/* ****************************************************************************** * HEADER FILE * * Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_payload_certificate.h,v $ $Revision: 1.10.10.1 $ * $Source: /home/interpeak/CVSRoot/ipike/src/ipike_payload_certificate.h,v $ * $Author: edahlber $ $Date: 2011-12-06 15:25:28 $ * $State: Exp $ $Locker: $ * * INTERPEAK_COPYRIGHT_STRING * Design and implementation by Kenneth Jonsson ****************************************************************************** */ #ifndef IPIKE_PAYLOAD_CERT_H #define IPIKE_PAYLOAD_CERT_H /* **************************************************************************** * 1 DESCRIPTION **************************************************************************** */ /* Certificate payload (RFC 2408, chapter 3.9) */ /* IKE version 1 and 2 */ /* **************************************************************************** * 2 CONFIGURATION **************************************************************************** */ #include "ipike_config.h" /* **************************************************************************** * 3 INCLUDE FILES **************************************************************************** */ #include "ipike_payload.h" #include #ifdef IPIKE_USE_OCSP #include #endif #ifdef __cplusplus extern "C" { #endif /* **************************************************************************** * 4 DEFINES **************************************************************************** */ #define IPIKE_CERT_HEADER_LENGTH 5 #define IPIKE_CERT_REQ_HEADER_LENGTH 5 /* X509 certificates wrapped in a PKCS#7 message */ #define IPIKE_CERT_PKCS_7 1 #define IPIKE_CERT_PGP 2 #define IPIKE_CERT_SIGNED_KEY 3 #define IPIKE_CERT_X509_SIGNATURE 4 #define IPIKE_CERT_X509_KEY_EXCHANGE 5 #define IPIKE_CERT_KERBEROS_TOKENS 6 #define IPIKE_CERT_CRL 7 #define IPIKE_CERT_ARL 8 #define IPIKE_CERT_SPKI 9 #define IPIKE_CERT_X509_ATTRIBUTE 10 #define IPIKE_CERT_X509_HASH_AND_URL 12 #define IPIKE_OCSP_CONTENT 14 /* **************************************************************************** * 5 TYPES **************************************************************************** */ /* Certificate Payload Format 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ! Next Payload ! RESERVED ! Payload Length ! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ! Cert Encoding ! ! +-+-+-+-+-+-+-+-+ ! ~ Certificate Data ~ ! ! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ */ typedef struct Ipike_cert_payload_struct { /* The generic ISAKMP payload header, the length includes the length of all transforms associated with the proposal */ Ipike_payload_header header; Ip_u8 cert_encoding; /* Hash data follows */ } Ipike_cert_payload; typedef struct Ipike_cert_struct { /* The certificate for our side */ X509* local; /* The certificate for the peer */ X509* peer; /* The certificate of additional certificates */ X509** ca; /* The certificate of trusted certificates */ X509** trusted; #ifdef IPIKE_USE_OCSP OCSP_RESPONSE *resp_local; OCSP_RESPONSE *resp_peer; #endif /* The CRLs used for certificate revocation check */ X509_CRL** crls; /* URL that points to the certificate when "Hash and URL" is used. */ const char *peer_url; } Ipike_cert; typedef struct Ipike_cert_req_payload_struct { /* The generic ISAKMP payload header, the length includes the length of all transforms associated with the proposal */ Ipike_payload_header header; /* Currently cert req is only used for OCSP content */ Ip_u8 cert_encoding; /* Hash data follows */ } Ipike_cert_req_payload; /* **************************************************************************** * 6 FUNCTIONS **************************************************************************** */ /* *=========================================================================== * ipike_payload_certificate_free *=========================================================================== * Description: Frees a Ipike_cert structure. * Parameters: cert - The cert structure to free. * Returns: * */ IP_GLOBAL void ipike_payload_certificate_free(Ipike_cert* cert); /* *=========================================================================== * ipike_payload_certificate_create *=========================================================================== * Description: Creates a new certificate payload. * Parameters: cert - The certificate structure to create the payload from. * uri - URI pointing out the location of the certificate. * Only supported in IKEv2. * payload - will point to a new certificate payload. * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY * */ IP_GLOBAL Ipike_error ipike_payload_certificate_create(X509* cert, const char *uri, Ipike_cert_payload** payload); #ifdef IPIKE_USE_OCSP /* *=========================================================================== * ipike_payload_certificate_ocsp_create *=========================================================================== * Description: Creates a new certificate payload with OCSP content. * Parameters: resp - The OCSP response that will be packaged as per * RFC 4806 specs. * payload - will point to a new certificate payload. * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY * */ IP_GLOBAL Ipike_error ipike_payload_certificate_ocsp_create(OCSP_RESPONSE* resp, Ipike_cert_payload** payload); #endif /* *=========================================================================== * ipike_payload_certificate_req_create_v1 *=========================================================================== * Description: Creates a new certificate IKEv1 req payload. * Parameters: payload - will point to a new certificate req payload. * ca_cert - Trusted CA certificate. * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY * */ IP_GLOBAL Ipike_error ipike_payload_certificate_req_create_v1( Ipike_cert_req_payload** payload, X509* ca_cert); #ifdef IPIKE_USE_VERSION2 /* *=========================================================================== * ipike_payload_certificate_req_create_v2 *=========================================================================== * Description: Creates a new certificate IKEv2 req payload. * Parameters: payload - will point to a new certificate req payload. * cert - Certificate information * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY * */ IP_GLOBAL Ipike_error ipike_payload_certificate_req_create_v2( Ipike_cert_req_payload **payload, Ipike_cert *cert); #endif /* *=========================================================================== * ipike_payload_certificate_check *=========================================================================== * Description: Verifies that the certificate payload is sane. * Parameters: cert - a pointer to a certificate payload. * Returns: IPIKE_SUCCESS * */ IP_GLOBAL Ipike_error ipike_payload_certificate_check(Ipike_cert_payload* cert); /* *=========================================================================== * ipike_payload_certificate_request_check *=========================================================================== * Description: Verifies that the certificate request payload is sane. * Parameters: req - a pointer to a certificate request payload. * Returns: IPIKE_SUCCESS * */ IP_GLOBAL Ipike_error ipike_payload_certificate_request_check(Ipike_cert_req_payload* req); /* *=========================================================================== * ipike_payload_certificate_print *=========================================================================== * Description: Prints the content of the certificate payload to the * system log. * Parameters: cert - A pointer to a certificate payload. * Returns: * * */ IP_GLOBAL void ipike_payload_certificate_print(Ipike_cert_payload* cert); /* *=========================================================================== * ipike_payload_certificate_request_print *=========================================================================== * Description: Prints the content of the certificate req payload to the * system log. * Parameters: cert - A pointer to a certificate req payload. * Returns: * * */ IP_GLOBAL void ipike_payload_certificate_request_print(Ipike_cert_req_payload* req); /* *=========================================================================== * ipike_payload_certificate_extract *=========================================================================== * Description: Extracts the certificate data from the payload. * Parameters: payload - a certificate payload. * cert - will be updated with the certificate data if the call * was successful. * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY * */ IP_GLOBAL Ipike_error ipike_payload_certificate_extract(Ipike_cert_payload* payload, Ipike_cert* cert); /* *=========================================================================== * ipike_payload_certificate_req_extract_v1 *=========================================================================== * Description: Extracts the certificate request data from the payload used * in IKEv1. * Parameters: payload - a certificate req payload. * Returns: IPIKE_SUCCESS * * */ IP_GLOBAL Ipike_error ipike_payload_certificate_req_extract_v1( Ipike_cert_req_payload* payload, Ipike_cert *cert); #ifdef IPIKE_USE_OCSP /* *=========================================================================== * ipike_payload_certificate_req_extract_v2 *=========================================================================== * Description: Extracts the certificate request data from the payload used * in IKEv2. * Parameters: payload - a certificate req payload. * ocsp_resp_flag - set to TRUE if a ocsp response has to be sent * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY * */ IP_GLOBAL Ipike_error ipike_payload_certificate_req_extract_v2(Ipike_cert_req_payload* payload, Ip_bool* ocsp_resp_flag); #endif /* #ifdef IPIKE_USE_OCSP */ #ifdef __cplusplus } #endif #endif /* **************************************************************************** * END OF FILE **************************************************************************** */