FD.io VPP  v19.04.2-12-g66b1689
Vector Packet Processing
ikev2_priv.h
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2015 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 #ifndef __included_ikev2_priv_h__
16 #define __included_ikev2_priv_h__
17 
18 #include <vnet/vnet.h>
19 #include <vnet/ip/ip.h>
20 #include <vnet/ethernet/ethernet.h>
21 
22 #include <plugins/ikev2/ikev2.h>
23 
24 #include <vppinfra/hash.h>
25 #include <vppinfra/elog.h>
26 #include <vppinfra/error.h>
27 
28 #include <openssl/rand.h>
29 #include <openssl/dh.h>
30 #include <openssl/hmac.h>
31 #include <openssl/evp.h>
32 
33 #define IKEV2_DEBUG_PAYLOAD 1
34 
35 #if IKEV2_DEBUG_PAYLOAD == 1
36 #define DBG_PLD(my_args...) clib_warning(my_args)
37 #else
38 #define DBG_PLD(my_args...)
39 #endif
40 
41 typedef enum
42 {
52 
53 typedef struct
54 {
56  u8 *data;
57  u8 hex; /* hex encoding of the shared secret */
58  EVP_PKEY *key;
59 } ikev2_auth_t;
60 
61 typedef enum
62 {
66 
67 typedef struct
68 {
70  union
71  {
78  };
84  int nid;
85  const char *dh_p;
86  const char *dh_g;
87  const void *md;
88  const void *cipher;
90 
91 typedef struct
92 {
94  ikev2_protocol_id_t protocol_id:8;
98 
99 typedef struct
100 {
108 } ikev2_ts_t;
109 
110 typedef struct
111 {
115 
116 typedef struct
117 {
123 
124 
125 typedef struct
126 {
129 } ikev2_id_t;
130 
131 typedef struct
132 {
133  /* sa proposals vectors */
136 
137  /* Traffic Selectors */
140 
141  /* keys */
146 
147  /* lifetime data */
152 
153 typedef struct
154 {
156  u32 spi; /*for ESP and AH SPI size is 4, for IKE size is 0 */
158 
159 typedef struct
160 {
168 } ikev2_rekey_t;
169 
170 typedef struct
171 {
177 
178 typedef struct
179 {
182 
196 
197 typedef struct
198 {
208 
209  /* DH data */
215 
216  /* sa proposals vectors */
219 
220  /* keys */
228 
229  /* auth */
232 
233  /* ID */
236 
237  /* pending deletes */
239 
240  /* pending rekeyings */
242 
243  /* packet data */
246 
247  /* retransmit */
250 
254 
256 } ikev2_sa_t;
257 
258 
259 typedef struct
260 {
261  /* pool of IKEv2 Security Associations */
263 
264  /* hash */
267 
268 typedef struct
269 {
270  /* pool of IKEv2 profiles */
272 
273  /* vector of supported transform types */
275 
276  /* hash */
278 
279  /* local private key */
280  EVP_PKEY *pkey;
281 
282  /* convenience */
285 
286  /* pool of IKEv2 Security Associations created in initiator mode */
288  /* hash */
290 
292 
293  /* API message ID base */
295 } ikev2_main_t;
296 
297 extern ikev2_main_t ikev2_main;
298 
302 
303 /* ikev2_crypto.c */
306  int len);
308  int len);
309 v8 *ikev2_decrypt_data (ikev2_sa_t * sa, u8 * data, int len);
310 int ikev2_encrypt_data (ikev2_sa_t * sa, v8 * src, u8 * dst);
313 int ikev2_verify_sign (EVP_PKEY * pkey, u8 * sigbuf, u8 * data);
