike_error
ipike_informational_on_new_exchange_initiator(
Ipike_isakmp_exchange* ie,
Ipike_sadb_entry* ike_sa,
const void* payload,
const void* not_used);
/*
*===========================================================================
* ipike_informational_on_new_exchange_responder
*===========================================================================
* Description: Gets the IKE SA that matches the cookies in the message.
* Parameters: ie - the state of this exchange (this pointer).
* first_isakmp - the first message (and only) that was/will be sent
* in this exchange.
* local_addr - The local address the peer communicates with.
* peer_addr - The address of the peer IKE daemon.
* Returns: Ipike standard error code.
*/
IP_PUBLIC Ipike_error
ipike_informational_on_new_exchange_responder(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header* first_isakmp,
union Ip_sockaddr_union* local_addr,
union Ip_sockaddr_union* peer_addr);
/*
*===========================================================================
* ipike_informational_on_delete_exchange
*===========================================================================
* Description: Does nothing.
* Parameters: ie - the state of this exchange (this pointer).
* Returns:
*/
IP_PUBLIC void
ipike_informational_on_delete_exchange(Ipike_isakmp_exchange* ie);
/*
*===========================================================================
* ipike_informational_get_payload_order
*===========================================================================
* Description: Returns a IPIKE_PAYLOAD_NONE terminated array of payload
* id:s that the main mode exchange message must contain.
* Parameters: ie - the state of this exchange.
* Returns: An array containing the payload IDs in the low byte and
* flags in the high byte.
*/
IP_PUBLIC const Ip_u16*
ipike_informational_get_payload_order(Ipike_isakmp_exchange* ie);
/*
*===========================================================================
* ipike_informational_process_payloads
*===========================================================================
* Description: Logs the content of the notify payload to the system log
* or remove the SA in the delete payload.
* Parameters: ie - the state of this exchange.
* isakmp - the ISAKMP message.
* Returns: IPIKE_SUCCESS
* IPIKE_SA_NOT_FOUND
*/
IP_PUBLIC Ipike_error
ipike_informational_process_payloads(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header* isakmp);
/*
*===========================================================================
* ipike_informational_add_reply_payloads
*===========================================================================
* Description: Adds all payloads that should part of the response.
* Parameters: ie - the state of this exchange (this pointer).
* reply_payloads - pointer to an array of payload pointers.
* The array will be allocated by this function.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
* IPIKE_ISAKMP_UNSUPPORTED_PAYLOAD
*
*/
IP_PUBLIC Ipike_error
ipike_informational_add_reply_payloads(
Ipike_isakmp_exchange* ie,
Ipike_payload_header*** reply_payloads);
/*
*===========================================================================
* ipike_informational_cleartext_outgoing_message
*===========================================================================
* Description: Adds the authentication hash if a IKE SA has been established
* with the recipient of the message.
* Parameters: ie - the state of this exchange.
* outgoing_isakmp - the outgoing ISAKMP message.
* Returns: IPIKE_SUCCESS
*/
IP_PUBLIC Ipike_error
ipike_informational_cleartext_outgoing_message(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header** outgoing_isakmp);
/*
*===========================================================================
* ipike_informational_exchange_done
*===========================================================================
* Description: Does nothing.
* Parameters: ie - the paramtes for the finnished exchange.
* Returns: IPIKE_SUCCESS
* OUT_OF_MEMORY
*/
IP_PUBLIC Ipike_error
ipike_informational_exchange_done(Ipike_isakmp_exchange* ie);
/*
*===========================================================================
* ipike_informational_report_error
*===========================================================================
* Description: Creates a new informational exchange from a standard ipike
* error code. The message is sent to the address in the IKE SA.
* Parameters: ike_sa - The IKE SA that should protect the traffic.
* ipsec_sa - The IPSec SA during quick mode and IPSec DOI.
* Can be IP_NULL.
* error_code - The error to report.
* Returns: IPIKE_SUCCESS
* OUT_OF_MEMORY
*/
IP_PUBLIC Ipike_error
ipike_informational_report_error(
Ipike_sadb_entry* ike_sa,
Ipike_ipsec_sa_param* ipsec_sa,
Ipike_error error_code);
/*
*===========================================================================
* ipike_informational_liveness
*===========================================================================
* Description: Initiate liveness information exchange, to validate that the
* peer is live and kicking.
* Parameters: ike_sa - The IKE SA that should protect the traffic.
* counter - The counter value from peer for acknowledge
* message. Set to 0 for hello message.
* Returns: TRUE if successfully executed or FALSE if failure.
*/
IP_PUBLIC Ip_bool
ipike_informational_liveness(
Ipike_sadb_entry* ike_sa,
Ip_u32 counter);
/*
*===========================================================================
* ipike_informational_report_sa_delete
*===========================================================================
* Description: Report to the IKE peer that this IKE daemon has deleted
* or detected deletion of a SA.
* Parameters: ike_sa - The IKE SA that should protect the traffic.
* proto_id - The protocol id of the SA.
* spi - The SPI of the deleted SA.
* Returns:
*/
IP_PUBLIC void
ipike_informational_report_sa_delete(
Ipike_sadb_entry* ike_sa,
Ip_u8 proto_id,
Ipike_value* spi);
/*
*===========================================================================
* ipike_informational_report_initial_contact
*===========================================================================
* Description: Report to the IKE peer that this is the first contact.
* Parameters: ike_sa - The IKE SA that should protect the traffic.
* proto_id - The protocol id of the SA.
* spi - The SPI of the deleted SA.
* Returns:
*/
IP_PUBLIC void
ipike_informational_report_initial_contact(Ipike_sadb_entry* ike_sa);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_exchange_main_mode.c
+1887
View File
File diff suppressed because it is too large Load Diff
components/ip_net2-6.9/ipike/src/ipike_exchange_main_mode.h
+244
View File
@@ -0,0 +1,244 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_exchange_main_mode.h,v $ $Revision: 1.5.14.2 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_exchange_main_mode.h,v $
* $Author: edahlber $ $Date: 2011-12-06 16:36:12 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#ifndef IPIKE_MAIN_MODE_H
#define IPIKE_MAIN_MODE_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* IKE main mode (phase 1) exchange */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_config.h"
#include "ipike.h"
#include "ipike_isakmp.h"
#include "ipike_payload.h"
#include "ipike_sadb.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_main_mode_update_responder_config
*===========================================================================
* Description: Tries to find a IKE SA config based on more properties than
* the addresses that was used the first time. If a more
* suitable configuration is found, the exchange state and
* associated ike_sa will be updated to use the new
* configuration.
* Parameters: ie - holds all the states associated with the exchange.
*
*/
IP_PUBLIC void
ipike_main_mode_update_responder_config(Ipike_isakmp_exchange *ie);
/*
*===========================================================================
* ipike_main_mode_authentication_check
*===========================================================================
* Description: Does a authentication check of the data.
* Parameters: ie - holds all the states associated with the exchange.
* Returns: IPIKE_SUCCESS
* IPIKE_INVALID_VALUE
*
*/
IP_GLOBAL Ipike_error
ipike_main_mode_authentication_check(Ipike_isakmp_exchange* ie);
/*
*===========================================================================
* ipike_main_mode_on_new_exchange_initiator
*===========================================================================
* Description: Creates a new IKE SA and creates a initiator cookie.
* Parameters: ie - the state of this exchange (this pointer).
* conf_section - The name of the configuration section that
* contatins information about how to initialize this exchange.
* Returns: Ipike standard error code.
*/
IP_PUBLIC Ipike_error
ipike_main_mode_on_new_exchange_initiator(
Ipike_isakmp_exchange* ie,
Ipike_sadb_entry* ike_sa,
const void* not_used1,
const void* not_used2);
/*
*===========================================================================
* ipike_main_mode_on_new_exchange_responder
*===========================================================================
* Description: Creates a new IKE SA.
* Parameters: ie - the state of this exchange (this pointer).
* first_isakmp - the first message (and only) that was/will be sent
* in this exchange.
* local_addr - The local address the peer send messages to.
* peer_addr - The address of the peer IKE daemon.
* Returns: Ipike standard error code.
*/
IP_PUBLIC Ipike_error
ipike_main_mode_on_new_exchange_responder(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header* first_isakmp,
union Ip_sockaddr_union* local_addr,
union Ip_sockaddr_union* peer_addr);
/*
*===========================================================================
* ipike_main_mode_on_delete_exchange
*===========================================================================
* Description: Updates the base initialization vector if the exchange
* was compleated successfully.
* Parameters: ie - the state of this exchange (this pointer).
* Returns:
*/
IP_PUBLIC void
ipike_main_mode_on_delete_exchange(Ipike_isakmp_exchange* ie);
/*
*===========================================================================
* ipike_main_mode_get_payload_order
*===========================================================================
* Description: Returns a IPIKE_PAYLOAD_NONE terminated array of payload
* id:s that the main mode exchange message must contain.
* Parameters: ie - the state of this exchange.
* Returns: An array containing the payload IDs in the low byte
* and flags in the high byte.
*/
IP_PUBLIC const Ip_u16*
ipike_main_mode_get_payload_order(Ipike_isakmp_exchange* ie);
/*
*===========================================================================
* ipike_main_mode_process_payloads
*===========================================================================
* Description: Updates the SA structure bound to this exchange.
* Parameters: ie - the state of this exchange.
* isakmp - the ISAKMP message.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
* IPIKE_SA_NO_ACCEPTED_TRANSFORM
* IPIKE_DOI_UNSUPPORTED
* IPIKE_SITUATION_UNSUPPORTED
*/
IP_PUBLIC Ipike_error
ipike_main_mode_process_payloads(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header *isakmp);
/*
*===========================================================================
* ipike_main_mode_add_reply_payloads
*===========================================================================
* Description: Adds all payloads that should part of the response.
* Parameters: ie - the state of this exchange (this pointer).
* reply_payloads - pointer to an array of payload pointers.
* The array will be allocated by this function.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
* IPIKE_ISAKMP_UNSUPPORTED_PAYLOAD
*
*/
IP_PUBLIC Ipike_error
ipike_main_mode_add_reply_payloads(
Ipike_isakmp_exchange* ie,
Ipike_payload_header*** reply_payloads);
/*
*===========================================================================
* ipike_main_mode_cleartext_outgoing_message
*===========================================================================
* Description: Does nothing (not needed in main mode)
* Parameters: ie - the state of this exchange.
* outgoing_isakmp - the outgoing ISAKMP message.
* Returns: IPIKE_SUCCESS
*/
IP_PUBLIC Ipike_error
ipike_main_mode_cleartext_outgoing_message(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header** outgoing_isakmp);
/*
*===========================================================================
* ipike_main_mode_exchange_done
*===========================================================================
* Description: Stores the final IV.
* Parameters: ie - the paramtes for the finnished exchange.
* Returns: IPIKE_SUCCESS
* OUT_OF_MEMORY
*/
IP_PUBLIC Ipike_error
ipike_main_mode_exchange_done(Ipike_isakmp_exchange* ie);
/*
*===========================================================================
* ipike_main_mode_exchange_done
*===========================================================================
* Description: Adds Certificate Request Payloads, one for each trusted CA.
* Parameters: conf - IKE SA configuration.
* reply_payloads - pointer to an array of payload pointers
* Returns: IPIKE_SUCCESS
* OUT_OF_MEMORY
*/
IP_PUBLIC Ipike_error
ipike_main_mode_add_cert_request(
Ipike_config_ike_sa* conf,
Ipike_payload_header*** reply_payloads);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_exchange_quick_mode.c
+1847
View File
File diff suppressed because it is too large Load Diff
components/ip_net2-6.9/ipike/src/ipike_exchange_quick_mode.h
+217
View File
@@ -0,0 +1,217 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_exchange_quick_mode.h,v $ $Revision: 1.3.16.1 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_exchange_quick_mode.h,v $
* $Author: ulf $ $Date: 2011-11-16 10:33:33 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#ifndef IPIKE_QUICK_MODE_H
#define IPIKE_QUICK_MODE_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* IKE quick mode (phase 2) exchange */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_config.h"
#include "ipike.h"
#include "ipike_isakmp.h"
#include "ipike_payload.h"
#include "ipike_sadb.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_quick_mode_on_new_exchange_initiator
*===========================================================================
* Description: Gets the correct IKE SA and creates a new phase 2 SA.
* Parameters: ie - the state of this exchange (this pointer).
* conf_section_data - The name of the configuration section that
* ike_sa - IKE SA
* not_used1 - Exchange specific option1
* not_used2 - Exchange specific option2
* Returns: Ipike standard error code.
*/
IP_PUBLIC Ipike_error
ipike_quick_mode_on_new_exchange_initiator(
Ipike_isakmp_exchange* ie,
Ipike_sadb_entry* ike_sa,
const void* not_used1,
const void* not_used2);
/*
*===========================================================================
* ipike_quick_mode_on_new_exchange_responder
*===========================================================================
* Description: Gets the correct IKE SA and creates a new phase 2 SA.
* Parameters: ie - the state of this exchange (this pointer).
* first_isakmp - the first message that was/will be sent
* in this exchange.
* local_addr - The local address the peer send messages to.
* peer_addr - The address of the peer IKE daemon.
* Returns: Ipike standard error code.
*/
IP_PUBLIC Ipike_error
ipike_quick_mode_on_new_exchange_responder(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header* first_isakmp,
union Ip_sockaddr_union* local_addr,
union Ip_sockaddr_union* peer_addr);
/*
*===========================================================================
* ipike_quick_mode_on_delete_exchange
*===========================================================================
* Description: Does nothing, but needed by the framework.
* Parameters: ie - the state of this exchange (this pointer).
* Returns:
*/
IP_PUBLIC void
ipike_quick_mode_on_delete_exchange(Ipike_isakmp_exchange* ie);
/*
*===========================================================================
* ipike_quick_mode_get_payload_order
*===========================================================================
* Description: Returns a IPIKE_PAYLOAD_NONE terminated array of payload
* id:s that the quick mode exchange message must contain.
* Parameters: ie - the state of this exchange.
* Returns: An array containing the payload IDs in the low byte and
* flags in the high byte.
*/
IP_PUBLIC const Ip_u16 *
ipike_quick_mode_get_payload_order(Ipike_isakmp_exchange* ie);
/*
*===========================================================================
* ipike_quick_mode_check_payload_order
*===========================================================================
* Description: Checks that the ISAKMP payloads in correctly ordered and
* that the payloads is allowed in the current stage of the
* current exchange.
* Parameters: isakmp - the ISAKMP message.
* ie - the state of this exchange.
* Returns: IPIKE_SUCCESS
* IPIKE_PHASE2_WRONG_PAYLOAD_ORDER,
* IPIKE_PHASE2_WRONG_PAYLOAD_TYPE,
*/
IP_PUBLIC Ipike_error
ipike_quick_mode_check_payload_order(
Ipike_isakmp_header* isakmp,
Ipike_isakmp_exchange* ie);
/*
*===========================================================================
* ipike_quick_mode_process_payloads
*===========================================================================
* Description: Updates the IPSec SA structure bound to this exchange.
* Parameters: ie - the state of this exchange.
* isakmp - the ISAKMP message.
* Returns: IPIKE_SUCCESS
*/
IP_PUBLIC Ipike_error
ipike_quick_mode_process_payloads(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header* isakmp);
/*
*===========================================================================
* ipike_quick_mode_add_reply_payloads
*===========================================================================
* Description: Adds all payloads that should part of the response.
* Parameters: ie - the state of this exchange (this pointer).
* reply_payloads - pointer to an array of payload pointers.
* The array will be allocated by this function.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
* IPIKE_ISAKMP_UNSUPPORTED_PAYLOAD
*
*/
IP_PUBLIC Ipike_error
ipike_quick_mode_add_reply_payloads(
Ipike_isakmp_exchange* ie,
Ipike_payload_header*** reply_payloads);
/*
*===========================================================================
* ipike_quick_mode_cleartext_outgoing_message
*===========================================================================
* Description: Calculates the hash value that is sent as the first payload
* in each quick mode message.
* Parameters: ie - the state of this exchange.
* outgoing_isakmp - the outgoing ISAKMP message.
* Returns: IPIKE_SUCCESS
* OUT_OF_MEMORY
*/
IP_PUBLIC Ipike_error
ipike_quick_mode_cleartext_outgoing_message(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header** outgoing_isakmp);
/*
*===========================================================================
* ipike_quick_mode_exchange_done
*===========================================================================
* Description: Writes the negotiated security paramtes to the appropriate
* source (to the security kernel via PF_KEY sockets).
* Parameters: ie - the paramtes for the finnished exchange.
* Returns: IPIKE_SUCCESS
* OUT_OF_MEMORY
*/
IP_PUBLIC Ipike_error
ipike_quick_mode_exchange_done(Ipike_isakmp_exchange* ie);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_exchange_transaction_mode.c
+465
View File
@@ -0,0 +1,465 @@
/*
******************************************************************************
* SOURCE FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_exchange_transaction_mode.c,v $ $Revision: 1.10.10.7 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_exchange_transaction_mode.c,v $
* $Author: zan $ $Date: 2015-04-29 03:42:02 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_h.h"
#include "ipike_exchange_transaction_mode.h"
#include "ipike_crypto.h"
#include "ipike_payload_delete.h"
#include "ipike_payload_hash.h"
#include "ipike2_payload_configuration.h"
#include "ipike_util.h"
#include "ipike_dynamic_ip.h"
#include <openssl/hmac.h>
#include <openssl/rand.h>
/*
****************************************************************************
* 4 EXTERN PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 5 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 6 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 7 LOCAL PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 8 DATA
****************************************************************************
*/
/*
****************************************************************************
* 9 LOCAL FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_transaction_mode_on_new_exchange
*===========================================================================
*/
IP_STATIC Ipike_error
ipike_transaction_mode_on_new_exchange(Ipike_isakmp_exchange* ie)
{
Ipike_error err;
Ipike_transform_ike* transform;
ie->version = 1 << 4;
ie->is_phase1 = IP_FALSE;
ie->isakmp_flags = IPIKE_ISAKMP_ENCRYPTION;
if ((transform = ipike_transform_ike_from_exch(ie)) == IP_NULL)
{
IPCOM_LOG0(CRIT, "ipike_transaction_mode_on_new_exchange: Bad exchange, probably configuration error");
return IPIKE_FAILED;
}
if (IPIKE_SUCCESS != (err = ipike_crypto_compute_phase2_iv(
transform->hash_algorithm, &ie->ike_sa->base_iv,
ip_htonl(ie->message_id), &ie->iv)))
return err;
return IPIKE_SUCCESS;
}
/*
****************************************************************************
* 10 PUBLIC FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_transaction_mode_on_new_exchange_initiator
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_transaction_mode_on_new_exchange_initiator(
Ipike_isakmp_exchange* ie,
Ipike_sadb_entry* ike_sa,
const void* not_used1,
const void* not_used2)
{
Ipike_error err;
/* Ignore */
IPCOM_UNUSED_ARG(not_used1);
IPCOM_UNUSED_ARG(not_used2);
ip_assert(ie->message_id != 0);
ip_assert(ike_sa);
ip_assert(IP_NULL == ie->ike_sa);
ipcom_microtime(&ie->start);
ie->exchange_initiator = IP_TRUE;
ie->ike_sa = ike_sa;
ipike_sadb_lock(ie->ike_sa);
err = ipike_payload_configuration_request_address(&ie->ike_sa->cp_request,
ie->ipsec_conf->dynamic_address,
ie->ike_sa->dhcp.has_info ?
&ie->ike_sa->dhcp.address :
IP_NULL);
if (IPIKE_SUCCESS != err)
{
IPCOM_LOG0(DEBUG, "ipike_transaction_mode_on_new_exchange_initiator() ::"\
" can't request address");
return err;
}
if (IPIKE_SUCCESS != (err = ipike_transaction_mode_on_new_exchange(ie)))
{
IPCOM_LOG0(DEBUG, "ipike_transaction_mode_on_new_exchange_initiator() ::"\
" generic on new failed");
return err;
}
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_transaction_mode_on_new_exchange_responder
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_transaction_mode_on_new_exchange_responder(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header* first_isakmp,
union Ip_sockaddr_union* local_addr,
union Ip_sockaddr_union* peer_addr)
{
Ipike_error err;
/* Ignore */
(void) local_addr;
(void) peer_addr;
ipcom_microtime(&ie->start);
if (IPIKE_SUCCESS != ipike_sadb_get(
first_isakmp->initiator_cookie,
first_isakmp->responder_cookie,
IPIKE_SA_ACTIVE,
&ie->ike_sa))
{
IPCOM_LOG0(WARNING, "ipike_transaction_mode_on_new_exchange: IKE SA not found");
IPCOM_LOG1(WARNING, "initiator_cookie: %s",
ipike_cookie_to_string(first_isakmp->initiator_cookie));
IPCOM_LOG1(WARNING, "responder_cookie: %s",
ipike_cookie_to_string(first_isakmp->responder_cookie));
return IPIKE_SA_NOT_FOUND;
}
if (IPIKE_SUCCESS != (err = ipike_transaction_mode_on_new_exchange(ie)))
{
IPCOM_LOG0(DEBUG, "ipike_transaction_mode_on_new_exchange_responder: generic on new failed");
return err;
}
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_transaction_mode_on_delete_exchange
*===========================================================================
*/
IP_PUBLIC void
ipike_transaction_mode_on_delete_exchange(Ipike_isakmp_exchange* ie)
{
(void)ie;
return;
}
/*
*===========================================================================
* ipike_transaction_mode_get_payload_order
*===========================================================================
*/
IP_PUBLIC const Ip_u16 *
ipike_transaction_mode_get_payload_order(Ipike_isakmp_exchange* ie)
{
static Ip_u16 transaction_mode_exchange[] = {
IPIKE_PAYLOAD_HASH,
IPIKE_PAYLOAD_ATTRIBUTES,
IPIKE_PAYLOAD_NONE,
};
(void) ie;
return transaction_mode_exchange;
}
/*
*===========================================================================
* ipike_transaction_mode_process_payloads
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_transaction_mode_process_payloads(Ipike_isakmp_exchange *ie, Ipike_isakmp_header *isakmp)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike_payload_header* payload;
Ip_u8 this_payload;
Ipike_payload_enum ctx;
/* Process payloads */
this_payload = isakmp->next_payload;
payload = ipike_first_payload(isakmp, &ctx);
while (payload != IP_NULL)
{
switch (this_payload)
{
case IPIKE_PAYLOAD_HASH:
if(!(err = ipike_hash_extract((Ipike_hash_payload*)payload, &ie->hash)))
err = ipike_crypto_verify_hash(ie, isakmp);
break;
case IPIKE_PAYLOAD_ATTRIBUTES:
err = ipike_payload_configuration_process(ie, (Ipike2_cp_payload*)payload);
break;
default:
IPCOM_LOG2(ERR,
"ipike_transaction_mode_process_payloads: '%s' (%d) is an unsupported payload type",
ipike_payload_type_to_string(this_payload), this_payload);
err = IPIKE_ISAKMP_UNSUPPORTED_PAYLOAD;
}
if (err != IPIKE_SUCCESS)
break;
this_payload = payload->next_payload;
payload = ipike_next_payload(&ctx);
}
ipike_free_payload_enumerator(&ctx);
if (err != IPIKE_SUCCESS)
{
IPIKE_EVENT_LOG(IKE_PHASE_II_FAIL, IKE_INTERNAL_ERROR,
&ie->ike_sa->peer_addr, &ie->ike_sa->local_addr,
0, IP_NULL);
return err;
}
/* Must have got ip adress */
if (!ie->ike_sa->dhcp.has_info)
{
IPCOM_LOG0(ERR, "No address received from responder");
return IPIKE_MISSING_PAYLOAD;
}
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_transaction_mode_add_reply_payloads
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_transaction_mode_add_reply_payloads(
Ipike_isakmp_exchange* ie,
Ipike_payload_header*** reply_payloads)
{
Ipike_error err = IPIKE_SUCCESS;
const Ip_u16* payload_ids;
int i;
Ip_u8 hash_buffer[HMAC_MAX_MD_CBLOCK];
Ipike_value dummy_hash;
Ipike_transform_ike *transform_ike;
dummy_hash.len = 0;
dummy_hash.value = hash_buffer;
payload_ids = ipike_transaction_mode_get_payload_order(ie);
for (i = 0; payload_ids[i] != IPIKE_PAYLOAD_NONE; i++)
{
Ipike_payload_header *reply_payload = IP_NULL;
Ip_u8 payload_type = (Ip_u8) IPIKE_PAYLOAD_TYPE(payload_ids[i]);
if (IP_BIT_ISSET(payload_ids[i], IPIKE_PAYLOAD_OPT) &&
IP_BIT_ISSET(payload_ids[i], IPIKE_PAYLOAD_ADD) == IP_FALSE)
/* Only add the optional payload that had the IPIKE_PAYLOAD_ADD bit set */
continue;
switch (payload_type)
{
case IPIKE_PAYLOAD_HASH:
/* The hash value will be calculated later, just add it so
enough memory will be allocated */
transform_ike = ipike_transform_ike_from_exch(ie);
if (transform_ike==IP_NULL)
{
err=IPIKE_FAILED;
break;
}
dummy_hash.len = ipike_attribute_get_digest_size(
transform_ike->hash_algorithm);
err = ipike_hash_create(&dummy_hash, (Ipike_hash_payload**) &reply_payload);
break;
case IPIKE_PAYLOAD_ATTRIBUTES:
if (IPIKE_SUCCESS == err)
{
err = ipike_payload_configuration_create(&ie->ike_sa->cp_response,
(Ipike2_cp_payload**)&reply_payload);
if ((IPIKE_SUCCESS == err) && (IP_NULL != reply_payload))
{
reply_payload->next_payload = payload_type;
err = ipike_array_add((void***) reply_payloads, reply_payload);
if (IPIKE_SUCCESS != err)
ipcom_free(reply_payload);
reply_payload = IP_NULL;
}
}
if (IPIKE_SUCCESS == err)
{
err = ipike_payload_configuration_create(&ie->ike_sa->cp_request,
(Ipike2_cp_payload**)&reply_payload);
if ((IPIKE_SUCCESS == err) && (IP_NULL != reply_payload))
{
reply_payload->next_payload = payload_type;
err = ipike_array_add((void***) reply_payloads, reply_payload);
if (IPIKE_SUCCESS != err)
ipcom_free(reply_payload);
reply_payload = IP_NULL;
}
}
break;
default:
IPCOM_LOG1(ERR,
"ipike_phase2_ipsec_add_reply_payloads: payload creation failed since %d is "
"a unknown payload type",
payload_type);
err = IPIKE_ISAKMP_UNSUPPORTED_PAYLOAD;
goto error;
}
if (err != IPIKE_SUCCESS)
goto error;
if (reply_payload != IP_NULL)
if (IPIKE_SUCCESS != (err = ipike_array_add((void***) reply_payloads, reply_payload)))
goto error;
}
return IPIKE_SUCCESS;
error:
ipike_array_free((void**) *reply_payloads, ipcom_free); /*lint !e123 */
*reply_payloads = IP_NULL;
return err;
}
/*
*===========================================================================
* ipike_transaction_mode_cleartext_outgoing_message
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_transaction_mode_cleartext_outgoing_message(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header** outgoing_isakmp)
{
Ipike_error err;
Ipike_isakmp_header* reply = *outgoing_isakmp;
Ipike_value hash = { IP_NULL, 0};
Ipike_payload_header* hash_payload;
if (reply->next_payload != IPIKE_PAYLOAD_HASH)
{
IPCOM_LOG1(ERR,
"ipike_transaction_mode_cleartext_outgoing_message: malformed message, "
"the first payload must be a hash payload (not %s)",
ipike_payload_type_to_string(reply->next_payload));
return IPIKE_ISAKMP_INVALID_PAYLOAD;
}
if (IPIKE_SUCCESS != (err = ipike_crypto_compute_hash_1(ie->ike_sa, reply, &hash)))
return err;
hash_payload = (Ipike_payload_header *) ((Ip_u8*) reply + sizeof(Ipike_isakmp_header));
ip_assert(ip_ntohs(hash_payload->length) == IPIKE_HASH_HEADER_LENGTH + hash.len);
ipcom_memcpy((Ip_u8*) hash_payload + IPIKE_HASH_HEADER_LENGTH, hash.value, hash.len);
ipcom_free(hash.value);
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_transaction_mode_exchange_done
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_transaction_mode_exchange_done(Ipike_isakmp_exchange* ie)
{
(void) ie;
IPCOM_LOG0(INFO, "Transaction mode exchange done");
ipcom_microtime(&ie->stop);
/* We have got the address, lets initiate the ipsec exchanges */
if (ie->ike_sa->is_initiator)
if (ie->ipsec_conf && ipike_has_valid_address_reference(ie->ipsec_conf->ipsec_id))
(void)ipike_isakmp_initiate_ipsec_exchange(ie->ipsec_conf->ike_sa,
ie->ipsec_conf,
IP_NULL,
ie->ike_sa,
IP_NULL,
IP_NULL);
return IPIKE_SUCCESS;
}
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_exchange_transaction_mode.h
+199
View File
@@ -0,0 +1,199 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_exchange_transaction_mode.h,v $ $Revision: 1.3.16.1 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_exchange_transaction_mode.h,v $
* $Author: ulf $ $Date: 2011-11-16 10:33:33 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#ifndef IPIKE_TRANSACTION_MODE_H
#define IPIKE_TRANSACTION_MODE_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* IKE transaction mode exchange (to get dynamic ip address)
* for more information see draft-ietf-ipsec-isakmp-mode-cfg-05.txt */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_config.h"
#include "ipike.h"
#include "ipike_isakmp.h"
#include "ipike_payload.h"
#include "ipike_ipsec_sadb.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_transaction_mode_on_new_exchange_initiator
*===========================================================================
* Description:
* Parameters: ie - the state of this exchange (this pointer).
