19 #include <vpp/app/version.h> 30 #include <openssl/sha.h> 33 #define IKEV2_LIVENESS_RETRIES 3 34 #define IKEV2_LIVENESS_PERIOD_CHECK 30 42 #define ikev2_set_state(sa, v) do { \ 44 ikev2_elog_sa_state("ispi %lx SA state changed to " #v, sa->ispi); \ 60 s =
format (s,
"ikev2: sw_if_index %d, next index %d",
65 #define IKEV2_GENERATE_SA_INIT_OK_str "" 66 #define IKEV2_GENERATE_SA_INIT_OK_ERR_NO_DH_STR \ 67 "no DH group configured for IKE proposals!" 68 #define IKEV2_GENERATE_SA_INIT_OK_ERR_UNSUPP_STR \ 69 "DH group not supported!" 96 #define foreach_ikev2_error \ 97 _(PROCESSED, "IKEv2 packets processed") \ 98 _(IKE_SA_INIT_RETRANSMIT, "IKE_SA_INIT retransmit ") \ 99 _(IKE_SA_INIT_IGNORE, "IKE_SA_INIT ignore (IKE SA already auth)") \ 100 _(IKE_REQ_RETRANSMIT, "IKE request retransmit") \ 101 _(IKE_REQ_IGNORE, "IKE request ignore (old msgid)") \ 102 _(NOT_IKEV2, "Non IKEv2 packets received") \ 103 _(BAD_LENGTH, "Bad packet length") \ 104 _(MALFORMED_PACKET, "Malformed packet") \ 105 _(NO_BUFF_SPACE, "No buffer space") 109 #define _(sym,str) IKEV2_ERROR_##sym, 116 #define _(sym,string) string, 165 if (td->
type == IKEV2_TRANSFORM_TYPE_ENCR)
168 || t->
attrs[1] != 14)
186 u8 mandatory_bitmap, optional_bitmap;
190 mandatory_bitmap = (1 << IKEV2_TRANSFORM_TYPE_ENCR) |
191 (1 << IKEV2_TRANSFORM_TYPE_PRF) | (1 << IKEV2_TRANSFORM_TYPE_DH);
192 optional_bitmap = mandatory_bitmap | (1 << IKEV2_TRANSFORM_TYPE_INTEG);
196 mandatory_bitmap = (1 << IKEV2_TRANSFORM_TYPE_ENCR) |
197 (1 << IKEV2_TRANSFORM_TYPE_ESN);
198 optional_bitmap = mandatory_bitmap |
199 (1 << IKEV2_TRANSFORM_TYPE_INTEG) | (1 << IKEV2_TRANSFORM_TYPE_DH);
203 mandatory_bitmap = (1 << IKEV2_TRANSFORM_TYPE_INTEG) |
204 (1 << IKEV2_TRANSFORM_TYPE_ESN);
205 optional_bitmap = mandatory_bitmap | (1 << IKEV2_TRANSFORM_TYPE_DH);
220 if ((1 << transform->
type) & bitmap)
225 bitmap |= 1 << transform->
type;
232 if ((bitmap & mandatory_bitmap) == mandatory_bitmap &&
233 (bitmap & ~optional_bitmap) == 0)
237 RAND_bytes ((
u8 *) & rv->
spi, sizeof (rv->
spi));
277 if (proposal && proposal->
spi == spi && proposal->
protocol_id == prot_id)
398 if (sa->
dh_group == IKEV2_TRANSFORM_DH_TYPE_NONE)
404 if (t2->type == IKEV2_TRANSFORM_TYPE_DH && sa->
dh_group == t2->dh_type)
413 sa->
dh_group = IKEV2_TRANSFORM_DH_TYPE_NONE;
420 RAND_bytes ((
u8 *) & sa->
ispi, 8);
429 RAND_bytes ((
u8 *) & sa->
rspi, 8);
449 #define _(A) ({void* __tmp__ = (A); (A) = 0; __tmp__;}) 479 if (sa->
dh_group == IKEV2_TRANSFORM_DH_TYPE_NONE)
487 if (t2->type == IKEV2_TRANSFORM_TYPE_DH && sa->
dh_group == t2->dh_type)
496 sa->
dh_group = IKEV2_TRANSFORM_DH_TYPE_NONE;
513 u16 integ_key_len = 0, salt_len = 0;
523 integ_key_len = tr_integ->
key_len;
525 salt_len =
sizeof (
u32);
533 vec_add2 (s, tmp, 2 *
sizeof (*spi));
535 spi[0] = clib_host_to_net_u64 (sa->
ispi);
536 spi[1] = clib_host_to_net_u64 (sa->
rspi);
562 pos += integ_key_len;
567 pos += integ_key_len;
573 pos += tr_encr->
key_len + salt_len;
578 pos += tr_encr->
key_len + salt_len;
598 u16 integ_key_len = 0;
610 integ_key_len = ctr_integ->
key_len;
612 salt_len =
sizeof (
u32);
618 int len = ctr_encr->
key_len * 2 + integ_key_len * 2 + salt_len * 2;
652 pos += integ_key_len;
668 const u32 max_buf_size =
669 sizeof (
ispi) +
sizeof (rspi) +
sizeof (ip6_address_t) +
sizeof (
u16);
670 u8 buf[max_buf_size];
677 SHA1 (buf, 2 *
sizeof (ispi) +
sizeof (port) +
ip_address_size (ia), res);
685 const ike_ke_payload_header_t *ke = p;
686 u16 plen = clib_net_to_host_u16 (ke->length);
687 ASSERT (plen >=
sizeof (*ke) && plen <= rlen);
688 if (
sizeof (*ke) > rlen)
691 sa->
dh_group = clib_net_to_host_u16 (ke->dh_group);
693 vec_add (ke_data[0], ke->payload, plen - sizeof (*ke));
700 const ike_payload_header_t *ikep = p;
701 u16 plen = clib_net_to_host_u16 (ikep->length);
702 ASSERT (plen >=
sizeof (*ikep) && plen <= rlen);
711 if (
sizeof (*ikep) > rlen)
713 *plen = clib_net_to_host_u16 (ikep->length);
714 if (*plen <
sizeof (*ikep) || *plen > rlen)
726 u8 payload = ike->nextpayload;
727 ike_payload_header_t *ikep;
731 "from ", clib_net_to_host_u64 (ike->ispi),
732 clib_net_to_host_u64 (ike->rspi),
736 sa->
ispi = clib_net_to_host_u64 (ike->ispi);
742 if (len <
sizeof (*ike))
745 len -=
sizeof (*ike);
748 ikep = (ike_payload_header_t *) & ike->payload[p];
749 int current_length = len - p;
774 if (n->
msg_type == IKEV2_NOTIFY_MSG_NAT_DETECTION_SOURCE_IP)
783 " behind NAT", sa->
ispi);
788 IKEV2_NOTIFY_MSG_NAT_DETECTION_DESTINATION_IP)
797 " (self) behind NAT", sa->
ispi);
819 payload = ikep->nextpayload;
834 u8 payload = ike->nextpayload;
835 ike_payload_header_t *ikep;
838 sa->
ispi = clib_net_to_host_u64 (ike->ispi);
839 sa->
rspi = clib_net_to_host_u64 (ike->rspi);
850 if (
sizeof (*ike) > len)
853 len -=
sizeof (*ike);
856 int current_length = len - p;
857 ikep = (ike_payload_header_t *) & ike->payload[p];
869 clib_host_to_net_u32 (clib_net_to_host_u32 (ike->msgid) + 1);
888 if (n->
msg_type == IKEV2_NOTIFY_MSG_NAT_DETECTION_SOURCE_IP)
896 " behind NAT, unsupported", sa->
ispi);
901 IKEV2_NOTIFY_MSG_NAT_DETECTION_DESTINATION_IP)
911 " (self) behind NAT", sa->
ispi);
933 payload = ikep->nextpayload;
940 u8 * payload,
u32 rlen,
u32 * out_len)
