isakmp_inf.c revision 1.26.2.1
1/* $NetBSD: isakmp_inf.c,v 1.26.2.1 2008/05/18 12:28:48 yamt Exp $ */ 2 3/* Id: isakmp_inf.c,v 1.44 2006/05/06 20:45:52 manubsd Exp */ 4 5/* 6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. Neither the name of the project nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34#include "config.h" 35 36#include <sys/types.h> 37#include <sys/param.h> 38#include <sys/socket.h> 39 40#include <net/pfkeyv2.h> 41#include <netinet/in.h> 42#include <sys/queue.h> 43#include PATH_IPSEC_H 44 45#include <stdlib.h> 46#include <stdio.h> 47#include <string.h> 48#include <errno.h> 49#if TIME_WITH_SYS_TIME 50# include <sys/time.h> 51# include <time.h> 52#else 53# if HAVE_SYS_TIME_H 54# include <sys/time.h> 55# else 56# include <time.h> 57# endif 58#endif 59#ifdef ENABLE_HYBRID 60#include <resolv.h> 61#endif 62 63#include "libpfkey.h" 64 65#include "var.h" 66#include "vmbuf.h" 67#include "schedule.h" 68#include "str2val.h" 69#include "misc.h" 70#include "plog.h" 71#include "debug.h" 72 73#include "localconf.h" 74#include "remoteconf.h" 75#include "sockmisc.h" 76#include "handler.h" 77#include "policy.h" 78#include "proposal.h" 79#include "isakmp_var.h" 80#include "evt.h" 81#include "isakmp.h" 82#ifdef ENABLE_HYBRID 83#include "isakmp_xauth.h" 84#include "isakmp_unity.h" 85#include "isakmp_cfg.h" 86#endif 87#include "isakmp_inf.h" 88#include "oakley.h" 89#include "ipsec_doi.h" 90#include "crypto_openssl.h" 91#include "pfkey.h" 92#include "policy.h" 93#include "algorithm.h" 94#include "proposal.h" 95#include "admin.h" 96#include "strnames.h" 97#ifdef ENABLE_NATT 98#include "nattraversal.h" 99#endif 100 101/* information exchange */ 102static int isakmp_info_recv_n (struct ph1handle *, struct isakmp_pl_n *, u_int32_t, int); 103static int isakmp_info_recv_d (struct ph1handle *, struct isakmp_pl_d *, u_int32_t, int); 104 105#ifdef ENABLE_DPD 106static int isakmp_info_recv_r_u __P((struct ph1handle *, 107 struct isakmp_pl_ru *, u_int32_t)); 108static int isakmp_info_recv_r_u_ack __P((struct ph1handle *, 109 struct isakmp_pl_ru *, u_int32_t)); 110static void isakmp_info_send_r_u __P((void *)); 111#endif 112 113static void purge_isakmp_spi __P((int, isakmp_index *, size_t)); 114static void info_recv_initialcontact __P((struct ph1handle *)); 115 116/* %%% 117 * Information Exchange 118 */ 119/* 120 * receive Information 121 */ 122int 123isakmp_info_recv(iph1, msg0) 124 struct ph1handle *iph1; 125 vchar_t *msg0; 126{ 127 vchar_t *msg = NULL; 128 vchar_t *pbuf = NULL; 129 u_int32_t msgid = 0; 130 int error = -1; 131 struct isakmp *isakmp; 132 struct isakmp_gen *gen; 133 struct isakmp_parse_t *pa, *pap; 134 void *p; 135 vchar_t *hash, *payload; 136 struct isakmp_gen *nd; 137 u_int8_t np; 138 int encrypted; 139 int flag; 140 141 plog(LLV_DEBUG, LOCATION, NULL, "receive Information.\n"); 142 143 encrypted = ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E); 144 msgid = ((struct isakmp *)msg0->v)->msgid; 145 146 /* Use new IV to decrypt Informational message. */ 147 if (encrypted) { 148 struct isakmp_ivm *ivm; 149 150 if (iph1->ivm == NULL) { 151 plog(LLV_ERROR, LOCATION, NULL, "iph1->ivm == NULL\n"); 152 return -1; 153 } 154 155 /* compute IV */ 156 ivm = oakley_newiv2(iph1, ((struct isakmp *)msg0->v)->msgid); 157 if (ivm == NULL) 158 return -1; 159 160 msg = oakley_do_decrypt(iph1, msg0, ivm->iv, ivm->ive); 161 oakley_delivm(ivm); 162 if (msg == NULL) 163 return -1; 164 165 } else 166 msg = vdup(msg0); 167 168 /* Safety check */ 169 if (msg->l < sizeof(*isakmp) + sizeof(*gen)) { 170 plog(LLV_ERROR, LOCATION, NULL, 171 "ignore information because the " 172 "message is way too short - %d byte(s).\n", 173 (int)msg->l); 174 goto end; 175 } 176 177 isakmp = (struct isakmp *)msg->v; 178 gen = (struct isakmp_gen *)((caddr_t)isakmp + sizeof(struct isakmp)); 179 np = gen->np; 180 181 if (encrypted) { 182 if (isakmp->np != ISAKMP_NPTYPE_HASH) { 183 plog(LLV_ERROR, LOCATION, NULL, 184 "ignore information because the" 185 "message has no hash payload.\n"); 186 goto end; 187 } 188 189 if (iph1->status != PHASE1ST_ESTABLISHED) { 190 plog(LLV_ERROR, LOCATION, NULL, 191 "ignore information because ISAKMP-SA" 192 "has not been established yet.\n"); 193 goto end; 194 } 195 196 /* Safety check */ 197 if (msg->l < sizeof(*isakmp) + ntohs(gen->len) + sizeof(*nd)) { 198 plog(LLV_ERROR, LOCATION, NULL, 199 "ignore information because the " 200 "message is too short - %d byte(s).\n", 201 (int)msg->l); 202 goto end; 203 } 204 205 p = (caddr_t) gen + sizeof(struct isakmp_gen); 206 nd = (struct isakmp_gen *) ((caddr_t) gen + ntohs(gen->len)); 207 208 /* nd length check */ 209 if (ntohs(nd->len) > msg->l - (sizeof(struct isakmp) + 210 ntohs(gen->len))) { 211 plog(LLV_ERROR, LOCATION, NULL, 212 "too long payload length (broken message?)\n"); 213 goto end; 214 } 215 216 if (ntohs(nd->len) < sizeof(*nd)) { 217 plog(LLV_ERROR, LOCATION, NULL, 218 "too short payload length (broken message?)\n"); 219 goto end; 220 } 221 222 payload = vmalloc(ntohs(nd->len)); 223 if (payload == NULL) { 224 plog(LLV_ERROR, LOCATION, NULL, 225 "cannot allocate memory\n"); 226 goto end; 227 } 228 229 memcpy(payload->v, (caddr_t) nd, ntohs(nd->len)); 230 231 /* compute HASH */ 232 hash = oakley_compute_hash1(iph1, isakmp->msgid, payload); 233 if (hash == NULL) { 234 plog(LLV_ERROR, LOCATION, NULL, 235 "cannot compute hash\n"); 236 237 vfree(payload); 238 goto end; 239 } 240 241 if (ntohs(gen->len) - sizeof(struct isakmp_gen) != hash->l) { 242 plog(LLV_ERROR, LOCATION, NULL, 243 "ignore information due to hash length mismatch\n"); 244 245 vfree(hash); 246 vfree(payload); 247 goto end; 248 } 249 250 if (memcmp(p, hash->v, hash->l) != 0) { 251 plog(LLV_ERROR, LOCATION, NULL, 252 "ignore information due to hash mismatch\n"); 253 254 vfree(hash); 255 vfree(payload); 256 goto end; 257 } 258 259 plog(LLV_DEBUG, LOCATION, NULL, "hash validated.