* ike_sa - The IKE SA to be used to protect the communication.
* option1 - Exchange specific option1
* option2 - Exchange specific option2
*
* Returns: Ipike standard error code.
*/
IP_PUBLIC Ipike_error
ipike_transaction_mode_on_new_exchange_initiator(
Ipike_isakmp_exchange* ie,
struct Ipike_sadb_entry_struct* ike_sa,
const void* option1,
const void* option2);
/*
*===========================================================================
* ipike_transaction_mode_on_new_exchange_responder
*===========================================================================
* Description: Gets the IKE SA that matches the cookies in the message.
* Parameters: ie - the state of this exchange (this pointer).
* first_isakmp - the first message (and only) that was/will be sent
* in this exchange.
* local_addr - The local address the peer communicates with.
* peer_addr - The address of the peer IKE daemon.
* Returns: Ipike standard error code.
*/
IP_PUBLIC Ipike_error
ipike_transaction_mode_on_new_exchange_responder(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header* first_isakmp,
union Ip_sockaddr_union* local_addr,
union Ip_sockaddr_union* peer_addr);
/*
*===========================================================================
* ipike_transaction_mode_on_delete_exchange
*===========================================================================
* Description: Does nothing.
* Parameters: ie - the state of this exchange (this pointer).
* Returns:
*/
IP_PUBLIC void
ipike_transaction_mode_on_delete_exchange(Ipike_isakmp_exchange* ie);
/*
*===========================================================================
* ipike_transaction_mode_get_payload_order
*===========================================================================
* Description: Returns a IPIKE_PAYLOAD_NONE terminated array of payload
* id:s that the main mode exchange message must contain.
* Parameters: ie - the state of this exchange.
* Returns: An array containing the payload IDs in the low byte and
* flags in the high byte.
*/
IP_PUBLIC const Ip_u16*
ipike_transaction_mode_get_payload_order(Ipike_isakmp_exchange* ie);
/*
*===========================================================================
* ipike_transaction_mode_process_payloads
*===========================================================================
* Description: Logs the content of the notify payload to the system log
* or remove the SA in the delete payload.
* Parameters: ie - the state of this exchange.
* isakmp - the ISAKMP message.
* Returns: IPIKE_SUCCESS
* IPIKE_SA_NOT_FOUND
*/
IP_PUBLIC Ipike_error
ipike_transaction_mode_process_payloads(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header* isakmp);
/*
*===========================================================================
* ipike_transaction_mode_add_reply_payloads
*===========================================================================
* Description: Adds all payloads that should part of the response.
* Parameters: ie - the state of this exchange (this pointer).
* reply_payloads - pointer to an array of payload pointers.
* The array will be allocated by this function.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
* IPIKE_ISAKMP_UNSUPPORTED_PAYLOAD
*
*/
IP_PUBLIC Ipike_error
ipike_transaction_mode_add_reply_payloads(
Ipike_isakmp_exchange* ie,
Ipike_payload_header*** reply_payloads);
/*
*===========================================================================
* ipike_transaction_mode_cleartext_outgoing_message
*===========================================================================
* Description: Adds the authentication hash if a IKE SA has been established
* with the recipient of the message.
* Parameters: ie - the state of this exchange.
* outgoing_isakmp - the outgoing ISAKMP message.
* Returns: IPIKE_SUCCESS
*/
IP_PUBLIC Ipike_error
ipike_transaction_mode_cleartext_outgoing_message(
Ipike_isakmp_exchange* ie,
Ipike_isakmp_header** outgoing_isakmp);
/*
*===========================================================================
* ipike_transaction_mode_exchange_done
*===========================================================================
* Description: Does nothing.
* Parameters: ie - the paramtes for the finnished exchange.
* Returns: IPIKE_SUCCESS
* OUT_OF_MEMORY
*/
IP_PUBLIC Ipike_error
ipike_transaction_mode_exchange_done(Ipike_isakmp_exchange* ie);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_h.h
+559
View File
@@ -0,0 +1,559 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_h.h,v $ $Revision: 1.47.10.5 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_h.h,v $
* $Author: svc-cmnet $ $Date: 2013-03-13 07:45:26 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#ifndef IPIKE_H_H
#define IPIKE_H_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#if defined(IPCRYPTO) && !defined(IPCOM_USE_CLIB_PROTO)
#define IPCOM_USE_CLIB_PROTO
#endif
#include <ipcom.h>
#include <ipcom_os.h>
#include <ipcom_hash.h>
#include <ipcom_list.h>
#include <ipcom_tmo2.h>
#include <ipcom_time.h>
#include "ipike_util.h"
#include "ipike_configuration.h"
#include "ipike_pfkeyv2.h"
#ifdef IPIKE_USE_EVENT_LOG
#include "ipike_event_server.h"
/* Set event logging function before including ipike_event_log.h */
#define IPIKE_EVENT_LOG_FUNC ipike_event_server_log
#endif
#include "ipike_event_log.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
/* Support IKE version 1 protocol. Disable of IKE v1 not fullt implemented
* yet, so this define MUST be set */
#define IPIKE_USE_VERSION1 1
/* The name this service is using in the IPD machinery */
#define IPIKE_IPD_NAME "ipike"
/* The name of the IKE daemon process */
#define IPIKE_PROC_NAME "ipiked"
/* The name of the IKE control command */
#define IPIKE_CMD_NAME "ike"
#define IPIKE_FREEP(p) do { ipcom_free((void *)p); p = IP_NULL; } while (0)
#ifdef IPIKE_USE_PKTINFO
#define IPIKE_PKT_CLEN 128
#else
#define IPIKE_PKT_CLEN 0
#endif
/* Mobility update related error messages */
#define IPIKE_MOBIKE_UPDATE_INITIATED 0
#define IPIKE_MOBIKE_INVALID_ADDRESS 1
#define IPIKE_MOBIKE_SIMILAR_ADDRESS 2
#define IPIKE_MOBIKE_LISTEN_NEW_FAILED 3
#define IPIKE_MOBIKE_UPDATE_FAILED 4
/* IKE MIP comm protocol msg types */
#define IPIKE_MOBIKE_UPDATE_LOCAL 0
#define IPIKE_MOBIKE_UPDATE_REMOTE 1 /* Not used currently */
#define IPIKE_MOBIKE_DYNAMIC_ADDRESS 2
/*
*===========================================================================
* syslog
*===========================================================================
*/
#define IPCOM_SYSLOG_PRIORITY IPIKE_SYSLOG_PRIORITY
#define IPCOM_SYSLOG_FACILITY IPCOM_LOG_IPIKE
#ifdef IPCOM_USE_INET6
#define IPIKE_ADDRSTRLEN IP_INET6_ADDRSTRLEN
#else
#define IPIKE_ADDRSTRLEN IP_INET_ADDRSTRLEN
#endif
/*
*===========================================================================
* code lock
*===========================================================================
*/
#define IPIKE_CODE_LOCK_INIT() if (ipike.code_lock_initialized == 0) \
if (ipcom_mutex_create(&ipike.code_mutex) == 0) \
ipike.code_lock_initialized = 1;
#define IPIKE_CODE_LOCK_INITIALIZED() (ipike.code_lock_initialized == 1)
#define IPIKE_CODE_LOCK_DESTROY() \
if (IPIKE_CODE_LOCK_INITIALIZED()) \
do { \
ipike.code_lock_initialized = 0; \
ipcom_mutex_delete(&ipike.code_mutex); \
} while(0)
#if defined (IP_ASSERT) && !defined(IP_PORT_LKM) && !defined(IP_PORT_VXWORKS)
#define IPIKE_CODE_ISLOCKED() if (IPIKE_CODE_LOCK_INITIALIZED()) \
ip_assert(ipike.code_mutex_count == 1)
#define IPIKE_CODE_LOCK() if (!IPIKE_CODE_LOCK_INITIALIZED()) \
IPIKE_CODE_LOCK_INIT(); \
if (IPIKE_CODE_LOCK_INITIALIZED()) { \
do { \
ipcom_mutex_lock(ipike.code_mutex); \
ipike.code_lock_owner = ipcom_getpid(); \
ip_assert(ipike.code_mutex_count == 0); \
ipike.code_mutex_count++; \
} while((0)); \
}
#define IPIKE_CODE_UNLOCK() if IPIKE_CODE_LOCK_INITIALIZED() { \
do { \
ip_assert(ipike.code_lock_owner == ipcom_getpid()); \
ip_assert(ipike.code_mutex_count == 1); \
ipike.code_mutex_count--; \
ipike.code_lock_owner = 0; \
ipcom_mutex_unlock(ipike.code_mutex); \
} while((0)); \
}
#else
#define IPIKE_CODE_ISLOCKED() IP_NOOP
#define IPIKE_CODE_LOCK() if (!IPIKE_CODE_LOCK_INITIALIZED()) \
IPIKE_CODE_LOCK_INIT(); \
if (IPIKE_CODE_LOCK_INITIALIZED()) \
ipcom_mutex_lock(ipike.code_mutex)
#define IPIKE_CODE_UNLOCK() if IPIKE_CODE_LOCK_INITIALIZED() \
ipcom_mutex_unlock(ipike.code_mutex)
#endif
#define IPIKE_IKE_SA_REACHED_LIMIT() \
((ipike.max_ike_sa_num != 0 && ipike.ike_sa_num >= ipike.max_ike_sa_num))
#define IPIKE_IPSEC_SA_REACHED_LIMIT() \
((ipike.max_ipsec_sa_num != 0 && ipike.ipsec_sa_num >= ipike.max_ipsec_sa_num))
#define IPIKE_FLOW_TYPE_ACQUIRE 12
#define IPIKE_FLOW_TYPE_REQUIRE 13
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
*===========================================================================
* Ipike_socket
*===========================================================================
*/
typedef struct Ipike_socket_struct
{
Ipcom_list list;
union Ip_sockaddr_union addr;
Ip_fd fd;
} Ipike_socket;
/*
*===========================================================================
* Ipike_flowtype_flow
*===========================================================================
*/
typedef struct Ipike_flowtype_flow
{
Ipcom_list list;
Ipike_config_flow flow;
Ip_u8 flowtype;
} Ipike_flowtype_flow;
/*
*===========================================================================
* Ipike_dispatcher
*===========================================================================
*/
typedef struct Ipike_dispatcher_struct
{
Ip_bool initialized;
Ipcom_atomic_t reconfigure;
Ipcom_list sockets; /* List of listening IKE (UDP) sockets */
Ipcom_list flowtype_flows; /* List of 'require' or 'acquire' flows */
/* The UDP socket to listen for Radius messages on. */
#ifdef IPIKE_USE_RADIUS
Ip_fd* sock_radius;
Ip_u32 sock_radius_count;
Ip_u32 sock_radius_count_max;
#endif
/* Socket waiting for IKE SA dump requests */
Ip_fd shell_cmd_sock;
/* Ticks, used to determine when houskeeping should be performed */
int ticks;
/* Buffer where data can (temporarily) be stored */
Ip_size_t recv_buf_len;
void * recv_buf;
}
Ipike_dispatcher;
/*
*===========================================================================
* Ipike_isakmp
*===========================================================================
*/
typedef struct Ipike_isakmp_struct
{
Ip_bool initialized;
/* Hash tables with on-going ISAKMP exchanges */
Ipcom_hash* exchange_hash_table_cookie;
Ipcom_hash* exchange_hash_table_spi;
Ipcom_hash* exchange_hash_table_id;
}
Ipike_isakmp;
/*
*===========================================================================
* Ipike_sadb
*===========================================================================
*/
typedef struct Ipike_sadb_struct
{
Ip_bool initialized;
/* Hash tables with IKE SA:s in constructing and active state */
Ipcom_hash *cookie_hash_table;
/* Hash tables with the most recent IKE SA:s in active state for a peer */
Ipcom_hash *peer_addr_hash_table;
/* Hash tables with the most recent IKE SA:s in active state for a peer */
Ipcom_hash *peer_id_hash_table;
/* Hash table with IKE SA:s in constructing state */
Ipcom_hash *constructing_peer_addr_hash_table;
}
Ipike_sadb;
/*
*===========================================================================
* Ipike_ipsec_sadb
*===========================================================================
*/
typedef struct Ipike_ipsec_sadb_struct
{
Ip_bool initialized;
/* Hash tables with all CHILD SA:s */
Ipcom_hash *child_hash_table;
/* Hash tables with active IPSec SA:s created from a specific configuration section */
Ipcom_hash *section_hash_table;
}
Ipike_ipsec_sadb;
/*
*===========================================================================
* Ipike_pfkeyv2
*===========================================================================
*/
typedef struct Ipike_pfkeyv2_struct
{
Ip_bool initialized;
/* The UDP socket to listen for PF_KEY messages on */
Ip_fd sock;
/* The callback to use when a IPSec SA expires */
Ipike_sa_expire_cb sa_expire_cb;
/* The callback to use when IPSec need a new SA */
Ipike_sa_acquire_cb sa_acquire_cb;
/* The callback to use when IPSec SA is deleted */
Ipike_sa_remove_cb sa_remove_cb;
/* The callback to use when all IPSec SA is flushed */
Ipike_sa_flush_cb sa_flush_cb;
}
Ipike_pfkeyv2;
/*
*===========================================================================
* Ipike_radius
*===========================================================================
*/
typedef struct Ipike_radius_struct
{
Ip_bool initialized;
/* Hash tables with ongoing radius communication */
Ipcom_hash* hash_table;
/* Hash table with unique id's */
Ipcom_hash* unique_id_table;
}
Ipike_radius;
/*
*===========================================================================
* Ipike_data
*===========================================================================
*/
typedef struct Ipike_data_struct
{
Ipcom_atomic_t initialized;
Ip_u8 version_min; /* Minimum supported major version */
Ip_u8 version_max; /* Maximum supported major version */
/* Timout list (second timeout and liveness timeout) */
Ipcom_pqueue* tmo_head;
Ipcom_tmo2 housekeep_tmo;
Ip_u16 port;
Ip_u16 port_nat;
Ip_u16 keepalive_nat;
Ip_u16 liveness_timer_resolution;
Ip_u16 rekey_fuzz;
Ip_u16 http_request_timeout;
/* The IKE daemon process pid */
Ip_pid_t pid;
/* The IPD control socket */
Ip_fd ipd;
/* Set require_cookie to TRUE if responder require a cookie notify to
* verify a real request. */
Ip_bool require_cookie;
/* Allow certificates to be fetched via HTTP */
Ip_bool use_hash_and_url;
/* Initiate rekey for IPSec SA key for passive connections. */
Ip_bool rekey_passive;
/* Read/Write data */
Ipike_config_ike config;
Ipike_dispatcher disp;
Ipike_isakmp isakmp;
Ipike_sadb sadb;
Ipike_ipsec_sadb ipsec_sadb;
Ipike_pfkeyv2 pfkeyv2;
Ipike_radius radius;
/* Number of active IPSec SAs */
Ip_u32 active_inbound_ipsec_sa;
/* Number of active ISAKMP exchanges */
Ip_u32 active_exchanges;
/* The maximum number of concurrent IKE SAs */
Ip_u32 max_ike_sa_num;
/* The number of IKE SAs */
Ip_u32 ike_sa_num;
/* The maximum number of concurrent IPsec SAs */
Ip_u32 max_ipsec_sa_num;
/* The number of IPsec SAs */
Ip_u32 ipsec_sa_num;
/* The maximum size of an IKE message */
Ip_u32 max_ike_message_size;
/* This variable is used for performance testing */
Ip_bool running_performance_test;
/* This variable is used to allow duplicate IKE SAs to be created */
Ip_bool allow_duplicate_ike_sa;
/* This variable is used to temporary paus initiating of new IPSec SA */
Ip_bool paus_init_ipsec_sa;
/* This variable is used to create a traffic selector matching any responder address */
Ip_bool dynamic_ip_anyflow;
/* This variable is used to add the dynamic address as a home address */
Ip_bool dynamic_ip_homeaddr;
/* Enables strict lifetime policy, IKEv1 only */
Ip_bool strict_lifetime_policy;
/* Statistic variables */
struct Ip_timeval start;
/* Schedule shutdown */
Ip_bool schedule_shutdown;
/* Mutex to protect IPIKE global data. */
Ip_bool code_lock_initialized;
Ipcom_mutex code_mutex;
#if defined (IP_ASSERT) && !defined(IP_PORT_LKM) && !defined(IP_PORT_VXWORKS)
int code_mutex_count;
Ip_pid_t code_lock_owner;
#endif
#ifdef IPIKE_USE_EVENT_LOG
Ipike_channel_server *event_server;
#endif
/* Callbacks */
/*
*===========================================================================
* key_password_cb
*===========================================================================
* Description: Returns the password for the private key.
* Parameters: buf - The buffer to which the password should be copied
* size - The maximum size of the password buffer.
* rwflag -
* filename - The filename of the private key file.
* Returns: The length of the password.
*
*/
int (*key_password_cb)(char *buf, int size, int rwflag, void *filename);
/* Read only data */
const Ipike_string_int_map *authentication_method_map;
const Ipike_string_int_map *v2_authentication_method_map;
const Ipike_string_int_map *encryption_algorithm_map;
const Ipike_string_int_map *v2_encryption_algorithm_map;
const Ipike_string_int_map *encryption_algorithm_map2;
const Ipike_string_int_map *v2_encryption_algorithm_map2;
const Ipike_string_int_map *hash_algorithm_map;
const Ipike_string_int_map *dh_group_map;
const Ipike_string_int_map *life_type_map;
const Ipike_string_int_map *encapsulation_mode_map;
const Ipike_string_int_map *authentication_algorithm_map;
const Ipike_string_int_map *doi_map;
const Ipike_string_int_map *exchange_map;
const Ipike_string_int_map *payload_map;
const Ipike_string_int_map *notify_map;
const Ipike_string_int_map *cp_type_map;
const Ipike_string_int_map *cp_attr_map;
const Ipike_string_int_map *id_type_map;
const Ipike_string_int_map *id_proto_map;
const Ipike_string_int_map *proposal_proto_map;
const Ipike_string_int_map *transform_type_map;
const Ipike_string_int_map *transform_encr_id_map;
const Ipike_string_int_map *transform_prf_id_map;
const Ipike_string_int_map *transform_integ_id_map;
const Ipike_string_int_map *transform_dh_id_map;
const Ipike_string_int_map *isakmp_trans_id_map;
const Ipike_string_int_map *ipsec_ah_trans_id_map;
const Ipike_string_int_map *ipsec_esp_trans_id_map;
const Ipike_string_int_map *ipsec_esp_key_length_map;
const Ipike_string_int_map *ipsec_ipcomp_trans_id_map;
const Ipike_string_int_map *cert_encode_type_map;
const Ipike_string_int_map *x509_verify_err_map;
const Ipike_string_int_map *eap_code_map;
const Ipike_string_int_map *rohc_map;
char addr_buf[64];
}
Ipike_data;
#ifdef IPIKE_USE_PERF_EVAL
#define IPIKE_PHASE1 0
#define IPIKE_PHASE2 1
typedef struct Ipike_exchange_stats_struct
{
struct Ip_timeval ok_time;
struct Ip_timeval nok_time;
unsigned int ok_count;
unsigned int nok_count;
}Ipike_exchange_stats;
typedef struct Ipike_perf_struct
{
/* 5 IKEv1 exchange types supported */
Ipike_exchange_stats v1_stat[5];
/* 3 IKEv2 exchange types supported */
Ipike_exchange_stats v2_stat[3];
/* Rekey stats */
/* As of now only phase 2 rekey is valid */
Ipike_exchange_stats v1_rekey[2];
Ipike_exchange_stats v2_rekey[2];
}Ipike_perf;
/* YYAGII: Yck! Yet another global in IKE! */
IP_EXTERN Ipike_perf ipike_perf;
#endif /* #ifdef IPIKE_USE_PERF_EVAL */
IP_EXTERN Ipike_data ipike;
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
IP_GLOBAL Ipike_error
ipike_process_ipd_msg(Ip_fd ipd_sock);
IP_GLOBAL int
ipike_cmd(int argc, char** argv);
IP_GLOBAL const char *
ipike_version_number(void);
IP_PUBLIC const char *
ipike_version(void);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_http_fetcher.c
+847
View File
@@ -0,0 +1,847 @@
/*
******************************************************************************
* SOURCE FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_http_fetcher.c,v $ $Revision: 1.4.10.1 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_http_fetcher.c,v $
* $Author: ulf $ $Date: 2011-11-16 10:33:33 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Erik Dahlberg <erik.dahlberg@windriver.com>
******************************************************************************
*/
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Provides functionality to fetch files (certificates) remotely using HTTP */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#define IPCOM_USE_CLIB_PROTO
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_h.h"
#include <ipcom_type.h>
#include <ipcom_cstyle.h>
#include <ipcom_strlib.h>
#include <ipcom_clib.h>
#include <ipcom_sock2.h>
#include <ipcom_os.h>
#include <ipcom_syslog.h>
#include <ipcom_tmo2.h>
#include "ipike_http_fetcher.h"
/*
****************************************************************************
* 4 EXTERN PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 5 DEFINES
****************************************************************************
*/
#define IPIKE_HTTP_REQUEST_FMT_STRING "GET %s HTTP/1.1\r\nhost: %s\r\n\r\n"
#define IPIKE_HTTP_REQUEST_BUF_SIZE 256
#define IPIKE_HTTP_RESPONSE_BUF_SIZE_DEFAULT 4096
#define IPIKE_HTTP_RESPONSE_STATUS_OK "HTTP/1.1 200"
#define IPIKE_HTTP_RESPONSE_STATUS_OK_LEN 12
#define IPIKE_HTTP_PORT 80
#define IPIKE_HTTP_PREFIX "http://"
#define IPIKE_HTTP_PREFIX_LEN 7
/* HTTP socket state */
#define IPIKE_HTTP_SOCK_STATE_CREATED (1 << 0)
#define IPIKE_HTTP_SOCK_STATE_CONNECTED (1 << 1)
/*
****************************************************************************
* 6 TYPES
****************************************************************************
*/
/* URL */
typedef struct Ipike_http_fetcher_url_st
{
char *address;
char *path;
} Ipike_http_fetcher_url;
/* HTTP fetcher context */
typedef struct Ipike_http_fetcher_ctx_st
{
Ipcom_list list; /* Context list */
Ipcom_tmo2 tmo; /* Timeout entry */
Ipike_http_fetcher_callback callback; /* User callback */
void *callback_ctx; /* User callback context */
Ip_fd fd; /* Socket filedescriptor */
Ipike_http_fetcher_url *url; /* URL */
Ip_u32 state; /* Socket state */
} Ipike_http_fetcher_ctx;
/*
****************************************************************************
* 7 LOCAL PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 8 DATA
****************************************************************************
*/
IP_STATIC Ipcom_list ctx_list_head =
{
.next = &ctx_list_head,
.prev = &ctx_list_head,
.head = &ctx_list_head,
.size = 0
};
/*
****************************************************************************
* 9 LOCAL FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* Ipike_http_fetcher_url_alloc
*===========================================================================
*/
IP_STATIC Ipike_http_fetcher_url *
ipike_http_fetcher_url_alloc()
{
Ipike_http_fetcher_url *url;
url = ipcom_malloc(sizeof(Ipike_http_fetcher_url));
if ( url )
ipcom_memset(url, 0, sizeof(Ipike_http_fetcher_url));
return url;
}
/*
*===========================================================================
* Ipike_http_fetcher_url_destroy
*===========================================================================
*/
IP_STATIC void
ipike_http_fetcher_url_destroy(Ipike_http_fetcher_url *url)
{
ip_assert(url);
if ( url->address )
ipcom_free(url->address);
if ( url->path )
ipcom_free(url->path);
ipcom_free(url);
}
/*
*===========================================================================
* Ipike_http_fetcher_ctx_alloc
*===========================================================================
*/
IP_STATIC Ipike_http_fetcher_ctx *
ipike_http_fetcher_ctx_alloc()
{
Ipike_http_fetcher_ctx *ctx;
ctx = ipcom_malloc(sizeof(Ipike_http_fetcher_ctx));
if ( ctx )
{
ipcom_memset(ctx, 0, sizeof(Ipike_http_fetcher_ctx));
ctx->fd = IP_INVALID_SOCKET;
}
return ctx;
}
/*
*===========================================================================
* ipike_http_fetcher_ctx_destroy
*===========================================================================
*/
IP_STATIC void
ipike_http_fetcher_ctx_destroy(Ipike_http_fetcher_ctx *ctx)
{
ip_assert(ctx);
ipike_tmo2_cancel(&ctx->tmo);
if ( ctx->fd != IP_INVALID_SOCKET )
ipcom_socketclose(ctx->fd);
if ( ctx->url )
ipike_http_fetcher_url_destroy(ctx->url);
ipcom_free(ctx);
}
/*
*===========================================================================
* ipike_http_fetcher_tmo_cb
*===========================================================================
*/
IP_STATIC Ip_bool
ipike_http_fetcher_tmo_cb(Ipike_http_fetcher_ctx *ctx)
{
if ( ctx->state == IPIKE_HTTP_SOCK_STATE_CREATED )
{
IPCOM_LOG1(WARNING, "ipike_http_fetcher_tmo_cb() :: could not connect"\
" to %s",
ctx->url->address);
}
else
{
IPCOM_LOG1(WARNING, "ipike_http_fetcher_tmo_cb() :: server %s did not"\
" respond",
ctx->url->address);
}
/* Notify failure to user callback */
ctx->callback(IPIKE_FAILED, IP_NULL, 0, ctx->callback_ctx);
ipcom_list_remove(&ctx->list);
ipike_http_fetcher_ctx_destroy(ctx);
return IP_FALSE;
}
/*
*===========================================================================
* ipike_http_fetcher_url_parse_string
*===========================================================================
*/
IP_STATIC Ipike_http_fetcher_url *
ipike_http_fetcher_url_parse_string(const char *url_string)
{
Ipike_http_fetcher_url *url = IP_NULL;
const char *addr_ptr = IP_NULL;
const char *path_ptr = IP_NULL;
Ip_size_t addr_len = 0;
if ( ipcom_strncmp(url_string, IPIKE_HTTP_PREFIX, IPIKE_HTTP_PREFIX_LEN) != 0 )
goto error_out;
url = ipike_http_fetcher_url_alloc();
if ( !url )
goto error_out;
/* Make a local copy of the string without the url prefix */
addr_ptr = url_string + IPIKE_HTTP_PREFIX_LEN;
/* Get the start of the path */
path_ptr = ipcom_strchr(addr_ptr, '/');
/* Make sure we have ha '/' and something after it */
if ( !path_ptr || *path_ptr == '\0' )
goto error_out;
url->path = ipcom_strdup( path_ptr );
/* Get length of the address */
addr_len = (Ip_size_t) (path_ptr - addr_ptr);
url->address = ipcom_malloc( addr_len + 1 );
if ( !url->address )
goto error_out;
ipcom_strncpy( url->address, addr_ptr, addr_len );
url->address[addr_len] = '\0';
return url;
error_out:
if ( url )
ipike_http_fetcher_url_destroy( url );
return IP_NULL;
}
/*
*===========================================================================
* Ipike_http_fetcher_get_content
*===========================================================================
*/
IP_STATIC const char *
ipike_http_fetcher_get_content(
const char *http_response,
Ip_size_t http_response_len,
Ip_size_t *content_len)
{
const char *needle = "\r\n\r\n";
const char *ptr;
const char *end_ptr;
const char *needle_ptr;
end_ptr = http_response + http_response_len;
needle_ptr = needle;
/* Search for the "needle*" */
for (ptr = http_response; ptr < end_ptr; ptr++)
{
if ( *ptr == *needle_ptr )
needle_ptr++;
else
needle_ptr = needle;
if ( *needle_ptr == '\0' )
{
/* Match */
ptr++;
*content_len = (Ip_size_t) (end_ptr - ptr);
if ( *content_len == 0 )
return IP_NULL;
return ptr;
}
}
*content_len = 0;
return IP_NULL;
}
/*
*===========================================================================
* ipike_http_fetcher_process_response
*===========================================================================
*/
IP_STATIC void
ipike_http_fetcher_process_response( Ipike_http_fetcher_ctx *ctx )
{
char *resp_buf = IP_NULL;
const char *content = IP_NULL;
Ip_ssize_t recv_len = 0;
Ip_size_t content_len = 0;
Ip_size_t resp_buf_size = 0;
Ipike_error status = IPIKE_FAILED;;
ip_assert(ctx);
/* Remove the context from the list */
ipcom_list_remove(&ctx->list);
resp_buf_size = (Ip_size_t) ipcom_sysvar_get_as_int("ipike.http_response_buf_size",
IPIKE_HTTP_RESPONSE_BUF_SIZE_DEFAULT);
/* Allocate response buffer */
resp_buf = ipcom_malloc(resp_buf_size);
if ( !resp_buf )
{
IPCOM_LOG1(CRIT, "ipike_http_fetcher_process_response() :: "\
"failed to allocate response buffer (%lu)",
resp_buf_size);
goto done;
}
/* Receive data */
recv_len = ipcom_recv(ctx->fd, resp_buf, resp_buf_size, 0);
if ( recv_len < 0 )
{
IPCOM_LOG1(ERR, "ipike_http_fetcher_process_response :: receive error \"%s\"",
ipcom_strerror(ipcom_errno));
goto done;
}
/* Were we able to read all data */
if ( (Ip_size_t) recv_len == resp_buf_size )
{
IPCOM_LOG1(ERR, "ipike_http_fetcher_process_response() :: "\
"response buffer to small (%lu)\n",
resp_buf_size);
goto done;
}
/* The received data must at least contain a HTTP OK code */
if ( recv_len <= IPIKE_HTTP_RESPONSE_STATUS_OK_LEN )
{
IPCOM_LOG1(WARNING, "ipike_http_fetcher_process_response() :: "\
"not enough data in http response (%ld)",
recv_len);
goto done;
}
IPCOM_LOG1(DEBUG2, "ipike_http_fetcher_process_response() :: "\
"received %ld bytes of http data",
recv_len);
/* Check for HTTP OK */
if ( ipcom_strncmp( resp_buf, IPIKE_HTTP_RESPONSE_STATUS_OK,
IPIKE_HTTP_RESPONSE_STATUS_OK_LEN) != 0 )
{
IPCOM_LOG0(WARNING, "ipike_http_fetcher_process_response() :: "\
"no ok code in http response");
goto done;
}
/* Ignore the rest of the HTTP Header and just get the content */
content = ipike_http_fetcher_get_content( resp_buf,
(Ip_size_t) recv_len,
&content_len);
if ( !content )
{
IPCOM_LOG0(WARNING, "ipike_http_fetcher_process_response() :: "\
"no http content in response data");
goto done;
}
/* All success */
status = IPIKE_SUCCESS;;
done:
/* Call user callback */
ctx->callback(status, content, content_len, ctx->callback_ctx);
/* Free response buffer */
if ( resp_buf )
ipcom_free(resp_buf);
/* Context can now be destroyed */
ipike_http_fetcher_ctx_destroy(ctx);
}
/*
*===========================================================================
* ipike_http_fetcher_send_request
*===========================================================================
*/
IP_STATIC void
ipike_http_fetcher_send_request(Ipike_http_fetcher_ctx *ctx)
{
char http_request[IPIKE_HTTP_REQUEST_BUF_SIZE];
Ip_ssize_t len = 0;
Ip_socklen_t err_len = 0;
Ip_err err = 0;
ip_assert(ctx);
/* Remove the context from the list */
ipcom_list_remove(&ctx->list);
/* Cancel the connect timeout */
ipike_tmo2_cancel(&ctx->tmo);
/* In the normal case the socket comes from a created state, i.e.
