FD.io VPP  v21.01.1
Vector Packet Processing
ikev2_priv.h
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2015 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 #ifndef __included_ikev2_priv_h__
16 #define __included_ikev2_priv_h__
17 
18 #include <vnet/vnet.h>
19 #include <vnet/ip/ip.h>
20 #include <vnet/ethernet/ethernet.h>
21 
22 #include <plugins/ikev2/ikev2.h>
23 
24 #include <vppinfra/hash.h>
25 #include <vppinfra/elog.h>
26 #include <vppinfra/error.h>
27 
28 #include <openssl/rand.h>
29 #include <openssl/dh.h>
30 #include <openssl/hmac.h>
31 #include <openssl/evp.h>
32 
33 #define foreach_ikev2_log_level \
34  _(0x00, LOG_NONE) \
35  _(0x01, LOG_ERROR) \
36  _(0x02, LOG_WARNING) \
37  _(0x03, LOG_INFO) \
38  _(0x04, LOG_DEBUG) \
39  _(0x05, LOG_DETAIL) \
40 
41 
42 typedef enum ikev2_log_level_t_
43 {
44 #define _(n,f) IKEV2_##f = n,
46 #undef _
49 
50 /* dataplane logging */
51 #define _ikev2_elog(_level, _msg) \
52 do { \
53  ikev2_main_t *km = &ikev2_main; \
54  if (PREDICT_FALSE (km->log_level >= _level)) \
55  { \
56  ELOG_TYPE_DECLARE (e) = \
57  { \
58  .format = "ikev2 " _msg, \
59  .format_args = "", \
60  }; \
61  ELOG_DATA (&vlib_global_main.elog_main, e); \
62  } \
63 } while (0)
64 
65 #define ikev2_elog_sa_state(_format, _ispi) \
66 do { \
67  ikev2_main_t *km = &ikev2_main; \
68  if (PREDICT_FALSE (km->log_level >= IKEV2_LOG_DEBUG)) \
69  { \
70  ELOG_TYPE_DECLARE (e) = \
71  { \
72  .format = "ikev2: " _format, \
73  .format_args = "i8", \
74  }; \
75  CLIB_PACKED(struct \
76  { \
77  u64 ispi; \
78  }) *ed; \
79  ed = ELOG_DATA (&vlib_global_main.elog_main, e); \
80  ed->ispi = _ispi; \
81  } \
82 } while (0) \
83 
84 #define ikev2_elog_exchange_internal(_format, _ispi, _rspi, _addr) \
85 do { \
86  ikev2_main_t *km = &ikev2_main; \
87  if (PREDICT_FALSE (km->log_level >= IKEV2_LOG_DEBUG)) \
88  { \
89  ELOG_TYPE_DECLARE (e) = \
90  { \
91  .format = "ikev2: " _format, \
92  .format_args = "i8i8i1i1i1i1", \
93  }; \
94  CLIB_PACKED(struct \
95  { \
96  u64 ispi; \
97  u64 rspi; \
98  u8 oct1; \
99  u8 oct2; \
100  u8 oct3; \
101  u8 oct4; \
102  }) *ed; \
103  ed = ELOG_DATA (&vlib_global_main.elog_main, e); \
104  ed->ispi = _ispi; \
105  ed->rspi = _rspi; \
106  ed->oct4 = (_addr) >> 24; \
107  ed->oct3 = (_addr) >> 16; \
108  ed->oct2 = (_addr) >> 8; \
109  ed->oct1 = (_addr); \
110  } \
111 } while (0) \
112 
113 #define IKE_ELOG_IP4_FMT "%d.%d.%d.%d"
114 #define IKE_ELOG_IP6_FMT "[v6]:%x%x:%x%x"
115 
116 #define ikev2_elog_exchange(_fmt, _ispi, _rspi, _addr, _v4) \
117 do { \
118  if (_v4) \
119  ikev2_elog_exchange_internal (_fmt IKE_ELOG_IP4_FMT, _ispi, _rspi, _addr);\
120  else \
121  ikev2_elog_exchange_internal (_fmt IKE_ELOG_IP6_FMT, _ispi, _rspi, _addr);\
122 } while (0)
123 
124 #define ikev2_elog_uint(_level, _format, _val) \
125 do { \
126  ikev2_main_t *km = &ikev2_main; \
