FD.io VPP  v19.08.3-2-gbabecb413
Vector Packet Processing
ikev2_priv.h
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2015 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 #ifndef __included_ikev2_priv_h__
16 #define __included_ikev2_priv_h__
17 
18 #include <vnet/vnet.h>
19 #include <vnet/ip/ip.h>
20 #include <vnet/ethernet/ethernet.h>
21 
22 #include <plugins/ikev2/ikev2.h>
23 
24 #include <vppinfra/hash.h>
25 #include <vppinfra/elog.h>
26 #include <vppinfra/error.h>
27 
28 #include <openssl/rand.h>
29 #include <openssl/dh.h>
30 #include <openssl/hmac.h>
31 #include <openssl/evp.h>
32 
33 #define IKEV2_DEBUG_PAYLOAD 1
34 
35 #if IKEV2_DEBUG_PAYLOAD == 1
36 #define DBG_PLD(my_args...) clib_warning(my_args)
37 #else
38 #define DBG_PLD(my_args...)
39 #endif
40 
41 typedef enum
42 {
52 
53 typedef struct
54 {
56  u8 *data;
57  u8 hex; /* hex encoding of the shared secret */
58  EVP_PKEY *key;
59 } ikev2_auth_t;
60 
61 typedef enum
62 {
66 
67 typedef struct
68 {
70  union
71  {
78  };
84  int nid;
85  const char *dh_p;
86  const char *dh_g;
87  const void *md;
88  const void *cipher;
90 
91 typedef struct
92 {
98 
99 typedef struct
100 {
108 } ikev2_ts_t;
109 
110 typedef struct
111 {
115 
116 typedef struct
117 {
123 
124 
125 typedef struct
126 {
129 } ikev2_id_t;
130 
131 typedef struct
132 {
133  /* sa proposals vectors */
136 
137  /* Traffic Selectors */
140 
141  /* keys */
146 
147  /* lifetime data */
152 
153 typedef struct
154 {
156  u32 spi; /*for ESP and AH SPI size is 4, for IKE size is 0 */
158 
159 typedef struct
160 {
168 } ikev2_rekey_t;
169 
170 typedef struct
171 {
177 
178 typedef struct
179 {
182 
196 
197 typedef struct
198 {
208 
209  /* DH data */
215 
216  /* sa proposals vectors */
219 
220  /* keys */
228 
229  /* auth */
232 
233  /* ID */
236 
237  /* pending deletes */
239 
240  /* pending rekeyings */
242 
243  /* packet data */
246 
247  /* retransmit */
250 
255 
257 } ikev2_sa_t;
258 
259 
260 typedef struct
261 {
262  /* pool of IKEv2 Security Associations */
264 
265  /* hash */
268 
269 typedef struct
270 {
271  /* pool of IKEv2 profiles */
273 
274  /* vector of supported transform types */
276 
277  /* hash */
279 
280  /* local private key */
281  EVP_PKEY *pkey;
282 
283  /* convenience */
286 
287  /* pool of IKEv2 Security Associations created in initiator mode */
289  /* hash */
291 
293 
294  /* API message ID base */
296 } ikev2_main_t;
297 
298 extern ikev2_main_t ikev2_main;
299 
303 
304 /* ikev2_crypto.c */
307  int len);
309  int len);
310 v8 *ikev2_decrypt_data (ikev2_sa_t * sa, u8 * data, int len);
311 int ikev2_encrypt_data (ikev2_sa_t * sa, v8 * src, u8 * dst);
314 int ikev2_verify_sign (EVP_PKEY * pkey, u8 * sigbuf, u8 * data);
315 u8 *ikev2_calc_sign (EVP_PKEY * pkey, u8 * data);
316 EVP_PKEY *ikev2_load_cert_file (u8 * file);
