FD.io VPP  v20.09-64-g4f7b92f0a
Vector Packet Processing
ikev2.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2015 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include <vlib/vlib.h>
17 #include <vlib/unix/plugin.h>
18 #include <vlibmemory/api.h>
19 #include <vpp/app/version.h>
20 #include <vnet/vnet.h>
21 #include <vnet/pg/pg.h>
22 #include <vppinfra/error.h>
23 #include <vppinfra/random.h>
24 #include <vnet/udp/udp.h>
25 #include <vnet/ipsec/ipsec.h>
26 #include <vnet/ipsec/ipsec_tun.h>
27 #include <vnet/ipip/ipip.h>
28 #include <plugins/ikev2/ikev2.h>
30 #include <openssl/sha.h>
31 #include <vnet/ipsec/ipsec_punt.h>
32 
33 #define IKEV2_LIVENESS_RETRIES 3
34 #define IKEV2_LIVENESS_PERIOD_CHECK 30
35 
37 
39  ikev2_sa_t * sa,
40  ikev2_child_sa_t * child);
41 
42 #define ikev2_set_state(sa, v) do { \
43  (sa)->state = v; \
44  ikev2_elog_sa_state("ispi %lx SA state changed to " #v, sa->ispi); \
45  } while(0);
46 
47 typedef struct
48 {
52 
53 static u8 *
54 format_ikev2_trace (u8 * s, va_list * args)
55 {
56  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
57  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
58  ikev2_trace_t *t = va_arg (*args, ikev2_trace_t *);
59 
60  s = format (s, "ikev2: sw_if_index %d, next index %d",
61  t->sw_if_index, t->next_index);
62  return s;
63 }
64 
65 #define IKEV2_GENERATE_SA_INIT_OK_str ""
66 #define IKEV2_GENERATE_SA_INIT_OK_ERR_NO_DH_STR \
67  "no DH group configured for IKE proposals!"
68 #define IKEV2_GENERATE_SA_INIT_OK_ERR_UNSUPP_STR \
69  "DH group not supported!"
70 
71 typedef enum
72 {
77 
78 static u8 *
79 format_ikev2_gen_sa_error (u8 * s, va_list * args)
80 {
82  switch (e)
83  {
85  break;
88  break;
91  break;
92  }
93  return s;
94 }
95 
96 #define foreach_ikev2_error \
97 _(PROCESSED, "IKEv2 packets processed") \
98 _(IKE_SA_INIT_RETRANSMIT, "IKE_SA_INIT retransmit ") \
99 _(IKE_SA_INIT_IGNORE, "IKE_SA_INIT ignore (IKE SA already auth)") \
100 _(IKE_REQ_RETRANSMIT, "IKE request retransmit") \
101 _(IKE_REQ_IGNORE, "IKE request ignore (old msgid)") \
102 _(NOT_IKEV2, "Non IKEv2 packets received") \
103 _(BAD_LENGTH, "Bad packet length") \
104 _(MALFORMED_PACKET, "Malformed packet") \
105 _(NO_BUFF_SPACE, "No buffer space")
106 
107 typedef enum
108 {
109 #define _(sym,str) IKEV2_ERROR_##sym,
111 #undef _
113 } ikev2_error_t;
114 
115 static char *ikev2_error_strings[] = {
116 #define _(sym,string) string,
118 #undef _
119 };
120 
121 typedef enum
122 {
127 
128 typedef enum
129 {
134 
136 
139 {
141 }
142 
144 ikev2_insert_non_esp_marker (ike_header_t * ike, int len)
145 {
146  memmove ((u8 *) ike + sizeof (ikev2_non_esp_marker), ike, len);
147  clib_memset (ike, 0, sizeof (ikev2_non_esp_marker));
148  return len + sizeof (ikev2_non_esp_marker);
149 }
150 
151 static ikev2_sa_transform_t *
153 {
154  ikev2_main_t *km = &ikev2_main;
156 
158  {
159  if (td->type != t->type)
160  continue;
161 
162  if (td->transform_id != t->transform_id)
163  continue;
164 
165  if (td->type == IKEV2_TRANSFORM_TYPE_ENCR)
166  {
167  if (vec_len (t->attrs) != 4 || t->attrs[0] != 0x80
168  || t->attrs[1] != 14)
169  continue;
170 
171  if (((t->attrs[2] << 8 | t->attrs[3]) / 8) != td->key_len)
172  continue;
173  }
174  return td;
175  }
176  return 0;
177 }
178 
179 static ikev2_sa_proposal_t *
181  ikev2_protocol_id_t prot_id)
182 {
183  ikev2_sa_proposal_t *rv = 0;
184  ikev2_sa_proposal_t *proposal;
185  ikev2_sa_transform_t *transform, *new_t;
186  u8 mandatory_bitmap, optional_bitmap;
187 
188  if (prot_id == IKEV2_PROTOCOL_IKE)
189  {
190  mandatory_bitmap = (1 << IKEV2_TRANSFORM_TYPE_ENCR) |
191  (1 << IKEV2_TRANSFORM_TYPE_PRF) | (1 << IKEV2_TRANSFORM_TYPE_DH);
192  optional_bitmap = mandatory_bitmap | (1 << IKEV2_TRANSFORM_TYPE_INTEG);
193  }
194  else if (prot_id == IKEV2_PROTOCOL_ESP)
195  {
196  mandatory_bitmap = (1 << IKEV2_TRANSFORM_TYPE_ENCR) |
197  (1 << IKEV2_TRANSFORM_TYPE_ESN);
198  optional_bitmap = mandatory_bitmap |
199  (1 << IKEV2_TRANSFORM_TYPE_INTEG) | (1 << IKEV2_TRANSFORM_TYPE_DH);
200  }
201  else if (prot_id == IKEV2_PROTOCOL_AH)
202  {
203  mandatory_bitmap = (1 << IKEV2_TRANSFORM_TYPE_INTEG) |
204  (1 << IKEV2_TRANSFORM_TYPE_ESN);
205  optional_bitmap = mandatory_bitmap | (1 << IKEV2_TRANSFORM_TYPE_DH);
206  }
207  else
208  return 0;
209 
210  vec_add2 (rv, proposal, 1);
211 
212  vec_foreach (proposal, proposals)
213  {
214  u8 bitmap = 0;
215  if (proposal->protocol_id != prot_id)
216  continue;
217 
218  vec_foreach (transform, proposal->transforms)
219  {
220  if ((1 << transform->type) & bitmap)
221  continue;
222 
223  if (ikev2_find_transform_data (transform))
224  {
225  bitmap |= 1 << transform->type;
226  vec_add2 (rv->transforms, new_t, 1);
227  clib_memcpy_fast (new_t, transform, sizeof (*new_t));
228  new_t->attrs = vec_dup (transform->attrs);
229  }
230  }
231 
232  if ((bitmap & mandatory_bitmap) == mandatory_bitmap &&
233  (bitmap & ~optional_bitmap) == 0)
234  {
235  rv->proposal_num = proposal->proposal_num;
236  rv->protocol_id = proposal->protocol_id;
237  RAND_bytes ((u8 *) & rv->spi, sizeof (rv->spi));
238  goto done;
239  }
240  else
241  {
242  vec_free (rv->transforms);
243  }
244  }
245 
246  vec_free (rv);
247 done:
248  return rv;
249 }
250 
254 {
256 
257  if (!p)
258  return 0;
259 
260  vec_foreach (t, p->transforms)
261  {
262  if (t->type == type)
263  return ikev2_find_transform_data (t);
264  }
265  return 0;
266 }
267 
270  int by_initiator)
271 {
273  vec_foreach (c, sa->childs)
274  {
275  ikev2_sa_proposal_t *proposal =
276  by_initiator ? &c->i_proposals[0] : &c->r_proposals[0];
277  if (proposal && proposal->spi == spi && proposal->protocol_id == prot_id)
278  return c;
279  }
280 
281  return 0;
282 }
283 
284 void
286 {
289 
290  if (!*v)
291  return;
292 
293  vec_foreach (p, *v)
294  {
295  vec_foreach (t, p->transforms)
296  {
297  vec_free (t->attrs);
298  }
299  vec_free (p->transforms);
300  }
301  vec_free (*v);
302 }
303 
304 static void
306 {
309  vec_free (c->sk_ai);
310  vec_free (c->sk_ar);
311  vec_free (c->sk_ei);
312  vec_free (c->sk_er);
313  vec_free (c->tsi);
314  vec_free (c->tsr);
315 }
316 
317 static void
319 {
321  vec_foreach (c, *childs) ikev2_sa_free_child_sa (c);
322 
323  vec_free (*childs);
324 }
325 
326 static void
328 {
329  ikev2_sa_free_child_sa (child);
330  vec_del1 (sa->childs, child - sa->childs);
331 }
332 
333 static void
335 {
336  vec_free (sa->i_nonce);
337  vec_free (sa->r_nonce);
338 
339  vec_free (sa->dh_shared_key);
340  vec_free (sa->dh_private_key);
341  vec_free (sa->i_dh_data);
342  vec_free (sa->r_dh_data);
343 
346 
347  vec_free (sa->sk_d);
348  vec_free (sa->sk_ai);
349  vec_free (sa->sk_ar);
350  vec_free (sa->sk_ei);
351  vec_free (sa->sk_er);
352  vec_free (sa->sk_pi);
353  vec_free (sa->sk_pr);
354 
355  vec_free (sa->i_id.data);
356  vec_free (sa->r_id.data);
357 
358  vec_free (sa->i_auth.data);
359  if (sa->i_auth.key)
360  EVP_PKEY_free (sa->i_auth.key);
361  vec_free (sa->r_auth.data);
362  if (sa->r_auth.key)
363  EVP_PKEY_free (sa->r_auth.key);
364 
365  vec_free (sa->del);
366 
367  vec_free (sa->rekey);
368 
371 
373 
375 }
376 
377 static void
379 {
380  uword *p;
381 
383 
384  p = hash_get (ptd->sa_by_rspi, sa->rspi);
385  if (p)
386  {
387  hash_unset (ptd->sa_by_rspi, sa->rspi);
388  pool_put (ptd->sas, sa);
389  }
390 }
391 
394 {
395  ikev2_sa_transform_t *t = 0, *t2;
396  ikev2_main_t *km = &ikev2_main;
397 
398  if (sa->dh_group == IKEV2_TRANSFORM_DH_TYPE_NONE)
400 
401  /* check if received DH group is on our list of supported groups */
403  {
404  if (t2->type == IKEV2_TRANSFORM_TYPE_DH && sa->dh_group == t2->dh_type)
405  {
406  t = t2;
407  break;
408  }
409  }
410 
411  if (!t)
412  {
413  sa->dh_group = IKEV2_TRANSFORM_DH_TYPE_NONE;
415  }
416 
417  if (sa->is_initiator)
418  {
419  /* generate rspi */
420  RAND_bytes ((u8 *) & sa->ispi, 8);
421 
422  /* generate nonce */
424  RAND_bytes ((u8 *) sa->i_nonce, IKEV2_NONCE_SIZE);
425  }
426  else
427  {
428  /* generate rspi */
429  RAND_bytes ((u8 *) & sa->rspi, 8);
430 
431  /* generate nonce */
433  RAND_bytes ((u8 *) sa->r_nonce, IKEV2_NONCE_SIZE);
434  }
435 
436  /* generate dh keys */
437  ikev2_generate_dh (sa, t);
438 
440 }
441 
442 static void
444 {
445  ikev2_sa_transform_t *t = 0, *t2;
446  ikev2_main_t *km = &ikev2_main;
447 
448  /*move some data to the new SA */
449 #define _(A) ({void* __tmp__ = (A); (A) = 0; __tmp__;})
450  sa->i_nonce = _(sai->i_nonce);
451  sa->i_dh_data = _(sai->i_dh_data);
452  sa->dh_private_key = _(sai->dh_private_key);
453  ip_address_copy (&sa->iaddr, &sai->iaddr);
454  ip_address_copy (&sa->raddr, &sai->raddr);
455  sa->is_initiator = sai->is_initiator;
456  sa->i_id.type = sai->i_id.type;
457  sa->r_id.type = sai->r_id.type;
458  sa->profile_index = sai->profile_index;
459  sa->tun_itf = sai->tun_itf;
460  sa->is_tun_itf_set = sai->is_tun_itf_set;
461  if (sai->natt_state == IKEV2_NATT_DISABLED)
463  sa->i_id.data = _(sai->i_id.data);
464  sa->r_id.data = _(sai->r_id.data);
465  sa->i_auth.method = sai->i_auth.method;
466  sa->i_auth.hex = sai->i_auth.hex;
467  sa->i_auth.data = _(sai->i_auth.data);
468  sa->i_auth.key = _(sai->i_auth.key);
471  sa->childs = _(sai->childs);
472  sa->udp_encap = sai->udp_encap;
474  sa->dst_port = sai->dst_port;
475  sa->sw_if_index = sai->sw_if_index;
476 #undef _
477 
478 
479  if (sa->dh_group == IKEV2_TRANSFORM_DH_TYPE_NONE)
480  {
481  return;
482  }
483 
484  /* check if received DH group is on our list of supported groups */
486  {
487  if (t2->type == IKEV2_TRANSFORM_TYPE_DH && sa->dh_group == t2->dh_type)
488  {
489  t = t2;
490  break;
491  }
492  }
493 
494  if (!t)
495  {
496  sa->dh_group = IKEV2_TRANSFORM_DH_TYPE_NONE;
497  return;
498  }
499 
500 
501  /* generate dh keys */
502  ikev2_complete_dh (sa, t);
503 
504 }
505 
506 static void
508 {
509  u8 *tmp;
510  /* calculate SKEYSEED = prf(Ni | Nr, g^ir) */
511  u8 *skeyseed = 0;
512  u8 *s = 0;
513  u16 integ_key_len = 0, salt_len = 0;
514  ikev2_sa_transform_t *tr_encr, *tr_prf, *tr_integ;
515  tr_encr =
516  ikev2_sa_get_td_for_type (sa->r_proposals, IKEV2_TRANSFORM_TYPE_ENCR);
517  tr_prf =
518  ikev2_sa_get_td_for_type (sa->r_proposals, IKEV2_TRANSFORM_TYPE_PRF);
519  tr_integ =
520  ikev2_sa_get_td_for_type (sa->r_proposals, IKEV2_TRANSFORM_TYPE_INTEG);
521 
522  if (tr_integ)
523  integ_key_len = tr_integ->key_len;
524  else
525  salt_len = sizeof (u32);
526 
527  vec_append (s, sa->i_nonce);
528  vec_append (s, sa->r_nonce);
529  skeyseed = ikev2_calc_prf (tr_prf, s, sa->dh_shared_key);
530 
531  /* Calculate S = Ni | Nr | SPIi | SPIr */
532  u64 *spi;
533  vec_add2 (s, tmp, 2 * sizeof (*spi));
534  spi = (u64 *) tmp;
535  spi[0] = clib_host_to_net_u64 (sa->ispi);
536  spi[1] = clib_host_to_net_u64 (sa->rspi);
537 
538  /* calculate PRFplus */
539  u8 *keymat;
540  int len = tr_prf->key_trunc + /* SK_d */
541  integ_key_len * 2 + /* SK_ai, SK_ar */
542  tr_encr->key_len * 2 + /* SK_ei, SK_er */
543  tr_prf->key_len * 2 + /* SK_pi, SK_pr */
544  salt_len * 2;
545 
546  keymat = ikev2_calc_prfplus (tr_prf, skeyseed, s, len);
547  vec_free (skeyseed);
548  vec_free (s);
549 
550  int pos = 0;
551 
552  /* SK_d */
553  sa->sk_d = vec_new (u8, tr_prf->key_trunc);
554  clib_memcpy_fast (sa->sk_d, keymat + pos, tr_prf->key_trunc);
555  pos += tr_prf->key_trunc;
556 
557  if (integ_key_len)
558  {
559  /* SK_ai */
560  sa->sk_ai = vec_new (u8, integ_key_len);
561  clib_memcpy_fast (sa->sk_ai, keymat + pos, integ_key_len);
562  pos += integ_key_len;
563 
564  /* SK_ar */
565  sa->sk_ar = vec_new (u8, integ_key_len);
566  clib_memcpy_fast (sa->sk_ar, keymat + pos, integ_key_len);
567  pos += integ_key_len;
568  }
569 
570  /* SK_ei */
571  sa->sk_ei = vec_new (u8, tr_encr->key_len + salt_len);
572  clib_memcpy_fast (sa->sk_ei, keymat + pos, tr_encr->key_len + salt_len);
573  pos += tr_encr->key_len + salt_len;
574 
575  /* SK_er */
576  sa->sk_er = vec_new (u8, tr_encr->key_len + salt_len);
577  clib_memcpy_fast (sa->sk_er, keymat + pos, tr_encr->key_len + salt_len);
578  pos += tr_encr->key_len + salt_len;
579 
580  /* SK_pi */
581  sa->sk_pi = vec_new (u8, tr_prf->key_len);
582  clib_memcpy_fast (sa->sk_pi, keymat + pos, tr_prf->key_len);
583  pos += tr_prf->key_len;
584 
585  /* SK_pr */
586  sa->sk_pr = vec_new (u8, tr_prf->key_len);
587  clib_memcpy_fast (sa->sk_pr, keymat + pos, tr_prf->key_len);
588  pos += tr_prf->key_len;
589 
590  vec_free (keymat);
591  sa->keys_generated = 1;
592 }
593 
594 static void
596 {
597  u8 *s = 0;
598  u16 integ_key_len = 0;
599  u8 salt_len = 0;
600 
601  ikev2_sa_transform_t *tr_prf, *ctr_encr, *ctr_integ;
602  tr_prf =
603  ikev2_sa_get_td_for_type (sa->r_proposals, IKEV2_TRANSFORM_TYPE_PRF);
604  ctr_encr =
605  ikev2_sa_get_td_for_type (child->r_proposals, IKEV2_TRANSFORM_TYPE_ENCR);
606  ctr_integ =
607  ikev2_sa_get_td_for_type (child->r_proposals, IKEV2_TRANSFORM_TYPE_INTEG);
608 
609  if (ctr_integ)
610  integ_key_len = ctr_integ->key_len;
611  else
612  salt_len = sizeof (u32);
613 
614  vec_append (s, sa->i_nonce);
615  vec_append (s, sa->r_nonce);
616  /* calculate PRFplus */
617  u8 *keymat;
618  int len = ctr_encr->key_len * 2 + integ_key_len * 2 + salt_len * 2;
619 
620  keymat = ikev2_calc_prfplus (tr_prf, sa->sk_d, s, len);
621 
622  int pos = 0;
623 
624  /* SK_ei */
625  child->sk_ei = vec_new (u8, ctr_encr->key_len);
626  clib_memcpy_fast (child->sk_ei, keymat + pos, ctr_encr->key_len);
627  pos += ctr_encr->key_len;
628 
629  if (ctr_integ)
630  {
631  /* SK_ai */
632  child->sk_ai = vec_new (u8, ctr_integ->key_len);
633  clib_memcpy_fast (child->sk_ai, keymat + pos, ctr_integ->key_len);
634  pos += ctr_integ->key_len;
635  }
636  else
637  {
638  clib_memcpy (&child->salt_ei, keymat + pos, salt_len);
639  pos += salt_len;
640  }
641 
642  /* SK_er */
643  child->sk_er = vec_new (u8, ctr_encr->key_len);
644  clib_memcpy_fast (child->sk_er, keymat + pos, ctr_encr->key_len);
645  pos += ctr_encr->key_len;
646 
647  if (ctr_integ)
648  {
649  /* SK_ar */
650  child->sk_ar = vec_new (u8, integ_key_len);
651  clib_memcpy_fast (child->sk_ar, keymat + pos, integ_key_len);
652  pos += integ_key_len;
653  }
654  else
655  {
656  clib_memcpy (&child->salt_er, keymat + pos, salt_len);
657  pos += salt_len;
658  }
659 
660  ASSERT (pos == len);
661 
662  vec_free (keymat);
663 }
664 
667 {
668  const u32 max_buf_size =
669  sizeof (ispi) + sizeof (rspi) + sizeof (ip6_address_t) + sizeof (u16);
670  u8 buf[max_buf_size];
671  u8 *res = vec_new (u8, 20);
672 
673  clib_memcpy_fast (&buf[0], &ispi, sizeof (ispi));
674  clib_memcpy_fast (&buf[8], &rspi, sizeof (rspi));
675  clib_memcpy_fast (&buf[8 + 8], ip_addr_bytes (ia), ip_address_size (ia));
676  clib_memcpy_fast (&buf[8 + 8 + ip_address_size (ia)], &port, sizeof (port));
677  SHA1 (buf, 2 * sizeof (ispi) + sizeof (port) + ip_address_size (ia), res);
678  return res;
679 }
680 
681 static int
682 ikev2_parse_ke_payload (const void *p, u32 rlen, ikev2_sa_t * sa,
683  u8 ** ke_data)
684 {
685  const ike_ke_payload_header_t *ke = p;
686  u16 plen = clib_net_to_host_u16 (ke->length);
687  ASSERT (plen >= sizeof (*ke) && plen <= rlen);
688  if (sizeof (*ke) > rlen)
689  return 0;
690 
691  sa->dh_group = clib_net_to_host_u16 (ke->dh_group);
692  vec_reset_length (ke_data[0]);
693  vec_add (ke_data[0], ke->payload, plen - sizeof (*ke));
694  return 1;
695 }
696 
697 static int
698 ikev2_parse_nonce_payload (const void *p, u32 rlen, u8 * nonce)
699 {
700  const ike_payload_header_t *ikep = p;
701  u16 plen = clib_net_to_host_u16 (ikep->length);
702  ASSERT (plen >= sizeof (*ikep) && plen <= rlen);
703  clib_memcpy_fast (nonce, ikep->payload, plen - sizeof (*ikep));
704  return 1;
705 }
706 
707 static int
708 ikev2_check_payload_length (const ike_payload_header_t * ikep, int rlen,
709  u16 * plen)
710 {
711  if (sizeof (*ikep) > rlen)
712  return 0;
713  *plen = clib_net_to_host_u16 (ikep->length);
714  if (*plen < sizeof (*ikep) || *plen > rlen)
715  return 0;
716  return 1;
717 }
718 
719 static int
721  ikev2_sa_t * sa, ike_header_t * ike,
722  udp_header_t * udp, u32 len)
723 {
724  u8 nonce[IKEV2_NONCE_SIZE];
725  int p = 0;
726  u8 payload = ike->nextpayload;
727  ike_payload_header_t *ikep;
728  u16 plen;
729 
730  ikev2_elog_exchange ("ispi %lx rspi %lx IKE_INIT request received "
731  "from ", clib_net_to_host_u64 (ike->ispi),
732  clib_net_to_host_u64 (ike->rspi),
733  ip_addr_v4 (&sa->iaddr).as_u32,
734  ip_addr_version (&sa->iaddr) == AF_IP4);
735 
736  sa->ispi = clib_net_to_host_u64 (ike->ispi);
737 
738  /* store whole IKE payload - needed for PSK auth */
740  vec_add (sa->last_sa_init_req_packet_data, ike, len);
741 
742  if (len < sizeof (*ike))
743  return 0;
744 
745  len -= sizeof (*ike);
746  while (p < len && payload != IKEV2_PAYLOAD_NONE)
747  {
748  ikep = (ike_payload_header_t *) & ike->payload[p];
749  int current_length = len - p;
750  if (!ikev2_check_payload_length (ikep, current_length, &plen))
751  return 0;
752 
753  if (payload == IKEV2_PAYLOAD_SA)
754  {
756  sa->i_proposals = ikev2_parse_sa_payload (ikep, current_length);
757  }
758  else if (payload == IKEV2_PAYLOAD_KE)
759  {
760  if (!ikev2_parse_ke_payload (ikep, current_length, sa,
761  &sa->i_dh_data))
762  return 0;
763  }
764  else if (payload == IKEV2_PAYLOAD_NONCE)
765  {
767  if (ikev2_parse_nonce_payload (ikep, current_length, nonce))
768  vec_add (sa->i_nonce, nonce, plen - sizeof (*ikep));
769  }
770  else if (payload == IKEV2_PAYLOAD_NOTIFY)
771  {
772  ikev2_notify_t *n =
773  ikev2_parse_notify_payload (ikep, current_length);
774  if (n->msg_type == IKEV2_NOTIFY_MSG_NAT_DETECTION_SOURCE_IP)
775  {
776  u8 *src_sha = ikev2_compute_nat_sha1 (ike->ispi, 0, &sa->iaddr,
777  udp->src_port);
778  if (clib_memcmp (src_sha, n->data, vec_len (src_sha)))
779  {
780  if (sa->natt_state == IKEV2_NATT_ENABLED)
782  ikev2_elog_uint (IKEV2_LOG_DEBUG, "ispi %lx initiator"
783  " behind NAT", sa->ispi);
784  }
785  vec_free (src_sha);
786  }
787  else if (n->msg_type ==
788  IKEV2_NOTIFY_MSG_NAT_DETECTION_DESTINATION_IP)
789  {
790  u8 *dst_sha = ikev2_compute_nat_sha1 (ike->ispi, 0, &sa->raddr,
791  udp->dst_port);
792  if (clib_memcmp (dst_sha, n->data, vec_len (dst_sha)))
793  {
794  if (sa->natt_state == IKEV2_NATT_ENABLED)
796  ikev2_elog_uint (IKEV2_LOG_DEBUG, "ispi %lx responder"
797  " (self) behind NAT", sa->ispi);
798  }
799  vec_free (dst_sha);
800  }
801  vec_free (n);
802  }
803  else if (payload == IKEV2_PAYLOAD_VENDOR)
804  {
806  }
807  else
808  {
809  ikev2_elog_uint (IKEV2_LOG_ERROR, "Unknown payload! type=%d",
810  payload);
811  if (ikep->flags & IKEV2_PAYLOAD_FLAG_CRITICAL)
812  {
814  sa->unsupported_cp = payload;
815  return 0;
816  }
817  }
818 
819  payload = ikep->nextpayload;
820  p += plen;
821  }
822 
824  return 1;
825 }
826 
827 static void
829  ikev2_sa_t * sa, ike_header_t * ike,
830  udp_header_t * udp, u32 len)
831 {
832  u8 nonce[IKEV2_NONCE_SIZE];
833  int p = 0;
834  u8 payload = ike->nextpayload;
835  ike_payload_header_t *ikep;
836  u16 plen;
837 
838  sa->ispi = clib_net_to_host_u64 (ike->ispi);
839  sa->rspi = clib_net_to_host_u64 (ike->rspi);
840 
841  ikev2_elog_exchange ("ispi %lx rspi %lx IKE_INIT response received "