127  if (PREDICT_FALSE (km->log_level >= _level)) \
128  { \
129  ELOG_TYPE_DECLARE (e) = \
130  { \
131  .format = "ikev2: " _format, \
132  .format_args = "i8", \
133  }; \
134  CLIB_PACKED(struct \
135  { \
136  u64 val; \
137  }) *ed; \
138  ed = ELOG_DATA (&vlib_global_main.elog_main, e); \
139  ed->val = _val; \
140  } \
141 } while (0)
142 
143 #define ikev2_elog_uint_peers(_level, _format, _val, _ip1, _ip2) \
144 do { \
145  ikev2_main_t *km = &ikev2_main; \
146  if (PREDICT_FALSE (km->log_level >= _level)) \
147  { \
148  ELOG_TYPE_DECLARE (e) = \
149  { \
150  .format = "ikev2: " _format, \
151  .format_args = "i8i1i1i1i1i1i1i1i1", \
152  }; \
153  CLIB_PACKED(struct { \
154  u64 val; \
155  u8 i11; u8 i12; u8 i13; u8 i14; \
156  u8 i21; u8 i22; u8 i23; u8 i24; }) *ed; \
157  ed = ELOG_DATA (&vlib_global_main.elog_main, e); \
158  ed->val = _val; \
159  ed->i14 = (_ip1) >> 24; \
160  ed->i13 = (_ip1) >> 16; \
161  ed->i12 = (_ip1) >> 8; \
162  ed->i11 = (_ip1); \
163  ed->i24 = (_ip2) >> 24; \
164  ed->i23 = (_ip2) >> 16; \
165  ed->i22 = (_ip2) >> 8; \
166  ed->i21 = (_ip2); \
167  } \
168 } while (0)
169 
170 #define ikev2_elog_error(_msg) \
171  _ikev2_elog(IKEV2_LOG_ERROR, "[error] " _msg)
172 #define ikev2_elog_warning(_msg) \
173  _ikev2_elog(IKEV2_LOG_WARNING, "[warning] " _msg)
174 #define ikev2_elog_debug(_msg) \
175  _ikev2_elog(IKEV2_LOG_DEBUG, "[debug] " _msg)
176 #define ikev2_elog_detail(_msg) \
177  _ikev2_elog(IKEV2_LOG_DETAIL, "[detail] " _msg)
178 
179 /* logging for main thread */
180 #define ikev2_log_error(...) \
181  vlib_log(VLIB_LOG_LEVEL_ERR, ikev2_main.log_class, __VA_ARGS__)
182 #define ikev2_log_warning(...) \
183  vlib_log(VLIB_LOG_LEVEL_WARNING, ikev2_main.log_class, __VA_ARGS__)
184 #define ikev2_log_debug(...) \
185  vlib_log(VLIB_LOG_LEVEL_DEBUG, ikev2_main.log_class, __VA_ARGS__)
186 
187 typedef enum
188 {
197 } ikev2_state_t;
198 
199 typedef struct
200 {
203  u8 hex; /* hex encoding of the shared secret */
204  EVP_PKEY *key;
205 } ikev2_auth_t;
206 
207 typedef enum
208 {
212 
213 typedef struct
214 {
216  union
217  {
224  };
230  int nid;
231  const char *dh_p;
232  const char *dh_g;
233  const void *md;
234  const void *cipher;
236 
237 typedef struct
238 {
244 
245 typedef struct
246 {
254 } ikev2_ts_t;
255 
256 typedef struct
257 {
261 
262 typedef struct
263 {
269 
270 
271 typedef struct
272 {
275 } ikev2_id_t;
276 
277 typedef struct
278 {
279  /* sa proposals vectors */
282 
283  /* Traffic Selectors */
286 
287  /* keys */
294 
295  /* installed data */
298 
299  /* lifetime data */
304 
305 typedef struct
306 {
308  u32 spi; /*for ESP and AH SPI size is 4, for IKE size is 0 */
310 
311 typedef struct
312 {
320 } ikev2_rekey_t;
321 
322 typedef struct
323 {
329 
330 typedef struct
331 {
333 
347 
352 
353 typedef enum
354 {
355  /* SA will switch to port 4500 when NAT is detected.
