isakmp_inf.c revision 1.2
1/* $NetBSD: isakmp_inf.c,v 1.2 2005/04/19 19:42:09 manu Exp $ */ 2 3/* Id: isakmp_inf.c,v 1.14.4.2 2005/03/02 20:00:03 vanhu Exp */ 4 5/* 6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. Neither the name of the project nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34#include "config.h" 35 36#include <sys/types.h> 37#include <sys/param.h> 38#include <sys/socket.h> 39 40#include <net/pfkeyv2.h> 41#include <netinet/in.h> 42#include <sys/queue.h> 43#ifndef HAVE_NETINET6_IPSEC 44#include <netinet/ipsec.h> 45#else 46#include <netinet6/ipsec.h> 47#endif 48 49#include <stdlib.h> 50#include <stdio.h> 51#include <string.h> 52#include <errno.h> 53#if TIME_WITH_SYS_TIME 54# include <sys/time.h> 55# include <time.h> 56#else 57# if HAVE_SYS_TIME_H 58# include <sys/time.h> 59# else 60# include <time.h> 61# endif 62#endif 63 64#include "libpfkey.h" 65 66#include "var.h" 67#include "vmbuf.h" 68#include "schedule.h" 69#include "str2val.h" 70#include "misc.h" 71#include "plog.h" 72#include "debug.h" 73 74#include "localconf.h" 75#include "remoteconf.h" 76#include "sockmisc.h" 77#include "isakmp_var.h" 78#include "evt.h" 79#include "isakmp.h" 80#ifdef ENABLE_HYBRID 81#include "isakmp_xauth.h" 82#include "isakmp_cfg.h" 83#endif 84#include "isakmp_inf.h" 85#include "oakley.h" 86#include "handler.h" 87#include "ipsec_doi.h" 88#include "crypto_openssl.h" 89#include "pfkey.h" 90#include "policy.h" 91#include "algorithm.h" 92#include "proposal.h" 93#include "admin.h" 94#include "strnames.h" 95 96/* information exchange */ 97static int isakmp_info_recv_n __P((struct ph1handle *, vchar_t *)); 98static int isakmp_info_recv_d __P((struct ph1handle *, vchar_t *)); 99 100#ifdef ENABLE_DPD 101static int isakmp_info_recv_r_u __P((struct ph1handle *, 102 struct isakmp_pl_ru *, u_int32_t)); 103static int isakmp_info_recv_r_u_ack __P((struct ph1handle *, 104 struct isakmp_pl_ru *, u_int32_t)); 105static void isakmp_info_send_r_u __P((void *)); 106static void purge_remote __P((struct ph1handle *)); 107#endif 108 109static void purge_isakmp_spi __P((int, isakmp_index *, size_t)); 110static void purge_ipsec_spi __P((struct sockaddr *, int, u_int32_t *, size_t)); 111static void info_recv_initialcontact __P((struct ph1handle *)); 112 113#ifdef INET6 114/* XXX copy of setscopeid from isakmp_quick.c */ 115static u_int32_t setscopeid __P((struct sockaddr *, struct sockaddr *)); 116#endif 117 118#ifdef HAVE_POLICY_FWD 119extern int tunnel_mode_prop __P((struct saprop *)); 120#endif 121 122 123/* %%% 124 * Information Exchange 125 */ 126/* 127 * receive Information 128 */ 129int 130isakmp_info_recv(iph1, msg0) 131 struct ph1handle *iph1; 132 vchar_t *msg0; 133{ 134 vchar_t *msg = NULL; 135 int error = -1; 136 struct isakmp *isakmp; 137 struct isakmp_gen *gen; 138 u_int8_t np; 139 int encrypted; 140 141 plog(LLV_DEBUG, LOCATION, NULL, "receive Information.\n"); 142 143 encrypted = ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E); 144 145 /* Use new IV to decrypt Informational message. */ 146 if (encrypted) { 147 148 struct isakmp_ivm *ivm; 149 150 /* compute IV */ 151 ivm = oakley_newiv2(iph1, ((struct isakmp *)msg0->v)->msgid); 152 if (ivm == NULL) 153 return -1; 154 155 msg = oakley_do_decrypt(iph1, msg0, ivm->iv, ivm->ive); 156 oakley_delivm(ivm); 157 if (msg == NULL) 158 return -1; 159 160 } else 161 msg = vdup(msg0); 162 163 isakmp = (struct isakmp *)msg->v; 164 gen = (struct isakmp_gen *)((caddr_t)isakmp + sizeof(struct isakmp)); 165 166 if (isakmp->np != ISAKMP_NPTYPE_HASH) { 167 plog(LLV_ERROR, LOCATION, NULL, 168 "ignore information because the message has no hash payload.\n"); 169 goto end; 170 } 171 172 if (iph1->status != PHASE1ST_ESTABLISHED) { 173 plog(LLV_ERROR, LOCATION, NULL, 174 "ignore information because ISAKMP-SA has not been established yet.\n"); 175 goto end; 176 } 177 178 np = gen->np; 179 180 { 181 void *p; 182 vchar_t *hash, *payload; 183 struct isakmp_gen *nd; 184 185 p = (caddr_t) gen + sizeof(struct isakmp_gen); 186 nd = (struct isakmp_gen *) ((caddr_t) gen + ntohs(gen->len)); 187 188 /* nd length check */ 189 if (ntohs(nd->len) > msg->l - (sizeof(struct isakmp) + 190 ntohs(gen->len))) { 191 plog(LLV_ERROR, LOCATION, NULL, 192 "too long payload length (broken message?)\n"); 193 goto end; 194 } 195 196 payload = vmalloc(ntohs(nd->len)); 197 if (payload == NULL) { 198 plog(LLV_ERROR, LOCATION, NULL, 199 "cannot allocate memory\n"); 200 goto end; 201 } 202 203 memcpy(payload->v, (caddr_t) nd, ntohs(nd->len)); 204 205 /* compute HASH */ 206 hash = oakley_compute_hash1(iph1, isakmp->msgid, payload); 207 if (hash == NULL) { 208 plog(LLV_ERROR, LOCATION, NULL, 209 "cannot compute hash\n"); 210 211 vfree(payload); 212 goto end; 213 } 214 215 if (ntohs(gen->len) - sizeof(struct isakmp_gen) != hash->l) { 216 plog(LLV_ERROR, LOCATION, NULL, 217 "ignore information due to hash length mismatch\n"); 218 219 vfree(hash); 220 vfree(payload); 221 goto end; 222 } 223 224 if (memcmp(p, hash->v, hash->l) != 0) { 225 plog(LLV_ERROR, LOCATION, NULL, 226 "ignore information due to hash mismatch\n"); 227 228 vfree(hash); 229 vfree(payload); 230 goto end; 231 } 232 233 plog(LLV_DEBUG, LOCATION, NULL, "hash validated.\n"); 234 235 vfree(hash); 236 vfree(payload); 237 } 238 239 /* make sure the packet were encrypted. */ 240 if (!encrypted) { 241 switch (iph1->etype) { 242 case ISAKMP_ETYPE_AGG: 243 case ISAKMP_ETYPE_BASE: 244 case ISAKMP_ETYPE_IDENT: 245 if ((iph1->side == INITIATOR && iph1->status < PHASE1ST_MSG3SENT) 246 || (iph1->side == RESPONDER && iph1->status < PHASE1ST_MSG2SENT)) { 247 break; 248 } 249 /*FALLTHRU*/ 250 default: 251 plog(LLV_ERROR, LOCATION, iph1->remote, 252 "%s message must be encrypted\n", 253 s_isakmp_nptype(np)); 254 goto end; 255 } 256 } 257 258 switch (np) { 259 case ISAKMP_NPTYPE_N: 260 if (isakmp_info_recv_n(iph1, msg) < 0) 261 goto end; 262 break; 263 case ISAKMP_NPTYPE_D: 264 if (isakmp_info_recv_d(iph1, msg) < 0) 265 goto end; 266 break; 267 case ISAKMP_NPTYPE_NONCE: 268 /* XXX to be 6.4.2 ike-01.txt */ 269 /* XXX IV is to be synchronized. */ 270 plog(LLV_ERROR, LOCATION, iph1->remote, 271 "ignore Acknowledged Informational\n"); 272 break; 273 default: 274 /* don't send information, see isakmp_ident_r1() */ 275 error = 0; 276 plog(LLV_ERROR, LOCATION, iph1->remote, 277 "reject the packet, " 278 "received unexpecting payload type %d.