Commit b5acb19b authored by schmitting's avatar schmitting
Browse files

ESP and AH key calculations added, SA contains ENCR and INTEGR keys now for initiator and responder

parent ecc7eaaa

ttcn3/EtsiLibrary/LibIpv6/LibCommonRfcs/LibIpv6_CommonRfcs_Functions.ttcn

+32 −49
Original line number Diff line number Diff line
@@ -739,57 +739,28 @@ group ipSecFns { 


		//TODO v_ahIntegrBlockSize

		

		// SAD-OUT

		vc_sad[c_saOut] := {

			spi := PX_SPI/*f_createSpi()*/,

			seqNr := c_uInt32Zero,

			// AH Integrity

			ahIntegrityAlgo := PX_INTEGRITY_ALGO,

			ahIntegrityKey := PX_INTEGRITY_KEY/*f_createSecretKey()*/,

			ahIntegrKeyLen := omit,

			ahIcvLen := f_getIcvLen(PX_INTEGRITY_ALGO),

			ahIcvPadLen := f_getIcvPadLen(PX_INTEGRITY_ALGO),

			// ESP encryption

			espEncryptionAlgo := PX_ENCRYPTION_ALGO,

			espEncryptionKey := PX_ESP_ENCR_KEY/*f_createSecretKey()*/,

			espEncrKeyLen := omit,

			espIv := v_espIv,

			espEncrBlockSize := v_espEncrBlockSize,

			// ESP integrity

			espIntegrityAlgo := PX_INTEGRITY_ALGO,

			espIntegrityKey := PX_INTEGRITY_KEY/*f_createSecretKey()*/,

			espIntegrKeyLen := omit,

			espIntegrBlockSize := v_espIntegrBlockSize,

			espIcvLen := f_getIcvLen(PX_INTEGRITY_ALGO),

			// Combined mode

			//espCombinedModeAlgo := PX_COMBINED_MODE_ALGO,

			//espCombinedModeKey := PX_COMBINED_MODE_KEY/*f_createSecretKey()*/,

			// Protocol mode

			ipSecProtocolMode := PX_IP_SEC_PROTOCOL_MODE,

			extentedSequenceNumbers := e_extentedSequenceNumbersNo,

			tsInitiator := omit,

			tsResponder := omit

		}



		// SAD-IN

		vc_sad[c_saIn] := {

		// SAD for ESP and AH Tests

		vc_sad[0] := {

			spi := PX_SPI/*f_createSpi()*/,

			seqNr := c_uInt32Zero,

			// AH Integrity

			ahIntegrityAlgo := PX_INTEGRITY_ALGO,

			ahIntegrityKey := PX_INTEGRITY_KEY/*f_createSecretKey()*/,

			ahIntegrityKeyInitiator := PX_INTEGRITY_KEY,

			ahIntegrityKeyResponder := PX_INTEGRITY_KEY,

			ahIntegrKeyLen := omit,

			ahIcvLen := f_getIcvLen(PX_INTEGRITY_ALGO),

			ahIcvPadLen := f_getIcvPadLen(PX_INTEGRITY_ALGO),

			// ESP encryption

			espEncryptionAlgo := PX_ENCRYPTION_ALGO,

			espEncryptionKey := PX_ESP_ENCR_KEY/*f_createSecretKey()*/,

			espEncryptionKeyInitiator := PX_ESP_ENCR_KEY,

			espEncryptionKeyResponder := PX_ESP_ENCR_KEY,

			espEncrKeyLen := omit,

			espIv := v_espIv,

			espEncrBlockSize := v_espEncrBlockSize,

			// ESP integrity

			espIntegrityAlgo := PX_INTEGRITY_ALGO,

			espIntegrityKey := PX_INTEGRITY_KEY/*f_createSecretKey()*/,

			espIntegrityKeyInitiator := PX_INTEGRITY_KEY,

			espIntegrityKeyResponder := PX_INTEGRITY_KEY,

			espIntegrKeyLen := omit,

			espIntegrBlockSize := v_espIntegrBlockSize,

			espIcvLen := f_getIcvLen(PX_INTEGRITY_ALGO),
@@ -809,19 +780,22 @@ group ipSecFns { 
			seqNr := c_uInt32Zero,

