src/plugins/ikev2/ikev2.h

   1 /*
   2  * Copyright (c) 2015 Cisco and/or its affiliates.
   3  * Licensed under the Apache License, Version 2.0 (the "License");
   4  * you may not use this file except in compliance with the License.
   5  * You may obtain a copy of the License at:
   6  *
   7  *     http://www.apache.org/licenses/LICENSE-2.0
   8  *
   9  * Unless required by applicable law or agreed to in writing, software
  10  * distributed under the License is distributed on an "AS IS" BASIS,
  11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12  * See the License for the specific language governing permissions and
  13  * limitations under the License.
  14  */
  15 #ifndef __included_ikev2_h__
  16 #define __included_ikev2_h__
  17
  18 #include <vnet/vnet.h>
  19 #include <vnet/ip/ip.h>
  20
  21 #include <vppinfra/error.h>
  22
  23 #define IKEV2_NONCE_SIZE  32
  24 #define IKEV2_PORT        500
  25 #define IKEV2_PORT_NATT   4500
  26 #define IKEV2_KEY_PAD "Key Pad for IKEv2"
  27
  28 #define IKEV2_GCM_ICV_SIZE 16
  29 #define IKEV2_GCM_NONCE_SIZE 12
  30 #define IKEV2_GCM_SALT_SIZE 4
  31 #define IKEV2_GCM_IV_SIZE (IKEV2_GCM_NONCE_SIZE - IKEV2_GCM_SALT_SIZE)
  32
  33 typedef u8 v8;
  34
  35 /* *INDENT-OFF* */
  36 typedef CLIB_PACKED (struct {
  37   u64 ispi;
  38   u64 rspi;
  39   u8 nextpayload;
  40   u8 version;
  41   u8 exchange;
  42   u8 flags;
  43   u32 msgid; u32 length; u8 payload[0];
  44 }) ike_header_t;
  45 /* *INDENT-ON* */
  46
  47 /* *INDENT-OFF* */
  48 typedef CLIB_PACKED (struct
  49                      {
  50                      u8 nextpayload;
  51                      u8 flags;
  52                      u16 length;
  53                      u16 dh_group;
  54                      u8 reserved[2]; u8 payload[0];}) ike_ke_payload_header_t;
  55 /* *INDENT-ON* */
  56
  57 /* *INDENT-OFF* */
  58 typedef CLIB_PACKED (struct {
  59   u8 nextpayload;
  60   u8 flags;
  61   u16 length; u8 payload[0];
  62 }) ike_payload_header_t;
  63 /* *INDENT-ON* */
  64
  65 /* *INDENT-OFF* */
  66 typedef CLIB_PACKED (struct {
  67   u8 nextpayload;
  68   u8 flags;
  69   u16 length;
  70   u8 auth_method;
  71   u8 reserved[3];
  72   u8 payload[0];
  73 }) ike_auth_payload_header_t;
  74 /* *INDENT-ON* */
  75
  76 /* *INDENT-OFF* */
  77 typedef CLIB_PACKED (struct {
  78   u8 nextpayload;
  79   u8 flags;
  80   u16 length;
  81   u8 id_type;
  82   u8 reserved[3]; u8 payload[0];
  83 }) ike_id_payload_header_t;
  84 /* *INDENT-ON* */
  85
  86 #define IKE_VERSION_2                    0x20
  87
  88 #define IKEV2_EXCHANGE_SA_INIT           34
  89 #define IKEV2_EXCHANGE_IKE_AUTH          35
  90 #define IKEV2_EXCHANGE_CREATE_CHILD_SA   36
  91 #define IKEV2_EXCHANGE_INFORMATIONAL     37
  92
  93 #define IKEV2_HDR_FLAG_INITIATOR         (1<<3)
  94 #define IKEV2_HDR_FLAG_VERSION           (1<<4)
  95 #define IKEV2_HDR_FLAG_RESPONSE          (1<<5)
  96
  97 #define IKEV2_PAYLOAD_FLAG_CRITICAL      (1<<7)
  98
  99 #define IKEV2_PAYLOAD_NONE      0
 100 #define IKEV2_PAYLOAD_NAT_D     20
 101 #define IKEV2_PAYLOAD_NAT_OA    21
 102 #define IKEV2_PAYLOAD_SA        33