\n"); 260 261 vfree(hash); 262 vfree(payload); 263 } else { 264 /* make sure the packet was encrypted after the beginning of phase 1. */ 265 switch (iph1->etype) { 266 case ISAKMP_ETYPE_AGG: 267 case ISAKMP_ETYPE_BASE: 268 case ISAKMP_ETYPE_IDENT: 269 if ((iph1->side == INITIATOR && iph1->status < PHASE1ST_MSG3SENT) 270 || (iph1->side == RESPONDER && iph1->status < PHASE1ST_MSG2SENT)) { 271 break; 272 } 273 /*FALLTHRU*/ 274 default: 275 plog(LLV_ERROR, LOCATION, iph1->remote, 276 "%s message must be encrypted\n", 277 s_isakmp_nptype(np)); 278 error = 0; 279 goto end; 280 } 281 } 282 283 if (!(pbuf = isakmp_parse(msg))) { 284 error = -1; 285 goto end; 286 } 287 288 error = 0; 289 for (pa = (struct isakmp_parse_t *)pbuf->v; pa->type; pa++) { 290 switch (pa->type) { 291 case ISAKMP_NPTYPE_HASH: 292 /* Handled above */ 293 break; 294 case ISAKMP_NPTYPE_N: 295 error = isakmp_info_recv_n(iph1, 296 (struct isakmp_pl_n *)pa->ptr, 297 msgid, encrypted); 298 break; 299 case ISAKMP_NPTYPE_D: 300 error = isakmp_info_recv_d(iph1, 301 (struct isakmp_pl_d *)pa->ptr, 302 msgid, encrypted); 303 break; 304 case ISAKMP_NPTYPE_NONCE: 305 /* XXX to be 6.4.2 ike-01.txt */ 306 /* XXX IV is to be synchronized. */ 307 plog(LLV_ERROR, LOCATION, iph1->remote, 308 "ignore Acknowledged Informational\n"); 309 break; 310 default: 311 /* don't send information, see isakmp_ident_r1() */ 312 error = 0; 313 plog(LLV_ERROR, LOCATION, iph1->remote, 314 "reject the packet, " 315 "received unexpected payload type %s.\n", 316 s_isakmp_nptype(gen->np)); 317 } 318 if(error < 0) { 319 break; 320 } else { 321 flag |= error; 322 } 323 } 324 end: 325 if (msg != NULL) 326 vfree(msg); 327 if (pbuf != NULL) 328 vfree(pbuf); 329 return error; 330} 331 332/* 333 * handling of Notification payload 334 */ 335static int 336isakmp_info_recv_n(iph1, notify, msgid, encrypted) 337 struct ph1handle *iph1; 338 struct isakmp_pl_n *notify; 339 u_int32_t msgid; 340 int encrypted; 341{ 342 u_int type; 343 vchar_t *pbuf; 344 vchar_t *ndata; 345 char *nraw; 346 size_t l; 347 char *spi; 348 349 type = ntohs(notify->type); 350 351 switch (type) { 352 case ISAKMP_NTYPE_CONNECTED: 353 case ISAKMP_NTYPE_RESPONDER_LIFETIME: 354 case ISAKMP_NTYPE_REPLAY_STATUS: 355#ifdef ENABLE_HYBRID 356 case ISAKMP_NTYPE_UNITY_HEARTBEAT: 357#endif 358 /* do something */ 359 break; 360 case ISAKMP_NTYPE_INITIAL_CONTACT: 361 if (encrypted) 362 info_recv_initialcontact(iph1); 363 return 0; 364 break; 365#ifdef ENABLE_DPD 366 case ISAKMP_NTYPE_R_U_THERE: 367 if (encrypted) 368 return isakmp_info_recv_r_u(iph1, 369 (struct isakmp_pl_ru *)notify, msgid); 370 break; 371 case ISAKMP_NTYPE_R_U_THERE_ACK: 372 if (encrypted) 373 return isakmp_info_recv_r_u_ack(iph1, 374 (struct isakmp_pl_ru *)notify, msgid); 375 break; 376#endif 377 default: 378 { 379 /* XXX there is a potential of dos attack. */ 380 if(type >= ISAKMP_NTYPE_MINERROR && 381 type <= ISAKMP_NTYPE_MAXERROR) { 382 if (msgid == 0) { 383 /* don't think this realy deletes ph1 ? */ 384 plog(LLV_ERROR, LOCATION, iph1->remote, 385 "delete phase1 handle.\n"); 386 return -1; 387 } else { 388 if (getph2bymsgid(iph1, msgid) == NULL) { 389 plog(LLV_ERROR, LOCATION, iph1->remote, 390 "fatal %s notify messsage, " 391 "phase1 should be deleted.\n", 392 s_isakmp_notify_msg(type)); 393 } else { 394 plog(LLV_ERROR, LOCATION, iph1->remote, 395 "fatal %s notify messsage, " 396 "phase2 should be deleted.\n", 397 s_isakmp_notify_msg(type)); 398 } 399 } 400 } else { 401 plog(LLV_ERROR, LOCATION, iph1->remote, 402 "unhandled notify message %s, " 403 "no phase2 handle found.\n", 404 s_isakmp_notify_msg(type)); 405 } 406 } 407 break; 408 } 409 410 /* get spi if specified and allocate */ 411 if(notify->spi_size > 0) { 412 if (ntohs(notify->h.len) < sizeof(*notify) + notify->spi_size) { 413 plog(LLV_ERROR, LOCATION, iph1->remote, 414 "invalid spi_size in notification payload.\n"); 415 return -1; 416 } 417 spi = val2str((char *)(notify + 1), notify->spi_size); 418 419 plog(LLV_DEBUG, LOCATION, iph1->remote, 420 "notification message %d:%s, " 421 "doi=%d proto_id=%d spi=%s(size=%d).\n", 422 type, s_isakmp_notify_msg(type), 423 ntohl(notify->doi), notify->proto_id, spi, notify->spi_size); 424 425 racoon_free(spi); 426 } 427 428 /* Send the message data to the logs */ 429 if(type >= ISAKMP_NTYPE_MINERROR && 430 type <= ISAKMP_NTYPE_MAXERROR) { 431 l = ntohs(notify->h.len) - sizeof(*notify) - notify->spi_size; 432 if (l > 0) { 433 nraw = (char*)notify; 434 nraw += sizeof(*notify) + notify->spi_size; 435 if ((ndata = vmalloc(l)) != NULL) { 436 memcpy(ndata->v, nraw, ndata->l); 437 plog(LLV_ERROR, LOCATION, iph1->remote, 438 "Message: '%s'.\n", 439 binsanitize(ndata->v, ndata->l)); 440 vfree(ndata); 441 } else { 442 plog(LLV_ERROR, LOCATION, iph1->remote, 443 "Cannot allocate memory\n"); 444 } 445 } 446 } 447 return 0; 448} 449 450/* 451 * handling of Deletion payload 452 */ 453static int 454isakmp_info_recv_d(iph1, delete, msgid, encrypted) 455 struct ph1handle *iph1; 456 struct isakmp_pl_d *delete; 457 u_int32_t msgid; 458 int encrypted; 459{ 460 int tlen, num_spi; 461 vchar_t *pbuf; 462 int protected = 0; 463 struct ph1handle *del_ph1; 464 struct ph2handle *iph2; 465 union { 466 u_int32_t spi32; 467 u_int16_t spi16[2]; 468 } spi; 469 470 if (ntohl(delete->doi) != IPSEC_DOI) { 471 plog(LLV_ERROR, LOCATION, iph1->remote, 472 "delete payload with invalid doi:%d.