842  "from ", sa->ispi, sa->rspi,
843  ip_addr_v4 (&sa->raddr).as_u32,
844  ip_addr_version (&sa->raddr) == AF_IP4);
845 
846  /* store whole IKE payload - needed for PSK auth */
848  vec_add (sa->last_sa_init_res_packet_data, ike, len);
849 
850  if (sizeof (*ike) > len)
851  return;
852 
853  len -= sizeof (*ike);
854  while (p < len && payload != IKEV2_PAYLOAD_NONE)
855  {
856  int current_length = len - p;
857  ikep = (ike_payload_header_t *) & ike->payload[p];
858  if (!ikev2_check_payload_length (ikep, current_length, &plen))
859  return;
860 
861  if (payload == IKEV2_PAYLOAD_SA)
862  {
864  sa->r_proposals = ikev2_parse_sa_payload (ikep, current_length);
865  if (sa->r_proposals)
866  {
868  ike->msgid =
869  clib_host_to_net_u32 (clib_net_to_host_u32 (ike->msgid) + 1);
870  }
871  }
872  else if (payload == IKEV2_PAYLOAD_KE)
873  {
874  if (!ikev2_parse_ke_payload (ikep, current_length, sa,
875  &sa->r_dh_data))
876  return;
877  }
878  else if (payload == IKEV2_PAYLOAD_NONCE)
879  {
881  if (ikev2_parse_nonce_payload (ikep, current_length, nonce))
882  vec_add (sa->r_nonce, nonce, plen - sizeof (*ikep));
883  }
884  else if (payload == IKEV2_PAYLOAD_NOTIFY)
885  {
886  ikev2_notify_t *n =
887  ikev2_parse_notify_payload (ikep, current_length);
888  if (n->msg_type == IKEV2_NOTIFY_MSG_NAT_DETECTION_SOURCE_IP)
889  {
890  u8 *src_sha = ikev2_compute_nat_sha1 (ike->ispi, ike->rspi,
891  &sa->raddr,
892  udp->src_port);
893  if (clib_memcmp (src_sha, n->data, vec_len (src_sha)))
894  {
895  ikev2_elog_uint (IKEV2_LOG_DEBUG, "ispi %lx responder"
896  " behind NAT, unsupported", sa->ispi);
897  }
898  vec_free (src_sha);
899  }
900  else if (n->msg_type ==
901  IKEV2_NOTIFY_MSG_NAT_DETECTION_DESTINATION_IP)
902  {
903  u8 *dst_sha = ikev2_compute_nat_sha1 (ike->ispi, ike->rspi,
904  &sa->iaddr,
905  udp->dst_port);
906  if (clib_memcmp (dst_sha, n->data, vec_len (dst_sha)))
907  {
908  if (sa->natt_state == IKEV2_NATT_ENABLED)
910  ikev2_elog_uint (IKEV2_LOG_DEBUG, "ispi %lx initiator"
911  " (self) behind NAT", sa->ispi);
912  }
913  vec_free (dst_sha);
914  }
915  vec_free (n);
916  }
917  else if (payload == IKEV2_PAYLOAD_VENDOR)
918  {
920  }
921  else
922  {
923  ikev2_elog_uint (IKEV2_LOG_ERROR, "Unknown payload! type=%d",
924  payload);
925  if (ikep->flags & IKEV2_PAYLOAD_FLAG_CRITICAL)
926  {
928  sa->unsupported_cp = payload;
929  return;
930  }
931  }
932 
933  payload = ikep->nextpayload;
934  p += plen;
935  }
936 }
937 
938 static u8 *
939 ikev2_decrypt_sk_payload (ikev2_sa_t * sa, ike_header_t * ike,
940  u8 * payload, u32 rlen, u32 * out_len)
941 {
943  int p = 0;
944  u8 last_payload = 0, *hmac = 0, *plaintext = 0;
945  ike_payload_header_t *ikep = 0;
946  u16 plen = 0;
947  u32 dlen = 0;
948  ikev2_sa_transform_t *tr_integ;
949  ikev2_sa_transform_t *tr_encr;
950  tr_integ =
951  ikev2_sa_get_td_for_type (sa->r_proposals, IKEV2_TRANSFORM_TYPE_INTEG);
952  tr_encr =
953  ikev2_sa_get_td_for_type (sa->r_proposals, IKEV2_TRANSFORM_TYPE_ENCR);
954  int is_aead = tr_encr->encr_type == IKEV2_TRANSFORM_ENCR_TYPE_AES_GCM_16;
955 
956  if (((!sa->sk_ar || !sa->sk_ai) && !is_aead) || (!sa->sk_ei || !sa->sk_er))
957  return 0;
958 
959  if (rlen <= sizeof (*ike))
960  return 0;
961 
962  int len = rlen - sizeof (*ike);
963  while (p < len &&
964  *payload != IKEV2_PAYLOAD_NONE && last_payload != IKEV2_PAYLOAD_SK)
965  {
966  ikep = (ike_payload_header_t *) & ike->payload[p];
967  int current_length = len - p;
968  if (!ikev2_check_payload_length (ikep, current_length, &plen))
969  return 0;
970 
971  if (*payload == IKEV2_PAYLOAD_SK)
972  {
973  last_payload = *payload;
974  }
975  else
976  {
977  ikev2_elog_uint (IKEV2_LOG_ERROR, "Unknown payload! type=%d",
978  *payload);
979  if (ikep->flags & IKEV2_PAYLOAD_FLAG_CRITICAL)
980  {
981  sa->unsupported_cp = *payload;
982  return 0;
983  }
984  }
985 
986  *payload = ikep->nextpayload;
987  p += plen;
988  }
989 
990  if (last_payload != IKEV2_PAYLOAD_SK)
991  {
992  ikev2_elog_error ("Last payload must be SK");
993  return 0;
994  }
995 
996  if (is_aead)
997  {
998  if (plen < sizeof (*ikep) + IKEV2_GCM_ICV_SIZE)
999  return 0;
1000 
1001  plen -= sizeof (*ikep) + IKEV2_GCM_ICV_SIZE;
1002  u8 *aad = (u8 *) ike;
1003  u32 aad_len = ikep->payload - aad;
1004  u8 *tag = ikep->payload + plen;
1005 
1006  int rc = ikev2_decrypt_aead_data (ptd, sa, tr_encr, ikep->payload,
1007  plen, aad, aad_len, tag, &dlen);
1008  if (rc)
1009  {
1010  *out_len = dlen;
1011  plaintext = ikep->payload + IKEV2_GCM_IV_SIZE;
1012  }
1013  }
1014  else
1015  {
1016  if (rlen < tr_integ->key_trunc)
1017  return 0;
1018 
1019  hmac =
1020  ikev2_calc_integr (tr_integ, sa->is_initiator ? sa->sk_ar : sa->sk_ai,
1021  (u8 *) ike, rlen - tr_integ->key_trunc);
1022 
1023  if (plen < sizeof (*ikep) + tr_integ->key_trunc)
1024  return 0;
1025 
1026  plen = plen - sizeof (*ikep) - tr_integ->key_trunc;
1027 
1028  if (clib_memcmp (hmac, &ikep->payload[plen], tr_integ->key_trunc))
1029  {
1030  ikev2_elog_error ("message integrity check failed");
1031  vec_free (hmac);
1032  return 0;
1033  }
1034  vec_free (hmac);
1035 
1036  int rc = ikev2_decrypt_data (ptd, sa, tr_encr, ikep->payload, plen,
1037  &dlen);
1038  if (rc)
1039  {
1040  *out_len = dlen;
1041  plaintext = ikep->payload + tr_encr->block_size;
1042  }
1043  }
1044 
1045  return plaintext;
1046 }
1047 
1050 {
1051  if (i1->type != i2->type)
1052  return 0;
1053 
1054  if (vec_len (i1->data) != vec_len (i2->data))
1055  return 0;
1056 
1057  if (clib_memcmp (i1->data, i2->data, vec_len (i1->data)))
1058  return 0;
1059 
1060  return 1;
1061 }
1062 
1063 static void
1065  ikev2_sa_t * sa)
1066 {
1067  ikev2_main_t *km = &ikev2_main;
1068  ikev2_sa_t *tmp;
1069  u32 i, *delete = 0;
1071 
1072  /* find old IKE SAs with the same authenticated identity */
1073  /* *INDENT-OFF* */
1074  pool_foreach (tmp, ptd->sas, ({
1075  if (!ikev2_is_id_equal (&tmp->i_id, &sa->i_id)
1076  || !ikev2_is_id_equal(&tmp->r_id, &sa->r_id))
1077  continue;
1078 
1079  if (sa->rspi != tmp->rspi)
1080  vec_add1(delete, tmp - ptd->sas);
1081  }));
1082  /* *INDENT-ON* */
1083 
1084  for (i = 0; i < vec_len (delete); i++)
1085  {
1086  tmp = pool_elt_at_index (ptd->sas, delete[i]);
1087  vec_foreach (c, tmp->childs)
1088  {
1090  }
1091  ikev2_delete_sa (ptd, tmp);
1092  }
1093 
1094  vec_free (delete);
1095  sa->initial_contact = 0;
1096 }
1097 
1098 static void
1100  ikev2_sa_t * sa)
1101 {
1102  ikev2_main_t *km = &ikev2_main;
1103 
1104  if (!sa->initial_contact)
1105  return;
1106 
1107  if (ptd)
1108  {
1110  }
1111  else
1112  {
1113  vec_foreach (ptd, km->per_thread_data)
1115  }
1116  sa->initial_contact = 0;
1117 }
1118 
1119 static int
1120 ikev2_parse_id_payload (const void *p, u16 rlen, ikev2_id_t * sa_id)
1121 {
1122  const ike_id_payload_header_t *id = p;
1123  u16 plen = clib_net_to_host_u16 (id->length);
1124  if (plen < sizeof (*id) || plen > rlen)
1125  return 0;
1126 
1127  sa_id->type = id->id_type;
1128  vec_reset_length (sa_id->data);
1129  vec_add (sa_id->data, id->payload, plen - sizeof (*id));
1130 
1131  return 1;
1132 }
1133 
1134 static int
1135 ikev2_parse_auth_payload (const void *p, u32 rlen, ikev2_auth_t * a)
1136 {
1137  const ike_auth_payload_header_t *ah = p;
1138  u16 plen = clib_net_to_host_u16 (ah->length);
1139 
1140  a->method = ah->auth_method;
1141  vec_reset_length (a->data);
1142  vec_add (a->data, ah->payload, plen - sizeof (*ah));
1143  return 1;
1144 }
1145 
1146 static int
1148  ike_header_t * ike, u32 len)
1149 {
1150  int p = 0;
1151  ikev2_child_sa_t *first_child_sa;
1152  u8 payload = ike->nextpayload;
1153  u8 *plaintext = 0;
1154  ike_payload_header_t *ikep;
1155  u16 plen;
1156  u32 dlen = 0;
1157 
1158  ikev2_elog_exchange ("ispi %lx rspi %lx EXCHANGE_IKE_AUTH received "
1159  "from ", clib_host_to_net_u64 (ike->ispi),
1160  clib_host_to_net_u64 (ike->rspi),
1161  sa->is_initiator ?
1162  ip_addr_v4 (&sa->raddr).as_u32 :
1163  ip_addr_v4 (&sa->iaddr).as_u32,
1164  ip_addr_version (&sa->raddr) == AF_IP4);
1165 
1166  ikev2_calc_keys (sa);
1167 
1168  plaintext = ikev2_decrypt_sk_payload (sa, ike, &payload, len, &dlen);
1169 
1170  if (!plaintext)
1171  {
1172  if (sa->unsupported_cp)
1173  {
1175  return 0;
1176  }
1177  goto malformed;
1178  }
1179 
1180  /* select or create 1st child SA */
1181  if (sa->is_initiator)
1182  {
1183  first_child_sa = &sa->childs[0];
1184  }
1185  else
1186  {
1188  vec_add2 (sa->childs, first_child_sa, 1);
1189  }
1190 
1191 
1192  /* process encrypted payload */
1193  while (p < dlen && payload != IKEV2_PAYLOAD_NONE)
1194  {
1195  ikep = (ike_payload_header_t *) & plaintext[p];
1196  int current_length = dlen - p;
1197  if (!ikev2_check_payload_length (ikep, current_length, &plen))
1198  goto malformed;
1199 
1200  if (payload == IKEV2_PAYLOAD_SA) /* 33 */
1201  {
1202  if (sa->is_initiator)
1203  {
1204  ikev2_sa_free_proposal_vector (&first_child_sa->r_proposals);
1205  first_child_sa->r_proposals = ikev2_parse_sa_payload (ikep,
1206  current_length);
1207  }
1208  else
1209  {
1210  ikev2_sa_free_proposal_vector (&first_child_sa->i_proposals);
1211  first_child_sa->i_proposals = ikev2_parse_sa_payload (ikep,
1212  current_length);
1213  }
1214  }
1215  else if (payload == IKEV2_PAYLOAD_IDI) /* 35 */
1216  {
1217  if (!ikev2_parse_id_payload (ikep, current_length, &sa->i_id))
1218  goto malformed;
1219  }
1220  else if (payload == IKEV2_PAYLOAD_IDR) /* 36 */
1221  {
1222  if (!ikev2_parse_id_payload (ikep, current_length, &sa->r_id))
1223  goto malformed;
1224  }
1225  else if (payload == IKEV2_PAYLOAD_AUTH) /* 39 */
1226  {
1227  if (sa->is_initiator)
1228  {
1229  if (!ikev2_parse_auth_payload (ikep, current_length,
1230  &sa->r_auth))
1231  goto malformed;
1232  }
1233  else
1234  {
1235  if (!ikev2_parse_auth_payload (ikep, current_length,
1236  &sa->i_auth))
1237  goto malformed;
1238  }
1239  }
1240  else if (payload == IKEV2_PAYLOAD_NOTIFY) /* 41 */
1241  {
1242  ikev2_notify_t *n =
1243  ikev2_parse_notify_payload (ikep, current_length);
1244  if (n->msg_type == IKEV2_NOTIFY_MSG_INITIAL_CONTACT)
1245  {
1246  sa->initial_contact = 1;
1247  }
1248  vec_free (n);
1249  }
1250  else if (payload == IKEV2_PAYLOAD_VENDOR) /* 43 */
1251  {
1253  }
1254  else if (payload == IKEV2_PAYLOAD_TSI) /* 44 */
1255  {
1256  vec_free (first_child_sa->tsi);
1257  first_child_sa->tsi = ikev2_parse_ts_payload (ikep, current_length);
1258  }
1259  else if (payload == IKEV2_PAYLOAD_TSR) /* 45 */
1260  {
1261  vec_free (first_child_sa->tsr);
1262  first_child_sa->tsr = ikev2_parse_ts_payload (ikep, current_length);
1263  }
1264  else
1265  {
1266  ikev2_elog_uint (IKEV2_LOG_ERROR, "Unknown payload! type=%d",
1267  payload);
1268 
1269  if (ikep->flags & IKEV2_PAYLOAD_FLAG_CRITICAL)
1270  {
1272  sa->unsupported_cp = payload;
1273  return 0;
1274  }
1275  }
1276 
1277  payload = ikep->nextpayload;
1278  p += plen;
1279  }
1280 
1281  return 1;
1282 
1283 malformed:
1285  return 0;
1286 }
1287 
1288 static int
1290  ikev2_sa_t * sa, ike_header_t * ike, u32 len)
1291 {
1292  int p = 0;
1293  u8 payload = ike->nextpayload;
1294  u8 *plaintext = 0;
1295  ike_payload_header_t *ikep;
1296  u32 dlen = 0;
1297  ikev2_notify_t *n = 0;
1298 
1299  sa->liveness_retries = 0;
1300  ikev2_elog_exchange ("ispi %lx rspi %lx INFORMATIONAL received "
1301  "from ", clib_host_to_net_u64 (ike->ispi),
1302  clib_host_to_net_u64 (ike->rspi),
1303  ip_addr_v4 (&sa->iaddr).as_u32,
1304  ip_addr_version (&sa->iaddr) == AF_IP4);
1305 
1306  plaintext = ikev2_decrypt_sk_payload (sa, ike, &payload, len, &dlen);
1307 
1308  if (!plaintext)
1309  return 0;
1310 
1311  /* process encrypted payload */
1312  p = 0;
1313  while (p < dlen && payload != IKEV2_PAYLOAD_NONE)
1314  {
1315  u32 current_length = dlen - p;
1316  if (p + sizeof (*ikep) > dlen)
1317  return 0;
1318 
1319  ikep = (ike_payload_header_t *) & plaintext[p];
1320  u16 plen = clib_net_to_host_u16 (ikep->length);
1321 
1322  if (plen < sizeof (*ikep) || plen > current_length)
1323  return 0;
1324 
1325  if (payload == IKEV2_PAYLOAD_NOTIFY) /* 41 */
1326  {
1327  n = ikev2_parse_notify_payload (ikep, current_length);
1328  if (!n)
1329  return 0;
1330  if (n->msg_type == IKEV2_NOTIFY_MSG_AUTHENTICATION_FAILED)
1332  vec_free (n);
1333  }
1334  else if (payload == IKEV2_PAYLOAD_DELETE) /* 42 */
1335  {
1336  sa->del = ikev2_parse_delete_payload (ikep, current_length);
1337  }
1338  else if (payload == IKEV2_PAYLOAD_VENDOR) /* 43 */
1339  {
1341  }
1342  else
1343  {
1344  ikev2_elog_uint (IKEV2_LOG_ERROR, "Unknown payload! type=%d",
1345  payload);
1346  if (ikep->flags & IKEV2_PAYLOAD_FLAG_CRITICAL)
1347  {
1348  sa->unsupported_cp = payload;
1349  return 0;
1350  }
1351  }
1352  payload = ikep->nextpayload;
1353  p += plen;
1354  }
1355  return 1;
1356 }
1357 
1358 static int
1360  ikev2_sa_t * sa, ike_header_t * ike,
1361  u32 len)
1362 {
1363  int p = 0;
1364  u8 payload = ike->nextpayload;
1365  u8 *plaintext = 0;
1366  u8 rekeying = 0;
1367  u8 nonce[IKEV2_NONCE_SIZE];
1368 
1369  ike_payload_header_t *ikep;
1370  ikev2_notify_t *n = 0;
1371  ikev2_ts_t *tsi = 0;
1372  ikev2_ts_t *tsr = 0;
1373  ikev2_sa_proposal_t *proposal = 0;
1374  ikev2_child_sa_t *child_sa;
1375  u32 dlen = 0;
1376  u16 plen;
1377 
1378  ikev2_elog_exchange ("ispi %lx rspi %lx CREATE_CHILD_SA received "
1379  "from ", clib_host_to_net_u64 (ike->ispi),
1380  clib_host_to_net_u64 (ike->rspi),
1381  ip_addr_v4 (&sa->raddr).as_u32,
1382  ip_addr_version (&sa->raddr) == AF_IP4);
1383 
1384  plaintext = ikev2_decrypt_sk_payload (sa, ike, &payload, len, &dlen);
1385 
1386  if (!plaintext)
1387  goto cleanup_and_exit;
1388 
1389  /* process encrypted payload */
1390  p = 0;
1391  while (payload != IKEV2_PAYLOAD_NONE)
1392  {
1393  ikep = (ike_payload_header_t *) & plaintext[p];
1394  int current_length = dlen - p;
1395  if (!ikev2_check_payload_length (ikep, current_length, &plen))
1396  goto cleanup_and_exit;
1397 
1398  if (payload == IKEV2_PAYLOAD_SA)
1399  {
1400  proposal = ikev2_parse_sa_payload (ikep, current_length);
1401  }
1402  else if (payload == IKEV2_PAYLOAD_NOTIFY)
1403  {
1404  n = ikev2_parse_notify_payload (ikep, current_length);
1405  if (n->msg_type == IKEV2_NOTIFY_MSG_REKEY_SA)
1406  {
1407  rekeying = 1;
1408  }
1409  }
1410  else if (payload == IKEV2_PAYLOAD_DELETE)
1411  {
1412  sa->del = ikev2_parse_delete_payload (ikep, current_length);
1413  }
1414  else if (payload == IKEV2_PAYLOAD_VENDOR)
1415  {
1417  }
1418  else if (payload == IKEV2_PAYLOAD_NONCE)
1419  {
1420  ikev2_parse_nonce_payload (ikep, current_length, nonce);
1421  }
1422  else if (payload == IKEV2_PAYLOAD_TSI)
1423  {
1424  tsi = ikev2_parse_ts_payload (ikep, current_length);
1425  }
1426  else if (payload == IKEV2_PAYLOAD_TSR)
1427  {
1428  tsr = ikev2_parse_ts_payload (ikep, current_length);
1429  }
1430  else
1431  {
1432  ikev2_elog_uint (IKEV2_LOG_ERROR, "Unknown payload! type=%d",
1433  payload);
1434  if (ikep->flags & IKEV2_PAYLOAD_FLAG_CRITICAL)
1435  {
1436  sa->unsupported_cp = payload;
1437  goto cleanup_and_exit;
1438  }
1439  }
1440  payload = ikep->nextpayload;
1441  p += plen;
1442  }
1443 
1444  if (sa->is_initiator && proposal
1445  && proposal->protocol_id == IKEV2_PROTOCOL_ESP)
1446  {
1447  ikev2_rekey_t *rekey = sa->rekey;
1448  if (vec_len (rekey) == 0)
1449  goto cleanup_and_exit;
1450  rekey->protocol_id = proposal->protocol_id;
1451  rekey->i_proposal =
1453  rekey->i_proposal->spi = rekey->spi;
1454  rekey->r_proposal = proposal;
1455  rekey->tsi = tsi;
1456  rekey->tsr = tsr;
1457  /* update Nr */
1458  vec_reset_length (sa->r_nonce);
1459  vec_add (sa->r_nonce, nonce, IKEV2_NONCE_SIZE);
1460  child_sa = ikev2_sa_get_child (sa, rekey->ispi, IKEV2_PROTOCOL_ESP, 1);
1461  if (child_sa)
1462  {
1463  child_sa->rekey_retries = 0;
1464  }
1465  }
1466  else if (rekeying)
1467  {
1468  ikev2_rekey_t *rekey;
1469  child_sa = ikev2_sa_get_child (sa, n->spi, n->protocol_id, 1);
1470  if (!child_sa)
1471  {
1472  ikev2_elog_uint (IKEV2_LOG_ERROR, "child SA spi %lx not found",
1473  n->spi);
1474  goto cleanup_and_exit;
1475  }
1476  vec_add2 (sa->rekey, rekey, 1);
1477  rekey->protocol_id = n->protocol_id;
1478  rekey->spi = n->spi;
1479  rekey->i_proposal = proposal;
1480  rekey->r_proposal =
1482  rekey->tsi = tsi;
1483  rekey->tsr = tsr;
1484  /* update Ni */
1485  vec_reset_length (sa->i_nonce);
1486  vec_add (sa->i_nonce, nonce, IKEV2_NONCE_SIZE);
1487  /* generate new Nr */
1489  RAND_bytes ((u8 *) sa->r_nonce, IKEV2_NONCE_SIZE);
1490  }
1491  else
1492  goto cleanup_and_exit;
1493  vec_free (n);
1494  return 1;
1495 
1496 cleanup_and_exit:
1497  vec_free (n);
1498  vec_free (proposal);
1499  vec_free (tsr);
1500  vec_free (tsi);
1501  return 0;
1502 }
1503 
1504 static u8 *
1505 ikev2_sa_generate_authmsg (ikev2_sa_t * sa, int is_responder)
1506 {
1507  u8 *authmsg = 0;
1508  u8 *data;
1509  u8 *nonce;
1510  ikev2_id_t *id;
1511  u8 *key;
1512  u8 *packet_data;
1513  ikev2_sa_transform_t *tr_prf;
1514 
1515  tr_prf =
1516  ikev2_sa_get_td_for_type (sa->r_proposals, IKEV2_TRANSFORM_TYPE_PRF);
1517 
1518  if (is_responder)
1519  {
1520  id = &sa->r_id;
1521  key = sa->sk_pr;
1522  nonce = sa->i_nonce;
1523  packet_data = sa->last_sa_init_res_packet_data;
1524  }
1525  else
1526  {
1527  id = &sa->i_id;
1528  key = sa->sk_pi;
1529  nonce = sa->r_nonce;
1530  packet_data = sa->last_sa_init_req_packet_data;
1531  }
1532 
1533  data = vec_new (u8, 4);
1534  data[0] = id->type;
1535  vec_append (data, id->data);
1536 
1537  u8 *id_hash = ikev2_calc_prf (tr_prf, key, data);
1538  vec_append (authmsg, packet_data);
1539  vec_append (authmsg, nonce);
1540  vec_append (authmsg, id_hash);
1541  vec_free (id_hash);
1542  vec_free (data);
1543 
1544  return authmsg;
1545 }
1546 
1547 static int
1549 {
1550  if (ts1->ts_type == ts2->ts_type && ts1->protocol_id == ts2->protocol_id &&
1551  ts1->start_port == ts2->start_port && ts1->end_port == ts2->end_port &&
1552  !ip_address_cmp (&ts1->start_addr, &ts2->start_addr) &&
1553  !ip_address_cmp (&ts1->end_addr, &ts2->end_addr))
1554  return 1;
1555 
1556  return 0;
1557 }
1558 
1559 static void
1561 {
1562  ikev2_main_t *km = &ikev2_main;
1563  ikev2_profile_t *p;
1564  ikev2_ts_t *ts, *p_tsi, *p_tsr, *tsi = 0, *tsr = 0;
1565  ikev2_id_t *id_rem, *id_loc;
1566 
1567  /* *INDENT-OFF* */
1568  pool_foreach (p, km->profiles, ({
1569 
1570  if (sa->is_initiator)
1571  {
1572  p_tsi = &p->loc_ts;
1573  p_tsr = &p->rem_ts;
1574  id_rem = &sa->r_id;
1575  id_loc = &sa->i_id;
1576  }
1577  else
1578  {
1579  p_tsi = &p->rem_ts;
1580  p_tsr = &p->loc_ts;
1581  id_rem = &sa->i_id;
1582  id_loc = &sa->r_id;
1583  }
1584 
1585  /* check id */
1586  if (!ikev2_is_id_equal (&p->rem_id, id_rem)
1587  || !ikev2_is_id_equal (&p->loc_id, id_loc))
1588  continue;
1589 
1590  sa->profile_index = p - km->profiles;
1591 
1592  vec_foreach(ts, sa->childs[0].tsi)
1593  {
1594  if (ikev2_ts_cmp(p_tsi, ts))
1595  {
1596  vec_add1 (tsi, ts[0]);
1597  break;
1598  }
1599  }
1600 
1601  vec_foreach(ts, sa->childs[0].tsr)
1602  {
1603  if (ikev2_ts_cmp(p_tsr, ts))
1604  {
1605  vec_add1 (tsr, ts[0]);
1606  break;
1607  }
1608  }
1609 
1610  break;
1611  }));
1612  /* *INDENT-ON* */