945 ike_payload_header_t *ikep = 0;
954 int is_aead = tr_encr->
encr_type == IKEV2_TRANSFORM_ENCR_TYPE_AES_GCM_16;
959 if (rlen <=
sizeof (*ike))
962 int len = rlen -
sizeof (*ike);
966 ikep = (ike_payload_header_t *) & ike->payload[p];
967 int current_length = len - p;
973 last_payload = *payload;
986 *payload = ikep->nextpayload;
1002 u8 *aad = (
u8 *) ike;
1003 u32 aad_len = ikep->payload - aad;
1004 u8 *tag = ikep->payload + plen;
1007 plen, aad, aad_len, tag, &dlen);
1023 if (plen <
sizeof (*ikep) + tr_integ->
key_trunc)
1026 plen = plen -
sizeof (*ikep) - tr_integ->
key_trunc;
1075 if (!ikev2_is_id_equal (&tmp->i_id, &sa->i_id)
1076 || !ikev2_is_id_equal(&tmp->r_id, &sa->r_id))
1079 if (sa->rspi != tmp->rspi)
1080 vec_add1(delete, tmp - ptd->sas);
1084 for (i = 0; i <
vec_len (
delete); i++)
1122 const ike_id_payload_header_t *
id = p;
1123 u16 plen = clib_net_to_host_u16 (id->length);
1124 if (plen <
sizeof (*
id) || plen > rlen)
1127 sa_id->
type =
id->id_type;
1129 vec_add (sa_id->
data, id->payload, plen - sizeof (*
id));
1137 const ike_auth_payload_header_t *ah = p;
1138 u16 plen = clib_net_to_host_u16 (ah->length);
1140 a->
method = ah->auth_method;
1142 vec_add (a->
data, ah->payload, plen - sizeof (*ah));
1148 ike_header_t * ike,
u32 len)
1152 u8 payload = ike->nextpayload;
1154 ike_payload_header_t *ikep;
1159 "from ", clib_host_to_net_u64 (ike->ispi),
1160 clib_host_to_net_u64 (ike->rspi),
1183 first_child_sa = &sa->
childs[0];
1195 ikep = (ike_payload_header_t *) & plaintext[p];
1196 int current_length = dlen - p;
1244 if (n->
msg_type == IKEV2_NOTIFY_MSG_INITIAL_CONTACT)
1277 payload = ikep->nextpayload;
1293 u8 payload = ike->nextpayload;
1295 ike_payload_header_t *ikep;
1301 "from ", clib_host_to_net_u64 (ike->ispi),
1302 clib_host_to_net_u64 (ike->rspi),
1315 u32 current_length = dlen - p;
1316 if (p +
sizeof (*ikep) > dlen)
1319 ikep = (ike_payload_header_t *) & plaintext[p];
1320 u16 plen = clib_net_to_host_u16 (ikep->length);
1322 if (plen <
sizeof (*ikep) || plen > current_length)
1330 if (n->
msg_type == IKEV2_NOTIFY_MSG_AUTHENTICATION_FAILED)
1352 payload = ikep->nextpayload;
1364 u8 payload = ike->nextpayload;
1369 ike_payload_header_t *ikep;
1379 "from ", clib_host_to_net_u64 (ike->ispi),
1380 clib_host_to_net_u64 (ike->rspi),
1387 goto cleanup_and_exit;
1393 ikep = (ike_payload_header_t *) & plaintext[p];
1394 int current_length = dlen - p;
1396 goto cleanup_and_exit;
1405 if (n->
msg_type == IKEV2_NOTIFY_MSG_REKEY_SA)
1437 goto cleanup_and_exit;
1440 payload = ikep->nextpayload;
1449 goto cleanup_and_exit;
1474 goto cleanup_and_exit;
1492 goto cleanup_and_exit;
1564 ikev2_ts_t *ts, *p_tsi, *p_tsr, *tsi = 0, *tsr = 0;
1570 if (sa->is_initiator)
1594 if (ikev2_ts_cmp(p_tsi, ts))
1596 vec_add1 (tsi, ts[0]);
1618 sa->childs[0].tsi = tsi;
1619 sa->childs[0].tsr = tsr;
1634 u8 *authmsg, *key_pad, *psk = 0, *
auth = 0;
1641 if (!(sa->
i_auth.
method == IKEV2_AUTH_METHOD_SHARED_KEY_MIC ||
1645 "unsupported authentication method %u",
1674 if (!ikev2_is_id_equal (&p->rem_id, id_rem)
1675 || !ikev2_is_id_equal (&p->loc_id, id_loc))
1678 if (sa_auth->method == IKEV2_AUTH_METHOD_SHARED_KEY_MIC)
1680 if (!p->auth.data ||
1681 p->auth.method != IKEV2_AUTH_METHOD_SHARED_KEY_MIC)
1684 psk = ikev2_calc_prf(tr_prf, p->auth.data, key_pad);
1685 auth = ikev2_calc_prf(tr_prf, psk, authmsg);
1687 if (!clib_memcmp(auth, sa_auth->data, vec_len(sa_auth->data)))
1689 ikev2_set_state(sa, IKEV2_STATE_AUTHENTICATED);
1696 else if (sa_auth->
method == IKEV2_AUTH_METHOD_RSA_SIG)
1698 if (p->auth.method != IKEV2_AUTH_METHOD_RSA_SIG)
1701 if (ikev2_verify_sign(p->auth.key, sa_auth->data, authmsg) == 1)
1703 ikev2_set_state(sa, IKEV2_STATE_AUTHENTICATED);
1716 sa->udp_encap = sel_p->udp_encap;
1717 sa->ipsec_over_udp_port = sel_p->ipsec_over_udp_port;
1723 if (!sa->is_initiator)
1726 sa->r_id.data =
vec_dup (sel_p->loc_id.data);
1727 sa->r_id.type = sel_p->loc_id.type;
1728 sa->i_id.data =
vec_dup (sel_p->rem_id.data);
1729 sa->i_id.type = sel_p->rem_id.type;
1733 if (sel_p->auth.method == IKEV2_AUTH_METHOD_SHARED_KEY_MIC)
1737 sa->r_auth.method = IKEV2_AUTH_METHOD_SHARED_KEY_MIC;
1739 else if (sel_p->auth.method == IKEV2_AUTH_METHOD_RSA_SIG)
1743 sa->r_auth.method = IKEV2_AUTH_METHOD_RSA_SIG;
1749 sa->childs[0].r_proposals =
1753 if (~0 != sel_p->tun_itf)
1755 sa->is_tun_itf_set = 1;
1756 sa->tun_itf = sel_p->tun_itf;
1762 ikev2_elog_uint (IKEV2_LOG_ERROR,
"authentication failed, no matching " 1763 "profile found! ispi %lx", sa->ispi);
1775 u8 *authmsg, *key_pad, *psk = 0;
1782 if (!(sa->
i_auth.
method == IKEV2_AUTH_METHOD_SHARED_KEY_MIC ||
1786 "unsupported authentication method %u",
1796 if (sa->
i_auth.
method == IKEV2_AUTH_METHOD_SHARED_KEY_MIC)
1802 else if (sa->
i_auth.
method == IKEV2_AUTH_METHOD_RSA_SIG)
1817 return (0x80000000 | (ti << 24) | (sai << 12) | ci);
1823 return (0xc0000000 | (ti << 24) | (sai << 12) | ci);
1860 TUNNEL_ENCAP_DECAP_FLAG_NONE, IP_DSCP_CS0,
1861 TUNNEL_MODE_P2P, &sw_if_index);
1863 if (rv == VNET_API_ERROR_IF_ALREADY_EXISTS)
1880 "installing ipip tunnel failed! local spi: %x",
1910 (a->
flags | IPSEC_SA_FLAG_IS_INBOUND), 0,
1935 u32 child_index,
u8 is_rekey)
1972 a.
