346 lines
13 KiB
C
346 lines
13 KiB
C
/*
|
|
******************************************************************************
|
|
* HEADER FILE
|
|
*
|
|
* Document no: @(#) $Name: VXWORKS_ITER40_RCPL8_2024030303 $ $RCSfile: ipike_payload.h,v $ $Revision: 1.12.14.5 $
|
|
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_payload.h,v $
|
|
* $Author: wdeng $ $Date: 2021-06-16 08:38:22 $
|
|
* $State: Exp $ $Locker: $
|
|
*
|
|
* INTERPEAK_COPYRIGHT_STRING
|
|
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
|
|
******************************************************************************
|
|
*/
|
|
#ifndef IPIKE_PAYLOAD_H
|
|
#define IPIKE_PAYLOAD_H
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 1 DESCRIPTION
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 2 CONFIGURATION
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 3 INCLUDE FILES
|
|
****************************************************************************
|
|
*/
|
|
|
|
#include "ipike_config.h"
|
|
#include "ipike.h"
|
|
#include "ipike_isakmp.h"
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 4 DEFINES
|
|
****************************************************************************
|
|
*/
|
|
|
|
#define IPIKE_PAYLOAD_NONE 0
|
|
|
|
#define IPIKE_PAYLOAD_SECURITY_ASSOCIATION 1
|
|
#define IPIKE_PAYLOAD_PROPOSAL 2
|
|
#define IPIKE_PAYLOAD_TRANSFORM 3
|
|
#define IPIKE_PAYLOAD_KEY_EXCHANGE 4
|
|
#define IPIKE_PAYLOAD_IDENTFICATION 5
|
|
#define IPIKE_PAYLOAD_CERTIFICATE 6
|
|
#define IPIKE_PAYLOAD_CERTIFICATE_REQUEST 7
|
|
#define IPIKE_PAYLOAD_HASH 8
|
|
#define IPIKE_PAYLOAD_SIGNATURE 9
|
|
#define IPIKE_PAYLOAD_NONCE 10
|
|
#define IPIKE_PAYLOAD_NOTIFICATION 11
|
|
#define IPIKE_PAYLOAD_DELETE 12
|
|
#define IPIKE_PAYLOAD_VENDOR_ID 13
|
|
#define IPIKE_PAYLOAD_ATTRIBUTES 14
|
|
#define IPIKE_PAYLOAD_NAT_DISCOVERY 20
|
|
#define IPIKE_PAYLOAD_NAT_ORIGINAL_ADDRESS 21
|
|
|
|
#define IPIKE2_PAYLOAD_SECURITY_ASSOCIATION 33
|
|
#define IPIKE2_PAYLOAD_KEY_EXCHANGE 34
|
|
#define IPIKE2_PAYLOAD_IDENTIFICATION_I 35
|
|
#define IPIKE2_PAYLOAD_IDENTIFICATION_R 36
|
|
#define IPIKE2_PAYLOAD_CERTIFICATE 37
|
|
#define IPIKE2_PAYLOAD_CERTIFICATE_REQUEST 38
|
|
#define IPIKE2_PAYLOAD_AUTHENTICATION 39
|
|
#define IPIKE2_PAYLOAD_NONCE 40
|
|
#define IPIKE2_PAYLOAD_NOTIFY 41
|
|
#define IPIKE2_PAYLOAD_DELETE 42
|
|
#define IPIKE2_PAYLOAD_VENDOR_ID 43
|
|
#define IPIKE2_PAYLOAD_TRAFFIC_SELECTOR_I 44
|
|
#define IPIKE2_PAYLOAD_TRAFFIC_SELECTOR_R 45
|
|
#define IPIKE2_PAYLOAD_ENCRYPTED 46
|
|
#define IPIKE2_PAYLOAD_CONFIGURATION 47
|
|
#define IPIKE2_PAYLOAD_EAP 48
|
|
/*
|
|
* COOKIE is also a NOTIFY payload but it needs special care because it needs
|
|
* to be placed as the first payload in the IKE exchange [RFC 4306].