1613 
1614  if (tsi && tsr)
1615  {
1616  vec_free (sa->childs[0].tsi);
1617  vec_free (sa->childs[0].tsr);
1618  sa->childs[0].tsi = tsi;
1619  sa->childs[0].tsr = tsr;
1620  }
1621  else
1622  {
1623  vec_free (tsi);
1624  vec_free (tsr);
1626  }
1627 }
1628 
1629 static void
1631 {
1632  ikev2_main_t *km = &ikev2_main;
1633  ikev2_profile_t *p, *sel_p = 0;
1634  u8 *authmsg, *key_pad, *psk = 0, *auth = 0;
1635  ikev2_sa_transform_t *tr_prf;
1636 
1637  tr_prf =
1638  ikev2_sa_get_td_for_type (sa->r_proposals, IKEV2_TRANSFORM_TYPE_PRF);
1639 
1640  /* only shared key and rsa signature */
1641  if (!(sa->i_auth.method == IKEV2_AUTH_METHOD_SHARED_KEY_MIC ||
1642  sa->i_auth.method == IKEV2_AUTH_METHOD_RSA_SIG))
1643  {
1644  ikev2_elog_uint (IKEV2_LOG_ERROR,
1645  "unsupported authentication method %u",
1646  sa->i_auth.method);
1648  return;
1649  }
1650 
1651  key_pad = format (0, "%s", IKEV2_KEY_PAD);
1652  authmsg = ikev2_sa_generate_authmsg (sa, sa->is_initiator);
1653 
1654  ikev2_id_t *id_rem, *id_loc;
1655  ikev2_auth_t *sa_auth;
1656 
1657  if (sa->is_initiator)
1658  {
1659  id_rem = &sa->r_id;
1660  id_loc = &sa->i_id;
1661  sa_auth = &sa->r_auth;
1662  }
1663  else
1664  {
1665  id_rem = &sa->i_id;
1666  id_loc = &sa->r_id;
1667  sa_auth = &sa->i_auth;
1668  }
1669 
1670  /* *INDENT-OFF* */
1671  pool_foreach (p, km->profiles, ({
1672 
1673  /* check id */
1674  if (!ikev2_is_id_equal (&p->rem_id, id_rem)
1675  || !ikev2_is_id_equal (&p->loc_id, id_loc))
1676  continue;
1677 
1678  if (sa_auth->method == IKEV2_AUTH_METHOD_SHARED_KEY_MIC)
1679  {
1680  if (!p->auth.data ||
1681  p->auth.method != IKEV2_AUTH_METHOD_SHARED_KEY_MIC)
1682  continue;
1683 
1684  psk = ikev2_calc_prf(tr_prf, p->auth.data, key_pad);
1685  auth = ikev2_calc_prf(tr_prf, psk, authmsg);
1686 
1687  if (!clib_memcmp(auth, sa_auth->data, vec_len(sa_auth->data)))
1688  {
1689  ikev2_set_state(sa, IKEV2_STATE_AUTHENTICATED);
1690  vec_free(auth);
1691  sel_p = p;
1692  break;
1693  }
1694 
1695  }
1696  else if (sa_auth->method == IKEV2_AUTH_METHOD_RSA_SIG)
1697  {
1698  if (p->auth.method != IKEV2_AUTH_METHOD_RSA_SIG)
1699  continue;
1700 
1701  if (ikev2_verify_sign(p->auth.key, sa_auth->data, authmsg) == 1)
1702  {
1703  ikev2_set_state(sa, IKEV2_STATE_AUTHENTICATED);
1704  sel_p = p;
1705  break;
1706  }
1707  }
1708 
1709  vec_free(auth);
1710  vec_free(psk);
1711  }));
1712  /* *INDENT-ON* */
1713 
1714  if (sel_p)
1715  {
1716  sa->udp_encap = sel_p->udp_encap;
1717  sa->ipsec_over_udp_port = sel_p->ipsec_over_udp_port;
1718  }
1719  vec_free (authmsg);
1720 
1721  if (sa->state == IKEV2_STATE_AUTHENTICATED)
1722  {
1723  if (!sa->is_initiator)
1724  {
1725  vec_free (sa->r_id.data);
1726  sa->r_id.data = vec_dup (sel_p->loc_id.data);
1727  sa->r_id.type = sel_p->loc_id.type;
1728  sa->i_id.data = vec_dup (sel_p->rem_id.data);
1729  sa->i_id.type = sel_p->rem_id.type;
1730 
1731  /* generate our auth data */
1732  authmsg = ikev2_sa_generate_authmsg (sa, 1);
1733  if (sel_p->auth.method == IKEV2_AUTH_METHOD_SHARED_KEY_MIC)
1734  {
1735  vec_free (sa->r_auth.data);
1736  sa->r_auth.data = ikev2_calc_prf (tr_prf, psk, authmsg);
1737  sa->r_auth.method = IKEV2_AUTH_METHOD_SHARED_KEY_MIC;
1738  }
1739  else if (sel_p->auth.method == IKEV2_AUTH_METHOD_RSA_SIG)
1740  {
1741  vec_free (sa->r_auth.data);
1742  sa->r_auth.data = ikev2_calc_sign (km->pkey, authmsg);
1743  sa->r_auth.method = IKEV2_AUTH_METHOD_RSA_SIG;
1744  }
1745  vec_free (authmsg);
1746 
1747  /* select transforms for 1st child sa */
1748  ikev2_sa_free_proposal_vector (&sa->childs[0].r_proposals);
1749  sa->childs[0].r_proposals =
1750  ikev2_select_proposal (sa->childs[0].i_proposals,
1752 
1753  if (~0 != sel_p->tun_itf)
1754  {
1755  sa->is_tun_itf_set = 1;
1756  sa->tun_itf = sel_p->tun_itf;
1757  }
1758  }
1759  }
1760  else
1761  {
1762  ikev2_elog_uint (IKEV2_LOG_ERROR, "authentication failed, no matching "
1763  "profile found! ispi %lx", sa->ispi);
1765  }
1766  vec_free (psk);
1767  vec_free (key_pad);
1768 }
1769 
1770 
1771 static void
1773 {
1774  ikev2_main_t *km = &ikev2_main;
1775  u8 *authmsg, *key_pad, *psk = 0;
1776  ikev2_sa_transform_t *tr_prf;
1777 
1778  tr_prf =
1779  ikev2_sa_get_td_for_type (sa->r_proposals, IKEV2_TRANSFORM_TYPE_PRF);
1780 
1781  /* only shared key and rsa signature */
1782  if (!(sa->i_auth.method == IKEV2_AUTH_METHOD_SHARED_KEY_MIC ||
1783  sa->i_auth.method == IKEV2_AUTH_METHOD_RSA_SIG))
1784  {
1785  ikev2_elog_uint (IKEV2_LOG_ERROR,
1786  "unsupported authentication method %u",
1787  sa->i_auth.method);
1789  return;
1790  }
1791 
1792  key_pad = format (0, "%s", IKEV2_KEY_PAD);
1793  authmsg = ikev2_sa_generate_authmsg (sa, 0);
1794  psk = ikev2_calc_prf (tr_prf, sa->i_auth.data, key_pad);
1795 
1796  if (sa->i_auth.method == IKEV2_AUTH_METHOD_SHARED_KEY_MIC)
1797  {
1798  vec_free (sa->i_auth.data);
1799  sa->i_auth.data = ikev2_calc_prf (tr_prf, psk, authmsg);
1800  sa->i_auth.method = IKEV2_AUTH_METHOD_SHARED_KEY_MIC;
1801  }
1802  else if (sa->i_auth.method == IKEV2_AUTH_METHOD_RSA_SIG)
1803  {
1804  vec_free (sa->i_auth.data);
1805  sa->i_auth.data = ikev2_calc_sign (km->pkey, authmsg);
1806  sa->i_auth.method = IKEV2_AUTH_METHOD_RSA_SIG;
1807  }
1808 
1809  vec_free (psk);
1810  vec_free (key_pad);
1811  vec_free (authmsg);
1812 }
1813 
1814 static u32
1816 {
1817  return (0x80000000 | (ti << 24) | (sai << 12) | ci);
1818 }
1819 
1820 static u32
1822 {
1823  return (0xc0000000 | (ti << 24) | (sai << 12) | ci);
1824 }
1825 
1826 typedef struct
1827 {
1838  ip46_address_t local_ip;
1839  ip46_address_t remote_ip;
1840  ipsec_key_t loc_ckey, rem_ckey, loc_ikey, rem_ikey;
1847 
1848 static void
1850 {
1851  ikev2_main_t *km = &ikev2_main;
1852  u32 sw_if_index;
1853  int rv = 0;
1854 
1855  if (~0 == a->sw_if_index)
1856  {
1857  /* no tunnel associated with the SA/profile - create a new one */
1859  &a->local_ip, &a->remote_ip, 0,
1860  TUNNEL_ENCAP_DECAP_FLAG_NONE, IP_DSCP_CS0,
1861  TUNNEL_MODE_P2P, &sw_if_index);
1862 
1863  if (rv == VNET_API_ERROR_IF_ALREADY_EXISTS)
1864  {
1865  if (hash_get (km->sw_if_indices, sw_if_index))
1866  /* interface is managed by IKE; proceed with updating SAs */
1867  rv = 0;
1868  }
1869  hash_set1 (km->sw_if_indices, sw_if_index);
1870  }
1871  else
1872  {
1873  sw_if_index = a->sw_if_index;
1874  vnet_sw_interface_admin_up (vnet_get_main (), sw_if_index);
1875  }
1876 
1877  if (rv)
1878  {
1879  ikev2_elog_uint (IKEV2_LOG_ERROR,
1880  "installing ipip tunnel failed! local spi: %x",
1881  a->local_spi);
1882  return;
1883  }
1884 
1885  u32 *sas_in = NULL;
1886  vec_add1 (sas_in, a->remote_sa_id);
1887  if (a->is_rekey)
1888  {
1889  ipsec_tun_protect_del (sw_if_index, NULL);
1890 
1891  /* replace local SA immediately */
1893 
1894  /* keep the old sa */
1895  vec_add1 (sas_in, a->old_remote_sa_id);
1896  }
1897 
1899  a->local_spi,
1901  &a->loc_ckey, a->integ_type, &a->loc_ikey,
1902  a->flags, 0, a->salt_local, &a->local_ip,
1903  &a->remote_ip, NULL, a->src_port, a->dst_port);
1904  if (rv)
1905  goto err0;
1906 
1909  a->integ_type, &a->rem_ikey,
1910  (a->flags | IPSEC_SA_FLAG_IS_INBOUND), 0,
1911  a->salt_remote, &a->remote_ip,
1912  &a->local_ip, NULL, a->ipsec_over_udp_port,
1913  a->ipsec_over_udp_port);
1914  if (rv)
1915  goto err1;
1916 
1917  rv = ipsec_tun_protect_update (sw_if_index, NULL, a->local_sa_id, sas_in);
1918  if (rv)
1919  goto err2;
1920 
1921  return;
1922 
1923 err2:
1925 err1:
1927 err0:
1928  vec_free (sas_in);
1929 }
1930 
1931 static int
1933  ikev2_sa_t * sa,
1934  ikev2_child_sa_t * child, u32 sa_index,
1935  u32 child_index, u8 is_rekey)
1936 {
1937  u32 thread_index = vlib_get_thread_index ();
1938  ikev2_main_t *km = &ikev2_main;
1939  ipsec_crypto_alg_t encr_type;
1940  ipsec_integ_alg_t integ_type;
1941  ikev2_profile_t *p = 0;
1943  ikev2_sa_proposal_t *proposals;
1944  u8 is_aead = 0;
1946 
1947  clib_memset (&a, 0, sizeof (a));
1948 
1949  if (!child->r_proposals)
1950  {
1952  return 1;
1953  }
1954 
1955  if (sa->is_initiator)
1956  {
1957  ip_address_to_46 (&sa->iaddr, &a.local_ip);
1958  ip_address_to_46 (&sa->raddr, &a.remote_ip);
1959  proposals = child->r_proposals;
1960  a.local_spi = child->r_proposals[0].spi;
1961  a.remote_spi = child->i_proposals[0].spi;
1962  }
1963  else
1964  {
1965  ip_address_to_46 (&sa->raddr, &a.local_ip);
1966  ip_address_to_46 (&sa->iaddr, &a.remote_ip);
1967  proposals = child->i_proposals;
1968  a.local_spi = child->i_proposals[0].spi;
1969  a.remote_spi = child->r_proposals[0].spi;
1970  }
1971 
1972  a.flags = IPSEC_SA_FLAG_USE_ANTI_REPLAY;
1973  if (sa->udp_encap)
1974  {
1975  a.flags |= IPSEC_SA_FLAG_IS_TUNNEL;
1976  a.flags |= IPSEC_SA_FLAG_UDP_ENCAP;
1977  }
1978  if (ikev2_natt_active (sa))
1979  a.flags |= IPSEC_SA_FLAG_UDP_ENCAP;
1980  a.is_rekey = is_rekey;
1981 
1982  tr = ikev2_sa_get_td_for_type (proposals, IKEV2_TRANSFORM_TYPE_ESN);
1983  if (tr && tr->esn_type)
1984  a.flags |= IPSEC_SA_FLAG_USE_ESN;
1985 
1986  tr = ikev2_sa_get_td_for_type (proposals, IKEV2_TRANSFORM_TYPE_ENCR);
1987  if (tr)
1988  {
1989  if (tr->encr_type == IKEV2_TRANSFORM_ENCR_TYPE_AES_CBC && tr->key_len)
1990  {
1991  switch (tr->key_len)
1992  {
1993  case 16:
1994  encr_type = IPSEC_CRYPTO_ALG_AES_CBC_128;
1995  break;
1996  case 24:
1997  encr_type = IPSEC_CRYPTO_ALG_AES_CBC_192;
1998  break;
1999  case 32:
2000  encr_type = IPSEC_CRYPTO_ALG_AES_CBC_256;
2001  break;
2002  default:
2004  return 1;
2005  break;
2006  }
2007  }
2008  else if (tr->encr_type == IKEV2_TRANSFORM_ENCR_TYPE_AES_GCM_16
2009  && tr->key_len)
2010  {
2011  switch (tr->key_len)
2012  {
2013  case 16:
2014  encr_type = IPSEC_CRYPTO_ALG_AES_GCM_128;
2015  break;
2016  case 24:
2017  encr_type = IPSEC_CRYPTO_ALG_AES_GCM_192;
2018  break;
2019  case 32:
2020  encr_type = IPSEC_CRYPTO_ALG_AES_GCM_256;
2021  break;
2022  default:
2024  return 1;
2025  break;
2026  }
2027  is_aead = 1;
2028  }
2029  else
2030  {
2032  return 1;
2033  }
2034  }
2035  else
2036  {
2038  return 1;
2039  }
2040  a.encr_type = encr_type;
2041 
2042  if (!is_aead)
2043  {
2044  tr = ikev2_sa_get_td_for_type (proposals, IKEV2_TRANSFORM_TYPE_INTEG);
2045  if (tr)
2046  {
2047  switch (tr->integ_type)
2048  {
2049  case IKEV2_TRANSFORM_INTEG_TYPE_AUTH_HMAC_SHA2_256_128:
2050  integ_type = IPSEC_INTEG_ALG_SHA_256_128;
2051  break;
2052  case IKEV2_TRANSFORM_INTEG_TYPE_AUTH_HMAC_SHA2_384_192:
2053  integ_type = IPSEC_INTEG_ALG_SHA_384_192;
2054  break;
2055  case IKEV2_TRANSFORM_INTEG_TYPE_AUTH_HMAC_SHA2_512_256:
2056  integ_type = IPSEC_INTEG_ALG_SHA_512_256;
2057  break;
2058  case IKEV2_TRANSFORM_INTEG_TYPE_AUTH_HMAC_SHA1_96:
2059  integ_type = IPSEC_INTEG_ALG_SHA1_96;
2060  break;
2061  default:
2063  return 1;
2064  }
2065  }
2066  else
2067  {
2069  return 1;
2070  }
2071  }
2072  else
2073  {
2074  integ_type = IPSEC_INTEG_ALG_NONE;
2075  }
2076 
2077  a.integ_type = integ_type;
2078  ikev2_calc_child_keys (sa, child);
2079 
2080  if (sa->is_initiator)
2081  {
2082  ipsec_mk_key (&a.loc_ikey, child->sk_ai, vec_len (child->sk_ai));
2083  ipsec_mk_key (&a.rem_ikey, child->sk_ar, vec_len (child->sk_ar));
2084  ipsec_mk_key (&a.loc_ckey, child->sk_ei, vec_len (child->sk_ei));
2085  ipsec_mk_key (&a.rem_ckey, child->sk_er, vec_len (child->sk_er));
2086  if (is_aead)
2087  {
2088  a.salt_remote = child->salt_er;
2089  a.salt_local = child->salt_ei;
2090  }
2092  }
2093  else
2094  {
2095  ipsec_mk_key (&a.loc_ikey, child->sk_ar, vec_len (child->sk_ar));
2096  ipsec_mk_key (&a.rem_ikey, child->sk_ai, vec_len (child->sk_ai));
2097  ipsec_mk_key (&a.loc_ckey, child->sk_er, vec_len (child->sk_er));
2098  ipsec_mk_key (&a.rem_ckey, child->sk_ei, vec_len (child->sk_ei));
2099  if (is_aead)
2100  {
2101  a.salt_remote = child->salt_ei;
2102  a.salt_local = child->salt_er;
2103  }
2104  a.dst_port =
2106  a.src_port = sa->ipsec_over_udp_port;
2107  }
2108 
2109  if (sa->is_initiator && sa->profile_index != ~0)
2110  p = pool_elt_at_index (km->profiles, sa->profile_index);
2111 
2112  if (p && p->lifetime)
2113  {
2114  child->time_to_expiration = vlib_time_now (vm) + p->lifetime;
2115  if (p->lifetime_jitter)
2116  {
2117  // This is not much better than rand(3), which Coverity warns
2118  // is unsuitable for security applications; random_u32 is
2119  // however fast. If this perturbance to the expiration time
2120  // needs to use a better RNG then we may need to use something
2121  // like /dev/urandom which has significant overhead.
2122  u32 rnd = (u32) (vlib_time_now (vm) * 1e6);
2123  rnd = random_u32 (&rnd);
2124 
2125  child->time_to_expiration += 1 + (rnd % p->lifetime_jitter);
2126  }
2127  }
2128 
2129  if (thread_index & 0xffffffc0)
2130  ikev2_elog_error ("error: thread index exceeds max range 0x3f!");
2131 
2132  if (child_index & 0xfffff000 || sa_index & 0xfffff000)
2133  ikev2_elog_error ("error: sa/child index exceeds max range 0xfff!");
2134 
2135  child->local_sa_id =
2136  a.local_sa_id =
2137  ikev2_mk_local_sa_id (sa_index, child_index, thread_index);
2138 
2139  u32 remote_sa_id = ikev2_mk_remote_sa_id (sa_index, child_index,
2140  thread_index);
2141 
2142  if (is_rekey)
2143  {
2144  /* create a new remote SA ID to keep the old SA for a bit longer
2145  * so the peer has some time to swap their SAs */
2146 
2147  /* use most significat bit of child index part in id */
2148  u32 mask = 0x800;
2149  if (sa->current_remote_id_mask)
2150  {
2151  sa->old_remote_id = a.old_remote_sa_id = remote_sa_id | mask;
2152  sa->current_remote_id_mask = 0;
2153  }
2154  else
2155  {
2156  sa->old_remote_id = a.old_remote_sa_id = remote_sa_id;
2158  remote_sa_id |= mask;
2159  }
2160  sa->old_id_expiration = 3.0;
2161  sa->old_remote_id_present = 1;
2162  }
2163 
2164  child->remote_sa_id = a.remote_sa_id = remote_sa_id;
2165 
2166  a.sw_if_index = (sa->is_tun_itf_set ? sa->tun_itf : ~0);
2168 
2170  (u8 *) & a, sizeof (a));
2171  return 0;
2172 }
2173 
2174 typedef struct
2175 {
2176  ip46_address_t local_ip;
2177  ip46_address_t remote_ip;
2182 
2185 {
2186  u32 mask = 0x800;
2187  if (mask & id)
2188  return id & ~mask;
2189  return id | mask;
2190 }
2191 
2192 static void
2194 {
2195  ikev2_main_t *km = &ikev2_main;
2196  ipip_tunnel_t *ipip = NULL;
2197  u32 sw_if_index;
2198 
2199  if (~0 == a->sw_if_index)
2200  {
2201  /* *INDENT-OFF* */
2202  ipip_tunnel_key_t key = {
2203  .src = a->local_ip,
2204  .dst = a->remote_ip,
2205  .transport = IPIP_TRANSPORT_IP4,
2206  .fib_index = 0,
2207  };
2208  /* *INDENT-ON* */
2209 
2210  ipip = ipip_tunnel_db_find (&key);
2211 
2212  if (ipip)
2213  {
2214  sw_if_index = ipip->sw_if_index;
2215  hash_unset (km->sw_if_indices, ipip->sw_if_index);
2216  }
2217  else
2218  sw_if_index = ~0;
2219  }
2220  else
2221  {
2222  sw_if_index = a->sw_if_index;
2223  vnet_sw_interface_admin_down (vnet_get_main (), sw_if_index);
2224  }
2225 
2226  if (~0 != sw_if_index)
2227  ipsec_tun_protect_del (sw_if_index, NULL);
2228 
2232 
2233  if (ipip)
2234  ipip_del_tunnel (ipip->sw_if_index);
2235 }
2236 
2237 static int
2239  ikev2_child_sa_t * child)
2240 {
2242 
2243  clib_memset (&a, 0, sizeof (a));
2244 
2245  if (sa->is_initiator)
2246  {
2247  ip_address_to_46 (&sa->iaddr, &a.local_ip);
2248  ip_address_to_46 (&sa->raddr, &a.remote_ip);
2249  }
2250  else
2251  {
2252  ip_address_to_46 (&sa->raddr, &a.local_ip);
2253  ip_address_to_46 (&sa->iaddr, &a.remote_ip);
2254  }
2255 
2256  a.remote_sa_id = child->remote_sa_id;
2257  a.local_sa_id = child->local_sa_id;
2258  a.sw_if_index = (sa->is_tun_itf_set ? sa->tun_itf : ~0);
2259 
2261  sizeof (a));
2262  return 0;
2263 }
2264 
2265 static u32
2267  ike_header_t * ike, void *user, udp_header_t * udp)
2268 {
2269  ikev2_main_t *km = &ikev2_main;
2270  u16 buffer_data_size = vlib_buffer_get_default_data_size (km->vlib_main);
2271  v8 *integ = 0;
2272  ike_payload_header_t *ph;
2273  u16 plen;
2274  u32 tlen = 0;
2275 
2276  ikev2_sa_transform_t *tr_encr, *tr_integ;
2277  tr_encr =
2278  ikev2_sa_get_td_for_type (sa->r_proposals, IKEV2_TRANSFORM_TYPE_ENCR);
2279  tr_integ =
2280  ikev2_sa_get_td_for_type (sa->r_proposals, IKEV2_TRANSFORM_TYPE_INTEG);
2281 
2282  ikev2_payload_chain_t *chain = 0;
2283  ikev2_payload_new_chain (chain);
2284 
2285  if (ike->exchange == IKEV2_EXCHANGE_SA_INIT)
2286  {
2287  if (sa->r_proposals == 0)
2288  {
2289  ikev2_payload_add_notify (chain,
2290  IKEV2_NOTIFY_MSG_NO_PROPOSAL_CHOSEN, 0);
2292  }
2293  else if (sa->dh_group == IKEV2_TRANSFORM_DH_TYPE_NONE)
2294  {
2295  u8 *data = vec_new (u8, 2);
2296  ikev2_sa_transform_t *tr_dh;
2297  tr_dh =
2299  IKEV2_TRANSFORM_TYPE_DH);
2300  ASSERT (tr_dh && tr_dh->dh_type);
2301 
2302  data[0] = (tr_dh->dh_type >> 8) & 0xff;
2303  data[1] = (tr_dh->dh_type) & 0xff;
2304 
2305  ikev2_payload_add_notify (chain,
2306  IKEV2_NOTIFY_MSG_INVALID_KE_PAYLOAD,
2307  data);
2308  vec_free (data);
2310  }
2311  else if (sa->state == IKEV2_STATE_NOTIFY_AND_DELETE)
2312  {
2313  u8 *data = vec_new (u8, 1);
2314 
2315  data[0] = sa->unsupported_cp;
2316  ikev2_payload_add_notify (chain,
2317  IKEV2_NOTIFY_MSG_UNSUPPORTED_CRITICAL_PAYLOAD,
2318  data);
2319  vec_free (data);
2320  }
2321  else
2322  {
2323  ASSERT (udp);
2324 
2325  ike->rspi = clib_host_to_net_u64 (sa->rspi);
2326  ikev2_payload_add_sa (chain, sa->r_proposals);
2327  ikev2_payload_add_ke (chain, sa->dh_group, sa->r_dh_data);
2328  ikev2_payload_add_nonce (chain, sa->r_nonce);
2329 
2330  u8 *nat_detection_sha1 =
2331  ikev2_compute_nat_sha1 (clib_host_to_net_u64 (sa->ispi),
2332  clib_host_to_net_u64 (sa->rspi),
2333  &sa->raddr, udp->dst_port);
2334  ikev2_payload_add_notify (chain,
2335  IKEV2_NOTIFY_MSG_NAT_DETECTION_SOURCE_IP,
2336  nat_detection_sha1);
2337  vec_free (nat_detection_sha1);
2338  nat_detection_sha1 =
2339  ikev2_compute_nat_sha1 (clib_host_to_net_u64 (sa->ispi),
2340  clib_host_to_net_u64 (sa->rspi),
2341  &sa->iaddr, udp->src_port);
2342  ikev2_payload_add_notify (chain,
2343  IKEV2_NOTIFY_MSG_NAT_DETECTION_DESTINATION_IP,
2344  nat_detection_sha1);
2345  vec_free (nat_detection_sha1);
2346  }
2347  }
2348  else if (ike->exchange == IKEV2_EXCHANGE_IKE_AUTH)
2349  {
2350  if (sa->state == IKEV2_STATE_AUTHENTICATED)
2351  {
2354  ikev2_payload_add_auth (chain, &sa->r_auth);
2355  ikev2_payload_add_sa (chain, sa->childs[0].r_proposals);
2358  }
2359  else if (sa->state == IKEV2_STATE_AUTH_FAILED)
2360  {
2361  ikev2_payload_add_notify (chain,
2362  IKEV2_NOTIFY_MSG_AUTHENTICATION_FAILED,
2363  0);
2365  }
2366  else if (sa->state == IKEV2_STATE_TS_UNACCEPTABLE)
2367  {
2368  ikev2_payload_add_notify (chain, IKEV2_NOTIFY_MSG_TS_UNACCEPTABLE,
2369  0);
2371  ikev2_payload_add_auth (chain, &sa->r_auth);
2372  }
2373  else if (sa->state == IKEV2_STATE_NO_PROPOSAL_CHOSEN)
2374  {
2375  ikev2_payload_add_notify (chain,
2376  IKEV2_NOTIFY_MSG_NO_PROPOSAL_CHOSEN, 0);
2378  ikev2_payload_add_auth (chain, &sa->r_auth);
2381  }
2382  else if (sa->state == IKEV2_STATE_NOTIFY_AND_DELETE)
2383  {
2384  u8 *data = vec_new (u8, 1);
2385 
2386  data[0] = sa->unsupported_cp;
2387  ikev2_payload_add_notify (chain,
2388  IKEV2_NOTIFY_MSG_UNSUPPORTED_CRITICAL_PAYLOAD,
2389  data);
2390  vec_free (data);
2391  }
2392  else if (sa->state == IKEV2_STATE_SA_INIT)
2393  {
