Helper functions for IKEv2. More...

#include "ike/ike.h"
#include "ike/ike_key_exchange.h"
#include "ike/ike_payload_parse.h"
#include "ike/ike_misc.h"
#include "ike/ike_debug.h"
#include "ipsec/ipsec_misc.h"
#include "debug.h"

Macros
#define	TRACE_LEVEL IKE_TRACE_LEVEL

Functions
error_t	ikeRetransmitRequest (IkeSaEntry *sa)
	Retransmit IKE request message. More...

error_t	ikeRetransmitResponse (IkeSaEntry *sa)
	Retransmit IKE response message. More...

IkeSaEntry *	ikeCreateSaEntry (IkeContext *context)
	Create a new IKE Security Association. More...

IkeSaEntry *	ikeFindSaEntry (IkeContext context, const IkeHeader ikeHeader)
	Find an IKE SA that matches an incoming IKE message. More...

IkeSaEntry *	ikeFindHalfOpenSaEntry (IkeContext context, const IkeHeader ikeHeader, const IkeNoncePayload *noncePayload)
	Find an half-open IKE SA that matches an incoming IKE_SA_INIT request. More...

void	ikeDeleteSaEntry (IkeSaEntry *sa)
	Delete an IKE Security Association. More...

void	ikeDeleteDuplicateSaEntries (IkeSaEntry *sa)
	Delete an duplicate IKE Security Associations. More...

IkeChildSaEntry *	ikeCreateChildSaEntry (IkeContext *context)
	Create a new Child Security Association. More...

IkeChildSaEntry *	ikeFindChildSaEntry (IkeSaEntry sa, uint8_t protocolId, const uint8_t spi)
	Find an Child SA that matches the specified SPI. More...

void	ikeDeleteChildSaEntry (IkeChildSaEntry *childSa)
	Delete a Child Security Association. More...

void	ikeInheritChildSas (IkeSaEntry newSa, IkeSaEntry oldSa)
	Move inherited Child SAs. More...

error_t	ikeGenerateSaSpi (IkeSaEntry sa, uint8_t spi)
	Generate a new IKE SA SPI. More...

error_t	ikeGenerateChildSaSpi (IkeChildSaEntry childSa, uint8_t spi)
	Generate a new Child SA SPI. More...

error_t	ikeGenerateNonce (IkeContext context, uint8_t nonce, size_t *length)
	Generate a new nonce. More...

systime_t	ikeRandomizeDelay (IkeContext *context, systime_t delay)
	Apply random jitter to a time interval. More...

void	ikeSubstituteId (IkeSaEntry *sa)
	Perform ID substitution. More...

error_t	ikeSelectTs (IkeChildSaEntry childSa, const IkeTsPayload tsiPayload, const IkeTsPayload *tsrPayload)
	Traffic selector selection. More...

error_t	ikeCheckTs (IkeChildSaEntry childSa, const IkeTsPayload tsiPayload, const IkeTsPayload *tsrPayload, bool_t rekey)
	Check whether the selected traffic selectors are acceptable. More...

void	ikeCopyLocalTsEntry (IkeChildSaEntry childSa, IpsecSelector selector, const IkeTsEntry *tsEntry)
	Copy local traffic selector. More...

void	ikeCopyRemoteTsEntry (IkeChildSaEntry childSa, IpsecSelector selector, const IkeTsEntry *tsEntry)
	Copy remote traffic selector. More...

error_t	ikeCheckNonceLength (IkeSaEntry *sa, size_t nonceLen)
	Check the length of the nonce. More...

int_t	ikeCompareNonces (const uint8_t nonce1, size_t nonceLen1, const uint8_t nonce2, size_t nonceLen2)
	Compare nonces. More...

int_t	ikeCompareSaNonces (IkeSaEntry sa1, IkeSaEntry sa2)
	Compare IKE SA nonces. More...

int_t	ikeCompareChildSaNonces (IkeChildSaEntry childSa1, IkeChildSaEntry childSa2)
	Compare Child SA nonces. More...

error_t	ikeCreateIpsecSaPair (IkeChildSaEntry *childSa)
	Create AH or ESP SA pair. More...

bool_t	ikeIsInitialContact (IkeSaEntry *sa)
	Test if the IKE SA is the only currently active with a given peer. More...

