isakmp_inf.c revision 1.7
1/* $NetBSD: isakmp_inf.c,v 1.7 2005/07/12 21:33:01 manu Exp $ */ 2 3/* $Id: isakmp_inf.c,v 1.7 2005/07/12 21:33:01 manu Exp $ */ 4 5/* 6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. Neither the name of the project nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34#include "config.h" 35 36#include <sys/types.h> 37#include <sys/param.h> 38#include <sys/socket.h> 39 40#include <net/pfkeyv2.h> 41#include <netinet/in.h> 42#include <sys/queue.h> 43#ifndef HAVE_NETINET6_IPSEC 44#include <netinet/ipsec.h> 45#else 46#include <netinet6/ipsec.h> 47#endif 48 49#include <stdlib.h> 50#include <stdio.h> 51#include <string.h> 52#include <errno.h> 53#if TIME_WITH_SYS_TIME 54# include <sys/time.h> 55# include <time.h> 56#else 57# if HAVE_SYS_TIME_H 58# include <sys/time.h> 59# else 60# include <time.h> 61# endif 62#endif 63 64#include "libpfkey.h" 65 66#include "var.h" 67#include "vmbuf.h" 68#include "schedule.h" 69#include "str2val.h" 70#include "misc.h" 71#include "plog.h" 72#include "debug.h" 73 74#include "localconf.h" 75#include "remoteconf.h" 76#include "sockmisc.h" 77#include "isakmp_var.h" 78#include "evt.h" 79#include "isakmp.h" 80#ifdef ENABLE_HYBRID 81#include "isakmp_xauth.h" 82#include "isakmp_cfg.h" 83#endif 84#include "isakmp_inf.h" 85#include "oakley.h" 86#include "handler.h" 87#include "ipsec_doi.h" 88#include "crypto_openssl.h" 89#include "pfkey.h" 90#include "policy.h" 91#include "algorithm.h" 92#include "proposal.h" 93#include "admin.h" 94#include "strnames.h" 95 96/* information exchange */ 97static int isakmp_info_recv_n __P((struct ph1handle *, vchar_t *)); 98static int isakmp_info_recv_d __P((struct ph1handle *, vchar_t *)); 99 100#ifdef ENABLE_DPD 101static int isakmp_info_recv_r_u __P((struct ph1handle *, 102 struct isakmp_pl_ru *, u_int32_t)); 103static int isakmp_info_recv_r_u_ack __P((struct ph1handle *, 104 struct isakmp_pl_ru *, u_int32_t)); 105static void isakmp_info_send_r_u __P((void *)); 106#endif 107 108static void purge_isakmp_spi __P((int, isakmp_index *, size_t)); 109static void purge_ipsec_spi __P((struct sockaddr *, int, u_int32_t *, size_t)); 110static void info_recv_initialcontact __P((struct ph1handle *)); 111 112/* %%% 113 * Information Exchange 114 */ 115/* 116 * receive Information 117 */ 118int 119isakmp_info_recv(iph1, msg0) 120 struct ph1handle *iph1; 121 vchar_t *msg0; 122{ 123 vchar_t *msg = NULL; 124 int error = -1; 125 struct isakmp *isakmp; 126 struct isakmp_gen *gen; 127 u_int8_t np; 128 int encrypted; 129 130 plog(LLV_DEBUG, LOCATION, NULL, "receive Information.\n"); 131 132 encrypted = ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E); 133 134 /* Use new IV to decrypt Informational message. */ 135 if (encrypted) { 136 137 struct isakmp_ivm *ivm; 138 139 /* compute IV */ 140 ivm = oakley_newiv2(iph1, ((struct isakmp *)msg0->v)->msgid); 141 if (ivm == NULL) 142 return -1; 143 144 msg = oakley_do_decrypt(iph1, msg0, ivm->iv, ivm->ive); 145 oakley_delivm(ivm); 146 if (msg == NULL) 147 return -1; 148 149 } else 150 msg = vdup(msg0); 151 152 /* Safety check */ 153 if (msg->l < sizeof(*isakmp) + sizeof(*gen)) { 154 plog(LLV_ERROR, LOCATION, NULL, 155 "ignore information because the " 156 "message is way too short\n"); 157 goto end; 158 } 159 160 isakmp = (struct isakmp *)msg->v; 161 gen = (struct isakmp_gen *)((caddr_t)isakmp + sizeof(struct isakmp)); 162 163 if (isakmp->np != ISAKMP_NPTYPE_HASH) { 164 plog(LLV_ERROR, LOCATION, NULL, 165 "ignore information because the message has no hash payload.