2396  ikev2_payload_add_auth (chain, &sa->i_auth);
2397  ikev2_payload_add_sa (chain, sa->childs[0].i_proposals);
2400  ikev2_payload_add_notify (chain, IKEV2_NOTIFY_MSG_INITIAL_CONTACT,
2401  0);
2402  }
2403  else
2404  {
2406  goto done;
2407  }
2408  }
2409  else if (ike->exchange == IKEV2_EXCHANGE_INFORMATIONAL)
2410  {
2411  /* if pending delete */
2412  if (sa->del)
2413  {
2414  if (sa->del[0].protocol_id == IKEV2_PROTOCOL_IKE)
2415  {
2416  if (ike_hdr_is_request (ike))
2417  ikev2_payload_add_delete (chain, sa->del);
2418 
2419  /* The response to a request that deletes the IKE SA is an empty
2420  INFORMATIONAL response. */
2422  }
2423  /* The response to a request that deletes ESP or AH SAs will contain
2424  delete payloads for the paired SAs going in the other direction. */
2425  else
2426  {
2427  ikev2_payload_add_delete (chain, sa->del);
2428  }
2429  vec_free (sa->del);
2430  sa->del = 0;
2431  }
2432  /* received N(AUTHENTICATION_FAILED) */
2433  else if (sa->state == IKEV2_STATE_AUTH_FAILED)
2434  {
2436  goto done;
2437  }
2438  /* received unsupported critical payload */
2439  else if (sa->unsupported_cp)
2440  {
2441  u8 *data = vec_new (u8, 1);
2442 
2443  data[0] = sa->unsupported_cp;
2444  ikev2_payload_add_notify (chain,
2445  IKEV2_NOTIFY_MSG_UNSUPPORTED_CRITICAL_PAYLOAD,
2446  data);
2447  vec_free (data);
2448  sa->unsupported_cp = 0;
2449  }
2450  /* else send empty response */
2451  }
2452  else if (ike->exchange == IKEV2_EXCHANGE_CREATE_CHILD_SA)
2453  {
2454  if (sa->is_initiator)
2455  {
2456 
2457  ikev2_sa_proposal_t *proposals = (ikev2_sa_proposal_t *) user;
2458  ikev2_notify_t notify;
2459  u8 *data = vec_new (u8, 4);
2460  clib_memset (&notify, 0, sizeof (notify));
2462  notify.spi = sa->childs[0].i_proposals->spi;
2463  *(u32 *) data = clib_host_to_net_u32 (notify.spi);
2464 
2465  ikev2_payload_add_sa (chain, proposals);
2466  ikev2_payload_add_nonce (chain, sa->i_nonce);
2469  ikev2_payload_add_notify_2 (chain, IKEV2_NOTIFY_MSG_REKEY_SA, data,
2470  &notify);
2471 
2472  vec_free (data);
2473  }
2474  else
2475  {
2476  if (vec_len (sa->rekey) > 0)
2477  {
2478  ikev2_payload_add_sa (chain, sa->rekey[0].r_proposal);
2479  ikev2_payload_add_nonce (chain, sa->r_nonce);
2480  ikev2_payload_add_ts (chain, sa->rekey[0].tsi,
2482  ikev2_payload_add_ts (chain, sa->rekey[0].tsr,
2484  vec_del1 (sa->rekey, 0);
2485  }
2486  else if (sa->unsupported_cp)
2487  {
2488  u8 *data = vec_new (u8, 1);
2489 
2490  data[0] = sa->unsupported_cp;
2491  ikev2_payload_add_notify (chain,
2492  IKEV2_NOTIFY_MSG_UNSUPPORTED_CRITICAL_PAYLOAD,
2493  data);
2494  vec_free (data);
2495  sa->unsupported_cp = 0;
2496  }
2497  else
2498  {
2499  ikev2_payload_add_notify (chain,
2500  IKEV2_NOTIFY_MSG_NO_ADDITIONAL_SAS,
2501  0);
2502  }
2503  }
2504  }
2505 
2506  /* IKEv2 header */
2507  ike->version = IKE_VERSION_2;
2508  ike->nextpayload = IKEV2_PAYLOAD_SK;
2509  tlen = sizeof (*ike);
2510 
2511  if (sa->is_initiator)
2512  ike->flags |= IKEV2_HDR_FLAG_INITIATOR;
2513 
2514  if (ike->exchange == IKEV2_EXCHANGE_SA_INIT)
2515  {
2516  tlen += vec_len (chain->data);
2517  ike->nextpayload = chain->first_payload_type;
2518  ike->length = clib_host_to_net_u32 (tlen);
2519 
2520  if (tlen + b->current_length + b->current_data > buffer_data_size)
2521  {
2522  tlen = ~0;
2523  goto done;
2524  }
2525 
2526  clib_memcpy_fast (ike->payload, chain->data, vec_len (chain->data));
2527 
2528  /* store whole IKE payload - needed for PSK auth */
2530  vec_add (sa->last_sa_init_res_packet_data, ike, tlen);
2531  }
2532  else
2533  {
2535  ikev2_payload_chain_add_padding (chain, tr_encr->block_size);
2536 
2537  /* SK payload */
2538  plen = sizeof (*ph);
2539  ph = (ike_payload_header_t *) & ike->payload[0];
2540  ph->nextpayload = chain->first_payload_type;
2541  ph->flags = 0;
2542  int is_aead =
2543  tr_encr->encr_type == IKEV2_TRANSFORM_ENCR_TYPE_AES_GCM_16;
2544  int iv_len = is_aead ? IKEV2_GCM_IV_SIZE : tr_encr->block_size;
2545  plen += vec_len (chain->data) + iv_len;
2546 
2547  /* add space for hmac/tag */
2548  if (tr_integ)
2549  plen += tr_integ->key_trunc;
2550  else
2551  plen += IKEV2_GCM_ICV_SIZE;
2552  tlen += plen;
2553 
2554  if (tlen + b->current_length + b->current_data > buffer_data_size)
2555  {
2556  tlen = ~0;
2557  goto done;
2558  }
2559 
2560  /* payload and total length */
2561  ph->length = clib_host_to_net_u16 (plen);
2562  ike->length = clib_host_to_net_u32 (tlen);
2563 
2564  if (is_aead)
2565  {
2566  if (!ikev2_encrypt_aead_data (ptd, sa, tr_encr, chain->data,
2567  ph->payload, (u8 *) ike,
2568  sizeof (*ike) + sizeof (*ph),
2569  ph->payload + plen - sizeof (*ph) -
2571  {
2572  tlen = ~0;
2573  goto done;
2574  }
2575  }
2576  else
2577  {
2578  if (!ikev2_encrypt_data
2579  (ptd, sa, tr_encr, chain->data, ph->payload))
2580  {
2581  tlen = ~0;
2582  goto done;
2583  }
2584  integ =
2585  ikev2_calc_integr (tr_integ,
2586  sa->is_initiator ? sa->sk_ai : sa->sk_ar,
2587  (u8 *) ike, tlen - tr_integ->key_trunc);
2588  clib_memcpy_fast (ike->payload + tlen - tr_integ->key_trunc -
2589  sizeof (*ike), integ, tr_integ->key_trunc);
2590  }
2591 
2592  /* store whole IKE payload - needed for retransmit */
2594  vec_add (sa->last_res_packet_data, ike, tlen);
2595  }
2596 
2597 done:
2599  vec_free (integ);
2600  return tlen;
2601 }
2602 
2603 static u32
2604 ikev2_retransmit_sa_init_one (ikev2_sa_t * sa, ike_header_t * ike,
2606  u32 rlen)
2607 {
2608  int p = 0;
2609  ike_header_t *tmp;
2610  u8 payload = ike->nextpayload;
2611 
2612  if (sa->ispi != clib_net_to_host_u64 (ike->ispi) ||
2613  ip_address_cmp (&sa->iaddr, &iaddr) ||
2614  ip_address_cmp (&sa->raddr, &raddr))
2615  {
2616  return 0;
2617  }
2618 
2619  while (p < rlen && payload != IKEV2_PAYLOAD_NONE)
2620  {
2621  ike_payload_header_t *ikep = (ike_payload_header_t *) & ike->payload[p];
2622  u32 plen = clib_net_to_host_u16 (ikep->length);
2623 
2624  if (plen < sizeof (ike_payload_header_t))
2625  return ~0;
2626 
2627  if (payload == IKEV2_PAYLOAD_NONCE &&
2628  !clib_memcmp (sa->i_nonce, ikep->payload, plen - sizeof (*ikep)))
2629  {
2630  /* req is retransmit */
2631  if (sa->state == IKEV2_STATE_SA_INIT)
2632  {
2633  tmp = (ike_header_t *) sa->last_sa_init_res_packet_data;
2634  u32 slen = clib_net_to_host_u32 (tmp->length);
2635  ike->ispi = tmp->ispi;
2636  ike->rspi = tmp->rspi;
2637  ike->nextpayload = tmp->nextpayload;
2638  ike->version = tmp->version;
2639  ike->exchange = tmp->exchange;
2640  ike->flags = tmp->flags;
2641  ike->msgid = tmp->msgid;
2642  ike->length = tmp->length;
2643  clib_memcpy_fast (ike->payload, tmp->payload,
2644  slen - sizeof (*ike));
2645  ikev2_elog_uint_peers (IKEV2_LOG_DEBUG,
2646  "ispi %lx IKE_SA_INIT retransmit "
2647  "from %d.%d.%d.%d to %d.%d.%d.%d",
2648  ike->ispi,
2649  ip_addr_v4 (&raddr).as_u32,
2650  ip_addr_v4 (&iaddr).as_u32);
2651  return slen;
2652  }
2653  /* else ignore req */
2654  else
2655  {
2656  ikev2_elog_uint_peers (IKEV2_LOG_DEBUG,
2657  "ispi %lx IKE_SA_INIT ignore "
2658  "from %d.%d.%d.%d to %d.%d.%d.%d",
2659  ike->ispi,
2660  ip_addr_v4 (&raddr).as_u32,
2661  ip_addr_v4 (&iaddr).as_u32);
2662  return ~0;
2663  }
2664  }
2665  payload = ikep->nextpayload;
2666  p += plen;
2667  }
2668 
2669  return 0;
2670 }
2671 
2672 static u32
2674  ip_address_t raddr, u32 rlen)
2675 {
2676  ikev2_sa_t *sa;
2677  u32 res;
2679 
2680  /* *INDENT-OFF* */
2681  pool_foreach (sa, ptd->sas, ({
2682  res = ikev2_retransmit_sa_init_one (sa, ike, iaddr, raddr, rlen);
2683  if (res)
2684  return res;
2685  }));
2686  /* *INDENT-ON* */
2687 
2688  /* req is not retransmit */
2689  return 0;
2690 }
2691 
2692 static u32
2693 ikev2_retransmit_resp (ikev2_sa_t * sa, ike_header_t * ike)
2694 {
2695  if (ike_hdr_is_response (ike))
2696  return 0;
2697 
2698  u32 msg_id = clib_net_to_host_u32 (ike->msgid);
2699 
2700  /* new req */
2701  if (msg_id > sa->last_msg_id)
2702  {
2703  sa->last_msg_id = msg_id;
2704  return 0;
2705  }
2706 
2707  /* retransmitted req */
2708  if (msg_id == sa->last_msg_id)
2709  {
2710  ike_header_t *tmp = (ike_header_t *) sa->last_res_packet_data;
2711  u32 slen = clib_net_to_host_u32 (tmp->length);
2712  ike->ispi = tmp->ispi;
2713  ike->rspi = tmp->rspi;
2714  ike->nextpayload = tmp->nextpayload;
2715  ike->version = tmp->version;
2716  ike->exchange = tmp->exchange;
2717  ike->flags = tmp->flags;
2718  ike->msgid = tmp->msgid;
2719  ike->length = tmp->length;
2720  clib_memcpy_fast (ike->payload, tmp->payload, slen - sizeof (*ike));
2721  ikev2_elog_uint_peers (IKEV2_LOG_DEBUG, "IKE retransmit msgid %d",
2722  msg_id, ip_addr_v4 (&sa->raddr).as_u32,
2723  ip_addr_v4 (&sa->iaddr).as_u32);
2724  return slen;
2725  }
2726 
2727  /* old req ignore */
2728  ikev2_elog_uint_peers (IKEV2_LOG_DEBUG, "IKE req ignore msgid %d",
2729  msg_id, ip_addr_v4 (&sa->raddr).as_u32,
2730  ip_addr_v4 (&sa->iaddr).as_u32);
2731  return ~0;
2732 }
2733 
2734 static void
2736 {
2737  ikev2_main_t *km = &ikev2_main;
2739  sa->profile_index = ~0;
2740 }
2741 
2742 static void
2744 {
2745  ikev2_main_t *km = &ikev2_main;
2746  uword *p = hash_get (km->sa_by_ispi, *ispi);
2747  if (p)
2748  {
2749  ikev2_sa_t *sai = pool_elt_at_index (km->sais, p[0]);
2750  hash_unset (km->sa_by_ispi, sai->ispi);
2751  ikev2_sa_free_all_vec (sai);
2752  pool_put (km->sais, sai);
2753  }
2754 }
2755 
2756 static void
2758 {
2760  sizeof (ispi));
2761 }
2762 
2765 {
2766  if (sa->is_initiator)
2767  {
2768  ip_address_copy_addr (&ih->dst_address, &sa->raddr);
2769  ip_address_copy_addr (&ih->src_address, &sa->iaddr);
2770  }
2771  else
2772  {
2773  ip_address_copy_addr (&ih->dst_address, &sa->iaddr);
2774  ip_address_copy_addr (&ih->src_address, &sa->raddr);
2775  }
2776 }
2777 
2780 {
2781  if (sa->is_initiator)
2782  {
2783  ip_address_copy_addr (&ih->dst_address, &sa->raddr);
2784  ip_address_copy_addr (&ih->src_address, &sa->iaddr);
2785  }
2786  else
2787  {
2788  ip_address_copy_addr (&ih->dst_address, &sa->iaddr);
2789  ip_address_copy_addr (&ih->src_address, &sa->raddr);
2790  }
2791 }
2792 
2795  const void *raddr, const int af)
2796 {
2797  ip_address_set (&sa->raddr, raddr, af);
2798  ip_address_set (&sa->iaddr, iaddr, af);
2799 }
2800 
2801 static void
2803  ip6_header_t * ip6, u8 is_ip4)
2804 {
2805  u32 src, dst;
2806  if (is_ip4)
2807  {
2808  src = ip4->src_address.as_u32;
2809  dst = ip4->dst_address.as_u32;
2810  }
2811  else
2812  {
2813  src = ip6->src_address.as_u32[3];
2814  dst = ip6->dst_address.as_u32[3];
2815  }
2816  ikev2_elog_uint_peers (IKEV2_LOG_WARNING, "IKEv2 exchange %d "
2817  "received from %d.%d.%d.%d to %d.%d.%d.%d",
2818  exchange, src, dst);
2819 }
2820 
2821 static void
2823 {
2825 
2827  return;
2828 
2833 }
2834 
2838  u8 is_ip4)
2839 {
2840  u32 n_left = frame->n_vectors, *from;
2841  ikev2_main_t *km = &ikev2_main;
2842  vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b;
2843  u16 nexts[VLIB_FRAME_SIZE], *next = nexts;
2845  int res;
2846 
2847  from = vlib_frame_vector_args (frame);
2848  vlib_get_buffers (vm, from, bufs, n_left);
2849  b = bufs;
2850 
2851  while (n_left > 0)
2852  {
2853  vlib_buffer_t *b0 = b[0];
2854  next[0] = is_ip4 ? IKEV2_NEXT_IP4_ERROR_DROP
2856  ip4_header_t *ip40 = 0;
2857  ip6_header_t *ip60 = 0;
2858  udp_header_t *udp0;
2859  ike_header_t *ike0;
2860  ikev2_sa_t *sa0 = 0;
2861  ikev2_sa_t sa; /* temporary store for SA */
2862  u32 rlen, slen = 0;
2863  int ip_hdr_sz = 0;
2864  int is_req = 0, has_non_esp_marker = 0;
2865 
2866  ASSERT (0 == b0->punt_reason
2867  || (is_ip4
2868  && b0->punt_reason ==
2869  ipsec_punt_reason[IPSEC_PUNT_IP4_SPI_UDP_0]));
2870 
2871  if (is_ip4
2872  && b0->punt_reason == ipsec_punt_reason[IPSEC_PUNT_IP4_SPI_UDP_0])
2873  {
2874  u8 *ptr = vlib_buffer_get_current (b0);
2875  ip40 = (ip4_header_t *) ptr;
2876  ptr += sizeof (*ip40);
2877  udp0 = (udp_header_t *) ptr;
2878  ptr += sizeof (*udp0);
2879  ike0 = (ike_header_t *) ptr;
2880  ip_hdr_sz = sizeof (*ip40);
2881  }
2882  else
2883  {
2884  u8 *ipx_hdr = b0->data + vnet_buffer (b0)->l3_hdr_offset;
2885  ike0 = vlib_buffer_get_current (b0);
2886  vlib_buffer_advance (b0, -sizeof (*udp0));
2887  udp0 = vlib_buffer_get_current (b0);
2888 
2889  if (is_ip4)
2890  {
2891  ip40 = (ip4_header_t *) ipx_hdr;
2892  ip_hdr_sz = sizeof (*ip40);
2893  }
2894  else
2895  {
2896  ip60 = (ip6_header_t *) ipx_hdr;
2897  ip_hdr_sz = sizeof (*ip60);
2898  }
2899  vlib_buffer_advance (b0, -ip_hdr_sz);
2900  }
2901 
2902  rlen = b0->current_length - ip_hdr_sz - sizeof (*udp0);
2903 
2904  /* check for non-esp marker */
2905  if (*((u32 *) ike0) == 0)
2906  {
2907  ike0 =
2908  (ike_header_t *) ((u8 *) ike0 + sizeof (ikev2_non_esp_marker));
2909  rlen -= sizeof (ikev2_non_esp_marker);
2910  has_non_esp_marker = 1;
2911  }
2912 
2913  if (clib_net_to_host_u32 (ike0->length) != rlen)
2914  {
2916  IKEV2_ERROR_BAD_LENGTH, 1);
2917  goto dispatch0;
2918  }
2919 
2920  if (ike0->version != IKE_VERSION_2)
2921  {
2923  IKEV2_ERROR_NOT_IKEV2, 1);
2924  goto dispatch0;
2925  }
2926 
2927  if (ike0->exchange == IKEV2_EXCHANGE_SA_INIT)
2928  {
2929  sa0 = &sa;
2930  clib_memset (sa0, 0, sizeof (*sa0));
2931 
2932  if (ike_hdr_is_initiator (ike0))
2933  {
2934  if (ike0->rspi == 0)
2935  {
2936  if (is_ip4)
2937  ikev2_set_ip_address (sa0, &ip40->src_address,
2938  &ip40->dst_address, AF_IP4);
2939  else
2940  ikev2_set_ip_address (sa0, &ip60->src_address,
2941  &ip60->dst_address, AF_IP6);
2942 
2943  sa0->dst_port = clib_net_to_host_u16 (udp0->src_port);
2944 
2945  slen =
2946  ikev2_retransmit_sa_init (ike0, sa0->iaddr,
2947  sa0->raddr, rlen);
2948  if (slen)
2949  {
2951  ~0 ==
2952  slen ?
2953  IKEV2_ERROR_IKE_SA_INIT_IGNORE
2954  :
2955  IKEV2_ERROR_IKE_SA_INIT_RETRANSMIT,
2956  1);
2957  goto dispatch0;
2958  }
2959 
2960  res = ikev2_process_sa_init_req (vm, sa0, ike0, udp0, rlen);
2961  if (!res)
2963  IKEV2_ERROR_MALFORMED_PACKET,
2964  1);
2965 
2966  if (sa0->state == IKEV2_STATE_SA_INIT)
2967  {
2969  sa0->r_proposals =
2973  }
2974 
2975  if (sa0->state == IKEV2_STATE_SA_INIT
2977  {
2978  ike0->flags = IKEV2_HDR_FLAG_RESPONSE;
2979  slen = ikev2_generate_message (b0, sa0, ike0, 0, udp0);
2980  if (~0 == slen)
2982  IKEV2_ERROR_NO_BUFF_SPACE,
2983  1);
2984  }
2985 
2986  if (sa0->state == IKEV2_STATE_SA_INIT)
2987  {
2988  /* add SA to the pool */
2989  pool_get (ptd->sas, sa0);
2990  clib_memcpy_fast (sa0, &sa, sizeof (*sa0));
2991  ikev2_init_sa (vm, sa0);
2992  hash_set (ptd->sa_by_rspi, sa0->rspi, sa0 - ptd->sas);
2993  }
2994  else
2995  {
2996  ikev2_sa_free_all_vec (sa0);
2997  }
2998  }
2999  }
3000  else //received sa_init without initiator flag
3001  {
3002  if (is_ip4)
3003  ikev2_set_ip_address (sa0, &ip40->dst_address,
3004  &ip40->src_address, AF_IP4);
3005  else
3006  ikev2_set_ip_address (sa0, &ip60->dst_address,
3007  &ip60->src_address, AF_IP6);
3008 
3009  ikev2_process_sa_init_resp (vm, sa0, ike0, udp0, rlen);
3010 
3011  if (sa0->state == IKEV2_STATE_SA_INIT)
3012  {
3013  is_req = 1;
3014  ike0->exchange = IKEV2_EXCHANGE_IKE_AUTH;
3015  uword *p = hash_get (km->sa_by_ispi, sa0->ispi);
3016  if (p)
3017  {
3018  ikev2_sa_t *sai = pool_elt_at_index (km->sais, p[0]);
3019 
3021  (&sai->init_response_received, 0, 1))
3022  {
3023  ikev2_complete_sa_data (sa0, sai);
3024  ikev2_calc_keys (sa0);
3025  ikev2_sa_auth_init (sa0);
3026  ike0->flags = IKEV2_HDR_FLAG_INITIATOR;
3027  ike0->msgid =
3028  clib_net_to_host_u32 (sai->last_init_msg_id);
3029  sa0->last_init_msg_id = sai->last_init_msg_id + 1;
3030  slen =
3031  ikev2_generate_message (b0, sa0, ike0, 0, udp0);
3032  if (~0 == slen)
3034  node->node_index,
3035  IKEV2_ERROR_NO_BUFF_SPACE,
3036  1);
3037  }
3038  else
3039  {
3040  /* we've already processed sa-init response */
3041  sa0->state = IKEV2_STATE_UNKNOWN;
3042  }
3043  }
3044  }
3045 
3046  if (sa0->state == IKEV2_STATE_SA_INIT)
3047  {
3048  /* add SA to the pool */
3049  pool_get (ptd->sas, sa0);
3050  clib_memcpy_fast (sa0, &sa, sizeof (*sa0));
3051  hash_set (ptd->sa_by_rspi, sa0->rspi, sa0 - ptd->sas);
3052  }
3053  else
3054  {
3055  ikev2_sa_free_all_vec (sa0);
3056  }
3057  }
3058  }
3059  else if (ike0->exchange == IKEV2_EXCHANGE_IKE_AUTH)
3060  {
3061  uword *p;
3062  p = hash_get (ptd->sa_by_rspi, clib_net_to_host_u64 (ike0->rspi));
3063  if (p)
3064  {
3065  sa0 = pool_elt_at_index (ptd->sas, p[0]);
3066  slen = ikev2_retransmit_resp (sa0, ike0);
3067  if (slen)
3068  {
3070  ~0 ==
3071  slen ?
3072  IKEV2_ERROR_IKE_REQ_IGNORE
3073  :
3074  IKEV2_ERROR_IKE_REQ_RETRANSMIT,
3075  1);
3076  goto dispatch0;
3077  }
3078 
3079  sa0->dst_port = clib_net_to_host_u16 (udp0->src_port);
3080  res = ikev2_process_auth_req (vm, sa0, ike0, rlen);
3081  if (res)
3082  ikev2_sa_auth (sa0);
3083  else
3085  IKEV2_ERROR_MALFORMED_PACKET, 1);
3086  if (sa0->state == IKEV2_STATE_AUTHENTICATED)
3087  {
3088  ikev2_initial_contact_cleanup (ptd, sa0);
3089  ikev2_sa_match_ts (sa0);
3090  if (sa0->state != IKEV2_STATE_TS_UNACCEPTABLE)
3092  &sa0->childs[0],
3093  p[0], 0, 0);
3094  }
3095 
3096  if (sa0->is_initiator)
3097  {
3098  ikev2_del_sa_init (sa0->ispi);
3099  }
3100  else
3101  {
3102  ike0->flags = IKEV2_HDR_FLAG_RESPONSE;
3103  slen = ikev2_generate_message (b0, sa0, ike0, 0, udp0);
3104  if (~0 == slen)
3106  IKEV2_ERROR_NO_BUFF_SPACE,
3107  1);
3108  }
3109  }
3110  }
3111  else if (ike0->exchange == IKEV2_EXCHANGE_INFORMATIONAL)
3112  {
3113  uword *p;
3114  p = hash_get (ptd->sa_by_rspi, clib_net_to_host_u64 (ike0->rspi));
3115  if (p)
3116  {
3117  sa0 = pool_elt_at_index (ptd->sas, p[0]);
3118  slen = ikev2_retransmit_resp (sa0, ike0);
3119  if (slen)
3120  {
3122  ~0 ==
3123  slen ?
3124  IKEV2_ERROR_IKE_REQ_IGNORE
3125  :
3126  IKEV2_ERROR_IKE_REQ_RETRANSMIT,
3127  1);
3128  goto dispatch0;
3129  }
3130 
3131  res = ikev2_process_informational_req (vm, sa0, ike0, rlen);
3132  if (!res)
3133  {
3135  IKEV2_ERROR_MALFORMED_PACKET,
3136  1);
3137  slen = ~0;
3138  goto dispatch0;
3139  }
3140 
3141  if (sa0->del)
3142  {
3143  if (sa0->del[0].protocol_id != IKEV2_PROTOCOL_IKE)
3144  {
3145  ikev2_delete_t *d, *tmp, *resp = 0;
3146  vec_foreach (d, sa0->del)
3147  {
3148  ikev2_child_sa_t *ch_sa;
3149  ch_sa = ikev2_sa_get_child (sa0, d->spi,
3150  d->protocol_id,
3151  !sa0->is_initiator);
3152  if (ch_sa)
3153  {
3155  sa0, ch_sa);
3156  if (!sa0->is_initiator)
3157  {
3158  vec_add2 (resp, tmp, 1);
3159  tmp->protocol_id = d->protocol_id;
3160  tmp->spi = ch_sa->r_proposals[0].spi;
3161  }
3162  ikev2_sa_del_child_sa (sa0, ch_sa);
3163  }
3164  }
3165  if (!sa0->is_initiator)
3166  {
3167  vec_free (sa0->del);
3168  sa0->del = resp;
3169  }
3170  }
3171  }
3172  if (ike_hdr_is_request (ike0))
3173  {
3174  ike0->flags = IKEV2_HDR_FLAG_RESPONSE;
3175  slen = ikev2_generate_message (b0, sa0, ike0, 0, udp0);
3176  if (~0 == slen)
3178  IKEV2_ERROR_NO_BUFF_SPACE,
3179  1);
3180  }
3181  }
3182  }
3183  else if (ike0->exchange == IKEV2_EXCHANGE_CREATE_CHILD_SA)
3184  {
3185  uword *p;
3186  p = hash_get (ptd->sa_by_rspi, clib_net_to_host_u64 (ike0->rspi));
3187  if (p)
3188  {
3189  sa0 = pool_elt_at_index (ptd->sas, p[0]);
3190  slen = ikev2_retransmit_resp (sa0, ike0);
3191  if (slen)
3192  {
3194  ~0 ==
3195  slen ?
