src/plugins/ikev2/ikev2_priv.h

   1 /*
   2  * Copyright (c) 2015 Cisco and/or its affiliates.
   3  * Licensed under the Apache License, Version 2.0 (the "License");
   4  * you may not use this file except in compliance with the License.
   5  * You may obtain a copy of the License at:
   6  *
   7  *     http://www.apache.org/licenses/LICENSE-2.0
   8  *
   9  * Unless required by applicable law or agreed to in writing, software
  10  * distributed under the License is distributed on an "AS IS" BASIS,
  11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12  * See the License for the specific language governing permissions and
  13  * limitations under the License.
  14  */
  15 #ifndef __included_ikev2_priv_h__
  16 #define __included_ikev2_priv_h__
  17
  18 #include <vnet/vnet.h>
  19 #include <vnet/ip/ip.h>
  20 #include <vnet/ethernet/ethernet.h>
  21
  22 #include <plugins/ikev2/ikev2.h>
  23
  24 #include <vppinfra/hash.h>
  25 #include <vppinfra/elog.h>
  26 #include <vppinfra/error.h>
  27
  28 #include <openssl/rand.h>
  29 #include <openssl/dh.h>
  30 #include <openssl/hmac.h>
  31 #include <openssl/evp.h>
  32
  33 #define foreach_ikev2_log_level \
  34   _(0x00, LOG_NONE)             \
  35   _(0x01, LOG_ERROR)            \
  36   _(0x02, LOG_WARNING)          \
  37   _(0x03, LOG_INFO)             \
  38   _(0x04, LOG_DEBUG)            \
  39   _(0x05, LOG_DETAIL)           \
  40
  41
  42 typedef enum ikev2_log_level_t_
  43 {
  44 #define _(n,f) IKEV2_##f = n,
  45   foreach_ikev2_log_level
  46 #undef _
  47   IKEV2_LOG_MAX
  48 } ikev2_log_level_t;
  49
  50 /* dataplane logging */
  51 #define _ikev2_elog(_level, _msg)                                             \
  52 do {                                                                          \
  53   ikev2_main_t *km = &ikev2_main;                                             \
  54   if (PREDICT_FALSE (km->log_level >= _level))                                \
  55     {                                                                         \
  56       ELOG_TYPE_DECLARE (e) =                                                 \
  57         {                                                                     \
  58           .format = "ikev2 " _msg,                                            \
  59           .format_args = "",                                                  \
  60         };                                                                    \
  61       ELOG_DATA (&vlib_global_main.elog_main, e);                             \
  62     }                                                                         \
  63 } while (0)
  64
  65 #define ikev2_elog_sa_state(_format, _ispi)                                   \
  66 do {                                                                          \
  67   ikev2_main_t *km = &ikev2_main;                                             \
  68   if (PREDICT_FALSE (km->log_level >= IKEV2_LOG_DEBUG))                       \
  69     {                                                                         \
  70       ELOG_TYPE_DECLARE (e) =                                                 \
  71         {                                                                     \
  72           .format = "ikev2: " _format,                                        \
  73           .format_args = "i8",                                                \
  74         };                                                                    \
  75       CLIB_PACKED(struct                                                      \
  76         {                                                                     \
  77           u64 ispi;                                                           \
  78         }) *ed;                                                               \
  79       ed = ELOG_DATA (&vlib_global_main.elog_main, e);                        \
  80       ed->ispi = _ispi;                                                       \
  81     }                                                                         \