317 EVP_PKEY *ikev2_load_key_file (u8 * file);
318 void ikev2_crypto_init (ikev2_main_t * km);
319 
320 /* ikev2_payload.c */
321 typedef struct
322 {
327 
328 #define ikev2_payload_new_chain(V) vec_validate (V, 0)
329 #define ikev2_payload_destroy_chain(V) do { \
330  vec_free((V)->data); \
331  vec_free(V); \
332 } while (0)
333 
335  u8 * data);
337  u8 * data, ikev2_notify_t * notify);
339  ikev2_sa_proposal_t * proposals);
341  u8 * dh_data);
344  u8 type);
347  u8 type);
350 void ikev2_parse_vendor_payload (ike_payload_header_t * ikep);
351 ikev2_sa_proposal_t *ikev2_parse_sa_payload (ike_payload_header_t * ikep);
352 ikev2_ts_t *ikev2_parse_ts_payload (ike_payload_header_t * ikep);
353 ikev2_delete_t *ikev2_parse_delete_payload (ike_payload_header_t * ikep);
354 ikev2_notify_t *ikev2_parse_notify_payload (ike_payload_header_t * ikep);
355 
356 #endif /* __included_ikev2_priv_h__ */
357 
358 
359 /*
360  * fd.io coding-style-patch-verification: ON
361  *
362  * Local Variables:
363  * eval: (c-set-style "gnu")
364  * End:
365  */
ikev2_main_per_thread_data_t * per_thread_data
Definition: ikev2_priv.h:292
u8 * dh_shared_key
Definition: ikev2_priv.h:211
ikev2_sa_t * sais
Definition: ikev2_priv.h:288
Definition: mhash.h:46
u8 * dh_private_key
Definition: ikev2_priv.h:212
ikev2_transform_type_t type
Definition: ikev2_priv.h:69
void ikev2_payload_add_sa(ikev2_payload_chain_t *c, ikev2_sa_proposal_t *proposals)
ikev2_id_t r_id
Definition: ikev2_priv.h:235
ikev2_id_type_t type
Definition: ikev2_priv.h:127
ikev2_transforms_set ike_ts
Definition: ikev2_priv.h:189
void ikev2_payload_add_notify(ikev2_payload_chain_t *c, u16 msg_type, u8 *data)
ikev2_transform_integ_type_t
Definition: ikev2.h:268
EVP_PKEY * pkey
Definition: ikev2_priv.h:281
u8 * ikev2_calc_prfplus(ikev2_sa_transform_t *tr, u8 *key, u8 *seed, int len)
Definition: ikev2_crypto.c:287
ikev2_auth_method_t
Definition: ikev2.h:340
u32 last_init_msg_id
Definition: ikev2_priv.h:252
ikev2_sa_transform_t * ikev2_sa_get_td_for_type(ikev2_sa_proposal_t *p, ikev2_transform_type_t type)
Definition: ikev2.c:194
ikev2_transform_dh_type_t dh_type
Definition: ikev2_priv.h:120
ikev2_profile_t * profiles
Definition: ikev2_priv.h:272
unsigned long u64
Definition: types.h:89
u8 v8
Definition: ikev2.h:27
ikev2_transform_esn_type_t esn_type
Definition: ikev2_priv.h:77
ikev2_state_t state
Definition: ikev2_priv.h:199
vl_api_address_t src
Definition: gre.api:51
ikev2_transform_encr_type_t crypto_alg
Definition: ikev2_priv.h:118
u8 * sk_pi
Definition: ikev2_priv.h:226
ikev2_main_t ikev2_main
Definition: ikev2.c:29
ip4_address_t ip4
Definition: ikev2_priv.h:113
u8 data[128]
Definition: ipsec.api:251
u8 initial_contact
Definition: ikev2_priv.h:201
ikev2_ts_t * tsi
Definition: ikev2_priv.h:166
