Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (c) 2015 Cisco and/or its affiliates. |
| 3 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | * you may not use this file except in compliance with the License. |
| 5 | * You may obtain a copy of the License at: |
| 6 | * |
| 7 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | * |
| 9 | * Unless required by applicable law or agreed to in writing, software |
| 10 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | * See the License for the specific language governing permissions and |
| 13 | * limitations under the License. |
| 14 | */ |
| 15 | |
| 16 | #include <vlib/vlib.h> |
| 17 | #include <vnet/vnet.h> |
| 18 | #include <vnet/pg/pg.h> |
| 19 | #include <vppinfra/error.h> |
Chris Luke | ab7b8d9 | 2017-09-07 07:40:13 -0400 | [diff] [blame] | 20 | #include <vppinfra/random.h> |
Dave Barach | 68b0fb0 | 2017-02-28 15:15:56 -0500 | [diff] [blame] | 21 | #include <vnet/udp/udp.h> |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 22 | #include <vnet/ipsec/ipsec.h> |
| 23 | #include <vnet/ipsec/ikev2.h> |
| 24 | #include <vnet/ipsec/ikev2_priv.h> |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 25 | #include <openssl/sha.h> |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 26 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 27 | static int ikev2_delete_tunnel_interface (vnet_main_t * vnm, |
| 28 | ikev2_sa_t * sa, |
| 29 | ikev2_child_sa_t * child); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 30 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 31 | #define ikev2_set_state(sa, v) do { \ |
| 32 | (sa)->state = v; \ |
| 33 | clib_warning("sa state changed to " #v); \ |
| 34 | } while(0); |
| 35 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 36 | typedef struct |
| 37 | { |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 38 | u32 next_index; |
| 39 | u32 sw_if_index; |
| 40 | } ikev2_trace_t; |
| 41 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 42 | static u8 * |
| 43 | format_ikev2_trace (u8 * s, va_list * args) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 44 | { |
| 45 | CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *); |
| 46 | CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 47 | ikev2_trace_t *t = va_arg (*args, ikev2_trace_t *); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 48 | |
| 49 | s = format (s, "ikev2: sw_if_index %d, next index %d", |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 50 | t->sw_if_index, t->next_index); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 51 | return s; |
| 52 | } |
| 53 | |
Jean-Mickael Guerin | 8941ec2 | 2016-03-04 14:14:21 +0100 | [diff] [blame] | 54 | static vlib_node_registration_t ikev2_node; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 55 | |
| 56 | #define foreach_ikev2_error \ |
| 57 | _(PROCESSED, "IKEv2 packets processed") \ |
| 58 | _(IKE_SA_INIT_RETRANSMIT, "IKE_SA_INIT retransmit ") \ |
| 59 | _(IKE_SA_INIT_IGNORE, "IKE_SA_INIT ignore (IKE SA already auth)") \ |
| 60 | _(IKE_REQ_RETRANSMIT, "IKE request retransmit") \ |
| 61 | _(IKE_REQ_IGNORE, "IKE request ignore (old msgid)") \ |
| 62 | _(NOT_IKEV2, "Non IKEv2 packets received") |
| 63 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 64 | typedef enum |
| 65 | { |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 66 | #define _(sym,str) IKEV2_ERROR_##sym, |
| 67 | foreach_ikev2_error |
| 68 | #undef _ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 69 | IKEV2_N_ERROR, |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 70 | } ikev2_error_t; |
| 71 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 72 | static char *ikev2_error_strings[] = { |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 73 | #define _(sym,string) string, |
| 74 | foreach_ikev2_error |
| 75 | #undef _ |
| 76 | }; |
| 77 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 78 | typedef enum |
| 79 | { |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 80 | IKEV2_NEXT_IP4_LOOKUP, |
| 81 | IKEV2_NEXT_ERROR_DROP, |
| 82 | IKEV2_N_NEXT, |
| 83 | } ikev2_next_t; |
| 84 | |
| 85 | static ikev2_sa_transform_t * |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 86 | ikev2_find_transform_data (ikev2_sa_transform_t * t) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 87 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 88 | ikev2_main_t *km = &ikev2_main; |
| 89 | ikev2_sa_transform_t *td; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 90 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 91 | vec_foreach (td, km->supported_transforms) |
| 92 | { |
| 93 | if (td->type != t->type) |
| 94 | continue; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 95 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 96 | if (td->transform_id != t->transform_id) |
| 97 | continue; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 98 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 99 | if (td->type == IKEV2_TRANSFORM_TYPE_ENCR) |
| 100 | { |
| 101 | if (vec_len (t->attrs) != 4 || t->attrs[0] != 0x80 |
| 102 | || t->attrs[1] != 14) |
| 103 | continue; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 104 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 105 | if (((t->attrs[2] << 8 | t->attrs[3]) / 8) != td->key_len) |
| 106 | continue; |
| 107 | } |
| 108 | return td; |
| 109 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 110 | return 0; |
| 111 | } |
| 112 | |
| 113 | static ikev2_sa_proposal_t * |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 114 | ikev2_select_proposal (ikev2_sa_proposal_t * proposals, |
| 115 | ikev2_protocol_id_t prot_id) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 116 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 117 | ikev2_sa_proposal_t *rv = 0; |
| 118 | ikev2_sa_proposal_t *proposal; |
| 119 | ikev2_sa_transform_t *transform, *new_t; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 120 | u8 mandatory_bitmap, optional_bitmap; |
| 121 | |
| 122 | if (prot_id == IKEV2_PROTOCOL_IKE) |
| 123 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 124 | mandatory_bitmap = (1 << IKEV2_TRANSFORM_TYPE_ENCR) | |
| 125 | (1 << IKEV2_TRANSFORM_TYPE_PRF) | |
| 126 | (1 << IKEV2_TRANSFORM_TYPE_INTEG) | (1 << IKEV2_TRANSFORM_TYPE_DH); |
| 127 | optional_bitmap = mandatory_bitmap; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 128 | } |
| 129 | else if (prot_id == IKEV2_PROTOCOL_ESP) |
| 130 | { |
| 131 | mandatory_bitmap = (1 << IKEV2_TRANSFORM_TYPE_ENCR) | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 132 | (1 << IKEV2_TRANSFORM_TYPE_ESN); |
| 133 | optional_bitmap = mandatory_bitmap | |
| 134 | (1 << IKEV2_TRANSFORM_TYPE_INTEG) | (1 << IKEV2_TRANSFORM_TYPE_DH); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 135 | } |
| 136 | else if (prot_id == IKEV2_PROTOCOL_AH) |
| 137 | { |
| 138 | mandatory_bitmap = (1 << IKEV2_TRANSFORM_TYPE_INTEG) | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 139 | (1 << IKEV2_TRANSFORM_TYPE_ESN); |
| 140 | optional_bitmap = mandatory_bitmap | (1 << IKEV2_TRANSFORM_TYPE_DH); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 141 | } |
| 142 | else |
| 143 | return 0; |
| 144 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 145 | vec_add2 (rv, proposal, 1); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 146 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 147 | vec_foreach (proposal, proposals) |
| 148 | { |
| 149 | u8 bitmap = 0; |
| 150 | if (proposal->protocol_id != prot_id) |
| 151 | continue; |
| 152 | |
| 153 | vec_foreach (transform, proposal->transforms) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 154 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 155 | if ((1 << transform->type) & bitmap) |
| 156 | continue; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 157 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 158 | if (ikev2_find_transform_data (transform)) |
| 159 | { |
| 160 | bitmap |= 1 << transform->type; |
| 161 | vec_add2 (rv->transforms, new_t, 1); |
| 162 | clib_memcpy (new_t, transform, sizeof (*new_t)); |
| 163 | new_t->attrs = vec_dup (transform->attrs); |
| 164 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 165 | } |
| 166 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 167 | clib_warning ("bitmap is %x mandatory is %x optional is %x", |
| 168 | bitmap, mandatory_bitmap, optional_bitmap); |
| 169 | |
| 170 | if ((bitmap & mandatory_bitmap) == mandatory_bitmap && |
| 171 | (bitmap & ~optional_bitmap) == 0) |
| 172 | { |
| 173 | rv->proposal_num = proposal->proposal_num; |
| 174 | rv->protocol_id = proposal->protocol_id; |
| 175 | RAND_bytes ((u8 *) & rv->spi, sizeof (rv->spi)); |
| 176 | goto done; |
| 177 | } |
| 178 | else |
| 179 | { |
| 180 | vec_free (rv->transforms); |
| 181 | } |
| 182 | } |
| 183 | |
| 184 | vec_free (rv); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 185 | done: |
| 186 | return rv; |
| 187 | } |
| 188 | |
| 189 | ikev2_sa_transform_t * |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 190 | ikev2_sa_get_td_for_type (ikev2_sa_proposal_t * p, |
| 191 | ikev2_transform_type_t type) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 192 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 193 | ikev2_sa_transform_t *t; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 194 | |
| 195 | if (!p) |
| 196 | return 0; |
| 197 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 198 | vec_foreach (t, p->transforms) |
| 199 | { |
| 200 | if (t->type == type) |
| 201 | return ikev2_find_transform_data (t); |
| 202 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 203 | return 0; |
| 204 | } |
| 205 | |
| 206 | ikev2_child_sa_t * |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 207 | ikev2_sa_get_child (ikev2_sa_t * sa, u32 spi, ikev2_protocol_id_t prot_id, |
| 208 | int by_initiator) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 209 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 210 | ikev2_child_sa_t *c; |
| 211 | vec_foreach (c, sa->childs) |
| 212 | { |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 213 | ikev2_sa_proposal_t *proposal = |
| 214 | by_initiator ? &c->i_proposals[0] : &c->r_proposals[0]; |
| 215 | if (proposal && proposal->spi == spi && proposal->protocol_id == prot_id) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 216 | return c; |
| 217 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 218 | |
| 219 | return 0; |
| 220 | } |
| 221 | |
| 222 | void |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 223 | ikev2_sa_free_proposal_vector (ikev2_sa_proposal_t ** v) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 224 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 225 | ikev2_sa_proposal_t *p; |
| 226 | ikev2_sa_transform_t *t; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 227 | |
| 228 | if (!*v) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 229 | return; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 230 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 231 | vec_foreach (p, *v) |
| 232 | { |
| 233 | vec_foreach (t, p->transforms) |
| 234 | { |
| 235 | vec_free (t->attrs); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 236 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 237 | vec_free (p->transforms); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 238 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 239 | vec_free (*v); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 240 | }; |
| 241 | |
| 242 | static void |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 243 | ikev2_sa_free_all_child_sa (ikev2_child_sa_t ** childs) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 244 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 245 | ikev2_child_sa_t *c; |
| 246 | vec_foreach (c, *childs) |
| 247 | { |
| 248 | ikev2_sa_free_proposal_vector (&c->r_proposals); |
| 249 | ikev2_sa_free_proposal_vector (&c->i_proposals); |
| 250 | vec_free (c->sk_ai); |
| 251 | vec_free (c->sk_ar); |
| 252 | vec_free (c->sk_ei); |
| 253 | vec_free (c->sk_er); |
| 254 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 255 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 256 | vec_free (*childs); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 257 | } |
| 258 | |
| 259 | static void |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 260 | ikev2_sa_del_child_sa (ikev2_sa_t * sa, ikev2_child_sa_t * child) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 261 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 262 | ikev2_sa_free_proposal_vector (&child->r_proposals); |
| 263 | ikev2_sa_free_proposal_vector (&child->i_proposals); |
| 264 | vec_free (child->sk_ai); |
| 265 | vec_free (child->sk_ar); |
| 266 | vec_free (child->sk_ei); |
| 267 | vec_free (child->sk_er); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 268 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 269 | vec_del1 (sa->childs, child - sa->childs); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 270 | } |
| 271 | |
| 272 | static void |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 273 | ikev2_sa_free_all_vec (ikev2_sa_t * sa) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 274 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 275 | vec_free (sa->i_nonce); |
| 276 | vec_free (sa->i_dh_data); |
| 277 | vec_free (sa->dh_shared_key); |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 278 | vec_free (sa->dh_private_key); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 279 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 280 | ikev2_sa_free_proposal_vector (&sa->r_proposals); |
| 281 | ikev2_sa_free_proposal_vector (&sa->i_proposals); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 282 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 283 | vec_free (sa->sk_d); |
| 284 | vec_free (sa->sk_ai); |
| 285 | vec_free (sa->sk_ar); |
| 286 | vec_free (sa->sk_ei); |
| 287 | vec_free (sa->sk_er); |
| 288 | vec_free (sa->sk_pi); |
| 289 | vec_free (sa->sk_pr); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 290 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 291 | vec_free (sa->i_id.data); |
| 292 | vec_free (sa->i_auth.data); |
| 293 | vec_free (sa->r_id.data); |
| 294 | vec_free (sa->r_auth.data); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 295 | if (sa->r_auth.key) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 296 | EVP_PKEY_free (sa->r_auth.key); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 297 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 298 | vec_free (sa->del); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 299 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 300 | ikev2_sa_free_all_child_sa (&sa->childs); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 301 | } |
| 302 | |
| 303 | static void |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 304 | ikev2_delete_sa (ikev2_sa_t * sa) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 305 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 306 | ikev2_main_t *km = &ikev2_main; |
Damjan Marion | 586afd7 | 2017-04-05 19:18:20 +0200 | [diff] [blame] | 307 | u32 thread_index = vlib_get_thread_index (); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 308 | uword *p; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 309 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 310 | ikev2_sa_free_all_vec (sa); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 311 | |
Damjan Marion | 586afd7 | 2017-04-05 19:18:20 +0200 | [diff] [blame] | 312 | p = hash_get (km->per_thread_data[thread_index].sa_by_rspi, sa->rspi); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 313 | if (p) |
| 314 | { |
Damjan Marion | 586afd7 | 2017-04-05 19:18:20 +0200 | [diff] [blame] | 315 | hash_unset (km->per_thread_data[thread_index].sa_by_rspi, sa->rspi); |
| 316 | pool_put (km->per_thread_data[thread_index].sas, sa); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 317 | } |
| 318 | } |
| 319 | |
| 320 | static void |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 321 | ikev2_generate_sa_init_data (ikev2_sa_t * sa) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 322 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 323 | ikev2_sa_transform_t *t = 0, *t2; |
| 324 | ikev2_main_t *km = &ikev2_main; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 325 | |
| 326 | if (sa->dh_group == IKEV2_TRANSFORM_DH_TYPE_NONE) |
| 327 | { |
| 328 | return; |
| 329 | } |
| 330 | |
| 331 | /* check if received DH group is on our list of supported groups */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 332 | vec_foreach (t2, km->supported_transforms) |
| 333 | { |
| 334 | if (t2->type == IKEV2_TRANSFORM_TYPE_DH && sa->dh_group == t2->dh_type) |
| 335 | { |
| 336 | t = t2; |
| 337 | break; |
| 338 | } |
| 339 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 340 | |
| 341 | if (!t) |
| 342 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 343 | clib_warning ("unknown dh data group %u (data len %u)", sa->dh_group, |
| 344 | vec_len (sa->i_dh_data)); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 345 | sa->dh_group = IKEV2_TRANSFORM_DH_TYPE_NONE; |
| 346 | return; |
| 347 | } |
| 348 | |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 349 | if (sa->is_initiator) |
| 350 | { |
| 351 | /* generate rspi */ |
| 352 | RAND_bytes ((u8 *) & sa->ispi, 8); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 353 | |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 354 | /* generate nonce */ |
| 355 | sa->i_nonce = vec_new (u8, IKEV2_NONCE_SIZE); |
| 356 | RAND_bytes ((u8 *) sa->i_nonce, IKEV2_NONCE_SIZE); |
| 357 | } |
| 358 | else |
| 359 | { |
| 360 | /* generate rspi */ |
| 361 | RAND_bytes ((u8 *) & sa->rspi, 8); |
| 362 | |
| 363 | /* generate nonce */ |
| 364 | sa->r_nonce = vec_new (u8, IKEV2_NONCE_SIZE); |
| 365 | RAND_bytes ((u8 *) sa->r_nonce, IKEV2_NONCE_SIZE); |
| 366 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 367 | |
| 368 | /* generate dh keys */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 369 | ikev2_generate_dh (sa, t); |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 370 | |
| 371 | } |
| 372 | |
| 373 | static void |
| 374 | ikev2_complete_sa_data (ikev2_sa_t * sa, ikev2_sa_t * sai) |
| 375 | { |
| 376 | ikev2_sa_transform_t *t = 0, *t2; |
| 377 | ikev2_main_t *km = &ikev2_main; |
| 378 | |
| 379 | |
| 380 | /*move some data to the new SA */ |
| 381 | #define _(A) ({void* __tmp__ = (A); (A) = 0; __tmp__;}) |
| 382 | sa->i_nonce = _(sai->i_nonce); |
| 383 | sa->i_dh_data = _(sai->i_dh_data); |
| 384 | sa->dh_private_key = _(sai->dh_private_key); |
| 385 | sa->iaddr.as_u32 = sai->iaddr.as_u32; |
| 386 | sa->raddr.as_u32 = sai->raddr.as_u32; |
| 387 | sa->is_initiator = sai->is_initiator; |
| 388 | sa->profile = sai->profile; |
| 389 | sa->i_id.type = sai->i_id.type; |
| 390 | sa->i_id.data = _(sai->i_id.data); |
| 391 | sa->i_auth.method = sai->i_auth.method; |
| 392 | sa->i_auth.hex = sai->i_auth.hex; |
| 393 | sa->i_auth.data = _(sai->i_auth.data); |
| 394 | sa->i_auth.key = _(sai->i_auth.key); |
| 395 | sa->last_sa_init_req_packet_data = _(sai->last_sa_init_req_packet_data); |
| 396 | sa->childs = _(sai->childs); |
| 397 | #undef _ |
| 398 | |
| 399 | |