  82 } while (0)                                                                   \
  83
  84 #define ikev2_elog_exchange_internal(_format, _ispi, _rspi, _addr)            \
  85 do {                                                                          \
  86   ikev2_main_t *km = &ikev2_main;                                             \
  87   if (PREDICT_FALSE (km->log_level >= IKEV2_LOG_DEBUG))                       \
  88     {                                                                         \
  89       ELOG_TYPE_DECLARE (e) =                                                 \
  90         {                                                                     \
  91           .format = "ikev2: " _format,                                        \
  92           .format_args = "i8i8i1i1i1i1",                                      \
  93         };                                                                    \
  94       CLIB_PACKED(struct                                                      \
  95         {                                                                     \
  96           u64 ispi;                                                           \
  97           u64 rspi;                                                           \
  98           u8 oct1;                                                            \
  99           u8 oct2;                                                            \
 100           u8 oct3;                                                            \
 101           u8 oct4;                                                            \
 102         }) *ed;                                                               \
 103       ed = ELOG_DATA (&vlib_global_main.elog_main, e);                        \
 104       ed->ispi = _ispi;                                                       \
 105       ed->rspi = _rspi;                                                       \
 106       ed->oct4 = (_addr) >> 24;                                               \
 107       ed->oct3 = (_addr) >> 16;                                               \
 108       ed->oct2 = (_addr) >> 8;                                                \
 109       ed->oct1 = (_addr);                                                     \
 110     }                                                                         \
 111 } while (0)                                                                   \
 112
 113 #define IKE_ELOG_IP4_FMT "%d.%d.%d.%d"
 114 #define IKE_ELOG_IP6_FMT "[v6]:%x%x:%x%x"
 115
 116 #define ikev2_elog_exchange(_fmt, _ispi, _rspi, _addr, _v4)                   \
 117 do {                                                                          \
 118   if (_v4)                                                                    \
 119     ikev2_elog_exchange_internal (_fmt IKE_ELOG_IP4_FMT, _ispi, _rspi, _addr);\
 120   else                                                                        \
 121     ikev2_elog_exchange_internal (_fmt IKE_ELOG_IP6_FMT, _ispi, _rspi, _addr);\
 122 } while (0)
 123
 124 #define ikev2_elog_uint(_level, _format, _val)                                \
 125 do {                                                                          \
 126   ikev2_main_t *km = &ikev2_main;                                             \
 127   if (PREDICT_FALSE (km->log_level >= _level))                                \
 128     {                                                                         \
 129       ELOG_TYPE_DECLARE (e) =                                                 \
 130         {                                                                     \
 131           .format = "ikev2: " _format,                                        \
 132           .format_args = "i8",                                                \
 133         };                                                                    \
 134       CLIB_PACKED(struct                                                      \
 135         {                                                                     \
