| use super::super::*; |
| use crate::err::ip_auth::IcvLenError; |
| use arrayvec::ArrayVec; |
| use core::fmt::{Debug, Formatter}; |
| |
| /// Deprecated use [IpAuthHeader] instead. |
| #[deprecated(since = "0.10.1", note = "Please use the type IpAuthHeader instead")] |
| pub type IPv6AuthenticationHeader = IpAuthHeader; |
| |
| /// Deprecated use [IpAuthHeader] instead. |
| #[deprecated(since = "0.14.0", note = "Please use the type IpAuthHeader instead")] |
| pub type IpAuthenticationHeader = IpAuthHeader; |
| |
| /// IP Authentication Header (rfc4302) |
| #[derive(Clone)] |
| pub struct IpAuthHeader { |
| /// IP protocol number specifying the next header or transport layer protocol. |
| /// |
| /// See [IpNumber] or [ip_number] for a definition of the known values. |
| pub next_header: IpNumber, |
| /// Security Parameters Index |
| pub spi: u32, |
| /// This unsigned 32-bit field contains a counter value that |
| /// increases by one for each packet sent. |
| pub sequence_number: u32, |
| /// Length in 4-octets (maximum valid value is 0xfe) of data filled in the |
| /// `raw_icv_buffer`. |
| raw_icv_len: u8, |
| /// Buffer containing the "Encoded Integrity Check Value-ICV" (variable). |
| /// The length of the used data can be set via the `variable` (must be a multiple of 4 bytes). |
| raw_icv_buffer: [u8; 0xfe * 4], |
| } |
| |
| impl Debug for IpAuthHeader { |
| fn fmt(&self, formatter: &mut Formatter) -> Result<(), core::fmt::Error> { |
| let mut s = formatter.debug_struct("IpAuthHeader"); |
| s.field("next_header", &self.next_header); |
| s.field("spi", &self.spi); |
| s.field("sequence_number", &self.sequence_number); |
| s.field("raw_icv", &self.raw_icv()); |
| s.finish() |
| } |
| } |
| |
| impl PartialEq for IpAuthHeader { |
| fn eq(&self, other: &Self) -> bool { |
| self.next_header == other.next_header |
| && self.spi == other.spi |
| && self.sequence_number == other.sequence_number |
| && self.raw_icv() == other.raw_icv() |
| } |
| } |
| |
| impl Eq for IpAuthHeader {} |
| |
| impl Default for IpAuthHeader { |
| fn default() -> Self { |
| IpAuthHeader { |
| next_header: IpNumber(255), |
| spi: 0, |
| sequence_number: 0, |
| raw_icv_len: 0, |
| raw_icv_buffer: [0; 0xfe * 4], |
| } |
| } |
| } |
| |
| impl<'a> IpAuthHeader { |
| /// Minimum length of an IP authentication header in bytes/octets. |
| pub const MIN_LEN: usize = 4 + 4 + 4; |
| |
| /// Maximum length of an IP authentication header in bytes/octets. |
| /// |
| /// This number is calculated by taking the maximum value |
| /// that the "payload length" field supports (0xff) adding 2 and |
| /// multiplying the sum by 4 as the "payload length" specifies how |
| /// many 4 bytes words are present in the header. |
| pub const MAX_LEN: usize = 4 * (0xff + 2); |
| |
| /// The maximum amount of bytes/octets that can be stored in the ICV |
| /// part of an IP authentication header. |
| pub const MAX_ICV_LEN: usize = 0xfe * 4; |
| |
| /// Create a new authentication header with the given parameters. |
| /// |
