490 lines
18 KiB
C
490 lines
18 KiB
C
/*
|
|
******************************************************************************
|
|
* HEADER FILE
|
|
*
|
|
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike2_payload_sa.h,v $ $Revision: 1.10.16.1 $
|
|
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike2_payload_sa.h,v $
|
|
* $Author: svc-cmnet $ $Date: 2013-03-13 07:45:26 $
|
|
* $State: Exp $ $Locker: $
|
|
*
|
|
* INTERPEAK_COPYRIGHT_STRING
|
|
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
|
|
******************************************************************************
|
|
*/
|
|
#if !defined(IPIKE2_PAYLOAD_SA_H) && defined(IPIKE_USE_VERSION2)
|
|
#define IPIKE2_PAYLOAD_SA_H
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 1 DESCRIPTION
|
|
****************************************************************************
|
|
*/
|
|
|
|
/* IKE Security Association Payload (IKE version 2) */
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 2 CONFIGURATION
|
|
****************************************************************************
|
|
*/
|
|
#include "ipike_config.h"
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 3 INCLUDE FILES
|
|
****************************************************************************
|
|
*/
|
|
#include "ipike_payload.h"
|
|
#include "ipike_payload_sa.h"
|
|
#include "ipike_attributes.h"
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
/*
|
|
****************************************************************************
|
|
* 4 DEFINES
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 5 TYPES
|
|
****************************************************************************
|
|
*/
|
|
|
|
/* Transform types */
|
|
#define IPIKE_TRANSFORM_TYPE_ENCR 1
|
|
#define IPIKE_TRANSFORM_TYPE_PRF 2
|
|
#define IPIKE_TRANSFORM_TYPE_INTEG 3
|
|
#define IPIKE_TRANSFORM_TYPE_DH 4
|
|
#define IPIKE_TRANSFORM_TYPE_ESN 5
|
|
|
|
/* Transform IDs for IPIKE_TRANSFORM_TYPE_ENCR */
|
|
#define IPIKE_ENCR_DES_IV64 1
|
|
#define IPIKE_ENCR_DES 2
|
|
#define IPIKE_ENCR_3DES 3
|
|
#define IPIKE_ENCR_RC5 4
|
|
#define IPIKE_ENCR_IDEA 5
|
|
#define IPIKE_ENCR_CAST 6
|
|
#define IPIKE_ENCR_BLOWFISH 7
|
|
#define IPIKE_ENCR_3IDEA 8
|
|
#define IPIKE_ENCR_DES_IV32 9
|
|
#define IPIKE_ENCR_NULL 11
|
|
#define IPIKE_ENCR_AES_CBC 12
|
|
#define IPIKE_ENCR_AES_CTR 13
|
|
|
|
/* Transform IDs for IPIKE_TRANSFORM_TYPE_PRF */
|
|
#define IPIKE_PRF_HMAC_MD5 1
|
|
#define IPIKE_PRF_HMAC_SHA1 2
|
|
#define IPIKE_PRF_HMAC_TIGER 3
|
|
#define IPIKE_PRF_AES128_CBC 4
|
|
#define IPIKE_PRF_HMAC_SHA2_256 5
|
|
#define IPIKE_PRF_HMAC_SHA2_384 6
|
|
#define IPIKE_PRF_HMAC_SHA2_512 7
|
|
|
|
/* Transform IDs for IPIKE_TRANSFORM_TYPE_INTEG */
|
|
#define IPIKE_AUTH_NONE 0
|
|
#define IPIKE_AUTH_HMAC_MD5_96 1
|
|
#define IPIKE_AUTH_HMAC_SHA1_96 2
|
|
#define IPIKE_AUTH_DES_MAC 3
|
|
#define IPIKE_AUTH_KPDK_MD5 4
|
|
#define IPIKE_AUTH_AES_XCBC_96 5
|
|
#define IPIKE_AUTH_HMAC_SHA2_256_128 12
|
|
#define IPIKE_AUTH_HMAC_SHA2_384_192 13
|
|
#define IPIKE_AUTH_HMAC_SHA2_512_256 14
|
|
|
|
/* Transform IDs for IPIKE_TRANSFORM_TYPE_DH */
|
|
#define IPIKE_DH_GROUP_1 1
|
|
#define IPIKE_DH_GROUP_2 2
|
|
#define IPIKE_DH_GROUP_5 5
|
|
#define IPIKE_DH_GROUP_14 14
|
|
#define IPIKE_DH_GROUP_15 15
|
|
#define IPIKE_DH_GROUP_16 16
|
|
#define IPIKE_DH_GROUP_17 17
|
|
#define IPIKE_DH_GROUP_18 18
|
|
|
|
/* Transform IDs for IPIKE_TRANSFORM_TYPE_ESN */
|
|
#define IPIKE_ESN_OFF 0
|
|
#define IPIKE_ESN_ON 1
|
|
|
|
/* Tranform ID values */
|
|
#define IPIKE_TRANSFORM_UNKNOWN 0x8000
|
|
#define IPIKE_TRANSFORM_IGNORE 0x8001
|
|
#define IPIKE_TRANSFORM_INVALID 0xFFFF
|
|
|
|
/*
|
|
Transform struct
|
|
|
|
1 2 3
|
|
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
! 0 (last) or 3 ! RESERVED ! Transform Length !