\n"); 166 goto end; 167 } 168 169 if (iph1->status != PHASE1ST_ESTABLISHED) { 170 plog(LLV_ERROR, LOCATION, NULL, 171 "ignore information because ISAKMP-SA has not been established yet.\n"); 172 goto end; 173 } 174 175 np = gen->np; 176 177 { 178 void *p; 179 vchar_t *hash, *payload; 180 struct isakmp_gen *nd; 181 182 /* Safety check */ 183 if (msg->l < sizeof(*isakmp) + ntohs(gen->len) + sizeof(*nd)) { 184 plog(LLV_ERROR, LOCATION, NULL, 185 "ignore information because the " 186 "message is too short\n"); 187 goto end; 188 } 189 190 p = (caddr_t) gen + sizeof(struct isakmp_gen); 191 nd = (struct isakmp_gen *) ((caddr_t) gen + ntohs(gen->len)); 192 193 /* nd length check */ 194 if (ntohs(nd->len) > msg->l - (sizeof(struct isakmp) + 195 ntohs(gen->len))) { 196 plog(LLV_ERROR, LOCATION, NULL, 197 "too long payload length (broken message?)\n"); 198 goto end; 199 } 200 201 if (ntohs(nd->len) < sizeof(*nd)) { 202 plog(LLV_ERROR, LOCATION, NULL, 203 "too short payload length (broken message?)\n"); 204 goto end; 205 } 206 207 payload = vmalloc(ntohs(nd->len)); 208 if (payload == NULL) { 209 plog(LLV_ERROR, LOCATION, NULL, 210 "cannot allocate memory\n"); 211 goto end; 212 } 213 214 memcpy(payload->v, (caddr_t) nd, ntohs(nd->len)); 215 216 /* compute HASH */ 217 hash = oakley_compute_hash1(iph1, isakmp->msgid, payload); 218 if (hash == NULL) { 219 plog(LLV_ERROR, LOCATION, NULL, 220 "cannot compute hash\n"); 221 222 vfree(payload); 223 goto end; 224 } 225 226 if (ntohs(gen->len) - sizeof(struct isakmp_gen) != hash->l) { 227 plog(LLV_ERROR, LOCATION, NULL, 228 "ignore information due to hash length mismatch\n"); 229 230 vfree(hash); 231 vfree(payload); 232 goto end; 233 } 234 235 if (memcmp(p, hash->v, hash->l) != 0) { 236 plog(LLV_ERROR, LOCATION, NULL, 237 "ignore information due to hash mismatch\n"); 238 239 vfree(hash); 240 vfree(payload); 241 goto end; 242 } 243 244 plog(LLV_DEBUG, LOCATION, NULL, "hash validated.\n"); 245 246 vfree(hash); 247 vfree(payload); 248 } 249 250 /* make sure the packet were encrypted. */ 251 if (!encrypted) { 252 switch (iph1->etype) { 253 case ISAKMP_ETYPE_AGG: 254 case ISAKMP_ETYPE_BASE: 255 case ISAKMP_ETYPE_IDENT: 256 if ((iph1->side == INITIATOR && iph1->status < PHASE1ST_MSG3SENT) 257 || (iph1->side == RESPONDER && iph1->status < PHASE1ST_MSG2SENT)) { 258 break; 259 } 260 /*FALLTHRU*/ 261 default: 262 plog(LLV_ERROR, LOCATION, iph1->remote, 263 "%s message must be encrypted\n", 264 s_isakmp_nptype(np)); 265 goto end; 266 } 267 } 268 269 switch (np) { 270 case ISAKMP_NPTYPE_N: 271 if (isakmp_info_recv_n(iph1, msg) < 0) 272 goto end; 273 break; 274 case ISAKMP_NPTYPE_D: 275 if (isakmp_info_recv_d(iph1, msg) < 0) 276 goto end; 277 break; 278 case ISAKMP_NPTYPE_NONCE: 279 /* XXX to be 6.4.2 ike-01.txt */ 280 /* XXX IV is to be synchronized. */ 281 plog(LLV_ERROR, LOCATION, iph1->remote, 282 "ignore Acknowledged Informational\n"); 283 break; 284 default: 285 /* don't send information, see isakmp_ident_r1() */ 286 error = 0; 287 plog(LLV_ERROR, LOCATION, iph1->remote, 288 "reject the packet, " 289 "received unexpecting payload type %d.