flags = IPSEC_SA_FLAG_USE_ANTI_REPLAY;
1975 a.
flags |= IPSEC_SA_FLAG_IS_TUNNEL;
1976 a.
flags |= IPSEC_SA_FLAG_UDP_ENCAP;
1979 a.
flags |= IPSEC_SA_FLAG_UDP_ENCAP;
1984 a.
flags |= IPSEC_SA_FLAG_USE_ESN;
1994 encr_type = IPSEC_CRYPTO_ALG_AES_CBC_128;
1997 encr_type = IPSEC_CRYPTO_ALG_AES_CBC_192;
2000 encr_type = IPSEC_CRYPTO_ALG_AES_CBC_256;
2008 else if (tr->
encr_type == IKEV2_TRANSFORM_ENCR_TYPE_AES_GCM_16
2014 encr_type = IPSEC_CRYPTO_ALG_AES_GCM_128;
2017 encr_type = IPSEC_CRYPTO_ALG_AES_GCM_192;
2020 encr_type = IPSEC_CRYPTO_ALG_AES_GCM_256;
2049 case IKEV2_TRANSFORM_INTEG_TYPE_AUTH_HMAC_SHA2_256_128:
2050 integ_type = IPSEC_INTEG_ALG_SHA_256_128;
2052 case IKEV2_TRANSFORM_INTEG_TYPE_AUTH_HMAC_SHA2_384_192:
2053 integ_type = IPSEC_INTEG_ALG_SHA_384_192;
2055 case IKEV2_TRANSFORM_INTEG_TYPE_AUTH_HMAC_SHA2_512_256:
2056 integ_type = IPSEC_INTEG_ALG_SHA_512_256;
2058 case IKEV2_TRANSFORM_INTEG_TYPE_AUTH_HMAC_SHA1_96:
2059 integ_type = IPSEC_INTEG_ALG_SHA1_96;
2074 integ_type = IPSEC_INTEG_ALG_NONE;
2129 if (thread_index & 0xffffffc0)
2132 if (child_index & 0xfffff000 || sa_index & 0xfffff000)
2158 remote_sa_id |=
mask;
2170 (
u8 *) & a,
sizeof (a));
2202 ipip_tunnel_key_t
key = {
2226 if (~0 != sw_if_index)
2272 ike_payload_header_t *ph;
2290 IKEV2_NOTIFY_MSG_NO_PROPOSAL_CHOSEN, 0);
2293 else if (sa->
dh_group == IKEV2_TRANSFORM_DH_TYPE_NONE)
2299 IKEV2_TRANSFORM_TYPE_DH);
2302 data[0] = (tr_dh->
dh_type >> 8) & 0xff;
2303 data[1] = (tr_dh->
dh_type) & 0xff;
2306 IKEV2_NOTIFY_MSG_INVALID_KE_PAYLOAD,
2317 IKEV2_NOTIFY_MSG_UNSUPPORTED_CRITICAL_PAYLOAD,
2325 ike->rspi = clib_host_to_net_u64 (sa->
rspi);
2330 u8 *nat_detection_sha1 =
2332 clib_host_to_net_u64 (sa->
rspi),
2335 IKEV2_NOTIFY_MSG_NAT_DETECTION_SOURCE_IP,
2336 nat_detection_sha1);
2338 nat_detection_sha1 =
2340 clib_host_to_net_u64 (sa->
rspi),
2343 IKEV2_NOTIFY_MSG_NAT_DETECTION_DESTINATION_IP,
2344 nat_detection_sha1);
2362 IKEV2_NOTIFY_MSG_AUTHENTICATION_FAILED,
2376 IKEV2_NOTIFY_MSG_NO_PROPOSAL_CHOSEN, 0);
2388 IKEV2_NOTIFY_MSG_UNSUPPORTED_CRITICAL_PAYLOAD,
2445 IKEV2_NOTIFY_MSG_UNSUPPORTED_CRITICAL_PAYLOAD,
2463 *(
u32 *) data = clib_host_to_net_u32 (notify.
spi);
2492 IKEV2_NOTIFY_MSG_UNSUPPORTED_CRITICAL_PAYLOAD,
2500 IKEV2_NOTIFY_MSG_NO_ADDITIONAL_SAS,
2509 tlen =
sizeof (*ike);
2518 ike->length = clib_host_to_net_u32 (tlen);
2538 plen =
sizeof (*ph);
2539 ph = (ike_payload_header_t *) & ike->payload[0];
2543 tr_encr->
encr_type == IKEV2_TRANSFORM_ENCR_TYPE_AES_GCM_16;
2561 ph->length = clib_host_to_net_u16 (plen);
2562 ike->length = clib_host_to_net_u32 (tlen);
2567 ph->payload, (
u8 *) ike,
2568 sizeof (*ike) +
sizeof (*ph),
2569 ph->payload + plen - sizeof (*ph) -
2579 (ptd, sa, tr_encr, chain->
data, ph->payload))
2589 sizeof (*ike), integ, tr_integ->
key_trunc);
2610 u8 payload = ike->nextpayload;
2612 if (sa->
ispi != clib_net_to_host_u64 (ike->ispi) ||
2621 ike_payload_header_t *ikep = (ike_payload_header_t *) & ike->payload[p];
2622 u32 plen = clib_net_to_host_u16 (ikep->length);
2624 if (plen <
sizeof (ike_payload_header_t))
2634 u32 slen = clib_net_to_host_u32 (tmp->length);
2635 ike->ispi = tmp->ispi;
2636 ike->rspi = tmp->rspi;
2637 ike->nextpayload = tmp->nextpayload;
2638 ike->version = tmp->version;
2639 ike->exchange = tmp->exchange;
2640 ike->flags = tmp->flags;
2641 ike->msgid = tmp->msgid;
2642 ike->length = tmp->length;
2644 slen - sizeof (*ike));
2646 "ispi %lx IKE_SA_INIT retransmit " 2647 "from %d.%d.%d.%d to %d.%d.%d.%d",
2657 "ispi %lx IKE_SA_INIT ignore " 2658 "from %d.%d.%d.%d to %d.%d.%d.%d",
2665 payload = ikep->nextpayload;
2682 res = ikev2_retransmit_sa_init_one (sa, ike, iaddr, raddr, rlen);
2698 u32 msg_id = clib_net_to_host_u32 (ike->msgid);
2711 u32 slen = clib_net_to_host_u32 (tmp->length);
2712 ike->ispi = tmp->ispi;
2713 ike->rspi = tmp->rspi;
2714 ike->nextpayload = tmp->nextpayload;
2715 ike->version = tmp->version;
2716 ike->exchange = tmp->exchange;
2717 ike->flags = tmp->flags;
2718 ike->msgid = tmp->msgid;
2719 ike->length = tmp->length;
2795 const void *
raddr,
const int af)
2817 "received from %d.%d.%d.%d to %d.%d.%d.%d",
2818 exchange, src, dst);
