node-ikev2 0.1.0

package/lib/src/header.js

@@ -0,0 +1,307 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Header = exports.exchangeType = void 0;
+const payload_1 = require("./payload");
+/**
+ * IKEv2 Message Header
+ *                        1                   2                   3
+       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+      !                       IKE_SA Initiator's SPI                  !
+      !                          (8 Octets)                           !
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+      !                       IKE_SA Responder's SPI                  !
+      !                          (8 Octets)                           !
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+      !  Next Payload(1)! MjVer ! MnVer ! Exchange Type(1) ! Flags(1) !
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+      !                          Message ID (4 Octets)                !
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+      !                            Length (4 Octets)                  !
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+                        RFC 4306:  IKE Header Format
+*/
+/**
+ * IKEv2 Exchange Types: \
+ * IKE_SA_INIT = 34 \
+ * IKE_AUTH = 35 \
+ * CREATE_CHILD_SA = 36 \
+ * INFORMATIONAL = 37
+ */
+var exchangeType;
+(function (exchangeType) {
+    exchangeType[exchangeType["IKE_SA_INIT"] = 34] = "IKE_SA_INIT";
+    exchangeType[exchangeType["IKE_AUTH"] = 35] = "IKE_AUTH";
+    exchangeType[exchangeType["CREATE_CHILD_SA"] = 36] = "CREATE_CHILD_SA";
+    exchangeType[exchangeType["INFORMATIONAL"] = 37] = "INFORMATIONAL";
+})(exchangeType || (exports.exchangeType = exchangeType = {}));
+/**
+ * IKEv2 Message Header
+ * @class
+ * @property {Buffer} initiatorSPI - 8 bytes
+ * @property {Buffer} responderSPI - 8 bytes
+ * @property {payloadType} nextPayload - 1 byte
+ * @property {number} majorVersion - 4 bits
+ * @property {number} minorVersion - 4 bits
+ * @property {exchangeType} exchangeType - 1 byte
+ * @property {boolean} isInitiator - 1 bit (flags)
+ * @property {boolean} canUseHigherVersion - 1 bit (flags)
+ * @property {boolean} isResponse - 1 bit (flags)
+ * @property {number} messageID - 4 bytes
+ * @property {number} length - 4 bytes
+ */
+class Header {
+    constructor(initiatorSPI, responderSPI, nextPayload, majorVersion, minorVersion, exchangeType, isInitiator, canUseHigherVersion, isResponse, messageID, length = 0 // if left as 0, it will be calculated during serialization
+    ) {
+        this.initiatorSPI = initiatorSPI;
+        this.responderSPI = responderSPI;
+        this.nextPayload = nextPayload;
+        this.majorVersion = majorVersion;
+        this.minorVersion = minorVersion;
+        this.exchangeType = exchangeType;
+        this.isInitiator = isInitiator;
+        this.canUseHigherVersion = canUseHigherVersion;
+        this.isResponse = isResponse;
+        this.messageID = messageID;
+        this.length = length;
+        // Validate SPI buffers
+        if (!Buffer.isBuffer(initiatorSPI) || initiatorSPI.length !== 8) {
+            throw new Error("Initiator SPI must be an 8-byte Buffer");
+        }
+        if (!Buffer.isBuffer(responderSPI) || responderSPI.length !== 8) {
+            throw new Error("Responder SPI must be an 8-byte Buffer");
+        }
+        // Validate version numbers (4-bit each)
+        if (majorVersion < 0 || majorVersion > 15) {
+            throw new Error(`Major version must be between 0 and 15, got ${majorVersion}`);
+        }
+        if (minorVersion < 0 || minorVersion > 15) {
+            throw new Error(`Minor version must be between 0 and 15, got ${minorVersion}`);
+        }
+        // Validate messageID (32-bit unsigned integer)
+        if (!Number.isInteger(messageID) ||
+            messageID < 0 ||
+            messageID > 0xffffffff) {
+            throw new Error(`Message ID must be a 32-bit unsigned integer (0-4294967295), got ${messageID}`);
+        }
+        // Validate length (32-bit unsigned integer)
+        if (!Number.isInteger(length) || length < 0 || length > 0xffffffff) {
+            throw new Error(`Length must be a 32-bit unsigned integer (0-4294967295), got ${length}`);
+        }
+        // Validate minimum length