			// AH Integrity

			ahIntegrityAlgo := PX_INTEGRITY_ALGO,

			ahIntegrityKey := PX_INTEGRITY_KEY/*f_createSecretKey()*/,

			ahIntegrityKeyInitiator := PX_INTEGRITY_KEY/*f_createSecretKey()*/,

			ahIntegrityKeyResponder := PX_INTEGRITY_KEY/*f_createSecretKey()*/,

			ahIntegrKeyLen := omit,

			ahIcvLen := f_getIcvLen(PX_INTEGRITY_ALGO),

			ahIcvPadLen := f_getIcvPadLen(PX_INTEGRITY_ALGO),

			// ESP encryption

			espEncryptionAlgo := PX_ENCRYPTION_ALGO,

			espEncryptionKey := PX_ESP_ENCR_KEY/*f_createSecretKey()*/,

			espEncryptionKeyInitiator := PX_ESP_ENCR_KEY/*f_createSecretKey()*/,

			espEncryptionKeyResponder := PX_ESP_ENCR_KEY/*f_createSecretKey()*/,

			espEncrKeyLen := omit,

			espIv := v_espIv,

			espEncrBlockSize := v_espEncrBlockSize,

			// ESP integrity

			espIntegrityAlgo := PX_INTEGRITY_ALGO,

			espIntegrityKey := PX_INTEGRITY_KEY/*f_createSecretKey()*/,

			espIntegrityKeyInitiator := PX_INTEGRITY_KEY/*f_createSecretKey()*/,

			espIntegrityKeyResponder := PX_INTEGRITY_KEY/*f_createSecretKey()*/,

			espIntegrKeyLen := omit,

			espIntegrBlockSize := v_espIntegrBlockSize,

			espIcvLen := f_getIcvLen(PX_INTEGRITY_ALGO),
@@ -841,19 +815,22 @@ group ipSecFns { 
			seqNr := c_uInt32Zero,

			// AH Integrity

			ahIntegrityAlgo := PX_INTEGRITY_ALGO,

			ahIntegrityKey := PX_INTEGRITY_KEY/*f_createSecretKey()*/,

			ahIntegrityKeyInitiator := PX_INTEGRITY_KEY/*f_createSecretKey()*/,

			ahIntegrityKeyResponder := PX_INTEGRITY_KEY/*f_createSecretKey()*/,

			ahIntegrKeyLen := omit,

			ahIcvLen := f_getIcvLen(PX_INTEGRITY_ALGO),

			ahIcvPadLen := f_getIcvPadLen(PX_INTEGRITY_ALGO),

			// ESP encryption

			espEncryptionAlgo := PX_ENCRYPTION_ALGO,

			espEncryptionKey := PX_ESP_ENCR_KEY/*f_createSecretKey()*/,

			espEncryptionKeyInitiator := PX_ESP_ENCR_KEY/*f_createSecretKey()*/,

			espEncryptionKeyResponder := PX_ESP_ENCR_KEY/*f_createSecretKey()*/,

			espEncrKeyLen := omit,

			espIv := v_espIv,

			espEncrBlockSize := v_espEncrBlockSize,

			// ESP integrity

			espIntegrityAlgo := PX_INTEGRITY_ALGO,

			espIntegrityKey := PX_INTEGRITY_KEY/*f_createSecretKey()*/,

			espIntegrityKeyInitiator := PX_INTEGRITY_KEY/*f_createSecretKey()*/,

			espIntegrityKeyResponder := PX_INTEGRITY_KEY/*f_createSecretKey()*/,

			espIntegrKeyLen := omit,

			espIntegrBlockSize := v_espIntegrBlockSize,

			espIcvLen := f_getIcvLen(PX_INTEGRITY_ALGO),
@@ -873,19 +850,22 @@ group ipSecFns { 
			seqNr := c_uInt32Zero,

