isakmp_inf.c revision 1.1.1.4
1/* $NetBSD: isakmp_inf.c,v 1.1.1.4 2005/08/07 08:46:16 manu Exp $ */ 2 3/* Id: isakmp_inf.c,v 1.14.4.9 2005/08/02 15:09:26 vanhu Exp */ 4 5/* 6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. Neither the name of the project nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34#include "config.h" 35 36#include <sys/types.h> 37#include <sys/param.h> 38#include <sys/socket.h> 39 40#include <net/pfkeyv2.h> 41#include <netinet/in.h> 42#include <sys/queue.h> 43#ifndef HAVE_NETINET6_IPSEC 44#include <netinet/ipsec.h> 45#else 46#include <netinet6/ipsec.h> 47#endif 48 49#include <stdlib.h> 50#include <stdio.h> 51#include <string.h> 52#include <errno.h> 53#if TIME_WITH_SYS_TIME 54# include <sys/time.h> 55# include <time.h> 56#else 57# if HAVE_SYS_TIME_H 58# include <sys/time.h> 59# else 60# include <time.h> 61# endif 62#endif 63 64#include "libpfkey.h" 65 66#include "var.h" 67#include "vmbuf.h" 68#include "schedule.h" 69#include "str2val.h" 70#include "misc.h" 71#include "plog.h" 72#include "debug.h" 73 74#include "localconf.h" 75#include "remoteconf.h" 76#include "sockmisc.h" 77#include "isakmp_var.h" 78#include "evt.h" 79#include "isakmp.h" 80#ifdef ENABLE_HYBRID 81#include "isakmp_xauth.h" 82#include "isakmp_cfg.h" 83#endif 84#include "isakmp_inf.h" 85#include "oakley.h" 86#include "handler.h" 87#include "ipsec_doi.h" 88#include "crypto_openssl.h" 89#include "pfkey.h" 90#include "policy.h" 91#include "algorithm.h" 92#include "proposal.h" 93#include "admin.h" 94#include "strnames.h" 95#ifdef ENABLE_NATT 96#include "nattraversal.h" 97#endif 98 99/* information exchange */ 100static int isakmp_info_recv_n __P((struct ph1handle *, vchar_t *)); 101static int isakmp_info_recv_d __P((struct ph1handle *, vchar_t *)); 102 103#ifdef ENABLE_DPD 104static int isakmp_info_recv_r_u __P((struct ph1handle *, 105 struct isakmp_pl_ru *, u_int32_t)); 106static int isakmp_info_recv_r_u_ack __P((struct ph1handle *, 107 struct isakmp_pl_ru *, u_int32_t)); 108static void isakmp_info_send_r_u __P((void *)); 109#endif 110 111static void purge_isakmp_spi __P((int, isakmp_index *, size_t)); 112static void purge_ipsec_spi __P((struct sockaddr *, int, u_int32_t *, size_t)); 113static void info_recv_initialcontact __P((struct ph1handle *)); 114 115/* %%% 116 * Information Exchange 117 */ 118/* 119 * receive Information 120 */ 121int 122isakmp_info_recv(iph1, msg0) 123 struct ph1handle *iph1; 124 vchar_t *msg0; 125{ 126 vchar_t *msg = NULL; 127 int error = -1; 128 struct isakmp *isakmp; 129 struct isakmp_gen *gen; 130 void *p; 131 vchar_t *hash, *payload; 132 struct isakmp_gen *nd; 133 u_int8_t np; 134 int encrypted; 135 136 plog(LLV_DEBUG, LOCATION, NULL, "receive Information.\n"); 137 138 encrypted = ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E); 139 140 /* Use new IV to decrypt Informational message. */ 141 if (encrypted) { 142 143 struct isakmp_ivm *ivm; 144 145 /* compute IV */ 146 ivm = oakley_newiv2(iph1, ((struct isakmp *)msg0->v)->msgid); 147 if (ivm == NULL) 148 return -1; 149 150 msg = oakley_do_decrypt(iph1, msg0, ivm->iv, ivm->ive); 151 oakley_delivm(ivm); 152 if (msg == NULL) 153 return -1; 154 155 } else 156 msg = vdup(msg0); 157 158 /* Safety check */ 159 if (msg->l < sizeof(*isakmp) + sizeof(*gen)) { 160 plog(LLV_ERROR, LOCATION, NULL, 161 "ignore information because the " 162 "message is way too short\n"); 163 goto end; 164 } 165 166 isakmp = (struct isakmp *)msg->v; 167 gen = (struct isakmp_gen *)((caddr_t)isakmp + sizeof(struct isakmp)); 168 np = gen->np; 169 170 if (encrypted) { 171 if (isakmp->np != ISAKMP_NPTYPE_HASH) { 172 plog(LLV_ERROR, LOCATION, NULL, 173 "ignore information because the " 174 "message has no hash payload.\n"); 175 goto end; 176 } 177 178 if (iph1->status != PHASE1ST_ESTABLISHED) { 179 plog(LLV_ERROR, LOCATION, NULL, 180 "ignore information because ISAKMP-SA " 181 "has not been established yet.\n"); 182 goto end; 183 } 184 185 /* Safety check */ 186 if (msg->l < sizeof(*isakmp) + ntohs(gen->len) + sizeof(*nd)) { 187 plog(LLV_ERROR, LOCATION, NULL, 188 "ignore information because the " 189 "message is too short\n"); 190 goto end; 191 } 192 193 p = (caddr_t) gen + sizeof(struct isakmp_gen); 194 nd = (struct isakmp_gen *) ((caddr_t) gen + ntohs(gen->len)); 195 196 /* nd length check */ 197 if (ntohs(nd->len) > msg->l - (sizeof(struct isakmp) + 198 ntohs(gen->len))) { 199 plog(LLV_ERROR, LOCATION, NULL, 200 "too long payload length (broken message?)\n"); 201 goto end; 202 } 203 204 if (ntohs(nd->len) < sizeof(*nd)) { 205 plog(LLV_ERROR, LOCATION, NULL, 206 "too short payload length (broken message?)\n"); 207 goto end; 208 } 209 210 payload = vmalloc(ntohs(nd->len)); 211 if (payload == NULL) { 212 plog(LLV_ERROR, LOCATION, NULL, 213 "cannot allocate memory\n"); 214 goto end; 215 } 216 217 memcpy(payload->v, (caddr_t) nd, ntohs(nd->len)); 218 219 /* compute HASH */ 220 hash = oakley_compute_hash1(iph1, isakmp->msgid, payload); 221 if (hash == NULL) { 222 plog(LLV_ERROR, LOCATION, NULL, 223 "cannot compute hash\n"); 224 225 vfree(payload); 226 goto end; 227 } 228 229 if (ntohs(gen->len) - sizeof(struct isakmp_gen) != hash->l) { 230 plog(LLV_ERROR, LOCATION, NULL, 231 "ignore information due to hash length mismatch\n"); 232 233 vfree(hash); 234 vfree(payload); 235 goto end; 236 } 237 238 if (memcmp(p, hash->v, hash->l) != 0) { 239 plog(LLV_ERROR, LOCATION, NULL, 240 "ignore information due to hash mismatch\n"); 241 242 vfree(hash); 243 vfree(payload); 244 goto end; 245 } 246 247 plog(LLV_DEBUG, LOCATION, NULL, "hash validated.