\n", 279 gen->np); 280 goto end; 281 } 282 283 end: 284 if (msg != NULL) 285 vfree(msg); 286 287 return 0; 288} 289 290/* 291 * send Delete payload (for ISAKMP SA) in Informational exchange. 292 */ 293int 294isakmp_info_send_d1(iph1) 295 struct ph1handle *iph1; 296{ 297 struct isakmp_pl_d *d; 298 vchar_t *payload = NULL; 299 int tlen; 300 int error = 0; 301 302 if (iph1->status != PHASE2ST_ESTABLISHED) 303 return 0; 304 305 /* create delete payload */ 306 307 /* send SPIs of inbound SAs. */ 308 /* XXX should send outbound SAs's ? */ 309 tlen = sizeof(*d) + sizeof(isakmp_index); 310 payload = vmalloc(tlen); 311 if (payload == NULL) { 312 plog(LLV_ERROR, LOCATION, NULL, 313 "failed to get buffer for payload.\n"); 314 return errno; 315 } 316 317 d = (struct isakmp_pl_d *)payload->v; 318 d->h.np = ISAKMP_NPTYPE_NONE; 319 d->h.len = htons(tlen); 320 d->doi = htonl(IPSEC_DOI); 321 d->proto_id = IPSECDOI_PROTO_ISAKMP; 322 d->spi_size = sizeof(isakmp_index); 323 d->num_spi = htons(1); 324 memcpy(d + 1, &iph1->index, sizeof(isakmp_index)); 325 326 error = isakmp_info_send_common(iph1, payload, 327 ISAKMP_NPTYPE_D, 0); 328 vfree(payload); 329 330 return error; 331} 332 333/* 334 * send Delete payload (for IPsec SA) in Informational exchange, based on 335 * pfkey msg. It sends always single SPI. 336 */ 337int 338isakmp_info_send_d2(iph2) 339 struct ph2handle *iph2; 340{ 341 struct ph1handle *iph1; 342 struct saproto *pr; 343 struct isakmp_pl_d *d; 344 vchar_t *payload = NULL; 345 int tlen; 346 int error = 0; 347 u_int8_t *spi; 348 349 if (iph2->status != PHASE2ST_ESTABLISHED) 350 return 0; 351 352 /* 353 * don't send delete information if there is no phase 1 handler. 354 * It's nonsensical to negotiate phase 1 to send the information. 355 */ 356 iph1 = getph1byaddr(iph2->src, iph2->dst); 357 if (iph1 == NULL) 358 return 0; 359 360 /* create delete payload */ 361 for (pr = iph2->approval->head; pr != NULL; pr = pr->next) { 362 363 /* send SPIs of inbound SAs. */ 364 /* 365 * XXX should I send outbound SAs's ? 366 * I send inbound SAs's SPI only at the moment because I can't 367 * decode any more if peer send encoded packet without aware of 368 * deletion of SA. Outbound SAs don't come under the situation. 369 */ 370 tlen = sizeof(*d) + pr->spisize; 371 payload = vmalloc(tlen); 372 if (payload == NULL) { 373 plog(LLV_ERROR, LOCATION, NULL, 374 "failed to get buffer for payload.\n"); 375 return errno; 376 } 377 378 d = (struct isakmp_pl_d *)payload->v; 379 d->h.np = ISAKMP_NPTYPE_NONE; 380 d->h.len = htons(tlen); 381 d->doi = htonl(IPSEC_DOI); 382 d->proto_id = pr->proto_id; 383 d->spi_size = pr->spisize; 384 d->num_spi = htons(1); 385 /* 386 * XXX SPI bits are left-filled, for use with IPComp. 387 * we should be switching to variable-length spi field... 388 */ 389 spi = (u_int8_t *)&pr->spi; 390 spi += sizeof(pr->spi); 391 spi -= pr->spisize; 392 memcpy(d + 1, spi, pr->spisize); 393 394 error = isakmp_info_send_common(iph1, payload, 395 ISAKMP_NPTYPE_D, 0); 396 vfree(payload); 397 } 398 399 return error; 400} 401 402/* 403 * send Notification payload (for without ISAKMP SA) in Informational exchange 404 */ 405int 406isakmp_info_send_nx(isakmp, remote, local, type, data) 407 struct isakmp *isakmp; 408 struct sockaddr *remote, *local; 409 int type; 410 vchar_t *data; 411{ 412 struct ph1handle *iph1 = NULL; 413 struct remoteconf *rmconf; 414 vchar_t *payload = NULL; 415 int tlen; 416 int error = -1; 417 struct isakmp_pl_n *n; 418 int spisiz = 0; /* see below */ 419 420 /* search appropreate configuration */ 421 rmconf = getrmconf(remote); 422 if (rmconf == NULL) { 423 plog(LLV_ERROR, LOCATION, remote, 424 "no configuration found for peer address.\n"); 425 goto end; 426 } 427 428 /* add new entry to isakmp status table. */ 429 iph1 = newph1(); 430 if (iph1 == NULL) 431 return -1; 432 433 memcpy(&iph1->index.i_ck, &isakmp->i_ck, sizeof(cookie_t)); 434 isakmp_newcookie((char *)&iph1->index.r_ck, remote, local); 435 iph1->status = PHASE1ST_START; 436 iph1->rmconf = rmconf; 437 iph1->side = INITIATOR; 438 iph1->version = isakmp->v; 439 iph1->flags = 0; 440 iph1->msgid = 0; /* XXX */ 441#ifdef ENABLE_HYBRID 442 if ((iph1->mode_cfg = isakmp_cfg_mkstate()) == NULL) 443 return -1; 444#endif 445#ifdef ENABLE_FRAG 446 iph1->frag = 0; 447 iph1->frag_chain = NULL; 448#endif 449 450 /* copy remote address */ 451 if (copy_ph1addresses(iph1, rmconf, remote, local) < 0) 452 return -1; 453 454 tlen = sizeof(*n) + spisiz; 455 if (data) 456 tlen += data->l; 457 payload = vmalloc(tlen); 458 if (payload == NULL) { 459 plog(LLV_ERROR, LOCATION, NULL, 460 "failed to get buffer to send.\n"); 461 goto end; 462 } 463 464 n = (struct isakmp_pl_n *)payload->v; 465 n->h.np = ISAKMP_NPTYPE_NONE; 466 n->h.len = htons(tlen); 467 n->doi = htonl(IPSEC_DOI); 468 n->proto_id = IPSECDOI_KEY_IKE; 469 n->spi_size = spisiz; 470 n->type = htons(type); 471 if (spisiz) 472 memset(n + 1, 0, spisiz); /*XXX*/ 473 if (data) 474 memcpy((caddr_t)(n + 1) + spisiz, data->v, data->l); 475 476 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 0); 477 vfree(payload); 478 479 end: 480 if (iph1 != NULL) 481 delph1(iph1); 482 483 return error; 484} 485 486/* 487 * send Notification payload (for ISAKMP SA) in Informational exchange 488 */ 489int 490isakmp_info_send_n1(iph1, type, data) 491 struct ph1handle *iph1; 492 int type; 493 vchar_t *data; 494{ 495 vchar_t *payload = NULL; 496 int tlen; 497 int error = 0; 498 struct isakmp_pl_n *n; 499 int spisiz; 500 501 /* 502 * note on SPI size: which description is correct? I have chosen 503 * this to be 0. 504 * 505 * RFC2408 3.1, 2nd paragraph says: ISAKMP SA is identified by 506 * Initiator/Responder cookie and SPI has no meaning, SPI size = 0. 507 * RFC2408 3.1, first paragraph on page 40: ISAKMP SA is identified 508 * by cookie and SPI has no meaning, 0 <= SPI size <= 16. 509 * RFC2407 4.6.3.3, INITIAL-CONTACT is required to set to 16. 510 */ 511 if (type == ISAKMP_NTYPE_INITIAL_CONTACT) 512 spisiz = sizeof(isakmp_index); 513 else 514 spisiz = 0; 515 516 tlen = sizeof(*n) + spisiz; 517 if (data) 518 tlen += data->l; 519 payload = vmalloc(tlen); 520 if (payload == NULL) { 521 plog(LLV_ERROR, LOCATION, NULL, 522 "failed to get buffer to send.