416 lines
13 KiB
C
416 lines
13 KiB
C
/*
|
|
******************************************************************************
|
|
* SOURCE FILE
|
|
*
|
|
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_ipsec_attributes.c,v $ $Revision: 1.20.10.4 $
|
|
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_ipsec_attributes.c,v $
|
|
* $Author: zan $ $Date: 2013-08-02 03:20:23 $
|
|
* $State: Exp $ $Locker: $
|
|
*
|
|
* INTERPEAK_COPYRIGHT_STRING
|
|
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
|
|
******************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 1 DESCRIPTION
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 2 CONFIGURATION
|
|
****************************************************************************
|
|
*/
|
|
#include "ipike_config.h"
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 3 INCLUDE FILES
|
|
****************************************************************************
|
|
*/
|
|
|
|
#include "ipike_h.h"
|
|
#include "ipike_ipsec_attributes.h"
|
|
#include "ipike_payload_proposal.h"
|
|
#include "ipike_util.h"
|
|
#include <openssl/evp.h>
|
|
#include <ipcom_syslog.h>
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 4 EXTERN PROTOTYPES
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 5 DEFINES
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 6 TYPES
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 7 LOCAL PROTOTYPES
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 8 DATA
|
|
****************************************************************************
|
|
*/
|
|
|
|
static const char* ipike_invalid_attr = "invalid attribute value";
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 9 LOCAL FUNCTIONS
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 10 PUBLIC FUNCTIONS
|
|
****************************************************************************
|
|
*/
|
|
|
|
IP_GLOBAL const char *
|
|
ipike_ipsec_attribute_class_to_string(Ip_u16 attribute_type)
|
|
{
|
|
static const char *attr_cls_str[IPIKE_IPSEC_CLS_COUNT] = {
|
|
"SA life type",
|
|
"SA life duration",
|
|
"group description",
|
|
"encapsulation mode",
|
|
"authentication algorithm",
|
|
"key length",
|
|
"key rounds",
|
|
"compress dictionary size",
|
|
"compress private algorithm"
|
|
};
|
|
|
|
if (attribute_type != 0 && attribute_type <= IPIKE_IPSEC_CLS_COUNT)
|
|
return attr_cls_str[attribute_type - 1];
|
|
|
|
return "invalid attribute type";
|
|
}
|
|
|
|
|
|
IP_GLOBAL const char*
|
|
ipike_ipsec_attribute_value_to_string(Ip_u16 type, Ip_u16 value)
|
|
{
|
|
switch (type)
|
|
{
|
|
case IPIKE_IPSEC_CLS_SA_LIFE_TYPE:
|
|
return ipike_attribute_life_type_to_string(value);
|
|
case IPIKE_IPSEC_CLS_GROUP_DESCRIPTION:
|
|
return ipike_attribute_dh_group_to_string(value);
|
|
case IPIKE_IPSEC_CLS_ENCAPSULATION_MODE:
|
|
return ipike_ipsec_attribute_encap_mode_to_string(value);
