original files of m241
This commit is contained in:
neelimap
@@ -0,0 +1,433 @@
|
||||
/*
|
||||
******************************************************************************
|
||||
* HEADER FILE
|
||||
*
|
||||
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_payload_identification.h,v $ $Revision: 1.8.10.4 $
|
||||
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_payload_identification.h,v $
|
||||
* $Author: edahlber $ $Date: 2012-06-29 11:13:44 $
|
||||
* $State: Exp $ $Locker: $
|
||||
*
|
||||
* INTERPEAK_COPYRIGHT_STRING
|
||||
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
|
||||
******************************************************************************
|
||||
*/
|
||||
#ifndef IPIKE_PAYLOAD_IDENTIFICATION_H
|
||||
#define IPIKE_PAYLOAD_IDENTIFICATION_H
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 1 DESCRIPTION
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/* Identification payload (RFC 2408, chapter 3.8 & RFC 2407, chapter 4.6.2 for
|
||||
the IPSec DOI) */
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 2 CONFIGURATION
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 3 INCLUDE FILES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
#include "ipike_config.h"
|
||||
#include "ipike_payload.h"
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 4 DEFINES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
#define IPIKE_ID_HEADER_LENGTH 8
|
||||
|
||||
/* IPSec DOI ID Types */
|
||||
/* The ID_IPV4_ADDR type specifies a single four (4) octet IPv4 address. */
|
||||
#define IPIKE_ID_IPV4_ADDR 1
|
||||
/* The ID_FQDN type specifies a fully-qualified domain name string. */
|
||||
#define IPIKE_ID_FQDN 2
|
||||
/* The ID_USER_FQDN type specifies a fully-qualified username string. */
|
||||
#define IPIKE_ID_USER_FQDN 3
|
||||
/* The ID_IPV4_ADDR_SUBNET type specifies a range of IPv4 addresses,
|
||||
represented by two four (4) octet values. The first value is an IPv4
|
||||
address. The second is an IPv4 network mask. */
|
||||
#define IPIKE_ID_IPV4_ADDR_SUBNET 4
|
||||
/* The ID_IPV6_ADDR type specifies a single sixteen (16) octet IPv6 address.*/
|
||||
#define IPIKE_ID_IPV6_ADDR 5
|
||||
/* The ID_IPV6_ADDR_SUBNET type specifies a range of IPv6 addresses,
|
||||
represented by two sixteen (16) octet values. The first value is an
|
||||
IPv6 address. The second is an IPv6 network mask. */
|
||||
#define IPIKE_ID_IPV6_ADDR_SUBNET 6
|
||||
/* The ID_IPV4_ADDR_RANGE type specifies a range of IPv4 addresses,
|
||||
represented by two four (4) octet values. The first value is the
|
||||
beginning IPv4 address (inclusive) and the second value is the ending
|
||||
IPv4 address (inclusive). */
|
||||
#define IPIKE_ID_IPV4_ADDR_RANGE 7
|
||||
/* The ID_IPV6_ADDR_RANGE type specifies a range of IPv6 addresses,
|
||||
represented by two sixteen (16) octet values. The first value is the
|
||||
beginning IPv6 address (inclusive) and the second value is the ending
|
||||
IPv6 address (inclusive). */
|
||||
#define IPIKE_ID_IPV6_ADDR_RANGE 8
|
||||
/* The ID_DER_ASN1_DN type specifies the binary DER encoding of an ASN.1
|
||||
X.500 Distinguished Name of the principal whose certificates
|
||||
are being exchanged to establish the SA. */
|
||||
#define IPIKE_ID_DER_ASN1_DN 9
|
||||
/* The ID_DER_ASN1_GN type specifies the binary DER encoding of an ASN.1
|
||||
X.500 GeneralName of the principal whose certificates are
|
||||
being exchanged to establish the SA. */
|
||||
#define IPIKE_ID_DER_ASN1_GN 10
|
||||
/* The ID_KEY_ID type specifies an opaque byte stream which may be used
|
||||
to pass vendor-specific information necessary to identify which pre-
|
||||
shared key should be used to authenticate Aggressive mode
|
||||
negotiations. */
|
||||
#define IPIKE_ID_KEY_ID 11
|
||||
|
||||
#define IPIKE_ID_COUNT 11
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 5 TYPES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*
|
||||
Identification Payload Format
|
||||
1 2 3
|
||||
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
|
||||
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
||||
! Next Payload ! RESERVED ! Payload Length !