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
!Transform Type ! RESERVED ! Transform ID !
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
! !
|
|
~ Transform Attributes ~
|
|
! !
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
*/
|
|
|
|
typedef struct Ipike2_transform_info_struct
|
|
{
|
|
/* 0 (last or 3 if more) */
|
|
Ip_u8 more;
|
|
/* Reserved */
|
|
Ip_u8 reserved;
|
|
/* Transform length */
|
|
Ip_u16 length;
|
|
/* Tranform type */
|
|
Ip_u8 type;
|
|
/* Reserved */
|
|
Ip_u8 reserved2;
|
|
/* Transform identifier */
|
|
Ip_u16 id;
|
|
}
|
|
Ipike2_transform_info;
|
|
|
|
typedef struct Ipike2_transform_struct
|
|
{
|
|
/* The tranform info struct */
|
|
Ipike2_transform_info info;
|
|
/* Attributes(s) for this transform */
|
|
Ipike_attribute** attributes;
|
|
}
|
|
Ipike2_transform;
|
|
|
|
/*
|
|
Proposal struct
|
|
1 2 3
|
|
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
! 0 (last) or 2 ! RESERVED ! Proposal Length !
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
! Proposal # ! Protocol-ID ! SPI Size !# of Transforms!
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
~ SPI (variable) ~
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
! !
|
|
~ Transforms ~
|
|
! !
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
*/
|
|
|
|
typedef struct Ipike2_proposal_info_struct
|
|
{
|
|
/* 0 (last or 2 if more) */
|
|
Ip_u8 more;
|
|
/* Reserved */
|
|
Ip_u8 reserved;
|
|
/* Length of the proposal struct */
|
|
Ip_u16 length;
|
|
/* The number of the selected proposal */
|
|
Ip_u8 number;
|
|
/* Specifies the protocol identifier for the current negotiation.
|
|
Examples might include IKE, ESP, AH, etc.*/
|
|
Ip_u8 proto_id;
|
|
/* SPI size */
|
|
Ip_u8 spi_size;
|
|
/* # of transforms */
|
|
Ip_u8 transform_count;
|
|
|
|
/* SPI and Tranform data */
|
|
}
|
|
Ipike2_proposal_info;
|
|
|
|
typedef struct Ipike2_proposal_struct
|
|
{
|
|
/* The proposal info struct */
|
|
Ipike2_proposal_info info;
|
|
/* The Security Parameter Index (SPI) as defined by the Protocol-ID. */
|
|
Ip_u8 spi[8];
|
|
/* Transform(s) for this proposal */
|
|
Ipike2_transform** transforms;
|
|
}
|
|
Ipike2_proposal;
|
|
|
|
/*
|
|
Security Association Payload
|
|
|
|
1 2 3
|
|
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
! Next Payload ! RESERVED ! Payload Length !
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
! !
|
|
~ Proposals ~
|
|
! !