* through an asynchronous (non-blocking) connect */
if ( ctx->state == IPIKE_HTTP_SOCK_STATE_CREATED )
{
/* Get any error on the socket */
err_len = sizeof(err);
if ( ipcom_getsockopt(ctx->fd, IP_SOL_SOCKET, IP_SO_ERROR, &err, &err_len) < 0 )
{
IPCOM_LOG1(ERR, "ipike_http_fetcher_send_request() :: getsockopt failed (%s)",
ipcom_strerror(ipcom_errno));
goto error_out;
}
/* Check if the connect operation was successful */
if ( err != 0 )
{
IPCOM_LOG1(ERR, "ipike_http_fetcher_send_request() :: connect failed (%s)",
ipcom_strerror(err));
goto error_out;
}
/* Connect operation was successful */
ctx->state = IPIKE_HTTP_SOCK_STATE_CONNECTED;
}
/* We should now have a connected socket */
ip_assert( ctx->state == IPIKE_HTTP_SOCK_STATE_CONNECTED );
/* Create HTTP Request */
len = ipcom_snprintf(http_request, sizeof(http_request),
IPIKE_HTTP_REQUEST_FMT_STRING,
ctx->url->path, ctx->url->address);
if ( len < 0 )
{
IPCOM_LOG0(ERR, "ipike_http_fetcher_send_request() :: "\
"failed to create http request");
goto error_out;
}
IPCOM_LOG1(DEBUG2, "ipike_http_fetcher_send_request() :: "\
"sending http request \n%s",
http_request);
/* Send HTTP Request */
if ( ipcom_send(ctx->fd, http_request, (Ip_size_t) len, 0) != len )
{
IPCOM_LOG1(ERR, "ipike_http_fetcher_send_request() :: "\
"failed to send http request (%s)",
ipcom_strerror(ipcom_errno));
goto error_out;
}
/* Add a timeout handler for the send operation */
if (ipcom_tmo2_request(ipike.tmo_head,
&ctx->tmo,
(Ipcom_tmo2_func) ipike_http_fetcher_tmo_cb,
ctx,
ipike.http_request_timeout * 1000u) != IPCOM_SUCCESS)
{
IPCOM_LOG0(ERR, "ipike_http_fetcher_send_request() :: "\
"failed to register timeout");
goto error_out;
}
/* Insert into list */
ipcom_list_insert_last(&ctx_list_head, &ctx->list);
/* All success, lets wait for the response */
return;
error_out:
/* Notify failure to user */
ctx->callback(IPIKE_FAILED, IP_NULL, 0, ctx->callback_ctx);
/* Destroy context */
ipike_http_fetcher_ctx_destroy(ctx);
}
/*
****************************************************************************
* 10 PUBLIC FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_http_fetcher_add_fds
*===========================================================================
*/
IP_GLOBAL int
ipike_http_fetcher_add_fds(Ip_fd_set *read_fds, Ip_fd_set *write_fds)
{
Ipike_http_fetcher_ctx *ctx;
int max = -1;
for ( ctx = (Ipike_http_fetcher_ctx *) ipcom_list_first(&ctx_list_head);
ctx != IP_NULL;
ctx = (Ipike_http_fetcher_ctx *) ipcom_list_next(&ctx->list) )
{
switch (ctx->state)
{
case IPIKE_HTTP_SOCK_STATE_CREATED:
/* Waiting for connect to finish */
IP_FD_SET(ctx->fd, write_fds);
break;
case IPIKE_HTTP_SOCK_STATE_CONNECTED:
/* Waiting for HTTP response */
IP_FD_SET(ctx->fd, read_fds);
break;
default:
IPCOM_LOG1(ERR, "ipike_http_fetcher_add_fds() :: "\
"invalid socket state (%u)",
ctx->state);
break;
}
max = IP_MAX(ctx->fd, max);
}
return max;
}
/*
*===========================================================================
* ipike_http_fetcher_get
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_http_fetcher_get(
const char *url_string,
Ipike_http_fetcher_callback callback,
void *callback_ctx)
{
union Ip_sockaddr_union server_addr;
struct Ip_addrinfo *result = IP_NULL;;
Ipike_http_fetcher_ctx *ctx = IP_NULL;
int i = 0;
IPCOM_LOG1(DEBUG2, "ipike_http_fetcher_get() :: fetching \"%s\"", url_string);
/* Allocate context for this request */
ctx = ipike_http_fetcher_ctx_alloc();
if ( !ctx )
{
IP_PANIC();
IPCOM_LOG0(CRIT, "ipike_http_fetcher_get() :: failed to allocate memory");
goto error_out;
}
/* Set user callback */
ctx->callback = callback;
ctx->callback_ctx = callback_ctx;
/* Parse URL */
ctx->url = ipike_http_fetcher_url_parse_string(url_string);
if ( !ctx->url )
{
IPCOM_LOG1(ERR, "ipike_http_fetcher_get() :: invalid URL \"%s\"", url_string);
goto error_out;
}
memset(&server_addr, 0, sizeof(server_addr));
/* Do we have a DNS name */
if ( isalpha(*ctx->url->address) )
{
/* Resolve */
if ( ipcom_getaddrinfo(ctx->url->address, IP_NULL, IP_NULL, &result) != 0 )
{
IPCOM_LOG1(ERR, "ipike_http_fetcher() :: failed to resolve \"%s\"",
ctx->url->address);
goto error_out;
}
/* Use the first proposed address */
memcpy(&server_addr, result->ai_addr, result->ai_addrlen);
ipcom_freeaddrinfo(result);
}
else
{
#ifdef IPCOM_USE_INET
if ( ipcom_inet_pton(IP_AF_INET, ctx->url->address, &server_addr.sin.sin_addr) == 1 )
{
server_addr.sa.sa_family = IP_AF_INET;
server_addr.sin.sin_port = ip_htons(IPIKE_HTTP_PORT);
IPCOM_SA_LEN_SET(&server_addr.sa, sizeof(struct Ip_sockaddr_in));
}
#endif
#ifdef IPCOM_USE_INET6
if ( server_addr.sa.sa_family == 0 &&
ipcom_inet_pton(IP_AF_INET6, ctx->url->address, &server_addr.sin6.sin6_addr) == 1 )
{
server_addr.sa.sa_family = IP_AF_INET6;
IPCOM_SA_LEN_SET(&server_addr.sa, sizeof(struct Ip_sockaddr_in6));
}
#endif
}
if ( server_addr.sa.sa_family == 0 )
{
IPCOM_LOG1(ERR, "ipike_http_fetcher() :: bad address \"%s\"", ctx->url->address);
goto error_out;
}
#ifdef IPCOM_USE_INET
if ( server_addr.sa.sa_family == IP_AF_INET )
server_addr.sin.sin_port = ip_htons(IPIKE_HTTP_PORT);
#endif
#ifdef IPCOM_USE_INET6
if ( server_addr.sa.sa_family == IP_AF_INET6 )
server_addr.sin6.sin6_port = ip_htons(IPIKE_HTTP_PORT);
#endif
/* Create socket */
if ( (ctx->fd = ipcom_socket(server_addr.sa.sa_family, IP_SOCK_STREAM, IP_IPPROTO_TCP)) < 0 )
{
IPCOM_LOG1(ERR, "ipike_http_fetcher() :: failed to create socket (%s)",
ipcom_strerror(ipcom_errno));
goto error_out;
}
/* Set state to created */
ctx->state = IPIKE_HTTP_SOCK_STATE_CREATED;
i = 1;
/* Set socket to non-blocking */
if (ipcom_socketioctl(ctx->fd, IP_FIONBIO, (char *)&i) != 0)
{
IPCOM_LOG1(WARNING, "ipike_http_fetcher() :: failed to set socket to"\
" non blocking (%s)",
ipcom_strerror(ipcom_errno));
goto error_out;
}
/* Connect */
if ( ipcom_connect(ctx->fd, (struct Ip_sockaddr *) &server_addr,
IPCOM_SA_LEN_GET(&server_addr.sa)) < 0 )
{
/* We expect IP_ERRNO_EINPROGRESS in the normal case, fail otherwise */
if ( ipcom_errno != IP_ERRNO_EINPROGRESS )
{
IPCOM_LOG1(ERR, "ipike_http_fetcher() :: failed to connect socket (%s)",
ipcom_strerror(ipcom_errno));
goto error_out;
}
}
else
{
/* Socket successfully connected, can only occur if server address is a
* local address */
IPCOM_LOG0(DEBUG2, "ipike_http_fetcher() :: socket immediately connected");
ctx->state = IPIKE_HTTP_SOCK_STATE_CONNECTED;
}
i = 0;
/* Set socket to blocking */
if (ipcom_socketioctl(ctx->fd, IP_FIONBIO, (char *)&i) != 0)
{
IPCOM_LOG1(WARNING, "ipike_http_fetcher() :: failed to set socket to"\
" blocking (%s)",
ipcom_strerror(ipcom_errno));
goto error_out;
}
/* Add a timeout handler for connect operation */
if (ipcom_tmo2_request(ipike.tmo_head,
&ctx->tmo,
(Ipcom_tmo2_func) ipike_http_fetcher_tmo_cb,
ctx,
ipike.http_request_timeout * 1000u) != IPCOM_SUCCESS)
goto error_out;
/* Insert into list */
ipcom_list_insert_last(&ctx_list_head, &ctx->list);
/* It's unlikely but the socket can be in a connected state, in that case
* we can send the request immediately */
if ( ctx->state == IPIKE_HTTP_SOCK_STATE_CONNECTED )
ipike_http_fetcher_send_request(ctx);
/* return */
return IPIKE_SUCCESS;
error_out:
if ( ctx )
ipike_http_fetcher_ctx_destroy(ctx);
return IPIKE_FAILED;
}
/*
*===========================================================================
* ipike_http_fetcher_process
*===========================================================================
*/
IP_GLOBAL int
ipike_http_fetcher_process( Ip_fd_set *read_fds, Ip_fd_set *write_fds )
{
Ipike_http_fetcher_ctx *ctx = IP_NULL;
Ipike_http_fetcher_ctx *next = IP_NULL;
int num_processed = 0;
ctx = (Ipike_http_fetcher_ctx *) ipcom_list_first(&ctx_list_head);
while ( ctx )
{
next = (Ipike_http_fetcher_ctx *) ipcom_list_next(&ctx->list);
/* Socket ready for write? (connect done?)*/
if ( IP_FD_ISSET(ctx->fd, write_fds) )
{
/* Try to send the request */
ipike_http_fetcher_send_request(ctx);
num_processed++;
}
/* Socket ready for read? */
else if ( IP_FD_ISSET(ctx->fd, read_fds) )
{
/* Process response */
ipike_http_fetcher_process_response(ctx);
num_processed++;
}
ctx = next;
}
return num_processed;
}
/*
*===========================================================================
* ipike_http_fetcher_cleanup
*===========================================================================
*/
IP_GLOBAL void
ipike_http_fetcher_cleanup(void)
{
Ipike_http_fetcher_ctx *ctx;
/* Close any pending http requests */
for ( ctx = (Ipike_http_fetcher_ctx *) ipcom_list_first(&ctx_list_head);
ctx != IP_NULL;
ctx = (Ipike_http_fetcher_ctx *) ipcom_list_first(&ctx_list_head) )
{
/* Notify failures to user callback */
ctx->callback(IPIKE_FAILED, IP_NULL, 0, ctx->callback_ctx);
/* Remove from list */
ipcom_list_remove(&ctx->list);
/* Destroy context */
ipike_http_fetcher_ctx_destroy(ctx);
}
}
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_http_fetcher.h
+163
View File
@@ -0,0 +1,163 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_http_fetcher.h,v $ $Revision: 1.2 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_http_fetcher.h,v $
* $Author: edahlber $ $Date: 2010-12-20 05:34:01 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Erik Dahlberg <erik.dahlberg@windriver.com>
******************************************************************************
*/
#ifndef IPIKE_HTTP_FETCHER_H
#define IPIKE_HTTP_FETCHER_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Module for fetching data via HTTP (1.1) */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include <ipike.h>
#include <ipcom_type.h>
#include <ipcom_sock2.h>
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
*===========================================================================
* Ipike_http_fetcher_callback
*===========================================================================
* Description: User callback which is called when an HTTP response has been
* received.
*
* Parameters: status - IPIKE_SUCCESS or IPIKE_FAILED.
* data - HTTP content data.
* data_len - Length of HTTP content data.
* callback_ctx - User callback context.
*
* Returns:
*
*/
typedef void
(*Ipike_http_fetcher_callback) (Ipike_error status,
const char *data,
Ip_size_t data_len,
void *callback_ctx);
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_http_fetcher_get
*===========================================================================
* Description: Sends a HTTP GET request for the given URL, repsonse data
* is returned to the registered callback.
*
* Parameters: url - URL pointing out the resource
* callback - Response callback
* callback_ctx - Callback context
*
* Returns: IPIKE_SUCCESS
* IPIKE_FAILURE
*
*/
IP_GLOBAL Ipike_error
ipike_http_fetcher_get(
const char *url,
Ipike_http_fetcher_callback callback,
void *callback_ctx);
/*
*===========================================================================
* ipike_http_fetcher_add_fds
*===========================================================================
* Description: Adds any open internal file descriptors into the fd set.
* is returned to the registered callback.
*
* Parameters: read_fds - Read file descriptor set
*
* Returns: The largest file descriptor, or
* -1 if no file descriptor was added.
*
*/
IP_GLOBAL int
ipike_http_fetcher_add_fds(Ip_fd_set *read_fds, Ip_fd_set *write_fds);
/*
*===========================================================================
* ipike_http_fetcher_process
*===========================================================================
* Description: Checks if there is any repsonses to processes on any internal
* file descriptor.
*
* Parameters: read_fds - Read file descriptor set.
*
* Returns: The number of processed file descriptors.
*
*/
IP_GLOBAL int
ipike_http_fetcher_process(Ip_fd_set *fd_set, Ip_fd_set *write_fds);
/*
*===========================================================================
* ipike_http_fetcher_cleanup
*===========================================================================
* Description: Closes all open sockets and releases memory for all pending
* http requests. All pending request will be notfied of
* failure through the registered callback.
*
* Parameters: -
*
* Returns: -
*
*/
IP_GLOBAL void
ipike_http_fetcher_cleanup(void);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_ipc.h
+99
View File
@@ -0,0 +1,99 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_ipc.h,v $ $Revision: 1.9.16.1 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_ipc.h,v $
* $Author: edahlber $ $Date: 2012-03-13 12:45:53 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#ifndef IPIKE_IPC_H
#define IPIKE_IPC_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Structures used by ipcom_call IPC mechanism */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_config.h"
#include <ipcom.h>
#include "ipike_sadb.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/* IPD info structure about one IKE SA */
struct Ipike_ipd_sa_info
{
int seq;
Ip_u8 initiator_cookie[IPIKE_ISAKMP_COOKIE_SIZE];
Ip_u8 responder_cookie[IPIKE_ISAKMP_COOKIE_SIZE];
Ip_time_t created;
Ipike_sadb_state state;
int ref_count;
union Ip_sockaddr_union peer_addr;
union Ip_sockaddr_union local_addr;
Ip_bool is_initiator;
Ip_u32 bytes_received;
Ip_u32 bytes_sent;
Ip_u16 encryption_algorithm;
Ip_u16 hash_algorithm;
Ip_u16 authentication_method;
Ip_u16 life_type;
Ip_u64 life_duration;
Ip_u16 dh_group;
Ip_u32 dh_generator;
Ip_u16 key_length;
Ip_u8 version;
};
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_ipsec.c
+130
View File
@@ -0,0 +1,130 @@
/*
******************************************************************************
* SOURCE FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_ipsec.c,v $ $Revision: 1.10.16.1 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_ipsec.c,v $
* $Author: ulf $ $Date: 2011-11-16 10:33:33 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Functions and constants related to the IPSec DOI */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_h.h"
#include "ipike_ipsec.h"
#include "ipike_doi.h"
#include <ipcom_clib.h>
#include <ipcom_syslog.h>
/*
****************************************************************************
* 4 EXTERN PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 5 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 6 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 7 LOCAL PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 8 DATA
****************************************************************************
*/
/*
****************************************************************************
* 9 LOCAL FUNCTIONS
****************************************************************************
*/
/*
****************************************************************************
* 10 PUBLIC FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_ipsec_set_idix
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_ipsec_set_idix(union Ip_sockaddr_union* addr, Ipike_id* idix)
{
switch (addr->sa.sa_family)
{
#ifdef IPCOM_USE_INET
case IP_AF_INET:
idix->id_type = IPIKE_ID_IPV4_ADDR;
break;
#endif
#ifdef IPCOM_USE_INET6
case IP_AF_INET6:
idix->id_type = IPIKE_ID_IPV6_ADDR;
break;
#endif
default:
IP_PANIC(); /* Should never happen */
return IPIKE_FAILED;
}
idix->doi = IPIKE_DOI_IPSEC;
idix->doi_specific_id_data.ipsec.proto_id = 0;
idix->doi_specific_id_data.ipsec.port = 0;
idix->id_data.len = ipike_addr_get_len(addr);
ipcom_free(idix->id_data.value);
if (IP_NULL == (idix->id_data.value = ipcom_malloc(idix->id_data.len)))
{
IP_PANIC();
return IPIKE_OUT_OF_MEMORY;
}
ipcom_memcpy(idix->id_data.value, ipike_addr_get_ptr(addr), idix->id_data.len);
return IPIKE_SUCCESS;
}
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_ipsec.h
+87
View File
@@ -0,0 +1,87 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_ipsec.h,v $ $Revision: 1.3 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_ipsec.h,v $
* $Author: edahlber $ $Date: 2010-04-23 15:31:40 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#ifndef IPIKE_IPSEC_H
#define IPIKE_IPSEC_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Functions and constants related to the IPSec DOI */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_config.h"
#include <ipcom.h>
#include "ipike_payload_identification.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_ipsec_set_idix
*===========================================================================
* Description: Creates a identification from the passed address.
* Parameters: addr - the IP address, protocol and port.