\n"); 523 return errno; 524 } 525 526 n = (struct isakmp_pl_n *)payload->v; 527 n->h.np = ISAKMP_NPTYPE_NONE; 528 n->h.len = htons(tlen); 529 n->doi = htonl(iph1->rmconf->doitype); 530 n->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX to be configurable ? */ 531 n->spi_size = spisiz; 532 n->type = htons(type); 533 if (spisiz) 534 memcpy(n + 1, &iph1->index, sizeof(isakmp_index)); 535 if (data) 536 memcpy((caddr_t)(n + 1) + spisiz, data->v, data->l); 537 538 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, iph1->flags); 539 vfree(payload); 540 541 return error; 542} 543 544/* 545 * send Notification payload (for IPsec SA) in Informational exchange 546 */ 547int 548isakmp_info_send_n2(iph2, type, data) 549 struct ph2handle *iph2; 550 int type; 551 vchar_t *data; 552{ 553 struct ph1handle *iph1 = iph2->ph1; 554 vchar_t *payload = NULL; 555 int tlen; 556 int error = 0; 557 struct isakmp_pl_n *n; 558 struct saproto *pr; 559 560 if (!iph2->approval) 561 return EINVAL; 562 563 pr = iph2->approval->head; 564 565 /* XXX must be get proper spi */ 566 tlen = sizeof(*n) + pr->spisize; 567 if (data) 568 tlen += data->l; 569 payload = vmalloc(tlen); 570 if (payload == NULL) { 571 plog(LLV_ERROR, LOCATION, NULL, 572 "failed to get buffer to send.\n"); 573 return errno; 574 } 575 576 n = (struct isakmp_pl_n *)payload->v; 577 n->h.np = ISAKMP_NPTYPE_NONE; 578 n->h.len = htons(tlen); 579 n->doi = htonl(IPSEC_DOI); /* IPSEC DOI (1) */ 580 n->proto_id = pr->proto_id; /* IPSEC AH/ESP/whatever*/ 581 n->spi_size = pr->spisize; 582 n->type = htons(type); 583 *(u_int32_t *)(n + 1) = pr->spi; 584 if (data) 585 memcpy((caddr_t)(n + 1) + pr->spisize, data->v, data->l); 586 587 iph2->flags |= ISAKMP_FLAG_E; /* XXX Should we do FLAG_A ? */ 588 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, iph2->flags); 589 vfree(payload); 590 591 return error; 592} 593 594/* 595 * send Information 596 * When ph1->skeyid_a == NULL, send message without encoding. 597 */ 598int 599isakmp_info_send_common(iph1, payload, np, flags) 600 struct ph1handle *iph1; 601 vchar_t *payload; 602 u_int32_t np; 603 int flags; 604{ 605 struct ph2handle *iph2 = NULL; 606 vchar_t *hash = NULL; 607 struct isakmp *isakmp; 608 struct isakmp_gen *gen; 609 char *p; 610 int tlen; 611 int error = -1; 612 613 /* add new entry to isakmp status table */ 614 iph2 = newph2(); 615 if (iph2 == NULL) 616 goto end; 617 618 iph2->dst = dupsaddr(iph1->remote); 619 iph2->src = dupsaddr(iph1->local); 620 switch (iph1->remote->sa_family) { 621 case AF_INET: 622 ((struct sockaddr_in *)iph2->dst)->sin_port = 0; 623 ((struct sockaddr_in *)iph2->src)->sin_port = 0; 624 break; 625#ifdef INET6 626 case AF_INET6: 627 ((struct sockaddr_in6 *)iph2->dst)->sin6_port = 0; 628 ((struct sockaddr_in6 *)iph2->src)->sin6_port = 0; 629 break; 630#endif 631 default: 632 plog(LLV_ERROR, LOCATION, NULL, 633 "invalid family: %d\n", iph1->remote->sa_family); 634 delph2(iph2); 635 goto end; 636 } 637 iph2->ph1 = iph1; 638 iph2->side = INITIATOR; 639 iph2->status = PHASE2ST_START; 640 iph2->msgid = isakmp_newmsgid2(iph1); 641 642 /* get IV and HASH(1) if skeyid_a was generated. */ 643 if (iph1->skeyid_a != NULL) { 644 iph2->ivm = oakley_newiv2(iph1, iph2->msgid); 645 if (iph2->ivm == NULL) { 646 delph2(iph2); 647 goto end; 648 } 649 650 /* generate HASH(1) */ 651 hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, payload); 652 if (hash == NULL) { 653 delph2(iph2); 654 goto end; 655 } 656 657 /* initialized total buffer length */ 658 tlen = hash->l; 659 tlen += sizeof(*gen); 660 } else { 661 /* IKE-SA is not established */ 662 hash = NULL; 663 664 /* initialized total buffer length */ 665 tlen = 0; 666 } 667 if ((flags & ISAKMP_FLAG_A) == 0) 668 iph2->flags = (hash == NULL ? 0 : ISAKMP_FLAG_E); 669 else 670 iph2->flags = (hash == NULL ? 0 : ISAKMP_FLAG_A); 671 672 insph2(iph2); 673 bindph12(iph1, iph2); 674 675 tlen += sizeof(*isakmp) + payload->l; 676 677 /* create buffer for isakmp payload */ 678 iph2->sendbuf = vmalloc(tlen); 679 if (iph2->sendbuf == NULL) { 680 plog(LLV_ERROR, LOCATION, NULL, 681 "failed to get buffer to send.\n"); 682 goto err; 683 } 684 685 /* create isakmp header */ 686 isakmp = (struct isakmp *)iph2->sendbuf->v; 687 memcpy(&isakmp->i_ck, &iph1->index.i_ck, sizeof(cookie_t)); 688 memcpy(&isakmp->r_ck, &iph1->index.r_ck, sizeof(cookie_t)); 689 isakmp->np = hash == NULL ? (np & 0xff) : ISAKMP_NPTYPE_HASH; 690 isakmp->v = iph1->version; 691 isakmp->etype = ISAKMP_ETYPE_INFO; 692 isakmp->flags = iph2->flags; 693 memcpy(&isakmp->msgid, &iph2->msgid, sizeof(isakmp->msgid)); 694 isakmp->len = htonl(tlen); 695 p = (char *)(isakmp + 1); 696 697 /* create HASH payload */ 698 if (hash != NULL) { 699 gen = (struct isakmp_gen *)p; 700 gen->np = np & 0xff; 701 gen->len = htons(sizeof(*gen) + hash->l); 702 p += sizeof(*gen); 703 memcpy(p, hash->v, hash->l); 704 p += hash->l; 705 } 706 707 /* add payload */ 708 memcpy(p, payload->v, payload->l); 709 p += payload->l; 710 711#ifdef HAVE_PRINT_ISAKMP_C 712 isakmp_printpacket(iph2->sendbuf, iph1->local, iph1->remote, 1); 713#endif 714 715 /* encoding */ 716 if (ISSET(isakmp->flags, ISAKMP_FLAG_E)) { 717 vchar_t *tmp; 718 719 tmp = oakley_do_encrypt(iph2->ph1, iph2->sendbuf, iph2->ivm->ive, 720 iph2->ivm->iv); 721 VPTRINIT(iph2->sendbuf); 722 if (tmp == NULL) 723 goto err; 724 iph2->sendbuf = tmp; 725 } 726 727 /* HDR*, HASH(1), N */ 728 if (isakmp_send(iph2->ph1, iph2->sendbuf) < 0) { 729 VPTRINIT(iph2->sendbuf); 730 goto err; 731 } 732 733 plog(LLV_DEBUG, LOCATION, NULL, 734 "sendto Information %s.\n", s_isakmp_nptype(np)); 735 736 /* 737 * don't resend notify message because peer can use Acknowledged 738 * Informational if peer requires the reply of the notify message. 739 */ 740 741 /* XXX If Acknowledged Informational required, don't delete ph2handle */ 742 error = 0; 743 VPTRINIT(iph2->sendbuf); 744 goto err; /* XXX */ 745 746end: 747 if (hash) 748 vfree(hash); 749 return error; 750 751err: 752 unbindph12(iph2); 753 remph2(iph2); 754 delph2(iph2); 755 goto end; 756} 757 758/* 759 * add a notify payload to buffer by reallocating buffer. 760 * If buf == NULL, the function only create a notify payload. 761 * 762 * XXX Which is SPI to be included, inbound or outbound ? 763 */ 764vchar_t * 765isakmp_add_pl_n(buf0, np_p, type, pr, data) 766 vchar_t *buf0; 767 u_int8_t **np_p; 768 int type; 769 struct saproto *pr; 770 vchar_t *data; 771{ 772 vchar_t *buf = NULL; 773 struct isakmp_pl_n *n; 774 int tlen; 775 int oldlen = 0; 776 777 if (*np_p) 778 **np_p = ISAKMP_NPTYPE_N; 779 780 tlen = sizeof(*n) + pr->spisize; 781 782 if (data) 783 tlen += data->l; 784 if (buf0) { 785 oldlen = buf0->l; 786 buf = vrealloc(buf0, buf0->l + tlen); 787 } else 788 buf = vmalloc(tlen); 789 if (!buf) { 790 plog(LLV_ERROR, LOCATION, NULL, 791 "failed to get a payload buffer.