/* ****************************************************************************** * SOURCE FILE * * Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_attributes.c,v $ $Revision: 1.47.10.6 $ * $Source: /home/interpeak/CVSRoot/ipike/src/ipike_attributes.c,v $ * $Author: jsheng $ $Date: 2014-10-09 09:25:58 $ * $State: Exp $ $Locker: $ * * INTERPEAK_COPYRIGHT_STRING * Design and implementation by Kenneth Jonsson ****************************************************************************** */ /* **************************************************************************** * 1 DESCRIPTION **************************************************************************** */ /* IKE attributes from Appendix A, RFC 2409 */ /* **************************************************************************** * 2 CONFIGURATION **************************************************************************** */ #include "ipike_config.h" /* **************************************************************************** * 3 INCLUDE FILES **************************************************************************** */ #include "ipike_h.h" #include "ipike_attributes.h" #include "ipike2_payload_sa.h" #include "ipike_util.h" #include "ipike_ipsec_attributes.h" #include #include /* **************************************************************************** * 4 EXTERN PROTOTYPES **************************************************************************** */ /* **************************************************************************** * 5 DEFINES **************************************************************************** */ #ifndef BF_ROUNDS #define BF_ROUNDS 16 #endif /* **************************************************************************** * 6 TYPES **************************************************************************** */ /* **************************************************************************** * 7 LOCAL PROTOTYPES **************************************************************************** */ /* *=========================================================================== * ipike_check_basic_attr_encoding *=========================================================================== * Description: Checks an attribute that has basic encoding. * Parameters: attr - the attribute to check. * Returns: IPIKE_SUCCESS * IPIKE_ATTRIBUTE_MUST_BE_BASIC */ IP_STATIC Ipike_error ipike_check_basic_attr_encoding(Ipike_attribute* attr); /* **************************************************************************** * 8 DATA **************************************************************************** */ /* First Oakley Default Group Oakley implementations MUST support a MODP group with the following prime and generator. This group is assigned id 1 (one). The prime is: 2^768 - 2 ^704 - 1 + 2^64 * { [2^638 pi] + 149686 } The generator is: 2. */ static Ip_u8 ipike_default_768_bit_MODP_group_data[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34, 0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1, 0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74, 0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22, 0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD, 0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B, 0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37, 0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45, 0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6, 0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x3A, 0x36, 0x20, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF }; static Ipike_value ipike_default_768_bit_MODP_group = { ipike_default_768_bit_MODP_group_data, sizeof(ipike_default_768_bit_MODP_group_data) }; static const Ip_u32 ipike_default_768_bit_MODP_generator = 2; /* Second Oakley Group IKE implementations SHOULD support a MODP group with the following prime and generator. This group is assigned id 2 (two). The prime is 2^1024 - 2^960 - 1 + 2^64 * { [2^894 pi] + 129093 }. The generator is: 2. */ static Ip_u8 ipike_alternate_1024_bit_MODP_group_data[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34, 0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1, 0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74, 0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22, 0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD, 0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B, 0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37, 0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45, 0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6, 0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B, 0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED, 0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5, 0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6, 0x49, 0x28, 0x66, 0x51, 0xEC, 0xE6, 0x53, 0x81, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF }; static Ipike_value ipike_alternate_1024_bit_MODP_group = { ipike_alternate_1024_bit_MODP_group_data, sizeof(ipike_alternate_1024_bit_MODP_group_data) }; static const Ip_u32 ipike_alternate_1024_bit_MODP_generator = 2; /* IKE implementations MAY support a MODP group with the following prime and generator. This group is assigned id 5. The prime is: 2^1536 - 2^1472 - 1 + 2^64 * { [2^1406 pi] + 741804 } The generator is: 2. */ static Ip_u8 ipike_alternate_1536_bit_MODP_group_data[] = { 0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xC9,0x0F,0xDA,0xA2,0x21,0x68,0xC2,0x34, 0xC4,0xC6,0x62,0x8B,0x80,0xDC,0x1C,0xD1,0x29,0x02,0x4E,0x08,0x8A,0x67,0xCC,0x74, 0x02,0x0B,0xBE,0xA6,0x3B,0x13,0x9B,0x22,0x51,0x4A,0x08,0x79,0x8E,0x34,0x04,0xDD, 0xEF,0x95,0x19,0xB3,0xCD,0x3A,0x43,0x1B,0x30,0x2B,0x0A,0x6D,0xF2,0x5F,0x14,0x37, 0x4F,0xE1,0x35,0x6D,0x6D,0x51,0xC2,0x45,0xE4,0x85,0xB5,0x76,0x62,0x5E,0x7E,0xC6, 0xF4,0x4C,0x42,0xE9,0xA6,0x37,0xED,0x6B,0x0B,0xFF,0x5C,0xB6,0xF4,0x06,0xB7,0xED, 0xEE,0x38,0x6B,0xFB,0x5A,0x89,0x9F,0xA5,0xAE,0x9F,0x24,0x11,0x7C,0x4B,0x1F,0xE6, 0x49,0x28,0x66,0x51,0xEC,0xE4,0x5B,0x3D,0xC2,0x00,0x7C,0xB8,0xA1,0x63,0xBF,0x05, 0x98,0xDA,0x48,0x36,0x1C,0x55,0xD3,0x9A,0x69,0x16,0x3F,0xA8,0xFD,0x24,0xCF,0x5F, 