2864 int is_req = 0, has_non_esp_marker = 0;
2876 ptr +=
sizeof (*ip40);
2878 ptr +=
sizeof (*udp0);
2879 ike0 = (ike_header_t *) ptr;
2880 ip_hdr_sz =
sizeof (*ip40);
2892 ip_hdr_sz =
sizeof (*ip40);
2897 ip_hdr_sz =
sizeof (*ip60);
2905 if (*((
u32 *) ike0) == 0)
2910 has_non_esp_marker = 1;
2913 if (clib_net_to_host_u32 (ike0->length) != rlen)
2916 IKEV2_ERROR_BAD_LENGTH, 1);
2923 IKEV2_ERROR_NOT_IKEV2, 1);
2934 if (ike0->rspi == 0)
2953 IKEV2_ERROR_IKE_SA_INIT_IGNORE
2955 IKEV2_ERROR_IKE_SA_INIT_RETRANSMIT,
2963 IKEV2_ERROR_MALFORMED_PACKET,
2982 IKEV2_ERROR_NO_BUFF_SPACE,
3035 IKEV2_ERROR_NO_BUFF_SPACE,
3072 IKEV2_ERROR_IKE_REQ_IGNORE
3074 IKEV2_ERROR_IKE_REQ_RETRANSMIT,
3085 IKEV2_ERROR_MALFORMED_PACKET, 1);
3106 IKEV2_ERROR_NO_BUFF_SPACE,
3124 IKEV2_ERROR_IKE_REQ_IGNORE
3126 IKEV2_ERROR_IKE_REQ_RETRANSMIT,
3135 IKEV2_ERROR_MALFORMED_PACKET,
3178 IKEV2_ERROR_NO_BUFF_SPACE,
3196 IKEV2_ERROR_IKE_REQ_IGNORE
3198 IKEV2_ERROR_IKE_REQ_RETRANSMIT,
3207 IKEV2_ERROR_MALFORMED_PACKET,
3239 IKEV2_ERROR_NO_BUFF_SPACE,
3252 if (slen && ~0 != slen)
3273 if (!has_non_esp_marker)
3279 if (has_non_esp_marker)
3313 && (b0->
flags & VLIB_BUFFER_IS_TRACED)))
3326 IKEV2_ERROR_PROCESSED, frame->
n_vectors);
3346 .name =
"ikev2-ip4",
3347 .vector_size =
sizeof (
u32),
3363 .name =
"ikev2-ip6",
3364 .vector_size =
sizeof (
u32),
3388 vec_add2 (*proposals, proposal, 1);
3396 if (td->
type == IKEV2_TRANSFORM_TYPE_ENCR
3401 attr[0] = clib_host_to_net_u16 (14 | (1 << 15));
3402 attr[1] = clib_host_to_net_u16 (td->
key_len << 3);
3417 if (IKEV2_TRANSFORM_INTEG_TYPE_NONE != ts->
integ_alg)
3423 if (td->
type == IKEV2_TRANSFORM_TYPE_INTEG
3434 (
"Didn't find any supported algorithm for IKEV2_TRANSFORM_TYPE_INTEG");
3446 if (td->
type == IKEV2_TRANSFORM_TYPE_PRF
3447 && td->
prf_type == IKEV2_TRANSFORM_PRF_TYPE_PRF_HMAC_SHA2_256)
3490 if (td->
type == IKEV2_TRANSFORM_TYPE_ESN)
3535 udp0->
dst_port = clib_host_to_net_u16 (dst_port);
3536 udp0->
src_port = clib_host_to_net_u16 (src_port);
3564 clib_host_to_net_u32 (0x6 << 28);
3575 b0->
flags |= VNET_BUFFER_F_LOCALLY_ORIGINATED;
3610 EVP_PKEY_free (km->
pkey);
3612 if (km->
pkey == NULL)
3636 return VNET_API_ERROR_UDP_PORT_TAKEN;
3689 if (send_notification)
3700 ike0->ispi = clib_host_to_net_u64 (sa->
ispi);
3701 ike0->rspi = clib_host_to_net_u64 (sa->
rspi);
3753 if (pi == sa->profile_index)
3754 vec_add1 (del_sai, sa - km->sais);
3771 if (sa->profile_index != ~0 && pi == sa->profile_index)
3772 vec_add1 (del_sai, sa - tkm->sas);
3839 u8 * auth_data,
u8 data_hex_format)
3858 p->
auth.
hex = data_hex_format;
3860 if (auth_method == IKEV2_AUTH_METHOD_RSA_SIG)
3874 return (id_type == IKEV2_ID_TYPE_ID_IPV4_ADDR ||
3875 id_type == IKEV2_ID_TYPE_ID_IPV6_ADDR ||
3876 id_type == IKEV2_ID_TYPE_ID_RFC822_ADDR ||
3877 id_type == IKEV2_ID_TYPE_ID_FQDN);
4074 return VNET_API_ERROR_INVALID_VALUE;
4079 return VNET_API_ERROR_VALUE_EXIST;
4087 return VNET_API_ERROR_IKE_NO_PORT;
4090 return VNET_API_ERROR_INVALID_VALUE;
4141 ip6_address_t *if_ip6;
4173 int len =
sizeof (ike_header_t), valid_ip = 0;
4246 u8 *nat_detection_sha1 =
4248 clib_host_to_net_u64 (sa.
rspi),
4252 nat_detection_sha1);
4254 nat_detection_sha1 =
4256 clib_host_to_net_u64 (sa.
rspi),
4258 clib_host_to_net_u16 (sa.
dst_port));
4260 IKEV2_NOTIFY_MSG_NAT_DETECTION_DESTINATION_IP,
4261 nat_detection_sha1);
4265 u64 tmpsig = clib_host_to_net_u64 (0x0001000200030004);
4268 IKEV2_NOTIFY_MSG_SIGNATURE_HASH_ALGORITHMS,
4277 char *errmsg =
"buffer alloc failure";
4286 ike0->length = clib_host_to_net_u32 (len);
4293 ike0->ispi = clib_host_to_net_u64 (sa.
ispi);
4330 (
"ispi %lx rspi %lx IKEV2_EXCHANGE_SA_INIT sent to ",
4331 clib_host_to_net_u64 (sa0->
ispi), 0,
4367 ike0->ispi = clib_host_to_net_u64 (sa->
ispi);
4368 ike0->rspi = clib_host_to_net_u64 (sa->
rspi);
4406 fchild = ikev2_sa_get_child(sa, ispi, IKEV2_PROTOCOL_ESP, 1);
4416 if (!fchild || !fsa)
4446 if (sa->ispi == ispi)
4487 ike0->ispi = clib_host_to_net_u64 (sa->
ispi);
4488 ike0->rspi = clib_host_to_net_u64 (sa->
rspi);
4498 RAND_bytes ((
u8 *) & proposals[0].
spi,
sizeof (proposals[0].spi));
4499 rekey->
spi = proposals[0].