* idix - will contain the identification if the call is successfull.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*
*/
IP_PUBLIC Ipike_error
ipike_ipsec_set_idix(union Ip_sockaddr_union* addr, Ipike_id* idix);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_ipsec_attributes.c
+415
View File
@@ -0,0 +1,415 @@
/*
******************************************************************************
* SOURCE FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_ipsec_attributes.c,v $ $Revision: 1.20.10.4 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_ipsec_attributes.c,v $
* $Author: zan $ $Date: 2013-08-02 03:20:23 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_h.h"
#include "ipike_ipsec_attributes.h"
#include "ipike_payload_proposal.h"
#include "ipike_util.h"
#include <openssl/evp.h>
#include <ipcom_syslog.h>
/*
****************************************************************************
* 4 EXTERN PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 5 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 6 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 7 LOCAL PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 8 DATA
****************************************************************************
*/
static const char* ipike_invalid_attr = "invalid attribute value";
/*
****************************************************************************
* 9 LOCAL FUNCTIONS
****************************************************************************
*/
/*
****************************************************************************
* 10 PUBLIC FUNCTIONS
****************************************************************************
*/
IP_GLOBAL const char *
ipike_ipsec_attribute_class_to_string(Ip_u16 attribute_type)
{
static const char *attr_cls_str[IPIKE_IPSEC_CLS_COUNT] = {
"SA life type",
"SA life duration",
"group description",
"encapsulation mode",
"authentication algorithm",
"key length",
"key rounds",
"compress dictionary size",
"compress private algorithm"
};
if (attribute_type != 0 && attribute_type <= IPIKE_IPSEC_CLS_COUNT)
return attr_cls_str[attribute_type - 1];
return "invalid attribute type";
}
IP_GLOBAL const char*
ipike_ipsec_attribute_value_to_string(Ip_u16 type, Ip_u16 value)
{
switch (type)
{
case IPIKE_IPSEC_CLS_SA_LIFE_TYPE:
return ipike_attribute_life_type_to_string(value);
case IPIKE_IPSEC_CLS_GROUP_DESCRIPTION:
return ipike_attribute_dh_group_to_string(value);
case IPIKE_IPSEC_CLS_ENCAPSULATION_MODE:
return ipike_ipsec_attribute_encap_mode_to_string(value);
case IPIKE_IPSEC_CLS_AUTHENTICATION_ALG:
return ipike_ipsec_attribute_integrity_alg_to_string(value);
}
return IP_NULL;
}
IP_GLOBAL Ipike_error
ipike_ipsec_attribute_process_encapsulation_mode(
Ipike_attribute* attr,
Ip_u16* enc_alg)
{
Ipike_error err;
err = ipike_check_basic_attr(attr, IPIKE_IPSEC_ENCAPSULATION_MODE_MAX);
if (IPIKE_SUCCESS != err)
return err;
*enc_alg = ip_ntohs(attr->value);
return IPIKE_SUCCESS;
}
IP_GLOBAL Ipike_error
ipike_ipsec_attribute_process_authentication_algorithm(
Ipike_attribute* attr,
Ip_u16* auth_alg)
{
Ipike_error err;
err = ipike_check_basic_attr(attr, IPIKE_IPSEC_AUTHENTICATION_ALG_COUNT);
if (IPIKE_SUCCESS != err)
return err;
if (ip_ntohs(attr->value) == IPIKE_IPSEC_AUTHENTICATION_ALG_DES_MAC
|| ip_ntohs(attr->value) == IPIKE_IPSEC_AUTHENTICATION_ALG_KPDK)
{
IPCOM_LOG1(ERR,
"ipike_ipsec_attribute_process_authentication_algorithm: %s not supported",
ipike_ipsec_attribute_value_to_string(IPIKE_ATTR_TYPE(attr->type), ip_ntohs(attr->value)));
return IPIKE_SA_AUTHENTICATION_ALGORITHM_NOT_SUPPORTED;
}
*auth_alg = ip_ntohs(attr->value);
return IPIKE_SUCCESS;
}
IP_GLOBAL Ipike_error
ipike_ipsec_attribute_process_key_length(Ipike_attribute* attr, Ip_u16* key_length)
{
return ipike_attribute_process_key_length(attr, key_length);
}
IP_GLOBAL Ipike_error
ipike_ipsec_check_transform_identifier(Ip_u8 security_proto_id, Ip_u8 transform_id)
{
switch (security_proto_id)
{
case IPIKE_PROTO_IPSEC_AH:
if (transform_id >= IPIKE_IPSEC_AH_MIN && transform_id <= IPIKE_IPSEC_AH_MAX)
return IPIKE_SUCCESS;
break;
case IPIKE_PROTO_IPSEC_ESP:
if (transform_id >= IPIKE_IPSEC_ESP_MIN && transform_id <= IPIKE_IPSEC_ESP_MAX)
return IPIKE_SUCCESS;
break;
case IPIKE_PROTO_IPCOMP:
if (transform_id >= IPIKE_IPSEC_IPCOMP_MIN && transform_id <= IPIKE_IPSEC_IPCOMP_MAX)
return IPIKE_SUCCESS;
break;
default:
break;
}
IPCOM_LOG2(ERR,
"ipike_ipsec_check_transform_identifier: invalid transform id (%d) for security protocol ID %s",
transform_id,
ipike_proposal_proto_id_to_string(security_proto_id));
return IPIKE_ISAKMP_INVALID_TRANSFORM_ID;
}
IP_GLOBAL Ipike_error
ipike_ipsec_attribute_get_esp_cipher_key_length(Ip_u8 transform_id, Ip_size_t* key_length)
{
EVP_CIPHER *cipher = IP_NULL;
switch (transform_id)
{
case 0:
*key_length = 0;
return IPIKE_SUCCESS;
case IPIKE_IPSEC_ESP_DES_IV64:
case IPIKE_IPSEC_ESP_DES:
case IPIKE_IPSEC_ESP_DES_IV32:
cipher=EVP_get_cipherbyname("des");
if (cipher == IP_NULL)
return IPIKE_PROPOSAL_INVALID_ID;
*key_length = (Ip_size_t)EVP_CIPHER_key_length(cipher);
return IPIKE_SUCCESS;
case IPIKE_IPSEC_ESP_3DES:
cipher=EVP_get_cipherbyname("des3");
if (cipher == IP_NULL)
return IPIKE_PROPOSAL_INVALID_ID;
*key_length = (Ip_size_t)EVP_CIPHER_key_length(cipher);
return IPIKE_SUCCESS;
case IPIKE_IPSEC_ESP_IDEA:
cipher=EVP_get_cipherbyname("idea");
if (cipher == IP_NULL)
return IPIKE_PROPOSAL_INVALID_ID;
*key_length = (Ip_size_t)EVP_CIPHER_key_length(cipher);
return IPIKE_SUCCESS;
case IPIKE_IPSEC_ESP_CAST:
cipher=EVP_get_cipherbyname("cast");
if (cipher == IP_NULL)
return IPIKE_PROPOSAL_INVALID_ID;
*key_length = (Ip_size_t)EVP_CIPHER_key_length(cipher);
return IPIKE_SUCCESS;
case IPIKE_IPSEC_ESP_BLOWFISH:
cipher=EVP_get_cipherbyname("bf");
if (cipher == IP_NULL)
return IPIKE_PROPOSAL_INVALID_ID;
*key_length = (Ip_size_t)EVP_CIPHER_key_length(cipher);
return IPIKE_SUCCESS;
case IPIKE_IPSEC_ESP_NULL:
*key_length = 0;
return IPIKE_SUCCESS;
case IPIKE_IPSEC_ESP_AESCBC:
case IPIKE_IPSEC_ESP_AESCTR:
/* default 128 bits */
cipher=EVP_get_cipherbyname("aes128");
if (cipher == IP_NULL)
return IPIKE_PROPOSAL_INVALID_ID;
*key_length = (Ip_size_t)EVP_CIPHER_key_length(cipher);
return IPIKE_SUCCESS;
}
IPCOM_LOG1(ERR,
"ipike_ipsec_attribute_get_esp_cipher_key_length: %d is an unknown transform ID",
transform_id);
return IPIKE_PROPOSAL_INVALID_ID;
}
IP_GLOBAL Ipike_error
ipike_ipsec_attribute_get_esp_auth_key_length(
Ip_u16 transform_id,
Ip_size_t * key_length)
{
switch (transform_id)
{
case 0:
*key_length = 0;
return IPIKE_SUCCESS;
case IPIKE_IPSEC_AUTHENTICATION_ALG_HMAC_MD5:
*key_length = 128/8;
return IPIKE_SUCCESS;
case IPIKE_IPSEC_AUTHENTICATION_ALG_HMAC_SHA1:
*key_length = 160/8;
return IPIKE_SUCCESS;
case IPIKE_IPSEC_AUTHENTICATION_ALG_AES_XCBC_MAC:
*key_length = 128/8;
return IPIKE_SUCCESS;
case IPIKE_IPSEC_AUTHENTICATION_ALG_HMAC_SHA2_256_128:
*key_length = 256/8;
return IPIKE_SUCCESS;
case IPIKE_IPSEC_AUTHENTICATION_ALG_HMAC_SHA2_384_192:
*key_length = 384/8;
return IPIKE_SUCCESS;
case IPIKE_IPSEC_AUTHENTICATION_ALG_HMAC_SHA2_512_256:
*key_length = 512/8;
return IPIKE_SUCCESS;
}
IPCOM_LOG1(ERR, "ipike_ipsec_attribute_get_esp_auth_key_length() :: "\
"%d is an unknown transform ID",
transform_id);
return IPIKE_ATTRIBUTE_UNSUPPORTED_VALUE;
}
IP_GLOBAL Ipike_error
ipike_ipsec_attribute_get_ah_key_length(
Ip_u8 transform_id,
Ip_size_t* key_length)
{
switch (transform_id)
{
case 0:
*key_length = 0;
return IPIKE_SUCCESS;
case IPIKE_IPSEC_AH_MD5:
*key_length = 128/8;
return IPIKE_SUCCESS;
case IPIKE_IPSEC_AH_SHA:
*key_length = 160/8;
return IPIKE_SUCCESS;
case IPIKE_IPSEC_AH_DES:
*key_length = 128/8;
return IPIKE_SUCCESS;
case IPIKE_IPSEC_AH_SHA2_256:
*key_length = 256/8;
return IPIKE_SUCCESS;
case IPIKE_IPSEC_AH_SHA2_384:
*key_length = 384/8;
return IPIKE_SUCCESS;
case IPIKE_IPSEC_AH_SHA2_512:
*key_length = 512/8;
return IPIKE_SUCCESS;
}
IPCOM_LOG1(ERR, "ipike_ipsec_attribute_get_ah_key_length() ::"\
" %d is an unknown transform ID",
transform_id);
return IPIKE_PROPOSAL_INVALID_ID;
}
IP_GLOBAL const char*
ipike_ipsec_attribute_esp_alg_to_string(Ip_u16 v)
{
const char *s;
if ((ipike_map_string(ipike.ipsec_esp_trans_id_map, v, &s)))
return ipike_invalid_attr;
return s;
}
IP_GLOBAL const char*
ipike_ipsec_attribute_ah_alg_to_string(Ip_u16 v)
{
const char *s;
if ((ipike_map_string(ipike.ipsec_ah_trans_id_map, v, &s)))
return ipike_invalid_attr;
return s;
}
IP_GLOBAL const char*
ipike_ipsec_attribute_integrity_alg_to_string(Ip_u16 v)
{
const char *s;
if ((ipike_map_string(ipike.authentication_algorithm_map, v, &s)))
return ipike_invalid_attr;
return s;
}
IP_GLOBAL const char*
ipike_ipsec_attribute_encap_mode_to_string(Ip_u16 v)
{
const char* s;
if ((ipike_map_string(ipike.encapsulation_mode_map, v, &s)))
return ipike_invalid_attr;
return s;
}
IP_GLOBAL const char*
ipike_ipsec_attribute_esp_key_length_alg_to_string(Ip_u16 v1, Ip_u16 v2)
{
const char* s;
int v = v1 + (v2 << 16);
if ((ipike_map_string(ipike.ipsec_esp_key_length_map, v, &s)))
return IP_NULL;
return s;
}
IP_GLOBAL Ipike_error
ipike_ipsec_attribute_esp_alg_from_string(const char* s, Ip_u16* v)
{
return ipike_attribute_map_Ip_u16(ipike.ipsec_esp_trans_id_map, s, v);
}
IP_GLOBAL Ipike_error
ipike_ipsec_attribute_ah_alg_from_string(const char* s, Ip_u16* v)
{
return ipike_attribute_map_Ip_u16(ipike.ipsec_ah_trans_id_map, s, v);
}
IP_GLOBAL Ipike_error
ipike_ipsec_attribute_integrity_alg_from_string(const char* s, Ip_u16* v)
{
return ipike_attribute_map_Ip_u16(ipike.authentication_algorithm_map, s, v);
}
IP_GLOBAL Ipike_error
ipike_ipsec_attribute_encap_mode_from_string(const char* s, Ip_u16* v)
{
return ipike_attribute_map_Ip_u16(ipike.encapsulation_mode_map, s, v);
}
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_ipsec_attributes.h
+313
View File
@@ -0,0 +1,313 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_ipsec_attributes.h,v $ $Revision: 1.9.16.2 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_ipsec_attributes.h,v $
* $Author: svc-cmnet $ $Date: 2013-03-13 07:45:26 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#ifndef IPIKE_IPSEC_ATTRIBUTE_H
#define IPIKE_IPSEC_ATTRIBUTE_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Attibutes from chapter 4.5 in RFC 2407 */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_config.h"
#include "ipike_attributes.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
#define IPIKE_IPSEC_CLS_SA_LIFE_TYPE 1 /* Basic */
#define IPIKE_IPSEC_CLS_SA_LIFE_DURATION 2 /* Variable */
#define IPIKE_IPSEC_CLS_GROUP_DESCRIPTION 3 /* Basic */
#define IPIKE_IPSEC_CLS_ENCAPSULATION_MODE 4 /* Basic */
#define IPIKE_IPSEC_CLS_AUTHENTICATION_ALG 5 /* Basic */
#define IPIKE_IPSEC_CLS_KEY_LENGTH 6 /* Basic */
#define IPIKE_IPSEC_CLS_KEY_ROUNDS 7 /* Basic */
#define IPIKE_IPSEC_CLS_COMPRESS_DICTIONARY_SIZE 8 /* Basic */
#define IPIKE_IPSEC_CLS_COMPRESS_PRIVATE_ALGORITHM 9 /* Variable */
#define IPIKE_IPSEC_CLS_COUNT 9
#define IPIKE_IPSEC_LIFE_TYPE_SECONDS 1
#define IPIKE_IPSEC_LIFE_TYPE_KBYTES 2
#define IPIKE_IPSEC_LIFE_TYPE_COUNT 2
#define IPIKE_IPSEC_GROUP_DESC_768_MODP 1
#define IPIKE_IPSEC_GROUP_DESC_1024_MODP 2
#define IPIKE_IPSEC_GROUP_DESC_155_EC2N 3
#define IPIKE_IPSEC_GROUP_DESC_185_EC2N 4
#define IPIKE_IPSEC_GROUP_DESC_1536_MODP 5
#define IPIKE_IPSEC_GROUP_DESC_2048_MODP 14
#define IPIKE_IPSEC_GROUP_DESC_3072_MODP 15
#define IPIKE_IPSEC_GROUP_DESC_4096_MODP 16
#define IPIKE_IPSEC_GROUP_DESC_6144_MODP 17
#define IPIKE_IPSEC_GROUP_DESC_8192_MODP 18
#define IPIKE_IPSEC_GROUP_DESC_MAX 18
#define IPIKE_IPSEC_ENCAPSULATION_MODE_TUNNEL 1
#define IPIKE_IPSEC_ENCAPSULATION_MODE_TRANSPORT 2
#define IPIKE_IPSEC_ENCAPSULATION_MODE_UDP_TUNNEL 3
#define IPIKE_IPSEC_ENCAPSULATION_MODE_UDP_TRANSPORT 4
#define IPIKE_IPSEC_ENCAPSULATION_MODE_MAX 4
#define IPIKE_IPSEC_AUTHENTICATION_ALG_HMAC_MD5 1
#define IPIKE_IPSEC_AUTHENTICATION_ALG_HMAC_SHA1 2
#define IPIKE_IPSEC_AUTHENTICATION_ALG_DES_MAC 3
#define IPIKE_IPSEC_AUTHENTICATION_ALG_KPDK 4
#define IPIKE_IPSEC_AUTHENTICATION_ALG_HMAC_SHA2_256_128 5
#define IPIKE_IPSEC_AUTHENTICATION_ALG_HMAC_SHA2_384_192 6
#define IPIKE_IPSEC_AUTHENTICATION_ALG_HMAC_SHA2_512_256 7
#define IPIKE_IPSEC_AUTHENTICATION_ALG_AES_XCBC_MAC 9
#define IPIKE_IPSEC_AUTHENTICATION_ALG_COUNT 9
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_ipsec_attribute_class_to_string
*===========================================================================
* Description: Returns a string representation of the attribute type.
* Parameters: attribute_type - the attribute type.
* Returns: A string representation of the attribute type.
*/
IP_GLOBAL const char*
ipike_ipsec_attribute_class_to_string(Ip_u16 attribute_type);
/*
*===========================================================================
* ipike_ipsec_attribute_value_to_string
*===========================================================================
* Description: Returns a string representation of the IPSec attribute value.
* Parameters: type - the attribute type.
* value - the attribute value.
* Returns: A string representation of the attribute value.
*/
IP_GLOBAL const char*
ipike_ipsec_attribute_value_to_string(Ip_u16 type, Ip_u16 value);
/*
*===========================================================================
* ipike_ipsec_attribute_process_encapsulation_mode
*===========================================================================
* Description: Verifies that the suggested encapsulation mode is supported,
* if it is, set enc_name.
* Parameters: attr - the encapsulation mode attribute.
* valid_suits - the valid IPSec suites.
* call is successfull.
* Returns: IPIKE_SUCCESS
* IPIKE_SA_NO_MATCHING_ENCRYPTION_ALGORITHM
*
*/
IP_GLOBAL Ipike_error
ipike_ipsec_attribute_process_encapsulation_mode(
Ipike_attribute* attr,
Ip_u16* enc_alg);
/*
*===========================================================================
* ipike_ipsec_attribute_process_authentication_algorithm
*===========================================================================
* Description: Verifies that the suggested authenticaton algorithm is
* supported, if it is, set enc_name.
* Parameters: attr - the encapsulation mode attribute.
* valid_suits - the valid IPSec suites.
* call is successfull.
* Returns: IPIKE_SUCCESS
* IPIKE_SA_NO_MATCHING_ENCRYPTION_ALGORITHM
*
*/
IP_GLOBAL Ipike_error
ipike_ipsec_attribute_process_authentication_algorithm(
Ipike_attribute* attr,
Ip_u16* auth_alg);
/*
*===========================================================================
* ipike_ipsec_attribute_process_key_length
*===========================================================================
* Description: Verifies that the suggested key length is supported,
* if it is, set key length.
* Parameters: attr - the encapsulation mode attribute.
* key_length - a valid key length if call is successfull.
* Returns: IPIKE_SUCCESS
* IPIKE_ATTRIBUTE_INVALID_VALUE
*
*/
IP_GLOBAL Ipike_error
ipike_ipsec_attribute_process_key_length(Ipike_attribute* attr, Ip_u16* key_length);
/*
*===========================================================================
* ipike_ipsec_check_transform_identifier
*===========================================================================
* Description: Verifies that the suggested crypto/HMAC-algorithm is supported,
* and that the configuration allows us to use it.
* Parameters: security_proto_id - the proposal protocol ID.
* transform_id - the AH/ESP/IPCOMP transform ID.
* valid_suits - the valid IPSec suites.
* Returns: IPIKE_SUCCESS
* IPIKE_SA_NO_MATCHING_HASH_ALGORITHM
* IPIKE_SA_NO_MATCHING_ENCRYPTION_ALGORITHM
*
*/
IP_GLOBAL Ipike_error
ipike_ipsec_check_transform_identifier(Ip_u8 security_proto_id, Ip_u8 transform_id);
/*
*===========================================================================
* ipike_ipsec_attribute_get_esp_cipher_key_length
*===========================================================================
* Description: Returns the key length (in bytes) for the specified transform
* ID. It is only legal to call this function for transform IDs
* under the IPIKE_PROTO_IPSEC_ESP proposal protocol ID.
* Parameters: transform_id - the ESP transform ID.
* key_length - the default key length for the specified cipher.
* Returns: IPIKE_SUCCESS
* IPIKE_PROPOSAL_INVALID_ID
*
*/
IP_GLOBAL Ipike_error
ipike_ipsec_attribute_get_esp_cipher_key_length(Ip_u8 transform_id, Ip_size_t* key_length);
/*
*===========================================================================
* ipike_ipsec_attribute_get_esp_auth_key_length
*===========================================================================
* Description: Returns the key length (in bytes) for the authentication
* algorithm.
* Parameters: auth_alg - the authentication algorithm.
* key_length - the default key length for the specified cipher.
* Returns: IPIKE_SUCCESS
* IPIKE_ATTRIBUTE_UNSUPPORTED_VALUE
*
*/
IP_GLOBAL Ipike_error
ipike_ipsec_attribute_get_esp_auth_key_length(Ip_u16 auth_alg, Ip_size_t* key_length);
/*
*===========================================================================
* ipike_ipsec_attribute_get_ah_key_length
*===========================================================================
* Description: Returns the key length (in bytes) for the specified transform
* ID. It is only legal to call this function for transform IDs
* under the IPIKE_PROTO_IPSEC_AH proposal protocol ID.
* Parameters: transform_id - the AH transform ID.
* key_length - the default key length for the specified cipher.
* Returns: IPIKE_SUCCESS
* IPIKE_PROPOSAL_INVALID_ID
*
*/
IP_GLOBAL Ipike_error
ipike_ipsec_attribute_get_ah_key_length(Ip_u8 transform_id, Ip_size_t* key_length);
/*
*===========================================================================
* ipike_ipsec_attribute_xxx_to_string
*===========================================================================
* Description: Converts the numberical representation of a attribute to its
* string form.
* Parameters: s - The string representation of the value.
* Returns: The string representation of the value.
*
*/
IP_GLOBAL const char*
ipike_ipsec_attribute_ah_alg_to_string(Ip_u16 v);
IP_GLOBAL const char*
ipike_ipsec_attribute_esp_alg_to_string(Ip_u16 v);
IP_GLOBAL const char*
ipike_ipsec_attribute_integrity_alg_to_string(Ip_u16 v);
IP_GLOBAL const char*
ipike_ipsec_attribute_encap_mode_to_string(Ip_u16 v);
IP_GLOBAL const char*
ipike_ipsec_attribute_esp_key_length_alg_to_string(Ip_u16 v1, Ip_u16 v2);
/*
*===========================================================================
* ipike_ipsec_attribute_xxx_from_string
*===========================================================================
* Description: Converts the string representation of a attribute to its
* numerical form.
* Parameters: s - The string representation of the value.
* v - Will hold the value if the call is successful.
* Returns: IPIKE_SUCCESS
* IPIKE_VALUE_NOT_FOUND
* IPIKE_INVALID_VALUE
*
*/
IP_GLOBAL Ipike_error
ipike_ipsec_attribute_ah_alg_from_string(const char *s, Ip_u16* v);
IP_GLOBAL Ipike_error
ipike_ipsec_attribute_esp_alg_from_string(const char *s, Ip_u16* v);
IP_GLOBAL Ipike_error
ipike_ipsec_attribute_integrity_alg_from_string(const char *s, Ip_u16* v);
IP_GLOBAL Ipike_error
ipike_ipsec_attribute_encap_mode_from_string(const char *s, Ip_u16* v);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_ipsec_sadb.c
+2368
View File
File diff suppressed because it is too large Load Diff
components/ip_net2-6.9/ipike/src/ipike_ipsec_sadb.h
+507
View File
@@ -0,0 +1,507 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_ipsec_sadb.h,v $ $Revision: 1.21.10.8 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_ipsec_sadb.h,v $
* $Author: svc-cmnet $ $Date: 2013-03-13 07:45:26 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#ifndef IPIKE_IPSEC_SADB_H
#define IPIKE_IPSEC_SADB_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Functions to handle the IPSec SA:s */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
#include "ipike.h"
#include "ipike_sadb.h"
#include "ipike_payload_sa.h"
#include "ipike_payload_transform.h"
#include "ipike_payload_identification.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
typedef struct Ipike_ipsec_sadb_entry_struct
{
Ipcom_list ipsec_sa_next; /* For IKE SA ipsec SA list */
const char * ipsec_id; /* IPSec id string */
Ip_u32 flags; /* IPIKE_IPSEC_FLAGS_xxx */
Ip_bool is_inbound; /* True if this SA is inbound (outbound otherwise) */
Ip_bool is_behind_nat; /* True if this SA is behind NAT */
Ip_bool passed_soft_timeout; /* True if this IPSec SA has passed the soft timeout */
Ip_bool register_flow; /* Add or register flow */
struct Ip_timeval last_liveness_check; /* Time when this SA was checked for liveness */
Ip_u32 worry_metric; /* Number of seconds we accept absense of packets
before we initates Dead-Peer-Detection check */
Ip_u32 replay_window; /* The size of the anti-replay window */
Ip_u64 bytes; /* The number of bytes processed by this SA */
Ip_u8 spi[4]; /* The SPI for the SA */
Ip_u8 proto; /* The IPSec protocol (ESP or AH) */
Ip_u8 use_esn;
Ip_u8 use_tfc;
Ip_u8 use_ecn; /* Handle ECN bits in TOS field, currently according RFC4301 */
Ipike_config_flow flow; /* IPsec flows, contains addresses, ports and protocol */
union Ip_sockaddr_union sa_src_addr; /* Source address for the IPSec end-point */
union Ip_sockaddr_union sa_dst_addr; /* Destination address for the IPSec end-point */
union Ip_sockaddr_union added_addr; /* IPSec got address from responder, should be removed from interface when deleted */
Ipike_transform_ipsec transform_param; /* The parameters from the selected transform */
Ipike_value encryption_key; /* The key used to decrypt IP packets */
Ipike_value auth_key; /* The key used to authenticate IP packets */
Ipike_value peer_id; /* The ID of the peer associated to this SA */
#ifdef IPIKE_USE_ROHC
Ipike_value rohc_integ_key; /* ROHC Integrity key */
char rohc_ifname[IPIKE_ROHC_IFNAME_SIZE]; /* ROHC Interface name */
Ipike_config_rohc rohc_param; /* ROHC Channel parameters */
#endif /* IPIKE_USE_ROHC */
Ipcom_tmo2 rekey_tmo; /* Rekey retry timer */
struct Ipike_ipsec_sadb_entry_struct *other; /* The outbound IPSec sa if this is inbound and vice versa */
struct Ipike_ipsec_sadb_entry_struct *nested; /* The pointer to one of the nested SAs */
}
Ipike_ipsec_sadb_entry;
#define IPIKE_IPSEC_FLAGS_IN_LIST (1u << 0)
#define IPIKE_IPSEC_FLAGS_IN_SPITABLE (1u << 1)
#define IPIKE_IPSEC_FLAGS_ROHC (1u << 2)
/* IPSec security association data collected during phase 2.
2 IPSec SA (Ipike_ipsec_sa_param) will be created from this information */
typedef struct Ipike_ipsec_sa_param_struct
{
/* The id of the IPSec config used to set up the SA:s */
const char* ipsec_id;
/* Is IP_TRUE if this entity was the initiator of the phase 2
* exchange */
Ip_bool is_initiator;
/* Values that can be freed when the SA is compleate */
/* Initiator id */
Ipike_id idci;
/* Responder id */
Ipike_id idcr;
/* Initiator nonce */
Ipike_value ni;
/* Responder nonce */
Ipike_value nr;
/* DH is only used if perfect forward security is needed */
/* The initiators public Diffie-Hellman value */
Ipike_value g_xi;
/* The responders public Diffie-Hellman value */
Ipike_value g_xr;
/* The Diffie-Hellman shared secret */
Ipike_value g_xy;
/* Values that can NOT be freed when the SA is compleate */
/* The IPSec SA parameters for incomming traffic
(this is the information sent in the IKE messages) */
Ipike_sa inbound_sa;
/* The IPSec SA parameters for outgoing traffic
(this is the information sent in the IKE messages)*/
Ipike_sa outbound_sa;
}
Ipike_ipsec_sa_param;
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
#ifdef __cplusplus
}
#endif
/*
*===========================================================================
* ipike_sadb_add
*===========================================================================
* Description: Creates an inbound and an outbound IPSec SA and adds it
* to IPIKE:s IPSec SA database.
* Parameters: ike_sa - The IKE SA for used by the endpoints.
* sa_param - Paramters negotiated during phase 2.
* inbound - The inbound IPSec SA
* outbound - The outbound IPSec SA.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
* IPIKE_SA_ALREADY_EXISTS
*
*/
IP_GLOBAL Ipike_error
ipike_ipsec_sadb_add(Ipike_sadb_entry* ike_sa,
Ipike_ipsec_sa_param* sa_param,
Ipike_ipsec_sadb_entry** inbound,
Ipike_ipsec_sadb_entry** inbound1,
Ipike_ipsec_sadb_entry** outbound,
Ipike_ipsec_sadb_entry** outbound1);
IP_GLOBAL Ipike_error
ipike_ipsec_sadb_add_v2(Ipike_sadb_entry* ike_sa,
Ipike_sadb_entry* ipsec_sa,
Ipike_ipsec_sadb_entry** inbound,
Ipike_ipsec_sadb_entry** outbound);
/*
*===========================================================================
* ipike_ipsec_sadb_hash_add
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_ipsec_sadb_hash_add(Ipike_ipsec_sadb_entry *ipsec_sa);
/*
*===========================================================================
* ipike_ipsec_sadb_hash_remove
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_ipsec_sadb_hash_remove(Ipike_ipsec_sadb_entry *ipsec_sa);
/*
*===========================================================================
* ipike_ipsec_sadb_hash_get
*===========================================================================
* Description: Returns the IPSec security association structure containing
* a inbound or outbound SA that match the proto ID and SPI.
* Parameters: spi - The SPI that the SA must match.
* proto_id - The protocol ID (IPIKE_PROTO_IPSEC_AH or IPIKE_PROTO_IPSEC_ESP).
* dst_addr - IPSec destination endpoint.
* ipsec_sa - Will point ot the IPSec SA if the call was successful.
* Returns: IPIKE_SUCCESS
* IPIKE_SA_NOT_FOUND
*
*/
IP_GLOBAL Ipike_error
ipike_ipsec_sadb_hash_get(Ip_u8 spi[4],
Ip_u8 proto_id,
union Ip_sockaddr_union* dst_addr,
union Ip_sockaddr_union* src_addr,
Ipike_ipsec_sadb_entry** ipsec_sa);
/*
*===========================================================================
* ipike_ipsec_sadb_free
*===========================================================================
*/
IP_GLOBAL void
ipike_ipsec_sadb_free(Ipike_ipsec_sadb_entry *ipsec_sa);
extern Ipike_ipsec_sadb_entry *ipsec_sadb_inbound_active;
extern Ipike_ipsec_sadb_entry *ipsec_sadb_outbound_active;
/*
*===========================================================================
* ipike_ipsec_sadb_delete_sa
*===========================================================================
* Description: Delete the IPSec SA from the IKE data base
* (and removes it from the stack).
* Parameters: sa_param - The paramters to delete.
* Returns:
*
*/
IP_GLOBAL void
ipike_ipsec_sadb_delete_sa(Ipike_ipsec_sadb_entry* ipsec_sa);
/*
*===========================================================================
* ipike_ipsec_sadb_delete_old_sa_pair
*===========================================================================
* Description: Find and delete both the inbound and outbound IPSec SA. Used
* after rekey.
* Parameters: spi - Spi value.
* proto_id - Protocol identifier (ESP/AH)
* dst_addr - Destination ip address.
* Returns:
*/
IP_GLOBAL void
ipike_ipsec_sadb_delete_old_sa_pair(
Ipike_value* spi,
Ip_u8 proto_id,
union Ip_sockaddr_union* dst_addr,
union Ip_sockaddr_union* src_addr);
/*
*===========================================================================
* ipike_ipsec_sadb_delete_param
*===========================================================================
* Description: Delete the IPSec negotiation paramters.
* Parameters: sa_param - The paramters to delete.
* Returns:
*
*/
IP_GLOBAL void
ipike_ipsec_sadb_delete_param(Ipike_ipsec_sa_param* sa_param);
/*
*===========================================================================
* ipike_ipsec_sadb_sa_exist
*===========================================================================
* Description: Return IP_TRUE if there exists a IPSec SA pair based on the
* specified IPSec configuration.
* Parameters: ipsec_id - The id of IPSec SA configuration.
* Returns: IP_TRUE if both a inbound and a outbund IPSec SA exist,
* IP_FALSE otherwise.
*
*/
IP_GLOBAL Ip_bool
ipike_ipsec_sadb_sa_exist(const char* ipsec_id);
/*
*===========================================================================
* ipike_ipsec_sadb_get_section_spi
*===========================================================================
* Description: Return IP_TRUE if there exists a IPSec SA pair based on the
* specified IPSec configuration.
* Parameters: ipsec_id - The id of IPSec SA configuration.
* spi - return spi of first SA.
* Returns: IP_TRUE if any IPSec SA exist,
* IP_FALSE otherwise.
*/
IP_GLOBAL Ip_bool
ipike_ipsec_sadb_get_section_spi(const char* ipsec_id, Ip_u32 *spi);
/*
*===========================================================================
* ipike_ipsec_sadb_update_addresses
*===========================================================================
* Description: Update IPSec SA/flow with new tunnel end-point addresses.
* Parameters: ike_sa - The IKE SA context.
* Returns: IPIKE_SUCCESS
* IPIKE_FAILED
*/
IP_GLOBAL Ipike_error
ipike_ipsec_sadb_update_addresses(Ipike_sadb_entry* ike_sa);
/*
*===========================================================================
* ipike_ipsec_sadb_sa_expire_cb
*===========================================================================
* Description: Change the state of the specified IPSec SA to 'expired' if
* this was a soft timeout and to 'dying' if this was a hard
* timeout.
* Parameters: exp_param - The paramters on the expired SA.
* is_hard - Set to IP_TRUE if this was a hard timeout.
* report - Set to IP_TRUE if delete of SA should be reported to
* peer.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*
*/
IP_GLOBAL Ipike_error
ipike_ipsec_sadb_sa_expire_cb(Ipike_pfkeyv2_ipsec_sa_param* exp_param,
Ip_bool is_hard,
Ip_bool report);
/*
*===========================================================================
* ipike_ipsec_sadb_sa_acquire_cb
*===========================================================================
* Description: Generate a new IPSec SA.
* Parameters: param - The parameters for that identifies the new IPSec SA.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*/
IP_GLOBAL Ipike_error
ipike_ipsec_sadb_sa_acquire_cb(Ipike_pfkeyv2_ipsec_sa_param* param);
/*
*===========================================================================
* ipike_ipsec_sadb_sa_remove_cb
*===========================================================================
* Description: Delete an IPSec SA.
* Parameters: param - The parameters for that identifies the IPSec SA.
* Returns: IPIKE_SUCCESS
*/
IP_GLOBAL Ipike_error
ipike_ipsec_sadb_sa_remove_cb(Ipike_pfkeyv2_ipsec_sa_param* param);
/*
*===========================================================================
* ipike_ipsec_sadb_sa_flush_cb
*===========================================================================
* Description: Flush all IPSec SA.
* Parameters:
* Returns: IPIKE_SUCCESS
*/
IP_GLOBAL Ipike_error
ipike_ipsec_sadb_sa_flush_cb(void);
/*
*===========================================================================
* ipike_ipsec_sadb_has_available_spi
*===========================================================================
* Description: Verify that there is spi values available.
* Parameters:
* Returns: Return TRUE if spi available (FALSE otherwise)
*
*/
IP_GLOBAL Ip_bool
ipike_ipsec_sadb_has_available_spi(void);
/*
*===========================================================================
* ipike_ipsec_sadb_remove_ike_id
*===========================================================================
* Description: Removed all IPSec SA:s between peers that are using the
* specified ike_id.
