FD.io VPP  v17.07-30-g839fa73
Vector Packet Processing
ikev2_priv.h
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2015 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 #ifndef __included_ikev2_priv_h__
16 #define __included_ikev2_priv_h__
17 
18 #include <vnet/vnet.h>
19 #include <vnet/ip/ip.h>
20 #include <vnet/ethernet/ethernet.h>
21 
22 #include <vnet/ipsec/ikev2.h>
23 
24 #include <vppinfra/hash.h>
25 #include <vppinfra/elog.h>
26 #include <vppinfra/error.h>
27 
28 #include <openssl/rand.h>
29 #include <openssl/dh.h>
30 #include <openssl/hmac.h>
31 #include <openssl/evp.h>
32 
33 #define IKEV2_DEBUG_PAYLOAD 1
34 
35 #if IKEV2_DEBUG_PAYLOAD == 1
36 #define DBG_PLD(my_args...) clib_warning(my_args)
37 #else
38 #define DBG_PLD(my_args...)
39 #endif
40 
41 typedef enum
42 {
52 
53 typedef struct
54 {
56  u8 *data;
57  u8 hex; /* hex encoding of the shared secret */
58  EVP_PKEY *key;
59 } ikev2_auth_t;
60 
61 typedef enum
62 {
66 
67 typedef struct
68 {
70  union
71  {
78  };
84  int nid;
85  const char *dh_p;
86  const char *dh_g;
87  const void *md;
88  const void *cipher;
90 
91 typedef struct
92 {
94  ikev2_protocol_id_t protocol_id:8;
98 
99 typedef struct
100 {
108 } ikev2_ts_t;
109 
110 typedef struct
111 {
115 
116 typedef struct
117 {
123 
124 
125 typedef struct
126 {
129 } ikev2_id_t;
130 
131 typedef struct
132 {
133  /* sa proposals vectors */
136 
137  /* Traffic Selectors */
140 
141  /* keys */
146 
147  /* lifetime data */
152 
153 typedef struct
154 {
156  u32 spi; /*for ESP and AH SPI size is 4, for IKE size is 0 */
158 
159 typedef struct
160 {
168 } ikev2_rekey_t;
169 
170 typedef struct
171 {
177 
178 typedef struct
179 {
182 
196 
197 typedef struct
198 {
208 
209  /* DH data */
215 
216  /* sa proposals vectors */
219 
220  /* keys */
228 
229  /* auth */
232 
233  /* ID */
236 
237  /* pending deletes */
239 
240  /* pending rekeyings */
242 
243  /* packet data */
246 
247  /* retransmit */
250 
254 
256 } ikev2_sa_t;
257 
258 
259 typedef struct
260 {
261  /* pool of IKEv2 Security Associations */
263 
264  /* hash */
267 
268 typedef struct
269 {
270  /* pool of IKEv2 profiles */
272 
273  /* vector of supported transform types */
275 
276  /* hash */
278 
279  /* local private key */
280  EVP_PKEY *pkey;
281 
282  /* convenience */
285 
286  /* pool of IKEv2 Security Associations created in initiator mode */
288  /* hash */
290 
292 
293 } ikev2_main_t;
294 
296 
300 
301 /* ikev2_crypto.c */
302 v8 *ikev2_calc_prf (ikev2_sa_transform_t * tr, v8 * key, v8 * data);
303 u8 *ikev2_calc_prfplus (ikev2_sa_transform_t * tr, u8 * key, u8 * seed,
304  int len);
305 v8 *ikev2_calc_integr (ikev2_sa_transform_t * tr, v8 * key, u8 * data,
306  int len);