 136           u64 val;                                                            \
 137         }) *ed;                                                               \
 138       ed = ELOG_DATA (&vlib_global_main.elog_main, e);                        \
 139       ed->val = _val;                                                         \
 140     }                                                                         \
 141 } while (0)
 142
 143 #define ikev2_elog_uint_peers(_level, _format, _val, _ip1, _ip2)              \
 144 do {                                                                          \
 145   ikev2_main_t *km = &ikev2_main;                                             \
 146   if (PREDICT_FALSE (km->log_level >= _level))                                \
 147     {                                                                         \
 148       ELOG_TYPE_DECLARE (e) =                                                 \
 149         {                                                                     \
 150           .format = "ikev2: " _format,                                        \
 151           .format_args = "i8i1i1i1i1i1i1i1i1",                                \
 152         };                                                                    \
 153       CLIB_PACKED(struct {                                                    \
 154         u64 val;                                                              \
 155         u8 i11; u8 i12; u8 i13; u8 i14;                                       \
 156         u8 i21; u8 i22; u8 i23; u8 i24; }) *ed;                               \
 157       ed = ELOG_DATA (&vlib_global_main.elog_main, e);                        \
 158       ed->val = _val;                                                         \
 159       ed->i14 = (_ip1) >> 24;                                                 \
 160       ed->i13 = (_ip1) >> 16;                                                 \
 161       ed->i12 = (_ip1) >> 8;                                                  \
 162       ed->i11 = (_ip1);                                                       \
 163       ed->i24 = (_ip2) >> 24;                                                 \
 164       ed->i23 = (_ip2) >> 16;                                                 \
 165       ed->i22 = (_ip2) >> 8;                                                  \
 166       ed->i21 = (_ip2);                                                       \
 167     }                                                                         \
 168 } while (0)
 169
 170 #define ikev2_elog_error(_msg) \
 171   _ikev2_elog(IKEV2_LOG_ERROR, "[error] " _msg)
 172 #define ikev2_elog_warning(_msg) \
 173   _ikev2_elog(IKEV2_LOG_WARNING, "[warning] " _msg)
 174 #define ikev2_elog_debug(_msg) \
 175   _ikev2_elog(IKEV2_LOG_DEBUG, "[debug] " _msg)
 176 #define ikev2_elog_detail(_msg) \
 177   _ikev2_elog(IKEV2_LOG_DETAIL, "[detail] " _msg)
 178
 179 /* logging for main thread */
 180 #define ikev2_log_error(...) \
 181   vlib_log(VLIB_LOG_LEVEL_ERR, ikev2_main.log_class, __VA_ARGS__)
 182 #define ikev2_log_warning(...) \
 183   vlib_log(VLIB_LOG_LEVEL_WARNING, ikev2_main.log_class, __VA_ARGS__)
 184 #define ikev2_log_debug(...) \
 185   vlib_log(VLIB_LOG_LEVEL_DEBUG, ikev2_main.log_class, __VA_ARGS__)
 186
 187 #define foreach_ikev2_state                                                   \
 188   _ (0, UNKNOWN, "UNKNOWN")                                                   \
 189   _ (1, SA_INIT, "SA_INIT")                                                   \
 190   _ (2, DELETED, "DELETED")                                                   \
 191   _ (3, AUTH_FAILED, "AUTH_FAILED")                                           \
 192   _ (4, AUTHENTICATED, "AUTHENTICATED")                                       \
 193   _ (5, NOTIFY_AND_DELETE, "NOTIFY_AND_DELETE")                               \
 194   _ (6, TS_UNACCEPTABLE, "TS_UNACCEPTABLE")                                   \
 195   _ (7, NO_PROPOSAL_CHOSEN, "NO_PROPOSAL_CHOSEN")
 196
 197 typedef enum
 198 {