0x83,0x65,0x5D,0x23,0xDC,0xA3,0xAD,0x96,0x1C,0x62,0xF3,0x56,0x20,0x85,0x52,0xBB, 0x9E,0xD5,0x29,0x07,0x70,0x96,0x96,0x6D,0x67,0x0C,0x35,0x4E,0x4A,0xBC,0x98,0x04, 0xF1,0x74,0x6C,0x08,0xCA,0x23,0x73,0x27,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF }; static Ipike_value ipike_alternate_1536_bit_MODP_group = { ipike_alternate_1536_bit_MODP_group_data, sizeof(ipike_alternate_1536_bit_MODP_group_data) }; static const Ip_u32 ipike_alternate_1536_bit_MODP_generator = 2; /* IKE implementations MAY support a MODP group with the following prime and generator. This group is assigned id 14. This prime is: 2^2048 - 2^1984 - 1 + 2^64 * { [2^1918 pi] + 124476 } The generator is: 2. */ static Ip_u8 ipike_alternate_2048_bit_MODP_group_data[] = { 0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xC9,0x0F,0xDA,0xA2,0x21,0x68,0xC2,0x34, 0xC4,0xC6,0x62,0x8B,0x80,0xDC,0x1C,0xD1,0x29,0x02,0x4E,0x08,0x8A,0x67,0xCC,0x74, 0x02,0x0B,0xBE,0xA6,0x3B,0x13,0x9B,0x22,0x51,0x4A,0x08,0x79,0x8E,0x34,0x04,0xDD, 0xEF,0x95,0x19,0xB3,0xCD,0x3A,0x43,0x1B,0x30,0x2B,0x0A,0x6D,0xF2,0x5F,0x14,0x37, 0x4F,0xE1,0x35,0x6D,0x6D,0x51,0xC2,0x45,0xE4,0x85,0xB5,0x76,0x62,0x5E,0x7E,0xC6, 0xF4,0x4C,0x42,0xE9,0xA6,0x37,0xED,0x6B,0x0B,0xFF,0x5C,0xB6,0xF4,0x06,0xB7,0xED, 0xEE,0x38,0x6B,0xFB,0x5A,0x89,0x9F,0xA5,0xAE,0x9F,0x24,0x11,0x7C,0x4B,0x1F,0xE6, 0x49,0x28,0x66,0x51,0xEC,0xE4,0x5B,0x3D,0xC2,0x00,0x7C,0xB8,0xA1,0x63,0xBF,0x05, 0x98,0xDA,0x48,0x36,0x1C,0x55,0xD3,0x9A,0x69,0x16,0x3F,0xA8,0xFD,0x24,0xCF,0x5F, 0x83,0x65,0x5D,0x23,0xDC,0xA3,0xAD,0x96,0x1C,0x62,0xF3,0x56,0x20,0x85,0x52,0xBB, 0x9E,0xD5,0x29,0x07,0x70,0x96,0x96,0x6D,0x67,0x0C,0x35,0x4E,0x4A,0xBC,0x98,0x04, 0xF1,0x74,0x6C,0x08,0xCA,0x18,0x21,0x7C,0x32,0x90,0x5E,0x46,0x2E,0x36,0xCE,0x3B, 0xE3,0x9E,0x77,0x2C,0x18,0x0E,0x86,0x03,0x9B,0x27,0x83,0xA2,0xEC,0x07,0xA2,0x8F, 0xB5,0xC5,0x5D,0xF0,0x6F,0x4C,0x52,0xC9,0xDE,0x2B,0xCB,0xF6,0x95,0x58,0x17,0x18, 0x39,0x95,0x49,0x7C,0xEA,0x95,0x6A,0xE5,0x15,0xD2,0x26,0x18,0x98,0xFA,0x05,0x10, 0x15,0x72,0x8E,0x5A,0x8A,0xAC,0xAA,0x68,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF }; static Ipike_value ipike_alternate_2048_bit_MODP_group = { ipike_alternate_2048_bit_MODP_group_data, sizeof(ipike_alternate_2048_bit_MODP_group_data) }; static const Ip_u32 ipike_alternate_2048_bit_MODP_generator = 2; /* IKE implementations MAY support a MODP group with the following prime and generator. This group is assigned id 15. This prime is: 2^3072 - 2^3008 - 1 + 2^64 * { [2^2942 pi] + 1690314 } The generator is: 2. */ static Ip_u8 ipike_alternate_3072_bit_MODP_group_data[] = { 0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xC9,0x0F,0xDA,0xA2,0x21,0x68,0xC2,0x34, 0xC4,0xC6,0x62,0x8B,0x80,0xDC,0x1C,0xD1,0x29,0x02,0x4E,0x08,0x8A,0x67,0xCC,0x74, 0x02,0x0B,0xBE,0xA6,0x3B,0x13,0x9B,0x22,0x51,0x4A,0x08,0x79,0x8E,0x34,0x04,0xDD, 0xEF,0x95,0x19,0xB3,0xCD,0x3A,0x43,0x1B,0x30,0x2B,0x0A,0x6D,0xF2,0x5F,0x14,0x37, 0x4F,0xE1,0x35,0x6D,0x6D,0x51,0xC2,0x45,0xE4,0x85,0xB5,0x76,0x62,0x5E,0x7E,0xC6, 0xF4,0x4C,0x42,0xE9,0xA6,0x37,0xED,0x6B,0x0B,0xFF,0x5C,0xB6,0xF4,0x06,0xB7,0xED, 0xEE,0x38,0x6B,0xFB,0x5A,0x89,0x9F,0xA5,0xAE,0x9F,0x24,0x11,0x7C,0x4B,0x1F,0xE6, 0x49,0x28,0x66,0x51,0xEC,0xE4,0x5B,0x3D,0xC2,0x00,0x7C,0xB8,0xA1,0x63,0xBF,0x05, 0x98,0xDA,0x48,0x36,0x1C,0x55,0xD3,0x9A,0x69,0x16,0x3F,0xA8,0xFD,0x24,0xCF,0x5F, 0x83,0x65,0x5D,0x23,0xDC,0xA3,0xAD,0x96,0x1C,0x62,0xF3,0x56,0x20,0x85,0x52,0xBB, 0x9E,0xD5,0x29,0x07,0x70,0x96,0x96,0x6D,0x67,0x0C,0x35,0x4E,0x4A,0xBC,0x98,0x04, 0xF1,0x74,0x6C,0x08,0xCA,0x18,0x21,0x7C,0x32,0x90,0x5E,0x46,0x2E,0x36,0xCE,0x3B, 0xE3,0x9E,0x77,0x2C,0x18,0x0E,0x86,0x03,0x9B,0x27,0x83,0xA2,0xEC,0x07,0xA2,0x8F, 0xB5,0xC5,0x5D,0xF0,0x6F,0x4C,0x52,0xC9,0xDE,0x2B,0xCB,0xF6,0x95,0x58,0x17,0x18, 0x39,0x95,0x49,0x7C,0xEA,0x95,0x6A,0xE5,0x15,0xD2,0x26,0x18,0x98,0xFA,0x05,0x10, 0x15,0x72,0x8E,0x5A,0x8A,0xAA,0xC4,0x2D,0xAD,0x33,0x17,0x0D,0x04,0x50,0x7A,0x33, 0xA8,0x55,0x21,0xAB,0xDF,0x1C,0xBA,0x64,0xEC,0xFB,0x85,0x04,0x58,0xDB,0xEF,0x0A, 0x8A,0xEA,0x71,0x57,0x5D,0x06,0x0C,0x7D,0xB3,0x97,0x0F,0x85,0xA6,0xE1,0xE4,0xC7, 0xAB,0xF5,0xAE,0x8C,0xDB,0x09,0x33,0xD7,0x1E,0x8C,0x94,0xE0,0x4A,0x25,0x61,0x9D, 0xCE,0xE3,0xD2,0x26,0x1A,0xD2,0xEE,0x6B,0xF1,0x2F,0xFA,0x06,0xD9,0x8A,0x08,0x64, 0xD8,0x76,0x02,0x73,0x3E,0xC8,0x6A,0x64,0x52,0x1F,0x2B,0x18,0x17,0x7B,0x20,0x0C, 0xBB,0xE1,0x17,0x57,0x7A,0x61,0x5D,0x6C,0x77,0x09,0x88,0xC0,0xBA,0xD9,0x46,0xE2, 0x08,0xE2,0x4F,0xA0,0x74,0xE5,0xAB,0x31,0x43,0xDB,0x5B,0xFC,0xE0,0xFD,0x10,0x8E, 0x4B,0x82,0xD1,0x20,0xA9,0x3A,0xD2,0xCA,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF }; static Ipike_value ipike_alternate_3072_bit_MODP_group = { ipike_alternate_3072_bit_MODP_group_data, sizeof(ipike_alternate_3072_bit_MODP_group_data) }; static const Ip_u32 ipike_alternate_3072_bit_MODP_generator = 2; /* IKE implementations MAY support a MODP group with the following prime and generator. This group is assigned id 16. This prime is: 2^4096 - 2^4032 - 1 + 2^64 * { [2^3966 pi] + 240904 } The generator is: 2. */ static Ip_u8 ipike_alternate_4096_bit_MODP_group_data[] = { 0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xC9,0x0F,0xDA,0xA2,0x21,0x68,0xC2,0x34, 0xC4,0xC6,0x62,0x8B,0x80,0xDC,0x1C,0xD1,0x29,0x02,0x4E,0x08,0x8A,0x67,0xCC,0x74, 0x02,0x0B,0xBE,0xA6,0x3B,0x13,0x9B,0x22,0x51,0x4A,0x08,0x79,0x8E,0x34,0x04,0xDD, 0xEF,0x95,0x19,0xB3,0xCD,0x3A,0x43,0x1B,0x30,0x2B,0x0A,0x6D,0xF2,0x5F,0x14,0x37, 0x4F,0xE1,0x35,0x6D,0x6D,0x51,0xC2,0x45,0xE4,0x85,0xB5,0x76,0x62,0x5E,0x7E,0xC6, 0xF4,0x4C,0x42,0xE9,0xA6,0x37,0xED,0x6B,0x0B,0xFF,0x5C,0xB6,0xF4,0x06,0xB7,0xED, 0xEE,0x38,0x6B,0xFB,0x5A,0x89,0x9F,0xA5,0xAE,0x9F,0x24,0x11,0x7C,0x4B,0x1F,0xE6, 0x49,0x28,0x66,0x51,0xEC,0xE4,0x5B,0x3D,0xC2,0x00,0x7C,0xB8,0xA1,0x63,0xBF,0x05, 0x98,0xDA,0x48,0x36,0x1C,0x55,0xD3,0x9A,0x69,0x16,0x3F,0xA8,0xFD,0x24,0xCF,0x5F, 0x83,0x65,0x5D,0x23,0xDC,0xA3,0xAD,0x96,0x1C,0x62,0xF3,0x56,0x20,0x85,0x52,0xBB, 0x9E,0xD5,0x29,0x07,0x70,0x96,0x96,0x6D,0x67,0x0C,0x35,0x4E,0x4A,0xBC,0x98,0x04, 0xF1,0x74,0x6C,0x08,0xCA,0x18,0x21,0x7C,0x32,0x90,0x5E,0x46,0x2E,0x36,0xCE,0x3B, 0xE3,0x9E,0x77,0x2C,0x18,0x0E,0x86,0x03,0x9B,0x27,0x83,0xA2,0xEC,0x07,0xA2,0x8F, 0xB5,0xC5,0x5D,0xF0,0x6F,0x4C,0x52,0xC9,0xDE,0x2B,0xCB,0xF6,0x95,0x58,0x17,0x18, 