?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
No empty .Rs/.Re
[netbsd-mini2440.git] / crypto / dist / ipsec-tools / src / racoon / isakmp_quick.c
blob91db6fbce5d3ddf03a54a01e0562e5a99e916e4e
1 /* $NetBSD: isakmp_quick.c,v 1.25 2009/03/12 10:57:26 tteras Exp $ */
2
3 /* Id: isakmp_quick.c,v 1.29 2006/08/22 18:17:17 manubsd Exp */
4
5 /*
6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the project nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34 #include "config.h"
35
36 #include <sys/types.h>
37 #include <sys/param.h>
38 #include <sys/socket.h>
39
40 #include <netinet/in.h>
41
42 #include <stdlib.h>
43 #include <stdio.h>
44 #include <string.h>
45 #include <errno.h>
46 #if TIME_WITH_SYS_TIME
47 # include <sys/time.h>
48 # include <time.h>
49 #else
50 # if HAVE_SYS_TIME_H
51 # include <sys/time.h>
52 # else
53 # include <time.h>
54 # endif
55 #endif
56
57 #include PATH_IPSEC_H
58
59 #include "var.h"
60 #include "vmbuf.h"
61 #include "schedule.h"
62 #include "misc.h"
63 #include "plog.h"
64 #include "debug.h"
65
66 #include "localconf.h"
67 #include "remoteconf.h"
68 #include "handler.h"
69 #include "policy.h"
70 #include "proposal.h"
71 #include "isakmp_var.h"
72 #include "isakmp.h"
73 #include "isakmp_inf.h"
74 #include "isakmp_quick.h"
75 #include "oakley.h"
76 #include "ipsec_doi.h"
77 #include "crypto_openssl.h"
78 #include "pfkey.h"
79 #include "policy.h"
80 #include "algorithm.h"
81 #include "sockmisc.h"
82 #include "proposal.h"
83 #include "sainfo.h"
84 #include "admin.h"
85 #include "strnames.h"
86
87 #ifdef ENABLE_HYBRID
88 #include <resolv.h>
89 #include "isakmp_xauth.h"
90 #include "isakmp_cfg.h"
91 #endif
92
93 #ifdef ENABLE_NATT
94 #include "nattraversal.h"
95 #endif
96
97 /* quick mode */
98 static vchar_t *quick_ir1mx __P((struct ph2handle *, vchar_t *, vchar_t *));
99 static int get_sainfo_r __P((struct ph2handle *));
100 static int get_proposal_r __P((struct ph2handle *));
101 static int ph2_recv_n __P((struct ph2handle *, struct isakmp_gen *));
102 static void quick_timeover_stub __P((struct sched *));
103 static void quick_timeover __P((struct ph2handle *));
104
105 /* called from scheduler */
106 static void
107 quick_timeover_stub(p)
108 struct sched *p;
109 {
110 quick_timeover(container_of(p, struct ph2handle, sce));
111 }
112
113 static void
114 quick_timeover(iph2)
115 struct ph2handle *iph2;
116 {
117 plog(LLV_ERROR, LOCATION, NULL,
118 "%s give up to get IPsec-SA due to time up to wait.\n",
119 saddrwop2str(iph2->dst));
120
121 /* If initiator side, send error to kernel by SADB_ACQUIRE. */
122 if (iph2->side == INITIATOR)
123 pk_sendeacquire(iph2);
124
125 remph2(iph2);
126 delph2(iph2);
127 }
128
129 /* \f%%%
130 * Quick Mode
131 */
132 /*
133 * begin Quick Mode as initiator. send pfkey getspi message to kernel.
134 */
135 int
136 quick_i1prep(iph2, msg)
137 struct ph2handle *iph2;
138 vchar_t *msg; /* must be null pointer */
139 {
140 int error = ISAKMP_INTERNAL_ERROR;
141
142 /* validity check */
143 if (iph2->status != PHASE2ST_STATUS2) {
144 plog(LLV_ERROR, LOCATION, NULL,
145 "status mismatched %d.\n", iph2->status);
146 goto end;
147 }
148
149 iph2->msgid = isakmp_newmsgid2(iph2->ph1);
150 iph2->ivm = oakley_newiv2(iph2->ph1, iph2->msgid);
151 if (iph2->ivm == NULL)
152 return 0;
153
154 iph2->status = PHASE2ST_GETSPISENT;
155
156 /* don't anything if local test mode. */
157 if (f_local) {
158 error = 0;
159 goto end;
160 }
161
162 /* send getspi message */
163 if (pk_sendgetspi(iph2) < 0)
164 goto end;
165
166 plog(LLV_DEBUG, LOCATION, NULL, "pfkey getspi sent.\n");
167
168 sched_schedule(&iph2->sce, lcconf->wait_ph2complete,
169 quick_timeover_stub);
170
171 error = 0;
172
173 end:
174 return error;
175 }
176
177 /*
178 * send to responder
179 * HDR*, HASH(1), SA, Ni [, KE ] [, IDi2, IDr2 ] [, NAT-OAi, NAT-OAr ]
180 */
181 int
182 quick_i1send(iph2, msg)
183 struct ph2handle *iph2;
184 vchar_t *msg; /* must be null pointer */
185 {
186 vchar_t *body = NULL;
187 vchar_t *hash = NULL;
188 struct isakmp_gen *gen;
189 char *p;
190 int tlen;
191 int error = ISAKMP_INTERNAL_ERROR;
192 int natoa = ISAKMP_NPTYPE_NONE;
193 int pfsgroup, idci, idcr;
194 int np;
195 struct ipsecdoi_id_b *id, *id_p;
196 #ifdef ENABLE_NATT
197 vchar_t *nat_oai = NULL;
198 vchar_t *nat_oar = NULL;
199 #endif
200
201 /* validity check */
202 if (msg != NULL) {
203 plog(LLV_ERROR, LOCATION, NULL,
204 "msg has to be NULL in this function.\n");
205 goto end;
206 }
207 if (iph2->status != PHASE2ST_GETSPIDONE) {
208 plog(LLV_ERROR, LOCATION, NULL,
209 "status mismatched %d.\n", iph2->status);
210 goto end;
211 }
212
213 /* create SA payload for my proposal */
214 if (ipsecdoi_setph2proposal(iph2) < 0)
215 goto end;
216
217 /* generate NONCE value */
218 iph2->nonce = eay_set_random(iph2->ph1->rmconf->nonce_size);
219 if (iph2->nonce == NULL)
220 goto end;
221
222 /*
223 * DH value calculation is kicked out into cfparse.y.
224 * because pfs group can not be negotiated, it's only to be checked
225 * acceptable.
226 */
227 /* generate KE value if need */
228 pfsgroup = iph2->proposal->pfs_group;
229 if (pfsgroup) {
230 /* DH group settting if PFS is required. */
231 if (oakley_setdhgroup(pfsgroup, &iph2->pfsgrp) < 0) {
232 plog(LLV_ERROR, LOCATION, NULL,
233 "failed to set DH value.\n");
234 goto end;
235 }
236 if (oakley_dh_generate(iph2->pfsgrp,
237 &iph2->dhpub, &iph2->dhpriv) < 0) {
238 goto end;
239 }
240 }
241
242 /* generate ID value */
243 if (ipsecdoi_setid2(iph2) < 0) {
244 plog(LLV_ERROR, LOCATION, NULL,
245 "failed to get ID.\n");
246 goto end;
247 }
248 plog(LLV_DEBUG, LOCATION, NULL, "IDci:\n");
249 plogdump(LLV_DEBUG, iph2->id->v, iph2->id->l);
250 plog(LLV_DEBUG, LOCATION, NULL, "IDcr:\n");
251 plogdump(LLV_DEBUG, iph2->id_p->v, iph2->id_p->l);
252
253 /*
254 * we do not attach IDci nor IDcr, under the following condition:
255 * - all proposals are transport mode
256 * - no MIP6 or proxy
257 * - id payload suggests to encrypt all the traffic (no specific
258 * protocol type)
259 * - SA endpoints and IKE addresses for the nego are the same
260 * (iph2->src/dst)
261 */
262 id = (struct ipsecdoi_id_b *)iph2->id->v;
263 id_p = (struct ipsecdoi_id_b *)iph2->id_p->v;
264 if (id->proto_id == 0 &&
265 id_p->proto_id == 0 &&
266 iph2->ph1->rmconf->support_proxy == 0 &&
267 iph2->sa_src == NULL && iph2->sa_dst == NULL &&
268 ipsecdoi_transportmode(iph2->proposal)) {
269 idci = idcr = 0;
270 } else
271 idci = idcr = 1;
272
273 #ifdef ENABLE_NATT
274 /*
275 * RFC3947 5.2. if we propose UDP-Encapsulated-Transport
276 * we should send NAT-OA
277 */
278 if (ipsecdoi_transportmode(iph2->proposal)
279 && (iph2->ph1->natt_flags & NAT_DETECTED)) {
280 natoa = iph2->ph1->natt_options->payload_nat_oa;
281
282 nat_oai = ipsecdoi_sockaddr2id(iph2->src,
283 IPSECDOI_PREFIX_HOST, IPSEC_ULPROTO_ANY);
284 nat_oar = ipsecdoi_sockaddr2id(iph2->dst,
285 IPSECDOI_PREFIX_HOST, IPSEC_ULPROTO_ANY);
286
287 if (nat_oai == NULL || nat_oar == NULL) {
288 plog(LLV_ERROR, LOCATION, NULL,
289 "failed to generate NAT-OA payload.\n");
290 goto end;
291 }
292
293 plog(LLV_DEBUG, LOCATION, NULL, "NAT-OAi:\n");
294 plogdump(LLV_DEBUG, nat_oai->v, nat_oai->l);
295 plog(LLV_DEBUG, LOCATION, NULL, "NAT-OAr:\n");
296 plogdump(LLV_DEBUG, nat_oar->v, nat_oar->l);
297 } else {
298 natoa = ISAKMP_NPTYPE_NONE;
299 }
300 #endif
301
302 /* create SA;NONCE payload, and KE if need, and IDii, IDir. */
303 tlen = + sizeof(*gen) + iph2->sa->l
304 + sizeof(*gen) + iph2->nonce->l;
305 if (pfsgroup)
306 tlen += (sizeof(*gen) + iph2->dhpub->l);
307 if (idci)
308 tlen += sizeof(*gen) + iph2->id->l;
309 if (idcr)
310 tlen += sizeof(*gen) + iph2->id_p->l;
311 #ifdef ENABLE_NATT
312 if (natoa != ISAKMP_NPTYPE_NONE)
313 tlen += 2 * sizeof(*gen) + nat_oai->l + nat_oar->l;
314 #endif
315
316 body = vmalloc(tlen);
317 if (body == NULL) {
318 plog(LLV_ERROR, LOCATION, NULL,
319 "failed to get buffer to send.\n");
320 goto end;
321 }
322
323 p = body->v;
324
325 /* add SA payload */
326 p = set_isakmp_payload(p, iph2->sa, ISAKMP_NPTYPE_NONCE);
327
328 /* add NONCE payload */
329 if (pfsgroup)
330 np = ISAKMP_NPTYPE_KE;
331 else if (idci || idcr)
332 np = ISAKMP_NPTYPE_ID;
333 else
334 np = natoa;
335 p = set_isakmp_payload(p, iph2->nonce, np);
336
337 /* add KE payload if need. */
338 np = (idci || idcr) ? ISAKMP_NPTYPE_ID : natoa;
339 if (pfsgroup)
340 p = set_isakmp_payload(p, iph2->dhpub, np);
341
342 /* IDci */
343 np = (idcr) ? ISAKMP_NPTYPE_ID : natoa;
344 if (idci)
345 p = set_isakmp_payload(p, iph2->id, np);
346
347 /* IDcr */
348 if (idcr)
349 p = set_isakmp_payload(p, iph2->id_p, natoa);
350
351 #ifdef ENABLE_NATT
352 /* NAT-OA */
353 if (natoa != ISAKMP_NPTYPE_NONE) {
354 p = set_isakmp_payload(p, nat_oai, natoa);
355 p = set_isakmp_payload(p, nat_oar, ISAKMP_NPTYPE_NONE);
356 }
357 #endif
358
359 /* generate HASH(1) */
360 hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, body);
361 if (hash == NULL)
362 goto end;
363
364 /* send isakmp payload */
365 iph2->sendbuf = quick_ir1mx(iph2, body, hash);
366 if (iph2->sendbuf == NULL)
367 goto end;
368
369 /* send the packet, add to the schedule to resend */
370 if (isakmp_ph2send(iph2) == -1)
371 goto end;
372
373 /* change status of isakmp status entry */
374 iph2->status = PHASE2ST_MSG1SENT;
375
376 error = 0;
377
378 end:
379 if (body != NULL)
380 vfree(body);
381 if (hash != NULL)
382 vfree(hash);
383 #ifdef ENABLE_NATT
384 if (nat_oai != NULL)
385 vfree(nat_oai);
386 if (nat_oar != NULL)
387 vfree(nat_oar);
388 #endif
389
390 return error;
391 }
392
393 /*
394 * receive from responder
395 * HDR*, HASH(2), SA, Nr [, KE ] [, IDi2, IDr2 ] [, NAT-OAi, NAT-OAr ]
396 */
397 int
398 quick_i2recv(iph2, msg0)
399 struct ph2handle *iph2;
400 vchar_t *msg0;
401 {
402 vchar_t *msg = NULL;
403 vchar_t *hbuf = NULL; /* for hash computing. */
404 vchar_t *pbuf = NULL; /* for payload parsing */
405 vchar_t *idci = NULL;
406 vchar_t *idcr = NULL;
407 struct isakmp_parse_t *pa;
408 struct isakmp *isakmp = (struct isakmp *)msg0->v;
409 struct isakmp_pl_hash *hash = NULL;
410 char *p;
411 int tlen;
412 int error = ISAKMP_INTERNAL_ERROR;
413
414 /* validity check */
415 if (iph2->status != PHASE2ST_MSG1SENT) {
416 plog(LLV_ERROR, LOCATION, NULL,
417 "status mismatched %d.\n", iph2->status);
418 goto end;
419 }
420
421 /* decrypt packet */
422 if (!ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E)) {
423 plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
424 "Packet wasn't encrypted.\n");
425 goto end;
426 }
427 msg = oakley_do_decrypt(iph2->ph1, msg0, iph2->ivm->iv, iph2->ivm->ive);
428 if (msg == NULL)
429 goto end;
430
431 /* create buffer for validating HASH(2) */
432 /*
433 * ordering rule:
434 * 1. the first one must be HASH
435 * 2. the second one must be SA (added in isakmp-oakley-05!)