| /// Note: The length of the raw_icv slice must be a multiple of 4 |
| /// and the maximum allowed length is 1016 bytes |
| /// (`IpAuthHeader::MAX_ICV_LEN`). If the slice length does |
| /// not fulfill these requirements the value is not copied and an |
| /// [`crate::err::ip_auth::IcvLenError`] is returned. |
| /// If successful an Ok(()) is returned. |
| pub fn new( |
| next_header: IpNumber, |
| spi: u32, |
| sequence_number: u32, |
| raw_icv: &'a [u8], |
| ) -> Result<IpAuthHeader, IcvLenError> { |
| use IcvLenError::*; |
| if raw_icv.len() > IpAuthHeader::MAX_ICV_LEN { |
| Err(TooBig(raw_icv.len())) |
| } else if 0 != raw_icv.len() % 4 { |
| Err(Unaligned(raw_icv.len())) |
| } else { |
| let mut result = IpAuthHeader { |
| next_header, |
| spi, |
| sequence_number, |
| raw_icv_len: (raw_icv.len() / 4) as u8, |
| raw_icv_buffer: [0; IpAuthHeader::MAX_ICV_LEN], |
| }; |
| result.raw_icv_buffer[..raw_icv.len()].copy_from_slice(raw_icv); |
| Ok(result) |
| } |
| } |
| |
| /// Read an authentication header from a slice and return the header & unused parts of the slice. |
| pub fn from_slice( |
| slice: &'a [u8], |
| ) -> Result<(IpAuthHeader, &'a [u8]), err::ip_auth::HeaderSliceError> { |
| let s = IpAuthHeaderSlice::from_slice(slice)?; |
| let rest = &slice[s.slice().len()..]; |
| let header = s.to_header(); |
| Ok((header, rest)) |
| } |
| |
| /// Read an authentication header from the current reader position. |
| #[cfg(feature = "std")] |
| #[cfg_attr(docsrs, doc(cfg(feature = "std")))] |
| pub fn read<T: std::io::Read + Sized>( |
| reader: &mut T, |
| ) -> Result<IpAuthHeader, err::ip_auth::HeaderReadError> { |
| use err::ip_auth::HeaderError::*; |
| use err::ip_auth::HeaderReadError::*; |
| |
| let start = { |
| let mut start = [0; 4 + 4 + 4]; |
| reader.read_exact(&mut start).map_err(Io)?; |
| start |
| }; |
| |
| let next_header = IpNumber(start[0]); |
| let payload_len = start[1]; |
| |
| // payload len must be at least 1 |
| if payload_len < 1 { |
| Err(Content(ZeroPayloadLen)) |
| } else { |
| // read the rest of the header |
| Ok(IpAuthHeader { |
| next_header, |
| spi: u32::from_be_bytes([start[4], start[5], start[6], start[7]]), |
| sequence_number: u32::from_be_bytes([start[8], start[9], start[10], start[11]]), |
| raw_icv_len: payload_len - 1, |
| raw_icv_buffer: { |
| let mut buffer = [0; 0xfe * 4]; |
| reader |
| .read_exact(&mut buffer[..usize::from(payload_len - 1) * 4]) |
| .map_err(Io)?; |
| buffer |
| }, |
| }) |
| } |
| } |
| |
| /// Read an authentication header from the current reader position |
| /// with a limited reader. |
| #[cfg(feature = "std")] |
| #[cfg_attr(docsrs, doc(cfg(feature = "std")))] |
| pub fn read_limited<T: std::io::Read + Sized>( |
| reader: &mut crate::io::LimitedReader<T>, |
| ) -> Result<IpAuthHeader, err::ip_auth::HeaderLimitedReadError> { |
| use err::{ |
| ip_auth::HeaderError::*, |
| ip_auth::HeaderLimitedReadError::{self, *}, |
| Layer, |
| }; |
| |
| fn map_err(err: err::io::LimitedReadError) -> HeaderLimitedReadError { |