| 400 | if (sa->dh_group == IKEV2_TRANSFORM_DH_TYPE_NONE) |
| 401 | { |
| 402 | return; |
| 403 | } |
| 404 | |
| 405 | /* check if received DH group is on our list of supported groups */ |
| 406 | vec_foreach (t2, km->supported_transforms) |
| 407 | { |
| 408 | if (t2->type == IKEV2_TRANSFORM_TYPE_DH && sa->dh_group == t2->dh_type) |
| 409 | { |
| 410 | t = t2; |
| 411 | break; |
| 412 | } |
| 413 | } |
| 414 | |
| 415 | if (!t) |
| 416 | { |
| 417 | clib_warning ("unknown dh data group %u (data len %u)", sa->dh_group, |
| 418 | vec_len (sa->i_dh_data)); |
| 419 | sa->dh_group = IKEV2_TRANSFORM_DH_TYPE_NONE; |
| 420 | return; |
| 421 | } |
| 422 | |
| 423 | |
| 424 | /* generate dh keys */ |
| 425 | ikev2_complete_dh (sa, t); |
| 426 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 427 | } |
| 428 | |
| 429 | static void |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 430 | ikev2_calc_keys (ikev2_sa_t * sa) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 431 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 432 | u8 *tmp; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 433 | /* calculate SKEYSEED = prf(Ni | Nr, g^ir) */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 434 | u8 *skeyseed = 0; |
| 435 | u8 *s = 0; |
| 436 | ikev2_sa_transform_t *tr_encr, *tr_prf, *tr_integ; |
| 437 | tr_encr = |
| 438 | ikev2_sa_get_td_for_type (sa->r_proposals, IKEV2_TRANSFORM_TYPE_ENCR); |
| 439 | tr_prf = |
| 440 | ikev2_sa_get_td_for_type (sa->r_proposals, IKEV2_TRANSFORM_TYPE_PRF); |
| 441 | tr_integ = |
| 442 | ikev2_sa_get_td_for_type (sa->r_proposals, IKEV2_TRANSFORM_TYPE_INTEG); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 443 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 444 | vec_append (s, sa->i_nonce); |
| 445 | vec_append (s, sa->r_nonce); |
| 446 | skeyseed = ikev2_calc_prf (tr_prf, s, sa->dh_shared_key); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 447 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 448 | /* Calculate S = Ni | Nr | SPIi | SPIr */ |
| 449 | u64 *spi; |
| 450 | vec_add2 (s, tmp, 2 * sizeof (*spi)); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 451 | spi = (u64 *) tmp; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 452 | spi[0] = clib_host_to_net_u64 (sa->ispi); |
| 453 | spi[1] = clib_host_to_net_u64 (sa->rspi); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 454 | |
| 455 | /* calculate PRFplus */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 456 | u8 *keymat; |
| 457 | int len = tr_prf->key_trunc + /* SK_d */ |
| 458 | tr_integ->key_len * 2 + /* SK_ai, SK_ar */ |
| 459 | tr_encr->key_len * 2 + /* SK_ei, SK_er */ |
| 460 | tr_prf->key_len * 2; /* SK_pi, SK_pr */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 461 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 462 | keymat = ikev2_calc_prfplus (tr_prf, skeyseed, s, len); |
| 463 | vec_free (skeyseed); |
| 464 | vec_free (s); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 465 | |
| 466 | int pos = 0; |
| 467 | |
| 468 | /* SK_d */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 469 | sa->sk_d = vec_new (u8, tr_prf->key_trunc); |
| 470 | clib_memcpy (sa->sk_d, keymat + pos, tr_prf->key_trunc); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 471 | pos += tr_prf->key_trunc; |
| 472 | |
| 473 | /* SK_ai */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 474 | sa->sk_ai = vec_new (u8, tr_integ->key_len); |
| 475 | clib_memcpy (sa->sk_ai, keymat + pos, tr_integ->key_len); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 476 | pos += tr_integ->key_len; |
| 477 | |
| 478 | /* SK_ar */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 479 | sa->sk_ar = vec_new (u8, tr_integ->key_len); |
| 480 | clib_memcpy (sa->sk_ar, keymat + pos, tr_integ->key_len); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 481 | pos += tr_integ->key_len; |
| 482 | |
| 483 | /* SK_ei */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 484 | sa->sk_ei = vec_new (u8, tr_encr->key_len); |
| 485 | clib_memcpy (sa->sk_ei, keymat + pos, tr_encr->key_len); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 486 | pos += tr_encr->key_len; |
| 487 | |
| 488 | /* SK_er */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 489 | sa->sk_er = vec_new (u8, tr_encr->key_len); |
| 490 | clib_memcpy (sa->sk_er, keymat + pos, tr_encr->key_len); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 491 | pos += tr_encr->key_len; |
| 492 | |
| 493 | /* SK_pi */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 494 | sa->sk_pi = vec_new (u8, tr_prf->key_len); |
| 495 | clib_memcpy (sa->sk_pi, keymat + pos, tr_prf->key_len); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 496 | pos += tr_prf->key_len; |
| 497 | |
| 498 | /* SK_pr */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 499 | sa->sk_pr = vec_new (u8, tr_prf->key_len); |
| 500 | clib_memcpy (sa->sk_pr, keymat + pos, tr_prf->key_len); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 501 | pos += tr_prf->key_len; |
| 502 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 503 | vec_free (keymat); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 504 | } |
| 505 | |
| 506 | static void |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 507 | ikev2_calc_child_keys (ikev2_sa_t * sa, ikev2_child_sa_t * child) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 508 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 509 | u8 *s = 0; |
| 510 | ikev2_sa_transform_t *tr_prf, *ctr_encr, *ctr_integ; |
| 511 | tr_prf = |
| 512 | ikev2_sa_get_td_for_type (sa->r_proposals, IKEV2_TRANSFORM_TYPE_PRF); |
| 513 | ctr_encr = |
| 514 | ikev2_sa_get_td_for_type (child->r_proposals, IKEV2_TRANSFORM_TYPE_ENCR); |
| 515 | ctr_integ = |
| 516 | ikev2_sa_get_td_for_type (child->r_proposals, IKEV2_TRANSFORM_TYPE_INTEG); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 517 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 518 | vec_append (s, sa->i_nonce); |
| 519 | vec_append (s, sa->r_nonce); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 520 | /* calculate PRFplus */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 521 | u8 *keymat; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 522 | int len = ctr_encr->key_len * 2 + ctr_integ->key_len * 2; |
| 523 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 524 | keymat = ikev2_calc_prfplus (tr_prf, sa->sk_d, s, len); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 525 | |
| 526 | int pos = 0; |
| 527 | |
| 528 | /* SK_ei */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 529 | child->sk_ei = vec_new (u8, ctr_encr->key_len); |
| 530 | clib_memcpy (child->sk_ei, keymat + pos, ctr_encr->key_len); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 531 | pos += ctr_encr->key_len; |
| 532 | |
| 533 | /* SK_ai */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 534 | child->sk_ai = vec_new (u8, ctr_integ->key_len); |
| 535 | clib_memcpy (child->sk_ai, keymat + pos, ctr_integ->key_len); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 536 | pos += ctr_integ->key_len; |
| 537 | |
| 538 | /* SK_er */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 539 | child->sk_er = vec_new (u8, ctr_encr->key_len); |
| 540 | clib_memcpy (child->sk_er, keymat + pos, ctr_encr->key_len); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 541 | pos += ctr_encr->key_len; |
| 542 | |
| 543 | /* SK_ar */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 544 | child->sk_ar = vec_new (u8, ctr_integ->key_len); |
| 545 | clib_memcpy (child->sk_ar, keymat + pos, ctr_integ->key_len); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 546 | pos += ctr_integ->key_len; |
| 547 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 548 | ASSERT (pos == len); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 549 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 550 | vec_free (keymat); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 551 | } |
| 552 | |
| 553 | static void |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 554 | ikev2_process_sa_init_req (vlib_main_t * vm, ikev2_sa_t * sa, |
| 555 | ike_header_t * ike) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 556 | { |
| 557 | int p = 0; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 558 | u32 len = clib_net_to_host_u32 (ike->length); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 559 | u8 payload = ike->nextpayload; |
| 560 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 561 | clib_warning ("ispi %lx rspi %lx nextpayload %x version %x " |
| 562 | "exchange %x flags %x msgid %x length %u", |
| 563 | clib_net_to_host_u64 (ike->ispi), |
| 564 | clib_net_to_host_u64 (ike->rspi), |
| 565 | payload, ike->version, |
| 566 | ike->exchange, ike->flags, |
| 567 | clib_net_to_host_u32 (ike->msgid), len); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 568 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 569 | sa->ispi = clib_net_to_host_u64 (ike->ispi); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 570 | |
| 571 | /* store whole IKE payload - needed for PSK auth */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 572 | vec_free (sa->last_sa_init_req_packet_data); |
| 573 | vec_add (sa->last_sa_init_req_packet_data, ike, len); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 574 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 575 | while (p < len && payload != IKEV2_PAYLOAD_NONE) |
| 576 | { |
| 577 | ike_payload_header_t *ikep = (ike_payload_header_t *) & ike->payload[p]; |
| 578 | u32 plen = clib_net_to_host_u16 (ikep->length); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 579 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 580 | if (plen < sizeof (ike_payload_header_t)) |
| 581 | return; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 582 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 583 | if (payload == IKEV2_PAYLOAD_SA) |
| 584 | { |
| 585 | ikev2_sa_free_proposal_vector (&sa->i_proposals); |
| 586 | sa->i_proposals = ikev2_parse_sa_payload (ikep); |
| 587 | } |
| 588 | else if (payload == IKEV2_PAYLOAD_KE) |
| 589 | { |
| 590 | ike_ke_payload_header_t *ke = (ike_ke_payload_header_t *) ikep; |
| 591 | sa->dh_group = clib_net_to_host_u16 (ke->dh_group); |
| 592 | vec_free (sa->i_dh_data); |
| 593 | vec_add (sa->i_dh_data, ke->payload, plen - sizeof (*ke)); |
| 594 | } |
| 595 | else if (payload == IKEV2_PAYLOAD_NONCE) |
| 596 | { |
| 597 | vec_free (sa->i_nonce); |
| 598 | vec_add (sa->i_nonce, ikep->payload, plen - sizeof (*ikep)); |
| 599 | } |
| 600 | else if (payload == IKEV2_PAYLOAD_NOTIFY) |
| 601 | { |
| 602 | ikev2_notify_t *n = ikev2_parse_notify_payload (ikep); |
| 603 | vec_free (n); |
| 604 | } |
| 605 | else if (payload == IKEV2_PAYLOAD_VENDOR) |
| 606 | { |
| 607 | ikev2_parse_vendor_payload (ikep); |
| 608 | } |
| 609 | else |
| 610 | { |
| 611 | clib_warning ("unknown payload %u flags %x length %u", payload, |
| 612 | ikep->flags, plen); |
| 613 | if (ikep->flags & IKEV2_PAYLOAD_FLAG_CRITICAL) |
| 614 | { |
| 615 | ikev2_set_state (sa, IKEV2_STATE_NOTIFY_AND_DELETE); |
| 616 | sa->unsupported_cp = payload; |
| 617 | return; |
| 618 | } |
| 619 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 620 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 621 | payload = ikep->nextpayload; |
| 622 | p += plen; |
| 623 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 624 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 625 | ikev2_set_state (sa, IKEV2_STATE_SA_INIT); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 626 | } |
| 627 | |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 628 | static void |
| 629 | ikev2_process_sa_init_resp (vlib_main_t * vm, ikev2_sa_t * sa, |
| 630 | ike_header_t * ike) |
| 631 | { |
| 632 | int p = 0; |
| 633 | u32 len = clib_net_to_host_u32 (ike->length); |
| 634 | u8 payload = ike->nextpayload; |
| 635 | |
| 636 | clib_warning ("ispi %lx rspi %lx nextpayload %x version %x " |
| 637 | "exchange %x flags %x msgid %x length %u", |
| 638 | clib_net_to_host_u64 (ike->ispi), |
| 639 | clib_net_to_host_u64 (ike->rspi), |
| 640 | payload, ike->version, |
| 641 | ike->exchange, ike->flags, |
| 642 | clib_net_to_host_u32 (ike->msgid), len); |
| 643 | |
| 644 | sa->ispi = clib_net_to_host_u64 (ike->ispi); |
| 645 | sa->rspi = clib_net_to_host_u64 (ike->rspi); |
| 646 | |
| 647 | /* store whole IKE payload - needed for PSK auth */ |
| 648 | vec_free (sa->last_sa_init_res_packet_data); |
| 649 | vec_add (sa->last_sa_init_res_packet_data, ike, len); |
| 650 | |
| 651 | while (p < len && payload != IKEV2_PAYLOAD_NONE) |
| 652 | { |
| 653 | ike_payload_header_t *ikep = (ike_payload_header_t *) & ike->payload[p]; |
| 654 | u32 plen = clib_net_to_host_u16 (ikep->length); |
| 655 | |
| 656 | if (plen < sizeof (ike_payload_header_t)) |
| 657 | return; |
| 658 | |
| 659 | if (payload == IKEV2_PAYLOAD_SA) |
| 660 | { |
| 661 | ikev2_sa_free_proposal_vector (&sa->r_proposals); |
| 662 | sa->r_proposals = ikev2_parse_sa_payload (ikep); |
| 663 | if (sa->r_proposals) |
| 664 | { |
| 665 | ikev2_set_state (sa, IKEV2_STATE_SA_INIT); |
| 666 | ike->msgid = |
| 667 | clib_host_to_net_u32 (clib_net_to_host_u32 (ike->msgid) + 1); |
| 668 | } |
| 669 | } |
| 670 | else if (payload == IKEV2_PAYLOAD_KE) |
| 671 | { |
| 672 | ike_ke_payload_header_t *ke = (ike_ke_payload_header_t *) ikep; |
| 673 | sa->dh_group = clib_net_to_host_u16 (ke->dh_group); |
| 674 | vec_free (sa->r_dh_data); |
| 675 | vec_add (sa->r_dh_data, ke->payload, plen - sizeof (*ke)); |
| 676 | } |
| 677 | else if (payload == IKEV2_PAYLOAD_NONCE) |
| 678 | { |
| 679 | vec_free (sa->r_nonce); |
| 680 | vec_add (sa->r_nonce, ikep->payload, plen - sizeof (*ikep)); |
| 681 | } |
| 682 | else if (payload == IKEV2_PAYLOAD_NOTIFY) |
| 683 | { |
| 684 | ikev2_notify_t *n = ikev2_parse_notify_payload (ikep); |
| 685 | vec_free (n); |
| 686 | } |
| 687 | else if (payload == IKEV2_PAYLOAD_VENDOR) |
| 688 | { |
| 689 | ikev2_parse_vendor_payload (ikep); |
| 690 | } |
| 691 | else |
| 692 | { |
| 693 | clib_warning ("unknown payload %u flags %x length %u", payload, |
| 694 | ikep->flags, plen); |
| 695 | if (ikep->flags & IKEV2_PAYLOAD_FLAG_CRITICAL) |
| 696 | { |
| 697 | ikev2_set_state (sa, IKEV2_STATE_NOTIFY_AND_DELETE); |
| 698 | sa->unsupported_cp = payload; |
| 699 | return; |
| 700 | } |
| 701 | } |
| 702 | |
| 703 | payload = ikep->nextpayload; |
| 704 | p += plen; |
| 705 | } |
| 706 | } |
| 707 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 708 | static u8 * |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 709 | ikev2_decrypt_sk_payload (ikev2_sa_t * sa, ike_header_t * ike, u8 * payload) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 710 | { |
| 711 | int p = 0; |
| 712 | u8 last_payload = 0; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 713 | u8 *hmac = 0; |
| 714 | u32 len = clib_net_to_host_u32 (ike->length); |
| 715 | ike_payload_header_t *ikep = 0; |
Benoît Ganne | d530445 | 2016-04-08 22:25:05 -0700 | [diff] [blame] | 716 | u32 plen = 0; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 717 | ikev2_sa_transform_t *tr_integ; |
| 718 | tr_integ = |
| 719 | ikev2_sa_get_td_for_type (sa->r_proposals, IKEV2_TRANSFORM_TYPE_INTEG); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 720 | |
| 721 | while (p < len && |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 722 | *payload != IKEV2_PAYLOAD_NONE && last_payload != IKEV2_PAYLOAD_SK) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 723 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 724 | ikep = (ike_payload_header_t *) & ike->payload[p]; |
| 725 | plen = clib_net_to_host_u16 (ikep->length); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 726 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 727 | if (plen < sizeof (*ikep)) |
| 728 | return 0; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 729 | |
| 730 | if (*payload == IKEV2_PAYLOAD_SK) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 731 | { |
| 732 | clib_warning ("received IKEv2 payload SK, len %u", plen - 4); |
| 733 | last_payload = *payload; |
| 734 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 735 | else |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 736 | { |
| 737 | clib_warning ("unknown payload %u flags %x length %u", payload, |
| 738 | ikep->flags, plen); |
| 739 | if (ikep->flags & IKEV2_PAYLOAD_FLAG_CRITICAL) |
| 740 | { |
| 741 | sa->unsupported_cp = *payload; |
| 742 | return 0; |
| 743 | } |
| 744 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 745 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 746 | *payload = ikep->nextpayload; |
| 747 | p += plen; |
| 748 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 749 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 750 | if (last_payload != IKEV2_PAYLOAD_SK) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 751 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 752 | clib_warning ("Last payload must be SK"); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 753 | return 0; |
| 754 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 755 | |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 756 | hmac = |
| 757 | ikev2_calc_integr (tr_integ, sa->is_initiator ? sa->sk_ar : sa->sk_ai, |
| 758 | (u8 *) ike, len - tr_integ->key_trunc); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 759 | |
| 760 | plen = plen - sizeof (*ikep) - tr_integ->key_trunc; |
| 761 | |
| 762 | if (memcmp (hmac, &ikep->payload[plen], tr_integ->key_trunc)) |
| 763 | { |
| 764 | clib_warning ("message integrity check failed"); |
| 765 | vec_free (hmac); |
| 766 | return 0; |
| 767 | } |
| 768 | vec_free (hmac); |
| 769 | |
| 770 | return ikev2_decrypt_data (sa, ikep->payload, plen); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 771 | } |
| 772 | |
| 773 | static void |
| 774 | ikev2_initial_contact_cleanup (ikev2_sa_t * sa) |
| 775 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 776 | ikev2_main_t *km = &ikev2_main; |
| 777 | ikev2_sa_t *tmp; |
| 778 | u32 i, *delete = 0; |
| 779 | ikev2_child_sa_t *c; |
Damjan Marion | 586afd7 | 2017-04-05 19:18:20 +0200 | [diff] [blame] | 780 | u32 thread_index = vlib_get_thread_index (); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 781 | |
| 782 | if (!sa->initial_contact) |
| 783 | return; |
| 784 | |
| 785 | /* find old IKE SAs with the same authenticated identity */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 786 | /* *INDENT-OFF* */ |
Damjan Marion | 586afd7 | 2017-04-05 19:18:20 +0200 | [diff] [blame] | 787 | pool_foreach (tmp, km->per_thread_data[thread_index].sas, ({ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 788 | if (tmp->i_id.type != sa->i_id.type || |
| 789 | vec_len(tmp->i_id.data) != vec_len(sa->i_id.data) || |
| 790 | memcmp(sa->i_id.data, tmp->i_id.data, vec_len(sa->i_id.data))) |
| 791 | continue; |
| 792 | |
| 793 | if (sa->rspi != tmp->rspi) |
Damjan Marion | 586afd7 | 2017-04-05 19:18:20 +0200 | [diff] [blame] | 794 | vec_add1(delete, tmp - km->per_thread_data[thread_index].sas); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 795 | })); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 796 | /* *INDENT-ON* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 797 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 798 | for (i = 0; i < vec_len (delete); i++) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 799 | { |