\n", 473 ntohl(delete->doi)); 474#ifdef ENABLE_HYBRID 475 /* 476 * At deconnexion time, Cisco VPN client does this 477 * with a zero DOI. Don't give up in that situation. 478 */ 479 if (((iph1->mode_cfg->flags & 480 ISAKMP_CFG_VENDORID_UNITY) == 0) || (delete->doi != 0)) 481 return 0; 482#else 483 return 0; 484#endif 485 } 486 487 num_spi = ntohs(delete->num_spi); 488 tlen = ntohs(delete->h.len) - sizeof(struct isakmp_pl_d); 489 490 if (tlen != num_spi * delete->spi_size) { 491 plog(LLV_ERROR, LOCATION, iph1->remote, 492 "deletion payload with invalid length.\n"); 493 return 0; 494 } 495 496 plog(LLV_DEBUG, LOCATION, iph1->remote, 497 "delete payload for protocol %s\n", 498 s_ipsecdoi_proto(delete->proto_id)); 499 500 if(!iph1->rmconf->weak_phase1_check && !encrypted) { 501 plog(LLV_WARNING, LOCATION, iph1->remote, 502 "Ignoring unencrypted delete payload " 503 "(check the weak_phase1_check option)\n"); 504 return 0; 505 } 506 507 switch (delete->proto_id) { 508 case IPSECDOI_PROTO_ISAKMP: 509 if (delete->spi_size != sizeof(isakmp_index)) { 510 plog(LLV_ERROR, LOCATION, iph1->remote, 511 "delete payload with strange spi " 512 "size %d(proto_id:%d)\n", 513 delete->spi_size, delete->proto_id); 514 return 0; 515 } 516 517 del_ph1=getph1byindex((isakmp_index *)(delete + 1)); 518 if(del_ph1 != NULL){ 519 520 evt_phase1(iph1, EVT_PHASE1_PEER_DELETED, NULL); 521 SCHED_KILL(del_ph1->scr); 522 523 /* 524 * Do not delete IPsec SAs when receiving an IKE delete notification. 525 * Just delete the IKE SA. 526 */ 527 isakmp_ph1expire(del_ph1); 528 } 529 break; 530 531 case IPSECDOI_PROTO_IPSEC_AH: 532 case IPSECDOI_PROTO_IPSEC_ESP: 533 if (delete->spi_size != sizeof(u_int32_t)) { 534 plog(LLV_ERROR, LOCATION, iph1->remote, 535 "delete payload with strange spi " 536 "size %d(proto_id:%d)\n", 537 delete->spi_size, delete->proto_id); 538 return 0; 539 } 540 purge_ipsec_spi(iph1->remote, delete->proto_id, 541 (u_int32_t *)(delete + 1), num_spi); 542 break; 543 544 case IPSECDOI_PROTO_IPCOMP: 545 /* need to handle both 16bit/32bit SPI */ 546 memset(&spi, 0, sizeof(spi)); 547 if (delete->spi_size == sizeof(spi.spi16[1])) { 548 memcpy(&spi.spi16[1], delete + 1, 549 sizeof(spi.spi16[1])); 550 } else if (delete->spi_size == sizeof(spi.spi32)) 551 memcpy(&spi.spi32, delete + 1, sizeof(spi.spi32)); 552 else { 553 plog(LLV_ERROR, LOCATION, iph1->remote, 554 "delete payload with strange spi " 555 "size %d(proto_id:%d)\n", 556 delete->spi_size, delete->proto_id); 557 return 0; 558 } 559 purge_ipsec_spi(iph1->remote, delete->proto_id, 560 &spi.spi32, num_spi); 561 break; 562 563 default: 564 plog(LLV_ERROR, LOCATION, iph1->remote, 565 "deletion message received, " 566 "invalid proto_id: %d\n", 567 delete->proto_id); 568 return 0; 569 } 570 571 plog(LLV_DEBUG, LOCATION, NULL, "purged SAs.\n"); 572 573 return 0; 574} 575 576/* 577 * send Delete payload (for ISAKMP SA) in Informational exchange. 578 */ 579int 580isakmp_info_send_d1(iph1) 581 struct ph1handle *iph1; 582{ 583 struct isakmp_pl_d *d; 584 vchar_t *payload = NULL; 585 int tlen; 586 int error = 0; 587 588 if (iph1->status != PHASE2ST_ESTABLISHED) 589 return 0; 590 591 /* create delete payload */ 592 593 /* send SPIs of inbound SAs. */ 594 /* XXX should send outbound SAs's ? */ 595 tlen = sizeof(*d) + sizeof(isakmp_index); 596 payload = vmalloc(tlen); 597 if (payload == NULL) { 598 plog(LLV_ERROR, LOCATION, NULL, 599 "failed to get buffer for payload.\n"); 600 return errno; 601 } 602 603 d = (struct isakmp_pl_d *)payload->v; 604 d->h.np = ISAKMP_NPTYPE_NONE; 605 d->h.len = htons(tlen); 606 d->doi = htonl(IPSEC_DOI); 607 d->proto_id = IPSECDOI_PROTO_ISAKMP; 608 d->spi_size = sizeof(isakmp_index); 609 d->num_spi = htons(1); 610 memcpy(d + 1, &iph1->index, sizeof(isakmp_index)); 611 612 error = isakmp_info_send_common(iph1, payload, 613 ISAKMP_NPTYPE_D, 0); 614 vfree(payload); 615 616 return error; 617} 618 619/* 620 * send Delete payload (for IPsec SA) in Informational exchange, based on 621 * pfkey msg. It sends always single SPI. 622 */ 623int 624isakmp_info_send_d2(iph2) 625 struct ph2handle *iph2; 626{ 627 struct ph1handle *iph1; 628 struct saproto *pr; 629 struct isakmp_pl_d *d; 630 vchar_t *payload = NULL; 631 int tlen; 632 int error = 0; 633 u_int8_t *spi; 634 635 if (iph2->status != PHASE2ST_ESTABLISHED) 636 return 0; 637 638 /* 639 * don't send delete information if there is no phase 1 handler. 640 * It's nonsensical to negotiate phase 1 to send the information. 641 */ 642 iph1 = getph1byaddr(iph2->src, iph2->dst, 0); 643 if (iph1 == NULL){ 644 plog(LLV_DEBUG2, LOCATION, NULL, 645 "No ph1 handler found, could not send DELETE_SA\n"); 646 return 0; 647 } 648 649 /* create delete payload */ 650 for (pr = iph2->approval->head; pr != NULL; pr = pr->next) { 651 652 /* send SPIs of inbound SAs. */ 653 /* 654 * XXX should I send outbound SAs's ? 655 * I send inbound SAs's SPI only at the moment because I can't 656 * decode any more if peer send encoded packet without aware of 657 * deletion of SA. Outbound SAs don't come under the situation. 658 */ 659 tlen = sizeof(*d) + pr->spisize; 660 payload = vmalloc(tlen); 661 if (payload == NULL) { 662 plog(LLV_ERROR, LOCATION, NULL, 663 "failed to get buffer for payload.\n"); 664 return errno; 665 } 666 667 d = (struct isakmp_pl_d *)payload->v; 668 d->h.np = ISAKMP_NPTYPE_NONE; 669 d->h.len = htons(tlen); 670 d->doi = htonl(IPSEC_DOI); 671 d->proto_id = pr->proto_id; 672 d->spi_size = pr->spisize; 673 d->num_spi = htons(1); 674 /* 675 * XXX SPI bits are left-filled, for use with IPComp. 676 * we should be switching to variable-length spi field... 