434 lines
17 KiB
C
434 lines
17 KiB
C
/*
|
|
******************************************************************************
|
|
* HEADER FILE
|
|
*
|
|
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_payload_identification.h,v $ $Revision: 1.8.10.4 $
|
|
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_payload_identification.h,v $
|
|
* $Author: edahlber $ $Date: 2012-06-29 11:13:44 $
|
|
* $State: Exp $ $Locker: $
|
|
*
|
|
* INTERPEAK_COPYRIGHT_STRING
|
|
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
|
|
******************************************************************************
|
|
*/
|
|
#ifndef IPIKE_PAYLOAD_IDENTIFICATION_H
|
|
#define IPIKE_PAYLOAD_IDENTIFICATION_H
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 1 DESCRIPTION
|
|
****************************************************************************
|
|
*/
|
|
|
|
/* Identification payload (RFC 2408, chapter 3.8 & RFC 2407, chapter 4.6.2 for
|
|
the IPSec DOI) */
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 2 CONFIGURATION
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 3 INCLUDE FILES
|
|
****************************************************************************
|
|
*/
|
|
|
|
#include "ipike_config.h"
|
|
#include "ipike_payload.h"
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 4 DEFINES
|
|
****************************************************************************
|
|
*/
|
|
|
|
#define IPIKE_ID_HEADER_LENGTH 8
|
|
|
|
/* IPSec DOI ID Types */
|
|
/* The ID_IPV4_ADDR type specifies a single four (4) octet IPv4 address. */
|
|
#define IPIKE_ID_IPV4_ADDR 1
|
|
/* The ID_FQDN type specifies a fully-qualified domain name string. */
|
|
#define IPIKE_ID_FQDN 2
|
|
/* The ID_USER_FQDN type specifies a fully-qualified username string. */
|
|
#define IPIKE_ID_USER_FQDN 3
|
|
/* The ID_IPV4_ADDR_SUBNET type specifies a range of IPv4 addresses,
|
|
represented by two four (4) octet values. The first value is an IPv4
|
|
address. The second is an IPv4 network mask. */
|
|
#define IPIKE_ID_IPV4_ADDR_SUBNET 4
|
|
/* The ID_IPV6_ADDR type specifies a single sixteen (16) octet IPv6 address.*/
|
|
#define IPIKE_ID_IPV6_ADDR 5
|
|
/* The ID_IPV6_ADDR_SUBNET type specifies a range of IPv6 addresses,
|
|
represented by two sixteen (16) octet values. The first value is an
|
|
IPv6 address. The second is an IPv6 network mask. */
|
|
#define IPIKE_ID_IPV6_ADDR_SUBNET 6
|
|
/* The ID_IPV4_ADDR_RANGE type specifies a range of IPv4 addresses,
|
|
represented by two four (4) octet values. The first value is the
|
|
beginning IPv4 address (inclusive) and the second value is the ending
|
|
IPv4 address (inclusive). */
|
|
#define IPIKE_ID_IPV4_ADDR_RANGE 7
|
|
/* The ID_IPV6_ADDR_RANGE type specifies a range of IPv6 addresses,
|
|
represented by two sixteen (16) octet values. The first value is the
|
|
beginning IPv6 address (inclusive) and the second value is the ending
|
|
IPv6 address (inclusive). */
|
|
#define IPIKE_ID_IPV6_ADDR_RANGE 8
|
|
/* The ID_DER_ASN1_DN type specifies the binary DER encoding of an ASN.1
|
|
X.500 Distinguished Name of the principal whose certificates
|
|
are being exchanged to establish the SA. */
|
|
#define IPIKE_ID_DER_ASN1_DN 9
|
|
/* The ID_DER_ASN1_GN type specifies the binary DER encoding of an ASN.1
|
|
X.500 GeneralName of the principal whose certificates are
|
|
being exchanged to establish the SA. */
|
|
#define IPIKE_ID_DER_ASN1_GN 10
|
|
/* The ID_KEY_ID type specifies an opaque byte stream which may be used
|
|
to pass vendor-specific information necessary to identify which pre-
|
|
shared key should be used to authenticate Aggressive mode
|
|
negotiations. */
|
|
#define IPIKE_ID_KEY_ID 11
|
|
|
|
#define IPIKE_ID_COUNT 11
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 5 TYPES
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
Identification Payload Format
|
|
1 2 3
|
|
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
! Next Payload ! RESERVED ! Payload Length !