Damjan Marion | 586afd7 | 2017-04-05 19:18:20 +0200 | [diff] [blame] | 800 | tmp = |
| 801 | pool_elt_at_index (km->per_thread_data[thread_index].sas, delete[i]); |
| 802 | vec_foreach (c, |
| 803 | tmp->childs) ikev2_delete_tunnel_interface (km->vnet_main, |
| 804 | tmp, c); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 805 | ikev2_delete_sa (tmp); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 806 | } |
| 807 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 808 | vec_free (delete); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 809 | sa->initial_contact = 0; |
| 810 | } |
| 811 | |
| 812 | static void |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 813 | ikev2_process_auth_req (vlib_main_t * vm, ikev2_sa_t * sa, ike_header_t * ike) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 814 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 815 | ikev2_child_sa_t *first_child_sa; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 816 | int p = 0; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 817 | u32 len = clib_net_to_host_u32 (ike->length); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 818 | u8 payload = ike->nextpayload; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 819 | u8 *plaintext = 0; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 820 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 821 | ike_payload_header_t *ikep; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 822 | u32 plen; |
| 823 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 824 | clib_warning ("ispi %lx rspi %lx nextpayload %x version %x " |
| 825 | "exchange %x flags %x msgid %x length %u", |
| 826 | clib_net_to_host_u64 (ike->ispi), |
| 827 | clib_net_to_host_u64 (ike->rspi), |
| 828 | payload, ike->version, |
| 829 | ike->exchange, ike->flags, |
| 830 | clib_net_to_host_u32 (ike->msgid), len); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 831 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 832 | ikev2_calc_keys (sa); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 833 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 834 | plaintext = ikev2_decrypt_sk_payload (sa, ike, &payload); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 835 | |
| 836 | if (!plaintext) |
| 837 | { |
| 838 | if (sa->unsupported_cp) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 839 | ikev2_set_state (sa, IKEV2_STATE_NOTIFY_AND_DELETE); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 840 | goto cleanup_and_exit; |
| 841 | } |
| 842 | |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 843 | /* select or create 1st child SA */ |
| 844 | if (sa->is_initiator) |
| 845 | { |
| 846 | first_child_sa = &sa->childs[0]; |
| 847 | } |
| 848 | else |
| 849 | { |
| 850 | ikev2_sa_free_all_child_sa (&sa->childs); |
| 851 | vec_add2 (sa->childs, first_child_sa, 1); |
| 852 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 853 | |
| 854 | |
| 855 | /* process encrypted payload */ |
| 856 | p = 0; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 857 | while (p < vec_len (plaintext) && payload != IKEV2_PAYLOAD_NONE) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 858 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 859 | ikep = (ike_payload_header_t *) & plaintext[p]; |
| 860 | plen = clib_net_to_host_u16 (ikep->length); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 861 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 862 | if (plen < sizeof (ike_payload_header_t)) |
| 863 | goto cleanup_and_exit; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 864 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 865 | if (payload == IKEV2_PAYLOAD_SA) /* 33 */ |
| 866 | { |
| 867 | clib_warning ("received payload SA, len %u", plen - sizeof (*ikep)); |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 868 | if (sa->is_initiator) |
| 869 | { |
| 870 | ikev2_sa_free_proposal_vector (&first_child_sa->r_proposals); |
| 871 | first_child_sa->r_proposals = ikev2_parse_sa_payload (ikep); |
| 872 | } |
| 873 | else |
| 874 | { |
| 875 | ikev2_sa_free_proposal_vector (&first_child_sa->i_proposals); |
| 876 | first_child_sa->i_proposals = ikev2_parse_sa_payload (ikep); |
| 877 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 878 | } |
Matthew Smith | 1e19ee4 | 2017-04-26 15:42:39 -0500 | [diff] [blame] | 879 | else if (payload == IKEV2_PAYLOAD_IDI) /* 35 */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 880 | { |
| 881 | ike_id_payload_header_t *id = (ike_id_payload_header_t *) ikep; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 882 | |
Matthew Smith | 1e19ee4 | 2017-04-26 15:42:39 -0500 | [diff] [blame] | 883 | sa->i_id.type = id->id_type; |
| 884 | vec_free (sa->i_id.data); |
| 885 | vec_add (sa->i_id.data, id->payload, plen - sizeof (*id)); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 886 | |
Matthew Smith | 1e19ee4 | 2017-04-26 15:42:39 -0500 | [diff] [blame] | 887 | clib_warning ("received payload IDi, len %u id_type %u", |
| 888 | plen - sizeof (*id), id->id_type); |
| 889 | } |
| 890 | else if (payload == IKEV2_PAYLOAD_IDR) /* 36 */ |
| 891 | { |
| 892 | ike_id_payload_header_t *id = (ike_id_payload_header_t *) ikep; |
| 893 | |
| 894 | sa->r_id.type = id->id_type; |
| 895 | vec_free (sa->r_id.data); |
| 896 | vec_add (sa->r_id.data, id->payload, plen - sizeof (*id)); |
| 897 | |
| 898 | clib_warning ("received payload IDr len %u id_type %u", |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 899 | plen - sizeof (*id), id->id_type); |
| 900 | } |
| 901 | else if (payload == IKEV2_PAYLOAD_AUTH) /* 39 */ |
| 902 | { |
| 903 | ike_auth_payload_header_t *a = (ike_auth_payload_header_t *) ikep; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 904 | |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 905 | if (sa->is_initiator) |
| 906 | { |
| 907 | sa->r_auth.method = a->auth_method; |
| 908 | vec_free (sa->r_auth.data); |
| 909 | vec_add (sa->r_auth.data, a->payload, plen - sizeof (*a)); |
| 910 | } |
| 911 | else |
| 912 | { |
| 913 | sa->i_auth.method = a->auth_method; |
| 914 | vec_free (sa->i_auth.data); |
| 915 | vec_add (sa->i_auth.data, a->payload, plen - sizeof (*a)); |
| 916 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 917 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 918 | clib_warning ("received payload AUTH, len %u auth_type %u", |
| 919 | plen - sizeof (*a), a->auth_method); |
| 920 | } |
| 921 | else if (payload == IKEV2_PAYLOAD_NOTIFY) /* 41 */ |
| 922 | { |
| 923 | ikev2_notify_t *n = ikev2_parse_notify_payload (ikep); |
| 924 | if (n->msg_type == IKEV2_NOTIFY_MSG_INITIAL_CONTACT) |
| 925 | { |
| 926 | sa->initial_contact = 1; |
| 927 | } |
| 928 | vec_free (n); |
| 929 | } |
| 930 | else if (payload == IKEV2_PAYLOAD_VENDOR) /* 43 */ |
| 931 | { |
| 932 | ikev2_parse_vendor_payload (ikep); |
| 933 | } |
| 934 | else if (payload == IKEV2_PAYLOAD_TSI) /* 44 */ |
| 935 | { |
| 936 | clib_warning ("received payload TSi, len %u", |
| 937 | plen - sizeof (*ikep)); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 938 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 939 | vec_free (first_child_sa->tsi); |
| 940 | first_child_sa->tsi = ikev2_parse_ts_payload (ikep); |
| 941 | } |
| 942 | else if (payload == IKEV2_PAYLOAD_TSR) /* 45 */ |
| 943 | { |
| 944 | clib_warning ("received payload TSr, len %u", |
| 945 | plen - sizeof (*ikep)); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 946 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 947 | vec_free (first_child_sa->tsr); |
| 948 | first_child_sa->tsr = ikev2_parse_ts_payload (ikep); |
| 949 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 950 | else |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 951 | { |
| 952 | clib_warning ("unknown payload %u flags %x length %u data %u", |
| 953 | payload, ikep->flags, plen - 4, |
| 954 | format_hex_bytes, ikep->payload, plen - 4); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 955 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 956 | if (ikep->flags & IKEV2_PAYLOAD_FLAG_CRITICAL) |
| 957 | { |
| 958 | ikev2_set_state (sa, IKEV2_STATE_NOTIFY_AND_DELETE); |
| 959 | sa->unsupported_cp = payload; |
| 960 | return; |
| 961 | } |
| 962 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 963 | |
| 964 | payload = ikep->nextpayload; |
| 965 | p += plen; |
| 966 | } |
| 967 | |
| 968 | cleanup_and_exit: |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 969 | vec_free (plaintext); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 970 | } |
| 971 | |
| 972 | static void |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 973 | ikev2_process_informational_req (vlib_main_t * vm, ikev2_sa_t * sa, |
| 974 | ike_header_t * ike) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 975 | { |
| 976 | int p = 0; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 977 | u32 len = clib_net_to_host_u32 (ike->length); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 978 | u8 payload = ike->nextpayload; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 979 | u8 *plaintext = 0; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 980 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 981 | ike_payload_header_t *ikep; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 982 | u32 plen; |
| 983 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 984 | clib_warning ("ispi %lx rspi %lx nextpayload %x version %x " |
| 985 | "exchange %x flags %x msgid %x length %u", |
| 986 | clib_net_to_host_u64 (ike->ispi), |
| 987 | clib_net_to_host_u64 (ike->rspi), |
| 988 | payload, ike->version, |
| 989 | ike->exchange, ike->flags, |
| 990 | clib_net_to_host_u32 (ike->msgid), len); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 991 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 992 | plaintext = ikev2_decrypt_sk_payload (sa, ike, &payload); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 993 | |
| 994 | if (!plaintext) |
| 995 | goto cleanup_and_exit; |
| 996 | |
| 997 | /* process encrypted payload */ |
| 998 | p = 0; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 999 | while (p < vec_len (plaintext) && payload != IKEV2_PAYLOAD_NONE) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1000 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1001 | ikep = (ike_payload_header_t *) & plaintext[p]; |
| 1002 | plen = clib_net_to_host_u16 (ikep->length); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1003 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1004 | if (plen < sizeof (ike_payload_header_t)) |
| 1005 | goto cleanup_and_exit; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1006 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1007 | if (payload == IKEV2_PAYLOAD_NOTIFY) /* 41 */ |
| 1008 | { |
| 1009 | ikev2_notify_t *n = ikev2_parse_notify_payload (ikep); |
| 1010 | if (n->msg_type == IKEV2_NOTIFY_MSG_AUTHENTICATION_FAILED) |
| 1011 | ikev2_set_state (sa, IKEV2_STATE_AUTH_FAILED); |
| 1012 | vec_free (n); |
| 1013 | } |
| 1014 | else if (payload == IKEV2_PAYLOAD_DELETE) /* 42 */ |
| 1015 | { |
| 1016 | sa->del = ikev2_parse_delete_payload (ikep); |
| 1017 | } |
| 1018 | else if (payload == IKEV2_PAYLOAD_VENDOR) /* 43 */ |
| 1019 | { |
| 1020 | ikev2_parse_vendor_payload (ikep); |
| 1021 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1022 | else |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1023 | { |
| 1024 | clib_warning ("unknown payload %u flags %x length %u data %u", |
| 1025 | payload, ikep->flags, plen - 4, |
| 1026 | format_hex_bytes, ikep->payload, plen - 4); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1027 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1028 | if (ikep->flags & IKEV2_PAYLOAD_FLAG_CRITICAL) |
| 1029 | { |
| 1030 | sa->unsupported_cp = payload; |
| 1031 | return; |
| 1032 | } |
| 1033 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1034 | |
| 1035 | payload = ikep->nextpayload; |
| 1036 | p += plen; |
| 1037 | } |
| 1038 | |
| 1039 | cleanup_and_exit: |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1040 | vec_free (plaintext); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1041 | } |
| 1042 | |
| 1043 | static void |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1044 | ikev2_process_create_child_sa_req (vlib_main_t * vm, ikev2_sa_t * sa, |
| 1045 | ike_header_t * ike) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1046 | { |
| 1047 | int p = 0; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1048 | u32 len = clib_net_to_host_u32 (ike->length); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1049 | u8 payload = ike->nextpayload; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1050 | u8 *plaintext = 0; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1051 | u8 rekeying = 0; |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1052 | u8 nonce[IKEV2_NONCE_SIZE]; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1053 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1054 | ike_payload_header_t *ikep; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1055 | u32 plen; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1056 | ikev2_notify_t *n = 0; |
| 1057 | ikev2_ts_t *tsi = 0; |
| 1058 | ikev2_ts_t *tsr = 0; |
| 1059 | ikev2_sa_proposal_t *proposal = 0; |
| 1060 | ikev2_child_sa_t *child_sa; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1061 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1062 | clib_warning ("ispi %lx rspi %lx nextpayload %x version %x " |
| 1063 | "exchange %x flags %x msgid %x length %u", |
| 1064 | clib_net_to_host_u64 (ike->ispi), |
| 1065 | clib_net_to_host_u64 (ike->rspi), |
| 1066 | payload, ike->version, |
| 1067 | ike->exchange, ike->flags, |
| 1068 | clib_net_to_host_u32 (ike->msgid), len); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1069 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1070 | plaintext = ikev2_decrypt_sk_payload (sa, ike, &payload); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1071 | |
| 1072 | if (!plaintext) |
| 1073 | goto cleanup_and_exit; |
| 1074 | |
| 1075 | /* process encrypted payload */ |
| 1076 | p = 0; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1077 | while (p < vec_len (plaintext) && payload != IKEV2_PAYLOAD_NONE) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1078 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1079 | ikep = (ike_payload_header_t *) & plaintext[p]; |
| 1080 | plen = clib_net_to_host_u16 (ikep->length); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1081 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1082 | if (plen < sizeof (ike_payload_header_t)) |
| 1083 | goto cleanup_and_exit; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1084 | |
| 1085 | else if (payload == IKEV2_PAYLOAD_SA) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1086 | { |
| 1087 | proposal = ikev2_parse_sa_payload (ikep); |
| 1088 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1089 | else if (payload == IKEV2_PAYLOAD_NOTIFY) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1090 | { |
| 1091 | n = ikev2_parse_notify_payload (ikep); |
| 1092 | if (n->msg_type == IKEV2_NOTIFY_MSG_REKEY_SA) |
| 1093 | { |
| 1094 | rekeying = 1; |
| 1095 | } |
| 1096 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1097 | else if (payload == IKEV2_PAYLOAD_DELETE) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1098 | { |
| 1099 | sa->del = ikev2_parse_delete_payload (ikep); |
| 1100 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1101 | else if (payload == IKEV2_PAYLOAD_VENDOR) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1102 | { |
| 1103 | ikev2_parse_vendor_payload (ikep); |
| 1104 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1105 | else if (payload == IKEV2_PAYLOAD_NONCE) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1106 | { |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1107 | clib_memcpy (nonce, ikep->payload, plen - sizeof (*ikep)); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1108 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1109 | else if (payload == IKEV2_PAYLOAD_TSI) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1110 | { |
| 1111 | tsi = ikev2_parse_ts_payload (ikep); |
| 1112 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1113 | else if (payload == IKEV2_PAYLOAD_TSR) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1114 | { |
| 1115 | tsr = ikev2_parse_ts_payload (ikep); |
| 1116 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1117 | else |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1118 | { |
| 1119 | clib_warning ("unknown payload %u flags %x length %u data %u", |
| 1120 | payload, ikep->flags, plen - 4, |
| 1121 | format_hex_bytes, ikep->payload, plen - 4); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1122 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1123 | if (ikep->flags & IKEV2_PAYLOAD_FLAG_CRITICAL) |
| 1124 | { |
| 1125 | sa->unsupported_cp = payload; |
| 1126 | return; |
| 1127 | } |
| 1128 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1129 | |
| 1130 | payload = ikep->nextpayload; |
| 1131 | p += plen; |
| 1132 | } |
| 1133 | |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1134 | if (sa->is_initiator && proposal->protocol_id == IKEV2_PROTOCOL_ESP) |
| 1135 | { |
| 1136 | ikev2_rekey_t *rekey = &sa->rekey[0]; |
| 1137 | rekey->protocol_id = proposal->protocol_id; |
| 1138 | rekey->i_proposal = |
| 1139 | ikev2_select_proposal (proposal, IKEV2_PROTOCOL_ESP); |
| 1140 | rekey->i_proposal->spi = rekey->spi; |
| 1141 | rekey->r_proposal = proposal; |
| 1142 | rekey->tsi = tsi; |
| 1143 | rekey->tsr = tsr; |
| 1144 | /* update Nr */ |
| 1145 | vec_free (sa->r_nonce); |
| 1146 | vec_add (sa->r_nonce, nonce, IKEV2_NONCE_SIZE); |
| 1147 | child_sa = ikev2_sa_get_child (sa, rekey->ispi, IKEV2_PROTOCOL_ESP, 1); |
| 1148 | if (child_sa) |
| 1149 | { |
| 1150 | child_sa->rekey_retries = 0; |
| 1151 | } |
| 1152 | } |
| 1153 | else if (rekeying) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1154 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1155 | ikev2_rekey_t *rekey; |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1156 | child_sa = ikev2_sa_get_child (sa, n->spi, n->protocol_id, 1); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1157 | if (!child_sa) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1158 | { |
| 1159 | clib_warning ("child SA spi %lx not found", n->spi); |
| 1160 | goto cleanup_and_exit; |
| 1161 | } |
| 1162 | vec_add2 (sa->rekey, rekey, 1); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1163 | rekey->protocol_id = n->protocol_id; |
| 1164 | rekey->spi = n->spi; |
| 1165 | rekey->i_proposal = proposal; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1166 | rekey->r_proposal = |
| 1167 | ikev2_select_proposal (proposal, IKEV2_PROTOCOL_ESP); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1168 | rekey->tsi = tsi; |
| 1169 | rekey->tsr = tsr; |