436 * 3. two IDs must be considered as IDci, then IDcr
437 */
438 pbuf = isakmp_parse(msg);
439 if (pbuf == NULL)
440 goto end;
441 pa = (struct isakmp_parse_t *)pbuf->v;
442
443 /* HASH payload is fixed postion */
444 if (pa->type != ISAKMP_NPTYPE_HASH) {
445 plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
446 "received invalid next payload type %d, "
447 "expecting %d.\n",
448 pa->type, ISAKMP_NPTYPE_HASH);
449 goto end;
450 }
451 hash = (struct isakmp_pl_hash *)pa->ptr;
452 pa++;
453
454 /*
455 * this restriction was introduced in isakmp-oakley-05.
456 * we do not check this for backward compatibility.
457 * TODO: command line/config file option to enable/disable this code
458 */
459 /* HASH payload is fixed postion */
460 if (pa->type != ISAKMP_NPTYPE_SA) {
461 plog(LLV_WARNING, LOCATION, iph2->ph1->remote,
462 "received invalid next payload type %d, "
463 "expecting %d.\n",
464 pa->type, ISAKMP_NPTYPE_HASH);
465 }
466
467 /* allocate buffer for computing HASH(2) */
468 tlen = iph2->nonce->l
469 + ntohl(isakmp->len) - sizeof(*isakmp);
470 hbuf = vmalloc(tlen);
471 if (hbuf == NULL) {
472 plog(LLV_ERROR, LOCATION, NULL,
473 "failed to get hash buffer.\n");
474 goto end;
475 }
476 p = hbuf->v + iph2->nonce->l; /* retain the space for Ni_b */
477
478 /*
479 * parse the payloads.
480 * copy non-HASH payloads into hbuf, so that we can validate HASH.
481 */
482 iph2->sa_ret = NULL;
483 tlen = 0; /* count payload length except of HASH payload. */
484 for (; pa->type; pa++) {
485
486 /* copy to buffer for HASH */
487 /* Don't modify the payload */
488 memcpy(p, pa->ptr, pa->len);
489
490 switch (pa->type) {
491 case ISAKMP_NPTYPE_SA:
492 if (iph2->sa_ret != NULL) {
493 plog(LLV_ERROR, LOCATION, NULL,
494 "Ignored, multiple SA "
495 "isn't supported.\n");
496 break;
497 }
498 if (isakmp_p2ph(&iph2->sa_ret, pa->ptr) < 0)
499 goto end;
500 break;
501
502 case ISAKMP_NPTYPE_NONCE:
503 if (isakmp_p2ph(&iph2->nonce_p, pa->ptr) < 0)
504 goto end;
505 break;
506
507 case ISAKMP_NPTYPE_KE:
508 if (isakmp_p2ph(&iph2->dhpub_p, pa->ptr) < 0)
509 goto end;
510 break;
511
512 case ISAKMP_NPTYPE_ID:
513 if (idci == NULL) {
514 if (isakmp_p2ph(&idci, pa->ptr) < 0)
515 goto end;
516 } else if (idcr == NULL) {
517 if (isakmp_p2ph(&idcr, pa->ptr) < 0)
518 goto end;
519 } else {
520 goto end;
521 }
522 break;
523
524 case ISAKMP_NPTYPE_N:
525 ph2_recv_n(iph2, pa->ptr);
526 break;
527
528 #ifdef ENABLE_NATT
529 case ISAKMP_NPTYPE_NATOA_DRAFT:
530 case ISAKMP_NPTYPE_NATOA_RFC:
531 {
532 struct sockaddr_storage addr;
533 struct sockaddr *daddr;
534 u_int8_t prefix;
535 u_int16_t ul_proto;
536 vchar_t *vp = NULL;
537
538 if (isakmp_p2ph(&vp, pa->ptr) < 0)
539 goto end;
540
541 error = ipsecdoi_id2sockaddr(vp,
542 (struct sockaddr *) &addr,
543 &prefix, &ul_proto);
544
545 vfree(vp);
546
547 if (error)
548 goto end;
549
550 daddr = dupsaddr((struct sockaddr *) &addr);
551 if (daddr == NULL)
552 goto end;
553
554 if (iph2->natoa_src == NULL)
555 iph2->natoa_src = daddr;
556 else if (iph2->natoa_dst == NULL)
557 iph2->natoa_dst = daddr;
558 else {
559 racoon_free(daddr);
560 goto end;
561 }
562 }
563 break;
564 #endif
565
566 default:
567 /* don't send information, see ident_r1recv() */
568 plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
569 "ignore the packet, "
570 "received unexpecting payload type %d.\n",
571 pa->type);
572 goto end;
573 }
574
575 p += pa->len;
576
577 /* compute true length of payload. */
578 tlen += pa->len;
579 }
580
581 /* payload existency check */
582 if (hash == NULL || iph2->sa_ret == NULL || iph2->nonce_p == NULL) {
583 plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
584 "few isakmp message received.\n");
585 goto end;
586 }
587
588 /* identity check */
589 if (idci != NULL) {
590 struct sockaddr_storage proposed_addr, got_addr;
591 u_int8_t proposed_prefix, got_prefix;
592 u_int16_t proposed_ulproto, got_ulproto;
593
594 error = ipsecdoi_id2sockaddr(iph2->id,
595 (struct sockaddr *) &proposed_addr,
596 &proposed_prefix, &proposed_ulproto);
597 if (error)
598 goto end;
599
600 error = ipsecdoi_id2sockaddr(idci,
601 (struct sockaddr *) &got_addr,
602 &got_prefix, &got_ulproto);
603 if (error)
604 goto end;
605
606 if (proposed_prefix != got_prefix
607 || proposed_ulproto != got_ulproto) {
608 plog(LLV_DEBUG, LOCATION, NULL,
609 "IDci prefix/ulproto does not match proposal.\n");
610 error = ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED;
611 goto end;
612 }
613 #ifdef ENABLE_NATT
614 set_port(iph2->natoa_src,
615 extract_port((struct sockaddr *) &proposed_addr));
616 #endif
617
618 if (cmpsaddr((struct sockaddr *) &proposed_addr,
619 (struct sockaddr *) &got_addr) == 0) {
620 plog(LLV_DEBUG, LOCATION, NULL,
621 "IDci matches proposal.\n");
622 #ifdef ENABLE_NATT
623 } else if (iph2->natoa_src != NULL
624 && cmpsaddr(iph2->natoa_src,
625 (struct sockaddr *) &got_addr) == 0) {
626 plog(LLV_DEBUG, LOCATION, NULL,
627 "IDci matches NAT-OAi.\n");
628 #endif
629 } else {
630 plog(LLV_ERROR, LOCATION, NULL,
631 "mismatched IDci was returned.\n");
632 error = ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED;
633 goto end;
634 }
635 }
636 if (idcr != NULL) {
637 struct sockaddr_storage proposed_addr, got_addr;
638 u_int8_t proposed_prefix, got_prefix;
639 u_int16_t proposed_ulproto, got_ulproto;
640
641 error = ipsecdoi_id2sockaddr(iph2->id_p,
642 (struct sockaddr *) &proposed_addr,
643 &proposed_prefix, &proposed_ulproto);
644 if (error)
645 goto end;
646
647 error = ipsecdoi_id2sockaddr(idcr,
648 (struct sockaddr *) &got_addr,
649 &got_prefix, &got_ulproto);
650 if (error)
651 goto end;
652
653 if (proposed_prefix != got_prefix
654 || proposed_ulproto != got_ulproto) {
655 plog(LLV_DEBUG, LOCATION, NULL,
656 "IDcr prefix/ulproto does not match proposal.\n");
657 error = ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED;
658 goto end;
659 }
660
661 #ifdef ENABLE_NATT
662 set_port(iph2->natoa_dst,
663 extract_port((struct sockaddr *) &proposed_addr));
664 #endif
665
666 if (cmpsaddr((struct sockaddr *) &proposed_addr,
667 (struct sockaddr *) &got_addr) == 0) {
668 plog(LLV_DEBUG, LOCATION, NULL,
669 "IDcr matches proposal.\n");
670 #ifdef ENABLE_NATT
671 } else if (iph2->natoa_dst != NULL
672 && cmpsaddr(iph2->natoa_dst,
673 (struct sockaddr *) &got_addr) == 0) {
674 plog(LLV_DEBUG, LOCATION, NULL,
675 "IDcr matches NAT-OAr.\n");
676 #endif
677 } else {
678 plog(LLV_ERROR, LOCATION, NULL,
679 "mismatched IDcr was returned.\n");
680 error = ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED;
681 goto end;
682 }
683 }
684
685 /* Fixed buffer for calculating HASH */
686 memcpy(hbuf->v, iph2->nonce->v, iph2->nonce->l);
687 plog(LLV_DEBUG, LOCATION, NULL,
688 "HASH allocated:hbuf->l=%zu actual:tlen=%zu\n",
689 hbuf->l, tlen + iph2->nonce->l);
690 /* adjust buffer length for HASH */
691 hbuf->l = iph2->nonce->l + tlen;
692
693 /* validate HASH(2) */
694 {
695 char *r_hash;
696 vchar_t *my_hash = NULL;
697 int result;
698
699 r_hash = (char *)hash + sizeof(*hash);
700
701 plog(LLV_DEBUG, LOCATION, NULL, "HASH(2) received:");
702 plogdump(LLV_DEBUG, r_hash, ntohs(hash->h.len) - sizeof(*hash));
703
704 my_hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, hbuf);
705 if (my_hash == NULL)
706 goto end;
707
708 result = memcmp(my_hash->v, r_hash, my_hash->l);
709 vfree(my_hash);
710
711 if (result) {
712 plog(LLV_DEBUG, LOCATION, iph2->ph1->remote,
713 "HASH(2) mismatch.\n");
714 error = ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
715 goto end;
716 }
717 }
718
719 /* validity check SA payload sent from responder */
720 if (ipsecdoi_checkph2proposal(iph2) < 0) {
721 error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
722 goto end;
723 }
724
725 /* change status of isakmp status entry */
726 iph2->status = PHASE2ST_STATUS6;
727
728 error = 0;
729
730 end:
731 if (hbuf)
732 vfree(hbuf);
733 if (pbuf)
734 vfree(pbuf);
735 if (msg)
736 vfree(msg);
737 if (idci)
738 vfree(idci);
739 if (idcr)
740 vfree(idcr);
741
742 if (error) {
743 VPTRINIT(iph2->sa_ret);
744 VPTRINIT(iph2->nonce_p);
745 VPTRINIT(iph2->dhpub_p);
746 VPTRINIT(iph2->id);
747 VPTRINIT(iph2->id_p);
748 #ifdef ENABLE_NATT
749 if (iph2->natoa_src) {
750 racoon_free(iph2->natoa_src);
751 iph2->natoa_src = NULL;
752 }
753 if (iph2->natoa_dst) {
754 racoon_free(iph2->natoa_dst);
755 iph2->natoa_dst = NULL;
756 }
757 #endif
758 }
759
760 return error;
761 }
762