3196  IKEV2_ERROR_IKE_REQ_IGNORE
3197  :
3198  IKEV2_ERROR_IKE_REQ_RETRANSMIT,
3199  1);
3200  goto dispatch0;
3201  }
3202 
3203  res = ikev2_process_create_child_sa_req (vm, sa0, ike0, rlen);
3204  if (!res)
3205  {
3207  IKEV2_ERROR_MALFORMED_PACKET,
3208  1);
3209  slen = ~0;
3210  goto dispatch0;
3211  }
3212 
3213  if (sa0->rekey)
3214  {
3215  if (sa0->rekey[0].protocol_id != IKEV2_PROTOCOL_IKE)
3216  {
3217  if (sa0->childs)
3219  ikev2_child_sa_t *child;
3220  vec_add2 (sa0->childs, child, 1);
3221  clib_memset (child, 0, sizeof (*child));
3222  child->r_proposals = sa0->rekey[0].r_proposal;
3223  child->i_proposals = sa0->rekey[0].i_proposal;
3224  child->tsi = sa0->rekey[0].tsi;
3225  child->tsr = sa0->rekey[0].tsr;
3226  ikev2_create_tunnel_interface (vm, sa0, child, p[0],
3227  child - sa0->childs, 1);
3228  }
3229  if (ike_hdr_is_response (ike0))
3230  {
3231  vec_free (sa0->rekey);
3232  }
3233  else
3234  {
3235  ike0->flags = IKEV2_HDR_FLAG_RESPONSE;
3236  slen = ikev2_generate_message (b0, sa0, ike0, 0, udp0);
3237  if (~0 == slen)
3239  IKEV2_ERROR_NO_BUFF_SPACE,
3240  1);
3241  }
3242  }
3243  }
3244  }
3245  else
3246  {
3247  ikev2_elog_uint_peers_addr (ike0->exchange, ip40, ip60, is_ip4);
3248  }
3249 
3250  dispatch0:
3251  /* if we are sending packet back, rewrite headers */
3252  if (slen && ~0 != slen)
3253  {
3254  if (is_ip4)
3255  {
3256  next[0] = IKEV2_NEXT_IP4_LOOKUP;
3257  ikev2_rewrite_v4_addrs (sa0, ip40);
3258  }
3259  else
3260  {
3261  next[0] = IKEV2_NEXT_IP6_LOOKUP;
3262  ikev2_rewrite_v6_addrs (sa0, ip60);
3263  }
3264 
3265  if (is_req)
3266  {
3267  udp0->dst_port = udp0->src_port =
3268  clib_net_to_host_u16 (ikev2_get_port (sa0));
3269 
3270  if (udp0->dst_port == clib_net_to_host_u16 (IKEV2_PORT_NATT)
3271  && ikev2_natt_active (sa0))
3272  {
3273  if (!has_non_esp_marker)
3274  slen = ikev2_insert_non_esp_marker (ike0, slen);
3275  }
3276  }
3277  else
3278  {
3279  if (has_non_esp_marker)
3280  slen += sizeof (ikev2_non_esp_marker);
3281 
3282  u16 tp = udp0->dst_port;
3283  udp0->dst_port = udp0->src_port;
3284  udp0->src_port = tp;
3285  }
3286 
3287  udp0->length = clib_host_to_net_u16 (slen + sizeof (udp_header_t));
3288  udp0->checksum = 0;
3289  b0->current_length = slen + ip_hdr_sz + sizeof (udp_header_t);
3290  if (is_ip4)
3291  {
3292  ip40->length = clib_host_to_net_u16 (b0->current_length);
3293  ip40->checksum = ip4_header_checksum (ip40);
3294  }
3295  else
3296  {
3297  ip60->payload_length =
3298  clib_host_to_net_u16 (b0->current_length - sizeof (*ip60));
3299  }
3300  }
3301  /* delete sa */
3302  if (sa0 && (sa0->state == IKEV2_STATE_DELETED ||
3304  {
3306 
3307  vec_foreach (c, sa0->childs)
3309 
3310  ikev2_delete_sa (ptd, sa0);
3311  }
3313  && (b0->flags & VLIB_BUFFER_IS_TRACED)))
3314  {
3315 
3316  ikev2_trace_t *t = vlib_add_trace (vm, node, b0, sizeof (*t));
3317  t->sw_if_index = vnet_buffer (b0)->sw_if_index[VLIB_RX];
3318  t->next_index = next[0];
3319  }
3320  n_left -= 1;
3321  next += 1;
3322  b += 1;
3323  }
3324 
3326  IKEV2_ERROR_PROCESSED, frame->n_vectors);
3327  vlib_buffer_enqueue_to_next (vm, node, from, nexts, frame->n_vectors);
3328  return frame->n_vectors;
3329 }
3330 
3331 static uword
3333 {
3334  return ikev2_node_internal (vm, node, frame, 1 /* is_ip4 */ );
3335 }
3336 
3337 static uword
3339 {
3340  return ikev2_node_internal (vm, node, frame, 0 /* is_ip4 */ );
3341 }
3342 
3343 /* *INDENT-OFF* */
3345  .function = ikev2_ip4,
3346  .name = "ikev2-ip4",
3347  .vector_size = sizeof (u32),
3348  .format_trace = format_ikev2_trace,
3350 
3351  .n_errors = ARRAY_LEN(ikev2_error_strings),
3352  .error_strings = ikev2_error_strings,
3353 
3354  .n_next_nodes = IKEV2_IP4_N_NEXT,
3355  .next_nodes = {
3356  [IKEV2_NEXT_IP4_LOOKUP] = "ip4-lookup",
3357  [IKEV2_NEXT_IP4_ERROR_DROP] = "error-drop",
3358  },
3359 };
3360 
3362  .function = ikev2_ip6,
3363  .name = "ikev2-ip6",
3364  .vector_size = sizeof (u32),
3365  .format_trace = format_ikev2_trace,
3367 
3368  .n_errors = ARRAY_LEN(ikev2_error_strings),
3369  .error_strings = ikev2_error_strings,
3370 
3371  .n_next_nodes = IKEV2_IP6_N_NEXT,
3372  .next_nodes = {
3373  [IKEV2_NEXT_IP6_LOOKUP] = "ip6-lookup",
3374  [IKEV2_NEXT_IP6_ERROR_DROP] = "error-drop",
3375  },
3376 };
3377 /* *INDENT-ON* */
3378 
3379 // set ikev2 proposals when vpp is used as initiator
3380 static clib_error_t *
3382  ikev2_transforms_set * ts,
3383  ikev2_sa_proposal_t ** proposals, int is_ike)
3384 {
3385  clib_error_t *r;
3386  ikev2_main_t *km = &ikev2_main;
3387  ikev2_sa_proposal_t *proposal;
3388  vec_add2 (*proposals, proposal, 1);
3390  int error;
3391 
3392  /* Encryption */
3393  error = 1;
3395  {
3396  if (td->type == IKEV2_TRANSFORM_TYPE_ENCR
3397  && td->encr_type == ts->crypto_alg
3398  && td->key_len == ts->crypto_key_size / 8)
3399  {
3400  u16 attr[2];
3401  attr[0] = clib_host_to_net_u16 (14 | (1 << 15));
3402  attr[1] = clib_host_to_net_u16 (td->key_len << 3);
3403  vec_add (td->attrs, (u8 *) attr, 4);
3404  vec_add1 (proposal->transforms, *td);
3405  td->attrs = 0;
3406 
3407  error = 0;
3408  break;
3409  }
3410  }
3411  if (error)
3412  {
3413  r = clib_error_return (0, "Unsupported algorithm");
3414  return r;
3415  }
3416 
3417  if (IKEV2_TRANSFORM_INTEG_TYPE_NONE != ts->integ_alg)
3418  {
3419  /* Integrity */
3420  error = 1;
3422  {
3423  if (td->type == IKEV2_TRANSFORM_TYPE_INTEG
3424  && td->integ_type == ts->integ_alg)
3425  {
3426  vec_add1 (proposal->transforms, *td);
3427  error = 0;
3428  break;
3429  }
3430  }
3431  if (error)
3432  {
3434  ("Didn't find any supported algorithm for IKEV2_TRANSFORM_TYPE_INTEG");
3435  r = clib_error_return (0, "Unsupported algorithm");
3436  return r;
3437  }
3438  }
3439 
3440  /* PRF */
3441  if (is_ike)
3442  {
3443  error = 1;
3445  {
3446  if (td->type == IKEV2_TRANSFORM_TYPE_PRF
3447  && td->prf_type == IKEV2_TRANSFORM_PRF_TYPE_PRF_HMAC_SHA2_256)
3448  {
3449  vec_add1 (proposal->transforms, *td);
3450  error = 0;
3451  break;
3452  }
3453  }
3454  if (error)
3455  {
3456  r = clib_error_return (0, "Unsupported algorithm");
3457  return r;
3458  }
3459  }
3460 
3461  /* DH */
3462  if (is_ike)
3463  {
3464  error = 1;
3466  {
3467  if (td->type == IKEV2_TRANSFORM_TYPE_DH && td->dh_type == ts->dh_type)
3468  {
3469  vec_add1 (proposal->transforms, *td);
3470  if (is_ike)
3471  {
3472  sa->dh_group = td->dh_type;
3473  }
3474  error = 0;
3475  break;
3476  }
3477  }
3478  if (error)
3479  {
3480  r = clib_error_return (0, "Unsupported algorithm");
3481  return r;
3482  }
3483  }
3484 
3485  if (!is_ike)
3486  {
3487  error = 1;
3489  {
3490  if (td->type == IKEV2_TRANSFORM_TYPE_ESN)
3491  {
3492  vec_add1 (proposal->transforms, *td);
3493  error = 0;
3494  }
3495  }
3496  if (error)
3497  {
3498  r = clib_error_return (0, "Unsupported algorithm");
3499  return r;
3500  }
3501  }
3502 
3503 
3504  return 0;
3505 }
3506 
3507 static ikev2_profile_t *
3509 {
3510  ikev2_main_t *km = &ikev2_main;
3511  uword *p;
3512 
3513  p = mhash_get (&km->profile_index_by_name, name);
3514  if (!p)
3515  return 0;
3516 
3517  return pool_elt_at_index (km->profiles, p[0]);
3518 }
3519 
3520 
3521 static void
3524 {
3525  ip4_header_t *ip40;
3526  ip6_header_t *ip60;
3527  udp_header_t *udp0;
3528  vlib_buffer_t *b0;
3529  vlib_frame_t *f;
3530  u32 *to_next;
3531 
3532  b0 = vlib_get_buffer (vm, bi0);
3533  vlib_buffer_advance (b0, -sizeof (udp_header_t));
3534  udp0 = vlib_buffer_get_current (b0);
3535  udp0->dst_port = clib_host_to_net_u16 (dst_port);
3536  udp0->src_port = clib_host_to_net_u16 (src_port);
3537  udp0->length = clib_host_to_net_u16 (len + sizeof (udp_header_t));
3538  udp0->checksum = 0;
3539 
3540  if (ip_addr_version (dst) == AF_IP4)
3541  {
3542  vlib_buffer_advance (b0, -sizeof (ip4_header_t));
3543  ip40 = vlib_buffer_get_current (b0);
3544  ip40->ip_version_and_header_length = 0x45;
3545  ip40->tos = 0;
3546  ip40->fragment_id = 0;
3547  ip40->flags_and_fragment_offset = 0;
3548  ip40->ttl = 0xff;
3549  ip40->protocol = IP_PROTOCOL_UDP;
3550  ip40->dst_address.as_u32 = ip_addr_v4 (dst).as_u32;
3551  ip40->src_address.as_u32 = ip_addr_v4 (src).as_u32;
3552  b0->current_length =
3553  len + sizeof (ip4_header_t) + sizeof (udp_header_t);
3554  ip40->length = clib_host_to_net_u16 (b0->current_length);
3555  ip40->checksum = ip4_header_checksum (ip40);
3556  }
3557  else
3558  {
3559  vlib_buffer_advance (b0, -sizeof (ip6_header_t));
3560  ip60 = vlib_buffer_get_current (b0);
3561 
3562  b0->current_length = len + sizeof (*ip60) + sizeof (udp_header_t);
3564  clib_host_to_net_u32 (0x6 << 28);
3565  ip60->payload_length =
3566  clib_host_to_net_u16 (b0->current_length - sizeof (*ip60));
3567  ip60->protocol = IP_PROTOCOL_UDP;
3568  ip60->hop_limit = 0xff;
3569  clib_memcpy_fast (ip60->src_address.as_u8, ip_addr_v6 (src).as_u8,
3570  sizeof (ip60->src_address));
3571  clib_memcpy_fast (ip60->dst_address.as_u8, ip_addr_v6 (dst).as_u8,
3572  sizeof (ip60->src_address));
3573  }
3574 
3575  b0->flags |= VNET_BUFFER_F_LOCALLY_ORIGINATED;
3576  vnet_buffer (b0)->sw_if_index[VLIB_RX] = sw_if_index;
3577  vnet_buffer (b0)->sw_if_index[VLIB_TX] = ~0;
3578 
3579  u32 next_index = (ip_addr_version (dst) == AF_IP4) ?
3580  ip4_lookup_node.index : ip6_lookup_node.index;
3581 
3582  /* send the request */
3583  f = vlib_get_frame_to_node (vm, next_index);
3584  to_next = vlib_frame_vector_args (f);
3585  to_next[0] = bi0;
3586  f->n_vectors = 1;
3587  vlib_put_frame_to_node (vm, next_index, f);
3588 
3589 }
3590 
3591 static u32
3593 {
3594  u32 bi0;
3595  if (vlib_buffer_alloc (vm, &bi0, 1) != 1)
3596  {
3597  *b = 0;
3598  return 0;
3599  }
3600  *b = vlib_get_buffer (vm, bi0);
3601  return bi0;
3602 }
3603 
3604 clib_error_t *
3606 {
3607  ikev2_main_t *km = &ikev2_main;
3608 
3609  if (km->pkey)
3610  EVP_PKEY_free (km->pkey);
3611  km->pkey = ikev2_load_key_file (file);
3612  if (km->pkey == NULL)
3613  return clib_error_return (0, "load key '%s' failed", file);
3614 
3615  return 0;
3616 }
3617 
3620 {
3621  ikev2_main_t *km = &ikev2_main;
3622  udp_dst_port_info_t *pi;
3623 
3624  uword *v = hash_get (km->udp_ports, port);
3625  pi = udp_get_dst_port_info (&udp_main, port, UDP_IP4);
3626 
3627  if (v)
3628  {
3629  /* IKE already uses this port, only increment reference counter */
3630  ASSERT (pi);
3631  v[0]++;
3632  }
3633  else
3634  {
3635  if (pi)
3636  return VNET_API_ERROR_UDP_PORT_TAKEN;
3637 
3638  udp_register_dst_port (km->vlib_main, port,
3639  ipsec4_tun_input_node.index, 1);
3640  hash_set (km->udp_ports, port, 1);
3641  }
3643  return 0;
3644 }
3645 
3648 {
3649  ikev2_main_t *km = &ikev2_main;
3650  uword *v;
3651 
3653  return;
3654 
3655  v = hash_get (km->udp_ports, p->ipsec_over_udp_port);
3656  if (!v)
3657  return;
3658 
3659  v[0]--;
3660 
3661  if (v[0] == 0)
3662  {
3665  }
3666 
3668 }
3669 
3670 static void
3673  ikev2_sa_t * sa, u8 send_notification)
3674 {
3675  ikev2_main_t *km = &ikev2_main;
3676  ip_address_t *src, *dst;
3677  vlib_buffer_t *b0;
3679 
3680  /* Create the Initiator notification for IKE SA removal */
3681  ike_header_t *ike0;
3682  u32 bi0 = 0;
3683  int len;
3684 
3685  vec_resize (sa->del, 1);
3687  sa->del->spi = sa->ispi;
3688 
3689  if (send_notification)
3690  {
3691  bi0 = ikev2_get_new_ike_header_buff (vm, &b0);
3692  if (!bi0)
3693  {
3694  ikev2_log_error ("buffer alloc failure");
3695  goto delete_sa;
3696  }
3697 
3698  ike0 = vlib_buffer_get_current (b0);
3699  ike0->exchange = IKEV2_EXCHANGE_INFORMATIONAL;
3700  ike0->ispi = clib_host_to_net_u64 (sa->ispi);
3701  ike0->rspi = clib_host_to_net_u64 (sa->rspi);
3702  ike0->flags = 0;
3703  ike0->msgid = clib_host_to_net_u32 (sa->last_init_msg_id);
3704  sa->last_init_msg_id += 1;
3705  len = ikev2_generate_message (b0, sa, ike0, 0, 0);
3706  if (~0 == len)
3707  return;
3708 
3709  if (ikev2_natt_active (sa))
3710  len = ikev2_insert_non_esp_marker (ike0, len);
3711 
3712  if (sa->is_initiator)
3713  {
3714  src = &sa->iaddr;
3715  dst = &sa->raddr;
3716  }
3717  else
3718  {
3719  dst = &sa->iaddr;
3720  src = &sa->raddr;
3721  }
3722 
3723  ikev2_send_ike (vm, src, dst, bi0, len,
3724  ikev2_get_port (sa), sa->dst_port, 0);
3725  }
3726 
3727 delete_sa:
3728  /* delete local SA */
3729  vec_foreach (c, sa->childs)
3731 
3732  u64 rspi = sa->rspi;
3733  ikev2_sa_free_all_vec (sa);
3734  uword *p = hash_get (tkm->sa_by_rspi, rspi);
3735  if (p)
3736  {
3737  hash_unset (tkm->sa_by_rspi, rspi);
3738  pool_put (tkm->sas, sa);
3739  }
3740 }
3741 
3742 static void
3744 {
3746  ikev2_sa_t *sa;
3747  u32 pi = p - km->profiles;
3748  u32 *sai;
3749  u32 *del_sai = 0;
3750 
3751  /* *INDENT-OFF* */
3752  pool_foreach(sa, km->sais, ({
3753  if (pi == sa->profile_index)
3754  vec_add1 (del_sai, sa - km->sais);
3755  }));
3756  /* *INDENT-ON* */
3757 
3758  vec_foreach (sai, del_sai)
3759  {
3760  sa = pool_elt_at_index (km->sais, sai[0]);
3761  ikev2_sa_free_all_vec (sa);
3762  hash_unset (km->sa_by_ispi, sa->ispi);
3763  pool_put (km->sais, sa);
3764  }
3765  vec_reset_length (del_sai);
3766 
3767  vec_foreach (tkm, km->per_thread_data)
3768  {
3769  /* *INDENT-OFF* */
3770  pool_foreach (sa, tkm->sas, ({
3771  if (sa->profile_index != ~0 && pi == sa->profile_index)
3772  vec_add1 (del_sai, sa - tkm->sas);
3773  }));
3774  /* *INDENT-ON* */
3775 
3776  vec_foreach (sai, del_sai)
3777  {
3778  sa = pool_elt_at_index (tkm->sas, sai[0]);
3780  }
3781 
3782  vec_reset_length (del_sai);
3783  }
3784 
3785  vec_free (del_sai);
3786 }
3787 
3788 static void
3790 {
3791  vec_free (p->name);
3792 
3793  vec_free (p->auth.data);
3794  if (p->auth.key)
3795  EVP_PKEY_free (p->auth.key);
3796 
3797  vec_free (p->loc_id.data);
3798  vec_free (p->rem_id.data);
3799 }
3800 
3801 clib_error_t *
3803 {
3804  ikev2_main_t *km = &ikev2_main;
3805  ikev2_profile_t *p;
3806 
3807  if (is_add)
3808  {
3809  if (ikev2_profile_index_by_name (name))
3810  return clib_error_return (0, "policy %v already exists", name);
3811 
3812  pool_get (km->profiles, p);
3813  clib_memset (p, 0, sizeof (*p));
3814  p->name = vec_dup (name);
3816  p->responder.sw_if_index = ~0;
3817  p->tun_itf = ~0;
3818  uword index = p - km->profiles;
3819  mhash_set_mem (&km->profile_index_by_name, name, &index, 0);
3820  }
3821  else
3822  {
3823  p = ikev2_profile_index_by_name (name);
3824  if (!p)
3825  return clib_error_return (0, "policy %v does not exists", name);
3826 
3829 
3830  ikev2_profile_free (p);
3831  pool_put (km->profiles, p);
3832  mhash_unset (&km->profile_index_by_name, name, 0);
3833  }
3834  return 0;
3835 }
3836 
3837 clib_error_t *
3839  u8 * auth_data, u8 data_hex_format)
3840 {
3841  ikev2_profile_t *p;
3842  clib_error_t *r;
3843 
3844  p = ikev2_profile_index_by_name (name);
3845 
3846  if (!p)
3847  {
3848  r = clib_error_return (0, "unknown profile %v", name);
3849  return r;
3850  }
3851 
3852  if (p->auth.key)
3853  EVP_PKEY_free (p->auth.key);
3854  vec_free (p->auth.data);
3855 
3856  p->auth.method = auth_method;
3857  p->auth.data = vec_dup (auth_data);
3858  p->auth.hex = data_hex_format;
3859 
3860  if (auth_method == IKEV2_AUTH_METHOD_RSA_SIG)
3861  {
3862  vec_add1 (p->auth.data, 0);
3864  if (p->auth.key == NULL)
3865  return clib_error_return (0, "load cert '%s' failed", p->auth.data);
3866  }
3867 
3868  return 0;
3869 }
3870 
3871 static int
3873 {
3874  return (id_type == IKEV2_ID_TYPE_ID_IPV4_ADDR ||
3875  id_type == IKEV2_ID_TYPE_ID_IPV6_ADDR ||
3876  id_type == IKEV2_ID_TYPE_ID_RFC822_ADDR ||
3877  id_type == IKEV2_ID_TYPE_ID_FQDN);
3878 }
3879 
3880 clib_error_t *
3882  int is_local)
3883 {
3884  ikev2_profile_t *p;
3885  clib_error_t *r;
3886 
3887  if (!ikev2_is_id_supported (id_type))
3888  {
3889  r = clib_error_return (0, "unsupported identity type %U",
3890  format_ikev2_id_type, id_type);
3891  return r;
3892  }
3893 
3894  p = ikev2_profile_index_by_name (name);
3895 
3896  if (!p)
3897  {
3898  r = clib_error_return (0, "unknown profile %v", name);
3899  return r;
3900  }
3901 
3902  if (is_local)
3903  {
3904  vec_free (p->loc_id.data);
3905  p->loc_id.type = id_type;
3906  p->loc_id.data = vec_dup (data);
3907  }
3908  else
3909  {
3910  vec_free (p->rem_id.data);
3911  p->rem_id.type = id_type;
3912  p->rem_id.data = vec_dup (data);
3913  }
3914 
3915  return 0;
3916 }
3917 
3920 {
3921  if (ip_addr_version (addr) == AF_IP4)
3923  else
3925 }
3926 
3929  const ip_address_t * end)
3930 {
3931  ip_address_copy (&ts->start_addr, start);
3932  ip_address_copy (&ts->end_addr, end);
3933 }
3934 
3935 clib_error_t *
3939 {
3940  ikev2_profile_t *p;
3941  clib_error_t *r;
3942 
3943  p = ikev2_profile_index_by_name (name);
3944 
3945  if (!p)
3946  {
3947  r = clib_error_return (0, "unknown profile %v", name);
3948  return r;
3949  }
3950 
3951  if (ip_addr_version (&start_addr) != ip_addr_version (&end_addr))
3952  return clib_error_return (0, "IP address version mismatch!");
3953 
3954  if (is_local)
3955  {
3956  ikev2_set_ts_addrs (&p->loc_ts, &start_addr, &end_addr);
3958  p->loc_ts.end_port = end_port;
3960  ikev2_set_ts_type (&p->loc_ts, &start_addr);
3961  }
3962  else
3963  {
3964  ikev2_set_ts_addrs (&p->rem_ts, &start_addr, &end_addr);
3966  p->rem_ts.end_port = end_port;
3968  ikev2_set_ts_type (&p->rem_ts, &start_addr);
3969  }
3970 
3971  return 0;
3972 }
3973 
3974 
3975 clib_error_t *
3978 {
3979  ikev2_profile_t *p;
3980  clib_error_t *r;
3981 
3982  p = ikev2_profile_index_by_name (name);
3983 
3984  if (!p)
3985  {
3986  r = clib_error_return (0, "unknown profile %v", name);
3987  return r;
3988  }
3989 
3991  ip_address_copy (&p->responder.addr, &addr);
3992 
3993  return 0;
3994 }
3995 
3996 clib_error_t *
3998  ikev2_transform_encr_type_t crypto_alg,
4000  ikev2_transform_dh_type_t dh_type,
4002 {
4003  ikev2_profile_t *p;
4004  clib_error_t *r;
4005 
4006  p = ikev2_profile_index_by_name (name);
4007 
4008  if (!p)
4009  {
4010  r = clib_error_return (0, "unknown profile %v", name);
4011  return r;
4012  }
4013 
4014  p->ike_ts.crypto_alg = crypto_alg;
4015  p->ike_ts.integ_alg = integ_alg;
4016  p->ike_ts.dh_type = dh_type;
4018  return 0;
4019 }
4020 
4021 clib_error_t *
4023  ikev2_transform_encr_type_t crypto_alg,
4026 {
4027  ikev2_profile_t *p;
4028  clib_error_t *r;
4029 
4030  p = ikev2_profile_index_by_name (name);
4031 
4032  if (!p)
4033  {
4034  r = clib_error_return (0, "unknown profile %v", name);
4035  return r;
4036  }
4037 
4038  p->esp_ts.crypto_alg = crypto_alg;
4039  p->esp_ts.integ_alg = integ_alg;
4041  return 0;
4042 }
4043 
4044 clib_error_t *
4046  u8 * name, u32 sw_if_index)
4047 {
4048  ikev2_profile_t *p;
4049  clib_error_t *r;
4050 
4051  p = ikev2_profile_index_by_name (name);
4052 
4053  if (!p)
4054  {
4055  r = clib_error_return (0, "unknown profile %v", name);
4056  return r;
4057  }
4058 
4059  p->tun_itf = sw_if_index;
4060 
4061  return 0;
4062 }
4063 
4066  u8 is_set)
4067 {
4069  ikev2_main_t *km = &ikev2_main;
4070  vnet_api_error_t rv = 0;
4071  uword *v;
4072 
4073  if (!p)
4074  return VNET_API_ERROR_INVALID_VALUE;
4075 
4076  if (is_set)
4077  {
4079  return VNET_API_ERROR_VALUE_EXIST;
4080 
4081  rv = ikev2_register_udp_port (p, port);
4082  }
4083  else
4084  {
4085  v = hash_get (km->udp_ports, port);
4086  if (!v)
4087  return VNET_API_ERROR_IKE_NO_PORT;
4088 
4090  return VNET_API_ERROR_INVALID_VALUE;
4091 
4093  }
4094  return rv;
4095 }
4096 
4097 clib_error_t *
4099 {
4101  clib_error_t *r;
4102 
4103  if (!p)
4104  {
4105  r = clib_error_return (0, "unknown profile %v", name);
4106  return r;
4107  }
4108 
4109  p->udp_encap = 1;
4110  return 0;
4111 }
4112 
4113 clib_error_t *
4115  u64 lifetime, u32 jitter, u32 handover,
4116  u64 maxdata)
4117 {
4118  ikev2_profile_t *p;
4119  clib_error_t *r;
4120 
4121  p = ikev2_profile_index_by_name (name);
4122 
4123  if (!p)
4124  {
4125  r = clib_error_return (0, "unknown profile %v", name);
4126  return r;
4127  }
4128 
4129  p->lifetime = lifetime;
4130  p->lifetime_jitter = jitter;
4131  p->handover = handover;
4132  p->lifetime_maxdata = maxdata;
4133  return 0;
4134 }
4135 
4136 static int
4138  ip_address_t * out_addr)
4139 {
4140  ip4_address_t *if_ip4;
4141  ip6_address_t *if_ip6;
4142 
4143  if (af == AF_IP4)
4144  {
4145  if_ip4 = ip4_interface_first_address (&ip4_main, sw_if_index, 0);
4146  if (if_ip4)
4147  {
4148  ip_address_set (out_addr, if_ip4, AF_IP4);
4149  return 1;
4150  }
4151  }
4152  else
4153  {
4154  if_ip6 = ip6_interface_first_address (&ip6_main, sw_if_index);
4155  if (if_ip6)
4156  {
4157  ip_address_set (out_addr, if_ip6, AF_IP6);
4158  return 1;
4159  }
4160  }
4161  return 0;
4162 }
4163 
4164 clib_error_t *
4166 {
4167  ikev2_profile_t *p;
4168  clib_error_t *r;
4169  ikev2_main_t *km = &ikev2_main;
4170  vlib_buffer_t *b0;
4171  ike_header_t *ike0;
4172  u32 bi0 = 0;
4173  int len = sizeof (ike_header_t), valid_ip = 0;
4174  ip_address_t if_ip = { };
4175 
4176  p = ikev2_profile_index_by_name (name);
4177 
4178  if (!p)
4179  {
4180  r = clib_error_return (0, "unknown profile %v", name);
4181  return r;
4182  }
4183 
4184  if (p->responder.sw_if_index == ~0
4186  {
4187  r = clib_error_return (0, "responder not set for profile %v", name);
4188  return r;
4189  }
4190 
4192  ip_addr_version (&p->responder.addr), &if_ip))
4193  {
4194  valid_ip = 1;
4195  }
4196 
4197  /* Prepare the SA and the IKE payload */
4198  ikev2_sa_t sa;
4199  clib_memset (&sa, 0, sizeof (ikev2_sa_t));
4200  ikev2_payload_chain_t *chain = 0;
4201  ikev2_payload_new_chain (chain);
4202 
4203  /* Build the IKE proposal payload */
4204  ikev2_sa_proposal_t *proposals = 0;
4205  ikev2_set_initiator_proposals (vm, &sa, &p->ike_ts, &proposals, 1);
4206  proposals[0].proposal_num = 1;
4207  proposals[0].protocol_id = IKEV2_PROTOCOL_IKE;