|
|
*/
|
|
#define IPIKE2_PAYLOAD_COOKIE 49
|
|
|
|
#define IPIKE_PAYLOAD_TYPE(x) (x & 0x00ff)
|
|
|
|
#define IPIKE_PAYLOAD_HEADER_LENGTH sizeof(Ipike_payload_header)
|
|
|
|
/* Get data length from payload header (a is length and b payload size) */
|
|
#define IPIKE_PAYLOAD_DATA_LENGTH(a,b) (Ip_u16)((ip_htons(a) < b) ? 0 : (ip_htons(a) - b))
|
|
|
|
/* Or with the payload types to indicate optional payload,
|
|
used when specifying payload orders */
|
|
#define IPIKE_PAYLOAD_OPT ((Ip_u16) 0x8000)
|
|
/* Must this optional payload will be added by IPIKE */
|
|
#define IPIKE_PAYLOAD_ADD ((Ip_u16) 0x4000)
|
|
|
|
#define IPIKE_PAYLOAD_CRITICAL 0x80
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 5 TYPES
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
Generic Payload Header
|
|
|
|
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
! Next Payload !C! RESERVED ! Payload Length !
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
|
|
|
+ critical bit (v2)
|
|
*/
|
|
typedef struct Ipike_payload_header_struct
|
|
{
|
|
/* the id for the payload following this payload */
|
|
Ip_u8 next_payload;
|
|
/* flags (v2) */
|
|
Ip_u8 flags;
|
|
/* payload length octets are stored in network (big endian) byte order */
|
|
Ip_u16 length;
|
|
}
|
|
Ipike_payload_header;
|
|
|
|
typedef struct Ipike_payload_enum_struct
|
|
{
|
|
Ipike_payload_header* real_header;
|
|
Ipike_payload_header* allocated_header;
|
|
Ip_u32 max_len;
|
|
}
|
|
Ipike_payload_enum;
|
|
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 6 FUNCTIONS
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_check_payloads
|
|
*===========================================================================
|
|
* Description: Verifies that the generic ISAKMP header for each payload
|
|
* is sane and that the sum of the payload sizes matches the
|
|
* size of the ISAKMP message.
|
|
* Parameters: isakmp - a pointer to the beginning of the isakmp message.
|
|
* Returns: IPIKE_SUCCESS
|
|
*
|
|
*
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_check_payloads(Ipike_isakmp_header* isakmp,Ip_bool phase1);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_first_payload
|
|
*===========================================================================
|
|
* Description: Returns a pointer to the first payload.
|
|
* Parameters: payload - a pointer to the current payload.
|
|
* Returns: A pointer to the first payload or IP_NULL if no payload exist.
|
|
*
|
|
*/
|
|
#ifdef IPCOM_USE_DMALLOC
|
|
IP_GLOBAL Ipike_payload_header *
|
|
ipike_first_payload_debug(Ipike_isakmp_header *isakmp, Ipike_payload_enum *ctx, const char *file, const char *function, Ip_u32 line);
|
|
#define ipike_first_payload(i,c) ipike_first_payload_debug(i,c, __FILE__, __FUNCTION__, __LINE__)
|
|
#else
|
|
IP_GLOBAL Ipike_payload_header *
|
|
ipike_first_payload(Ipike_isakmp_header *isakmp, Ipike_payload_enum *ctx);
|
|
#endif
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_next_payload
|
|
*===========================================================================
|
|
* Description: Returns a pointer to the next payload in the chain.
|
|
* Parameters: payload - a pointer to the current payload.
|
|
* Returns: the pointer to the next payload of IP_NULL if the 'next payload'
|
|
* field of the current payload is IPIKE_PAYLOAD_NONE.
|
|
*
|
|
*/
|
|
#ifdef IPCOM_USE_DMALLOC
|
|
IP_GLOBAL Ipike_payload_header*
|
|
ipike_next_payload_debug(Ipike_payload_enum *ctx, const char *file, const char *function, Ip_u32 line);
|
|
#define ipike_next_payload(c) ipike_next_payload_debug(c, __FILE__, __FUNCTION__, __LINE__)
|
|
#else
|
|
IP_GLOBAL Ipike_payload_header*
|
|
ipike_next_payload(Ipike_payload_enum* ctx);
|
|
#endif
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_next_payload_structure
|
|
*===========================================================================
|
|
* Description: Returns a pointer to the next payload in the chain.
|
|
* Parameters: payload - a pointer to the current payload.
|
|
* Returns: the pointer to the next payload of IP_NULL if the 'next payload'
|
|
* field of the current payload is IPIKE_PAYLOAD_NONE.