763 /*
764 * send to responder
765 * HDR*, HASH(3)
766 */
767 int
768 quick_i2send(iph2, msg0)
769 struct ph2handle *iph2;
770 vchar_t *msg0;
771 {
772 vchar_t *msg = NULL;
773 vchar_t *buf = NULL;
774 vchar_t *hash = NULL;
775 char *p = NULL;
776 int tlen;
777 int error = ISAKMP_INTERNAL_ERROR;
778
779 /* validity check */
780 if (iph2->status != PHASE2ST_STATUS6) {
781 plog(LLV_ERROR, LOCATION, NULL,
782 "status mismatched %d.\n", iph2->status);
783 goto end;
784 }
785
786 /* generate HASH(3) */
787 {
788 vchar_t *tmp = NULL;
789
790 plog(LLV_DEBUG, LOCATION, NULL, "HASH(3) generate\n");
791
792 tmp = vmalloc(iph2->nonce->l + iph2->nonce_p->l);
793 if (tmp == NULL) {
794 plog(LLV_ERROR, LOCATION, NULL,
795 "failed to get hash buffer.\n");
796 goto end;
797 }
798 memcpy(tmp->v, iph2->nonce->v, iph2->nonce->l);
799 memcpy(tmp->v + iph2->nonce->l, iph2->nonce_p->v, iph2->nonce_p->l);
800
801 hash = oakley_compute_hash3(iph2->ph1, iph2->msgid, tmp);
802 vfree(tmp);
803
804 if (hash == NULL)
805 goto end;
806 }
807
808 /* create buffer for isakmp payload */
809 tlen = sizeof(struct isakmp)
810 + sizeof(struct isakmp_gen) + hash->l;
811 buf = vmalloc(tlen);
812 if (buf == NULL) {
813 plog(LLV_ERROR, LOCATION, NULL,
814 "failed to get buffer to send.\n");
815 goto end;
816 }
817
818 /* create isakmp header */
819 p = set_isakmp_header2(buf, iph2, ISAKMP_NPTYPE_HASH);
820 if (p == NULL)
821 goto end;
822
823 /* add HASH(3) payload */
824 p = set_isakmp_payload(p, hash, ISAKMP_NPTYPE_NONE);
825
826 #ifdef HAVE_PRINT_ISAKMP_C
827 isakmp_printpacket(buf, iph2->ph1->local, iph2->ph1->remote, 1);
828 #endif
829
830 /* encoding */
831 iph2->sendbuf = oakley_do_encrypt(iph2->ph1, buf, iph2->ivm->ive, iph2->ivm->iv);
832 if (iph2->sendbuf == NULL)
833 goto end;
834
835 /* if there is commit bit, need resending */
836 if (ISSET(iph2->flags, ISAKMP_FLAG_C)) {
837 /* send the packet, add to the schedule to resend */
838 if (isakmp_ph2send(iph2) == -1)
839 goto end;
840 } else {
841 /* send the packet */
842 if (isakmp_send(iph2->ph1, iph2->sendbuf) < 0)
843 goto end;
844 }
845
846 /* the sending message is added to the received-list. */
847 if (add_recvdpkt(iph2->ph1->remote, iph2->ph1->local,
848 iph2->sendbuf, msg0) == -1) {
849 plog(LLV_ERROR , LOCATION, NULL,
850 "failed to add a response packet to the tree.\n");
851 goto end;
852 }
853
854 /* compute both of KEYMATs */
855 if (oakley_compute_keymat(iph2, INITIATOR) < 0)
856 goto end;
857
858 iph2->status = PHASE2ST_ADDSA;
859
860 /* don't anything if local test mode. */
861 if (f_local) {
862 error = 0;
863 goto end;
864 }
865
866 /* if there is commit bit don't set up SA now. */
867 if (ISSET(iph2->flags, ISAKMP_FLAG_C)) {
868 iph2->status = PHASE2ST_COMMIT;
869 error = 0;
870 goto end;
871 }
872
873 /* Do UPDATE for initiator */
874 plog(LLV_DEBUG, LOCATION, NULL, "call pk_sendupdate\n");
875 if (pk_sendupdate(iph2) < 0) {
876 plog(LLV_ERROR, LOCATION, NULL, "pfkey update failed.\n");
877 goto end;
878 }
879 plog(LLV_DEBUG, LOCATION, NULL, "pfkey update sent.\n");
880
881 /* Do ADD for responder */
882 if (pk_sendadd(iph2) < 0) {
883 plog(LLV_ERROR, LOCATION, NULL, "pfkey add failed.\n");
884 goto end;
885 }
886 plog(LLV_DEBUG, LOCATION, NULL, "pfkey add sent.\n");
887
888 error = 0;
889
890 end:
891 if (buf != NULL)
892 vfree(buf);
893 if (msg != NULL)
894 vfree(msg);
895 if (hash != NULL)
896 vfree(hash);
897
898 return error;
899 }
900
901 /*
902 * receive from responder
903 * HDR#*, HASH(4), notify
904 */
905 int
906 quick_i3recv(iph2, msg0)
907 struct ph2handle *iph2;
908 vchar_t *msg0;
909 {
910 vchar_t *msg = NULL;
911 vchar_t *pbuf = NULL; /* for payload parsing */
912 struct isakmp_parse_t *pa;
913 struct isakmp_pl_hash *hash = NULL;
914 vchar_t *notify = NULL;
915 int error = ISAKMP_INTERNAL_ERROR;
916
917 /* validity check */
918 if (iph2->status != PHASE2ST_COMMIT) {
919 plog(LLV_ERROR, LOCATION, NULL,
920 "status mismatched %d.\n", iph2->status);
921 goto end;
922 }
923
924 /* decrypt packet */
925 if (!ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E)) {
926 plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
927 "Packet wasn't encrypted.\n");
928 goto end;
929 }
930 msg = oakley_do_decrypt(iph2->ph1, msg0, iph2->ivm->iv, iph2->ivm->ive);
931 if (msg == NULL)
932 goto end;
933
934 /* validate the type of next payload */
935 pbuf = isakmp_parse(msg);
936 if (pbuf == NULL)
937 goto end;
938
939 for (pa = (struct isakmp_parse_t *)pbuf->v;
940 pa->type != ISAKMP_NPTYPE_NONE;
941 pa++) {
942
943 switch (pa->type) {
944 case ISAKMP_NPTYPE_HASH:
945 hash = (struct isakmp_pl_hash *)pa->ptr;
946 break;
947 case ISAKMP_NPTYPE_N:
948 if (notify != NULL) {
949 plog(LLV_WARNING, LOCATION, NULL,
950 "Ignoring multiples notifications\n");
951 break;
952 }
953 ph2_recv_n(iph2, pa->ptr);
954 notify = vmalloc(pa->len);
955 if (notify == NULL) {
956 plog(LLV_ERROR, LOCATION, NULL,
957 "failed to get notify buffer.\n");
958 goto end;
959 }
960 memcpy(notify->v, pa->ptr, notify->l);
961 break;
962 default:
963 /* don't send information, see ident_r1recv() */
964 plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
965 "ignore the packet, "
966 "received unexpecting payload type %d.\n",
967 pa->type);
968 goto end;
969 }
970 }
971
972 /* payload existency check */
973 if (hash == NULL) {
974 plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
975 "few isakmp message received.\n");
976 goto end;
977 }
978
979 /* validate HASH(4) */
980 {
981 char *r_hash;
982 vchar_t *my_hash = NULL;
983 vchar_t *tmp = NULL;
984 int result;
985
986 r_hash = (char *)hash + sizeof(*hash);
987
988 plog(LLV_DEBUG, LOCATION, NULL, "HASH(4) validate:");
989 plogdump(LLV_DEBUG, r_hash, ntohs(hash->h.len) - sizeof(*hash));
990
991 my_hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, notify);
992 vfree(tmp);
993 if (my_hash == NULL)
994 goto end;
995
996 result = memcmp(my_hash->v, r_hash, my_hash->l);
997 vfree(my_hash);
998
999 if (result) {
1000 plog(LLV_DEBUG, LOCATION, iph2->ph1->remote,
1001 "HASH(4) mismatch.\n");
1002 error = ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
1003 goto end;
1004 }
1005 }
1006
1007 iph2->status = PHASE2ST_ADDSA;
1008 iph2->flags ^= ISAKMP_FLAG_C; /* reset bit */
1009
1010 /* don't anything if local test mode. */
1011 if (f_local) {
1012 error = 0;
1013 goto end;
1014 }
1015
1016 /* Do UPDATE for initiator */
1017 plog(LLV_DEBUG, LOCATION, NULL, "call pk_sendupdate\n");
1018 if (pk_sendupdate(iph2) < 0) {
1019 plog(LLV_ERROR, LOCATION, NULL, "pfkey update failed.\n");
1020 goto end;
1021 }
1022 plog(LLV_DEBUG, LOCATION, NULL, "pfkey update sent.\n");
1023
1024 /* Do ADD for responder */
1025 if (pk_sendadd(iph2) < 0) {
1026 plog(LLV_ERROR, LOCATION, NULL, "pfkey add failed.\n");
1027 goto end;
1028 }
1029 plog(LLV_DEBUG, LOCATION, NULL, "pfkey add sent.\n");
1030
1031 error = 0;
1032
1033 end:
1034 if (msg != NULL)
1035 vfree(msg);
1036 if (pbuf != NULL)
1037 vfree(pbuf);
1038 if (notify != NULL)
1039 vfree(notify);
1040
1041 return error;
1042 }
1043
1044 /*
1045 * receive from initiator
1046 * HDR*, HASH(1), SA, Ni [, KE ] [, IDi2, IDr2 ] [, NAT-OAi, NAT-OAr ]
1047 */
1048 int
1049 quick_r1recv(iph2, msg0)
1050 struct ph2handle *iph2;
1051 vchar_t *msg0;
1052 {
1053 vchar_t *msg = NULL;
1054 vchar_t *hbuf = NULL; /* for hash computing. */
1055 vchar_t *pbuf = NULL; /* for payload parsing */
1056 struct isakmp_parse_t *pa;
1057 struct isakmp *isakmp = (struct isakmp *)msg0->v;
1058 struct isakmp_pl_hash *hash = NULL;
1059 char *p;
1060 int tlen;
1061 int f_id_order; /* for ID payload detection */
1062 int error = ISAKMP_INTERNAL_ERROR;
1063
1064 /* validity check */
1065 if (iph2->status != PHASE2ST_START) {
1066 plog(LLV_ERROR, LOCATION, NULL,
1067 "status mismatched %d.\n", iph2->status);
1068 goto end;
1069 }
1070
1071 /* decrypting */
1072 if (!ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E)) {
1073 plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1074 "Packet wasn't encrypted.\n");
1075 error = ISAKMP_NTYPE_PAYLOAD_MALFORMED;
1076 goto end;
1077 }
1078 /* decrypt packet */
1079 msg = oakley_do_decrypt(iph2->ph1, msg0, iph2->ivm->iv, iph2->ivm->ive);
1080 if (msg == NULL)
1081 goto end;
1082
1083 /* create buffer for using to validate HASH(1) */
1084 /*
1085 * ordering rule:
1086 * 1. the first one must be HASH
1087 * 2. the second one must be SA (added in isakmp-oakley-05!)
