489 lines
18 KiB
C
489 lines
18 KiB
C
/*
|
|
******************************************************************************
|
|
* HEADER FILE
|
|
*
|
|
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_payload_transform.h,v $ $Revision: 1.8.16.5 $
|
|
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_payload_transform.h,v $
|
|
* $Author: jsheng $ $Date: 2014-10-09 09:26:00 $
|
|
* $State: Exp $ $Locker: $
|
|
*
|
|
* INTERPEAK_COPYRIGHT_STRING
|
|
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
|
|
******************************************************************************
|
|
*/
|
|
#ifndef IPIKE_PAYLOAD_TRANSFORM_H
|
|
#define IPIKE_PAYLOAD_TRANSFORM_H
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 1 DESCRIPTION
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 2 CONFIGURATION
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 3 INCLUDE FILES
|
|
****************************************************************************
|
|
*/
|
|
|
|
#include "ipike_config.h"
|
|
#include "ipike_attributes.h"
|
|
#include "ipike_payload.h"
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 4 DEFINES
|
|
****************************************************************************
|
|
*/
|
|
|
|
/* IPSEC ISAKMP Transform Identifiers (chapter 4.4.2, RFC 2407) */
|
|
#define IPIKE_IKE_KEY 1
|
|
#define IPIKE_IKE_MIN 1
|
|
#define IPIKE_IKE_MAX 1
|
|
#define IPIKE_IKE_PRIVATE_MIN 249
|
|
#define IPIKE_IKE_PRIVATE_MAX 255
|
|
|
|
|
|
#define IPIKE_IKE_COUNT 1
|
|
|
|
#define IPIKE_TRANS_HEADER_LENGTH sizeof(Ipike_transform_payload)
|
|
|
|
|
|
/* Security Protocol Identifier (in proposal payload) is IPIKE_PROTO_IPSEC_AH */
|
|
|
|
#define IPIKE_IPSEC_AH_MD5 2 /* [RFC2407] */
|
|
#define IPIKE_IPSEC_AH_SHA 3 /* [RFC2407] */
|
|
#define IPIKE_IPSEC_AH_DES 4 /* [RFC2407] */
|
|
#define IPIKE_IPSEC_AH_SHA2_256 5 /* [Leech][RFC4868] */
|
|
#define IPIKE_IPSEC_AH_SHA2_384 6 /* [Leech][RFC4868] */
|
|
#define IPIKE_IPSEC_AH_SHA2_512 7 /* [Leech][RFC4868] */
|
|
#define IPIKE_IPSEC_AH_RIPEMD 8 /* [RFC2857] */
|
|
#define IPIKE_IPSEC_AH_AES_XCBC_MAC 9 /* [RFC3566] */
|
|
#define IPIKE_IPSEC_AH_RSA 10 /* [RFC4359] */
|
|
#define IPIKE_IPSEC_AH_AES_128_GMAC 11 /* [RFC4543][Errata1821] */
|
|
#define IPIKE_IPSEC_AH_AES_192_GMAC 12 /* [RFC4543][Errata1821] */
|
|
#define IPIKE_IPSEC_AH_AES_256_GMAC 13 /* [RFC4543][Errata1821] */
|
|
|
|
#define IPIKE_IPSEC_AH_MIN 2
|
|
#define IPIKE_IPSEC_AH_MAX 13
|
|
#define IPIKE_IPSEC_AH_PRIVATE_MIN 249
|
|
#define IPIKE_IPSEC_AH_PRIVATE_MAX 255
|
|
|
|
|
|
/* Security Protocol Identifier (in proposal payload) is PROTO_IPSEC_ESP */
|
|
#define IPIKE_IPSEC_ESP_DES_IV64 1 /* [RFC2407] */
|
|
#define IPIKE_IPSEC_ESP_DES 2 /* [RFC2407] */
|
|
#define IPIKE_IPSEC_ESP_3DES 3 /* [RFC2407] */
|
|
#define IPIKE_IPSEC_ESP_RC5 4 /* [RFC2407] */
|
|
#define IPIKE_IPSEC_ESP_IDEA 5 /* [RFC2407] */
|
|
#define IPIKE_IPSEC_ESP_CAST 6 /* [RFC2407] */
|
|
#define IPIKE_IPSEC_ESP_BLOWFISH 7 /* [RFC2407] */
|
|
#define IPIKE_IPSEC_ESP_3IDEA 8 /* [RFC2407] */
|
|
#define IPIKE_IPSEC_ESP_DES_IV32 9 /* [RFC2407] */
|
|
#define IPIKE_IPSEC_ESP_RC4 10 /* [RFC2407] */
|
|
#define IPIKE_IPSEC_ESP_NULL 11 /* [RFC2407] */
|
|
#define IPIKE_IPSEC_ESP_AESCBC 12 /* [RFC2407] */
|
|
#define IPIKE_IPSEC_ESP_AESCTR 13 /* [RFC2407] */
|
|
|
|
#define IPIKE_IPSEC_ESP_AES_CCM_8 14 /* [RFC4309] */
|
|
#define IPIKE_IPSEC_ESP_AES_CCM_12 15 /* [RFC4309] */
|
|
#define IPIKE_IPSEC_ESP_AES_CCM_16 16 /* [RFC4309] */
|
|
#define IPIKE_IPSEC_ESP_AES_GCM_8 18 /* [RFC4106] */
|
|
#define IPIKE_IPSEC_ESP_AES_GCM_12 19 /* [RFC4106] */
|
|
#define IPIKE_IPSEC_ESP_AES_GCM_16 20 /* [RFC4106] */
