/* ****************************************************************************** * HEADER FILE * * Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_payload_identification.h,v $ $Revision: 1.8.10.4 $ * $Source: /home/interpeak/CVSRoot/ipike/src/ipike_payload_identification.h,v $ * $Author: edahlber $ $Date: 2012-06-29 11:13:44 $ * $State: Exp $ $Locker: $ * * INTERPEAK_COPYRIGHT_STRING * Design and implementation by Kenneth Jonsson ****************************************************************************** */ #ifndef IPIKE_PAYLOAD_IDENTIFICATION_H #define IPIKE_PAYLOAD_IDENTIFICATION_H /* **************************************************************************** * 1 DESCRIPTION **************************************************************************** */ /* Identification payload (RFC 2408, chapter 3.8 & RFC 2407, chapter 4.6.2 for the IPSec DOI) */ /* **************************************************************************** * 2 CONFIGURATION **************************************************************************** */ /* **************************************************************************** * 3 INCLUDE FILES **************************************************************************** */ #include "ipike_config.h" #include "ipike_payload.h" #ifdef __cplusplus extern "C" { #endif /* **************************************************************************** * 4 DEFINES **************************************************************************** */ #define IPIKE_ID_HEADER_LENGTH 8 /* IPSec DOI ID Types */ /* The ID_IPV4_ADDR type specifies a single four (4) octet IPv4 address. */ #define IPIKE_ID_IPV4_ADDR 1 /* The ID_FQDN type specifies a fully-qualified domain name string. */ #define IPIKE_ID_FQDN 2 /* The ID_USER_FQDN type specifies a fully-qualified username string. */ #define IPIKE_ID_USER_FQDN 3 /* The ID_IPV4_ADDR_SUBNET type specifies a range of IPv4 addresses, represented by two four (4) octet values. The first value is an IPv4 address. The second is an IPv4 network mask. */ #define IPIKE_ID_IPV4_ADDR_SUBNET 4 /* The ID_IPV6_ADDR type specifies a single sixteen (16) octet IPv6 address.*/ #define IPIKE_ID_IPV6_ADDR 5 /* The ID_IPV6_ADDR_SUBNET type specifies a range of IPv6 addresses, represented by two sixteen (16) octet values. The first value is an IPv6 address. The second is an IPv6 network mask. */ #define IPIKE_ID_IPV6_ADDR_SUBNET 6 /* The ID_IPV4_ADDR_RANGE type specifies a range of IPv4 addresses, represented by two four (4) octet values. The first value is the beginning IPv4 address (inclusive) and the second value is the ending IPv4 address (inclusive). */ #define IPIKE_ID_IPV4_ADDR_RANGE 7 /* The ID_IPV6_ADDR_RANGE type specifies a range of IPv6 addresses, represented by two sixteen (16) octet values. The first value is the beginning IPv6 address (inclusive) and the second value is the ending IPv6 address (inclusive). */ #define IPIKE_ID_IPV6_ADDR_RANGE 8 /* The ID_DER_ASN1_DN type specifies the binary DER encoding of an ASN.1 X.500 Distinguished Name of the principal whose certificates are being exchanged to establish the SA. */ #define IPIKE_ID_DER_ASN1_DN 9 /* The ID_DER_ASN1_GN type specifies the binary DER encoding of an ASN.1 X.500 GeneralName of the principal whose certificates are being exchanged to establish the SA. */ #define IPIKE_ID_DER_ASN1_GN 10 /* The ID_KEY_ID type specifies an opaque byte stream which may be used to pass vendor-specific information necessary to identify which pre- shared key should be used to authenticate Aggressive mode negotiations. */ #define IPIKE_ID_KEY_ID 11 #define IPIKE_ID_COUNT 11 /* **************************************************************************** * 5 TYPES **************************************************************************** */ /* Identification Payload Format 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ! Next Payload ! RESERVED ! Payload Length ! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ! ID Type ! DOI Specific ID Data ! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ! ! ~ Identification Data ~ ! ! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Identification Payload Format (DOI: IPSec) 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ! Next Payload ! RESERVED ! Payload Length ! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ! ID Type ! Protocol ID ! Port ! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ~ Identification Data ~ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ */ typedef struct Ipike_identification_payload_struct { /* The generic ISAKMP payload header, the length includes the length of all transforms associated with the proposal */ Ipike_payload_header header; /* Value describing the identity information found in the Identification Data field. */ Ip_u8 id_type; } Ipike_id_payload; typedef struct Ipike_identification_struct { /* Value describing the identity information found in the Identification Data field. */ Ip_u8 id_type; /* the domain of interpretation for this identification */ Ip_u32 doi; /* DOI Specific ID Data, the DOI is stored in the Ipike_sa struct */ union { struct Ipike_ipsec_param_struct { /* UPD or TCP, a zero value means that this field should be ignored */ Ip_u8 proto_id; /* Value specifying an associated port. A value of zero means that the Port field should be ignored. */ Ip_u16 port; } ipsec; } doi_specific_id_data; Ipike_value id_data; } Ipike_id; /* **************************************************************************** * 6 FUNCTIONS **************************************************************************** */ /* *=========================================================================== * ipike_identification_init_ip_address *=========================================================================== * Description: Initializes the id with IPv4 or IPv6 address. * Parameters: addr - The ip address holding the id data. * id - Will hold the id data from the configuration if the call * was successful. * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY * IPIKE_CONF_VALUE_NOT_FOUND */ IP_GLOBAL Ipike_error ipike_identification_init_ip_address( const char* addr, Ip_u8* type, Ipike_value* id); /* *=========================================================================== * ipike_identification_init_ip_subnet *=========================================================================== * Description: Initializes the identification with ip subnet. * Parameters: addr - The ip address. * mask - The ip netmask. * type - Will hold the id type if the call was successful. * id - Will hold the identification data from the configuration * if the call was successful. * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY * IPIKE_CONF_VALUE_NOT_FOUND * */ IP_GLOBAL Ipike_error ipike_identification_init_ip_subnet( union Ip_sockaddr_union* addr, union Ip_sockaddr_union* mask, Ip_u8* type, Ipike_value* id); /* *=========================================================================== * ipike_identification_init_asn1_dn *=========================================================================== * Description: Initializes the id with a asn1 dn value. * Parameters: dn - The asn1 dn value holding the id data. * id - Will hold the id data from the configuration if the call * was successful. * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY * IPIKE_CONF_VALUE_NOT_FOUND */ IP_GLOBAL Ipike_error ipike_identification_init_asn1_dn(const char* dn, Ipike_value* id); /* *=========================================================================== * ipike_identification_init_value *=========================================================================== * Description: Initializes the id with a configuration value. * Parameters: value - The value holding the id data. * id - Will hold the id data from the configuration if the call * was successful. * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY * IPIKE_CONF_VALUE_NOT_FOUND */ IP_GLOBAL Ipike_error ipike_identification_init_value(const char* value, Ipike_value* id); /* *=========================================================================== * ipike_identification_new *=========================================================================== * Description: Creates a new identification payload. * Parameters: id_type - the type of identification being used. * doi_specific_id_data_len - the least significant 24 bits * specifies the DOI specific data. * id_data - the identification data, depends on both DOI * and the value of 'id_type'. * Returns: A new identification payload or IP_NULL if out of memory. * * */ IP_GLOBAL Ipike_id_payload* ipike_identification_new( Ip_u8 id_type, Ip_u32 doi_specific_id_data, const Ip_u8* id_data, Ip_size_t id_data_len); /* *=========================================================================== * ipike_identification_create *=========================================================================== * Description: Creates a new identification payload from the information created * in the exchange. * Parameters: identification - the identification structure to encode into * a ISAKMP payload. * payload - will point to a new identification payload. * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY * IPIKE_DOI_UNSUPPORTED * */ IP_GLOBAL Ipike_error ipike_identification_create( Ipike_id* identification, Ipike_id_payload** payload); /* *=========================================================================== * ipike_identification_generate *=========================================================================== * Description: Generate identification structure from configuration