spi;
4529 fchild = ikev2_sa_get_child(sa, ispi, IKEV2_PROTOCOL_ESP, 1);
4539 if (!fchild || !fsa)
4571 if (ikev2_sa_sw_if_match (sa, sw_if_index))
4572 vec_add1 (sa_vec, sa);
4586 if (ikev2_sa_sw_if_match (sa, sw_if_index))
4587 vec_add1 (ispi_vec, sa->ispi);
4610 if (p->responder.sw_if_index == sw_if_index)
4611 ikev2_sa_del (p, sw_if_index);
4639 for (thread_id = 0; thread_id < tm->
n_vlib_mains; thread_id++)
4646 #if OPENSSL_VERSION_NUMBER >= 0x10100000L 4647 ptd->
evp_ctx = EVP_CIPHER_CTX_new ();
4650 EVP_CIPHER_CTX_init (&ptd->_evp_ctx);
4651 ptd->
evp_ctx = &ptd->_evp_ctx;
4652 HMAC_CTX_init (&(ptd->_hmac_ctx));
4679 .runs_after =
VLIB_INITS(
"ipsec_init",
"ipsec_punt_init"),
4733 if (~0 == sw_if_index)
4735 ip46_address_t local_ip;
4736 ip46_address_t remote_ip;
4753 ipip_tunnel_key_t
key = {
4803 if (period == 0 || max_retries == 0)
4842 fchild = ikev2_sa_get_child(sa, ipsec_sa->spi, IKEV2_PROTOCOL_ESP, 1);
4852 ipsec_sa->stat_index, &counts);
4854 if (fsa && fsa->profile_index != ~0 && fsa->is_initiator)
4857 if (fchild && p && p->lifetime_maxdata)
4859 if (!fchild->is_expired && counts.bytes > p->lifetime_maxdata)
4861 fchild->time_to_expiration = now;
4885 IKEV2_NOTIFY_MSG_NAT_DETECTION_SOURCE_IP);
4890 clib_host_to_net_u64 (sa->
rspi),
4921 sa = pool_elt_at_index (km->sais, sai);
4922 if (sa->init_response_received)
4925 ikev2_process_pending_sa_init_one (km, sa);
4950 ike0->ispi = clib_host_to_net_u64 (sa->
ispi);
4951 ike0->rspi = clib_host_to_net_u64 (sa->
rspi);
5028 u32 *to_be_deleted = 0;
5032 ikev2_child_sa_t *c;
5035 if (sa->state != IKEV2_STATE_AUTHENTICATED)
5038 if (sa->old_remote_id_present && 0 > sa->old_id_expiration)
5040 sa->old_remote_id_present = 0;
5057 u8 reinitiate = (sa->is_initiator && sa->profile_index != ~0);
5088 ikev2_mngr_process_ipsec_sa(sa);
5102 "ikev2-manager-process",
5106 .version = VPP_BUILD_VER,
5107 .description =
"Internet Key Exchange (IKEv2) Protocol",
ikev2_main_per_thread_data_t * per_thread_data
ipip_tunnel_t * ipip_tunnel_db_find(const ipip_tunnel_key_t *key)
vlib_log_class_t vlib_log_register_class(char *class, char *subclass)
#define vec_validate(V, I)
Make sure vector is long enough for given index (no header, unspecified alignment) ...
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index, VLIB_BUFFER_IS_TRACED: trace this buffer.
clib_error_t * ikev2_profile_natt_disable(u8 *name)
vl_api_address_t end_addr
void ikev2_payload_add_nonce(ikev2_payload_chain_t *c, u8 *nonce)
static ikev2_generate_sa_error_t ikev2_generate_sa_init_data(ikev2_sa_t *sa)
static u8 * format_ikev2_trace(u8 *s, va_list *args)
u8 * format_clib_error(u8 *s, va_list *va)
#define hash_set(h, key, value)
#define IKEV2_PAYLOAD_NONCE
void ikev2_payload_add_notify(ikev2_payload_chain_t *c, u16 msg_type, u8 *data)
ikev2_transforms_set ike_ts
static int ikev2_delete_tunnel_interface(vnet_main_t *vnm, ikev2_sa_t *sa, ikev2_child_sa_t *child)
static uword ikev2_ip4(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame)
static u8 ikev2_mngr_process_child_sa(ikev2_sa_t *sa, ikev2_child_sa_t *csa, u8 del_old_ids)
static f64 vlib_process_wait_for_event_or_clock(vlib_main_t *vm, f64 dt)
Suspend a cooperative multi-tasking thread Waits for an event, or for the indicated number of seconds...
ikev2_transform_integ_type_t
#define hash_unset(h, key)
#define ike_hdr_is_response(_h)
static void ikev2_del_sa_init(u64 ispi)
ikev2_natt_state_t natt_state
void ip_address_set(ip_address_t *dst, const void *src, u8 version)
clib_error_t * ikev2_add_del_profile(vlib_main_t *vm, u8 *name, int is_add)
int ikev2_encrypt_data(ikev2_main_per_thread_data_t *ptd, ikev2_sa_t *sa, ikev2_sa_transform_t *tr_encr, v8 *src, u8 *dst)
A representation of a IPIP tunnel.
void ikev2_payload_add_sa(ikev2_payload_chain_t *c, ikev2_sa_proposal_t *proposals)
vnet_main_t * vnet_get_main(void)
static void ikev2_elog_uint_peers_addr(u32 exchange, ip4_header_t *ip4, ip6_header_t *ip6, u8 is_ip4)
ikev2_traffic_selector_type_t ts_type
clib_error_t * ikev2_set_profile_udp_encap(vlib_main_t *vm, u8 *name)
static void ikev2_profile_free(ikev2_profile_t *p)
static void ikev2_calc_keys(ikev2_sa_t *sa)
#define IKEV2_PAYLOAD_NONE
ikev2_profile_t * profiles
i16 current_data
signed offset in data[], pre_data[] that we are currently processing.
vl_api_ip_port_and_mask_t dst_port
clib_error_t * ikev2_initiate_delete_ike_sa(vlib_main_t *vm, u64 ispi)
vl_api_address_t start_addr
static void ikev2_initial_contact_cleanup(ikev2_main_per_thread_data_t *ptd, ikev2_sa_t *sa)
#define clib_memcpy_fast(a, b, c)
u32 current_remote_id_mask
uword mhash_unset(mhash_t *h, void *key, uword *old_value)
clib_memset(h->entries, 0, sizeof(h->entries[0]) *entries)
static void ikev2_sa_free_child_sa(ikev2_child_sa_t *c)
ip4_address_t * ip4_interface_first_address(ip4_main_t *im, u32 sw_if_index, ip_interface_address_t **result_ia)
v8 * ikev2_calc_prf(ikev2_sa_transform_t *tr, v8 *key, v8 *data)
static f64 vlib_time_now(vlib_main_t *vm)
void vnet_sw_interface_admin_up(vnet_main_t *vnm, u32 sw_if_index)
static void ikev2_complete_sa_data(ikev2_sa_t *sa, ikev2_sa_t *sai)
#define ikev2_elog_error(_msg)
static int ikev2_get_if_address(u32 sw_if_index, ip_address_family_t af, ip_address_t *out_addr)
#define IKEV2_GENERATE_SA_INIT_OK_ERR_NO_DH_STR
#define IKEV2_EXCHANGE_SA_INIT
static void ikev2_delete_child_sa_internal(vlib_main_t *vm, ikev2_sa_t *sa, ikev2_child_sa_t *csa)
static u32 ikev2_get_new_ike_header_buff(vlib_main_t *vm, vlib_buffer_t **b)
u16 current_length
Nbytes between current data and the end of this buffer.
#define IKEV2_PAYLOAD_VENDOR
#define vec_add1(V, E)
Add 1 element to end of vector (unspecified alignment).
ip6_address_t * ip6_interface_first_address(ip6_main_t *im, u32 sw_if_index)
get first IPv6 interface address
Combined counter to hold both packets and byte differences.
u16 ip_address_size(const ip_address_t *a)
clib_error_t * ikev2_set_profile_tunnel_interface(vlib_main_t *vm, u8 *name, u32 sw_if_index)
int vlib_punt_hdl_t
Typedef for a client handle.