\n", 290 gen->np); 291 goto end; 292 } 293 294 end: 295 if (msg != NULL) 296 vfree(msg); 297 298 return 0; 299} 300 301/* 302 * send Delete payload (for ISAKMP SA) in Informational exchange. 303 */ 304int 305isakmp_info_send_d1(iph1) 306 struct ph1handle *iph1; 307{ 308 struct isakmp_pl_d *d; 309 vchar_t *payload = NULL; 310 int tlen; 311 int error = 0; 312 313 if (iph1->status != PHASE2ST_ESTABLISHED) 314 return 0; 315 316 /* create delete payload */ 317 318 /* send SPIs of inbound SAs. */ 319 /* XXX should send outbound SAs's ? */ 320 tlen = sizeof(*d) + sizeof(isakmp_index); 321 payload = vmalloc(tlen); 322 if (payload == NULL) { 323 plog(LLV_ERROR, LOCATION, NULL, 324 "failed to get buffer for payload.\n"); 325 return errno; 326 } 327 328 d = (struct isakmp_pl_d *)payload->v; 329 d->h.np = ISAKMP_NPTYPE_NONE; 330 d->h.len = htons(tlen); 331 d->doi = htonl(IPSEC_DOI); 332 d->proto_id = IPSECDOI_PROTO_ISAKMP; 333 d->spi_size = sizeof(isakmp_index); 334 d->num_spi = htons(1); 335 memcpy(d + 1, &iph1->index, sizeof(isakmp_index)); 336 337 error = isakmp_info_send_common(iph1, payload, 338 ISAKMP_NPTYPE_D, 0); 339 vfree(payload); 340 341 return error; 342} 343 344/* 345 * send Delete payload (for IPsec SA) in Informational exchange, based on 346 * pfkey msg. It sends always single SPI. 347 */ 348int 349isakmp_info_send_d2(iph2) 350 struct ph2handle *iph2; 351{ 352 struct ph1handle *iph1; 353 struct saproto *pr; 354 struct isakmp_pl_d *d; 355 vchar_t *payload = NULL; 356 int tlen; 357 int error = 0; 358 u_int8_t *spi; 359 360 if (iph2->status != PHASE2ST_ESTABLISHED) 361 return 0; 362 363 /* 364 * don't send delete information if there is no phase 1 handler. 365 * It's nonsensical to negotiate phase 1 to send the information. 366 */ 367 iph1 = getph1byaddr(iph2->src, iph2->dst); 368 if (iph1 == NULL) 369 return 0; 370 371 /* create delete payload */ 372 for (pr = iph2->approval->head; pr != NULL; pr = pr->next) { 373 374 /* send SPIs of inbound SAs. */ 375 /* 376 * XXX should I send outbound SAs's ? 377 * I send inbound SAs's SPI only at the moment because I can't 378 * decode any more if peer send encoded packet without aware of 379 * deletion of SA. Outbound SAs don't come under the situation. 380 */ 381 tlen = sizeof(*d) + pr->spisize; 382 payload = vmalloc(tlen); 383 if (payload == NULL) { 384 plog(LLV_ERROR, LOCATION, NULL, 385 "failed to get buffer for payload.\n"); 386 return errno; 387 } 388 389 d = (struct isakmp_pl_d *)payload->v; 390 d->h.np = ISAKMP_NPTYPE_NONE; 391 d->h.len = htons(tlen); 392 d->doi = htonl(IPSEC_DOI); 393 d->proto_id = pr->proto_id; 394 d->spi_size = pr->spisize; 395 d->num_spi = htons(1); 396 /* 397 * XXX SPI bits are left-filled, for use with IPComp. 398 * we should be switching to variable-length spi field... 