FD.io VPP  v16.09
Vector Packet Processing
ikev2_priv.h
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2015 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 #ifndef __included_ikev2_priv_h__
16 #define __included_ikev2_priv_h__
17 
18 #include <vnet/vnet.h>
19 #include <vnet/ip/ip.h>
20 #include <vnet/ethernet/ethernet.h>
21 
22 #include <vnet/ipsec/ikev2.h>
23 
24 #include <vppinfra/hash.h>
25 #include <vppinfra/elog.h>
26 #include <vppinfra/error.h>
27 
28 #include <openssl/rand.h>
29 #include <openssl/dh.h>
30 #include <openssl/hmac.h>
31 #include <openssl/evp.h>
32 
33 #define IKEV2_DEBUG_PAYLOAD 1
34 
35 #if IKEV2_DEBUG_PAYLOAD == 1
36 #define DBG_PLD(my_args...) clib_warning(my_args)
37 #else
38 #define DBG_PLD(my_args...)
39 #endif
40 
41 typedef enum
42 {
52 
53 typedef struct
54 {
56  u8 *data;
57  u8 hex; /* hex encoding of the shared secret */
58  EVP_PKEY *key;
59 } ikev2_auth_t;
60 
61 typedef enum
62 {
66 
67 typedef struct
68 {
70  union
71  {
78  };
84  int nid;
85  const char *dh_p;
86  const char *dh_g;
87  const void *md;
88  const void *cipher;
90 
91 typedef struct
92 {
94  ikev2_protocol_id_t protocol_id:8;
98 
99 typedef struct
100 {
108 } ikev2_ts_t;
109 
110 typedef struct
111 {
114 } ikev2_id_t;
115 
116 typedef struct
117 {
118  /* sa proposals vectors */
121 
122  /* Traffic Selectors */
125 
126  /* keys */
132 
133 typedef struct
134 {
136  u32 spi; /*for ESP and AH SPI size is 4, for IKE size is 0 */
138 
139 typedef struct
140 {
147 } ikev2_rekey_t;
148 
149 typedef struct
150 {
156 
157 
158 typedef struct
159 {
169 
170  /* DH data */
175 
176  /* sa proposals vectors */
179 
180  /* keys */
188 
189  /* auth */
192 
193  /* ID */
196 
197  /* pending deletes */
199 
200  /* pending rekeyings */
202 
203  /* packet data */
206 
207  /* retransmit */
210 
212 } ikev2_sa_t;
213 
214 typedef struct
215 {
218 
225 
226 typedef struct
227 {
228  /* pool of IKEv2 Security Associations */
230 
231  /* hash */
234 
235 typedef struct
236 {
237  /* pool of IKEv2 profiles */
239 
240  /* vector of supported transform types */
242 
243  /* hash */
245 
246  /* local private key */
247  EVP_PKEY *pkey;
248 
249  /* convenience */
252 
254 
255 } ikev2_main_t;
256 
258 
262 
263 /* ikev2_crypto.c */
264 v8 *ikev2_calc_prf (ikev2_sa_transform_t * tr, v8 * key, v8 * data);
265 u8 *ikev2_calc_prfplus (ikev2_sa_transform_t * tr, u8 * key, u8 * seed,
266  int len);
267 v8 *ikev2_calc_integr (ikev2_sa_transform_t * tr, v8 * key, u8 * data,
268  int len);
269 v8 *ikev2_decrypt_data (ikev2_sa_t * sa, u8 * data, int len);
270 int ikev2_encrypt_data (ikev2_sa_t * sa, v8 * src, u8 * dst);
272 int ikev2_verify_sign (EVP_PKEY * pkey, u8 * sigbuf, u8 * data);
273 u8 *ikev2_calc_sign (EVP_PKEY * pkey, u8 * data);
274 EVP_PKEY *ikev2_load_cert_file (u8 * file);
275 EVP_PKEY *ikev2_load_key_file (u8 * file);
276 void ikev2_crypto_init (ikev2_main_t * km);
277 
278 /* ikev2_payload.c */
279 typedef struct
280 {
285 
286 #define ikev2_payload_new_chain(V) vec_validate (V, 0)
287 #define ikev2_payload_destroy_chain(V) do { \
288  vec_free((V)->data); \
289  vec_free(V); \
290 } while (0)
291 
293  u8 * data);
295  ikev2_sa_proposal_t * proposals);
297  u8 * dh_data);
300  u8 type);
303  u8 type);
306 void ikev2_parse_vendor_payload (ike_payload_header_t * ikep);