* Parameters: ike_id - The ike identifier.
* Returns:
*/
IP_GLOBAL void
ipike_ipsec_sadb_remove_ike_id(const char* ike_id);
/*
*===========================================================================
* ipike_ipsec_sadb_remove_ipsec_id
*===========================================================================
* Description: Removed all IPSec SA:s between peers that are using the
* specified ipsec_id.
* Parameters: ipsec_id - The ipsec identifier.
* Returns:
*/
IP_GLOBAL void
ipike_ipsec_sadb_remove_ipsec_id(const char* ipsec_id);
/*
*===========================================================================
* ipike_ipsec_sadb_check_liveness
*===========================================================================
* Description: Traverses all IPsec SA:s and checks for evidence of life, i.e
* no traffic received. If no traffic has been received during
* the configured "liveness" time it will send a liveness message.
*
* Parameters:
* Returns:
*/
IP_GLOBAL void
ipike_ipsec_sadb_check_liveness(void);
/*
*===========================================================================
* ipike_ipsec_sadb_add_flows
*===========================================================================
* Description: Add all flows which are associated with the IPsec SA to
* the kernel.
* Parameters:
* Returns: IPIKE_SUCCESS - On success
*
*/
IP_GLOBAL Ipike_error
ipike_ipsec_sadb_add_flows(Ipike_ipsec_sadb_entry * sa);
/*
*===========================================================================
* ipike_ipsec_sadb_remove_flows
*===========================================================================
* Description: Remove all flows which are associated with the IPsec SA from
* the kernel.
* Parameters:
* Returns: IPIKE_SUCCESS - On success
* *
*/
IP_GLOBAL Ipike_error
ipike_ipsec_sadb_remove_flows(Ipike_ipsec_sadb_entry * sa);
#ifdef IP_DEBUG
/*
*===========================================================================
* ipike_ipsec_sadb_dump
*===========================================================================
* Description: Dumps the IPsec SA into the (debug) log.
* Parameters:
* Returns:
*
*/
IP_GLOBAL void
ipike_ipsec_sadb_log(Ipike_ipsec_sadb_entry * sa);
#else
#define ipike_ipsec_sadb_log(_sa)
#endif
/*
*===========================================================================
* ipike_ipsec_sadb_startup
*===========================================================================
* Description: Initialize the IKE SA module.
* Parameters:
* Returns: IPIKE_SUCCESS
*
*/
IP_GLOBAL Ipike_error
ipike_ipsec_sadb_startup(void);
/*
*===========================================================================
* ipike_ipsec_sadb_shutdown
*===========================================================================
* Description: Frees all IKE SA structures.
* Parameters:
* Returns:
*
*/
IP_GLOBAL void
ipike_ipsec_sadb_shutdown(void);
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_isakmp.c
+4624
View File
File diff suppressed because it is too large Load Diff
components/ip_net2-6.9/ipike/src/ipike_isakmp.h
+1026
View File
File diff suppressed because it is too large Load Diff
components/ip_net2-6.9/ipike/src/ipike_map.c
+861
View File
@@ -0,0 +1,861 @@
/*
******************************************************************************
* SOURCE FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_map.c,v $ $Revision: 1.44.10.4 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_map.c,v $
* $Author: svc-cmnet $ $Date: 2013-03-13 07:45:26 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/*
Contains all the string and the corresponing numeric values for all
constants used in the configuration file and during printing.
*/
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_h.h"
#include "ipike_attributes.h"
#include "ipike_ipsec_attributes.h"
#include "ipike_doi.h"
#include "ipike_isakmp.h"
#include "ipike_payload_certificate.h"
#include "ipike_payload_identification.h"
#include "ipike_payload_proposal.h"
#include "ipike_payload_transform.h"
#include "ipike2_payload_authentication.h"
#include "ipike2_payload_configuration.h"
#include "ipike2_payload_sa.h"
#include "ipike2_payload_notify.h"
#include "ipike2_payload_eap.h"
#include "ipike_crypto.h"
#include "ipike_map.h"
#include <ipcom_syslog.h>
/*
****************************************************************************
* 4 EXTERN PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 5 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 6 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 7 LOCAL PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 8 DATA
****************************************************************************
*/
/*
****************************************************************************
* 9 LOCAL FUNCTIONS
****************************************************************************
*/
IP_STATIC void
ipike_map_check_algorithms(void)
{
int i = 0;
int value = 0;
/* May store algorithms with several different names. At least one for
* each value must be possible to get. */
for (i=0; ipike.encryption_algorithm_map[i].value != 0; i++)
{
if ( value == ipike.encryption_algorithm_map[i].value ||
-1 == ipike.encryption_algorithm_map[i].value )
continue;
value = ipike.encryption_algorithm_map[i].value;
if ( !ipike_crypto_enc_alg_supported(value) )
{
IPCOM_LOG1(DEBUG, "cipher algorithm '%s' not supported by EVP",
ipike.encryption_algorithm_map[i].key);
}
}
/* Check hash algorithms */
for (i=0; ipike.hash_algorithm_map[i].value != 0; i++)
{
if (value == ipike.hash_algorithm_map[i].value ||
-1 == ipike.hash_algorithm_map[i].value )
continue;
value = ipike.hash_algorithm_map[i].value;
if ( !ipike_crypto_hash_alg_supported(value) )
{
IPCOM_LOG1(DEBUG, "digest algorithm '%s' not supported by EVP",
ipike.hash_algorithm_map[i].key);
}
}
#ifdef IPIKE_USE_CRYPTO_SELF_TEST
/* Check crypto algorithms */
if (ipike_crypto_self_test() != IPIKE_SUCCESS)
{
IPCOM_LOG0(DEBUG, "All algorithms may not be working, check your cryptographic support");
}
#endif
return;
}
/*
****************************************************************************
* 10 PUBLIC FUNCTIONS
****************************************************************************
*/
IP_PUBLIC Ipike_error
ipike_map_startup(void)
{
/* The matching of strings ignore case */
static const Ipike_string_int_map authentication_method_map[] = {
{ "pre_shared_key", IPIKE_ATTR_AUTH_PRE_SHARED_KEY },
{ "rsa_signature", IPIKE_ATTR_AUTH_RSA_SIGNATURES },
{ "dss_signature", IPIKE_ATTR_AUTH_DSS_SIGNATURES },
{ "any", -1 },
{ IP_NULL, 0 }
};
static const Ipike_string_int_map v2_authentication_method_map[] = {
#ifdef IPIKE_USE_VERSION2
{ "pre_shared_key", IPIKE2_AUTH_PRE_SHARED_KEY },
{ "rsa_signature", IPIKE2_AUTH_RSA_SIGNATURE },
{ "dss_signature", IPIKE2_AUTH_DSS_SIGNATURE },
#ifdef IPIKE_USE_EAP
{ "eap", IPIKE2_AUTH_EAP },
#endif
#endif
{ IP_NULL, 0 }
};
static const Ipike_string_int_map encryption_algorithm_map[] = {
#ifndef OPENSSL_NO_DES
#ifndef OPENSSL_FIPS
{ "DES-CBC", IPIKE_ATTR_ENCRYPTION_DES },
{ "des", IPIKE_ATTR_ENCRYPTION_DES },
#endif
{ "3DES-CBC", IPIKE_ATTR_ENCRYPTION_3DES },
{ "3des", IPIKE_ATTR_ENCRYPTION_3DES },
#endif
#ifndef OPENSSL_NO_IDEA
{ "IDEA-CBC", IPIKE_ATTR_ENCRYPTION_IDEA },
{ "idea", IPIKE_ATTR_ENCRYPTION_IDEA },
#endif
#ifndef OPENSSL_NO_BF
{ "BF-CBC", IPIKE_ATTR_ENCRYPTION_BLOWFISH },
{ "bf", IPIKE_ATTR_ENCRYPTION_BLOWFISH },
{ "blowfish", IPIKE_ATTR_ENCRYPTION_BLOWFISH },
#endif
#ifndef OPENSSL_NO_CAST
{ "CAST5-CBC", IPIKE_ATTR_ENCRYPTION_CAST },
{ "cast5", IPIKE_ATTR_ENCRYPTION_CAST },
{ "cast", IPIKE_ATTR_ENCRYPTION_CAST },
#endif
#ifndef OPENSSL_NO_AES
{ "AES-CBC", IPIKE_ATTR_ENCRYPTION_AESCBC },
{ "aes128", IPIKE_ATTR_ENCRYPTION_AESCBC },
{ "aes192", IPIKE_ATTR_ENCRYPTION_AESCBC },
{ "aes256", IPIKE_ATTR_ENCRYPTION_AESCBC },
{ "aes128cbc", IPIKE_ATTR_ENCRYPTION_AESCBC },
{ "aes192cbc", IPIKE_ATTR_ENCRYPTION_AESCBC },
{ "aes256cbc", IPIKE_ATTR_ENCRYPTION_AESCBC },
{ "aes128ctr", IPIKE_ATTR_ENCRYPTION_AESCTR },
{ "aes192ctr", IPIKE_ATTR_ENCRYPTION_AESCTR },
{ "aes256ctr", IPIKE_ATTR_ENCRYPTION_AESCTR },
#endif
{ "any", -1 },
{ IP_NULL, 0 }
};
static const Ipike_string_int_map v2_encryption_algorithm_map[] = {
#ifdef IPIKE_USE_VERSION2
#ifndef OPENSSL_NO_DES
#ifndef OPENSSL_FIPS
{ "DES-CBC", IPIKE_ENCR_DES },
{ "des", IPIKE_ENCR_DES },
#endif
{ "3DES-CBC", IPIKE_ENCR_3DES },
{ "3des", IPIKE_ENCR_3DES },
#endif
#ifndef OPENSSL_NO_IDEA
{ "IDEA-CBC", IPIKE_ENCR_IDEA },
{ "idea", IPIKE_ENCR_IDEA },
{ "3IDEA-CBC", IPIKE_ENCR_3IDEA },
{ "3idea", IPIKE_ENCR_3IDEA },
#endif
#ifndef OPENSSL_NO_CAST
{ "CAST5-CBC", IPIKE_ENCR_CAST },
{ "cast5", IPIKE_ENCR_CAST },
{ "cast", IPIKE_ENCR_CAST },
#endif
#ifndef OPENSSL_NO_BF
{ "BF-CBC", IPIKE_ENCR_BLOWFISH },
{ "bf", IPIKE_ENCR_BLOWFISH },
{ "blowfish", IPIKE_ENCR_BLOWFISH },
#endif
#ifndef OPENSSL_NO_AES
{ "AES-CBC", IPIKE_ENCR_AES_CBC },
{ "aesctr", IPIKE_ENCR_AES_CTR },
{ "aes", IPIKE_ENCR_AES_CBC },
#endif
{ "any", -1 },
#endif
{ IP_NULL, 0 }
};
/* store key length as top 16 bits */
static const Ipike_string_int_map encryption_algorithm_map2[] = {
#ifndef OPENSSL_NO_AES
{ "aes128", (IPIKE_ATTR_ENCRYPTION_AESCBC + ((128/8) << 16))},
{ "aes192", (IPIKE_ATTR_ENCRYPTION_AESCBC + ((192/8) << 16))},
{ "aes256", (IPIKE_ATTR_ENCRYPTION_AESCBC + ((256/8) << 16))},
{ "aes128cbc", (IPIKE_ATTR_ENCRYPTION_AESCBC + ((128/8) << 16))},
{ "aes192cbc", (IPIKE_ATTR_ENCRYPTION_AESCBC + ((192/8) << 16))},
{ "aes256cbc", (IPIKE_ATTR_ENCRYPTION_AESCBC + ((256/8) << 16))},
{ "aes128ctr", (IPIKE_ATTR_ENCRYPTION_AESCTR + ((128/8) << 16))},
{ "aes192ctr", (IPIKE_ATTR_ENCRYPTION_AESCTR + ((192/8) << 16))},
{ "aes256ctr", (IPIKE_ATTR_ENCRYPTION_AESCTR + ((256/8) << 16))},
#endif
#ifndef OPENSSL_NO_BF
{ "blowfish", (IPIKE_ATTR_ENCRYPTION_BLOWFISH + ((128/8) << 16))},
#endif
#ifndef OPENSSL_NO_CAST
{ "cast", (IPIKE_ATTR_ENCRYPTION_CAST + ((128/8) << 16))},
#endif
{ IP_NULL, 0 }
};
/* store key length as top 16 bits */
static const Ipike_string_int_map v2_encryption_algorithm_map2[] = {
#ifdef IPIKE_USE_VERSION2
#ifndef OPENSSL_NO_AES
{ "aes128", (IPIKE_ENCR_AES_CBC + ((128/8) << 16))},
{ "aes192", (IPIKE_ENCR_AES_CBC + ((192/8) << 16))},
{ "aes256", (IPIKE_ENCR_AES_CBC + ((256/8) << 16))},
{ "aes128cbc", (IPIKE_ENCR_AES_CBC + ((128/8) << 16))},
{ "aes192cbc", (IPIKE_ENCR_AES_CBC + ((192/8) << 16))},
{ "aes256cbc", (IPIKE_ENCR_AES_CBC + ((256/8) << 16))},
{ "aes128ctr", (IPIKE_ENCR_AES_CTR + ((128/8) << 16))},
{ "aes192ctr", (IPIKE_ENCR_AES_CTR + ((192/8) << 16))},
{ "aes256ctr", (IPIKE_ENCR_AES_CTR + ((256/8) << 16))},
#endif
#ifndef OPENSSL_NO_BF
{ "blowfish", (IPIKE_ENCR_BLOWFISH + ((128/8) << 16))},
#endif
#ifndef OPENSSL_NO_CAST
{ "cast", (IPIKE_ENCR_CAST + ((128/8) << 16))},
#endif
#endif
{ IP_NULL, 0 }
};
static const Ipike_string_int_map hash_algorithm_map[] = {
#if !defined(OPENSSL_NO_MD5) && !defined(OPENSSL_FIPS)
{ "md5", IPIKE_ATTR_HASH_MD5 },
#endif
#ifndef OPENSSL_NO_SHA
{ "sha1", IPIKE_ATTR_HASH_SHA1 },
#ifndef OPENSSL_NO_SHA256
{ "sha256", IPIKE_ATTR_HASH_SHA2_256 },
#endif
#ifndef OPENSSL_NO_SHA512
{ "sha384", IPIKE_ATTR_HASH_SHA2_384 },
{ "sha512", IPIKE_ATTR_HASH_SHA2_512 },
#endif
#endif
{ "any", -1 },
{ IP_NULL, 0 }
};
static const Ipike_string_int_map dh_group_map[] = {
#ifndef OPENSSL_FIPS
{ "modp768", IPIKE_ATTR_GROUP_DESC_768_MODP },
{ "1", IPIKE_ATTR_GROUP_DESC_768_MODP },
#endif
{ "modp1024", IPIKE_ATTR_GROUP_DESC_1024_MODP },
{ "2", IPIKE_ATTR_GROUP_DESC_1024_MODP },
{ "modp1536", IPIKE_ATTR_GROUP_DESC_1536_MODP },
{ "5", IPIKE_ATTR_GROUP_DESC_1536_MODP },
{ "modp2048", IPIKE_ATTR_GROUP_DESC_2048_MODP },
{ "14", IPIKE_ATTR_GROUP_DESC_2048_MODP },
{ "modp3072", IPIKE_ATTR_GROUP_DESC_3072_MODP },
{ "15", IPIKE_ATTR_GROUP_DESC_3072_MODP },
{ "modp4096", IPIKE_ATTR_GROUP_DESC_4096_MODP },
{ "16", IPIKE_ATTR_GROUP_DESC_4096_MODP },
{ "modp6144", IPIKE_ATTR_GROUP_DESC_6144_MODP },
{ "17", IPIKE_ATTR_GROUP_DESC_6144_MODP },
{ "modp8192", IPIKE_ATTR_GROUP_DESC_8192_MODP },
{ "18", IPIKE_ATTR_GROUP_DESC_8192_MODP },
{ "none", 0 },
{ "any", -1 },
{ IP_NULL, 0 }
};
static const Ipike_string_int_map life_type_map[] = {
{ "seconds", IPIKE_ATTR_LIFE_TYPE_SECONDS },
{ "kilobytes", IPIKE_ATTR_LIFE_TYPE_KBYTES },
{ "any", -1 },
{ IP_NULL, 0 }
};
static const Ipike_string_int_map encapsulation_mode_map[] = {
{ "tunnel", IPIKE_IPSEC_ENCAPSULATION_MODE_TUNNEL },
{ "transport", IPIKE_IPSEC_ENCAPSULATION_MODE_TRANSPORT },
{ "udp_tunnel", IPIKE_IPSEC_ENCAPSULATION_MODE_UDP_TUNNEL },
{ "udp_transport", IPIKE_IPSEC_ENCAPSULATION_MODE_UDP_TRANSPORT },
{ IP_NULL, 0 }
};
static const Ipike_string_int_map authentication_algorithm_map[] = {
#if !defined(OPENSSL_NO_MD5) && !defined(OPENSSL_FIPS)
{ "md5", IPIKE_IPSEC_AUTHENTICATION_ALG_HMAC_MD5 },
#endif
#ifndef OPENSSL_NO_SHA
{ "sha1", IPIKE_IPSEC_AUTHENTICATION_ALG_HMAC_SHA1 },
#ifndef OPENSSL_NO_SHA256
{ "sha256", IPIKE_IPSEC_AUTHENTICATION_ALG_HMAC_SHA2_256_128 },
#endif
#ifndef OPENSSL_NO_SHA512
{ "sha384", IPIKE_IPSEC_AUTHENTICATION_ALG_HMAC_SHA2_384_192 },
{ "sha512", IPIKE_IPSEC_AUTHENTICATION_ALG_HMAC_SHA2_512_256 },
#endif
#endif
{ "aes", IPIKE_IPSEC_AUTHENTICATION_ALG_AES_XCBC_MAC },
{ "any", -1 },
{ IP_NULL, 0 }
};
static const Ipike_string_int_map doi_map[] = {
{ "ISAKMP", IPIKE_DOI_ISAKMP },
{ "IPSec", IPIKE_DOI_IPSEC },
{ IP_NULL, 0 }
};
static const Ipike_string_int_map exchange_map[] = {
#ifdef IPIKE_USE_VERSION1
{ "BASE", IPIKE_ISAKMP_EXCH_BASE },
{ "ID_PROT", IPIKE_ISAKMP_EXCH_IDENTITY_PROTECTION },
{ "AGGRESSIVE", IPIKE_ISAKMP_EXCH_AGGRESSIVE },
{ "INFORMATIONAL", IPIKE_ISAKMP_EXCH_INFORMATIONAL },
{ "TRANSACTION", IPIKE_ISAKMP_EXCH_TRANSACTION_MODE },
{ "QUICK_MODE", IPIKE_ISAKMP_EXCH_QUICK_MODE },
#endif
#ifdef IPIKE_USE_VERSION2
{ "IKE_SA_INIT", IPIKE2_ISAKMP_EXCH_IKE_SA_INIT },
{ "IKE_AUTH", IPIKE2_ISAKMP_EXCH_IKE_AUTH },
{ "CREATE_CHILD_SA", IPIKE2_ISAKMP_EXCH_CREATE_CHILD_SA },
{ "INFORMATIONAL", IPIKE2_ISAKMP_EXCH_INFORMATIONAL },
#endif
{ IP_NULL, 0 }
};
static const Ipike_string_int_map payload_map[] = {
{ "none", IPIKE_PAYLOAD_NONE },
#ifdef IPIKE_USE_VERSION1
{ "security association", IPIKE_PAYLOAD_SECURITY_ASSOCIATION },
{ "proposal", IPIKE_PAYLOAD_PROPOSAL },
{ "transform", IPIKE_PAYLOAD_TRANSFORM },
{ "key exchange", IPIKE_PAYLOAD_KEY_EXCHANGE },
{ "identification", IPIKE_PAYLOAD_IDENTFICATION },
{ "certificate", IPIKE_PAYLOAD_CERTIFICATE },
{ "certificate request", IPIKE_PAYLOAD_CERTIFICATE_REQUEST },
{ "hash", IPIKE_PAYLOAD_HASH },
{ "signature", IPIKE_PAYLOAD_SIGNATURE },
{ "nonce", IPIKE_PAYLOAD_NONCE },
{ "notification", IPIKE_PAYLOAD_NOTIFICATION },
{ "delete", IPIKE_PAYLOAD_DELETE },
{ "vendor id", IPIKE_PAYLOAD_VENDOR_ID },
{ "attributes", IPIKE_PAYLOAD_ATTRIBUTES },
{ "nat discovery", IPIKE_PAYLOAD_NAT_DISCOVERY },
{ "nat original address", IPIKE_PAYLOAD_NAT_ORIGINAL_ADDRESS },
#endif
#ifdef IPIKE_USE_VERSION2
{ "security association", IPIKE2_PAYLOAD_SECURITY_ASSOCIATION },
{ "key exchange", IPIKE2_PAYLOAD_KEY_EXCHANGE },
{ "identification initiator", IPIKE2_PAYLOAD_IDENTIFICATION_I },
{ "identification responder", IPIKE2_PAYLOAD_IDENTIFICATION_R },
{ "certificate", IPIKE2_PAYLOAD_CERTIFICATE },
{ "certificate request", IPIKE2_PAYLOAD_CERTIFICATE_REQUEST },
{ "authentication", IPIKE2_PAYLOAD_AUTHENTICATION },
{ "nonce", IPIKE2_PAYLOAD_NONCE },
{ "notify", IPIKE2_PAYLOAD_NOTIFY },
{ "delete", IPIKE2_PAYLOAD_DELETE },
{ "vendor id", IPIKE2_PAYLOAD_VENDOR_ID },
{ "traffic selector initiator", IPIKE2_PAYLOAD_TRAFFIC_SELECTOR_I },
{ "traffic selector responder", IPIKE2_PAYLOAD_TRAFFIC_SELECTOR_R },
{ "encrypted", IPIKE2_PAYLOAD_ENCRYPTED },
{ "configuration", IPIKE2_PAYLOAD_CONFIGURATION },
{ "eap", IPIKE2_PAYLOAD_EAP },
#endif
{ IP_NULL, 0 }
};
static const Ipike_string_int_map notify_map[] = {
#ifdef IPIKE_USE_VERSION2
{ "UNSUPPORTED_CRITICAL_PAYLOAD", IPIKE_NOTI_ERR_UNSUPPORTED_CRITICAL_PAYLOAD },
{ "INVALID_IKE_SPI", IPIKE_NOTI_ERR_INVALID_IKE_SPI },
{ "INVALID_MAJOR_VERSION", IPIKE_NOTI_ERR_INVALID_MAJOR_VERSION },
{ "INVALID_SYNTAX", IPIKE_NOTI_ERR_INVALID_SYNTAX },
{ "INVALID_MESSAGE_ID", IPIKE_NOTI_ERR_INVALID_MESSAGE_ID },
{ "INVALID_SPI", IPIKE_NOTI_ERR_INVALID_SPI },
{ "NO_PROPOSAL_CHOSEN", IPIKE_NOTI_ERR_NO_PROPOSAL_CHOSEN },
{ "KE_PAYLOAD", IPIKE_NOTI_ERR_KE_PAYLOAD },
{ "INVALID ID TYPE", IPIKE_NOTI_ERR_INVALID_ID_INFORMATION },
{ "AUTHENTICATION_FAILED", IPIKE_NOTI_ERR_AUTHENTICATION_FAILED },
{ "SINGLE_PAIR_REQUIRED", IPIKE_NOTI_ERR_SINGLE_PAIR_REQUIRED },
{ "NO_ADDITIONAL_SAS", IPIKE_NOTI_ERR_NO_ADDITIONAL_SAS },
{ "INTERNAL_ADDRESS_FAILURE", IPIKE_NOTI_ERR_INTERNAL_ADDRESS_FAILURE },
{ "FAILED_CP_REQUIRED", IPIKE_NOTI_ERR_FAILED_CP_REQUIRED },
{ "TS_UNACCEPTABLE", IPIKE_NOTI_ERR_TS_UNACCEPTABLE },
{ "INVALID_SELECTORS", IPIKE_NOTI_ERR_INVALID_SELECTORS },
{ "UNACCEPTABLE_ADDRESSES", IPIKE_NOTI_ERR_UNACCEPTABLE_ADDRESSES },
{ "UNEXPECTED_NAT_DETECTED", IPIKE_NOTI_ERR_UNEXPECTED_NAT_DETECTED },
{ "INITIAL_CONTACT", IPIKE_NOTI_INF_INITIAL_CONTACT },
{ "SET_WINDOW_SIZE", IPIKE_NOTI_INF_SET_WINDOW_SIZE },
{ "ADDITIONAL_TS_POSSIBLE", IPIKE_NOTI_INF_ADDITIONAL_TS_POSSIBLE },
{ "IPCOMP_SUPPORTED", IPIKE_NOTI_INF_IPCOMP_SUPPORTED },
{ "NAT_DETECTION_SOURCE_IP", IPIKE_NOTI_INF_NAT_DETECTION_SOURCE_IP },
{ "NAT_DETECTION_DESTINATION_IP", IPIKE_NOTI_INF_NAT_DETECTION_DESTINATION_IP },
{ "COOKIE", IPIKE_NOTI_INF_COOKIE },
{ "USE_TRANSPORT_MODE", IPIKE_NOTI_INF_USE_TRANSPORT_MODE },
{ "HTTP_CERT_LOOKUP_SUPPORTED", IPIKE_NOTI_INF_HTTP_CERT_LOOKUP_SUPPORTED },
{ "REKEY_SA", IPIKE_NOTI_INF_REKEY_SA },
{ "ESP_TFC_PADDING_NOT_SUPPORTED", IPIKE_NOTI_INF_ESP_TFC_PADDING_NOT_SUPPORTED },
{ "NON_FIRST_FRAGMENTS_ALSO", IPIKE_NOTI_INF_NON_FIRST_FRAGMENTS_ALSO },
{ "MOBIKE_SUPPORTED", IPIKE_NOTI_INF_MOBIKE_SUPPORTED },
{ "ADDITIONAL_IP4_ADDRESS", IPIKE_NOTI_INF_ADDITIONAL_IP4_ADDRESS },
{ "ADDITIONAL_IP6_ADDRESS", IPIKE_NOTI_INF_ADDITIONAL_IP6_ADDRESS },
{ "NO_ADDITIONAL_ADDRESSES", IPIKE_NOTI_INF_NO_ADDITIONAL_ADDRESSES },
{ "UPDATE_SA_ADDRESSES", IPIKE_NOTI_INF_UPDATE_SA_ADDRESSES },
{ "COOKIE2", IPIKE_NOTI_INF_COOKIE2 },
{ "NO_NATS_ALLOWED", IPIKE_NOTI_INF_NO_NATS_ALLOWED },
{ "ROHC_SUPPORTED", IPIKE_NOTI_INF_ROHC_SUPPORTED },
#endif
{ IP_NULL, 0 }
};
static const Ipike_string_int_map rohc_type_map[] = {
{ "MAX_CID", IPIKE_ATTR_ROHC_MAX_CID },
{ "ROHC_PROFILE", IPIKE_ATTR_ROHC_PROFILE },
{ "ROHC_INTEG", IPIKE_ATTR_ROHC_INTEG },
{ "ROHC_ICV_LEN", IPIKE_ATTR_ROHC_ICV_LEN },
{ "MRRU", IPIKE_ATTR_ROHC_MRRU },
{ IP_NULL, 0 }
};
static const Ipike_string_int_map cp_type_map[] = {
{ "CFG_REQUEST", IPIKE_CFG_REQUEST },
{ "CFG_REPLY", IPIKE_CFG_RESPONSE },
{ "CFG_SET", IPIKE_CFG_SET },
{ "CFG_ACK", IPIKE_CFG_ACK },
{ IP_NULL, 0 }
};
static const Ipike_string_int_map cp_attr_map[] = {
{ "INTERNAL_IP4_ADDRESS", IPIKE_CFG_ATTR_INTERNAL_IP4_ADDRESS },
{ "INTERNAL_IP4_NETMASK", IPIKE_CFG_ATTR_INTERNAL_IP4_NETMASK },
{ "INTERNAL_IP4_DNS", IPIKE_CFG_ATTR_INTERNAL_IP4_DNS },
{ "INTERNAL_IP4_NBNS", IPIKE_CFG_ATTR_INTERNAL_IP4_NBNS },
{ "INTERNAL_ADDRESS_EXPIRY", IPIKE_CFG_ATTR_INTERNAL_ADDRESS_EXPIRY },
{ "INTERNAL_IP4_DHCP", IPIKE_CFG_ATTR_INTERNAL_IP4_DHCP },
{ "APPLICATION_VERSION", IPIKE_CFG_ATTR_APPLICATION_VERSION },
{ "INTERNAL_IP6_ADDRESS", IPIKE_CFG_ATTR_INTERNAL_IP6_ADDRESS },
{ "INTERNAL_IP6_NETMASK", IPIKE_CFG_ATTR_INTERNAL_IP6_NETMASK },
{ "INTERNAL_IP6_DNS", IPIKE_CFG_ATTR_INTERNAL_IP6_DNS },
{ "INTERNAL_IP6_NBNS", IPIKE_CFG_ATTR_INTERNAL_IP6_NBNS },
{ "INTERNAL_IP6_DHCP", IPIKE_CFG_ATTR_INTERNAL_IP6_DHCP },
{ "INTERNAL_IP4_SUBNET", IPIKE_CFG_ATTR_INTERNAL_IP4_SUBNET },
{ "SUPPORTED_ATTRIBUTES", IPIKE_CFG_ATTR_SUPPORTED_ATTRIBUTES },
{ "INTERNAL_IP6_SUBNET", IPIKE_CFG_ATTR_INTERNAL_IP6_SUBNET },
{ IP_NULL, 0 }
};
static const Ipike_string_int_map id_type_map[] = {
{ "address", IPIKE_ID_IPV4_ADDR },
{ "address6", IPIKE_ID_IPV6_ADDR },
{ "network", IPIKE_ID_IPV4_ADDR_SUBNET },
{ "network6", IPIKE_ID_IPV6_ADDR_SUBNET },
{ "fqdn", IPIKE_ID_FQDN },
{ "user_fqdn", IPIKE_ID_USER_FQDN },
{ "asn1_dn", IPIKE_ID_DER_ASN1_DN },
{ "asn1_gn", IPIKE_ID_DER_ASN1_GN },
{ "keyid", IPIKE_ID_KEY_ID },
{ IP_NULL, 0 }
};
static const Ipike_string_int_map id_proto_map[] = {
{ "icmpv6", IP_IPPROTO_ICMPV6 },
{ "icmp", IP_IPPROTO_ICMP },
{ "tcp", IP_IPPROTO_TCP },
{ "udp", IP_IPPROTO_UDP },
{ "any", 0 },
{ IP_NULL, 0 }
};
static const Ipike_string_int_map proposal_proto_map[] = {
{ "ISAKMP", IPIKE_PROTO_ISAKMP },
{ "IPSEC_AH", IPIKE_PROTO_IPSEC_AH },
{ "IPSEC_ESP", IPIKE_PROTO_IPSEC_ESP },
{ "IPCOMP", IPIKE_PROTO_IPCOMP },
{ IP_NULL, 0 }
};
static const Ipike_string_int_map isakmp_trans_id_map[] = {
{ "IKE_KEY", IPIKE_IKE_KEY },
{ IP_NULL, 0 }
};
static const Ipike_string_int_map transform_type_map[] = {
#ifdef IPIKE_USE_VERSION2
{ "encr", IPIKE_TRANSFORM_TYPE_ENCR },
{ "prf", IPIKE_TRANSFORM_TYPE_PRF },
{ "integ", IPIKE_TRANSFORM_TYPE_INTEG },
{ "dh", IPIKE_TRANSFORM_TYPE_DH },
{ "esn", IPIKE_TRANSFORM_TYPE_ESN },
#endif
{ IP_NULL, 0 }
};
static const Ipike_string_int_map transform_encr_id_map[] = {
#ifdef IPIKE_USE_VERSION2
#ifndef OPENSSL_NO_DES
{ "des_iv64", IPIKE_ENCR_DES_IV64 },
{ "des", IPIKE_ENCR_DES },
{ "3des", IPIKE_ENCR_3DES },
{ "des_iv32", IPIKE_ENCR_DES_IV32 },
#endif
#ifndef OPENSSL_NO_RC5
{ "rc5", IPIKE_ENCR_RC5 },
#endif
#ifndef OPENSSL_NO_IDEA
{ "idea", IPIKE_ENCR_IDEA },
{ "3idea", IPIKE_ENCR_3IDEA },
#endif
#ifndef OPENSSL_NO_CAST
{ "cast", IPIKE_ENCR_CAST },
#endif
#ifndef OPENSSL_NO_BF
{ "blowfish", IPIKE_ENCR_BLOWFISH },
{ "blf", IPIKE_ENCR_BLOWFISH },
#endif
#ifndef OPENSSL_NO_AES
{ "aes", IPIKE_ENCR_AES_CBC },
{ "aes128", IPIKE_ENCR_AES_CBC },
{ "aes192", IPIKE_ENCR_AES_CBC },
{ "aes256", IPIKE_ENCR_AES_CBC },
{ "aes128cbc", IPIKE_ENCR_AES_CBC },
{ "aes192cbc", IPIKE_ENCR_AES_CBC },