void ikev2_payload_add_id(ikev2_payload_chain_t *c, ikev2_id_t *id, u8 type)
ikev2_auth_t r_auth
Definition: ikev2_priv.h:231
u8 * last_sa_init_res_packet_data
Definition: ikev2_priv.h:245
unsigned char u8
Definition: types.h:56
ikev2_auth_t auth
Definition: ikev2_priv.h:183
double f64
Definition: types.h:142
ikev2_ts_t * tsr
Definition: ikev2_priv.h:167
ikev2_ts_t * ikev2_parse_ts_payload(ike_payload_header_t *ikep)
ikev2_id_t rem_id
Definition: ikev2_priv.h:185
ikev2_transform_dh_type_t
Definition: ikev2.h:318
EVP_PKEY * ikev2_load_cert_file(u8 *file)
Definition: ikev2_crypto.c:766
void ikev2_payload_add_ts(ikev2_payload_chain_t *c, ikev2_ts_t *ts, u8 type)
u32 last_msg_id
Definition: ikev2_priv.h:248
ikev2_sa_proposal_t * r_proposals
Definition: ikev2_priv.h:135
ip4_address_t start_addr
Definition: ikev2_priv.h:106
u16 selector_len
Definition: ikev2_priv.h:103
EVP_PKEY * ikev2_load_key_file(u8 *file)
Definition: ikev2_crypto.c:796
ikev2_sa_proposal_t * i_proposals
Definition: ikev2_priv.h:217
int ikev2_verify_sign(EVP_PKEY *pkey, u8 *sigbuf, u8 *data)
Definition: ikev2_crypto.c:703
ikev2_transform_integ_type_t integ_alg
Definition: ikev2_priv.h:119
unsigned int u32
Definition: types.h:88
ikev2_auth_t i_auth
Definition: ikev2_priv.h:230
ikev2_id_t loc_id
Definition: ikev2_priv.h:184
ikev2_sa_transform_t * transforms
Definition: ikev2_priv.h:96
u8 * sk_ar
Definition: ikev2_priv.h:223
u8 * r_dh_data
Definition: ikev2_priv.h:214
ikev2_responder_t responder
Definition: ikev2_priv.h:188
vl_api_fib_path_type_t type
Definition: fib_types.api:123
u8 * last_sa_init_req_packet_data
Definition: ikev2_priv.h:244
ikev2_ts_t rem_ts
Definition: ikev2_priv.h:187
u8 * i_dh_data
Definition: ikev2_priv.h:213
unsigned short u16
Definition: types.h:57
ikev2_sa_proposal_t * i_proposals
Definition: ikev2_priv.h:134
u8 * r_nonce
Definition: ikev2_priv.h:207
mhash_t profile_index_by_name
Definition: ikev2_priv.h:278
u16 end_port
Definition: ikev2_priv.h:105
ikev2_sa_transform_t * supported_transforms
Definition: ikev2_priv.h:275
ikev2_rekey_t * rekey
Definition: ikev2_priv.h:241
void ikev2_payload_chain_add_padding(ikev2_payload_chain_t *c, int bs)
signed char i8
Definition: types.h:45
ikev2_protocol_id_t
Definition: ikev2.h:107
vl_api_address_t dst
Definition: gre.api:52
ip4_address_t end_addr
Definition: ikev2_priv.h:107
ip4_address_t iaddr
Definition: ikev2_priv.h:202
u8 * ikev2_calc_sign(EVP_PKEY *pkey, u8 *data)
Definition: ikev2_crypto.c:732
v8 * ikev2_calc_prf(ikev2_sa_transform_t *tr, v8 *key, v8 *data)
Definition: ikev2_crypto.c:257
u8 * i_nonce
Definition: ikev2_priv.h:206
u8 len
Definition: ip_types.api:90
u8 * sk_ei
Definition: ikev2_priv.h:224
ikev2_delete_t * ikev2_parse_delete_payload(ike_payload_header_t *ikep)
The fine-grained event logger allows lightweight, thread-safe event logging at minimum cost...