\n"); 248 249 vfree(hash); 250 vfree(payload); 251 } else { 252 /* make sure the packet were encrypted after the beginning of phase 1. */ 253 switch (iph1->etype) { 254 case ISAKMP_ETYPE_AGG: 255 case ISAKMP_ETYPE_BASE: 256 case ISAKMP_ETYPE_IDENT: 257 if ((iph1->side == INITIATOR && iph1->status < PHASE1ST_MSG3SENT) 258 || (iph1->side == RESPONDER && iph1->status < PHASE1ST_MSG2SENT)) { 259 break; 260 } 261 /*FALLTHRU*/ 262 default: 263 plog(LLV_ERROR, LOCATION, iph1->remote, 264 "%s message must be encrypted\n", 265 s_isakmp_nptype(np)); 266 goto end; 267 } 268 } 269 270 switch (np) { 271 case ISAKMP_NPTYPE_N: 272 if (isakmp_info_recv_n(iph1, msg) < 0) 273 goto end; 274 break; 275 case ISAKMP_NPTYPE_D: 276 if (isakmp_info_recv_d(iph1, msg) < 0) 277 goto end; 278 break; 279 case ISAKMP_NPTYPE_NONCE: 280 /* XXX to be 6.4.2 ike-01.txt */ 281 /* XXX IV is to be synchronized. */ 282 plog(LLV_ERROR, LOCATION, iph1->remote, 283 "ignore Acknowledged Informational\n"); 284 break; 285 default: 286 /* don't send information, see isakmp_ident_r1() */ 287 error = 0; 288 plog(LLV_ERROR, LOCATION, iph1->remote, 289 "reject the packet, " 290 "received unexpecting payload type %d.\n", 291 gen->np); 292 goto end; 293 } 294 295 end: 296 if (msg != NULL) 297 vfree(msg); 298 299 return 0; 300} 301 302/* 303 * send Delete payload (for ISAKMP SA) in Informational exchange. 304 */ 305int 306isakmp_info_send_d1(iph1) 307 struct ph1handle *iph1; 308{ 309 struct isakmp_pl_d *d; 310 vchar_t *payload = NULL; 311 int tlen; 312 int error = 0; 313 314 if (iph1->status != PHASE2ST_ESTABLISHED) 315 return 0; 316 317 /* create delete payload */ 318 319 /* send SPIs of inbound SAs. */ 320 /* XXX should send outbound SAs's ? */ 321 tlen = sizeof(*d) + sizeof(isakmp_index); 322 payload = vmalloc(tlen); 323 if (payload == NULL) { 324 plog(LLV_ERROR, LOCATION, NULL, 325 "failed to get buffer for payload.\n"); 326 return errno; 327 } 328 329 d = (struct isakmp_pl_d *)payload->v; 330 d->h.np = ISAKMP_NPTYPE_NONE; 331 d->h.len = htons(tlen); 332 d->doi = htonl(IPSEC_DOI); 333 d->proto_id = IPSECDOI_PROTO_ISAKMP; 334 d->spi_size = sizeof(isakmp_index); 335 d->num_spi = htons(1); 336 memcpy(d + 1, &iph1->index, sizeof(isakmp_index)); 337 338 error = isakmp_info_send_common(iph1, payload, 339 ISAKMP_NPTYPE_D, 0); 340 vfree(payload); 341 342 return error; 343} 344 345/* 346 * send Delete payload (for IPsec SA) in Informational exchange, based on 347 * pfkey msg. It sends always single SPI. 348 */ 349int 350isakmp_info_send_d2(iph2) 351 struct ph2handle *iph2; 352{ 353 struct ph1handle *iph1; 354 struct saproto *pr; 355 struct isakmp_pl_d *d; 356 vchar_t *payload = NULL; 357 int tlen; 358 int error = 0; 359 u_int8_t *spi; 360 361 if (iph2->status != PHASE2ST_ESTABLISHED) 362 return 0; 363 364 /* 365 * don't send delete information if there is no phase 1 handler. 366 * It's nonsensical to negotiate phase 1 to send the information. 367 */ 368 iph1 = getph1byaddr(iph2->src, iph2->dst); 369 if (iph1 == NULL) 370 return 0; 371 372 /* create delete payload */ 373 for (pr = iph2->approval->head; pr != NULL; pr = pr->next) { 374 375 /* send SPIs of inbound SAs. */ 376 /* 377 * XXX should I send outbound SAs's ? 378 * I send inbound SAs's SPI only at the moment because I can't 379 * decode any more if peer send encoded packet without aware of 380 * deletion of SA. Outbound SAs don't come under the situation. 381 */ 382 tlen = sizeof(*d) + pr->spisize; 383 payload = vmalloc(tlen); 384 if (payload == NULL) { 385 plog(LLV_ERROR, LOCATION, NULL, 386 "failed to get buffer for payload.\n"); 387 return errno; 388 } 389 390 d = (struct isakmp_pl_d *)payload->v; 391 d->h.np = ISAKMP_NPTYPE_NONE; 392 d->h.len = htons(tlen); 393 d->doi = htonl(IPSEC_DOI); 394 d->proto_id = pr->proto_id; 395 d->spi_size = pr->spisize; 396 d->num_spi = htons(1); 397 /* 398 * XXX SPI bits are left-filled, for use with IPComp. 399 * we should be switching to variable-length spi field... 400 */ 401 spi = (u_int8_t *)&pr->spi; 402 spi += sizeof(pr->spi); 403 spi -= pr->spisize; 404 memcpy(d + 1, spi, pr->spisize); 405 406 error = isakmp_info_send_common(iph1, payload, 407 ISAKMP_NPTYPE_D, 0); 408 vfree(payload); 409 } 410 411 return error; 412} 413 414/* 415 * send Notification payload (for without ISAKMP SA) in Informational exchange 416 */ 417int 418isakmp_info_send_nx(isakmp, remote, local, type, data) 419 struct isakmp *isakmp; 420 struct sockaddr *remote, *local; 421 int type; 422 vchar_t *data; 423{ 424 struct ph1handle *iph1 = NULL; 425 struct remoteconf *rmconf; 426 vchar_t *payload = NULL; 427 int tlen; 428 int error = -1; 429 struct isakmp_pl_n *n; 430 int spisiz = 0; /* see below */ 431 432 /* search appropreate configuration */ 433 rmconf = getrmconf(remote); 434 if (rmconf == NULL) { 435 plog(LLV_ERROR, LOCATION, remote, 436 "no configuration found for peer address.