15 #ifndef __included_ikev2_priv_h__ 16 #define __included_ikev2_priv_h__ 28 #include <openssl/rand.h> 29 #include <openssl/dh.h> 30 #include <openssl/hmac.h> 31 #include <openssl/evp.h> 33 #define foreach_ikev2_log_level \ 36 _(0x02, LOG_WARNING) \ 44 #define _(n,f) IKEV2_##f = n, 51 #define _ikev2_elog(_level, _msg) \ 53 ikev2_main_t *km = &ikev2_main; \ 54 if (PREDICT_FALSE (km->log_level >= _level)) \ 56 ELOG_TYPE_DECLARE (e) = \ 58 .format = "ikev2 " _msg, \ 61 ELOG_DATA (&vlib_global_main.elog_main, e); \ 65 #define ikev2_elog_sa_state(_format, _ispi) \ 67 ikev2_main_t *km = &ikev2_main; \ 68 if (PREDICT_FALSE (km->log_level >= IKEV2_LOG_DEBUG)) \ 70 ELOG_TYPE_DECLARE (e) = \ 72 .format = "ikev2: " _format, \ 73 .format_args = "i8", \ 79 ed = ELOG_DATA (&vlib_global_main.elog_main, e); \ 84 #define ikev2_elog_exchange_internal(_format, _ispi, _rspi, _addr) \ 86 ikev2_main_t *km = &ikev2_main; \ 87 if (PREDICT_FALSE (km->log_level >= IKEV2_LOG_DEBUG)) \ 89 ELOG_TYPE_DECLARE (e) = \ 91 .format = "ikev2: " _format, \ 92 .format_args = "i8i8i1i1i1i1", \ 103 ed = ELOG_DATA (&vlib_global_main.elog_main, e); \ 106 ed->oct4 = (_addr) >> 24; \ 107 ed->oct3 = (_addr) >> 16; \ 108 ed->oct2 = (_addr) >> 8; \ 109 ed->oct1 = (_addr); \ 113 #define IKE_ELOG_IP4_FMT "%d.%d.%d.%d" 114 #define IKE_ELOG_IP6_FMT "[v6]:%x%x:%x%x" 116 #define ikev2_elog_exchange(_fmt, _ispi, _rspi, _addr, _v4) \ 119 ikev2_elog_exchange_internal (_fmt IKE_ELOG_IP4_FMT, _ispi, _rspi, _addr);\ 121 ikev2_elog_exchange_internal (_fmt IKE_ELOG_IP6_FMT, _ispi, _rspi, _addr);\ 124 #define ikev2_elog_uint(_level, _format, _val) \ 126 ikev2_main_t *km = &ikev2_main; \ 127 if (PREDICT_FALSE (km->log_level >= _level)) \ 129 ELOG_TYPE_DECLARE (e) = \ 131 .format = "ikev2: " _format, \ 132 .format_args = "i8", \ 138 ed = ELOG_DATA (&vlib_global_main.elog_main, e); \ 143 #define ikev2_elog_uint_peers(_level, _format, _val, _ip1, _ip2) \ 145 ikev2_main_t *km = &ikev2_main; \ 146 if (PREDICT_FALSE (km->log_level >= _level)) \ 148 ELOG_TYPE_DECLARE (e) = \ 150 .format = "ikev2: " _format, \ 151 .format_args = "i8i1i1i1i1i1i1i1i1", \ 153 CLIB_PACKED(struct { \ 155 u8 i11; u8 i12; u8 i13; u8 i14; \ 156 u8 i21; u8 i22; u8 i23; u8 i24; }) *ed; \ 157 ed = ELOG_DATA (&vlib_global_main.elog_main, e); \ 159 ed->i14 = (_ip1) >> 24; \ 160 ed->i13 = (_ip1) >> 16; \ 161 ed->i12 = (_ip1) >> 8; \ 163 ed->i24 = (_ip2) >> 24; \ 164 ed->i23 = (_ip2) >> 16; \ 165 ed->i22 = (_ip2) >> 8; \ 170 #define ikev2_elog_error(_msg) \ 171 _ikev2_elog(IKEV2_LOG_ERROR, "[error] " _msg) 172 #define ikev2_elog_warning(_msg) \ 173 _ikev2_elog(IKEV2_LOG_WARNING, "[warning] " _msg) 174 #define ikev2_elog_debug(_msg) \ 175 _ikev2_elog(IKEV2_LOG_DEBUG, "[debug] " _msg) 176 #define ikev2_elog_detail(_msg) \ 177 _ikev2_elog(IKEV2_LOG_DETAIL, "[detail] " _msg) 180 #define ikev2_log_error(...) \ 181 vlib_log(VLIB_LOG_LEVEL_ERR, ikev2_main.log_class, __VA_ARGS__) 182 #define ikev2_log_warning(...) \ 183 vlib_log(VLIB_LOG_LEVEL_WARNING, ikev2_main.log_class, __VA_ARGS__) 184 #define ikev2_log_debug(...) \ 185 vlib_log(VLIB_LOG_LEVEL_DEBUG, ikev2_main.log_class, __VA_ARGS__) 366 #define ikev2_natt_active(_sa) ((_sa)->natt_state == IKEV2_NATT_ACTIVE) 464 #if OPENSSL_VERSION_NUMBER < 0x10100000L 466 EVP_CIPHER_CTX _evp_ctx;
540 u32 aad_len,
u8 * tag);
544 u8 * tag,
u32 * out_len);
561 #define ikev2_payload_new_chain(V) vec_validate (V, 0) 562 #define ikev2_payload_destroy_chain(V) do { \ 563 vec_free((V)->data); \ ikev2_main_per_thread_data_t * per_thread_data
void ikev2_payload_add_sa(ikev2_payload_chain_t *c, ikev2_sa_proposal_t *proposals)
int ikev2_decrypt_aead_data(ikev2_main_per_thread_data_t *ptd, ikev2_sa_t *sa, ikev2_sa_transform_t *tr_encr, u8 *data, int data_len, u8 *aad, u32 aad_len, u8 *tag, u32 *out_len)
#define CLIB_CACHE_LINE_ALIGN_MARK(mark)
ikev2_transforms_set ike_ts
void ikev2_payload_add_notify(ikev2_payload_chain_t *c, u16 msg_type, u8 *data)
ikev2_transform_integ_type_t
ikev2_natt_state_t natt_state
ikev2_ts_t * ikev2_parse_ts_payload(ike_payload_header_t *ikep, u32 rlen)
ikev2_traffic_selector_type_t ts_type
int ikev2_encrypt_aead_data(ikev2_main_per_thread_data_t *ptd, ikev2_sa_t *sa, ikev2_sa_transform_t *tr_encr, v8 *src, u8 *dst, u8 *aad, u32 aad_len, u8 *tag)
u8 * ikev2_calc_prfplus(ikev2_sa_transform_t *tr, u8 *key, u8 *seed, int len)
ikev2_notify_t * ikev2_parse_notify_payload(ike_payload_header_t *ikep, u32 rlen)
ikev2_sa_transform_t * ikev2_sa_get_td_for_type(ikev2_sa_proposal_t *p, ikev2_transform_type_t type)
ikev2_profile_t * profiles
u32 current_remote_id_mask
ikev2_traffic_selector_type_t
void ikev2_payload_add_id(ikev2_payload_chain_t *c, ikev2_id_t *id, u8 type)
ikev2_delete_t * ikev2_parse_delete_payload(ike_payload_header_t *ikep, u32 rlen)
u8 * last_sa_init_res_packet_data
u8 init_response_received
ikev2_transform_dh_type_t
EVP_PKEY * ikev2_load_cert_file(u8 *file)
void ikev2_payload_add_ts(ikev2_payload_chain_t *c, ikev2_ts_t *ts, u8 type)
#define static_always_inline
ikev2_sa_proposal_t * r_proposals
ikev2_sa_proposal_t * ikev2_parse_sa_payload(ike_payload_header_t *ikep, u32 rlen)
#define vec_elt_at_index(v, i)
Get vector value at index i checking that i is in bounds.
