/* ****************************************************************************** * HEADER FILE * * Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike2_payload_sa.h,v $ $Revision: 1.10.16.1 $ * $Source: /home/interpeak/CVSRoot/ipike/src/ipike2_payload_sa.h,v $ * $Author: svc-cmnet $ $Date: 2013-03-13 07:45:26 $ * $State: Exp $ $Locker: $ * * INTERPEAK_COPYRIGHT_STRING * Design and implementation by Kenneth Jonsson ****************************************************************************** */ #if !defined(IPIKE2_PAYLOAD_SA_H) && defined(IPIKE_USE_VERSION2) #define IPIKE2_PAYLOAD_SA_H /* **************************************************************************** * 1 DESCRIPTION **************************************************************************** */ /* IKE Security Association Payload (IKE version 2) */ /* **************************************************************************** * 2 CONFIGURATION **************************************************************************** */ #include "ipike_config.h" /* **************************************************************************** * 3 INCLUDE FILES **************************************************************************** */ #include "ipike_payload.h" #include "ipike_payload_sa.h" #include "ipike_attributes.h" #ifdef __cplusplus extern "C" { #endif /* **************************************************************************** * 4 DEFINES **************************************************************************** */ /* **************************************************************************** * 5 TYPES **************************************************************************** */ /* Transform types */ #define IPIKE_TRANSFORM_TYPE_ENCR 1 #define IPIKE_TRANSFORM_TYPE_PRF 2 #define IPIKE_TRANSFORM_TYPE_INTEG 3 #define IPIKE_TRANSFORM_TYPE_DH 4 #define IPIKE_TRANSFORM_TYPE_ESN 5 /* Transform IDs for IPIKE_TRANSFORM_TYPE_ENCR */ #define IPIKE_ENCR_DES_IV64 1 #define IPIKE_ENCR_DES 2 #define IPIKE_ENCR_3DES 3 #define IPIKE_ENCR_RC5 4 #define IPIKE_ENCR_IDEA 5 #define IPIKE_ENCR_CAST 6 #define IPIKE_ENCR_BLOWFISH 7 #define IPIKE_ENCR_3IDEA 8 #define IPIKE_ENCR_DES_IV32 9 #define IPIKE_ENCR_NULL 11 #define IPIKE_ENCR_AES_CBC 12 #define IPIKE_ENCR_AES_CTR 13 /* Transform IDs for IPIKE_TRANSFORM_TYPE_PRF */ #define IPIKE_PRF_HMAC_MD5 1 #define IPIKE_PRF_HMAC_SHA1 2 #define IPIKE_PRF_HMAC_TIGER 3 #define IPIKE_PRF_AES128_CBC 4 #define IPIKE_PRF_HMAC_SHA2_256 5 #define IPIKE_PRF_HMAC_SHA2_384 6 #define IPIKE_PRF_HMAC_SHA2_512 7 /* Transform IDs for IPIKE_TRANSFORM_TYPE_INTEG */ #define IPIKE_AUTH_NONE 0 #define IPIKE_AUTH_HMAC_MD5_96 1 #define IPIKE_AUTH_HMAC_SHA1_96 2 #define IPIKE_AUTH_DES_MAC 3 #define IPIKE_AUTH_KPDK_MD5 4 #define IPIKE_AUTH_AES_XCBC_96 5 #define IPIKE_AUTH_HMAC_SHA2_256_128 12 #define IPIKE_AUTH_HMAC_SHA2_384_192 13 #define IPIKE_AUTH_HMAC_SHA2_512_256 14 /* Transform IDs for IPIKE_TRANSFORM_TYPE_DH */ #define IPIKE_DH_GROUP_1 1 #define IPIKE_DH_GROUP_2 2 #define IPIKE_DH_GROUP_5 5 #define IPIKE_DH_GROUP_14 14 #define IPIKE_DH_GROUP_15 15 #define IPIKE_DH_GROUP_16 16 #define IPIKE_DH_GROUP_17 17 #define IPIKE_DH_GROUP_18 18 /* Transform IDs for IPIKE_TRANSFORM_TYPE_ESN */ #define IPIKE_ESN_OFF 0 #define IPIKE_ESN_ON 1 /* Tranform ID values */ #define IPIKE_TRANSFORM_UNKNOWN 0x8000 #define IPIKE_TRANSFORM_IGNORE 0x8001 #define IPIKE_TRANSFORM_INVALID 0xFFFF /* Transform struct 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ! 0 (last) or 3 ! RESERVED ! Transform Length ! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ !Transform Type ! RESERVED ! Transform ID ! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ! ! ~ Transform Attributes ~ ! ! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ */ typedef struct Ipike2_transform_info_struct { /* 0 (last or 3 if more) */ Ip_u8 more; /* Reserved */ Ip_u8 reserved; /* Transform length */ Ip_u16 length; /* Tranform type */ Ip_u8 type; /* Reserved */ Ip_u8 reserved2; /* Transform identifier */ Ip_u16 id; } Ipike2_transform_info; typedef struct Ipike2_transform_struct { /* The tranform info struct */ Ipike2_transform_info info; /* Attributes(s) for this transform */ Ipike_attribute** attributes; } Ipike2_transform; /* Proposal struct 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ! 0 (last) or 2 ! RESERVED ! Proposal Length ! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ! Proposal # ! Protocol-ID ! SPI Size !# of Transforms! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ~ SPI (variable) ~ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ! ! ~ Transforms ~ ! ! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ */ typedef struct Ipike2_proposal_info_struct { /* 0 (last or 2 if more) */ Ip_u8 more; /* Reserved */ Ip_u8 reserved; /* Length of the proposal struct */ Ip_u16 length; /* The number of the selected proposal */ Ip_u8 number; /* Specifies the protocol identifier for the current negotiation. Examples might include IKE, ESP, AH, etc.