4208 
4209  /* Add and then cleanup proposal data */
4210  ikev2_payload_add_sa (chain, proposals);
4211  ikev2_sa_free_proposal_vector (&proposals);
4212 
4213  sa.is_initiator = 1;
4214  sa.profile_index = p - km->profiles;
4216  sa.tun_itf = p->tun_itf;
4217  sa.udp_encap = p->udp_encap;
4218  if (p->natt_disabled)
4221  sa.is_tun_itf_set = 1;
4222  sa.initial_contact = 1;
4223  sa.dst_port = IKEV2_PORT;
4224 
4226  if (rc != IKEV2_GENERATE_SA_INIT_OK)
4227  {
4228  ikev2_sa_free_all_vec (&sa);
4230  return clib_error_return (0, "%U", format_ikev2_gen_sa_error, rc);
4231  }
4232 
4233  ikev2_payload_add_ke (chain, sa.dh_group, sa.i_dh_data);
4234  ikev2_payload_add_nonce (chain, sa.i_nonce);
4235 
4236  /* Build the child SA proposal */
4237  vec_resize (sa.childs, 1);
4238  ikev2_set_initiator_proposals (vm, &sa, &p->esp_ts,
4239  &sa.childs[0].i_proposals, 0);
4240  sa.childs[0].i_proposals[0].proposal_num = 1;
4242  RAND_bytes ((u8 *) & sa.childs[0].i_proposals[0].spi,
4243  sizeof (sa.childs[0].i_proposals[0].spi));
4244 
4245  /* Add NAT detection notification messages (mandatory) */
4246  u8 *nat_detection_sha1 =
4247  ikev2_compute_nat_sha1 (clib_host_to_net_u64 (sa.ispi),
4248  clib_host_to_net_u64 (sa.rspi),
4249  &if_ip, clib_host_to_net_u16 (IKEV2_PORT));
4250 
4251  ikev2_payload_add_notify (chain, IKEV2_NOTIFY_MSG_NAT_DETECTION_SOURCE_IP,
4252  nat_detection_sha1);
4253  vec_free (nat_detection_sha1);
4254  nat_detection_sha1 =
4255  ikev2_compute_nat_sha1 (clib_host_to_net_u64 (sa.ispi),
4256  clib_host_to_net_u64 (sa.rspi),
4257  &p->responder.addr,
4258  clib_host_to_net_u16 (sa.dst_port));
4259  ikev2_payload_add_notify (chain,
4260  IKEV2_NOTIFY_MSG_NAT_DETECTION_DESTINATION_IP,
4261  nat_detection_sha1);
4262  vec_free (nat_detection_sha1);
4263 
4264  u8 *sig_hash_algo = vec_new (u8, 8);
4265  u64 tmpsig = clib_host_to_net_u64 (0x0001000200030004);
4266  clib_memcpy_fast (sig_hash_algo, &tmpsig, sizeof (tmpsig));
4267  ikev2_payload_add_notify (chain,
4268  IKEV2_NOTIFY_MSG_SIGNATURE_HASH_ALGORITHMS,
4269  sig_hash_algo);
4270  vec_free (sig_hash_algo);
4271 
4272  bi0 = ikev2_get_new_ike_header_buff (vm, &b0);
4273  if (!bi0)
4274  {
4275  ikev2_sa_free_all_vec (&sa);
4277  char *errmsg = "buffer alloc failure";
4278  ikev2_log_error (errmsg);
4279  return clib_error_return (0, errmsg);
4280  }
4281  ike0 = vlib_buffer_get_current (b0);
4282 
4283  /* Buffer update and boilerplate */
4284  len += vec_len (chain->data);
4285  ike0->nextpayload = chain->first_payload_type;
4286  ike0->length = clib_host_to_net_u32 (len);
4287  clib_memcpy_fast (ike0->payload, chain->data, vec_len (chain->data));
4289 
4290  ike0->version = IKE_VERSION_2;
4291  ike0->flags = IKEV2_HDR_FLAG_INITIATOR;
4292  ike0->exchange = IKEV2_EXCHANGE_SA_INIT;
4293  ike0->ispi = clib_host_to_net_u64 (sa.ispi);
4294  ike0->rspi = 0;
4295  ike0->msgid = 0;
4296  sa.last_init_msg_id += 1;
4297 
4298  /* store whole IKE payload - needed for PSK auth */
4300  vec_add (sa.last_sa_init_req_packet_data, ike0, len);
4301 
4302  /* add data to the SA then add it to the pool */
4303  ip_address_copy (&sa.iaddr, &if_ip);
4304  ip_address_copy (&sa.raddr, &p->responder.addr);
4305  sa.i_id.type = p->loc_id.type;
4306  sa.i_id.data = vec_dup (p->loc_id.data);
4307  sa.r_id.type = p->rem_id.type;
4308  sa.r_id.data = vec_dup (p->rem_id.data);
4309  sa.i_auth.method = p->auth.method;
4310  sa.i_auth.hex = p->auth.hex;
4311  sa.i_auth.data = vec_dup (p->auth.data);
4313  vec_add (sa.childs[0].tsi, &p->loc_ts, 1);
4314  vec_add (sa.childs[0].tsr, &p->rem_ts, 1);
4315 
4317 
4318  /* add SA to the pool */
4319  ikev2_sa_t *sa0 = 0;
4320  pool_get (km->sais, sa0);
4321  clib_memcpy_fast (sa0, &sa, sizeof (*sa0));
4322  hash_set (km->sa_by_ispi, sa0->ispi, sa0 - km->sais);
4323 
4324  if (valid_ip)
4325  {
4326  ikev2_send_ike (vm, &if_ip, &p->responder.addr, bi0, len,
4327  IKEV2_PORT, sa.dst_port, sa.sw_if_index);
4328 
4330  ("ispi %lx rspi %lx IKEV2_EXCHANGE_SA_INIT sent to ",
4331  clib_host_to_net_u64 (sa0->ispi), 0,
4332  ip_addr_v4 (&p->responder.addr).as_u32,
4334  }
4335  else
4336  {
4337  r =
4338  clib_error_return (0, "interface %U does not have any IP address!",
4340  p->responder.sw_if_index);
4341  return r;
4342  }
4343 
4344  return 0;
4345 }
4346 
4347 static void
4349  ikev2_child_sa_t * csa)
4350 {
4351  /* Create the Initiator notification for child SA removal */
4352  ikev2_main_t *km = &ikev2_main;
4353  ike_header_t *ike0;
4354  u32 bi0 = 0;
4355  vlib_buffer_t *b0;
4356  int len;
4357 
4358  bi0 = ikev2_get_new_ike_header_buff (vm, &b0);
4359  if (!bi0)
4360  {
4361  ikev2_log_error ("buffer alloc failure");
4362  return;
4363  }
4364 
4365  ike0 = vlib_buffer_get_current (b0);
4366  ike0->exchange = IKEV2_EXCHANGE_INFORMATIONAL;
4367  ike0->ispi = clib_host_to_net_u64 (sa->ispi);
4368  ike0->rspi = clib_host_to_net_u64 (sa->rspi);
4369  ike0->flags = 0;
4370  vec_resize (sa->del, 1);
4372  sa->del->spi = csa->i_proposals->spi;
4373  ike0->msgid = clib_host_to_net_u32 (sa->last_init_msg_id);
4374  sa->last_init_msg_id += 1;
4375  len = ikev2_generate_message (b0, sa, ike0, 0, 0);
4376  if (~0 == len)
4377  return;
4378 
4379  if (ikev2_natt_active (sa))
4380  len = ikev2_insert_non_esp_marker (ike0, len);
4381  ikev2_send_ike (vm, &sa->iaddr, &sa->raddr, bi0, len,
4382  ikev2_get_port (sa), sa->dst_port, sa->sw_if_index);
4383 
4384  /* delete local child SA */
4386  ikev2_sa_del_child_sa (sa, csa);
4387 }
4388 
4389 clib_error_t *
4391 {
4392  clib_error_t *r;
4393  ikev2_main_t *km = &ikev2_main;
4395  ikev2_sa_t *fsa = 0;
4396  ikev2_child_sa_t *fchild = 0;
4397 
4398  /* Search for the child SA */
4399  vec_foreach (tkm, km->per_thread_data)
4400  {
4401  ikev2_sa_t *sa;
4402  if (fchild)
4403  break;
4404  /* *INDENT-OFF* */
4405  pool_foreach (sa, tkm->sas, ({
4406  fchild = ikev2_sa_get_child(sa, ispi, IKEV2_PROTOCOL_ESP, 1);
4407  if (fchild)
4408  {
4409  fsa = sa;
4410  break;
4411  }
4412  }));
4413  /* *INDENT-ON* */
4414  }
4415 
4416  if (!fchild || !fsa)
4417  {
4418  r = clib_error_return (0, "Child SA not found");
4419  return r;
4420  }
4421  else
4422  {
4423  ikev2_delete_child_sa_internal (vm, fsa, fchild);
4424  }
4425 
4426  return 0;
4427 }
4428 
4429 clib_error_t *
4431 {
4432  clib_error_t *r;
4433  ikev2_main_t *km = &ikev2_main;
4435  ikev2_sa_t *fsa = 0;
4436  ikev2_main_per_thread_data_t *ftkm = 0;
4437 
4438  /* Search for the IKE SA */
4439  vec_foreach (tkm, km->per_thread_data)
4440  {
4441  ikev2_sa_t *sa;
4442  if (fsa)
4443  break;
4444  /* *INDENT-OFF* */
4445  pool_foreach (sa, tkm->sas, ({
4446  if (sa->ispi == ispi)
4447  {
4448  fsa = sa;
4449  ftkm = tkm;
4450  break;
4451  }
4452  }));
4453  /* *INDENT-ON* */
4454  }
4455 
4456  if (!fsa)
4457  {
4458  r = clib_error_return (0, "IKE SA not found");
4459  return r;
4460  }
4461 
4462  ikev2_initiate_delete_ike_sa_internal (vm, ftkm, fsa, 1);
4463  return 0;
4464 }
4465 
4466 static void
4468  ikev2_child_sa_t * csa)
4469 {
4470  /* Create the Initiator request for create child SA */
4471  ike_header_t *ike0;
4472  vlib_buffer_t *b0;
4473  u32 bi0 = 0;
4474  int len;
4475 
4476  bi0 = ikev2_get_new_ike_header_buff (vm, &b0);
4477  if (!bi0)
4478  {
4479  ikev2_log_error ("buffer alloc failure");
4480  return;
4481  }
4482 
4483  ike0 = vlib_buffer_get_current (b0);
4484  ike0->version = IKE_VERSION_2;
4485  ike0->flags = IKEV2_HDR_FLAG_INITIATOR;
4486  ike0->exchange = IKEV2_EXCHANGE_CREATE_CHILD_SA;
4487  ike0->ispi = clib_host_to_net_u64 (sa->ispi);
4488  ike0->rspi = clib_host_to_net_u64 (sa->rspi);
4489  ike0->msgid = clib_host_to_net_u32 (sa->last_init_msg_id);
4490  sa->last_init_msg_id += 1;
4491 
4492  ikev2_rekey_t *rekey;
4493  vec_reset_length (sa->rekey);
4494  vec_add2 (sa->rekey, rekey, 1);
4495  ikev2_sa_proposal_t *proposals = vec_dup (csa->i_proposals);
4496 
4497  /*need new ispi */
4498  RAND_bytes ((u8 *) & proposals[0].spi, sizeof (proposals[0].spi));
4499  rekey->spi = proposals[0].spi;
4500  rekey->ispi = csa->i_proposals->spi;
4501  len = ikev2_generate_message (b0, sa, ike0, proposals, 0);
4502  if (~0 == len)
4503  return;
4504 
4505  if (ikev2_natt_active (sa))
4506  len = ikev2_insert_non_esp_marker (ike0, len);
4507  ikev2_send_ike (vm, &sa->iaddr, &sa->raddr, bi0, len,
4508  ikev2_get_port (sa), ikev2_get_port (sa), sa->sw_if_index);
4509  vec_free (proposals);
4510 }
4511 
4512 clib_error_t *
4514 {
4515  clib_error_t *r;
4516  ikev2_main_t *km = &ikev2_main;
4518  ikev2_sa_t *fsa = 0;
4519  ikev2_child_sa_t *fchild = 0;
4520 
4521  /* Search for the child SA */
4522  vec_foreach (tkm, km->per_thread_data)
4523  {
4524  ikev2_sa_t *sa;
4525  if (fchild)
4526  break;
4527  /* *INDENT-OFF* */
4528  pool_foreach (sa, tkm->sas, ({
4529  fchild = ikev2_sa_get_child(sa, ispi, IKEV2_PROTOCOL_ESP, 1);
4530  if (fchild)
4531  {
4532  fsa = sa;
4533  break;
4534  }
4535  }));
4536  /* *INDENT-ON* */
4537  }
4538 
4539  if (!fchild || !fsa)
4540  {
4541  r = clib_error_return (0, "Child SA not found");
4542  return r;
4543  }
4544  else
4545  {
4546  ikev2_rekey_child_sa_internal (vm, fsa, fchild);
4547  }
4548 
4549  return 0;
4550 }
4551 
4552 static int
4554 {
4555  return (sa->sw_if_index == sw_if_index) && sa->is_initiator;
4556 }
4557 
4558 static void
4560 {
4561  u64 *ispi, *ispi_vec = 0;
4562  ikev2_sa_t *sa, **sap, **sa_vec = 0;
4563  ikev2_main_t *km = &ikev2_main;
4565  p->responder.sw_if_index = ~0;
4566 
4567  vec_foreach (tkm, km->per_thread_data)
4568  {
4569  /* *INDENT-OFF* */
4570  pool_foreach (sa, tkm->sas, ({
4571  if (ikev2_sa_sw_if_match (sa, sw_if_index))
4572  vec_add1 (sa_vec, sa);
4573  }));
4574  /* *INDENT-ON* */
4575 
4576  vec_foreach (sap, sa_vec)
4577  {
4579  }
4580  vec_reset_length (sa_vec);
4581  }
4582  vec_free (sa_vec);
4583 
4584  /* *INDENT-OFF* */
4585  pool_foreach (sa, km->sais, ({
4586  if (ikev2_sa_sw_if_match (sa, sw_if_index))
4587  vec_add1 (ispi_vec, sa->ispi);
4588  }));
4589  /* *INDENT-ON* */
4590 
4591  vec_foreach (ispi, ispi_vec)
4592  {
4594  }
4595 
4596  vec_free (ispi_vec);
4597 }
4598 
4599 static clib_error_t *
4601 {
4602  ikev2_main_t *km = &ikev2_main;
4603  ikev2_profile_t *p;
4604 
4605  if (is_add)
4606  return 0;
4607 
4608  /* *INDENT-OFF* */
4609  pool_foreach (p, km->profiles, ({
4610  if (p->responder.sw_if_index == sw_if_index)
4611  ikev2_sa_del (p, sw_if_index);
4612  }));
4613  /* *INDENT-ON* */
4614 
4615  return 0;
4616 }
4617 
4619 
4620 clib_error_t *
4622 {
4623  ikev2_main_t *km = &ikev2_main;
4625  int thread_id;
4626 
4627  clib_memset (km, 0, sizeof (ikev2_main_t));
4628  km->vnet_main = vnet_get_main ();
4629  km->vlib_main = vm;
4630 
4633  ikev2_crypto_init (km);
4634 
4636 
4639  for (thread_id = 0; thread_id < tm->n_vlib_mains; thread_id++)
4640  {
4642  vec_elt_at_index (km->per_thread_data, thread_id);
4643 
4644  ptd->sa_by_rspi = hash_create (0, sizeof (uword));
4645 
4646 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
4647  ptd->evp_ctx = EVP_CIPHER_CTX_new ();
4648  ptd->hmac_ctx = HMAC_CTX_new ();
4649 #else
4650  EVP_CIPHER_CTX_init (&ptd->_evp_ctx);
4651  ptd->evp_ctx = &ptd->_evp_ctx;
4652  HMAC_CTX_init (&(ptd->_hmac_ctx));
4653  ptd->hmac_ctx = &ptd->_hmac_ctx;
4654 #endif
4655  }
4656 
4657  km->sa_by_ispi = hash_create (0, sizeof (uword));
4658  km->sw_if_indices = hash_create (0, 0);
4659  km->udp_ports = hash_create (0, sizeof (uword));
4660 
4665 
4667  vlib_punt_register (punt_hdl, ipsec_punt_reason[IPSEC_PUNT_IP4_SPI_UDP_0],
4668  "ikev2-ip4");
4670 
4671  km->log_level = IKEV2_LOG_ERROR;
4672  km->log_class = vlib_log_register_class ("ikev2", 0);
4673  return 0;
4674 }
4675 
4676 /* *INDENT-OFF* */
4678 {
4679  .runs_after = VLIB_INITS("ipsec_init", "ipsec_punt_init"),
4680 };
4681 /* *INDENT-ON* */
4682 
4683 static u8
4685  u8 del_old_ids)
4686 {
4687  ikev2_main_t *km = &ikev2_main;
4688  ikev2_profile_t *p = 0;
4689  vlib_main_t *vm = km->vlib_main;
4690  f64 now = vlib_time_now (vm);
4691  u8 res = 0;
4692 
4693  if (sa->profile_index != ~0)
4694  p = pool_elt_at_index (km->profiles, sa->profile_index);
4695 
4696  if (sa->is_initiator && p && csa->time_to_expiration
4697  && now > csa->time_to_expiration)
4698  {
4699  if (!csa->is_expired || csa->rekey_retries > 0)
4700  {
4701  ikev2_rekey_child_sa_internal (vm, sa, csa);
4702  csa->time_to_expiration = now + p->handover;
4703  csa->is_expired = 1;
4704  if (csa->rekey_retries == 0)
4705  {
4706  csa->rekey_retries = 5;
4707  }
4708  else if (csa->rekey_retries > 0)
4709  {
4710  csa->rekey_retries--;
4711  ikev2_log_debug ("Rekeying Child SA 0x%x, retries left %d",
4712  csa->i_proposals->spi, csa->rekey_retries);
4713  if (csa->rekey_retries == 0)
4714  {
4715  csa->rekey_retries = -1;
4716  }
4717  }
4718  res |= 1;
4719  }
4720  else
4721  {
4722  csa->time_to_expiration = 0;
4723  ikev2_delete_child_sa_internal (vm, sa, csa);
4724  res |= 1;
4725  return res;
4726  }
4727  }
4728 
4729  if (del_old_ids)
4730  {
4731  ipip_tunnel_t *ipip = NULL;
4732  u32 sw_if_index = sa->is_tun_itf_set ? sa->tun_itf : ~0;
4733  if (~0 == sw_if_index)
4734  {
4735  ip46_address_t local_ip;
4736  ip46_address_t remote_ip;
4737  if (sa->is_initiator)
4738  {
4739  local_ip = to_ip46 (ip_addr_version (&sa->iaddr),
4740  ip_addr_bytes (&sa->iaddr));
4741  remote_ip = to_ip46 (ip_addr_version (&sa->raddr),
4742  ip_addr_bytes (&sa->raddr));
4743  }
4744  else
4745  {
4746  local_ip = to_ip46 (ip_addr_version (&sa->raddr),
4747  ip_addr_bytes (&sa->raddr));
4748  remote_ip = to_ip46 (ip_addr_version (&sa->iaddr),
4749  ip_addr_bytes (&sa->iaddr));
4750  }
4751 
4752  /* *INDENT-OFF* */
4753  ipip_tunnel_key_t key = {
4754  .src = local_ip,
4755  .dst = remote_ip,
4756  .transport = IPIP_TRANSPORT_IP4,
4757  .fib_index = 0,
4758  };
4759  /* *INDENT-ON* */
4760 
4761  ipip = ipip_tunnel_db_find (&key);
4762 
4763  if (ipip)
4764  sw_if_index = ipip->sw_if_index;
4765  else
4766  return res;
4767  }
4768 
4769  u32 *sas_in = NULL;
4770  vec_add1 (sas_in, csa->remote_sa_id);
4772  int rv = ipsec_tun_protect_update (sw_if_index, NULL,
4773  csa->local_sa_id, sas_in);
4774  if (rv)
4775  vec_free (sas_in);
4778  }
4779 
4780  return res;
4781 }
4782 
4783 int
4785 {
4786  ikev2_main_t *km = &ikev2_main;
4787 
4788  if (log_level >= IKEV2_LOG_MAX)
4789  {
4790  ikev2_log_error ("unknown logging level %d", log_level);
4791  return -1;
4792  }
4793 
4794  km->log_level = log_level;
4795  return 0;
4796 }
4797 
4798 clib_error_t *
4799 ikev2_set_liveness_params (u32 period, u32 max_retries)
4800 {
4801  ikev2_main_t *km = &ikev2_main;
4802 
4803  if (period == 0 || max_retries == 0)
4804  return clib_error_return (0, "invalid args");
4805 
4806  km->liveness_period = period;
4807  km->liveness_max_retries = max_retries;
4808  return 0;
4809 }
4810 
4811 clib_error_t *
4813 {
4815  if (!p)
4816  return clib_error_return (0, "unknown profile %v", name);
4817 
4818  p->natt_disabled = 1;
4819  return 0;
4820 }
4821 
4822 static void
4824 {
4825  ikev2_main_t *km = &ikev2_main;
4826  vlib_main_t *vm = km->vlib_main;
4828  ikev2_sa_t *fsa = 0;
4829  ikev2_profile_t *p = 0;
4830  ikev2_child_sa_t *fchild = 0;
4831  f64 now = vlib_time_now (vm);
4832  vlib_counter_t counts;
4833 
4834  /* Search for the SA and child SA */
4835  vec_foreach (tkm, km->per_thread_data)
4836  {
4837  ikev2_sa_t *sa;
4838  if (fchild)
4839  break;
4840  /* *INDENT-OFF* */
4841  pool_foreach (sa, tkm->sas, ({
4842  fchild = ikev2_sa_get_child(sa, ipsec_sa->spi, IKEV2_PROTOCOL_ESP, 1);
4843  if (fchild)
4844  {
4845  fsa = sa;
4846  break;
4847  }
4848  }));
4849  /* *INDENT-ON* */
4850  }
4852  ipsec_sa->stat_index, &counts);
4853 
4854  if (fsa && fsa->profile_index != ~0 && fsa->is_initiator)
4855  p = pool_elt_at_index (km->profiles, fsa->profile_index);
4856 
4857  if (fchild && p && p->lifetime_maxdata)
4858  {
4859  if (!fchild->is_expired && counts.bytes > p->lifetime_maxdata)
4860  {
4861  fchild->time_to_expiration = now;
4862  }
4863  }
4864 }
4865 
4866 static void
4868 {
4869  ikev2_profile_t *p;
4870  u32 bi0;
4871  u8 *nat_sha, *np;
4872 
4873  if (ip_address_is_zero (&sa->iaddr))
4874  {
4875  p = pool_elt_at_index (km->profiles, sa->profile_index);
4878  &sa->iaddr))
4879  return;
4880 
4881  /* update NAT detection payload */
4882  np =
4884  ((ike_header_t *) sa->last_sa_init_req_packet_data,
4885  IKEV2_NOTIFY_MSG_NAT_DETECTION_SOURCE_IP);
4886  if (np)
4887  {
4888  nat_sha =
4889  ikev2_compute_nat_sha1 (clib_host_to_net_u64 (sa->ispi),
4890  clib_host_to_net_u64 (sa->rspi),
4891  &sa->iaddr,
4892  clib_host_to_net_u16 (IKEV2_PORT));
4893  clib_memcpy_fast (np, nat_sha, vec_len (nat_sha));
4894  vec_free (nat_sha);
4895  }
4896  }
4897 
4898  if (vlib_buffer_alloc (km->vlib_main, &bi0, 1) != 1)
4899  return;
4900 
4901  vlib_buffer_t *b = vlib_get_buffer (km->vlib_main, bi0);
4905 
4906  ikev2_send_ike (km->vlib_main, &sa->iaddr, &sa->raddr, bi0,
4909 }
4910 
4911 static void
4913 {
4914  u32 sai;
4915  u64 ispi;
4916  ikev2_sa_t *sa;
4917 
4918  /* *INDENT-OFF* */
4919  hash_foreach (ispi, sai, km->sa_by_ispi,
4920  ({
4921  sa = pool_elt_at_index (km->sais, sai);
4922  if (sa->init_response_received)
4923  continue;
4924 
4925  ikev2_process_pending_sa_init_one (km, sa);
4926  }));
4927  /* *INDENT-ON* */
4928 }
4929 
4930 static void
4932 {
4933  ikev2_main_t *km = &ikev2_main;
4934  ip_address_t *src, *dst;
4935  ike_header_t *ike0;
4936  vlib_buffer_t *b0;
4937  u32 bi0 = 0;
4938  u16 dp;
4939  int len;
4940 
4941  bi0 = ikev2_get_new_ike_header_buff (km->vlib_main, &b0);
4942  if (!bi0)
4943  {
4944  ikev2_log_error ("buffer alloc failure");
4945  return;
4946  }
4947 
4948  ike0 = vlib_buffer_get_current (b0);
4949  ike0->exchange = IKEV2_EXCHANGE_INFORMATIONAL;
4950  ike0->ispi = clib_host_to_net_u64 (sa->ispi);
4951  ike0->rspi = clib_host_to_net_u64 (sa->rspi);
4952  ike0->msgid = clib_host_to_net_u32 (sa->last_init_msg_id);
4953  ike0->flags = 0;
4954  sa->last_init_msg_id += 1;
4955  len = ikev2_generate_message (b0, sa, ike0, 0, 0);
4956  if (~0 == len)
4957  return;
4958 
4959  if (ikev2_natt_active (sa))
4960  len = ikev2_insert_non_esp_marker (ike0, len);
4961 
4962  if (sa->is_initiator)
4963  {
4964  src = &sa->iaddr;
4965  dst = &sa->raddr;
4966  }
4967  else
4968  {
4969  dst = &sa->iaddr;
4970  src = &sa->raddr;
4971  }
4972 
4973  dp = sa->dst_port ? sa->dst_port : ikev2_get_port (sa);
4974  ikev2_send_ike (km->vlib_main, src, dst, bi0, len, ikev2_get_port (sa), dp,
4975  sa->sw_if_index);
4976 }
4977 
4978 void
4980 {
4981  ikev2_main_t *km = &ikev2_main;
4982  km->dpd_disabled = 1;
4983 }
4984 
4987 {
4988  ikev2_main_t *km = &ikev2_main;
4989  vlib_main_t *vm = km->vlib_main;
4990 
4991  if (!sa->keys_generated)
4992  return 0;
4993 
4994  if (sa->liveness_retries >= km->liveness_max_retries)
4995  return 1;
4996 
4997  f64 now = vlib_time_now (vm);
4998 
4999  if (sa->liveness_period_check < now)
5000  {
5001  sa->liveness_retries++;
5002  sa->liveness_period_check = now + km->liveness_period;
5004  }
5005  return 0;
5006 }
5007 
5008 static uword
5010  vlib_frame_t * f)
5011 {
5012  ikev2_main_t *km = &ikev2_main;
5013  ipsec_main_t *im = &ipsec_main;
5014  ikev2_profile_t *p;
5016  u32 *sai;
5017 
5018  while (1)
5019  {
5021  vlib_process_get_events (vm, NULL);
5022 
5023  /* process ike child sas */
5025  vec_foreach (tkm, km->per_thread_data)
5026  {
5027  ikev2_sa_t *sa;
5028  u32 *to_be_deleted = 0;
5029 
5030  /* *INDENT-OFF* */
5031  pool_foreach (sa, tkm->sas, ({
5032  ikev2_child_sa_t *c;
5033  u8 del_old_ids = 0;
5034 
5035  if (sa->state != IKEV2_STATE_AUTHENTICATED)
5036  continue;
5037 
5038  if (sa->old_remote_id_present && 0 > sa->old_id_expiration)
5039  {
5040  sa->old_remote_id_present = 0;
5041  del_old_ids = 1;
5042  }
5043  else
5044  sa->old_id_expiration -= 1;
5045 
5046  vec_foreach (c, sa->childs)
5047  ikev2_mngr_process_child_sa(sa, c, del_old_ids);
5048 
5050  vec_add1 (to_be_deleted, sa - tkm->sas);
5051  }));
5052  /* *INDENT-ON* */
5053 
5054  vec_foreach (sai, to_be_deleted)
5055  {
5056  sa = pool_elt_at_index (tkm->sas, sai[0]);
5057  u8 reinitiate = (sa->is_initiator && sa->profile_index != ~0);
5058  vec_foreach (c, sa->childs)
5059  {
5061  ikev2_sa_del_child_sa (sa, c);
5062  }
5063  ikev2_sa_free_all_vec (sa);
5064  hash_unset (tkm->sa_by_rspi, sa->rspi);
5065  pool_put (tkm->sas, sa);
5066 
5067  if (reinitiate)
5068  {
5069  p = pool_elt_at_index (km->profiles, sa->profile_index);
5070  if (p)
5071  {
5073  if (e)
5074  {
5076  clib_error_free (e);
5077  }
5078  }
5079  }
5080  }
5081  vec_free (to_be_deleted);
5082  }
5083 
5084  /* process ipsec sas */
5085  ipsec_sa_t *sa;
5086  /* *INDENT-OFF* */
5087  pool_foreach (sa, im->sad, ({
5088  ikev2_mngr_process_ipsec_sa(sa);
5089  }));
5090  /* *INDENT-ON* */
5091 
5093  }
5094  return 0;
5095 }
5096 
5097 /* *INDENT-OFF* */
5099  .function = ikev2_mngr_process_fn,
5100  .type = VLIB_NODE_TYPE_PROCESS,
5101  .name =
5102  "ikev2-manager-process",
5103 };
5104 
5105 VLIB_PLUGIN_REGISTER () = {
5106  .version = VPP_BUILD_VER,
5107  .description = "Internet Key Exchange (IKEv2) Protocol",
5108 };
5109 /* *INDENT-ON* */
5110 
5111 /*
5112  * fd.io coding-style-patch-verification: ON
5113  *
5114  * Local Variables:
5115  * eval: (c-set-style "gnu")
5116  * End:
5117  */
ikev2_main_per_thread_data_t * per_thread_data
Definition: ikev2_priv.h:493
ipip_tunnel_t * ipip_tunnel_db_find(const ipip_tunnel_key_t *key)
Definition: ipip.c:484
vlib_log_class_t vlib_log_register_class(char *class, char *subclass)
Definition: log.c:209
#define vec_validate(V, I)
Make sure vector is long enough for given index (no header, unspecified alignment) ...