 103 #define IKEV2_PAYLOAD_KE        34
 104 #define IKEV2_PAYLOAD_IDI       35
 105 #define IKEV2_PAYLOAD_IDR       36
 106 #define IKEV2_PAYLOAD_AUTH      39
 107 #define IKEV2_PAYLOAD_NONCE     40
 108 #define IKEV2_PAYLOAD_NOTIFY    41
 109 #define IKEV2_PAYLOAD_DELETE    42
 110 #define IKEV2_PAYLOAD_VENDOR    43
 111 #define IKEV2_PAYLOAD_TSI       44
 112 #define IKEV2_PAYLOAD_TSR       45
 113 #define IKEV2_PAYLOAD_SK        46
 114
 115 typedef enum
 116 {
 117   IKEV2_PROTOCOL_IKE = 1,
 118   IKEV2_PROTOCOL_AH = 2,
 119   IKEV2_PROTOCOL_ESP = 3,
 120 } ikev2_protocol_id_t;
 121
 122 #define foreach_ikev2_notify_msg_type \
 123   _(    0, NONE)                                \
 124   _(    1, UNSUPPORTED_CRITICAL_PAYLOAD)        \
 125   _(    4, INVALID_IKE_SPI)                     \
 126   _(    5, INVALID_MAJOR_VERSION)               \
 127   _(    7, INVALID_SYNTAX)                      \
 128   _(    8, INVALID_MESSAGE_ID)                  \
 129   _(   11, INVALID_SPI)                         \
 130   _(   14, NO_PROPOSAL_CHOSEN)                  \
 131   _(   17, INVALID_KE_PAYLOAD)                  \
 132   _(   24, AUTHENTICATION_FAILED)               \
 133   _(   34, SINGLE_PAIR_REQUIRED)                \
 134   _(   35, NO_ADDITIONAL_SAS)                   \
 135   _(   36, INTERNAL_ADDRESS_FAILURE)            \
 136   _(   37, FAILED_CP_REQUIRED)                  \
 137   _(   38, TS_UNACCEPTABLE)                     \
 138   _(   39, INVALID_SELECTORS)                   \
 139   _(   40, UNACCEPTABLE_ADDRESSES)              \
 140   _(   41, UNEXPECTED_NAT_DETECTED)             \
 141   _(   42, USE_ASSIGNED_HoA)                    \
 142   _(   43, TEMPORARY_FAILURE)                   \
 143   _(   44, CHILD_SA_NOT_FOUND)                  \
 144   _(   45, INVALID_GROUP_ID)                    \
 145   _(   46, AUTHORIZATION_FAILED)                \
 146   _(16384, INITIAL_CONTACT)                     \
 147   _(16385, SET_WINDOW_SIZE)                     \
 148   _(16386, ADDITIONAL_TS_POSSIBLE)              \
 149   _(16387, IPCOMP_SUPPORTED)                    \
 150   _(16388, NAT_DETECTION_SOURCE_IP)             \
 151   _(16389, NAT_DETECTION_DESTINATION_IP)        \
 152   _(16390, COOKIE)                              \
 153   _(16391, USE_TRANSPORT_MODE)                  \
 154   _(16392, HTTP_CERT_LOOKUP_SUPPORTED)          \
 155   _(16393, REKEY_SA)                            \
 156   _(16394, ESP_TFC_PADDING_NOT_SUPPORTED)       \
 157   _(16395, NON_FIRST_FRAGMENTS_ALSO)            \
 158   _(16396, MOBIKE_SUPPORTED)                    \
 159   _(16397, ADDITIONAL_IP4_ADDRESS)              \
 160   _(16398, ADDITIONAL_IP6_ADDRESS)              \
 161   _(16399, NO_ADDITIONAL_ADDRESSES)             \
 162   _(16400, UPDATE_SA_ADDRESSES)                 \
 163   _(16401, COOKIE2)                             \
 164   _(16402, NO_NATS_ALLOWED)                     \
 165   _(16403, AUTH_LIFETIME)                       \
 166   _(16404, MULTIPLE_AUTH_SUPPORTED)             \
 167   _(16405, ANOTHER_AUTH_FOLLOWS)                \
 168   _(16406, REDIRECT_SUPPORTED)                  \