|
|
case IPIKE_IPSEC_CLS_AUTHENTICATION_ALG:
|
|
return ipike_ipsec_attribute_integrity_alg_to_string(value);
|
|
}
|
|
return IP_NULL;
|
|
}
|
|
|
|
|
|
IP_GLOBAL Ipike_error
|
|
ipike_ipsec_attribute_process_encapsulation_mode(
|
|
Ipike_attribute* attr,
|
|
Ip_u16* enc_alg)
|
|
{
|
|
Ipike_error err;
|
|
|
|
err = ipike_check_basic_attr(attr, IPIKE_IPSEC_ENCAPSULATION_MODE_MAX);
|
|
if (IPIKE_SUCCESS != err)
|
|
return err;
|
|
|
|
*enc_alg = ip_ntohs(attr->value);
|
|
return IPIKE_SUCCESS;
|
|
}
|
|
|
|
|
|
IP_GLOBAL Ipike_error
|
|
ipike_ipsec_attribute_process_authentication_algorithm(
|
|
Ipike_attribute* attr,
|
|
Ip_u16* auth_alg)
|
|
{
|
|
Ipike_error err;
|
|
|
|
err = ipike_check_basic_attr(attr, IPIKE_IPSEC_AUTHENTICATION_ALG_COUNT);
|
|
if (IPIKE_SUCCESS != err)
|
|
return err;
|
|
|
|
if (ip_ntohs(attr->value) == IPIKE_IPSEC_AUTHENTICATION_ALG_DES_MAC
|
|
|| ip_ntohs(attr->value) == IPIKE_IPSEC_AUTHENTICATION_ALG_KPDK)
|
|
{
|
|
IPCOM_LOG1(ERR,
|
|
"ipike_ipsec_attribute_process_authentication_algorithm: %s not supported",
|
|
ipike_ipsec_attribute_value_to_string(IPIKE_ATTR_TYPE(attr->type), ip_ntohs(attr->value)));
|
|
return IPIKE_SA_AUTHENTICATION_ALGORITHM_NOT_SUPPORTED;
|
|
}
|
|
|
|
*auth_alg = ip_ntohs(attr->value);
|
|
return IPIKE_SUCCESS;
|
|
}
|
|
|
|
|
|
IP_GLOBAL Ipike_error
|
|
ipike_ipsec_attribute_process_key_length(Ipike_attribute* attr, Ip_u16* key_length)
|
|
{
|
|
return ipike_attribute_process_key_length(attr, key_length);
|
|
}
|
|
|
|
|
|
IP_GLOBAL Ipike_error
|
|
ipike_ipsec_check_transform_identifier(Ip_u8 security_proto_id, Ip_u8 transform_id)
|
|
{
|
|
switch (security_proto_id)
|
|
{
|
|
case IPIKE_PROTO_IPSEC_AH:
|
|
if (transform_id >= IPIKE_IPSEC_AH_MIN && transform_id <= IPIKE_IPSEC_AH_MAX)
|
|
return IPIKE_SUCCESS;
|
|
break;
|
|
case IPIKE_PROTO_IPSEC_ESP:
|
|
if (transform_id >= IPIKE_IPSEC_ESP_MIN && transform_id <= IPIKE_IPSEC_ESP_MAX)
|
|
return IPIKE_SUCCESS;
|
|
break;
|
|
case IPIKE_PROTO_IPCOMP:
|
|
if (transform_id >= IPIKE_IPSEC_IPCOMP_MIN && transform_id <= IPIKE_IPSEC_IPCOMP_MAX)
|
|
return IPIKE_SUCCESS;
|
|
break;
|
|
default:
|
|
break;
|
|
}
|
|
IPCOM_LOG2(ERR,
|
|
"ipike_ipsec_check_transform_identifier: invalid transform id (%d) for security protocol ID %s",
|
|
transform_id,
|
|
ipike_proposal_proto_id_to_string(security_proto_id));
|
|
return IPIKE_ISAKMP_INVALID_TRANSFORM_ID;
|
|
}
|
|
|
|
|
|
IP_GLOBAL Ipike_error
|
|
ipike_ipsec_attribute_get_esp_cipher_key_length(Ip_u8 transform_id, Ip_size_t* key_length)
|
|
{
|
|
EVP_CIPHER *cipher = IP_NULL;
|
|
switch (transform_id)
|
|
{
|
|
case 0:
|
|
*key_length = 0;
|
|
return IPIKE_SUCCESS;
|
|
case IPIKE_IPSEC_ESP_DES_IV64:
|
|
case IPIKE_IPSEC_ESP_DES:
|
|
case IPIKE_IPSEC_ESP_DES_IV32:
|
|
cipher=EVP_get_cipherbyname("des");
|
|
if (cipher == IP_NULL)
|
|