677 */ 678 spi = (u_int8_t *)&pr->spi; 679 spi += sizeof(pr->spi); 680 spi -= pr->spisize; 681 memcpy(d + 1, spi, pr->spisize); 682 683 error = isakmp_info_send_common(iph1, payload, 684 ISAKMP_NPTYPE_D, 0); 685 vfree(payload); 686 } 687 688 return error; 689} 690 691/* 692 * send Notification payload (for without ISAKMP SA) in Informational exchange 693 */ 694int 695isakmp_info_send_nx(isakmp, remote, local, type, data) 696 struct isakmp *isakmp; 697 struct sockaddr *remote, *local; 698 int type; 699 vchar_t *data; 700{ 701 struct ph1handle *iph1 = NULL; 702 struct remoteconf *rmconf; 703 vchar_t *payload = NULL; 704 int tlen; 705 int error = -1; 706 struct isakmp_pl_n *n; 707 int spisiz = 0; /* see below */ 708 709 /* search appropreate configuration */ 710 rmconf = getrmconf(remote); 711 if (rmconf == NULL) { 712 plog(LLV_ERROR, LOCATION, remote, 713 "no configuration found for peer address.\n"); 714 goto end; 715 } 716 717 /* add new entry to isakmp status table. */ 718 iph1 = newph1(); 719 if (iph1 == NULL) 720 return -1; 721 722 memcpy(&iph1->index.i_ck, &isakmp->i_ck, sizeof(cookie_t)); 723 isakmp_newcookie((char *)&iph1->index.r_ck, remote, local); 724 iph1->status = PHASE1ST_START; 725 iph1->rmconf = rmconf; 726 iph1->side = INITIATOR; 727 iph1->version = isakmp->v; 728 iph1->flags = 0; 729 iph1->msgid = 0; /* XXX */ 730#ifdef ENABLE_HYBRID 731 if ((iph1->mode_cfg = isakmp_cfg_mkstate()) == NULL) { 732 error = -1; 733 goto end; 734 } 735#endif 736#ifdef ENABLE_FRAG 737 iph1->frag = 0; 738 iph1->frag_chain = NULL; 739#endif 740 741 /* copy remote address */ 742 if (copy_ph1addresses(iph1, rmconf, remote, local) < 0) { 743 error = -1; 744 goto end; 745 } 746 747 tlen = sizeof(*n) + spisiz; 748 if (data) 749 tlen += data->l; 750 payload = vmalloc(tlen); 751 if (payload == NULL) { 752 plog(LLV_ERROR, LOCATION, NULL, 753 "failed to get buffer to send.\n"); 754 error = -1; 755 goto end; 756 } 757 758 n = (struct isakmp_pl_n *)payload->v; 759 n->h.np = ISAKMP_NPTYPE_NONE; 760 n->h.len = htons(tlen); 761 n->doi = htonl(IPSEC_DOI); 762 n->proto_id = IPSECDOI_KEY_IKE; 763 n->spi_size = spisiz; 764 n->type = htons(type); 765 if (spisiz) 766 memset(n + 1, 0, spisiz); /* XXX spisiz is always 0 */ 767 if (data) 768 memcpy((caddr_t)(n + 1) + spisiz, data->v, data->l); 769 770 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 0); 771 vfree(payload); 772 773 end: 774 if (iph1 != NULL) 775 delph1(iph1); 776 777 return error; 778} 779 780/* 781 * send Notification payload (for ISAKMP SA) in Informational exchange 782 */ 783int 784isakmp_info_send_n1(iph1, type, data) 785 struct ph1handle *iph1; 786 int type; 787 vchar_t *data; 788{ 789 vchar_t *payload = NULL; 790 int tlen; 791 int error = 0; 792 struct isakmp_pl_n *n; 793 int spisiz; 794 795 /* 796 * note on SPI size: which description is correct? I have chosen 797 * this to be 0. 798 * 799 * RFC2408 3.1, 2nd paragraph says: ISAKMP SA is identified by 800 * Initiator/Responder cookie and SPI has no meaning, SPI size = 0. 801 * RFC2408 3.1, first paragraph on page 40: ISAKMP SA is identified 802 * by cookie and SPI has no meaning, 0 <= SPI size <= 16. 803 * RFC2407 4.6.3.3, INITIAL-CONTACT is required to set to 16. 804 */ 805 if (type == ISAKMP_NTYPE_INITIAL_CONTACT) 806 spisiz = sizeof(isakmp_index); 807 else 808 spisiz = 0; 809 810 tlen = sizeof(*n) + spisiz; 811 if (data) 812 tlen += data->l; 813 payload = vmalloc(tlen); 814 if (payload == NULL) { 815 plog(LLV_ERROR, LOCATION, NULL, 816 "failed to get buffer to send.\n"); 817 return errno; 818 } 819 820 n = (struct isakmp_pl_n *)payload->v; 821 n->h.np = ISAKMP_NPTYPE_NONE; 822 n->h.len = htons(tlen); 823 n->doi = htonl(iph1->rmconf->doitype); 824 n->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX to be configurable ? */ 825 n->spi_size = spisiz; 826 n->type = htons(type); 827 if (spisiz) 828 memcpy(n + 1, &iph1->index, sizeof(isakmp_index)); 829 if (data) 830 memcpy((caddr_t)(n + 1) + spisiz, data->v, data->l); 831 832 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, iph1->flags); 833 vfree(payload); 834 835 return error; 836} 837 838/* 839 * send Notification payload (for IPsec SA) in Informational exchange 840 */ 841int 842isakmp_info_send_n2(iph2, type, data) 843 struct ph2handle *iph2; 844 int type; 845 vchar_t *data; 846{ 847 struct ph1handle *iph1 = iph2->ph1; 848 vchar_t *payload = NULL; 849 int tlen; 850 int error = 0; 851 struct isakmp_pl_n *n; 852 struct saproto *pr; 853 854 if (!iph2->approval) 855 return EINVAL; 856 857 pr = iph2->approval->head; 858 859 /* XXX must be get proper spi */ 860 tlen = sizeof(*n) + pr->spisize; 861 if (data) 862 tlen += data->l; 863 payload = vmalloc(tlen); 864 if (payload == NULL) { 865 plog(LLV_ERROR, LOCATION, NULL, 866 "failed to get buffer to send.\n"); 867 return errno; 868 } 869 870 n = (struct isakmp_pl_n *)payload->v; 871 n->h.np = ISAKMP_NPTYPE_NONE; 872 n->h.len = htons(tlen); 873 n->doi = htonl(IPSEC_DOI); /* IPSEC DOI (1) */ 874 n->proto_id = pr->proto_id; /* IPSEC AH/ESP/whatever*/ 875 n->spi_size = pr->spisize; 876 n->type = htons(type); 877 *(u_int32_t *)(n + 1) = pr->spi; 878 if (data) 879 memcpy((caddr_t)(n + 1) + pr->spisize, data->v, data->l); 880 881 iph2->flags |= ISAKMP_FLAG_E; /* XXX Should we do FLAG_A ? */ 882 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, iph2->flags); 883 vfree(payload); 884 885 return error; 886} 887 888/* 889 * send Information 890 * When ph1->skeyid_a == NULL, send message without encoding. 