| use err::io::LimitedReadError as I; |
| match err { |
| I::Io(err) => Io(err), |
| I::Len(err) => Len(err), |
| } |
| } |
| |
| // notify reader of layer start |
| reader.start_layer(Layer::IpAuthHeader); |
| |
| let start = { |
| let mut start = [0; 4 + 4 + 4]; |
| reader.read_exact(&mut start).map_err(map_err)?; |
| start |
| }; |
| |
| let next_header = IpNumber(start[0]); |
| let payload_len = start[1]; |
| |
| // payload len must be at least 1 |
| if payload_len < 1 { |
| Err(Content(ZeroPayloadLen)) |
| } else { |
| // read the rest of the header |
| Ok(IpAuthHeader { |
| next_header, |
| spi: u32::from_be_bytes([start[4], start[5], start[6], start[7]]), |
| sequence_number: u32::from_be_bytes([start[8], start[9], start[10], start[11]]), |
| raw_icv_len: payload_len - 1, |
| raw_icv_buffer: { |
| let mut buffer = [0; 0xfe * 4]; |
| reader |
| .read_exact(&mut buffer[..usize::from(payload_len - 1) * 4]) |
| .map_err(map_err)?; |
| buffer |
| }, |
| }) |
| } |
| } |
| |
| /// Returns a slice the raw icv value. |
| pub fn raw_icv(&self) -> &[u8] { |
| &self.raw_icv_buffer[..usize::from(self.raw_icv_len) * 4] |
| } |
| |
| /// Sets the icv value to the given raw value. The length of the slice must be |
| /// a multiple of 4 and the maximum allowed length is 1016 bytes |
| /// (`IpAuthHeader::MAX_ICV_LEN`). If the slice length does |
| /// not fulfill these requirements the value is not copied and an |
| /// [`crate::err::ip_auth::IcvLenError`] is returned. |
| /// If successful an Ok(()) is returned. |
| pub fn set_raw_icv(&mut self, raw_icv: &[u8]) -> Result<(), IcvLenError> { |
| use IcvLenError::*; |
| if raw_icv.len() > IpAuthHeader::MAX_ICV_LEN { |
| Err(TooBig(raw_icv.len())) |
| } else if 0 != raw_icv.len() % 4 { |
| Err(Unaligned(raw_icv.len())) |
| } else { |
| self.raw_icv_buffer[..raw_icv.len()].copy_from_slice(raw_icv); |
| self.raw_icv_len = (raw_icv.len() / 4) as u8; |
| Ok(()) |
| } |
| } |
| |
| /// Writes the given authentication header to the current position. |
| #[cfg(feature = "std")] |
| #[cfg_attr(docsrs, doc(cfg(feature = "std")))] |
| pub fn write<T: std::io::Write + Sized>(&self, writer: &mut T) -> Result<(), std::io::Error> { |
| let spi_be = self.spi.to_be_bytes(); |
| let sequence_number_be = self.sequence_number.to_be_bytes(); |
| debug_assert!(self.raw_icv_len != 0xff); |
| |
| writer.write_all(&[ |
| self.next_header.0, |
| self.raw_icv_len + 1, |
| 0, |
| 0, |
| spi_be[0], |
| spi_be[1], |
| spi_be[2], |
| spi_be[3], |
| sequence_number_be[0], |
| sequence_number_be[1], |
| sequence_number_be[2], |
| sequence_number_be[3], |
| ])?; |
| writer.write_all(self.raw_icv())?; |
| Ok(()) |
| } |
| |
| ///Length of the header in bytes. |
| pub fn header_len(&self) -> usize { |
| 12 + usize::from(self.raw_icv_len) * 4 |
| } |
| |
| /// Returns the serialized header. |
| pub fn to_bytes(&self) -> ArrayVec<u8, { IpAuthHeader::MAX_LEN }> { |
| let spi_be = self.spi.to_be_bytes(); |
| let seq_be = self.sequence_number.to_be_bytes(); |