0x39,0x95,0x49,0x7C,0xEA,0x95,0x6A,0xE5,0x15,0xD2,0x26,0x18,0x98,0xFA,0x05,0x10, 0x15,0x72,0x8E,0x5A,0x8A,0xAA,0xC4,0x2D,0xAD,0x33,0x17,0x0D,0x04,0x50,0x7A,0x33, 0xA8,0x55,0x21,0xAB,0xDF,0x1C,0xBA,0x64,0xEC,0xFB,0x85,0x04,0x58,0xDB,0xEF,0x0A, 0x8A,0xEA,0x71,0x57,0x5D,0x06,0x0C,0x7D,0xB3,0x97,0x0F,0x85,0xA6,0xE1,0xE4,0xC7, 0xAB,0xF5,0xAE,0x8C,0xDB,0x09,0x33,0xD7,0x1E,0x8C,0x94,0xE0,0x4A,0x25,0x61,0x9D, 0xCE,0xE3,0xD2,0x26,0x1A,0xD2,0xEE,0x6B,0xF1,0x2F,0xFA,0x06,0xD9,0x8A,0x08,0x64, 0xD8,0x76,0x02,0x73,0x3E,0xC8,0x6A,0x64,0x52,0x1F,0x2B,0x18,0x17,0x7B,0x20,0x0C, 0xBB,0xE1,0x17,0x57,0x7A,0x61,0x5D,0x6C,0x77,0x09,0x88,0xC0,0xBA,0xD9,0x46,0xE2, 0x08,0xE2,0x4F,0xA0,0x74,0xE5,0xAB,0x31,0x43,0xDB,0x5B,0xFC,0xE0,0xFD,0x10,0x8E, 0x4B,0x82,0xD1,0x20,0xA9,0x21,0x08,0x01,0x1A,0x72,0x3C,0x12,0xA7,0x87,0xE6,0xD7, 0x88,0x71,0x9A,0x10,0xBD,0xBA,0x5B,0x26,0x99,0xC3,0x27,0x18,0x6A,0xF4,0xE2,0x3C, 0x1A,0x94,0x68,0x34,0xB6,0x15,0x0B,0xDA,0x25,0x83,0xE9,0xCA,0x2A,0xD4,0x4C,0xE8, 0xDB,0xBB,0xC2,0xDB,0x04,0xDE,0x8E,0xF9,0x2E,0x8E,0xFC,0x14,0x1F,0xBE,0xCA,0xA6, 0x28,0x7C,0x59,0x47,0x4E,0x6B,0xC0,0x5D,0x99,0xB2,0x96,0x4F,0xA0,0x90,0xC3,0xA2, 0x23,0x3B,0xA1,0x86,0x51,0x5B,0xE7,0xED,0x1F,0x61,0x29,0x70,0xCE,0xE2,0xD7,0xAF, 0xB8,0x1B,0xDD,0x76,0x21,0x70,0x48,0x1C,0xD0,0x06,0x91,0x27,0xD5,0xB0,0x5A,0xA9, 0x93,0xB4,0xEA,0x98,0x8D,0x8F,0xDD,0xC1,0x86,0xFF,0xB7,0xDC,0x90,0xA6,0xC0,0x8F, 0x4D,0xF4,0x35,0xC9,0x34,0x06,0x31,0x99,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF }; static Ipike_value ipike_alternate_4096_bit_MODP_group = { ipike_alternate_4096_bit_MODP_group_data, sizeof(ipike_alternate_4096_bit_MODP_group_data) }; static const Ip_u32 ipike_alternate_4096_bit_MODP_generator = 2; /* IKE implementations MAY support a MODP group with the following prime and generator. This group is assigned id 17. This prime is: 2^6144 - 2^3008 - 1 + 2^64 * { [2^2942 pi] + 1690314 } The generator is: 2. */ static Ip_u8 ipike_alternate_6144_bit_MODP_group_data[] = { 0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xC9,0x0F,0xDA,0xA2,0x21,0x68,0xC2,0x34, 0xC4,0xC6,0x62,0x8B,0x80,0xDC,0x1C,0xD1,0x29,0x02,0x4E,0x08,0x8A,0x67,0xCC,0x74, 0x02,0x0B,0xBE,0xA6,0x3B,0x13,0x9B,0x22,0x51,0x4A,0x08,0x79,0x8E,0x34,0x04,0xDD, 0xEF,0x95,0x19,0xB3,0xCD,0x3A,0x43,0x1B,0x30,0x2B,0x0A,0x6D,0xF2,0x5F,0x14,0x37, 0x4F,0xE1,0x35,0x6D,0x6D,0x51,0xC2,0x45,0xE4,0x85,0xB5,0x76,0x62,0x5E,0x7E,0xC6, 0xF4,0x4C,0x42,0xE9,0xA6,0x37,0xED,0x6B,0x0B,0xFF,0x5C,0xB6,0xF4,0x06,0xB7,0xED, 0xEE,0x38,0x6B,0xFB,0x5A,0x89,0x9F,0xA5,0xAE,0x9F,0x24,0x11,0x7C,0x4B,0x1F,0xE6, 0x49,0x28,0x66,0x51,0xEC,0xE4,0x5B,0x3D,0xC2,0x00,0x7C,0xB8,0xA1,0x63,0xBF,0x05, 0x98,0xDA,0x48,0x36,0x1C,0x55,0xD3,0x9A,0x69,0x16,0x3F,0xA8,0xFD,0x24,0xCF,0x5F, 0x83,0x65,0x5D,0x23,0xDC,0xA3,0xAD,0x96,0x1C,0x62,0xF3,0x56,0x20,0x85,0x52,0xBB, 0x9E,0xD5,0x29,0x07,0x70,0x96,0x96,0x6D,0x67,0x0C,0x35,0x4E,0x4A,0xBC,0x98,0x04, 0xF1,0x74,0x6C,0x08,0xCA,0x18,0x21,0x7C,0x32,0x90,0x5E,0x46,0x2E,0x36,0xCE,0x3B, 0xE3,0x9E,0x77,0x2C,0x18,0x0E,0x86,0x03,0x9B,0x27,0x83,0xA2,0xEC,0x07,0xA2,0x8F, 0xB5,0xC5,0x5D,0xF0,0x6F,0x4C,0x52,0xC9,0xDE,0x2B,0xCB,0xF6,0x95,0x58,0x17,0x18, 0x39,0x95,0x49,0x7C,0xEA,0x95,0x6A,0xE5,0x15,0xD2,0x26,0x18,0x98,0xFA,0x05,0x10, 0x15,0x72,0x8E,0x5A,0x8A,0xAA,0xC4,0x2D,0xAD,0x33,0x17,0x0D,0x04,0x50,0x7A,0x33, 0xA8,0x55,0x21,0xAB,0xDF,0x1C,0xBA,0x64,0xEC,0xFB,0x85,0x04,0x58,0xDB,0xEF,0x0A, 0x8A,0xEA,0x71,0x57,0x5D,0x06,0x0C,0x7D,0xB3,0x97,0x0F,0x85,0xA6,0xE1,0xE4,0xC7, 0xAB,0xF5,0xAE,0x8C,0xDB,0x09,0x33,0xD7,0x1E,0x8C,0x94,0xE0,0x4A,0x25,0x61,0x9D, 0xCE,0xE3,0xD2,0x26,0x1A,0xD2,0xEE,0x6B,0xF1,0x2F,0xFA,0x06,0xD9,0x8A,0x08,0x64, 0xD8,0x76,0x02,0x73,0x3E,0xC8,0x6A,0x64,0x52,0x1F,0x2B,0x18,0x17,0x7B,0x20,0x0C, 0xBB,0xE1,0x17,0x57,0x7A,0x61,0x5D,0x6C,0x77,0x09,0x88,0xC0,0xBA,0xD9,0x46,0xE2, 0x08,0xE2,0x4F,0xA0,0x74,0xE5,0xAB,0x31,0x43,0xDB,0x5B,0xFC,0xE0,0xFD,0x10,0x8E, 0x4B,0x82,0xD1,0x20,0xA9,0x21,0x08,0x01,0x1A,0x72,0x3C,0x12,0xA7,0x87,0xE6,0xD7, 0x88,0x71,0x9A,0x10,0xBD,0xBA,0x5B,0x26,0x99,0xC3,0x27,0x18,0x6A,0xF4,0xE2,0x3C, 0x1A,0x94,0x68,0x34,0xB6,0x15,0x0B,0xDA,0x25,0x83,0xE9,0xCA,0x2A,0xD4,0x4C,0xE8, 0xDB,0xBB,0xC2,0xDB,0x04,0xDE,0x8E,0xF9,0x2E,0x8E,0xFC,0x14,0x1F,0xBE,0xCA,0xA6, 0x28,0x7C,0x59,0x47,0x4E,0x6B,0xC0,0x5D,0x99,0xB2,0x96,0x4F,0xA0,0x90,0xC3,0xA2, 0x23,0x3B,0xA1,0x86,0x51,0x5B,0xE7,0xED,0x1F,0x61,0x29,0x70,0xCE,0xE2,0xD7,0xAF, 0xB8,0x1B,0xDD,0x76,0x21,0x70,0x48,0x1C,0xD0,0x06,0x91,0x27,0xD5,0xB0,0x5A,0xA9, 0x93,0xB4,0xEA,0x98,0x8D,0x8F,0xDD,0xC1,0x86,0xFF,0xB7,0xDC,0x90,0xA6,0xC0,0x8F, 0x4D,0xF4,0x35,0xC9,0x34,0x02,0x84,0x92,0x36,0xC3,0xFA,0xB4,0xD2,0x7C,0x70,0x26, 0xC1,0xD4,0xDC,0xB2,0x60,0x26,0x46,0xDE,0xC9,0x75,0x1E,0x76,0x3D,0xBA,0x37,0xBD, 0xF8,0xFF,0x94,0x06,0xAD,0x9E,0x53,0x0E,0xE5,0xDB,0x38,0x2F,0x41,0x30,0x01,0xAE, 0xB0,0x6A,0x53,0xED,0x90,0x27,0xD8,0x31,0x17,0x97,0x27,0xB0,0x86,0x5A,0x89,0x18, 0xDA,0x3E,0xDB,0xEB,0xCF,0x9B,0x14,0xED,0x44,0xCE,0x6C,0xBA,0xCE,0xD4,0xBB,0x1B, 0xDB,0x7F,0x14,0x47,0xE6,0xCC,0x25,0x4B,0x33,0x20,0x51,0x51,0x2B,0xD7,0xAF,0x42, 0x6F,0xB8,0xF4,0x01,0x37,0x8C,0xD2,0xBF,0x59,0x83,0xCA,0x01,0xC6,0x4B,0x92,0xEC, 0xF0,0x32,0xEA,0x15,0xD1,0x72,0x1D,0x03,0xF4,0x82,0xD7,0xCE,0x6E,0x74,0xFE,0xF6, 0xD5,0x5E,0x70,0x2F,0x46,0x98,0x0C,0x82,0xB5,0xA8,0x40,0x31,0x90,0x0B,0x1C,0x9E, 0x59,0xE7,0xC9,0x7F,0xBE,0xC7,0xE8,0xF3,0x23,0xA9,0x7A,0x7E,0x36,0xCC,0x88,0xBE, 0x0F,0x1D,0x45,0xB7,0xFF,0x58,0x5A,0xC5,0x4B,0xD4,0x07,0xB2,0x2B,0x41,0x54,0xAA, 0xCC,0x8F,0x6D,0x7E,0xBF,0x48,0xE1,0xD8,0x14,0xCC,0x5E,0xD2,0x0F,0x80,0x37,0xE0, 0xA7,0x97,0x15,0xEE,0xF2,0x9B,0xE3,0x28,0x06,0xA1,0xD5,0x8B,0xB7,0xC5,0xDA,0x76, 0xF5,0x50,0xAA,0x3D,0x8A,0x1F,0xBF,0xF0,0xEB,0x19,0xCC,0xB1,0xA3,0x13,0xD5,0x5C, 0xDA,0x56,0xC9,0xEC,0x2E,0xF2,0x96,0x32,0x38,0x7F,0xE8,0xD7,0x6E,0x3C,0x04,0x68, 0x04,0x3E,0x8F,0x66,0x3F,0x48,0x60,0xEE,0x12,0xBF,0x2D,0x5B,0x0B,0x74,0x74,0xD6, 0xE6,0x94,0xF9,0x1E,0x6D,0xCC,0x40,0x24,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF }; static Ipike_value ipike_alternate_6144_bit_MODP_group = { ipike_alternate_6144_bit_MODP_group_data, sizeof(ipike_alternate_6144_bit_MODP_group_data) }; static const Ip_u32 ipike_alternate_6144_bit_MODP_generator = 2; /* IKE implementations MAY support a MODP group with