FD.io VPP  v17.01.1-3-gc6833f8
Vector Packet Processing
ikev2_payload.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2015 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include <ctype.h>
17 
18 #include <vnet/vnet.h>
19 #include <vnet/api_errno.h>
20 #include <vnet/ip/ip.h>
21 #include <vnet/interface.h>
22 
23 #include <vnet/ipsec/ipsec.h>
24 #include <vnet/ipsec/ikev2.h>
25 #include <vnet/ipsec/ikev2_priv.h>
26 
27 /* *INDENT-OFF* */
28 typedef CLIB_PACKED (struct
29  {
30  u8 nextpayload;
31  u8 flags;
32  u16 length;
33  u8 protocol_id;
34  u8 spi_size;
35  u16 msg_type;
36  u8 payload[0];}) ike_notify_payload_header_t;
37 /* *INDENT-ON* */
38 
39 /* *INDENT-OFF* */
40 typedef CLIB_PACKED (struct
41  {
42  u8 ts_type;
43  u8 protocol_id;
44  u16 selector_len;
45  u16 start_port;
46  u16 end_port;
47  ip4_address_t start_addr;
49 /* *INDENT-OFF* */
50 
51 /* *INDENT-OFF* */
52 typedef CLIB_PACKED (struct
53  {
54  u8 nextpayload;
55  u8 flags;
56  u16 length;
57  u8 num_ts;
58  u8 reserved[3];
60  ike_ts_payload_header_t;
61 /* *INDENT-OFF* */
62 
63 /* *INDENT-OFF* */
64 typedef CLIB_PACKED (struct {
65  u8 last_or_more;
66  u8 reserved;
67  u16 proposal_len;
68  u8 proposal_num;
69  u8 protocol_id;
70  u8 spi_size;
71  u8 num_transforms; u32 spi[0];
73 /* *INDENT-OFF* */
74 
75 /* *INDENT-OFF* */
76 typedef CLIB_PACKED (struct {
77  u8 last_or_more;
78  u8 reserved;
79  u16 transform_len;
80  u8 transform_type;
81  u8 reserved2;
82  u16 transform_id;
83  u8 attributes[0];
84 }) ike_sa_transform_data_t;
85 /* *INDENT-OFF* */
86 
87 /* *INDENT-OFF* */
88 typedef CLIB_PACKED (struct {
89  u8 nextpayload;
90  u8 flags;
91  u16 length;
92  u8 protocol_id;
93  u8 spi_size;
94  u16 num_of_spi;
95  u32 spi[0];
97 /* *INDENT-OFF* */
98 
99 static ike_payload_header_t *
101 {
102  ike_payload_header_t *hdr =
103  (ike_payload_header_t *) & c->data[c->last_hdr_off];
104  u8 *tmp;
105 
106  if (c->data)
107  hdr->nextpayload = payload_type;
108  else
109  c->first_payload_type = payload_type;
110 
111  c->last_hdr_off = vec_len (c->data);
112  vec_add2 (c->data, tmp, len);
113  hdr = (ike_payload_header_t *) tmp;
114  memset (hdr, 0, len);
115 
116  hdr->length = clib_host_to_net_u16 (len);
117 
118  return hdr;
119 }
120 
121 static void
123 {
124  u16 len;
125  ike_payload_header_t *hdr;
126 
127  vec_append (c->data, data);
128  hdr = (ike_payload_header_t *) & c->data[c->last_hdr_off];
129  len = clib_net_to_host_u16 (hdr->length);
130  hdr->length = clib_host_to_net_u16 (len + vec_len (data));
131 }
132 
133 void
135 {
136  ike_notify_payload_header_t *n;
137 
138  n =
139  (ike_notify_payload_header_t *) ikev2_payload_add_hdr (c,
141  sizeof (*n));
142  n->msg_type = clib_host_to_net_u16 (msg_type);
143  ikev2_payload_add_data (c, data);
144 }
145 
146 void
148  ikev2_sa_proposal_t * proposals)
