343 lines
12 KiB
C
343 lines
12 KiB
C
/*
|
|
******************************************************************************
|
|
* HEADER FILE
|
|
*
|
|
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_payload_certificate.h,v $ $Revision: 1.10.10.1 $
|
|
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_payload_certificate.h,v $
|
|
* $Author: edahlber $ $Date: 2011-12-06 15:25:28 $
|
|
* $State: Exp $ $Locker: $
|
|
*
|
|
* INTERPEAK_COPYRIGHT_STRING
|
|
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
|
|
******************************************************************************
|
|
*/
|
|
#ifndef IPIKE_PAYLOAD_CERT_H
|
|
#define IPIKE_PAYLOAD_CERT_H
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 1 DESCRIPTION
|
|
****************************************************************************
|
|
*/
|
|
|
|
/* Certificate payload (RFC 2408, chapter 3.9) */
|
|
/* IKE version 1 and 2 */
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 2 CONFIGURATION
|
|
****************************************************************************
|
|
*/
|
|
#include "ipike_config.h"
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 3 INCLUDE FILES
|
|
****************************************************************************
|
|
*/
|
|
|
|
#include "ipike_payload.h"
|
|
#include <openssl/x509.h>
|
|
|
|
#ifdef IPIKE_USE_OCSP
|
|
#include <openssl/ocsp.h>
|
|
#endif
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 4 DEFINES
|
|
****************************************************************************
|
|
*/
|
|
|
|
#define IPIKE_CERT_HEADER_LENGTH 5
|
|
#define IPIKE_CERT_REQ_HEADER_LENGTH 5
|
|
|
|
/* X509 certificates wrapped in a PKCS#7 message */
|
|
#define IPIKE_CERT_PKCS_7 1
|
|
#define IPIKE_CERT_PGP 2
|
|
#define IPIKE_CERT_SIGNED_KEY 3
|
|
#define IPIKE_CERT_X509_SIGNATURE 4
|
|
#define IPIKE_CERT_X509_KEY_EXCHANGE 5
|
|
#define IPIKE_CERT_KERBEROS_TOKENS 6
|
|
#define IPIKE_CERT_CRL 7
|
|
#define IPIKE_CERT_ARL 8
|
|
#define IPIKE_CERT_SPKI 9
|
|
#define IPIKE_CERT_X509_ATTRIBUTE 10
|
|
#define IPIKE_CERT_X509_HASH_AND_URL 12
|
|
#define IPIKE_OCSP_CONTENT 14
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 5 TYPES
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
Certificate Payload Format
|
|
|
|
1 2 3
|
|
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
! Next Payload ! RESERVED ! Payload Length !
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
! Cert Encoding ! !
|
|
+-+-+-+-+-+-+-+-+ !
|
|
~ Certificate Data ~
|
|
! !
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
|
|
*/
|
|
|
|
typedef struct Ipike_cert_payload_struct
|
|
{
|
|
/* The generic ISAKMP payload header, the length includes the length
|
|
of all transforms associated with the proposal */
|
|
Ipike_payload_header header;
|
|
|
|
Ip_u8 cert_encoding;
|
|
/* Hash data follows */
|
|
}
|
|
Ipike_cert_payload;
|
|
|
|
typedef struct Ipike_cert_struct
|
|
{
|
|
/* The certificate for our side */
|
|
X509* local;
|
|
/* The certificate for the peer */
|
|
X509* peer;
|
|
/* The certificate of additional certificates */
|
|
X509** ca;
|
|
/* The certificate of trusted certificates */
|
|
X509** trusted;
|
|
#ifdef IPIKE_USE_OCSP
|
|
OCSP_RESPONSE *resp_local;
|
|
OCSP_RESPONSE *resp_peer;
|
|
#endif
|
|
|
|
/* The CRLs used for certificate revocation check */
|
|
X509_CRL** crls;
|
|
|
|
/* URL that points to the certificate when "Hash and URL" is used. */
|
|
const char *peer_url;
|
|
}
|
|
Ipike_cert;
|
|
|
|
typedef struct Ipike_cert_req_payload_struct
|
|
{
|
|
/* The generic ISAKMP payload header, the length includes the length
|
|
of all transforms associated with the proposal */
|
|
Ipike_payload_header header;
|
|
|
|
/* Currently cert req is only used for OCSP content */
|
|
Ip_u8 cert_encoding;
|
|
/* Hash data follows */
|
|
}
|
|
Ipike_cert_req_payload;
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 6 FUNCTIONS
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_certificate_free
|
|
*===========================================================================
|
|
* Description: Frees a Ipike_cert structure.
|
|
* Parameters: cert - The cert structure to free.
|
|
* Returns:
|
|
*
|
|
*/
|
|
IP_GLOBAL void
|
|
ipike_payload_certificate_free(Ipike_cert* cert);
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_certificate_create
|
|
*===========================================================================
|
|
* Description: Creates a new certificate payload.