|
|
#define IPIKE_IPSEC_ESP_SEED_CBC 21 /* [RFC4196] */
|
|
#define IPIKE_IPSEC_ESP_CAMELLIA 22 /* [RFC4312] */
|
|
#define IPIKE_IPSEC_ESP_NULL_AUTH_AES_GMAC 23 /* [RFC4543][Errata1821] */
|
|
|
|
#define IPIKE_IPSEC_ESP_MIN 1
|
|
#define IPIKE_IPSEC_ESP_MAX 23
|
|
#define IPIKE_IPSEC_ESP_PRIVATE_MIN 248
|
|
#define IPIKE_IPSEC_ESP_PRIVATE_MAX 255
|
|
|
|
|
|
|
|
|
|
/* Security Protocol Identifier (in proposal payload) is PROTO_IPCOMP */
|
|
#define IPIKE_IPSEC_IPCOMP_OUI 1
|
|
#define IPIKE_IPSEC_IPCOMP_DEFLATE 2
|
|
#define IPIKE_IPSEC_IPCOMP_LZS 3
|
|
#define IPIKE_IPSEC_IPCOMP_LZJH 4 /* [RFC3051] */
|
|
|
|
#define IPIKE_IPSEC_IPCOMP_MIN 1
|
|
#define IPIKE_IPSEC_IPCOMP_MAX 4
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 5 TYPES
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
Transform Payload Format
|
|
|
|
1 2 3
|
|
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
! Next Payload ! RESERVED ! Payload Length !
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
! Transform # ! Transform-Id ! RESERVED2 !
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
! !
|
|
~ SA Attributes ~
|
|
! !
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
*/
|
|
typedef struct Ipike_transform_payload_struct
|
|
{
|
|
/* The generic ISAKMP payload header */
|
|
Ipike_payload_header header;
|
|
|
|
/* Identifies the Transform number for the current payload. If there is
|
|
more than one transform proposed for a specific protocol within the
|
|
Proposal payload, then each Transform payload has a unique Transform
|
|
number.*/
|
|
Ip_u8 number;
|
|
/* Specifies the Transform identifier for the protocol within the current
|
|
proposal. These transforms are defined by the DOI and are dependent on
|
|
the protocol being negotiated. */
|
|
Ip_u8 id;
|
|
/* reserved, must be 0 */
|
|
Ip_u16 reserved2;
|
|
|
|
/* SA attributes follows */
|
|
}
|
|
Ipike_transform_payload;
|
|
|
|
/* Transform structure to use during phase 1 */
|
|
typedef struct Ipike_transform_ike_struct
|
|
{
|
|
/* The number of the selected transform */
|
|
Ip_u8 number;
|
|
/* The transform id */
|
|
Ip_u8 id;
|
|
|
|
/* Attributes */
|
|
Ip_u16 encryption_algorithm;
|
|
Ip_u16 key_length;
|
|
Ip_u16 hash_algorithm;
|
|
Ip_u16 authentication_method;
|
|
Ip_u16 life_type;
|
|
Ip_u64 life_duration;
|
|
Ip_u16 dh_group;
|
|
const Ipike_value* dh_prime;
|
|
Ip_u32 dh_generator;
|
|
Ip_u64 local_life_duration;
|
|
}
|
|
Ipike_transform_ike;
|
|
|
|
/* Transform structure to use during phase 2 and IPSec DOI */
|
|
typedef struct Ipike_transform_ipsec_struct
|
|
{
|
|
/* The number of the transform */
|
|
Ip_u8 number;
|
|
/* AH Transform Identifiers, ESP Transform Identifiers
|
|
or IPCOMP Transform Identifiers. Depends on the value of
|
|
the IPSEC Security Protocol Identifier in the proposal */
|
|
Ip_u8 id;
|
|
|
|
Ip_u16 authentication_algorithm;
|
|
Ip_u16 key_length;
|
|
Ip_u16 encapsulation_mode;
|
|
Ip_u16 key_rounds;
|
|
Ip_u32 life_duration_sec;
|
|
Ip_u64 life_duration_kbytes;
|
|
Ip_u16 dh_group;
|
|
const Ipike_value* dh_prime;
|
|
Ip_u32 dh_generator;
|
|
Ip_u32 local_life_duration_sec;
|
|
Ip_u64 local_life_duration_kbytes;
|
|
}
|
|
Ipike_transform_ipsec;
|
|
|
|
typedef union Ipike_transform_union
|
|
{
|
|
Ipike_transform_ike ike;
|
|
Ipike_transform_ipsec ipsec;
|
|
}
|
|
Ipike_transform;
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 6 FUNCTIONS
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_transform_id_to_string
|
|
*===========================================================================
|
|
* Description: Returns a string representation of the specified transform id.