307 ikev2_sa_proposal_t *ikev2_parse_sa_payload (ike_payload_header_t * ikep);
308 ikev2_ts_t *ikev2_parse_ts_payload (ike_payload_header_t * ikep);
309 ikev2_delete_t *ikev2_parse_delete_payload (ike_payload_header_t * ikep);
310 ikev2_notify_t *ikev2_parse_notify_payload (ike_payload_header_t * ikep);
311 
312 #endif /* __included_ikev2_priv_h__ */
313 
314 
315 /*
316  * fd.io coding-style-patch-verification: ON
317  *
318  * Local Variables:
319  * eval: (c-set-style "gnu")
320  * End:
321  */
ikev2_main_per_thread_data_t * per_thread_data
Definition: ikev2_priv.h:253
u8 * dh_shared_key
Definition: ikev2_priv.h:172
Definition: mhash.h:46
ikev2_transform_type_t type
Definition: ikev2_priv.h:69
void ikev2_payload_add_sa(ikev2_payload_chain_t *c, ikev2_sa_proposal_t *proposals)
ikev2_id_t r_id
Definition: ikev2_priv.h:195
void ikev2_payload_add_notify(ikev2_payload_chain_t *c, u16 msg_type, u8 *data)
ikev2_transform_integ_type_t
Definition: ikev2.h:267
EVP_PKEY * pkey
Definition: ikev2_priv.h:247
bad routing header type(not 4)") sr_error (NO_MORE_SEGMENTS
u8 * ikev2_calc_prfplus(ikev2_sa_transform_t *tr, u8 *key, u8 *seed, int len)
Definition: ikev2_crypto.c:275
ikev2_auth_method_t
Definition: ikev2.h:339
ikev2_sa_transform_t * ikev2_sa_get_td_for_type(ikev2_sa_proposal_t *p, ikev2_transform_type_t type)
Definition: ikev2.c:188
ikev2_profile_t * profiles
Definition: ikev2_priv.h:238
u8 v8
Definition: ikev2.h:27
ikev2_state_t state
Definition: ikev2_priv.h:160
u8 * sk_pi
Definition: ikev2_priv.h:186
ikev2_main_t ikev2_main
Definition: ikev2_priv.h:257
u8 initial_contact
Definition: ikev2_priv.h:162
ikev2_ts_t * tsi
Definition: ikev2_priv.h:145
void ikev2_payload_add_id(ikev2_payload_chain_t *c, ikev2_id_t *id, u8 type)
ikev2_auth_t r_auth
Definition: ikev2_priv.h:191
u8 * last_sa_init_res_packet_data
Definition: ikev2_priv.h:205
ikev2_auth_t auth
Definition: ikev2_priv.h:219
ikev2_ts_t * tsr
Definition: ikev2_priv.h:146
ikev2_ts_t * ikev2_parse_ts_payload(ike_payload_header_t *ikep)
ikev2_id_t rem_id
Definition: ikev2_priv.h:221
ikev2_transform_dh_type_t
Definition: ikev2.h:317
EVP_PKEY * ikev2_load_cert_file(u8 *file)
Definition: ikev2_crypto.c:503
void ikev2_payload_add_ts(ikev2_payload_chain_t *c, ikev2_ts_t *ts, u8 type)
u32 last_msg_id
Definition: ikev2_priv.h:208
ikev2_sa_proposal_t * r_proposals
Definition: ikev2_priv.h:120
ip4_address_t start_addr
Definition: ikev2_priv.h:106
u16 selector_len
Definition: ikev2_priv.h:103
EVP_PKEY * ikev2_load_key_file(u8 *file)
Definition: ikev2_crypto.c:533
unsigned long u64
Definition: types.h:89
ikev2_sa_proposal_t * i_proposals
Definition: ikev2_priv.h:177
int ikev2_verify_sign(EVP_PKEY *pkey, u8 *sigbuf, u8 *data)
Definition: ikev2_crypto.c:474
ikev2_auth_t i_auth
Definition: ikev2_priv.h:190
ikev2_id_t loc_id
Definition: ikev2_priv.h:220
ikev2_sa_transform_t * transforms
Definition: ikev2_priv.h:96
u8 * sk_ar
Definition: ikev2_priv.h:183
u8 * r_dh_data
Definition: ikev2_priv.h:174
u8 * last_sa_init_req_packet_data
Definition: ikev2_priv.h:204
ikev2_ts_t rem_ts
Definition: ikev2_priv.h:223
u8 * i_dh_data
Definition: ikev2_priv.h:173
ikev2_sa_proposal_t * i_proposals
Definition: ikev2_priv.h:119
u8 * r_nonce
Definition: ikev2_priv.h:168
mhash_t profile_index_by_name
Definition: ikev2_priv.h:244
u16 end_port
Definition: ikev2_priv.h:105
ikev2_sa_transform_t * supported_transforms
