2 * Copyright (c) 2015 Cisco and/or its affiliates.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at:
7 * http://www.apache.org/licenses/LICENSE-2.0
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
15 #ifndef __included_ikev2_h__
16 #define __included_ikev2_h__
18 #include <vnet/vnet.h>
19 #include <vnet/ip/ip.h>
21 #include <vppinfra/error.h>
23 #define IKEV2_NONCE_SIZE 32
24 #define IKEV2_PORT 500
25 #define IKEV2_PORT_NATT 4500
26 #define IKEV2_KEY_PAD "Key Pad for IKEv2"
28 #define IKEV2_GCM_ICV_SIZE 16
29 #define IKEV2_GCM_NONCE_SIZE 12
30 #define IKEV2_GCM_SALT_SIZE 4
31 #define IKEV2_GCM_IV_SIZE (IKEV2_GCM_NONCE_SIZE - IKEV2_GCM_SALT_SIZE)
35 typedef CLIB_PACKED (struct {
42 u32 msgid; u32 length; u8 payload[0];
45 #define ike_hdr_is_response(_h) ((_h)->flags & IKEV2_HDR_FLAG_RESPONSE)
46 #define ike_hdr_is_request(_h) (!ike_hdr_is_response(_h))
47 #define ike_hdr_is_initiator(_h) ((_h)->flags & IKEV2_HDR_FLAG_INITIATOR)
48 #define ike_hdr_is_responder(_h) (!(ike_hdr_is_initiator(_h)))
50 typedef CLIB_PACKED (struct {
57 }) ike_ke_payload_header_t;
59 typedef CLIB_PACKED (struct {
62 u16 length; u8 payload[0];
63 }) ike_payload_header_t;
65 typedef CLIB_PACKED (struct {
72 }) ike_auth_payload_header_t;
74 typedef CLIB_PACKED (struct {
79 u8 reserved[3]; u8 payload[0];
80 }) ike_id_payload_header_t;
82 #define IKE_VERSION_2 0x20
84 #define IKEV2_EXCHANGE_SA_INIT 34
85 #define IKEV2_EXCHANGE_IKE_AUTH 35
86 #define IKEV2_EXCHANGE_CREATE_CHILD_SA 36
87 #define IKEV2_EXCHANGE_INFORMATIONAL 37
89 #define IKEV2_HDR_FLAG_INITIATOR (1<<3)
90 #define IKEV2_HDR_FLAG_VERSION (1<<4)
91 #define IKEV2_HDR_FLAG_RESPONSE (1<<5)
93 #define IKEV2_PAYLOAD_FLAG_CRITICAL (1<<7)
95 #define IKEV2_PAYLOAD_NONE 0
96 #define IKEV2_PAYLOAD_NAT_D 20
97 #define IKEV2_PAYLOAD_NAT_OA 21
98 #define IKEV2_PAYLOAD_SA 33
99 #define IKEV2_PAYLOAD_KE 34
100 #define IKEV2_PAYLOAD_IDI 35
101 #define IKEV2_PAYLOAD_IDR 36
102 #define IKEV2_PAYLOAD_AUTH 39
103 #define IKEV2_PAYLOAD_NONCE 40
104 #define IKEV2_PAYLOAD_NOTIFY 41
105 #define IKEV2_PAYLOAD_DELETE 42
106 #define IKEV2_PAYLOAD_VENDOR 43
107 #define IKEV2_PAYLOAD_TSI 44
108 #define IKEV2_PAYLOAD_TSR 45
109 #define IKEV2_PAYLOAD_SK 46
113 IKEV2_PROTOCOL_IKE = 1,
114 IKEV2_PROTOCOL_AH = 2,
115 IKEV2_PROTOCOL_ESP = 3,
116 } ikev2_protocol_id_t;
118 #define foreach_ikev2_notify_msg_type \
120 _( 1, UNSUPPORTED_CRITICAL_PAYLOAD) \
121 _( 4, INVALID_IKE_SPI) \
122 _( 5, INVALID_MAJOR_VERSION) \
123 _( 7, INVALID_SYNTAX) \