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
*/
|
|
|
|
typedef struct Ipike2_sa_payload_struct
|
|
{
|
|
/* The generic payload header, the length includes the length of the
|
|
proposal and transform payloads */
|
|
Ipike_payload_header header;
|
|
|
|
/* Proposals follows */
|
|
}
|
|
Ipike2_sa_payload;
|
|
|
|
/* Holds the parameters from the SA payload */
|
|
typedef struct Ipike2_sa_struct
|
|
{
|
|
/* More than 1 proposal can be selected (ex. AH + ESP is two different
|
|
proposals that can be active at the same time). All proposal in the
|
|
selected set (must) have the same proposal number */
|
|
/* The index of the first selected proposal */
|
|
int selected_proposal;
|
|
/* The number of proposal in this SA */
|
|
int proposal_count;
|
|
/* Proposal(s) for this SA */
|
|
Ipike2_proposal** proposals;
|
|
/* Selected transforms */
|
|
Ip_u16 selected_encr;
|
|
Ip_u16 selected_prf;
|
|
Ip_u16 selected_integ;
|
|
Ip_u16 selected_dh;
|
|
Ip_u16 selected_esn;
|
|
/* Selected attributes */
|
|
Ip_u16 selected_key_length;
|
|
/* Selected protocol id */
|
|
Ip_u8 proto_id;
|
|
}
|
|
Ipike2_sa;
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 6 FUNCTIONS
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_sa_transform_id_available
|
|
*===========================================================================
|
|
* Description: Return true/false depending of availability of transform.
|
|
* Parameters: type - type of transfrom.
|
|
* id - id of transforn
|
|
* Returns: IP_TRUE if available (else IP_FALSE)
|
|
*
|
|
*/
|
|
IP_GLOBAL Ip_bool
|
|
ipike_sa_transform_id_available(Ip_u8 type, Ip_u16 id);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_sa_transform_id_from_string
|
|
*===========================================================================
|
|
* Description: Return transfrom if from a string representation.
|
|
* Parameters: type - type of transfrom.
|
|
* s - string representation of transfrom.
|
|
* Returns: Transform id or IPIKE_ATTR_INVALID if not found
|
|
*
|
|
*/
|
|
IP_GLOBAL Ip_u16
|
|
ipike_sa_transform_id_from_string(Ip_u8 type, const char * s);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_sa_create
|
|
*===========================================================================
|
|
* Description: Creates a new SA payload from the information collected
|
|
* in the exchange.
|
|
* Parameters: sa - the SA to encode in to a ISAKMP payload.
|
|
* payload - will point to a new SA payload if the call was
|
|
* successful.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
*
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_payload_sa_create(Ipike2_sa* sa, Ipike2_sa_payload** payload);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_sa_free
|
|
*===========================================================================
|
|
* Description: Frees all resource allocated by the SA structure.
|
|
* Parameters: sa - The SA structure to free.
|
|
* free_func - The function to use when freeing the 'sa'.
|
|
* Pass IP_NULL if 'sa' is located on the stack.
|
|
* Returns:
|
|
*
|
|
*/
|
|
IP_GLOBAL void
|
|
ipike_payload_sa_free(Ipike2_sa* sa, void(*free_func)(void*));
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_sa_initialize
|
|
*===========================================================================
|
|
* Description: Creates a new IKE/IPSec SA from the proposals for the peer
|
|
* host.
|
|
* Parameters: is_ike - TRUE if IKE SA (otherwise IPSec SA)
|
|
* proposals - The configuration where information about the
|
|
* exchange can be found.
|
|
* sa - Will contain a initilized IKE SA if the call was
|
|
* successful.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
* IPIKE_CONF_VALUE_NOT_FOUND
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_payload_sa_initialize(
|
|
Ip_bool is_ike,
|
|
Ipike_config_proposal** proposals,
|
|
Ipike2_sa* sa);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_sa_check
|
|
*===========================================================================
|
|
* Description: Verifies that the security association payload is sane.
|
|
* Parameters: sa - a pointer to a SA payload.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_ISAKMP_PAYLOAD_LENGTH_ERROR
|
|
* IPIKE_ISAKMP_INVALID_SYNTAX
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_payload_sa_check(Ipike2_sa_payload* sa);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_sa_print
|
|
*===========================================================================
|
|
* Description: Prints the content of a SA payload to the system log.