+        if (length < Header.headerLength && length !== 0) {
+            throw new Error(`Length must be at least ${Header.headerLength} bytes, got ${length}`);
+        }
+    }
+    /**
+     * Parses IKEv2 message header
+     * @param buffer
+     * @public
+     * @static
+     * @returns {Header}
+     */
+    static parse(buffer) {
+        if (!Buffer.isBuffer(buffer)) {
+            throw new Error("Input must be a Buffer");
+        }
+        if (buffer.length < Header.headerLength) {
+            throw new Error(`Buffer is too short to contain a valid IKEv2 message header. Expected at least ${Header.headerLength} bytes, got ${buffer.length}`);
+        }
+        try {
+            let offset = 0;
+            // Validate we have enough data for each field before accessing
+            if (offset + 8 > buffer.length) {
+                throw new Error("Buffer too short for initiator SPI");
+            }
+            const initiatorSPI = buffer.subarray(offset, offset + 8);
+            offset += 8;
+            if (offset + 8 > buffer.length) {
+                throw new Error("Buffer too short for responder SPI");
+            }
+            const responderSPI = buffer.subarray(offset, offset + 8);
+            offset += 8;
+            if (offset + 1 > buffer.length) {
+                throw new Error("Buffer too short for next payload");
+            }
+            const nextPayloadByte = buffer.readUInt8(offset);
+            const nextPayload = nextPayloadByte;
+            offset += 1;
+            if (offset + 1 > buffer.length) {
+                throw new Error("Buffer too short for version");
+            }
+            const majorVersion = buffer.readUInt8(offset) >> 4;
+            const minorVersion = buffer.readUInt8(offset) & 0x0f;
+            offset += 1;
+            if (offset + 1 > buffer.length) {
+                throw new Error("Buffer too short for exchange type");
+            }
+            const exchangeTypeByte = buffer.readUInt8(offset);
+            const exchangeTypePayload = exchangeTypeByte;
+            offset += 1;
+            if (offset + 1 > buffer.length) {
+                throw new Error("Buffer too short for flags");
+            }
+            const flags = buffer.readUInt8(offset);
+            const isInitiator = Boolean(flags & 0x08);
+            const canUseHigherVersion = Boolean(flags & 0x10);
+            const isResponse = Boolean(flags & 0x20);
+            offset += 1;
+            if (offset + 4 > buffer.length) {
+                throw new Error("Buffer too short for message ID");
+            }
+            const messageID = buffer.readUInt32BE(offset);
+            offset += 4;
+            if (offset + 4 > buffer.length) {
+                throw new Error("Buffer too short for length");
+            }
+            const length = buffer.readUInt32BE(offset);
+            offset += 4;
+            return new Header(initiatorSPI, responderSPI, nextPayload, majorVersion, minorVersion, exchangeTypePayload, isInitiator, canUseHigherVersion, isResponse, messageID, length);
+        }
+        catch (error) {
+            if (error instanceof Error) {
+                throw new Error(`Failed to parse message header: ${error.message}`);
+            }
+            throw new Error("Failed to parse message header: Unknown error");
+        }
+    }
+    /**
+     * Serializes JSON to IKEv2 message header
+     * @param json object
+     * @public
+     * @static
+     * @returns {Buffer}
+     */
+    static serializeJSON(json) {
+        var _a;
+        try {
+            // Input validation
+            if (!json) {
+                throw new Error("JSON data is required");
+            }
+            // Validate required fields
+            if (!json.initiatorSPI || !json.responderSPI) {
+                throw new Error("Both initiatorSPI and responderSPI are required");
+            }
+            if (typeof json.nextPayload === "undefined") {
+                throw new Error("nextPayload is required");
+            }
+            if (typeof json.exchangeType === "undefined") {
+                throw new Error("exchangeType is required");
+            }
+            if (typeof json.messageID === "undefined") {
+                throw new Error("messageID is required");