356  * This is the default. */
358 
359  /* Do nothing when NAT is detected */
361 
362  /* NAT was detected and port switched to 4500 */
365 
366 #define ikev2_natt_active(_sa) ((_sa)->natt_state == IKEV2_NATT_ACTIVE)
367 
368 typedef struct
369 {
379 
380  /* DH data */
386 
387  /* sa proposals vectors */
390 
391  /* keys */
399 
400  /* auth */
403 
404  /* ID */
407 
408  /* pending deletes */
410 
411  /* pending rekeyings */
413 
414  /* packet data */
417 
418  /* retransmit */
419  /* message id expected in the request from the other peer */
422 
424  /* last message id that was used for an initiated request */
431 
437 
439 
442 
445 
446  /* is NAT traversal mode */
449 } ikev2_sa_t;
450 
451 
452 typedef struct
453 {
454  CLIB_CACHE_LINE_ALIGN_MARK (cacheline0);
455 
456  /* pool of IKEv2 Security Associations */
458 
459  /* hash */
461 
462  EVP_CIPHER_CTX *evp_ctx;
463  HMAC_CTX *hmac_ctx;
464 #if OPENSSL_VERSION_NUMBER < 0x10100000L
465  HMAC_CTX _hmac_ctx;
466  EVP_CIPHER_CTX _evp_ctx;
467 #endif
469 
470 typedef struct
471 {
472  /* pool of IKEv2 profiles */
474 
475  /* vector of supported transform types */
477 
478  /* hash */
480 
481  /* local private key */
482  EVP_PKEY *pkey;
483 
484  /* convenience */
487 
488  /* pool of IKEv2 Security Associations created in initiator mode */
490  /* hash */
492 
494 
495  /* interface indices managed by IKE */
497 
498  /* API message ID base */
500 
501  /* log class used for main thread */
503 
504  /* logging level */
506 
507  /* custom ipsec-over-udp ports managed by ike */
509 
510  /* how often a liveness check will be performed */
512 
513  /* max number of retries before considering peer dead */
515 
516  /* dead peer detection */
518 } ikev2_main_t;
519 
520 extern ikev2_main_t ikev2_main;
521 
525 
526 /* ikev2_crypto.c */
529  int len);
531  int len);
533  ikev2_sa_transform_t * tr_encr, u8 * data, int len,
534  u32 * out_len);
536  ikev2_sa_transform_t * tr_encr, v8 * src, u8 * dst);
538  ikev2_sa_t * sa, ikev2_sa_transform_t * tr_encr,
539  v8 * src, u8 * dst, u8 * aad,
540  u32 aad_len, u8 * tag);
542  ikev2_sa_t * sa, ikev2_sa_transform_t * tr_encr,
543  u8 * data, int data_len, u8 * aad, u32 aad_len,
544  u8 * tag, u32 * out_len);
547 int ikev2_verify_sign (EVP_PKEY * pkey, u8 * sigbuf, u8 * data);
548 u8 *ikev2_calc_sign (EVP_PKEY * pkey, u8 * data);
549 EVP_PKEY *ikev2_load_cert_file (u8 * file);
550 EVP_PKEY *ikev2_load_key_file (u8 * file);
551 void ikev2_crypto_init (ikev2_main_t * km);
552 
553 /* ikev2_payload.c */
554 typedef struct
555 {
560 
561 #define ikev2_payload_new_chain(V) vec_validate (V, 0)
562 #define ikev2_payload_destroy_chain(V) do { \