the following prime and generator. This group is assigned id 18. This prime is: 2^8192 - 2^8128 - 1 + 2^64 * { [2^8062 pi] + 4743158 } The generator is: 2. */ static Ip_u8 ipike_alternate_8192_bit_MODP_group_data[] = { 0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xC9,0x0F,0xDA,0xA2,0x21,0x68,0xC2,0x34, 0xC4,0xC6,0x62,0x8B,0x80,0xDC,0x1C,0xD1,0x29,0x02,0x4E,0x08,0x8A,0x67,0xCC,0x74, 0x02,0x0B,0xBE,0xA6,0x3B,0x13,0x9B,0x22,0x51,0x4A,0x08,0x79,0x8E,0x34,0x04,0xDD, 0xEF,0x95,0x19,0xB3,0xCD,0x3A,0x43,0x1B,0x30,0x2B,0x0A,0x6D,0xF2,0x5F,0x14,0x37, 0x4F,0xE1,0x35,0x6D,0x6D,0x51,0xC2,0x45,0xE4,0x85,0xB5,0x76,0x62,0x5E,0x7E,0xC6, 0xF4,0x4C,0x42,0xE9,0xA6,0x37,0xED,0x6B,0x0B,0xFF,0x5C,0xB6,0xF4,0x06,0xB7,0xED, 0xEE,0x38,0x6B,0xFB,0x5A,0x89,0x9F,0xA5,0xAE,0x9F,0x24,0x11,0x7C,0x4B,0x1F,0xE6, 0x49,0x28,0x66,0x51,0xEC,0xE4,0x5B,0x3D,0xC2,0x00,0x7C,0xB8,0xA1,0x63,0xBF,0x05, 0x98,0xDA,0x48,0x36,0x1C,0x55,0xD3,0x9A,0x69,0x16,0x3F,0xA8,0xFD,0x24,0xCF,0x5F, 0x83,0x65,0x5D,0x23,0xDC,0xA3,0xAD,0x96,0x1C,0x62,0xF3,0x56,0x20,0x85,0x52,0xBB, 0x9E,0xD5,0x29,0x07,0x70,0x96,0x96,0x6D,0x67,0x0C,0x35,0x4E,0x4A,0xBC,0x98,0x04, 0xF1,0x74,0x6C,0x08,0xCA,0x18,0x21,0x7C,0x32,0x90,0x5E,0x46,0x2E,0x36,0xCE,0x3B, 0xE3,0x9E,0x77,0x2C,0x18,0x0E,0x86,0x03,0x9B,0x27,0x83,0xA2,0xEC,0x07,0xA2,0x8F, 0xB5,0xC5,0x5D,0xF0,0x6F,0x4C,0x52,0xC9,0xDE,0x2B,0xCB,0xF6,0x95,0x58,0x17,0x18, 0x39,0x95,0x49,0x7C,0xEA,0x95,0x6A,0xE5,0x15,0xD2,0x26,0x18,0x98,0xFA,0x05,0x10, 0x15,0x72,0x8E,0x5A,0x8A,0xAA,0xC4,0x2D,0xAD,0x33,0x17,0x0D,0x04,0x50,0x7A,0x33, 0xA8,0x55,0x21,0xAB,0xDF,0x1C,0xBA,0x64,0xEC,0xFB,0x85,0x04,0x58,0xDB,0xEF,0x0A, 0x8A,0xEA,0x71,0x57,0x5D,0x06,0x0C,0x7D,0xB3,0x97,0x0F,0x85,0xA6,0xE1,0xE4,0xC7, 0xAB,0xF5,0xAE,0x8C,0xDB,0x09,0x33,0xD7,0x1E,0x8C,0x94,0xE0,0x4A,0x25,0x61,0x9D, 0xCE,0xE3,0xD2,0x26,0x1A,0xD2,0xEE,0x6B,0xF1,0x2F,0xFA,0x06,0xD9,0x8A,0x08,0x64, 0xD8,0x76,0x02,0x73,0x3E,0xC8,0x6A,0x64,0x52,0x1F,0x2B,0x18,0x17,0x7B,0x20,0x0C, 0xBB,0xE1,0x17,0x57,0x7A,0x61,0x5D,0x6C,0x77,0x09,0x88,0xC0,0xBA,0xD9,0x46,0xE2, 0x08,0xE2,0x4F,0xA0,0x74,0xE5,0xAB,0x31,0x43,0xDB,0x5B,0xFC,0xE0,0xFD,0x10,0x8E, 0x4B,0x82,0xD1,0x20,0xA9,0x21,0x08,0x01,0x1A,0x72,0x3C,0x12,0xA7,0x87,0xE6,0xD7, 0x88,0x71,0x9A,0x10,0xBD,0xBA,0x5B,0x26,0x99,0xC3,0x27,0x18,0x6A,0xF4,0xE2,0x3C, 0x1A,0x94,0x68,0x34,0xB6,0x15,0x0B,0xDA,0x25,0x83,0xE9,0xCA,0x2A,0xD4,0x4C,0xE8, 0xDB,0xBB,0xC2,0xDB,0x04,0xDE,0x8E,0xF9,0x2E,0x8E,0xFC,0x14,0x1F,0xBE,0xCA,0xA6, 0x28,0x7C,0x59,0x47,0x4E,0x6B,0xC0,0x5D,0x99,0xB2,0x96,0x4F,0xA0,0x90,0xC3,0xA2, 0x23,0x3B,0xA1,0x86,0x51,0x5B,0xE7,0xED,0x1F,0x61,0x29,0x70,0xCE,0xE2,0xD7,0xAF, 0xB8,0x1B,0xDD,0x76,0x21,0x70,0x48,0x1C,0xD0,0x06,0x91,0x27,0xD5,0xB0,0x5A,0xA9, 0x93,0xB4,0xEA,0x98,0x8D,0x8F,0xDD,0xC1,0x86,0xFF,0xB7,0xDC,0x90,0xA6,0xC0,0x8F, 0x4D,0xF4,0x35,0xC9,0x34,0x02,0x84,0x92,0x36,0xC3,0xFA,0xB4,0xD2,0x7C,0x70,0x26, 0xC1,0xD4,0xDC,0xB2,0x60,0x26,0x46,0xDE,0xC9,0x75,0x1E,0x76,0x3D,0xBA,0x37,0xBD, 0xF8,0xFF,0x94,0x06,0xAD,0x9E,0x53,0x0E,0xE5,0xDB,0x38,0x2F,0x41,0x30,0x01,0xAE, 0xB0,0x6A,0x53,0xED,0x90,0x27,0xD8,0x31,0x17,0x97,0x27,0xB0,0x86,0x5A,0x89,0x18, 0xDA,0x3E,0xDB,0xEB,0xCF,0x9B,0x14,0xED,0x44,0xCE,0x6C,0xBA,0xCE,0xD4,0xBB,0x1B, 0xDB,0x7F,0x14,0x47,0xE6,0xCC,0x25,0x4B,0x33,0x20,0x51,0x51,0x2B,0xD7,0xAF,0x42, 0x6F,0xB8,0xF4,0x01,0x37,0x8C,0xD2,0xBF,0x59,0x83,0xCA,0x01,0xC6,0x4B,0x92,0xEC, 0xF0,0x32,0xEA,0x15,0xD1,0x72,0x1D,0x03,0xF4,0x82,0xD7,0xCE,0x6E,0x74,0xFE,0xF6, 0xD5,0x5E,0x70,0x2F,0x46,0x98,0x0C,0x82,0xB5,0xA8,0x40,0x31,0x90,0x0B,0x1C,0x9E, 0x59,0xE7,0xC9,0x7F,0xBE,0xC7,0xE8,0xF3,0x23,0xA9,0x7A,0x7E,0x36,0xCC,0x88,0xBE, 0x0F,0x1D,0x45,0xB7,0xFF,0x58,0x5A,0xC5,0x4B,0xD4,0x07,0xB2,0x2B,0x41,0x54,0xAA, 0xCC,0x8F,0x6D,0x7E,0xBF,0x48,0xE1,0xD8,0x14,0xCC,0x5E,0xD2,0x0F,0x80,0x37,0xE0, 0xA7,0x97,0x15,0xEE,0xF2,0x9B,0xE3,0x28,0x06,0xA1,0xD5,0x8B,0xB7,0xC5,0xDA,0x76, 0xF5,0x50,0xAA,0x3D,0x8A,0x1F,0xBF,0xF0,0xEB,0x19,0xCC,0xB1,0xA3,0x13,0xD5,0x5C, 0xDA,0x56,0xC9,0xEC,0x2E,0xF2,0x96,0x32,0x38,0x7F,0xE8,0xD7,0x6E,0x3C,0x04,0x68, 0x04,0x3E,0x8F,0x66,0x3F,0x48,0x60,0xEE,0x12,0xBF,0x2D,0x5B,0x0B,0x74,0x74,0xD6, 0xE6,0x94,0xF9,0x1E,0x6D,0xBE,0x11,0x59,0x74,0xA3,0x92,0x6F,0x12,0xFE,0xE5,0xE4, 0x38,0x77,0x7C,0xB6,0xA9,0x32,0xDF,0x8C,0xD8,0xBE,0xC4,0xD0,0x73,0xB9,0x31,0xBA, 0x3B,0xC8,0x32,0xB6,0x8D,0x9D,0xD3,0x00,0x74,0x1F,0xA7,0xBF,0x8A,0xFC,0x47,0xED, 0x25,0x76,0xF6,0x93,0x6B,0xA4,0x24,0x66,0x3A,0xAB,0x63,0x9C,0x5A,0xE4,0xF5,0x68, 0x34,0x23,0xB4,0x74,0x2B,0xF1,0xC9,0x78,0x23,0x8F,0x16,0xCB,0xE3,0x9D,0x65,0x2D, 0xE3,0xFD,0xB8,0xBE,0xFC,0x84,0x8A,0xD9,0x22,0x22,0x2E,0x04,0xA4,0x03,0x7C,0x07, 0x13,0xEB,0x57,0xA8,0x1A,0x23,0xF0,0xC7,0x34,0x73,0xFC,0x64,0x6C,0xEA,0x30,0x6B, 0x4B,0xCB,0xC8,0x86,0x2F,0x83,0x85,0xDD,0xFA,0x9D,0x4B,0x7F,0xA2,0xC0,0x87,0xE8, 0x79,0x68,0x33,0x03,0xED,0x5B,0xDD,0x3A,0x06,0x2B,0x3C,0xF5,0xB3,0xA2,0x78,0xA6, 0x6D,0x2A,0x13,0xF8,0x3F,0x44,0xF8,0x2D,0xDF,0x31,0x0E,0xE0,0x74,0xAB,0x6A,0x36, 0x45,0x97,0xE8,0x99,0xA0,0x25,0x5D,0xC1,0x64,0xF3,0x1C,0xC5,0x08,0x46,0x85,0x1D, 0xF9,0xAB,0x48,0x19,0x5D,0xED,0x7E,0xA1,0xB1,0xD5,0x10,0xBD,0x7E,0xE7,0x4D,0x73, 0xFA,0xF3,0x6B,0xC3,0x1E,0xCF,0xA2,0x68,0x35,0x90,0x46,0xF4,0xEB,0x87,0x9F,0x92, 0x40,0x09,0x43,0x8B,0x48,0x1C,0x6C,0xD7,0x88,0x9A,0x00,0x2E,0xD5,0xEE,0x38,0x2B, 0xC9,0x19,0x0D,0xA6,0xFC,0x02,0x6E,0x47,0x95,0x58,0xE4,0x47,0x56,0x77,0xE9,0xAA, 0x9E,0x30,0x50,0xE2,0x76,0x56,0x94,0xDF,0xC8,0x1F,0x56,0xE8,0x80,0xB9,0x6E,0x71, 0x60,0xC9,0x80,0xDD,0x98,0xED,0xD3,0xDF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF }; static Ipike_value ipike_alternate_8192_bit_MODP_group = { ipike_alternate_8192_bit_MODP_group_data, sizeof(ipike_alternate_8192_bit_MODP_group_data) }; static const Ip_u32 ipike_alternate_8192_bit_MODP_generator = 2; static const char* ipike_invalid_attr = "invalid attribute value"; /* **************************************************************************** * 9 LOCAL FUNCTIONS **************************************************************************** */ IP_STATIC Ipike_error ipike_check_basic_attr_encoding(Ipike_attribute* attr) { Ip_u16 attr_type = IP_GET_NTOHS(&attr->type); if (!IPIKE_ATTR_AF(attr_type)) { IPCOM_LOG1(ERR, "%s must use basic encoding", ipike_attribute_class_to_string(IPIKE_ATTR_TYPE(attr_type))); return