307 v8 *ikev2_decrypt_data (ikev2_sa_t * sa, u8 * data, int len);
308 int ikev2_encrypt_data (ikev2_sa_t * sa, v8 * src, u8 * dst);
311 int ikev2_verify_sign (EVP_PKEY * pkey, u8 * sigbuf, u8 * data);
312 u8 *ikev2_calc_sign (EVP_PKEY * pkey, u8 * data);
313 EVP_PKEY *ikev2_load_cert_file (u8 * file);
314 EVP_PKEY *ikev2_load_key_file (u8 * file);
315 void ikev2_crypto_init (ikev2_main_t * km);
316 
317 /* ikev2_payload.c */
318 typedef struct
319 {
324 
325 #define ikev2_payload_new_chain(V) vec_validate (V, 0)
326 #define ikev2_payload_destroy_chain(V) do { \
327  vec_free((V)->data); \
328  vec_free(V); \
329 } while (0)
330 
332  u8 * data);
334  u8 * data, ikev2_notify_t * notify);
336  ikev2_sa_proposal_t * proposals);
338  u8 * dh_data);
341  u8 type);
344  u8 type);
347 void ikev2_parse_vendor_payload (ike_payload_header_t * ikep);
348 ikev2_sa_proposal_t *ikev2_parse_sa_payload (ike_payload_header_t * ikep);
349 ikev2_ts_t *ikev2_parse_ts_payload (ike_payload_header_t * ikep);
350 ikev2_delete_t *ikev2_parse_delete_payload (ike_payload_header_t * ikep);
351 ikev2_notify_t *ikev2_parse_notify_payload (ike_payload_header_t * ikep);
352 
353 #endif /* __included_ikev2_priv_h__ */
354 
355 
356 /*
357  * fd.io coding-style-patch-verification: ON
358  *
359  * Local Variables:
360  * eval: (c-set-style "gnu")
361  * End:
362  */
ikev2_main_per_thread_data_t * per_thread_data
Definition: ikev2_priv.h:291
u8 * dh_shared_key
Definition: ikev2_priv.h:211
ikev2_sa_t * sais
Definition: ikev2_priv.h:287
Definition: mhash.h:46
u8 * dh_private_key
Definition: ikev2_priv.h:212
ikev2_transform_type_t type
Definition: ikev2_priv.h:69
void ikev2_payload_add_sa(ikev2_payload_chain_t *c, ikev2_sa_proposal_t *proposals)
ikev2_id_t r_id
Definition: ikev2_priv.h:235
ikev2_transforms_set ike_ts
Definition: ikev2_priv.h:189
void ikev2_payload_add_notify(ikev2_payload_chain_t *c, u16 msg_type, u8 *data)
ikev2_transform_integ_type_t
Definition: ikev2.h:267
EVP_PKEY * pkey
Definition: ikev2_priv.h:280
u8 * ikev2_calc_prfplus(ikev2_sa_transform_t *tr, u8 *key, u8 *seed, int len)
Definition: ikev2_crypto.c:275
ikev2_auth_method_t
Definition: ikev2.h:339
u32 last_init_msg_id
Definition: ikev2_priv.h:252
ikev2_sa_transform_t * ikev2_sa_get_td_for_type(ikev2_sa_proposal_t *p, ikev2_transform_type_t type)
Definition: ikev2.c:189
ikev2_transform_dh_type_t dh_type
Definition: ikev2_priv.h:120
ikev2_profile_t * profiles
Definition: ikev2_priv.h:271
u8 v8
Definition: ikev2.h:27
ikev2_state_t state
Definition: ikev2_priv.h:199
ikev2_transform_encr_type_t crypto_alg
Definition: ikev2_priv.h:118
u8 * sk_pi
Definition: ikev2_priv.h:226
ikev2_main_t ikev2_main
Definition: ikev2_priv.h:295
ip4_address_t ip4
Definition: ikev2_priv.h:113
u8 initial_contact