563  vec_free((V)->data); \
564  vec_free(V); \
565 } while (0)
566 
568  u8 * data);
570  u8 * data, ikev2_notify_t * notify);
572  ikev2_sa_proposal_t * proposals);
574  u8 * dh_data);
577  u8 type);
580  u8 type);
583 void ikev2_parse_vendor_payload (ike_payload_header_t * ikep);
584 ikev2_sa_proposal_t *ikev2_parse_sa_payload (ike_payload_header_t * ikep,
585  u32 rlen);
586 ikev2_ts_t *ikev2_parse_ts_payload (ike_payload_header_t * ikep, u32 rlen);
587 ikev2_delete_t *ikev2_parse_delete_payload (ike_payload_header_t * ikep,
588  u32 rlen);
589 ikev2_notify_t *ikev2_parse_notify_payload (ike_payload_header_t * ikep,
590  u32 rlen);
592 u8 *ikev2_find_ike_notify_payload (ike_header_t * ike, u32 msg_type);
593 void ikev2_disable_dpd (void);
595 
598 {
599  u32 thread_index = vlib_get_thread_index ();
600  return vec_elt_at_index (ikev2_main.per_thread_data, thread_index);
601 }
602 #endif /* __included_ikev2_priv_h__ */
603 
604 
605 /*
606  * fd.io coding-style-patch-verification: ON
607  *
608  * Local Variables:
609  * eval: (c-set-style "gnu")
610  * End:
611  */
ikev2_main_per_thread_data_t * per_thread_data
Definition: ikev2_priv.h:493
u32 liveness_period
Definition: ikev2_priv.h:511
u8 * dh_shared_key
Definition: ikev2_priv.h:382
ikev2_sa_t * sais
Definition: ikev2_priv.h:489
Definition: mhash.h:46
u8 * dh_private_key
Definition: ikev2_priv.h:383
ikev2_transform_type_t type
Definition: ikev2_priv.h:215
void ikev2_payload_add_sa(ikev2_payload_chain_t *c, ikev2_sa_proposal_t *proposals)
int ikev2_decrypt_aead_data(ikev2_main_per_thread_data_t *ptd, ikev2_sa_t *sa, ikev2_sa_transform_t *tr_encr, u8 *data, int data_len, u8 *aad, u32 aad_len, u8 *tag, u32 *out_len)
Definition: ikev2_crypto.c:351
#define CLIB_CACHE_LINE_ALIGN_MARK(mark)
Definition: cache.h:60
ikev2_id_t r_id
Definition: ikev2_priv.h:406
ikev2_id_type_t type
Definition: ikev2_priv.h:273
ikev2_transforms_set ike_ts
Definition: ikev2_priv.h:340
ip_address_t end_addr
Definition: ikev2_priv.h:253
u32 old_remote_id
Definition: ikev2_priv.h:434
void ikev2_payload_add_notify(ikev2_payload_chain_t *c, u16 msg_type, u8 *data)
ikev2_transform_integ_type_t
Definition: ikev2.h:282
u16 dst_port
Definition: ikev2_priv.h:443
ikev2_natt_state_t natt_state
Definition: ikev2_priv.h:447
ikev2_ts_t * ikev2_parse_ts_payload(ike_payload_header_t *ikep, u32 rlen)
EVP_PKEY * pkey
Definition: ikev2_priv.h:482
ikev2_traffic_selector_type_t ts_type
Definition: ikev2_priv.h:247
int ikev2_encrypt_aead_data(ikev2_main_per_thread_data_t *ptd, ikev2_sa_t *sa, ikev2_sa_transform_t *tr_encr, v8 *src, u8 *dst, u8 *aad, u32 aad_len, u8 *tag)
Definition: ikev2_crypto.c:422