|
|
* Parameters: sa - a pointer to a SA payload.
|
|
* Returns:
|
|
*/
|
|
IP_GLOBAL void
|
|
ipike_payload_sa_print(Ipike2_sa_payload* sa);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_sa_extract
|
|
*===========================================================================
|
|
* Description: Extracts the SA from the payload.
|
|
* Parameters: payload - A SA payload.
|
|
* sa - Will be updated with the parameters from the SA payload
|
|
* if the call was successful.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_payload_sa_extract(Ipike2_sa_payload *payload, Ipike2_sa *sa);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_sa_set_spi
|
|
*===========================================================================
|
|
* Description: Set spi value for all SA proposals.
|
|
* Parameters: sa - Will be updated with the new spi value if the call was
|
|
* successful.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_payload_sa_set_spi(Ipike2_sa* sa, Ip_u8* spi_data, Ip_u16 spi_len);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_transform_???_to_string
|
|
*===========================================================================
|
|
* Description: Get description for the specified algorithm id.
|
|
* id - Algorithm id
|
|
* Returns: The description
|
|
*/
|
|
IP_GLOBAL const char *
|
|
ipike_transform_encryption_to_string(Ip_u16 id);
|
|
|
|
IP_GLOBAL const char *
|
|
ipike_transform_integrity_to_string(Ip_u16 id);
|
|
|
|
IP_GLOBAL const char *
|
|
ipike_transform_hash_to_string(Ip_u16 id);
|
|
|
|
IP_GLOBAL const char *
|
|
ipike_transform_dh_group_to_string(Ip_u16 id);
|
|
|
|
IP_GLOBAL const char *
|
|
ipike_transform_esn_to_string(Ip_u16 id);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_proposal_get_first_transform
|
|
*===========================================================================
|
|
* Description: Get next transform id of specified type from the SA structure
|
|
* sa - the SA
|
|
* type - type of transform, i.e. encr, prf, integ, dh
|
|
* old_id - last returned id or 0 if first.
|
|
* Returns: The found id or 0xffff
|
|
*/
|
|
IP_GLOBAL Ip_u16
|
|
ipike_proposal_get_next_transform(Ipike2_sa* sa, Ip_u16 type, Ip_u16 old_id);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_proposal_has_transform
|
|
*===========================================================================
|
|
* Description: Get next transform id of specified type from the proposal
|
|
* structure.
|
|
* proposal - the proposal
|
|
* type - type of transform, i.e. encr, prf, integ, dh
|
|
* id - the id of the transform.
|
|
* Returns: TRUE if found else FALSE
|
|
*/
|
|
IP_GLOBAL Ip_bool
|
|
ipike_proposal_has_transform(Ipike2_proposal* proposal, Ip_u16 type, Ip_u16 id);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_proposal_has_transform_type
|
|
*===========================================================================
|
|
* Description: Verify that the transform type is present in the proposal
|
|
* proposal - the proposal
|
|
* type - type of transform, i.e. encr, prf, integ, dh
|
|
* Returns: TRUE if found else FALSE
|
|
*/
|
|
IP_GLOBAL Ip_bool
|
|
ipike_proposal_has_transform_type(Ipike2_proposal* proposal, Ip_u16 type);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_proposal_remove_transform_type
|
|
*===========================================================================
|
|
* Description: Remove all transforms of a specified type in the proposals
|
|
* for the sa.
|
|
* sa - the sa
|
|
* type - type of transform, i.e. encr, prf, integ, dh
|
|
* Returns:
|
|
*/
|
|
IP_GLOBAL void
|
|
ipike_proposal_remove_transform_type(Ipike2_sa* sa, Ip_u16 type);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_transform_get_key_length
|
|
*===========================================================================
|
|
* Description: Get key length of specified (encryption) transform from
|
|
* attributes list.
|
|
* transform - the transfrom
|
|
* Returns: key length if specified else 0
|
|
*/
|
|
IP_GLOBAL Ip_u16
|
|
ipike_transform_get_key_length(Ipike2_transform* transform);
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
|
|
#endif
|
|
|
|
|
|
/*
|
|
****************************************************************************
|
|
* END OF FILE
|
|
****************************************************************************
|
|
*/
|