\n"); 792 return NULL; 793 } 794 795 n = (struct isakmp_pl_n *)(buf->v + oldlen); 796 n->h.np = ISAKMP_NPTYPE_NONE; 797 n->h.len = htons(tlen); 798 n->doi = htonl(IPSEC_DOI); /* IPSEC DOI (1) */ 799 n->proto_id = pr->proto_id; /* IPSEC AH/ESP/whatever*/ 800 n->spi_size = pr->spisize; 801 n->type = htons(type); 802 *(u_int32_t *)(n + 1) = pr->spi; /* XXX */ 803 if (data) 804 memcpy((caddr_t)(n + 1) + pr->spisize, data->v, data->l); 805 806 /* save the pointer of next payload type */ 807 *np_p = &n->h.np; 808 809 return buf; 810} 811 812/* 813 * handling to receive Notification payload 814 */ 815static int 816isakmp_info_recv_n(iph1, msg) 817 struct ph1handle *iph1; 818 vchar_t *msg; 819{ 820 struct isakmp_pl_n *n = NULL; 821 u_int type; 822 vchar_t *pbuf; 823 struct isakmp_parse_t *pa, *pap; 824 char *spi; 825 826 if (!(pbuf = isakmp_parse(msg))) 827 return -1; 828 pa = (struct isakmp_parse_t *)pbuf->v; 829 for (pap = pa; pap->type; pap++) { 830 switch (pap->type) { 831 case ISAKMP_NPTYPE_HASH: 832 /* do something here */ 833 break; 834 case ISAKMP_NPTYPE_NONCE: 835 /* send to ack */ 836 break; 837 case ISAKMP_NPTYPE_N: 838 n = (struct isakmp_pl_n *)pap->ptr; 839 break; 840 default: 841 vfree(pbuf); 842 return -1; 843 } 844 } 845 vfree(pbuf); 846 if (!n) 847 return -1; 848 849 type = ntohs(n->type); 850 851 switch (type) { 852 case ISAKMP_NTYPE_CONNECTED: 853 case ISAKMP_NTYPE_RESPONDER_LIFETIME: 854 case ISAKMP_NTYPE_REPLAY_STATUS: 855 /* do something */ 856 break; 857 case ISAKMP_NTYPE_INITIAL_CONTACT: 858 info_recv_initialcontact(iph1); 859 break; 860#ifdef ENABLE_DPD 861 case ISAKMP_NTYPE_R_U_THERE: 862 isakmp_info_recv_r_u(iph1, (struct isakmp_pl_ru *)n, 863 ((struct isakmp *)msg->v)->msgid); 864 break; 865 case ISAKMP_NTYPE_R_U_THERE_ACK: 866 isakmp_info_recv_r_u_ack(iph1, (struct isakmp_pl_ru *)n, 867 ((struct isakmp *)msg->v)->msgid); 868 break; 869#endif 870 871 default: 872 { 873 u_int32_t msgid = ((struct isakmp *)msg->v)->msgid; 874 struct ph2handle *iph2; 875 876 /* XXX there is a potential of dos attack. */ 877 if (msgid == 0) { 878 /* delete ph1 */ 879 plog(LLV_ERROR, LOCATION, iph1->remote, 880 "delete phase1 handle.\n"); 881 return -1; 882 } else { 883 iph2 = getph2bymsgid(iph1, msgid); 884 if (iph2 == NULL) { 885 plog(LLV_ERROR, LOCATION, iph1->remote, 886 "unknown notify message, " 887 "no phase2 handle found.\n"); 888 } else { 889 /* delete ph2 */ 890 unbindph12(iph2); 891 remph2(iph2); 892 delph2(iph2); 893 } 894 } 895 } 896 break; 897 } 898 899 /* get spi and allocate */ 900 if (ntohs(n->h.len) < sizeof(*n) + n->spi_size) { 901 plog(LLV_ERROR, LOCATION, iph1->remote, 902 "invalid spi_size in notification payload.\n"); 903 return -1; 904 } 905 spi = val2str((u_char *)(n + 1), n->spi_size); 906 907 plog(LLV_DEBUG, LOCATION, iph1->remote, 908 "notification message %d:%s, " 909 "doi=%d proto_id=%d spi=%s(size=%d).\n", 910 type, s_isakmp_notify_msg(type), 911 ntohl(n->doi), n->proto_id, spi, n->spi_size); 912 913 racoon_free(spi); 914 915 return(0); 916} 917 918static void 919purge_isakmp_spi(proto, spi, n) 920 int proto; 921 isakmp_index *spi; /*network byteorder*/ 922 size_t n; 923{ 924 struct ph1handle *iph1; 925 size_t i; 926 927 for (i = 0; i < n; i++) { 928 iph1 = getph1byindex(&spi[i]); 929 if (!iph1) 930 continue; 931 932 plog(LLV_INFO, LOCATION, NULL, 933 "purged ISAKMP-SA proto_id=%s spi=%s.\n", 934 s_ipsecdoi_proto(proto), 935 isakmp_pindex(&spi[i], 0)); 936 937 if (iph1->sce) 938 SCHED_KILL(iph1->sce); 939 iph1->status = PHASE1ST_EXPIRED; 940 iph1->sce = sched_new(1, isakmp_ph1delete_stub, iph1); 941 } 942} 943 944static void 945purge_ipsec_spi(dst0, proto, spi, n) 946 struct sockaddr *dst0; 947 int proto; 948 u_int32_t *spi; /*network byteorder*/ 949 size_t n; 950{ 951 vchar_t *buf = NULL; 952 struct sadb_msg *msg, *next, *end; 953 struct sadb_sa *sa; 954 struct sockaddr *src, *dst; 955 struct ph2handle *iph2; 956 size_t i; 957 caddr_t mhp[SADB_EXT_MAX + 1]; 958 959 buf = pfkey_dump_sadb(ipsecdoi2pfkey_proto(proto)); 960 if (buf == NULL) { 961 plog(LLV_DEBUG, LOCATION, NULL, 962 "pfkey_dump_sadb returned nothing.\n"); 963 return; 964 } 965 966 msg = (struct sadb_msg *)buf->v; 967 end = (struct sadb_msg *)(buf->v + buf->l); 968 969 while (msg < end) { 970 if ((msg->sadb_msg_len << 3) < sizeof(*msg)) 971 break; 972 next = (struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3)); 973 if (msg->sadb_msg_type != SADB_DUMP) { 974 msg = next; 975 continue; 976 } 977 978 if (pfkey_align(msg, mhp) || pfkey_check(mhp)) { 979 plog(LLV_ERROR, LOCATION, NULL, 980 "pfkey_check (%s)\n", ipsec_strerror()); 981 msg = next; 982 continue; 983 } 984 985 sa = (struct sadb_sa *)(mhp[SADB_EXT_SA]); 986 if (!sa 987 || !mhp[SADB_EXT_ADDRESS_SRC] 988 || !mhp[SADB_EXT_ADDRESS_DST]) { 989 msg = next; 990 continue; 991 } 992 src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]); 993 dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]); 994 995 if (sa->sadb_sa_state != SADB_SASTATE_MATURE 996 && sa->sadb_sa_state != SADB_SASTATE_DYING) { 997 msg = next; 998 continue; 999 } 1000 1001 /* XXX n^2 algorithm, inefficient */ 1002 1003 /* don't delete inbound SAs at the moment */ 1004 /* XXX should we remove SAs with opposite direction as well? */ 1005 if (cmpsaddrwop(dst0, dst)) { 1006 msg = next; 1007 continue; 1008 } 1009 1010 for (i = 0; i < n; i++) { 1011 plog(LLV_DEBUG, LOCATION, NULL, 1012 "check spi(packet)=%u spi(db)=%u.\n", 1013 ntohl(spi[i]), ntohl(sa->sadb_sa_spi)); 1014 if (spi[i] != sa->sadb_sa_spi) 1015 continue; 1016 1017 pfkey_send_delete(lcconf->sock_pfkey, 1018 msg->sadb_msg_satype, 1019 IPSEC_MODE_ANY, 1020 src, dst, sa->sadb_sa_spi); 1021 1022 /* 1023 * delete a relative phase 2 handler. 1024 * continue to process if no relative phase 2 handler 1025 * exists. 1026 */ 1027 iph2 = getph2bysaidx(src, dst, proto, spi[i]); 1028 if (iph2) { 1029 /* Delete the SPD entry if we generated it 1030 */ 1031 if (iph2->generated_spidx) { 1032 struct policyindex spidx; 1033 struct sockaddr_storage addr; 1034 u_int8_t pref; 1035 struct sockaddr *src = iph2->src; 1036 struct sockaddr *dst = iph2->dst; 1037 int error; 1038 int idi2type = 0;/* switch whether copy IDs into id[src,dst]. */ 1039 1040 plog(LLV_INFO, LOCATION, NULL, 1041 "generated policy, deleting it.