{ "aes256cbc", IPIKE_ENCR_AES_CBC },
{ "aesctr", IPIKE_ENCR_AES_CTR },
{ "aes128ctr", IPIKE_ENCR_AES_CTR },
{ "aes192ctr", IPIKE_ENCR_AES_CTR },
{ "aes256ctr", IPIKE_ENCR_AES_CTR },
#endif
{ "null", IPIKE_ENCR_NULL },
#endif
{ "any", -1 },
{ IP_NULL, 0 }
};
static const Ipike_string_int_map transform_prf_id_map[] = {
#ifdef IPIKE_USE_VERSION2
#if !defined(OPENSSL_NO_MD5) && !defined(OPENSSL_FIPS)
{ "md5", IPIKE_PRF_HMAC_MD5 },
#endif
#ifndef OPENSSL_NO_SHA
{ "sha1", IPIKE_PRF_HMAC_SHA1 },
#ifndef OPENSSL_NO_SHA256
{ "sha256", IPIKE_PRF_HMAC_SHA2_256},
#endif
#ifndef OPENSSL_NO_SHA384
{ "sha384", IPIKE_PRF_HMAC_SHA2_384},
{ "sha512", IPIKE_PRF_HMAC_SHA2_512},
#endif
#endif
#ifndef OPENSSL_NO_AES
{ "aes128", IPIKE_PRF_AES128_CBC },
#endif
#endif
{ "any", -1 },
{ IP_NULL, 0 }
};
static const Ipike_string_int_map transform_integ_id_map[] = {
#ifdef IPIKE_USE_VERSION2
#if !defined(OPENSSL_NO_MD5) && !defined(OPENSSL_FIPS)
{ "md5", IPIKE_AUTH_HMAC_MD5_96 },
#endif
#ifndef OPENSSL_NO_SHA
{ "sha1", IPIKE_AUTH_HMAC_SHA1_96 },
#ifndef OPENSSL_NO_SHA256
{ "sha256", IPIKE_AUTH_HMAC_SHA2_256_128 },
#endif
#ifndef OPENSSL_NO_SHA512
{ "sha384", IPIKE_AUTH_HMAC_SHA2_384_192 },
{ "sha512", IPIKE_AUTH_HMAC_SHA2_512_256 },
#endif
#endif
#ifndef OPENSSL_NO_AES
{ "aes", IPIKE_AUTH_AES_XCBC_96 },
#endif
#endif
{ "any", -1 },
{ IP_NULL, 0 }
};
static const Ipike_string_int_map ipsec_ah_trans_id_map[] = {
#if !defined(OPENSSL_NO_MD5) && !defined(OPENSSL_FIPS)
{ "md5", IPIKE_IPSEC_AH_MD5 },
#endif
#ifndef OPENSSL_NO_SHA
{ "sha1", IPIKE_IPSEC_AH_SHA },
#ifndef OPENSSL_NO_SHA256
{ "sha256", IPIKE_IPSEC_AH_SHA2_256 },
{ "sha384", IPIKE_IPSEC_AH_SHA2_384 },
#endif
#ifndef OPENSSL_NO_SHA512
{ "sha512", IPIKE_IPSEC_AH_SHA2_512 },
#endif
#endif
#ifndef OPENSSL_NO_AES
{ "aes", IPIKE_IPSEC_AH_AES_XCBC_MAC },
#endif
{ "any", -1 },
{ IP_NULL, 0 }
};
static const Ipike_string_int_map ipsec_esp_trans_id_map[] = {
#ifndef OPENSSL_NO_DES
{ "des_iv64", IPIKE_IPSEC_ESP_DES_IV64 },
{ "des", IPIKE_IPSEC_ESP_DES },
{ "des_iv32", IPIKE_IPSEC_ESP_DES_IV32 },
{ "3des", IPIKE_IPSEC_ESP_3DES },
#endif
#ifndef OPENSSL_NO_RC5
{ "rc5", IPIKE_IPSEC_ESP_RC5 },
#endif
#ifndef OPENSSL_NO_IDEA
{ "idea", IPIKE_IPSEC_ESP_IDEA },
{ "3idea", IPIKE_IPSEC_ESP_3IDEA },
#endif
#ifndef OPENSSL_NO_CAST
{ "cast", IPIKE_IPSEC_ESP_CAST },
#endif
#ifndef OPENSSL_NO_BF
{ "blowfish", IPIKE_IPSEC_ESP_BLOWFISH },
{ "blf", IPIKE_IPSEC_ESP_BLOWFISH },
#endif
#ifndef OPENSSL_NO_RC4
{ "rc4", IPIKE_IPSEC_ESP_RC4 },
#endif
#ifndef OPENSSL_NO_AES
{ "aes", IPIKE_IPSEC_ESP_AESCBC },
{ "aes128", IPIKE_IPSEC_ESP_AESCBC },
{ "aes192", IPIKE_IPSEC_ESP_AESCBC },
{ "aes256", IPIKE_IPSEC_ESP_AESCBC },
{ "aes128cbc", IPIKE_IPSEC_ESP_AESCBC },
{ "aes192cbc", IPIKE_IPSEC_ESP_AESCBC },
{ "aes256cbc", IPIKE_IPSEC_ESP_AESCBC },
{ "aesctr", IPIKE_IPSEC_ESP_AESCTR },
{ "aes128ctr", IPIKE_IPSEC_ESP_AESCTR },
{ "aes192ctr", IPIKE_IPSEC_ESP_AESCTR },
{ "aes256ctr", IPIKE_IPSEC_ESP_AESCTR },
#endif
{ "null", IPIKE_IPSEC_ESP_NULL },
{ "any", -1 },
{ IP_NULL, 0 }
};
/* store key length as top 16 bits */
static const Ipike_string_int_map ipsec_esp_key_length_map[] = {
#ifdef IPIKE_USE_VERSION2
#ifndef OPENSSL_NO_AES
{ "aes128", (IPIKE_IPSEC_ESP_AESCBC + ((128/8) << 16))},
{ "aes192", (IPIKE_IPSEC_ESP_AESCBC + ((192/8) << 16))},
{ "aes256", (IPIKE_IPSEC_ESP_AESCBC + ((256/8) << 16))},
{ "aes128cbc", (IPIKE_IPSEC_ESP_AESCBC + ((128/8) << 16))},
{ "aes192cbc", (IPIKE_IPSEC_ESP_AESCBC + ((192/8) << 16))},
{ "aes256cbc", (IPIKE_IPSEC_ESP_AESCBC + ((256/8) << 16))},
{ "aes128ctr", (IPIKE_IPSEC_ESP_AESCTR + ((128/8) << 16))},
{ "aes192ctr", (IPIKE_IPSEC_ESP_AESCTR + ((192/8) << 16))},
{ "aes256ctr", (IPIKE_IPSEC_ESP_AESCTR + ((256/8) << 16))},
#endif
#ifndef OPENSSL_NO_BF
{ "blowfish", (IPIKE_IPSEC_ESP_BLOWFISH + ((128/8) << 16))},
#endif
#ifndef OPENSSL_NO_CAST
{ "cast", (IPIKE_IPSEC_ESP_CAST + ((128/8) << 16))},
#endif
#endif
{ IP_NULL, 0 }
};
static const Ipike_string_int_map ipsec_ipcomp_trans_id_map[] = {
{ "IPCOMP_OUI", IPIKE_IPSEC_IPCOMP_OUI },
{ "IPCOMP_DEFLATE", IPIKE_IPSEC_IPCOMP_DEFLATE },
{ "IPCOMP_LZS", IPIKE_IPSEC_IPCOMP_LZS },
{ IP_NULL, 0 }
};
static const Ipike_string_int_map cert_encode_type_map[] = {
{ "CERT_PKCS7", IPIKE_CERT_PKCS_7 },
{ "CERT_PGP", IPIKE_CERT_PGP },
{ "CERT_SIGNED_KEY", IPIKE_CERT_SIGNED_KEY },
{ "CERT_X509_SIGNATURE", IPIKE_CERT_X509_SIGNATURE },
{ "CERT_X509_KEY_EXCHANGE", IPIKE_CERT_X509_KEY_EXCHANGE },
{ "CERT_KERBEROS_TOKENS", IPIKE_CERT_KERBEROS_TOKENS },
{ "CERT_CRL", IPIKE_CERT_CRL },
{ "CERT_ARL", IPIKE_CERT_ARL },
{ "CERT_SPKI", IPIKE_CERT_SPKI },
{ "CERT_SIGNED_KEY", IPIKE_CERT_SIGNED_KEY },
{ "CERT_X509_ATTRIBUTE", IPIKE_CERT_X509_ATTRIBUTE },
{ "IPIKE_CERT_X509_HASH_AND_URL", IPIKE_CERT_X509_HASH_AND_URL },
{ "OCSP_CONTENT",IPIKE_OCSP_CONTENT },
{ IP_NULL, 0 }
};
static const Ipike_string_int_map x509_verify_err_map[] = {
{ "X509_V_OK", X509_V_OK },
{ "X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT", X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT },
{ "X509_V_ERR_UNABLE_TO_GET_CRL", X509_V_ERR_UNABLE_TO_GET_CRL },
{ "X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE", X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE },
{ "X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE", X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE },
{ "X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY", X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY },
{ "X509_V_ERR_CERT_SIGNATURE_FAILURE", X509_V_ERR_CERT_SIGNATURE_FAILURE },
{ "X509_V_ERR_CRL_SIGNATURE_FAILURE", X509_V_ERR_CRL_SIGNATURE_FAILURE },
{ "X509_V_ERR_CERT_NOT_YET_VALID", X509_V_ERR_CERT_NOT_YET_VALID },
{ "X509_V_ERR_CERT_HAS_EXPIRED", X509_V_ERR_CERT_HAS_EXPIRED },
{ "X509_V_ERR_CRL_NOT_YET_VALID", X509_V_ERR_CRL_NOT_YET_VALID },
{ "X509_V_ERR_CRL_HAS_EXPIRED", X509_V_ERR_CRL_HAS_EXPIRED },
{ "X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD", X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD },
{ "X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD", X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD },
{ "X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD", X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD },
{ "X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD", X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD },
{ "X509_V_ERR_OUT_OF_MEM", X509_V_ERR_OUT_OF_MEM },
{ "X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT", X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT },
{ "X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN", X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN },
{ "X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY", X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY },
{ "X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE", X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE },
{ "X509_V_ERR_CERT_CHAIN_TOO_LONG", X509_V_ERR_CERT_CHAIN_TOO_LONG },
{ "X509_V_ERR_CERT_REVOKED", X509_V_ERR_CERT_REVOKED },
{ "X509_V_ERR_INVALID_CA", X509_V_ERR_INVALID_CA },
{ "X509_V_ERR_PATH_LENGTH_EXCEEDED", X509_V_ERR_PATH_LENGTH_EXCEEDED },
{ "X509_V_ERR_INVALID_PURPOSE", X509_V_ERR_INVALID_PURPOSE },
{ "X509_V_ERR_CERT_UNTRUSTED", X509_V_ERR_CERT_UNTRUSTED },
{ "X509_V_ERR_CERT_REJECTED", X509_V_ERR_CERT_REJECTED },
{ "X509_V_ERR_SUBJECT_ISSUER_MISMATCH", X509_V_ERR_SUBJECT_ISSUER_MISMATCH },
{ "X509_V_ERR_AKID_SKID_MISMATCH", X509_V_ERR_AKID_SKID_MISMATCH },
{ "X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH", X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH },
{ "X509_V_ERR_KEYUSAGE_NO_CERTSIGN", X509_V_ERR_KEYUSAGE_NO_CERTSIGN },
{ "X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER", X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER },
{ "X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION", X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION },
{ "X509_V_ERR_APPLICATION_VERIFICATION", X509_V_ERR_APPLICATION_VERIFICATION },
{ IP_NULL, 0 }
};
static const Ipike_string_int_map eap_code_map[] = {
#ifdef IPIKE_USE_EAP
{ "request", IPIKE_EAP_REQUEST },
{ "response", IPIKE_EAP_RESPONSE },
{ "success", IPIKE_EAP_SUCCESS },
{ "failure", IPIKE_EAP_FAILURE },
#endif
{ IP_NULL, 0 }
};
ipike.authentication_method_map = authentication_method_map;
ipike.v2_authentication_method_map = v2_authentication_method_map;
ipike.encryption_algorithm_map = encryption_algorithm_map;
ipike.v2_encryption_algorithm_map = v2_encryption_algorithm_map;
ipike.encryption_algorithm_map2 = encryption_algorithm_map2;
ipike.v2_encryption_algorithm_map2 = v2_encryption_algorithm_map2;
ipike.hash_algorithm_map = hash_algorithm_map;
ipike.dh_group_map = dh_group_map;
ipike.life_type_map = life_type_map;
ipike.encapsulation_mode_map = encapsulation_mode_map;
ipike.authentication_algorithm_map = authentication_algorithm_map;
ipike.doi_map = doi_map;
ipike.exchange_map = exchange_map;
ipike.payload_map = payload_map;
ipike.notify_map = notify_map;
ipike.cp_type_map = cp_type_map;
ipike.cp_attr_map = cp_attr_map;
ipike.id_type_map = id_type_map;
ipike.id_proto_map = id_proto_map;
ipike.proposal_proto_map = proposal_proto_map;
ipike.isakmp_trans_id_map = isakmp_trans_id_map;
ipike.transform_type_map = transform_type_map;
ipike.transform_encr_id_map = transform_encr_id_map;
ipike.transform_prf_id_map = transform_prf_id_map;
ipike.transform_integ_id_map = transform_integ_id_map;
ipike.transform_dh_id_map = dh_group_map;
ipike.ipsec_ah_trans_id_map = ipsec_ah_trans_id_map;
ipike.ipsec_esp_trans_id_map = ipsec_esp_trans_id_map;
ipike.ipsec_esp_key_length_map = ipsec_esp_key_length_map;
ipike.ipsec_ipcomp_trans_id_map = ipsec_ipcomp_trans_id_map;
ipike.cert_encode_type_map = cert_encode_type_map;
ipike.x509_verify_err_map = x509_verify_err_map;
ipike.eap_code_map = eap_code_map;
ipike.rohc_map = rohc_type_map;
/* Some sanity checks */
ipike_map_check_algorithms();
return IPIKE_SUCCESS;
}
IP_PUBLIC void
ipike_map_shutdown(void)
{
}
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_map.h
+97
View File
@@ -0,0 +1,97 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_map.h,v $ $Revision: 1.2 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_map.h,v $
* $Author: edahlber $ $Date: 2010-04-23 15:31:40 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#ifndef IPIKE_MAP_H
#define IPIKE_MAP_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/*
Registers all the string-int mappings used by IKE.
*/
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_config.h"
#include "ipike.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_map_startup
*===========================================================================
* Description: Registers all the string-int mappings to be used.
* Parameters:
* Returns:
*/
IP_GLOBAL Ipike_error
ipike_map_startup(void);
/*
*===========================================================================
* ipike_map_shutdown
*===========================================================================
* Description:
* Parameters:
* Returns:
*/
IP_GLOBAL void
ipike_map_shutdown(void);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_payload.c
+705
View File
@@ -0,0 +1,705 @@
/*
******************************************************************************
* SOURCE FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_RCPL8_2024030303 $ $RCSfile: ipike_payload.c,v $ $Revision: 1.38.10.9 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_payload.c,v $
* $Author: wdeng $ $Date: 2021-11-05 09:51:39 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_h.h"
#include "ipike_payload.h"
#include "ipike2_payload_authentication.h"
#include "ipike2_payload_configuration.h"
#include "ipike2_payload_delete.h"
#include "ipike2_payload_encrypted.h"
#include "ipike2_payload_identification.h"
#include "ipike2_payload_key_exchange.h"
#include "ipike2_payload_notify.h"
#include "ipike2_payload_sa.h"
#include "ipike2_payload_traffic_selector.h"
#include "ipike2_payload_eap.h"
#include "ipike_payload_sa.h"
#include "ipike_payload_key_exchange.h"
#include "ipike_payload_nonce.h"
#include "ipike_payload_delete.h"
#include "ipike_payload_identification.h"
#include "ipike_payload_notification.h"
#include "ipike_payload_hash.h"
#include "ipike_payload_certificate.h"
#include "ipike_payload_sign.h"
#include "ipike_payload_vendor_id.h"
#include "ipike_payload_nat.h"
#include <ipcom_clib.h>
#include <ipcom_syslog.h>
/*
****************************************************************************
* 4 EXTERN PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 5 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 6 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 7 LOCAL PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 8 DATA
****************************************************************************
*/
/*
****************************************************************************
* 9 LOCAL FUNCTIONS
****************************************************************************
*/
/*
****************************************************************************
* 10 PUBLIC FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_check_payloads
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_check_payloads(Ipike_isakmp_header *isakmp,Ip_bool phase1)
{
Ipike_error err = IPIKE_SUCCESS;
Ipike_payload_header *payload;
Ip_u8 this_payload;
Ip_u32 max_length;
Ip_s32 chain_length;
Ipike_payload_enum ctx;
if (isakmp->next_payload == IPIKE_PAYLOAD_NONE)
{
/* The message may have no payloads for IKEv2, so accept if v2 message */
IPCOM_LOG0(DEBUG, "ipike_check_payloads() :: no payloads exist"\
" according to the ISAKMP header");
if (isakmp->version >= 0x20)
return IPIKE_SUCCESS;
else
return IPIKE_ISAKMP_NO_PAYLOAD;
}
this_payload = isakmp->next_payload;
max_length = (Ip_u32)(ip_ntohl(isakmp->length) - sizeof(Ipike_isakmp_header));
if (max_length == 0)
{
IPCOM_LOG0(DEBUG, "ipike_check_payloads() :: next_payload is not none"\
" but no payload exist");
return IPIKE_ISAKMP_PAYLOAD_LENGTH_ERROR;
}
payload = (Ipike_payload_header*)((Ip_u8*)isakmp + sizeof(Ipike_isakmp_header));
chain_length = ipike_payload_chain_size(payload, max_length);
if (chain_length < 0 || chain_length > 0xffff)
{
IPCOM_LOG0(ERR, "ipike_check_payloads() :: the payloads extends"\
" beyond the end of the ISAKMP package");
return IPIKE_ISAKMP_PAYLOAD_LENGTH_ERROR;
}
payload = ipike_first_payload(isakmp, &ctx);
while (IPIKE_SUCCESS == err && IPIKE_PAYLOAD_NONE != this_payload)
{
/* Check reserved field, must be zero in IKEv1 */
#ifdef IPIKE_USE_VERSION1
if ( isakmp->version == 0x10 )
{
if ( payload->flags != 0 )
{
IPCOM_LOG1(ERR, "ipike_check_payloads() :: "\
"invalid reserved field (0x%.2x)",
payload->flags);
err = IPIKE_ISAKMP_INVALID_PAYLOAD;
break;
}
switch (this_payload)
{
case IPIKE_PAYLOAD_SECURITY_ASSOCIATION:
err = ipike_sa_check_payload((Ipike_sa_payload*) payload,phase1);
break;
case IPIKE_PAYLOAD_KEY_EXCHANGE:
err = ipike_key_exchange_check_payload((Ipike_ke_payload*) payload);
break;
case IPIKE_PAYLOAD_IDENTFICATION:
err = ipike_identification_check_payload((Ipike_id_payload*) payload);
break;
case IPIKE_PAYLOAD_HASH:
err = ipike_hash_check_payload((Ipike_hash_payload*) payload);
break;
case IPIKE_PAYLOAD_NONCE:
err = ipike_payload_nonce_check((Ipike_nonce_payload*) payload);
break;
case IPIKE_PAYLOAD_NOTIFICATION:
err = ipike_notification_check_payload((Ipike_notification_payload*) payload);
break;
case IPIKE_PAYLOAD_CERTIFICATE:
err = ipike_payload_certificate_check((Ipike_cert_payload*) payload);
break;
case IPIKE_PAYLOAD_SIGNATURE:
err = ipike_sign_check_payload((Ipike_sign_payload*) payload);
break;
case IPIKE_PAYLOAD_DELETE:
err = ipike_payload_delete_check((Ipike_delete_payload*) payload);
break;
case IPIKE_PAYLOAD_VENDOR_ID:
err = ipike_payload_vendor_id_check((Ipike_vendor_id_payload*) payload);
break;
case IPIKE_PAYLOAD_ATTRIBUTES:
err = ipike_payload_configuration_check((Ipike2_cp_payload*) payload);
break;
case IPIKE_PAYLOAD_NAT_DISCOVERY:
err = ipike_nat_discovery_check_payload((Ipike_nat_discovery_payload*) payload);
break;
case IPIKE_PAYLOAD_NAT_ORIGINAL_ADDRESS:
err = ipike_nat_original_address_check_payload((Ipike_nat_org_addr_payload*) payload);
break;
case IPIKE_PAYLOAD_CERTIFICATE_REQUEST:
err = ipike_payload_certificate_request_check((Ipike_cert_req_payload*) payload);
break;
default:
IPCOM_LOG1(ERR, "ipike_check_payloads() :: payload check failed "\
"since %d is an unsupported payload type",
this_payload);
err = IPIKE_ISAKMP_UNSUPPORTED_PAYLOAD;
break;
}
} /* if ( isakmp->version == 0x10 ) */
#endif
#ifdef IPIKE_USE_VERSION2
else if ( isakmp->version >= 0x20 )
{
switch (this_payload)
{
case IPIKE2_PAYLOAD_SECURITY_ASSOCIATION:
err = ipike_payload_sa_check((Ipike2_sa_payload*) payload);
break;
case IPIKE2_PAYLOAD_KEY_EXCHANGE:
err = ipike_payload_key_exchange_check((Ipike2_ke_payload*) payload);
break;
case IPIKE2_PAYLOAD_IDENTIFICATION_I:
case IPIKE2_PAYLOAD_IDENTIFICATION_R:
err = ipike_payload_identification_check((Ipike2_id_payload*) payload);
break;
case IPIKE2_PAYLOAD_CERTIFICATE:
err = ipike_payload_certificate_check((Ipike_cert_payload*) payload);
break;
case IPIKE2_PAYLOAD_CERTIFICATE_REQUEST:
err = ipike_payload_certificate_request_check((Ipike_cert_req_payload*) payload);
break;
case IPIKE2_PAYLOAD_AUTHENTICATION:
err = ipike_payload_authentication_check((Ipike2_auth_payload*) payload);
break;
case IPIKE2_PAYLOAD_NONCE:
err = ipike2_payload_nonce_check((Ipike_nonce_payload*) payload);
break;
case IPIKE2_PAYLOAD_NOTIFY:
err = ipike_payload_notify_check((Ipike2_notify_payload*) payload);
break;
case IPIKE2_PAYLOAD_DELETE:
err = ipike2_payload_delete_check((Ipike2_del_payload*) payload);
break;
case IPIKE2_PAYLOAD_VENDOR_ID:
err = ipike_payload_vendor_id_check((Ipike_vendor_id_payload*) payload);
break;
case IPIKE2_PAYLOAD_TRAFFIC_SELECTOR_I:
case IPIKE2_PAYLOAD_TRAFFIC_SELECTOR_R:
err = ipike_payload_traffic_selector_check((Ipike2_ts_payload*) payload);
break;
case IPIKE2_PAYLOAD_CONFIGURATION:
err = ipike_payload_configuration_check((Ipike2_cp_payload*) payload);
break;
case IPIKE2_PAYLOAD_EAP:
err = ipike_payload_eap_check((Ipike2_eap_payload*) payload);
break;
default:
/* IKE v2 is capable of handling unknown payload types */
IPCOM_LOG1(WARNING, "ipike_check_payloads() :: payload check failed "\
"since %d is an unsupported payload type",
this_payload);
break;
} /* switch */
} /* if ( isakmp->version >= 0x20 ) */
#endif /* IPIKE_USE_VERSION2 */
if (err != IPIKE_SUCCESS)
break;
this_payload = payload->next_payload;
payload = ipike_next_payload(&ctx);
if (payload == IP_NULL && this_payload != IPIKE_PAYLOAD_NONE)
err = IPIKE_ISAKMP_PAYLOAD_LENGTH_ERROR;
} /* while */
ipike_free_payload_enumerator(&ctx);
return err;
}
/*
*===========================================================================
* ipike_first_payload
*===========================================================================
*/
#ifdef IPCOM_USE_DMALLOC
IP_GLOBAL Ipike_payload_header *
ipike_first_payload_debug(Ipike_isakmp_header *isakmp, Ipike_payload_enum *ctx, const char *file, const char *function, Ip_u32 line)
#else
IP_GLOBAL Ipike_payload_header *
ipike_first_payload(Ipike_isakmp_header *isakmp, Ipike_payload_enum *ctx)
#endif
{
Ip_u32 len;
ctx->real_header = (Ipike_payload_header *) ((Ip_u8*) isakmp + sizeof(Ipike_isakmp_header));
ctx->allocated_header = IP_NULL;
len = ip_ntohl(isakmp->length);
if (len < sizeof(Ipike_isakmp_header))
{
IPCOM_LOG1(DEBUG2, "ipike_first_payload - isakmp header length too small %d", len);
return IP_NULL;
}
else if (len == sizeof(Ipike_isakmp_header))
{
return IP_NULL; /* No payloads */
}
len -= (Ip_u32)sizeof(Ipike_isakmp_header);
ctx->max_len = (Ip_u32)ipike_payload_chain_size(ctx->real_header, len);
if (ctx->max_len == 0xffffffff)
{
IPCOM_LOG0(DEBUG2, "ipike_first_payload - bad payload chain size");
(void)ipike_print_memory(IPCOM_LOG_DEBUG2, " ISAKMP data:\n", (Ip_u8*)isakmp, ip_ntohl(isakmp->length));
return IP_NULL;
}
#ifdef IPCOM_USE_DMALLOC
return ipike_next_payload_debug(ctx, file, function, line);
#else
return ipike_next_payload(ctx);
#endif
}
/*
*===========================================================================
* ipike_next_payload
*===========================================================================
*/
#ifdef IPCOM_USE_DMALLOC
IP_GLOBAL Ipike_payload_header*
ipike_next_payload_debug(Ipike_payload_enum *ctx, const char *file, const char *function, Ip_u32 line)
#else
IP_GLOBAL Ipike_payload_header *
ipike_next_payload(Ipike_payload_enum *ctx)
#endif
{
Ipike_payload_header payload_test;
Ip_u16 len;
/* We may get alignment problem, so always make a copy */
ipcom_free(ctx->allocated_header);
ctx->allocated_header = IP_NULL;
if (IP_NULL == ctx->real_header)
return IP_NULL;
ipcom_memcpy((void*)&payload_test, (void*)ctx->real_header, sizeof(payload_test));
len = ip_htons(payload_test.length);
if ((ctx->max_len > 0) && (len > ctx->max_len))
return IP_NULL;
#ifdef IPCOM_USE_DMALLOC
ctx->allocated_header = ipcom_dcalloc(sizeof(Ipike_payload_header), len/sizeof(Ipike_payload_header) + 1, file, function, line);
#else
ctx->allocated_header = ipcom_calloc(sizeof(Ipike_payload_header), len/sizeof(Ipike_payload_header) + 1);
#endif
if (IP_NULL == ctx->allocated_header)
return IP_NULL;
ipcom_memcpy((void*)ctx->allocated_header, (void*)ctx->real_header, len);
if (IPIKE_PAYLOAD_NONE == ctx->real_header->next_payload)
ctx->real_header = IP_NULL;
else
ctx->real_header = (Ipike_payload_header*)(((Ip_u8*)ctx->real_header) + len);
return ctx->allocated_header;
}
/*
*===========================================================================
* ipike_payload_sa_next_proposal
