vnet/vnet/ipsec/ikev2_priv.h

   1 /*
   2  * Copyright (c) 2015 Cisco and/or its affiliates.
   3  * Licensed under the Apache License, Version 2.0 (the "License");
   4  * you may not use this file except in compliance with the License.
   5  * You may obtain a copy of the License at:
   6  *
   7  *     http://www.apache.org/licenses/LICENSE-2.0
   8  *
   9  * Unless required by applicable law or agreed to in writing, software
  10  * distributed under the License is distributed on an "AS IS" BASIS,
  11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12  * See the License for the specific language governing permissions and
  13  * limitations under the License.
  14  */
  15 #ifndef __included_ikev2_priv_h__
  16 #define __included_ikev2_priv_h__
  17
  18 #include <vnet/vnet.h>
  19 #include <vnet/ip/ip.h>
  20 #include <vnet/ethernet/ethernet.h>
  21
  22 #include <vnet/ipsec/ikev2.h>
  23
  24 #include <vppinfra/hash.h>
  25 #include <vppinfra/elog.h>
  26 #include <vppinfra/error.h>
  27
  28 #include <openssl/rand.h>
  29 #include <openssl/dh.h>
  30 #include <openssl/hmac.h>
  31 #include <openssl/evp.h>
  32
  33 #define IKEV2_DEBUG_PAYLOAD 1
  34
  35 #if IKEV2_DEBUG_PAYLOAD == 1
  36 #define DBG_PLD(my_args...) clib_warning(my_args)
  37 #else
  38 #define DBG_PLD(my_args...)
  39 #endif
  40
  41 typedef enum {
  42   IKEV2_STATE_UNKNOWN,
  43   IKEV2_STATE_SA_INIT,
  44   IKEV2_STATE_DELETED,
  45   IKEV2_STATE_AUTH_FAILED,
  46   IKEV2_STATE_AUTHENTICATED,
  47   IKEV2_STATE_NOTIFY_AND_DELETE,
  48   IKEV2_STATE_TS_UNACCEPTABLE,
  49   IKEV2_STATE_NO_PROPOSAL_CHOSEN,
  50 } ikev2_state_t;
  51
  52 typedef struct {
  53   ikev2_auth_method_t method:8;
  54   u8 * data;
  55   u8 hex; /* hex encoding of the shared secret */
  56   EVP_PKEY * key;
  57 } ikev2_auth_t;
  58
  59 typedef enum {
  60   IKEV2_DH_GROUP_MODP = 0,
  61   IKEV2_DH_GROUP_ECP  = 1,
  62 } ikev2_dh_group_t;
  63
  64 typedef struct {
  65   ikev2_transform_type_t type;
  66   union {
  67     u16                          transform_id;
  68     ikev2_transform_encr_type_t  encr_type:16;
  69     ikev2_transform_prf_type_t   prf_type:16;
  70     ikev2_transform_integ_type_t integ_type:16;
  71     ikev2_transform_dh_type_t    dh_type:16;
  72     ikev2_transform_esn_type_t   esn_type:16;
  73   };
  74   u8 * attrs;
  75   u16 key_len;
  76   u16 key_trunc;
  77   u16 block_size;
  78   u8 dh_group;
  79   int nid;
  80   const char * dh_p;
  81   const char * dh_g;
  82   const void * md;
  83   const void * cipher;
  84 } ikev2_sa_transform_t;
  85
  86 typedef struct {
  87   u8 proposal_num;
  88   ikev2_protocol_id_t protocol_id:8;
  89   u32 spi;
  90   ikev2_sa_transform_t * transforms;
  91 } ikev2_sa_proposal_t;
  92
  93 typedef struct {
  94   u8   ts_type;
  95   u8   protocol_id;
  96   u16  selector_len;
  97   u16  start_port;