Variables
const uint8_t	IKE_INVALID_SPI [8] = {0}

Detailed Description

Helper functions for IKEv2.

License

SPDX-License-Identifier: GPL-2.0-or-later

This file is part of CycloneIPSEC Open.

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.

Author: Oryx Embedded SARL (www.oryx-embedded.com)

Version: 2.6.6

Definition in file ike_misc.c.

Macro Definition Documentation

◆ TRACE_LEVEL

#define TRACE_LEVEL IKE_TRACE_LEVEL

Definition at line 32 of file ike_misc.c.

Function Documentation

◆ ikeCheckNonceLength()

error_t ikeCheckNonceLength	(	IkeSaEntry *	sa,
		size_t	nonceLen
	)

Check the length of the nonce.

Parameters

[in]	sa	Pointer to the IKE SA
[in]	nonceLen	Length of the nonce, in bytes

Returns: Error code

Definition at line 1238 of file ike_misc.c.

◆ ikeCheckTs()

error_t ikeCheckTs	(	IkeChildSaEntry *	childSa,
		const IkeTsPayload *	tsiPayload,
		const IkeTsPayload *	tsrPayload,
		bool_t	rekey
	)

Check whether the selected traffic selectors are acceptable.

Parameters

[in]	childSa	Pointer to the Child SA
[in]	tsiPayload	Pointer to the TSi payload
[in]	tsrPayload	Pointer to the TSr payload
[in]	rekey	Rekeying operation

Returns: Error code

Definition at line 1046 of file ike_misc.c.

◆ ikeCompareChildSaNonces()

int_t ikeCompareChildSaNonces	(	IkeChildSaEntry *	childSa1,
		IkeChildSaEntry *	childSa2
	)

Compare Child SA nonces.

Parameters

[in]	childSa1	Pointer to the first Child SA
[in]	childSa2	Pointer to the second Child SA

Returns: The function returns -1 if the first one has the lowest of the four nonces, or 1 if the second one has the lowest of the four nonces

Definition at line 1422 of file ike_misc.c.

◆ ikeCompareNonces()

int_t ikeCompareNonces	(	const uint8_t *	nonce1,
		size_t	nonceLen1,
		const uint8_t *	nonce2,
		size_t	nonceLen2
	)

Compare nonces.

Parameters

[in]	nonce1	Pointer to the first nonce
[in]	nonceLen1	Length of the first nonce, in bytes
[in]	nonce2	Pointer to the second nonce
[in]	nonceLen2	Length of the second nonce, in bytes

Returns: The function returns 0 if the nonces match, -1 if the first nonce is lower, or 1 if the second nonce is lower

Definition at line 1334 of file ike_misc.c.

◆ ikeCompareSaNonces()

int_t ikeCompareSaNonces	(	IkeSaEntry *	sa1,
		IkeSaEntry *	sa2
	)

Compare IKE SA nonces.

Parameters

[in]	sa1	Pointer to the first IKE SA
[in]	sa2	Pointer to the second IKE SA

Returns: The function returns -1 if the first one has the lowest of the four nonces, or 1 if the second one has the lowest of the four nonces

Definition at line 1376 of file ike_misc.c.

◆ ikeCopyLocalTsEntry()

void ikeCopyLocalTsEntry	(	IkeChildSaEntry *	childSa,
		IpsecSelector *	selector,
		const IkeTsEntry *	tsEntry
	)

Copy local traffic selector.

Parameters

[in]	childSa	Pointer to the Child SA
[in,out]	selector	Pointer to the IPsec selector
[in]	tsEntry	Traffic selector entry

Definition at line 1149 of file ike_misc.c.

◆ ikeCopyRemoteTsEntry()

void ikeCopyRemoteTsEntry	(	IkeChildSaEntry *	childSa,
		IpsecSelector *	selector,
		const IkeTsEntry *	tsEntry
	)

Copy remote traffic selector.

Parameters

[in]	childSa	Pointer to the Child SA
[in,out]	selector	Pointer to the IPsec selector
[in]	tsEntry	Traffic selector entry

Definition at line 1194 of file ike_misc.c.