 199 #define _(v, f, s) IKEV2_STATE_##f = v,
 200   foreach_ikev2_state
 201 #undef _
 202 } ikev2_state_t;
 203
 204 typedef struct
 205 {
 206   ikev2_auth_method_t method:8;
 207   u8 *data;
 208   u8 hex;                       /* hex encoding of the shared secret */
 209   EVP_PKEY *key;
 210 } ikev2_auth_t;
 211
 212 typedef enum
 213 {
 214   IKEV2_DH_GROUP_MODP = 0,
 215   IKEV2_DH_GROUP_ECP = 1,
 216 } ikev2_dh_group_t;
 217
 218 typedef struct
 219 {
 220   ikev2_transform_type_t type;
 221   union
 222   {
 223     u16 transform_id;
 224     ikev2_transform_encr_type_t encr_type:16;
 225     ikev2_transform_prf_type_t prf_type:16;
 226     ikev2_transform_integ_type_t integ_type:16;
 227     ikev2_transform_dh_type_t dh_type:16;
 228     ikev2_transform_esn_type_t esn_type:16;
 229   };
 230   u8 *attrs;
 231   u16 key_len;
 232   u16 key_trunc;
 233   u16 block_size;
 234   u8 dh_group;
 235   int nid;
 236   const char *dh_p;
 237   const char *dh_g;
 238   const void *md;
 239   const void *cipher;
 240 } ikev2_sa_transform_t;
 241
 242 typedef struct
 243 {
 244   u8 proposal_num;
 245   ikev2_protocol_id_t protocol_id:8;
 246   u64 spi;
 247   ikev2_sa_transform_t *transforms;
 248 } ikev2_sa_proposal_t;
 249
 250 typedef struct
 251 {
 252   ikev2_traffic_selector_type_t ts_type;
 253   u8 protocol_id;
 254   u16 selector_len;
 255   u16 start_port;
 256   u16 end_port;
 257   ip_address_t start_addr;
 258   ip_address_t end_addr;
 259 } ikev2_ts_t;
 260
 261 typedef struct
 262 {
 263   u32 sw_if_index;
 264   ip_address_t addr;
 265   u8 *hostname;
 266   u8 is_resolved;
 267 } ikev2_responder_t;
 268
 269 typedef struct
 270 {
 271   ikev2_transform_encr_type_t crypto_alg;
 272   ikev2_transform_integ_type_t integ_alg;
 273   ikev2_transform_dh_type_t dh_type;
 274   u32 crypto_key_size;
 275 } ikev2_transforms_set;
 276
 277
 278 typedef struct
 279 {
 280   ikev2_id_type_t type:8;
 281   u8 *data;
 282 } ikev2_id_t;
 283
 284 typedef struct
 285 {
 286   /* sa proposals vectors */
 287   ikev2_sa_proposal_t *i_proposals;
 288   ikev2_sa_proposal_t *r_proposals;
 289
 290   /* Traffic Selectors */
 291   ikev2_ts_t *tsi;
 292   ikev2_ts_t *tsr;
 293
 294   /* keys */
 295   u8 *sk_ai;
 296   u8 *sk_ar;
 297   u8 *sk_ei;
 298   u8 *sk_er;
 299   u32 salt_ei;
 300   u32 salt_er;
 301
 302   /* installed data */
 303   u32 local_sa_id;
 304   u32 remote_sa_id;
 305
 306   /* lifetime data */
 307   f64 time_to_expiration;
 308   u8 is_expired;
 309   i8 rekey_retries;
 310
 311   f64 timestamp;
 312 } ikev2_child_sa_t;
 313
 314 typedef struct
 315 {
 316   u8 protocol_id;
 317   u32 spi;                      /*for ESP and AH SPI size is 4, for IKE size is 0 */
 318 } ikev2_delete_t;
 319
 320 typedef struct
 321 {
 322   u16 notify_type;
 323   u8 kex;
 324   u8 protocol_id;
 325   u32 spi;
 326   u32 ispi;
 327   ikev2_sa_proposal_t *i_proposal;
 328   ikev2_sa_proposal_t *r_proposal;
 329   ikev2_ts_t *tsi;
 330   ikev2_ts_t *tsr;
 331 } ikev2_rekey_t;
 332
 333 typedef struct
 334 {
 335   u16 notify_type;
 336   u16 dh_group;
 337   u64 ispi;
 338   u64 rspi;
 339   u8 *i_nonce;
 340   u8 *r_nonce;
 341   u8 *dh_shared_key;
 342   u8 *dh_private_key;
 343   u8 *i_dh_data;
 344   u8 *r_dh_data;
 345   ikev2_sa_proposal_t *i_proposals;
 346   ikev2_sa_proposal_t *r_proposals;
 347 } ikev2_sa_rekey_t;
 348
 349 typedef struct
 350 {
 351   u16 msg_type;
 352   u8 protocol_id;
 353   u32 spi;
 354   u8 *data;
 355 } ikev2_notify_t;
 356
 357 typedef struct
 358 {
 359   u8 *name;
 360
 361   ikev2_auth_t auth;
 362   ikev2_id_t loc_id;
 363   ikev2_id_t rem_id;
 364   ikev2_ts_t loc_ts;
 365   ikev2_ts_t rem_ts;
 366   ikev2_responder_t responder;
 367   ikev2_transforms_set ike_ts;
 368   ikev2_transforms_set esp_ts;
 369   u64 lifetime;
 370   u64 lifetime_maxdata;
 371   u32 lifetime_jitter;
 372   u32 handover;
 373   u16 ipsec_over_udp_port;
 374
 375   u32 tun_itf;
 376   u8 udp_encap;
 377   u8 natt_disabled;
 378 } ikev2_profile_t;
 379
 380 typedef enum
 381 {
 382   /* SA will switch to port 4500 when NAT is detected.