124 _( 8, INVALID_MESSAGE_ID) \
125 _( 11, INVALID_SPI) \
126 _( 14, NO_PROPOSAL_CHOSEN) \
127 _( 17, INVALID_KE_PAYLOAD) \
128 _( 24, AUTHENTICATION_FAILED) \
129 _( 34, SINGLE_PAIR_REQUIRED) \
130 _( 35, NO_ADDITIONAL_SAS) \
131 _( 36, INTERNAL_ADDRESS_FAILURE) \
132 _( 37, FAILED_CP_REQUIRED) \
133 _( 38, TS_UNACCEPTABLE) \
134 _( 39, INVALID_SELECTORS) \
135 _( 40, UNACCEPTABLE_ADDRESSES) \
136 _( 41, UNEXPECTED_NAT_DETECTED) \
137 _( 42, USE_ASSIGNED_HoA) \
138 _( 43, TEMPORARY_FAILURE) \
139 _( 44, CHILD_SA_NOT_FOUND) \
140 _( 45, INVALID_GROUP_ID) \
141 _( 46, AUTHORIZATION_FAILED) \
142 _(16384, INITIAL_CONTACT) \
143 _(16385, SET_WINDOW_SIZE) \
144 _(16386, ADDITIONAL_TS_POSSIBLE) \
145 _(16387, IPCOMP_SUPPORTED) \
146 _(16388, NAT_DETECTION_SOURCE_IP) \
147 _(16389, NAT_DETECTION_DESTINATION_IP) \
149 _(16391, USE_TRANSPORT_MODE) \
150 _(16392, HTTP_CERT_LOOKUP_SUPPORTED) \
152 _(16394, ESP_TFC_PADDING_NOT_SUPPORTED) \
153 _(16395, NON_FIRST_FRAGMENTS_ALSO) \
154 _(16396, MOBIKE_SUPPORTED) \
155 _(16397, ADDITIONAL_IP4_ADDRESS) \
156 _(16398, ADDITIONAL_IP6_ADDRESS) \
157 _(16399, NO_ADDITIONAL_ADDRESSES) \
158 _(16400, UPDATE_SA_ADDRESSES) \
160 _(16402, NO_NATS_ALLOWED) \
161 _(16403, AUTH_LIFETIME) \
162 _(16404, MULTIPLE_AUTH_SUPPORTED) \
163 _(16405, ANOTHER_AUTH_FOLLOWS) \
164 _(16406, REDIRECT_SUPPORTED) \
166 _(16408, REDIRECTED_FROM) \
167 _(16409, TICKET_LT_OPAQUE) \
168 _(16410, TICKET_REQUEST) \
169 _(16411, TICKET_ACK) \
170 _(16412, TICKET_NACK) \
171 _(16413, TICKET_OPAQUE) \
173 _(16415, USE_WESP_MODE) \
174 _(16416, ROHC_SUPPORTED) \
175 _(16417, EAP_ONLY_AUTHENTICATION) \
176 _(16418, CHILDLESS_IKEV2_SUPPORTED) \
177 _(16419, QUICK_CRASH_DETECTION) \
178 _(16420, IKEV2_MESSAGE_ID_SYNC_SUPPORTED) \
179 _(16421, IPSEC_REPLAY_COUNTER_SYNC_SUPPORTED) \
180 _(16422, IKEV2_MESSAGE_ID_SYNC) \
181 _(16423, IPSEC_REPLAY_COUNTER_SYNC) \
182 _(16424, SECURE_PASSWORD_METHODS) \
183 _(16425, PSK_PERSIST) \
184 _(16426, PSK_CONFIRM) \
185 _(16427, ERX_SUPPORTED) \
186 _(16428, IFOM_CAPABILITY) \
187 _(16429, SENDER_REQUEST_ID) \
188 _(16430, IKEV2_FRAGMENTATION_SUPPORTED) \
189 _(16431, SIGNATURE_HASH_ALGORITHMS)
194 #define _(v,f) IKEV2_NOTIFY_MSG_##f = v,
195 foreach_ikev2_notify_msg_type
197 } ikev2_notify_msg_type_t;
199 #define foreach_ikev2_transform_type \
200 _(0, UNDEFINED, "undefined") \
203 _(3, INTEG, "integ") \
204 _(4, DH, "dh-group") \
209 #define _(v,f,s) IKEV2_TRANSFORM_TYPE_##f = v,
210 foreach_ikev2_transform_type
212 IKEV2_TRANSFORM_NUM_TYPES