| 1170 | /* update Ni */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1171 | vec_free (sa->i_nonce); |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1172 | vec_add (sa->i_nonce, nonce, IKEV2_NONCE_SIZE); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1173 | /* generate new Nr */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1174 | vec_free (sa->r_nonce); |
| 1175 | sa->r_nonce = vec_new (u8, IKEV2_NONCE_SIZE); |
| 1176 | RAND_bytes ((u8 *) sa->r_nonce, IKEV2_NONCE_SIZE); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1177 | } |
| 1178 | |
| 1179 | cleanup_and_exit: |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1180 | vec_free (plaintext); |
| 1181 | vec_free (n); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1182 | } |
| 1183 | |
| 1184 | static u8 * |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1185 | ikev2_sa_generate_authmsg (ikev2_sa_t * sa, int is_responder) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1186 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1187 | u8 *authmsg = 0; |
| 1188 | u8 *data; |
| 1189 | u8 *nonce; |
| 1190 | ikev2_id_t *id; |
| 1191 | u8 *key; |
| 1192 | u8 *packet_data; |
| 1193 | ikev2_sa_transform_t *tr_prf; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1194 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1195 | tr_prf = |
| 1196 | ikev2_sa_get_td_for_type (sa->r_proposals, IKEV2_TRANSFORM_TYPE_PRF); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1197 | |
| 1198 | if (is_responder) |
| 1199 | { |
| 1200 | id = &sa->r_id; |
| 1201 | key = sa->sk_pr; |
| 1202 | nonce = sa->i_nonce; |
| 1203 | packet_data = sa->last_sa_init_res_packet_data; |
| 1204 | } |
| 1205 | else |
| 1206 | { |
| 1207 | id = &sa->i_id; |
| 1208 | key = sa->sk_pi; |
| 1209 | nonce = sa->r_nonce; |
| 1210 | packet_data = sa->last_sa_init_req_packet_data; |
| 1211 | } |
| 1212 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1213 | data = vec_new (u8, 4); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1214 | data[0] = id->type; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1215 | vec_append (data, id->data); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1216 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1217 | u8 *id_hash = ikev2_calc_prf (tr_prf, key, data); |
| 1218 | vec_append (authmsg, packet_data); |
| 1219 | vec_append (authmsg, nonce); |
| 1220 | vec_append (authmsg, id_hash); |
| 1221 | vec_free (id_hash); |
| 1222 | vec_free (data); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1223 | |
| 1224 | return authmsg; |
| 1225 | } |
| 1226 | |
| 1227 | static int |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1228 | ikev2_ts_cmp (ikev2_ts_t * ts1, ikev2_ts_t * ts2) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1229 | { |
| 1230 | if (ts1->ts_type == ts2->ts_type && ts1->protocol_id == ts2->protocol_id && |
| 1231 | ts1->start_port == ts2->start_port && ts1->end_port == ts2->end_port && |
| 1232 | ts1->start_addr.as_u32 == ts2->start_addr.as_u32 && |
| 1233 | ts1->end_addr.as_u32 == ts2->end_addr.as_u32) |
| 1234 | return 1; |
| 1235 | |
| 1236 | return 0; |
| 1237 | } |
| 1238 | |
| 1239 | static void |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1240 | ikev2_sa_match_ts (ikev2_sa_t * sa) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1241 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1242 | ikev2_main_t *km = &ikev2_main; |
| 1243 | ikev2_profile_t *p; |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1244 | ikev2_ts_t *ts, *p_tsi, *p_tsr, *tsi = 0, *tsr = 0; |
| 1245 | ikev2_id_t *id; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1246 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1247 | /* *INDENT-OFF* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1248 | pool_foreach (p, km->profiles, ({ |
| 1249 | |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1250 | if (sa->is_initiator) |
| 1251 | { |
| 1252 | p_tsi = &p->loc_ts; |
| 1253 | p_tsr = &p->rem_ts; |
| 1254 | id = &sa->r_id; |
| 1255 | } |
| 1256 | else |
| 1257 | { |
| 1258 | p_tsi = &p->rem_ts; |
| 1259 | p_tsr = &p->loc_ts; |
| 1260 | id = &sa->i_id; |
| 1261 | } |
| 1262 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1263 | /* check id */ |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1264 | if (p->rem_id.type != id->type || |
| 1265 | vec_len(p->rem_id.data) != vec_len(id->data) || |
| 1266 | memcmp(p->rem_id.data, id->data, vec_len(p->rem_id.data))) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1267 | continue; |
| 1268 | |
| 1269 | vec_foreach(ts, sa->childs[0].tsi) |
| 1270 | { |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1271 | if (ikev2_ts_cmp(p_tsi, ts)) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1272 | { |
| 1273 | tsi = vec_dup(ts); |
| 1274 | break; |
| 1275 | } |
| 1276 | } |
| 1277 | |
| 1278 | vec_foreach(ts, sa->childs[0].tsr) |
| 1279 | { |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1280 | if (ikev2_ts_cmp(p_tsr, ts)) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1281 | { |
| 1282 | tsr = vec_dup(ts); |
| 1283 | break; |
| 1284 | } |
| 1285 | } |
| 1286 | |
| 1287 | break; |
| 1288 | })); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1289 | /* *INDENT-ON* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1290 | |
| 1291 | if (tsi && tsr) |
| 1292 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1293 | vec_free (sa->childs[0].tsi); |
| 1294 | vec_free (sa->childs[0].tsr); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1295 | sa->childs[0].tsi = tsi; |
| 1296 | sa->childs[0].tsr = tsr; |
| 1297 | } |
| 1298 | else |
| 1299 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1300 | vec_free (tsi); |
| 1301 | vec_free (tsr); |
| 1302 | ikev2_set_state (sa, IKEV2_STATE_TS_UNACCEPTABLE); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1303 | } |
| 1304 | } |
| 1305 | |
| 1306 | static void |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1307 | ikev2_sa_auth (ikev2_sa_t * sa) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1308 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1309 | ikev2_main_t *km = &ikev2_main; |
| 1310 | ikev2_profile_t *p, *sel_p = 0; |
| 1311 | u8 *authmsg, *key_pad, *psk = 0, *auth = 0; |
| 1312 | ikev2_sa_transform_t *tr_prf; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1313 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1314 | tr_prf = |
| 1315 | ikev2_sa_get_td_for_type (sa->r_proposals, IKEV2_TRANSFORM_TYPE_PRF); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1316 | |
| 1317 | /* only shared key and rsa signature */ |
| 1318 | if (!(sa->i_auth.method == IKEV2_AUTH_METHOD_SHARED_KEY_MIC || |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1319 | sa->i_auth.method == IKEV2_AUTH_METHOD_RSA_SIG)) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1320 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1321 | clib_warning ("unsupported authentication method %u", |
| 1322 | sa->i_auth.method); |
| 1323 | ikev2_set_state (sa, IKEV2_STATE_AUTH_FAILED); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1324 | return; |
| 1325 | } |
| 1326 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1327 | key_pad = format (0, "%s", IKEV2_KEY_PAD); |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1328 | authmsg = ikev2_sa_generate_authmsg (sa, sa->is_initiator); |
| 1329 | |
| 1330 | ikev2_id_t *sa_id; |
| 1331 | ikev2_auth_t *sa_auth; |
| 1332 | |
| 1333 | if (sa->is_initiator) |
| 1334 | { |
| 1335 | sa_id = &sa->r_id; |
| 1336 | sa_auth = &sa->r_auth; |
| 1337 | } |
| 1338 | else |
| 1339 | { |
| 1340 | sa_id = &sa->i_id; |
| 1341 | sa_auth = &sa->i_auth; |
| 1342 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1343 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1344 | /* *INDENT-OFF* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1345 | pool_foreach (p, km->profiles, ({ |
| 1346 | |
| 1347 | /* check id */ |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1348 | if (p->rem_id.type != sa_id->type || |
| 1349 | vec_len(p->rem_id.data) != vec_len(sa_id->data) || |
| 1350 | memcmp(p->rem_id.data, sa_id->data, vec_len(p->rem_id.data))) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1351 | continue; |
| 1352 | |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1353 | if (sa_auth->method == IKEV2_AUTH_METHOD_SHARED_KEY_MIC) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1354 | { |
| 1355 | if (!p->auth.data || |
| 1356 | p->auth.method != IKEV2_AUTH_METHOD_SHARED_KEY_MIC) |
| 1357 | continue; |
| 1358 | |
| 1359 | psk = ikev2_calc_prf(tr_prf, p->auth.data, key_pad); |
| 1360 | auth = ikev2_calc_prf(tr_prf, psk, authmsg); |
| 1361 | |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1362 | if (!memcmp(auth, sa_auth->data, vec_len(sa_auth->data))) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1363 | { |
| 1364 | ikev2_set_state(sa, IKEV2_STATE_AUTHENTICATED); |
| 1365 | vec_free(auth); |
| 1366 | sel_p = p; |
| 1367 | break; |
| 1368 | } |
| 1369 | |
| 1370 | } |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1371 | else if (sa_auth->method == IKEV2_AUTH_METHOD_RSA_SIG) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1372 | { |
| 1373 | if (p->auth.method != IKEV2_AUTH_METHOD_RSA_SIG) |
| 1374 | continue; |
| 1375 | |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1376 | if (ikev2_verify_sign(p->auth.key, sa_auth->data, authmsg) == 1) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1377 | { |
| 1378 | ikev2_set_state(sa, IKEV2_STATE_AUTHENTICATED); |
| 1379 | sel_p = p; |
| 1380 | break; |
| 1381 | } |
| 1382 | } |
| 1383 | |
| 1384 | vec_free(auth); |
| 1385 | vec_free(psk); |
| 1386 | })); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1387 | /* *INDENT-ON* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1388 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1389 | vec_free (authmsg); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1390 | |
| 1391 | if (sa->state == IKEV2_STATE_AUTHENTICATED) |
| 1392 | { |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1393 | if (!sa->is_initiator) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1394 | { |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1395 | vec_free (sa->r_id.data); |
| 1396 | sa->r_id.data = vec_dup (sel_p->loc_id.data); |
| 1397 | sa->r_id.type = sel_p->loc_id.type; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1398 | |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1399 | /* generate our auth data */ |
| 1400 | authmsg = ikev2_sa_generate_authmsg (sa, 1); |
| 1401 | if (sel_p->auth.method == IKEV2_AUTH_METHOD_SHARED_KEY_MIC) |
| 1402 | { |
| 1403 | sa->r_auth.data = ikev2_calc_prf (tr_prf, psk, authmsg); |
| 1404 | sa->r_auth.method = IKEV2_AUTH_METHOD_SHARED_KEY_MIC; |
| 1405 | } |
| 1406 | else if (sel_p->auth.method == IKEV2_AUTH_METHOD_RSA_SIG) |
| 1407 | { |
| 1408 | sa->r_auth.data = ikev2_calc_sign (km->pkey, authmsg); |
| 1409 | sa->r_auth.method = IKEV2_AUTH_METHOD_RSA_SIG; |
| 1410 | } |
| 1411 | vec_free (authmsg); |
| 1412 | |
| 1413 | /* select transforms for 1st child sa */ |
| 1414 | ikev2_sa_free_proposal_vector (&sa->childs[0].r_proposals); |
| 1415 | sa->childs[0].r_proposals = |
| 1416 | ikev2_select_proposal (sa->childs[0].i_proposals, |
| 1417 | IKEV2_PROTOCOL_ESP); |
| 1418 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1419 | } |
| 1420 | else |
| 1421 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1422 | ikev2_set_state (sa, IKEV2_STATE_AUTH_FAILED); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1423 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1424 | vec_free (psk); |
| 1425 | vec_free (key_pad); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1426 | } |
| 1427 | |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1428 | |
| 1429 | static void |
| 1430 | ikev2_sa_auth_init (ikev2_sa_t * sa) |
| 1431 | { |
| 1432 | ikev2_main_t *km = &ikev2_main; |
| 1433 | u8 *authmsg, *key_pad, *psk = 0, *auth = 0; |
| 1434 | ikev2_sa_transform_t *tr_prf; |
| 1435 | |
| 1436 | tr_prf = |
| 1437 | ikev2_sa_get_td_for_type (sa->r_proposals, IKEV2_TRANSFORM_TYPE_PRF); |
| 1438 | |
| 1439 | /* only shared key and rsa signature */ |
| 1440 | if (!(sa->i_auth.method == IKEV2_AUTH_METHOD_SHARED_KEY_MIC || |
| 1441 | sa->i_auth.method == IKEV2_AUTH_METHOD_RSA_SIG)) |
| 1442 | { |
| 1443 | clib_warning ("unsupported authentication method %u", |
| 1444 | sa->i_auth.method); |
| 1445 | ikev2_set_state (sa, IKEV2_STATE_AUTH_FAILED); |
| 1446 | return; |
| 1447 | } |
| 1448 | |
| 1449 | key_pad = format (0, "%s", IKEV2_KEY_PAD); |
| 1450 | authmsg = ikev2_sa_generate_authmsg (sa, 0); |
| 1451 | psk = ikev2_calc_prf (tr_prf, sa->i_auth.data, key_pad); |
| 1452 | auth = ikev2_calc_prf (tr_prf, psk, authmsg); |
| 1453 | |
| 1454 | |
| 1455 | if (sa->i_auth.method == IKEV2_AUTH_METHOD_SHARED_KEY_MIC) |
| 1456 | { |
| 1457 | sa->i_auth.data = ikev2_calc_prf (tr_prf, psk, authmsg); |
| 1458 | sa->i_auth.method = IKEV2_AUTH_METHOD_SHARED_KEY_MIC; |
| 1459 | } |
| 1460 | else if (sa->i_auth.method == IKEV2_AUTH_METHOD_RSA_SIG) |
| 1461 | { |
| 1462 | sa->i_auth.data = ikev2_calc_sign (km->pkey, authmsg); |
| 1463 | sa->i_auth.method = IKEV2_AUTH_METHOD_RSA_SIG; |
| 1464 | } |
| 1465 | |
| 1466 | vec_free (psk); |
| 1467 | vec_free (key_pad); |
| 1468 | vec_free (auth); |
| 1469 | vec_free (authmsg); |
| 1470 | } |
| 1471 | |
| 1472 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1473 | static int |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1474 | ikev2_create_tunnel_interface (vnet_main_t * vnm, ikev2_sa_t * sa, |
| 1475 | ikev2_child_sa_t * child) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1476 | { |
| 1477 | ipsec_add_del_tunnel_args_t a; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1478 | ikev2_sa_transform_t *tr; |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1479 | ikev2_sa_proposal_t *proposals; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1480 | u8 encr_type = 0; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1481 | |
| 1482 | if (!child->r_proposals) |
| 1483 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1484 | ikev2_set_state (sa, IKEV2_STATE_NO_PROPOSAL_CHOSEN); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1485 | return 1; |
| 1486 | } |
| 1487 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1488 | memset (&a, 0, sizeof (a)); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1489 | a.is_add = 1; |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1490 | if (sa->is_initiator) |
| 1491 | { |
| 1492 | a.local_ip.as_u32 = sa->iaddr.as_u32; |
| 1493 | a.remote_ip.as_u32 = sa->raddr.as_u32; |
| 1494 | proposals = child->i_proposals; |
| 1495 | a.local_spi = child->r_proposals[0].spi; |
| 1496 | a.remote_spi = child->i_proposals[0].spi; |
| 1497 | } |
| 1498 | else |
| 1499 | { |
| 1500 | a.local_ip.as_u32 = sa->raddr.as_u32; |
| 1501 | a.remote_ip.as_u32 = sa->iaddr.as_u32; |
| 1502 | proposals = child->r_proposals; |
| 1503 | a.local_spi = child->i_proposals[0].spi; |
| 1504 | a.remote_spi = child->r_proposals[0].spi; |
| 1505 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1506 | a.anti_replay = 1; |
| 1507 | |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1508 | tr = ikev2_sa_get_td_for_type (proposals, IKEV2_TRANSFORM_TYPE_ESN); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1509 | if (tr) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1510 | a.esn = tr->esn_type; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1511 | else |
| 1512 | a.esn = 0; |
| 1513 | |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1514 | tr = ikev2_sa_get_td_for_type (proposals, IKEV2_TRANSFORM_TYPE_ENCR); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1515 | if (tr) |
| 1516 | { |
| 1517 | if (tr->encr_type == IKEV2_TRANSFORM_ENCR_TYPE_AES_CBC && tr->key_len) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1518 | { |
| 1519 | switch (tr->key_len) |
| 1520 | { |
| 1521 | case 16: |
| 1522 | encr_type = IPSEC_CRYPTO_ALG_AES_CBC_128; |
| 1523 | break; |
| 1524 | case 24: |
| 1525 | encr_type = IPSEC_CRYPTO_ALG_AES_CBC_192; |
| 1526 | break; |
| 1527 | case 32: |
| 1528 | encr_type = IPSEC_CRYPTO_ALG_AES_CBC_256; |
| 1529 | break; |
| 1530 | default: |
| 1531 | ikev2_set_state (sa, IKEV2_STATE_NO_PROPOSAL_CHOSEN); |
| 1532 | return 1; |
| 1533 | break; |
| 1534 | } |
| 1535 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1536 | else |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1537 | { |
| 1538 | ikev2_set_state (sa, IKEV2_STATE_NO_PROPOSAL_CHOSEN); |
| 1539 | return 1; |
| 1540 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1541 | } |
| 1542 | else |
| 1543 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1544 | ikev2_set_state (sa, IKEV2_STATE_NO_PROPOSAL_CHOSEN); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1545 | return 1; |
| 1546 | } |
| 1547 | |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1548 | tr = ikev2_sa_get_td_for_type (proposals, IKEV2_TRANSFORM_TYPE_INTEG); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1549 | if (tr) |
| 1550 | { |
| 1551 | if (tr->integ_type != IKEV2_TRANSFORM_INTEG_TYPE_AUTH_HMAC_SHA1_96) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1552 | { |
| 1553 | ikev2_set_state (sa, IKEV2_STATE_NO_PROPOSAL_CHOSEN); |
| 1554 | return 1; |
| 1555 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1556 | } |
| 1557 | else |
| 1558 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1559 | ikev2_set_state (sa, IKEV2_STATE_NO_PROPOSAL_CHOSEN); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1560 | return 1; |
| 1561 | } |
| 1562 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1563 | ikev2_calc_child_keys (sa, child); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1564 | |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1565 | u8 *loc_ckey, *rem_ckey, *loc_ikey, *rem_ikey; |
| 1566 | if (sa->is_initiator) |
| 1567 | { |
| 1568 | loc_ikey = child->sk_ai; |
| 1569 | rem_ikey = child->sk_ar; |
| 1570 | loc_ckey = child->sk_ei; |
| 1571 | rem_ckey = child->sk_er; |
| 1572 | } |
| 1573 | else |
| 1574 | { |
| 1575 | loc_ikey = child->sk_ar; |
| 1576 | rem_ikey = child->sk_ai; |
| 1577 | loc_ckey = child->sk_er; |
| 1578 | rem_ckey = child->sk_ei; |
| 1579 | } |
| 1580 | |
Matthew Smith | 2838a23 | 2016-06-21 16:05:09 -0500 | [diff] [blame] | 1581 | a.integ_alg = IPSEC_INTEG_ALG_SHA1_96; |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1582 | a.local_integ_key_len = vec_len (loc_ikey); |
| 1583 | clib_memcpy (a.local_integ_key, loc_ikey, a.local_integ_key_len); |
| 1584 | a.remote_integ_key_len = vec_len (rem_ikey); |
| 1585 | clib_memcpy (a.remote_integ_key, rem_ikey, a.remote_integ_key_len); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1586 | |
Matthew Smith | 2838a23 | 2016-06-21 16:05:09 -0500 | [diff] [blame] | 1587 | a.crypto_alg = encr_type; |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1588 | a.local_crypto_key_len = vec_len (loc_ckey); |
| 1589 | clib_memcpy (a.local_crypto_key, loc_ckey, a.local_crypto_key_len); |
| 1590 | a.remote_crypto_key_len = vec_len (rem_ckey); |
| 1591 | clib_memcpy (a.remote_crypto_key, rem_ckey, a.remote_crypto_key_len); |
| 1592 | |
| 1593 | if (sa->profile && sa->profile->lifetime) |
| 1594 | { |
| 1595 | child->time_to_expiration = vlib_time_now (vnm->vlib_main) |
| 1596 | + sa->profile->lifetime; |
| 1597 | if (sa->profile->lifetime_jitter) |