  98   u16  end_port;
  99   ip4_address_t start_addr;
 100   ip4_address_t end_addr;
 101 } ikev2_ts_t;
 102
 103 typedef struct {
 104   ikev2_id_type_t type:8;
 105   u8 * data;
 106 } ikev2_id_t;
 107
 108 typedef struct {
 109   /* sa proposals vectors */
 110   ikev2_sa_proposal_t * i_proposals;
 111   ikev2_sa_proposal_t * r_proposals;
 112
 113   /* Traffic Selectors */
 114   ikev2_ts_t * tsi;
 115   ikev2_ts_t * tsr;
 116
 117   /* keys */
 118   u8 * sk_ai;
 119   u8 * sk_ar;
 120   u8 * sk_ei;
 121   u8 * sk_er;
 122 } ikev2_child_sa_t;
 123
 124 typedef struct {
 125   u8  protocol_id;
 126   u32 spi;  /*for ESP and AH SPI size is 4, for IKE size is 0 */
 127 } ikev2_delete_t;
 128
 129 typedef struct {
 130   u8 protocol_id;
 131   u32 spi;
 132   ikev2_sa_proposal_t * i_proposal;
 133   ikev2_sa_proposal_t * r_proposal;
 134   ikev2_ts_t * tsi;
 135   ikev2_ts_t * tsr;
 136 } ikev2_rekey_t;
 137
 138 typedef struct {
 139   u16 msg_type;
 140   u8 protocol_id;
 141   u32 spi;
 142   u8 * data;
 143 } ikev2_notify_t;
 144
 145
 146 typedef struct {
 147   ikev2_state_t state;
 148   u8 unsupported_cp;
 149   u8 initial_contact;
 150   ip4_address_t iaddr;
 151   ip4_address_t raddr;
 152   u64 ispi;
 153   u64 rspi;
 154   u8 * i_nonce;
 155   u8 * r_nonce;
 156
 157   /* DH data */
 158   u16  dh_group;
 159   u8 * dh_shared_key;
 160   u8 * i_dh_data;
 161   u8 * r_dh_data;
 162
 163   /* sa proposals vectors */
 164   ikev2_sa_proposal_t * i_proposals;
 165   ikev2_sa_proposal_t * r_proposals;
 166
 167   /* keys */
 168   u8 * sk_d;
 169   u8 * sk_ai;
 170   u8 * sk_ar;
 171   u8 * sk_ei;
 172   u8 * sk_er;
 173   u8 * sk_pi;
 174   u8 * sk_pr;
 175
 176   /* auth */
 177   ikev2_auth_t i_auth;
 178   ikev2_auth_t r_auth;
 179
 180   /* ID */
 181   ikev2_id_t i_id;
 182   ikev2_id_t r_id;
 183
 184   /* pending deletes */
 185   ikev2_delete_t * del;
 186
 187   /* pending rekeyings */
 188   ikev2_rekey_t * rekey;
 189
 190   /* packet data */
 191   u8 * last_sa_init_req_packet_data;
 192   u8 * last_sa_init_res_packet_data;
 193
 194   /* retransmit */
 195   u32 last_msg_id;
 196   u8 * last_res_packet_data;
 197
 198   ikev2_child_sa_t * childs;
 199 } ikev2_sa_t;
 200
 201 typedef struct {
 202   u8 * name;
 203   u8 is_enabled;
 204
 205   ikev2_auth_t auth;
 206   ikev2_id_t loc_id;
 207   ikev2_id_t rem_id;
 208   ikev2_ts_t loc_ts;
 209   ikev2_ts_t rem_ts;
 210 } ikev2_profile_t;
 211
 212 typedef struct {
 213     /* pool of IKEv2 Security Associations */
 214     ikev2_sa_t * sas;
 215
 216     /* hash */
 217     uword * sa_by_rspi;
 218 } ikev2_main_per_thread_data_t;
 219
 220 typedef struct {
 221     /* pool of IKEv2 profiles */
 222     ikev2_profile_t * profiles;
 223
 224     /* vector of supported transform types */
 225     ikev2_sa_transform_t * supported_transforms;
 226
 227     /* hash */
