/* ****************************************************************************** * HEADER FILE * * Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike2_payload_authentication.h,v $ $Revision: 1.6 $ * $Source: /home/interpeak/CVSRoot/ipike/src/ipike2_payload_authentication.h,v $ * $Author: edahlber $ $Date: 2010-04-23 15:31:40 $ * $State: Exp $ $Locker: $ * * INTERPEAK_COPYRIGHT_STRING * Design and implementation by Kenneth Jonsson ****************************************************************************** */ #if !defined(IPIKE2_PAYLOAD_AUTHENTICATION_H) && defined(IPIKE_USE_VERSION2) #define IPIKE2_PAYLOAD_AUTHENTICATION_H /* **************************************************************************** * 1 DESCRIPTION **************************************************************************** */ /* Authentication payload (IKE version 2) */ /* **************************************************************************** * 2 CONFIGURATION **************************************************************************** */ #include "ipike_config.h" /* **************************************************************************** * 3 INCLUDE FILES **************************************************************************** */ #include "ipike_payload.h" #include "ipike_payload_certificate.h" #include "ipike2_payload_identification.h" #include "ipike2_payload_sa.h" #ifdef __cplusplus extern "C" { #endif /* **************************************************************************** * 4 DEFINES **************************************************************************** */ #define IPIKE2_AUTH_RSA_SIGNATURE 1 #define IPIKE2_AUTH_PRE_SHARED_KEY 2 #define IPIKE2_AUTH_DSS_SIGNATURE 3 #define IPIKE2_AUTH_EAP 4 /* **************************************************************************** * 5 TYPES **************************************************************************** */ /* Authentication Payload Format 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ! Next Payload !C! RESERVED ! Payload Length ! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ! Auth Method ! RESERVED ! ! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ! ! ~ Authentication Data ~ ! ! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ */ typedef struct Ipike2_auth_payload_struct { /* The generic ISAKMP payload header, the length includes the length of all transforms associated with the proposal */ Ipike_payload_header header; /* Authentication method */ Ip_u8 method; /* Reserved */ Ip_u8 reserved; Ip_u16 reserved2; /* Authentication data follows */ } Ipike2_auth_payload; typedef struct Ipike2_auth_struct { /* Authentication method */ Ip_u8 method; /* Authentication data */ Ipike_value data; } Ipike2_auth; /* **************************************************************************** * 6 FUNCTIONS **************************************************************************** */ /* *=========================================================================== * ipike_payload_authentication_create *=========================================================================== * Description: Creates a new authentication payload from the information * created in the exchange. * Parameters: auth - The authentication struct to encode to payload. * payload - Will point to a new authentication payload if the * call was successful. * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY */ IP_GLOBAL Ipike_error ipike_payload_authentication_create( Ipike2_auth* auth, Ipike2_auth_payload** payload); /* *=========================================================================== * ipike_payload_authentication_free *=========================================================================== * Description: Free all the values associated with the authentication * structure created in the exchange. * Parameters: auth - The authentication struct to free. * Returns: */ IP_GLOBAL void ipike_payload_authentication_free(Ipike2_auth* auth); /* *=========================================================================== * ipike_payload_authentication_check *=========================================================================== * Description: Verifies that the authentication payload is sane. * Parameters: auth - a pointer to a authentication payload. * Returns: IPIKE_SUCCESS */ IP_GLOBAL Ipike_error ipike_payload_authentication_check(Ipike2_auth_payload* auth); /* *=========================================================================== * ipike_payload_authentication_print *=========================================================================== * Description: Prints the content of the authentication payload to the * system log. * Parameters: auth - a pointer to a authentication