ikev2_transform_dh_type_t dh_type
Definition: ikev2_priv.h:76
svmdb_client_t * c
ikev2_sa_proposal_t * ikev2_parse_sa_payload(ike_payload_header_t *ikep)
ikev2_auth_method_t method
Definition: ikev2_priv.h:55
ikev2_transform_encr_type_t
Definition: ikev2.h:227
ikev2_delete_t * del
Definition: ikev2_priv.h:238
ikev2_ts_t * tsi
Definition: ikev2_priv.h:138
v8 * ikev2_decrypt_data(ikev2_sa_t *sa, u8 *data, int len)
Definition: ikev2_crypto.c:373
void ikev2_payload_add_nonce(ikev2_payload_chain_t *c, u8 *nonce)
ip4_address_t raddr
Definition: ikev2_priv.h:203
u8 * sk_er
Definition: ikev2_priv.h:225
u8 is_initiator
Definition: ikev2_priv.h:251
const void * cipher
Definition: ikev2_priv.h:88
ikev2_ts_t loc_ts
Definition: ikev2_priv.h:186
ikev2_sa_proposal_t * r_proposals
Definition: ikev2_priv.h:218
ikev2_protocol_id_t protocol_id
Definition: ikev2_priv.h:94
u8 protocol_id
Definition: ikev2_priv.h:102
vnet_main_t * vnet_main
Definition: ikev2_priv.h:285
ikev2_id_type_t
Definition: ikev2.h:356
ikev2_notify_t * ikev2_parse_notify_payload(ike_payload_header_t *ikep)
void ikev2_complete_dh(ikev2_sa_t *sa, ikev2_sa_transform_t *t)
Definition: ikev2_crypto.c:603
ikev2_transform_esn_type_t
Definition: ikev2.h:329
ikev2_sa_proposal_t * r_proposal
Definition: ikev2_priv.h:165
u8 * sk_ai
Definition: ikev2_priv.h:222
v8 * ikev2_calc_integr(ikev2_sa_transform_t *tr, v8 *key, u8 *data, int len)
Definition: ikev2_crypto.c:329
u16 dh_group
Definition: ikev2_priv.h:210
ikev2_sa_proposal_t * i_proposal
Definition: ikev2_priv.h:164
const char * dh_p
Definition: ikev2_priv.h:85
EVP_PKEY * key
Definition: ikev2_priv.h:58
ikev2_dh_group_t
Definition: ikev2_priv.h:61
const void * md
Definition: ikev2_priv.h:87
void ikev2_crypto_init(ikev2_main_t *km)
Definition: ikev2_crypto.c:818
ikev2_transform_encr_type_t encr_type
Definition: ikev2_priv.h:73
u8 * last_res_packet_data
Definition: ikev2_priv.h:249
const char * dh_g
Definition: ikev2_priv.h:86
ikev2_transform_integ_type_t integ_type
Definition: ikev2_priv.h:75
void ikev2_payload_add_auth(ikev2_payload_chain_t *c, ikev2_auth_t *auth)
u16 start_port
Definition: ikev2_priv.h:104
void ikev2_payload_add_ke(ikev2_payload_chain_t *c, u16 dh_group, u8 *dh_data)
u8 * sk_pr
Definition: ikev2_priv.h:227
u64 uword
Definition: types.h:112
ikev2_id_t i_id
Definition: ikev2_priv.h:234
typedef key
Definition: ipsec.api:247
ikev2_ts_t * tsr
Definition: ikev2_priv.h:139
void ikev2_payload_add_notify_2(ikev2_payload_chain_t *c, u16 msg_type, u8 *data, ikev2_notify_t *notify)
ikev2_child_sa_t * childs
Definition: ikev2_priv.h:256
ikev2_transform_prf_type_t prf_type
Definition: ikev2_priv.h:74
void ikev2_parse_vendor_payload(ike_payload_header_t *ikep)
int ikev2_encrypt_data(ikev2_sa_t *sa, v8 *src, u8 *dst)
Definition: ikev2_crypto.c:425
void ikev2_payload_add_delete(ikev2_payload_chain_t *c, ikev2_delete_t *d)
ikev2_transform_prf_type_t
Definition: ikev2.h:244
uword * sa_by_ispi
Definition: ikev2_priv.h:290
u8 unsupported_cp
Definition: ikev2_priv.h:200
u8 is_profile_index_set
Definition: ikev2_priv.h:253
void ikev2_sa_free_proposal_vector(ikev2_sa_proposal_t **v)
Definition: ikev2.c:227
u32 profile_index
Definition: ikev2_priv.h:254
ikev2_transform_type_t
Definition: ikev2.h:203
ikev2_transforms_set esp_ts
Definition: ikev2_priv.h:190
void ikev2_generate_dh(ikev2_sa_t *sa, ikev2_sa_transform_t *t)
Definition: ikev2_crypto.c:462
vlib_main_t * vlib_main
Definition: ikev2_priv.h:284
ikev2_state_t
Definition: ikev2_priv.h:41