213 } ikev2_transform_type_t;
216 #define foreach_ikev2_transform_encr_type \
217 _(1 , DES_IV64, "des-iv64") \
219 _(3 , 3DES, "3des") \
221 _(5 , IDEA, "idea") \
222 _(6 , CAST, "cast") \
223 _(7 , BLOWFISH, "blowfish") \
224 _(8 , 3IDEA, "3idea") \
225 _(9 , DES_IV32, "des-iv32") \
226 _(11, NULL, "null") \
227 _(12, AES_CBC, "aes-cbc") \
228 _(13, AES_CTR, "aes-ctr") \
229 _(20, AES_GCM_16, "aes-gcm-16")
233 #define _(v,f,str) IKEV2_TRANSFORM_ENCR_TYPE_##f = v,
234 foreach_ikev2_transform_encr_type
236 } ikev2_transform_encr_type_t;
238 #define foreach_ikev2_transform_prf_type \
239 _(1, PRF_HMAC_MD5, "hmac-md5") \
240 _(2, PRF_HMAC_SHA1, "hmac-sha1") \
241 _(3, PRF_MAC_TIGER, "mac-tiger") \
242 _(4, PRF_AES128_XCBC, "aes128-xcbc") \
243 _(5, PRF_HMAC_SHA2_256, "hmac-sha2-256") \
244 _(6, PRF_HMAC_SHA2_384, "hmac-sha2-384") \
245 _(7, PRF_HMAC_SHA2_512, "hmac-sha2-512") \
246 _(8, PRF_AES128_CMAC, "aes128-cmac")
250 #define _(v,f,str) IKEV2_TRANSFORM_PRF_TYPE_##f = v,
251 foreach_ikev2_transform_prf_type
253 } ikev2_transform_prf_type_t;
255 #define foreach_ikev2_transform_integ_type \
257 _(1, AUTH_HMAC_MD5_96, "md5-96") \
258 _(2, AUTH_HMAC_SHA1_96, "sha1-96") \
259 _(3, AUTH_DES_MAC, "des-mac") \
260 _(4, AUTH_KPDK_MD5, "kpdk-md5") \
261 _(5, AUTH_AES_XCBC_96, "aes-xcbc-96") \
262 _(6, AUTH_HMAC_MD5_128, "md5-128") \
263 _(7, AUTH_HMAC_SHA1_160, "sha1-160") \
264 _(8, AUTH_AES_CMAC_96, "cmac-96") \
265 _(9, AUTH_AES_128_GMAC, "aes-128-gmac") \
266 _(10, AUTH_AES_192_GMAC, "aes-192-gmac") \
267 _(11, AUTH_AES_256_GMAC, "aes-256-gmac") \
268 _(12, AUTH_HMAC_SHA2_256_128, "hmac-sha2-256-128") \
269 _(13, AUTH_HMAC_SHA2_384_192, "hmac-sha2-384-192") \
270 _(14, AUTH_HMAC_SHA2_512_256, "hmac-sha2-512-256")
274 #define _(v,f, str) IKEV2_TRANSFORM_INTEG_TYPE_##f = v,
275 foreach_ikev2_transform_integ_type
277 } ikev2_transform_integ_type_t;
279 #if defined(OPENSSL_NO_CISCO_FECDH)
280 #define foreach_ikev2_transform_dh_type \
282 _(1, MODP_768, "modp-768") \
283 _(2, MODP_1024, "modp-1024") \
284 _(5, MODP_1536, "modp-1536") \
285 _(14, MODP_2048, "modp-2048") \
286 _(15, MODP_3072, "modp-3072") \
287 _(16, MODP_4096, "modp-4096") \
288 _(17, MODP_6144, "modp-6144") \
289 _(18, MODP_8192, "modp-8192") \
290 _(19, ECP_256, "ecp-256") \
291 _(20, ECP_384, "ecp-384") \
292 _(21, ECP_521, "ecp-521") \
293 _(22, MODP_1024_160, "modp-1024-160") \
294 _(23, MODP_2048_224, "modp-2048-224") \
295 _(24, MODP_2048_256, "modp-2048-256") \
296 _(25, ECP_192, "ecp-192") \