#define vec_add2(V, P, N)
Add N elements to end of vector V, return pointer to new elements in P.
static int ikev2_process_sa_init_req(vlib_main_t *vm, ikev2_sa_t *sa, ike_header_t *ike, udp_header_t *udp, u32 len)
static clib_error_t * ikev2_sw_interface_add_del(vnet_main_t *vnm, u32 sw_if_index, u32 is_add)
static void mhash_init_vec_string(mhash_t *h, uword n_value_bytes)
static udp_dst_port_info_t * udp_get_dst_port_info(udp_main_t *um, udp_dst_port_t dst_port, u8 is_ip4)
#define IKEV2_GCM_ICV_SIZE
clib_error_t * ikev2_set_profile_sa_lifetime(vlib_main_t *vm, u8 *name, u64 lifetime, u32 jitter, u32 handover, u64 maxdata)
void ikev2_payload_add_ke(ikev2_payload_chain_t *c, u16 dh_group, u8 *dh_data)
clib_error_t * ikev2_set_liveness_params(u32 period, u32 max_retries)
#define IKEV2_PAYLOAD_TSR
static int ikev2_parse_id_payload(const void *p, u16 rlen, ikev2_id_t *sa_id)
#define vec_validate_aligned(V, I, A)
Make sure vector is long enough for given index (no header, specified alignment)
int ipsec_sa_add_and_lock(u32 id, u32 spi, ipsec_protocol_t proto, ipsec_crypto_alg_t crypto_alg, const ipsec_key_t *ck, ipsec_integ_alg_t integ_alg, const ipsec_key_t *ik, ipsec_sa_flags_t flags, u32 tx_table_id, u32 salt, const ip46_address_t *tun_src, const ip46_address_t *tun_dst, u32 *sa_out_index, u16 src_port, u16 dst_port)
int ipip_add_tunnel(ipip_transport_t transport, u32 instance, ip46_address_t *src, ip46_address_t *dst, u32 fib_index, tunnel_encap_decap_flags_t flags, ip_dscp_t dscp, tunnel_mode_t tmode, u32 *sw_if_indexp)
static_always_inline int ikev2_mngr_process_responder_sas(ikev2_sa_t *sa)
static u8 * format_ikev2_gen_sa_error(u8 *s, va_list *args)
#define ip_addr_version(_a)
#define pool_get(P, E)
Allocate an object E from a pool P (unspecified alignment).
void ipsec_mk_key(ipsec_key_t *key, const u8 *data, u8 len)
u8 * last_sa_init_res_packet_data
format_function_t format_vnet_sw_if_index_name
vnet_api_error_t ikev2_set_profile_ipsec_udp_port(vlib_main_t *vm, u8 *name, u16 port, u8 is_set)
u8 init_response_received
static void ikev2_cleanup_profile_sessions(ikev2_main_t *km, ikev2_profile_t *p)
ikev2_sa_transform_t * ikev2_sa_get_td_for_type(ikev2_sa_proposal_t *p, ikev2_transform_type_t type)
#define vec_reset_length(v)
Reset vector length to zero NULL-pointer tolerant.
#define vlib_worker_thread_barrier_sync(X)
vlib_node_registration_t ip4_lookup_node
(constructor) VLIB_REGISTER_NODE (ip4_lookup_node)
#define clib_memcpy(d, s, n)
static void ikev2_mngr_process_ipsec_sa(ipsec_sa_t *ipsec_sa)
#define vec_add(V, E, N)
Add N elements to end of vector V (no header, unspecified alignment)
ikev2_transform_dh_type_t
static int ikev2_sa_sw_if_match(ikev2_sa_t *sa, u32 sw_if_index)
ikev2_child_sa_t * ikev2_sa_get_child(ikev2_sa_t *sa, u32 spi, ikev2_protocol_id_t prot_id, int by_initiator)
static u32 ikev2_retransmit_resp(ikev2_sa_t *sa, ike_header_t *ike)
static_always_inline void ikev2_rewrite_v6_addrs(ikev2_sa_t *sa, ip6_header_t *ih)
#define static_always_inline
#define IKEV2_PAYLOAD_DELETE
#define pool_foreach(VAR, POOL, BODY)
Iterate through pool.
ikev2_sa_proposal_t * r_proposals
void ikev2_generate_dh(ikev2_sa_t *sa, ikev2_sa_transform_t *t)
#define VLIB_INIT_FUNCTION(x)
static uword vlib_process_get_events(vlib_main_t *vm, uword **data_vector)
Return the first event type which has occurred and a vector of per-event data of that type...
EVP_PKEY * ikev2_load_cert_file(u8 *file)
clib_error_t * ikev2_initiate_sa_init(vlib_main_t *vm, u8 *name)
#define IKEV2_LIVENESS_PERIOD_CHECK
int ipsec_tun_protect_del(u32 sw_if_index, const ip_address_t *nh)
static ikev2_sa_transform_t * ikev2_find_transform_data(ikev2_sa_transform_t *t)
#define vec_new(T, N)
Create new vector of given type and length (unspecified alignment, no header).
EVP_PKEY * ikev2_load_key_file(u8 *file)
clib_error_t * ikev2_set_profile_auth(vlib_main_t *vm, u8 *name, u8 auth_method, u8 *auth_data, u8 data_hex_format)
ipsec_crypto_alg_t encr_type
void ikev2_parse_vendor_payload(ike_payload_header_t *ikep)
#define hash_foreach(key_var, value_var, h, body)
static vlib_node_registration_t ikev2_mngr_process_node
(constructor) VLIB_REGISTER_NODE (ikev2_mngr_process_node)
#define vec_elt_at_index(v, i)
Get vector value at index i checking that i is in bounds.
ipsec_integ_alg_t integ_type
vlib_frame_t * vlib_get_frame_to_node(vlib_main_t *vm, u32 to_node_index)
#define clib_error_return(e, args...)
int ipsec_sa_unlock_id(u32 id)
void ikev2_payload_add_id(ikev2_payload_chain_t *c, ikev2_id_t *id, u8 type)
#define IKEV2_PAYLOAD_NOTIFY
void vl_api_rpc_call_main_thread(void *fp, u8 *data, u32 data_length)
static void ikev2_sa_match_ts(ikev2_sa_t *sa)
static u32 ikev2_retransmit_sa_init_one(ikev2_sa_t *sa, ike_header_t *ike, ip_address_t iaddr, ip_address_t raddr, u32 rlen)
static void ikev2_initiate_delete_ike_sa_internal(vlib_main_t *vm, ikev2_main_per_thread_data_t *tkm, ikev2_sa_t *sa, u8 send_notification)
static void ikev2_send_ike(vlib_main_t *vm, ip_address_t *src, ip_address_t *dst, u32 bi0, u32 len, u16 src_port, u16 dst_port, u32 sw_if_index)
ikev2_sa_proposal_t * i_proposals
static void ikev2_sa_auth(ikev2_sa_t *sa)
#define vec_resize(V, N)
Resize a vector (no header, unspecified alignment) Add N elements to end of given vector V...
static u8 * ikev2_decrypt_sk_payload(ikev2_sa_t *sa, ike_header_t *ike, u8 *payload, u32 rlen, u32 *out_len)
#define ikev2_set_state(sa, v)
#define ikev2_payload_destroy_chain(V)
clib_error_t * ikev2_set_profile_esp_transforms(vlib_main_t *vm, u8 *name, ikev2_transform_encr_type_t crypto_alg, ikev2_transform_integ_type_t integ_alg, u32 crypto_key_size)
static void ikev2_del_sa_init_from_main(u64 *ispi)
ikev2_sa_transform_t * transforms
vlib_punt_hdl_t vlib_punt_client_register(const char *who)
Register a new clinet.
static void ikev2_process_pending_sa_init_one(ikev2_main_t *km, ikev2_sa_t *sa)
#define IKEV2_EXCHANGE_CREATE_CHILD_SA
void ip_address_copy_addr(void *dst, const ip_address_t *src)
ikev2_responder_t responder
vl_api_fib_path_type_t type
int ikev2_set_log_level(ikev2_log_level_t log_level)
static ikev2_profile_t * ikev2_profile_index_by_name(u8 *name)
static vlib_node_registration_t ikev2_node_ip6
(constructor) VLIB_REGISTER_NODE (ikev2_node_ip6)
clib_error_t * ikev2_set_profile_id(vlib_main_t *vm, u8 *name, u8 id_type, u8 *data, int is_local)
u8 * ikev2_calc_prfplus(ikev2_sa_transform_t *tr, u8 *key, u8 *seed, int len)
static u32 ikev2_mk_local_sa_id(u32 sai, u32 ci, u32 ti)
static clib_error_t * ikev2_set_initiator_proposals(vlib_main_t *vm, ikev2_sa_t *sa, ikev2_transforms_set *ts, ikev2_sa_proposal_t **proposals, int is_ike)
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
#define ikev2_elog_exchange(_fmt, _ispi, _rspi, _addr, _v4)
void ikev2_cli_reference(void)
u8 * last_sa_init_req_packet_data
#define IKEV2_PAYLOAD_IDR
static_always_inline u32 ikev2_flip_alternate_sa_bit(u32 id)
#define ikev2_log_debug(...)