 228     mhash_t profile_index_by_name;
 229
 230     /* local private key */
 231     EVP_PKEY * pkey;
 232
 233     /* convenience */
 234     vlib_main_t * vlib_main;
 235     vnet_main_t * vnet_main;
 236
 237     ikev2_main_per_thread_data_t * per_thread_data;
 238
 239 } ikev2_main_t;
 240
 241 ikev2_main_t ikev2_main;
 242
 243 void ikev2_sa_free_proposal_vector(ikev2_sa_proposal_t ** v);
 244 ikev2_sa_transform_t * ikev2_sa_get_td_for_type(ikev2_sa_proposal_t * p,
 245                                                 ikev2_transform_type_t type);
 246
 247 /* ikev2_crypto.c */
 248 v8 * ikev2_calc_prf(ikev2_sa_transform_t * tr, v8 * key, v8 * data);
 249 u8 * ikev2_calc_prfplus(ikev2_sa_transform_t * tr, u8 * key, u8 * seed, int len);
 250 v8 * ikev2_calc_integr(ikev2_sa_transform_t * tr, v8 * key, u8 * data, int len);
 251 v8 * ikev2_decrypt_data(ikev2_sa_t * sa, u8 * data, int len);
 252 int ikev2_encrypt_data(ikev2_sa_t * sa, v8 * src, u8 * dst);
 253 void ikev2_generate_dh(ikev2_sa_t * sa, ikev2_sa_transform_t * t);
 254 int ikev2_verify_sign(EVP_PKEY *pkey, u8 * sigbuf, u8 * data);
 255 u8 * ikev2_calc_sign(EVP_PKEY *pkey, u8 * data);
 256 EVP_PKEY * ikev2_load_cert_file(u8 * file);
 257 EVP_PKEY * ikev2_load_key_file(u8 * file);
 258 void ikev2_crypto_init (ikev2_main_t * km);
 259
 260 /* ikev2_payload.c */
 261 typedef struct {
 262   u8 first_payload_type;
 263   u16 last_hdr_off;
 264   u8 * data;
 265 } ikev2_payload_chain_t;
 266
 267 #define ikev2_payload_new_chain(V) vec_validate (V, 0)
 268 #define ikev2_payload_destroy_chain(V) do { \
 269   vec_free((V)->data);                 \
 270   vec_free(V);                         \
 271 } while (0)
 272
 273 void ikev2_payload_add_notify(ikev2_payload_chain_t * c, u16 msg_type, u8 * data);
 274 void ikev2_payload_add_sa(ikev2_payload_chain_t * c, ikev2_sa_proposal_t * proposals);
 275 void ikev2_payload_add_ke(ikev2_payload_chain_t * c, u16 dh_group, u8 * dh_data);
 276 void ikev2_payload_add_nonce(ikev2_payload_chain_t * c, u8 * nonce);
 277 void ikev2_payload_add_id(ikev2_payload_chain_t *c, ikev2_id_t * id, u8 type);
 278 void ikev2_payload_add_auth(ikev2_payload_chain_t *c, ikev2_auth_t * auth);
 279 void ikev2_payload_add_ts(ikev2_payload_chain_t * c, ikev2_ts_t * ts, u8 type);
 280 void ikev2_payload_add_delete(ikev2_payload_chain_t *c, ikev2_delete_t * d);
 281 void ikev2_payload_chain_add_padding(ikev2_payload_chain_t * c, int bs);
 282 void ikev2_parse_vendor_payload(ike_payload_header_t * ikep);
 283 ikev2_sa_proposal_t * ikev2_parse_sa_payload(ike_payload_header_t * ikep);
 284 ikev2_ts_t * ikev2_parse_ts_payload(ike_payload_header_t * ikep);
 285 ikev2_delete_t * ikev2_parse_delete_payload(ike_payload_header_t * ikep);
 286 ikev2_notify_t * ikev2_parse_notify_payload(ike_payload_header_t * ikep);
 287
 288 #endif /* __included_ikev2_priv_h__ */
 289