891 */ 892int 893isakmp_info_send_common(iph1, payload, np, flags) 894 struct ph1handle *iph1; 895 vchar_t *payload; 896 u_int32_t np; 897 int flags; 898{ 899 struct ph2handle *iph2 = NULL; 900 vchar_t *hash = NULL; 901 struct isakmp *isakmp; 902 struct isakmp_gen *gen; 903 char *p; 904 int tlen; 905 int error = -1; 906 907 /* add new entry to isakmp status table */ 908 iph2 = newph2(); 909 if (iph2 == NULL) 910 goto end; 911 912 iph2->dst = dupsaddr(iph1->remote); 913 if (iph2->dst == NULL) { 914 delph2(iph2); 915 goto end; 916 } 917 iph2->src = dupsaddr(iph1->local); 918 if (iph2->src == NULL) { 919 delph2(iph2); 920 goto end; 921 } 922 switch (iph1->remote->sa_family) { 923 case AF_INET: 924#if (!defined(ENABLE_NATT)) || (defined(BROKEN_NATT)) 925 ((struct sockaddr_in *)iph2->dst)->sin_port = 0; 926 ((struct sockaddr_in *)iph2->src)->sin_port = 0; 927#endif 928 break; 929#ifdef INET6 930 case AF_INET6: 931#if (!defined(ENABLE_NATT)) || (defined(BROKEN_NATT)) 932 ((struct sockaddr_in6 *)iph2->dst)->sin6_port = 0; 933 ((struct sockaddr_in6 *)iph2->src)->sin6_port = 0; 934#endif 935 break; 936#endif 937 default: 938 plog(LLV_ERROR, LOCATION, NULL, 939 "invalid family: %d\n", iph1->remote->sa_family); 940 delph2(iph2); 941 goto end; 942 } 943 iph2->ph1 = iph1; 944 iph2->side = INITIATOR; 945 iph2->status = PHASE2ST_START; 946 iph2->msgid = isakmp_newmsgid2(iph1); 947 948 /* get IV and HASH(1) if skeyid_a was generated. */ 949 if (iph1->skeyid_a != NULL) { 950 iph2->ivm = oakley_newiv2(iph1, iph2->msgid); 951 if (iph2->ivm == NULL) { 952 delph2(iph2); 953 goto end; 954 } 955 956 /* generate HASH(1) */ 957 hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, payload); 958 if (hash == NULL) { 959 delph2(iph2); 960 goto end; 961 } 962 963 /* initialized total buffer length */ 964 tlen = hash->l; 965 tlen += sizeof(*gen); 966 } else { 967 /* IKE-SA is not established */ 968 hash = NULL; 969 970 /* initialized total buffer length */ 971 tlen = 0; 972 } 973 if ((flags & ISAKMP_FLAG_A) == 0) 974 iph2->flags = (hash == NULL ? 0 : ISAKMP_FLAG_E); 975 else 976 iph2->flags = (hash == NULL ? 0 : ISAKMP_FLAG_A); 977 978 insph2(iph2); 979 bindph12(iph1, iph2); 980 981 tlen += sizeof(*isakmp) + payload->l; 982 983 /* create buffer for isakmp payload */ 984 iph2->sendbuf = vmalloc(tlen); 985 if (iph2->sendbuf == NULL) { 986 plog(LLV_ERROR, LOCATION, NULL, 987 "failed to get buffer to send.\n"); 988 goto err; 989 } 990 991 /* create isakmp header */ 992 isakmp = (struct isakmp *)iph2->sendbuf->v; 993 memcpy(&isakmp->i_ck, &iph1->index.i_ck, sizeof(cookie_t)); 994 memcpy(&isakmp->r_ck, &iph1->index.r_ck, sizeof(cookie_t)); 995 isakmp->np = hash == NULL ? (np & 0xff) : ISAKMP_NPTYPE_HASH; 996 isakmp->v = iph1->version; 997 isakmp->etype = ISAKMP_ETYPE_INFO; 998 isakmp->flags = iph2->flags; 999 memcpy(&isakmp->msgid, &iph2->msgid, sizeof(isakmp->msgid)); 1000 isakmp->len = htonl(tlen); 1001 p = (char *)(isakmp + 1); 1002 1003 /* create HASH payload */ 1004 if (hash != NULL) { 1005 gen = (struct isakmp_gen *)p; 1006 gen->np = np & 0xff; 1007 gen->len = htons(sizeof(*gen) + hash->l); 1008 p += sizeof(*gen); 1009 memcpy(p, hash->v, hash->l); 1010 p += hash->l; 1011 } 1012 1013 /* add payload */ 1014 memcpy(p, payload->v, payload->l); 1015 p += payload->l; 1016 1017#ifdef HAVE_PRINT_ISAKMP_C 1018 isakmp_printpacket(iph2->sendbuf, iph1->local, iph1->remote, 1); 1019#endif 1020 1021 /* encoding */ 1022 if (ISSET(isakmp->flags, ISAKMP_FLAG_E)) { 1023 vchar_t *tmp; 1024 1025 tmp = oakley_do_encrypt(iph2->ph1, iph2->sendbuf, iph2->ivm->ive, 1026 iph2->ivm->iv); 1027 VPTRINIT(iph2->sendbuf); 1028 if (tmp == NULL) 1029 goto err; 1030 iph2->sendbuf = tmp; 1031 } 1032 1033 /* HDR*, HASH(1), N */ 1034 if (isakmp_send(iph2->ph1, iph2->sendbuf) < 0) { 1035 VPTRINIT(iph2->sendbuf); 1036 goto err; 1037 } 1038 1039 plog(LLV_DEBUG, LOCATION, NULL, 1040 "sendto Information %s.\n", s_isakmp_nptype(np)); 1041 1042 /* 1043 * don't resend notify message because peer can use Acknowledged 1044 * Informational if peer requires the reply of the notify message. 1045 */ 1046 1047 /* XXX If Acknowledged Informational required, don't delete ph2handle */ 1048 error = 0; 1049 VPTRINIT(iph2->sendbuf); 1050 goto err; /* XXX */ 1051 1052end: 1053 if (hash) 1054 vfree(hash); 1055 return error; 1056 1057err: 1058 unbindph12(iph2); 1059 remph2(iph2); 1060 delph2(iph2); 1061 goto end; 1062} 1063 1064/* 1065 * add a notify payload to buffer by reallocating buffer. 1066 * If buf == NULL, the function only create a notify payload. 1067 * 1068 * XXX Which is SPI to be included, inbound or outbound ? 1069 */ 1070vchar_t * 1071isakmp_add_pl_n(buf0, np_p, type, pr, data) 1072 vchar_t *buf0; 1073 u_int8_t **np_p; 1074 int type; 1075 struct saproto *pr; 1076 vchar_t *data; 1077{ 1078 vchar_t *buf = NULL; 1079 struct isakmp_pl_n *n; 1080 int tlen; 1081 int oldlen = 0; 1082 1083 if (*np_p) 1084 **np_p = ISAKMP_NPTYPE_N; 1085 1086 tlen = sizeof(*n) + pr->spisize; 1087 1088 if (data) 1089 tlen += data->l; 1090 if (buf0) { 1091 oldlen = buf0->l; 1092 buf = vrealloc(buf0, buf0->l + tlen); 1093 } else 1094 buf = vmalloc(tlen); 1095 if (!buf) { 1096 plog(LLV_ERROR, LOCATION, NULL, 1097 "failed to get a payload buffer.\n"); 1098 return NULL; 1099 } 1100 1101 n = (struct isakmp_pl_n *)(buf->v + oldlen); 1102 n->h.np = ISAKMP_NPTYPE_NONE; 1103 n->h.len = htons(tlen); 1104 n->doi = htonl(IPSEC_DOI); /* IPSEC DOI (1) */ 1105 n->proto_id = pr->proto_id; /* IPSEC AH/ESP/whatever*/ 1106 n->spi_size = pr->spisize; 1107 n->type = htons(type); 1108 *(u_int32_t *)(n + 1) = pr->spi; /* XXX */ 1109 if (data) 1110 memcpy((caddr_t)(n + 1) + pr->spisize, data->v, data->l); 1111 1112 /* save the pointer of next payload type */ 1113 *np_p = &n->h.np; 1114 1115 return buf; 1116} 1117 1118static void 1119purge_isakmp_spi(proto, spi, n) 1120 int proto; 1121 isakmp_index *spi; /*network byteorder*/ 1122 size_t n; 1123{ 1124 struct ph1handle *iph1; 1125 size_t i; 1126 1127 for (i = 0; i < n; i++) { 1128 iph1 = getph1byindex(&spi[i]); 1129 if (!iph1) 1130 continue; 1131 1132 plog(LLV_INFO, LOCATION, NULL, 1133 "purged ISAKMP-SA proto_id=%s spi=%s.