◆ ikeCreateChildSaEntry()

IkeChildSaEntry* ikeCreateChildSaEntry ( IkeContext * context )

Create a new Child Security Association.

Parameters

[in] context Pointer to the IKE context

Returns: Pointer to the newly created Child SA

Definition at line 451 of file ike_misc.c.

◆ ikeCreateIpsecSaPair()

error_t ikeCreateIpsecSaPair ( IkeChildSaEntry * childSa )

Create AH or ESP SA pair.

Parameters

[in] childSa Pointer to the Child SA

Returns: Error code

Definition at line 1467 of file ike_misc.c.

◆ ikeCreateSaEntry()

IkeSaEntry* ikeCreateSaEntry ( IkeContext * context )

Create a new IKE Security Association.

Parameters

[in] context Pointer to the IKE context

Returns: Pointer to the newly created IKE SA

Definition at line 185 of file ike_misc.c.

◆ ikeDeleteChildSaEntry()

void ikeDeleteChildSaEntry ( IkeChildSaEntry * childSa )

Delete a Child Security Association.

Parameters

[in] childSa Pointer to the Child SA

Definition at line 560 of file ike_misc.c.

◆ ikeDeleteDuplicateSaEntries()

void ikeDeleteDuplicateSaEntries ( IkeSaEntry * sa )

Delete an duplicate IKE Security Associations.

Parameters

[in] sa Pointer to the currently active IKE SA

Definition at line 408 of file ike_misc.c.

◆ ikeDeleteSaEntry()

void ikeDeleteSaEntry ( IkeSaEntry * sa )

Delete an IKE Security Association.

Parameters

[in] sa Pointer to the IKE SA

Definition at line 347 of file ike_misc.c.

◆ ikeFindChildSaEntry()

IkeChildSaEntry* ikeFindChildSaEntry	(	IkeSaEntry *	sa,
		uint8_t	protocolId,
		const uint8_t *	spi
	)

Find an Child SA that matches the specified SPI.

Parameters

[in]	sa	Pointer to the IKE SA
[in]	protocolId	Protocol identifier (AH or ESP)
[in]	spi	Security parameter index

Returns: Pointer to the matching Child SA, if any

Definition at line 518 of file ike_misc.c.

◆ ikeFindHalfOpenSaEntry()

IkeSaEntry* ikeFindHalfOpenSaEntry	(	IkeContext *	context,
		const IkeHeader *	ikeHeader,
		const IkeNoncePayload *	noncePayload
	)

Find an half-open IKE SA that matches an incoming IKE_SA_INIT request.

Parameters

[in]	context	Pointer to the IKE context
[in]	ikeHeader	Pointer to the IKE header
[in]	noncePayload	Pointer to the Ni payload

Returns: Pointer to the matching IKE SA, if any

Definition at line 293 of file ike_misc.c.

◆ ikeFindSaEntry()

IkeSaEntry* ikeFindSaEntry	(	IkeContext *	context,
		const IkeHeader *	ikeHeader
	)

Find an IKE SA that matches an incoming IKE message.

Parameters

[in]	context	Pointer to the IKE context
[in]	ikeHeader	Pointer to the IKE header

Returns: Pointer to the matching IKE SA, if any

Definition at line 232 of file ike_misc.c.

◆ ikeGenerateChildSaSpi()

error_t ikeGenerateChildSaSpi	(	IkeChildSaEntry *	childSa,
		uint8_t *	spi
	)

Generate a new Child SA SPI.

Parameters

[in]	childSa	Pointer to the Child SA
[out]	spi	Pointer to the buffer where to store the resulting SPI

Returns: Error code

Definition at line 718 of file ike_misc.c.

◆ ikeGenerateNonce()

error_t ikeGenerateNonce	(	IkeContext *	context,
		uint8_t *	nonce,
		size_t *	length
	)

Generate a new nonce.

Parameters

[in]	context	Pointer to the IKE context
[out]	nonce	Pointer to the buffer where to store the resulting nonce
[in]	length	Length of the nonce, in bytes

Returns: Error code

Definition at line 792 of file ike_misc.c.