u8 * ikev2_calc_prfplus(ikev2_sa_transform_t *tr, u8 *key, u8 *seed, int len)
Definition: ikev2_crypto.c:272
ikev2_auth_method_t
Definition: ikev2.h:354
u32 last_init_msg_id
Definition: ikev2_priv.h:425
ikev2_notify_t * ikev2_parse_notify_payload(ike_payload_header_t *ikep, u32 rlen)
ikev2_sa_transform_t * ikev2_sa_get_td_for_type(ikev2_sa_proposal_t *p, ikev2_transform_type_t type)
Definition: ikev2.c:251
ikev2_transform_dh_type_t dh_type
Definition: ikev2_priv.h:266
vl_api_ikev2_auth_t auth
Definition: ikev2_types.api:88
ikev2_profile_t * profiles
Definition: ikev2_priv.h:473
unsigned long u64
Definition: types.h:89
u8 v8
Definition: ikev2.h:33
ikev2_natt_state_t
Definition: ikev2_priv.h:353
u32 current_remote_id_mask
Definition: ikev2_priv.h:433
ikev2_traffic_selector_type_t
Definition: ikev2.h:377
ip_address_t addr
Definition: ikev2_priv.h:259
ikev2_transform_esn_type_t esn_type
Definition: ikev2_priv.h:223
ikev2_state_t state
Definition: ikev2_priv.h:370
vl_api_address_t src
Definition: gre.api:54
ikev2_transform_encr_type_t crypto_alg
Definition: ikev2_priv.h:264
u8 * sk_pi
Definition: ikev2_priv.h:397
ikev2_main_t ikev2_main
Definition: ikev2.c:35
u8 initial_contact
Definition: ikev2_priv.h:372
ikev2_ts_t * tsi
Definition: ikev2_priv.h:318
ip_address_t iaddr
Definition: ikev2_priv.h:373
void ikev2_payload_add_id(ikev2_payload_chain_t *c, ikev2_id_t *id, u8 type)
ikev2_auth_t r_auth
Definition: ikev2_priv.h:402
ikev2_delete_t * ikev2_parse_delete_payload(ike_payload_header_t *ikep, u32 rlen)
u8 dh_group
Definition: ikev2_types.api:60
u16 ipsec_over_udp_port
Definition: ikev2_priv.h:346
u8 * last_sa_init_res_packet_data
Definition: ikev2_priv.h:416
unsigned char u8
Definition: types.h:56
u8 init_response_received
Definition: ikev2_priv.h:436
u8 data[128]
Definition: ipsec_types.api:90
ikev2_auth_t auth
Definition: ikev2_priv.h:334
double f64
Definition: types.h:142
ikev2_ts_t * tsr
Definition: ikev2_priv.h:319
ikev2_id_t rem_id
Definition: ikev2_priv.h:336
ikev2_transform_dh_type_t
Definition: ikev2.h:332
log_level
Definition: vpe_types.api:33
EVP_PKEY * ikev2_load_cert_file(u8 *file)
Definition: ikev2_crypto.c:816
void ikev2_payload_add_ts(ikev2_payload_chain_t *c, ikev2_ts_t *ts, u8 type)
u32 vlib_log_class_t
Definition: vlib.h:51
u32 last_msg_id
Definition: ikev2_priv.h:420
#define static_always_inline
Definition: clib.h:109
ikev2_sa_proposal_t * r_proposals
Definition: ikev2_priv.h:281
u32 liveness_max_retries
Definition: ikev2_priv.h:514
ikev2_sa_proposal_t * ikev2_parse_sa_payload(ike_payload_header_t *ikep, u32 rlen)
u16 selector_len
Definition: ikev2_priv.h:249
#define vec_elt_at_index(v, i)
Get vector value at index i checking that i is in bounds.