|
||||
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
||||
! ID Type ! DOI Specific ID Data !
|
||||
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
||||
! !
|
||||
~ Identification Data ~
|
||||
! !
|
||||
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
||||
|
||||
|
||||
Identification Payload Format (DOI: IPSec)
|
||||
1 2 3
|
||||
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
|
||||
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
||||
! Next Payload ! RESERVED ! Payload Length !
|
||||
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
||||
! ID Type ! Protocol ID ! Port !
|
||||
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
||||
~ Identification Data ~
|
||||
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
||||
|
||||
*/
|
||||
|
||||
typedef struct Ipike_identification_payload_struct
|
||||
{
|
||||
/* The generic ISAKMP payload header, the length includes the length
|
||||
of all transforms associated with the proposal */
|
||||
Ipike_payload_header header;
|
||||
|
||||
/* Value describing the identity information found in the
|
||||
Identification Data field. */
|
||||
Ip_u8 id_type;
|
||||
}
|
||||
Ipike_id_payload;
|
||||
|
||||
typedef struct Ipike_identification_struct
|
||||
{
|
||||
/* Value describing the identity information found in the
|
||||
Identification Data field. */
|
||||
Ip_u8 id_type;
|
||||
/* the domain of interpretation for this identification */
|
||||
Ip_u32 doi;
|
||||
/* DOI Specific ID Data, the DOI is stored in the Ipike_sa struct */
|
||||
union {
|
||||
struct Ipike_ipsec_param_struct {
|
||||
/* UPD or TCP, a zero value means that this field should be ignored */
|
||||
Ip_u8 proto_id;
|
||||
/* Value specifying an associated port. A value of zero means that
|
||||
the Port field should be ignored. */
|
||||
Ip_u16 port;
|
||||
} ipsec;
|
||||
} doi_specific_id_data;
|
||||
|
||||
Ipike_value id_data;
|
||||
}
|
||||
Ipike_id;
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 6 FUNCTIONS
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipike_identification_init_ip_address
|
||||
*===========================================================================
|
||||
* Description: Initializes the id with IPv4 or IPv6 address.
|
||||
* Parameters: addr - The ip address holding the id data.
|
||||
* id - Will hold the id data from the configuration if the call
|
||||
* was successful.
|
||||
* Returns: IPIKE_SUCCESS
|
||||
* IPIKE_OUT_OF_MEMORY
|
||||
* IPIKE_CONF_VALUE_NOT_FOUND
|
||||
*/
|
||||
IP_GLOBAL Ipike_error
|
||||
ipike_identification_init_ip_address(
|
||||
const char* addr,
|
||||
Ip_u8* type,
|
||||
Ipike_value* id);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipike_identification_init_ip_subnet
|
||||
*===========================================================================
|
||||
* Description: Initializes the identification with ip subnet.
|
||||
* Parameters: addr - The ip address.
|
||||
* mask - The ip netmask.
|
||||
* type - Will hold the id type if the call was successful.
|
||||
* id - Will hold the identification data from the configuration
|
||||
* if the call was successful.
|
||||
* Returns: IPIKE_SUCCESS
|
||||
* IPIKE_OUT_OF_MEMORY
|
||||
* IPIKE_CONF_VALUE_NOT_FOUND
|
||||
*
|
||||
*/
|
||||
IP_GLOBAL Ipike_error
|
||||
ipike_identification_init_ip_subnet(
|
||||
union Ip_sockaddr_union* addr,
|
||||
union Ip_sockaddr_union* mask,
|
||||
Ip_u8* type,
|
||||
Ipike_value* id);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipike_identification_init_asn1_dn
|
||||
*===========================================================================
|
||||
* Description: Initializes the id with a asn1 dn value.
|
||||
* Parameters: dn - The asn1 dn value holding the id data.