 169   _(16407, REDIRECT)                            \
 170   _(16408, REDIRECTED_FROM)                     \
 171   _(16409, TICKET_LT_OPAQUE)                    \
 172   _(16410, TICKET_REQUEST)                      \
 173   _(16411, TICKET_ACK)                          \
 174   _(16412, TICKET_NACK)                         \
 175   _(16413, TICKET_OPAQUE)                       \
 176   _(16414, LINK_ID)                             \
 177   _(16415, USE_WESP_MODE)                       \
 178   _(16416, ROHC_SUPPORTED)                      \
 179   _(16417, EAP_ONLY_AUTHENTICATION)             \
 180   _(16418, CHILDLESS_IKEV2_SUPPORTED)           \
 181   _(16419, QUICK_CRASH_DETECTION)               \
 182   _(16420, IKEV2_MESSAGE_ID_SYNC_SUPPORTED)     \
 183   _(16421, IPSEC_REPLAY_COUNTER_SYNC_SUPPORTED) \
 184   _(16422, IKEV2_MESSAGE_ID_SYNC)               \
 185   _(16423, IPSEC_REPLAY_COUNTER_SYNC)           \
 186   _(16424, SECURE_PASSWORD_METHODS)             \
 187   _(16425, PSK_PERSIST)                         \
 188   _(16426, PSK_CONFIRM)                         \
 189   _(16427, ERX_SUPPORTED)                       \
 190   _(16428, IFOM_CAPABILITY)                     \
 191   _(16429, SENDER_REQUEST_ID)                   \
 192   _(16430, IKEV2_FRAGMENTATION_SUPPORTED)       \
 193   _(16431, SIGNATURE_HASH_ALGORITHMS)
 194
 195
 196 typedef enum
 197 {
 198 #define _(v,f) IKEV2_NOTIFY_MSG_##f = v,
 199   foreach_ikev2_notify_msg_type
 200 #undef _
 201 } ikev2_notify_msg_type_t;
 202
 203 #define foreach_ikev2_transform_type       \
 204   _(0, UNDEFINED, "undefined") \
 205   _(1, ENCR,  "encr")           \
 206   _(2, PRF,   "prf")            \
 207   _(3, INTEG, "integ")          \
 208   _(4, DH,    "dh-group")       \
 209   _(5, ESN,   "esn")
 210
 211 typedef enum
 212 {
 213 #define _(v,f,s) IKEV2_TRANSFORM_TYPE_##f = v,
 214   foreach_ikev2_transform_type
 215 #undef _
 216   IKEV2_TRANSFORM_NUM_TYPES
 217 } ikev2_transform_type_t;
 218
 219
 220 #define foreach_ikev2_transform_encr_type     \
 221   _(1 , DES_IV64,  "des-iv64") \
 222   _(2 , DES,       "des")      \
 223   _(3 , 3DES,      "3des")     \
 224   _(4 , RC5,       "rc5")      \
 225   _(5 , IDEA,      "idea")     \
 226   _(6 , CAST,      "cast")     \
 227   _(7 , BLOWFISH,  "blowfish") \
 228   _(8 , 3IDEA,     "3idea")    \
 229   _(9 , DES_IV32,  "des-iv32") \
 230   _(11, NULL,      "null")     \
 231   _(12, AES_CBC,   "aes-cbc")  \
 232   _(13, AES_CTR,   "aes-ctr")  \
 233   _(20, AES_GCM_16, "aes-gcm-16")
 234
 235 typedef enum
 236 {
 237 #define _(v,f,str) IKEV2_TRANSFORM_ENCR_TYPE_##f = v,
 238   foreach_ikev2_transform_encr_type
 239 #undef _
 240 } ikev2_transform_encr_type_t;
 241
 242 #define foreach_ikev2_transform_prf_type   \
 243   _(1, PRF_HMAC_MD5,      "hmac-md5")      \
 244   _(2, PRF_HMAC_SHA1,     "hmac-sha1")     \
 245   _(3, PRF_MAC_TIGER,     "mac-tiger")     \
 246   _(4, PRF_AES128_XCBC,   "aes128-xcbc")   \
 247   _(5, PRF_HMAC_SHA2_256, "hmac-sha2-256") \
 248   _(6, PRF_HMAC_SHA2_384, "hmac-sha2-384") \
 249   _(7, PRF_HMAC_SHA2_512, "hmac-sha2-512") \
 250   _(8, PRF_AES128_CMAC,   "aes128-cmac")
