Inheritance diagram for ProtocolPP::jipsecsa:

Collaboration diagram for ProtocolPP::jipsecsa:

Public Member Functions
	jipsecsa ()

	jipsecsa (direction_t dir, iana_t ver, ipmode_t mode, uint32_t spi, uint32_t seqnum, uint32_t extseqnum, uint32_t arlen, jarray< uint8_t > arwin, cipher_t cipher, uint32_t ckeylen, std::shared_ptr< jarray< uint8_t >> cipherkey, auth_t auth, uint32_t akeylen, std::shared_ptr< jarray< uint8_t >> authkey, uint32_t ivlen, std::shared_ptr< jarray< uint8_t >> iv, uint32_t saltlen, std::shared_ptr< jarray< uint8_t >> salt, uint64_t bytecnt, uint64_t lifetime, bool seqnumovrflw, bool statefulfrag, bool bypassdf, bool bypassdscp, bool nat, bool nchk, uint8_t dsecn, uint8_t ttl, uint8_t flags, uint16_t natsrc, uint16_t natdst, uint16_t id, uint32_t label, uint16_t fragoff, bool morefrag, uint32_t fragid, uint32_t mtu, jarray< uint8_t > src, jarray< uint8_t > dst, jarray< uint8_t > exthdr, iana_t nh, uint32_t icvlen, uint32_t hdrlen, uint32_t tfclen, bool usext, bool randiv, bool jumbogram, bool audit, std::string auditlog)

	jipsecsa (jipsecsa &rhs)

	jipsecsa (std::shared_ptr< jipsecsa > &rhs)

	~jipsecsa ()

template<typename T >
void	set_field (field_t field, T fieldval)

template<typename T >
T	get_field (field_t field)

void	to_xml (tinyxml2::XMLPrinter &myxml, direction_t direction)

void	to_json (std::ofstream &myjson, direction_t direction, std::string &indent)

	jipsecsa (const jipsecsa &jipsec)=delete

Public Member Functions inherited from ProtocolPP::jsecass
	jsecass ()

virtual	~jsecass ()=default
	Standard deconstructor.

	jsecass (jsecass &jsecass)=delete

	jsecass (const jsecass &jsecass)=delete

Constructor & Destructor Documentation

◆ jipsecsa() [1/4]

ProtocolPP::jipsecsa::jipsecsa ( )

Standard constructor with defaults

IPsec Defaults
field	Default Value
dir	direction_t::DECAP
ver	iana_t::IPV4
mode	ipmode_t::TUNNEL
spi	0
seqnum	0
extseqnum	0
arlen	0
arwin	0
cipher	cipher_t::AES_CBC
ckeylen	16
auth	auth_t::HMAC_SHA2_256
akeylen	32
ivlen	16
saltlen	0
bytecnt	0
lifetime	0xFFFFFFFFFFFFFFFF
seqnumovrflw	false
statefulfrag	false
bypassdf	false
bypassdscp	false
nat	false
nchk	false
natsrc	0
natdst	0
dsecn	0
ttl	0
flags	0x02
id	0x00000001
label	0
fragoff	0
morefrag	false
fragid	0
mtu	1500
src	0
dst	0
exthdr	0
nh	iana_t::ESP
icvlen	32
hdrlen	20
tfclen	0
usext	true
randiv	false
jumbogram	true
audit	false
auditlog	"./ipsec_audit.log"

◆ jipsecsa() [2/4]