\n"); 1042 1043 memset(&spidx, 0, sizeof(spidx)); 1044 iph2->spidx_gen = (caddr_t )&spidx; 1045 1046 /* make inbound policy */ 1047 iph2->src = dst; 1048 iph2->dst = src; 1049 spidx.dir = IPSEC_DIR_INBOUND; 1050 spidx.ul_proto = 0; 1051 1052 /* Note: code from get_proposal_r 1053 */ 1054 1055#define _XIDT(d) ((struct ipsecdoi_id_b *)(d)->v)->type 1056 1057 /* 1058 * make destination address in spidx from either ID payload 1059 * or phase 1 address into a address in spidx. 1060 */ 1061 if (iph2->id != NULL 1062 && (_XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR 1063 || _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR 1064 || _XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR_SUBNET 1065 || _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR_SUBNET)) { 1066 /* get a destination address of a policy */ 1067 error = ipsecdoi_id2sockaddr(iph2->id, 1068 (struct sockaddr *)&spidx.dst, 1069 &spidx.prefd, &spidx.ul_proto); 1070 if (error) 1071 goto purge; 1072 1073#ifdef INET6 1074 /* 1075 * get scopeid from the SA address. 1076 * note that the phase 1 source address is used as 1077 * a destination address to search for a inbound policy entry 1078 * because rcoon is responder. 1079 */ 1080 if (_XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR) { 1081 error = setscopeid((struct sockaddr *)&spidx.dst, 1082 iph2->src); 1083 if (error) 1084 goto purge; 1085 } 1086#endif 1087 1088 if (_XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR 1089 || _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR) 1090 idi2type = _XIDT(iph2->id); 1091 1092 } else { 1093 1094 plog(LLV_DEBUG, LOCATION, NULL, 1095 "get a destination address of SP index " 1096 "from phase1 address " 1097 "due to no ID payloads found " 1098 "OR because ID type is not address.\n"); 1099 1100 /* 1101 * copy the SOURCE address of IKE into the DESTINATION address 1102 * of the key to search the SPD because the direction of policy 1103 * is inbound. 1104 */ 1105 memcpy(&spidx.dst, iph2->src, sysdep_sa_len(iph2->src)); 1106 switch (spidx.dst.ss_family) { 1107 case AF_INET: 1108 spidx.prefd = sizeof(struct in_addr) << 3; 1109 break; 1110#ifdef INET6 1111 case AF_INET6: 1112 spidx.prefd = sizeof(struct in6_addr) << 3; 1113 break; 1114#endif 1115 default: 1116 spidx.prefd = 0; 1117 break; 1118 } 1119 } 1120 1121 /* make source address in spidx */ 1122 if (iph2->id_p != NULL 1123 && (_XIDT(iph2->id_p) == IPSECDOI_ID_IPV4_ADDR 1124 || _XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR 1125 || _XIDT(iph2->id_p) == IPSECDOI_ID_IPV4_ADDR_SUBNET 1126 || _XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR_SUBNET)) { 1127 /* get a source address of inbound SA */ 1128 error = ipsecdoi_id2sockaddr(iph2->id_p, 1129 (struct sockaddr *)&spidx.src, 1130 &spidx.prefs, &spidx.ul_proto); 1131 if (error) 1132 goto purge; 1133 1134#ifdef INET6 1135 /* 1136 * get scopeid from the SA address. 1137 * for more detail, see above of this function. 1138 */ 1139 if (_XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR) { 1140 error = setscopeid((struct sockaddr *)&spidx.src, 1141 iph2->dst); 1142 if (error) 1143 goto purge; 1144 } 1145#endif 1146 1147 /* make id[src,dst] if both ID types are IP address and same */ 1148 if (_XIDT(iph2->id_p) == idi2type 1149 && spidx.dst.ss_family == spidx.src.ss_family) { 1150 iph2->src_id = dupsaddr((struct sockaddr *)&spidx.dst); 1151 iph2->dst_id = dupsaddr((struct sockaddr *)&spidx.src); 1152 } 1153 1154 } else { 1155 plog(LLV_DEBUG, LOCATION, NULL, 1156 "get a source address of SP index " 1157 "from phase1 address " 1158 "due to no ID payloads found " 1159 "OR because ID type is not address.\n"); 1160 1161 /* see above comment. */ 1162 memcpy(&spidx.src, iph2->dst, sysdep_sa_len(iph2->dst)); 1163 switch (spidx.src.ss_family) { 1164 case AF_INET: 1165 spidx.prefs = sizeof(struct in_addr) << 3; 1166 break; 1167#ifdef INET6 1168 case AF_INET6: 1169 spidx.prefs = sizeof(struct in6_addr) << 3; 1170 break; 1171#endif 1172 default: 1173 spidx.prefs = 0; 1174 break; 1175 } 1176 } 1177 1178#undef _XIDT 1179 1180 plog(LLV_DEBUG, LOCATION, NULL, 1181 "get a src address from ID payload " 1182 "%s prefixlen=%u ul_proto=%u\n", 1183 saddr2str((struct sockaddr *)&spidx.src), 1184 spidx.prefs, spidx.ul_proto); 1185 plog(LLV_DEBUG, LOCATION, NULL, 1186 "get dst address from ID payload " 1187 "%s prefixlen=%u ul_proto=%u\n", 1188 saddr2str((struct sockaddr *)&spidx.dst), 1189 spidx.prefd, spidx.ul_proto); 1190 1191 /* 1192 * convert the ul_proto if it is 0 1193 * because 0 in ID payload means a wild card. 1194 */ 1195 if (spidx.ul_proto == 0) 1196 spidx.ul_proto = IPSEC_ULPROTO_ANY; 1197 1198#undef _XIDT 1199 1200 /* End of code from get_proposal_r 1201 */ 1202 1203 if (pk_sendspddelete(iph2) < 0) { 1204 plog(LLV_ERROR, LOCATION, NULL, 1205 "pfkey spddelete(inbound) failed.\n"); 1206 }else{ 1207 plog(LLV_DEBUG, LOCATION, NULL, 1208 "pfkey spddelete(inbound) sent.\n"); 1209 } 1210 1211#ifdef HAVE_POLICY_FWD 1212 /* make forward policy if required */ 1213 if (tunnel_mode_prop(iph2->approval)) { 1214 spidx.dir = IPSEC_DIR_FWD; 1215 if (pk_sendspddelete(iph2) < 0) { 1216 plog(LLV_ERROR, LOCATION, NULL, 1217 "pfkey spddelete(forward) failed.\n"); 1218 }else{ 1219 plog(LLV_DEBUG, LOCATION, NULL, 1220 "pfkey spddelete(forward) sent.\n"); 1221 } 1222 } 1223#endif 1224 1225 /* make outbound policy */ 1226 iph2->src = src; 1227 iph2->dst = dst; 1228 spidx.dir = IPSEC_DIR_OUTBOUND; 1229 addr = spidx.src; 1230 spidx.src = spidx.dst; 1231 spidx.dst = addr; 1232 pref = spidx.prefs; 1233 spidx.prefs = spidx.prefd; 1234 spidx.prefd = pref; 1235 1236 if (pk_sendspddelete(iph2) < 0) { 1237 plog(LLV_ERROR, LOCATION, NULL, 1238 "pfkey spddelete(outbound) failed.\n"); 1239 }else{ 1240 plog(LLV_DEBUG, LOCATION, NULL, 1241 "pfkey spddelete(outbound) sent.\n"); 1242 } 1243 purge: 1244 iph2->spidx_gen=NULL; 1245 } 1246 1247 unbindph12(iph2); 1248 remph2(iph2); 1249 delph2(iph2); 1250 } 1251 1252 plog(LLV_INFO, LOCATION, NULL, 1253 "purged IPsec-SA proto_id=%s spi=%u.\n", 1254 s_ipsecdoi_proto(proto), 1255 ntohl(spi[i])); 1256 } 1257 1258 msg = next; 1259 } 1260 1261 if (buf) 1262 vfree(buf); 1263} 1264 1265/* 1266 * delete all phase2 sa relatived to the destination address. 