Definition: ikev2_priv.h:201
ikev2_ts_t * tsi
Definition: ikev2_priv.h:166
void ikev2_payload_add_id(ikev2_payload_chain_t *c, ikev2_id_t *id, u8 type)
ikev2_auth_t r_auth
Definition: ikev2_priv.h:231
u8 * last_sa_init_res_packet_data
Definition: ikev2_priv.h:245
ikev2_profile_t * profile
Definition: ikev2_priv.h:253
ikev2_auth_t auth
Definition: ikev2_priv.h:183
ikev2_ts_t * tsr
Definition: ikev2_priv.h:167
ikev2_ts_t * ikev2_parse_ts_payload(ike_payload_header_t *ikep)
ikev2_id_t rem_id
Definition: ikev2_priv.h:185
ikev2_transform_dh_type_t
Definition: ikev2.h:317
EVP_PKEY * ikev2_load_cert_file(u8 *file)
Definition: ikev2_crypto.c:612
void ikev2_payload_add_ts(ikev2_payload_chain_t *c, ikev2_ts_t *ts, u8 type)
u32 last_msg_id
Definition: ikev2_priv.h:248
ikev2_sa_proposal_t * r_proposals
Definition: ikev2_priv.h:135
ip4_address_t start_addr
Definition: ikev2_priv.h:106
u16 selector_len
Definition: ikev2_priv.h:103
char i8
Definition: types.h:45
EVP_PKEY * ikev2_load_key_file(u8 *file)
Definition: ikev2_crypto.c:642
unsigned long u64
Definition: types.h:89
ikev2_sa_proposal_t * i_proposals
Definition: ikev2_priv.h:217
int ikev2_verify_sign(EVP_PKEY *pkey, u8 *sigbuf, u8 *data)
Definition: ikev2_crypto.c:583
ikev2_transform_integ_type_t integ_alg
Definition: ikev2_priv.h:119
ikev2_auth_t i_auth
Definition: ikev2_priv.h:230
ikev2_id_t loc_id
Definition: ikev2_priv.h:184
ikev2_sa_transform_t * transforms
Definition: ikev2_priv.h:96
u8 * sk_ar
Definition: ikev2_priv.h:223
u8 * r_dh_data
Definition: ikev2_priv.h:214
ikev2_responder_t responder
Definition: ikev2_priv.h:188
u8 * last_sa_init_req_packet_data
Definition: ikev2_priv.h:244
ikev2_ts_t rem_ts
Definition: ikev2_priv.h:187
u8 * i_dh_data
Definition: ikev2_priv.h:213
#define v
Definition: acl.c:320
ikev2_sa_proposal_t * i_proposals
Definition: ikev2_priv.h:134
u8 * r_nonce
Definition: ikev2_priv.h:207
mhash_t profile_index_by_name
Definition: ikev2_priv.h:277
u16 end_port
Definition: ikev2_priv.h:105
ikev2_sa_transform_t * supported_transforms
Definition: ikev2_priv.h:274
ikev2_rekey_t * rekey
Definition: ikev2_priv.h:241
void ikev2_payload_chain_add_padding(ikev2_payload_chain_t *c, int bs)
ikev2_protocol_id_t
Definition: ikev2.h:107
ip4_address_t end_addr
Definition: ikev2_priv.h:107
ip4_address_t iaddr
Definition: ikev2_priv.h:202
u8 * ikev2_calc_sign(EVP_PKEY *pkey, u8 *data)
Definition: ikev2_crypto.c:594
v8 * ikev2_calc_prf(ikev2_sa_transform_t *tr, v8 *key, v8 *data)
Definition: ikev2_crypto.c:256
u8 * i_nonce
Definition: ikev2_priv.h:206
u8 * sk_ei
Definition: ikev2_priv.h:224
ikev2_delete_t * ikev2_parse_delete_payload(ike_payload_header_t *ikep)
The fine-grained event logger allows lightweight, thread-safe event logging at minimum cost...
