/* ****************************************************************************** * HEADER FILE * * Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_payload_transform.h,v $ $Revision: 1.8.16.5 $ * $Source: /home/interpeak/CVSRoot/ipike/src/ipike_payload_transform.h,v $ * $Author: jsheng $ $Date: 2014-10-09 09:26:00 $ * $State: Exp $ $Locker: $ * * INTERPEAK_COPYRIGHT_STRING * Design and implementation by Kenneth Jonsson ****************************************************************************** */ #ifndef IPIKE_PAYLOAD_TRANSFORM_H #define IPIKE_PAYLOAD_TRANSFORM_H /* **************************************************************************** * 1 DESCRIPTION **************************************************************************** */ /* **************************************************************************** * 2 CONFIGURATION **************************************************************************** */ /* **************************************************************************** * 3 INCLUDE FILES **************************************************************************** */ #include "ipike_config.h" #include "ipike_attributes.h" #include "ipike_payload.h" #ifdef __cplusplus extern "C" { #endif /* **************************************************************************** * 4 DEFINES **************************************************************************** */ /* IPSEC ISAKMP Transform Identifiers (chapter 4.4.2, RFC 2407) */ #define IPIKE_IKE_KEY 1 #define IPIKE_IKE_MIN 1 #define IPIKE_IKE_MAX 1 #define IPIKE_IKE_PRIVATE_MIN 249 #define IPIKE_IKE_PRIVATE_MAX 255 #define IPIKE_IKE_COUNT 1 #define IPIKE_TRANS_HEADER_LENGTH sizeof(Ipike_transform_payload) /* Security Protocol Identifier (in proposal payload) is IPIKE_PROTO_IPSEC_AH */ #define IPIKE_IPSEC_AH_MD5 2 /* [RFC2407] */ #define IPIKE_IPSEC_AH_SHA 3 /* [RFC2407] */ #define IPIKE_IPSEC_AH_DES 4 /* [RFC2407] */ #define IPIKE_IPSEC_AH_SHA2_256 5 /* [Leech][RFC4868] */ #define IPIKE_IPSEC_AH_SHA2_384 6 /* [Leech][RFC4868] */ #define IPIKE_IPSEC_AH_SHA2_512 7 /* [Leech][RFC4868] */ #define IPIKE_IPSEC_AH_RIPEMD 8 /* [RFC2857] */ #define IPIKE_IPSEC_AH_AES_XCBC_MAC 9 /* [RFC3566] */ #define IPIKE_IPSEC_AH_RSA 10 /* [RFC4359] */ #define IPIKE_IPSEC_AH_AES_128_GMAC 11 /* [RFC4543][Errata1821] */ #define IPIKE_IPSEC_AH_AES_192_GMAC 12 /* [RFC4543][Errata1821] */ #define IPIKE_IPSEC_AH_AES_256_GMAC 13 /* [RFC4543][Errata1821] */ #define IPIKE_IPSEC_AH_MIN 2 #define IPIKE_IPSEC_AH_MAX 13 #define IPIKE_IPSEC_AH_PRIVATE_MIN 249 #define IPIKE_IPSEC_AH_PRIVATE_MAX 255 /* Security Protocol Identifier (in proposal payload) is PROTO_IPSEC_ESP */ #define IPIKE_IPSEC_ESP_DES_IV64 1 /* [RFC2407] */ #define IPIKE_IPSEC_ESP_DES 2 /* [RFC2407] */ #define IPIKE_IPSEC_ESP_3DES 3 /* [RFC2407] */ #define IPIKE_IPSEC_ESP_RC5 4 /* [RFC2407] */ #define IPIKE_IPSEC_ESP_IDEA 5 /* [RFC2407] */ #define IPIKE_IPSEC_ESP_CAST 6 /* [RFC2407] */ #define IPIKE_IPSEC_ESP_BLOWFISH 7 /* [RFC2407] */ #define IPIKE_IPSEC_ESP_3IDEA 8 /* [RFC2407] */ #define IPIKE_IPSEC_ESP_DES_IV32 9 /* [RFC2407] */ #define IPIKE_IPSEC_ESP_RC4 10 /* [RFC2407] */ #define IPIKE_IPSEC_ESP_NULL 11 /* [RFC2407] */ #define IPIKE_IPSEC_ESP_AESCBC 12 /* [RFC2407] */ #define IPIKE_IPSEC_ESP_AESCTR 13 /* [RFC2407] */ #define IPIKE_IPSEC_ESP_AES_CCM_8 14 /* [RFC4309] */ #define IPIKE_IPSEC_ESP_AES_CCM_12 15 /* [RFC4309] */ #define IPIKE_IPSEC_ESP_AES_CCM_16 16 /* [RFC4309] */ #define IPIKE_IPSEC_ESP_AES_GCM_8 18 /* [RFC4106] */ #define IPIKE_IPSEC_ESP_AES_GCM_12 19 /* [RFC4106] */ #define IPIKE_IPSEC_ESP_AES_GCM_16 20 /* [RFC4106] */ #define IPIKE_IPSEC_ESP_SEED_CBC 21 /* [RFC4196] */ #define IPIKE_IPSEC_ESP_CAMELLIA 22 /* [RFC4312] */ #define IPIKE_IPSEC_ESP_NULL_AUTH_AES_GMAC 23 /* [RFC4543][Errata1821] */ #define IPIKE_IPSEC_ESP_MIN 1 #define IPIKE_IPSEC_ESP_MAX 23 #define IPIKE_IPSEC_ESP_PRIVATE_MIN 248 #define IPIKE_IPSEC_ESP_PRIVATE_MAX 