return IPIKE_PROPOSAL_INVALID_ID;
|
|
*key_length = (Ip_size_t)EVP_CIPHER_key_length(cipher);
|
|
return IPIKE_SUCCESS;
|
|
case IPIKE_IPSEC_ESP_3DES:
|
|
cipher=EVP_get_cipherbyname("des3");
|
|
if (cipher == IP_NULL)
|
|
return IPIKE_PROPOSAL_INVALID_ID;
|
|
*key_length = (Ip_size_t)EVP_CIPHER_key_length(cipher);
|
|
return IPIKE_SUCCESS;
|
|
case IPIKE_IPSEC_ESP_IDEA:
|
|
cipher=EVP_get_cipherbyname("idea");
|
|
if (cipher == IP_NULL)
|
|
return IPIKE_PROPOSAL_INVALID_ID;
|
|
*key_length = (Ip_size_t)EVP_CIPHER_key_length(cipher);
|
|
return IPIKE_SUCCESS;
|
|
case IPIKE_IPSEC_ESP_CAST:
|
|
cipher=EVP_get_cipherbyname("cast");
|
|
if (cipher == IP_NULL)
|
|
return IPIKE_PROPOSAL_INVALID_ID;
|
|
*key_length = (Ip_size_t)EVP_CIPHER_key_length(cipher);
|
|
return IPIKE_SUCCESS;
|
|
case IPIKE_IPSEC_ESP_BLOWFISH:
|
|
cipher=EVP_get_cipherbyname("bf");
|
|
if (cipher == IP_NULL)
|
|
return IPIKE_PROPOSAL_INVALID_ID;
|
|
*key_length = (Ip_size_t)EVP_CIPHER_key_length(cipher);
|
|
return IPIKE_SUCCESS;
|
|
case IPIKE_IPSEC_ESP_NULL:
|
|
*key_length = 0;
|
|
return IPIKE_SUCCESS;
|
|
case IPIKE_IPSEC_ESP_AESCBC:
|
|
case IPIKE_IPSEC_ESP_AESCTR:
|
|
/* default 128 bits */
|
|
cipher=EVP_get_cipherbyname("aes128");
|
|
if (cipher == IP_NULL)
|
|
return IPIKE_PROPOSAL_INVALID_ID;
|
|
*key_length = (Ip_size_t)EVP_CIPHER_key_length(cipher);
|
|
return IPIKE_SUCCESS;
|
|
}
|
|
IPCOM_LOG1(ERR,
|
|
"ipike_ipsec_attribute_get_esp_cipher_key_length: %d is an unknown transform ID",
|
|
transform_id);
|
|
return IPIKE_PROPOSAL_INVALID_ID;
|
|
}
|
|
|
|
|
|
IP_GLOBAL Ipike_error
|
|
ipike_ipsec_attribute_get_esp_auth_key_length(
|
|
Ip_u16 transform_id,
|
|
Ip_size_t * key_length)
|
|
{
|
|
switch (transform_id)
|
|
{
|
|
case 0:
|
|
*key_length = 0;
|
|
return IPIKE_SUCCESS;
|
|
case IPIKE_IPSEC_AUTHENTICATION_ALG_HMAC_MD5:
|
|
*key_length = 128/8;
|
|
return IPIKE_SUCCESS;
|
|
case IPIKE_IPSEC_AUTHENTICATION_ALG_HMAC_SHA1:
|
|
*key_length = 160/8;
|
|
return IPIKE_SUCCESS;
|
|
case IPIKE_IPSEC_AUTHENTICATION_ALG_AES_XCBC_MAC:
|
|
*key_length = 128/8;
|
|
return IPIKE_SUCCESS;
|
|
case IPIKE_IPSEC_AUTHENTICATION_ALG_HMAC_SHA2_256_128:
|
|
*key_length = 256/8;
|
|
return IPIKE_SUCCESS;
|
|
case IPIKE_IPSEC_AUTHENTICATION_ALG_HMAC_SHA2_384_192:
|
|
*key_length = 384/8;
|
|
return IPIKE_SUCCESS;
|
|
case IPIKE_IPSEC_AUTHENTICATION_ALG_HMAC_SHA2_512_256:
|
|
*key_length = 512/8;
|
|
return IPIKE_SUCCESS;
|
|
}
|
|
IPCOM_LOG1(ERR, "ipike_ipsec_attribute_get_esp_auth_key_length() :: "\
|
|
"%d is an unknown transform ID",
|
|
transform_id);
|
|
return IPIKE_ATTRIBUTE_UNSUPPORTED_VALUE;
|
|
}
|
|
|
|
|
|
IP_GLOBAL Ipike_error
|
|
ipike_ipsec_attribute_get_ah_key_length(
|
|
Ip_u8 transform_id,
|
|
Ip_size_t* key_length)
|
|
{
|
|
switch (transform_id)
|
|
{
|
|
case 0:
|
|
*key_length = 0;
|
|
return IPIKE_SUCCESS;
|
|