 383    * This is the default. */
 384   IKEV2_NATT_ENABLED,
 385
 386   /* Do nothing when NAT is detected */
 387   IKEV2_NATT_DISABLED,
 388
 389   /* NAT was detected and port switched to 4500 */
 390   IKEV2_NATT_ACTIVE,
 391 } ikev2_natt_state_t;
 392
 393 #define ikev2_natt_active(_sa) ((_sa)->natt_state == IKEV2_NATT_ACTIVE)
 394
 395 typedef struct
 396 {
 397   u16 n_keepalives;
 398   u16 n_rekey_req;
 399   u16 n_sa_auth_req;
 400   u16 n_sa_init_req;
 401   u16 n_init_retransmit;
 402   u16 n_retransmit;
 403 } ikev2_stats_t;
 404
 405 typedef struct
 406 {
 407   ikev2_state_t state;
 408   u8 unsupported_cp;
 409   u8 initial_contact;
 410   ip_address_t iaddr;
 411   ip_address_t raddr;
 412   u64 ispi;
 413   u64 rspi;
 414   u8 *i_nonce;
 415   u8 *r_nonce;
 416
 417   /* DH data */
 418   u16 dh_group;
 419   u8 *dh_shared_key;
 420   u8 *dh_private_key;
 421   u8 *i_dh_data;
 422   u8 *r_dh_data;
 423
 424   /* sa proposals vectors */
 425   ikev2_sa_proposal_t *i_proposals;
 426   ikev2_sa_proposal_t *r_proposals;
 427
 428   /* keys */
 429   u8 *sk_d;
 430   u8 *sk_ai;
 431   u8 *sk_ar;
 432   u8 *sk_ei;
 433   u8 *sk_er;
 434   u8 *sk_pi;
 435   u8 *sk_pr;
 436
 437   /* auth */
 438   ikev2_auth_t i_auth;
 439   ikev2_auth_t r_auth;
 440
 441   /* ID */
 442   ikev2_id_t i_id;
 443   ikev2_id_t r_id;
 444
 445   /* pending deletes */
 446   ikev2_delete_t *del;
 447
 448   /* pending rekeyings */
 449   ikev2_rekey_t *rekey;
 450
 451   ikev2_rekey_t *new_child;
 452
 453   /* pending sa rekeyings */
 454   ikev2_sa_rekey_t *sa_rekey;
 455
 456   /* packet data */
 457   u8 *last_sa_init_req_packet_data;
 458   u8 *last_sa_init_res_packet_data;
 459
 460   /* retransmit */
 461   /* message id expected in the request from the other peer */
 462   u32 last_msg_id;
 463   u8 *last_res_packet_data;
 464
 465   u8 is_initiator;
 466   /* last message id that was used for an initiated request */
 467   u32 last_init_msg_id;
 468   u32 profile_index;
 469   u8 is_tun_itf_set;
 470   u32 tun_itf;
 471   u8 udp_encap;
 472   u16 ipsec_over_udp_port;
 473
 474   f64 old_id_expiration;
 475   u32 current_remote_id_mask;
 476   u32 old_remote_id;
 477   u8 old_remote_id_present;
 478   u8 init_response_received;
 479
 480   ikev2_child_sa_t *childs;
 481
 482   u8 liveness_retries;
 483   f64 liveness_period_check;
 484
 485   u16 dst_port;
 486   u32 sw_if_index;
 487
 488   /* is NAT traversal mode */
 489   ikev2_natt_state_t natt_state;
 490   u8 keys_generated;
 491
 492   ikev2_stats_t stats;
 493
 494   f64 auth_timestamp;
 495 } ikev2_sa_t;
 496
 497
 498 typedef struct
 499 {
 500   CLIB_CACHE_LINE_ALIGN_MARK (cacheline0);
 501
 502   /* pool of IKEv2 Security Associations */
 503   ikev2_sa_t *sas;
 504
 505   /* hash */
 506   uword *sa_by_rspi;
 507
 508   EVP_CIPHER_CTX *evp_ctx;
 509   HMAC_CTX *hmac_ctx;
 510 #if OPENSSL_VERSION_NUMBER < 0x10100000L
 511   HMAC_CTX _hmac_ctx;
 512   EVP_CIPHER_CTX _evp_ctx;
 513 #endif
 514 } ikev2_main_per_thread_data_t;
 515
 516 typedef struct
 517 {
 518   /* pool of IKEv2 profiles */