Definition: vec.h:509
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
Definition: buffer.h:124
udp_main_t udp_main
Definition: udp.c:22
u32 liveness_period
Definition: ikev2_priv.h:511
clib_error_t * ikev2_profile_natt_disable(u8 *name)
Definition: ikev2.c:4812
u8 * dh_shared_key
Definition: ikev2_priv.h:382
ikev2_sa_t * sais
Definition: ikev2_priv.h:489
vl_api_address_t end_addr
Definition: ikev2_types.api:38
void ikev2_payload_add_nonce(ikev2_payload_chain_t *c, u8 *nonce)
static ikev2_generate_sa_error_t ikev2_generate_sa_init_data(ikev2_sa_t *sa)
Definition: ikev2.c:393
static u8 * format_ikev2_trace(u8 *s, va_list *args)
Definition: ikev2.c:54
u8 * dh_private_key
Definition: ikev2_priv.h:383
#define ip_addr_v6(_a)
Definition: ip_types.h:59
ikev2_transform_type_t type
Definition: ikev2_priv.h:215
u8 * format_clib_error(u8 *s, va_list *va)
Definition: error.c:191
vnet_api_error_t
Definition: api_errno.h:162
#define hash_set(h, key, value)
Definition: hash.h:255
#define IKEV2_PAYLOAD_NONCE
Definition: ikev2.h:113
ikev2_id_t r_id
Definition: ikev2_priv.h:406
ikev2_id_type_t type
Definition: ikev2_priv.h:273
#define CLIB_UNUSED(x)
Definition: clib.h:87
void ikev2_payload_add_notify(ikev2_payload_chain_t *c, u16 msg_type, u8 *data)
ikev2_transforms_set ike_ts
Definition: ikev2_priv.h:340
ip_address_t end_addr
Definition: ikev2_priv.h:253
u32 old_remote_id
Definition: ikev2_priv.h:434
static int ikev2_delete_tunnel_interface(vnet_main_t *vnm, ikev2_sa_t *sa, ikev2_child_sa_t *child)
Definition: ikev2.c:2238
static uword ikev2_ip4(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame)
Definition: ikev2.c:3332
static u8 ikev2_mngr_process_child_sa(ikev2_sa_t *sa, ikev2_child_sa_t *csa, u8 del_old_ids)
Definition: ikev2.c:4684
static f64 vlib_process_wait_for_event_or_clock(vlib_main_t *vm, f64 dt)
Suspend a cooperative multi-tasking thread Waits for an event, or for the indicated number of seconds...
Definition: node_funcs.h:751
ikev2_transform_integ_type_t
Definition: ikev2.h:282
#define hash_unset(h, key)
Definition: hash.h:261
a
Definition: bitmap.h:538
u16 dst_port
Definition: ikev2_priv.h:443
#define ike_hdr_is_response(_h)
Definition: ikev2.h:47
static void ikev2_del_sa_init(u64 ispi)
Definition: ikev2.c:2757
ikev2_natt_state_t natt_state
Definition: ikev2_priv.h:447
void ip_address_set(ip_address_t *dst, const void *src, u8 version)
Definition: ip_types.c:205
ip4_address_t src_address
Definition: ip4_packet.h:125
clib_error_t * ikev2_add_del_profile(vlib_main_t *vm, u8 *name, int is_add)
Definition: ikev2.c:3802
int ikev2_encrypt_data(ikev2_main_per_thread_data_t *ptd, ikev2_sa_t *sa, ikev2_sa_transform_t *tr_encr, v8 *src, u8 *dst)
Definition: ikev2_crypto.c:455
EVP_PKEY * pkey
Definition: ikev2_priv.h:482
A representation of a IPIP tunnel.
Definition: ipip.h:75
void ikev2_payload_add_sa(ikev2_payload_chain_t *c, ikev2_sa_proposal_t *proposals)
vnet_main_t * vnet_get_main(void)
Definition: misc.c:46
static void ikev2_elog_uint_peers_addr(u32 exchange, ip4_header_t *ip4, ip6_header_t *ip6, u8 is_ip4)
Definition: ikev2.c:2802
ikev2_traffic_selector_type_t ts_type
Definition: ikev2_priv.h:247
clib_error_t * ikev2_set_profile_udp_encap(vlib_main_t *vm, u8 *name)
Definition: ikev2.c:4098
static void ikev2_profile_free(ikev2_profile_t *p)
Definition: ikev2.c:3789
static void ikev2_calc_keys(ikev2_sa_t *sa)
Definition: ikev2.c:507
u32 last_init_msg_id
Definition: ikev2_priv.h:425
vl_api_address_t raddr
ikev2_transform_dh_type_t dh_type
Definition: ikev2_priv.h:266
#define PREDICT_TRUE(x)
Definition: clib.h:121
ipsec_integ_alg_t
Definition: ipsec_sa.h:59
#define IKEV2_PAYLOAD_NONE
Definition: ikev2.h:105
vl_api_ikev2_auth_t auth
Definition: ikev2_types.api:88
ikev2_profile_t * profiles
Definition: ikev2_priv.h:473
i16 current_data
signed offset in data[], pre_data[] that we are currently processing.
Definition: buffer.h:110
unsigned long u64
Definition: types.h:89
vl_api_ip_port_and_mask_t dst_port
Definition: flow_types.api:92
u8 v8
Definition: ikev2.h:33
clib_error_t * ikev2_initiate_delete_ike_sa(vlib_main_t *vm, u64 ispi)
Definition: ikev2.c:4430
vl_api_address_t start_addr
Definition: ikev2_types.api:37
static void ikev2_initial_contact_cleanup(ikev2_main_per_thread_data_t *ptd, ikev2_sa_t *sa)
Definition: ikev2.c:1099
#define clib_memcpy_fast(a, b, c)
Definition: string.h:81
u32 current_remote_id_mask
Definition: ikev2_priv.h:433
uword mhash_unset(mhash_t *h, void *key, uword *old_value)
Definition: mhash.c:346
clib_memset(h->entries, 0, sizeof(h->entries[0]) *entries)
static void ikev2_sa_free_child_sa(ikev2_child_sa_t *c)
Definition: ikev2.c:305
ip4_address_t * ip4_interface_first_address(ip4_main_t *im, u32 sw_if_index, ip_interface_address_t **result_ia)
Definition: ip4_forward.c:281
v8 * ikev2_calc_prf(ikev2_sa_transform_t *tr, v8 *key, v8 *data)
Definition: ikev2_crypto.c:257
static f64 vlib_time_now(vlib_main_t *vm)
Definition: main.h:333
void vnet_sw_interface_admin_up(vnet_main_t *vnm, u32 sw_if_index)
Definition: interface.c:516
static void ikev2_complete_sa_data(ikev2_sa_t *sa, ikev2_sa_t *sai)
Definition: ikev2.c:443
#define ikev2_elog_error(_msg)
Definition: ikev2_priv.h:170
static int ikev2_get_if_address(u32 sw_if_index, ip_address_family_t af, ip_address_t *out_addr)
Definition: ikev2.c:4137
#define IKEV2_GENERATE_SA_INIT_OK_ERR_NO_DH_STR
Definition: ikev2.c:66
ip_address_t addr
Definition: ikev2_priv.h:259
#define IKEV2_EXCHANGE_SA_INIT
Definition: ikev2.h:94
static void ikev2_delete_child_sa_internal(vlib_main_t *vm, ikev2_sa_t *sa, ikev2_child_sa_t *csa)
Definition: ikev2.c:4348
static u32 ikev2_get_new_ike_header_buff(vlib_main_t *vm, vlib_buffer_t **b)
Definition: ikev2.c:3592
ikev2_transform_esn_type_t esn_type
Definition: ikev2_priv.h:223
u16 current_length
Nbytes between current data and the end of this buffer.
Definition: buffer.h:113
VLIB_PLUGIN_REGISTER()
#define IKEV2_PAYLOAD_VENDOR
Definition: ikev2.h:116
ikev2_state_t state
Definition: ikev2_priv.h:370
#define vec_add1(V, E)
Add 1 element to end of vector (unspecified alignment).
Definition: vec.h:592
ip6_address_t * ip6_interface_first_address(ip6_main_t *im, u32 sw_if_index)
get first IPv6 interface address
Definition: ip6_forward.c:278
Combined counter to hold both packets and byte differences.
Definition: counter_types.h:26
vl_api_address_t src
Definition: gre.api:54
ikev2_transform_encr_type_t crypto_alg
Definition: ikev2_priv.h:264
u16 ip_address_size(const ip_address_t *a)
Definition: ip_types.c:84
clib_error_t * ikev2_set_profile_tunnel_interface(vlib_main_t *vm, u8 *name, u32 sw_if_index)
Definition: ikev2.c:4045
#define IKEV2_PORT_NATT
Definition: ikev2.h:25
int vlib_punt_hdl_t
Typedef for a client handle.
Definition: punt.h:47
#define vec_add2(V, P, N)
Add N elements to end of vector V, return pointer to new elements in P.
Definition: vec.h:630
static int ikev2_process_sa_init_req(vlib_main_t *vm, ikev2_sa_t *sa, ike_header_t *ike, udp_header_t *udp, u32 len)
Definition: ikev2.c:720
u8 * sk_pi
Definition: ikev2_priv.h:397
static clib_error_t * ikev2_sw_interface_add_del(vnet_main_t *vnm, u32 sw_if_index, u32 is_add)
Definition: ikev2.c:4600
static void mhash_init_vec_string(mhash_t *h, uword n_value_bytes)
Definition: mhash.h:84
static udp_dst_port_info_t * udp_get_dst_port_info(udp_main_t *um, udp_dst_port_t dst_port, u8 is_ip4)
Definition: udp.h:275
vlib_main_t * vm
Definition: in2out_ed.c:1582
#define IKEV2_GCM_ICV_SIZE
Definition: ikev2.h:28
clib_error_t * ikev2_set_profile_sa_lifetime(vlib_main_t *vm, u8 *name, u64 lifetime, u32 jitter, u32 handover, u64 maxdata)
Definition: ikev2.c:4114
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:424
u16 flags_and_fragment_offset
Definition: ip4_packet.h:106
void ikev2_payload_add_ke(ikev2_payload_chain_t *c, u16 dh_group, u8 *dh_data)
#define IKEV2_NONCE_SIZE
Definition: ikev2.h:23
u8 initial_contact
Definition: ikev2_priv.h:372
ikev2_ts_t * tsi
Definition: ikev2_priv.h:318
clib_error_t * ikev2_set_liveness_params(u32 period, u32 max_retries)
Definition: ikev2.c:4799
ip_address_t iaddr
Definition: ikev2_priv.h:373
#define IKEV2_PAYLOAD_TSR
Definition: ikev2.h:118
static int ikev2_parse_id_payload(const void *p, u16 rlen, ikev2_id_t *sa_id)
Definition: ikev2.c:1120
#define vec_validate_aligned(V, I, A)
Make sure vector is long enough for given index (no header, specified alignment)
Definition: vec.h:520
int ipsec_sa_add_and_lock(u32 id, u32 spi, ipsec_protocol_t proto, ipsec_crypto_alg_t crypto_alg, const ipsec_key_t *ck, ipsec_integ_alg_t integ_alg, const ipsec_key_t *ik, ipsec_sa_flags_t flags, u32 tx_table_id, u32 salt, const ip46_address_t *tun_src, const ip46_address_t *tun_dst, u32 *sa_out_index, u16 src_port, u16 dst_port)
Definition: ipsec_sa.c:170
int ipip_add_tunnel(ipip_transport_t transport, u32 instance, ip46_address_t *src, ip46_address_t *dst, u32 fib_index, tunnel_encap_decap_flags_t flags, ip_dscp_t dscp, tunnel_mode_t tmode, u32 *sw_if_indexp)
Definition: ipip.c:653
ikev2_auth_t r_auth
Definition: ikev2_priv.h:402
u16 mask
Definition: flow_types.api:52
static_always_inline int ikev2_mngr_process_responder_sas(ikev2_sa_t *sa)
Definition: ikev2.c:4986
u16 start_port
Definition: ikev2_types.api:35
static u8 * format_ikev2_gen_sa_error(u8 *s, va_list *args)
Definition: ikev2.c:79
#define ip_addr_version(_a)
Definition: ip_types.h:60
#define pool_get(P, E)
Allocate an object E from a pool P (unspecified alignment).
Definition: pool.h:252
vhost_vring_addr_t addr
Definition: vhost_user.h:111
u16 ipsec_over_udp_port
Definition: ikev2_priv.h:346
void ipsec_mk_key(ipsec_key_t *key, const u8 *data, u8 len)
Definition: ipsec_sa.c:56
ip6_address_t src_address
Definition: ip6_packet.h:310
u8 * last_sa_init_res_packet_data
Definition: ikev2_priv.h:416
format_function_t format_vnet_sw_if_index_name
unsigned char u8
Definition: types.h:56
vnet_api_error_t ikev2_set_profile_ipsec_udp_port(vlib_main_t *vm, u8 *name, u16 port, u8 is_set)
Definition: ikev2.c:4065
u8 init_response_received
Definition: ikev2_priv.h:436
u8 data[128]
Definition: ipsec_types.api:89
static void ikev2_cleanup_profile_sessions(ikev2_main_t *km, ikev2_profile_t *p)
Definition: ikev2.c:3743
ikev2_sa_transform_t * ikev2_sa_get_td_for_type(ikev2_sa_proposal_t *p, ikev2_transform_type_t type)
Definition: ikev2.c:252
ikev2_auth_t auth
Definition: ikev2_priv.h:334
u8 id[64]
Definition: dhcp.api:160
#define vec_reset_length(v)
Reset vector length to zero NULL-pointer tolerant.
double f64
Definition: types.h:142
ikev2_ts_t * tsr
Definition: ikev2_priv.h:319
#define vlib_worker_thread_barrier_sync(X)
Definition: threads.h:205
u16 end_port
Definition: ikev2_types.api:36
vlib_node_registration_t ip4_lookup_node
(constructor) VLIB_REGISTER_NODE (ip4_lookup_node)
Definition: ip4_forward.c:104
u16 key_trunc
Definition: ikev2_types.api:96
#define clib_memcpy(d, s, n)
Definition: string.h:180
static void ikev2_mngr_process_ipsec_sa(ipsec_sa_t *ipsec_sa)
Definition: ikev2.c:4823
ikev2_id_t rem_id
Definition: ikev2_priv.h:336
#define vec_add(V, E, N)
Add N elements to end of vector V (no header, unspecified alignment)
Definition: vec.h:668
ikev2_transform_dh_type_t
Definition: ikev2.h:332
log_level
Definition: vpe_types.api:32
static int ikev2_sa_sw_if_match(ikev2_sa_t *sa, u32 sw_if_index)
Definition: ikev2.c:4553
u64 lifetime
Definition: ikev2_types.api:80
ikev2_child_sa_t * ikev2_sa_get_child(ikev2_sa_t *sa, u32 spi, ikev2_protocol_id_t prot_id, int by_initiator)
Definition: ikev2.c:269
u32 next_index
Definition: ikev2.c:49
static u32 ikev2_retransmit_resp(ikev2_sa_t *sa, ike_header_t *ike)
Definition: ikev2.c:2693
static_always_inline void ikev2_rewrite_v6_addrs(ikev2_sa_t *sa, ip6_header_t *ih)
Definition: ikev2.c:2764
u32 last_msg_id
Definition: ikev2_priv.h:420
#define static_always_inline
Definition: clib.h:108
#define IKEV2_PAYLOAD_DELETE
Definition: ikev2.h:115
#define pool_foreach(VAR, POOL, BODY)
Iterate through pool.
Definition: pool.h:513
ikev2_sa_proposal_t * r_proposals
Definition: ikev2_priv.h:281
void ikev2_generate_dh(ikev2_sa_t *sa, ikev2_sa_transform_t *t)
Definition: ikev2_crypto.c:500
#define VLIB_INIT_FUNCTION(x)
Definition: init.h:173
static uword vlib_process_get_events(vlib_main_t *vm, uword **data_vector)
Return the first event type which has occurred and a vector of per-event data of that type...
Definition: node_funcs.h:579
ipsec_main_t ipsec_main
Definition: ipsec.c:28
EVP_PKEY * ikev2_load_cert_file(u8 *file)
Definition: ikev2_crypto.c:818
clib_error_t * ikev2_initiate_sa_init(vlib_main_t *vm, u8 *name)
Definition: ikev2.c:4165
#define IKEV2_LIVENESS_PERIOD_CHECK
Definition: ikev2.c:34
vl_api_ip6_address_t ip6
Definition: one.api:424
int ipsec_tun_protect_del(u32 sw_if_index, const ip_address_t *nh)
Definition: ipsec_tun.c:769
static ikev2_sa_transform_t * ikev2_find_transform_data(ikev2_sa_transform_t *t)
Definition: ikev2.c:152
ip4_address_t dst_address
Definition: ip4_packet.h:125
u32 liveness_max_retries
Definition: ikev2_priv.h:514
#define vec_new(T, N)
Create new vector of given type and length (unspecified alignment, no header).
Definition: vec.h:350
EVP_PKEY * ikev2_load_key_file(u8 *file)
Definition: ikev2_crypto.c:849
clib_error_t * ikev2_set_profile_auth(vlib_main_t *vm, u8 *name, u8 auth_method, u8 *auth_data, u8 data_hex_format)
Definition: ikev2.c:3838
ipsec_crypto_alg_t encr_type
Definition: ikev2.c:1836
void ikev2_parse_vendor_payload(ike_payload_header_t *ikep)
#define hash_foreach(key_var, value_var, h, body)
Definition: hash.h:442
static vlib_node_registration_t ikev2_mngr_process_node
(constructor) VLIB_REGISTER_NODE (ikev2_mngr_process_node)
Definition: ikev2.c:5098
#define vec_elt_at_index(v, i)
Get vector value at index i checking that i is in bounds.
ipsec_integ_alg_t integ_type
Definition: ikev2.c:1837
vlib_frame_t * vlib_get_frame_to_node(vlib_main_t *vm, u32 to_node_index)
Definition: main.c:182
#define clib_error_return(e, args...)
Definition: error.h:99
int ipsec_sa_unlock_id(u32 id)
Definition: ipsec_sa.c:428
void ikev2_payload_add_id(ikev2_payload_chain_t *c, ikev2_id_t *id, u8 type)
#define IKEV2_PAYLOAD_NOTIFY
Definition: ikev2.h:114
void vl_api_rpc_call_main_thread(void *fp, u8 *data, u32 data_length)
Definition: vlib_api.c:619
static void ikev2_sa_match_ts(ikev2_sa_t *sa)
Definition: ikev2.c:1560
static u32 ikev2_retransmit_sa_init_one(ikev2_sa_t *sa, ike_header_t *ike, ip_address_t iaddr, ip_address_t raddr, u32 rlen)
Definition: ikev2.c:2604
static void ikev2_initiate_delete_ike_sa_internal(vlib_main_t *vm, ikev2_main_per_thread_data_t *tkm, ikev2_sa_t *sa, u8 send_notification)
Definition: ikev2.c:3671
static void ikev2_send_ike(vlib_main_t *vm, ip_address_t *src, ip_address_t *dst, u32 bi0, u32 len, u16 src_port, u16 dst_port, u32 sw_if_index)
Definition: ikev2.c:3522
ikev2_sa_proposal_t * i_proposals
Definition: ikev2_priv.h:388
uword * sw_if_indices
Definition: ikev2_priv.h:496
static void ikev2_sa_auth(ikev2_sa_t *sa)
Definition: ikev2.c:1630
#define vec_resize(V, N)
Resize a vector (no header, unspecified alignment) Add N elements to end of given vector V...
Definition: vec.h:281
ikev2_transform_integ_type_t integ_alg
Definition: ikev2_priv.h:265
unsigned int u32
Definition: types.h:88
ikev2_auth_t i_auth
Definition: ikev2_priv.h:401
static u8 * ikev2_decrypt_sk_payload(ikev2_sa_t *sa, ike_header_t *ike, u8 *payload, u32 rlen, u32 *out_len)
Definition: ikev2.c:939
#define ikev2_set_state(sa, v)
Definition: ikev2.c:42
#define ikev2_payload_destroy_chain(V)
Definition: ikev2_priv.h:562
#define VLIB_FRAME_SIZE
Definition: node.h:377
clib_error_t * ikev2_set_profile_esp_transforms(vlib_main_t *vm, u8 *name, ikev2_transform_encr_type_t crypto_alg, ikev2_transform_integ_type_t integ_alg, u32 crypto_key_size)
Definition: ikev2.c:4022
static void ikev2_del_sa_init_from_main(u64 *ispi)
Definition: ikev2.c:2743
ikev2_id_t loc_id
Definition: ikev2_priv.h:335
ikev2_sa_transform_t * transforms
Definition: ikev2_priv.h:242
vlib_punt_hdl_t vlib_punt_client_register(const char *who)
Register a new clinet.