ProtocolPP::jipsecsa::jipsecsa	(	direction_t	dir,
		iana_t	ver,
		ipmode_t	mode,
		uint32_t	spi,
		uint32_t	seqnum,
		uint32_t	extseqnum,
		uint32_t	arlen,
		jarray< uint8_t >	arwin,
		cipher_t	cipher,
		uint32_t	ckeylen,
		std::shared_ptr< jarray< uint8_t >>	cipherkey,
		auth_t	auth,
		uint32_t	akeylen,
		std::shared_ptr< jarray< uint8_t >>	authkey,
		uint32_t	ivlen,
		std::shared_ptr< jarray< uint8_t >>	iv,
		uint32_t	saltlen,
		std::shared_ptr< jarray< uint8_t >>	salt,
		uint64_t	bytecnt,
		uint64_t	lifetime,
		bool	seqnumovrflw,
		bool	statefulfrag,
		bool	bypassdf,
		bool	bypassdscp,
		bool	nat,
		bool	nchk,
		uint8_t	dsecn,
		uint8_t	ttl,
		uint8_t	flags,
		uint16_t	natsrc,
		uint16_t	natdst,
		uint16_t	id,
		uint32_t	label,
		uint16_t	fragoff,
		bool	morefrag,
		uint32_t	fragid,
		uint32_t	mtu,
		jarray< uint8_t >	src,
		jarray< uint8_t >	dst,
		jarray< uint8_t >	exthdr,
		iana_t	nh,
		uint32_t	icvlen,
		uint32_t	hdrlen,
		uint32_t	tfclen,
		bool	usext,
		bool	randiv,
		bool	jumbogram,
		bool	audit,
		std::string	auditlog
	)

See RFC4301 for required fields and their meanings (Section 4.4.2.1)

Security Association for IPsec. Initialization Vectors are generated randomly using the Mersenne Twister algorithm or are passed to the SA during key negotiation depending on the randiv setting

Required fields:

Parameters

dir	- Direction of processing (ENCAP or DECAP)
ver	- Version of IPsec (IPV4 or IPV6)
spi	- Security parameters index
seqnum	- Initial sequence number
extseqnum	- Initial value of the extended sequence number
arlen	- Number of packets to track in replay window
arwin	- Anti-replay window for tracking packets
cipher	- Encryption algorithm to use with IPsec
ckeylen	- Length of the cipher key
cipherkey	- Key for the encryption algorithm
auth	- Authentication algorithm to use with IPsec
akeylen	- Length of the authentication key
authkey	- Key for the authentication algorithm
ivlen	- Length of the initialization vector (IV)
iv	- Passed in initializaton vector (IV)
saltlen	- Length of the IPsec salt material
salt	- IPsec salt material
bytecnt	- Lifetime implementation of encrypted bytes
lifetime	- Time for this SA to live before it expires
mode	- Mode of operation, either TUNNEL or TRANSPORT
seqnumovrflw	- Allow sequence number overflow in ENCAP
statefulfrag	- Indicates whether stateful fragment checking applies to this SA
bypassdf	- Do not copy the DF bit from inner to outer header (both IPv4)
bypassdscp	- Do not copy the DSCP field from inner to outer header
nat	- Perform NAT-T on packets
nchk	- Update the UDP checksum if NAT-T is enabled
natsrc	- Source port for NAT-T
natdst	- Destination port for NAT-T
dsecn	- Traffic class bits (DS and ECN)
ttl	- Time-To-Live (or HOP limit)
flags	- Flags for IPv4
id	- Identification field for IPv4
label	- Flow label for IPv6
fragoff	- Fragment offset for IPv4
morefrag	- More fragments flag in IPV6_FRAG extension header 1-more fragments after this one, 0-last fragment
fragid	- ID for the fragmentation segment
mtu	- Maximum Transmission Unit (MTU) for the path
src	- Source address
dst	- Destination address
exthdr	- Extension headers for IPv6
audit	- Enable auditing
auditlog	- path to the audit log

Fields required for this implementation:

Parameters

nh	- Next Header (NH) value for the payload
icvlen	- Length of the ICV tag
hdrlen	- Length of the IP header
tfclen	- Length of the TFC padding, if any
usext	- Use extended sequence number (default=TRUE)
randiv	- Use a random IV instead of the passed in one
jumbogram	- Nodal support for IPv6 JUMBOGRAMs

◆ jipsecsa() [3/4]

ProtocolPP::jipsecsa::jipsecsa ( jipsecsa & rhs )

Constructor for IPsec

Parameters

rhs	- Security association (SA) for this IPsec flow

◆ jipsecsa() [4/4]

ProtocolPP::jipsecsa::jipsecsa ( std::shared_ptr< jipsecsa > & rhs )

explicit

Constructor for IPsec

Parameters

rhs	- Security association (SA) for this IPsec flow

◆ ~jipsecsa()