255 /* Security Protocol Identifier (in proposal payload) is PROTO_IPCOMP */ #define IPIKE_IPSEC_IPCOMP_OUI 1 #define IPIKE_IPSEC_IPCOMP_DEFLATE 2 #define IPIKE_IPSEC_IPCOMP_LZS 3 #define IPIKE_IPSEC_IPCOMP_LZJH 4 /* [RFC3051] */ #define IPIKE_IPSEC_IPCOMP_MIN 1 #define IPIKE_IPSEC_IPCOMP_MAX 4 /* **************************************************************************** * 5 TYPES **************************************************************************** */ /* Transform Payload Format 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ! Next Payload ! RESERVED ! Payload Length ! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ! Transform # ! Transform-Id ! RESERVED2 ! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ! ! ~ SA Attributes ~ ! ! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ */ typedef struct Ipike_transform_payload_struct { /* The generic ISAKMP payload header */ Ipike_payload_header header; /* Identifies the Transform number for the current payload. If there is more than one transform proposed for a specific protocol within the Proposal payload, then each Transform payload has a unique Transform number.*/ Ip_u8 number; /* Specifies the Transform identifier for the protocol within the current proposal. These transforms are defined by the DOI and are dependent on the protocol being negotiated. */ Ip_u8 id; /* reserved, must be 0 */ Ip_u16 reserved2; /* SA attributes follows */ } Ipike_transform_payload; /* Transform structure to use during phase 1 */ typedef struct Ipike_transform_ike_struct { /* The number of the selected transform */ Ip_u8 number; /* The transform id */ Ip_u8 id; /* Attributes */ Ip_u16 encryption_algorithm; Ip_u16 key_length; Ip_u16 hash_algorithm; Ip_u16 authentication_method; Ip_u16 life_type; Ip_u64 life_duration; Ip_u16 dh_group; const Ipike_value* dh_prime; Ip_u32 dh_generator; Ip_u64 local_life_duration; } Ipike_transform_ike; /* Transform structure to use during phase 2 and IPSec DOI */ typedef struct Ipike_transform_ipsec_struct { /* The number of the transform */ Ip_u8 number; /* AH Transform Identifiers, ESP Transform Identifiers or IPCOMP Transform Identifiers. Depends on the value of the IPSEC Security Protocol Identifier in the proposal */ Ip_u8 id; Ip_u16 authentication_algorithm; Ip_u16 key_length; Ip_u16 encapsulation_mode; Ip_u16 key_rounds; Ip_u32 life_duration_sec; Ip_u64 life_duration_kbytes; Ip_u16 dh_group; const Ipike_value* dh_prime; Ip_u32 dh_generator; Ip_u32 local_life_duration_sec; Ip_u64 local_life_duration_kbytes; } Ipike_transform_ipsec; typedef union Ipike_transform_union { Ipike_transform_ike ike; Ipike_transform_ipsec ipsec; } Ipike_transform; /* **************************************************************************** * 6 FUNCTIONS **************************************************************************** */ /* *=========================================================================== * ipike_transform_id_to_string *=========================================================================== * Description: Returns a string representation of the specified transform id. * Parameters: id - a transform id. * Returns: A string representation of the specified transform id. * */ IP_GLOBAL const char * ipike_transform_id_to_string(Ip_u8 id, Ip_u8 prop_proto_id); /* *=========================================================================== * ipike_transform_set *=========================================================================== * Description: Set all transform parameters. * Parameters: transform_dst - the transform that will be set. * transform_src - the transform that will be read. * Returns: */ IP_GLOBAL void ipike_transform_set( Ipike_transform* transform_dst, Ipike_transform* transform_src); /* *=========================================================================== * ipike_transform_new *=========================================================================== * Description: Creates a new transform payload. * Parameters: number - the transform number. * id - the protocol id for this transform. * attrs - the attributes to include in this transform. * Returns: A transform payload that must be freed with ipcom_free or * IP_NULL if out of memory. * */ IP_GLOBAL Ipike_transform_payload* ipike_transform_new(Ip_u8 number, Ip_u8 id, Ipike_attribute** attrs); /* *=========================================================================== * Ipike_transform_ike_free *=========================================================================== * Description: Frees all resources allocated by the ISAKMP transform structure. * Parameters: t - The transform to free. * Returns: * */ IP_GLOBAL void ipike_transform_ike_free(Ipike_transform_ike* t); /* *=========================================================================== * ipike_transform_ipsec_free *=========================================================================== * Description: Frees all resources allocated by the IPSec transform structure. * Parameters: t - The transform to free. * Returns: * */ IP_GLOBAL void ipike_transform_ipsec_free(Ipike_transform_ipsec* t); /* *=========================================================================== * ipike_transform_ike_create *=========================================================================== * Description: Creates a new transform payload from the data collected * during the ike exchange (phase 1). * Parameters: transform - the transform to encode into a ISAKMP payload. * payload - the new transform payload if the call was successful. * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY * */ IP_GLOBAL Ipike_error ipike_transform_ike_create( Ipike_transform_ike* transform, Ipike_transform_payload** payload); /* *=========================================================================== * ipike_transform_ipsec_create *=========================================================================== * Description: Creates a new transform payload to use during phase 2 when * neogatiate IPSec paramters. * Parameters: transform - the transform to encode into a ISAKMP payload. * payload - the new transform payload if the call was successful. * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY * */ IP_GLOBAL Ipike_error ipike_transform_ipsec_create( Ipike_transform_ipsec* transform, Ipike_transform_payload** payload); /* *=========================================================================== * ipike_transform_ike_initialize *=========================================================================== * Description: Initializes a transform structure from the configuration. * Parameters: conf - The IKE configuration structure. * proposal - The proposal structure * number - The transform number. * transform - Will contain a initilized transform if the call * was successful. * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY * IPIKE_CONF_INVALID_VALUE */ IP_GLOBAL Ipike_error ipike_transform_ike_initialize( Ipike_config_ike_sa* conf, Ipike_config_proposal* proposal, Ip_u8 number, Ipike_transform_ike* transform); /* *=========================================================================== * ipike_transform_ipsec_initialize *=========================================================================== * Description: Initializes a IPSec transform structure from the * configuration. * Parameters: conf - The IKE configuration structure. * proposal - The proposal structure * number - The transform number. * proto_id - The proposal protocol id. * transform - Will contain a initilized transform if the call * was successful. * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY * IPIKE_CONF_INVALID_VALUE */ IP_GLOBAL Ipike_error ipike_transform_ipsec_initialize( Ipike_config_ipsec_sa* conf, Ipike_config_proposal* proposal, Ip_u8 number, Ip_u8 