\n"); 437 goto end; 438 } 439 440 /* add new entry to isakmp status table. */ 441 iph1 = newph1(); 442 if (iph1 == NULL) 443 return -1; 444 445 memcpy(&iph1->index.i_ck, &isakmp->i_ck, sizeof(cookie_t)); 446 isakmp_newcookie((char *)&iph1->index.r_ck, remote, local); 447 iph1->status = PHASE1ST_START; 448 iph1->rmconf = rmconf; 449 iph1->side = INITIATOR; 450 iph1->version = isakmp->v; 451 iph1->flags = 0; 452 iph1->msgid = 0; /* XXX */ 453#ifdef ENABLE_HYBRID 454 if ((iph1->mode_cfg = isakmp_cfg_mkstate()) == NULL) 455 return -1; 456#endif 457#ifdef ENABLE_FRAG 458 iph1->frag = 0; 459 iph1->frag_chain = NULL; 460#endif 461 462 /* copy remote address */ 463 if (copy_ph1addresses(iph1, rmconf, remote, local) < 0) 464 return -1; 465 466 tlen = sizeof(*n) + spisiz; 467 if (data) 468 tlen += data->l; 469 payload = vmalloc(tlen); 470 if (payload == NULL) { 471 plog(LLV_ERROR, LOCATION, NULL, 472 "failed to get buffer to send.\n"); 473 goto end; 474 } 475 476 n = (struct isakmp_pl_n *)payload->v; 477 n->h.np = ISAKMP_NPTYPE_NONE; 478 n->h.len = htons(tlen); 479 n->doi = htonl(IPSEC_DOI); 480 n->proto_id = IPSECDOI_KEY_IKE; 481 n->spi_size = spisiz; 482 n->type = htons(type); 483 if (spisiz) 484 memset(n + 1, 0, spisiz); /*XXX*/ 485 if (data) 486 memcpy((caddr_t)(n + 1) + spisiz, data->v, data->l); 487 488 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 0); 489 vfree(payload); 490 491 end: 492 if (iph1 != NULL) 493 delph1(iph1); 494 495 return error; 496} 497 498/* 499 * send Notification payload (for ISAKMP SA) in Informational exchange 500 */ 501int 502isakmp_info_send_n1(iph1, type, data) 503 struct ph1handle *iph1; 504 int type; 505 vchar_t *data; 506{ 507 vchar_t *payload = NULL; 508 int tlen; 509 int error = 0; 510 struct isakmp_pl_n *n; 511 int spisiz; 512 513 /* 514 * note on SPI size: which description is correct? I have chosen 515 * this to be 0. 516 * 517 * RFC2408 3.1, 2nd paragraph says: ISAKMP SA is identified by 518 * Initiator/Responder cookie and SPI has no meaning, SPI size = 0. 519 * RFC2408 3.1, first paragraph on page 40: ISAKMP SA is identified 520 * by cookie and SPI has no meaning, 0 <= SPI size <= 16. 521 * RFC2407 4.6.3.3, INITIAL-CONTACT is required to set to 16. 522 */ 523 if (type == ISAKMP_NTYPE_INITIAL_CONTACT) 524 spisiz = sizeof(isakmp_index); 525 else 526 spisiz = 0; 527 528 tlen = sizeof(*n) + spisiz; 529 if (data) 530 tlen += data->l; 531 payload = vmalloc(tlen); 532 if (payload == NULL) { 533 plog(LLV_ERROR, LOCATION, NULL, 534 "failed to get buffer to send.\n"); 535 return errno; 536 } 537 538 n = (struct isakmp_pl_n *)payload->v; 539 n->h.np = ISAKMP_NPTYPE_NONE; 540 n->h.len = htons(tlen); 541 n->doi = htonl(iph1->rmconf->doitype); 542 n->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX to be configurable ? */ 543 n->spi_size = spisiz; 544 n->type = htons(type); 545 if (spisiz) 546 memcpy(n + 1, &iph1->index, sizeof(isakmp_index)); 547 if (data) 548 memcpy((caddr_t)(n + 1) + spisiz, data->v, data->l); 549 550 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, iph1->flags); 551 vfree(payload); 552 553 return error; 554} 555 556/* 557 * send Notification payload (for IPsec SA) in Informational exchange 558 */ 559int 560isakmp_info_send_n2(iph2, type, data) 561 struct ph2handle *iph2; 562 int type; 563 vchar_t *data; 564{ 565 struct ph1handle *iph1 = iph2->ph1; 566 vchar_t *payload = NULL; 567 int tlen; 568 int error = 0; 569 struct isakmp_pl_n *n; 570 struct saproto *pr; 571 572 if (!iph2->approval) 573 return EINVAL; 574 575 pr = iph2->approval->head; 576 577 /* XXX must be get proper spi */ 578 tlen = sizeof(*n) + pr->spisize; 579 if (data) 580 tlen += data->l; 581 payload = vmalloc(tlen); 582 if (payload == NULL) { 583 plog(LLV_ERROR, LOCATION, NULL, 584 "failed to get buffer to send.\n"); 585 return errno; 586 } 587 588 n = (struct isakmp_pl_n *)payload->v; 589 n->h.np = ISAKMP_NPTYPE_NONE; 590 n->h.len = htons(tlen); 591 n->doi = htonl(IPSEC_DOI); /* IPSEC DOI (1) */ 592 n->proto_id = pr->proto_id; /* IPSEC AH/ESP/whatever*/ 593 n->spi_size = pr->spisize; 594 n->type = htons(type); 595 *(u_int32_t *)(n + 1) = pr->spi; 596 if (data) 597 memcpy((caddr_t)(n + 1) + pr->spisize, data->v, data->l); 598 599 iph2->flags |= ISAKMP_FLAG_E; /* XXX Should we do FLAG_A ? */ 600 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, iph2->flags); 601 vfree(payload); 602 603 return error; 604} 605 606/* 607 * send Information 608 * When ph1->skeyid_a == NULL, send message without encoding. 609 */ 610int 611isakmp_info_send_common(iph1, payload, np, flags) 612 struct ph1handle *iph1; 613 vchar_t *payload; 614 u_int32_t np; 615 int flags; 616{ 617 struct ph2handle *iph2 = NULL; 618 vchar_t *hash = NULL; 619 struct isakmp *isakmp; 620 struct isakmp_gen *gen; 621 char *p; 622 int tlen; 623 int error = -1; 624 625 /* add new entry to isakmp status table */ 626 iph2 = newph2(); 627 if (iph2 == NULL) 628 goto end; 629 630 iph2->dst = dupsaddr(iph1->remote); 631 iph2->src = dupsaddr(iph1->local); 632 switch (iph1->remote->sa_family) { 633 case AF_INET: 634#ifndef ENABLE_NATT 635 ((struct sockaddr_in *)iph2->dst)->sin_port = 0; 636 ((struct sockaddr_in *)iph2->src)->sin_port = 0; 637#endif 638 break; 639#ifdef INET6 640 case AF_INET6: 641 ((struct sockaddr_in6 *)iph2->dst)->sin6_port = 0; 642 ((struct sockaddr_in6 *)iph2->src)->sin6_port = 0; 643 break; 644#endif 645 default: 646 plog(LLV_ERROR, LOCATION, NULL, 647 "invalid family: %d\n", iph1->remote->sa_family); 648 delph2(iph2); 649 goto end; 650 } 651 iph2->ph1 = iph1; 652 iph2->side = INITIATOR; 653 iph2->status = PHASE2ST_START; 654 iph2->msgid = isakmp_newmsgid2(iph1); 655 656 /* get IV and HASH(1) if skeyid_a was generated. */ 657 if (iph1->skeyid_a != NULL) { 658 iph2->ivm = oakley_newiv2(iph1, iph2->msgid); 659 if (iph2->ivm == NULL) { 660 delph2(iph2); 661 goto end; 662 } 663 664 /* generate HASH(1) */ 665 hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, payload); 666 if (hash == NULL) { 667 delph2(iph2); 668 goto end; 669 } 670 671 /* initialized total buffer length */ 672 tlen = hash->l; 673 tlen += sizeof(*gen); 674 } else { 675 /* IKE-SA is not established */ 676 hash = NULL; 677 678 /* initialized total buffer length */ 679 tlen = 0; 680 } 681 if ((flags & ISAKMP_FLAG_A) == 0) 682 iph2->flags = (hash == NULL ? 