*===========================================================================
*/
IP_GLOBAL Ipike_payload_header*
ipike_next_payload_structure(Ipike_payload_header* p)
{
if (p->next_payload == IPIKE_PAYLOAD_NONE)
return IP_NULL;
p = (Ipike_payload_header*)((Ip_u8*)p + ip_htons(p->length));
return p;
}
/*
*===========================================================================
* ipike_free_payload_enumerator
*===========================================================================
*/
IP_GLOBAL void
ipike_free_payload_enumerator(Ipike_payload_enum* ctx)
{
ipcom_free(ctx->allocated_header);
}
/*
*===========================================================================
* ipike_payload_array_size
*===========================================================================
*/
IP_GLOBAL Ip_u32
ipike_payload_array_size(Ipike_payload_header** payloads)
{
int i;
Ip_u32 size = 0;
if (IP_NULL != payloads)
for (i = 0; payloads[i] != IP_NULL; i++)
size += ip_ntohs(payloads[i]->length);
return size;
}
/*
*===========================================================================
* ipike_payload_chain_size
*===========================================================================
*/
IP_GLOBAL Ip_s32
ipike_payload_chain_size(Ipike_payload_header* first_payload, Ip_u32 max_size)
{
Ip_u32 size = 0;
Ipike_payload_header payload = {0};
if (max_size != 0 && max_size < sizeof(payload))
return -1;
while (1)
{
if (max_size - size < sizeof(payload))
return -1;
ipcom_memcpy((void*)&payload, (void*)(((Ip_u8*)first_payload)+size), sizeof(payload));
size += ip_htons(payload.length);
if (size > max_size)
return -1;
if ( payload.next_payload == IPIKE_PAYLOAD_NONE ||
payload.length == 0 ||
size == 0)
break;
}
return (Ip_s32) size;
}
/*
*===========================================================================
* ipike_payload_type_to_string
*===========================================================================
*/
IP_GLOBAL const char *
ipike_payload_type_to_string(Ip_u8 payload_type)
{
const char *s;
if (ipike_map_string(ipike.payload_map, payload_type, &s) != IPIKE_SUCCESS)
return "invalid payload type";
return s;
}
/*
*===========================================================================
* ipike_payload_print
*===========================================================================
*/
IP_GLOBAL void
ipike_payload_print(Ipike_isakmp_header* isakmp, Ip_bool is_phase1, int version)
{
Ip_u8 this_payload;
Ipike_payload_header *payload;
Ipike_payload_enum ctx;
this_payload = isakmp->next_payload;
payload = ipike_first_payload(isakmp, &ctx);
/* The last payload is either a none payload or an encrypted payload */
while (IP_NULL != payload
&& IPIKE_PAYLOAD_NONE != this_payload
&& IPIKE2_PAYLOAD_ENCRYPTED != this_payload)
{
IPCOM_LOG1(DEBUG2, " < %s >",
ipike_payload_type_to_string(this_payload));
IPCOM_LOG2(DEBUG2, " Next Payload: %s (%d)",
ipike_payload_type_to_string(payload->next_payload),
(int) payload->next_payload);
IPCOM_LOG2(DEBUG2, " Payload Length: %d (%#x)",
ip_ntohs(payload->length),
ip_ntohs(payload->length));
if ( version == 0x10 )
{
switch (this_payload)
{
#ifdef IPIKE_USE_VERSION1
case IPIKE_PAYLOAD_SECURITY_ASSOCIATION:
if (is_phase1)
ipike_sa_ike_print_payload((Ipike_sa_payload*) payload);
else
ipike_sa_ipsec_print_payload((Ipike_sa_payload*) payload);
break;
case IPIKE_PAYLOAD_KEY_EXCHANGE:
ipike_key_exchange_print_payload((Ipike_ke_payload*) payload);
break;
case IPIKE_PAYLOAD_IDENTFICATION:
ipike_identification_print_payload((Ipike_id_payload*) payload);
break;
case IPIKE_PAYLOAD_HASH:
ipike_hash_print_payload((Ipike_hash_payload*) payload);
break;
case IPIKE_PAYLOAD_NONCE:
ipike_payload_nonce_print((Ipike_nonce_payload*) payload);
break;
case IPIKE_PAYLOAD_NOTIFICATION:
ipike_notification_print_payload((Ipike_notification_payload*) payload);
break;
case IPIKE_PAYLOAD_CERTIFICATE:
ipike_payload_certificate_print((Ipike_cert_payload*) payload);
break;
case IPIKE_PAYLOAD_CERTIFICATE_REQUEST:
ipike_payload_certificate_request_print((Ipike_cert_req_payload*) payload);
break;
case IPIKE_PAYLOAD_SIGNATURE:
ipike_sign_print_payload((Ipike_sign_payload*) payload);
break;
case IPIKE_PAYLOAD_DELETE:
ipike_payload_delete_print((Ipike_delete_payload*) payload);
break;
case IPIKE_PAYLOAD_VENDOR_ID:
ipike_payload_vendor_id_print((Ipike_vendor_id_payload*) payload);
break;
case IPIKE_PAYLOAD_ATTRIBUTES:
ipike_payload_configuration_print((Ipike2_cp_payload*) payload);
break;
case IPIKE_PAYLOAD_NAT_DISCOVERY:
ipike_nat_discovery_print_payload((Ipike_nat_discovery_payload*) payload);
break;
case IPIKE_PAYLOAD_NAT_ORIGINAL_ADDRESS:
ipike_nat_original_address_print_payload((Ipike_nat_org_addr_payload*) payload);
break;
#endif /* IPIKE_USE_VERSION1 */
default:
IPCOM_LOG1(WARNING,
"printing of payload failed since %d is a unknown payload type", this_payload);
break;
}
}
else if ( version >= 0x20 )
{
switch (this_payload)
{
#ifdef IPIKE_USE_VERSION2
case IPIKE2_PAYLOAD_SECURITY_ASSOCIATION:
ipike_payload_sa_print((Ipike2_sa_payload*) payload);
break;
case IPIKE2_PAYLOAD_KEY_EXCHANGE:
ipike_payload_key_exchange_print((Ipike2_ke_payload*) payload);
break;
case IPIKE2_PAYLOAD_IDENTIFICATION_I:
case IPIKE2_PAYLOAD_IDENTIFICATION_R:
ipike_payload_identification_print((Ipike2_id_payload*) payload);
break;
case IPIKE2_PAYLOAD_CERTIFICATE:
ipike_payload_certificate_print((Ipike_cert_payload*) payload);
break;
case IPIKE2_PAYLOAD_CERTIFICATE_REQUEST:
ipike_payload_certificate_request_print((Ipike_cert_req_payload*) payload);
break;
case IPIKE2_PAYLOAD_AUTHENTICATION:
ipike_payload_authentication_print((Ipike2_auth_payload*) payload);
break;
case IPIKE2_PAYLOAD_NONCE:
ipike_payload_nonce_print((Ipike_nonce_payload*) payload);
break;
case IPIKE2_PAYLOAD_NOTIFY:
Ipike_payload_notify_print((Ipike2_notify_payload*) payload);
break;
case IPIKE2_PAYLOAD_DELETE:
ipike2_payload_delete_print((Ipike2_del_payload*) payload);
break;
case IPIKE2_PAYLOAD_VENDOR_ID:
break;
case IPIKE2_PAYLOAD_TRAFFIC_SELECTOR_I:
case IPIKE2_PAYLOAD_TRAFFIC_SELECTOR_R:
ipike_payload_traffic_selector_print((Ipike2_ts_payload*) payload);
break;
case IPIKE2_PAYLOAD_CONFIGURATION:
ipike_payload_configuration_print((Ipike2_cp_payload*) payload);
break;
case IPIKE2_PAYLOAD_EAP:
ipike_payload_eap_print((Ipike2_eap_payload*) payload);
break;
#endif /* IPIKE_USE_VERSION2 */
default:
IPCOM_LOG1(WARNING,
"printing of payload failed since %d is a unknown payload type", this_payload);
break;
}
}
this_payload = payload->next_payload;
payload = ipike_next_payload(&ctx);
}
ipike_free_payload_enumerator(&ctx);
}
/*
*===========================================================================
* ipike_is_ike_rekeying
*===========================================================================
* Check if we are doing IKE-rekeying (missing traffic selectors)
*/
#ifdef IPIKE_USE_VERSION2
IP_PUBLIC Ip_bool
ipike_is_ike_rekeying(Ipike_isakmp_header *isakmp)
{
Ipike_payload_header *payload;
Ip_u8 this_payload;
Ipike_payload_enum ctx;
Ip_bool is_ike_rekeying = IP_TRUE;
if (isakmp->exchange_type != IPIKE2_ISAKMP_EXCH_CREATE_CHILD_SA)
return IP_FALSE;
this_payload = isakmp->next_payload;
payload = ipike_first_payload(isakmp, &ctx);
while (this_payload != IPIKE_PAYLOAD_NONE && payload != IP_NULL)
{
switch (this_payload)
{
case IPIKE2_PAYLOAD_TRAFFIC_SELECTOR_I:
case IPIKE2_PAYLOAD_TRAFFIC_SELECTOR_R:
is_ike_rekeying = IP_FALSE;
break;
case IPIKE2_PAYLOAD_SECURITY_ASSOCIATION:
case IPIKE2_PAYLOAD_NONCE:
case IPIKE2_PAYLOAD_KEY_EXCHANGE:
case IPIKE2_PAYLOAD_NOTIFY:
break;
default:
ipike_free_payload_enumerator(&ctx);
return IP_FALSE; /* unexpected payload, be safe and ignore whole message */
}
this_payload = payload->next_payload;
payload = ipike_next_payload(&ctx);
}
ipike_free_payload_enumerator(&ctx);
return is_ike_rekeying;
}
/*
*===========================================================================
* ipike_exchange_verify_critial_payload
*===========================================================================
*/
IP_PUBLIC Ipike_error
ipike_payload_handle_unsupported_payload(
Ipike_value *notify_data,
Ipike_payload_header *payload,
Ip_u8 this_payload)
{
if (IPIKE_PAYLOAD_CRITICAL & payload->flags)
{
/* Critial payloads that are unsupported should be reported back to sender */
(void)ipike_cpy_data(notify_data, &this_payload, 1);
IPCOM_LOG2(ERR,
"ipike_payload_handle_unsupported_payload() :: '%s' (%d) is an unsupported payload type",
ipike_payload_type_to_string(this_payload), this_payload);
return IPIKE_ISAKMP_UNSUPPORTED_CRITICAL_PAYLOAD;
}
/* It's safe to ignore all payloads that isn't critical */
IPCOM_LOG2(DEBUG2,
"ipike_payload_handle_unsupported_payload() :: '%s' (%d) is an unsupported payload type",
ipike_payload_type_to_string(this_payload), this_payload);
return IPIKE_SUCCESS;
}
#endif /* IPIKE_USE_VERSION2 */
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_payload.h
+345
View File
@@ -0,0 +1,345 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_RCPL8_2024030303 $ $RCSfile: ipike_payload.h,v $ $Revision: 1.12.14.5 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_payload.h,v $
* $Author: wdeng $ $Date: 2021-06-16 08:38:22 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#ifndef IPIKE_PAYLOAD_H
#define IPIKE_PAYLOAD_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_config.h"
#include "ipike.h"
#include "ipike_isakmp.h"
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
#define IPIKE_PAYLOAD_NONE 0
#define IPIKE_PAYLOAD_SECURITY_ASSOCIATION 1
#define IPIKE_PAYLOAD_PROPOSAL 2
#define IPIKE_PAYLOAD_TRANSFORM 3
#define IPIKE_PAYLOAD_KEY_EXCHANGE 4
#define IPIKE_PAYLOAD_IDENTFICATION 5
#define IPIKE_PAYLOAD_CERTIFICATE 6
#define IPIKE_PAYLOAD_CERTIFICATE_REQUEST 7
#define IPIKE_PAYLOAD_HASH 8
#define IPIKE_PAYLOAD_SIGNATURE 9
#define IPIKE_PAYLOAD_NONCE 10
#define IPIKE_PAYLOAD_NOTIFICATION 11
#define IPIKE_PAYLOAD_DELETE 12
#define IPIKE_PAYLOAD_VENDOR_ID 13
#define IPIKE_PAYLOAD_ATTRIBUTES 14
#define IPIKE_PAYLOAD_NAT_DISCOVERY 20
#define IPIKE_PAYLOAD_NAT_ORIGINAL_ADDRESS 21
#define IPIKE2_PAYLOAD_SECURITY_ASSOCIATION 33
#define IPIKE2_PAYLOAD_KEY_EXCHANGE 34
#define IPIKE2_PAYLOAD_IDENTIFICATION_I 35
#define IPIKE2_PAYLOAD_IDENTIFICATION_R 36
#define IPIKE2_PAYLOAD_CERTIFICATE 37
#define IPIKE2_PAYLOAD_CERTIFICATE_REQUEST 38
#define IPIKE2_PAYLOAD_AUTHENTICATION 39
#define IPIKE2_PAYLOAD_NONCE 40
#define IPIKE2_PAYLOAD_NOTIFY 41
#define IPIKE2_PAYLOAD_DELETE 42
#define IPIKE2_PAYLOAD_VENDOR_ID 43
#define IPIKE2_PAYLOAD_TRAFFIC_SELECTOR_I 44
#define IPIKE2_PAYLOAD_TRAFFIC_SELECTOR_R 45
#define IPIKE2_PAYLOAD_ENCRYPTED 46
#define IPIKE2_PAYLOAD_CONFIGURATION 47
#define IPIKE2_PAYLOAD_EAP 48
/*
* COOKIE is also a NOTIFY payload but it needs special care because it needs
* to be placed as the first payload in the IKE exchange [RFC 4306].
*/
#define IPIKE2_PAYLOAD_COOKIE 49
#define IPIKE_PAYLOAD_TYPE(x) (x & 0x00ff)
#define IPIKE_PAYLOAD_HEADER_LENGTH sizeof(Ipike_payload_header)
/* Get data length from payload header (a is length and b payload size) */
#define IPIKE_PAYLOAD_DATA_LENGTH(a,b) (Ip_u16)((ip_htons(a) < b) ? 0 : (ip_htons(a) - b))
/* Or with the payload types to indicate optional payload,
used when specifying payload orders */
#define IPIKE_PAYLOAD_OPT ((Ip_u16) 0x8000)
/* Must this optional payload will be added by IPIKE */
#define IPIKE_PAYLOAD_ADD ((Ip_u16) 0x4000)
#define IPIKE_PAYLOAD_CRITICAL 0x80
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
Generic Payload Header
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Next Payload !C! RESERVED ! Payload Length !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
+ critical bit (v2)
*/
typedef struct Ipike_payload_header_struct
{
/* the id for the payload following this payload */
Ip_u8 next_payload;
/* flags (v2) */
Ip_u8 flags;
/* payload length octets are stored in network (big endian) byte order */
Ip_u16 length;
}
Ipike_payload_header;
typedef struct Ipike_payload_enum_struct
{
Ipike_payload_header* real_header;
Ipike_payload_header* allocated_header;
Ip_u32 max_len;
}
Ipike_payload_enum;
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_check_payloads
*===========================================================================
* Description: Verifies that the generic ISAKMP header for each payload
* is sane and that the sum of the payload sizes matches the
* size of the ISAKMP message.
* Parameters: isakmp - a pointer to the beginning of the isakmp message.
* Returns: IPIKE_SUCCESS
*
*
*/
IP_GLOBAL Ipike_error
ipike_check_payloads(Ipike_isakmp_header* isakmp,Ip_bool phase1);
/*
*===========================================================================
* ipike_first_payload
*===========================================================================
* Description: Returns a pointer to the first payload.
* Parameters: payload - a pointer to the current payload.
* Returns: A pointer to the first payload or IP_NULL if no payload exist.
*
*/
#ifdef IPCOM_USE_DMALLOC
IP_GLOBAL Ipike_payload_header *
ipike_first_payload_debug(Ipike_isakmp_header *isakmp, Ipike_payload_enum *ctx, const char *file, const char *function, Ip_u32 line);
#define ipike_first_payload(i,c) ipike_first_payload_debug(i,c, __FILE__, __FUNCTION__, __LINE__)
#else
IP_GLOBAL Ipike_payload_header *
ipike_first_payload(Ipike_isakmp_header *isakmp, Ipike_payload_enum *ctx);
#endif
/*
*===========================================================================
* ipike_next_payload
*===========================================================================
* Description: Returns a pointer to the next payload in the chain.
* Parameters: payload - a pointer to the current payload.
* Returns: the pointer to the next payload of IP_NULL if the 'next payload'
* field of the current payload is IPIKE_PAYLOAD_NONE.
*
*/
#ifdef IPCOM_USE_DMALLOC
IP_GLOBAL Ipike_payload_header*
ipike_next_payload_debug(Ipike_payload_enum *ctx, const char *file, const char *function, Ip_u32 line);
#define ipike_next_payload(c) ipike_next_payload_debug(c, __FILE__, __FUNCTION__, __LINE__)
#else
IP_GLOBAL Ipike_payload_header*
ipike_next_payload(Ipike_payload_enum* ctx);
#endif
/*
*===========================================================================
* ipike_next_payload_structure
*===========================================================================
* Description: Returns a pointer to the next payload in the chain.
* Parameters: payload - a pointer to the current payload.
* Returns: the pointer to the next payload of IP_NULL if the 'next payload'
* field of the current payload is IPIKE_PAYLOAD_NONE.
*
*/
IP_GLOBAL Ipike_payload_header*
ipike_next_payload_structure(Ipike_payload_header* payload);
/*
*===========================================================================
* ipike_free_payload_enumerator
*===========================================================================
*/
IP_GLOBAL void
ipike_free_payload_enumerator(Ipike_payload_enum* ctx);
/*
*===========================================================================
* ipike_payload_array_size
*===========================================================================
* Description: Returns the size (in bytes) of the sum of the payloads.
* Parameters: payloads - an IP_NULL terminated array of ISAKMP payloads.
* Returns: The total size in bytes of the payloads in the array.
*
*/
IP_GLOBAL Ip_u32
ipike_payload_array_size(Ipike_payload_header** payloads);
/*
*===========================================================================
* ipike_payload_chain_size
*===========================================================================
* Description: Returns the length of a payload chain.
* Parameters: first_payload - a pointer to the first payload in the chain.
* max_size - the maximum size the chain is allowed to have.
* Returns: The size (in bytes) of the payload chain or -1 if the chain
* was longer than max_size.
*
*/
IP_GLOBAL Ip_s32
ipike_payload_chain_size(Ipike_payload_header* first_payload, Ip_u32 max_size);
/*
*===========================================================================
* ipike_payload_type_to_string
*===========================================================================
* Description: Returns a texual representation of the payload type.
* Parameters: payload_type - the numerical value of the payload_type.
* Returns: A texual representation of the payload type.
*
*
*/
IP_GLOBAL const char*
ipike_payload_type_to_string(Ip_u8 payload_type);
/*
*===========================================================================
* ipike_payload_print
*===========================================================================
* Description: Prints the content of all payloads in a ISAKMP message to
* the system log.
* Parameters: isakmp - a pointer to the beginning of the isakmp message.
* is_phase1 - is IP_TRUE if the message is a phase 1 message.
* version - IKE version
* Returns: A texual representation of the payload type.
*
*
*/
IP_GLOBAL void
ipike_payload_print(Ipike_isakmp_header* isakmp, Ip_bool is_phase1, int version);
/*
*===========================================================================
* ipike_payload_check
*===========================================================================
* Description: Checks that the messages only contains payloads that is allowed
* in the current exchange and message.
* Parameters: isakmp - a pointer to a ISAKMP message.
* payload_types - an array of payload IDs which has the correct
* order for the current message in the current exchange.
* message_number - the message number in the current exchange.
* Returns: IPIKE_SUCCESS
* IPIKE_WRONG_PAYLOAD_ORDER
*
*/
IP_GLOBAL Ipike_error
ipike_payload_check(
Ipike_isakmp_header* isakmp,
const Ip_u16* payload_types,
int message_number);
#ifdef IPIKE_USE_VERSION2
/*
*===========================================================================
* ipike_is_ike_rekeying
*===========================================================================
* Check if we are doing IKE-rekeying (missing traffic selectors)
*/
IP_PUBLIC Ip_bool
ipike_is_ike_rekeying(Ipike_isakmp_header *isakmp);
/*
*===========================================================================
* ipike_payload_handle_unsupported_payload
*===========================================================================
* Description: Checks if the unsupported payload has the critical bit set,
if so it stores the payload type in the specified notify_data,
otherwise just log.
* Parameters: notify_data - Place to put the unsupported payload_type in
* in case of error.
* payload - Unsupported payload.
* this_payload - Type of the unsupported payload.
* Returns: IPIKE_SUCCESS
* IPIKE_ISAKMP_UNSUPPORTED_CRITICAL_PAYLOAD
*
*/
IP_PUBLIC Ipike_error
ipike_payload_handle_unsupported_payload(
Ipike_value *notify_data,
Ipike_payload_header *payload,
Ip_u8 this_payload);
#endif /* IPIKE_USE_VERSION2 */
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_payload_certificate.c
+890
View File
@@ -0,0 +1,890 @@
/*
******************************************************************************
* SOURCE FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_payload_certificate.c,v $ $Revision: 1.19.10.4 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_payload_certificate.c,v $
* $Author: edahlber $ $Date: 2012-02-15 08:41:53 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Certificate payload (RFC 2408, chapter 3.9) */
/* IKE version 1 and 2 */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_h.h"
#include "ipike_payload_certificate.h"
#include "ipike_crypto.h"
#include "ipike_util.h"
/*
****************************************************************************
* 4 EXTERN PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 5 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 6 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 7 LOCAL PROTOTYPES
****************************************************************************
*/
/*
*===========================================================================
* ipike_payload_certificate_data
*===========================================================================
* Description: Returns a pointer to the certificate data in the payload.
* Parameters: cert - A certificate payload.
* Returns: A pointer to the certificate data.
*
*/
IP_STATIC Ip_u8*
ipike_payload_certificate_data(Ipike_cert_payload* hash);
/*
*===========================================================================
* ipike_payload_certificate_data_length
*===========================================================================
* Description: Returns the length of the certificate data.
* Parameters: cert - A certificate payload.
* Returns: The length of the certificate data (in bytes).
*
*
*/
IP_STATIC Ip_u16
ipike_payload_certificate_data_length(Ipike_cert_payload* cert);
#ifdef IPIKE_USE_OCSP
/*
*===========================================================================
* ipike_payload_certificate_req_data
*===========================================================================
* Description: Returns a pointer to the certificate data in the payload.
* Parameters: cert - A certificate payload.
* Returns: A pointer to the certificate data.
*
*/
IP_STATIC Ip_u8*
ipike_payload_certificate_req_data(Ipike_cert_req_payload* hash);
/*
*===========================================================================
* ipike_payload_certificate_data_length
*===========================================================================
* Description: Returns the length of the certificate data.
* Parameters: cert - A certificate payload.
* Returns: The length of the certificate data (in bytes).