|
||||
* id - Will hold the id data from the configuration if the call
|
||||
* was successful.
|
||||
* Returns: IPIKE_SUCCESS
|
||||
* IPIKE_OUT_OF_MEMORY
|
||||
* IPIKE_CONF_VALUE_NOT_FOUND
|
||||
*/
|
||||
IP_GLOBAL Ipike_error
|
||||
ipike_identification_init_asn1_dn(const char* dn, Ipike_value* id);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipike_identification_init_value
|
||||
*===========================================================================
|
||||
* Description: Initializes the id with a configuration value.
|
||||
* Parameters: value - The value holding the id data.
|
||||
* id - Will hold the id data from the configuration if the call
|
||||
* was successful.
|
||||
* Returns: IPIKE_SUCCESS
|
||||
* IPIKE_OUT_OF_MEMORY
|
||||
* IPIKE_CONF_VALUE_NOT_FOUND
|
||||
*/
|
||||
IP_GLOBAL Ipike_error
|
||||
ipike_identification_init_value(const char* value, Ipike_value* id);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipike_identification_new
|
||||
*===========================================================================
|
||||
* Description: Creates a new identification payload.
|
||||
* Parameters: id_type - the type of identification being used.
|
||||
* doi_specific_id_data_len - the least significant 24 bits
|
||||
* specifies the DOI specific data.
|
||||
* id_data - the identification data, depends on both DOI
|
||||
* and the value of 'id_type'.
|
||||
* Returns: A new identification payload or IP_NULL if out of memory.
|
||||
*
|
||||
*
|
||||
*/
|
||||
IP_GLOBAL Ipike_id_payload*
|
||||
ipike_identification_new(
|
||||
Ip_u8 id_type,
|
||||
Ip_u32 doi_specific_id_data,
|
||||
const Ip_u8* id_data,
|
||||
Ip_size_t id_data_len);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipike_identification_create
|
||||
*===========================================================================
|
||||
* Description: Creates a new identification payload from the information created
|
||||
* in the exchange.
|
||||
* Parameters: identification - the identification structure to encode into
|
||||
* a ISAKMP payload.
|
||||
* payload - will point to a new identification payload.
|
||||
* Returns: IPIKE_SUCCESS
|
||||
* IPIKE_OUT_OF_MEMORY
|
||||
* IPIKE_DOI_UNSUPPORTED
|
||||
*
|
||||
*/
|
||||
IP_GLOBAL Ipike_error
|
||||
ipike_identification_create(
|
||||
Ipike_id* identification,
|
||||
Ipike_id_payload** payload);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipike_identification_generate
|
||||
*===========================================================================
|
||||
* Description: Generate identification structure from configuration value.
|
||||
* Parameters: value - The configuration value
|
||||
* id - The generated identification structure.
|
||||
* Returns: IPIKE_SUCCESS
|
||||
* IPIKE_OUT_OF_MEMORY
|
||||
* IPIKE_CONF_VALUE_INVALID
|
||||
*/
|
||||
IP_GLOBAL Ipike_error
|
||||
ipike_identification_generate(
|
||||
const char* value,
|
||||
Ipike_id* id);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipike_identification_initiator_initialize
|
||||
*===========================================================================
|
||||
* Description: Initializes IPSec local and remote identification structures.
|
||||
* Parameters: ie - The exchange
|
||||
* idii - The identification of this machine.
|
||||
* idir - The identification of the remote machine.
|
||||
* Returns: IPIKE_SUCCESS
|
||||
* IPIKE_OUT_OF_MEMORY
|
||||
* IPIKE_CONF_VALUE_NOT_FOUND
|
||||
*/
|
||||
IP_GLOBAL Ipike_error
|
||||
ipike_identification_initiator_initialize(
|
||||
Ipike_isakmp_exchange* ie,
|
||||
Ipike_id* idii,
|
||||
Ipike_id* idir);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipike_identification_check_payload
|
||||
*===========================================================================
|
||||
* Description: Verifies that the identification payload is sane.
|
||||
* Parameters: identification - a pointer to a identification payload.