0 : ISAKMP_FLAG_E); 683 else 684 iph2->flags = (hash == NULL ? 0 : ISAKMP_FLAG_A); 685 686 insph2(iph2); 687 bindph12(iph1, iph2); 688 689 tlen += sizeof(*isakmp) + payload->l; 690 691 /* create buffer for isakmp payload */ 692 iph2->sendbuf = vmalloc(tlen); 693 if (iph2->sendbuf == NULL) { 694 plog(LLV_ERROR, LOCATION, NULL, 695 "failed to get buffer to send.\n"); 696 goto err; 697 } 698 699 /* create isakmp header */ 700 isakmp = (struct isakmp *)iph2->sendbuf->v; 701 memcpy(&isakmp->i_ck, &iph1->index.i_ck, sizeof(cookie_t)); 702 memcpy(&isakmp->r_ck, &iph1->index.r_ck, sizeof(cookie_t)); 703 isakmp->np = hash == NULL ? (np & 0xff) : ISAKMP_NPTYPE_HASH; 704 isakmp->v = iph1->version; 705 isakmp->etype = ISAKMP_ETYPE_INFO; 706 isakmp->flags = iph2->flags; 707 memcpy(&isakmp->msgid, &iph2->msgid, sizeof(isakmp->msgid)); 708 isakmp->len = htonl(tlen); 709 p = (char *)(isakmp + 1); 710 711 /* create HASH payload */ 712 if (hash != NULL) { 713 gen = (struct isakmp_gen *)p; 714 gen->np = np & 0xff; 715 gen->len = htons(sizeof(*gen) + hash->l); 716 p += sizeof(*gen); 717 memcpy(p, hash->v, hash->l); 718 p += hash->l; 719 } 720 721 /* add payload */ 722 memcpy(p, payload->v, payload->l); 723 p += payload->l; 724 725#ifdef HAVE_PRINT_ISAKMP_C 726 isakmp_printpacket(iph2->sendbuf, iph1->local, iph1->remote, 1); 727#endif 728 729 /* encoding */ 730 if (ISSET(isakmp->flags, ISAKMP_FLAG_E)) { 731 vchar_t *tmp; 732 733 tmp = oakley_do_encrypt(iph2->ph1, iph2->sendbuf, iph2->ivm->ive, 734 iph2->ivm->iv); 735 VPTRINIT(iph2->sendbuf); 736 if (tmp == NULL) 737 goto err; 738 iph2->sendbuf = tmp; 739 } 740 741 /* HDR*, HASH(1), N */ 742 if (isakmp_send(iph2->ph1, iph2->sendbuf) < 0) { 743 VPTRINIT(iph2->sendbuf); 744 goto err; 745 } 746 747 plog(LLV_DEBUG, LOCATION, NULL, 748 "sendto Information %s.\n", s_isakmp_nptype(np)); 749 750 /* 751 * don't resend notify message because peer can use Acknowledged 752 * Informational if peer requires the reply of the notify message. 753 */ 754 755 /* XXX If Acknowledged Informational required, don't delete ph2handle */ 756 error = 0; 757 VPTRINIT(iph2->sendbuf); 758 goto err; /* XXX */ 759 760end: 761 if (hash) 762 vfree(hash); 763 return error; 764 765err: 766 unbindph12(iph2); 767 remph2(iph2); 768 delph2(iph2); 769 goto end; 770} 771 772/* 773 * add a notify payload to buffer by reallocating buffer. 774 * If buf == NULL, the function only create a notify payload. 775 * 776 * XXX Which is SPI to be included, inbound or outbound ? 777 */ 778vchar_t * 779isakmp_add_pl_n(buf0, np_p, type, pr, data) 780 vchar_t *buf0; 781 u_int8_t **np_p; 782 int type; 783 struct saproto *pr; 784 vchar_t *data; 785{ 786 vchar_t *buf = NULL; 787 struct isakmp_pl_n *n; 788 int tlen; 789 int oldlen = 0; 790 791 if (*np_p) 792 **np_p = ISAKMP_NPTYPE_N; 793 794 tlen = sizeof(*n) + pr->spisize; 795 796 if (data) 797 tlen += data->l; 798 if (buf0) { 799 oldlen = buf0->l; 800 buf = vrealloc(buf0, buf0->l + tlen); 801 } else 802 buf = vmalloc(tlen); 803 if (!buf) { 804 plog(LLV_ERROR, LOCATION, NULL, 805 "failed to get a payload buffer.\n"); 806 return NULL; 807 } 808 809 n = (struct isakmp_pl_n *)(buf->v + oldlen); 810 n->h.np = ISAKMP_NPTYPE_NONE; 811 n->h.len = htons(tlen); 812 n->doi = htonl(IPSEC_DOI); /* IPSEC DOI (1) */ 813 n->proto_id = pr->proto_id; /* IPSEC AH/ESP/whatever*/ 814 n->spi_size = pr->spisize; 815 n->type = htons(type); 816 *(u_int32_t *)(n + 1) = pr->spi; /* XXX */ 817 if (data) 818 memcpy((caddr_t)(n + 1) + pr->spisize, data->v, data->l); 819 820 /* save the pointer of next payload type */ 821 *np_p = &n->h.np; 822 823 return buf; 824} 825 826/* 827 * handling to receive Notification payload 828 */ 829static int 830isakmp_info_recv_n(iph1, msg) 831 struct ph1handle *iph1; 832 vchar_t *msg; 833{ 834 struct isakmp_pl_n *n = NULL; 835 u_int type; 836 vchar_t *pbuf; 837 struct isakmp_parse_t *pa, *pap; 838 char *spi; 839 840 if (!(pbuf = isakmp_parse(msg))) 841 return -1; 842 pa = (struct isakmp_parse_t *)pbuf->v; 843 for (pap = pa; pap->type; pap++) { 844 switch (pap->type) { 845 case ISAKMP_NPTYPE_HASH: 846 /* do something here */ 847 break; 848 case ISAKMP_NPTYPE_NONCE: 849 /* send to ack */ 850 break; 851 case ISAKMP_NPTYPE_N: 852 n = (struct isakmp_pl_n *)pap->ptr; 853 break; 854 default: 855 vfree(pbuf); 856 return -1; 857 } 858 } 859 vfree(pbuf); 860 if (!n) 861 return -1; 862 863 type = ntohs(n->type); 864 865 switch (type) { 866 case ISAKMP_NTYPE_CONNECTED: 867 case ISAKMP_NTYPE_RESPONDER_LIFETIME: 868 case ISAKMP_NTYPE_REPLAY_STATUS: 869 /* do something */ 870 break; 871 case ISAKMP_NTYPE_INITIAL_CONTACT: 872 info_recv_initialcontact(iph1); 873 break; 874#ifdef ENABLE_DPD 875 case ISAKMP_NTYPE_R_U_THERE: 876 isakmp_info_recv_r_u(iph1, (struct isakmp_pl_ru *)n, 877 ((struct isakmp *)msg->v)->msgid); 878 break; 879 case ISAKMP_NTYPE_R_U_THERE_ACK: 880 isakmp_info_recv_r_u_ack(iph1, (struct isakmp_pl_ru *)n, 881 ((struct isakmp *)msg->v)->msgid); 882 break; 883#endif 884 885 default: 886 { 887 u_int32_t msgid = ((struct isakmp *)msg->v)->msgid; 888 struct ph2handle *iph2; 889 890 /* XXX there is a potential of dos attack. */ 891 if (msgid == 0) { 892 /* delete ph1 */ 893 plog(LLV_ERROR, LOCATION, iph1->remote, 894 "delete phase1 handle.