| |
| let mut result = ArrayVec::<u8, { IpAuthHeader::MAX_LEN }>::new(); |
| result.extend([ |
| self.next_header.0, |
| self.raw_icv_len + 1, |
| 0, |
| 0, |
| spi_be[0], |
| spi_be[1], |
| spi_be[2], |
| spi_be[3], |
| seq_be[0], |
| seq_be[1], |
| seq_be[2], |
| seq_be[3], |
| ]); |
| result.extend(self.raw_icv_buffer); |
| // SAFETY: Safe as the header len can not exceed the maximum length |
| // of the header. |
| unsafe { |
| result.set_len(self.header_len()); |
| } |
| |
| result |
| } |
| } |
| |
| #[cfg(test)] |
| mod test { |
| use super::*; |
| use crate::{ |
| err::{Layer, LenError}, |
| io::LimitedReader, |
| test_gens::*, |
| }; |
| use alloc::{format, vec::Vec}; |
| use err::ip_auth::HeaderError::*; |
| use proptest::prelude::*; |
| use std::io::Cursor; |
| |
| #[test] |
| fn default() { |
| let default_header = IpAuthHeader { |
| ..Default::default() |
| }; |
| |
| assert_eq!(default_header.next_header, IpNumber(255)); |
| assert_eq!(default_header.spi, 0); |
| assert_eq!(default_header.sequence_number, 0); |
| assert_eq!(default_header.raw_icv_len, 0); |
| assert_eq!(default_header.raw_icv_buffer, [0; 0xfe * 4]); |
| } |
| |
| proptest! { |
| #[test] |
| fn debug(input in ip_auth_any()) { |
| assert_eq!( |
| &format!( |
| "IpAuthHeader {{ next_header: {:?}, spi: {}, sequence_number: {}, raw_icv: {:?} }}", |
| input.next_header, |
| input.spi, |
| input.sequence_number, |
| input.raw_icv()), |
| &format!("{:?}", input) |
| ); |
| } |
| } |
| |
| #[test] |
| pub fn clone() { |
| let a = IpAuthHeader::new(0.into(), 0, 0, &[0; 4]); |
| assert_eq!(a.clone(), a); |
| } |
| |
| #[test] |
| pub fn partial_eq() { |
| let a = IpAuthHeader::new(0.into(), 0, 0, &[0; 4]); |
| |
| //equal |
| assert!(a == IpAuthHeader::new(0.into(), 0, 0, &[0; 4])); |
| |
| //not equal tests |
| assert!(a != IpAuthHeader::new(1.into(), 0, 0, &[0; 4])); |
| assert!(a != IpAuthHeader::new(0.into(), 1, 0, &[0; 4])); |
| assert!(a != IpAuthHeader::new(0.into(), 0, 1, &[0; 4])); |
| assert!(a != IpAuthHeader::new(0.into(), 0, 0, &[0, 1, 0, 0])); |
| assert!(a != IpAuthHeader::new(0.into(), 0, 1, &[])); |
| assert!(a != IpAuthHeader::new(0.into(), 0, 1, &[0; 8])); |
| } |
| |
| #[test] |
| fn new_and_set_icv() { |
| use IcvLenError::*; |
| |
| struct Test { |
| icv: &'static [u8], |
| err: Option<IcvLenError>, |
| } |
| |
| let tests = [ |
| // ok |
| Test { |
| icv: &[], |
| err: None, |
| }, |
| Test { |
| icv: &[1, 2, 3, 4], |
| err: None, |
| }, |
| Test { |
| icv: &[1, 2, 3, 4, 5, 6, 7, 8], |
| err: None, |
| }, |
| Test { |
| icv: &[1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12], |
| err: None, |
| }, |
| Test { |
| icv: &[0; 0xfe * 4], |
| err: None, |
| }, |
| // unaligned |
| Test { |
| icv: &[1], |
| err: Some(Unaligned(1)), |
| }, |
| Test { |
| icv: &[1, 2, 3], |
| err: Some(Unaligned(3)), |
| }, |
| Test { |
| icv: &[1, 2, 3, 4, 5], |
| err: Some(Unaligned(5)), |
| }, |
| Test { |
| icv: &[1, 2, 3, 4, 5, 6, 7], |
| err: Some(Unaligned(7)), |
| }, |
| // too big |