			// AH Integrity

			ahIntegrityAlgo := PX_INTEGRITY_ALGO,

			ahIntegrityKey := PX_INTEGRITY_KEY/*f_createSecretKey()*/,

			ahIntegrityKeyInitiator := PX_INTEGRITY_KEY/*f_createSecretKey()*/,

			ahIntegrityKeyResponder := PX_INTEGRITY_KEY/*f_createSecretKey()*/,

			ahIntegrKeyLen := omit,

			ahIcvLen := f_getIcvLen(PX_INTEGRITY_ALGO),

			ahIcvPadLen := f_getIcvPadLen(PX_INTEGRITY_ALGO),

			// ESP encryption

			espEncryptionAlgo := PX_ENCRYPTION_ALGO,

			espEncryptionKey := PX_ESP_ENCR_KEY/*f_createSecretKey()*/,

			espEncryptionKeyInitiator := PX_ESP_ENCR_KEY/*f_createSecretKey()*/,

			espEncryptionKeyResponder := PX_ESP_ENCR_KEY/*f_createSecretKey()*/,

			espEncrKeyLen := omit,

			espIv := v_espIv,

			espEncrBlockSize := v_espEncrBlockSize,

			// ESP integrity

			espIntegrityAlgo := PX_INTEGRITY_ALGO,

			espIntegrityKey := PX_INTEGRITY_KEY/*f_createSecretKey()*/,

			espIntegrityKeyInitiator := PX_INTEGRITY_KEY/*f_createSecretKey()*/,

			espIntegrityKeyResponder := PX_INTEGRITY_KEY/*f_createSecretKey()*/,

			espIntegrKeyLen := omit,

			espIntegrBlockSize := v_espIntegrBlockSize,

			espIcvLen := f_getIcvLen(PX_INTEGRITY_ALGO),
@@ -905,19 +885,22 @@ group ipSecFns { 
			seqNr := c_uInt32Zero,

			// AH Integrity

			ahIntegrityAlgo := PX_INTEGRITY_ALGO,

			ahIntegrityKey := PX_INTEGRITY_KEY/*f_createSecretKey()*/,

			ahIntegrityKeyInitiator := PX_INTEGRITY_KEY/*f_createSecretKey()*/,

			ahIntegrityKeyResponder := PX_INTEGRITY_KEY/*f_createSecretKey()*/,

			ahIntegrKeyLen := omit,

			ahIcvLen := f_getIcvLen(PX_INTEGRITY_ALGO),

			ahIcvPadLen := f_getIcvPadLen(PX_INTEGRITY_ALGO),

			// ESP encryption

			espEncryptionAlgo := PX_ENCRYPTION_ALGO,

			espEncryptionKey := PX_ESP_ENCR_KEY/*f_createSecretKey()*/,

			espEncryptionKeyInitiator := PX_ESP_ENCR_KEY/*f_createSecretKey()*/,

			espEncryptionKeyResponder := PX_ESP_ENCR_KEY/*f_createSecretKey()*/,

			espEncrKeyLen := omit,

			espIv := v_espIv,

			espEncrBlockSize := v_espEncrBlockSize,

			// ESP integrity

			espIntegrityAlgo := PX_INTEGRITY_ALGO,

			espIntegrityKey := PX_INTEGRITY_KEY/*f_createSecretKey()*/,

			espIntegrityKeyInitiator := PX_INTEGRITY_KEY/*f_createSecretKey()*/,

			espIntegrityKeyResponder := PX_INTEGRITY_KEY/*f_createSecretKey()*/,

			espIntegrKeyLen := omit,

			espIntegrBlockSize := v_espIntegrBlockSize,

			espIcvLen := f_getIcvLen(PX_INTEGRITY_ALGO),

ttcn3/EtsiLibrary/LibIpv6/LibCommonRfcs/LibIpv6_ExternalFunctions.ttcn

+24 −1
Original line number Diff line number Diff line
@@ -158,7 +158,7 @@ 
  	 *			SK_pi = prf (p_first, SK_er | p_second | 0x06)

  	 *			SK_pr = prf (p_first, SK_pi | p_second | 0x07)

	 *			The key lenghts of Encryption Key, Integrity Key and PRF Key must be set in IkeSa before fx_pseudoRandomPlus is called.

	 * @param   p_prf negotiated PseudoRandomFunction

	 * @param   p_ikeSa containing negotiated PseudoRandomFunction

	 *			choice is:

	 *			e_prfHmacMd5(1),

	 *			e_prfHmacSha1(2),
@@ -172,6 +172,29 @@ 
									   	   in octetstring p_second ) 

	return SevenSecrets;

	

	/* @desc	This external function implements the negotiated

	 *         	pseudo random function and calcutes pseudo random value

	 *			based on the two input strings.