 251
 252 typedef enum
 253 {
 254 #define _(v,f,str) IKEV2_TRANSFORM_PRF_TYPE_##f = v,
 255   foreach_ikev2_transform_prf_type
 256 #undef _
 257 } ikev2_transform_prf_type_t;
 258
 259 #define foreach_ikev2_transform_integ_type           \
 260   _(0,  NONE,                   "none")              \
 261   _(1,  AUTH_HMAC_MD5_96,       "md5-96")            \
 262   _(2,  AUTH_HMAC_SHA1_96,      "sha1-96")           \
 263   _(3,  AUTH_DES_MAC,           "des-mac")           \
 264   _(4,  AUTH_KPDK_MD5,          "kpdk-md5")          \
 265   _(5,  AUTH_AES_XCBC_96,       "aes-xcbc-96")       \
 266   _(6,  AUTH_HMAC_MD5_128,      "md5-128")           \
 267   _(7,  AUTH_HMAC_SHA1_160,     "sha1-160")          \
 268   _(8,  AUTH_AES_CMAC_96,       "cmac-96")           \
 269   _(9,  AUTH_AES_128_GMAC,      "aes-128-gmac")      \
 270   _(10, AUTH_AES_192_GMAC,      "aes-192-gmac")      \
 271   _(11, AUTH_AES_256_GMAC,      "aes-256-gmac")      \
 272   _(12, AUTH_HMAC_SHA2_256_128, "hmac-sha2-256-128") \
 273   _(13, AUTH_HMAC_SHA2_384_192, "hmac-sha2-384-192") \
 274   _(14, AUTH_HMAC_SHA2_512_256, "hmac-sha2-512-256")
 275
 276 typedef enum
 277 {
 278 #define _(v,f, str) IKEV2_TRANSFORM_INTEG_TYPE_##f = v,
 279   foreach_ikev2_transform_integ_type
 280 #undef _
 281 } ikev2_transform_integ_type_t;
 282
 283 #if defined(OPENSSL_NO_CISCO_FECDH)
 284 #define foreach_ikev2_transform_dh_type \
 285   _(0, NONE,           "none")          \
 286   _(1, MODP_768,       "modp-768")      \
 287   _(2, MODP_1024,      "modp-1024")     \
 288   _(5, MODP_1536,      "modp-1536")     \
 289   _(14, MODP_2048,     "modp-2048")     \
 290   _(15, MODP_3072,     "modp-3072")     \
 291   _(16, MODP_4096,     "modp-4096")     \
 292   _(17, MODP_6144,     "modp-6144")     \
 293   _(18, MODP_8192,     "modp-8192")     \
 294   _(19, ECP_256,       "ecp-256")       \
 295   _(20, ECP_384,       "ecp-384")       \
 296   _(21, ECP_521,       "ecp-521")       \
 297   _(22, MODP_1024_160, "modp-1024-160") \
 298   _(23, MODP_2048_224, "modp-2048-224") \
 299   _(24, MODP_2048_256, "modp-2048-256") \
 300   _(25, ECP_192,       "ecp-192")       \
 301   _(26, ECP_224,       "ecp-224")       \
 302   _(27, BRAINPOOL_224, "brainpool-224") \
 303   _(28, BRAINPOOL_256, "brainpool-256") \
 304   _(29, BRAINPOOL_384, "brainpool-384") \
 305   _(30, BRAINPOOL_512, "brainpool-512")
 306 #else
 307 #define foreach_ikev2_transform_dh_type \
 308   _(0, NONE,           "none")          \
 309   _(1, MODP_768,       "modp-768")      \
 310   _(2, MODP_1024,      "modp-1024")     \
 311   _(5, MODP_1536,      "modp-1536")     \
 312   _(14, MODP_2048,     "modp-2048")     \
 313   _(15, MODP_3072,     "modp-3072")     \
 314   _(16, MODP_4096,     "modp-4096")     \
 315   _(17, MODP_6144,     "modp-6144")     \
 316   _(18, MODP_8192,     "modp-8192")     \
 317   _(19, ECP_256,       "ecp-256")       \
 318   _(20, ECP_384,       "ecp-384")       \
 319   _(21, ECP_521,       "ecp-521")       \
 320   _(22, MODP_1024_160, "modp-1024-160") \
 321   _(23, MODP_2048_224, "modp-2048-224") \
 322   _(24, MODP_2048_256, "modp-2048-256") \