\n", 1134 s_ipsecdoi_proto(proto), 1135 isakmp_pindex(&spi[i], 0)); 1136 1137 SCHED_KILL(iph1->sce); 1138 iph1->status = PHASE1ST_EXPIRED; 1139 iph1->sce = sched_new(1, isakmp_ph1delete_stub, iph1); 1140 } 1141} 1142 1143 1144 1145void 1146purge_ipsec_spi(dst0, proto, spi, n) 1147 struct sockaddr *dst0; 1148 int proto; 1149 u_int32_t *spi; /*network byteorder*/ 1150 size_t n; 1151{ 1152 vchar_t *buf = NULL; 1153 struct sadb_msg *msg, *next, *end; 1154 struct sadb_sa *sa; 1155 struct sadb_lifetime *lt; 1156 struct sockaddr *src, *dst; 1157 struct ph2handle *iph2; 1158 u_int64_t created; 1159 size_t i; 1160 caddr_t mhp[SADB_EXT_MAX + 1]; 1161#ifdef ENABLE_NATT 1162 struct sadb_x_nat_t_type *natt_type; 1163 struct sadb_x_nat_t_port *natt_port; 1164#endif 1165 1166 plog(LLV_DEBUG2, LOCATION, NULL, 1167 "purge_ipsec_spi:\n"); 1168 plog(LLV_DEBUG2, LOCATION, NULL, "dst0: %s\n", saddr2str(dst0)); 1169 plog(LLV_DEBUG2, LOCATION, NULL, "SPI: %08X\n", ntohl(spi[0])); 1170 1171 buf = pfkey_dump_sadb(ipsecdoi2pfkey_proto(proto)); 1172 if (buf == NULL) { 1173 plog(LLV_DEBUG, LOCATION, NULL, 1174 "pfkey_dump_sadb returned nothing.\n"); 1175 return; 1176 } 1177 1178 msg = (struct sadb_msg *)buf->v; 1179 end = (struct sadb_msg *)(buf->v + buf->l); 1180 1181 while (msg < end) { 1182 if ((msg->sadb_msg_len << 3) < sizeof(*msg)) 1183 break; 1184 next = (struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3)); 1185 if (msg->sadb_msg_type != SADB_DUMP) { 1186 msg = next; 1187 continue; 1188 } 1189 1190 if (pfkey_align(msg, mhp) || pfkey_check(mhp)) { 1191 plog(LLV_ERROR, LOCATION, NULL, 1192 "pfkey_check (%s)\n", ipsec_strerror()); 1193 msg = next; 1194 continue; 1195 } 1196 1197 sa = (struct sadb_sa *)(mhp[SADB_EXT_SA]); 1198 if (!sa 1199 || !mhp[SADB_EXT_ADDRESS_SRC] 1200 || !mhp[SADB_EXT_ADDRESS_DST]) { 1201 msg = next; 1202 continue; 1203 } 1204 src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]); 1205 dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]); 1206 lt = (struct sadb_lifetime*)mhp[SADB_EXT_LIFETIME_HARD]; 1207 if(lt != NULL) 1208 created = lt->sadb_lifetime_addtime; 1209 else 1210 created = 0; 1211 1212 if (sa->sadb_sa_state != SADB_SASTATE_MATURE 1213 && sa->sadb_sa_state != SADB_SASTATE_DYING) { 1214 msg = next; 1215 continue; 1216 } 1217#ifdef ENABLE_NATT 1218 natt_type = (void *)mhp[SADB_X_EXT_NAT_T_TYPE]; 1219 if (natt_type && natt_type->sadb_x_nat_t_type_type) { 1220 /* NAT-T is enabled for this SADB entry; copy 1221 * the ports from NAT-T extensions */ 1222 natt_port = (void *)mhp[SADB_X_EXT_NAT_T_SPORT]; 1223 if (extract_port(src) == 0 && natt_port != NULL) 1224 set_port(src, ntohs(natt_port->sadb_x_nat_t_port_port)); 1225 1226 natt_port = (void *)mhp[SADB_X_EXT_NAT_T_DPORT]; 1227 if (extract_port(dst) == 0 && natt_port != NULL) 1228 set_port(dst, ntohs(natt_port->sadb_x_nat_t_port_port)); 1229 } 1230#endif 1231 plog(LLV_DEBUG2, LOCATION, NULL, "src: %s\n", saddr2str(src)); 1232 plog(LLV_DEBUG2, LOCATION, NULL, "dst: %s\n", saddr2str(dst)); 1233 1234 /* XXX n^2 algorithm, inefficient */ 1235 1236 /* don't delete inbound SAs at the moment */ 1237 /* XXX should we remove SAs with opposite direction as well? */ 1238 if (CMPSADDR(dst0, dst)) { 1239 msg = next; 1240 continue; 1241 } 1242 1243 for (i = 0; i < n; i++) { 1244 plog(LLV_DEBUG, LOCATION, NULL, 1245 "check spi(packet)=%u spi(db)=%u.\n", 1246 ntohl(spi[i]), ntohl(sa->sadb_sa_spi)); 1247 if (spi[i] != sa->sadb_sa_spi) 1248 continue; 1249 1250 pfkey_send_delete(lcconf->sock_pfkey, 1251 msg->sadb_msg_satype, 1252 IPSEC_MODE_ANY, 1253 src, dst, sa->sadb_sa_spi); 1254 1255 /* 1256 * delete a relative phase 2 handler. 1257 * continue to process if no relative phase 2 handler 1258 * exists. 1259 */ 1260 iph2 = getph2bysaidx(src, dst, proto, spi[i]); 1261 if(iph2 != NULL){ 1262 delete_spd(iph2, created); 1263 unbindph12(iph2); 1264 remph2(iph2); 1265 delph2(iph2); 1266 } 1267 1268 plog(LLV_INFO, LOCATION, NULL, 1269 "purged IPsec-SA proto_id=%s spi=%u.\n", 1270 s_ipsecdoi_proto(proto), 1271 ntohl(spi[i])); 1272 } 1273 1274 msg = next; 1275 } 1276 1277 if (buf) 1278 vfree(buf); 1279} 1280 1281/* 1282 * delete all phase2 sa relatived to the destination address. 1283 * Don't delete Phase 1 handlers on INITIAL-CONTACT, and don't ignore 1284 * an INITIAL-CONTACT if we have contacted the peer. This matches the 1285 * Sun IKE behavior, and makes rekeying work much better when the peer 1286 * restarts. 