| 1598 | { |
Chris Luke | ab7b8d9 | 2017-09-07 07:40:13 -0400 | [diff] [blame] | 1599 | // This is not much better than rand(3), which Coverity warns |
| 1600 | // is unsuitable for security applications; random_u32 is |
| 1601 | // however fast. If this perturbance to the expiration time |
| 1602 | // needs to use a better RNG then we may need to use something |
| 1603 | // like /dev/urandom which has significant overhead. |
| 1604 | u32 rnd = (u32) (vlib_time_now (vnm->vlib_main) * 1e6); |
| 1605 | rnd = random_u32 (&rnd); |
| 1606 | |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1607 | child->time_to_expiration += |
Chris Luke | ab7b8d9 | 2017-09-07 07:40:13 -0400 | [diff] [blame] | 1608 | 1 + (rnd % sa->profile->lifetime_jitter); |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1609 | } |
| 1610 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1611 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1612 | ipsec_add_del_tunnel_if (&a); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1613 | |
| 1614 | return 0; |
| 1615 | } |
| 1616 | |
| 1617 | static int |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1618 | ikev2_delete_tunnel_interface (vnet_main_t * vnm, ikev2_sa_t * sa, |
| 1619 | ikev2_child_sa_t * child) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1620 | { |
| 1621 | ipsec_add_del_tunnel_args_t a; |
| 1622 | |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1623 | if (sa->is_initiator) |
| 1624 | { |
| 1625 | if (!vec_len (child->i_proposals)) |
| 1626 | return 0; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1627 | |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1628 | a.is_add = 0; |
| 1629 | a.local_ip.as_u32 = sa->iaddr.as_u32; |
| 1630 | a.remote_ip.as_u32 = sa->raddr.as_u32; |
| 1631 | a.local_spi = child->r_proposals[0].spi; |
| 1632 | a.remote_spi = child->i_proposals[0].spi; |
| 1633 | } |
| 1634 | else |
| 1635 | { |
| 1636 | if (!vec_len (child->r_proposals)) |
| 1637 | return 0; |
| 1638 | |
| 1639 | a.is_add = 0; |
| 1640 | a.local_ip.as_u32 = sa->raddr.as_u32; |
| 1641 | a.remote_ip.as_u32 = sa->iaddr.as_u32; |
| 1642 | a.local_spi = child->i_proposals[0].spi; |
| 1643 | a.remote_spi = child->r_proposals[0].spi; |
| 1644 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1645 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1646 | ipsec_add_del_tunnel_if (&a); |
Matthew Smith | 2838a23 | 2016-06-21 16:05:09 -0500 | [diff] [blame] | 1647 | return 0; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1648 | } |
| 1649 | |
| 1650 | static u32 |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1651 | ikev2_generate_message (ikev2_sa_t * sa, ike_header_t * ike, void *user) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1652 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1653 | v8 *integ = 0; |
| 1654 | ike_payload_header_t *ph; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1655 | u16 plen; |
| 1656 | u32 tlen = 0; |
| 1657 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1658 | ikev2_sa_transform_t *tr_encr, *tr_integ; |
| 1659 | tr_encr = |
| 1660 | ikev2_sa_get_td_for_type (sa->r_proposals, IKEV2_TRANSFORM_TYPE_ENCR); |
| 1661 | tr_integ = |
| 1662 | ikev2_sa_get_td_for_type (sa->r_proposals, IKEV2_TRANSFORM_TYPE_INTEG); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1663 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1664 | ikev2_payload_chain_t *chain = 0; |
| 1665 | ikev2_payload_new_chain (chain); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1666 | |
| 1667 | if (ike->exchange == IKEV2_EXCHANGE_SA_INIT) |
| 1668 | { |
| 1669 | if (sa->r_proposals == 0) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1670 | { |
| 1671 | ikev2_payload_add_notify (chain, |
| 1672 | IKEV2_NOTIFY_MSG_NO_PROPOSAL_CHOSEN, 0); |
| 1673 | ikev2_set_state (sa, IKEV2_STATE_NOTIFY_AND_DELETE); |
| 1674 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1675 | else if (sa->dh_group == IKEV2_TRANSFORM_DH_TYPE_NONE) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1676 | { |
| 1677 | u8 *data = vec_new (u8, 2); |
| 1678 | ikev2_sa_transform_t *tr_dh; |
| 1679 | tr_dh = |
| 1680 | ikev2_sa_get_td_for_type (sa->r_proposals, |
| 1681 | IKEV2_TRANSFORM_TYPE_DH); |
| 1682 | ASSERT (tr_dh && tr_dh->dh_type); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1683 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1684 | data[0] = (tr_dh->dh_type >> 8) & 0xff; |
| 1685 | data[1] = (tr_dh->dh_type) & 0xff; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1686 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1687 | ikev2_payload_add_notify (chain, |
| 1688 | IKEV2_NOTIFY_MSG_INVALID_KE_PAYLOAD, |
| 1689 | data); |
| 1690 | vec_free (data); |
| 1691 | ikev2_set_state (sa, IKEV2_STATE_NOTIFY_AND_DELETE); |
| 1692 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1693 | else if (sa->state == IKEV2_STATE_NOTIFY_AND_DELETE) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1694 | { |
| 1695 | u8 *data = vec_new (u8, 1); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1696 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1697 | data[0] = sa->unsupported_cp; |
| 1698 | ikev2_payload_add_notify (chain, |
| 1699 | IKEV2_NOTIFY_MSG_UNSUPPORTED_CRITICAL_PAYLOAD, |
| 1700 | data); |
| 1701 | vec_free (data); |
| 1702 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1703 | else |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1704 | { |
| 1705 | ike->rspi = clib_host_to_net_u64 (sa->rspi); |
| 1706 | ikev2_payload_add_sa (chain, sa->r_proposals); |
| 1707 | ikev2_payload_add_ke (chain, sa->dh_group, sa->r_dh_data); |
| 1708 | ikev2_payload_add_nonce (chain, sa->r_nonce); |
| 1709 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1710 | } |
| 1711 | else if (ike->exchange == IKEV2_EXCHANGE_IKE_AUTH) |
| 1712 | { |
| 1713 | if (sa->state == IKEV2_STATE_AUTHENTICATED) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1714 | { |
| 1715 | ikev2_payload_add_id (chain, &sa->r_id, IKEV2_PAYLOAD_IDR); |
| 1716 | ikev2_payload_add_auth (chain, &sa->r_auth); |
| 1717 | ikev2_payload_add_sa (chain, sa->childs[0].r_proposals); |
| 1718 | ikev2_payload_add_ts (chain, sa->childs[0].tsi, IKEV2_PAYLOAD_TSI); |
| 1719 | ikev2_payload_add_ts (chain, sa->childs[0].tsr, IKEV2_PAYLOAD_TSR); |
| 1720 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1721 | else if (sa->state == IKEV2_STATE_AUTH_FAILED) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1722 | { |
| 1723 | ikev2_payload_add_notify (chain, |
| 1724 | IKEV2_NOTIFY_MSG_AUTHENTICATION_FAILED, |
| 1725 | 0); |
| 1726 | ikev2_set_state (sa, IKEV2_STATE_NOTIFY_AND_DELETE); |
| 1727 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1728 | else if (sa->state == IKEV2_STATE_TS_UNACCEPTABLE) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1729 | { |
| 1730 | ikev2_payload_add_notify (chain, IKEV2_NOTIFY_MSG_TS_UNACCEPTABLE, |
| 1731 | 0); |
| 1732 | ikev2_payload_add_id (chain, &sa->r_id, IKEV2_PAYLOAD_IDR); |
| 1733 | ikev2_payload_add_auth (chain, &sa->r_auth); |
| 1734 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1735 | else if (sa->state == IKEV2_STATE_NO_PROPOSAL_CHOSEN) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1736 | { |
| 1737 | ikev2_payload_add_notify (chain, |
| 1738 | IKEV2_NOTIFY_MSG_NO_PROPOSAL_CHOSEN, 0); |
| 1739 | ikev2_payload_add_id (chain, &sa->r_id, IKEV2_PAYLOAD_IDR); |
| 1740 | ikev2_payload_add_auth (chain, &sa->r_auth); |
| 1741 | ikev2_payload_add_ts (chain, sa->childs[0].tsi, IKEV2_PAYLOAD_TSI); |
| 1742 | ikev2_payload_add_ts (chain, sa->childs[0].tsr, IKEV2_PAYLOAD_TSR); |
| 1743 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1744 | else if (sa->state == IKEV2_STATE_NOTIFY_AND_DELETE) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1745 | { |
| 1746 | u8 *data = vec_new (u8, 1); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1747 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1748 | data[0] = sa->unsupported_cp; |
| 1749 | ikev2_payload_add_notify (chain, |
| 1750 | IKEV2_NOTIFY_MSG_UNSUPPORTED_CRITICAL_PAYLOAD, |
| 1751 | data); |
| 1752 | vec_free (data); |
| 1753 | } |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1754 | else if (sa->state == IKEV2_STATE_SA_INIT) |
| 1755 | { |
| 1756 | ikev2_payload_add_id (chain, &sa->i_id, IKEV2_PAYLOAD_IDI); |
| 1757 | ikev2_payload_add_auth (chain, &sa->i_auth); |
| 1758 | ikev2_payload_add_sa (chain, sa->childs[0].i_proposals); |
| 1759 | ikev2_payload_add_ts (chain, sa->childs[0].tsi, IKEV2_PAYLOAD_TSI); |
| 1760 | ikev2_payload_add_ts (chain, sa->childs[0].tsr, IKEV2_PAYLOAD_TSR); |
| 1761 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1762 | else |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1763 | { |
| 1764 | ikev2_set_state (sa, IKEV2_STATE_DELETED); |
| 1765 | goto done; |
| 1766 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1767 | } |
| 1768 | else if (ike->exchange == IKEV2_EXCHANGE_INFORMATIONAL) |
| 1769 | { |
| 1770 | /* if pending delete */ |
| 1771 | if (sa->del) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1772 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1773 | if (sa->del[0].protocol_id == IKEV2_PROTOCOL_IKE) |
| 1774 | { |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1775 | if (sa->is_initiator) |
| 1776 | ikev2_payload_add_delete (chain, sa->del); |
| 1777 | |
| 1778 | /* The response to a request that deletes the IKE SA is an empty |
| 1779 | INFORMATIONAL response. */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1780 | ikev2_set_state (sa, IKEV2_STATE_NOTIFY_AND_DELETE); |
| 1781 | } |
| 1782 | /* The response to a request that deletes ESP or AH SAs will contain |
| 1783 | delete payloads for the paired SAs going in the other direction. */ |
| 1784 | else |
| 1785 | { |
| 1786 | ikev2_payload_add_delete (chain, sa->del); |
| 1787 | } |
| 1788 | vec_free (sa->del); |
| 1789 | sa->del = 0; |
| 1790 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1791 | /* received N(AUTHENTICATION_FAILED) */ |
| 1792 | else if (sa->state == IKEV2_STATE_AUTH_FAILED) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1793 | { |
| 1794 | ikev2_set_state (sa, IKEV2_STATE_DELETED); |
| 1795 | goto done; |
| 1796 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1797 | /* received unsupported critical payload */ |
| 1798 | else if (sa->unsupported_cp) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1799 | { |
| 1800 | u8 *data = vec_new (u8, 1); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1801 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1802 | data[0] = sa->unsupported_cp; |
| 1803 | ikev2_payload_add_notify (chain, |
| 1804 | IKEV2_NOTIFY_MSG_UNSUPPORTED_CRITICAL_PAYLOAD, |
| 1805 | data); |
| 1806 | vec_free (data); |
| 1807 | sa->unsupported_cp = 0; |
| 1808 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1809 | /* else send empty response */ |
| 1810 | } |
| 1811 | else if (ike->exchange == IKEV2_EXCHANGE_CREATE_CHILD_SA) |
| 1812 | { |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1813 | if (sa->is_initiator) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1814 | { |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1815 | |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1816 | ikev2_sa_proposal_t *proposals = (ikev2_sa_proposal_t *) user; |
| 1817 | ikev2_notify_t notify; |
| 1818 | u8 *data = vec_new (u8, 4); |
| 1819 | memset (¬ify, 0, sizeof (notify)); |
| 1820 | notify.protocol_id = IKEV2_PROTOCOL_ESP; |
| 1821 | notify.spi = sa->childs[0].i_proposals->spi; |
| 1822 | *(u32 *) data = clib_host_to_net_u32 (notify.spi); |
| 1823 | |
| 1824 | ikev2_payload_add_sa (chain, proposals); |
| 1825 | ikev2_payload_add_nonce (chain, sa->i_nonce); |
| 1826 | ikev2_payload_add_ts (chain, sa->childs[0].tsi, IKEV2_PAYLOAD_TSI); |
| 1827 | ikev2_payload_add_ts (chain, sa->childs[0].tsr, IKEV2_PAYLOAD_TSR); |
| 1828 | ikev2_payload_add_notify_2 (chain, IKEV2_NOTIFY_MSG_REKEY_SA, data, |
| 1829 | ¬ify); |
| 1830 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1831 | vec_free (data); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1832 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1833 | else |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1834 | { |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1835 | if (sa->rekey) |
| 1836 | { |
| 1837 | ikev2_payload_add_sa (chain, sa->rekey[0].r_proposal); |
| 1838 | ikev2_payload_add_nonce (chain, sa->r_nonce); |
| 1839 | ikev2_payload_add_ts (chain, sa->rekey[0].tsi, |
| 1840 | IKEV2_PAYLOAD_TSI); |
| 1841 | ikev2_payload_add_ts (chain, sa->rekey[0].tsr, |
| 1842 | IKEV2_PAYLOAD_TSR); |
| 1843 | vec_del1 (sa->rekey, 0); |
| 1844 | } |
| 1845 | else if (sa->unsupported_cp) |
| 1846 | { |
| 1847 | u8 *data = vec_new (u8, 1); |
| 1848 | |
| 1849 | data[0] = sa->unsupported_cp; |
| 1850 | ikev2_payload_add_notify (chain, |
| 1851 | IKEV2_NOTIFY_MSG_UNSUPPORTED_CRITICAL_PAYLOAD, |
| 1852 | data); |
| 1853 | vec_free (data); |
| 1854 | sa->unsupported_cp = 0; |
| 1855 | } |
| 1856 | else |
| 1857 | { |
| 1858 | ikev2_payload_add_notify (chain, |
| 1859 | IKEV2_NOTIFY_MSG_NO_ADDITIONAL_SAS, |
| 1860 | 0); |
| 1861 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1862 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1863 | } |
| 1864 | |
| 1865 | /* IKEv2 header */ |
| 1866 | ike->version = IKE_VERSION_2; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1867 | ike->nextpayload = IKEV2_PAYLOAD_SK; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1868 | tlen = sizeof (*ike); |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1869 | if (sa->is_initiator) |
| 1870 | { |
| 1871 | ike->flags = IKEV2_HDR_FLAG_INITIATOR; |
| 1872 | sa->last_init_msg_id = clib_net_to_host_u32 (ike->msgid); |
| 1873 | } |
| 1874 | else |
| 1875 | { |
| 1876 | ike->flags = IKEV2_HDR_FLAG_RESPONSE; |
| 1877 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1878 | |
| 1879 | |
| 1880 | if (ike->exchange == IKEV2_EXCHANGE_SA_INIT) |
| 1881 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1882 | tlen += vec_len (chain->data); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1883 | ike->nextpayload = chain->first_payload_type; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1884 | ike->length = clib_host_to_net_u32 (tlen); |
| 1885 | clib_memcpy (ike->payload, chain->data, vec_len (chain->data)); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1886 | |
| 1887 | /* store whole IKE payload - needed for PSK auth */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1888 | vec_free (sa->last_sa_init_res_packet_data); |
| 1889 | vec_add (sa->last_sa_init_res_packet_data, ike, tlen); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1890 | } |
| 1891 | else |
| 1892 | { |
| 1893 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1894 | ikev2_payload_chain_add_padding (chain, tr_encr->block_size); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1895 | |
| 1896 | /* SK payload */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1897 | plen = sizeof (*ph); |
| 1898 | ph = (ike_payload_header_t *) & ike->payload[0]; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1899 | ph->nextpayload = chain->first_payload_type; |
| 1900 | ph->flags = 0; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1901 | int enc_len = ikev2_encrypt_data (sa, chain->data, ph->payload); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1902 | plen += enc_len; |
| 1903 | |
| 1904 | /* add space for hmac */ |
| 1905 | plen += tr_integ->key_trunc; |
| 1906 | tlen += plen; |
| 1907 | |
| 1908 | /* payload and total length */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1909 | ph->length = clib_host_to_net_u16 (plen); |
| 1910 | ike->length = clib_host_to_net_u32 (tlen); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1911 | |
| 1912 | /* calc integrity data for whole packet except hash itself */ |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 1913 | integ = |
| 1914 | ikev2_calc_integr (tr_integ, sa->is_initiator ? sa->sk_ai : sa->sk_ar, |
| 1915 | (u8 *) ike, tlen - tr_integ->key_trunc); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1916 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1917 | clib_memcpy (ike->payload + tlen - tr_integ->key_trunc - sizeof (*ike), |
| 1918 | integ, tr_integ->key_trunc); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1919 | |
| 1920 | /* store whole IKE payload - needed for retransmit */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1921 | vec_free (sa->last_res_packet_data); |
| 1922 | vec_add (sa->last_res_packet_data, ike, tlen); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1923 | } |
| 1924 | |
| 1925 | done: |
| 1926 | ikev2_payload_destroy_chain (chain); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1927 | vec_free (integ); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1928 | return tlen; |
| 1929 | } |
| 1930 | |
| 1931 | static int |
| 1932 | ikev2_retransmit_sa_init (ike_header_t * ike, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1933 | ip4_address_t iaddr, ip4_address_t raddr) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1934 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1935 | ikev2_main_t *km = &ikev2_main; |
| 1936 | ikev2_sa_t *sa; |
Damjan Marion | 586afd7 | 2017-04-05 19:18:20 +0200 | [diff] [blame] | 1937 | u32 thread_index = vlib_get_thread_index (); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1938 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1939 | /* *INDENT-OFF* */ |
Damjan Marion | 586afd7 | 2017-04-05 19:18:20 +0200 | [diff] [blame] | 1940 | pool_foreach (sa, km->per_thread_data[thread_index].sas, ({ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1941 | if (sa->ispi == clib_net_to_host_u64(ike->ispi) && |
| 1942 | sa->iaddr.as_u32 == iaddr.as_u32 && |
| 1943 | sa->raddr.as_u32 == raddr.as_u32) |
| 1944 | { |
| 1945 | int p = 0; |
| 1946 | u32 len = clib_net_to_host_u32(ike->length); |
| 1947 | u8 payload = ike->nextpayload; |
| 1948 | |
| 1949 | while (p < len && payload!= IKEV2_PAYLOAD_NONE) { |
| 1950 | ike_payload_header_t * ikep = (ike_payload_header_t *) &ike->payload[p]; |
| 1951 | u32 plen = clib_net_to_host_u16(ikep->length); |
| 1952 | |
| 1953 | if (plen < sizeof(ike_payload_header_t)) |
| 1954 | return -1; |
| 1955 | |
| 1956 | if (payload == IKEV2_PAYLOAD_NONCE) |
| 1957 | { |
| 1958 | if (!memcmp(sa->i_nonce, ikep->payload, plen - sizeof(*ikep))) |
| 1959 | { |
| 1960 | /* req is retransmit */ |
| 1961 | if (sa->state == IKEV2_STATE_SA_INIT) |
| 1962 | { |
| 1963 | ike_header_t * tmp; |
| 1964 | tmp = (ike_header_t*)sa->last_sa_init_res_packet_data; |
| 1965 | ike->ispi = tmp->ispi; |
| 1966 | ike->rspi = tmp->rspi; |
| 1967 | ike->nextpayload = tmp->nextpayload; |
| 1968 | ike->version = tmp->version; |
| 1969 | ike->exchange = tmp->exchange; |
| 1970 | ike->flags = tmp->flags; |
| 1971 | ike->msgid = tmp->msgid; |
| 1972 | ike->length = tmp->length; |
Damjan Marion | f1213b8 | 2016-03-13 02:22:06 +0100 | [diff] [blame] | 1973 | clib_memcpy(ike->payload, tmp->payload, |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1974 | clib_net_to_host_u32(tmp->length) - sizeof(*ike)); |
| 1975 | clib_warning("IKE_SA_INIT retransmit from %U to %U", |