*
*
*/
IP_STATIC Ip_u16
ipike_payload_certificate_req_data_length(Ipike_cert_req_payload* certreq);
#endif /* IPIKE_USE_OCSP */
/*
****************************************************************************
* 8 DATA
****************************************************************************
*/
/*
****************************************************************************
* 9 LOCAL FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_payload_certificate_data
*===========================================================================
*/
IP_STATIC Ip_u8*
ipike_payload_certificate_data(Ipike_cert_payload* cert)
{
return (Ip_u8*) cert + 5;
}
/*
*===========================================================================
* ipike_payload_certificate_data_length
*===========================================================================
*/
IP_STATIC Ip_u16
ipike_payload_certificate_data_length(Ipike_cert_payload* cert)
{
return IPIKE_PAYLOAD_DATA_LENGTH(cert->header.length, 5);
}
/*
*===========================================================================
* ipike_payload_certificate_req_data
*===========================================================================
*/
IP_STATIC Ip_u8*
ipike_payload_certificate_req_data(Ipike_cert_req_payload* hash)
{
return (Ip_u8*) hash + 5;
}
/*
*===========================================================================
* ipike_payload_certificate_req_data_length
*===========================================================================
*/
IP_STATIC Ip_u16
ipike_payload_certificate_req_data_length(Ipike_cert_req_payload* certreq)
{
return IPIKE_PAYLOAD_DATA_LENGTH(certreq->header.length, 5);
}
/*
*===========================================================================
* ipike_payload_certificate_encode_type_to_string
*===========================================================================
*/
IP_STATIC const char*
ipike_payload_certificate_encode_type_to_string(Ip_u8 type)
{
const char* s;
if ((ipike_map_string(ipike.cert_encode_type_map, type, &s)))
return "unknown certificate encoding type";
return s;
}
/*
****************************************************************************
* 10 PUBLIC FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_payload_certificate_free
*===========================================================================
*/
IP_GLOBAL void
ipike_payload_certificate_free(Ipike_cert* cert)
{
if (IP_NULL != cert->local)
X509_free(cert->local);
if (IP_NULL != cert->peer)
X509_free(cert->peer);
if (IP_NULL != cert->peer_url)
ipcom_free((void*)cert->peer_url);
ipike_array_free((void**)cert->crls, (void(*)(void*)) X509_CRL_free);
ipike_array_free((void**)cert->ca, (void(*)(void*)) X509_free);
ipike_array_free((void**)cert->trusted, (void(*)(void*)) X509_free);
#ifdef IPIKE_USE_OCSP
if (IP_NULL != cert->resp_local)
OCSP_RESPONSE_free(cert->resp_local);
if (IP_NULL != cert->resp_peer)
OCSP_RESPONSE_free(cert->resp_peer);
#endif
ipcom_memset(cert, 0, sizeof(Ipike_cert));
}
/*
*===========================================================================
* ipike_payload_certificate_create
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_certificate_create(
X509* cert,
const char *url,
Ipike_cert_payload** payload
)
{
unsigned char* cert_data;
int cert_len;
int payload_len;
int encoding = IPIKE_CERT_X509_SIGNATURE;
if (IP_NULL == cert)
{
IPCOM_LOG0(ERR, "ipike_payload_certificate_create: no certificate specified, check configuration");
return IPIKE_INVALID_VALUE;
}
cert_len = i2d_X509(cert, IP_NULL);
if (cert_len <= 0)
{
IPCOM_LOG0(ERR,
"ipike_payload_certificate_create: failed to determine the length of the certificate");
return IPIKE_INVALID_VALUE;
}
payload_len = 5 + cert_len;
if (IP_NULL == (*payload = ipcom_calloc(1, (Ip_size_t) payload_len)))
{
IP_PANIC();
return IPIKE_OUT_OF_MEMORY;
}
cert_data = (unsigned char*)ipike_payload_certificate_data(*payload);
if (i2d_X509(cert, &cert_data) < 0)
{
IPIKE_FREEP(*payload);
IPCOM_LOG0(ERR, "ipike_payload_certificate_create: failed to encode the certificate");
return IPIKE_INVALID_VALUE;
}
#ifdef IPIKE_USE_VERSION2
if ( IP_NULL != url )
{
Ip_u8 *message_digest;
Ipike_value data;
Ipike_error err;
Ip_size_t url_len;
/* Length of URL including NULL termination */
url_len = ipcom_strlen(url);
IPCOM_LOG0(DEBUG2, "ipike_payload_certificate_create: Hash and URL enabled, sending hash of certificate");
/* Payload header + SHA1_HASH + url_base_len + NULL termination */
payload_len = 5 + SHA_DIGEST_LENGTH + (int)url_len + SHA_DIGEST_LENGTH + SHA_DIGEST_LENGTH + 1;
message_digest = ipcom_malloc((Ip_size_t)payload_len);
if ( !message_digest )
{
IP_PANIC();
return IPIKE_OUT_OF_MEMORY;
}
data.value = ipike_payload_certificate_data(*payload);
data.len = (Ip_size_t) cert_len;
if ( (err = ipike_crypto_sha_hash(&data, message_digest + 5)) != IPIKE_SUCCESS )
{
IPIKE_FREEP(*payload);
ipcom_free(message_digest);
IPCOM_LOG0(ERR, "ipike_payload_certificate_create: Failed to create SHA1 hash of the certificate");
return err;
}
/* Add URL base */
memcpy(message_digest + 5 + SHA_DIGEST_LENGTH, url, url_len);
/* Add hex representation of certificate, this will add a NULL termination */
ipike_bin2hex(message_digest + 5, SHA_DIGEST_LENGTH, (char *) message_digest + 5 + SHA_DIGEST_LENGTH + url_len);
ipcom_free(*payload);
*payload = (Ipike_cert_payload *) message_digest;
encoding = IPIKE_CERT_X509_HASH_AND_URL;
}
#else
/* Send hash of certificate is only supported in IKEv2 */
ip_assert(url == IP_NULL);
#endif
(*payload)->header.length = (Ip_u16)ip_htons(payload_len);
(*payload)->header.next_payload = IPIKE_PAYLOAD_CERTIFICATE;
(*payload)->cert_encoding = (Ip_u8) encoding;
return IPIKE_SUCCESS;
}
#ifdef IPIKE_USE_OCSP
/*
*===========================================================================
* ipike_payload_certificate_ocsp_create
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_certificate_ocsp_create(OCSP_RESPONSE* resp, Ipike_cert_payload** payload)
{
int resp_len;
int payload_len;
unsigned char* resp_data;
if (IP_NULL == resp)
{
IPCOM_LOG0(ERR, "ipike_payload_certificate_ocsp_create: no response specified, check configuration");
return IPIKE_INVALID_VALUE;
}
resp_len = i2d_OCSP_RESPONSE(resp, IP_NULL);
if (resp_len <= 0)
{
IPCOM_LOG0(ERR, "ipike_payload_certificate_ocsp_create: failed to determine the length of the response");
return IPIKE_INVALID_VALUE;
}
payload_len = 5 + resp_len;
if (IP_NULL == (*payload = ipcom_calloc(1, (Ip_size_t) payload_len)))
{
IP_PANIC();
return IPIKE_OUT_OF_MEMORY;
}
resp_data = (unsigned char*)ipike_payload_certificate_data(*payload);
if (i2d_OCSP_RESPONSE(resp, &resp_data) < 0)
{
IPCOM_LOG0(ERR, "ipike_payload_certificate_ocsp_create: failed to encode the response");
return IPIKE_INVALID_VALUE;
}
(*payload)->header.length = (Ip_u16) ip_htons(payload_len);
(*payload)->header.next_payload = IPIKE_PAYLOAD_CERTIFICATE;
(*payload)->cert_encoding = IPIKE_OCSP_CONTENT;
return IPIKE_SUCCESS;
}
#endif /* #ifdef IPIKE_USE_OCSP */
/*
*===========================================================================
* ipike_payload_certificate_req_create
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_certificate_req_create_v1(
Ipike_cert_req_payload** payload,
X509* ca_cert)
{
Ip_size_t payload_len = 0;
Ip_u8 *payload_data = IP_NULL;
X509_NAME *x509_name = IP_NULL;
int name_len = 0;
/* No trusted CA certificates => no certificate request payload */
if ( !ca_cert )
return IPIKE_SUCCESS;
/* Ignore non CA certificate */
if ( !ipike_crypto_is_ca_certificate(ca_cert) )
{
IPCOM_LOG0(DEBUG2, "ipike_payload_certificate_req_create_v1() :: "\
" skipping non-CA certificate");
return IPIKE_SUCCESS;
}
x509_name = X509_get_subject_name(ca_cert);
/* Should not happen, skip this CA if it happens */
if (!x509_name)
return IPIKE_SUCCESS;
name_len = i2d_X509_NAME(x509_name, IP_NULL);
/* Should not happen, skip this CA if it happens */
if ( name_len < 0 )
return IPIKE_FAILED;
IPCOM_LOG0(DEBUG2, "ipike_payload_certificate_req_create_v1() :: "\
" adding CA subject info into certificate request");
/* Calculate payload size */
payload_len = (Ip_size_t)name_len + IPIKE_CERT_REQ_HEADER_LENGTH;
/* Allocate payload */
if (IP_NULL == (*payload = ipcom_calloc(1, payload_len)))
{
IP_PANIC();
return IPIKE_OUT_OF_MEMORY;
}
/* Get payload data pointer */
payload_data = ipike_payload_certificate_req_data(*payload);
/* Encode to DER format into the payload data */
name_len = i2d_X509_NAME(x509_name, &payload_data);
if ( name_len < 0 )
{
IPCOM_LOG0(ERR, "ipike_payload_certificate_req_create_v1() :: "\
" failed to decode CA subject name");
ipcom_free(*payload);
*payload = IP_NULL;
/* Skip this CA */
return IPIKE_SUCCESS;
}
/* Set the rest of the payload fields */
(*payload)->cert_encoding = IPIKE_CERT_X509_SIGNATURE;
(*payload)->header.next_payload = IPIKE_PAYLOAD_CERTIFICATE_REQUEST;
(*payload)->header.length = (Ip_u16) ip_htons(payload_len);
return IPIKE_SUCCESS;
}
#ifdef IPIKE_USE_VERSION2
/*
*===========================================================================
* ipike_payload_certificate_req_create
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_certificate_req_create_v2(
Ipike_cert_req_payload** payload,
Ipike_cert *cert)
{
Ip_size_t payload_len = 0;
Ipike_error err = IPIKE_SUCCESS;
#ifdef IPIKE_USE_OCSP
/* Request OCSP */
if ( cert->resp_local != IP_NULL )
{
/* Only support CA signed OCSP responses*/
payload_len = IPIKE_CERT_REQ_HEADER_LENGTH;
if (IP_NULL == (*payload = ipcom_calloc(1, payload_len)))
{
IP_PANIC();
return IPIKE_OUT_OF_MEMORY;
}
(*payload)->cert_encoding = IPIKE_OCSP_CONTENT;
(*payload)->header.next_payload = IPIKE2_PAYLOAD_CERTIFICATE_REQUEST;
(*payload)->header.length = (Ip_u16) ip_htons(payload_len);
}
else if ( cert->trusted )
#endif
{
Ipike_value key_hashes;
Ip_u32 num_cas;
memset(&key_hashes, 0, sizeof(key_hashes));
IPCOM_LOG0(DEBUG2, "ipike_payload_certificate_req_create() :: adding public key hash to certificate request");
/* Get number of CAs we trust */
num_cas = ipike_array_size((void **)cert->trusted);
/* Send a sha1 hash of the public key of the CAs we trust */
payload_len = IPIKE_CERT_REQ_HEADER_LENGTH + (SHA_DIGEST_LENGTH * num_cas);
/* Allocate payload */
if (IP_NULL == (*payload = ipcom_calloc(1, payload_len)))
{
IP_PANIC();
return IPIKE_OUT_OF_MEMORY;
}
/* Get payload data pointer */
key_hashes.value = ipike_payload_certificate_req_data(*payload);
key_hashes.len = payload_len - IPIKE_CERT_REQ_HEADER_LENGTH;
/* Generate hashes */
err = ipike_crypto_generate_public_key_hashes(cert->trusted, &key_hashes);
if ( IPIKE_SUCCESS != err )
{
IPCOM_LOG1(DEBUG2,
"ipike_payload_certificate_req_create() :: failed to create hashes (%d)", err);
ipcom_free(*payload);
return err;
}
(*payload)->cert_encoding = IPIKE_CERT_X509_SIGNATURE;
(*payload)->header.next_payload = IPIKE2_PAYLOAD_CERTIFICATE_REQUEST;
(*payload)->header.length = (Ip_u16) ip_htons(payload_len);
}
return err;
}
#endif /* #ifdef IPIKE_USE_VERSION2 */
/*
*===========================================================================
* ipike_payload_certificate_check
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_certificate_check(Ipike_cert_payload* cert)
{
switch (cert->cert_encoding)
{
case IPIKE_CERT_X509_SIGNATURE:
return IPIKE_SUCCESS;
#ifdef IPIKE_USE_VERSION2
case IPIKE_CERT_X509_HASH_AND_URL:
return IPIKE_SUCCESS;
#endif
#ifdef IPIKE_USE_OCSP
case IPIKE_OCSP_CONTENT:
return IPIKE_SUCCESS;
#endif
default:
break;
}
IPCOM_LOG2(ERR,
"ipike_check_cert_payload: %s (%d) is a unsupported certificate encoding type",
ipike_payload_certificate_encode_type_to_string(cert->cert_encoding), cert->cert_encoding);
return IPIKE_INVALID_VALUE;
}
/*
*===========================================================================
* ipike_payload_certificate_request_check
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_certificate_request_check(Ipike_cert_req_payload* req)
{
switch (req->cert_encoding)
{
case IPIKE_CERT_X509_SIGNATURE:
return IPIKE_SUCCESS;
#ifdef IPIKE_USE_OCSP
case IPIKE_OCSP_CONTENT:
return IPIKE_SUCCESS;
#endif
case IPIKE_CERT_X509_HASH_AND_URL:
return IPIKE_SUCCESS;
/* Valid encodings but unsupported */
case IPIKE_CERT_PKCS_7:
case IPIKE_CERT_PGP:
case IPIKE_CERT_SIGNED_KEY:
case IPIKE_CERT_X509_KEY_EXCHANGE:
case IPIKE_CERT_KERBEROS_TOKENS:
case IPIKE_CERT_CRL:
case IPIKE_CERT_ARL:
case IPIKE_CERT_SPKI:
case IPIKE_CERT_X509_ATTRIBUTE:
IPCOM_LOG2(DEBUG2,
"ipike_check_certreq_payload() :: unsupported certificate request encoding type %s (%d)",
ipike_payload_certificate_encode_type_to_string(req->cert_encoding), req->cert_encoding);
return IPIKE_ISAKMP_CERT_TYPE_UNSUPPORTED;
default:
break;
}
IPCOM_LOG2(DEBUG2,
"ipike_check_certreq_payload() :: invalid certificate request encoding type %s (%d)",
ipike_payload_certificate_encode_type_to_string(req->cert_encoding), req->cert_encoding);
/* Ignored, until we support multiple certificates */
return IPIKE_ISAKMP_INVALID_CERT_ENCODING;
}
/*
*===========================================================================
* ipike_payload_certificate_print
*===========================================================================
*/
IP_GLOBAL void
ipike_payload_certificate_print(Ipike_cert_payload* cert)
{
(void)ipike_payload_certificate_encode_type_to_string; /* lint */
IPCOM_LOG1(DEBUG2, " encoding type: %s",
ipike_payload_certificate_encode_type_to_string(cert->cert_encoding));
(void)ipike_print_memory(IPCOM_LOG_DEBUG2, " value:\n",
ipike_payload_certificate_data(cert),
ipike_payload_certificate_data_length(cert));
}
/*
*===========================================================================
* ipike_payload_certificate_request_print
*===========================================================================
*/
IP_GLOBAL void
ipike_payload_certificate_request_print(Ipike_cert_req_payload* req)
{
/* Ignored until we support multiple certificates */
IPCOM_LOG1(DEBUG2, " encoding type: %s",
ipike_payload_certificate_encode_type_to_string(req->cert_encoding));
(void)ipike_print_memory(IPCOM_LOG_DEBUG2, " value:\n",
ipike_payload_certificate_req_data(req),
ipike_payload_certificate_req_data_length(req));
}
/*
*===========================================================================
* ipike_payload_certificate_extract
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_certificate_extract(
Ipike_cert_payload* payload,
Ipike_cert* cert)
{
Ipike_error err;
Ip_u8* cert_data;
X509* x509;
#ifdef IPIKE_USE_OCSP
OCSP_RESPONSE* ocsp_resp;
#endif
switch (payload->cert_encoding)
{
case IPIKE_CERT_X509_SIGNATURE:
cert_data = ipike_payload_certificate_data(payload);
x509 = d2i_X509(IP_NULL, (const unsigned char**)&cert_data, ipike_payload_certificate_data_length(payload));
if (IP_NULL == x509)
{
IPCOM_LOG1(CRIT,
"ipike_payload_certificate_extract: failed to decode the certificate (type %s)",
ipike_payload_certificate_encode_type_to_string(payload->cert_encoding));
return IPIKE_INVALID_VALUE;
}
else
{
if (ipike_crypto_is_ca_certificate(x509))
{
if (IPIKE_SUCCESS != (err = ipike_array_add((void***)&cert->ca, x509)))
{
IPCOM_LOG0(CRIT, "ipike_payload_certificate_extract: Out of memory");
X509_free(x509);
return err;
}
}
else
{
if (IP_NULL != cert->peer)
X509_free(cert->peer);
cert->peer = x509;
}
}
break;
#ifdef IPIKE_USE_VERSION2
case IPIKE_CERT_X509_HASH_AND_URL:
{
Ip_size_t cert_data_len;
if ( !ipike.use_hash_and_url )
{
IPCOM_LOG0(CRIT,
"ipike_payload_certificate_extract: hash and url support not enabled");
return IPIKE_INVALID_VALUE;
}
cert_data = ipike_payload_certificate_data(payload);
cert_data_len = ipike_payload_certificate_data_length(payload);
/* Expect a 20 byte SHA digest followed by an URL */
if ( cert_data_len <= SHA_DIGEST_LENGTH )
{
IPCOM_LOG1(ERR,
"ipike_cert_extract: Invalid length of \"Hash And URL\" data (type %d)",
cert_data_len);
return IPIKE_INVALID_VALUE;
}
/* Verify that the URL is NULL terminated */
if ( cert_data[cert_data_len - 1] != '\0' )
{
IPCOM_LOG0(ERR, "ipike_cert_extract: Invalid URL received in \"Hash And URL\" data") ;
return IPIKE_INVALID_VALUE;
}
cert->peer_url = ipcom_strdup( (char *) cert_data + SHA_DIGEST_LENGTH);
cert->peer = IP_NULL;
cert->ca = IP_NULL;
break;
}
#endif
#ifdef IPIKE_USE_OCSP
case IPIKE_OCSP_CONTENT:
cert_data = (unsigned char*)ipike_payload_certificate_data(payload);
ocsp_resp = d2i_OCSP_RESPONSE(IP_NULL, (const unsigned char**)&cert_data, ipike_payload_certificate_data_length(payload));
if (IP_NULL == ocsp_resp)
{
IPCOM_LOG1(CRIT,
"ipike_payload_certificate_extract: failed to decode the ocsp_response (type %s)",
ipike_payload_certificate_encode_type_to_string(payload->cert_encoding));
return IPIKE_INVALID_VALUE;
}
else
{
if (IP_NULL != cert->resp_peer)
OCSP_RESPONSE_free(cert->resp_peer);
cert->resp_peer = ocsp_resp;
}
break;
#endif /* IPIKE_USE_OCSP */
default:
IPCOM_LOG1(CRIT,
"ipike_payload_certificate_extract: %s not supported",
ipike_payload_certificate_encode_type_to_string(payload->cert_encoding));
return IPIKE_INVALID_VALUE;
}
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_payload_certificate_req_extract_v1
*===========================================================================
*/
IP_GLOBAL Ipike_error
ipike_payload_certificate_req_extract_v1(
Ipike_cert_req_payload *payload,
Ipike_cert *cert)
{
Ip_u8 *payload_data = IP_NULL;
Ip_size_t payload_len = 0;
payload_data = ipike_payload_certificate_req_data(payload);
payload_len = ipike_payload_certificate_req_data_length(payload);
/* It's valid for a peer to send an empty certificate request payload.
* See RFC4945 Section 3.2.7.2. */
if ( payload_len == 0 )
{
IPCOM_LOG0(DEBUG2, "ipike_payload_certificate_req_extract_v1() ::"\
" received empty certificate request payload");
return IPIKE_SUCCESS;
}
switch (payload->cert_encoding)
{
case IPIKE_CERT_X509_SIGNATURE:
{
/* Get preferred CA certificate to use. This information could be used
to separate tunnels by the CA certificate. This is not supported so
just accept the presence of this payload for now. In IKEv1 this
payload includes a DER encoded subject name of a CA which is
trusted by the peer */
X509_NAME *x509_name = IP_NULL;
x509_name = d2i_X509_NAME(IP_NULL,
(const unsigned char **)&payload_data,
(long)payload_len);
if ( !x509_name )
{
IPCOM_LOG0(ERR,
"ipike_payload_certificate_req_extract_v1() ::"\
" invalid CA format");
return IPIKE_ISAKMP_INVALID_CERT_AUTHORITY;
}
/* Find CA based on name, do nothing for now */
IPCOM_UNUSED_ARG(cert);
X509_NAME_free(x509_name);
break;
}
default:
IPCOM_LOG1(CRIT,
"ipike_payload_certificate_req_extract: %s encoding not supported",
ipike_payload_certificate_encode_type_to_string(payload->cert_encoding));
return IPIKE_ISAKMP_INVALID_CERT_ENCODING;
}
return IPIKE_SUCCESS;
}
/*
*===========================================================================
* ipike_payload_certificate_req_extract_v2
*===========================================================================
*/
#ifdef IPIKE_USE_OCSP
IP_GLOBAL Ipike_error
ipike_payload_certificate_req_extract_v2(
Ipike_cert_req_payload* payload,
Ip_bool* ocsp_resp_flag)
{
*ocsp_resp_flag = IP_FALSE;
switch (payload->cert_encoding)
{
case IPIKE_OCSP_CONTENT:
IPCOM_LOG0(DEBUG2,
"ipike_payload_certificate_req_extract: Received OCSP request");
if (payload->header.length > 5)
{
/* Extract Responder public key SHA1 hashes */
#if 0
unsigned char *cert_data;
cert_data = (unsigned char*)ipike_payload_certificate_req_data(payload);
#endif
/*!!OCSP TODO: match hashes against OCSP response store
to select one of the many. Currently only OCSP
responses signed by CA can be configured */
IPCOM_LOG0(DEBUG2,
"ipike_payload_certificate_req_extract: Ignoring SHA1 hashes in OCSP content");
IPCOM_LOG0(DEBUG2,
"ipike_payload_certificate_req_extract: Only support CA signed OCSP responses");
}
*ocsp_resp_flag = IP_TRUE;
break;
case IPIKE_CERT_X509_SIGNATURE:
/* Get preferred CA certificate to use. This information could be used
to separate tunnels by the CA certificate. This is not supported so
just accept the presence of this payload for now. */
break;
default:
IPCOM_LOG1(CRIT,
"ipike_payload_certificate_req_extract: %s encoding not supported",
ipike_payload_certificate_encode_type_to_string(payload->cert_encoding));
return IPIKE_INVALID_VALUE;
}
return IPIKE_SUCCESS;
}
#endif /* #ifdef IPIKE_USE_OCSP */
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/src/ipike_payload_certificate.h
+342
View File
@@ -0,0 +1,342 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_payload_certificate.h,v $ $Revision: 1.10.10.1 $
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_payload_certificate.h,v $
* $Author: edahlber $ $Date: 2011-12-06 15:25:28 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#ifndef IPIKE_PAYLOAD_CERT_H
#define IPIKE_PAYLOAD_CERT_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Certificate payload (RFC 2408, chapter 3.9) */
/* IKE version 1 and 2 */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipike_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include "ipike_payload.h"
#include <openssl/x509.h>
#ifdef IPIKE_USE_OCSP
#include <openssl/ocsp.h>
#endif
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
#define IPIKE_CERT_HEADER_LENGTH 5
#define IPIKE_CERT_REQ_HEADER_LENGTH 5
/* X509 certificates wrapped in a PKCS#7 message */
#define IPIKE_CERT_PKCS_7 1
#define IPIKE_CERT_PGP 2
#define IPIKE_CERT_SIGNED_KEY 3
#define IPIKE_CERT_X509_SIGNATURE 4
#define IPIKE_CERT_X509_KEY_EXCHANGE 5
#define IPIKE_CERT_KERBEROS_TOKENS 6
#define IPIKE_CERT_CRL 7
#define IPIKE_CERT_ARL 8
#define IPIKE_CERT_SPKI 9
#define IPIKE_CERT_X509_ATTRIBUTE 10
#define IPIKE_CERT_X509_HASH_AND_URL 12
#define IPIKE_OCSP_CONTENT 14
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
Certificate Payload Format
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Next Payload ! RESERVED ! Payload Length !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Cert Encoding ! !
+-+-+-+-+-+-+-+-+ !
~ Certificate Data ~
! !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
*/
typedef struct Ipike_cert_payload_struct
{
/* The generic ISAKMP payload header, the length includes the length
of all transforms associated with the proposal */
Ipike_payload_header header;
Ip_u8 cert_encoding;
/* Hash data follows */
}
Ipike_cert_payload;
typedef struct Ipike_cert_struct
{
/* The certificate for our side */
X509* local;
/* The certificate for the peer */
X509* peer;
/* The certificate of additional certificates */
X509** ca;
/* The certificate of trusted certificates */
X509** trusted;
#ifdef IPIKE_USE_OCSP
OCSP_RESPONSE *resp_local;
OCSP_RESPONSE *resp_peer;
#endif
/* The CRLs used for certificate revocation check */
X509_CRL** crls;
/* URL that points to the certificate when "Hash and URL" is used. */
const char *peer_url;
}
Ipike_cert;
typedef struct Ipike_cert_req_payload_struct
{
/* The generic ISAKMP payload header, the length includes the length
of all transforms associated with the proposal */
Ipike_payload_header header;
/* Currently cert req is only used for OCSP content */
Ip_u8 cert_encoding;
/* Hash data follows */
}
Ipike_cert_req_payload;
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_payload_certificate_free
*===========================================================================
* Description: Frees a Ipike_cert structure.
* Parameters: cert - The cert structure to free.
* Returns:
*
*/
IP_GLOBAL void
ipike_payload_certificate_free(Ipike_cert* cert);
/*
*===========================================================================
* ipike_payload_certificate_create
*===========================================================================
* Description: Creates a new certificate payload.
* Parameters: cert - The certificate structure to create the payload from.
* uri - URI pointing out the location of the certificate.
* Only supported in IKEv2.
* payload - will point to a new certificate payload.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*
*/
IP_GLOBAL Ipike_error
ipike_payload_certificate_create(X509* cert, const char *uri, Ipike_cert_payload** payload);
#ifdef IPIKE_USE_OCSP
/*
*===========================================================================
* ipike_payload_certificate_ocsp_create
*===========================================================================
* Description: Creates a new certificate payload with OCSP content.
* Parameters: resp - The OCSP response that will be packaged as per
* RFC 4806 specs.
* payload - will point to a new certificate payload.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*
*/
IP_GLOBAL Ipike_error
ipike_payload_certificate_ocsp_create(OCSP_RESPONSE* resp, Ipike_cert_payload** payload);
#endif
/*
*===========================================================================
* ipike_payload_certificate_req_create_v1
*===========================================================================
* Description: Creates a new certificate IKEv1 req payload.
* Parameters: payload - will point to a new certificate req payload.
* ca_cert - Trusted CA certificate.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*
*/
IP_GLOBAL Ipike_error
ipike_payload_certificate_req_create_v1(
Ipike_cert_req_payload** payload,
X509* ca_cert);
#ifdef IPIKE_USE_VERSION2
/*
*===========================================================================
* ipike_payload_certificate_req_create_v2
*===========================================================================
* Description: Creates a new certificate IKEv2 req payload.
* Parameters: payload - will point to a new certificate req payload.
* cert - Certificate information
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*
*/
IP_GLOBAL Ipike_error
ipike_payload_certificate_req_create_v2(
Ipike_cert_req_payload **payload,
Ipike_cert *cert);
#endif
/*
*===========================================================================
* ipike_payload_certificate_check
*===========================================================================
* Description: Verifies that the certificate payload is sane.
* Parameters: cert - a pointer to a certificate payload.
* Returns: IPIKE_SUCCESS
*
*/
IP_GLOBAL Ipike_error
ipike_payload_certificate_check(Ipike_cert_payload* cert);
/*
*===========================================================================
* ipike_payload_certificate_request_check
*===========================================================================
* Description: Verifies that the certificate request payload is sane.
* Parameters: req - a pointer to a certificate request payload.
* Returns: IPIKE_SUCCESS
*
*/
IP_GLOBAL Ipike_error
ipike_payload_certificate_request_check(Ipike_cert_req_payload* req);
/*
*===========================================================================
* ipike_payload_certificate_print
*===========================================================================
* Description: Prints the content of the certificate payload to the
* system log.
* Parameters: cert - A pointer to a certificate payload.
* Returns:
*
*
*/
IP_GLOBAL void
ipike_payload_certificate_print(Ipike_cert_payload* cert);
/*
*===========================================================================
* ipike_payload_certificate_request_print
*===========================================================================
* Description: Prints the content of the certificate req payload to the
* system log.
* Parameters: cert - A pointer to a certificate req payload.
* Returns:
*
*
*/
IP_GLOBAL void
ipike_payload_certificate_request_print(Ipike_cert_req_payload* req);
/*
*===========================================================================
* ipike_payload_certificate_extract
*===========================================================================
* Description: Extracts the certificate data from the payload.
* Parameters: payload - a certificate payload.
* cert - will be updated with the certificate data if the call
* was successful.
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*
*/
IP_GLOBAL Ipike_error
ipike_payload_certificate_extract(Ipike_cert_payload* payload, Ipike_cert* cert);
/*
*===========================================================================
* ipike_payload_certificate_req_extract_v1
*===========================================================================
* Description: Extracts the certificate request data from the payload used
* in IKEv1.
* Parameters: payload - a certificate req payload.
* Returns: IPIKE_SUCCESS
*
*
*/
IP_GLOBAL Ipike_error
ipike_payload_certificate_req_extract_v1(
Ipike_cert_req_payload* payload,
Ipike_cert *cert);
#ifdef IPIKE_USE_OCSP
/*
*===========================================================================
* ipike_payload_certificate_req_extract_v2
*===========================================================================
* Description: Extracts the certificate request data from the payload used
* in IKEv2.
* Parameters: payload - a certificate req payload.
* ocsp_resp_flag - set to TRUE if a ocsp response has to be sent
* Returns: IPIKE_SUCCESS
* IPIKE_OUT_OF_MEMORY
*
*/
IP_GLOBAL Ipike_error
ipike_payload_certificate_req_extract_v2(Ipike_cert_req_payload* payload,
Ip_bool* ocsp_resp_flag);
#endif /* #ifdef IPIKE_USE_OCSP */
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/

Some files were not shown because too many files have changed in this diff Show More