1287 */ 1288static void 1289info_recv_initialcontact(iph1) 1290 struct ph1handle *iph1; 1291{ 1292 vchar_t *buf = NULL; 1293 struct sadb_msg *msg, *next, *end; 1294 struct sadb_sa *sa; 1295 struct sockaddr *src, *dst; 1296 caddr_t mhp[SADB_EXT_MAX + 1]; 1297 int proto_id, i; 1298 struct ph2handle *iph2; 1299#if 0 1300 char *loc, *rem; 1301#endif 1302 1303 if (f_local) 1304 return; 1305 1306#if 0 1307 loc = racoon_strdup(saddrwop2str(iph1->local)); 1308 rem = racoon_strdup(saddrwop2str(iph1->remote)); 1309 STRDUP_FATAL(loc); 1310 STRDUP_FATAL(rem); 1311 1312 /* 1313 * Purge all IPSEC-SAs for the peer. We can do this 1314 * the easy way (using a PF_KEY SADB_DELETE extension) 1315 * or we can do it the hard way. 1316 */ 1317 for (i = 0; i < pfkey_nsatypes; i++) { 1318 proto_id = pfkey2ipsecdoi_proto(pfkey_satypes[i].ps_satype); 1319 1320 plog(LLV_INFO, LOCATION, NULL, 1321 "purging %s SAs for %s -> %s\n", 1322 pfkey_satypes[i].ps_name, loc, rem); 1323 if (pfkey_send_delete_all(lcconf->sock_pfkey, 1324 pfkey_satypes[i].ps_satype, IPSEC_MODE_ANY, 1325 iph1->local, iph1->remote) == -1) { 1326 plog(LLV_ERROR, LOCATION, NULL, 1327 "delete_all %s -> %s failed for %s (%s)\n", 1328 loc, rem, 1329 pfkey_satypes[i].ps_name, ipsec_strerror()); 1330 goto the_hard_way; 1331 } 1332 1333 deleteallph2(iph1->local, iph1->remote, proto_id); 1334 1335 plog(LLV_INFO, LOCATION, NULL, 1336 "purging %s SAs for %s -> %s\n", 1337 pfkey_satypes[i].ps_name, rem, loc); 1338 if (pfkey_send_delete_all(lcconf->sock_pfkey, 1339 pfkey_satypes[i].ps_satype, IPSEC_MODE_ANY, 1340 iph1->remote, iph1->local) == -1) { 1341 plog(LLV_ERROR, LOCATION, NULL, 1342 "delete_all %s -> %s failed for %s (%s)\n", 1343 rem, loc, 1344 pfkey_satypes[i].ps_name, ipsec_strerror()); 1345 goto the_hard_way; 1346 } 1347 1348 deleteallph2(iph1->remote, iph1->local, proto_id); 1349 } 1350 1351 racoon_free(loc); 1352 racoon_free(rem); 1353 return; 1354 1355 the_hard_way: 1356 racoon_free(loc); 1357 racoon_free(rem); 1358#endif 1359 1360 buf = pfkey_dump_sadb(SADB_SATYPE_UNSPEC); 1361 if (buf == NULL) { 1362 plog(LLV_DEBUG, LOCATION, NULL, 1363 "pfkey_dump_sadb returned nothing.\n"); 1364 return; 1365 } 1366 1367 msg = (struct sadb_msg *)buf->v; 1368 end = (struct sadb_msg *)(buf->v + buf->l); 1369 1370 while (msg < end) { 1371 if ((msg->sadb_msg_len << 3) < sizeof(*msg)) 1372 break; 1373 next = (struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3)); 1374 if (msg->sadb_msg_type != SADB_DUMP) { 1375 msg = next; 1376 continue; 1377 } 1378 1379 if (pfkey_align(msg, mhp) || pfkey_check(mhp)) { 1380 plog(LLV_ERROR, LOCATION, NULL, 1381 "pfkey_check (%s)\n", ipsec_strerror()); 1382 msg = next; 1383 continue; 1384 } 1385 1386 if (mhp[SADB_EXT_SA] == NULL 1387 || mhp[SADB_EXT_ADDRESS_SRC] == NULL 1388 || mhp[SADB_EXT_ADDRESS_DST] == NULL) { 1389 msg = next; 1390 continue; 1391 } 1392 sa = (struct sadb_sa *)mhp[SADB_EXT_SA]; 1393 src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]); 1394 dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]); 1395 1396 if (sa->sadb_sa_state != SADB_SASTATE_MATURE 1397 && sa->sadb_sa_state != SADB_SASTATE_DYING) { 1398 msg = next; 1399 continue; 1400 } 1401 1402 /* 1403 * RFC2407 4.6.3.3 INITIAL-CONTACT is the message that 1404 * announces the sender of the message was rebooted. 1405 * it is interpreted to delete all SAs which source address 1406 * is the sender of the message. 1407 * racoon only deletes SA which is matched both the 1408 * source address and the destination accress. 1409 */ 1410#ifdef ENABLE_NATT 1411 /* 1412 * XXX RFC 3947 says that whe MUST NOT use IP+port to find old SAs 1413 * from this peer ! 1414 */ 1415 if(iph1->natt_flags & NAT_DETECTED){ 1416 if (CMPSADDR(iph1->local, src) == 0 && 1417 CMPSADDR(iph1->remote, dst) == 0) 1418 ; 1419 else if (CMPSADDR(iph1->remote, src) == 0 && 1420 CMPSADDR(iph1->local, dst) == 0) 1421 ; 1422 else { 1423 msg = next; 1424 continue; 1425 } 1426 } else 1427#endif 1428 /* If there is no NAT-T, we don't have to check addr + port... 1429 * XXX what about a configuration with a remote peers which is not 1430 * NATed, but which NATs some other peers ? 1431 * Here, the INITIAl-CONTACT would also flush all those NATed peers !! 1432 */ 1433 if (cmpsaddrwop(iph1->local, src) == 0 && 1434 cmpsaddrwop(iph1->remote, dst) == 0) 1435 ; 1436 else if (cmpsaddrwop(iph1->remote, src) == 0 && 1437 cmpsaddrwop(iph1->local, dst) == 0) 1438 ; 1439 else { 1440 msg = next; 1441 continue; 1442 } 1443 1444 /* 1445 * Make sure this is an SATYPE that we manage. 1446 * This is gross; too bad we couldn't do it the 1447 * easy way. 1448 */ 1449 for (i = 0; i < pfkey_nsatypes; i++) { 1450 if (pfkey_satypes[i].ps_satype == 1451 msg->sadb_msg_satype) 1452 break; 1453 } 1454 if (i == pfkey_nsatypes) { 1455 msg = next; 1456 continue; 1457 } 1458 1459 plog(LLV_INFO, LOCATION, NULL, 1460 "purging spi=%u.\n", ntohl(sa->sadb_sa_spi)); 1461 pfkey_send_delete(lcconf->sock_pfkey, 1462 msg->sadb_msg_satype, 1463 IPSEC_MODE_ANY, src, dst, sa->sadb_sa_spi); 1464 1465 /* 1466 * delete a relative phase 2 handler. 1467 * continue to process if no relative phase 2 handler 1468 * exists. 1469 */ 1470 proto_id = pfkey2ipsecdoi_proto(msg->sadb_msg_satype); 1471 iph2 = getph2bysaidx(src, dst, proto_id, sa->sadb_sa_spi); 1472 if (iph2) { 1473 delete_spd(iph2, 0); 1474 unbindph12(iph2); 1475 remph2(iph2); 1476 delph2(iph2); 1477 } 1478 1479 msg = next; 1480 } 1481 1482 vfree(buf); 1483} 1484 1485void 1486isakmp_check_notify(gen, iph1) 1487 struct isakmp_gen *gen; /* points to Notify payload */ 1488 struct ph1handle *iph1; 1489{ 1490 struct isakmp_pl_n *notify = (struct isakmp_pl_n *)gen; 1491 1492 plog(LLV_DEBUG, LOCATION, iph1->remote, 1493 "Notify Message received\n"); 1494 1495 switch (ntohs(notify->type)) { 1496 case ISAKMP_NTYPE_CONNECTED: 1497 case ISAKMP_NTYPE_RESPONDER_LIFETIME: 1498 case ISAKMP_NTYPE_REPLAY_STATUS: 1499 case ISAKMP_NTYPE_HEARTBEAT: 1500#ifdef ENABLE_HYBRID 1501 case ISAKMP_NTYPE_UNITY_HEARTBEAT: 1502#endif 1503 plog(LLV_WARNING, LOCATION, iph1->remote, 1504 "ignore %s notification.\n", 1505 s_isakmp_notify_msg(ntohs(notify->type))); 1506 break; 1507 case ISAKMP_NTYPE_INITIAL_CONTACT: 1508 plog(LLV_WARNING, LOCATION, iph1->remote, 1509 "ignore INITIAL-CONTACT notification, " 1510 "because it is only accepted after phase1.\n"); 1511 break; 1512 default: 1513 isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL); 1514 plog(LLV_ERROR, LOCATION, iph1->remote, 1515 "received unknown notification type %s.