149 {
150  ike_payload_header_t *ph;
152  ike_sa_transform_data_t *tr;
155 
156  u8 *tmp;
157  u8 *pr_data = 0;
158  u8 *tr_data = 0;
159 
160  ikev2_payload_add_hdr (c, IKEV2_PAYLOAD_SA, sizeof (*ph));
161 
162  vec_foreach (p, proposals)
163  {
164  int spi_size = (p->protocol_id == IKEV2_PROTOCOL_ESP) ? 4 : 0;
165  pr_data = vec_new (u8, sizeof (ike_sa_proposal_data_t) + spi_size);
166  prop = (ike_sa_proposal_data_t *) pr_data;
167  prop->last_or_more = proposals - p + 1 < vec_len (proposals) ? 2 : 0;
168  prop->protocol_id = p->protocol_id;
169  prop->proposal_num = p->proposal_num;
170  prop->spi_size = spi_size;
171  prop->num_transforms = vec_len (p->transforms);
172 
173  if (spi_size)
174  prop->spi[0] = clib_host_to_net_u32 (p->spi);
175 
176  DBG_PLD ("proposal num %u protocol_id %u last_or_more %u spi_size %u%s%U",
177  prop->proposal_num, prop->protocol_id, prop->last_or_more,
178  prop->spi_size, prop->spi_size ? " spi_data " : "",
179  format_hex_bytes, prop->spi, prop->spi_size);
180 
181  vec_foreach (t, p->transforms)
182  {
183  vec_add2 (tr_data, tmp, sizeof (*tr) + vec_len (t->attrs));
184  tr = (ike_sa_transform_data_t *) tmp;
185  tr->last_or_more =
186  ((t - p->transforms) + 1 < vec_len (p->transforms)) ? 3 : 0;
187  tr->transform_type = t->type;
188  tr->transform_id = clib_host_to_net_u16 (t->transform_id);
189  tr->transform_len =
190  clib_host_to_net_u16 (sizeof (*tr) + vec_len (t->attrs));
191 
192  if (vec_len (t->attrs) > 0)
193  clib_memcpy (tr->attributes, t->attrs, vec_len (t->attrs));
194 
195  DBG_PLD
196  ("transform type %U transform_id %u last_or_more %u attr_size %u%s%U",
197  format_ikev2_transform_type, tr->transform_type, t->transform_id,
198  tr->last_or_more, vec_len (t->attrs),
199  vec_len (t->attrs) ? " attrs " : "", format_hex_bytes,
200  tr->attributes, vec_len (t->attrs));
201  }
202 
203  prop->proposal_len =
204  clib_host_to_net_u16 (vec_len (tr_data) + vec_len (pr_data));
205  ikev2_payload_add_data (c, pr_data);
206  ikev2_payload_add_data (c, tr_data);
207  vec_free (pr_data);
208  vec_free (tr_data);
209  }
210 }
211 
212 void
214 {
215  ike_ke_payload_header_t *ke;
216  ke = (ike_ke_payload_header_t *) ikev2_payload_add_hdr (c, IKEV2_PAYLOAD_KE,
217  sizeof (*ke));
218 
219  ke->dh_group = clib_host_to_net_u16 (dh_group);
220  ikev2_payload_add_data (c, dh_data);
221 }
222 
223 void
225 {
227  sizeof (ike_payload_header_t));
228  ikev2_payload_add_data (c, nonce);
229 }
230 
231 void
233 {
234  ike_id_payload_header_t *idp;
235  idp =
236  (ike_id_payload_header_t *) ikev2_payload_add_hdr (c, type,
237  sizeof (*idp));
238 
239  idp->id_type = id->type;
240  ikev2_payload_add_data (c, id->data);
241 }
242 
243 void
245 {
247  u16 num_of_spi = vec_len (d);
248  ikev2_delete_t *d2;
249  dp =
252  sizeof (*dp));
253 
254  if (d[0].protocol_id == IKEV2_PROTOCOL_IKE)