|
|
* Parameters: id - a transform id.
|
|
* Returns: A string representation of the specified transform id.
|
|
*
|
|
*/
|
|
IP_GLOBAL const char *
|
|
ipike_transform_id_to_string(Ip_u8 id, Ip_u8 prop_proto_id);
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_transform_set
|
|
*===========================================================================
|
|
* Description: Set all transform parameters.
|
|
* Parameters: transform_dst - the transform that will be set.
|
|
* transform_src - the transform that will be read.
|
|
* Returns:
|
|
*/
|
|
IP_GLOBAL void
|
|
ipike_transform_set(
|
|
Ipike_transform* transform_dst,
|
|
Ipike_transform* transform_src);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_transform_new
|
|
*===========================================================================
|
|
* Description: Creates a new transform payload.
|
|
* Parameters: number - the transform number.
|
|
* id - the protocol id for this transform.
|
|
* attrs - the attributes to include in this transform.
|
|
* Returns: A transform payload that must be freed with ipcom_free or
|
|
* IP_NULL if out of memory.
|
|
*
|
|
*/
|
|
IP_GLOBAL Ipike_transform_payload*
|
|
ipike_transform_new(Ip_u8 number, Ip_u8 id, Ipike_attribute** attrs);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipike_transform_ike_free
|
|
*===========================================================================
|
|
* Description: Frees all resources allocated by the ISAKMP transform structure.
|
|
* Parameters: t - The transform to free.
|
|
* Returns:
|
|
*
|
|
*/
|
|
IP_GLOBAL void
|
|
ipike_transform_ike_free(Ipike_transform_ike* t);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_transform_ipsec_free
|
|
*===========================================================================
|
|
* Description: Frees all resources allocated by the IPSec transform structure.
|
|
* Parameters: t - The transform to free.
|
|
* Returns:
|
|
*
|
|
*/
|
|
IP_GLOBAL void
|
|
ipike_transform_ipsec_free(Ipike_transform_ipsec* t);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_transform_ike_create
|
|
*===========================================================================
|
|
* Description: Creates a new transform payload from the data collected
|
|
* during the ike exchange (phase 1).
|
|
* Parameters: transform - the transform to encode into a ISAKMP payload.
|
|
* payload - the new transform payload if the call was successful.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
*
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_transform_ike_create(
|
|
Ipike_transform_ike* transform,
|
|
Ipike_transform_payload** payload);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_transform_ipsec_create
|
|
*===========================================================================
|
|
* Description: Creates a new transform payload to use during phase 2 when
|
|
* neogatiate IPSec paramters.
|
|
* Parameters: transform - the transform to encode into a ISAKMP payload.
|
|
* payload - the new transform payload if the call was successful.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
*
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_transform_ipsec_create(
|
|
Ipike_transform_ipsec* transform,
|
|
Ipike_transform_payload** payload);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_transform_ike_initialize
|
|
*===========================================================================
|
|
* Description: Initializes a transform structure from the configuration.
|
|
* Parameters: conf - The IKE configuration structure.
|
|
* proposal - The proposal structure
|
|
* number - The transform number.
|
|
* transform - Will contain a initilized transform if the call
|
|
* was successful.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
* IPIKE_CONF_INVALID_VALUE
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_transform_ike_initialize(
|
|
Ipike_config_ike_sa* conf,
|
|
Ipike_config_proposal* proposal,
|
|
Ip_u8 number,
|
|
Ipike_transform_ike* transform);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_transform_ipsec_initialize
|
|
*===========================================================================
|
|
* Description: Initializes a IPSec transform structure from the
|
|
* configuration.