| 1976 | format_ip4_address, &raddr, |
| 1977 | format_ip4_address, &iaddr); |
| 1978 | return 1; |
| 1979 | } |
| 1980 | /* else ignore req */ |
| 1981 | else |
| 1982 | { |
| 1983 | clib_warning("IKE_SA_INIT ignore from %U to %U", |
| 1984 | format_ip4_address, &raddr, |
| 1985 | format_ip4_address, &iaddr); |
| 1986 | return -1; |
| 1987 | } |
| 1988 | } |
| 1989 | } |
| 1990 | payload = ikep->nextpayload; |
| 1991 | p+=plen; |
| 1992 | } |
| 1993 | } |
| 1994 | })); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 1995 | /* *INDENT-ON* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 1996 | |
| 1997 | /* req is not retransmit */ |
| 1998 | return 0; |
| 1999 | } |
| 2000 | |
| 2001 | static int |
| 2002 | ikev2_retransmit_resp (ikev2_sa_t * sa, ike_header_t * ike) |
| 2003 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2004 | u32 msg_id = clib_net_to_host_u32 (ike->msgid); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2005 | |
| 2006 | /* new req */ |
| 2007 | if (msg_id > sa->last_msg_id) |
| 2008 | { |
| 2009 | sa->last_msg_id = msg_id; |
| 2010 | return 0; |
| 2011 | } |
| 2012 | /* retransmitted req */ |
| 2013 | else if (msg_id == sa->last_msg_id) |
| 2014 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2015 | ike_header_t *tmp; |
| 2016 | tmp = (ike_header_t *) sa->last_res_packet_data; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2017 | ike->ispi = tmp->ispi; |
| 2018 | ike->rspi = tmp->rspi; |
| 2019 | ike->nextpayload = tmp->nextpayload; |
| 2020 | ike->version = tmp->version; |
| 2021 | ike->exchange = tmp->exchange; |
| 2022 | ike->flags = tmp->flags; |
| 2023 | ike->msgid = tmp->msgid; |
| 2024 | ike->length = tmp->length; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2025 | clib_memcpy (ike->payload, tmp->payload, |
| 2026 | clib_net_to_host_u32 (tmp->length) - sizeof (*ike)); |
| 2027 | clib_warning ("IKE msgid %u retransmit from %U to %U", |
| 2028 | msg_id, |
| 2029 | format_ip4_address, &sa->raddr, |
| 2030 | format_ip4_address, &sa->iaddr); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2031 | return 1; |
| 2032 | } |
| 2033 | /* old req ignore */ |
| 2034 | else |
| 2035 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2036 | clib_warning ("IKE msgid %u req ignore from %U to %U", |
| 2037 | msg_id, |
| 2038 | format_ip4_address, &sa->raddr, |
| 2039 | format_ip4_address, &sa->iaddr); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2040 | return -1; |
| 2041 | } |
| 2042 | } |
| 2043 | |
| 2044 | static uword |
| 2045 | ikev2_node_fn (vlib_main_t * vm, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2046 | vlib_node_runtime_t * node, vlib_frame_t * frame) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2047 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2048 | u32 n_left_from, *from, *to_next; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2049 | ikev2_next_t next_index; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2050 | ikev2_main_t *km = &ikev2_main; |
Damjan Marion | 586afd7 | 2017-04-05 19:18:20 +0200 | [diff] [blame] | 2051 | u32 thread_index = vlib_get_thread_index (); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2052 | |
| 2053 | from = vlib_frame_vector_args (frame); |
| 2054 | n_left_from = frame->n_vectors; |
| 2055 | next_index = node->cached_next_index; |
| 2056 | |
| 2057 | while (n_left_from > 0) |
| 2058 | { |
| 2059 | u32 n_left_to_next; |
| 2060 | |
| 2061 | vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next); |
| 2062 | |
| 2063 | while (n_left_from > 0 && n_left_to_next > 0) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2064 | { |
| 2065 | u32 bi0; |
| 2066 | vlib_buffer_t *b0; |
| 2067 | u32 next0 = IKEV2_NEXT_ERROR_DROP; |
| 2068 | u32 sw_if_index0; |
| 2069 | ip4_header_t *ip40; |
| 2070 | udp_header_t *udp0; |
| 2071 | ike_header_t *ike0; |
| 2072 | ikev2_sa_t *sa0 = 0; |
Damjan Marion | 3f54b18 | 2016-08-16 11:27:02 +0200 | [diff] [blame] | 2073 | ikev2_sa_t sa; /* temporary store for SA */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2074 | int len = 0; |
| 2075 | int r; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2076 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2077 | /* speculatively enqueue b0 to the current next frame */ |
| 2078 | bi0 = from[0]; |
| 2079 | to_next[0] = bi0; |
| 2080 | from += 1; |
| 2081 | to_next += 1; |
| 2082 | n_left_from -= 1; |
| 2083 | n_left_to_next -= 1; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2084 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2085 | b0 = vlib_get_buffer (vm, bi0); |
| 2086 | ike0 = vlib_buffer_get_current (b0); |
| 2087 | vlib_buffer_advance (b0, -sizeof (*udp0)); |
| 2088 | udp0 = vlib_buffer_get_current (b0); |
| 2089 | vlib_buffer_advance (b0, -sizeof (*ip40)); |
| 2090 | ip40 = vlib_buffer_get_current (b0); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2091 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2092 | if (ike0->version != IKE_VERSION_2) |
| 2093 | { |
| 2094 | vlib_node_increment_counter (vm, ikev2_node.index, |
| 2095 | IKEV2_ERROR_NOT_IKEV2, 1); |
| 2096 | goto dispatch0; |
| 2097 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2098 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2099 | if (ike0->exchange == IKEV2_EXCHANGE_SA_INIT) |
| 2100 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2101 | sa0 = &sa; |
| 2102 | memset (sa0, 0, sizeof (*sa0)); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2103 | |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 2104 | if (ike0->flags & IKEV2_HDR_FLAG_INITIATOR) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2105 | { |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 2106 | if (ike0->rspi == 0) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2107 | { |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 2108 | sa0->raddr.as_u32 = ip40->dst_address.as_u32; |
| 2109 | sa0->iaddr.as_u32 = ip40->src_address.as_u32; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2110 | |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 2111 | r = ikev2_retransmit_sa_init (ike0, sa0->iaddr, |
| 2112 | sa0->raddr); |
| 2113 | if (r == 1) |
| 2114 | { |
| 2115 | vlib_node_increment_counter (vm, ikev2_node.index, |
| 2116 | IKEV2_ERROR_IKE_SA_INIT_RETRANSMIT, |
| 2117 | 1); |
| 2118 | len = clib_net_to_host_u32 (ike0->length); |
| 2119 | goto dispatch0; |
| 2120 | } |
| 2121 | else if (r == -1) |
| 2122 | { |
| 2123 | vlib_node_increment_counter (vm, ikev2_node.index, |
| 2124 | IKEV2_ERROR_IKE_SA_INIT_IGNORE, |
| 2125 | 1); |
| 2126 | goto dispatch0; |
| 2127 | } |
| 2128 | |
| 2129 | ikev2_process_sa_init_req (vm, sa0, ike0); |
| 2130 | |
| 2131 | if (sa0->state == IKEV2_STATE_SA_INIT) |
| 2132 | { |
| 2133 | ikev2_sa_free_proposal_vector (&sa0->r_proposals); |
| 2134 | sa0->r_proposals = |
| 2135 | ikev2_select_proposal (sa0->i_proposals, |
| 2136 | IKEV2_PROTOCOL_IKE); |
| 2137 | ikev2_generate_sa_init_data (sa0); |
| 2138 | } |
| 2139 | |
| 2140 | if (sa0->state == IKEV2_STATE_SA_INIT |
| 2141 | || sa0->state == IKEV2_STATE_NOTIFY_AND_DELETE) |
| 2142 | { |
| 2143 | len = ikev2_generate_message (sa0, ike0, 0); |
| 2144 | } |
| 2145 | |
| 2146 | if (sa0->state == IKEV2_STATE_SA_INIT) |
| 2147 | { |
| 2148 | /* add SA to the pool */ |
Damjan Marion | 586afd7 | 2017-04-05 19:18:20 +0200 | [diff] [blame] | 2149 | pool_get (km->per_thread_data[thread_index].sas, |
| 2150 | sa0); |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 2151 | clib_memcpy (sa0, &sa, sizeof (*sa0)); |
Damjan Marion | 586afd7 | 2017-04-05 19:18:20 +0200 | [diff] [blame] | 2152 | hash_set (km-> |
| 2153 | per_thread_data[thread_index].sa_by_rspi, |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 2154 | sa0->rspi, |
Damjan Marion | 586afd7 | 2017-04-05 19:18:20 +0200 | [diff] [blame] | 2155 | sa0 - |
| 2156 | km->per_thread_data[thread_index].sas); |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 2157 | } |
| 2158 | else |
| 2159 | { |
| 2160 | ikev2_sa_free_all_vec (sa0); |
| 2161 | } |
| 2162 | } |
| 2163 | } |
| 2164 | else |
| 2165 | { |
| 2166 | ikev2_process_sa_init_resp (vm, sa0, ike0); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2167 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2168 | if (sa0->state == IKEV2_STATE_SA_INIT) |
| 2169 | { |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 2170 | ike0->exchange = IKEV2_EXCHANGE_IKE_AUTH; |
| 2171 | uword *p = hash_get (km->sa_by_ispi, ike0->ispi); |
| 2172 | if (p) |
| 2173 | { |
| 2174 | ikev2_sa_t *sai = |
| 2175 | pool_elt_at_index (km->sais, p[0]); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2176 | |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 2177 | ikev2_complete_sa_data (sa0, sai); |
| 2178 | ikev2_calc_keys (sa0); |
| 2179 | ikev2_sa_auth_init (sa0); |
| 2180 | len = ikev2_generate_message (sa0, ike0, 0); |
| 2181 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2182 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2183 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2184 | if (sa0->state == IKEV2_STATE_SA_INIT) |
| 2185 | { |
| 2186 | /* add SA to the pool */ |
Damjan Marion | 586afd7 | 2017-04-05 19:18:20 +0200 | [diff] [blame] | 2187 | pool_get (km->per_thread_data[thread_index].sas, sa0); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2188 | clib_memcpy (sa0, &sa, sizeof (*sa0)); |
Damjan Marion | 586afd7 | 2017-04-05 19:18:20 +0200 | [diff] [blame] | 2189 | hash_set (km->per_thread_data[thread_index].sa_by_rspi, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2190 | sa0->rspi, |
Damjan Marion | 586afd7 | 2017-04-05 19:18:20 +0200 | [diff] [blame] | 2191 | sa0 - km->per_thread_data[thread_index].sas); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2192 | } |
| 2193 | else |
| 2194 | { |
| 2195 | ikev2_sa_free_all_vec (sa0); |
| 2196 | } |
| 2197 | } |
| 2198 | } |
| 2199 | else if (ike0->exchange == IKEV2_EXCHANGE_IKE_AUTH) |
| 2200 | { |
| 2201 | uword *p; |
Damjan Marion | 586afd7 | 2017-04-05 19:18:20 +0200 | [diff] [blame] | 2202 | p = hash_get (km->per_thread_data[thread_index].sa_by_rspi, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2203 | clib_net_to_host_u64 (ike0->rspi)); |
| 2204 | if (p) |
| 2205 | { |
Damjan Marion | 586afd7 | 2017-04-05 19:18:20 +0200 | [diff] [blame] | 2206 | sa0 = |
| 2207 | pool_elt_at_index (km->per_thread_data[thread_index].sas, |
| 2208 | p[0]); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2209 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2210 | r = ikev2_retransmit_resp (sa0, ike0); |
| 2211 | if (r == 1) |
| 2212 | { |
| 2213 | vlib_node_increment_counter (vm, ikev2_node.index, |
| 2214 | IKEV2_ERROR_IKE_REQ_RETRANSMIT, |
| 2215 | 1); |
| 2216 | len = clib_net_to_host_u32 (ike0->length); |
| 2217 | goto dispatch0; |
| 2218 | } |
| 2219 | else if (r == -1) |
| 2220 | { |
| 2221 | vlib_node_increment_counter (vm, ikev2_node.index, |
| 2222 | IKEV2_ERROR_IKE_REQ_IGNORE, |
| 2223 | 1); |
| 2224 | goto dispatch0; |
| 2225 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2226 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2227 | ikev2_process_auth_req (vm, sa0, ike0); |
| 2228 | ikev2_sa_auth (sa0); |
| 2229 | if (sa0->state == IKEV2_STATE_AUTHENTICATED) |
| 2230 | { |
| 2231 | ikev2_initial_contact_cleanup (sa0); |
| 2232 | ikev2_sa_match_ts (sa0); |
| 2233 | if (sa0->state != IKEV2_STATE_TS_UNACCEPTABLE) |
| 2234 | ikev2_create_tunnel_interface (km->vnet_main, sa0, |
| 2235 | &sa0->childs[0]); |
| 2236 | } |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 2237 | |
| 2238 | if (sa0->is_initiator) |
| 2239 | { |
| 2240 | uword *p = hash_get (km->sa_by_ispi, ike0->ispi); |
| 2241 | if (p) |
| 2242 | { |
| 2243 | ikev2_sa_t *sai = |
| 2244 | pool_elt_at_index (km->sais, p[0]); |
| 2245 | hash_unset (km->sa_by_ispi, sai->ispi); |
| 2246 | ikev2_sa_free_all_vec (sai); |
| 2247 | pool_put (km->sais, sai); |
| 2248 | } |
| 2249 | } |
| 2250 | else |
| 2251 | { |
| 2252 | len = ikev2_generate_message (sa0, ike0, 0); |
| 2253 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2254 | } |
| 2255 | } |
| 2256 | else if (ike0->exchange == IKEV2_EXCHANGE_INFORMATIONAL) |
| 2257 | { |
| 2258 | uword *p; |
Damjan Marion | 586afd7 | 2017-04-05 19:18:20 +0200 | [diff] [blame] | 2259 | p = hash_get (km->per_thread_data[thread_index].sa_by_rspi, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2260 | clib_net_to_host_u64 (ike0->rspi)); |
| 2261 | if (p) |
| 2262 | { |
Damjan Marion | 586afd7 | 2017-04-05 19:18:20 +0200 | [diff] [blame] | 2263 | sa0 = |
| 2264 | pool_elt_at_index (km->per_thread_data[thread_index].sas, |
| 2265 | p[0]); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2266 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2267 | r = ikev2_retransmit_resp (sa0, ike0); |
| 2268 | if (r == 1) |
| 2269 | { |
| 2270 | vlib_node_increment_counter (vm, ikev2_node.index, |
| 2271 | IKEV2_ERROR_IKE_REQ_RETRANSMIT, |
| 2272 | 1); |
| 2273 | len = clib_net_to_host_u32 (ike0->length); |
| 2274 | goto dispatch0; |
| 2275 | } |
| 2276 | else if (r == -1) |
| 2277 | { |
| 2278 | vlib_node_increment_counter (vm, ikev2_node.index, |
| 2279 | IKEV2_ERROR_IKE_REQ_IGNORE, |
| 2280 | 1); |
| 2281 | goto dispatch0; |
| 2282 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2283 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2284 | ikev2_process_informational_req (vm, sa0, ike0); |
| 2285 | if (sa0->del) |
| 2286 | { |
| 2287 | if (sa0->del[0].protocol_id != IKEV2_PROTOCOL_IKE) |
| 2288 | { |
| 2289 | ikev2_delete_t *d, *tmp, *resp = 0; |
| 2290 | vec_foreach (d, sa0->del) |
| 2291 | { |
| 2292 | ikev2_child_sa_t *ch_sa; |
| 2293 | ch_sa = ikev2_sa_get_child (sa0, d->spi, |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 2294 | d->protocol_id, |
| 2295 | !sa0->is_initiator); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2296 | if (ch_sa) |
| 2297 | { |
| 2298 | ikev2_delete_tunnel_interface (km->vnet_main, |
| 2299 | sa0, ch_sa); |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 2300 | if (!sa0->is_initiator) |
| 2301 | { |
| 2302 | vec_add2 (resp, tmp, 1); |
| 2303 | tmp->protocol_id = d->protocol_id; |
| 2304 | tmp->spi = ch_sa->r_proposals[0].spi; |
| 2305 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2306 | ikev2_sa_del_child_sa (sa0, ch_sa); |
| 2307 | } |
| 2308 | } |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 2309 | if (!sa0->is_initiator) |
| 2310 | { |
| 2311 | vec_free (sa0->del); |
| 2312 | sa0->del = resp; |
| 2313 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2314 | } |
| 2315 | } |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 2316 | if (!sa0->is_initiator) |
| 2317 | { |
| 2318 | len = ikev2_generate_message (sa0, ike0, 0); |
| 2319 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2320 | } |
| 2321 | } |
| 2322 | else if (ike0->exchange == IKEV2_EXCHANGE_CREATE_CHILD_SA) |
| 2323 | { |
| 2324 | uword *p; |
Damjan Marion | 586afd7 | 2017-04-05 19:18:20 +0200 | [diff] [blame] | 2325 | p = hash_get (km->per_thread_data[thread_index].sa_by_rspi, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2326 | clib_net_to_host_u64 (ike0->rspi)); |
| 2327 | if (p) |
| 2328 | { |
Damjan Marion | 586afd7 | 2017-04-05 19:18:20 +0200 | [diff] [blame] | 2329 | sa0 = |
| 2330 | pool_elt_at_index (km->per_thread_data[thread_index].sas, |
| 2331 | p[0]); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2332 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2333 | r = ikev2_retransmit_resp (sa0, ike0); |
| 2334 | if (r == 1) |
| 2335 | { |
| 2336 | vlib_node_increment_counter (vm, ikev2_node.index, |
| 2337 | IKEV2_ERROR_IKE_REQ_RETRANSMIT, |
| 2338 | 1); |
| 2339 | len = clib_net_to_host_u32 (ike0->length); |
| 2340 | goto dispatch0; |
| 2341 | } |
| 2342 | else if (r == -1) |
| 2343 | { |
| 2344 | vlib_node_increment_counter (vm, ikev2_node.index, |
| 2345 | IKEV2_ERROR_IKE_REQ_IGNORE, |
| 2346 | 1); |
| 2347 | goto dispatch0; |
| 2348 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2349 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2350 | ikev2_process_create_child_sa_req (vm, sa0, ike0); |
| 2351 | if (sa0->rekey) |
| 2352 | { |
| 2353 | if (sa0->rekey[0].protocol_id != IKEV2_PROTOCOL_IKE) |
| 2354 | { |
| 2355 | ikev2_child_sa_t *child; |
| 2356 | vec_add2 (sa0->childs, child, 1); |
| 2357 | child->r_proposals = sa0->rekey[0].r_proposal; |
| 2358 | child->i_proposals = sa0->rekey[0].i_proposal; |
| 2359 | child->tsi = sa0->rekey[0].tsi; |
| 2360 | child->tsr = sa0->rekey[0].tsr; |
| 2361 | ikev2_create_tunnel_interface (km->vnet_main, sa0, |
| 2362 | child); |
| 2363 | } |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 2364 | if (sa0->is_initiator) |
| 2365 | { |
| 2366 | vec_del1 (sa0->rekey, 0); |
| 2367 | } |
| 2368 | else |
| 2369 | { |
| 2370 | len = ikev2_generate_message (sa0, ike0, 0); |
| 2371 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2372 | } |
| 2373 | } |
| 2374 | } |
| 2375 | else |
| 2376 | { |
| 2377 | clib_warning ("IKEv2 exchange %u packet received from %U to %U", |
| 2378 | ike0->exchange, |
| 2379 | format_ip4_address, ip40->src_address.as_u8, |
| 2380 | format_ip4_address, ip40->dst_address.as_u8); |
| 2381 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2382 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2383 | dispatch0: |
| 2384 | /* if we are sending packet back, rewrite headers */ |
| 2385 | if (len) |
| 2386 | { |
| 2387 | next0 = IKEV2_NEXT_IP4_LOOKUP; |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 2388 | if (sa0->is_initiator) |
| 2389 | { |
| 2390 | ip40->dst_address.as_u32 = sa0->raddr.as_u32; |
| 2391 | ip40->src_address.as_u32 = sa0->iaddr.as_u32; |
| 2392 | } |
| 2393 | else |
| 2394 | { |
| 2395 | ip40->dst_address.as_u32 = sa0->iaddr.as_u32; |
| 2396 | ip40->src_address.as_u32 = sa0->raddr.as_u32; |
| 2397 | } |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2398 | udp0->length = |
| 2399 | clib_host_to_net_u16 (len + sizeof (udp_header_t)); |
| 2400 | udp0->checksum = 0; |
| 2401 | b0->current_length = |
| 2402 | len + sizeof (ip4_header_t) + sizeof (udp_header_t); |
| 2403 | ip40->length = clib_host_to_net_u16 (b0->current_length); |
| 2404 | ip40->checksum = ip4_header_checksum (ip40); |
| 2405 | } |
| 2406 | /* delete sa */ |
| 2407 | if (sa0 && (sa0->state == IKEV2_STATE_DELETED || |
| 2408 | sa0->state == IKEV2_STATE_NOTIFY_AND_DELETE)) |
| 2409 | { |
| 2410 | ikev2_child_sa_t *c; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2411 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2412 | vec_foreach (c, sa0->childs) |
| 2413 | ikev2_delete_tunnel_interface (km->vnet_main, sa0, c); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2414 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2415 | ikev2_delete_sa (sa0); |
| 2416 | } |
| 2417 | sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX]; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2418 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2419 | if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE) |
| 2420 | && (b0->flags & VLIB_BUFFER_IS_TRACED))) |
| 2421 | { |
| 2422 | ikev2_trace_t *t = vlib_add_trace (vm, node, b0, sizeof (*t)); |
| 2423 | t->sw_if_index = sw_if_index0; |