1267 * Don't delete Phase 1 handlers on INITIAL-CONTACT, and don't ignore 1268 * an INITIAL-CONTACT if we have contacted the peer. This matches the 1269 * Sun IKE behavior, and makes rekeying work much better when the peer 1270 * restarts. 1271 */ 1272static void 1273info_recv_initialcontact(iph1) 1274 struct ph1handle *iph1; 1275{ 1276 vchar_t *buf = NULL; 1277 struct sadb_msg *msg, *next, *end; 1278 struct sadb_sa *sa; 1279 struct sockaddr *src, *dst; 1280 caddr_t mhp[SADB_EXT_MAX + 1]; 1281 int proto_id, i; 1282 struct ph2handle *iph2; 1283#if 0 1284 char *loc, *rem; 1285#endif 1286 1287 if (f_local) 1288 return; 1289 1290#if 0 1291 loc = strdup(saddrwop2str(iph1->local)); 1292 rem = strdup(saddrwop2str(iph1->remote)); 1293 1294 /* 1295 * Purge all IPSEC-SAs for the peer. We can do this 1296 * the easy way (using a PF_KEY SADB_DELETE extension) 1297 * or we can do it the hard way. 1298 */ 1299 for (i = 0; i < pfkey_nsatypes; i++) { 1300 proto_id = pfkey2ipsecdoi_proto(pfkey_satypes[i].ps_satype); 1301 1302 plog(LLV_INFO, LOCATION, NULL, 1303 "purging %s SAs for %s -> %s\n", 1304 pfkey_satypes[i].ps_name, loc, rem); 1305 if (pfkey_send_delete_all(lcconf->sock_pfkey, 1306 pfkey_satypes[i].ps_satype, IPSEC_MODE_ANY, 1307 iph1->local, iph1->remote) == -1) { 1308 plog(LLV_ERROR, LOCATION, NULL, 1309 "delete_all %s -> %s failed for %s (%s)\n", 1310 loc, rem, 1311 pfkey_satypes[i].ps_name, ipsec_strerror()); 1312 goto the_hard_way; 1313 } 1314 1315 deleteallph2(iph1->local, iph1->remote, proto_id); 1316 1317 plog(LLV_INFO, LOCATION, NULL, 1318 "purging %s SAs for %s -> %s\n", 1319 pfkey_satypes[i].ps_name, rem, loc); 1320 if (pfkey_send_delete_all(lcconf->sock_pfkey, 1321 pfkey_satypes[i].ps_satype, IPSEC_MODE_ANY, 1322 iph1->remote, iph1->local) == -1) { 1323 plog(LLV_ERROR, LOCATION, NULL, 1324 "delete_all %s -> %s failed for %s (%s)\n", 1325 rem, loc, 1326 pfkey_satypes[i].ps_name, ipsec_strerror()); 1327 goto the_hard_way; 1328 } 1329 1330 deleteallph2(iph1->remote, iph1->local, proto_id); 1331 } 1332 1333 racoon_free(loc); 1334 racoon_free(rem); 1335 return; 1336 1337 the_hard_way: 1338 racoon_free(loc); 1339 racoon_free(rem); 1340#endif 1341 1342 buf = pfkey_dump_sadb(SADB_SATYPE_UNSPEC); 1343 if (buf == NULL) { 1344 plog(LLV_DEBUG, LOCATION, NULL, 1345 "pfkey_dump_sadb returned nothing.\n"); 1346 return; 1347 } 1348 1349 msg = (struct sadb_msg *)buf->v; 1350 end = (struct sadb_msg *)(buf->v + buf->l); 1351 1352 while (msg < end) { 1353 if ((msg->sadb_msg_len << 3) < sizeof(*msg)) 1354 break; 1355 next = (struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3)); 1356 if (msg->sadb_msg_type != SADB_DUMP) { 1357 msg = next; 1358 continue; 1359 } 1360 1361 if (pfkey_align(msg, mhp) || pfkey_check(mhp)) { 1362 plog(LLV_ERROR, LOCATION, NULL, 1363 "pfkey_check (%s)\n", ipsec_strerror()); 1364 msg = next; 1365 continue; 1366 } 1367 1368 if (mhp[SADB_EXT_SA] == NULL 1369 || mhp[SADB_EXT_ADDRESS_SRC] == NULL 1370 || mhp[SADB_EXT_ADDRESS_DST] == NULL) { 1371 msg = next; 1372 continue; 1373 } 1374 sa = (struct sadb_sa *)mhp[SADB_EXT_SA]; 1375 src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]); 1376 dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]); 1377 1378 if (sa->sadb_sa_state != SADB_SASTATE_MATURE 1379 && sa->sadb_sa_state != SADB_SASTATE_DYING) { 1380 msg = next; 1381 continue; 1382 } 1383 1384 /* 1385 * RFC2407 4.6.3.3 INITIAL-CONTACT is the message that 1386 * announces the sender of the message was rebooted. 1387 * it is interpreted to delete all SAs which source address 1388 * is the sender of the message. 1389 * racoon only deletes SA which is matched both the 1390 * source address and the destination accress. 1391 */ 1392 if (cmpsaddrwop(iph1->local, src) == 0 && 1393 cmpsaddrwop(iph1->remote, dst) == 0) 1394 ; 1395 else if (cmpsaddrwop(iph1->remote, src) == 0 && 1396 cmpsaddrwop(iph1->local, dst) == 0) 1397 ; 1398 else { 1399 msg = next; 1400 continue; 1401 } 1402 1403 /* 1404 * Make sure this is an SATYPE that we manage. 1405 * This is gross; too bad we couldn't do it the 1406 * easy way. 1407 */ 1408 for (i = 0; i < pfkey_nsatypes; i++) { 1409 if (pfkey_satypes[i].ps_satype == 1410 msg->sadb_msg_satype) 1411 break; 1412 } 1413 if (i == pfkey_nsatypes) { 1414 msg = next; 1415 continue; 1416 } 1417 1418 plog(LLV_INFO, LOCATION, NULL, 1419 "purging spi=%u.\n", ntohl(sa->sadb_sa_spi)); 1420 pfkey_send_delete(lcconf->sock_pfkey, 1421 msg->sadb_msg_satype, 1422 IPSEC_MODE_ANY, src, dst, sa->sadb_sa_spi); 1423 1424 /* 1425 * delete a relative phase 2 handler. 1426 * continue to process if no relative phase 2 handler 1427 * exists. 1428 */ 1429 proto_id = pfkey2ipsecdoi_proto(msg->sadb_msg_satype); 1430 iph2 = getph2bysaidx(src, dst, proto_id, sa->sadb_sa_spi); 1431 if (iph2) { 1432 unbindph12(iph2); 1433 remph2(iph2); 1434 delph2(iph2); 1435 } 1436 1437 msg = next; 1438 } 1439 1440 vfree(buf); 1441} 1442 1443/* 1444 * handling to receive Deletion payload 1445 */ 1446static int 1447isakmp_info_recv_d(iph1, msg) 1448 struct ph1handle *iph1; 1449 vchar_t *msg; 1450{ 1451 struct isakmp_pl_d *d; 1452 int tlen, num_spi; 1453 vchar_t *pbuf; 1454 struct isakmp_parse_t *pa, *pap; 1455 int protected = 0; 1456 union { 1457 u_int32_t spi32; 1458 u_int16_t spi16[2]; 1459 } spi; 1460 1461 /* validate the type of next payload */ 1462 if (!(pbuf = isakmp_parse(msg))) 1463 return -1; 1464 pa = (struct isakmp_parse_t *)pbuf->v; 1465 for (pap = pa; pap->type; pap++) { 1466 switch (pap->type) { 1467 case ISAKMP_NPTYPE_D: 1468 break; 1469 case ISAKMP_NPTYPE_HASH: 1470 if (pap == pa) { 1471 protected++; 1472 break; 1473 } 1474 plog(LLV_ERROR, LOCATION, iph1->remote, 1475 "received next payload type %d " 1476 "in wrong place (must be the first payload).\n", 1477 pap->type); 1478 vfree(pbuf); 1479 return -1; 1480 default: 1481 /* don't send information, see isakmp_ident_r1() */ 1482 plog(LLV_ERROR, LOCATION, iph1->remote, 1483 "reject the packet, " 1484 "received unexpecting payload type %d.\n", 1485 pap->type); 1486 vfree(pbuf); 1487 return 0; 1488 } 1489 } 1490 1491 if (!protected) { 1492 plog(LLV_ERROR, LOCATION, NULL, 1493 "delete payload is not proteted, " 1494 "ignored.\n"); 1495 vfree(pbuf); 1496 return -1; 1497 } 1498 1499 /* process a delete payload */ 1500 for (pap = pa; pap->type; pap++) { 1501 if (pap->type != ISAKMP_NPTYPE_D) 1502 continue; 1503 1504 d = (struct isakmp_pl_d *)pap->ptr; 1505 1506 if (ntohl(d->doi) != IPSEC_DOI) { 1507 plog(LLV_ERROR, LOCATION, iph1->remote, 1508 "delete payload with invalid doi:%d.