+            }
+            if (typeof json.length === "undefined") {
+                throw new Error("length is required");
+            }
+            // Validate flags object
+            if (!json.flags || typeof json.flags !== "object") {
+                throw new Error("flags object is required");
+            }
+            const version = (_a = json.version) === null || _a === void 0 ? void 0 : _a.split(".");
+            const header = new Header(Buffer.from(json.initiatorSPI, "hex"), Buffer.from(json.responderSPI, "hex"), json.nextPayload, version ? parseInt(version[0], 10) : json.majorVersion, version ? parseInt(version[1], 10) : json.minorVersion, json.exchangeType, json.flags.isInitiator, json.flags.useHigherVersion, json.flags.isResponse, json.messageID, json.length);
+            return header.serialize();
+        }
+        catch (error) {
+            if (error instanceof Error) {
+                throw new Error(`Failed to serialize header: ${error.message}`);
+            }
+            throw new Error("Failed to serialize header: Unknown error");
+        }
+    }
+    /**
+     * Serializes IKEv2 message header
+     * @public
+     * @returns {Buffer}
+     */
+    serialize() {
+        const buffer = Buffer.alloc(28);
+        let offset = 0;
+        // write initiator SPI
+        this.initiatorSPI.copy(buffer, offset);
+        offset += 8;
+        // write responder SPI
+        this.responderSPI.copy(buffer, offset);
+        offset += 8;
+        // Write nextPayload (1 byte)
+        buffer.writeUInt8(this.nextPayload, offset);
+        offset += 1;
+        // Write majorVersion and minorVersion (4 bits each, combined into 1 byte)
+        buffer.writeUInt8((this.majorVersion << 4) | (this.minorVersion & 0x0f), offset);
+        offset += 1;
+        // Write exchangeType (1 byte)
+        buffer.writeUInt8(this.exchangeType, offset);
+        offset += 1;
+        // Write flags (1 byte)
+        let flags = 0;
+        if (this.isInitiator)
+            flags |= 0x08;
+        if (this.canUseHigherVersion)
+            flags |= 0x10;
+        if (this.isResponse)
+            flags |= 0x20;
+        buffer.writeUInt8(flags, offset);
+        offset += 1;
+        // Write messageID (4 bytes)
+        buffer.writeUInt32BE(this.messageID, offset);
+        offset += 4;
+        // Write length (4 bytes)
+        buffer.writeUInt32BE(this.length, offset);
+        return buffer;
+    }
+    isRequest() {
+        return !this.isResponse;
+    }
+    isResponder() {
+        return !this.isInitiator;
+    }
+    /**
+     * Convert object to JSON
+     * @method
+     * @public
+     * @returns {Record<string, any>} JSON object
+     */
+    toJSON() {
+        return {
+            initiatorSPI: this.initiatorSPI.toString("hex"),
+            responderSPI: this.responderSPI.toString("hex"),
+            nextPayload: this.nextPayload,
+            version: this.majorVersion + "." + this.minorVersion,
+            exchangeType: this.exchangeType,
+            flags: {
+                isInitiator: this.isInitiator,
+                useHigherVersion: this.canUseHigherVersion,
+                isResponse: this.isResponse,
+            },
+            messageID: this.messageID,
+            length: this.length,
+        };
+    }
+    /**
+     * Returns a string representation of the header
+     * @method
+     * @public
+     * @returns {void}
+     */
+    toString() {
+        const prettyJson = this.toJSON();
+        prettyJson.messageID = `0x${prettyJson.messageID.toString(16).padStart(8, "0")}`;
+        prettyJson.nextPayload =
+            payload_1.payloadType[prettyJson.nextPayload] + " (" + prettyJson.nextPayload + ")";
+        prettyJson.exchangeType =
+            exchangeType[prettyJson.exchangeType] +
+                " (" +
+                prettyJson.exchangeType +
+                ")";
+        prettyJson.flags = {
+            isInitiator: prettyJson.flags.isInitiator ? "Initiator" : "Responder",
+            useHigherVersion: prettyJson.flags.canUseHigherVersion ? "Yes" : "No",
+            isResponse: prettyJson.flags.isResponse ? "Response" : "Request",
+        };
+        return JSON.stringify(prettyJson, null, 2);
+    }
+}
+exports.Header = Header;
+Header.headerLength = 28;