| Test { |
| icv: &[0; 0xff * 4], |
| err: Some(TooBig(0xff * 4)), |
| }, |
| ]; |
| |
| for test in tests.iter() { |
| // new |
| { |
| let a = IpAuthHeader::new(5.into(), 6, 7, test.icv); |
| if let Some(err) = &test.err { |
| assert_eq!(Err(err.clone()), a); |
| } else { |
| let unwrapped = a.unwrap(); |
| assert_eq!(IpNumber(5), unwrapped.next_header); |
| assert_eq!(6, unwrapped.spi); |
| assert_eq!(7, unwrapped.sequence_number); |
| assert_eq!(test.icv, unwrapped.raw_icv()); |
| } |
| } |
| // set_raw_icv |
| { |
| let mut header = IpAuthHeader::new(5.into(), 6, 7, &[0; 4]).unwrap(); |
| let result = header.set_raw_icv(test.icv); |
| assert_eq!(IpNumber(5), header.next_header); |
| assert_eq!(6, header.spi); |
| assert_eq!(7, header.sequence_number); |
| if let Some(err) = &test.err { |
| assert_eq!(Err(err.clone()), result); |
| assert_eq!(&[0; 4], header.raw_icv()); |
| } else { |
| assert_eq!(Ok(()), result); |
| assert_eq!(test.icv, header.raw_icv()); |
| } |
| } |
| } |
| } |
| |
| proptest! { |
| #[test] |
| fn from_slice(header in ip_auth_any()) { |
| use err::ip_auth::HeaderSliceError::*; |
| |
| // ok |
| { |
| let mut bytes = ArrayVec::<u8, {IpAuthHeader::MAX_LEN + 2}>::new(); |
| bytes.extend(header.to_bytes()); |
| bytes.push(1); |
| bytes.push(2); |
| |
| let (actual_header, actual_slice) = IpAuthHeader::from_slice(&bytes).unwrap(); |
| assert_eq!(header, actual_header); |
| assert_eq!(&[1,2], actual_slice); |
| } |
| |
| // length error |
| { |
| let bytes = header.to_bytes(); |
| for len in 0..header.header_len() { |
| assert_eq!( |
| IpAuthHeader::from_slice(&bytes[..len]).unwrap_err(), |
| Len(err::LenError{ |
| required_len: if len < IpAuthHeader::MIN_LEN { |
| IpAuthHeader::MIN_LEN |
| } else { |
| header.header_len() |
| }, |
| len: len, |
| len_source: LenSource::Slice, |
| layer: err::Layer::IpAuthHeader, |
| layer_start_offset: 0, |
| }) |
| ); |
| } |
| } |
| |
| // payload length error |
| { |
| let mut bytes = header.to_bytes(); |
| // set payload length to 0 |
| bytes[1] = 0; |
| assert_eq!( |
| IpAuthHeader::from_slice(&bytes).unwrap_err(), |
| Content(ZeroPayloadLen) |
| ); |
| } |
| } |
| } |
| |
| proptest! { |
| #[test] |
| fn read(header in ip_auth_any()) { |
| // ok |
| { |
| let bytes = header.to_bytes(); |
| let mut cursor = Cursor::new(&bytes); |
| assert_eq!(header, IpAuthHeader::read(&mut cursor).unwrap()); |
| } |
| |
| // length error |
| { |
| let bytes = header.to_bytes(); |
| for len in 0..header.header_len() { |
| let mut cursor = Cursor::new(&bytes[..len]); |
| assert!( |
| IpAuthHeader::read(&mut cursor) |
| .unwrap_err() |
| .io() |
| .is_some() |
| ); |
| } |
| } |
| |
| // payload length error |
| { |
| let mut bytes = header.to_bytes(); |
| // set payload length to 0 |
| bytes[1] = 0; |
| let mut cursor = Cursor::new(&bytes); |
| assert_eq!( |
| IpAuthHeader::read(&mut cursor).unwrap_err().content(), |
| Some(ZeroPayloadLen) |
| ); |
| } |
| } |
| } |
| |
| proptest! { |
| #[test] |
| fn read_limited(header in ip_auth_any()) { |