Definition: ikev2_priv.h:241
ikev2_rekey_t * rekey
Definition: ikev2_priv.h:201
void ikev2_payload_chain_add_padding(ikev2_payload_chain_t *c, int bs)
ikev2_protocol_id_t
Definition: ikev2.h:107
ip4_address_t end_addr
Definition: ikev2_priv.h:107
ip4_address_t iaddr
Definition: ikev2_priv.h:163
u8 * ikev2_calc_sign(EVP_PKEY *pkey, u8 *data)
Definition: ikev2_crypto.c:485
v8 * ikev2_calc_prf(ikev2_sa_transform_t *tr, v8 *key, v8 *data)
Definition: ikev2_crypto.c:256
u8 * i_nonce
Definition: ikev2_priv.h:167
u8 * sk_ei
Definition: ikev2_priv.h:184
ikev2_delete_t * ikev2_parse_delete_payload(ike_payload_header_t *ikep)
svmdb_client_t * c
ikev2_sa_proposal_t * ikev2_parse_sa_payload(ike_payload_header_t *ikep)
ikev2_transform_encr_type_t
Definition: ikev2.h:226
ikev2_delete_t * del
Definition: ikev2_priv.h:198
ikev2_ts_t * tsi
Definition: ikev2_priv.h:123
v8 * ikev2_decrypt_data(ikev2_sa_t *sa, u8 *data, int len)
Definition: ikev2_crypto.c:340
void ikev2_payload_add_nonce(ikev2_payload_chain_t *c, u8 *nonce)
ip4_address_t raddr
Definition: ikev2_priv.h:164
u8 * sk_er
Definition: ikev2_priv.h:185
const void * cipher
Definition: ikev2_priv.h:88
ikev2_ts_t loc_ts
Definition: ikev2_priv.h:222
ikev2_sa_proposal_t * r_proposals
Definition: ikev2_priv.h:178
u8 protocol_id
Definition: ikev2_priv.h:102
unsigned int u32
Definition: types.h:88
vnet_main_t * vnet_main
Definition: ikev2_priv.h:251
ikev2_id_type_t
Definition: ikev2.h:355
ikev2_notify_t * ikev2_parse_notify_payload(ike_payload_header_t *ikep)
ikev2_transform_esn_type_t
Definition: ikev2.h:328
ikev2_sa_proposal_t * r_proposal
Definition: ikev2_priv.h:144
u8 * sk_ai
Definition: ikev2_priv.h:182
v8 * ikev2_calc_integr(ikev2_sa_transform_t *tr, v8 *key, u8 *data, int len)
Definition: ikev2_crypto.c:317
u16 dh_group
Definition: ikev2_priv.h:171
ikev2_sa_proposal_t * i_proposal
Definition: ikev2_priv.h:143
const char * dh_p
Definition: ikev2_priv.h:85
EVP_PKEY * key
Definition: ikev2_priv.h:58
ikev2_dh_group_t
Definition: ikev2_priv.h:61
u64 uword
Definition: types.h:112
const void * md
Definition: ikev2_priv.h:87
void ikev2_crypto_init(ikev2_main_t *km)
Definition: ikev2_crypto.c:555
u8 * last_res_packet_data
Definition: ikev2_priv.h:209
const char * dh_g
Definition: ikev2_priv.h:86
unsigned short u16
Definition: types.h:57
void ikev2_payload_add_auth(ikev2_payload_chain_t *c, ikev2_auth_t *auth)
u16 start_port
Definition: ikev2_priv.h:104
void ikev2_payload_add_ke(ikev2_payload_chain_t *c, u16 dh_group, u8 *dh_data)
unsigned char u8
Definition: types.h:56
u8 * sk_pr
Definition: ikev2_priv.h:187
ikev2_id_t i_id
Definition: ikev2_priv.h:194
ikev2_ts_t * tsr
Definition: ikev2_priv.h:124
ikev2_child_sa_t * childs
Definition: ikev2_priv.h:211
void ikev2_parse_vendor_payload(ike_payload_header_t *ikep)
int ikev2_encrypt_data(ikev2_sa_t *sa, v8 *src, u8 *dst)
Definition: ikev2_crypto.c:372
void ikev2_payload_add_delete(ikev2_payload_chain_t *c, ikev2_delete_t *d)
ikev2_transform_prf_type_t
Definition: ikev2.h:243
u8 unsupported_cp
Definition: ikev2_priv.h:161
void ikev2_sa_free_proposal_vector(ikev2_sa_proposal_t **v)
Definition: ikev2.c:219
ikev2_transform_type_t
Definition: ikev2.h:203
void ikev2_generate_dh(ikev2_sa_t *sa, ikev2_sa_transform_t *t)
Definition: ikev2_crypto.c:399
vlib_main_t * vlib_main
Definition: ikev2_priv.h:250
ikev2_state_t
Definition: ikev2_priv.h:41