\n"); 895 return -1; 896 } else { 897 iph2 = getph2bymsgid(iph1, msgid); 898 if (iph2 == NULL) { 899 plog(LLV_ERROR, LOCATION, iph1->remote, 900 "unknown notify message, " 901 "no phase2 handle found.\n"); 902 } else { 903 /* delete ph2 */ 904 unbindph12(iph2); 905 remph2(iph2); 906 delph2(iph2); 907 } 908 } 909 } 910 break; 911 } 912 913 /* get spi and allocate */ 914 if (ntohs(n->h.len) < sizeof(*n) + n->spi_size) { 915 plog(LLV_ERROR, LOCATION, iph1->remote, 916 "invalid spi_size in notification payload.\n"); 917 return -1; 918 } 919 spi = val2str((char *)(n + 1), n->spi_size); 920 921 plog(LLV_DEBUG, LOCATION, iph1->remote, 922 "notification message %d:%s, " 923 "doi=%d proto_id=%d spi=%s(size=%d).\n", 924 type, s_isakmp_notify_msg(type), 925 ntohl(n->doi), n->proto_id, spi, n->spi_size); 926 927 racoon_free(spi); 928 929 return(0); 930} 931 932void 933purge_isakmp_spi(proto, spi, n) 934 int proto; 935 isakmp_index *spi; /*network byteorder*/ 936 size_t n; 937{ 938 struct ph1handle *iph1; 939 size_t i; 940 941 for (i = 0; i < n; i++) { 942 iph1 = getph1byindex(&spi[i]); 943 if (!iph1) 944 continue; 945 946 plog(LLV_INFO, LOCATION, NULL, 947 "purged ISAKMP-SA proto_id=%s spi=%s.\n", 948 s_ipsecdoi_proto(proto), 949 isakmp_pindex(&spi[i], 0)); 950 951 if (iph1->sce) 952 SCHED_KILL(iph1->sce); 953 iph1->status = PHASE1ST_EXPIRED; 954 iph1->sce = sched_new(1, isakmp_ph1delete_stub, iph1); 955 } 956} 957 958<<<<<<< isakmp_inf.c 959 960 961void 962======= 963static void 964>>>>>>> 1.14.4.9 965purge_ipsec_spi(dst0, proto, spi, n) 966 struct sockaddr *dst0; 967 int proto; 968 u_int32_t *spi; /*network byteorder*/ 969 size_t n; 970{ 971 vchar_t *buf = NULL; 972 struct sadb_msg *msg, *next, *end; 973 struct sadb_sa *sa; 974 struct sockaddr *src, *dst; 975 struct ph2handle *iph2; 976 size_t i; 977 caddr_t mhp[SADB_EXT_MAX + 1]; 978 979 buf = pfkey_dump_sadb(ipsecdoi2pfkey_proto(proto)); 980 if (buf == NULL) { 981 plog(LLV_DEBUG, LOCATION, NULL, 982 "pfkey_dump_sadb returned nothing.\n"); 983 return; 984 } 985 986 msg = (struct sadb_msg *)buf->v; 987 end = (struct sadb_msg *)(buf->v + buf->l); 988 989 while (msg < end) { 990 if ((msg->sadb_msg_len << 3) < sizeof(*msg)) 991 break; 992 next = (struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3)); 993 if (msg->sadb_msg_type != SADB_DUMP) { 994 msg = next; 995 continue; 996 } 997 998 if (pfkey_align(msg, mhp) || pfkey_check(mhp)) { 999 plog(LLV_ERROR, LOCATION, NULL, 1000 "pfkey_check (%s)\n", ipsec_strerror()); 1001 msg = next; 1002 continue; 1003 } 1004 1005 sa = (struct sadb_sa *)(mhp[SADB_EXT_SA]); 1006 if (!sa 1007 || !mhp[SADB_EXT_ADDRESS_SRC] 1008 || !mhp[SADB_EXT_ADDRESS_DST]) { 1009 msg = next; 1010 continue; 1011 } 1012 src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]); 1013 dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]); 1014 1015 if (sa->sadb_sa_state != SADB_SASTATE_MATURE 1016 && sa->sadb_sa_state != SADB_SASTATE_DYING) { 1017 msg = next; 1018 continue; 1019 } 1020 1021 /* XXX n^2 algorithm, inefficient */ 1022 1023 /* don't delete inbound SAs at the moment */ 1024 /* XXX should we remove SAs with opposite direction as well? */ 1025 if (CMPSADDR(dst0, dst)) { 1026 msg = next; 1027 continue; 1028 } 1029 1030 for (i = 0; i < n; i++) { 1031 plog(LLV_DEBUG, LOCATION, NULL, 1032 "check spi(packet)=%u spi(db)=%u.\n", 1033 ntohl(spi[i]), ntohl(sa->sadb_sa_spi)); 1034 if (spi[i] != sa->sadb_sa_spi) 1035 continue; 1036 1037 pfkey_send_delete(lcconf->sock_pfkey, 1038 msg->sadb_msg_satype, 1039 IPSEC_MODE_ANY, 1040 src, dst, sa->sadb_sa_spi); 1041 1042 /* 1043 * delete a relative phase 2 handler. 1044 * continue to process if no relative phase 2 handler 1045 * exists. 1046 */ 1047 iph2 = getph2bysaidx(src, dst, proto, spi[i]); 1048 if (iph2) { 1049 delete_spd(iph2); 1050 unbindph12(iph2); 1051 remph2(iph2); 1052 delph2(iph2); 1053 } 1054 1055 plog(LLV_INFO, LOCATION, NULL, 1056 "purged IPsec-SA proto_id=%s spi=%u.\n", 1057 s_ipsecdoi_proto(proto), 1058 ntohl(spi[i])); 1059 } 1060 1061 msg = next; 1062 } 1063 1064 if (buf) 1065 vfree(buf); 1066} 1067 1068/* 1069 * delete all phase2 sa relatived to the destination address. 1070 * Don't delete Phase 1 handlers on INITIAL-CONTACT, and don't ignore 1071 * an INITIAL-CONTACT if we have contacted the peer. This matches the 1072 * Sun IKE behavior, and makes rekeying work much better when the peer 1073 * restarts. 