 323   _(25, ECP_192,       "ecp-192")
 324 #endif
 325
 326 typedef enum
 327 {
 328 #define _(v,f, str) IKEV2_TRANSFORM_DH_TYPE_##f = v,
 329   foreach_ikev2_transform_dh_type
 330 #undef _
 331 } ikev2_transform_dh_type_t;
 332
 333 #define foreach_ikev2_transform_esn_type     \
 334   _(0, NO_ESN, "no")       \
 335   _(1, ESN,    "yes")
 336
 337 typedef enum
 338 {
 339 #define _(v,f,str) IKEV2_TRANSFORM_ESN_TYPE_##f = v,
 340   foreach_ikev2_transform_esn_type
 341 #undef _
 342 } ikev2_transform_esn_type_t;
 343
 344 #define foreach_ikev2_auth_method \
 345  _( 1, RSA_SIG,        "rsa-sig")        \
 346  _( 2, SHARED_KEY_MIC, "shared-key-mic")
 347
 348 typedef enum
 349 {
 350 #define _(v,f,s) IKEV2_AUTH_METHOD_##f = v,
 351   foreach_ikev2_auth_method
 352 #undef _
 353 } ikev2_auth_method_t;
 354
 355 #define foreach_ikev2_id_type \
 356  _( 1, ID_IPV4_ADDR,   "ip4-addr")    \
 357  _( 2, ID_FQDN,        "fqdn")        \
 358  _( 3, ID_RFC822_ADDR, "rfc822")      \
 359  _( 5, ID_IPV6_ADDR,   "ip6-addr")    \
 360  _( 9, ID_DER_ASN1_DN, "der-asn1-dn") \
 361  _(10, ID_DER_ASN1_GN, "der-asn1-gn") \
 362  _(11, ID_KEY_ID,      "key-id")
 363
 364 typedef enum
 365 {
 366 #define _(v,f,s) IKEV2_ID_TYPE_##f = v,
 367   foreach_ikev2_id_type
 368 #undef _
 369 } ikev2_id_type_t;
 370
 371 clib_error_t *ikev2_init (vlib_main_t * vm);
 372 clib_error_t *ikev2_set_local_key (vlib_main_t * vm, u8 * file);
 373 clib_error_t *ikev2_add_del_profile (vlib_main_t * vm, u8 * name, int is_add);
 374 clib_error_t *ikev2_set_profile_auth (vlib_main_t * vm, u8 * name,
 375                                       u8 auth_method, u8 * data,
 376                                       u8 data_hex_format);
 377 clib_error_t *ikev2_set_profile_id (vlib_main_t * vm, u8 * name,
 378                                     u8 id_type, u8 * data, int is_local);
 379 clib_error_t *ikev2_set_profile_ts (vlib_main_t * vm, u8 * name,
 380                                     u8 protocol_id, u16 start_port,
 381                                     u16 end_port, ip4_address_t start_addr,
 382                                     ip4_address_t end_addr, int is_local);
 383 clib_error_t *ikev2_set_profile_responder (vlib_main_t * vm, u8 * name,
 384                                            u32 sw_if_index,
 385                                            ip4_address_t ip4);
 386 clib_error_t *ikev2_set_profile_ike_transforms (vlib_main_t * vm, u8 * name,
 387                                                 ikev2_transform_encr_type_t
 388                                                 crypto_alg,
 389                                                 ikev2_transform_integ_type_t
 390                                                 integ_alg,
 391                                                 ikev2_transform_dh_type_t
 392                                                 dh_type, u32 crypto_key_size);
 393 clib_error_t *ikev2_set_profile_esp_transforms (vlib_main_t * vm, u8 * name,
 394                                                 ikev2_transform_encr_type_t
 395                                                 crypto_alg,