EVP_PKEY * ikev2_load_key_file(u8 *file)
Definition: ikev2_crypto.c:847
ikev2_sa_proposal_t * i_proposals
Definition: ikev2_priv.h:388
uword * sw_if_indices
Definition: ikev2_priv.h:496
int ikev2_verify_sign(EVP_PKEY *pkey, u8 *sigbuf, u8 *data)
Definition: ikev2_crypto.c:753
ikev2_transform_integ_type_t integ_alg
Definition: ikev2_priv.h:265
unsigned int u32
Definition: types.h:88
ikev2_auth_t i_auth
Definition: ikev2_priv.h:401
ikev2_id_t loc_id
Definition: ikev2_priv.h:335
ikev2_sa_transform_t * transforms
Definition: ikev2_priv.h:242
u8 * sk_ar
Definition: ikev2_priv.h:394
u8 * r_dh_data
Definition: ikev2_priv.h:385
ikev2_responder_t responder
Definition: ikev2_priv.h:339
vl_api_fib_path_type_t type
Definition: fib_types.api:123
u8 * last_sa_init_req_packet_data
Definition: ikev2_priv.h:415
int ikev2_set_log_level(ikev2_log_level_t log_level)
Definition: ikev2.c:4785
ikev2_ts_t rem_ts
Definition: ikev2_priv.h:338
u8 * i_dh_data
Definition: ikev2_priv.h:384
unsigned short u16
Definition: types.h:57
ikev2_sa_proposal_t * i_proposals
Definition: ikev2_priv.h:280
u8 data_len
Definition: ikev2_types.api:24
EVP_CIPHER_CTX * evp_ctx
Definition: ikev2_priv.h:462
u8 * r_nonce
Definition: ikev2_priv.h:378
mhash_t profile_index_by_name
Definition: ikev2_priv.h:479
u16 end_port
Definition: ikev2_priv.h:251
ikev2_sa_transform_t * supported_transforms
Definition: ikev2_priv.h:476
ikev2_rekey_t * rekey
Definition: ikev2_priv.h:412
void ikev2_payload_chain_add_padding(ikev2_payload_chain_t *c, int bs)
static_always_inline ikev2_main_per_thread_data_t * ikev2_get_per_thread_data()
Definition: ikev2_priv.h:597
signed char i8
Definition: types.h:45
ikev2_protocol_id_t
Definition: ikev2.h:121
vl_api_address_t dst
Definition: gre.api:55
u8 * ikev2_calc_sign(EVP_PKEY *pkey, u8 *data)
Definition: ikev2_crypto.c:782
v8 * ikev2_calc_prf(ikev2_sa_transform_t *tr, v8 *key, v8 *data)
Definition: ikev2_crypto.c:255
u8 * i_nonce
Definition: ikev2_priv.h:377
u8 len
Definition: ip_types.api:103
u8 * sk_ei
Definition: ikev2_priv.h:395
u8 old_remote_id_present
Definition: ikev2_priv.h:435
The fine-grained event logger allows lightweight, thread-safe event logging at minimum cost...
u32 sw_if_index
Definition: ikev2_priv.h:444
ip_address_t raddr
Definition: ikev2_priv.h:374
ikev2_transform_dh_type_t dh_type
Definition: ikev2_priv.h:222
svmdb_client_t * c
static_always_inline uword vlib_get_thread_index(void)
Definition: threads.h:219
ikev2_auth_method_t method
Definition: ikev2_priv.h:201
ikev2_transform_encr_type_t
Definition: ikev2.h:241
ikev2_delete_t * del
Definition: ikev2_priv.h:409
ikev2_ts_t * tsi
Definition: ikev2_priv.h:284
void ikev2_payload_add_nonce(ikev2_payload_chain_t *c, u8 *nonce)
uword * udp_ports
Definition: ikev2_priv.h:508
u8 * sk_er
Definition: ikev2_priv.h:396
u8 is_initiator
Definition: ikev2_priv.h:423
const void * cipher
Definition: ikev2_priv.h:234
string name[64]
Definition: ip.api:44
ikev2_ts_t loc_ts
Definition: ikev2_priv.h:337
ikev2_sa_proposal_t * r_proposals
Definition: ikev2_priv.h:389
f64 old_id_expiration
Definition: ikev2_priv.h:432
enum ikev2_log_level_t_ ikev2_log_level_t
ikev2_protocol_id_t protocol_id
Definition: ikev2_priv.h:240
u8 protocol_id
Definition: ikev2_priv.h:248
vnet_main_t * vnet_main
Definition: ikev2_priv.h:486
ikev2_id_type_t
Definition: ikev2.h:370