297 _(26, ECP_224, "ecp-224") \
298 _(27, BRAINPOOL_224, "brainpool-224") \
299 _(28, BRAINPOOL_256, "brainpool-256") \
300 _(29, BRAINPOOL_384, "brainpool-384") \
301 _(30, BRAINPOOL_512, "brainpool-512")
303 #define foreach_ikev2_transform_dh_type \
305 _(1, MODP_768, "modp-768") \
306 _(2, MODP_1024, "modp-1024") \
307 _(5, MODP_1536, "modp-1536") \
308 _(14, MODP_2048, "modp-2048") \
309 _(15, MODP_3072, "modp-3072") \
310 _(16, MODP_4096, "modp-4096") \
311 _(17, MODP_6144, "modp-6144") \
312 _(18, MODP_8192, "modp-8192") \
313 _(19, ECP_256, "ecp-256") \
314 _(20, ECP_384, "ecp-384") \
315 _(21, ECP_521, "ecp-521") \
316 _(22, MODP_1024_160, "modp-1024-160") \
317 _(23, MODP_2048_224, "modp-2048-224") \
318 _(24, MODP_2048_256, "modp-2048-256") \
319 _(25, ECP_192, "ecp-192")
324 #define _(v,f, str) IKEV2_TRANSFORM_DH_TYPE_##f = v,
325 foreach_ikev2_transform_dh_type
327 } ikev2_transform_dh_type_t;
329 #define foreach_ikev2_transform_esn_type \
335 #define _(v,f,str) IKEV2_TRANSFORM_ESN_TYPE_##f = v,
336 foreach_ikev2_transform_esn_type
338 } ikev2_transform_esn_type_t;
340 #define foreach_ikev2_auth_method \
341 _( 1, RSA_SIG, "rsa-sig") \
342 _( 2, SHARED_KEY_MIC, "shared-key-mic")
346 #define _(v,f,s) IKEV2_AUTH_METHOD_##f = v,
347 foreach_ikev2_auth_method
349 } ikev2_auth_method_t;
351 #define foreach_ikev2_id_type \
352 _( 1, ID_IPV4_ADDR, "ip4-addr") \
353 _( 2, ID_FQDN, "fqdn") \
354 _( 3, ID_RFC822_ADDR, "rfc822") \
355 _( 5, ID_IPV6_ADDR, "ip6-addr") \
356 _( 9, ID_DER_ASN1_DN, "der-asn1-dn") \
357 _(10, ID_DER_ASN1_GN, "der-asn1-gn") \
358 _(11, ID_KEY_ID, "key-id")
362 #define _(v,f,s) IKEV2_ID_TYPE_##f = v,
363 foreach_ikev2_id_type
369 TS_IPV4_ADDR_RANGE = 7,
370 TS_IPV6_ADDR_RANGE = 8,
371 } ikev2_traffic_selector_type_t;
373 clib_error_t *ikev2_init (vlib_main_t * vm);
374 clib_error_t *ikev2_set_local_key (vlib_main_t * vm, u8 * file);
375 clib_error_t *ikev2_add_del_profile (vlib_main_t * vm, u8 * name, int is_add);
376 clib_error_t *ikev2_set_profile_auth (vlib_main_t * vm, u8 * name,
377 u8 auth_method, u8 * data,
379 clib_error_t *ikev2_set_profile_id (vlib_main_t * vm, u8 * name,
380 u8 id_type, u8 * data, int is_local);
381 clib_error_t *ikev2_set_profile_ts (vlib_main_t * vm, u8 * name,
382 u8 protocol_id, u16 start_port,
383 u16 end_port, ip_address_t start_addr,
384 ip_address_t end_addr, int is_local);
385 clib_error_t *ikev2_set_profile_responder (vlib_main_t * vm, u8 * name,
388 clib_error_t *ikev2_set_profile_responder_hostname (vlib_main_t *vm, u8 *name,