255  {
256  dp->protocol_id = 1;
257  }
258  else
259  {
260  dp->protocol_id = d[0].protocol_id;
261  dp->spi_size = 4;
262  dp->num_of_spi = clib_host_to_net_u16 (num_of_spi);
263  vec_foreach (d2, d)
264  {
265  u8 *data = vec_new (u8, 4);
266  u32 spi = clib_host_to_net_u32 (d2->spi);
267  clib_memcpy (data, &spi, 4);
268  ikev2_payload_add_data (c, data);
269  vec_free (data);
270  }
271  }
272 }
273 
274 void
276 {
277  ike_auth_payload_header_t *ap;
278  ap =
279  (ike_auth_payload_header_t *) ikev2_payload_add_hdr (c,
281  sizeof (*ap));
282 
283  ap->auth_method = auth->method;
284  ikev2_payload_add_data (c, auth->data);
285 }
286 
287 void
289 {
290  ike_ts_payload_header_t *tsh;
291  ikev2_ts_t *ts2;
292  u8 *data = 0, *tmp;
293 
294  tsh =
295  (ike_ts_payload_header_t *) ikev2_payload_add_hdr (c, type,
296  sizeof (*tsh));
297  tsh->num_ts = vec_len (ts);
298 
299  vec_foreach (ts2, ts)
300  {
301  ASSERT (ts2->ts_type == 7); /*TS_IPV4_ADDR_RANGE */
303  vec_add2 (data, tmp, sizeof (*entry));
304  entry = (ikev2_ts_payload_entry_t *) tmp;
305  entry->ts_type = ts2->ts_type;
306  entry->protocol_id = ts2->protocol_id;
307  entry->selector_len = clib_host_to_net_u16 (16);
308  entry->start_port = clib_host_to_net_u16 (ts2->start_port);
309  entry->end_port = clib_host_to_net_u16 (ts2->end_port);
310  entry->start_addr.as_u32 = ts2->start_addr.as_u32;
311  entry->end_addr.as_u32 = ts2->end_addr.as_u32;
312  }
313 
314  ikev2_payload_add_data (c, data);
315  vec_free (data);
316 }
317 
318 void
320 {
321  u8 *tmp __attribute__ ((unused));
322  u8 pad_len = (vec_len (c->data) / bs + 1) * bs - vec_len (c->data);
323  vec_add2 (c->data, tmp, pad_len);
324  c->data[vec_len (c->data) - 1] = pad_len - 1;
325 }
326 
328 ikev2_parse_sa_payload (ike_payload_header_t * ikep)
329 {
330  ikev2_sa_proposal_t *v = 0;
331  ikev2_sa_proposal_t *proposal;
332  ikev2_sa_transform_t *transform;
333 
334  u32 plen = clib_net_to_host_u16 (ikep->length);
335 
337  int proposal_ptr = 0;
338 
339  do
340  {
341  sap = (ike_sa_proposal_data_t *) & ikep->payload[proposal_ptr];
342  int i;
343  int transform_ptr;
344 
345  DBG_PLD ("proposal num %u len %u last_or_more %u id %u "
346  "spi_size %u num_transforms %u",
347  sap->proposal_num, clib_net_to_host_u16 (sap->proposal_len),
348  sap->last_or_more, sap->protocol_id, sap->spi_size,
349  sap->num_transforms);
350 
351  /* IKE proposal should not have SPI */
352  if (sap->protocol_id == IKEV2_PROTOCOL_IKE && sap->spi_size != 0)
353  goto data_corrupted;
354 
355  /* IKE proposal should not have SPI */
356  if (sap->protocol_id == IKEV2_PROTOCOL_ESP && sap->spi_size != 4)
357  goto data_corrupted;
358 
359  transform_ptr = proposal_ptr + sizeof (*sap) + sap->spi_size;
360 
361  vec_add2 (v, proposal, 1);
362  proposal->proposal_num = sap->proposal_num;
