Annotation of embedaddon/strongswan/src/libcharon/sa/authenticator.h, revision 1.1.1.1
1.1 misho 1: /*
2: * Copyright (C) 2008-2018 Tobias Brunner
3: * Copyright (C) 2005-2009 Martin Willi
4: * Copyright (C) 2005 Jan Hutter
5: * HSR Hochschule fuer Technik Rapperswil
6: *
7: * This program is free software; you can redistribute it and/or modify it
8: * under the terms of the GNU General Public License as published by the
9: * Free Software Foundation; either version 2 of the License, or (at your
10: * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
11: *
12: * This program is distributed in the hope that it will be useful, but
13: * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
14: * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15: * for more details.
16: */
17:
18: /**
19: * @defgroup authenticator authenticator
20: * @{ @ingroup sa
21: */
22:
23: #ifndef AUTHENTICATOR_H_
24: #define AUTHENTICATOR_H_
25:
26: typedef enum auth_method_t auth_method_t;
27: typedef struct authenticator_t authenticator_t;
28:
29: #include <library.h>
30: #include <credentials/auth_cfg.h>
31: #include <sa/ike_sa.h>
32:
33: /**
34: * Method to use for authentication, as defined in IKEv2.
35: */
36: enum auth_method_t {
37:
38: /**
39: * No authentication used.
40: */
41: AUTH_NONE = 0,
42:
43: /**
44: * Computed as specified in section 2.15 of RFC using
45: * an RSA private key over a PKCS#1 padded hash.
46: */
47: AUTH_RSA = 1,
48:
49: /**
50: * Computed as specified in section 2.15 of RFC using the
51: * shared key associated with the identity in the ID payload
52: * and the negotiated prf function
53: */
54: AUTH_PSK = 2,
55:
56: /**
57: * Computed as specified in section 2.15 of RFC using a
58: * DSS private key over a SHA-1 hash.
59: */
60: AUTH_DSS = 3,
61:
62: /**
63: * ECDSA with SHA-256 on the P-256 curve as specified in RFC 4754
64: */
65: AUTH_ECDSA_256 = 9,
66:
67: /**
68: * ECDSA with SHA-384 on the P-384 curve as specified in RFC 4754
69: */
70: AUTH_ECDSA_384 = 10,
71:
72: /**
73: * ECDSA with SHA-512 on the P-521 curve as specified in RFC 4754
74: */
75: AUTH_ECDSA_521 = 11,
76:
77: /**
78: * Generic Secure Password Authentication Method as specified in RFC 6467
79: */
80: AUTH_GSPM = 12,
81:
82: /**
83: * NULL Authentication Method as specified in draft-ietf-ipsecme-ikev2-null-auth
84: */
85: AUTH_NULL = 13,
86:
87: /**
88: * Digital Signature as specified in RFC 7427
89: */
90: AUTH_DS = 14,
91:
92: /**
93: * IKEv1 initiator XAUTH with PSK, outside of IANA range
94: */
95: AUTH_XAUTH_INIT_PSK = 256,
96:
97: /**
98: * IKEv1 responder XAUTH with PSK, outside of IANA range
99: */
100: AUTH_XAUTH_RESP_PSK,
101:
102: /**
103: * IKEv1 initiator XAUTH with RSA, outside of IANA range
104: */
105: AUTH_XAUTH_INIT_RSA,
106:
107: /**
108: * IKEv1 responder XAUTH with RSA, outside of IANA range
109: */
110: AUTH_XAUTH_RESP_RSA,
111:
112: /**
113: * IKEv1 initiator XAUTH, responder RSA, outside of IANA range
114: */
115: AUTH_HYBRID_INIT_RSA,
116:
117: /**
118: * IKEv1 responder XAUTH, initiator RSA, outside of IANA range
119: */
120: AUTH_HYBRID_RESP_RSA,
121: };
122:
123: /**
124: * enum names for auth_method_t.
125: */
126: extern enum_name_t *auth_method_names;
127:
128: /**
129: * Authenticator interface implemented by the various authenticators.
130: *
131: * An authenticator implementation handles AUTH and EAP payloads. Received
132: * messages are passed to the process() method, to send authentication data
133: * the message is passed to the build() method.
134: */
135: struct authenticator_t {
136:
137: /**
138: * Process an incoming message using the authenticator.