|
|
* Parameters: cert - The certificate structure to create the payload from.
|
|
* uri - URI pointing out the location of the certificate.
|
|
* Only supported in IKEv2.
|
|
* payload - will point to a new certificate payload.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
*
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_payload_certificate_create(X509* cert, const char *uri, Ipike_cert_payload** payload);
|
|
|
|
#ifdef IPIKE_USE_OCSP
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_certificate_ocsp_create
|
|
*===========================================================================
|
|
* Description: Creates a new certificate payload with OCSP content.
|
|
* Parameters: resp - The OCSP response that will be packaged as per
|
|
* RFC 4806 specs.
|
|
* payload - will point to a new certificate payload.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
*
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_payload_certificate_ocsp_create(OCSP_RESPONSE* resp, Ipike_cert_payload** payload);
|
|
#endif
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_certificate_req_create_v1
|
|
*===========================================================================
|
|
* Description: Creates a new certificate IKEv1 req payload.
|
|
* Parameters: payload - will point to a new certificate req payload.
|
|
* ca_cert - Trusted CA certificate.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
*
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_payload_certificate_req_create_v1(
|
|
Ipike_cert_req_payload** payload,
|
|
X509* ca_cert);
|
|
|
|
#ifdef IPIKE_USE_VERSION2
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_certificate_req_create_v2
|
|
*===========================================================================
|
|
* Description: Creates a new certificate IKEv2 req payload.
|
|
* Parameters: payload - will point to a new certificate req payload.
|
|
* cert - Certificate information
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
*
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_payload_certificate_req_create_v2(
|
|
Ipike_cert_req_payload **payload,
|
|
Ipike_cert *cert);
|
|
#endif
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_certificate_check
|
|
*===========================================================================
|
|
* Description: Verifies that the certificate payload is sane.
|
|
* Parameters: cert - a pointer to a certificate payload.
|
|
* Returns: IPIKE_SUCCESS
|
|
*
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_payload_certificate_check(Ipike_cert_payload* cert);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_certificate_request_check
|
|
*===========================================================================
|
|
* Description: Verifies that the certificate request payload is sane.
|
|
* Parameters: req - a pointer to a certificate request payload.
|
|
* Returns: IPIKE_SUCCESS
|
|
*
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_payload_certificate_request_check(Ipike_cert_req_payload* req);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_certificate_print
|
|
*===========================================================================
|
|
* Description: Prints the content of the certificate payload to the
|
|
* system log.
|
|
* Parameters: cert - A pointer to a certificate payload.
|
|
* Returns:
|
|
*
|
|
*
|
|
*/
|
|
IP_GLOBAL void
|
|
ipike_payload_certificate_print(Ipike_cert_payload* cert);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_certificate_request_print
|
|
*===========================================================================
|
|
* Description: Prints the content of the certificate req payload to the
|
|
* system log.
|
|
* Parameters: cert - A pointer to a certificate req payload.
|
|
* Returns:
|
|
*
|
|
*
|
|
*/
|
|
IP_GLOBAL void
|
|
ipike_payload_certificate_request_print(Ipike_cert_req_payload* req);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_certificate_extract
|
|
*===========================================================================
|
|
* Description: Extracts the certificate data from the payload.
|
|
* Parameters: payload - a certificate payload.
|
|
* cert - will be updated with the certificate data if the call
|
|
* was successful.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
*
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_payload_certificate_extract(Ipike_cert_payload* payload, Ipike_cert* cert);
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_certificate_req_extract_v1
|
|
*===========================================================================
|
|
* Description: Extracts the certificate request data from the payload used
|
|
* in IKEv1.
|
|
* Parameters: payload - a certificate req payload.
|
|
* Returns: IPIKE_SUCCESS
|
|
*
|
|
*
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_payload_certificate_req_extract_v1(
|
|
Ipike_cert_req_payload* payload,
|
|
Ipike_cert *cert);
|
|
|
|
|
|
#ifdef IPIKE_USE_OCSP
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_certificate_req_extract_v2
|
|
*===========================================================================
|
|
* Description: Extracts the certificate request data from the payload used
|
|
* in IKEv2.
|
|
* Parameters: payload - a certificate req payload.
|
|
* ocsp_resp_flag - set to TRUE if a ocsp response has to be sent
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
*
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_payload_certificate_req_extract_v2(Ipike_cert_req_payload* payload,
|
|
Ip_bool* ocsp_resp_flag);
|
|
|
|
#endif /* #ifdef IPIKE_USE_OCSP */
|
|
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
|
|
#endif
|
|
|
|
/*
|
|
****************************************************************************
|
|
* END OF FILE
|
|
****************************************************************************
|
|
*/
|