*/ Ip_u8 proto_id; /* SPI size */ Ip_u8 spi_size; /* # of transforms */ Ip_u8 transform_count; /* SPI and Tranform data */ } Ipike2_proposal_info; typedef struct Ipike2_proposal_struct { /* The proposal info struct */ Ipike2_proposal_info info; /* The Security Parameter Index (SPI) as defined by the Protocol-ID. */ Ip_u8 spi[8]; /* Transform(s) for this proposal */ Ipike2_transform** transforms; } Ipike2_proposal; /* Security Association Payload 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ! Next Payload ! RESERVED ! Payload Length ! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ! ! ~ Proposals ~ ! ! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ */ typedef struct Ipike2_sa_payload_struct { /* The generic payload header, the length includes the length of the proposal and transform payloads */ Ipike_payload_header header; /* Proposals follows */ } Ipike2_sa_payload; /* Holds the parameters from the SA payload */ typedef struct Ipike2_sa_struct { /* More than 1 proposal can be selected (ex. AH + ESP is two different proposals that can be active at the same time). All proposal in the selected set (must) have the same proposal number */ /* The index of the first selected proposal */ int selected_proposal; /* The number of proposal in this SA */ int proposal_count; /* Proposal(s) for this SA */ Ipike2_proposal** proposals; /* Selected transforms */ Ip_u16 selected_encr; Ip_u16 selected_prf; Ip_u16 selected_integ; Ip_u16 selected_dh; Ip_u16 selected_esn; /* Selected attributes */ Ip_u16 selected_key_length; /* Selected protocol id */ Ip_u8 proto_id; } Ipike2_sa; /* **************************************************************************** * 6 FUNCTIONS **************************************************************************** */ /* *=========================================================================== * ipike_sa_transform_id_available *=========================================================================== * Description: Return true/false depending of availability of transform. * Parameters: type - type of transfrom. * id - id of transforn * Returns: IP_TRUE if available (else IP_FALSE) * */ IP_GLOBAL Ip_bool ipike_sa_transform_id_available(Ip_u8 type, Ip_u16 id); /* *=========================================================================== * ipike_sa_transform_id_from_string *=========================================================================== * Description: Return transfrom if from a string representation. * Parameters: type - type of transfrom. * s - string representation of transfrom. * Returns: Transform id or IPIKE_ATTR_INVALID if not found * */ IP_GLOBAL Ip_u16 ipike_sa_transform_id_from_string(Ip_u8 type, const char * s); /* *=========================================================================== * ipike_payload_sa_create *=========================================================================== * Description: Creates a new SA payload from the information collected * in the exchange. * Parameters: sa - the SA to encode in to a ISAKMP payload. * payload - will point to a new SA payload if the call was * successful. * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY * */ IP_GLOBAL Ipike_error ipike_payload_sa_create(Ipike2_sa* sa, Ipike2_sa_payload** payload); /* *=========================================================================== * ipike_payload_sa_free *=========================================================================== * Description: Frees all resource allocated by the SA structure. * Parameters: sa - The SA structure to free. * free_func - The function to use when freeing the 'sa'. * Pass IP_NULL if 'sa' is located on the stack. * Returns: * */ IP_GLOBAL void ipike_payload_sa_free(Ipike2_sa* sa, void(*free_func)(void*)); /* *=========================================================================== * ipike_payload_sa_initialize *=========================================================================== * Description: Creates a new IKE/IPSec SA from the proposals for the peer * host. * Parameters: is_ike - TRUE if IKE SA (otherwise IPSec SA) * proposals - The configuration where information about the * exchange can be found. * sa - Will contain a initilized IKE SA if the call was * successful. * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY * IPIKE_CONF_VALUE_NOT_FOUND */ IP_GLOBAL Ipike_error ipike_payload_sa_initialize( Ip_bool is_ike, Ipike_config_proposal** proposals, Ipike2_sa* sa); /* *=========================================================================== * ipike_payload_sa_check *=========================================================================== * Description: Verifies that the security association