|
|
*
|
|
*/
|
|
IP_GLOBAL Ipike_payload_header*
|
|
ipike_next_payload_structure(Ipike_payload_header* payload);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_free_payload_enumerator
|
|
*===========================================================================
|
|
*/
|
|
IP_GLOBAL void
|
|
ipike_free_payload_enumerator(Ipike_payload_enum* ctx);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_array_size
|
|
*===========================================================================
|
|
* Description: Returns the size (in bytes) of the sum of the payloads.
|
|
* Parameters: payloads - an IP_NULL terminated array of ISAKMP payloads.
|
|
* Returns: The total size in bytes of the payloads in the array.
|
|
*
|
|
*/
|
|
IP_GLOBAL Ip_u32
|
|
ipike_payload_array_size(Ipike_payload_header** payloads);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_chain_size
|
|
*===========================================================================
|
|
* Description: Returns the length of a payload chain.
|
|
* Parameters: first_payload - a pointer to the first payload in the chain.
|
|
* max_size - the maximum size the chain is allowed to have.
|
|
* Returns: The size (in bytes) of the payload chain or -1 if the chain
|
|
* was longer than max_size.
|
|
*
|
|
*/
|
|
IP_GLOBAL Ip_s32
|
|
ipike_payload_chain_size(Ipike_payload_header* first_payload, Ip_u32 max_size);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_type_to_string
|
|
*===========================================================================
|
|
* Description: Returns a texual representation of the payload type.
|
|
* Parameters: payload_type - the numerical value of the payload_type.
|
|
* Returns: A texual representation of the payload type.
|
|
*
|
|
*
|
|
*/
|
|
IP_GLOBAL const char*
|
|
ipike_payload_type_to_string(Ip_u8 payload_type);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_print
|
|
*===========================================================================
|
|
* Description: Prints the content of all payloads in a ISAKMP message to
|
|
* the system log.
|
|
* Parameters: isakmp - a pointer to the beginning of the isakmp message.
|
|
* is_phase1 - is IP_TRUE if the message is a phase 1 message.
|
|
* version - IKE version
|
|
* Returns: A texual representation of the payload type.
|
|
*
|
|
*
|
|
*/
|
|
IP_GLOBAL void
|
|
ipike_payload_print(Ipike_isakmp_header* isakmp, Ip_bool is_phase1, int version);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_check
|
|
*===========================================================================
|
|
* Description: Checks that the messages only contains payloads that is allowed
|
|
* in the current exchange and message.
|
|
* Parameters: isakmp - a pointer to a ISAKMP message.
|
|
* payload_types - an array of payload IDs which has the correct
|
|
* order for the current message in the current exchange.
|
|
* message_number - the message number in the current exchange.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_WRONG_PAYLOAD_ORDER
|
|
*
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_payload_check(
|
|
Ipike_isakmp_header* isakmp,
|
|
const Ip_u16* payload_types,
|
|
int message_number);
|
|
|
|
|
|
#ifdef IPIKE_USE_VERSION2
|
|
/*
|
|
*===========================================================================
|
|
* ipike_is_ike_rekeying
|
|
*===========================================================================
|
|
* Check if we are doing IKE-rekeying (missing traffic selectors)
|
|
*/
|
|
IP_PUBLIC Ip_bool
|
|
ipike_is_ike_rekeying(Ipike_isakmp_header *isakmp);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_handle_unsupported_payload
|
|
*===========================================================================
|
|
* Description: Checks if the unsupported payload has the critical bit set,
|
|
if so it stores the payload type in the specified notify_data,
|
|
otherwise just log.
|
|
* Parameters: notify_data - Place to put the unsupported payload_type in
|
|
* in case of error.
|
|
* payload - Unsupported payload.
|
|
* this_payload - Type of the unsupported payload.
|
|
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_ISAKMP_UNSUPPORTED_CRITICAL_PAYLOAD
|
|
*
|
|
*/
|
|
IP_PUBLIC Ipike_error
|
|
ipike_payload_handle_unsupported_payload(
|
|
Ipike_value *notify_data,
|
|
Ipike_payload_header *payload,
|
|
Ip_u8 this_payload);
|
|
|
|
|
|
|
|
#endif /* IPIKE_USE_VERSION2 */
|
|
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
|
|
#endif
|
|
|
|
/*
|
|
****************************************************************************
|
|
* END OF FILE
|
|
****************************************************************************
|
|
*/
|