|
|
* Parameters: conf - The IKE configuration structure.
|
|
* proposal - The proposal structure
|
|
* number - The transform number.
|
|
* proto_id - The proposal protocol id.
|
|
* transform - Will contain a initilized transform if the call
|
|
* was successful.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
* IPIKE_CONF_INVALID_VALUE
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_transform_ipsec_initialize(
|
|
Ipike_config_ipsec_sa* conf,
|
|
Ipike_config_proposal* proposal,
|
|
Ip_u8 number,
|
|
Ip_u8 proto_id,
|
|
Ipike_transform_ipsec* transform);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_transform_check_payload
|
|
*===========================================================================
|
|
* Description: Verifies that the transform payload is sane.
|
|
* Parameters: transform - a pointer to the ISAKMP header for the payload.
|
|
* protocol - Protocol context of the transform
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_ISAKMP_INVALID_PAYLOAD
|
|
* IPIKE_ISAKMP_PAYLOAD_LENGTH_ERROR
|
|
*
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_transform_check_payload(
|
|
Ipike_transform_payload* transform,
|
|
Ip_u8 protocol,
|
|
Ip_bool phase1);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_transform_ike_print_payload
|
|
*===========================================================================
|
|
* Description: Prints the content of a phase 1 transform payload to
|
|
* the system log.
|
|
* Parameters: transform - a pointer to the ISAKMP header for the payload.
|
|
* security_proto_id - the proposal protocol ID.
|
|
* Returns:
|
|
*
|
|
*/
|
|
IP_GLOBAL void
|
|
ipike_transform_ike_print_payload(
|
|
Ipike_transform_payload* transform,
|
|
Ip_u8 security_proto_id);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_transform_ipsec_print_payload
|
|
*===========================================================================
|
|
* Description: Prints the content of a IPSec transform payload to
|
|
* the system log.
|
|
* Parameters: transform - a pointer to the ISAKMP header for the payload.
|
|
* security_proto_id - the proposal protocol ID.
|
|
* Returns:
|
|
*
|
|
*/
|
|
IP_GLOBAL void
|
|
ipike_transform_ipsec_print_payload(
|
|
Ipike_transform_payload* transform,
|
|
Ip_u8 security_proto_id);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_transform_ike_extract
|
|
*===========================================================================
|
|
* Description: Verifies that all paramters in the transform is supported
|
|
* and copies them to the 'transform' structure.
|
|
* Parameters: payload - A pointer to a transform payload.
|
|
* transform - Will contain the transform paramters if the call
|
|
* was successful.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
* IPIKE_SA_NO_MATCHING_HASH_ALGORITHM
|
|
* IPIKE_SA_NO_MATCHING_ENCRYPTION_ALGORITHM
|
|
* IPIKE_SA_NO_PRE_SHARED_SECRET
|
|
*
|
|
*/
|
|
IP_PUBLIC Ipike_error
|
|
ipike_transform_ike_extract(
|
|
Ipike_transform_payload* payload,
|
|
Ipike_transform_ike* transform);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_transform_ipsec_extract
|
|
*===========================================================================
|
|
* Description: Verifies that all paramters in the transform is supported
|
|
* and copies them to the 'transform' structure.
|
|
* Parameters: payload - A pointer to a transform payload.
|
|
* proposal_proto_id - The proposal protocol ID for the proposal
|
|
* containg this transform.
|
|
* transform - Will contain the transform paramters if the call
|
|
* was successful.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
* IPIKE_SA_NO_MATCHING_HASH_ALGORITHM
|
|
* IPIKE_SA_NO_MATCHING_ENCRYPTION_ALGORITHM
|
|
* IPIKE_SA_NO_PRE_SHARED_SECRET
|
|
*
|
|
*/
|
|
IP_PUBLIC Ipike_error
|
|
ipike_transform_ipsec_extract(
|
|
Ipike_transform_payload* payload,
|
|
Ip_u8 proposal_proto_id,
|
|
Ipike_transform_ipsec* transform);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_transform_isakmp_from_exch
|
|
*===========================================================================
|
|
* Description: Returns the selected transform for the IKE SA.
|
|
* Parameters: ie - The paramters for the exchange.
|
|
* Returns: A pointer to the IKE SA transform.
|
|
*
|
|
*/
|
|
IP_GLOBAL Ipike_transform_ike*
|
|
ipike_transform_ike_from_exch(Ipike_isakmp_exchange* ie);
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
|
|
#endif
|
|
|
|
/*
|
|
****************************************************************************
|
|
* END OF FILE
|
|
****************************************************************************
|
|
*/
|