ProtocolPP::jipsecsa::~jipsecsa ( )

Standard deconstructor flush and close the auditlog if present

Member Function Documentation

◆ get_field()

template<typename T >

T ProtocolPP::jipsecsa::get_field ( field_t field )

Retrieve the field from the IPSec security association

IPSec Get Fields
field type	field name	Example
direction_t	DIRECTION	direction_t mydir = get_field<direction_t>(field_t::DIRECTION)
iana_t	VERSION	iana_t myver = get_field<iana_t>(field_t::VERSION)
	NH	iana_t mynh = get_field<iana_t>(field_t::NH)
ipmode_t	MODE	ipmode_t mymode = get_field<ipmode_t>(field_t::MODE)
cipher_t	CIPHER	cipher_t mycipher = get_field<cipher_t>(field_t::CIPHER)
auth_t	AUTH	auth_t myauth = get_field<auth_t>(field_t::AUTH)
jarray<uint8_t>	SOURCE	jarray<uint8_t> mysrc = get_field<jarray<uint8_t>>(field_t::SOURCE)
	DESTINATION	jarray<uint8_t> mydst = get_field<jarray<uint8_t>>(field_t::DESTINATION)
	EXTHDR	jarray<uint8_t> myexthdr = get_field<jarray<uint8_t>>(field_t::EXTHDR)
	ARWIN	jarray<uint8_t> myarwin = get_field<jarray<uint8_t>>(field_t::ARWIN)
std::shared_ptr<jarray<uint8_t>>	CIPHERKEY	std::shared_ptr<jarray<uint8_t>> mycipherkey = get_field<std::shared_ptr<jarray<uint8_t>>>(field_t::CIPHERKEY)
	AUTHKEY	std::shared_ptr<jarray<uint8_t>> myauthkey = get_field<std::shared_ptr<jarray<uint8_t>>>(field_t::AUTHKEY)
	IV	std::shared_ptr<jarray<uint8_t>> myiv = get_field<std::shared_ptr<jarray<uint8_t>>>(field_t::IV)
	SALT	std::shared_ptr<jarray<uint8_t>> mysalt = get_field<std::shared_ptr<jarray<uint8_t>>>(field_t::SALT)
uint8_t	DSECN	uint8_t mydsecn = get_field<uint8_t>(field_t::DSECN)
	TTLHOP	uint8_t myttl = get_field<uint8_t>(field_t::TTLHOP)
	FLAGS	uint8_t myflags = get_field<uint8_t>(field_t::FLAGS)
uint16_t	FRAGOFFSET	uint16_t myoffset = get_field<uint16_t>(field_t::FRAGOFFSET)
	ID	uint16_t myid = get_field<uint16_t>(field_t::ID)
	NATSRC	uint16_t mynatsrc = get_field<uint16_t>(field_t::NATSRC)
	NATDST	uint16_t mynatdst = get_field<uint16_t>(field_t::NATDST)
uint32_t	LABEL	uint32_t mylabel = get_field<uint32_t>(field_t::LABEL)
	SPI	uint32_t myspi = get_field<uint32_t>(field_t::SPI)
	SEQNUM	uint32_t myseqnum = get_field<uint32_t>(field_t::SEQNUM)
	EXTSEQNUM	uint32_t myextnum = get_field<uint32_t>(field_t::EXTSEQNUM)
	ARLEN	uint32_t myarlen = get_field<uint32_t>(field_t::ARLEN)
	CKEYLEN	uint32_t myckeylen = get_field<uint32_t>(field_t::CKEYLEN)
	AKEYLEN	uint32_t myakeylen = get_field<uint32_t>(field_t::AKEYLEN)
	IVLEN	uint32_t myivlen = get_field<uint32_t>(field_t::IVLEN)
	SALTLEN	uint32_t mysaltlen = get_field<uint32_t>(field_t::SALTLEN)
	ICVLEN	uint32_t myicvlen = get_field<uint32_t>(field_t::ICVLEN)
	HDRLEN	uint32_t myhdrlen = get_field<uint32_t>(field_t::HDRLEN)
	TFCLEN	uint32_t mytfclen = get_field<uint32_t>(field_t::TFCLEN)
	FRAGID	uint32_t myfragid = get_field<uint32_t>(field_t::FRAGID)
	MTU	uint32_t mymtu = get_field<uint32_t>(field_t::MTU)
uint64_t	BYTECNT	uint64_t mybytecnt = get_field<uint64_t>(field_t::BYTECNT)
	LIFETIME	uint64_t mylifetime = get_field<uint64_t>(field_t::LIFETIME)
bool	MODEJUMBO	bool myjumbo = get_field<uint32_t>(field_t::MODEJUMBO)
	SEQNUMOVRFLW	bool myovflw = get_field<bool>(field_t::SEQNUMOVRFLW)
	STATEFULFRAG	bool mystateful = get_field<bool>(field_t::STATEFULFRAG)
	BYPASSDF	bool mybypassdf = get_field<bool>(field_t::BYPASSDF)
	BYPASSDSCP	bool mybypassdscp = get_field<bool>(field_t::BYPASSDSCP)
	NAT	bool mynat = get_field<bool>(field_t::NAT)
	NCHK	bool mynchk = get_field<bool>(field_t::NCHK)
	MOREFRAG	bool mymfrag = get_field<bool>(field_t::MOREFRAG)
	USEXT	bool myusext = get_field<bool>(field_t::USEXT)
	RANDIV	bool myrandiv = get_field<bool>(field_t::RANDIV)
	AUDIT	bool myaudit = get_field<bool>(field_t::AUDIT)