 519   ikev2_profile_t *profiles;
 520
 521   /* vector of supported transform types */
 522   ikev2_sa_transform_t *supported_transforms;
 523
 524   /* hash */
 525   mhash_t profile_index_by_name;
 526
 527   /* local private key */
 528   EVP_PKEY *pkey;
 529
 530   /* convenience */
 531   vlib_main_t *vlib_main;
 532   vnet_main_t *vnet_main;
 533
 534   /* pool of IKEv2 Security Associations created in initiator mode */
 535   ikev2_sa_t *sais;
 536   /* hash */
 537   uword *sa_by_ispi;
 538
 539   ikev2_main_per_thread_data_t *per_thread_data;
 540
 541   /* interface indices managed by IKE */
 542   uword *sw_if_indices;
 543
 544   /* API message ID base */
 545   u16 msg_id_base;
 546
 547   /* log class used for main thread */
 548   vlib_log_class_t log_class;
 549
 550   /* logging level */
 551   ikev2_log_level_t log_level;
 552
 553   /* how often a liveness check will be performed */
 554   u32 liveness_period;
 555
 556   /* max number of retries before considering peer dead */
 557   u32 liveness_max_retries;
 558
 559   /* dead peer detection */
 560   u8 dpd_disabled;
 561
 562   /* pointer to name resolver function in dns plugin */
 563   void *dns_resolve_name_ptr;
 564
 565   /* flag indicating whether lazy init is done or not */
 566   int lazy_init_done;
 567
 568   /* refcount for IKEv2 udp ports and IPsec NATT punt registration */
 569   int bind_refcount;
 570
 571   /* punt handle for IPsec NATT IPSEC_PUNT_IP4_SPI_UDP_0 reason */
 572   vlib_punt_hdl_t punt_hdl;
 573
 574 } ikev2_main_t;
 575
 576 extern ikev2_main_t ikev2_main;
 577
 578 void ikev2_sa_free_proposal_vector (ikev2_sa_proposal_t ** v);
 579 ikev2_sa_transform_t *ikev2_sa_get_td_for_type (ikev2_sa_proposal_t * p,
 580                                                 ikev2_transform_type_t type);
 581
 582 /* ikev2_crypto.c */
 583 v8 *ikev2_calc_prf (ikev2_sa_transform_t * tr, v8 * key, v8 * data);
 584 u8 *ikev2_calc_prfplus (ikev2_sa_transform_t * tr, u8 * key, u8 * seed,
 585                         int len);
 586 v8 *ikev2_calc_integr (ikev2_sa_transform_t * tr, v8 * key, u8 * data,
 587                        int len);
 588 int ikev2_decrypt_data (ikev2_main_per_thread_data_t * ptd, ikev2_sa_t * sa,
 589                         ikev2_sa_transform_t * tr_encr, u8 * data, int len,
 590                         u32 * out_len);
 591 int ikev2_encrypt_data (ikev2_main_per_thread_data_t * ptd, ikev2_sa_t * sa,
 592                         ikev2_sa_transform_t * tr_encr, v8 * src, u8 * dst);
 593 int ikev2_encrypt_aead_data (ikev2_main_per_thread_data_t * ptd,
 594                              ikev2_sa_t * sa, ikev2_sa_transform_t * tr_encr,
 595                              v8 * src, u8 * dst, u8 * aad,
 596                              u32 aad_len, u8 * tag);
 597 int ikev2_decrypt_aead_data (ikev2_main_per_thread_data_t * ptd,
 598                              ikev2_sa_t * sa, ikev2_sa_transform_t * tr_encr,
 599                              u8 * data, int data_len, u8 * aad, u32 aad_len,
 600                              u8 * tag, u32 * out_len);