IPIKE_ATTRIBUTE_MUST_BE_BASIC; } return IPIKE_SUCCESS; } /* **************************************************************************** * 10 PUBLIC FUNCTIONS **************************************************************************** */ /* *=========================================================================== * ipike_check_basic_attr *=========================================================================== * Description: * Parameters: * Returns: * */ IP_GLOBAL Ipike_error ipike_check_basic_attr(Ipike_attribute *attr, Ip_u16 value_range) { Ipike_error err; Ip_u16 attr_type; Ip_u16 attr_value; attr_type = IP_GET_NTOHS(&attr->type); attr_value = IP_GET_NTOHS(&attr->value); (void)attr_type; err = ipike_check_basic_attr_encoding(attr); if (err != IPIKE_SUCCESS) return err; if (attr_value < 1 || attr_value > value_range) { IPCOM_LOG3(ERR, "%d is not a valid value for %s, range is 1 - %d", (int)attr_value, ipike_attribute_class_to_string(IPIKE_ATTR_TYPE(attr_type)), (int)value_range); return IPIKE_ATTRIBUTE_INVALID_VALUE; } return IPIKE_SUCCESS; } IP_GLOBAL const char * ipike_attribute_class_to_string(Ip_u16 attribute_type) { static const char* attr_cls_str[IPIKE_ATTR_CLS_COUNT] = { "encryption algorithm", "hash algorithm", "authentication method", "group description", "group type", "group prime", "group generator one", "group generator two", "group curve A", "group curve B", "life type", "life duration", "pseudo random function", "key length", "field size", "group order", }; if (attribute_type != 0 && attribute_type <= IPIKE_ATTR_CLS_COUNT) return attr_cls_str[attribute_type - 1]; return "invalid attribute type"; } IP_GLOBAL const char* ipike_attribute_value_to_string(Ip_u16 type, Ip_u16 value) { switch (type) { case IPIKE_ATTR_CLS_ENCRYPTION_ALGORITHM: return ipike_attribute_encryption_alg_to_string(value); case IPIKE_ATTR_CLS_HASH_ALGORITHM: return ipike_attribute_hash_alg_to_string(value); case IPIKE_ATTR_CLS_AUTHENTICATION_METHOD: return ipike_attribute_auth_method_to_string(value); case IPIKE_ATTR_CLS_GROUP_DESCRIPTION: return ipike_attribute_dh_group_to_string(value); case IPIKE_ATTR_CLS_LIFE_TYPE: return ipike_attribute_life_type_to_string(value); } return IP_NULL; } IP_GLOBAL Ip_size_t ipike_attribute_size(Ipike_attribute* attr) { Ip_u16 attr_type,attr_value; attr_type = IP_GET_NTOHS(&attr->type); attr_value = IP_GET_NTOHS(&attr->value); if (IPIKE_ATTR_AF(attr_type)) return sizeof(Ipike_attribute); return (attr_value + sizeof(Ipike_attribute)); } IP_GLOBAL Ip_size_t ipike_attribute_array_size(Ipike_attribute** attrs) { int i; Ip_size_t size = 0; for (i = 0; attrs[i] != IP_NULL; i++) size += ipike_attribute_size(attrs[i]); return size; } IP_GLOBAL Ip_size_t ipike_attribute_array_count( Ip_u8* data, Ip_size_t length) { Ipike_attribute* attr = IP_NULL; Ip_size_t count = 0; Ip_ssize_t bytes_left = (Ip_ssize_t) length; attr = (Ipike_attribute*)data; while (bytes_left > 0) { count++; if ((attr = ipike_next_attribute(attr, &bytes_left)) == IP_NULL && bytes_left != 0) { count = 0; break; } } return count; } IP_GLOBAL Ipike_attribute** ipike_attributes_extract(Ip_u8* data, Ip_size_t length) { Ipike_attribute** values = IP_NULL; Ipike_attribute* attr = IP_NULL; Ip_size_t count = 0; int i = 0; if (length > 0) { count = ipike_attribute_array_count(data, length); if (count > 0) count++; } else { count++; } if (count > 0) { values = (Ipike_attribute**)ipcom_calloc(sizeof(*values), count); if (values != IP_NULL) { attr = (Ipike_attribute*)data; count--; while ((count > 0) && (length > 0) && (attr != IP_NULL)) { values[i++] = ipike_attribute_copy(attr); attr = ipike_next_attribute(attr, (Ip_ssize_t*)&length); count--; } } } return values; } IP_GLOBAL Ipike_attribute * ipike_attribute_copy(Ipike_attribute* attr) { Ipike_attribute * attr_copy; Ip_size_t attr_size = ipike_attribute_size(attr); if (IP_NULL == (attr_copy = ipcom_malloc(attr_size))) { IPCOM_LOG0(CRIT, "ipike_copy_attribute: out of memory"); return IP_NULL; } ipcom_memcpy((void*)attr_copy, (void*)attr, attr_size); return attr_copy; } IP_GLOBAL Ipike_attribute* ipike_attribute_new(Ip_u16 type, Ip_u32 value) { Ipike_attribute* attr; Ip_u16 total_size; total_size = (Ip_u16) (sizeof(Ipike_attribute) + (value > 0xFFFF ? 4 : 0)); if (IP_NULL == (attr = ipcom_malloc(total_size))) { IPCOM_LOG0(CRIT, "ipike_create_attribute: out of memory"); return IP_NULL; } if (value <= 0xFFFF) { attr->type = ip_htons(type | IPIKE_ATTR_BASIC); attr->value = (Ip_u16) ip_htons(value); } else { Ip_u32* attr_val = (Ip_u32*) ((Ip_u8*) attr + sizeof(Ipike_attribute)); attr->type = ip_htons(type | IPIKE_ATTR_VARIABLE); attr->value = ip_htons(4); *attr_val = ip_htonl(value); } return attr; } IP_GLOBAL Ipike_attribute* ipike_attribute_new2(Ip_u16 type, Ip_u64 value) { Ipike_attribute* attr; Ip_u16 total_size; Ip_u32* attr_val; /* Create as 32 bit if possible */ if (IP_U64_GETHI(value) == 0) return ipike_attribute_new(type, IP_U64_GETLO(value)); total_size = (Ip_u16) (sizeof(Ipike_attribute) + 8); if (IP_NULL == (attr = ipcom_malloc(total_size))) { IPCOM_LOG0(CRIT, "ipike_create_attribute: out of memory"); return IP_NULL; } attr_val = (Ip_u32*) ((Ip_u8*) attr + sizeof(Ipike_attribute)); attr->type = ip_htons(type | IPIKE_ATTR_VARIABLE); attr->value = ip_htons(8); *attr_val = ip_htonl(IP_U64_GETHI(value)); attr_val++; *attr_val = ip_htonl(IP_U64_GETLO(value)); return attr; } IP_GLOBAL Ipike_attribute* ipike_next_attribute(Ipike_attribute* attr, Ip_ssize_t* bytes_left) { Ipike_attribute* ret = IP_NULL; Ip_size_t attr_size = ipike_attribute_size(attr); *bytes_left -= (Ip_ssize_t) attr_size; if (*bytes_left <= 0) return IP_NULL; ret = (Ipike_attribute*) ((Ip_u8*) attr + attr_size); if ((Ip_size_t)(*bytes_left) < ipike_attribute_size(ret)) { IPCOM_LOG1(ERR, "the attribute extends beyond size of the buffer, last valid attribute was %s", ipike_attribute_class_to_string(IPIKE_ATTR_TYPE(IP_GET_NTOHS(&attr->type)))); return IP_NULL; } return ret; } IP_GLOBAL Ipike_error ipike_attribute_check(Ipike_attribute* attr, Ip_ssize_t attr_length, Ip_bool phase1) { Ip_ssize_t bytes_left = attr_length; Ip_ssize_t attr_count = 0; attr_count = ipike_attribute_array_count((Ip_u8 *)attr, (Ip_size_t)attr_length); if (attr_count > 0) { Ip_u16 *attr_types; int i; int attr_idx = 0; if ((attr_types = ipcom_calloc(attr_count, sizeof(Ip_u16))) == IP_NULL) return IPIKE_OUT_OF_MEMORY; while (IP_NULL != attr) { attr_types[attr_idx] = IPIKE_ATTR_TYPE(IP_GET_NTOHS(&attr->type)); for (i=0; ivalue); return IPIKE_SUCCESS; } IP_GLOBAL Ip_u16 ipike_attribute_get_default_key_length(Ip_u16 encryption_alg) { const char* enc_name; const EVP_CIPHER* evp_cipher; /* Treat encryption alg 0 as null cipher with blocksize 0 */ if (encryption_alg == 0) return 1; enc_name = ipike_attribute_encryption_alg_to_string(encryption_alg); if (IP_NULL == enc_name) { IPCOM_LOG2(ERR, "ipike_attribute_get_default_key_length: unknown encryption algorithm %s (%d)", enc_name, encryption_alg); return IPIKE_ATTR_INVALID; } if (IP_NULL == (evp_cipher = EVP_get_cipherbyname(enc_name))) { #ifndef OPENSSL_NO_CAST if (encryption_alg == IPIKE_ATTR_ENCRYPTION_CAST) return 16; /* rfc 2409 appendix B */ #endif #ifndef OPENSSL_NO_BF if (encryption_alg == IPIKE_ATTR_ENCRYPTION_BLOWFISH) return ((BF_ROUNDS-2)*4)/8; /* maximum length, rfc 2409 appendix B */ #endif #ifdef IPIKE_ISAKMPD_AES_KEY_LENGTH_BUG_WORKAROUND #ifndef OPENSSL_NO_AES /* Not correct since no default for AES */ if (encryption_alg == IPIKE_ATTR_ENCRYPTION_AESCBC) return 256/8; #endif #endif /* We have probably retrieved a ciphername above without specified key * length. This means that this algorithm have no default key length. * Return IPIKE_ATTR_INVALID without logging, since this may be normal */ return IPIKE_ATTR_INVALID; } return (Ip_u16) EVP_CIPHER_key_length(evp_cipher); } IP_GLOBAL Ip_u16 ipike_attribute_get_cipher_block_size(Ip_u16 encryption_alg, Ip_u16 key_length) { const char* enc_name; const EVP_CIPHER* evp_cipher; if ((encryption_alg == 0) || (encryption_alg == IPIKE_ATTR_INVALID)) return 0; enc_name = ipike_attribute_encryption_alg_key_length_to_string(encryption_alg, key_length); if (IP_NULL == enc_name) enc_name = ipike_attribute_encryption_alg_to_string(encryption_alg); if (IP_NULL == (evp_cipher = EVP_get_cipherbyname(enc_name))) { IPCOM_LOG2(ERR, "ipike_attribute_get_cipher_block_size: unknown encryption algorithm %s (%d)", enc_name, encryption_alg); return 0; } return (Ip_u16) EVP_CIPHER_block_size(evp_cipher); } IP_GLOBAL Ip_u16 ipike_attribute_get_digest_size(Ip_u16 hash_alg) { const char* hash_name; const EVP_MD* evp_hash; hash_name = ipike_attribute_hash_alg_to_string(hash_alg); if (IP_NULL == (evp_hash = EVP_get_digestbyname(hash_name))) { IPCOM_LOG2(ERR, "unknown hash algorithm %s (%d)", hash_name, hash_alg); return 0; } return (Ip_u16) EVP_MD_size(evp_hash); } IP_GLOBAL const EVP_MD * ipike_attribute_get_evp_hash(Ip_u16 hash_attr) { const EVP_MD *evp_md; const char* hash_name; hash_name = ipike_attribute_hash_alg_to_string(hash_attr); evp_md = EVP_get_digestbyname(hash_name); if (evp_md == IP_NULL) IPCOM_LOG1(ERR, "hash algorithm '%s' not supported by EVP", hash_name); return evp_md; } IP_GLOBAL const EVP_CIPHER * ipike_attribute_get_evp_cipher(Ip_u16 cipher_attr, Ip_u16 key_length) { const EVP_CIPHER *evp_cipher; const char* cipher_name; cipher_name = ipike_attribute_encryption_alg_key_length_to_string( cipher_attr, key_length); if (IP_NULL == cipher_name) cipher_name = ipike_attribute_encryption_alg_to_string(cipher_attr); evp_cipher = EVP_get_cipherbyname(cipher_name); if (evp_cipher == IP_NULL) IPCOM_LOG1(ERR, "cipher algorithm '%s' not supported by EVP", cipher_name); return evp_cipher; } IP_GLOBAL Ipike_error ipike_attribute_process_hash(Ipike_attribute* attr, Ip_u16* hash_alg) { Ipike_error err; Ip_u16 attr_value; attr_value = IP_GET_NTOHS(&attr->value); err = ipike_check_basic_attr(attr, IPIKE_ATTR_HASH_COUNT); if (IPIKE_SUCCESS != err) return err; if (attr_value == IPIKE_ATTR_HASH_TIGER) { /* The TIGER hash algorithm is currently not supported */ IPCOM_LOG1(WARNING, "hash algorithm %s is not supported", ipike_attribute_hash_alg_to_string(attr_value)); return IPIKE_ATTRIBUTE_UNSUPPORTED_VALUE; } *hash_alg = attr_value; return IPIKE_SUCCESS; } IP_GLOBAL Ipike_error ipike_attribute_process_authentication_method(Ipike_attribute* attr, Ip_u16* auth_meth) { Ipike_error err; Ip_u16 attr_value; attr_value = IP_GET_NTOHS(&attr->value); err = ipike_check_basic_attr(attr, IPIKE_ATTR_AUTH_COUNT); if (IPIKE_SUCCESS != err) return err; switch (attr_value) { case IPIKE_ATTR_AUTH_PRE_SHARED_KEY: case IPIKE_ATTR_AUTH_DSS_SIGNATURES: case IPIKE_ATTR_AUTH_RSA_SIGNATURES: break; default: IPCOM_LOG1(WARNING, "the authentication method %s is not supported", ipike_attribute_auth_method_to_string(attr_value)); return IPIKE_ATTRIBUTE_UNSUPPORTED_VALUE; } *auth_meth = attr_value; return IPIKE_SUCCESS; } IP_GLOBAL Ipike_error ipike_attribute_process_dh_group_desc(Ipike_attribute* attr, Ip_u16* dh_group) { Ipike_error err; Ip_u16 attr_value; attr_value = IP_GET_NTOHS(&attr->value); err = ipike_check_basic_attr(attr, IPIKE_ATTR_GROUP_DESC_MAX); if (IPIKE_SUCCESS != err) return err; switch (attr_value) { case IPIKE_ATTR_GROUP_DESC_768_MODP: case IPIKE_ATTR_GROUP_DESC_1024_MODP: case IPIKE_ATTR_GROUP_DESC_1536_MODP: case IPIKE_ATTR_GROUP_DESC_2048_MODP: case IPIKE_ATTR_GROUP_DESC_3072_MODP: case IPIKE_ATTR_GROUP_DESC_4096_MODP: case IPIKE_ATTR_GROUP_DESC_6144_MODP: case IPIKE_ATTR_GROUP_DESC_8192_MODP: break; default: IPCOM_LOG1(WARNING, "the DH group %s is not supported", ipike_attribute_dh_group_to_string(attr_value)); return IPIKE_ATTRIBUTE_UNSUPPORTED_VALUE; } *dh_group = attr_value; return IPIKE_SUCCESS; } IP_GLOBAL Ipike_error ipike_attribute_process_key_length(Ipike_attribute* attr, Ip_u16* key_length) { Ipike_error err; err = ipike_check_basic_attr_encoding(attr); if (IPIKE_SUCCESS != err) return err; *key_length = IP_GET_NTOHS(&attr->value); /* require in 8 bit blocks */ if (((*key_length) % 8) != 0) { IPCOM_LOG1(WARNING, "the key length %d is not supported", *key_length); return IPIKE_ATTRIBUTE_UNSUPPORTED_VALUE; } return IPIKE_SUCCESS; } /* *=========================================================================== * ipike_attribute_get_dh_prime *=========================================================================== */ IP_GLOBAL const Ipike_value * ipike_attribute_get_dh_prime(Ip_u16 dh_group) { switch (dh_group) { case IPIKE_ATTR_GROUP_DESC_768_MODP: return &ipike_default_768_bit_MODP_group; case IPIKE_ATTR_GROUP_DESC_1024_MODP: return &ipike_alternate_1024_bit_MODP_group; case IPIKE_ATTR_GROUP_DESC_1536_MODP: return &ipike_alternate_1536_bit_MODP_group; case IPIKE_ATTR_GROUP_DESC_2048_MODP: return &ipike_alternate_2048_bit_MODP_group; case IPIKE_ATTR_GROUP_DESC_3072_MODP: return &ipike_alternate_3072_bit_MODP_group; case IPIKE_ATTR_GROUP_DESC_4096_MODP: return &ipike_alternate_4096_bit_MODP_group; case IPIKE_ATTR_GROUP_DESC_6144_MODP: return &ipike_alternate_6144_bit_MODP_group; case IPIKE_ATTR_GROUP_DESC_8192_MODP: return &ipike_alternate_8192_bit_MODP_group; default: IPCOM_LOG2(ERR, "the DH group %s (%d) is not supported", ipike_attribute_dh_group_to_string(dh_group), dh_group); return IP_NULL; } } /* *=========================================================================== * ipike_attribute_get_dh_generator *=========================================================================== */ IP_GLOBAL Ip_u32 ipike_attribute_get_dh_generator(Ip_u16 dh_group) { switch (dh_group) { case IPIKE_ATTR_GROUP_DESC_768_MODP: return ipike_default_768_bit_MODP_generator; case IPIKE_ATTR_GROUP_DESC_1024_MODP: return ipike_alternate_1024_bit_MODP_generator; case IPIKE_ATTR_GROUP_DESC_1536_MODP: return ipike_alternate_1536_bit_MODP_generator; case IPIKE_ATTR_GROUP_DESC_2048_MODP: return ipike_alternate_2048_bit_MODP_generator; case IPIKE_ATTR_GROUP_DESC_3072_MODP: return ipike_alternate_3072_bit_MODP_generator; case IPIKE_ATTR_GROUP_DESC_4096_MODP: return ipike_alternate_4096_bit_MODP_generator; case IPIKE_ATTR_GROUP_DESC_6144_MODP: return ipike_alternate_6144_bit_MODP_generator; case IPIKE_ATTR_GROUP_DESC_8192_MODP: return ipike_alternate_8192_bit_MODP_generator; default: IPCOM_LOG2(ERR, "the DH group %s (%d) is not supported", ipike_attribute_dh_group_to_string(dh_group), dh_group); return IP_NULL; } } IP_GLOBAL Ipike_error ipike_attribute_process_life_type(Ipike_attribute* attr, Ip_u16* life_type) { Ipike_error err; err = ipike_check_basic_attr(attr, IPIKE_ATTR_CLS_LIFE_TYPE); if (err != IPIKE_SUCCESS) return err; *life_type = IP_GET_NTOHS(&attr->value); return IPIKE_SUCCESS; } IP_GLOBAL Ipike_error ipike_attribute_process_life_duration(Ipike_attribute* attr, Ip_u64* life_duration) { Ip_u16 attr_type,attr_value; attr_type = IP_GET_NTOHS(&attr->type); attr_value = IP_GET_NTOHS(&attr->value); IP_U64_CLEAR(*life_duration); if (IPIKE_ATTR_AF(attr_type)) IP_U64_SETLO(*life_duration, attr_value); else { int i; Ip_u16 len = attr_value; Ip_u8* attr_val = ((Ip_u8*) attr + sizeof(Ipike_attribute)); Ip_u32 hi = 0; Ip_u32 lo = 0; if (len > sizeof(*life_duration)) { IPCOM_LOG1(ERR, "the length of the life duration attribute is %d, can not handle sizes larger that 8", len); return IPIKE_ATTRIBUTE_UNSUPPORTED_VALUE; } /* Value is stored in big-endian format */ for (i = 0; i < len; i++) if ((len - i) <= 4) lo = (lo << 8) + attr_val[i]; else hi = (hi << 8) + attr_val[i]; IP_U64_SETLO(*life_duration, lo); IP_U64_SETHI(*life_duration, hi); } return IPIKE_SUCCESS; } IP_GLOBAL const char * ipike_attribute_encryption_alg_to_string(Ip_u16 v) { const char* s; if ((ipike_map_string(ipike.encryption_algorithm_map, v, &s))) return ipike_invalid_attr; return s; } IP_GLOBAL const char * ipike_attribute_encryption_alg_key_length_to_string(Ip_u16 v1, Ip_u16 v2) { const char* s; int v = v1 + (v2 << 16); if ((ipike_map_string(ipike.encryption_algorithm_map2, v, &s))) return IP_NULL; return s; } IP_GLOBAL const char * ipike_attribute_hash_alg_to_string(Ip_u16 v) { const char* s; if ((ipike_map_string(ipike.hash_algorithm_map, v, &s))) return ipike_invalid_attr; return s; } IP_GLOBAL const char * ipike_attribute_auth_method_to_string(Ip_u16 v) { const char* s; if ((ipike_map_string(ipike.authentication_method_map, v, &s))) return ipike_invalid_attr; return s; } IP_GLOBAL const char * ipike_attribute_auth_method_to_string_v2(Ip_u16 v) { const char* s; if ((ipike_map_string(ipike.v2_authentication_method_map, v, &s))) return ipike_invalid_attr; return s; } IP_GLOBAL const char * ipike_attribute_dh_group_to_string(Ip_u16 v) { const char* s; if ((ipike_map_string(ipike.dh_group_map, v, &s))) return ipike_invalid_attr; return s; } IP_GLOBAL const char * ipike_attribute_life_type_to_string(Ip_u16 v) { const char* s; if ((ipike_map_string(ipike.life_type_map, v, &s))) return ipike_invalid_attr; return s; } IP_GLOBAL Ipike_error ipike_attribute_encryption_alg_from_string(const char *s, Ip_u16 *v) { return ipike_attribute_map_Ip_u16(ipike.encryption_algorithm_map, s, v); } IP_GLOBAL Ipike_error ipike_attribute_encryption_alg_from_string_v2(const char *s, Ip_u16 *v) { return ipike_attribute_map_Ip_u16(ipike.v2_encryption_algorithm_map, s, v); } IP_GLOBAL Ipike_error ipike_attribute_key_length_from_enc_alg_string(const char *s, Ip_u16 *v) { int i; if (ipike_map_int(ipike.encryption_algorithm_map2, s, &i)) *v = 0; /* default no key length needed */ else *v = (Ip_u16)(i >> 16); return IPIKE_SUCCESS; } IP_GLOBAL Ipike_error ipike_attribute_key_length_from_enc_alg_string_v2(const char *s, Ip_u16 *v) { int i; if (ipike_map_int(ipike.v2_encryption_algorithm_map2, s, &i)) *v = 0; /* default no key length needed */ else *v = (Ip_u16)(i >> 16); return IPIKE_SUCCESS; } IP_GLOBAL Ipike_error ipike_attribute_hash_alg_from_string(const char *s, Ip_u16 *v) { return ipike_attribute_map_Ip_u16(ipike.hash_algorithm_map, s, v); } IP_GLOBAL Ipike_error ipike_attribute_auth_method_from_string(const char *s, Ip_u16 *v) { return ipike_attribute_map_Ip_u16(ipike.authentication_method_map, s, v); } IP_GLOBAL Ipike_error ipike_attribute_auth_method_from_string_v2(const char *s, Ip_u8 *v) { return ipike_attribute_map_Ip_u8(ipike.v2_authentication_method_map, s, v); } IP_GLOBAL Ipike_error ipike_attribute_dh_group_from_string(const char *s, Ip_u16 *v) { return ipike_attribute_map_Ip_u16(ipike.dh_group_map, s, v); } IP_GLOBAL Ipike_error