1074 */ 1075static void 1076info_recv_initialcontact(iph1) 1077 struct ph1handle *iph1; 1078{ 1079 vchar_t *buf = NULL; 1080 struct sadb_msg *msg, *next, *end; 1081 struct sadb_sa *sa; 1082 struct sockaddr *src, *dst; 1083 caddr_t mhp[SADB_EXT_MAX + 1]; 1084 int proto_id, i; 1085 struct ph2handle *iph2; 1086#if 0 1087 char *loc, *rem; 1088#endif 1089 1090 if (f_local) 1091 return; 1092 1093#if 0 1094 loc = strdup(saddrwop2str(iph1->local)); 1095 rem = strdup(saddrwop2str(iph1->remote)); 1096 1097 /* 1098 * Purge all IPSEC-SAs for the peer. We can do this 1099 * the easy way (using a PF_KEY SADB_DELETE extension) 1100 * or we can do it the hard way. 1101 */ 1102 for (i = 0; i < pfkey_nsatypes; i++) { 1103 proto_id = pfkey2ipsecdoi_proto(pfkey_satypes[i].ps_satype); 1104 1105 plog(LLV_INFO, LOCATION, NULL, 1106 "purging %s SAs for %s -> %s\n", 1107 pfkey_satypes[i].ps_name, loc, rem); 1108 if (pfkey_send_delete_all(lcconf->sock_pfkey, 1109 pfkey_satypes[i].ps_satype, IPSEC_MODE_ANY, 1110 iph1->local, iph1->remote) == -1) { 1111 plog(LLV_ERROR, LOCATION, NULL, 1112 "delete_all %s -> %s failed for %s (%s)\n", 1113 loc, rem, 1114 pfkey_satypes[i].ps_name, ipsec_strerror()); 1115 goto the_hard_way; 1116 } 1117 1118 deleteallph2(iph1->local, iph1->remote, proto_id); 1119 1120 plog(LLV_INFO, LOCATION, NULL, 1121 "purging %s SAs for %s -> %s\n", 1122 pfkey_satypes[i].ps_name, rem, loc); 1123 if (pfkey_send_delete_all(lcconf->sock_pfkey, 1124 pfkey_satypes[i].ps_satype, IPSEC_MODE_ANY, 1125 iph1->remote, iph1->local) == -1) { 1126 plog(LLV_ERROR, LOCATION, NULL, 1127 "delete_all %s -> %s failed for %s (%s)\n", 1128 rem, loc, 1129 pfkey_satypes[i].ps_name, ipsec_strerror()); 1130 goto the_hard_way; 1131 } 1132 1133 deleteallph2(iph1->remote, iph1->local, proto_id); 1134 } 1135 1136 racoon_free(loc); 1137 racoon_free(rem); 1138 return; 1139 1140 the_hard_way: 1141 racoon_free(loc); 1142 racoon_free(rem); 1143#endif 1144 1145 buf = pfkey_dump_sadb(SADB_SATYPE_UNSPEC); 1146 if (buf == NULL) { 1147 plog(LLV_DEBUG, LOCATION, NULL, 1148 "pfkey_dump_sadb returned nothing.\n"); 1149 return; 1150 } 1151 1152 msg = (struct sadb_msg *)buf->v; 1153 end = (struct sadb_msg *)(buf->v + buf->l); 1154 1155 while (msg < end) { 1156 if ((msg->sadb_msg_len << 3) < sizeof(*msg)) 1157 break; 1158 next = (struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3)); 1159 if (msg->sadb_msg_type != SADB_DUMP) { 1160 msg = next; 1161 continue; 1162 } 1163 1164 if (pfkey_align(msg, mhp) || pfkey_check(mhp)) { 1165 plog(LLV_ERROR, LOCATION, NULL, 1166 "pfkey_check (%s)\n", ipsec_strerror()); 1167 msg = next; 1168 continue; 1169 } 1170 1171 if (mhp[SADB_EXT_SA] == NULL 1172 || mhp[SADB_EXT_ADDRESS_SRC] == NULL 1173 || mhp[SADB_EXT_ADDRESS_DST] == NULL) { 1174 msg = next; 1175 continue; 1176 } 1177 sa = (struct sadb_sa *)mhp[SADB_EXT_SA]; 1178 src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]); 1179 dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]); 1180 1181 if (sa->sadb_sa_state != SADB_SASTATE_MATURE 1182 && sa->sadb_sa_state != SADB_SASTATE_DYING) { 1183 msg = next; 1184 continue; 1185 } 1186 1187 /* 1188 * RFC2407 4.6.3.3 INITIAL-CONTACT is the message that 1189 * announces the sender of the message was rebooted. 1190 * it is interpreted to delete all SAs which source address 1191 * is the sender of the message. 1192 * racoon only deletes SA which is matched both the 1193 * source address and the destination accress. 1194 */ 1195#ifdef ENABLE_NATT 1196 /* 1197 * XXX RFC 3947 says that whe MUST NOT use IP+port to find old SAs 1198 * from this peer ! 1199 */ 1200 if(iph1->natt_flags & NAT_DETECTED){ 1201 if (CMPSADDR(iph1->local, src) == 0 && 1202 CMPSADDR(iph1->remote, dst) == 0) 1203 ; 1204 else if (CMPSADDR(iph1->remote, src) == 0 && 1205 CMPSADDR(iph1->local, dst) == 0) 1206 ; 1207 else { 1208 msg = next; 1209 continue; 1210 } 1211 } else 1212#endif 1213 /* If there is no NAT-T, we don't have to check addr + port... 1214 * XXX what about a configuration with a remote peers which is not 1215 * NATed, but which NATs some other peers ? 1216 * Here, the INITIAl-CONTACT would also flush all those NATed peers !! 1217 */ 1218 if (cmpsaddrwop(iph1->local, src) == 0 && 1219 cmpsaddrwop(iph1->remote, dst) == 0) 1220 ; 1221 else if (cmpsaddrwop(iph1->remote, src) == 0 && 1222 cmpsaddrwop(iph1->local, dst) == 0) 1223 ; 1224 else { 1225 msg = next; 1226 continue; 1227 } 1228 1229 /* 1230 * Make sure this is an SATYPE that we manage. 1231 * This is gross; too bad we couldn't do it the 1232 * easy way. 1233 */ 1234 for (i = 0; i < pfkey_nsatypes; i++) { 1235 if (pfkey_satypes[i].ps_satype == 1236 msg->sadb_msg_satype) 1237 break; 1238 } 1239 if (i == pfkey_nsatypes) { 1240 msg = next; 1241 continue; 1242 } 1243 1244 plog(LLV_INFO, LOCATION, NULL, 1245 "purging spi=%u.\n", ntohl(sa->sadb_sa_spi)); 1246 pfkey_send_delete(lcconf->sock_pfkey, 1247 msg->sadb_msg_satype, 1248 IPSEC_MODE_ANY, src, dst, sa->sadb_sa_spi); 1249 1250 /* 1251 * delete a relative phase 2 handler. 1252 * continue to process if no relative phase 2 handler 1253 * exists. 1254 */ 1255 proto_id = pfkey2ipsecdoi_proto(msg->sadb_msg_satype); 1256 iph2 = getph2bysaidx(src, dst, proto_id, sa->sadb_sa_spi); 1257 if (iph2) { 1258 delete_spd(iph2); 1259 unbindph12(iph2); 1260 remph2(iph2); 1261 delph2(iph2); 1262 } 1263 1264 msg = next; 1265 } 1266 1267 vfree(buf); 1268} 1269 1270/* 1271 * handling to receive Deletion payload 1272 */ 1273static int 1274isakmp_info_recv_d(iph1, msg) 1275 struct ph1handle *iph1; 1276 vchar_t *msg; 1277{ 1278 struct isakmp_pl_d *d; 1279 int tlen, num_spi; 1280 vchar_t *pbuf; 1281 struct isakmp_parse_t *pa, *pap; 1282 int protected = 0; 1283 union { 1284 u_int32_t spi32; 1285 u_int16_t spi16[2]; 1286 } spi; 1287 1288 /* validate the type of next payload */ 1289 if (!