Due to their dynamic nature, some fields are only available in jip which include the following fields

LENGTH
CHECKSUM

Parameters

field - field to return from the secuirty association

Returns: value of the field

◆ set_field()

template<typename T >

void ProtocolPP::jipsecsa::set_field	(	field_t	field,
		T	fieldval
	)

Update IPSec field with the new value

IPSec Set Fields
field type	field name	Example
direction_t	DIRECTION	set_field<direction_t>(field_t::DIRECTION, direction_t::DECAP)
iana_t	VERSION	set_field<iana_t>(field_t::VERSION, iana_t::IPV4)
	NH	set_field<iana_t>(field_t::NH, iana_t::UDP)
ipmode_t	MODE	set_field<ipmode_t>(field_t::MODE, ipmode_t::TUNNEL)
cipher_t	CIPHER	set_field<cipher_t>(field_t::CIPHER, cipher_t::CAMELLIA_CBC)
auth_t	AUTH	set_field<auth_t>(field_t::AUTH, auth_t::HMAC_SHA2_256)
jarray<uint8_t>	SOURCE	set_field<jarray<uint8_t>>(field_t::SOURCE, jarray<uint8_t>("CCEE1144"))
	DESTINATION	set_field<jarray<uint8_t>>(field_t::DESTINATION, jarray<uint8_t>("4433AABB"))
	EXTHDR	set_field<jarray<uint8_t>>(field_t::EXTHDR, jarray<uint8_t>("50000104"))
	ARWIN	set_field<jarray<uint8_t>>(field_t::ARWIN, jarray<uint8_t>("00000001"))
std::shared_ptr<jarray<uint8_t>>	CIPHERKEY	set_field<std::shared_ptr<jarray<uint8_t>>>(field_t::CIPHERKEY, std::make_shared<jarray<uint8_t>>(16))
	AUTHKEY	set_field<std::shared_ptr<jarray<uint8_t>>>(field_t::AUTHKEY, std::make_shared<jarray<uint8_t>>(16))
	IV	set_field<std::shared_ptr<jarray<uint8_t>>>(field_t::IV, std::make_shared<jarray<uint8_t>>(16))
	SALT	set_field<std::shared_ptr<jarray<uint8_t>>>(field_t::SALT, std::make_shared<jarray<uint8_t>>(4))
uint8_t	DSECN	set_field<uint8_t>(field_t::DSECN, 0x11)
	TTLHOP	set_field<uint8_t>(field_t::TTLHOP, 0xFF)
	FLAGS	set_field<uint8_t>(field_t::FLAGS, 0x01)
uint16_t	FRAGOFFSET	set_field<uint16_t>(field_t::FRAGOFFSET, 0x0010)
	ID	set_field<uint16_t>(field_t::ID, 0xFFEE)
	NATSRC	set_field<uint16_t>(field_t::NATSRC, 0x10BB)
	NATDST	set_field<uint16_t>(field_t::NATDST, 0xCCBB)
uint32_t	LABEL	set_field<uint32_t>(field_t::LABEL, 0xAABB1155)
	SPI	set_field<uint32_t>(field_t::SPI, 0x00000040)
	SEQNUM	set_field<uint32_t>(field_t::SEQNUM, 0x00000040)
	EXTSEQNUM	set_field<uint32_t>(field_t::EXTSEQNUM, 0x00000040)
	ARLEN	set_field<uint32_t>(field_t::ARLEN, 2048)