1088 * 3. two IDs must be considered as IDci, then IDcr
1089 */
1090 pbuf = isakmp_parse(msg);
1091 if (pbuf == NULL)
1092 goto end;
1093 pa = (struct isakmp_parse_t *)pbuf->v;
1094
1095 /* HASH payload is fixed postion */
1096 if (pa->type != ISAKMP_NPTYPE_HASH) {
1097 plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1098 "received invalid next payload type %d, "
1099 "expecting %d.\n",
1100 pa->type, ISAKMP_NPTYPE_HASH);
1101 error = ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX;
1102 goto end;
1103 }
1104 hash = (struct isakmp_pl_hash *)pa->ptr;
1105 pa++;
1106
1107 /*
1108 * this restriction was introduced in isakmp-oakley-05.
1109 * we do not check this for backward compatibility.
1110 * TODO: command line/config file option to enable/disable this code
1111 */
1112 /* HASH payload is fixed postion */
1113 if (pa->type != ISAKMP_NPTYPE_SA) {
1114 plog(LLV_WARNING, LOCATION, iph2->ph1->remote,
1115 "received invalid next payload type %d, "
1116 "expecting %d.\n",
1117 pa->type, ISAKMP_NPTYPE_SA);
1118 error = ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX;
1119 }
1120
1121 /* allocate buffer for computing HASH(1) */
1122 tlen = ntohl(isakmp->len) - sizeof(*isakmp);
1123 hbuf = vmalloc(tlen);
1124 if (hbuf == NULL) {
1125 plog(LLV_ERROR, LOCATION, NULL,
1126 "failed to get hash buffer.\n");
1127 goto end;
1128 }
1129 p = hbuf->v;
1130
1131 /*
1132 * parse the payloads.
1133 * copy non-HASH payloads into hbuf, so that we can validate HASH.
1134 */
1135 iph2->sa = NULL; /* we don't support multi SAs. */
1136 iph2->nonce_p = NULL;
1137 iph2->dhpub_p = NULL;
1138 iph2->id_p = NULL;
1139 iph2->id = NULL;
1140 tlen = 0; /* count payload length except of HASH payload. */
1141
1142 /*
1143 * IDi2 MUST be immediatelly followed by IDr2. We allowed the
1144 * illegal case, but logged. First ID payload is to be IDi2.
1145 * And next ID payload is to be IDr2.
1146 */
1147 f_id_order = 0;
1148
1149 for (; pa->type; pa++) {
1150
1151 /* copy to buffer for HASH */
1152 /* Don't modify the payload */
1153 memcpy(p, pa->ptr, pa->len);
1154
1155 if (pa->type != ISAKMP_NPTYPE_ID)
1156 f_id_order = 0;
1157
1158 switch (pa->type) {
1159 case ISAKMP_NPTYPE_SA:
1160 if (iph2->sa != NULL) {
1161 plog(LLV_ERROR, LOCATION, NULL,
1162 "Multi SAs isn't supported.\n");
1163 goto end;
1164 }
1165 if (isakmp_p2ph(&iph2->sa, pa->ptr) < 0)
1166 goto end;
1167 break;
1168
1169 case ISAKMP_NPTYPE_NONCE:
1170 if (isakmp_p2ph(&iph2->nonce_p, pa->ptr) < 0)
1171 goto end;
1172 break;
1173
1174 case ISAKMP_NPTYPE_KE:
1175 if (isakmp_p2ph(&iph2->dhpub_p, pa->ptr) < 0)
1176 goto end;
1177 break;
1178
1179 case ISAKMP_NPTYPE_ID:
1180 if (iph2->id_p == NULL) {
1181 /* for IDci */
1182 f_id_order++;
1183
1184 if (isakmp_p2ph(&iph2->id_p, pa->ptr) < 0)
1185 goto end;
1186
1187 } else if (iph2->id == NULL) {
1188 /* for IDcr */
1189 if (f_id_order == 0) {
1190 plog(LLV_ERROR, LOCATION, NULL,
1191 "IDr2 payload is not "
1192 "immediatelly followed "
1193 "by IDi2. We allowed.\n");
1194 /* XXX we allowed in this case. */
1195 }
1196
1197 if (isakmp_p2ph(&iph2->id, pa->ptr) < 0)
1198 goto end;
1199 } else {
1200 plog(LLV_ERROR, LOCATION, NULL,
1201 "received too many ID payloads.\n");
1202 plogdump(LLV_ERROR, iph2->id->v, iph2->id->l);
1203 error = ISAKMP_NTYPE_INVALID_ID_INFORMATION;
1204 goto end;
1205 }
1206 break;
1207
1208 case ISAKMP_NPTYPE_N:
1209 ph2_recv_n(iph2, pa->ptr);
1210 break;
1211
1212 #ifdef ENABLE_NATT
1213 case ISAKMP_NPTYPE_NATOA_DRAFT:
1214 case ISAKMP_NPTYPE_NATOA_RFC:
1215 {
1216 struct sockaddr_storage addr;
1217 struct sockaddr *daddr;
1218 u_int8_t prefix;
1219 u_int16_t ul_proto;
1220 vchar_t *vp = NULL;
1221
1222 if (isakmp_p2ph(&vp, pa->ptr) < 0)
1223 goto end;
1224
1225 error = ipsecdoi_id2sockaddr(vp,
1226 (struct sockaddr *) &addr,
1227 &prefix, &ul_proto);
1228
1229 vfree(vp);
1230
1231 if (error)
1232 goto end;
1233
1234 daddr = dupsaddr((struct sockaddr *) &addr);
1235 if (daddr == NULL)
1236 goto end;
1237
1238 if (iph2->natoa_dst == NULL)
1239 iph2->natoa_dst = daddr;
1240 else if (iph2->natoa_src == NULL)
1241 iph2->natoa_src = daddr;
1242 else {
1243 racoon_free(daddr);
1244 goto end;
1245 }
1246 }
1247 break;
1248 #endif
1249
1250 default:
1251 plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1252 "ignore the packet, "
1253 "received unexpecting payload type %d.\n",
1254 pa->type);
1255 error = ISAKMP_NTYPE_PAYLOAD_MALFORMED;
1256 goto end;
1257 }
1258
1259 p += pa->len;
1260
1261 /* compute true length of payload. */
1262 tlen += pa->len;
1263 }
1264
1265 /* payload existency check */
1266 if (hash == NULL || iph2->sa == NULL || iph2->nonce_p == NULL) {
1267 plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1268 "few isakmp message received.\n");
1269 error = ISAKMP_NTYPE_PAYLOAD_MALFORMED;
1270 goto end;
1271 }
1272
1273 if (iph2->id_p) {
1274 plog(LLV_DEBUG, LOCATION, NULL, "received IDci2:");
1275 plogdump(LLV_DEBUG, iph2->id_p->v, iph2->id_p->l);
1276 }
1277 if (iph2->id) {
1278 plog(LLV_DEBUG, LOCATION, NULL, "received IDcr2:");
1279 plogdump(LLV_DEBUG, iph2->id->v, iph2->id->l);
1280 }
1281
1282 /* adjust buffer length for HASH */
1283 hbuf->l = tlen;
1284
1285 /* validate HASH(1) */
1286 {
1287 char *r_hash;
1288 vchar_t *my_hash = NULL;
1289 int result;
1290
1291 r_hash = (caddr_t)hash + sizeof(*hash);
1292
1293 plog(LLV_DEBUG, LOCATION, NULL, "HASH(1) validate:");
1294 plogdump(LLV_DEBUG, r_hash, ntohs(hash->h.len) - sizeof(*hash));
1295
1296 my_hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, hbuf);
1297 if (my_hash == NULL)
1298 goto end;
1299
1300 result = memcmp(my_hash->v, r_hash, my_hash->l);
1301 vfree(my_hash);
1302
1303 if (result) {
1304 plog(LLV_DEBUG, LOCATION, iph2->ph1->remote,
1305 "HASH(1) mismatch.\n");
1306 error = ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
1307 goto end;
1308 }
1309 }
1310
1311 /* get sainfo */
1312 error = get_sainfo_r(iph2);
1313 if (error) {
1314 plog(LLV_ERROR, LOCATION, NULL,
1315 "failed to get sainfo.\n");
1316 goto end;
1317 }
1318
1319
1320 /* check the existence of ID payload and create responder's proposal */
1321 error = get_proposal_r(iph2);
1322 switch (error) {
1323 case -2:
1324 /* generate a policy template from peer's proposal */
1325 if (set_proposal_from_proposal(iph2)) {
1326 plog(LLV_ERROR, LOCATION, NULL,
1327 "failed to generate a proposal template "
1328 "from client's proposal.\n");
1329 error = ISAKMP_INTERNAL_ERROR;
1330 goto end;
1331 }
1332 /*FALLTHROUGH*/
1333 case 0:
1334 /* select single proposal or reject it. */
1335 if (ipsecdoi_selectph2proposal(iph2) < 0) {
1336 error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
1337 goto end;
1338 }
1339 break;
1340 default:
1341 plog(LLV_ERROR, LOCATION, NULL,
1342 "failed to get proposal for responder.\n");
1343 goto end;
1344 }
1345
1346 /* check KE and attribute of PFS */
1347 if (iph2->dhpub_p != NULL && iph2->approval->pfs_group == 0) {
1348 plog(LLV_ERROR, LOCATION, NULL,
1349 "no PFS is specified, but peer sends KE.\n");
1350 error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
1351 goto end;
1352 }
1353 if (iph2->dhpub_p == NULL && iph2->approval->pfs_group != 0) {
1354 plog(LLV_ERROR, LOCATION, NULL,
1355 "PFS is specified, but peer doesn't sends KE.\n");
1356 error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
1357 goto end;
1358 }
1359
1360 /*
1361 * save the packet from the initiator in order to resend the
1362 * responder's first packet against this packet.