314 u8 *ikev2_calc_sign (EVP_PKEY * pkey, u8 * data);
315 EVP_PKEY *ikev2_load_cert_file (u8 * file);
316 EVP_PKEY *ikev2_load_key_file (u8 * file);
317 void ikev2_crypto_init (ikev2_main_t * km);
318 
319 /* ikev2_payload.c */
320 typedef struct
321 {
326 
327 #define ikev2_payload_new_chain(V) vec_validate (V, 0)
328 #define ikev2_payload_destroy_chain(V) do { \
329  vec_free((V)->data); \
330  vec_free(V); \
331 } while (0)
332 
334  u8 * data);
336  u8 * data, ikev2_notify_t * notify);
338  ikev2_sa_proposal_t * proposals);
340  u8 * dh_data);
343  u8 type);
346  u8 type);
349 void ikev2_parse_vendor_payload (ike_payload_header_t * ikep);
350 ikev2_sa_proposal_t *ikev2_parse_sa_payload (ike_payload_header_t * ikep);
351 ikev2_ts_t *ikev2_parse_ts_payload (ike_payload_header_t * ikep);
352 ikev2_delete_t *ikev2_parse_delete_payload (ike_payload_header_t * ikep);
353 ikev2_notify_t *ikev2_parse_notify_payload (ike_payload_header_t * ikep);
354 
355 #endif /* __included_ikev2_priv_h__ */
356 
357 
358 /*
359  * fd.io coding-style-patch-verification: ON
360  *
361  * Local Variables:
362  * eval: (c-set-style "gnu")
363  * End:
364  */
ikev2_main_per_thread_data_t * per_thread_data
Definition: ikev2_priv.h:291
u8 * dh_shared_key
Definition: ikev2_priv.h:211
ikev2_sa_t * sais
Definition: ikev2_priv.h:287
Definition: mhash.h:46
u8 * dh_private_key
Definition: ikev2_priv.h:212
ikev2_transform_type_t type
Definition: ikev2_priv.h:69
void ikev2_payload_add_sa(ikev2_payload_chain_t *c, ikev2_sa_proposal_t *proposals)
ikev2_id_t r_id
Definition: ikev2_priv.h:235
ikev2_transforms_set ike_ts
Definition: ikev2_priv.h:189
void ikev2_payload_add_notify(ikev2_payload_chain_t *c, u16 msg_type, u8 *data)
ikev2_transform_integ_type_t
Definition: ikev2.h:267
EVP_PKEY * pkey
Definition: ikev2_priv.h:280
u8 * ikev2_calc_prfplus(ikev2_sa_transform_t *tr, u8 *key, u8 *seed, int len)
Definition: ikev2_crypto.c:286
ikev2_auth_method_t
Definition: ikev2.h:339
u32 last_init_msg_id
Definition: ikev2_priv.h:252
ikev2_sa_transform_t * ikev2_sa_get_td_for_type(ikev2_sa_proposal_t *p, ikev2_transform_type_t type)
Definition: ikev2.c:194
ikev2_transform_dh_type_t dh_type
Definition: ikev2_priv.h:120
ikev2_profile_t * profiles
Definition: ikev2_priv.h:271
unsigned long u64
Definition: types.h:89
u8 v8
Definition: ikev2.h:27
ikev2_state_t state
Definition: ikev2_priv.h:199
ikev2_transform_encr_type_t crypto_alg
Definition: ikev2_priv.h:118
u8 * sk_pi
Definition: ikev2_priv.h:226
ikev2_main_t ikev2_main
Definition: ikev2.c:29
ip4_address_t ip4
Definition: ikev2_priv.h:113
u8 data[128]
Definition: ipsec.api:248
u8 initial_contact
Definition: ikev2_priv.h:201
ikev2_ts_t * tsi
Definition: ikev2_priv.h:166
vl_api_ip4_address_t dst
Definition: ipsec_gre.api:39
void ikev2_payload_add_id(ikev2_payload_chain_t *c, ikev2_id_t *id, u8 type)