EVP_PKEY * ikev2_load_key_file(u8 *file)
ikev2_sa_proposal_t * i_proposals
int ikev2_verify_sign(EVP_PKEY *pkey, u8 *sigbuf, u8 *data)
ikev2_sa_transform_t * transforms
ikev2_responder_t responder
vl_api_fib_path_type_t type
u8 * last_sa_init_req_packet_data
int ikev2_set_log_level(ikev2_log_level_t log_level)
ikev2_sa_proposal_t * i_proposals
mhash_t profile_index_by_name
ikev2_sa_transform_t * supported_transforms
void ikev2_payload_chain_add_padding(ikev2_payload_chain_t *c, int bs)
static_always_inline ikev2_main_per_thread_data_t * ikev2_get_per_thread_data()
u8 * ikev2_calc_sign(EVP_PKEY *pkey, u8 *data)
v8 * ikev2_calc_prf(ikev2_sa_transform_t *tr, v8 *key, v8 *data)
The fine-grained event logger allows lightweight, thread-safe event logging at minimum cost...
static_always_inline uword vlib_get_thread_index(void)
ikev2_auth_method_t method
ikev2_transform_encr_type_t
void ikev2_payload_add_nonce(ikev2_payload_chain_t *c, u8 *nonce)
ikev2_sa_proposal_t * r_proposals
enum ikev2_log_level_t_ ikev2_log_level_t
ikev2_protocol_id_t protocol_id
f64 liveness_period_check
void ikev2_complete_dh(ikev2_sa_t *sa, ikev2_sa_transform_t *t)
ikev2_transform_esn_type_t
ikev2_sa_proposal_t * r_proposal
v8 * ikev2_calc_integr(ikev2_sa_transform_t *tr, v8 *key, u8 *data, int len)
ikev2_log_level_t log_level
ikev2_sa_proposal_t * i_proposal
void ikev2_crypto_init(ikev2_main_t *km)
int ikev2_decrypt_data(ikev2_main_per_thread_data_t *ptd, ikev2_sa_t *sa, ikev2_sa_transform_t *tr_encr, u8 *data, int len, u32 *out_len)
u8 * last_res_packet_data
u8 * ikev2_find_ike_notify_payload(ike_header_t *ike, u32 msg_type)
void ikev2_payload_add_auth(ikev2_payload_chain_t *c, ikev2_auth_t *auth)
void ikev2_payload_add_ke(ikev2_payload_chain_t *c, u16 dh_group, u8 *dh_data)
void ikev2_payload_add_notify_2(ikev2_payload_chain_t *c, u16 msg_type, u8 *data, ikev2_notify_t *notify)
ikev2_child_sa_t * childs
vlib_log_class_t log_class
void ikev2_parse_vendor_payload(ike_payload_header_t *ikep)
void ikev2_payload_add_delete(ikev2_payload_chain_t *c, ikev2_delete_t *d)
ikev2_transform_prf_type_t
void ikev2_sa_free_proposal_vector(ikev2_sa_proposal_t **v)
#define foreach_ikev2_log_level
ikev2_transforms_set esp_ts
void ikev2_disable_dpd(void)
void ikev2_generate_dh(ikev2_sa_t *sa, ikev2_sa_transform_t *t)
int ikev2_encrypt_data(ikev2_main_per_thread_data_t *ptd, ikev2_sa_t *sa, ikev2_sa_transform_t *tr_encr, v8 *src, u8 *dst)
clib_error_t * ikev2_profile_natt_disable(u8 *name)