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
! ID Type ! DOI Specific ID Data !
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
! !
|
|
~ Identification Data ~
|
|
! !
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
|
|
|
|
Identification Payload Format (DOI: IPSec)
|
|
1 2 3
|
|
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
! Next Payload ! RESERVED ! Payload Length !
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
! ID Type ! Protocol ID ! Port !
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
~ Identification Data ~
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
|
|
*/
|
|
|
|
typedef struct Ipike_identification_payload_struct
|
|
{
|
|
/* The generic ISAKMP payload header, the length includes the length
|
|
of all transforms associated with the proposal */
|
|
Ipike_payload_header header;
|
|
|
|
/* Value describing the identity information found in the
|
|
Identification Data field. */
|
|
Ip_u8 id_type;
|
|
}
|
|
Ipike_id_payload;
|
|
|
|
typedef struct Ipike_identification_struct
|
|
{
|
|
/* Value describing the identity information found in the
|
|
Identification Data field. */
|
|
Ip_u8 id_type;
|
|
/* the domain of interpretation for this identification */
|
|
Ip_u32 doi;
|
|
/* DOI Specific ID Data, the DOI is stored in the Ipike_sa struct */
|
|
union {
|
|
struct Ipike_ipsec_param_struct {
|
|
/* UPD or TCP, a zero value means that this field should be ignored */
|
|
Ip_u8 proto_id;
|
|
/* Value specifying an associated port. A value of zero means that
|
|
the Port field should be ignored. */
|
|
Ip_u16 port;
|
|
} ipsec;
|
|
} doi_specific_id_data;
|
|
|
|
Ipike_value id_data;
|
|
}
|
|
Ipike_id;
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 6 FUNCTIONS
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_identification_init_ip_address
|
|
*===========================================================================
|
|
* Description: Initializes the id with IPv4 or IPv6 address.
|
|
* Parameters: addr - The ip address holding the id data.
|
|
* id - Will hold the id data from the configuration if the call
|
|
* was successful.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
* IPIKE_CONF_VALUE_NOT_FOUND
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_identification_init_ip_address(
|
|
const char* addr,
|
|
Ip_u8* type,
|
|
Ipike_value* id);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_identification_init_ip_subnet
|
|
*===========================================================================
|
|
* Description: Initializes the identification with ip subnet.
|
|
* Parameters: addr - The ip address.
|
|
* mask - The ip netmask.
|
|
* type - Will hold the id type if the call was successful.
|
|
* id - Will hold the identification data from the configuration
|
|
* if the call was successful.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
* IPIKE_CONF_VALUE_NOT_FOUND
|
|
*
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_identification_init_ip_subnet(
|
|
union Ip_sockaddr_union* addr,
|
|
union Ip_sockaddr_union* mask,
|
|
Ip_u8* type,
|
|
Ipike_value* id);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_identification_init_asn1_dn
|
|
*===========================================================================
|
|
* Description: Initializes the id with a asn1 dn value.
|
|
* Parameters: dn - The asn1 dn value holding the id data.
|
|
* id - Will hold the id data from the configuration if the call
|
|
* was successful.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
* IPIKE_CONF_VALUE_NOT_FOUND
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_identification_init_asn1_dn(const char* dn, Ipike_value* id);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_identification_init_value
|
|
*===========================================================================
|
|
* Description: Initializes the id with a configuration value.
|
|
* Parameters: value - The value holding the id data.
|
|
* id - Will hold the id data from the configuration if the call
|
|
* was successful.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
* IPIKE_CONF_VALUE_NOT_FOUND
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_identification_init_value(const char* value, Ipike_value* id);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_identification_new
|
|
*===========================================================================
|
|
* Description: Creates a new identification payload.
|
|
* Parameters: id_type - the type of identification being used.
|
|
* doi_specific_id_data_len - the least significant 24 bits
|
|
* specifies the DOI specific data.
|
|
* id_data - the identification data, depends on both DOI
|
|
* and the value of 'id_type'.
|
|
* Returns: A new identification payload or IP_NULL if out of memory.
|
|
*
|
|
*
|
|
*/
|
|
IP_GLOBAL Ipike_id_payload*
|
|
ipike_identification_new(
|
|
Ip_u8 id_type,
|
|
Ip_u32 doi_specific_id_data,
|
|
const Ip_u8* id_data,
|
|
Ip_size_t id_data_len);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_identification_create
|
|
*===========================================================================
|
|
* Description: Creates a new identification payload from the information created
|
|
* in the exchange.