1363 */
1364 iph2->msg1 = vdup(msg0);
1365
1366 /* change status of isakmp status entry */
1367 iph2->status = PHASE2ST_STATUS2;
1368
1369 error = 0;
1370
1371 end:
1372 if (hbuf)
1373 vfree(hbuf);
1374 if (msg)
1375 vfree(msg);
1376 if (pbuf)
1377 vfree(pbuf);
1378
1379 if (error) {
1380 VPTRINIT(iph2->sa);
1381 VPTRINIT(iph2->nonce_p);
1382 VPTRINIT(iph2->dhpub_p);
1383 VPTRINIT(iph2->id);
1384 VPTRINIT(iph2->id_p);
1385 #ifdef ENABLE_NATT
1386 if (iph2->natoa_src) {
1387 racoon_free(iph2->natoa_src);
1388 iph2->natoa_src = NULL;
1389 }
1390 if (iph2->natoa_dst) {
1391 racoon_free(iph2->natoa_dst);
1392 iph2->natoa_dst = NULL;
1393 }
1394 #endif
1395 }
1396
1397 return error;
1398 }
1399
1400 /*
1401 * call pfkey_getspi.
1402 */
1403 int
1404 quick_r1prep(iph2, msg)
1405 struct ph2handle *iph2;
1406 vchar_t *msg;
1407 {
1408 int error = ISAKMP_INTERNAL_ERROR;
1409
1410 /* validity check */
1411 if (iph2->status != PHASE2ST_STATUS2) {
1412 plog(LLV_ERROR, LOCATION, NULL,
1413 "status mismatched %d.\n", iph2->status);
1414 goto end;
1415 }
1416
1417 iph2->status = PHASE2ST_GETSPISENT;
1418
1419 /* send getspi message */
1420 if (pk_sendgetspi(iph2) < 0)
1421 goto end;
1422
1423 plog(LLV_DEBUG, LOCATION, NULL, "pfkey getspi sent.\n");
1424
1425 sched_schedule(&iph2->sce, lcconf->wait_ph2complete,
1426 quick_timeover_stub);
1427
1428 error = 0;
1429
1430 end:
1431 return error;
1432 }
1433
1434 /*
1435 * send to initiator
1436 * HDR*, HASH(2), SA, Nr [, KE ] [, IDi2, IDr2 ] [, NAT-OAi, NAT-OAr ]
1437 */
1438 int
1439 quick_r2send(iph2, msg)
1440 struct ph2handle *iph2;
1441 vchar_t *msg;
1442 {
1443 vchar_t *body = NULL;
1444 vchar_t *hash = NULL;
1445 struct isakmp_gen *gen;
1446 char *p;
1447 int tlen;
1448 int error = ISAKMP_INTERNAL_ERROR;
1449 int natoa = ISAKMP_NPTYPE_NONE;
1450 int pfsgroup;
1451 u_int8_t *np_p = NULL;
1452 #ifdef ENABLE_NATT
1453 vchar_t *nat_oai = NULL;
1454 vchar_t *nat_oar = NULL;
1455 #endif
1456
1457 /* validity check */
1458 if (msg != NULL) {
1459 plog(LLV_ERROR, LOCATION, NULL,
1460 "msg has to be NULL in this function.\n");
1461 goto end;
1462 }
1463 if (iph2->status != PHASE2ST_GETSPIDONE) {
1464 plog(LLV_ERROR, LOCATION, NULL,
1465 "status mismatched %d.\n", iph2->status);
1466 goto end;
1467 }
1468
1469 /* update responders SPI */
1470 if (ipsecdoi_updatespi(iph2) < 0) {
1471 plog(LLV_ERROR, LOCATION, NULL, "failed to update spi.\n");
1472 goto end;
1473 }
1474
1475 /* generate NONCE value */
1476 iph2->nonce = eay_set_random(iph2->ph1->rmconf->nonce_size);
1477 if (iph2->nonce == NULL)
1478 goto end;
1479
1480 /* generate KE value if need */
1481 pfsgroup = iph2->approval->pfs_group;
1482 if (iph2->dhpub_p != NULL && pfsgroup != 0) {
1483 /* DH group settting if PFS is required. */
1484 if (oakley_setdhgroup(pfsgroup, &iph2->pfsgrp) < 0) {
1485 plog(LLV_ERROR, LOCATION, NULL,
1486 "failed to set DH value.\n");
1487 goto end;
1488 }
1489 /* generate DH public value */
1490 if (oakley_dh_generate(iph2->pfsgrp,
1491 &iph2->dhpub, &iph2->dhpriv) < 0) {
1492 goto end;
1493 }
1494 }
1495
1496 #ifdef ENABLE_NATT
1497 /*
1498 * RFC3947 5.2. if we chose UDP-Encapsulated-Transport
1499 * we should send NAT-OA
1500 */
1501 if (ipsecdoi_transportmode(iph2->proposal)
1502 && (iph2->ph1->natt_flags & NAT_DETECTED)) {
1503 natoa = iph2->ph1->natt_options->payload_nat_oa;
1504
1505 nat_oai = ipsecdoi_sockaddr2id(iph2->dst,
1506 IPSECDOI_PREFIX_HOST, IPSEC_ULPROTO_ANY);
1507 nat_oar = ipsecdoi_sockaddr2id(iph2->src,
1508 IPSECDOI_PREFIX_HOST, IPSEC_ULPROTO_ANY);
1509
1510 if (nat_oai == NULL || nat_oar == NULL) {
1511 plog(LLV_ERROR, LOCATION, NULL,
1512 "failed to generate NAT-OA payload.\n");
1513 goto end;
1514 }
1515
1516 plog(LLV_DEBUG, LOCATION, NULL, "NAT-OAi:\n");
1517 plogdump(LLV_DEBUG, nat_oai->v, nat_oai->l);
1518 plog(LLV_DEBUG, LOCATION, NULL, "NAT-OAr:\n");
1519 plogdump(LLV_DEBUG, nat_oar->v, nat_oar->l);
1520 }
1521 #endif
1522
1523 /* create SA;NONCE payload, and KE and ID if need */
1524 tlen = sizeof(*gen) + iph2->sa_ret->l
1525 + sizeof(*gen) + iph2->nonce->l;
1526 if (iph2->dhpub_p != NULL && pfsgroup != 0)
1527 tlen += (sizeof(*gen) + iph2->dhpub->l);
1528 if (iph2->id_p != NULL)
1529 tlen += (sizeof(*gen) + iph2->id_p->l
1530 + sizeof(*gen) + iph2->id->l);
1531 #ifdef ENABLE_NATT
1532 if (natoa != ISAKMP_NPTYPE_NONE)
1533 tlen += 2 * sizeof(*gen) + nat_oai->l + nat_oar->l;
1534 #endif
1535
1536 body = vmalloc(tlen);
1537 if (body == NULL) {
1538 plog(LLV_ERROR, LOCATION, NULL,
1539 "failed to get buffer to send.\n");
1540 goto end;
1541 }
1542 p = body->v;
1543
1544 /* make SA payload */
1545 p = set_isakmp_payload(body->v, iph2->sa_ret, ISAKMP_NPTYPE_NONCE);
1546
1547 /* add NONCE payload */
1548 np_p = &((struct isakmp_gen *)p)->np; /* XXX */
1549 p = set_isakmp_payload(p, iph2->nonce,
1550 (iph2->dhpub_p != NULL && pfsgroup != 0)
1551 ? ISAKMP_NPTYPE_KE
1552 : (iph2->id_p != NULL
1553 ? ISAKMP_NPTYPE_ID
1554 : natoa));
1555
1556 /* add KE payload if need. */
1557 if (iph2->dhpub_p != NULL && pfsgroup != 0) {
1558 np_p = &((struct isakmp_gen *)p)->np; /* XXX */
1559 p = set_isakmp_payload(p, iph2->dhpub,
1560 (iph2->id_p == NULL)
1561 ? natoa
1562 : ISAKMP_NPTYPE_ID);
1563 }
1564
1565 /* add ID payloads received. */
1566 if (iph2->id_p != NULL) {
1567 /* IDci */
1568 p = set_isakmp_payload(p, iph2->id_p, ISAKMP_NPTYPE_ID);
1569 /* IDcr */
1570 np_p = &((struct isakmp_gen *)p)->np; /* XXX */
1571 p = set_isakmp_payload(p, iph2->id, natoa);
1572 }
1573
1574 #ifdef ENABLE_NATT
1575 /* NAT-OA */
1576 if (natoa != ISAKMP_NPTYPE_NONE) {
1577 p = set_isakmp_payload(p, nat_oai, natoa);
1578 p = set_isakmp_payload(p, nat_oar, ISAKMP_NPTYPE_NONE);
1579 }
1580 #endif
1581
1582 /* add a RESPONDER-LIFETIME notify payload if needed */
1583 {
1584 vchar_t *data = NULL;
1585 struct saprop *pp = iph2->approval;
1586 struct saproto *pr;
1587
1588 if (pp->claim & IPSECDOI_ATTR_SA_LD_TYPE_SEC) {
1589 u_int32_t v = htonl((u_int32_t)pp->lifetime);
1590 data = isakmp_add_attr_l(data, IPSECDOI_ATTR_SA_LD_TYPE,
1591 IPSECDOI_ATTR_SA_LD_TYPE_SEC);
1592 if (!data)
1593 goto end;
1594 data = isakmp_add_attr_v(data, IPSECDOI_ATTR_SA_LD,
1595 (caddr_t)&v, sizeof(v));
1596 if (!data)
1597 goto end;
1598 }
1599 if (pp->claim & IPSECDOI_ATTR_SA_LD_TYPE_KB) {
1600 u_int32_t v = htonl((u_int32_t)pp->lifebyte);
1601 data = isakmp_add_attr_l(data, IPSECDOI_ATTR_SA_LD_TYPE,
1602 IPSECDOI_ATTR_SA_LD_TYPE_KB);
1603 if (!data)
1604 goto end;
1605 data = isakmp_add_attr_v(data, IPSECDOI_ATTR_SA_LD,
1606 (caddr_t)&v, sizeof(v));
1607 if (!data)
1608 goto end;
1609 }
1610
1611 /*
1612 * XXX Is there only single RESPONDER-LIFETIME payload in a IKE message
1613 * in the case of SA bundle ?