VNET_SW_INTERFACE_ADD_DEL_FUNCTION(ikev2_sw_interface_add_del)
uword mhash_set_mem(mhash_t *h, void *key, uword *new_value, uword *old_value)
static __clib_warn_unused_result u32 vlib_buffer_alloc(vlib_main_t *vm, u32 *buffers, u32 n_buffers)
Allocate buffers into supplied array.
ikev2_sa_proposal_t * i_proposals
void vlib_put_frame_to_node(vlib_main_t *vm, u32 to_node_index, vlib_frame_t *f)
#define IKEV2_HDR_FLAG_RESPONSE
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
mhash_t profile_index_by_name
ikev2_sa_transform_t * supported_transforms
static uword ikev2_ip6(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame)
#define pool_put(P, E)
Free an object E in pool P.
#define vec_dup(V)
Return copy of vector (no header, no alignment)
clib_error_t * ikev2_initiate_delete_child_sa(vlib_main_t *vm, u32 ispi)
static_always_inline int ikev2_insert_non_esp_marker(ike_header_t *ike, int len)
static void ikev2_rekey_child_sa_internal(vlib_main_t *vm, ikev2_sa_t *sa, ikev2_child_sa_t *csa)
bool ip_address_is_zero(const ip_address_t *ip)
int ikev2_decrypt_data(ikev2_main_per_thread_data_t *ptd, ikev2_sa_t *sa, ikev2_sa_transform_t *tr_encr, u8 *data, int len, u32 *out_len)
#define vec_del1(v, i)
Delete the element at index I.
static_always_inline void ikev2_set_ts_type(ikev2_ts_t *ts, const ip_address_t *addr)
#define IKEV2_PAYLOAD_FLAG_CRITICAL
static void ikev2_sa_auth_init(ikev2_sa_t *sa)
static_always_inline ikev2_main_per_thread_data_t * ikev2_get_per_thread_data()
static int ikev2_parse_nonce_payload(const void *p, u32 rlen, u8 *nonce)
fib_protocol_t ip_address_to_46(const ip_address_t *addr, ip46_address_t *a)
u32 node_index
Node index.
#define ikev2_natt_active(_sa)
static void ikev2_sa_del(ikev2_profile_t *p, u32 sw_if_index)
static int ikev2_process_informational_req(vlib_main_t *vm, ikev2_sa_t *sa, ike_header_t *ike, u32 len)
clib_error_t * ikev2_set_local_key(vlib_main_t *vm, u8 *file)
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
static void ikev2_process_pending_sa_init(ikev2_main_t *km)
#define IKEV2_EXCHANGE_INFORMATIONAL
void ikev2_payload_add_delete(ikev2_payload_chain_t *c, ikev2_delete_t *d)
static_always_inline u32 vlib_buffer_get_default_data_size(vlib_main_t *vm)
static u32 ikev2_mk_remote_sa_id(u32 sai, u32 ci, u32 ti)
vl_api_ip_port_and_mask_t src_port
#define IKEV2_HDR_FLAG_INITIATOR
static void ikev2_add_tunnel_from_main(ikev2_add_ipsec_tunnel_args_t *a)
static uword ikev2_mngr_process_fn(vlib_main_t *vm, vlib_node_runtime_t *rt, vlib_frame_t *f)
clib_error_t * ikev2_initiate_rekey_child_sa(vlib_main_t *vm, u32 ispi)
vlib_punt_reason_t ipsec_punt_reason[IPSEC_PUNT_N_REASONS]
#define VLIB_REGISTER_NODE(x,...)
#define ikev2_elog_uint(_level, _format, _val)
static_always_inline uword vlib_get_thread_index(void)
static void vlib_get_combined_counter(const vlib_combined_counter_main_t *cm, u32 index, vlib_counter_t *result)
Get the value of a combined counter, never called in the speed path Scrapes the entire set of per-thr...
static_always_inline void vlib_buffer_enqueue_to_next(vlib_main_t *vm, vlib_node_runtime_t *node, u32 *buffers, u16 *nexts, uword count)
static void ikev2_sa_del_child_sa(ikev2_sa_t *sa, ikev2_child_sa_t *child)
ikev2_auth_method_t method
ikev2_transform_encr_type_t
#define clib_memcmp(s1, s2, m1)
sll srl srl sll sra u16x4 i
ikev2_sa_proposal_t * ikev2_parse_sa_payload(ike_payload_header_t *ikep, u32 rlen)
static vlib_punt_hdl_t punt_hdl
#define vec_free(V)
Free vector's memory (no header).
void udp_unregister_dst_port(vlib_main_t *vm, udp_dst_port_t dst_port, u8 is_ip4)
static_always_inline vnet_api_error_t ikev2_register_udp_port(ikev2_profile_t *p, u16 port)
#define IKEV2_LIVENESS_RETRIES
static void ikev2_generate_sa_init_data_and_log(ikev2_sa_t *sa)
enum ipsec_sad_flags_t_ ipsec_sa_flags_t
static void ikev2_initial_contact_cleanup_internal(ikev2_main_per_thread_data_t *ptd, ikev2_sa_t *sa)
static_always_inline u16 ikev2_get_port(ikev2_sa_t *sa)
static_always_inline void ikev2_unregister_udp_port(ikev2_profile_t *p)
static int ikev2_create_tunnel_interface(vlib_main_t *vm, ikev2_sa_t *sa, ikev2_child_sa_t *child, u32 sa_index, u32 child_index, u8 is_rekey)
static_always_inline uword ikev2_node_internal(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame, u8 is_ip4)
static_always_inline void ikev2_set_ip_address(ikev2_sa_t *sa, const void *iaddr, const void *raddr, const int af)
#define ikev2_log_error(...)
ikev2_sa_proposal_t * r_proposals
static u32 ikev2_generate_message(vlib_buffer_t *b, ikev2_sa_t *sa, ike_header_t *ike, void *user, udp_header_t *udp)
vlib_main_t vlib_node_runtime_t * node
static u8 * ikev2_sa_generate_authmsg(ikev2_sa_t *sa, int is_responder)
static void ikev2_calc_child_keys(ikev2_sa_t *sa, ikev2_child_sa_t *child)
static int ikev2_parse_auth_payload(const void *p, u32 rlen, ikev2_auth_t *a)
#define hash_set1(h, key)
enum ikev2_log_level_t_ ikev2_log_level_t
vlib_node_registration_t ip6_lookup_node
(constructor) VLIB_REGISTER_NODE (ip6_lookup_node)
#define hash_create(elts, value_bytes)
void ikev2_payload_add_auth(ikev2_payload_chain_t *c, ikev2_auth_t *auth)
ikev2_protocol_id_t protocol_id
vlib_combined_counter_main_t ipsec_sa_counters
SA packet & bytes counters.
