diff options
Diffstat (limited to 'src/plugins/ikev2/ikev2_priv.h')
| -rw-r--r-- | src/plugins/ikev2/ikev2_priv.h | 64 |
1 files changed, 52 insertions, 12 deletions
diff --git a/src/plugins/ikev2/ikev2_priv.h b/src/plugins/ikev2/ikev2_priv.h index 4c56b980f1c..0639809e9b1 100644 --- a/src/plugins/ikev2/ikev2_priv.h +++ b/src/plugins/ikev2/ikev2_priv.h @@ -184,16 +184,21 @@ do { \ #define ikev2_log_debug(...) \ vlib_log(VLIB_LOG_LEVEL_DEBUG, ikev2_main.log_class, __VA_ARGS__) +#define foreach_ikev2_state \ + _ (0, UNKNOWN, "UNKNOWN") \ + _ (1, SA_INIT, "SA_INIT") \ + _ (2, DELETED, "DELETED") \ + _ (3, AUTH_FAILED, "AUTH_FAILED") \ + _ (4, AUTHENTICATED, "AUTHENTICATED") \ + _ (5, NOTIFY_AND_DELETE, "NOTIFY_AND_DELETE") \ + _ (6, TS_UNACCEPTABLE, "TS_UNACCEPTABLE") \ + _ (7, NO_PROPOSAL_CHOSEN, "NO_PROPOSAL_CHOSEN") + typedef enum { - IKEV2_STATE_UNKNOWN, - IKEV2_STATE_SA_INIT, - IKEV2_STATE_DELETED, - IKEV2_STATE_AUTH_FAILED, - IKEV2_STATE_AUTHENTICATED, - IKEV2_STATE_NOTIFY_AND_DELETE, - IKEV2_STATE_TS_UNACCEPTABLE, - IKEV2_STATE_NO_PROPOSAL_CHOSEN, +#define _(v, f, s) IKEV2_STATE_##f = v, + foreach_ikev2_state +#undef _ } ikev2_state_t; typedef struct @@ -238,7 +243,7 @@ typedef struct { u8 proposal_num; ikev2_protocol_id_t protocol_id:8; - u32 spi; + u64 spi; ikev2_sa_transform_t *transforms; } ikev2_sa_proposal_t; @@ -302,6 +307,8 @@ typedef struct f64 time_to_expiration; u8 is_expired; i8 rekey_retries; + + f64 timestamp; } ikev2_child_sa_t; typedef struct @@ -312,6 +319,8 @@ typedef struct typedef struct { + u16 notify_type; + u8 kex; u8 protocol_id; u32 spi; u32 ispi; @@ -323,6 +332,22 @@ typedef struct typedef struct { + u16 notify_type; + u16 dh_group; + u64 ispi; + u64 rspi; + u8 *i_nonce; + u8 *r_nonce; + u8 *dh_shared_key; + u8 *dh_private_key; + u8 *i_dh_data; + u8 *r_dh_data; + ikev2_sa_proposal_t *i_proposals; + ikev2_sa_proposal_t *r_proposals; +} ikev2_sa_rekey_t; + +typedef struct +{ u16 msg_type; u8 protocol_id; u32 spi; @@ -425,6 +450,9 @@ typedef struct ikev2_rekey_t *new_child; + /* pending sa rekeyings */ + ikev2_sa_rekey_t *sa_rekey; + /* packet data */ u8 *last_sa_init_req_packet_data; u8 *last_sa_init_res_packet_data; @@ -462,6 +490,8 @@ typedef struct u8 keys_generated; ikev2_stats_t stats; + + f64 auth_timestamp; } ikev2_sa_t; @@ -530,7 +560,17 @@ typedef struct u8 dpd_disabled; /* pointer to name resolver function in dns plugin */ - int (*dns_resolve_name) (); + void *dns_resolve_name_ptr; + + /* flag indicating whether lazy init is done or not */ + int lazy_init_done; + + /* refcount for IKEv2 udp ports and IPsec NATT punt registration */ + int bind_refcount; + + /* punt handle for IPsec NATT IPSEC_PUNT_IP4_SPI_UDP_0 reason */ + vlib_punt_hdl_t punt_hdl; + } ikev2_main_t; extern ikev2_main_t ikev2_main; @@ -584,8 +624,8 @@ void ikev2_payload_add_notify (ikev2_payload_chain_t * c, u16 msg_type, u8 * data); void ikev2_payload_add_notify_2 (ikev2_payload_chain_t * c, u16 msg_type, u8 * data, ikev2_notify_t * notify); -void ikev2_payload_add_sa (ikev2_payload_chain_t * c, - ikev2_sa_proposal_t * proposals); +void ikev2_payload_add_sa (ikev2_payload_chain_t *c, + ikev2_sa_proposal_t *proposals, u8 force_spi); void ikev2_payload_add_ke (ikev2_payload_chain_t * c, u16 dh_group, u8 * dh_data); void ikev2_payload_add_nonce (ikev2_payload_chain_t * c, u8 * nonce); |