363  proposal->protocol_id = sap->protocol_id;
364 
365  if (sap->spi_size == 4)
366  {
367  proposal->spi = clib_net_to_host_u32 (sap->spi[0]);
368  }
369 
370  for (i = 0; i < sap->num_transforms; i++)
371  {
372  ike_sa_transform_data_t *tr =
373  (ike_sa_transform_data_t *) & ikep->payload[transform_ptr];
374  u16 tlen = clib_net_to_host_u16 (tr->transform_len);
375 
376  if (tlen < sizeof (*tr))
377  goto data_corrupted;
378 
379  vec_add2 (proposal->transforms, transform, 1);
380 
381  transform->type = tr->transform_type;
382  transform->transform_id = clib_net_to_host_u16 (tr->transform_id);
383  if (tlen > sizeof (*tr))
384  vec_add (transform->attrs, tr->attributes, tlen - sizeof (*tr));
385 
386  DBG_PLD
387  ("transform num %u len %u last_or_more %u type %U id %u%s%U", i,
388  tlen, tr->last_or_more, format_ikev2_sa_transform, transform,
389  clib_net_to_host_u16 (tr->transform_id),
390  tlen > sizeof (*tr) ? " attrs " : "", format_hex_bytes,
391  tr->attributes, tlen - sizeof (*tr));
392 
393  transform_ptr += tlen;
394  }
395 
396  proposal_ptr += clib_net_to_host_u16 (sap->proposal_len);
397  }
398  while (proposal_ptr < (plen - sizeof (*ikep)) && sap->last_or_more == 2);
399 
400  /* data validation */
401  if (proposal_ptr != (plen - sizeof (*ikep)) || sap->last_or_more)
402  goto data_corrupted;
403 
404  return v;
405 
406 data_corrupted:
407  DBG_PLD ("SA payload data corrupted");
409  return 0;
410 }
411 
412 ikev2_ts_t *
413 ikev2_parse_ts_payload (ike_payload_header_t * ikep)
414 {
415  ike_ts_payload_header_t *tsp = (ike_ts_payload_header_t *) ikep;
416  ikev2_ts_t *r = 0, *ts;
417  u8 i;
418 
419  for (i = 0; i < tsp->num_ts; i++)
420  {
421  if (tsp->ts[i].ts_type != 7) /* TS_IPV4_ADDR_RANGE */
422  {
423  DBG_PLD ("unsupported TS type received (%u)", tsp->ts[i].ts_type);
424  continue;
425  }
426 
427  vec_add2 (r, ts, 1);
428  ts->ts_type = tsp->ts[i].ts_type;
429  ts->protocol_id = tsp->ts[i].protocol_id;
430  ts->start_port = tsp->ts[i].start_port;
431  ts->end_port = tsp->ts[i].end_port;
432  ts->start_addr.as_u32 = tsp->ts[i].start_addr.as_u32;
433  ts->end_addr.as_u32 = tsp->ts[i].end_addr.as_u32;
434  }
435  return r;
436 }
437 
439 ikev2_parse_notify_payload (ike_payload_header_t * ikep)
440 {
441  ike_notify_payload_header_t *n = (ike_notify_payload_header_t *) ikep;
442  u32 plen = clib_net_to_host_u16 (ikep->length);
443  ikev2_notify_t *r = 0;
444  u32 spi;
445 
446  DBG_PLD ("msg_type %U len %u%s%U",
447  format_ikev2_notify_msg_type, clib_net_to_host_u16 (n->msg_type),
448  plen, plen > sizeof (*n) ? " data " : "",
449  format_hex_bytes, n->payload, plen - sizeof (*n));
450 
451  r = vec_new (ikev2_notify_t, 1);
452  r->msg_type = clib_net_to_host_u16 (n->msg_type);
453  r->protocol_id = n->protocol_id;
454 
455  if (n->spi_size == 4)
456  {