payload. * Returns: */ IP_GLOBAL void ipike_payload_authentication_print(Ipike2_auth_payload* auth); /* *=========================================================================== * ipike_payload_authentication_extract *=========================================================================== * Description: Extracts the authentication data from the payload. * Parameters: payload - a authentication payload. * auth - will be updated with the authentication data if the * call was successful. * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY */ IP_GLOBAL Ipike_error ipike_payload_authentication_extract( Ipike2_auth_payload* payload, Ipike2_auth* auth); /* *=========================================================================== * ipike_payload_authentication_generate *=========================================================================== * Description: Generates a new authentication data from the information * created in the exchange. * Parameters: auth_method - The used authentication method. * prf_alg - The used prf algorithm (or 0 if not used). * conf - The configuration structure. * id - The id of the authenticator * key - The key that may be used to generate the authentication * data. * msg - The first message, may be used to generate the data. * auth - The generated authentication data * call was successful. * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY * IPIKE_SA_AUTHENTICATION_ALGORITHM_NOT_SUPPORTED */ IP_GLOBAL Ipike_error ipike_payload_authentication_generate( Ip_u8 auth_method, Ip_u16 prf_alg, Ipike_config_auth* conf, Ipike2_id* id, Ipike_value* key, Ipike_value* nonce, Ipike_value* msg, Ipike2_auth* auth); /* *=========================================================================== * ipike_payload_authentication_generate_eap *=========================================================================== * Description: Generates a new authentication data from EAP exchange key. * Parameters: shared_key - Buffer with key froam EAP exchange. * shared_key_len - Length of shared key buffer. * prf_alg - The used prf algorithm (or 0 if not used). * id - The id of the authenticator * key - The key that may be used to generate the authentication * data. * msg - The first message, may be used to generate the data. * auth - The generated authentication data * call was successful. * Returns: IPIKE_SUCCESS * IPIKE_OUT_OF_MEMORY * IPIKE_SA_AUTHENTICATION_ALGORITHM_NOT_SUPPORTED */ IP_GLOBAL Ipike_error ipike_payload_authentication_generate_eap( Ip_u8* shared_key, Ip_u32 shared_key_len, Ip_u16 prf_alg, Ipike2_id* id, Ipike_value* key, Ipike_value* nonce, Ipike_value* msg, Ipike2_auth* auth); /* *=========================================================================== * ipike_payload_authentication_verify *=========================================================================== * Description: Verify authentication data generated by the function above. * Parameters: prf_alg - The prf algorithm used (or 0 if not used). * conf - The configuration structure. * id - The id of the authenticator * key - The key that may be used to generate the authentication * data. * msg - The first message, may be used to generate the data. * cert - The certificate that should be used to verify the * message in case RSA/DSA signature. * auth - The authentication data. * Returns: IPIKE_SUCCESS * IPIKE_ISAKMP_AUTHENTICATION_FAILED */ IP_GLOBAL Ipike_error ipike_payload_authentication_verify( Ip_u16 prf_alg, Ipike_config_auth* conf, Ipike2_id* id, Ipike_value* key, Ipike_value* nonce, Ipike_value* msg, Ipike_cert* cert, Ipike2_auth* auth); /* *=========================================================================== * ipike_payload_authentication_verify_eap *=========================================================================== * Description: Verify EAP authentication data generated by the function above. * Parameters: shared_key - Buffer with key froam EAP exchange. * shared_key_len - Length of shared key buffer. * prf_alg - The prf algorithm used (or 0 if not used). * id - The id of the authenticator * key - The key that may be used to generate the authentication * data. * msg - The first message, may be used to generate the data. * auth - The authentication data. * Returns: IPIKE_SUCCESS * IPIKE_ISAKMP_AUTHENTICATION_FAILED */ IP_GLOBAL Ipike_error ipike_payload_authentication_verify_eap( Ip_u8* shared_key, Ip_u32 shared_key_len, Ip_u16 prf_alg, Ipike2_id* id, Ipike_value* key, Ipike_value* nonce, Ipike_value* msg, Ipike2_auth* auth); #ifdef __cplusplus } #endif #endif /* **************************************************************************** * END OF FILE **************************************************************************** */