(pbuf = isakmp_parse(msg))) 1290 return -1; 1291 pa = (struct isakmp_parse_t *)pbuf->v; 1292 for (pap = pa; pap->type; pap++) { 1293 switch (pap->type) { 1294 case ISAKMP_NPTYPE_D: 1295 break; 1296 case ISAKMP_NPTYPE_HASH: 1297 if (pap == pa) { 1298 protected++; 1299 break; 1300 } 1301 plog(LLV_ERROR, LOCATION, iph1->remote, 1302 "received next payload type %d " 1303 "in wrong place (must be the first payload).\n", 1304 pap->type); 1305 vfree(pbuf); 1306 return -1; 1307 default: 1308 /* don't send information, see isakmp_ident_r1() */ 1309 plog(LLV_ERROR, LOCATION, iph1->remote, 1310 "reject the packet, " 1311 "received unexpecting payload type %d.\n", 1312 pap->type); 1313 vfree(pbuf); 1314 return 0; 1315 } 1316 } 1317 1318 if (!protected) { 1319 plog(LLV_ERROR, LOCATION, NULL, 1320 "delete payload is not proteted, " 1321 "ignored.\n"); 1322 vfree(pbuf); 1323 return -1; 1324 } 1325 1326 /* process a delete payload */ 1327 for (pap = pa; pap->type; pap++) { 1328 if (pap->type != ISAKMP_NPTYPE_D) 1329 continue; 1330 1331 d = (struct isakmp_pl_d *)pap->ptr; 1332 1333 if (ntohl(d->doi) != IPSEC_DOI) { 1334 plog(LLV_ERROR, LOCATION, iph1->remote, 1335 "delete payload with invalid doi:%d.\n", 1336 ntohl(d->doi)); 1337#ifdef ENABLE_HYBRID 1338 /* 1339 * At deconnexion time, Cisco VPN client does this 1340 * with a zero DOI. Don't give up in that situation. 1341 */ 1342 if (((iph1->mode_cfg->flags & 1343 ISAKMP_CFG_VENDORID_UNITY) == 0) || (d->doi != 0)) 1344 continue; 1345#else 1346 continue; 1347#endif 1348 } 1349 1350 num_spi = ntohs(d->num_spi); 1351 tlen = ntohs(d->h.len) - sizeof(struct isakmp_pl_d); 1352 1353 if (tlen != num_spi * d->spi_size) { 1354 plog(LLV_ERROR, LOCATION, iph1->remote, 1355 "deletion payload with invalid length.\n"); 1356 vfree(pbuf); 1357 return -1; 1358 } 1359 1360 switch (d->proto_id) { 1361 case IPSECDOI_PROTO_ISAKMP: 1362 if (d->spi_size != sizeof(isakmp_index)) { 1363 plog(LLV_ERROR, LOCATION, iph1->remote, 1364 "delete payload with strange spi " 1365 "size %d(proto_id:%d)\n", 1366 d->spi_size, d->proto_id); 1367 continue; 1368 } 1369 1370 if (iph1->scr) 1371 SCHED_KILL(iph1->scr); 1372 1373 purge_remote(iph1); 1374 break; 1375 1376 case IPSECDOI_PROTO_IPSEC_AH: 1377 case IPSECDOI_PROTO_IPSEC_ESP: 1378 if (d->spi_size != sizeof(u_int32_t)) { 1379 plog(LLV_ERROR, LOCATION, iph1->remote, 1380 "delete payload with strange spi " 1381 "size %d(proto_id:%d)\n", 1382 d->spi_size, d->proto_id); 1383 continue; 1384 } 1385 EVT_PUSH(iph1->local, iph1->remote, 1386 EVTT_PEER_DELETE, NULL); 1387 purge_ipsec_spi(iph1->remote, d->proto_id, 1388 (u_int32_t *)(d + 1), num_spi); 1389 break; 1390 1391 case IPSECDOI_PROTO_IPCOMP: 1392 /* need to handle both 16bit/32bit SPI */ 1393 memset(&spi, 0, sizeof(spi)); 1394 if (d->spi_size == sizeof(spi.spi16[1])) { 1395 memcpy(&spi.spi16[1], d + 1, 1396 sizeof(spi.spi16[1])); 1397 } else if (d->spi_size == sizeof(spi.spi32)) 1398 memcpy(&spi.spi32, d + 1, sizeof(spi.spi32)); 1399 else { 1400 plog(LLV_ERROR, LOCATION, iph1->remote, 1401 "delete payload with strange spi " 1402 "size %d(proto_id:%d)\n", 1403 d->spi_size, d->proto_id); 1404 continue; 1405 } 1406 purge_ipsec_spi(iph1->remote, d->proto_id, 1407 &spi.spi32, num_spi); 1408 break; 1409 1410 default: 1411 plog(LLV_ERROR, LOCATION, iph1->remote, 1412 "deletion message received, " 1413 "invalid proto_id: %d\n", 1414 d->proto_id); 1415 continue; 1416 } 1417 1418 plog(LLV_DEBUG, LOCATION, NULL, "purged SAs.\n"); 1419 } 1420 1421 vfree(pbuf); 1422 1423 return 0; 1424} 1425 1426void 1427isakmp_check_notify(gen, iph1) 1428 struct isakmp_gen *gen; /* points to Notify payload */ 1429 struct ph1handle *iph1; 1430{ 1431 struct isakmp_pl_n *notify = (struct isakmp_pl_n *)gen; 1432 1433 plog(LLV_DEBUG, LOCATION, iph1->remote, 1434 "Notify Message received\n"); 1435 1436 switch (ntohs(notify->type)) { 1437 case ISAKMP_NTYPE_CONNECTED: 1438 plog(LLV_WARNING, LOCATION, iph1->remote, 1439 "ignore CONNECTED notification.\n"); 1440 break; 1441 case ISAKMP_NTYPE_RESPONDER_LIFETIME: 1442 plog(LLV_WARNING, LOCATION, iph1->remote, 1443 "ignore RESPONDER-LIFETIME notification.\n"); 1444 break; 1445 case ISAKMP_NTYPE_REPLAY_STATUS: 1446 plog(LLV_WARNING, LOCATION, iph1->remote, 1447 "ignore REPLAY-STATUS notification.\n"); 1448 break; 1449 case ISAKMP_NTYPE_INITIAL_CONTACT: 1450 plog(LLV_WARNING, LOCATION, iph1->remote, 1451 "ignore INITIAL-CONTACT notification, " 1452 "because it is only accepted after phase1.\n"); 1453 break; 1454 case ISAKMP_NTYPE_HEARTBEAT: 1455 plog(LLV_WARNING, LOCATION, iph1->remote, 1456 "ignore HEARTBEAT notification\n"); 1457 break; 1458 default: 1459 isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL); 1460 plog(LLV_ERROR, LOCATION, iph1->remote, 1461 "received unknown notification type %u.\n", 1462 ntohs(notify->type)); 1463 } 1464 1465 return; 1466} 1467 1468 1469#ifdef ENABLE_DPD 1470static int 1471isakmp_info_recv_r_u (iph1, ru, msgid) 1472 struct ph1handle *iph1; 1473 struct isakmp_pl_ru *ru; 1474 u_int32_t msgid; 1475{ 1476 struct isakmp_pl_ru *ru_ack; 1477 vchar_t *payload = NULL; 1478 int tlen; 1479 int error = 0; 1480 1481 plog(LLV_DEBUG, LOCATION, iph1->remote, 1482 "DPD R-U-There received\n"); 1483 1484 /* XXX should compare cookies with iph1->index? 1485 Or is this already done by calling function? */ 1486 tlen = sizeof(*ru_ack); 1487 payload = vmalloc(tlen); 1488 if (payload == NULL) { 1489 plog(LLV_ERROR, LOCATION, NULL, 1490 "failed to get buffer to send.