\n", 1509 ntohl(d->doi)); 1510#ifdef ENABLE_HYBRID 1511 /* 1512 * At deconnexion time, Cisco VPN client does this 1513 * with a zero DOI. Don't give up in that situation. 1514 */ 1515 if (((iph1->mode_cfg->flags & 1516 ISAKMP_CFG_VENDORID_UNITY) == 0) || (d->doi != 0)) 1517 continue; 1518#else 1519 continue; 1520#endif 1521 } 1522 1523 num_spi = ntohs(d->num_spi); 1524 tlen = ntohs(d->h.len) - sizeof(struct isakmp_pl_d); 1525 1526 if (tlen != num_spi * d->spi_size) { 1527 plog(LLV_ERROR, LOCATION, iph1->remote, 1528 "deletion payload with invalid length.\n"); 1529 vfree(pbuf); 1530 return -1; 1531 } 1532 1533 switch (d->proto_id) { 1534 case IPSECDOI_PROTO_ISAKMP: 1535 if (d->spi_size != sizeof(isakmp_index)) { 1536 plog(LLV_ERROR, LOCATION, iph1->remote, 1537 "delete payload with strange spi " 1538 "size %d(proto_id:%d)\n", 1539 d->spi_size, d->proto_id); 1540 continue; 1541 } 1542 purge_isakmp_spi(d->proto_id, 1543 (isakmp_index *)(d + 1), num_spi); 1544 break; 1545 1546 case IPSECDOI_PROTO_IPSEC_AH: 1547 case IPSECDOI_PROTO_IPSEC_ESP: 1548 if (d->spi_size != sizeof(u_int32_t)) { 1549 plog(LLV_ERROR, LOCATION, iph1->remote, 1550 "delete payload with strange spi " 1551 "size %d(proto_id:%d)\n", 1552 d->spi_size, d->proto_id); 1553 continue; 1554 } 1555 EVT_PUSH(iph1->local, iph1->remote, 1556 EVTT_PEER_DELETE, NULL); 1557 purge_ipsec_spi(iph1->remote, d->proto_id, 1558 (u_int32_t *)(d + 1), num_spi); 1559 break; 1560 1561 case IPSECDOI_PROTO_IPCOMP: 1562 /* need to handle both 16bit/32bit SPI */ 1563 memset(&spi, 0, sizeof(spi)); 1564 if (d->spi_size == sizeof(spi.spi16[1])) { 1565 memcpy(&spi.spi16[1], d + 1, 1566 sizeof(spi.spi16[1])); 1567 } else if (d->spi_size == sizeof(spi.spi32)) 1568 memcpy(&spi.spi32, d + 1, sizeof(spi.spi32)); 1569 else { 1570 plog(LLV_ERROR, LOCATION, iph1->remote, 1571 "delete payload with strange spi " 1572 "size %d(proto_id:%d)\n", 1573 d->spi_size, d->proto_id); 1574 continue; 1575 } 1576 purge_ipsec_spi(iph1->remote, d->proto_id, 1577 &spi.spi32, num_spi); 1578 break; 1579 1580 default: 1581 plog(LLV_ERROR, LOCATION, iph1->remote, 1582 "deletion message received, " 1583 "invalid proto_id: %d\n", 1584 d->proto_id); 1585 continue; 1586 } 1587 1588 plog(LLV_DEBUG, LOCATION, NULL, "purged SAs.\n"); 1589 } 1590 1591 vfree(pbuf); 1592 1593 return 0; 1594} 1595 1596void 1597isakmp_check_notify(gen, iph1) 1598 struct isakmp_gen *gen; /* points to Notify payload */ 1599 struct ph1handle *iph1; 1600{ 1601 struct isakmp_pl_n *notify = (struct isakmp_pl_n *)gen; 1602 1603 plog(LLV_DEBUG, LOCATION, iph1->remote, 1604 "Notify Message received\n"); 1605 1606 switch (ntohs(notify->type)) { 1607 case ISAKMP_NTYPE_CONNECTED: 1608 plog(LLV_WARNING, LOCATION, iph1->remote, 1609 "ignore CONNECTED notification.\n"); 1610 break; 1611 case ISAKMP_NTYPE_RESPONDER_LIFETIME: 1612 plog(LLV_WARNING, LOCATION, iph1->remote, 1613 "ignore RESPONDER-LIFETIME notification.\n"); 1614 break; 1615 case ISAKMP_NTYPE_REPLAY_STATUS: 1616 plog(LLV_WARNING, LOCATION, iph1->remote, 1617 "ignore REPLAY-STATUS notification.\n"); 1618 break; 1619 case ISAKMP_NTYPE_INITIAL_CONTACT: 1620 plog(LLV_WARNING, LOCATION, iph1->remote, 1621 "ignore INITIAL-CONTACT notification, " 1622 "because it is only accepted after phase1.\n"); 1623 break; 1624 case ISAKMP_NTYPE_HEARTBEAT: 1625 plog(LLV_WARNING, LOCATION, iph1->remote, 1626 "ignore HEARTBEAT notification\n"); 1627 break; 1628 default: 1629 isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL); 1630 plog(LLV_ERROR, LOCATION, iph1->remote, 1631 "received unknown notification type %u.\n", 1632 ntohs(notify->type)); 1633 } 1634 1635 return; 1636} 1637 1638 1639#ifdef ENABLE_DPD 1640static int 1641isakmp_info_recv_r_u (iph1, ru, msgid) 1642 struct ph1handle *iph1; 1643 struct isakmp_pl_ru *ru; 1644 u_int32_t msgid; 1645{ 1646 struct isakmp_pl_ru *ru_ack; 1647 vchar_t *payload = NULL; 1648 int tlen; 1649 int error = 0; 1650 1651 plog(LLV_DEBUG, LOCATION, iph1->remote, 1652 "DPD R-U-There received\n"); 1653 1654 /* XXX should compare cookies with iph1->index? 1655 Or is this already done by calling function? */ 1656 tlen = sizeof(*ru_ack); 1657 payload = vmalloc(tlen); 1658 if (payload == NULL) { 1659 plog(LLV_ERROR, LOCATION, NULL, 1660 "failed to get buffer to send.\n"); 1661 return errno; 1662 } 1663 1664 ru_ack = (struct isakmp_pl_ru *)payload->v; 1665 ru_ack->h.np = ISAKMP_NPTYPE_NONE; 1666 ru_ack->h.len = htons(tlen); 1667 ru_ack->doi = htonl(IPSEC_DOI); 1668 ru_ack->type = htons(ISAKMP_NTYPE_R_U_THERE_ACK); 1669 ru_ack->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX ? */ 1670 ru_ack->spi_size = sizeof(isakmp_index); 1671 memcpy(ru_ack->i_ck, ru->i_ck, sizeof(cookie_t)); 1672 memcpy(ru_ack->r_ck, ru->r_ck, sizeof(cookie_t)); 1673 ru_ack->data = ru->data; 1674 1675 /* XXX Should we do FLAG_A ? */ 1676 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 1677 ISAKMP_FLAG_E); 1678 vfree(payload); 1679 1680 plog(LLV_DEBUG, LOCATION, NULL, "received a valid R-U-THERE, ACK sent\n"); 1681 1682 /* Should we mark tunnel as active ? */ 1683 return error; 1684} 1685 1686static int 1687isakmp_info_recv_r_u_ack (iph1, ru, msgid) 1688 struct ph1handle *iph1; 1689 struct isakmp_pl_ru *ru; 1690 u_int32_t msgid; 1691{ 1692 1693 plog(LLV_DEBUG, LOCATION, iph1->remote, 1694 "DPD R-U-There-Ack received\n"); 1695 1696 /* XXX Maintain window of acceptable sequence numbers ? 1697 * => ru->data <= iph2->dpd_seq && 1698 * ru->data >= iph2->dpd_seq - iph2->dpd_fails ? */ 1699 if (ntohl(ru->data) != iph1->dpd_seq-1) { 1700 plog(LLV_ERROR, LOCATION, iph1->remote, 1701 "Wrong DPD sequence number (%d, %d expected).\n", 1702 ntohl(ru->data), iph1->dpd_seq-1); 1703 return 0; 1704 } 1705 1706 if (memcmp(ru->i_ck, iph1->index.i_ck, sizeof(cookie_t)) || 1707 memcmp(ru->r_ck, iph1->index.r_ck, sizeof(cookie_t))) { 1708 plog(LLV_ERROR, LOCATION, iph1->remote, 1709 "Cookie mismatch in DPD ACK!.\n"); 1710 return 0; 1711 } 1712 1713 iph1->dpd_fails = 0; 1714 1715 /* Useless ??? */ 1716 iph1->dpd_lastack = time(NULL); 1717 1718 if (iph1->dpd_r_u != NULL) 1719 SCHED_KILL(iph1->dpd_r_u); 1720 1721 isakmp_sched_r_u(iph1, 0); 1722 1723 plog(LLV_DEBUG, LOCATION, NULL, "received an R-U-THERE-ACK\n"); 1724 1725 return 0; 1726} 1727 1728 1729 1730static void 1731purge_remote(iph1) 1732 struct ph1handle *iph1; 1733{ 1734 vchar_t *buf = NULL; 1735 struct sadb_msg *msg, *next, *end; 1736 struct sadb_sa *sa; 1737 struct sockaddr *src, *dst; 1738 caddr_t mhp[SADB_EXT_MAX + 1]; 1739 1740 /* Delete all phase2 SAs */ 1741 buf = pfkey_dump_sadb(SADB_SATYPE_UNSPEC); 1742 if (buf == NULL) { 1743 plog(LLV_DEBUG, LOCATION, NULL, 1744 "pfkey_dump_sadb returned nothing.