 396                                                 ikev2_transform_integ_type_t
 397                                                 integ_alg,
 398                                                 u32 crypto_key_size);
 399 clib_error_t *ikev2_set_profile_sa_lifetime (vlib_main_t * vm, u8 * name,
 400                                              u64 lifetime, u32 jitter,
 401                                              u32 handover, u64 maxdata);
 402 clib_error_t *ikev2_set_profile_tunnel_interface (vlib_main_t * vm, u8 * name,
 403                                                   u32 sw_if_index);
 404 vnet_api_error_t ikev2_set_profile_ipsec_udp_port (vlib_main_t * vm,
 405                                                    u8 * name, u16 port,
 406                                                    u8 is_set);
 407 clib_error_t *ikev2_set_profile_udp_encap (vlib_main_t * vm, u8 * name);
 408 clib_error_t *ikev2_initiate_sa_init (vlib_main_t * vm, u8 * name);
 409 clib_error_t *ikev2_initiate_delete_child_sa (vlib_main_t * vm, u32 ispi);
 410 clib_error_t *ikev2_initiate_delete_ike_sa (vlib_main_t * vm, u64 ispi);
 411 clib_error_t *ikev2_initiate_rekey_child_sa (vlib_main_t * vm, u32 ispi);
 412
 413 /* ikev2_format.c */
 414 u8 *format_ikev2_auth_method (u8 * s, va_list * args);
 415 u8 *format_ikev2_id_type (u8 * s, va_list * args);
 416 u8 *format_ikev2_transform_type (u8 * s, va_list * args);
 417 u8 *format_ikev2_notify_msg_type (u8 * s, va_list * args);
 418 u8 *format_ikev2_transform_encr_type (u8 * s, va_list * args);
 419 u8 *format_ikev2_transform_prf_type (u8 * s, va_list * args);
 420 u8 *format_ikev2_transform_integ_type (u8 * s, va_list * args);
 421 u8 *format_ikev2_transform_dh_type (u8 * s, va_list * args);
 422 u8 *format_ikev2_transform_esn_type (u8 * s, va_list * args);
 423 u8 *format_ikev2_sa_transform (u8 * s, va_list * args);
 424
 425 uword unformat_ikev2_auth_method (unformat_input_t * input, va_list * args);
 426 uword unformat_ikev2_id_type (unformat_input_t * input, va_list * args);
 427 uword unformat_ikev2_transform_type (unformat_input_t * input,
 428                                      va_list * args);
 429 uword unformat_ikev2_transform_encr_type (unformat_input_t * input,
 430                                           va_list * args);
 431 uword unformat_ikev2_transform_prf_type (unformat_input_t * input,
 432                                          va_list * args);
 433 uword unformat_ikev2_transform_integ_type (unformat_input_t * input,
 434                                            va_list * args);
 435 uword unformat_ikev2_transform_dh_type (unformat_input_t * input,
 436                                         va_list * args);
 437 uword unformat_ikev2_transform_esn_type (unformat_input_t * input,
 438                                          va_list * args);
 439 void ikev2_cli_reference (void);
 440
 441 clib_error_t *ikev2_set_liveness_params (u32 period, u32 max_retries);
 442
 443 #endif /* __included_ikev2_h__ */
 444
 445
 446 /*
 447  * fd.io coding-style-patch-verification: ON
 448  *
 449  * Local Variables:
 450  * eval: (c-set-style "gnu")
 451  * End:
 452  */