Definition: punt.c:156
static void ikev2_process_pending_sa_init_one(ikev2_main_t *km, ikev2_sa_t *sa)
Definition: ikev2.c:4867
#define IKEV2_EXCHANGE_CREATE_CHILD_SA
Definition: ikev2.h:96
u8 * sk_ar
Definition: ikev2_priv.h:394
u8 * r_dh_data
Definition: ikev2_priv.h:385
void ip_address_copy_addr(void *dst, const ip_address_t *src)
Definition: ip_types.c:161
ip46_address_t remote_ip
Definition: ikev2.c:1839
ikev2_responder_t responder
Definition: ikev2_priv.h:339
vl_api_fib_path_type_t type
Definition: fib_types.api:123
int ikev2_set_log_level(ikev2_log_level_t log_level)
Definition: ikev2.c:4784
static ikev2_profile_t * ikev2_profile_index_by_name(u8 *name)
Definition: ikev2.c:3508
static vlib_node_registration_t ikev2_node_ip6
(constructor) VLIB_REGISTER_NODE (ikev2_node_ip6)
Definition: ikev2.c:3361
#define hash_get(h, key)
Definition: hash.h:249
clib_error_t * ikev2_set_profile_id(vlib_main_t *vm, u8 *name, u8 id_type, u8 *data, int is_local)
Definition: ikev2.c:3881
u8 * ikev2_calc_prfplus(ikev2_sa_transform_t *tr, u8 *key, u8 *seed, int len)
Definition: ikev2_crypto.c:274
static u32 ikev2_mk_local_sa_id(u32 sai, u32 ci, u32 ti)
Definition: ikev2.c:1815
static clib_error_t * ikev2_set_initiator_proposals(vlib_main_t *vm, ikev2_sa_t *sa, ikev2_transforms_set *ts, ikev2_sa_proposal_t **proposals, int is_ike)
Definition: ikev2.c:3381
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
Definition: pool.h:534
#define ikev2_elog_exchange(_fmt, _ispi, _rspi, _addr, _v4)
Definition: ikev2_priv.h:116
u32 sa_id
Definition: ipsec.api:98
ikev2_main_t ikev2_main
Definition: ikev2.c:36
void ikev2_cli_reference(void)
Definition: ikev2_cli.c:813
u8 * last_sa_init_req_packet_data
Definition: ikev2_priv.h:415
u8 integ_alg
Definition: ikev2_types.api:59
#define IKEV2_PAYLOAD_IDR
Definition: ikev2.h:111
static_always_inline u32 ikev2_flip_alternate_sa_bit(u32 id)
Definition: ikev2.c:2184
#define IKEV2_PAYLOAD_SA
Definition: ikev2.h:108
ikev2_ts_t rem_ts
Definition: ikev2_priv.h:338
#define ikev2_log_debug(...)
Definition: ikev2_priv.h:184
VNET_SW_INTERFACE_ADD_DEL_FUNCTION(ikev2_sw_interface_add_del)
u8 * i_dh_data
Definition: ikev2_priv.h:384
uword mhash_set_mem(mhash_t *h, void *key, uword *new_value, uword *old_value)
Definition: mhash.c:264
static __clib_warn_unused_result u32 vlib_buffer_alloc(vlib_main_t *vm, u32 *buffers, u32 n_buffers)
Allocate buffers into supplied array.
Definition: buffer_funcs.h:677
unsigned short u16
Definition: types.h:57
ikev2_sa_proposal_t * i_proposals
Definition: ikev2_priv.h:280
EVP_CIPHER_CTX * evp_ctx
Definition: ikev2_priv.h:462
void vlib_put_frame_to_node(vlib_main_t *vm, u32 to_node_index, vlib_frame_t *f)
Definition: main.c:216
u8 * r_nonce
Definition: ikev2_priv.h:378
#define IKEV2_HDR_FLAG_RESPONSE
Definition: ikev2.h:101
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
Definition: buffer.h:229
mhash_t profile_index_by_name
Definition: ikev2_priv.h:479
u16 end_port
Definition: ikev2_priv.h:251
ikev2_sa_transform_t * supported_transforms
Definition: ikev2_priv.h:476
static uword ikev2_ip6(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame)
Definition: ikev2.c:3338
#define pool_put(P, E)
Free an object E in pool P.
Definition: pool.h:302
ikev2_rekey_t * rekey
Definition: ikev2_priv.h:412
#define vec_dup(V)
Return copy of vector (no header, no alignment)
Definition: vec.h:429
clib_error_t * ikev2_initiate_delete_child_sa(vlib_main_t *vm, u32 ispi)
Definition: ikev2.c:4390
static_always_inline int ikev2_insert_non_esp_marker(ike_header_t *ike, int len)
Definition: ikev2.c:144
static void ikev2_rekey_child_sa_internal(vlib_main_t *vm, ikev2_sa_t *sa, ikev2_child_sa_t *csa)
Definition: ikev2.c:4467
bool ip_address_is_zero(const ip_address_t *ip)
Definition: ip_types.c:99
int ikev2_decrypt_data(ikev2_main_per_thread_data_t *ptd, ikev2_sa_t *sa, ikev2_sa_transform_t *tr_encr, u8 *data, int len, u32 *out_len)
Definition: ikev2_crypto.c:391
#define PREDICT_FALSE(x)
Definition: clib.h:120
#define vec_del1(v, i)
Delete the element at index I.
Definition: vec.h:875
vl_api_ip4_address_t ip4
Definition: one.api:376
ip6_main_t ip6_main
Definition: ip6_forward.c:2781
static_always_inline void ikev2_set_ts_type(ikev2_ts_t *ts, const ip_address_t *addr)
Definition: ikev2.c:3919
#define IKEV2_PAYLOAD_FLAG_CRITICAL
Definition: ikev2.h:103
static void ikev2_sa_auth_init(ikev2_sa_t *sa)
Definition: ikev2.c:1772
static_always_inline ikev2_main_per_thread_data_t * ikev2_get_per_thread_data()
Definition: ikev2_priv.h:597
ikev2_protocol_id_t
Definition: ikev2.h:121
static int ikev2_parse_nonce_payload(const void *p, u32 rlen, u8 *nonce)
Definition: ikev2.c:698
fib_protocol_t ip_address_to_46(const ip_address_t *addr, ip46_address_t *a)
Definition: ip_types.c:250
u32 node_index
Node index.
Definition: node.h:487
ipsec_sa_flags_t flags
Definition: ikev2.c:1833
vl_api_address_t dst
Definition: gre.api:55
#define ikev2_natt_active(_sa)
Definition: ikev2_priv.h:366
static void ikev2_sa_del(ikev2_profile_t *p, u32 sw_if_index)
Definition: ikev2.c:4559
static int ikev2_process_informational_req(vlib_main_t *vm, ikev2_sa_t *sa, ike_header_t *ike, u32 len)
Definition: ikev2.c:1289
u8 * i_nonce
Definition: ikev2_priv.h:377
clib_error_t * ikev2_set_local_key(vlib_main_t *vm, u8 *file)
Definition: ikev2.c:3605
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
Definition: node_funcs.h:1231
u32 punt_reason
Definition: buffer.h:149
static void ikev2_process_pending_sa_init(ikev2_main_t *km)
Definition: ikev2.c:4912
u8 len
Definition: ip_types.api:92
u8 * sk_ei
Definition: ikev2_priv.h:395
u8 old_remote_id_present
Definition: ikev2_priv.h:435
bool is_local
Definition: ikev2_types.api:33
#define IKEV2_EXCHANGE_INFORMATIONAL
Definition: ikev2.h:97
void ikev2_payload_add_delete(ikev2_payload_chain_t *c, ikev2_delete_t *d)
static_always_inline u32 vlib_buffer_get_default_data_size(vlib_main_t *vm)
Definition: buffer_funcs.h:96
static u32 ikev2_mk_remote_sa_id(u32 sai, u32 ci, u32 ti)
Definition: ikev2.c:1821
vl_api_ip_port_and_mask_t src_port
Definition: flow_types.api:91
#define IKEV2_HDR_FLAG_INITIATOR
Definition: ikev2.h:99
#define IKEV2_KEY_PAD
Definition: ikev2.h:26
u32 sw_if_index
Definition: ikev2_priv.h:444
ip_address_t raddr
Definition: ikev2_priv.h:374
static void ikev2_add_tunnel_from_main(ikev2_add_ipsec_tunnel_args_t *a)
Definition: ikev2.c:1849
static uword ikev2_mngr_process_fn(vlib_main_t *vm, vlib_node_runtime_t *rt, vlib_frame_t *f)
Definition: ikev2.c:5009
clib_error_t * ikev2_initiate_rekey_child_sa(vlib_main_t *vm, u32 ispi)
Definition: ikev2.c:4513
vlib_punt_reason_t ipsec_punt_reason[IPSEC_PUNT_N_REASONS]
Definition: ipsec_punt.c:24
#define VLIB_REGISTER_NODE(x,...)
Definition: node.h:169
ikev2_transform_dh_type_t dh_type
Definition: ikev2_priv.h:222
#define ikev2_elog_uint(_level, _format, _val)
Definition: ikev2_priv.h:124
svmdb_client_t * c
u16 n_vectors
Definition: node.h:396
static_always_inline uword vlib_get_thread_index(void)
Definition: threads.h:219
static void vlib_get_combined_counter(const vlib_combined_counter_main_t *cm, u32 index, vlib_counter_t *result)
Get the value of a combined counter, never called in the speed path Scrapes the entire set of per-thr...
Definition: counter.h:259
static_always_inline void vlib_buffer_enqueue_to_next(vlib_main_t *vm, vlib_node_runtime_t *node, u32 *buffers, u16 *nexts, uword count)
Definition: buffer_node.h:339
static void ikev2_sa_del_child_sa(ikev2_sa_t *sa, ikev2_child_sa_t *child)
Definition: ikev2.c:327
ikev2_auth_method_t method
Definition: ikev2_priv.h:201
ikev2_transform_encr_type_t
Definition: ikev2.h:241
ikev2_delete_t * del
Definition: ikev2_priv.h:409
ikev2_ts_t * tsi
Definition: ikev2_priv.h:284
#define clib_memcmp(s1, s2, m1)
Definition: string.h:720
sll srl srl sll sra u16x4 i
Definition: vector_sse42.h:317
ikev2_sa_proposal_t * ikev2_parse_sa_payload(ike_payload_header_t *ikep, u32 rlen)
static vlib_punt_hdl_t punt_hdl
Definition: ipsec_punt.c:22
#define vec_free(V)
Free vector&#39;s memory (no header).
Definition: vec.h:380
void udp_unregister_dst_port(vlib_main_t *vm, udp_dst_port_t dst_port, u8 is_ip4)
Definition: udp_local.c:506
static_always_inline vnet_api_error_t ikev2_register_udp_port(ikev2_profile_t *p, u16 port)
Definition: ikev2.c:3619
#define IKEV2_LIVENESS_RETRIES
Definition: ikev2.c:33
ip46_address_t remote_ip
Definition: ikev2.c:2177
u8 data[]
Packet data.
Definition: buffer.h:181
static void ikev2_generate_sa_init_data_and_log(ikev2_sa_t *sa)
Definition: ikev2.c:2822
enum ipsec_sad_flags_t_ ipsec_sa_flags_t
static void ikev2_initial_contact_cleanup_internal(ikev2_main_per_thread_data_t *ptd, ikev2_sa_t *sa)
Definition: ikev2.c:1064
static_always_inline u16 ikev2_get_port(ikev2_sa_t *sa)
Definition: ikev2.c:138
uword * udp_ports
Definition: ikev2_priv.h:508
u32 spi
Definition: flow_types.api:140
u8 * sk_er
Definition: ikev2_priv.h:396
u8 is_initiator
Definition: ikev2_priv.h:423
static_always_inline void ikev2_unregister_udp_port(ikev2_profile_t *p)
Definition: ikev2.c:3647
static int ikev2_create_tunnel_interface(vlib_main_t *vm, ikev2_sa_t *sa, ikev2_child_sa_t *child, u32 sa_index, u32 child_index, u8 is_rekey)
Definition: ikev2.c:1932
#define ARRAY_LEN(x)
Definition: clib.h:67
#define IKEV2_PAYLOAD_KE
Definition: ikev2.h:109
static_always_inline uword ikev2_node_internal(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame, u8 is_ip4)
Definition: ikev2.c:2836
string name[64]
Definition: ip.api:44
static_always_inline void ikev2_set_ip_address(ikev2_sa_t *sa, const void *iaddr, const void *raddr, const int af)
Definition: ikev2.c:2794
ikev2_ts_t loc_ts
Definition: ikev2_priv.h:337
#define ikev2_log_error(...)
Definition: ikev2_priv.h:180
ikev2_sa_proposal_t * r_proposals
Definition: ikev2_priv.h:389
static u32 ikev2_generate_message(vlib_buffer_t *b, ikev2_sa_t *sa, ike_header_t *ike, void *user, udp_header_t *udp)
Definition: ikev2.c:2266
vlib_main_t vlib_node_runtime_t * node
Definition: in2out_ed.c:1582
static u8 * ikev2_sa_generate_authmsg(ikev2_sa_t *sa, int is_responder)
Definition: ikev2.c:1505
u64 rspi
static void ikev2_calc_child_keys(ikev2_sa_t *sa, ikev2_child_sa_t *child)
Definition: ikev2.c:595
f64 old_id_expiration
Definition: ikev2_priv.h:432
static int ikev2_parse_auth_payload(const void *p, u32 rlen, ikev2_auth_t *a)
Definition: ikev2.c:1135
#define hash_set1(h, key)
Definition: hash.h:258
enum ikev2_log_level_t_ ikev2_log_level_t
vlib_node_registration_t ip6_lookup_node
(constructor) VLIB_REGISTER_NODE (ip6_lookup_node)
Definition: ip6_forward.c:741
#define hash_create(elts, value_bytes)
Definition: hash.h:696
void ikev2_payload_add_auth(ikev2_payload_chain_t *c, ikev2_auth_t *auth)
ikev2_protocol_id_t protocol_id
Definition: ikev2_priv.h:240
vlib_combined_counter_main_t ipsec_sa_counters
SA packet & bytes counters.
Definition: ipsec_sa.c:27
u8 protocol_id
Definition: ikev2_priv.h:248
#define ASSERT(truth)
ip46_address_t local_ip
Definition: ikev2.c:2176
ikev2_notify_t * ikev2_parse_notify_payload(ike_payload_header_t *ikep, u32 rlen)
static_always_inline int ikev2_is_id_equal(ikev2_id_t *i1, ikev2_id_t *i2)
Definition: ikev2.c:1049
static_always_inline u8 * ikev2_compute_nat_sha1(u64 ispi, u64 rspi, ip_address_t *ia, u16 port)
Definition: ikev2.c:666
static_always_inline void ikev2_set_ts_addrs(ikev2_ts_t *ts, const ip_address_t *start, const ip_address_t *end)
Definition: ikev2.c:3928
#define ip_addr_v4(_a)
Definition: ip_types.h:58
static_always_inline void ikev2_rewrite_v4_addrs(ikev2_sa_t *sa, ip4_header_t *ih)
Definition: ikev2.c:2779
int ikev2_decrypt_aead_data(ikev2_main_per_thread_data_t *ptd, ikev2_sa_t *sa, ikev2_sa_transform_t *tr_encr, u8 *data, int data_len, u8 *aad, u32 aad_len, u8 *tag, u32 *out_len)
Definition: ikev2_crypto.c:353
static uword * mhash_get(mhash_t *h, const void *key)
Definition: mhash.h:110
#define ike_hdr_is_request(_h)
Definition: ikev2.h:48
vnet_main_t * vnet_main
Definition: ikev2_priv.h:486
f64 liveness_period_check
Definition: ikev2_priv.h:441
ip_dscp_t tos
Definition: ip4_packet.h:96
void ikev2_sa_free_proposal_vector(ikev2_sa_proposal_t **v)
Definition: ikev2.c:285
ipsec_sa_t * sad
Definition: ipsec.h:107
#define IKEV2_PAYLOAD_AUTH
Definition: ikev2.h:112
#define ikev2_payload_new_chain(V)
Definition: ikev2_priv.h:561
#define IKEV2_PAYLOAD_SK
Definition: ikev2.h:119
static vlib_node_registration_t ikev2_node_ip4
(constructor) VLIB_REGISTER_NODE (ikev2_node_ip4)
Definition: ikev2.c:3344
ikev2_sa_proposal_t * r_proposal
Definition: ikev2_priv.h:317
static void ikev2_process_sa_init_resp(vlib_main_t *vm, ikev2_sa_t *sa, ike_header_t *ike, udp_header_t *udp, u32 len)
Definition: ikev2.c:828
u8 * sk_ai
Definition: ikev2_priv.h:393
#define IKE_VERSION_2
Definition: ikev2.h:92
void ikev2_complete_dh(ikev2_sa_t *sa, ikev2_sa_transform_t *t)
Definition: ikev2_crypto.c:648
#define vec_append(v1, v2)
Append v2 after v1.
Definition: vec.h:890
int ikev2_encrypt_aead_data(ikev2_main_per_thread_data_t *ptd, ikev2_sa_t *sa, ikev2_sa_transform_t *tr_encr, v8 *src, u8 *dst, u8 *aad, u32 aad_len, u8 *tag)
Definition: ikev2_crypto.c:424
static void vlib_buffer_advance(vlib_buffer_t *b, word l)
Advance current data pointer by the supplied (signed!) amount.
Definition: buffer.h:248
ikev2_ip6_next_t
Definition: ikev2.c:128
int ip_address_cmp(const ip_address_t *ip1, const ip_address_t *ip2)
Definition: ip_types.c:114
u16 dh_group
Definition: ikev2_priv.h:381
u8 is_tun_itf_set
Definition: ikev2_priv.h:427
static u8 plaintext[]
Definition: aes_cbc.c:29
ikev2_log_level_t log_level
Definition: ikev2_priv.h:505
ikev2_sa_proposal_t * i_proposal
Definition: ikev2_priv.h:316
u32 sw_if_index
Definition: ipip.h:86
vlib_node_registration_t ipsec4_tun_input_node
(constructor) VLIB_REGISTER_NODE (ipsec4_tun_input_node)
Definition: ipsec_tun_in.c:367
#define IKEV2_PAYLOAD_TSI
Definition: ikev2.h:117
EVP_PKEY * key
Definition: ikev2_priv.h:204
u8 liveness_retries
Definition: ikev2_priv.h:440
enum ip_address_family_t_ ip_address_family_t
typedef key
Definition: ipsec_types.api:85
ikev2_transform_encr_type_t encr_type
Definition: ikev2_priv.h:219
u32 crypto_key_size
Definition: ikev2_types.api:58
u8 * last_res_packet_data
Definition: ikev2_priv.h:421
u32 ip_version_traffic_class_and_flow_label
Definition: ip6_packet.h:297
ikev2_delete_t * ikev2_parse_delete_payload(ike_payload_header_t *ikep, u32 rlen)
ikev2_transform_integ_type_t integ_type
Definition: ikev2_priv.h:221
static char * ikev2_error_strings[]
Definition: ikev2.c:115
Definition: defs.h:47
void vnet_sw_interface_admin_down(vnet_main_t *vnm, u32 sw_if_index)
Definition: interface.c:528
#define clib_atomic_bool_cmp_and_swap(addr, old, new)
Definition: atomics.h:38
int vlib_punt_register(vlib_punt_hdl_t client, vlib_punt_reason_t reason, const char *node_name)
Register a node to receive particular punted buffers.
Definition: punt.c:268
u16 payload_length
Definition: ip6_packet.h:301
u8 protocol_id
Definition: ikev2_types.api:34
u32 ikev2_non_esp_marker
Definition: ikev2.c:135
static ip46_address_t to_ip46(u32 is_ipv6, u8 *buf)
Definition: ip46_address.h:137
#define IKEV2_PORT
Definition: ikev2.h:24
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
clib_error_t * ikev2_set_profile_responder(vlib_main_t *vm, u8 *name, u32 sw_if_index, ip_address_t addr)
Definition: ikev2.c:3976
u16 start_port
Definition: ikev2_priv.h:250
void ikev2_payload_chain_add_padding(ikev2_payload_chain_t *c, int bs)
u8 * sk_pr
Definition: ikev2_priv.h:398
vlib_main_t vlib_node_runtime_t vlib_frame_t * frame
Definition: in2out_ed.c:1583
static int ikev2_is_id_supported(u8 id_type)
Definition: ikev2.c:3872
VLIB buffer representation.
Definition: buffer.h:102
static int ikev2_parse_ke_payload(const void *p, u32 rlen, ikev2_sa_t *sa, u8 **ke_data)
Definition: ikev2.c:682
u64 uword
Definition: types.h:112
#define IKEV2_PAYLOAD_IDI
Definition: ikev2.h:110
clib_error_t * ikev2_set_profile_ike_transforms(vlib_main_t *vm, u8 *name, ikev2_transform_encr_type_t crypto_alg, ikev2_transform_integ_type_t integ_alg, ikev2_transform_dh_type_t dh_type, u32 crypto_key_size)
Definition: ikev2.c:3997
ikev2_id_t i_id
Definition: ikev2_priv.h:405
#define ikev2_elog_uint_peers(_level, _format, _val, _ip1, _ip2)
Definition: ikev2_priv.h:143
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
Definition: node_funcs.h:297
ipsec_crypto_alg_t
Definition: ipsec_sa.h:37
static u32 ikev2_retransmit_sa_init(ike_header_t *ike, ip_address_t iaddr, ip_address_t raddr, u32 rlen)
Definition: ikev2.c:2673
#define IKEV2_GENERATE_SA_INIT_OK_ERR_UNSUPP_STR
Definition: ikev2.c:68
u32 index
Definition: flow_types.api:221
static int ikev2_check_payload_length(const ike_payload_header_t *ikep, int rlen, u16 *plen)
Definition: ikev2.c:708
ikev2_ts_t * tsr
Definition: ikev2_priv.h:285
ikev2_child_sa_t * childs
Definition: ikev2_priv.h:438
vlib_log_class_t log_class
Definition: ikev2_priv.h:502
#define clib_error_free(e)
Definition: error.h:86
ikev2_transform_prf_type_t prf_type
Definition: ikev2_priv.h:220
int ipip_del_tunnel(u32 sw_if_index)
Definition: ipip.c:761
u16 port
Definition: lb_types.api:72
Linear Congruential Random Number Generator.
#define IKEV2_EXCHANGE_IKE_AUTH
Definition: ikev2.h:95
static int ikev2_process_create_child_sa_req(vlib_main_t *vm, ikev2_sa_t *sa, ike_header_t *ike, u32 len)
Definition: ikev2.c:1359
static int ikev2_ts_cmp(ikev2_ts_t *ts1, ikev2_ts_t *ts2)
Definition: ikev2.c:1548
#define vnet_buffer(b)
Definition: buffer.h:417
clib_error_t * ikev2_init(vlib_main_t *vm)
Definition: ikev2.c:4621
ip46_address_t local_ip
Definition: ikev2.c:1838
static u32 random_u32(u32 *seed)
32-bit random number generator
Definition: random.h:69
void vlib_worker_thread_barrier_release(vlib_main_t *vm)
Definition: threads.c:1554
void ip_address_copy(ip_address_t *dst, const ip_address_t *src)
Definition: ip_types.c:130
#define ike_hdr_is_initiator(_h)
Definition: ikev2.h:49
ikev2_error_t
Definition: ikev2.c:107
ip4_main_t ip4_main
Global ip4 main structure.
Definition: ip4_forward.c:1144
ikev2_ts_t * ikev2_parse_ts_payload(ike_payload_header_t *ikep, u32 rlen)
static vlib_thread_main_t * vlib_get_thread_main()
Definition: global_funcs.h:32
u32 handover
Definition: ikev2_types.api:83
uword * sa_by_ispi
Definition: ikev2_priv.h:491
vl_api_address_t iaddr
#define vec_foreach(var, vec)
Vector iterator.
ip_address_t start_addr
Definition: ikev2_priv.h:252
u8 unsupported_cp
Definition: ikev2_priv.h:371
f64 end
end of the time range
Definition: mactime.api:44
u64 ispi
static void ikev2_sa_free_all_child_sa(ikev2_child_sa_t **childs)
Definition: ikev2.c:318
u16 flags
Copy of main node flags.
Definition: node.h:500
void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
Definition: trace.c:577
static ikev2_sa_proposal_t * ikev2_select_proposal(ikev2_sa_proposal_t *proposals, ikev2_protocol_id_t prot_id)
Definition: ikev2.c:180
u32 profile_index
Definition: ikev2_priv.h:426
ikev2_generate_sa_error_t
Definition: ikev2.c:71
void udp_register_dst_port(vlib_main_t *vm, udp_dst_port_t dst_port, u32 node_index, u8 is_ip4)
Definition: udp_local.c:468
u8 ip_version_and_header_length
Definition: ip4_packet.h:93
ikev2_transform_type_t
Definition: ikev2.h:217
static_always_inline void vlib_get_buffers(vlib_main_t *vm, u32 *bi, vlib_buffer_t **b, int count)
Translate array of buffer indices into buffer pointers.
Definition: buffer_funcs.h:280
ikev2_transforms_set esp_ts
Definition: ikev2_priv.h:341
#define VLIB_NODE_FLAG_TRACE
Definition: node.h:301
void ikev2_crypto_init(ikev2_main_t *km)
Definition: ikev2_crypto.c:871
static void ikev2_del_tunnel_from_main(ikev2_del_ipsec_tunnel_args_t *a)
Definition: ikev2.c:2193
#define CLIB_CACHE_LINE_BYTES
Definition: cache.h:59
u8 * ip_addr_bytes(ip_address_t *ip)
Definition: ip_types.c:146
void ikev2_payload_add_ts(ikev2_payload_chain_t *c, ikev2_ts_t *ts, u8 type)
ikev2_ip4_next_t
Definition: ikev2.c:121
vlib_main_t * vlib_main
Definition: ikev2_priv.h:485
clib_error_t * ikev2_set_profile_ts(vlib_main_t *vm, u8 *name, u8 protocol_id, u16 start_port, u16 end_port, ip_address_t start_addr, ip_address_t end_addr, int is_local)
Definition: ikev2.c:3936
static void ikev2_sa_free_all_vec(ikev2_sa_t *sa)
Definition: ikev2.c:334
u8 keys_generated
Definition: ikev2_priv.h:448
#define VLIB_INITS(...)
Definition: init.h:357
static void ikev2_send_informational_request(ikev2_sa_t *sa)
Definition: ikev2.c:4931
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.
Definition: buffer_funcs.h:85
#define IPSEC_UDP_PORT_NONE
Definition: ipsec_sa.h:277
static void ikev2_delete_sa(ikev2_main_per_thread_data_t *ptd, ikev2_sa_t *sa)
Definition: ikev2.c:378
static u16 ip4_header_checksum(ip4_header_t *i)
Definition: ip4_packet.h:314
Definition: udp.h:145
u8 * ikev2_calc_sign(EVP_PKEY *pkey, u8 *data)
Definition: ikev2_crypto.c:784
v8 * ikev2_calc_integr(ikev2_sa_transform_t *tr, v8 *key, u8 *data, int len)
Definition: ikev2_crypto.c:316
vl_api_interface_index_t sw_if_index
Definition: wireguard.api:33
u8 * ikev2_find_ike_notify_payload(ike_header_t *ike, u32 msg_type)
u8 * format_ikev2_id_type(u8 *s, va_list *args)
Definition: defs.h:46
#define foreach_ikev2_error
Definition: ikev2.c:96
void ikev2_disable_dpd(void)
Definition: ikev2.c:4979
ip6_address_t dst_address
Definition: ip6_packet.h:310
static void ikev2_init_sa(vlib_main_t *vm, ikev2_sa_t *sa)
Definition: ikev2.c:2735
u32 sw_if_index
Definition: ikev2.c:50
#define IKEV2_GCM_IV_SIZE
Definition: ikev2.h:31
u16 ipsec_over_udp_port
Definition: ikev2_priv.h:430
static int ikev2_process_auth_req(vlib_main_t *vm, ikev2_sa_t *sa, ike_header_t *ike, u32 len)
Definition: ikev2.c:1147
int ipsec_tun_protect_update(u32 sw_if_index, const ip_address_t *nh, u32 sa_out, u32 *sas_in)
Definition: ipsec_tun.c:616
void ikev2_payload_add_notify_2(ikev2_payload_chain_t *c, u16 msg_type, u8 *data, ikev2_notify_t *notify)