302 lines
12 KiB
C
302 lines
12 KiB
C
/*
|
|
******************************************************************************
|
|
* HEADER FILE
|
|
*
|
|
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike2_payload_authentication.h,v $ $Revision: 1.6 $
|
|
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike2_payload_authentication.h,v $
|
|
* $Author: edahlber $ $Date: 2010-04-23 15:31:40 $
|
|
* $State: Exp $ $Locker: $
|
|
*
|
|
* INTERPEAK_COPYRIGHT_STRING
|
|
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
|
|
******************************************************************************
|
|
*/
|
|
#if !defined(IPIKE2_PAYLOAD_AUTHENTICATION_H) && defined(IPIKE_USE_VERSION2)
|
|
#define IPIKE2_PAYLOAD_AUTHENTICATION_H
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 1 DESCRIPTION
|
|
****************************************************************************
|
|
*/
|
|
|
|
/* Authentication payload (IKE version 2) */
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 2 CONFIGURATION
|
|
****************************************************************************
|
|
*/
|
|
#include "ipike_config.h"
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 3 INCLUDE FILES
|
|
****************************************************************************
|
|
*/
|
|
#include "ipike_payload.h"
|
|
#include "ipike_payload_certificate.h"
|
|
#include "ipike2_payload_identification.h"
|
|
#include "ipike2_payload_sa.h"
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 4 DEFINES
|
|
****************************************************************************
|
|
*/
|
|
|
|
#define IPIKE2_AUTH_RSA_SIGNATURE 1
|
|
#define IPIKE2_AUTH_PRE_SHARED_KEY 2
|
|
#define IPIKE2_AUTH_DSS_SIGNATURE 3
|
|
#define IPIKE2_AUTH_EAP 4
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 5 TYPES
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
Authentication Payload Format
|
|
|
|
1 2 3
|
|
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
! Next Payload !C! RESERVED ! Payload Length !
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
! Auth Method ! RESERVED ! !
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
! !
|
|
~ Authentication Data ~
|
|
! !
|
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
*/
|
|
typedef struct Ipike2_auth_payload_struct
|
|
{
|
|
/* The generic ISAKMP payload header, the length includes the length
|
|
of all transforms associated with the proposal */
|
|
Ipike_payload_header header;
|
|
|
|
/* Authentication method */
|
|
Ip_u8 method;
|
|
/* Reserved */
|
|
Ip_u8 reserved;
|
|
Ip_u16 reserved2;
|
|
|
|
/* Authentication data follows */
|
|
}
|
|
Ipike2_auth_payload;
|
|
|
|
typedef struct Ipike2_auth_struct
|
|
{
|
|
/* Authentication method */
|
|
Ip_u8 method;
|
|
/* Authentication data */
|
|
Ipike_value data;
|
|
}
|
|
Ipike2_auth;
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 6 FUNCTIONS
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_authentication_create
|
|
*===========================================================================
|
|
* Description: Creates a new authentication payload from the information
|
|
* created in the exchange.
|
|
* Parameters: auth - The authentication struct to encode to payload.
|
|
* payload - Will point to a new authentication payload if the
|
|
* call was successful.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_payload_authentication_create(
|
|
Ipike2_auth* auth,
|
|
Ipike2_auth_payload** payload);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_authentication_free
|
|
*===========================================================================
|
|
* Description: Free all the values associated with the authentication
|
|
* structure created in the exchange.
|
|
* Parameters: auth - The authentication struct to free.
|
|
* Returns:
|
|
*/
|
|
IP_GLOBAL void
|
|
ipike_payload_authentication_free(Ipike2_auth* auth);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_authentication_check
|
|
*===========================================================================
|
|
* Description: Verifies that the authentication payload is sane.
|
|
* Parameters: auth - a pointer to a authentication payload.
|
|
* Returns: IPIKE_SUCCESS
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_payload_authentication_check(Ipike2_auth_payload* auth);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_authentication_print
|
|
*===========================================================================
|
|
* Description: Prints the content of the authentication payload to the
|
|
* system log.
|
|
* Parameters: auth - a pointer to a authentication payload.
|
|
* Returns:
|
|
*/
|
|
IP_GLOBAL void
|
|
ipike_payload_authentication_print(Ipike2_auth_payload* auth);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_authentication_extract
|
|
*===========================================================================
|
|
* Description: Extracts the authentication data from the payload.
|
|
* Parameters: payload - a authentication payload.