|
||||
* Returns: IPIKE_SUCCESS
|
||||
* IPIKE_ISAKMP_PAYLOAD_LENGTH_ERROR
|
||||
*
|
||||
*/
|
||||
IP_GLOBAL Ipike_error
|
||||
ipike_identification_check_payload(Ipike_id_payload* identification);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipike_identification_print_payload
|
||||
*===========================================================================
|
||||
* Description: Prints the content of the identification payload to the
|
||||
* system log.
|
||||
* Parameters: identification - a pointer to identification payload.
|
||||
* Returns:
|
||||
*
|
||||
*
|
||||
*/
|
||||
IP_GLOBAL void
|
||||
ipike_identification_print_payload(Ipike_id_payload* identification);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipike_identification_extract
|
||||
*===========================================================================
|
||||
* Description: Extracts the identification data from the payload.
|
||||
* Parameters: payload - a identification payload.
|
||||
* identification - will be updated with the identification data
|
||||
* if the call was successful.
|
||||
* Returns: IPIKE_SUCCESS
|
||||
* IPIKE_OUT_OF_MEMORY
|
||||
* IPIKE_DOI_UNSUPPORTED
|
||||
*
|
||||
*/
|
||||
IP_GLOBAL Ipike_error
|
||||
ipike_identification_extract(
|
||||
Ipike_id_payload* payload,
|
||||
Ip_u32 doi,
|
||||
Ipike_id* identification);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipike_identification_ike_extract
|
||||
*===========================================================================
|
||||
* Description: Extracts the identification data from the payload and
|
||||
* validates the identification data in the context of IKE.
|
||||
* Parameters: payload - a identification payload.
|
||||
* identification - will be updated with the identification data
|
||||
* if the call was successful.
|
||||
* Returns: IPIKE_SUCCESS
|
||||
* IPIKE_OUT_OF_MEMORY
|
||||
* IPIKE_DOI_UNSUPPORTED
|
||||
* IPIKE_ISAKMP_INVALID_ID_TYPE
|
||||
*
|
||||
*/
|
||||
IP_GLOBAL Ipike_error
|
||||
ipike_identification_ike_extract(
|
||||
Ipike_id_payload* payload,
|
||||
Ip_u32 doi,
|
||||
Ipike_id* identification);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipike_identification_ipsec_extract
|
||||
*===========================================================================
|
||||
* Description: Extracts IPv4 paramters from the identification data,
|
||||
* everything is returned in big-endian byte order.
|
||||
* Parameters: identification - the identification data
|
||||
* proto - will contain the protocol (TCP, UDP or 0 if protocol
|
||||
* should be ignored).
|
||||
* addr_or_net - will contain the IP address or IP subnet.
|
||||
* netmask - will contain the network mask if the identification
|
||||
* contains subnet information, it will be set to 0 otherwise.
|
||||
* port - will contain the port (or 0 if the port should be ignored).
|
||||
* Returns: IPIKE_SUCCESS
|
||||
* IPIKE_OUT_OF_MEMORY
|
||||
* IPIKE_DOI_UNSUPPORTED
|
||||
*
|
||||
*/
|
||||
IP_GLOBAL Ipike_error
|
||||
ipike_identification_ipsec_extract(
|
||||
Ipike_id* identification,
|
||||
Ip_u8* proto,
|
||||
Ipike_config_netobj* netobj);
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* ipike_identification_match_flow
|
||||
*===========================================================================
|
||||
* Description: Match the IPSec SA configuration flow with the specified id
|
||||
* structures.
|
||||
* Parameters: flow - the IPSec SA flow.
|
||||
* id_src - the id for source.
|
||||
* id_dst - the id for destination.
|
||||
* Returns: IPIKE_SUCCESS, IPIKE_CONF_INVALID_VALUE
|
||||
*/
|
||||
IP_GLOBAL Ipike_error
|
||||
ipike_identification_match_flow(
|
||||
Ipike_config_flow* flow,
|
||||
Ipike_id* id_src,
|
||||
Ipike_id* id_dst);
|
||||
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* END OF FILE
|
||||
****************************************************************************
|
||||
*/
|
||||
Reference in New Issue
Block a user