| 2424 | t->next_index = next0; |
| 2425 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2426 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2427 | vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next, |
| 2428 | n_left_to_next, bi0, next0); |
| 2429 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2430 | |
| 2431 | vlib_put_next_frame (vm, node, next_index, n_left_to_next); |
| 2432 | } |
| 2433 | |
| 2434 | vlib_node_increment_counter (vm, ikev2_node.index, |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2435 | IKEV2_ERROR_PROCESSED, frame->n_vectors); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2436 | return frame->n_vectors; |
| 2437 | } |
| 2438 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2439 | /* *INDENT-OFF* */ |
Jean-Mickael Guerin | 8941ec2 | 2016-03-04 14:14:21 +0100 | [diff] [blame] | 2440 | VLIB_REGISTER_NODE (ikev2_node,static) = { |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2441 | .function = ikev2_node_fn, |
| 2442 | .name = "ikev2", |
| 2443 | .vector_size = sizeof (u32), |
| 2444 | .format_trace = format_ikev2_trace, |
| 2445 | .type = VLIB_NODE_TYPE_INTERNAL, |
| 2446 | |
| 2447 | .n_errors = ARRAY_LEN(ikev2_error_strings), |
| 2448 | .error_strings = ikev2_error_strings, |
| 2449 | |
| 2450 | .n_next_nodes = IKEV2_N_NEXT, |
| 2451 | |
| 2452 | .next_nodes = { |
| 2453 | [IKEV2_NEXT_IP4_LOOKUP] = "ip4-lookup", |
| 2454 | [IKEV2_NEXT_ERROR_DROP] = "error-drop", |
| 2455 | }, |
| 2456 | }; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2457 | /* *INDENT-ON* */ |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2458 | |
| 2459 | |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 2460 | static clib_error_t * |
| 2461 | ikev2_set_initiator_proposals (vlib_main_t * vm, ikev2_sa_t * sa, |
| 2462 | ikev2_transforms_set * ts, |
| 2463 | ikev2_sa_proposal_t ** proposals, int is_ike) |
| 2464 | { |
| 2465 | clib_error_t *r; |
| 2466 | ikev2_main_t *km = &ikev2_main; |
| 2467 | ikev2_sa_proposal_t *proposal; |
| 2468 | vec_add2 (*proposals, proposal, 1); |
| 2469 | ikev2_sa_transform_t *td; |
| 2470 | int error; |
| 2471 | |
| 2472 | /* Encryption */ |
| 2473 | error = 1; |
| 2474 | vec_foreach (td, km->supported_transforms) |
| 2475 | { |
| 2476 | if (td->type == IKEV2_TRANSFORM_TYPE_ENCR |
| 2477 | && td->encr_type == IKEV2_TRANSFORM_ENCR_TYPE_AES_CBC |
| 2478 | && td->key_len == ts->crypto_key_size / 8) |
| 2479 | { |
| 2480 | u16 attr[2]; |
| 2481 | attr[0] = clib_host_to_net_u16 (14 | (1 << 15)); |
| 2482 | attr[1] = clib_host_to_net_u16 (td->key_len << 3); |
| 2483 | vec_add (td->attrs, (u8 *) attr, 4); |
| 2484 | vec_add1 (proposal->transforms, *td); |
| 2485 | td->attrs = 0; |
| 2486 | |
| 2487 | error = 0; |
| 2488 | break; |
| 2489 | } |
| 2490 | } |
| 2491 | if (error) |
| 2492 | { |
| 2493 | r = clib_error_return (0, "Unsupported algorithm"); |
| 2494 | return r; |
| 2495 | } |
| 2496 | |
| 2497 | /* Integrity */ |
| 2498 | error = 1; |
| 2499 | vec_foreach (td, km->supported_transforms) |
| 2500 | { |
| 2501 | if (td->type == IKEV2_TRANSFORM_TYPE_INTEG |
| 2502 | && td->integ_type == IKEV2_TRANSFORM_INTEG_TYPE_AUTH_HMAC_SHA1_96) |
| 2503 | { |
| 2504 | vec_add1 (proposal->transforms, *td); |
| 2505 | error = 0; |
| 2506 | break; |
| 2507 | } |
| 2508 | } |
| 2509 | if (error) |
| 2510 | { |
| 2511 | r = clib_error_return (0, "Unsupported algorithm"); |
| 2512 | return r; |
| 2513 | } |
| 2514 | |
| 2515 | /* PRF */ |
| 2516 | if (is_ike) |
| 2517 | { |
| 2518 | error = 1; |
| 2519 | vec_foreach (td, km->supported_transforms) |
| 2520 | { |
| 2521 | if (td->type == IKEV2_TRANSFORM_TYPE_PRF |
| 2522 | && td->prf_type == IKEV2_TRANSFORM_PRF_TYPE_PRF_HMAC_SHA1) |
| 2523 | { |
| 2524 | vec_add1 (proposal->transforms, *td); |
| 2525 | error = 0; |
| 2526 | break; |
| 2527 | } |
| 2528 | } |
| 2529 | if (error) |
| 2530 | { |
| 2531 | r = clib_error_return (0, "Unsupported algorithm"); |
| 2532 | return r; |
| 2533 | } |
| 2534 | } |
| 2535 | |
| 2536 | /* DH */ |
| 2537 | error = 1; |
| 2538 | vec_foreach (td, km->supported_transforms) |
| 2539 | { |
| 2540 | if (td->type == IKEV2_TRANSFORM_TYPE_DH && td->dh_type == ts->dh_type) |
| 2541 | { |
| 2542 | vec_add1 (proposal->transforms, *td); |
| 2543 | if (is_ike) |
| 2544 | { |
| 2545 | sa->dh_group = td->dh_type; |
| 2546 | } |
| 2547 | error = 0; |
| 2548 | break; |
| 2549 | } |
| 2550 | } |
| 2551 | if (error) |
| 2552 | { |
| 2553 | r = clib_error_return (0, "Unsupported algorithm"); |
| 2554 | return r; |
| 2555 | } |
| 2556 | |
| 2557 | if (!is_ike) |
| 2558 | { |
| 2559 | error = 1; |
| 2560 | vec_foreach (td, km->supported_transforms) |
| 2561 | { |
| 2562 | if (td->type == IKEV2_TRANSFORM_TYPE_ESN) |
| 2563 | { |
| 2564 | vec_add1 (proposal->transforms, *td); |
| 2565 | error = 0; |
| 2566 | break; |
| 2567 | } |
| 2568 | } |
| 2569 | if (error) |
| 2570 | { |
| 2571 | r = clib_error_return (0, "Unsupported algorithm"); |
| 2572 | return r; |
| 2573 | } |
| 2574 | } |
| 2575 | |
| 2576 | |
| 2577 | return 0; |
| 2578 | } |
| 2579 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2580 | static ikev2_profile_t * |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2581 | ikev2_profile_index_by_name (u8 * name) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2582 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2583 | ikev2_main_t *km = &ikev2_main; |
| 2584 | uword *p; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2585 | |
| 2586 | p = mhash_get (&km->profile_index_by_name, name); |
| 2587 | if (!p) |
| 2588 | return 0; |
| 2589 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2590 | return pool_elt_at_index (km->profiles, p[0]); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2591 | } |
| 2592 | |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 2593 | |
| 2594 | static void |
| 2595 | ikev2_send_ike (vlib_main_t * vm, ip4_address_t * src, ip4_address_t * dst, |
| 2596 | u32 bi0, u32 len) |
| 2597 | { |
| 2598 | ip4_header_t *ip40; |
| 2599 | udp_header_t *udp0; |
| 2600 | vlib_buffer_t *b0; |
| 2601 | vlib_frame_t *f; |
| 2602 | u32 *to_next; |
| 2603 | |
| 2604 | b0 = vlib_get_buffer (vm, bi0); |
| 2605 | vlib_buffer_advance (b0, -sizeof (udp_header_t)); |
| 2606 | udp0 = vlib_buffer_get_current (b0); |
| 2607 | vlib_buffer_advance (b0, -sizeof (ip4_header_t)); |
| 2608 | ip40 = vlib_buffer_get_current (b0); |
| 2609 | |
| 2610 | |
| 2611 | ip40->ip_version_and_header_length = 0x45; |
| 2612 | ip40->tos = 0; |
| 2613 | ip40->fragment_id = 0; |
| 2614 | ip40->flags_and_fragment_offset = 0; |
| 2615 | ip40->ttl = 0xff; |
| 2616 | ip40->protocol = IP_PROTOCOL_UDP; |
| 2617 | ip40->dst_address.as_u32 = dst->as_u32; |
| 2618 | ip40->src_address.as_u32 = src->as_u32; |
| 2619 | udp0->dst_port = clib_host_to_net_u16 (500); |
| 2620 | udp0->src_port = clib_host_to_net_u16 (500); |
| 2621 | udp0->length = clib_host_to_net_u16 (len + sizeof (udp_header_t)); |
| 2622 | udp0->checksum = 0; |
| 2623 | b0->current_length = len + sizeof (ip4_header_t) + sizeof (udp_header_t); |
| 2624 | ip40->length = clib_host_to_net_u16 (b0->current_length); |
| 2625 | ip40->checksum = ip4_header_checksum (ip40); |
| 2626 | |
| 2627 | |
| 2628 | /* send the request */ |
| 2629 | f = vlib_get_frame_to_node (vm, ip4_lookup_node.index); |
| 2630 | to_next = vlib_frame_vector_args (f); |
| 2631 | to_next[0] = bi0; |
| 2632 | f->n_vectors = 1; |
| 2633 | vlib_put_frame_to_node (vm, ip4_lookup_node.index, f); |
| 2634 | |
| 2635 | } |
| 2636 | |
| 2637 | static u32 |
| 2638 | ikev2_get_new_ike_header_buff (vlib_main_t * vm, ike_header_t ** ike) |
| 2639 | { |
| 2640 | u32 bi0; |
| 2641 | if (vlib_buffer_alloc (vm, &bi0, 1) != 1) |
| 2642 | { |
| 2643 | *ike = 0; |
| 2644 | return 0; |
| 2645 | } |
| 2646 | vlib_buffer_t *b0 = vlib_get_buffer (vm, bi0); |
| 2647 | *ike = vlib_buffer_get_current (b0); |
| 2648 | return bi0; |
| 2649 | } |
| 2650 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2651 | clib_error_t * |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2652 | ikev2_set_local_key (vlib_main_t * vm, u8 * file) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2653 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2654 | ikev2_main_t *km = &ikev2_main; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2655 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2656 | km->pkey = ikev2_load_key_file (file); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2657 | if (km->pkey == NULL) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2658 | return clib_error_return (0, "load key '%s' failed", file); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2659 | |
| 2660 | return 0; |
| 2661 | } |
| 2662 | |
| 2663 | clib_error_t * |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2664 | ikev2_add_del_profile (vlib_main_t * vm, u8 * name, int is_add) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2665 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2666 | ikev2_main_t *km = &ikev2_main; |
| 2667 | ikev2_profile_t *p; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2668 | |
| 2669 | if (is_add) |
| 2670 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2671 | if (ikev2_profile_index_by_name (name)) |
| 2672 | return clib_error_return (0, "policy %v already exists", name); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2673 | |
| 2674 | pool_get (km->profiles, p); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2675 | memset (p, 0, sizeof (*p)); |
| 2676 | p->name = vec_dup (name); |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 2677 | p->responder.sw_if_index = ~0; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2678 | uword index = p - km->profiles; |
| 2679 | mhash_set_mem (&km->profile_index_by_name, name, &index, 0); |
| 2680 | } |
| 2681 | else |
| 2682 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2683 | p = ikev2_profile_index_by_name (name); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2684 | if (!p) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2685 | return clib_error_return (0, "policy %v does not exists", name); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2686 | |
| 2687 | vec_free (p->name); |
| 2688 | pool_put (km->profiles, p); |
| 2689 | mhash_unset (&km->profile_index_by_name, name, 0); |
| 2690 | } |
| 2691 | return 0; |
| 2692 | } |
| 2693 | |
| 2694 | clib_error_t * |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2695 | ikev2_set_profile_auth (vlib_main_t * vm, u8 * name, u8 auth_method, |
| 2696 | u8 * auth_data, u8 data_hex_format) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2697 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2698 | ikev2_profile_t *p; |
| 2699 | clib_error_t *r; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2700 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2701 | p = ikev2_profile_index_by_name (name); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2702 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2703 | if (!p) |
| 2704 | { |
| 2705 | r = clib_error_return (0, "unknown profile %v", name); |
| 2706 | return r; |
| 2707 | } |
| 2708 | vec_free (p->auth.data); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2709 | p->auth.method = auth_method; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2710 | p->auth.data = vec_dup (auth_data); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2711 | p->auth.hex = data_hex_format; |
| 2712 | |
| 2713 | if (auth_method == IKEV2_AUTH_METHOD_RSA_SIG) |
| 2714 | { |
Matus Fabian | 698b952 | 2016-09-13 23:15:56 -0700 | [diff] [blame] | 2715 | vec_add1 (p->auth.data, 0); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2716 | if (p->auth.key) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2717 | EVP_PKEY_free (p->auth.key); |
| 2718 | p->auth.key = ikev2_load_cert_file (auth_data); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2719 | if (p->auth.key == NULL) |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2720 | return clib_error_return (0, "load cert '%s' failed", auth_data); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2721 | } |
| 2722 | |
| 2723 | return 0; |
| 2724 | } |
| 2725 | |
| 2726 | clib_error_t * |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2727 | ikev2_set_profile_id (vlib_main_t * vm, u8 * name, u8 id_type, u8 * data, |
| 2728 | int is_local) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2729 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2730 | ikev2_profile_t *p; |
| 2731 | clib_error_t *r; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2732 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2733 | if (id_type > IKEV2_ID_TYPE_ID_RFC822_ADDR |
| 2734 | && id_type < IKEV2_ID_TYPE_ID_KEY_ID) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2735 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2736 | r = clib_error_return (0, "unsupported identity type %U", |
| 2737 | format_ikev2_id_type, id_type); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2738 | return r; |
| 2739 | } |
| 2740 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2741 | p = ikev2_profile_index_by_name (name); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2742 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2743 | if (!p) |
| 2744 | { |
| 2745 | r = clib_error_return (0, "unknown profile %v", name); |
| 2746 | return r; |
| 2747 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2748 | |
| 2749 | if (is_local) |
| 2750 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2751 | vec_free (p->loc_id.data); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2752 | p->loc_id.type = id_type; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2753 | p->loc_id.data = vec_dup (data); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2754 | } |
| 2755 | else |
| 2756 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2757 | vec_free (p->rem_id.data); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2758 | p->rem_id.type = id_type; |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2759 | p->rem_id.data = vec_dup (data); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2760 | } |
| 2761 | |
| 2762 | return 0; |
| 2763 | } |
| 2764 | |
| 2765 | clib_error_t * |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2766 | ikev2_set_profile_ts (vlib_main_t * vm, u8 * name, u8 protocol_id, |
| 2767 | u16 start_port, u16 end_port, ip4_address_t start_addr, |
| 2768 | ip4_address_t end_addr, int is_local) |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2769 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2770 | ikev2_profile_t *p; |
| 2771 | clib_error_t *r; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2772 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2773 | p = ikev2_profile_index_by_name (name); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2774 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2775 | if (!p) |
| 2776 | { |
| 2777 | r = clib_error_return (0, "unknown profile %v", name); |
| 2778 | return r; |
| 2779 | } |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2780 | |
| 2781 | if (is_local) |
| 2782 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 2783 | p->loc_ts.start_addr.as_u32 = start_addr.as_u32; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 2784 | p->loc_ts.end_addr.as_u32 = end_addr.as_u32; |
| 2785 | p->loc_ts.start_port = start_port; |
| 2786 | p->loc_ts.end_port = end_port; |
| 2787 | p->loc_ts.protocol_id = protocol_id; |
| 2788 | p->loc_ts.ts_type = 7; |
| 2789 | } |
| 2790 | else |
| 2791 | { |
| 2792 | p->rem_ts.start_addr.as_u32 = start_addr.as_u32; |
| 2793 | p->rem_ts.end_addr.as_u32 = end_addr.as_u32; |
| 2794 | p->rem_ts.start_port = start_port; |
| 2795 | p->rem_ts.end_port = end_port; |
| 2796 | p->rem_ts.protocol_id = protocol_id; |
| 2797 | p->rem_ts.ts_type = 7; |
| 2798 | } |
| 2799 | |
| 2800 | return 0; |
| 2801 | } |
| 2802 | |
| 2803 | |
| 2804 | clib_error_t * |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 2805 | ikev2_set_profile_responder (vlib_main_t * vm, u8 * name, |
| 2806 | u32 sw_if_index, ip4_address_t ip4) |
| 2807 | { |
| 2808 | ikev2_profile_t *p; |
| 2809 | clib_error_t *r; |
| 2810 | |
| 2811 | p = ikev2_profile_index_by_name (name); |
| 2812 | |
| 2813 | if (!p) |
| 2814 | { |
| 2815 | r = clib_error_return (0, "unknown profile %v", name); |
| 2816 | return r; |
| 2817 | } |
| 2818 | |
| 2819 | p->responder.sw_if_index = sw_if_index; |
| 2820 | p->responder.ip4 = ip4; |
| 2821 | |
| 2822 | return 0; |
| 2823 | } |
| 2824 | |
| 2825 | clib_error_t * |
| 2826 | ikev2_set_profile_ike_transforms (vlib_main_t * vm, u8 * name, |
| 2827 | ikev2_transform_encr_type_t crypto_alg, |
| 2828 | ikev2_transform_integ_type_t integ_alg, |
| 2829 | ikev2_transform_dh_type_t dh_type, |
| 2830 | u32 crypto_key_size) |
| 2831 | { |
| 2832 | ikev2_profile_t *p; |
| 2833 | clib_error_t *r; |
| 2834 | |
| 2835 | p = ikev2_profile_index_by_name (name); |
| 2836 | |
| 2837 | if (!p) |
| 2838 | { |
| 2839 | r = clib_error_return (0, "unknown profile %v", name); |
| 2840 | return r; |
| 2841 | } |
| 2842 | |
| 2843 | p->ike_ts.crypto_alg = crypto_alg; |
| 2844 | p->ike_ts.integ_alg = integ_alg; |
| 2845 | p->ike_ts.dh_type = dh_type; |
| 2846 | p->ike_ts.crypto_key_size = crypto_key_size; |
| 2847 | return 0; |
| 2848 | } |
| 2849 | |
| 2850 | clib_error_t * |
| 2851 | ikev2_set_profile_esp_transforms (vlib_main_t * vm, u8 * name, |
| 2852 | ikev2_transform_encr_type_t crypto_alg, |
| 2853 | ikev2_transform_integ_type_t integ_alg, |
| 2854 | ikev2_transform_dh_type_t dh_type, |
| 2855 | u32 crypto_key_size) |
| 2856 | { |
| 2857 | ikev2_profile_t *p; |
| 2858 | clib_error_t *r; |
| 2859 | |
| 2860 | p = ikev2_profile_index_by_name (name); |
| 2861 | |
| 2862 | if (!p) |
| 2863 | { |
| 2864 | r = clib_error_return (0, "unknown profile %v", name); |
| 2865 | return r; |
| 2866 | } |
| 2867 | |
| 2868 | p->esp_ts.crypto_alg = crypto_alg; |
| 2869 | p->esp_ts.integ_alg = integ_alg; |
| 2870 | p->esp_ts.dh_type = dh_type; |
| 2871 | p->esp_ts.crypto_key_size = crypto_key_size; |
| 2872 | return 0; |
| 2873 | } |
| 2874 | |
| 2875 | clib_error_t * |
| 2876 | ikev2_set_profile_sa_lifetime (vlib_main_t * vm, u8 * name, |
| 2877 | u64 lifetime, u32 jitter, u32 handover, |
| 2878 | u64 maxdata) |
| 2879 | { |
| 2880 | ikev2_profile_t *p; |
| 2881 | clib_error_t *r; |
| 2882 | |
| 2883 | p = ikev2_profile_index_by_name (name); |
| 2884 | |
| 2885 | if (!p) |
| 2886 | { |
| 2887 | r = clib_error_return (0, "unknown profile %v", name); |
| 2888 | return r; |
| 2889 | } |
| 2890 | |
| 2891 | p->lifetime = lifetime; |
| 2892 | p->lifetime_jitter = jitter; |
| 2893 | p->handover = handover; |
| 2894 | p->lifetime_maxdata = maxdata; |
| 2895 | return 0; |
| 2896 | } |
| 2897 | |
| 2898 | clib_error_t * |
| 2899 | ikev2_initiate_sa_init (vlib_main_t * vm, u8 * name) |
| 2900 | { |
| 2901 | ikev2_profile_t *p; |
| 2902 | clib_error_t *r; |
| 2903 | ip4_main_t *im = &ip4_main; |
| 2904 | ikev2_main_t *km = &ikev2_main; |
| 2905 | |
| 2906 | p = ikev2_profile_index_by_name (name); |
| 2907 | |
| 2908 | if (!p) |
| 2909 | { |
| 2910 | r = clib_error_return (0, "unknown profile %v", name); |
| 2911 | return r; |
| 2912 | } |
| 2913 | |