ikev2_auth_t r_auth
Definition: ikev2_priv.h:231
u8 * last_sa_init_res_packet_data
Definition: ikev2_priv.h:245
unsigned char u8
Definition: types.h:56
ikev2_profile_t * profile
Definition: ikev2_priv.h:253
ikev2_auth_t auth
Definition: ikev2_priv.h:183
double f64
Definition: types.h:142
ikev2_ts_t * tsr
Definition: ikev2_priv.h:167
ikev2_ts_t * ikev2_parse_ts_payload(ike_payload_header_t *ikep)
ikev2_id_t rem_id
Definition: ikev2_priv.h:185
ikev2_transform_dh_type_t
Definition: ikev2.h:317
EVP_PKEY * ikev2_load_cert_file(u8 *file)
Definition: ikev2_crypto.c:759
void ikev2_payload_add_ts(ikev2_payload_chain_t *c, ikev2_ts_t *ts, u8 type)
u32 last_msg_id
Definition: ikev2_priv.h:248
ikev2_sa_proposal_t * r_proposals
Definition: ikev2_priv.h:135
ip4_address_t start_addr
Definition: ikev2_priv.h:106
u16 selector_len
Definition: ikev2_priv.h:103
EVP_PKEY * ikev2_load_key_file(u8 *file)
Definition: ikev2_crypto.c:789
ikev2_sa_proposal_t * i_proposals
Definition: ikev2_priv.h:217
int ikev2_verify_sign(EVP_PKEY *pkey, u8 *sigbuf, u8 *data)
Definition: ikev2_crypto.c:703
ikev2_transform_integ_type_t integ_alg
Definition: ikev2_priv.h:119
unsigned int u32
Definition: types.h:88
ikev2_auth_t i_auth
Definition: ikev2_priv.h:230
ikev2_id_t loc_id
Definition: ikev2_priv.h:184
ikev2_sa_transform_t * transforms
Definition: ikev2_priv.h:96
u8 * sk_ar
Definition: ikev2_priv.h:223
u8 * r_dh_data
Definition: ikev2_priv.h:214
ikev2_responder_t responder
Definition: ikev2_priv.h:188
u8 * last_sa_init_req_packet_data
Definition: ikev2_priv.h:244
ikev2_ts_t rem_ts
Definition: ikev2_priv.h:187
u8 * i_dh_data
Definition: ikev2_priv.h:213
unsigned short u16
Definition: types.h:57
ikev2_sa_proposal_t * i_proposals
Definition: ikev2_priv.h:134
u8 * r_nonce
Definition: ikev2_priv.h:207
mhash_t profile_index_by_name
Definition: ikev2_priv.h:277
u16 end_port
Definition: ikev2_priv.h:105
ikev2_sa_transform_t * supported_transforms
Definition: ikev2_priv.h:274
ikev2_rekey_t * rekey
Definition: ikev2_priv.h:241
void ikev2_payload_chain_add_padding(ikev2_payload_chain_t *c, int bs)
signed char i8
Definition: types.h:45
ikev2_protocol_id_t
Definition: ikev2.h:107
vl_api_ip4_address_t src
Definition: ipsec_gre.api:38
ip4_address_t end_addr
Definition: ikev2_priv.h:107
ip4_address_t iaddr
Definition: ikev2_priv.h:202
u8 * ikev2_calc_sign(EVP_PKEY *pkey, u8 *data)
Definition: ikev2_crypto.c:728
v8 * ikev2_calc_prf(ikev2_sa_transform_t *tr, v8 *key, v8 *data)
Definition: ikev2_crypto.c:257
u8 * i_nonce
Definition: ikev2_priv.h:206
u8 len
Definition: ip_types.api:49
u8 * sk_ei
Definition: ikev2_priv.h:224
ikev2_delete_t * ikev2_parse_delete_payload(ike_payload_header_t *ikep)
The fine-grained event logger allows lightweight, thread-safe event logging at minimum cost...