 601 void ikev2_generate_dh (ikev2_sa_t * sa, ikev2_sa_transform_t * t);
 602 void ikev2_complete_dh (ikev2_sa_t * sa, ikev2_sa_transform_t * t);
 603 int ikev2_verify_sign (EVP_PKEY * pkey, u8 * sigbuf, u8 * data);
 604 u8 *ikev2_calc_sign (EVP_PKEY * pkey, u8 * data);
 605 EVP_PKEY *ikev2_load_cert_file (u8 * file);
 606 EVP_PKEY *ikev2_load_key_file (u8 * file);
 607 void ikev2_crypto_init (ikev2_main_t * km);
 608
 609 /* ikev2_payload.c */
 610 typedef struct
 611 {
 612   u8 first_payload_type;
 613   u16 last_hdr_off;
 614   u8 *data;
 615 } ikev2_payload_chain_t;
 616
 617 #define ikev2_payload_new_chain(V) vec_validate (V, 0)
 618 #define ikev2_payload_destroy_chain(V) do { \
 619   vec_free((V)->data);                 \
 620   vec_free(V);                         \
 621 } while (0)
 622
 623 void ikev2_payload_add_notify (ikev2_payload_chain_t * c, u16 msg_type,
 624                                u8 * data);
 625 void ikev2_payload_add_notify_2 (ikev2_payload_chain_t * c, u16 msg_type,
 626                                  u8 * data, ikev2_notify_t * notify);
 627 void ikev2_payload_add_sa (ikev2_payload_chain_t *c,
 628                            ikev2_sa_proposal_t *proposals, u8 force_spi);
 629 void ikev2_payload_add_ke (ikev2_payload_chain_t * c, u16 dh_group,
 630                            u8 * dh_data);
 631 void ikev2_payload_add_nonce (ikev2_payload_chain_t * c, u8 * nonce);
 632 void ikev2_payload_add_id (ikev2_payload_chain_t * c, ikev2_id_t * id,
 633                            u8 type);
 634 void ikev2_payload_add_auth (ikev2_payload_chain_t * c, ikev2_auth_t * auth);
 635 void ikev2_payload_add_ts (ikev2_payload_chain_t * c, ikev2_ts_t * ts,
 636                            u8 type);
 637 void ikev2_payload_add_delete (ikev2_payload_chain_t * c, ikev2_delete_t * d);
 638 void ikev2_payload_chain_add_padding (ikev2_payload_chain_t * c, int bs);
 639 void ikev2_parse_vendor_payload (ike_payload_header_t * ikep);
 640 ikev2_sa_proposal_t *ikev2_parse_sa_payload (ike_payload_header_t * ikep,
 641                                              u32 rlen);
 642 ikev2_ts_t *ikev2_parse_ts_payload (ike_payload_header_t * ikep, u32 rlen);
 643 ikev2_delete_t *ikev2_parse_delete_payload (ike_payload_header_t * ikep,
 644                                             u32 rlen);
 645 ikev2_notify_t *ikev2_parse_notify_payload (ike_payload_header_t * ikep,
 646                                             u32 rlen);
 647 int ikev2_set_log_level (ikev2_log_level_t log_level);
 648 u8 *ikev2_find_ike_notify_payload (ike_header_t * ike, u32 msg_type);
 649 void ikev2_disable_dpd (void);
 650 clib_error_t *ikev2_profile_natt_disable (u8 * name);
 651
 652 static_always_inline ikev2_main_per_thread_data_t *
 653 ikev2_get_per_thread_data ()
 654 {
 655   u32 thread_index = vlib_get_thread_index ();
 656   return vec_elt_at_index (ikev2_main.per_thread_data, thread_index);
 657 }
 658 #endif /* __included_ikev2_priv_h__ */
 659
 660
 661 /*
 662  * fd.io coding-style-patch-verification: ON
 663  *
 664  * Local Variables:
 665  * eval: (c-set-style "gnu")
 666  * End:
 667  */