proto_id, Ipike_transform_ipsec* transform); /* *=========================================================================== * ipike_transform_check_payload *=========================================================================== * Description: Verifies that the transform payload is sane. * Parameters: transform - a pointer to the ISAKMP header for the payload. * protocol - Protocol context of the transform * Returns: IPIKE_SUCCESS * IPIKE_ISAKMP_INVALID_PAYLOAD * IPIKE_ISAKMP_PAYLOAD_LENGTH_ERROR * */ IP_GLOBAL Ipike_error ipike_transform_check_payload( Ipike_transform_payload* transform, Ip_u8 protocol, Ip_bool phase1); /* *=========================================================================== * ipike_transform_ike_print_payload *=========================================================================== * Description: Prints the content of a phase 1 transform payload to * the system log. * Parameters: transform - a pointer to the ISAKMP header for the payload. * security_proto_id - the proposal protocol ID. * Returns: * */ IP_GLOBAL void ipike_transform_ike_print_payload( Ipike_transform_payload* transform, Ip_u8 security_proto_id); /* *=========================================================================== * ipike_transform_ipsec_print_payload *=========================================================================== * Description: Prints the content of a IPSec transform payload to * the system log. * Parameters: transform - a pointer to the ISAKMP header for the payload. * security_proto_id - the proposal protocol ID. * Returns: * */ IP_GLOBAL void ipike_transform_ipsec_print_payload( Ipike_transform_payload* transform, Ip_u8 security_proto_id); /* *=========================================================================== * ipike_transform_ike_extract *=========================================================================== * Description: Verifies that all paramters in the transform is supported * and copies them to the 'transform' structure. * Parameters: payload - A pointer to a transform payload. * transform - Will contain the transform paramters if the call * was successful. * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY * IPIKE_SA_NO_MATCHING_HASH_ALGORITHM * IPIKE_SA_NO_MATCHING_ENCRYPTION_ALGORITHM * IPIKE_SA_NO_PRE_SHARED_SECRET * */ IP_PUBLIC Ipike_error ipike_transform_ike_extract( Ipike_transform_payload* payload, Ipike_transform_ike* transform); /* *=========================================================================== * ipike_transform_ipsec_extract *=========================================================================== * Description: Verifies that all paramters in the transform is supported * and copies them to the 'transform' structure. * Parameters: payload - A pointer to a transform payload. * proposal_proto_id - The proposal protocol ID for the proposal * containg this transform. * transform - Will contain the transform paramters if the call * was successful. * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY * IPIKE_SA_NO_MATCHING_HASH_ALGORITHM * IPIKE_SA_NO_MATCHING_ENCRYPTION_ALGORITHM * IPIKE_SA_NO_PRE_SHARED_SECRET * */ IP_PUBLIC Ipike_error ipike_transform_ipsec_extract( Ipike_transform_payload* payload, Ip_u8 proposal_proto_id, Ipike_transform_ipsec* transform); /* *=========================================================================== * ipike_transform_isakmp_from_exch *=========================================================================== * Description: Returns the selected transform for the IKE SA. * Parameters: ie - The paramters for the exchange. * Returns: A pointer to the IKE SA transform. * */ IP_GLOBAL Ipike_transform_ike* ipike_transform_ike_from_exch(Ipike_isakmp_exchange* ie); #ifdef __cplusplus } #endif #endif /* **************************************************************************** * END OF FILE **************************************************************************** */