| // ok |
| { |
| let bytes = header.to_bytes(); |
| let mut cursor = Cursor::new(&bytes); |
| let mut reader = LimitedReader::new( |
| &mut cursor, |
| bytes.len(), |
| LenSource::Slice, |
| 0, |
| Layer::Ipv4Header |
| ); |
| assert_eq!(header, IpAuthHeader::read_limited(&mut reader).unwrap()); |
| } |
| |
| // length error |
| { |
| let bytes = header.to_bytes(); |
| for len in 0..header.header_len() { |
| // io error |
| { |
| let mut cursor = Cursor::new(&bytes[..len]); |
| let mut reader = LimitedReader::new( |
| &mut cursor, |
| bytes.len(), |
| LenSource::Slice, |
| 0, |
| Layer::Ipv4Header |
| ); |
| assert!( |
| IpAuthHeader::read_limited(&mut reader) |
| .unwrap_err() |
| .io() |
| .is_some() |
| ); |
| } |
| // limited reader error |
| { |
| |
| let mut cursor = Cursor::new(&bytes); |
| let mut reader = LimitedReader::new( |
| &mut cursor, |
| len, |
| LenSource::Ipv4HeaderTotalLen, |
| 0, |
| Layer::Ipv4Header |
| ); |
| assert_eq!( |
| IpAuthHeader::read_limited(&mut reader) |
| .unwrap_err() |
| .len() |
| .unwrap(), |
| LenError { |
| required_len: if len < 12 { |
| 12 |
| } else { |
| bytes.len() |
| }, |
| len, |
| len_source: LenSource::Ipv4HeaderTotalLen, |
| layer: Layer::IpAuthHeader, |
| layer_start_offset: 0 |
| } |
| ); |
| } |
| } |
| } |
| |
| // payload length error |
| { |
| let mut bytes = header.to_bytes(); |
| // set payload length to 0 |
| bytes[1] = 0; |
| let mut cursor = Cursor::new(&bytes); |
| let mut reader = LimitedReader::new( |
| &mut cursor, |
| bytes.len(), |
| LenSource::Ipv4HeaderTotalLen, |
| 0, |
| Layer::Ipv4Header |
| ); |
| assert_eq!( |
| IpAuthHeader::read_limited(&mut reader).unwrap_err().content(), |
| Some(ZeroPayloadLen) |
| ); |
| } |
| } |
| } |
| |
| proptest! { |
| #[test] |
| fn write(header in ip_auth_any()) { |
| |
| // ok case |
| { |
| let mut buffer: Vec<u8> = Vec::with_capacity(header.header_len()); |
| header.write(&mut buffer).unwrap(); |
| assert_eq!(header, IpAuthHeader::from_slice(&buffer).unwrap().0); |
| }; |
| |
| // io error |
| for len in 0..header.header_len() { |
| let mut buffer = [0u8;IpAuthHeader::MAX_LEN]; |
| let mut cursor = Cursor::new(&mut buffer[..len]); |
| assert!(header.write(&mut cursor).is_err()); |
| } |
| } |
| } |
| |
| proptest! { |
| #[test] |
| fn header_len(header in ip_auth_any()) { |
| assert_eq!(header.header_len(), header.raw_icv().len() + 12); |
| } |
| } |
| |
| proptest! { |
| #[test] |
| fn to_bytes(header in ip_auth_any()) { |
| let bytes = header.to_bytes(); |
| |
| assert_eq!(header.next_header.0, bytes[0]); |
| assert_eq!((header.header_len()/4 - 2) as u8, bytes[1]); |
| assert_eq!(0, bytes[2]); |
| assert_eq!(0, bytes[3]); |
| { |
| let spi = u32::from_be_bytes([bytes[4], bytes[5], bytes[6], bytes[7]]); |
| assert_eq!(spi, header.spi); |
| } |
| { |
| let seq_nr = u32::from_be_bytes([bytes[8], bytes[9], bytes[10], bytes[11]]); |
| assert_eq!(seq_nr, header.sequence_number); |
| } |
| assert_eq!(&bytes[12..], header.raw_icv()); |
| } |
| } |
| } |