| 2914 | if (p->responder.sw_if_index == ~0 || p->responder.ip4.data_u32 == 0) |
| 2915 | { |
| 2916 | r = clib_error_return (0, "responder not set for profile %v", name); |
| 2917 | return r; |
| 2918 | } |
| 2919 | |
| 2920 | |
| 2921 | /* Create the Initiator Request */ |
| 2922 | { |
| 2923 | ike_header_t *ike0; |
| 2924 | u32 bi0 = 0; |
| 2925 | ip_lookup_main_t *lm = &im->lookup_main; |
| 2926 | u32 if_add_index0; |
| 2927 | int len = sizeof (ike_header_t); |
| 2928 | |
| 2929 | /* Get own iface IP */ |
| 2930 | if_add_index0 = |
| 2931 | lm->if_address_pool_index_by_sw_if_index[p->responder.sw_if_index]; |
| 2932 | ip_interface_address_t *if_add = |
| 2933 | pool_elt_at_index (lm->if_address_pool, if_add_index0); |
| 2934 | ip4_address_t *if_ip = ip_interface_address_get_address (lm, if_add); |
| 2935 | |
| 2936 | bi0 = ikev2_get_new_ike_header_buff (vm, &ike0); |
| 2937 | |
| 2938 | /* Prepare the SA and the IKE payload */ |
| 2939 | ikev2_sa_t sa; |
| 2940 | memset (&sa, 0, sizeof (ikev2_sa_t)); |
| 2941 | ikev2_payload_chain_t *chain = 0; |
| 2942 | ikev2_payload_new_chain (chain); |
| 2943 | |
| 2944 | /* Build the IKE proposal payload */ |
| 2945 | ikev2_sa_proposal_t *proposals = 0; |
| 2946 | ikev2_set_initiator_proposals (vm, &sa, &p->ike_ts, &proposals, 1); |
| 2947 | proposals[0].proposal_num = 1; |
| 2948 | proposals[0].protocol_id = IKEV2_PROTOCOL_IKE; |
| 2949 | |
| 2950 | /* Add and then cleanup proposal data */ |
| 2951 | ikev2_payload_add_sa (chain, proposals); |
| 2952 | ikev2_sa_free_proposal_vector (&proposals); |
| 2953 | |
| 2954 | sa.is_initiator = 1; |
| 2955 | sa.profile = p; |
| 2956 | sa.state = IKEV2_STATE_SA_INIT; |
| 2957 | ikev2_generate_sa_init_data (&sa); |
| 2958 | ikev2_payload_add_ke (chain, sa.dh_group, sa.i_dh_data); |
| 2959 | ikev2_payload_add_nonce (chain, sa.i_nonce); |
| 2960 | |
| 2961 | /* Build the child SA proposal */ |
| 2962 | vec_resize (sa.childs, 1); |
| 2963 | ikev2_set_initiator_proposals (vm, &sa, &p->esp_ts, |
| 2964 | &sa.childs[0].i_proposals, 0); |
| 2965 | sa.childs[0].i_proposals[0].proposal_num = 1; |
| 2966 | sa.childs[0].i_proposals[0].protocol_id = IKEV2_PROTOCOL_ESP; |
| 2967 | RAND_bytes ((u8 *) & sa.childs[0].i_proposals[0].spi, |
| 2968 | sizeof (sa.childs[0].i_proposals[0].spi)); |
| 2969 | |
| 2970 | |
| 2971 | |
| 2972 | /* Add NAT detection notification messages (mandatory) */ |
| 2973 | u8 nat_detection_source[8 + 8 + 4 + 2]; |
| 2974 | u8 *nat_detection_sha1 = vec_new (u8, 20); |
| 2975 | |
| 2976 | u64 tmpspi = clib_host_to_net_u64 (sa.ispi); |
| 2977 | clib_memcpy (&nat_detection_source[0], &tmpspi, sizeof (tmpspi)); |
| 2978 | tmpspi = clib_host_to_net_u64 (sa.rspi); |
| 2979 | clib_memcpy (&nat_detection_source[8], &tmpspi, sizeof (tmpspi)); |
| 2980 | u16 tmpport = clib_host_to_net_u16 (500); |
| 2981 | clib_memcpy (&nat_detection_source[8 + 8 + 4], &tmpport, |
| 2982 | sizeof (tmpport)); |
| 2983 | u32 tmpip = clib_host_to_net_u32 (if_ip->as_u32); |
| 2984 | clib_memcpy (&nat_detection_source[8 + 8], &tmpip, sizeof (tmpip)); |
| 2985 | SHA1 (nat_detection_source, sizeof (nat_detection_source), |
| 2986 | nat_detection_sha1); |
| 2987 | ikev2_payload_add_notify (chain, IKEV2_NOTIFY_MSG_NAT_DETECTION_SOURCE_IP, |
| 2988 | nat_detection_sha1); |
| 2989 | tmpip = clib_host_to_net_u32 (p->responder.ip4.as_u32); |
| 2990 | clib_memcpy (&nat_detection_source[8 + 8], &tmpip, sizeof (tmpip)); |
| 2991 | SHA1 (nat_detection_source, sizeof (nat_detection_source), |
| 2992 | nat_detection_sha1); |
| 2993 | ikev2_payload_add_notify (chain, |
| 2994 | IKEV2_NOTIFY_MSG_NAT_DETECTION_DESTINATION_IP, |
| 2995 | nat_detection_sha1); |
| 2996 | vec_free (nat_detection_sha1); |
| 2997 | |
| 2998 | u8 *sig_hash_algo = vec_new (u8, 8); |
| 2999 | u64 tmpsig = clib_host_to_net_u64 (0x0001000200030004); |
| 3000 | clib_memcpy (sig_hash_algo, &tmpsig, sizeof (tmpsig)); |
| 3001 | ikev2_payload_add_notify (chain, |
| 3002 | IKEV2_NOTIFY_MSG_SIGNATURE_HASH_ALGORITHMS, |
| 3003 | sig_hash_algo); |
| 3004 | vec_free (sig_hash_algo); |
| 3005 | |
| 3006 | |
| 3007 | /* Buffer update and bolierplate */ |
| 3008 | len += vec_len (chain->data); |
| 3009 | ike0->nextpayload = chain->first_payload_type; |
| 3010 | ike0->length = clib_host_to_net_u32 (len); |
| 3011 | clib_memcpy (ike0->payload, chain->data, vec_len (chain->data)); |
| 3012 | ikev2_payload_destroy_chain (chain); |
| 3013 | |
| 3014 | ike0->version = IKE_VERSION_2; |
| 3015 | ike0->flags = IKEV2_HDR_FLAG_INITIATOR; |
| 3016 | ike0->exchange = IKEV2_EXCHANGE_SA_INIT; |
| 3017 | ike0->ispi = sa.ispi; |
| 3018 | |
| 3019 | /* store whole IKE payload - needed for PSK auth */ |
| 3020 | vec_free (sa.last_sa_init_req_packet_data); |
| 3021 | vec_add (sa.last_sa_init_req_packet_data, ike0, len); |
| 3022 | |
| 3023 | /* add data to the SA then add it to the pool */ |
| 3024 | sa.iaddr.as_u32 = if_ip->as_u32; |
| 3025 | sa.raddr.as_u32 = p->responder.ip4.as_u32; |
| 3026 | sa.i_id.type = p->loc_id.type; |
| 3027 | sa.i_id.data = vec_dup (p->loc_id.data); |
| 3028 | sa.i_auth.method = p->auth.method; |
| 3029 | sa.i_auth.hex = p->auth.hex; |
| 3030 | sa.i_auth.data = vec_dup (p->auth.data); |
| 3031 | sa.i_auth.key = vec_dup (p->auth.key); |
| 3032 | vec_add (sa.childs[0].tsi, &p->loc_ts, 1); |
| 3033 | vec_add (sa.childs[0].tsr, &p->rem_ts, 1); |
| 3034 | |
| 3035 | /* add SA to the pool */ |
| 3036 | ikev2_sa_t *sa0 = 0; |
| 3037 | pool_get (km->sais, sa0); |
| 3038 | clib_memcpy (sa0, &sa, sizeof (*sa0)); |
| 3039 | hash_set (km->sa_by_ispi, sa0->ispi, sa0 - km->sais); |
| 3040 | |
| 3041 | ikev2_send_ike (vm, if_ip, &p->responder.ip4, bi0, len); |
| 3042 | |
| 3043 | } |
| 3044 | |
| 3045 | return 0; |
| 3046 | } |
| 3047 | |
| 3048 | static void |
| 3049 | ikev2_delete_child_sa_internal (vlib_main_t * vm, ikev2_sa_t * sa, |
| 3050 | ikev2_child_sa_t * csa) |
| 3051 | { |
| 3052 | /* Create the Initiator notification for child SA removal */ |
| 3053 | ikev2_main_t *km = &ikev2_main; |
| 3054 | ike_header_t *ike0; |
| 3055 | u32 bi0 = 0; |
| 3056 | int len; |
| 3057 | |
| 3058 | bi0 = ikev2_get_new_ike_header_buff (vm, &ike0); |
| 3059 | |
| 3060 | |
| 3061 | ike0->exchange = IKEV2_EXCHANGE_INFORMATIONAL; |
| 3062 | ike0->ispi = clib_host_to_net_u64 (sa->ispi); |
| 3063 | ike0->rspi = clib_host_to_net_u64 (sa->rspi); |
| 3064 | vec_resize (sa->del, 1); |
| 3065 | sa->del->protocol_id = IKEV2_PROTOCOL_ESP; |
| 3066 | sa->del->spi = csa->i_proposals->spi; |
| 3067 | ike0->msgid = clib_host_to_net_u32 (sa->last_init_msg_id + 1); |
| 3068 | sa->last_init_msg_id = clib_net_to_host_u32 (ike0->msgid); |
| 3069 | len = ikev2_generate_message (sa, ike0, 0); |
| 3070 | |
| 3071 | ikev2_send_ike (vm, &sa->iaddr, &sa->raddr, bi0, len); |
| 3072 | |
| 3073 | /* delete local child SA */ |
| 3074 | ikev2_delete_tunnel_interface (km->vnet_main, sa, csa); |
| 3075 | ikev2_sa_del_child_sa (sa, csa); |
| 3076 | } |
| 3077 | |
| 3078 | clib_error_t * |
| 3079 | ikev2_initiate_delete_child_sa (vlib_main_t * vm, u32 ispi) |
| 3080 | { |
| 3081 | clib_error_t *r; |
| 3082 | ikev2_main_t *km = &ikev2_main; |
| 3083 | ikev2_main_per_thread_data_t *tkm; |
| 3084 | ikev2_sa_t *fsa = 0; |
| 3085 | ikev2_child_sa_t *fchild = 0; |
| 3086 | |
| 3087 | /* Search for the child SA */ |
| 3088 | vec_foreach (tkm, km->per_thread_data) |
| 3089 | { |
| 3090 | ikev2_sa_t *sa; |
| 3091 | if (fchild) |
| 3092 | break; |
| 3093 | /* *INDENT-OFF* */ |
| 3094 | pool_foreach (sa, tkm->sas, ({ |
| 3095 | fchild = ikev2_sa_get_child(sa, ispi, IKEV2_PROTOCOL_ESP, 1); |
| 3096 | if (fchild) |
| 3097 | { |
| 3098 | fsa = sa; |
| 3099 | break; |
| 3100 | } |
| 3101 | })); |
| 3102 | /* *INDENT-ON* */ |
| 3103 | } |
| 3104 | |
| 3105 | if (!fchild || !fsa) |
| 3106 | { |
| 3107 | r = clib_error_return (0, "Child SA not found"); |
| 3108 | return r; |
| 3109 | } |
| 3110 | else |
| 3111 | { |
| 3112 | ikev2_delete_child_sa_internal (vm, fsa, fchild); |
| 3113 | } |
| 3114 | |
| 3115 | return 0; |
| 3116 | } |
| 3117 | |
| 3118 | clib_error_t * |
| 3119 | ikev2_initiate_delete_ike_sa (vlib_main_t * vm, u64 ispi) |
| 3120 | { |
| 3121 | clib_error_t *r; |
| 3122 | ikev2_main_t *km = &ikev2_main; |
| 3123 | ikev2_main_per_thread_data_t *tkm; |
| 3124 | ikev2_sa_t *fsa = 0; |
| 3125 | ikev2_main_per_thread_data_t *ftkm = 0; |
| 3126 | |
| 3127 | /* Search for the IKE SA */ |
| 3128 | vec_foreach (tkm, km->per_thread_data) |
| 3129 | { |
| 3130 | ikev2_sa_t *sa; |
| 3131 | if (fsa) |
| 3132 | break; |
| 3133 | /* *INDENT-OFF* */ |
| 3134 | pool_foreach (sa, tkm->sas, ({ |
| 3135 | if (sa->ispi == ispi) |
| 3136 | { |
| 3137 | fsa = sa; |
| 3138 | ftkm = tkm; |
| 3139 | break; |
| 3140 | } |
| 3141 | })); |
| 3142 | /* *INDENT-ON* */ |
| 3143 | } |
| 3144 | |
| 3145 | if (!fsa) |
| 3146 | { |
| 3147 | r = clib_error_return (0, "IKE SA not found"); |
| 3148 | return r; |
| 3149 | } |
| 3150 | |
| 3151 | |
| 3152 | /* Create the Initiator notification for IKE SA removal */ |
| 3153 | { |
| 3154 | ike_header_t *ike0; |
| 3155 | u32 bi0 = 0; |
| 3156 | int len; |
| 3157 | |
| 3158 | bi0 = ikev2_get_new_ike_header_buff (vm, &ike0); |
| 3159 | |
| 3160 | |
| 3161 | ike0->exchange = IKEV2_EXCHANGE_INFORMATIONAL; |
| 3162 | ike0->ispi = clib_host_to_net_u64 (fsa->ispi); |
| 3163 | ike0->rspi = clib_host_to_net_u64 (fsa->rspi); |
| 3164 | vec_resize (fsa->del, 1); |
| 3165 | fsa->del->protocol_id = IKEV2_PROTOCOL_IKE; |
| 3166 | fsa->del->spi = ispi; |
| 3167 | ike0->msgid = clib_host_to_net_u32 (fsa->last_init_msg_id + 1); |
| 3168 | fsa->last_init_msg_id = clib_net_to_host_u32 (ike0->msgid); |
| 3169 | len = ikev2_generate_message (fsa, ike0, 0); |
| 3170 | |
| 3171 | ikev2_send_ike (vm, &fsa->iaddr, &fsa->raddr, bi0, len); |
| 3172 | } |
| 3173 | |
| 3174 | |
| 3175 | /* delete local SA */ |
| 3176 | ikev2_child_sa_t *c; |
| 3177 | vec_foreach (c, fsa->childs) |
| 3178 | { |
| 3179 | ikev2_delete_tunnel_interface (km->vnet_main, fsa, c); |
| 3180 | ikev2_sa_del_child_sa (fsa, c); |
| 3181 | } |
| 3182 | ikev2_sa_free_all_vec (fsa); |
| 3183 | uword *p = hash_get (ftkm->sa_by_rspi, fsa->rspi); |
| 3184 | if (p) |
| 3185 | { |
| 3186 | hash_unset (ftkm->sa_by_rspi, fsa->rspi); |
| 3187 | pool_put (ftkm->sas, fsa); |
| 3188 | } |
| 3189 | |
| 3190 | |
| 3191 | return 0; |
| 3192 | } |
| 3193 | |
| 3194 | static void |
| 3195 | ikev2_rekey_child_sa_internal (vlib_main_t * vm, ikev2_sa_t * sa, |
| 3196 | ikev2_child_sa_t * csa) |
| 3197 | { |
| 3198 | /* Create the Initiator request for create child SA */ |
| 3199 | ike_header_t *ike0; |
| 3200 | u32 bi0 = 0; |
| 3201 | int len; |
| 3202 | |
| 3203 | |
| 3204 | bi0 = ikev2_get_new_ike_header_buff (vm, &ike0); |
| 3205 | |
| 3206 | |
| 3207 | ike0->version = IKE_VERSION_2; |
| 3208 | ike0->flags = IKEV2_HDR_FLAG_INITIATOR; |
| 3209 | ike0->exchange = IKEV2_EXCHANGE_CREATE_CHILD_SA; |
| 3210 | ike0->ispi = clib_host_to_net_u64 (sa->ispi); |
| 3211 | ike0->rspi = clib_host_to_net_u64 (sa->rspi); |
| 3212 | ike0->msgid = clib_host_to_net_u32 (sa->last_init_msg_id + 1); |
| 3213 | sa->last_init_msg_id = clib_net_to_host_u32 (ike0->msgid); |
| 3214 | |
| 3215 | ikev2_rekey_t *rekey; |
| 3216 | vec_add2 (sa->rekey, rekey, 1); |
| 3217 | ikev2_sa_proposal_t *proposals = vec_dup (csa->i_proposals); |
| 3218 | |
| 3219 | /*need new ispi */ |
| 3220 | RAND_bytes ((u8 *) & proposals[0].spi, sizeof (proposals[0].spi)); |
| 3221 | rekey->spi = proposals[0].spi; |
| 3222 | rekey->ispi = csa->i_proposals->spi; |
| 3223 | len = ikev2_generate_message (sa, ike0, proposals); |
| 3224 | ikev2_send_ike (vm, &sa->iaddr, &sa->raddr, bi0, len); |
| 3225 | vec_free (proposals); |
| 3226 | } |
| 3227 | |
| 3228 | clib_error_t * |
| 3229 | ikev2_initiate_rekey_child_sa (vlib_main_t * vm, u32 ispi) |
| 3230 | { |
| 3231 | clib_error_t *r; |
| 3232 | ikev2_main_t *km = &ikev2_main; |
| 3233 | ikev2_main_per_thread_data_t *tkm; |
| 3234 | ikev2_sa_t *fsa = 0; |
| 3235 | ikev2_child_sa_t *fchild = 0; |
| 3236 | |
| 3237 | /* Search for the child SA */ |
| 3238 | vec_foreach (tkm, km->per_thread_data) |
| 3239 | { |
| 3240 | ikev2_sa_t *sa; |
| 3241 | if (fchild) |
| 3242 | break; |
| 3243 | /* *INDENT-OFF* */ |
| 3244 | pool_foreach (sa, tkm->sas, ({ |
| 3245 | fchild = ikev2_sa_get_child(sa, ispi, IKEV2_PROTOCOL_ESP, 1); |
| 3246 | if (fchild) |
| 3247 | { |
| 3248 | fsa = sa; |
| 3249 | break; |
| 3250 | } |
| 3251 | })); |
| 3252 | /* *INDENT-ON* */ |
| 3253 | } |
| 3254 | |
| 3255 | if (!fchild || !fsa) |
| 3256 | { |
| 3257 | r = clib_error_return (0, "Child SA not found"); |
| 3258 | return r; |
| 3259 | } |
| 3260 | else |
| 3261 | { |
| 3262 | ikev2_rekey_child_sa_internal (vm, fsa, fchild); |
| 3263 | } |
| 3264 | |
| 3265 | return 0; |
| 3266 | } |
| 3267 | |
| 3268 | clib_error_t * |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 3269 | ikev2_init (vlib_main_t * vm) |
| 3270 | { |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 3271 | ikev2_main_t *km = &ikev2_main; |
| 3272 | clib_error_t *error; |
| 3273 | vlib_thread_main_t *tm = vlib_get_thread_main (); |
Matthew Smith | 2838a23 | 2016-06-21 16:05:09 -0500 | [diff] [blame] | 3274 | int thread_id; |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 3275 | |
| 3276 | memset (km, 0, sizeof (ikev2_main_t)); |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 3277 | km->vnet_main = vnet_get_main (); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 3278 | km->vlib_main = vm; |
| 3279 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 3280 | ikev2_crypto_init (km); |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 3281 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 3282 | mhash_init_vec_string (&km->profile_index_by_name, sizeof (uword)); |
| 3283 | |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 3284 | vec_validate (km->per_thread_data, tm->n_vlib_mains - 1); |
Matthew Smith | 2838a23 | 2016-06-21 16:05:09 -0500 | [diff] [blame] | 3285 | for (thread_id = 0; thread_id < tm->n_vlib_mains - 1; thread_id++) |
| 3286 | { |
| 3287 | km->per_thread_data[thread_id].sa_by_rspi = |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 3288 | hash_create (0, sizeof (uword)); |
Matthew Smith | 2838a23 | 2016-06-21 16:05:09 -0500 | [diff] [blame] | 3289 | } |
| 3290 | |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 3291 | km->sa_by_ispi = hash_create (0, sizeof (uword)); |
| 3292 | |
| 3293 | |
Ed Warnicke | cb9cada | 2015-12-08 15:45:58 -0700 | [diff] [blame] | 3294 | if ((error = vlib_call_init_function (vm, ikev2_cli_init))) |
| 3295 | return error; |
| 3296 | |
| 3297 | udp_register_dst_port (vm, 500, ikev2_node.index, 1); |
| 3298 | |
| 3299 | return 0; |
| 3300 | } |
| 3301 | |
| 3302 | |
Radu Nicolau | cb33dc2 | 2017-02-16 16:49:46 +0000 | [diff] [blame] | 3303 | static u8 |
| 3304 | ikev2_mngr_process_child_sa (ikev2_sa_t * sa, ikev2_child_sa_t * csa) |
| 3305 | { |
| 3306 | ikev2_main_t *km = &ikev2_main; |
| 3307 | vlib_main_t *vm = km->vlib_main; |
| 3308 | f64 now = vlib_time_now (vm); |
| 3309 | u8 res = 0; |
| 3310 | |
| 3311 | if (sa->is_initiator && sa->profile && csa->time_to_expiration |
| 3312 | && now > csa->time_to_expiration) |
| 3313 | { |
| 3314 | if (!csa->is_expired || csa->rekey_retries > 0) |
| 3315 | { |
| 3316 | ikev2_rekey_child_sa_internal (vm, sa, csa); |
| 3317 | csa->time_to_expiration = now + sa->profile->handover; |
| 3318 | csa->is_expired = 1; |
| 3319 | if (csa->rekey_retries == 0) |
| 3320 | { |
| 3321 | csa->rekey_retries = 5; |
| 3322 | } |
| 3323 | else if (csa->rekey_retries > 0) |
| 3324 | { |
| 3325 | csa->rekey_retries--; |
| 3326 | clib_warning ("Rekeing Child SA 0x%x, retries left %d", |
| 3327 | csa->i_proposals->spi, csa->rekey_retries); |
| 3328 | if (csa->rekey_retries == 0) |
| 3329 | { |
| 3330 | csa->rekey_retries = -1; |
| 3331 | } |
| 3332 | } |
| 3333 | res |= 1; |
| 3334 | } |
| 3335 | else |
| 3336 | { |
| 3337 | csa->time_to_expiration = 0; |
| 3338 | ikev2_delete_child_sa_internal (vm, sa, csa); |
| 3339 | res |= 1; |
| 3340 | } |
| 3341 | } |
| 3342 | |
| 3343 | return res; |
| 3344 | } |
| 3345 | |
| 3346 | static void |
| 3347 | ikev2_mngr_process_ipsec_sa (ipsec_sa_t * ipsec_sa) |
| 3348 | { |
| 3349 | ikev2_main_t *km = &ikev2_main; |
| 3350 | vlib_main_t *vm = km->vlib_main; |
| 3351 | ikev2_main_per_thread_data_t *tkm; |
| 3352 | ikev2_sa_t *fsa = 0; |
| 3353 | ikev2_child_sa_t *fchild = 0; |
| 3354 | f64 now = vlib_time_now (vm); |
| 3355 | |
| 3356 | /* Search for the SA and child SA */ |
| 3357 | vec_foreach (tkm, km->per_thread_data) |
| 3358 | { |
| 3359 | ikev2_sa_t *sa; |
| 3360 | if (fchild) |
| 3361 | break; |
| 3362 | /* *INDENT-OFF* */ |
| 3363 | pool_foreach (sa, tkm->sas, ({ |
| 3364 | fchild = ikev2_sa_get_child(sa, ipsec_sa->spi, IKEV2_PROTOCOL_ESP, 1); |
| 3365 | if (fchild) |
| 3366 | { |
| 3367 | fsa = sa; |
| 3368 | break; |
| 3369 | } |
| 3370 | })); |
| 3371 | /* *INDENT-ON* */ |
| 3372 | } |
| 3373 | |
| 3374 | if (fchild && fsa && fsa->profile && fsa->profile->lifetime_maxdata) |
| 3375 | { |
| 3376 | if (!fchild->is_expired |
| 3377 | && ipsec_sa->total_data_size > fsa->profile->lifetime_maxdata) |
| 3378 | { |
| 3379 | fchild->time_to_expiration = now; |
| 3380 | } |
| 3381 | } |
| 3382 | } |
| 3383 | |
| 3384 | static vlib_node_registration_t ikev2_mngr_process_node; |
| 3385 | |
| 3386 | static uword |
| 3387 | ikev2_mngr_process_fn (vlib_main_t * vm, vlib_node_runtime_t * rt, |
| 3388 | vlib_frame_t * f) |
| 3389 | { |
| 3390 | ikev2_main_t *km = &ikev2_main; |
| 3391 | ipsec_main_t *im = &ipsec_main; |
| 3392 | |
| 3393 | while (1) |
| 3394 | { |
| 3395 | u8 req_sent = 0; |
| 3396 | vlib_process_wait_for_event_or_clock (vm, 1); |
| 3397 | vlib_process_get_events (vm, NULL); |
| 3398 | |
| 3399 | /* process ike child sas */ |
| 3400 | ikev2_main_per_thread_data_t *tkm; |
| 3401 | vec_foreach (tkm, km->per_thread_data) |
| 3402 | { |
| 3403 | ikev2_sa_t *sa; |
| 3404 | /* *INDENT-OFF* */ |
| 3405 | pool_foreach (sa, tkm->sas, ({ |
| 3406 | ikev2_child_sa_t *c; |
| 3407 | vec_foreach (c, sa->childs) |
| 3408 | { |
| 3409 | req_sent |= ikev2_mngr_process_child_sa(sa, c); |
| 3410 | } |
| 3411 | })); |
| 3412 | /* *INDENT-ON* */ |
| 3413 | } |
| 3414 | |
| 3415 | /* process ipsec sas */ |
| 3416 | ipsec_sa_t *sa; |
| 3417 | /* *INDENT-OFF* */ |
| 3418 | pool_foreach (sa, im->sad, ({ |
| 3419 | ikev2_mngr_process_ipsec_sa(sa); |
| 3420 | })); |
| 3421 | /* *INDENT-ON* */ |
| 3422 | |
| 3423 | if (req_sent) |
| 3424 | { |
| 3425 | vlib_process_wait_for_event_or_clock (vm, 5); |
| 3426 | vlib_process_get_events (vm, NULL); |
| 3427 | req_sent = 0; |
| 3428 | } |
| 3429 | |
| 3430 | } |
| 3431 | return 0; |
| 3432 | } |
| 3433 | |
| 3434 | /* *INDENT-OFF* */ |
| 3435 | VLIB_REGISTER_NODE (ikev2_mngr_process_node, static) = { |
| 3436 | .function = ikev2_mngr_process_fn, |
| 3437 | .type = VLIB_NODE_TYPE_PROCESS, |
| 3438 | .name = |
| 3439 | "ikev2-manager-process", |
| 3440 | }; |
| 3441 | |
| 3442 | /* *INDENT-ON* */ |
Keith Burns (alagalah) | 166a9d4 | 2016-08-06 11:00:56 -0700 | [diff] [blame] | 3443 | |
| 3444 | /* |
| 3445 | * fd.io coding-style-patch-verification: ON |
| 3446 | * |
| 3447 | * Local Variables: |
| 3448 | * eval: (c-set-style "gnu") |
| 3449 | * End: |
| 3450 | */ |