package/lib/src/index.d.ts

@@ -0,0 +1,9 @@
+export * from "./attribute";
+export * from "./payload";
+export * from "./header";
+export * from "./proposal";
+export * from "./selector";
+export * from "./transform";
+export * from "./message";
+import * as ikev2 from "./message";
+export { ikev2 };

package/lib/src/index.js

@@ -0,0 +1,38 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ikev2 = void 0;
+__exportStar(require("./attribute"), exports);
+__exportStar(require("./payload"), exports);
+__exportStar(require("./header"), exports);
+__exportStar(require("./proposal"), exports);
+__exportStar(require("./selector"), exports);
+__exportStar(require("./transform"), exports);
+__exportStar(require("./message"), exports);
+const ikev2 = __importStar(require("./message"));
+exports.ikev2 = ikev2;

package/lib/src/message.d.ts

@@ -0,0 +1,88 @@
+import { Header } from "./header";
+import { Payload, payloadType } from "./payload";
+/**
+ * IKEv2 Message class
+ * @class
+ * @property {Header} header - IKEv2 header
+ * @property {Payload[]} payloads - IKEv2 payloads
+ */
+export declare class Message {
+    header: Header;
+    payloads: Payload[];
+    /**
+     * @constructor
+     * @param {Header} header - IKEv2 header
+     * @param {Payload[]} payloads - IKEv2 payloads
+     */
+    constructor(header: Header, payloads: Payload[]);
+    private static getBuffer;
+    /**
+     * Parses IKEv2 message
+     * @param buffer - Buffer containing the message
+     * @param headerOnly - If only header is needed (default: false)
+     * @returns {Message}
+     */
+    static parse(packet: Buffer | string, headerOnly?: boolean): Message;
+    /**
+     * Serializes IKEv2 message from JSON to Buffer
+     * @param {Record<string, any>} json - JSON representation of the message
+     * @returns {Buffer}
+     */
+    static serializeJSON(json: Record<string, any>): Buffer;
+    /**
+     * Serializes IKEv2 message
+     * @returns {Buffer}
+     */
+    serialize(): Buffer;
+    /**
+     * Returns a JSON representation of the message
+     * @returns {Record<string, any>}
+     */
+    toJSON(): Record<string, any>;
+    /**
+     * Returns a string representation of the message
+     * @returns {string}
+     */
+    toString(): string;
+    /**
+     * Gets the payloads of the given type
+     * @param type
+     * @returns Payload[] | undefined
+     */
+    getPayloads(type: payloadType): Payload[] | undefined;
+    /**
+     * Gets the payload of the given type
+     * @param type
+     * @returns Payload | undefined
+     */
+    getPayload(type: payloadType): Payload | undefined;
+    /**
+     * Verifies the integrity checksum data of the given packet using the provided verifyFunction. Should be called on
+     * whenever you detect that the SK payload is present.
+     *
+     * The SK payload is always the last one in the message, such that the Integrity Checksum Data is at the end of the
+     * packet.
+     *
+     * Might want to verify that the SK payload is the last one in the message before calling this function. Else it will
+     * always fail.
+     *
+     * @param iv  the IV used for the encryption of the SK payload, obtained from the decrypt function.
+     * @param packet the original input packet, as passed to the parse() function
+     * @param verifyFunction
+     * @returns
+     */
+    static verifyIntegrityChecksumData(iv: Buffer, packet: Buffer | string, verifyFunction: (iv: Buffer, packet: Buffer) => boolean): boolean;
+    /**
+     * Updated the integrity checksum data of the given packet using the provided computeFunction. Should be called on the
+     * entire serialized packet, when an SK was included (and it was the last payload, hence the Integrity Checksum Data
+     * is supposed to be in the last bytes of the packet).
+     *
+     * Please verify that the SK payload is the last one in the message before calling this function.
+     *
+     * @param packet
+     * @param integrityChecksumDataLength
+     * @param signFunction
+     * @returns
+     */
+    static updateIntegrityChecksumData(iv: Buffer, packet: Buffer, signFunction: (iv: Buffer, packet: Buffer) => Buffer): Buffer;
+}