f64 liveness_period_check
Definition: ikev2_priv.h:441
void ikev2_complete_dh(ikev2_sa_t *sa, ikev2_sa_transform_t *t)
Definition: ikev2_crypto.c:646
ikev2_transform_esn_type_t
Definition: ikev2.h:343
ikev2_sa_proposal_t * r_proposal
Definition: ikev2_priv.h:317
u8 * sk_ai
Definition: ikev2_priv.h:393
v8 * ikev2_calc_integr(ikev2_sa_transform_t *tr, v8 *key, u8 *data, int len)
Definition: ikev2_crypto.c:314
u16 dh_group
Definition: ikev2_priv.h:381
u8 is_tun_itf_set
Definition: ikev2_priv.h:427
ikev2_log_level_t log_level
Definition: ikev2_priv.h:505
ikev2_sa_proposal_t * i_proposal
Definition: ikev2_priv.h:316
const char * dh_p
Definition: ikev2_priv.h:231
EVP_PKEY * key
Definition: ikev2_priv.h:204
u8 liveness_retries
Definition: ikev2_priv.h:440
ikev2_dh_group_t
Definition: ikev2_priv.h:207
const void * md
Definition: ikev2_priv.h:233
void ikev2_crypto_init(ikev2_main_t *km)
Definition: ikev2_crypto.c:869
typedef key
Definition: ipsec_types.api:86
int ikev2_decrypt_data(ikev2_main_per_thread_data_t *ptd, ikev2_sa_t *sa, ikev2_sa_transform_t *tr_encr, u8 *data, int len, u32 *out_len)
Definition: ikev2_crypto.c:389
ikev2_transform_encr_type_t encr_type
Definition: ikev2_priv.h:219
u8 * last_res_packet_data
Definition: ikev2_priv.h:421
const char * dh_g
Definition: ikev2_priv.h:232
ikev2_transform_integ_type_t integ_type
Definition: ikev2_priv.h:221
u8 * ikev2_find_ike_notify_payload(ike_header_t *ike, u32 msg_type)
void ikev2_payload_add_auth(ikev2_payload_chain_t *c, ikev2_auth_t *auth)
u16 start_port
Definition: ikev2_priv.h:250
void ikev2_payload_add_ke(ikev2_payload_chain_t *c, u16 dh_group, u8 *dh_data)
u8 * sk_pr
Definition: ikev2_priv.h:398
u64 uword
Definition: types.h:112
ikev2_id_t i_id
Definition: ikev2_priv.h:405
ikev2_ts_t * tsr
Definition: ikev2_priv.h:285
void ikev2_payload_add_notify_2(ikev2_payload_chain_t *c, u16 msg_type, u8 *data, ikev2_notify_t *notify)
ikev2_child_sa_t * childs
Definition: ikev2_priv.h:438
vlib_log_class_t log_class
Definition: ikev2_priv.h:502
ikev2_transform_prf_type_t prf_type
Definition: ikev2_priv.h:220
void ikev2_parse_vendor_payload(ike_payload_header_t *ikep)
void ikev2_payload_add_delete(ikev2_payload_chain_t *c, ikev2_delete_t *d)
ikev2_transform_prf_type_t
Definition: ikev2.h:258
uword * sa_by_ispi
Definition: ikev2_priv.h:491
ip_address_t start_addr
Definition: ikev2_priv.h:252
u8 unsupported_cp
Definition: ikev2_priv.h:371
void ikev2_sa_free_proposal_vector(ikev2_sa_proposal_t **v)
Definition: ikev2.c:284
u32 profile_index
Definition: ikev2_priv.h:426
#define foreach_ikev2_log_level
Definition: ikev2_priv.h:33
ikev2_transform_type_t
Definition: ikev2.h:217
ikev2_transforms_set esp_ts
Definition: ikev2_priv.h:341
ikev2_log_level_t_
Definition: ikev2_priv.h:42
void ikev2_disable_dpd(void)
Definition: ikev2.c:4980
void ikev2_generate_dh(ikev2_sa_t *sa, ikev2_sa_transform_t *t)
Definition: ikev2_crypto.c:498
vlib_main_t * vlib_main
Definition: ikev2_priv.h:485
u8 keys_generated
Definition: ikev2_priv.h:448
int ikev2_encrypt_data(ikev2_main_per_thread_data_t *ptd, ikev2_sa_t *sa, ikev2_sa_transform_t *tr_encr, v8 *src, u8 *dst)
Definition: ikev2_crypto.c:453
u16 ipsec_over_udp_port
Definition: ikev2_priv.h:430
clib_error_t * ikev2_profile_natt_disable(u8 *name)
Definition: ikev2.c:4813
ikev2_state_t
Definition: ikev2_priv.h:187