|
|
* auth - will be updated with the authentication data if the
|
|
* call was successful.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_payload_authentication_extract(
|
|
Ipike2_auth_payload* payload,
|
|
Ipike2_auth* auth);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_authentication_generate
|
|
*===========================================================================
|
|
* Description: Generates a new authentication data from the information
|
|
* created in the exchange.
|
|
* Parameters: auth_method - The used authentication method.
|
|
* prf_alg - The used prf algorithm (or 0 if not used).
|
|
* conf - The configuration structure.
|
|
* id - The id of the authenticator
|
|
* key - The key that may be used to generate the authentication
|
|
* data.
|
|
* msg - The first message, may be used to generate the data.
|
|
* auth - The generated authentication data
|
|
* call was successful.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
* IPIKE_SA_AUTHENTICATION_ALGORITHM_NOT_SUPPORTED
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_payload_authentication_generate(
|
|
Ip_u8 auth_method,
|
|
Ip_u16 prf_alg,
|
|
Ipike_config_auth* conf,
|
|
Ipike2_id* id,
|
|
Ipike_value* key,
|
|
Ipike_value* nonce,
|
|
Ipike_value* msg,
|
|
Ipike2_auth* auth);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_authentication_generate_eap
|
|
*===========================================================================
|
|
* Description: Generates a new authentication data from EAP exchange key.
|
|
* Parameters: shared_key - Buffer with key froam EAP exchange.
|
|
* shared_key_len - Length of shared key buffer.
|
|
* prf_alg - The used prf algorithm (or 0 if not used).
|
|
* id - The id of the authenticator
|
|
* key - The key that may be used to generate the authentication
|
|
* data.
|
|
* msg - The first message, may be used to generate the data.
|
|
* auth - The generated authentication data
|
|
* call was successful.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_OUT_OF_MEMORY
|
|
* IPIKE_SA_AUTHENTICATION_ALGORITHM_NOT_SUPPORTED
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_payload_authentication_generate_eap(
|
|
Ip_u8* shared_key,
|
|
Ip_u32 shared_key_len,
|
|
Ip_u16 prf_alg,
|
|
Ipike2_id* id,
|
|
Ipike_value* key,
|
|
Ipike_value* nonce,
|
|
Ipike_value* msg,
|
|
Ipike2_auth* auth);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_authentication_verify
|
|
*===========================================================================
|
|
* Description: Verify authentication data generated by the function above.
|
|
* Parameters: prf_alg - The prf algorithm used (or 0 if not used).
|
|
* conf - The configuration structure.
|
|
* id - The id of the authenticator
|
|
* key - The key that may be used to generate the authentication
|
|
* data.
|
|
* msg - The first message, may be used to generate the data.
|
|
* cert - The certificate that should be used to verify the
|
|
* message in case RSA/DSA signature.
|
|
* auth - The authentication data.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_ISAKMP_AUTHENTICATION_FAILED
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_payload_authentication_verify(
|
|
Ip_u16 prf_alg,
|
|
Ipike_config_auth* conf,
|
|
Ipike2_id* id,
|
|
Ipike_value* key,
|
|
Ipike_value* nonce,
|
|
Ipike_value* msg,
|
|
Ipike_cert* cert,
|
|
Ipike2_auth* auth);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_payload_authentication_verify_eap
|
|
*===========================================================================
|
|
* Description: Verify EAP authentication data generated by the function above.
|
|
* Parameters: shared_key - Buffer with key froam EAP exchange.
|
|
* shared_key_len - Length of shared key buffer.
|
|
* prf_alg - The prf algorithm used (or 0 if not used).
|
|
* id - The id of the authenticator
|
|
* key - The key that may be used to generate the authentication
|
|
* data.
|
|
* msg - The first message, may be used to generate the data.
|
|
* auth - The authentication data.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_ISAKMP_AUTHENTICATION_FAILED
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_payload_authentication_verify_eap(
|
|
Ip_u8* shared_key,
|
|
Ip_u32 shared_key_len,
|
|
Ip_u16 prf_alg,
|
|
Ipike2_id* id,
|
|
Ipike_value* key,
|
|
Ipike_value* nonce,
|
|
Ipike_value* msg,
|
|
Ipike2_auth* auth);
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
|
|
#endif
|
|
|
|
/*
|
|
****************************************************************************
|
|
* END OF FILE
|
|
****************************************************************************
|
|
*/
|