1526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt/* 2526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * IKEv2 definitions 3526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * Copyright (c) 2007, Jouni Malinen <j@w1.fi> 4526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * 5526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * This program is free software; you can redistribute it and/or modify 6526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * it under the terms of the GNU General Public License version 2 as 7526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * published by the Free Software Foundation. 8526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * 9526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * Alternatively, this software may be distributed under the terms of BSD 10526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * license. 11526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * 12526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * See README and COPYING for more details. 13526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt */ 14526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 15526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#ifndef IKEV2_COMMON_H 16526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#define IKEV2_COMMON_H 17526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 18526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt/* 19526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * Nonce length must be at least 16 octets. It must also be at least half the 20526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * key size of the negotiated PRF. 21526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt */ 22526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#define IKEV2_NONCE_MIN_LEN 16 23526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#define IKEV2_NONCE_MAX_LEN 256 24526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 25526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt/* IKE Header - RFC 4306, Sect. 3.1 */ 26526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#ifdef _MSC_VER 27526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#pragma pack(push, 1) 28526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#endif /* _MSC_VER */ 29526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 30526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#define IKEV2_SPI_LEN 8 31526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 32526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtstruct ikev2_hdr { 33526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 i_spi[IKEV2_SPI_LEN]; /* IKE_SA Initiator's SPI */ 34526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 r_spi[IKEV2_SPI_LEN]; /* IKE_SA Responder's SPI */ 35526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 next_payload; 36526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 version; /* MjVer | MnVer */ 37526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 exchange_type; 38526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 flags; 39526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 message_id[4]; 40526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 length[4]; /* total length of HDR + payloads */ 41526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt} STRUCT_PACKED; 42526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 43526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtstruct ikev2_payload_hdr { 44526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 next_payload; 45526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 flags; 46526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 payload_length[2]; /* this payload, including the payload header */ 47526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt} STRUCT_PACKED; 48526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 49526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtstruct ikev2_proposal { 50526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 type; /* 0 (last) or 2 (more) */ 51526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 reserved; 52526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 proposal_length[2]; /* including all transform and attributes */ 53526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 proposal_num; 54526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 protocol_id; /* IKEV2_PROTOCOL_* */ 55526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 spi_size; 56526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 num_transforms; 57526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt /* SPI of spi_size octets */ 58526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt /* Transforms */ 59526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt} STRUCT_PACKED; 60526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 61526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtstruct ikev2_transform { 62526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 type; /* 0 (last) or 3 (more) */ 63526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 reserved; 64526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 transform_length[2]; /* including Header and Attributes */ 65526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 transform_type; 66526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 reserved2; 67526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 transform_id[2]; 68526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt /* Transform Attributes */ 69526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt} STRUCT_PACKED; 70526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 71526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#ifdef _MSC_VER 72526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#pragma pack(pop) 73526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#endif /* _MSC_VER */ 74526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 75526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 76526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt/* Current IKEv2 version from RFC 4306 */ 77526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#define IKEV2_MjVer 2 78526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#define IKEV2_MnVer 0 79526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#ifdef CCNS_PL 80526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#define IKEV2_VERSION ((IKEV2_MjVer) | ((IKEV2_MnVer) << 4)) 81526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#else /* CCNS_PL */ 82526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#define IKEV2_VERSION (((IKEV2_MjVer) << 4) | (IKEV2_MnVer)) 83526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#endif /* CCNS_PL */ 84526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 85526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt/* IKEv2 Exchange Types */ 86526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtenum { 87526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt /* 0-33 RESERVED */ 88526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt IKE_SA_INIT = 34, 89526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt IKE_SA_AUTH = 35, 90526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt CREATE_CHILD_SA = 36, 91526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt INFORMATION = 37 92526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt /* 38-239 RESERVED TO IANA */ 93526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt /* 240-255 Reserved for private use */ 94526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt}; 95526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 96526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt/* IKEv2 Flags */ 97526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#define IKEV2_HDR_INITIATOR 0x08 98526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#define IKEV2_HDR_VERSION 0x10 99526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#define IKEV2_HDR_RESPONSE 0x20 100526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 101526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt/* Payload Header Flags */ 102526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#define IKEV2_PAYLOAD_FLAGS_CRITICAL 0x01 103526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 104526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 105526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt/* EAP-IKEv2 Payload Types (in Next Payload Type field) 106526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * http://www.iana.org/assignments/eap-ikev2-payloads */ 107526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtenum { 108526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt IKEV2_PAYLOAD_NO_NEXT_PAYLOAD = 0, 109526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt IKEV2_PAYLOAD_SA = 33, 110526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt IKEV2_PAYLOAD_KEY_EXCHANGE = 34, 111526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt IKEV2_PAYLOAD_IDi = 35, 112526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt IKEV2_PAYLOAD_IDr = 36, 113526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt IKEV2_PAYLOAD_CERTIFICATE = 37, 114526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt IKEV2_PAYLOAD_CERT_REQ = 38, 115526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt IKEV2_PAYLOAD_AUTHENTICATION = 39, 116526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt IKEV2_PAYLOAD_NONCE = 40, 117526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt IKEV2_PAYLOAD_NOTIFICATION = 41, 118526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt IKEV2_PAYLOAD_VENDOD_ID = 43, 119526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt IKEV2_PAYLOAD_ENCRYPTED = 46, 120526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt IKEV2_PAYLOAD_NEXT_FAST_ID = 121 121526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt}; 122526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 123526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 124526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt/* IKEv2 Proposal - Protocol ID */ 125526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtenum { 126526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt IKEV2_PROTOCOL_RESERVED = 0, 127526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt IKEV2_PROTOCOL_IKE = 1, /* IKE is the only one allowed for EAP-IKEv2 */ 128526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt IKEV2_PROTOCOL_AH = 2, 129526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt IKEV2_PROTOCOL_ESP = 3 130526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt}; 131526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 132526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 133526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt/* IKEv2 Transform Types */ 134526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtenum { 135526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt IKEV2_TRANSFORM_ENCR = 1, 136526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt IKEV2_TRANSFORM_PRF = 2, 137526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt IKEV2_TRANSFORM_INTEG = 3, 138526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt IKEV2_TRANSFORM_DH = 4, 139526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt IKEV2_TRANSFORM_ESN = 5 140526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt}; 141526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 142526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt/* IKEv2 Tranform Type 1 (Encryption Algorithm) */ 143526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtenum { 144526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt ENCR_DES_IV64 = 1, 145526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt ENCR_DES = 2, 146526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt ENCR_3DES = 3, 147526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt ENCR_RC5 = 4, 148526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt ENCR_IDEA = 5, 149526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt ENCR_CAST = 6, 150526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt ENCR_BLOWFISH = 7, 151526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt ENCR_3IDEA = 8, 152526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt ENCR_DES_IV32 = 9, 153526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt ENCR_NULL = 11, 154526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt ENCR_AES_CBC = 12, 155526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt ENCR_AES_CTR = 13 156526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt}; 157526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 158526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt/* IKEv2 Transform Type 2 (Pseudo-random Function) */ 159526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtenum { 160526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt PRF_HMAC_MD5 = 1, 161526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt PRF_HMAC_SHA1 = 2, 162526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt PRF_HMAC_TIGER = 3, 163526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt PRF_AES128_XCBC = 4 164526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt}; 165526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 166526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt/* IKEv2 Transform Type 3 (Integrity Algorithm) */ 167526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtenum { 168526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt AUTH_HMAC_MD5_96 = 1, 169526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt AUTH_HMAC_SHA1_96 = 2, 170526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt AUTH_DES_MAC = 3, 171526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt AUTH_KPDK_MD5 = 4, 172526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt AUTH_AES_XCBC_96 = 5 173526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt}; 174526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 175526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt/* IKEv2 Transform Type 4 (Diffie-Hellman Group) */ 176526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtenum { 177526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt DH_GROUP1_768BIT_MODP = 1, /* RFC 4306 */ 178526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt DH_GROUP2_1024BIT_MODP = 2, /* RFC 4306 */ 179526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt DH_GROUP5_1536BIT_MODP = 5, /* RFC 3526 */ 180526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt DH_GROUP5_2048BIT_MODP = 14, /* RFC 3526 */ 181526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt DH_GROUP5_3072BIT_MODP = 15, /* RFC 3526 */ 182526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt DH_GROUP5_4096BIT_MODP = 16, /* RFC 3526 */ 183526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt DH_GROUP5_6144BIT_MODP = 17, /* RFC 3526 */ 184526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt DH_GROUP5_8192BIT_MODP = 18 /* RFC 3526 */ 185526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt}; 186526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 187526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 188526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt/* Identification Data Types (RFC 4306, Sect. 3.5) */ 189526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtenum { 190526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt ID_IPV4_ADDR = 1, 191526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt ID_FQDN = 2, 192526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt ID_RFC822_ADDR = 3, 193526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt ID_IPV6_ADDR = 5, 194526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt ID_DER_ASN1_DN = 9, 195526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt ID_DER_ASN1_GN= 10, 196526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt ID_KEY_ID = 11 197526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt}; 198526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 199526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 200526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt/* Certificate Encoding (RFC 4306, Sect. 3.6) */ 201526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtenum { 202526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt CERT_ENCODING_PKCS7_X509 = 1, 203526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt CERT_ENCODING_PGP_CERT = 2, 204526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt CERT_ENCODING_DNS_SIGNED_KEY = 3, 205526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt /* X.509 Certificate - Signature: DER encoded X.509 certificate whose 206526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt * public key is used to validate the sender's AUTH payload */ 207526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt CERT_ENCODING_X509_CERT_SIGN = 4, 208526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt CERT_ENCODING_KERBEROS_TOKEN = 6, 209526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt /* DER encoded X.509 certificate revocation list */ 210526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt CERT_ENCODING_CRL = 7, 211526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt CERT_ENCODING_ARL = 8, 212526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt CERT_ENCODING_SPKI_CERT = 9, 213526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt CERT_ENCODING_X509_CERT_ATTR = 10, 214526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt /* PKCS #1 encoded RSA key */ 215526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt CERT_ENCODING_RAW_RSA_KEY = 11, 216526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt CERT_ENCODING_HASH_AND_URL_X509_CERT = 12, 217526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt CERT_ENCODING_HASH_AND_URL_X509_BUNDLE = 13 218526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt}; 219526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 220526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 221526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt/* Authentication Method (RFC 4306, Sect. 3.8) */ 222526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtenum { 223526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt AUTH_RSA_SIGN = 1, 224526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt AUTH_SHARED_KEY_MIC = 2, 225526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt AUTH_DSS_SIGN = 3 226526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt}; 227526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 228526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 229526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt/* Notify Message Types (RFC 4306, Sect. 3.10.1) */ 230526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtenum { 231526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt UNSUPPORTED_CRITICAL_PAYLOAD = 1, 232526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt INVALID_IKE_SPI = 4, 233526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt INVALID_MAJOR_VERSION = 5, 234526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt INVALID_SYNTAX = 7, 235526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt INVALID_MESSAGE_ID = 9, 236526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt INVALID_SPI = 11, 237526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt NO_PROPOSAL_CHOSEN = 14, 238526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt INVALID_KE_PAYLOAD = 17, 239526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt AUTHENTICATION_FAILED = 24, 240526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt SINGLE_PAIR_REQUIRED = 34, 241526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt NO_ADDITIONAL_SAS = 35, 242526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt INTERNAL_ADDRESS_FAILURE = 36, 243526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt FAILED_CP_REQUIRED = 37, 244526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt TS_UNACCEPTABLE = 38, 245526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt INVALID_SELECTORS = 39 246526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt}; 247526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 248526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 249526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtstruct ikev2_keys { 250526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 *SK_d, *SK_ai, *SK_ar, *SK_ei, *SK_er, *SK_pi, *SK_pr; 251526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt size_t SK_d_len, SK_integ_len, SK_encr_len, SK_prf_len; 252526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt}; 253526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 254526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 255526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtint ikev2_keys_set(struct ikev2_keys *keys); 256526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtvoid ikev2_free_keys(struct ikev2_keys *keys); 257526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 258526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 259526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt/* Maximum hash length for supported hash algorithms */ 260526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#define IKEV2_MAX_HASH_LEN 20 261526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 262526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtstruct ikev2_integ_alg { 263526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt int id; 264526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt size_t key_len; 265526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt size_t hash_len; 266526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt}; 267526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 268526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtstruct ikev2_prf_alg { 269526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt int id; 270526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt size_t key_len; 271526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt size_t hash_len; 272526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt}; 273526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 274526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtstruct ikev2_encr_alg { 275526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt int id; 276526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt size_t key_len; 277526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt size_t block_size; 278526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt}; 279526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 280526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtconst struct ikev2_integ_alg * ikev2_get_integ(int id); 281526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtint ikev2_integ_hash(int alg, const u8 *key, size_t key_len, const u8 *data, 282526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt size_t data_len, u8 *hash); 283526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtconst struct ikev2_prf_alg * ikev2_get_prf(int id); 284526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtint ikev2_prf_hash(int alg, const u8 *key, size_t key_len, 285526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt size_t num_elem, const u8 *addr[], const size_t *len, 286526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 *hash); 287526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtint ikev2_prf_plus(int alg, const u8 *key, size_t key_len, 288526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt const u8 *data, size_t data_len, 289526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 *out, size_t out_len); 290526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtconst struct ikev2_encr_alg * ikev2_get_encr(int id); 291526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtint ikev2_encr_encrypt(int alg, const u8 *key, size_t key_len, const u8 *iv, 292526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt const u8 *plain, u8 *crypt, size_t len); 293526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtint ikev2_encr_decrypt(int alg, const u8 *key, size_t key_len, const u8 *iv, 294526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt const u8 *crypt, u8 *plain, size_t len); 295526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 296526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtint ikev2_derive_auth_data(int prf_alg, const struct wpabuf *sign_msg, 297526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt const u8 *ID, size_t ID_len, u8 ID_type, 298526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt struct ikev2_keys *keys, int initiator, 299526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt const u8 *shared_secret, size_t shared_secret_len, 300526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt const u8 *nonce, size_t nonce_len, 301526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt const u8 *key_pad, size_t key_pad_len, 302526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 *auth_data); 303526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 304526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 305526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtstruct ikev2_payloads { 306526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt const u8 *sa; 307526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt size_t sa_len; 308526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt const u8 *ke; 309526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt size_t ke_len; 310526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt const u8 *idi; 311526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt size_t idi_len; 312526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt const u8 *idr; 313526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt size_t idr_len; 314526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt const u8 *cert; 315526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt size_t cert_len; 316526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt const u8 *auth; 317526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt size_t auth_len; 318526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt const u8 *nonce; 319526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt size_t nonce_len; 320526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt const u8 *encrypted; 321526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt size_t encrypted_len; 322526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 encr_next_payload; 323526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt const u8 *notification; 324526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt size_t notification_len; 325526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt}; 326526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 327526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtint ikev2_parse_payloads(struct ikev2_payloads *payloads, 328526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt u8 next_payload, const u8 *pos, const u8 *end); 329526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 330526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtu8 * ikev2_decrypt_payload(int encr_id, int integ_id, struct ikev2_keys *keys, 331526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt int initiator, const struct ikev2_hdr *hdr, 332526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt const u8 *encrypted, size_t encrypted_len, 333526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt size_t *res_len); 334526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtvoid ikev2_update_hdr(struct wpabuf *msg); 335526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtint ikev2_build_encrypted(int encr_id, int integ_id, struct ikev2_keys *keys, 336526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt int initiator, struct wpabuf *msg, 337526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt struct wpabuf *plain, u8 next_payload); 338526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidtint ikev2_derive_sk_keys(const struct ikev2_prf_alg *prf, 339526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt const struct ikev2_integ_alg *integ, 340526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt const struct ikev2_encr_alg *encr, 341526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt const u8 *skeyseed, const u8 *data, size_t data_len, 342526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt struct ikev2_keys *keys); 343526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt 344526fc2a7dc09b4450086cdec313a5c44d36b10fdDmitry Shmidt#endif /* IKEV2_COMMON_H */ 345