1614 */
1615 if (data) {
1616 for (pr = pp->head; pr; pr = pr->next) {
1617 body = isakmp_add_pl_n(body, &np_p,
1618 ISAKMP_NTYPE_RESPONDER_LIFETIME, pr, data);
1619 if (!body) {
1620 vfree(data);
1621 return error; /* XXX */
1622 }
1623 }
1624 vfree(data);
1625 }
1626 }
1627
1628 /* generate HASH(2) */
1629 {
1630 vchar_t *tmp;
1631
1632 tmp = vmalloc(iph2->nonce_p->l + body->l);
1633 if (tmp == NULL) {
1634 plog(LLV_ERROR, LOCATION, NULL,
1635 "failed to get hash buffer.\n");
1636 goto end;
1637 }
1638 memcpy(tmp->v, iph2->nonce_p->v, iph2->nonce_p->l);
1639 memcpy(tmp->v + iph2->nonce_p->l, body->v, body->l);
1640
1641 hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, tmp);
1642 vfree(tmp);
1643
1644 if (hash == NULL)
1645 goto end;
1646 }
1647
1648 /* send isakmp payload */
1649 iph2->sendbuf = quick_ir1mx(iph2, body, hash);
1650 if (iph2->sendbuf == NULL)
1651 goto end;
1652
1653 /* send the packet, add to the schedule to resend */
1654 if (isakmp_ph2send(iph2) == -1)
1655 goto end;
1656
1657 /* the sending message is added to the received-list. */
1658 if (add_recvdpkt(iph2->ph1->remote, iph2->ph1->local, iph2->sendbuf, iph2->msg1) == -1) {
1659 plog(LLV_ERROR , LOCATION, NULL,
1660 "failed to add a response packet to the tree.\n");
1661 goto end;
1662 }
1663
1664 /* change status of isakmp status entry */
1665 iph2->status = PHASE2ST_MSG1SENT;
1666
1667 error = 0;
1668
1669 end:
1670 if (body != NULL)
1671 vfree(body);
1672 if (hash != NULL)
1673 vfree(hash);
1674 #ifdef ENABLE_NATT
1675 if (nat_oai != NULL)
1676 vfree(nat_oai);
1677 if (nat_oar != NULL)
1678 vfree(nat_oar);
1679 #endif
1680
1681 return error;
1682 }
1683
1684 /*
1685 * receive from initiator
1686 * HDR*, HASH(3)
1687
1688 */
1689 int
1690 quick_r3recv(iph2, msg0)
1691 struct ph2handle *iph2;
1692 vchar_t *msg0;
1693 {
1694 vchar_t *msg = NULL;
1695 vchar_t *pbuf = NULL; /* for payload parsing */
1696 struct isakmp_parse_t *pa;
1697 struct isakmp_pl_hash *hash = NULL;
1698 int error = ISAKMP_INTERNAL_ERROR;
1699
1700 /* validity check */
1701 if (iph2->status != PHASE2ST_MSG1SENT) {
1702 plog(LLV_ERROR, LOCATION, NULL,
1703 "status mismatched %d.\n", iph2->status);
1704 goto end;
1705 }
1706
1707 /* decrypt packet */
1708 if (!ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E)) {
1709 plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1710 "Packet wasn't encrypted.\n");
1711 goto end;
1712 }
1713 msg = oakley_do_decrypt(iph2->ph1, msg0, iph2->ivm->iv, iph2->ivm->ive);
1714 if (msg == NULL)
1715 goto end;
1716
1717 /* validate the type of next payload */
1718 pbuf = isakmp_parse(msg);
1719 if (pbuf == NULL)
1720 goto end;
1721
1722 for (pa = (struct isakmp_parse_t *)pbuf->v;
1723 pa->type != ISAKMP_NPTYPE_NONE;
1724 pa++) {
1725
1726 switch (pa->type) {
1727 case ISAKMP_NPTYPE_HASH:
1728 hash = (struct isakmp_pl_hash *)pa->ptr;
1729 break;
1730 case ISAKMP_NPTYPE_N:
1731 ph2_recv_n(iph2, pa->ptr);
1732 break;
1733 default:
1734 /* don't send information, see ident_r1recv() */
1735 plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1736 "ignore the packet, "
1737 "received unexpecting payload type %d.\n",
1738 pa->type);
1739 goto end;
1740 }
1741 }
1742
1743 /* payload existency check */
1744 if (hash == NULL) {
1745 plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1746 "few isakmp message received.\n");
1747 goto end;
1748 }
1749
1750 /* validate HASH(3) */
1751 /* HASH(3) = prf(SKEYID_a, 0 | M-ID | Ni_b | Nr_b) */
1752 {
1753 char *r_hash;
1754 vchar_t *my_hash = NULL;
1755 vchar_t *tmp = NULL;
1756 int result;
1757
1758 r_hash = (char *)hash + sizeof(*hash);
1759
1760 plog(LLV_DEBUG, LOCATION, NULL, "HASH(3) validate:");
1761 plogdump(LLV_DEBUG, r_hash, ntohs(hash->h.len) - sizeof(*hash));
1762
1763 tmp = vmalloc(iph2->nonce_p->l + iph2->nonce->l);
1764 if (tmp == NULL) {
1765 plog(LLV_ERROR, LOCATION, NULL,
1766 "failed to get hash buffer.\n");
1767 goto end;
1768 }
1769 memcpy(tmp->v, iph2->nonce_p->v, iph2->nonce_p->l);
1770 memcpy(tmp->v + iph2->nonce_p->l, iph2->nonce->v, iph2->nonce->l);
1771
1772 my_hash = oakley_compute_hash3(iph2->ph1, iph2->msgid, tmp);
1773 vfree(tmp);
1774 if (my_hash == NULL)
1775 goto end;
1776
1777 result = memcmp(my_hash->v, r_hash, my_hash->l);
1778 vfree(my_hash);
1779
1780 if (result) {
1781 plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1782 "HASH(3) mismatch.\n");
1783 error = ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
1784 goto end;
1785 }
1786 }
1787
1788 /* if there is commit bit, don't set up SA now. */
1789 if (ISSET(iph2->flags, ISAKMP_FLAG_C)) {
1790 iph2->status = PHASE2ST_COMMIT;
1791 } else
1792 iph2->status = PHASE2ST_STATUS6;
1793
1794 error = 0;
1795
1796 end:
1797 if (pbuf != NULL)
1798 vfree(pbuf);
1799 if (msg != NULL)
1800 vfree(msg);
1801
1802 return error;
1803 }
1804
1805 /*
1806 * send to initiator
1807 * HDR#*, HASH(4), notify
1808 */
1809 int
1810 quick_r3send(iph2, msg0)
1811 struct ph2handle *iph2;
1812 vchar_t *msg0;
1813 {
1814 vchar_t *buf = NULL;
1815 vchar_t *myhash = NULL;
1816 struct isakmp_pl_n *n;
1817 vchar_t *notify = NULL;
1818 char *p;
1819 int tlen;
1820 int error = ISAKMP_INTERNAL_ERROR;
1821
1822 /* validity check */
1823 if (iph2->status != PHASE2ST_COMMIT) {
1824 plog(LLV_ERROR, LOCATION, NULL,
1825 "status mismatched %d.\n", iph2->status);
1826 goto end;
1827 }
1828
1829 /* generate HASH(4) */
1830 /* XXX What can I do in the case of multiple different SA */
1831 plog(LLV_DEBUG, LOCATION, NULL, "HASH(4) generate\n");
1832
1833 /* XXX What should I do if there are multiple SAs ? */
1834 tlen = sizeof(struct isakmp_pl_n) + iph2->approval->head->spisize;
1835 notify = vmalloc(tlen);
1836 if (notify == NULL) {
1837 plog(LLV_ERROR, LOCATION, NULL,
1838 "failed to get notify buffer.\n");
1839 goto end;
1840 }
1841 n = (struct isakmp_pl_n *)notify->v;
1842 n->h.np = ISAKMP_NPTYPE_NONE;
1843 n->h.len = htons(tlen);
1844 n->doi = htonl(IPSEC_DOI);
1845 n->proto_id = iph2->approval->head->proto_id;
1846 n->spi_size = sizeof(iph2->approval->head->spisize);
1847 n->type = htons(ISAKMP_NTYPE_CONNECTED);
1848 memcpy(n + 1, &iph2->approval->head->spi, iph2->approval->head->spisize);
1849
1850 myhash = oakley_compute_hash1(iph2->ph1, iph2->msgid, notify);
1851 if (myhash == NULL)
1852 goto end;
1853
1854 /* create buffer for isakmp payload */
1855 tlen = sizeof(struct isakmp)
1856 + sizeof(struct isakmp_gen) + myhash->l
1857 + notify->l;
1858 buf = vmalloc(tlen);
1859 if (buf == NULL) {
1860 plog(LLV_ERROR, LOCATION, NULL,
1861 "failed to get buffer to send.\n");
1862 goto end;
1863 }
1864
1865 /* create isakmp header */
1866 p = set_isakmp_header2(buf, iph2, ISAKMP_NPTYPE_HASH);
1867 if (p == NULL)
1868 goto end;
1869
1870 /* add HASH(4) payload */
1871 p = set_isakmp_payload(p, myhash, ISAKMP_NPTYPE_N);
1872
1873 /* add notify payload */
1874 memcpy(p, notify->v, notify->l);
1875
1876 #ifdef HAVE_PRINT_ISAKMP_C
1877 isakmp_printpacket(buf, iph2->ph1->local, iph2->ph1->remote, 1);
1878 #endif
1879
1880 /* encoding */
1881 iph2->sendbuf = oakley_do_encrypt(iph2->ph1, buf, iph2->ivm->ive, iph2->ivm->iv);
1882 if (iph2->sendbuf == NULL)
1883 goto end;
1884
1885 /* send the packet */
1886 if (isakmp_send(iph2->ph1, iph2->sendbuf) < 0)
1887 goto end;
1888
1889 /* the sending message is added to the received-list. */
1890 if (add_recvdpkt(iph2->ph1->remote, iph2->ph1->local, iph2->sendbuf, msg0) == -1) {
1891 plog(LLV_ERROR , LOCATION, NULL,
1892 "failed to add a response packet to the tree.\n");
1893 goto end;
1894 }
1895
1896 iph2->status = PHASE2ST_COMMIT;
1897
1898 error = 0;
1899
1900 end:
1901 if (buf != NULL)
1902 vfree(buf);
1903 if (myhash != NULL)
1904 vfree(myhash);
1905 if (notify != NULL)
1906 vfree(notify);
1907
1908 return error;
1909 }
1910
1911 int
1912 tunnel_mode_prop(p)
1913 struct saprop *p;
1914 {
1915 struct saproto *pr;
1916
1917 for (pr = p->head; pr; pr = pr->next)
1918 if (pr->encmode == IPSECDOI_ATTR_ENC_MODE_TUNNEL)
1919 return 1;
1920 return 0;
1921 }
1922
1923 /*
1924 * set SA to kernel.
1925 */
1926 int
1927 quick_r3prep(iph2, msg0)
1928 struct ph2handle *iph2;
1929 vchar_t *msg0;
1930 {
1931 int error = ISAKMP_INTERNAL_ERROR;
1932
1933 /* validity check */
1934 if (iph2->status != PHASE2ST_STATUS6) {
1935 plog(LLV_ERROR, LOCATION, NULL,
1936 "status mismatched %d.\n", iph2->status);
1937 goto end;
1938 }
1939
1940 /* compute both of KEYMATs */
1941 if (oakley_compute_keymat(iph2, RESPONDER) < 0)
1942 goto end;
1943
1944 iph2->status = PHASE2ST_ADDSA;
1945 iph2->flags ^= ISAKMP_FLAG_C; /* reset bit */
1946
1947 /* don't anything if local test mode. */
1948 if (f_local) {
1949 error = 0;
1950 goto end;
1951 }
1952
1953 /* Do UPDATE as responder */
1954 plog(LLV_DEBUG, LOCATION, NULL, "call pk_sendupdate\n");
1955 if (pk_sendupdate(iph2) < 0) {
1956 plog(LLV_ERROR, LOCATION, NULL, "pfkey update failed.\n");
1957 goto end;
1958 }
1959 plog(LLV_DEBUG, LOCATION, NULL, "pfkey update sent.\n");
1960
1961 /* Do ADD for responder */
1962 if (pk_sendadd(iph2) < 0) {
1963 plog(LLV_ERROR, LOCATION, NULL, "pfkey add failed.\n");
1964 goto end;
1965 }
1966 plog(LLV_DEBUG, LOCATION, NULL, "pfkey add sent.\n");
1967
1968 /*
1969 * set policies into SPD if the policy is generated
1970 * from peer's policy.