|
|
* Parameters: identification - the identification structure to encode into
|
|
* a ISAKMP payload.
|
|
* payload - will point to a new identification payload.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
* IPIKE_DOI_UNSUPPORTED
|
|
*
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_identification_create(
|
|
Ipike_id* identification,
|
|
Ipike_id_payload** payload);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_identification_generate
|
|
*===========================================================================
|
|
* Description: Generate identification structure from configuration value.
|
|
* Parameters: value - The configuration value
|
|
* id - The generated identification structure.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
* IPIKE_CONF_VALUE_INVALID
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_identification_generate(
|
|
const char* value,
|
|
Ipike_id* id);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_identification_initiator_initialize
|
|
*===========================================================================
|
|
* Description: Initializes IPSec local and remote identification structures.
|
|
* Parameters: ie - The exchange
|
|
* idii - The identification of this machine.
|
|
* idir - The identification of the remote machine.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
* IPIKE_CONF_VALUE_NOT_FOUND
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_identification_initiator_initialize(
|
|
Ipike_isakmp_exchange* ie,
|
|
Ipike_id* idii,
|
|
Ipike_id* idir);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_identification_check_payload
|
|
*===========================================================================
|
|
* Description: Verifies that the identification payload is sane.
|
|
* Parameters: identification - a pointer to a identification payload.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_ISAKMP_PAYLOAD_LENGTH_ERROR
|
|
*
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_identification_check_payload(Ipike_id_payload* identification);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_identification_print_payload
|
|
*===========================================================================
|
|
* Description: Prints the content of the identification payload to the
|
|
* system log.
|
|
* Parameters: identification - a pointer to identification payload.
|
|
* Returns:
|
|
*
|
|
*
|
|
*/
|
|
IP_GLOBAL void
|
|
ipike_identification_print_payload(Ipike_id_payload* identification);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_identification_extract
|
|
*===========================================================================
|
|
* Description: Extracts the identification data from the payload.
|
|
* Parameters: payload - a identification payload.
|
|
* identification - will be updated with the identification data
|
|
* if the call was successful.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
* IPIKE_DOI_UNSUPPORTED
|
|
*
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_identification_extract(
|
|
Ipike_id_payload* payload,
|
|
Ip_u32 doi,
|
|
Ipike_id* identification);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_identification_ike_extract
|
|
*===========================================================================
|
|
* Description: Extracts the identification data from the payload and
|
|
* validates the identification data in the context of IKE.
|
|
* Parameters: payload - a identification payload.
|
|
* identification - will be updated with the identification data
|
|
* if the call was successful.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
* IPIKE_DOI_UNSUPPORTED
|
|
* IPIKE_ISAKMP_INVALID_ID_TYPE
|
|
*
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_identification_ike_extract(
|
|
Ipike_id_payload* payload,
|
|
Ip_u32 doi,
|
|
Ipike_id* identification);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_identification_ipsec_extract
|
|
*===========================================================================
|
|
* Description: Extracts IPv4 paramters from the identification data,
|
|
* everything is returned in big-endian byte order.
|
|
* Parameters: identification - the identification data
|
|
* proto - will contain the protocol (TCP, UDP or 0 if protocol
|
|
* should be ignored).
|
|
* addr_or_net - will contain the IP address or IP subnet.
|
|
* netmask - will contain the network mask if the identification
|
|
* contains subnet information, it will be set to 0 otherwise.
|
|
* port - will contain the port (or 0 if the port should be ignored).
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
* IPIKE_DOI_UNSUPPORTED
|
|
*
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_identification_ipsec_extract(
|
|
Ipike_id* identification,
|
|
Ip_u8* proto,
|
|
Ipike_config_netobj* netobj);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_identification_match_flow
|
|
*===========================================================================
|
|
* Description: Match the IPSec SA configuration flow with the specified id
|
|
* structures.
|
|
* Parameters: flow - the IPSec SA flow.
|
|
* id_src - the id for source.
|
|
* id_dst - the id for destination.
|
|
* Returns: IPIKE_SUCCESS, IPIKE_CONF_INVALID_VALUE
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_identification_match_flow(
|
|
Ipike_config_flow* flow,
|
|
Ipike_id* id_src,
|
|
Ipike_id* id_dst);
|
|
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
|
|
#endif
|
|
|
|
/*
|
|
****************************************************************************
|
|
* END OF FILE
|
|
****************************************************************************
|
|
*/
|