ikev2_notify_t * ikev2_parse_notify_payload(ike_payload_header_t *ikep, u32 rlen)
static_always_inline int ikev2_is_id_equal(ikev2_id_t *i1, ikev2_id_t *i2)
static_always_inline u8 * ikev2_compute_nat_sha1(u64 ispi, u64 rspi, ip_address_t *ia, u16 port)
static_always_inline void ikev2_set_ts_addrs(ikev2_ts_t *ts, const ip_address_t *start, const ip_address_t *end)
static_always_inline void ikev2_rewrite_v4_addrs(ikev2_sa_t *sa, ip4_header_t *ih)
int ikev2_decrypt_aead_data(ikev2_main_per_thread_data_t *ptd, ikev2_sa_t *sa, ikev2_sa_transform_t *tr_encr, u8 *data, int data_len, u8 *aad, u32 aad_len, u8 *tag, u32 *out_len)
static uword * mhash_get(mhash_t *h, const void *key)
#define ike_hdr_is_request(_h)
f64 liveness_period_check
void ikev2_sa_free_proposal_vector(ikev2_sa_proposal_t **v)
#define IKEV2_PAYLOAD_AUTH
#define ikev2_payload_new_chain(V)
static vlib_node_registration_t ikev2_node_ip4
(constructor) VLIB_REGISTER_NODE (ikev2_node_ip4)
ikev2_sa_proposal_t * r_proposal
static void ikev2_process_sa_init_resp(vlib_main_t *vm, ikev2_sa_t *sa, ike_header_t *ike, udp_header_t *udp, u32 len)
void ikev2_complete_dh(ikev2_sa_t *sa, ikev2_sa_transform_t *t)
#define vec_append(v1, v2)
Append v2 after v1.
int ikev2_encrypt_aead_data(ikev2_main_per_thread_data_t *ptd, ikev2_sa_t *sa, ikev2_sa_transform_t *tr_encr, v8 *src, u8 *dst, u8 *aad, u32 aad_len, u8 *tag)
static void vlib_buffer_advance(vlib_buffer_t *b, word l)
Advance current data pointer by the supplied (signed!) amount.
int ip_address_cmp(const ip_address_t *ip1, const ip_address_t *ip2)
ikev2_log_level_t log_level
ikev2_sa_proposal_t * i_proposal
vlib_node_registration_t ipsec4_tun_input_node
(constructor) VLIB_REGISTER_NODE (ipsec4_tun_input_node)
#define IKEV2_PAYLOAD_TSI
enum ip_address_family_t_ ip_address_family_t
u8 * last_res_packet_data
ikev2_delete_t * ikev2_parse_delete_payload(ike_payload_header_t *ikep, u32 rlen)
static char * ikev2_error_strings[]
void vnet_sw_interface_admin_down(vnet_main_t *vnm, u32 sw_if_index)
#define clib_atomic_bool_cmp_and_swap(addr, old, new)
int vlib_punt_register(vlib_punt_hdl_t client, vlib_punt_reason_t reason, const char *node_name)
Register a node to receive particular punted buffers.
static ip46_address_t to_ip46(u32 is_ipv6, u8 *buf)
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
clib_error_t * ikev2_set_profile_responder(vlib_main_t *vm, u8 *name, u32 sw_if_index, ip_address_t addr)
void ikev2_payload_chain_add_padding(ikev2_payload_chain_t *c, int bs)
vlib_main_t vlib_node_runtime_t vlib_frame_t * frame
static int ikev2_is_id_supported(u8 id_type)
VLIB buffer representation.
static int ikev2_parse_ke_payload(const void *p, u32 rlen, ikev2_sa_t *sa, u8 **ke_data)
#define IKEV2_PAYLOAD_IDI
clib_error_t * ikev2_set_profile_ike_transforms(vlib_main_t *vm, u8 *name, ikev2_transform_encr_type_t crypto_alg, ikev2_transform_integ_type_t integ_alg, ikev2_transform_dh_type_t dh_type, u32 crypto_key_size)
#define ikev2_elog_uint_peers(_level, _format, _val, _ip1, _ip2)
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
static u32 ikev2_retransmit_sa_init(ike_header_t *ike, ip_address_t iaddr, ip_address_t raddr, u32 rlen)
#define IKEV2_GENERATE_SA_INIT_OK_ERR_UNSUPP_STR
static int ikev2_check_payload_length(const ike_payload_header_t *ikep, int rlen, u16 *plen)
ikev2_child_sa_t * childs
vlib_log_class_t log_class
#define clib_error_free(e)
int ipip_del_tunnel(u32 sw_if_index)
Linear Congruential Random Number Generator.
#define IKEV2_EXCHANGE_IKE_AUTH
static int ikev2_process_create_child_sa_req(vlib_main_t *vm, ikev2_sa_t *sa, ike_header_t *ike, u32 len)
static int ikev2_ts_cmp(ikev2_ts_t *ts1, ikev2_ts_t *ts2)
clib_error_t * ikev2_init(vlib_main_t *vm)
static u32 random_u32(u32 *seed)
32-bit random number generator
void vlib_worker_thread_barrier_release(vlib_main_t *vm)
void ip_address_copy(ip_address_t *dst, const ip_address_t *src)
#define ike_hdr_is_initiator(_h)
ip4_main_t ip4_main
Global ip4 main structure.
ikev2_ts_t * ikev2_parse_ts_payload(ike_payload_header_t *ikep, u32 rlen)
static vlib_thread_main_t * vlib_get_thread_main()
#define vec_foreach(var, vec)
Vector iterator.
f64 end
end of the time range
static void ikev2_sa_free_all_child_sa(ikev2_child_sa_t **childs)
u16 flags
Copy of main node flags.
void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
static ikev2_sa_proposal_t * ikev2_select_proposal(ikev2_sa_proposal_t *proposals, ikev2_protocol_id_t prot_id)
ikev2_generate_sa_error_t
void udp_register_dst_port(vlib_main_t *vm, udp_dst_port_t dst_port, u32 node_index, u8 is_ip4)
static_always_inline void vlib_get_buffers(vlib_main_t *vm, u32 *bi, vlib_buffer_t **b, int count)
Translate array of buffer indices into buffer pointers.
ikev2_transforms_set esp_ts
#define VLIB_NODE_FLAG_TRACE
void ikev2_crypto_init(ikev2_main_t *km)
static void ikev2_del_tunnel_from_main(ikev2_del_ipsec_tunnel_args_t *a)
#define CLIB_CACHE_LINE_BYTES
u8 * ip_addr_bytes(ip_address_t *ip)
void ikev2_payload_add_ts(ikev2_payload_chain_t *c, ikev2_ts_t *ts, u8 type)
clib_error_t * ikev2_set_profile_ts(vlib_main_t *vm, u8 *name, u8 protocol_id, u16 start_port, u16 end_port, ip_address_t start_addr, ip_address_t end_addr, int is_local)
static void ikev2_sa_free_all_vec(ikev2_sa_t *sa)
static void ikev2_send_informational_request(ikev2_sa_t *sa)
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.
#define IPSEC_UDP_PORT_NONE
static void ikev2_delete_sa(ikev2_main_per_thread_data_t *ptd, ikev2_sa_t *sa)
static u16 ip4_header_checksum(ip4_header_t *i)
u8 * ikev2_calc_sign(EVP_PKEY *pkey, u8 *data)
v8 * ikev2_calc_integr(ikev2_sa_transform_t *tr, v8 *key, u8 *data, int len)
vl_api_interface_index_t sw_if_index
u8 * ikev2_find_ike_notify_payload(ike_header_t *ike, u32 msg_type)
u8 * format_ikev2_id_type(u8 *s, va_list *args)
#define foreach_ikev2_error
void ikev2_disable_dpd(void)
static void ikev2_init_sa(vlib_main_t *vm, ikev2_sa_t *sa)
#define IKEV2_GCM_IV_SIZE
static int ikev2_process_auth_req(vlib_main_t *vm, ikev2_sa_t *sa, ike_header_t *ike, u32 len)
int ipsec_tun_protect_update(u32 sw_if_index, const ip_address_t *nh, u32 sa_out, u32 *sas_in)
void ikev2_payload_add_notify_2(ikev2_payload_chain_t *c, u16 msg_type, u8 *data, ikev2_notify_t *notify)