1971 */
1972 if (iph2->spidx_gen) {
1973
1974 struct policyindex *spidx;
1975 struct sockaddr_storage addr;
1976 u_int8_t pref;
1977 struct sockaddr *src = iph2->src;
1978 struct sockaddr *dst = iph2->dst;
1979
1980 /* make inbound policy */
1981 iph2->src = dst;
1982 iph2->dst = src;
1983 if (pk_sendspdupdate2(iph2) < 0) {
1984 plog(LLV_ERROR, LOCATION, NULL,
1985 "pfkey spdupdate2(inbound) failed.\n");
1986 goto end;
1987 }
1988 plog(LLV_DEBUG, LOCATION, NULL,
1989 "pfkey spdupdate2(inbound) sent.\n");
1990
1991 spidx = (struct policyindex *)iph2->spidx_gen;
1992 #ifdef HAVE_POLICY_FWD
1993 /* make forward policy if required */
1994 if (tunnel_mode_prop(iph2->approval)) {
1995 spidx->dir = IPSEC_DIR_FWD;
1996 if (pk_sendspdupdate2(iph2) < 0) {
1997 plog(LLV_ERROR, LOCATION, NULL,
1998 "pfkey spdupdate2(forward) failed.\n");
1999 goto end;
2000 }
2001 plog(LLV_DEBUG, LOCATION, NULL,
2002 "pfkey spdupdate2(forward) sent.\n");
2003 }
2004 #endif
2005
2006 /* make outbound policy */
2007 iph2->src = src;
2008 iph2->dst = dst;
2009 spidx->dir = IPSEC_DIR_OUTBOUND;
2010 addr = spidx->src;
2011 spidx->src = spidx->dst;
2012 spidx->dst = addr;
2013 pref = spidx->prefs;
2014 spidx->prefs = spidx->prefd;
2015 spidx->prefd = pref;
2016
2017 if (pk_sendspdupdate2(iph2) < 0) {
2018 plog(LLV_ERROR, LOCATION, NULL,
2019 "pfkey spdupdate2(outbound) failed.\n");
2020 goto end;
2021 }
2022 plog(LLV_DEBUG, LOCATION, NULL,
2023 "pfkey spdupdate2(outbound) sent.\n");
2024
2025 /* spidx_gen is unnecessary any more */
2026 delsp_bothdir((struct policyindex *)iph2->spidx_gen);
2027 racoon_free(iph2->spidx_gen);
2028 iph2->spidx_gen = NULL;
2029 iph2->generated_spidx=1;
2030 }
2031
2032 error = 0;
2033
2034 end:
2035 return error;
2036 }
2037
2038 /*
2039 * create HASH, body (SA, NONCE) payload with isakmp header.
2040 */
2041 static vchar_t *
2042 quick_ir1mx(iph2, body, hash)
2043 struct ph2handle *iph2;
2044 vchar_t *body, *hash;
2045 {
2046 struct isakmp *isakmp;
2047 vchar_t *buf = NULL, *new = NULL;
2048 char *p;
2049 int tlen;
2050 struct isakmp_gen *gen;
2051 int error = ISAKMP_INTERNAL_ERROR;
2052
2053 /* create buffer for isakmp payload */
2054 tlen = sizeof(*isakmp)
2055 + sizeof(*gen) + hash->l
2056 + body->l;
2057 buf = vmalloc(tlen);
2058 if (buf == NULL) {
2059 plog(LLV_ERROR, LOCATION, NULL,
2060 "failed to get buffer to send.\n");
2061 goto end;
2062 }
2063
2064 /* re-set encryption flag, for serurity. */
2065 iph2->flags |= ISAKMP_FLAG_E;
2066
2067 /* set isakmp header */
2068 p = set_isakmp_header2(buf, iph2, ISAKMP_NPTYPE_HASH);
2069 if (p == NULL)
2070 goto end;
2071
2072 /* add HASH payload */
2073 /* XXX is next type always SA ? */
2074 p = set_isakmp_payload(p, hash, ISAKMP_NPTYPE_SA);
2075
2076 /* add body payload */
2077 memcpy(p, body->v, body->l);
2078
2079 #ifdef HAVE_PRINT_ISAKMP_C
2080 isakmp_printpacket(buf, iph2->ph1->local, iph2->ph1->remote, 1);
2081 #endif
2082
2083 /* encoding */
2084 new = oakley_do_encrypt(iph2->ph1, buf, iph2->ivm->ive, iph2->ivm->iv);
2085
2086 if (new == NULL)
2087 goto end;
2088
2089 vfree(buf);
2090
2091 buf = new;
2092
2093 error = 0;
2094
2095 end:
2096 if (error && buf != NULL) {
2097 vfree(buf);
2098 buf = NULL;
2099 }
2100
2101 return buf;
2102 }
2103
2104 /*
2105 * get remote's sainfo.
2106 * NOTE: this function is for responder.
2107 */
2108 static int
2109 get_sainfo_r(iph2)
2110 struct ph2handle *iph2;
2111 {
2112 vchar_t *idsrc = NULL, *iddst = NULL, *client = NULL;
2113 int error = ISAKMP_INTERNAL_ERROR;
2114
2115 if (iph2->id == NULL) {
2116 idsrc = ipsecdoi_sockaddr2id(iph2->src, IPSECDOI_PREFIX_HOST,
2117 IPSEC_ULPROTO_ANY);
2118 } else {
2119 idsrc = vdup(iph2->id);
2120 }
2121 if (idsrc == NULL) {
2122 plog(LLV_ERROR, LOCATION, NULL,
2123 "failed to set ID for source.\n");
2124 goto end;
2125 }
2126
2127 if (iph2->id_p == NULL) {
2128 iddst = ipsecdoi_sockaddr2id(iph2->dst, IPSECDOI_PREFIX_HOST,
2129 IPSEC_ULPROTO_ANY);
2130 } else {
2131 iddst = vdup(iph2->id_p);
2132 }
2133 if (iddst == NULL) {
2134 plog(LLV_ERROR, LOCATION, NULL,
2135 "failed to set ID for destination.\n");
2136 goto end;
2137 }
2138
2139 #ifdef ENABLE_HYBRID
2140
2141 /* clientaddr check : obtain modecfg address */
2142 if (iph2->ph1->mode_cfg != NULL) {
2143 if ((iph2->ph1->mode_cfg->flags & ISAKMP_CFG_ADDR4_EXTERN) ||
2144 (iph2->ph1->mode_cfg->flags & ISAKMP_CFG_ADDR4_LOCAL)){
2145 struct sockaddr saddr;
2146 saddr.sa_family = AF_INET;
2147 #ifndef __linux__
2148 saddr.sa_len = sizeof(struct sockaddr_in);
2149 #endif
2150 ((struct sockaddr_in *)&saddr)->sin_port = IPSEC_PORT_ANY;
2151 memcpy(&((struct sockaddr_in *)&saddr)->sin_addr,
2152 &iph2->ph1->mode_cfg->addr4, sizeof(struct in_addr));
2153 client = ipsecdoi_sockaddr2id(&saddr, 32, IPSEC_ULPROTO_ANY);
2154 }
2155 }
2156
2157 /* clientaddr check, fallback to peer address */
2158 if (client == NULL)
2159 {
2160 client = ipsecdoi_sockaddr2id(iph2->dst, IPSECDOI_PREFIX_HOST,
2161 IPSEC_ULPROTO_ANY);
2162 }
2163 #endif
2164
2165 /* obtain a matching sainfo section */
2166 iph2->sainfo = getsainfo(idsrc, iddst, iph2->ph1->id_p, client, iph2->ph1->rmconf->ph1id);
2167 if (iph2->sainfo == NULL) {
2168 plog(LLV_ERROR, LOCATION, NULL,
2169 "failed to get sainfo.\n");
2170 goto end;
2171 }
2172
2173 #ifdef ENABLE_HYBRID
2174 /* xauth group inclusion check */
2175 if (iph2->sainfo->group != NULL)
2176 if(group_check(iph2->ph1,&iph2->sainfo->group->v,1))
2177 goto end;
2178 #endif
2179
2180 plog(LLV_DEBUG, LOCATION, NULL,
2181 "selected sainfo: %s\n", sainfo2str(iph2->sainfo));
2182
2183 error = 0;
2184 end:
2185 if (idsrc)
2186 vfree(idsrc);
2187 if (iddst)
2188 vfree(iddst);
2189 if (client)
2190 vfree(client);
2191
2192 return error;
2193 }
2194
2195 /*
2196 * Copy both IP addresses in ID payloads into [src,dst]_id if both ID types
2197 * are IP address and same address family.
2198 * Then get remote's policy from SPD copied from kernel.
2199 * If the type of ID payload is address or subnet type, then the index is
2200 * made from the payload. If there is no ID payload, or the type of ID
2201 * payload is NOT address type, then the index is made from the address
2202 * pair of phase 1.
2203 * NOTE: This function is only for responder.
2204 */
2205 static int
2206 get_proposal_r(iph2)
2207 struct ph2handle *iph2;
2208 {
2209 struct policyindex spidx;
2210 struct secpolicy *sp_in, *sp_out;
2211 int idi2type = 0; /* switch whether copy IDs into id[src,dst]. */
2212 int error = ISAKMP_INTERNAL_ERROR;
2213
2214 /* check the existence of ID payload */
2215 if ((iph2->id_p != NULL && iph2->id == NULL)
2216 || (iph2->id_p == NULL && iph2->id != NULL)) {
2217 plog(LLV_ERROR, LOCATION, NULL,
2218 "Both IDs wasn't found in payload.\n");
2219 return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
2220 }
2221
2222 /* make sure if sa_[src, dst] are null. */
2223 if (iph2->sa_src || iph2->sa_dst) {
2224 plog(LLV_ERROR, LOCATION, NULL,
2225 "Why do ID[src,dst] exist already.\n");
2226 return ISAKMP_INTERNAL_ERROR;
2227 }
2228
2229 memset(&spidx, 0, sizeof(spidx));
2230
2231 #define _XIDT(d) ((struct ipsecdoi_id_b *)(d)->v)->type
2232
2233 /* make a spidx; a key to search SPD */
2234 spidx.dir = IPSEC_DIR_INBOUND;
2235 spidx.ul_proto = 0;
2236
2237 /*
2238 * make destination address in spidx from either ID payload
2239 * or phase 1 address into a address in spidx.
2240 */
2241 if (iph2->id != NULL
2242 && (_XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR
2243 || _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR
2244 || _XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR_SUBNET
2245 || _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR_SUBNET)) {
2246 /* get a destination address of a policy */
2247 error = ipsecdoi_id2sockaddr(iph2->id,
2248 (struct sockaddr *)&spidx.dst,
2249 &spidx.prefd, &spidx.ul_proto);
2250 if (error)
2251 return error;
2252
2253 #ifdef INET6
2254 /*
2255 * get scopeid from the SA address.
2256 * note that the phase 1 source address is used as
2257 * a destination address to search for a inbound policy entry
2258 * because rcoon is responder.
2259 */
2260 if (_XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR) {
2261 error = setscopeid((struct sockaddr *)&spidx.dst,
2262 iph2->src);
2263 if (error)
2264 return error;
2265 }
2266 #endif
2267
2268 if (_XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR
2269 || _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR)
2270 idi2type = _XIDT(iph2->id);
2271
2272 } else {
2273
2274 plog(LLV_DEBUG, LOCATION, NULL,
2275 "get a destination address of SP index "
2276 "from phase1 address "
2277 "due to no ID payloads found "
2278 "OR because ID type is not address.\n");
2279
2280 /*
2281 * copy the SOURCE address of IKE into the DESTINATION address
2282 * of the key to search the SPD because the direction of policy
2283 * is inbound.