svmdb_client_t * c
ikev2_sa_proposal_t * ikev2_parse_sa_payload(ike_payload_header_t *ikep)
ikev2_transform_encr_type_t
Definition: ikev2.h:226
ikev2_delete_t * del
Definition: ikev2_priv.h:238
ikev2_ts_t * tsi
Definition: ikev2_priv.h:138
v8 * ikev2_decrypt_data(ikev2_sa_t *sa, u8 *data, int len)
Definition: ikev2_crypto.c:371
void ikev2_payload_add_nonce(ikev2_payload_chain_t *c, u8 *nonce)
ip4_address_t raddr
Definition: ikev2_priv.h:203
u8 * sk_er
Definition: ikev2_priv.h:225
u8 is_initiator
Definition: ikev2_priv.h:251
const void * cipher
Definition: ikev2_priv.h:88
ikev2_ts_t loc_ts
Definition: ikev2_priv.h:186
ikev2_sa_proposal_t * r_proposals
Definition: ikev2_priv.h:218
u8 protocol_id
Definition: ikev2_priv.h:102
vnet_main_t * vnet_main
Definition: ikev2_priv.h:284
ikev2_id_type_t
Definition: ikev2.h:355
ikev2_notify_t * ikev2_parse_notify_payload(ike_payload_header_t *ikep)
void ikev2_complete_dh(ikev2_sa_t *sa, ikev2_sa_transform_t *t)
Definition: ikev2_crypto.c:601
ikev2_transform_esn_type_t
Definition: ikev2.h:328
ikev2_sa_proposal_t * r_proposal
Definition: ikev2_priv.h:165
u8 * sk_ai
Definition: ikev2_priv.h:222
v8 * ikev2_calc_integr(ikev2_sa_transform_t *tr, v8 *key, u8 *data, int len)
Definition: ikev2_crypto.c:328
u16 dh_group
Definition: ikev2_priv.h:210
ikev2_sa_proposal_t * i_proposal
Definition: ikev2_priv.h:164
const char * dh_p
Definition: ikev2_priv.h:85
EVP_PKEY * key
Definition: ikev2_priv.h:58
ikev2_dh_group_t
Definition: ikev2_priv.h:61
const void * md
Definition: ikev2_priv.h:87
void ikev2_crypto_init(ikev2_main_t *km)
Definition: ikev2_crypto.c:811
u8 * last_res_packet_data
Definition: ikev2_priv.h:249
const char * dh_g
Definition: ikev2_priv.h:86
void ikev2_payload_add_auth(ikev2_payload_chain_t *c, ikev2_auth_t *auth)
u16 start_port
Definition: ikev2_priv.h:104
void ikev2_payload_add_ke(ikev2_payload_chain_t *c, u16 dh_group, u8 *dh_data)
u8 * sk_pr
Definition: ikev2_priv.h:227
u64 uword
Definition: types.h:112
ikev2_id_t i_id
Definition: ikev2_priv.h:234
typedef key
Definition: ipsec.api:244
ikev2_ts_t * tsr
Definition: ikev2_priv.h:139
void ikev2_payload_add_notify_2(ikev2_payload_chain_t *c, u16 msg_type, u8 *data, ikev2_notify_t *notify)
ikev2_child_sa_t * childs
Definition: ikev2_priv.h:255
void ikev2_parse_vendor_payload(ike_payload_header_t *ikep)
int ikev2_encrypt_data(ikev2_sa_t *sa, v8 *src, u8 *dst)
Definition: ikev2_crypto.c:421
void ikev2_payload_add_delete(ikev2_payload_chain_t *c, ikev2_delete_t *d)
ikev2_transform_prf_type_t
Definition: ikev2.h:243
uword * sa_by_ispi
Definition: ikev2_priv.h:289
u8 unsupported_cp
Definition: ikev2_priv.h:200
void ikev2_sa_free_proposal_vector(ikev2_sa_proposal_t **v)
Definition: ikev2.c:227
ikev2_transform_type_t
Definition: ikev2.h:203
ikev2_transforms_set esp_ts
Definition: ikev2_priv.h:190
void ikev2_generate_dh(ikev2_sa_t *sa, ikev2_sa_transform_t *t)
Definition: ikev2_crypto.c:457
vlib_main_t * vlib_main
Definition: ikev2_priv.h:283
ikev2_state_t
Definition: ikev2_priv.h:41