399 */ 400 spi = (u_int8_t *)&pr->spi; 401 spi += sizeof(pr->spi); 402 spi -= pr->spisize; 403 memcpy(d + 1, spi, pr->spisize); 404 405 error = isakmp_info_send_common(iph1, payload, 406 ISAKMP_NPTYPE_D, 0); 407 vfree(payload); 408 } 409 410 return error; 411} 412 413/* 414 * send Notification payload (for without ISAKMP SA) in Informational exchange 415 */ 416int 417isakmp_info_send_nx(isakmp, remote, local, type, data) 418 struct isakmp *isakmp; 419 struct sockaddr *remote, *local; 420 int type; 421 vchar_t *data; 422{ 423 struct ph1handle *iph1 = NULL; 424 struct remoteconf *rmconf; 425 vchar_t *payload = NULL; 426 int tlen; 427 int error = -1; 428 struct isakmp_pl_n *n; 429 int spisiz = 0; /* see below */ 430 431 /* search appropreate configuration */ 432 rmconf = getrmconf(remote); 433 if (rmconf == NULL) { 434 plog(LLV_ERROR, LOCATION, remote, 435 "no configuration found for peer address.\n"); 436 goto end; 437 } 438 439 /* add new entry to isakmp status table. */ 440 iph1 = newph1(); 441 if (iph1 == NULL) 442 return -1; 443 444 memcpy(&iph1->index.i_ck, &isakmp->i_ck, sizeof(cookie_t)); 445 isakmp_newcookie((char *)&iph1->index.r_ck, remote, local); 446 iph1->status = PHASE1ST_START; 447 iph1->rmconf = rmconf; 448 iph1->side = INITIATOR; 449 iph1->version = isakmp->v; 450 iph1->flags = 0; 451 iph1->msgid = 0; /* XXX */ 452#ifdef ENABLE_HYBRID 453 if ((iph1->mode_cfg = isakmp_cfg_mkstate()) == NULL) 454 return -1; 455#endif 456#ifdef ENABLE_FRAG 457 iph1->frag = 0; 458 iph1->frag_chain = NULL; 459#endif 460 461 /* copy remote address */ 462 if (copy_ph1addresses(iph1, rmconf, remote, local) < 0) 463 return -1; 464 465 tlen = sizeof(*n) + spisiz; 466 if (data) 467 tlen += data->l; 468 payload = vmalloc(tlen); 469 if (payload == NULL) { 470 plog(LLV_ERROR, LOCATION, NULL, 471 "failed to get buffer to send.\n"); 472 goto end; 473 } 474 475 n = (struct isakmp_pl_n *)payload->v; 476 n->h.np = ISAKMP_NPTYPE_NONE; 477 n->h.len = htons(tlen); 478 n->doi = htonl(IPSEC_DOI); 479 n->proto_id = IPSECDOI_KEY_IKE; 480 n->spi_size = spisiz; 481 n->type = htons(type); 482 if (spisiz) 483 memset(n + 1, 0, spisiz); /*XXX*/ 484 if (data) 485 memcpy((caddr_t)(n + 1) + spisiz, data->v, data->l); 486 487 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 0); 488 vfree(payload); 489 490 end: 491 if (iph1 != NULL) 492 delph1(iph1); 493 494 return error; 495} 496 497/* 498 * send Notification payload (for ISAKMP SA) in Informational exchange 499 */ 500int 501isakmp_info_send_n1(iph1, type, data) 502 struct ph1handle *iph1; 503 int type; 504 vchar_t *data; 505{ 506 vchar_t *payload = NULL; 507 int tlen; 508 int error = 0; 509 struct isakmp_pl_n *n; 510 int spisiz; 511 512 /* 513 * note on SPI size: which description is correct? I have chosen 514 * this to be 0. 515 * 516 * RFC2408 3.1, 2nd paragraph says: ISAKMP SA is identified by 517 * Initiator/Responder cookie and SPI has no meaning, SPI size = 0. 518 * RFC2408 3.1, first paragraph on page 40: ISAKMP SA is identified 519 * by cookie and SPI has no meaning, 0 <= SPI size <= 16. 520 * RFC2407 4.6.3.3, INITIAL-CONTACT is required to set to 16. 521 */ 522 if (type == ISAKMP_NTYPE_INITIAL_CONTACT) 523 spisiz = sizeof(isakmp_index); 524 else 525 spisiz = 0; 526 527 tlen = sizeof(*n) + spisiz; 528 if (data) 529 tlen += data->l; 530 payload = vmalloc(tlen); 531 if (payload == NULL) { 532 plog(LLV_ERROR, LOCATION, NULL, 533 "failed to get buffer to send.