\n", 1516 s_isakmp_notify_msg(ntohs(notify->type))); 1517 } 1518 1519 return; 1520} 1521 1522 1523#ifdef ENABLE_DPD 1524static int 1525isakmp_info_recv_r_u (iph1, ru, msgid) 1526 struct ph1handle *iph1; 1527 struct isakmp_pl_ru *ru; 1528 u_int32_t msgid; 1529{ 1530 struct isakmp_pl_ru *ru_ack; 1531 vchar_t *payload = NULL; 1532 int tlen; 1533 int error = 0; 1534 1535 plog(LLV_DEBUG, LOCATION, iph1->remote, 1536 "DPD R-U-There received\n"); 1537 1538 /* XXX should compare cookies with iph1->index? 1539 Or is this already done by calling function? */ 1540 tlen = sizeof(*ru_ack); 1541 payload = vmalloc(tlen); 1542 if (payload == NULL) { 1543 plog(LLV_ERROR, LOCATION, NULL, 1544 "failed to get buffer to send.\n"); 1545 return errno; 1546 } 1547 1548 ru_ack = (struct isakmp_pl_ru *)payload->v; 1549 ru_ack->h.np = ISAKMP_NPTYPE_NONE; 1550 ru_ack->h.len = htons(tlen); 1551 ru_ack->doi = htonl(IPSEC_DOI); 1552 ru_ack->type = htons(ISAKMP_NTYPE_R_U_THERE_ACK); 1553 ru_ack->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX ? */ 1554 ru_ack->spi_size = sizeof(isakmp_index); 1555 memcpy(ru_ack->i_ck, ru->i_ck, sizeof(cookie_t)); 1556 memcpy(ru_ack->r_ck, ru->r_ck, sizeof(cookie_t)); 1557 ru_ack->data = ru->data; 1558 1559 /* XXX Should we do FLAG_A ? */ 1560 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 1561 ISAKMP_FLAG_E); 1562 vfree(payload); 1563 1564 plog(LLV_DEBUG, LOCATION, NULL, "received a valid R-U-THERE, ACK sent\n"); 1565 1566 /* Should we mark tunnel as active ? */ 1567 return error; 1568} 1569 1570static int 1571isakmp_info_recv_r_u_ack (iph1, ru, msgid) 1572 struct ph1handle *iph1; 1573 struct isakmp_pl_ru *ru; 1574 u_int32_t msgid; 1575{ 1576 1577 plog(LLV_DEBUG, LOCATION, iph1->remote, 1578 "DPD R-U-There-Ack received\n"); 1579 1580 /* XXX Maintain window of acceptable sequence numbers ? 1581 * => ru->data <= iph2->dpd_seq && 1582 * ru->data >= iph2->dpd_seq - iph2->dpd_fails ? */ 1583 if (ntohl(ru->data) != iph1->dpd_seq-1) { 1584 plog(LLV_ERROR, LOCATION, iph1->remote, 1585 "Wrong DPD sequence number (%d, %d expected).\n", 1586 ntohl(ru->data), iph1->dpd_seq-1); 1587 return 0; 1588 } 1589 1590 if (memcmp(ru->i_ck, iph1->index.i_ck, sizeof(cookie_t)) || 1591 memcmp(ru->r_ck, iph1->index.r_ck, sizeof(cookie_t))) { 1592 plog(LLV_ERROR, LOCATION, iph1->remote, 1593 "Cookie mismatch in DPD ACK!.\n"); 1594 return 0; 1595 } 1596 1597 iph1->dpd_fails = 0; 1598 1599 /* Useless ??? */ 1600 iph1->dpd_lastack = time(NULL); 1601 1602 SCHED_KILL(iph1->dpd_r_u); 1603 1604 isakmp_sched_r_u(iph1, 0); 1605 1606 plog(LLV_DEBUG, LOCATION, NULL, "received an R-U-THERE-ACK\n"); 1607 1608 return 0; 1609} 1610 1611 1612 1613 1614/* 1615 * send DPD R-U-THERE payload in Informational exchange. 1616 */ 1617static void 1618isakmp_info_send_r_u(arg) 1619 void *arg; 1620{ 1621 struct ph1handle *iph1 = arg; 1622 1623 /* create R-U-THERE payload */ 1624 struct isakmp_pl_ru *ru; 1625 vchar_t *payload = NULL; 1626 int tlen; 1627 int error = 0; 1628 1629 plog(LLV_DEBUG, LOCATION, iph1->remote, "DPD monitoring....\n"); 1630 1631 iph1->dpd_r_u=NULL; 1632 1633 if (iph1->dpd_fails >= iph1->rmconf->dpd_maxfails) { 1634 1635 plog(LLV_INFO, LOCATION, iph1->remote, 1636 "DPD: remote (ISAKMP-SA spi=%s) seems to be dead.\n", 1637 isakmp_pindex(&iph1->index, 0)); 1638 1639 evt_phase1(iph1, EVT_PHASE1_DPD_TIMEOUT, NULL); 1640 purge_remote(iph1); 1641 1642 /* Do not reschedule here: phase1 is deleted, 1643 * DPD will be reactivated when a new ph1 will be negociated 1644 */ 1645 return; 1646 } 1647 1648 /* TODO: check recent activity to avoid useless sends... */ 1649 1650 tlen = sizeof(*ru); 1651 payload = vmalloc(tlen); 1652 if (payload == NULL) { 1653 plog(LLV_ERROR, LOCATION, NULL, 1654 "failed to get buffer for payload.\n"); 1655 return; 1656 } 1657 ru = (struct isakmp_pl_ru *)payload->v; 1658 ru->h.np = ISAKMP_NPTYPE_NONE; 1659 ru->h.len = htons(tlen); 1660 ru->doi = htonl(IPSEC_DOI); 1661 ru->type = htons(ISAKMP_NTYPE_R_U_THERE); 1662 ru->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX ?*/ 1663 ru->spi_size = sizeof(isakmp_index); 1664 1665 memcpy(ru->i_ck, iph1->index.i_ck, sizeof(cookie_t)); 1666 memcpy(ru->r_ck, iph1->index.r_ck, sizeof(cookie_t)); 1667 1668 if (iph1->dpd_seq == 0){ 1669 /* generate a random seq which is not too big */ 1670 srand(time(NULL)); 1671 iph1->dpd_seq = rand() & 0x0fff; 1672 } 1673 1674 ru->data = htonl(iph1->dpd_seq); 1675 1676 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 0); 1677 vfree(payload); 1678 1679 plog(LLV_DEBUG, LOCATION, iph1->remote, 1680 "DPD R-U-There sent (%d)\n", error); 1681 1682 /* will be decreased if ACK received... */ 1683 iph1->dpd_fails++; 1684 1685 /* XXX should be increased only when ACKed ? */ 1686 iph1->dpd_seq++; 1687 1688 /* Reschedule the r_u_there with a short delay, 1689 * will be deleted/rescheduled if ACK received before */ 1690 isakmp_sched_r_u(iph1, 1); 1691 1692 plog(LLV_DEBUG, LOCATION, iph1->remote, 1693 "rescheduling send_r_u (%d).\n", iph1->rmconf->dpd_retry); 1694} 1695 1696/* Schedule a new R-U-THERE */ 1697int 1698isakmp_sched_r_u(iph1, retry) 1699 struct ph1handle *iph1; 1700 int retry; 1701{ 1702 if(iph1 == NULL || 1703 iph1->rmconf == NULL) 1704 return 1; 1705 1706 1707 if(iph1->dpd_support == 0 || 1708 iph1->rmconf->dpd_interval == 0) 1709 return 0; 1710 1711 if(retry) 1712 iph1->dpd_r_u = sched_new(iph1->rmconf->dpd_retry, 1713 isakmp_info_send_r_u, iph1); 1714 else 1715 iph1->dpd_r_u = sched_new(iph1->rmconf->dpd_interval, 1716 isakmp_info_send_r_u, iph1); 1717 1718 return 0; 1719} 1720#endif 1721