457  clib_memcpy (&spi, n->payload, n->spi_size);
458  r->spi = clib_net_to_host_u32 (spi);
459  DBG_PLD ("spi %lx", r->spi);
460  }
461  else if (n->spi_size == 0)
462  {
463  r->spi = 0;
464  }
465  else
466  {
467  clib_warning ("invalid SPI Size %d", n->spi_size);
468  }
469 
470  if (plen > (sizeof (*n) + n->spi_size))
471  {
472  vec_add (r->data, n->payload + n->spi_size,
473  plen - sizeof (*n) - n->spi_size);
474  }
475 
476  return r;
477 }
478 
479 void
480 ikev2_parse_vendor_payload (ike_payload_header_t * ikep)
481 {
482  u32 plen = clib_net_to_host_u16 (ikep->length);
483  int i;
484  int is_string = 1;
485 
486  for (i = 0; i < plen - 4; i++)
487  if (!isprint (ikep->payload[i]))
488  is_string = 0;
489 
490  DBG_PLD ("len %u data %s:%U",
491  plen,
492  is_string ? "string" : "hex",
493  is_string ? format_ascii_bytes : format_hex_bytes,
494  ikep->payload, plen - sizeof (*ikep));
495 }
496 
498 ikev2_parse_delete_payload (ike_payload_header_t * ikep)
499 {
501  u32 plen = clib_net_to_host_u16 (ikep->length);
502  ikev2_delete_t *r = 0, *del;
503  u16 num_of_spi = clib_net_to_host_u16 (d->num_of_spi);
504  u16 i = 0;
505 
506  DBG_PLD ("protocol_id %u spi_size %u num_of_spi %u len %u%s%U",
507  d->protocol_id, d->spi_size, num_of_spi,
508  plen, plen > sizeof (d) ? " data " : "",
509  format_hex_bytes, d->spi, plen - sizeof (*d));
510 
511  if (d->protocol_id == IKEV2_PROTOCOL_IKE)
512  {
513  r = vec_new (ikev2_delete_t, 1);
514  r->protocol_id = 1;
515  }
516  else
517  {
518  r = vec_new (ikev2_delete_t, num_of_spi);
519  vec_foreach (del, r)
520  {
521  del->protocol_id = d->protocol_id;
522  del->spi = clib_net_to_host_u32 (d->spi[i++]);
523  }
524  }
525 
526  return r;
527 }
528 
529 /*
530  * fd.io coding-style-patch-verification: ON
531  *
532  * Local Variables:
533  * eval: (c-set-style "gnu")
534  * End:
535  */
void ikev2_payload_add_nonce(ikev2_payload_chain_t *c, u8 *nonce)
ikev2_transform_type_t type
Definition: ikev2_priv.h:69
sll srl srl sll sra u16x4 i
Definition: vector_sse2.h:343
#define IKEV2_PAYLOAD_NONCE
Definition: ikev2.h:99
void ikev2_payload_add_notify(ikev2_payload_chain_t *c, u16 msg_type, u8 *data)
u8 * format_ascii_bytes(u8 *s, va_list *va)
Definition: std-formats.c:74
bad routing header type(not 4)") sr_error (NO_MORE_SEGMENTS
void ikev2_payload_add_sa(ikev2_payload_chain_t *c, ikev2_sa_proposal_t *proposals)
ikev2_sa_proposal_t * ikev2_parse_sa_payload(ike_payload_header_t *ikep)
ikev2_ts_t * ikev2_parse_ts_payload(ike_payload_header_t *ikep)
u8 * format_ikev2_sa_transform(u8 *s, va_list *args)
Definition: ikev2_format.c:25
typedef CLIB_PACKED(struct{u8 nextpayload;u8 flags;u16 length;u8 protocol_id;u8 spi_size;u16 msg_type;u8 payload[0];})
Definition: ikev2_payload.c:28
#define vec_add2(V, P, N)
Add N elements to end of vector V, return pointer to new elements in P.