case IPIKE_IPSEC_AH_MD5:
|
|
*key_length = 128/8;
|
|
return IPIKE_SUCCESS;
|
|
case IPIKE_IPSEC_AH_SHA:
|
|
*key_length = 160/8;
|
|
return IPIKE_SUCCESS;
|
|
case IPIKE_IPSEC_AH_DES:
|
|
*key_length = 128/8;
|
|
return IPIKE_SUCCESS;
|
|
case IPIKE_IPSEC_AH_SHA2_256:
|
|
*key_length = 256/8;
|
|
return IPIKE_SUCCESS;
|
|
case IPIKE_IPSEC_AH_SHA2_384:
|
|
*key_length = 384/8;
|
|
return IPIKE_SUCCESS;
|
|
case IPIKE_IPSEC_AH_SHA2_512:
|
|
*key_length = 512/8;
|
|
return IPIKE_SUCCESS;
|
|
}
|
|
IPCOM_LOG1(ERR, "ipike_ipsec_attribute_get_ah_key_length() ::"\
|
|
" %d is an unknown transform ID",
|
|
transform_id);
|
|
return IPIKE_PROPOSAL_INVALID_ID;
|
|
}
|
|
|
|
|
|
IP_GLOBAL const char*
|
|
ipike_ipsec_attribute_esp_alg_to_string(Ip_u16 v)
|
|
{
|
|
const char *s;
|
|
if ((ipike_map_string(ipike.ipsec_esp_trans_id_map, v, &s)))
|
|
return ipike_invalid_attr;
|
|
return s;
|
|
}
|
|
|
|
|
|
IP_GLOBAL const char*
|
|
ipike_ipsec_attribute_ah_alg_to_string(Ip_u16 v)
|
|
{
|
|
const char *s;
|
|
if ((ipike_map_string(ipike.ipsec_ah_trans_id_map, v, &s)))
|
|
return ipike_invalid_attr;
|
|
return s;
|
|
}
|
|
|
|
|
|
IP_GLOBAL const char*
|
|
ipike_ipsec_attribute_integrity_alg_to_string(Ip_u16 v)
|
|
{
|
|
const char *s;
|
|
if ((ipike_map_string(ipike.authentication_algorithm_map, v, &s)))
|
|
return ipike_invalid_attr;
|
|
return s;
|
|
}
|
|
|
|
|
|
IP_GLOBAL const char*
|
|
ipike_ipsec_attribute_encap_mode_to_string(Ip_u16 v)
|
|
{
|
|
const char* s;
|
|
if ((ipike_map_string(ipike.encapsulation_mode_map, v, &s)))
|
|
return ipike_invalid_attr;
|
|
return s;
|
|
}
|
|
|
|
|
|
IP_GLOBAL const char*
|
|
ipike_ipsec_attribute_esp_key_length_alg_to_string(Ip_u16 v1, Ip_u16 v2)
|
|
{
|
|
const char* s;
|
|
int v = v1 + (v2 << 16);
|
|
if ((ipike_map_string(ipike.ipsec_esp_key_length_map, v, &s)))
|
|
return IP_NULL;
|
|
return s;
|
|
}
|
|
|
|
IP_GLOBAL Ipike_error
|
|
ipike_ipsec_attribute_esp_alg_from_string(const char* s, Ip_u16* v)
|
|
{
|
|
return ipike_attribute_map_Ip_u16(ipike.ipsec_esp_trans_id_map, s, v);
|
|
}
|
|
|
|
|
|
IP_GLOBAL Ipike_error
|
|
ipike_ipsec_attribute_ah_alg_from_string(const char* s, Ip_u16* v)
|
|
{
|
|
return ipike_attribute_map_Ip_u16(ipike.ipsec_ah_trans_id_map, s, v);
|
|
}
|
|
|
|
|
|
IP_GLOBAL Ipike_error
|
|
ipike_ipsec_attribute_integrity_alg_from_string(const char* s, Ip_u16* v)
|
|
{
|
|
return ipike_attribute_map_Ip_u16(ipike.authentication_algorithm_map, s, v);
|
|
}
|
|
|
|
|
|
IP_GLOBAL Ipike_error
|
|
ipike_ipsec_attribute_encap_mode_from_string(const char* s, Ip_u16* v)
|
|
{
|
|
return ipike_attribute_map_Ip_u16(ipike.encapsulation_mode_map, s, v);
|
|
}
|
|
|
|
|
|
/*
|
|
****************************************************************************
|
|
* END OF FILE
|
|
****************************************************************************
|
|
*/
|