ipike_attribute_life_type_from_string(const char *s, Ip_u16 *v) { return ipike_attribute_map_Ip_u16(ipike.life_type_map, s, v); } IP_GLOBAL Ipike_error ipike_attribute_map_Ip_u16(const Ipike_string_int_map map[], const char *key, Ip_u16 *value) { int val; Ipike_error err; err = ipike_map_int(map, key, &val); if (err == IPIKE_SUCCESS && val == -1) *value = IPIKE_VALUE_ANY; /* ANY value */ else *value = (Ip_u16) val; return err; } IP_GLOBAL Ipike_error ipike_attribute_map_Ip_u8(const Ipike_string_int_map map[], const char *key, Ip_u8 *value) { int val; Ipike_error err; err = ipike_map_int(map, key, &val); if (err == IPIKE_SUCCESS && val == -1) *value = (Ip_u8) (IPIKE_VALUE_ANY & 0xff); /* ANY value */ else *value = (Ip_u8) val; return err; } IP_GLOBAL void ipike_print_attribute( Ipike_attribute* attr, Ipike_attr_cls_to_str_ptr attr_cls_to_string, Ipike_attr_to_str_ptr attr_to_string) { Ip_u16 attr_type,type,value; char* data; attr_type = IP_GET_NTOHS(&attr->type); type = IPIKE_ATTR_TYPE(attr_type); value = IP_GET_NTOHS(&attr->value); (void) attr_cls_to_string; /* lint */ if (attr_to_string(type, value) != IP_NULL) { IPCOM_LOG2(DEBUG2, " %s: %s", attr_cls_to_string(type), attr_to_string(type, value)); return; } if (IPIKE_ATTR_AF(attr_type)) { IPCOM_LOG3(DEBUG2, " %s: %d (0x%x)", attr_cls_to_string(type), value, value); return; } data = ipike_memory_to_string((Ip_u8*) attr + sizeof(Ipike_attribute), value, 4); if (IP_NULL == data) { IPCOM_LOG1(CRIT, "ipike_print_attribute(%s): out of memory", attr_cls_to_string(type)); return; } IPCOM_LOG3(DEBUG2, " %s: %d\n%s", attr_cls_to_string(type), (int) value, data); ipcom_free(data); } IP_GLOBAL const char * ipike_attribute_id_type_to_string(Ip_u8 v) { const char* s; if ((ipike_map_string(ipike.id_type_map, v, &s))) return "invalid ID type"; return s; } IP_GLOBAL Ipike_error ipike_attribute_id_type_from_string(const char* s, Ip_u8* v) { Ipike_error err; int t_v; err = ipike_map_int(ipike.id_type_map, s, &t_v); *v = (Ip_u8) t_v; return err; } IP_GLOBAL const char * ipike_attribute_protocol_id_to_string(Ip_u8 v) { static char id[5]; const char* s; if ((ipike_map_string(ipike.id_proto_map, v, &s))) { ipcom_sprintf(id, "0x%.2X", v); return id; } return s; } IP_GLOBAL Ipike_error ipike_attribute_protocol_id_from_string(const char* s, Ip_u8* v) { Ipike_error err = IPIKE_SUCCESS; Ip_u8* p; Ip_size_t n; int t_v; if ((s[0] == '0') && (s[1] == 'x') && ((n = (ipcom_strlen(s) - 2)) == 2) && ((p = ipike_hex2bin(&s[2], &n)) != IP_NULL)) { *v = p[0]; ipcom_free(p); } else { err = ipike_map_int(ipike.id_proto_map, s, &t_v); *v = (Ip_u8) t_v; } return err; } IP_GLOBAL const char * ipike_attribute_rohc_to_string(Ip_u16 v) { const char* s; if ((ipike_map_string(ipike.rohc_map, v, &s))) return ipike_invalid_attr; return s; } #ifdef IPIKE_USE_VERSION2 IP_GLOBAL const EVP_CIPHER * ipike_attribute_get_evp_cipher_v2(Ip_u16 cipher_attr, Ip_u16 key_length) { const EVP_CIPHER *evp_cipher; const char* cipher_name; cipher_name = ipike_attribute_encryption_alg_key_length_to_string_v2( cipher_attr, key_length); if (IP_NULL == cipher_name) cipher_name = ipike_attribute_encryption_alg_to_string_v2(cipher_attr); evp_cipher = EVP_get_cipherbyname(cipher_name); if (evp_cipher == IP_NULL) IPCOM_LOG1(ERR, "cipher algorithm '%s' not supported by EVP", cipher_name); return evp_cipher; } IP_GLOBAL Ip_u16 ipike_attribute_get_default_key_length_v2(Ip_u16 encryption_alg) { const char* enc_name; const EVP_CIPHER* evp_cipher; /* Treat encryption alg 0 as null cipher with blocksize 0 */ if ((encryption_alg == 0) || (encryption_alg == IPIKE_IPSEC_ESP_NULL)) return 0; enc_name = ipike_attribute_encryption_alg_to_string_v2(encryption_alg); if (IP_NULL == enc_name) { IPCOM_LOG2(ERR, "ipike_attribute_get_default_key_length: unknown encryption algorithm %s (%d)", enc_name, encryption_alg); return IPIKE_ATTR_INVALID; } if (IP_NULL == (evp_cipher = EVP_get_cipherbyname(enc_name))) { #ifndef OPENSSL_NO_CAST if (encryption_alg == IPIKE_ENCR_CAST) return 16; /* rfc 2409 appendix B */ #endif #ifndef OPENSSL_NO_BF if (encryption_alg == IPIKE_ENCR_BLOWFISH) return ((BF_ROUNDS-2)*4)/8; /* maximum length, rfc 2409 appendix B */ #endif #ifdef IPIKE_ISAKMPD_AES_KEY_LENGTH_BUG_WORKAROUND #ifndef OPENSSL_NO_AES /* Not correct since no default for AES */ if (encryption_alg == IPIKE_ENCR_AES_CBC) return 256/8; #endif #endif /* We have probably retrieved a ciphername above without specified key * length. This means that this algorithm have no default key length. * Return IPIKE_ATTR_INVALID without logging, since this may be normal */ return IPIKE_ATTR_INVALID; } return (Ip_u16) EVP_CIPHER_key_length(evp_cipher); } IP_GLOBAL Ip_u16 ipike_attribute_get_cipher_block_size_v2(Ip_u16 encryption_alg, Ip_u16 key_length) { const char* enc_name; const EVP_CIPHER* evp_cipher; if ((encryption_alg == 0) || (encryption_alg == IPIKE_ATTR_INVALID)) return 0; enc_name = ipike_attribute_encryption_alg_key_length_to_string_v2(encryption_alg, key_length); if (IP_NULL == enc_name) enc_name = ipike_attribute_encryption_alg_to_string_v2(encryption_alg); if (IP_NULL == (evp_cipher = EVP_get_cipherbyname(enc_name))) { IPCOM_LOG2(ERR, "ipike_attribute_get_cipher_block_size: unknown algorithm %s (%d)", enc_name, encryption_alg); return 0; } return (Ip_u16) EVP_CIPHER_block_size(evp_cipher); } IP_GLOBAL const char * ipike_attribute_encryption_alg_to_string_v2(Ip_u16 v) { const char* s; if ((ipike_map_string(ipike.v2_encryption_algorithm_map, v, &s))) return ipike_invalid_attr; return s; } IP_GLOBAL const char * ipike_attribute_encryption_alg_key_length_to_string_v2(Ip_u16 v1, Ip_u16 v2) { const char* s; int v = v1 + (v2 << 16); if ((ipike_map_string(ipike.v2_encryption_algorithm_map2, v, &s))) return IP_NULL; return s; } IP_GLOBAL const char * ipike_attribute_prf_alg_to_string_v2(Ip_u16 v) { const char* s; if ((ipike_map_string(ipike.transform_prf_id_map, v, &s))) return ipike_invalid_attr; return s; } #endif /* IPIKE_USE_VERSION2 */ /* **************************************************************************** * END OF FILE **************************************************************************** */