391 clib_error_t *ikev2_set_profile_ike_transforms (vlib_main_t * vm, u8 * name,
392 ikev2_transform_encr_type_t
394 ikev2_transform_integ_type_t
396 ikev2_transform_dh_type_t
397 dh_type, u32 crypto_key_size);
398 clib_error_t *ikev2_set_profile_esp_transforms (vlib_main_t * vm, u8 * name,
399 ikev2_transform_encr_type_t
401 ikev2_transform_integ_type_t
403 u32 crypto_key_size);
404 clib_error_t *ikev2_set_profile_sa_lifetime (vlib_main_t * vm, u8 * name,
405 u64 lifetime, u32 jitter,
406 u32 handover, u64 maxdata);
407 clib_error_t *ikev2_set_profile_tunnel_interface (vlib_main_t * vm, u8 * name,
409 vnet_api_error_t ikev2_set_profile_ipsec_udp_port (vlib_main_t * vm,
412 clib_error_t *ikev2_set_profile_udp_encap (vlib_main_t * vm, u8 * name);
413 clib_error_t *ikev2_initiate_sa_init (vlib_main_t * vm, u8 * name);
414 clib_error_t *ikev2_initiate_delete_child_sa (vlib_main_t * vm, u32 ispi);
415 clib_error_t *ikev2_initiate_delete_ike_sa (vlib_main_t * vm, u64 ispi);
416 clib_error_t *ikev2_initiate_rekey_child_sa (vlib_main_t * vm, u32 ispi);
419 u8 *format_ikev2_auth_method (u8 * s, va_list * args);
420 u8 *format_ikev2_id_type (u8 * s, va_list * args);
421 u8 *format_ikev2_transform_type (u8 * s, va_list * args);
422 u8 *format_ikev2_notify_msg_type (u8 * s, va_list * args);
423 u8 *format_ikev2_transform_encr_type (u8 * s, va_list * args);
424 u8 *format_ikev2_transform_prf_type (u8 * s, va_list * args);
425 u8 *format_ikev2_transform_integ_type (u8 * s, va_list * args);
426 u8 *format_ikev2_transform_dh_type (u8 * s, va_list * args);
427 u8 *format_ikev2_transform_esn_type (u8 * s, va_list * args);
428 u8 *format_ikev2_sa_transform (u8 * s, va_list * args);
430 uword unformat_ikev2_auth_method (unformat_input_t * input, va_list * args);
431 uword unformat_ikev2_id_type (unformat_input_t * input, va_list * args);
432 uword unformat_ikev2_transform_type (unformat_input_t * input,
434 uword unformat_ikev2_transform_encr_type (unformat_input_t * input,
436 uword unformat_ikev2_transform_prf_type (unformat_input_t * input,
438 uword unformat_ikev2_transform_integ_type (unformat_input_t * input,
440 uword unformat_ikev2_transform_dh_type (unformat_input_t * input,
442 uword unformat_ikev2_transform_esn_type (unformat_input_t * input,
445 clib_error_t *ikev2_set_liveness_params (u32 period, u32 max_retries);
447 #endif /* __included_ikev2_h__ */
451 * fd.io coding-style-patch-verification: ON
454 * eval: (c-set-style "gnu")