◆ ikeGenerateSaSpi()

error_t ikeGenerateSaSpi	(	IkeSaEntry *	sa,
		uint8_t *	spi
	)

Generate a new IKE SA SPI.

Parameters

[in]	sa	Pointer to the IKE SA
[out]	spi	Pointer to the buffer where to store the resulting SPI

Returns: Error code

Definition at line 632 of file ike_misc.c.

◆ ikeInheritChildSas()

void ikeInheritChildSas	(	IkeSaEntry *	newSa,
		IkeSaEntry *	oldSa
	)

Move inherited Child SAs.

Parameters

[in]	newSa	Pointer to the new IKE SA
[in]	oldSa	Pointer to the old IKE SA

Definition at line 597 of file ike_misc.c.

◆ ikeIsInitialContact()

bool_t ikeIsInitialContact ( IkeSaEntry * sa )

Test if the IKE SA is the only currently active with a given peer.

Parameters

[in] sa Pointer to the IKE SA

Returns: TRUE if this IKE SA is the only IKE SA currently active between the authenticated identities, else FALSE

Definition at line 1625 of file ike_misc.c.

◆ ikeRandomizeDelay()

systime_t ikeRandomizeDelay	(	IkeContext *	context,
		systime_t	delay
	)

Apply random jitter to a time interval.

Parameters

[in]	context	Pointer to the IKE context
[out]	delay	Time interval to be randomized

Returns: Randomized time interval

Definition at line 826 of file ike_misc.c.

◆ ikeRetransmitRequest()

error_t ikeRetransmitRequest ( IkeSaEntry * sa )

Retransmit IKE request message.

Parameters

[in] sa Pointer to the IKE SA

Returns: Error code

Definition at line 56 of file ike_misc.c.

◆ ikeRetransmitResponse()

error_t ikeRetransmitResponse ( IkeSaEntry * sa )

Retransmit IKE response message.

Parameters

[in] sa Pointer to the IKE SA

Returns: Error code

Definition at line 117 of file ike_misc.c.

◆ ikeSelectTs()

error_t ikeSelectTs	(	IkeChildSaEntry *	childSa,
		const IkeTsPayload *	tsiPayload,
		const IkeTsPayload *	tsrPayload
	)

Traffic selector selection.

Parameters

[in]	childSa	Pointer to the Child SA
[in]	tsiPayload	Pointer to the TSi payload
[in]	tsrPayload	Pointer to the TSr payload

Returns: Error code

Definition at line 904 of file ike_misc.c.

◆ ikeSubstituteId()

void ikeSubstituteId ( IkeSaEntry * sa )

Perform ID substitution.

Parameters

[in] sa Pointer to the IKE SA

Definition at line 860 of file ike_misc.c.

Variable Documentation

◆ IKE_INVALID_SPI

const uint8_t IKE_INVALID_SPI[8] = {0}

Definition at line 47 of file ike_misc.c.

Macros

Functions

Variables

Detailed Description

License

Macro Definition Documentation

◆ TRACE_LEVEL

Function Documentation

◆ ikeCheckNonceLength()

◆ ikeCheckTs()

◆ ikeCompareChildSaNonces()

◆ ikeCompareNonces()

◆ ikeCompareSaNonces()

◆ ikeCopyLocalTsEntry()

◆ ikeCopyRemoteTsEntry()

◆ ikeCreateChildSaEntry()

◆ ikeCreateIpsecSaPair()

◆ ikeCreateSaEntry()

◆ ikeDeleteChildSaEntry()

◆ ikeDeleteDuplicateSaEntries()

◆ ikeDeleteSaEntry()

◆ ikeFindChildSaEntry()

◆ ikeFindHalfOpenSaEntry()

◆ ikeFindSaEntry()

◆ ikeGenerateChildSaSpi()

◆ ikeGenerateNonce()

◆ ikeGenerateSaSpi()

◆ ikeInheritChildSas()

◆ ikeIsInitialContact()

◆ ikeRandomizeDelay()

◆ ikeRetransmitRequest()

◆ ikeRetransmitResponse()

◆ ikeSelectTs()

◆ ikeSubstituteId()

Variable Documentation

◆ IKE_INVALID_SPI