payload is sane. * Parameters: sa - a pointer to a SA payload. * Returns: IPIKE_SUCCESS * IPIKE_ISAKMP_PAYLOAD_LENGTH_ERROR * IPIKE_ISAKMP_INVALID_SYNTAX */ IP_GLOBAL Ipike_error ipike_payload_sa_check(Ipike2_sa_payload* sa); /* *=========================================================================== * ipike_payload_sa_print *=========================================================================== * Description: Prints the content of a SA payload to the system log. * Parameters: sa - a pointer to a SA payload. * Returns: */ IP_GLOBAL void ipike_payload_sa_print(Ipike2_sa_payload* sa); /* *=========================================================================== * ipike_payload_sa_extract *=========================================================================== * Description: Extracts the SA from the payload. * Parameters: payload - A SA payload. * sa - Will be updated with the parameters from the SA payload * if the call was successful. * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY */ IP_GLOBAL Ipike_error ipike_payload_sa_extract(Ipike2_sa_payload *payload, Ipike2_sa *sa); /* *=========================================================================== * ipike_payload_sa_set_spi *=========================================================================== * Description: Set spi value for all SA proposals. * Parameters: sa - Will be updated with the new spi value if the call was * successful. * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY */ IP_GLOBAL Ipike_error ipike_payload_sa_set_spi(Ipike2_sa* sa, Ip_u8* spi_data, Ip_u16 spi_len); /* *=========================================================================== * ipike_transform_???_to_string *=========================================================================== * Description: Get description for the specified algorithm id. * id - Algorithm id * Returns: The description */ IP_GLOBAL const char * ipike_transform_encryption_to_string(Ip_u16 id); IP_GLOBAL const char * ipike_transform_integrity_to_string(Ip_u16 id); IP_GLOBAL const char * ipike_transform_hash_to_string(Ip_u16 id); IP_GLOBAL const char * ipike_transform_dh_group_to_string(Ip_u16 id); IP_GLOBAL const char * ipike_transform_esn_to_string(Ip_u16 id); /* *=========================================================================== * ipike_proposal_get_first_transform *=========================================================================== * Description: Get next transform id of specified type from the SA structure * sa - the SA * type - type of transform, i.e. encr, prf, integ, dh * old_id - last returned id or 0 if first. * Returns: The found id or 0xffff */ IP_GLOBAL Ip_u16 ipike_proposal_get_next_transform(Ipike2_sa* sa, Ip_u16 type, Ip_u16 old_id); /* *=========================================================================== * ipike_proposal_has_transform *=========================================================================== * Description: Get next transform id of specified type from the proposal * structure. * proposal - the proposal * type - type of transform, i.e. encr, prf, integ, dh * id - the id of the transform. * Returns: TRUE if found else FALSE */ IP_GLOBAL Ip_bool ipike_proposal_has_transform(Ipike2_proposal* proposal, Ip_u16 type, Ip_u16 id); /* *=========================================================================== * ipike_proposal_has_transform_type *=========================================================================== * Description: Verify that the transform type is present in the proposal * proposal - the proposal * type - type of transform, i.e. encr, prf, integ, dh * Returns: TRUE if found else FALSE */ IP_GLOBAL Ip_bool ipike_proposal_has_transform_type(Ipike2_proposal* proposal, Ip_u16 type); /* *=========================================================================== * ipike_proposal_remove_transform_type *=========================================================================== * Description: Remove all transforms of a specified type in the proposals * for the sa. * sa - the sa * type - type of transform, i.e. encr, prf, integ, dh * Returns: */ IP_GLOBAL void ipike_proposal_remove_transform_type(Ipike2_sa* sa, Ip_u16 type); /* *=========================================================================== * ipike_transform_get_key_length *=========================================================================== * Description: Get key length of specified (encryption) transform from * attributes list. * transform - the transfrom * Returns: key length if specified else 0 */ IP_GLOBAL Ip_u16 ipike_transform_get_key_length(Ipike2_transform* transform); #ifdef __cplusplus } #endif #endif /* **************************************************************************** * END OF FILE **************************************************************************** */