Definition: vec.h:521
void ikev2_payload_add_ke(ikev2_payload_chain_t *c, u16 dh_group, u8 *dh_data)
ikev2_ts_payload_entry_t
Definition: ikev2_payload.c:48
ikev2_notify_t * ikev2_parse_notify_payload(ike_payload_header_t *ikep)
#define vec_add(V, E, N)
Add N elements to end of vector V (no header, unspecified alignment)
Definition: vec.h:559
#define IKEV2_PAYLOAD_DELETE
Definition: ikev2.h:101
#define vec_new(T, N)
Create new vector of given type and length (unspecified alignment, no header).
Definition: vec.h:270
void ikev2_parse_vendor_payload(ike_payload_header_t *ikep)
ip4_address_t start_addr
Definition: ikev2_priv.h:106
u8 * format_hex_bytes(u8 *s, va_list *va)
Definition: std-formats.c:84
void ikev2_payload_add_id(ikev2_payload_chain_t *c, ikev2_id_t *id, u8 type)
#define IKEV2_PAYLOAD_NOTIFY
Definition: ikev2.h:100
#define clib_warning(format, args...)
Definition: error.h:59
ikev2_sa_transform_t * transforms
Definition: ikev2_priv.h:96
#define IKEV2_PAYLOAD_SA
Definition: ikev2.h:94
ike_sa_proposal_data_t
Definition: ikev2_payload.c:72
#define v
Definition: acl.c:314
u16 end_port
Definition: ikev2_priv.h:105
#define DBG_PLD(my_args...)
Definition: ikev2_priv.h:36
ip4_address_t end_addr
Definition: ikev2_priv.h:107
void ikev2_payload_add_delete(ikev2_payload_chain_t *c, ikev2_delete_t *d)
u8 * format_ikev2_notify_msg_type(u8 *s, va_list *args)
svmdb_client_t * c
ikev2_auth_method_t method
Definition: ikev2_priv.h:55
#define vec_free(V)
Free vector&#39;s memory (no header).
Definition: vec.h:300
#define clib_memcpy(a, b, c)
Definition: string.h:69
static ike_payload_header_t * ikev2_payload_add_hdr(ikev2_payload_chain_t *c, u8 payload_type, int len)
#define IKEV2_PAYLOAD_KE
Definition: ikev2.h:95
void ikev2_payload_add_auth(ikev2_payload_chain_t *c, ikev2_auth_t *auth)
ikev2_protocol_id_t protocol_id
Definition: ikev2_priv.h:94
u8 protocol_id
Definition: ikev2_priv.h:102
#define ASSERT(truth)
unsigned int u32
Definition: types.h:88
ike_delete_payload_header_t
Definition: ikev2_payload.c:96
u8 * format_ikev2_transform_type(u8 *s, va_list *args)
void ikev2_sa_free_proposal_vector(ikev2_sa_proposal_t **v)
Definition: ikev2.c:219
#define IKEV2_PAYLOAD_AUTH
Definition: ikev2.h:98
#define vec_append(v1, v2)
Append v2 after v1.
Definition: vec.h:779
static void ikev2_payload_add_data(ikev2_payload_chain_t *c, u8 *data)
unsigned short u16
Definition: types.h:57
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
u16 start_port
Definition: ikev2_priv.h:104
unsigned char u8
Definition: types.h:56
void ikev2_payload_chain_add_padding(ikev2_payload_chain_t *c, int bs)
#define vec_foreach(var, vec)
Vector iterator.
u32 flags
Definition: vhost-user.h:75
void ikev2_payload_add_ts(ikev2_payload_chain_t *c, ikev2_ts_t *ts, u8 type)
ikev2_delete_t * ikev2_parse_delete_payload(ike_payload_header_t *ikep)