svmdb_client_t * c
ikev2_sa_proposal_t * ikev2_parse_sa_payload(ike_payload_header_t *ikep)
ikev2_transform_encr_type_t
Definition: ikev2.h:226
ikev2_delete_t * del
Definition: ikev2_priv.h:238
ikev2_ts_t * tsi
Definition: ikev2_priv.h:138
v8 * ikev2_decrypt_data(ikev2_sa_t *sa, u8 *data, int len)
Definition: ikev2_crypto.c:340
void ikev2_payload_add_nonce(ikev2_payload_chain_t *c, u8 *nonce)
ip4_address_t raddr
Definition: ikev2_priv.h:203
u8 * sk_er
Definition: ikev2_priv.h:225
u8 is_initiator
Definition: ikev2_priv.h:251
const void * cipher
Definition: ikev2_priv.h:88
ikev2_ts_t loc_ts
Definition: ikev2_priv.h:186
ikev2_sa_proposal_t * r_proposals
Definition: ikev2_priv.h:218
u8 protocol_id
Definition: ikev2_priv.h:102
unsigned int u32
Definition: types.h:88
vnet_main_t * vnet_main
Definition: ikev2_priv.h:284
ikev2_id_type_t
Definition: ikev2.h:355
ikev2_notify_t * ikev2_parse_notify_payload(ike_payload_header_t *ikep)
void ikev2_complete_dh(ikev2_sa_t *sa, ikev2_sa_transform_t *t)
Definition: ikev2_crypto.c:509
ikev2_transform_esn_type_t
Definition: ikev2.h:328
ikev2_sa_proposal_t * r_proposal
Definition: ikev2_priv.h:165
u8 * sk_ai
Definition: ikev2_priv.h:222
v8 * ikev2_calc_integr(ikev2_sa_transform_t *tr, v8 *key, u8 *data, int len)
Definition: ikev2_crypto.c:317
u16 dh_group
Definition: ikev2_priv.h:210
ikev2_sa_proposal_t * i_proposal
Definition: ikev2_priv.h:164
const char * dh_p
Definition: ikev2_priv.h:85
EVP_PKEY * key
Definition: ikev2_priv.h:58
ikev2_dh_group_t
Definition: ikev2_priv.h:61
u64 uword
Definition: types.h:112
const void * md
Definition: ikev2_priv.h:87
void ikev2_crypto_init(ikev2_main_t *km)
Definition: ikev2_crypto.c:664
u8 * last_res_packet_data
Definition: ikev2_priv.h:249
const char * dh_g
Definition: ikev2_priv.h:86
unsigned short u16
Definition: types.h:57
void ikev2_payload_add_auth(ikev2_payload_chain_t *c, ikev2_auth_t *auth)
double f64
Definition: types.h:142
u16 start_port
Definition: ikev2_priv.h:104
void ikev2_payload_add_ke(ikev2_payload_chain_t *c, u16 dh_group, u8 *dh_data)
unsigned char u8
Definition: types.h:56
u8 * sk_pr
Definition: ikev2_priv.h:227
ikev2_id_t i_id
Definition: ikev2_priv.h:234
ikev2_ts_t * tsr
Definition: ikev2_priv.h:139
void ikev2_payload_add_notify_2(ikev2_payload_chain_t *c, u16 msg_type, u8 *data, ikev2_notify_t *notify)
ikev2_child_sa_t * childs
Definition: ikev2_priv.h:255
void ikev2_parse_vendor_payload(ike_payload_header_t *ikep)
int ikev2_encrypt_data(ikev2_sa_t *sa, v8 *src, u8 *dst)
Definition: ikev2_crypto.c:373
void ikev2_payload_add_delete(ikev2_payload_chain_t *c, ikev2_delete_t *d)
ikev2_transform_prf_type_t
Definition: ikev2.h:243
uword * sa_by_ispi
Definition: ikev2_priv.h:289
u8 unsupported_cp
Definition: ikev2_priv.h:200
void ikev2_sa_free_proposal_vector(ikev2_sa_proposal_t **v)
Definition: ikev2.c:222
ikev2_transform_type_t
Definition: ikev2.h:203
ikev2_transforms_set esp_ts
Definition: ikev2_priv.h:190
void ikev2_generate_dh(ikev2_sa_t *sa, ikev2_sa_transform_t *t)
Definition: ikev2_crypto.c:401
vlib_main_t * vlib_main
Definition: ikev2_priv.h:283
ikev2_state_t
Definition: ikev2_priv.h:41