2284 */
2285 memcpy(&spidx.dst, iph2->src, sysdep_sa_len(iph2->src));
2286 switch (spidx.dst.ss_family) {
2287 case AF_INET:
2288 spidx.prefd = sizeof(struct in_addr) << 3;
2289 break;
2290 #ifdef INET6
2291 case AF_INET6:
2292 spidx.prefd = sizeof(struct in6_addr) << 3;
2293 break;
2294 #endif
2295 default:
2296 spidx.prefd = 0;
2297 break;
2298 }
2299 }
2300
2301 /* make source address in spidx */
2302 if (iph2->id_p != NULL
2303 && (_XIDT(iph2->id_p) == IPSECDOI_ID_IPV4_ADDR
2304 || _XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR
2305 || _XIDT(iph2->id_p) == IPSECDOI_ID_IPV4_ADDR_SUBNET
2306 || _XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR_SUBNET)) {
2307 /* get a source address of inbound SA */
2308 error = ipsecdoi_id2sockaddr(iph2->id_p,
2309 (struct sockaddr *)&spidx.src,
2310 &spidx.prefs, &spidx.ul_proto);
2311 if (error)
2312 return error;
2313
2314 #ifdef INET6
2315 /*
2316 * get scopeid from the SA address.
2317 * for more detail, see above of this function.
2318 */
2319 if (_XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR) {
2320 error = setscopeid((struct sockaddr *)&spidx.src,
2321 iph2->dst);
2322 if (error)
2323 return error;
2324 }
2325 #endif
2326
2327 /* Before setting iph2->[sa_src, sa_dst] with the addresses
2328 * provided in ID payloads, we check:
2329 * - they are both addresses of same family
2330 * - sainfo has not been selected only based on ID payload
2331 * information but also based on specific Phase 1
2332 * credentials (iph2->sainfo->id_i is defined), i.e.
2333 * local configuration _explicitly_ expect that user
2334 * (e.g. from asn1dn "C=FR, ...") with those IDs) */
2335 if (_XIDT(iph2->id_p) == idi2type &&
2336 spidx.dst.ss_family == spidx.src.ss_family &&
2337 iph2->sainfo && iph2->sainfo->id_i) {
2338
2339 iph2->sa_src = dupsaddr((struct sockaddr *)&spidx.dst);
2340 if (iph2->sa_src == NULL) {
2341 plog(LLV_ERROR, LOCATION, NULL,
2342 "buffer allocation failed.\n");
2343 return ISAKMP_INTERNAL_ERROR;
2344 }
2345
2346 iph2->sa_dst = dupsaddr((struct sockaddr *)&spidx.src);
2347 if (iph2->sa_dst == NULL) {
2348 plog(LLV_ERROR, LOCATION, NULL,
2349 "buffer allocation failed.\n");
2350 return ISAKMP_INTERNAL_ERROR;
2351 }
2352 } else {
2353 plog(LLV_DEBUG, LOCATION, NULL,
2354 "Either family (%d - %d), types (%d - %d) of ID"
2355 "from initiator differ or matching sainfo has"
2356 "has no id_i defined for the peer. Not filling"
2357 "iph2->sa_src and iph2->sa_dst.\n",
2358 spidx.src.ss_family, spidx.dst.ss_family,
2359 _XIDT(iph2->id_p),idi2type);
2360 }
2361 } else {
2362 plog(LLV_DEBUG, LOCATION, NULL,
2363 "get a source address of SP index from Phase 1"
2364 "addresses due to no ID payloads found"
2365 "OR because ID type is not address.\n");
2366
2367 /* see above comment. */
2368 memcpy(&spidx.src, iph2->dst, sysdep_sa_len(iph2->dst));
2369 switch (spidx.src.ss_family) {
2370 case AF_INET:
2371 spidx.prefs = sizeof(struct in_addr) << 3;
2372 break;
2373 #ifdef INET6
2374 case AF_INET6:
2375 spidx.prefs = sizeof(struct in6_addr) << 3;
2376 break;
2377 #endif
2378 default:
2379 spidx.prefs = 0;
2380 break;
2381 }
2382 }
2383
2384 #undef _XIDT
2385
2386 plog(LLV_DEBUG, LOCATION, NULL,
2387 "get a src address from ID payload "
2388 "%s prefixlen=%u ul_proto=%u\n",
2389 saddr2str((struct sockaddr *)&spidx.src),
2390 spidx.prefs, spidx.ul_proto);
2391 plog(LLV_DEBUG, LOCATION, NULL,
2392 "get dst address from ID payload "
2393 "%s prefixlen=%u ul_proto=%u\n",
2394 saddr2str((struct sockaddr *)&spidx.dst),
2395 spidx.prefd, spidx.ul_proto);
2396
2397 /*
2398 * convert the ul_proto if it is 0
2399 * because 0 in ID payload means a wild card.
2400 */
2401 if (spidx.ul_proto == 0)
2402 spidx.ul_proto = IPSEC_ULPROTO_ANY;
2403
2404 #ifdef HAVE_SECCTX
2405 /*
2406 * Need to use security context in spidx to ensure the correct
2407 * policy is selected. The only way to get the security context
2408 * is to look into the proposal sent by peer ahead of time.
2409 */
2410 if (get_security_context(iph2->sa, &spidx)) {
2411 plog(LLV_ERROR, LOCATION, NULL,
2412 "error occurred trying to get security context.\n");
2413 return ISAKMP_INTERNAL_ERROR;
2414 }
2415 #endif /* HAVE_SECCTX */
2416
2417 /* get inbound policy */
2418 sp_in = getsp_r(&spidx);
2419 if (sp_in == NULL) {
2420 if (iph2->ph1->rmconf->gen_policy) {
2421 plog(LLV_INFO, LOCATION, NULL,
2422 "no policy found, "
2423 "try to generate the policy : %s\n",
2424 spidx2str(&spidx));
2425 iph2->spidx_gen = racoon_malloc(sizeof(spidx));
2426 if (!iph2->spidx_gen) {
2427 plog(LLV_ERROR, LOCATION, NULL,
2428 "buffer allocation failed.\n");
2429 return ISAKMP_INTERNAL_ERROR;
2430 }
2431 memcpy(iph2->spidx_gen, &spidx, sizeof(spidx));
2432 return -2; /* special value */
2433 }
2434 plog(LLV_ERROR, LOCATION, NULL,
2435 "no policy found: %s\n", spidx2str(&spidx));
2436 return ISAKMP_INTERNAL_ERROR;
2437 }
2438 /* Refresh existing generated policies
2439 */
2440 if (iph2->ph1->rmconf->gen_policy) {
2441 plog(LLV_INFO, LOCATION, NULL,
2442 "Update the generated policy : %s\n",
2443 spidx2str(&spidx));
2444 iph2->spidx_gen = racoon_malloc(sizeof(spidx));
2445 if (!iph2->spidx_gen) {
2446 plog(LLV_ERROR, LOCATION, NULL,
2447 "buffer allocation failed.\n");
2448 return ISAKMP_INTERNAL_ERROR;
2449 }
2450 memcpy(iph2->spidx_gen, &spidx, sizeof(spidx));
2451 }
2452
2453 /* get outbound policy */
2454 {
2455 struct sockaddr_storage addr;
2456 u_int8_t pref;
2457
2458 spidx.dir = IPSEC_DIR_OUTBOUND;
2459 addr = spidx.src;
2460 spidx.src = spidx.dst;
2461 spidx.dst = addr;
2462 pref = spidx.prefs;
2463 spidx.prefs = spidx.prefd;
2464 spidx.prefd = pref;
2465
2466 sp_out = getsp_r(&spidx);
2467 if (!sp_out) {
2468 plog(LLV_WARNING, LOCATION, NULL,
2469 "no outbound policy found: %s\n",
2470 spidx2str(&spidx));
2471 }
2472 }
2473
2474 plog(LLV_DEBUG, LOCATION, NULL,
2475 "suitable SP found:%s\n", spidx2str(&spidx));
2476
2477 /*
2478 * In the responder side, the inbound policy should be using IPsec.
2479 * outbound policy is not checked currently.
2480 */
2481 if (sp_in->policy != IPSEC_POLICY_IPSEC) {
2482 plog(LLV_ERROR, LOCATION, NULL,
2483 "policy found, but no IPsec required: %s\n",
2484 spidx2str(&spidx));
2485 return ISAKMP_INTERNAL_ERROR;
2486 }
2487
2488 /* set new proposal derived from a policy into the iph2->proposal. */
2489 if (set_proposal_from_policy(iph2, sp_in, sp_out) < 0) {
2490 plog(LLV_ERROR, LOCATION, NULL,
2491 "failed to create saprop.\n");
2492 return ISAKMP_INTERNAL_ERROR;
2493 }
2494
2495 #ifdef HAVE_SECCTX
2496 if (spidx.sec_ctx.ctx_str) {
2497 set_secctx_in_proposal(iph2, spidx);
2498 }
2499 #endif /* HAVE_SECCTX */
2500
2501 iph2->spid = sp_in->id;
2502
2503 return 0;
2504 }
2505
2506 /*
2507 * handle a notification payload inside phase2 exchange.
2508 * phase2 is always encrypted, so it does not need to be checked
2509 * for explicitely.
2510 */
2511 static int
2512 ph2_recv_n(iph2, gen)
2513 struct ph2handle *iph2;
2514 struct isakmp_gen *gen;
2515 {
2516 struct ph1handle *iph1 = iph2->ph1;
2517 struct isakmp_pl_n *notify = (struct isakmp_pl_n *) gen;
2518 u_int type;
2519 int check_level;
2520
2521 type = ntohs(notify->type);
2522 switch (type) {
2523 case ISAKMP_NTYPE_CONNECTED:
2524 break;
2525 case ISAKMP_NTYPE_INITIAL_CONTACT:
2526 return isakmp_info_recv_initialcontact(iph1, iph2);
2527 case ISAKMP_NTYPE_RESPONDER_LIFETIME:
2528 ipsecdoi_parse_responder_lifetime(notify,
2529 &iph2->lifetime_secs, &iph2->lifetime_kb);
2530
2531 if (iph1 != NULL && iph1->rmconf != NULL) {
2532 check_level = iph1->rmconf->pcheck_level;
2533 } else {
2534 if (iph1 != NULL)
2535 plog(LLV_DEBUG, LOCATION, NULL,
2536 "No phase1 rmconf found !\n");
2537 else
2538 plog(LLV_DEBUG, LOCATION, NULL,
2539 "No phase1 found !\n");
2540 check_level = PROP_CHECK_EXACT;
2541 }
2542
2543 switch (check_level) {
2544 case PROP_CHECK_OBEY:
2545 break;
2546 case PROP_CHECK_STRICT:
2547 case PROP_CHECK_CLAIM:
2548 if (iph2->sainfo == NULL
2549 || iph2->sainfo->lifetime <= iph2->lifetime_secs) {
2550 plog(LLV_WARNING, LOCATION, NULL,
2551 "RESPONDER-LIFETIME: lifetime mismatch\n");
2552 iph2->lifetime_secs = 0;
2553 }
2554 break;
2555 case PROP_CHECK_EXACT:
2556 if (iph2->sainfo == NULL
2557 || iph2->sainfo->lifetime != iph2->lifetime_secs) {
2558 plog(LLV_WARNING, LOCATION, NULL,
2559 "RESPONDER-LIFETIME: lifetime mismatch\n");
2560 iph2->lifetime_secs = 0;
2561 }
2562 break;
2563 }
2564 break;
2565 default:
2566 isakmp_log_notify(iph2->ph1, notify, "phase2 exchange");
2567 isakmp_info_send_n2(iph2, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE,
2568 NULL);
2569 break;
2570 }
2571 return 0;
2572 }
2573
NetBSD on the FriendlyARM MINI2440