value. * Parameters: value - The configuration value * id - The generated identification structure. * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY * IPIKE_CONF_VALUE_INVALID */ IP_GLOBAL Ipike_error ipike_identification_generate( const char* value, Ipike_id* id); /* *=========================================================================== * ipike_identification_initiator_initialize *=========================================================================== * Description: Initializes IPSec local and remote identification structures. * Parameters: ie - The exchange * idii - The identification of this machine. * idir - The identification of the remote machine. * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY * IPIKE_CONF_VALUE_NOT_FOUND */ IP_GLOBAL Ipike_error ipike_identification_initiator_initialize( Ipike_isakmp_exchange* ie, Ipike_id* idii, Ipike_id* idir); /* *=========================================================================== * ipike_identification_check_payload *=========================================================================== * Description: Verifies that the identification payload is sane. * Parameters: identification - a pointer to a identification payload. * Returns: IPIKE_SUCCESS * IPIKE_ISAKMP_PAYLOAD_LENGTH_ERROR * */ IP_GLOBAL Ipike_error ipike_identification_check_payload(Ipike_id_payload* identification); /* *=========================================================================== * ipike_identification_print_payload *=========================================================================== * Description: Prints the content of the identification payload to the * system log. * Parameters: identification - a pointer to identification payload. * Returns: * * */ IP_GLOBAL void ipike_identification_print_payload(Ipike_id_payload* identification); /* *=========================================================================== * ipike_identification_extract *=========================================================================== * Description: Extracts the identification data from the payload. * Parameters: payload - a identification payload. * identification - will be updated with the identification data * if the call was successful. * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY * IPIKE_DOI_UNSUPPORTED * */ IP_GLOBAL Ipike_error ipike_identification_extract( Ipike_id_payload* payload, Ip_u32 doi, Ipike_id* identification); /* *=========================================================================== * ipike_identification_ike_extract *=========================================================================== * Description: Extracts the identification data from the payload and * validates the identification data in the context of IKE. * Parameters: payload - a identification payload. * identification - will be updated with the identification data * if the call was successful. * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY * IPIKE_DOI_UNSUPPORTED * IPIKE_ISAKMP_INVALID_ID_TYPE * */ IP_GLOBAL Ipike_error ipike_identification_ike_extract( Ipike_id_payload* payload, Ip_u32 doi, Ipike_id* identification); /* *=========================================================================== * ipike_identification_ipsec_extract *=========================================================================== * Description: Extracts IPv4 paramters from the identification data, * everything is returned in big-endian byte order. * Parameters: identification - the identification data * proto - will contain the protocol (TCP, UDP or 0 if protocol * should be ignored). * addr_or_net - will contain the IP address or IP subnet. * netmask - will contain the network mask if the identification * contains subnet information, it will be set to 0 otherwise. * port - will contain the port (or 0 if the port should be ignored). * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY * IPIKE_DOI_UNSUPPORTED * */ IP_GLOBAL Ipike_error ipike_identification_ipsec_extract( Ipike_id* identification, Ip_u8* proto, Ipike_config_netobj* netobj); /* *=========================================================================== * ipike_identification_match_flow *=========================================================================== * Description: Match the IPSec SA configuration flow with the specified id * structures. * Parameters: flow - the IPSec SA flow. * id_src - the id for source. * id_dst - the id for destination. * Returns: IPIKE_SUCCESS, IPIKE_CONF_INVALID_VALUE */ IP_GLOBAL Ipike_error ipike_identification_match_flow( Ipike_config_flow* flow, Ipike_id* id_src, Ipike_id* id_dst); #ifdef __cplusplus } #endif #endif /* **************************************************************************** * END OF FILE **************************************************************************** */