\n"); 1745 return; 1746 } 1747 1748 msg = (struct sadb_msg *)buf->v; 1749 end = (struct sadb_msg *)(buf->v + buf->l); 1750 1751 while (msg < end) { 1752 if ((msg->sadb_msg_len << 3) < sizeof(*msg)) 1753 break; 1754 next = (struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3)); 1755 if (msg->sadb_msg_type != SADB_DUMP) { 1756 msg = next; 1757 continue; 1758 } 1759 1760 if (pfkey_align(msg, mhp) || pfkey_check(mhp)) { 1761 plog(LLV_ERROR, LOCATION, NULL, 1762 "pfkey_check (%s)\n", ipsec_strerror()); 1763 msg = next; 1764 continue; 1765 } 1766 1767 sa = (struct sadb_sa *)(mhp[SADB_EXT_SA]); 1768 if (!sa || 1769 !mhp[SADB_EXT_ADDRESS_SRC] || 1770 !mhp[SADB_EXT_ADDRESS_DST]) { 1771 msg = next; 1772 continue; 1773 } 1774 src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]); 1775 dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]); 1776 1777 if (sa->sadb_sa_state != SADB_SASTATE_MATURE && 1778 sa->sadb_sa_state != SADB_SASTATE_DYING) { 1779 msg = next; 1780 continue; 1781 } 1782 1783 /* delete in/outbound SAs */ 1784 if (cmpsaddrwop(iph1->remote, dst) && 1785 cmpsaddrwop(iph1->remote, src)) { 1786 msg = next; 1787 continue; 1788 } 1789 1790 pfkey_send_delete(lcconf->sock_pfkey, 1791 msg->sadb_msg_satype, 1792 IPSEC_MODE_ANY, 1793 src, dst, sa->sadb_sa_spi); 1794 1795 plog(LLV_INFO, LOCATION, NULL, 1796 "purged IPsec-SA spi=%u.\n", 1797 ntohl(sa->sadb_sa_spi)); 1798 1799 msg = next; 1800 } 1801 1802 if (buf) 1803 vfree(buf); 1804 1805 /* Mark the phase1 handler as EXPIRED */ 1806 plog(LLV_INFO, LOCATION, NULL, 1807 "purged ISAKMP-SA spi=%s.\n", 1808 isakmp_pindex(&(iph1->index), iph1->msgid)); 1809 1810 if (iph1->sce) 1811 SCHED_KILL(iph1->sce); 1812 1813 iph1->status = PHASE1ST_EXPIRED; 1814 iph1->sce = sched_new(1, isakmp_ph1delete_stub, iph1); 1815} 1816 1817/* 1818 * send Delete payload (for ISAKMP SA) in Informational exchange. 1819 */ 1820static void 1821isakmp_info_send_r_u(arg) 1822 void *arg; 1823{ 1824 struct ph1handle *iph1 = arg; 1825 1826 /* create R-U-THERE payload */ 1827 struct isakmp_pl_ru *ru; 1828 vchar_t *payload = NULL; 1829 int tlen; 1830 int error = 0; 1831 1832 plog(LLV_DEBUG, LOCATION, iph1->remote, "DPD monitoring....\n"); 1833 1834 if (iph1->dpd_fails >= iph1->rmconf->dpd_maxfails) { 1835 EVT_PUSH(iph1->local, iph1->remote, EVTT_DPD_TIMEOUT, NULL); 1836 purge_remote(iph1); 1837 plog(LLV_DEBUG, LOCATION, iph1->remote, 1838 "DPD: remote seems to be dead\n"); 1839 1840 /* Do not reschedule here: phase1 is deleted, 1841 * DPD will be reactivated when a new ph1 will be negociated 1842 */ 1843 return; 1844 } 1845 1846 /* TODO: check recent activity to avoid useless sends... */ 1847 1848 /* XXX: why do we have a NULL LIST_FIRST even when a Phase2 exists ??? */ 1849#if 0 1850 if (LIST_FIRST(&iph1->ph2tree) == NULL){ 1851 /* XXX: No Ph2 => no need to test ph1 ? 1852 */ 1853 /* Reschedule the r_u_there.... 1854 XXX: reschedule when a new ph2 ? 1855 */ 1856 isakmp_sched_r_u(iph1, 0); 1857 plog(LLV_DEBUG, LOCATION, iph1->remote, 1858 "no phase2 handler, rescheduling send_r_u (%d).\n", iph1->rmconf->dpd_interval); 1859 return 0; 1860 } 1861#endif 1862 1863 tlen = sizeof(*ru); 1864 payload = vmalloc(tlen); 1865 if (payload == NULL) { 1866 plog(LLV_ERROR, LOCATION, NULL, 1867 "failed to get buffer for payload.\n"); 1868 return; 1869 } 1870 ru = (struct isakmp_pl_ru *)payload->v; 1871 ru->h.np = ISAKMP_NPTYPE_NONE; 1872 ru->h.len = htons(tlen); 1873 ru->doi = htonl(IPSEC_DOI); 1874 ru->type = htons(ISAKMP_NTYPE_R_U_THERE); 1875 ru->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX ?*/ 1876 ru->spi_size = sizeof(isakmp_index); 1877 1878 memcpy(ru->i_ck, iph1->index.i_ck, sizeof(cookie_t)); 1879 memcpy(ru->r_ck, iph1->index.r_ck, sizeof(cookie_t)); 1880 1881 if (iph1->dpd_seq == 0){ 1882 /* generate a random seq which is not too big */ 1883 srand(time(NULL)); 1884 iph1->dpd_seq = rand() & 0x0fff; 1885 } 1886 1887 ru->data = htonl(iph1->dpd_seq); 1888 1889 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 0); 1890 vfree(payload); 1891 1892 plog(LLV_DEBUG, LOCATION, iph1->remote, 1893 "DPD R-U-There sent (%d)\n", error); 1894 1895 /* will be decreased if ACK received... */ 1896 iph1->dpd_fails++; 1897 1898 /* XXX should be increased only when ACKed ? */ 1899 iph1->dpd_seq++; 1900 1901 /* Reschedule the r_u_there with a short delay, 1902 * will be deleted/rescheduled if ACK received before */ 1903 isakmp_sched_r_u(iph1, 1); 1904 1905 plog(LLV_DEBUG, LOCATION, iph1->remote, 1906 "rescheduling send_r_u (%d).\n", iph1->rmconf->dpd_retry); 1907} 1908 1909/* Schedule a new R-U-THERE */ 1910int 1911isakmp_sched_r_u(iph1, retry) 1912 struct ph1handle *iph1; 1913 int retry; 1914{ 1915 if(iph1 == NULL || 1916 iph1->rmconf == NULL) 1917 return 1; 1918 1919 1920 if(iph1->dpd_support == 0 || 1921 iph1->rmconf->dpd_interval == 0) 1922 return 0; 1923 1924 if(retry) 1925 iph1->dpd_r_u = sched_new(iph1->rmconf->dpd_retry, 1926 isakmp_info_send_r_u, iph1); 1927 else 1928 sched_new(iph1->rmconf->dpd_interval, 1929 isakmp_info_send_r_u, iph1); 1930 1931 return 0; 1932} 1933#endif 1934 1935 1936#ifdef INET6 1937/* XXX copy of setscopeid from isakmp_quick.c 1938 */ 1939static u_int32_t 1940setscopeid(sp_addr0, sa_addr0) 1941 struct sockaddr *sp_addr0, *sa_addr0; 1942{ 1943 struct sockaddr_in6 *sp_addr, *sa_addr; 1944 1945 sp_addr = (struct sockaddr_in6 *)sp_addr0; 1946 sa_addr = (struct sockaddr_in6 *)sa_addr0; 1947 1948 if (!IN6_IS_ADDR_LINKLOCAL(&sp_addr->sin6_addr) 1949 && !IN6_IS_ADDR_SITELOCAL(&sp_addr->sin6_addr) 1950 && !IN6_IS_ADDR_MULTICAST(&sp_addr->sin6_addr)) 1951 return 0; 1952 1953 /* this check should not be here ? */ 1954 if (sa_addr->sin6_family != AF_INET6) { 1955 plog(LLV_ERROR, LOCATION, NULL, 1956 "can't get scope ID: family mismatch\n"); 1957 return -1; 1958 } 1959 1960 if (!IN6_IS_ADDR_LINKLOCAL(&sa_addr->sin6_addr)) { 1961 plog(LLV_ERROR, LOCATION, NULL, 1962 "scope ID is not supported except of lladdr.\n"); 1963 return -1; 1964 } 1965 1966 sp_addr->sin6_scope_id = sa_addr->sin6_scope_id; 1967 1968 return 0; 1969} 1970#endif 1971