	 * @param   p_prf negotiated PseudoRandomFunction

	 *			choice is:

	 *			e_prfHmacMd5(1),

	 *			e_prfHmacSha1(2),

	 *			e_prfHmacTiger(3),

	 *			e_prfAes128Xcbc(4)

	 * @param   p_first, p_second input values to pseudo random function

	 * @param   p_EncIntKeys input/output value carries a record of 

	 *          encryption and integrity key lengths and key values

	 *          Input value contains only the key lengths, 

	 *          length values set to 0 indicate that no correspondent keys need to be calculated.

	 *          Output value contains key values taken from KEYMAT

	 *          according to the rules of RFC4306, clause 2.17.

	*/

	external function fx_calculateKEYMATandDistribute ( in PseudoRandomFunction p_prf,

									   in octetstring p_first,

									   in octetstring p_second,

									   inout EncIntKeys p_encIntKeys) 

	return FncRetCode;



	/* @desc	This external function implements the Diffie-Hellman procedure

	 *         	and calculates the key for the Key Exchange payload to be sent to the 

	 *			peer based on the private key and the number of the Diffie-Hellman group.

ttcn3/EtsiLibrary/LibIpv6/LibCommonRfcs/LibIpv6_Interface_Functions.ttcn

+2 −1
Original line number Diff line number Diff line
@@ -300,7 +300,8 @@ group rfc2460Root_Functions { 
				v_tempIpv6Packet.ipv6Hdr.hopLimit := 0;

				

				// Compute ICV

				v_activeIpv6Packet.extHdrList[v_authHdrIndex].authHeader.icv := fx_mac( vc_sad[v_spi].ahIntegrityAlgo , vc_sad[v_spi].ahIntegrityKey, fx_encodeMessage(v_tempIpv6Packet));

				// !!!!! PS: changed ahIntegrityKey to ahIntegrityKeyInitiator, CHECK !!!!!

				v_activeIpv6Packet.extHdrList[v_authHdrIndex].authHeader.icv := fx_mac( vc_sad[v_spi].ahIntegrityAlgo , vc_sad[v_spi].ahIntegrityKeyInitiator, fx_encodeMessage(v_tempIpv6Packet));

			}					

		}

ttcn3/EtsiLibrary/LibIpv6/LibSec/LibIpv6_Rfc4306Ikev2_Functions.ttcn

+137 −82

File changed.

Preview size limit exceeded, changes collapsed.

ttcn3/EtsiLibrary/LibIpv6/LibSec/LibIpv6_Rfc4306Ikev2_TypesAndValues.ttcn

+19 −6
Original line number Diff line number Diff line
@@ -1023,8 +1023,8 @@ 
		}

		

		const UInt8 c_maxNrDa := 8;

		const UInt8 c_saOut := 0;

		const UInt8 c_saIn := 1;

		const UInt8 c_saOut := 1;

		const UInt8 c_saIn := 2;

		const UInt8 c_saRrpOut := 2;

		const UInt8 c_saRrpIn := 3; 

		const UInt8 c_saCnOut := 4;
@@ -1036,17 +1036,20 @@ 
			UInt32 spi,

			UInt32 seqNr,

			IntegrityAlgo ahIntegrityAlgo,

			octetstring	ahIntegrityKey,

			octetstring	ahIntegrityKeyInitiator,

			octetstring	ahIntegrityKeyResponder,

			UInt16 ahIntegrKeyLen optional,

			UInt8 ahIcvLen,

			UInt ahIcvPadLen,

			EncryptionAlgo espEncryptionAlgo,

			octetstring	espEncryptionKey,

			octetstring	espEncryptionKeyInitiator,

			octetstring	espEncryptionKeyResponder,

			UInt16 espEncrKeyLen optional,

			octetstring espIv optional,

			UInt8 espEncrBlockSize,

			IntegrityAlgo espIntegrityAlgo optional,

			octetstring	espIntegrityKey,

			octetstring	espIntegrityKeyInitiator,

			octetstring	espIntegrityKeyResponder,

			UInt16 espIntegrKeyLen optional,

			UInt8 espIntegrBlockSize,

			UInt8 espIcvLen,
@@ -1071,7 +1074,17 @@ 
			octetstring 	tfcPadding optional

		}





		/* 

		* @desc Type to store encryption and integrity key lengths and key values

		*/

		type record EncIntKeys {

			UInt16	    encKeyLength,

			UInt16	    intKeyLength,

			octetstring encKeyInitiator,

			octetstring intKeyInitiator,

			octetstring encKeyResponder,

			octetstring intKeyResponder

		}



	group ikeSecurity

	{