\n"); 1491 return errno; 1492 } 1493 1494 ru_ack = (struct isakmp_pl_ru *)payload->v; 1495 ru_ack->h.np = ISAKMP_NPTYPE_NONE; 1496 ru_ack->h.len = htons(tlen); 1497 ru_ack->doi = htonl(IPSEC_DOI); 1498 ru_ack->type = htons(ISAKMP_NTYPE_R_U_THERE_ACK); 1499 ru_ack->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX ? */ 1500 ru_ack->spi_size = sizeof(isakmp_index); 1501 memcpy(ru_ack->i_ck, ru->i_ck, sizeof(cookie_t)); 1502 memcpy(ru_ack->r_ck, ru->r_ck, sizeof(cookie_t)); 1503 ru_ack->data = ru->data; 1504 1505 /* XXX Should we do FLAG_A ? */ 1506 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 1507 ISAKMP_FLAG_E); 1508 vfree(payload); 1509 1510 plog(LLV_DEBUG, LOCATION, NULL, "received a valid R-U-THERE, ACK sent\n"); 1511 1512 /* Should we mark tunnel as active ? */ 1513 return error; 1514} 1515 1516static int 1517isakmp_info_recv_r_u_ack (iph1, ru, msgid) 1518 struct ph1handle *iph1; 1519 struct isakmp_pl_ru *ru; 1520 u_int32_t msgid; 1521{ 1522 1523 plog(LLV_DEBUG, LOCATION, iph1->remote, 1524 "DPD R-U-There-Ack received\n"); 1525 1526 /* XXX Maintain window of acceptable sequence numbers ? 1527 * => ru->data <= iph2->dpd_seq && 1528 * ru->data >= iph2->dpd_seq - iph2->dpd_fails ? */ 1529 if (ntohl(ru->data) != iph1->dpd_seq-1) { 1530 plog(LLV_ERROR, LOCATION, iph1->remote, 1531 "Wrong DPD sequence number (%d, %d expected).\n", 1532 ntohl(ru->data), iph1->dpd_seq-1); 1533 return 0; 1534 } 1535 1536 if (memcmp(ru->i_ck, iph1->index.i_ck, sizeof(cookie_t)) || 1537 memcmp(ru->r_ck, iph1->index.r_ck, sizeof(cookie_t))) { 1538 plog(LLV_ERROR, LOCATION, iph1->remote, 1539 "Cookie mismatch in DPD ACK!.\n"); 1540 return 0; 1541 } 1542 1543 iph1->dpd_fails = 0; 1544 1545 /* Useless ??? */ 1546 iph1->dpd_lastack = time(NULL); 1547 1548 if (iph1->dpd_r_u != NULL) 1549 SCHED_KILL(iph1->dpd_r_u); 1550 1551 isakmp_sched_r_u(iph1, 0); 1552 1553 plog(LLV_DEBUG, LOCATION, NULL, "received an R-U-THERE-ACK\n"); 1554 1555 return 0; 1556} 1557 1558 1559<<<<<<< isakmp_inf.c 1560 1561 1562======= 1563>>>>>>> 1.14.4.9 1564/* 1565 * send Delete payload (for ISAKMP SA) in Informational exchange. 1566 */ 1567static void 1568isakmp_info_send_r_u(arg) 1569 void *arg; 1570{ 1571 struct ph1handle *iph1 = arg; 1572 1573 /* create R-U-THERE payload */ 1574 struct isakmp_pl_ru *ru; 1575 vchar_t *payload = NULL; 1576 int tlen; 1577 int error = 0; 1578 1579 plog(LLV_DEBUG, LOCATION, iph1->remote, "DPD monitoring....\n"); 1580 1581 if (iph1->dpd_fails >= iph1->rmconf->dpd_maxfails) { 1582 EVT_PUSH(iph1->local, iph1->remote, EVTT_DPD_TIMEOUT, NULL); 1583 purge_remote(iph1); 1584 plog(LLV_DEBUG, LOCATION, iph1->remote, 1585 "DPD: remote seems to be dead\n"); 1586 1587 /* Do not reschedule here: phase1 is deleted, 1588 * DPD will be reactivated when a new ph1 will be negociated 1589 */ 1590 return; 1591 } 1592 1593 /* TODO: check recent activity to avoid useless sends... */ 1594 1595 /* XXX: why do we have a NULL LIST_FIRST even when a Phase2 exists ??? */ 1596#if 0 1597 if (LIST_FIRST(&iph1->ph2tree) == NULL){ 1598 /* XXX: No Ph2 => no need to test ph1 ? 1599 */ 1600 /* Reschedule the r_u_there.... 1601 XXX: reschedule when a new ph2 ? 1602 */ 1603 isakmp_sched_r_u(iph1, 0); 1604 plog(LLV_DEBUG, LOCATION, iph1->remote, 1605 "no phase2 handler, rescheduling send_r_u (%d).\n", iph1->rmconf->dpd_interval); 1606 return 0; 1607 } 1608#endif 1609 1610 tlen = sizeof(*ru); 1611 payload = vmalloc(tlen); 1612 if (payload == NULL) { 1613 plog(LLV_ERROR, LOCATION, NULL, 1614 "failed to get buffer for payload.\n"); 1615 return; 1616 } 1617 ru = (struct isakmp_pl_ru *)payload->v; 1618 ru->h.np = ISAKMP_NPTYPE_NONE; 1619 ru->h.len = htons(tlen); 1620 ru->doi = htonl(IPSEC_DOI); 1621 ru->type = htons(ISAKMP_NTYPE_R_U_THERE); 1622 ru->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX ?*/ 1623 ru->spi_size = sizeof(isakmp_index); 1624 1625 memcpy(ru->i_ck, iph1->index.i_ck, sizeof(cookie_t)); 1626 memcpy(ru->r_ck, iph1->index.r_ck, sizeof(cookie_t)); 1627 1628 if (iph1->dpd_seq == 0){ 1629 /* generate a random seq which is not too big */ 1630 srand(time(NULL)); 1631 iph1->dpd_seq = rand() & 0x0fff; 1632 } 1633 1634 ru->data = htonl(iph1->dpd_seq); 1635 1636 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 0); 1637 vfree(payload); 1638 1639 plog(LLV_DEBUG, LOCATION, iph1->remote, 1640 "DPD R-U-There sent (%d)\n", error); 1641 1642 /* will be decreased if ACK received... */ 1643 iph1->dpd_fails++; 1644 1645 /* XXX should be increased only when ACKed ? */ 1646 iph1->dpd_seq++; 1647 1648 /* Reschedule the r_u_there with a short delay, 1649 * will be deleted/rescheduled if ACK received before */ 1650 isakmp_sched_r_u(iph1, 1); 1651 1652 plog(LLV_DEBUG, LOCATION, iph1->remote, 1653 "rescheduling send_r_u (%d).\n", iph1->rmconf->dpd_retry); 1654} 1655 1656/* Schedule a new R-U-THERE */ 1657int 1658isakmp_sched_r_u(iph1, retry) 1659 struct ph1handle *iph1; 1660 int retry; 1661{ 1662 if(iph1 == NULL || 1663 iph1->rmconf == NULL) 1664 return 1; 1665 1666 1667 if(iph1->dpd_support == 0 || 1668 iph1->rmconf->dpd_interval == 0) 1669 return 0; 1670 1671 if(retry) 1672 iph1->dpd_r_u = sched_new(iph1->rmconf->dpd_retry, 1673 isakmp_info_send_r_u, iph1); 1674 else 1675 sched_new(iph1->rmconf->dpd_interval, 1676 isakmp_info_send_r_u, iph1); 1677 1678 return 0; 1679} 1680#endif 1681