	CKEYLEN	set_field<uint32_t>(field_t::CKEYLEN, 16)
	AKEYLEN	set_field<uint32_t>(field_t::AKEYLEN, 16)
	IVLEN	set_field<uint32_t>(field_t::IVLEN, 12)
	SALTLEN	set_field<uint32_t>(field_t::SALTLEN, 4)
	ICVLEN	set_field<uint32_t>(field_t::ICVLEN, 12)
	HDRLEN	set_field<uint32_t>(field_t::HDRLEN, 20)
	TFCLEN	set_field<uint32_t>(field_t::TFCLEN, 96)
	FRAGID	set_field<uint32_t>(field_t::FRAGID, 0x10000010)
	MTU	set_field<uint32_t>(field_t::MTU, 0x00000040)
uint64_t	BYTECNT	set_field<uint64_t>(field_t::BYTECNT, 0xFFFFFFFFAAAAAAAA)
	LIFETIME	set_field<uint64_t>(field_t::LIFETIME, 0xFFFFFFFFAAAAAAAA)
bool	MODEJUMBO	set_field<bool>(field_t::MODEJUMBO, true)
	SEQNUMOVRFLW	set_field<bool>(field_t::SEQNUMOVRFLW, false)
	STATEFULFRAG	set_field<bool>(field_t::STATEFULFRAG, false)
	BYPASSDF	set_field<bool>(field_t::BYPASSDF, true)
	BYPASSDSCP	set_field<bool>(field_t::BYPASSDSCP, true)
	NAT	set_field<bool>(field_t::NAT, true)
	NCHK	set_field<bool>(field_t::NCHK, true)
	MOREFRAG	set_field<bool>(field_t::MOREFRAG, false)
	USEXT	set_field<bool>(field_t::USEXT, true)
	RANDIV	set_field<bool>(field_t::RANDIV, true)
	AUDIT	set_field<bool>(field_t::AUDIT, false)

Due to their dynamic nature, some fields are only available in jip which include the following fields

LENGTH
CHECKSUM

Parameters

field	- field to update
fieldval	- new value for the field

◆ to_json()

void ProtocolPP::jipsecsa::to_json	(	std::ofstream &	myjson,
		direction_t	direction,
		std::string &	indent
	)

virtual

Return the protocol and security fields as JSON

Parameters

myjson	- JSON object
direction	- randomization
indent	- indentation for JSON output

Implements ProtocolPP::jsecass.

◆ to_xml()

void ProtocolPP::jipsecsa::to_xml	(	tinyxml2::XMLPrinter &	myxml,
		direction_t	direction
	)

virtual

Return the protocol and security fields as XML

Parameters

myxml	- XMLPrinter object
direction	- randomization

Implements ProtocolPP::jsecass.

The documentation for this class was generated from the following file:

include/jipsecsa.h

Public Member Functions

Constructor & Destructor Documentation

◆ jipsecsa() [1/4]

◆ jipsecsa() [2/4]

◆ jipsecsa() [3/4]

◆ jipsecsa() [4/4]

◆ ~jipsecsa()

Member Function Documentation

◆ get_field()

◆ set_field()

◆ to_json()

◆ to_xml()