139: *
140: * @param message message containing authentication payloads
141: * @return
142: * - SUCCESS if authentication successful
143: * - FAILED if authentication failed
144: * - NEED_MORE if another exchange required
145: */
146: status_t (*process)(authenticator_t *this, message_t *message);
147:
148: /**
149: * Attach authentication data to an outgoing message.
150: *
151: * @param message message to add authentication data to
152: * @return
153: * - SUCCESS if authentication successful
154: * - FAILED if authentication failed
155: * - NEED_MORE if another exchange required
156: */
157: status_t (*build)(authenticator_t *this, message_t *message);
158:
159: /**
160: * Optional method to set a Postquantum Preshared Key (PPK) to be used
161: * during authentication.
162: *
163: * Has to be called before the final call to process()/build().
164: *
165: * @param ppk PPK to use
166: * @param no_ppk_auth whether to add a NO_PPK_AUTH notify in build()
167: */
168: void (*use_ppk)(authenticator_t *this, chunk_t ppk, bool no_ppk_auth);
169:
170: /**
171: * Check if the authenticator is capable of mutual authentication.
172: *
173: * Some authenticator authenticate both peers, e.g. EAP. To support
174: * mutual authentication with only a single authenticator (EAP-only
175: * authentication), it must be mutual. This method is invoked in ike_auth
176: * to check if the given authenticator is capable of doing so.
177: */
178: bool (*is_mutual)(authenticator_t *this);
179:
180: /**
181: * Destroy authenticator instance.
182: */
183: void (*destroy) (authenticator_t *this);
184: };
185:
186: /**
187: * Create an IKEv2 authenticator to build signatures.
188: *
189: * @param ike_sa associated ike_sa
190: * @param cfg authentication configuration
191: * @param received_nonce nonce received in IKE_SA_INIT
192: * @param sent_nonce nonce sent in IKE_SA_INIT
193: * @param received_init received IKE_SA_INIT message data
194: * @param sent_init sent IKE_SA_INIT message data
195: * @param reserved reserved bytes of the ID payload
196: * @return authenticator, NULL if not supported
197: */
198: authenticator_t *authenticator_create_builder(
199: ike_sa_t *ike_sa, auth_cfg_t *cfg,
200: chunk_t received_nonce, chunk_t sent_nonce,
201: chunk_t received_init, chunk_t sent_init,
202: char reserved[3]);
203:
204: /**
205: * Create an IKEv2 authenticator to verify signatures.
206: *
207: * @param ike_sa associated ike_sa
208: * @param message message containing authentication data
209: * @param received_nonce nonce received in IKE_SA_INIT
210: * @param sent_nonce nonce sent in IKE_SA_INIT
211: * @param received_init received IKE_SA_INIT message data
212: * @param sent_init sent IKE_SA_INIT message data
213: * @param reserved reserved bytes of the ID payload
214: * @return authenticator, NULL if not supported
215: */
216: authenticator_t *authenticator_create_verifier(
217: ike_sa_t *ike_sa, message_t *message,
218: chunk_t received_nonce, chunk_t sent_nonce,
219: chunk_t received_init, chunk_t sent_init,
220: char reserved[3]);
221:
222: /**
223: * Create an IKEv1 authenticator to build and verify signatures or hash
224: * payloads.
225: *
226: * @note Due to the fixed ID, these authenticators can only be used in one
227: * direction at a time.
228: *
229: * @param ike_sa associated IKE_SA
230: * @param initiator TRUE if we are the IKE_SA initiator
231: * @param auth_method negotiated authentication method to use
232: * @param dh diffie hellman key exchange
233: * @param dh_value others public diffie hellman value
234: * @param sa_payload generated SA payload data, without payload header
235: * @param id_payload encoded ID payload of peer to authenticate or verify
236: * without payload header (gets owned)
237: * @return authenticator, NULL if not supported
238: */
239: authenticator_t *authenticator_create_v1(ike_sa_t *ike_sa, bool initiator,
240: auth_method_t auth_method, diffie_hellman_t *dh,
241: chunk_t dh_value, chunk_t sa_payload,
242: chunk_t id_payload);
243:
244: #endif /** AUTHENTICATOR_H_ @}*/
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to authenticator.h CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / src / libcharon / sa