\n"); 534 return errno; 535 } 536 537 n = (struct isakmp_pl_n *)payload->v; 538 n->h.np = ISAKMP_NPTYPE_NONE; 539 n->h.len = htons(tlen); 540 n->doi = htonl(iph1->rmconf->doitype); 541 n->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX to be configurable ? */ 542 n->spi_size = spisiz; 543 n->type = htons(type); 544 if (spisiz) 545 memcpy(n + 1, &iph1->index, sizeof(isakmp_index)); 546 if (data) 547 memcpy((caddr_t)(n + 1) + spisiz, data->v, data->l); 548 549 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, iph1->flags); 550 vfree(payload); 551 552 return error; 553} 554 555/* 556 * send Notification payload (for IPsec SA) in Informational exchange 557 */ 558int 559isakmp_info_send_n2(iph2, type, data) 560 struct ph2handle *iph2; 561 int type; 562 vchar_t *data; 563{ 564 struct ph1handle *iph1 = iph2->ph1; 565 vchar_t *payload = NULL; 566 int tlen; 567 int error = 0; 568 struct isakmp_pl_n *n; 569 struct saproto *pr; 570 571 if (!iph2->approval) 572 return EINVAL; 573 574 pr = iph2->approval->head; 575 576 /* XXX must be get proper spi */ 577 tlen = sizeof(*n) + pr->spisize; 578 if (data) 579 tlen += data->l; 580 payload = vmalloc(tlen); 581 if (payload == NULL) { 582 plog(LLV_ERROR, LOCATION, NULL, 583 "failed to get buffer to send.\n"); 584 return errno; 585 } 586 587 n = (struct isakmp_pl_n *)payload->v; 588 n->h.np = ISAKMP_NPTYPE_NONE; 589 n->h.len = htons(tlen); 590 n->doi = htonl(IPSEC_DOI); /* IPSEC DOI (1) */ 591 n->proto_id = pr->proto_id; /* IPSEC AH/ESP/whatever*/ 592 n->spi_size = pr->spisize; 593 n->type = htons(type); 594 *(u_int32_t *)(n + 1) = pr->spi; 595 if (data) 596 memcpy((caddr_t)(n + 1) + pr->spisize, data->v, data->l); 597 598 iph2->flags |= ISAKMP_FLAG_E; /* XXX Should we do FLAG_A ? */ 599 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, iph2->flags); 600 vfree(payload); 601 602 return error; 603} 604 605/* 606 * send Information 607 * When ph1->skeyid_a == NULL, send message without encoding. 608 */ 609int 610isakmp_info_send_common(iph1, payload, np, flags) 611 struct ph1handle *iph1; 612 vchar_t *payload; 613 u_int32_t np; 614 int flags; 615{ 616 struct ph2handle *iph2 = NULL; 617 vchar_t *hash = NULL; 618 struct isakmp *isakmp; 619 struct isakmp_gen *gen; 620 char *p; 621 int tlen; 622 int error = -1; 623 624 /* add new entry to isakmp status table */ 625 iph2 = newph2(); 626 if (iph2 == NULL) 627 goto end; 628 629 iph2->dst = dupsaddr(iph1->remote); 630 iph2->src = dupsaddr(iph1->local); 631 switch (iph1->remote->sa_family) { 632 case AF_INET: 633#ifndef ENABLE_NATT 634 ((struct sockaddr_in *)iph2->dst)->sin_port = 0; 635 ((struct sockaddr_in *)iph2->src)->sin_port = 0; 636#endif 637 break; 638#ifdef INET6 639 case AF_INET6: 640 ((struct sockaddr_in6 *)iph2->dst)->sin6_port = 0; 641 ((struct sockaddr_in6 *)iph2->src)->sin6_port = 0; 642 break; 643#endif 644 default: 645 plog(LLV_ERROR, LOCATION, NULL, 646 "invalid family: %d\n", iph1->remote->sa_family); 647 delph2(iph2); 648 goto end; 649 } 650 iph2->ph1 = iph1; 651 iph2->side = INITIATOR; 652 iph2->status = PHASE2ST_START; 653 iph2->msgid = isakmp_newmsgid2(iph1); 654 655 /* get IV and HASH(1) if skeyid_a was generated. */ 656 if (iph1->skeyid_a != NULL) { 657 iph2->ivm = oakley_newiv2(iph1, iph2->msgid); 658 if (iph2->ivm == NULL) { 659 delph2(iph2); 660 goto end; 661 } 662 663 /* generate HASH(1) */ 664 hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, payload); 665 if (hash == NULL) { 666 delph2(iph2); 667 goto end; 668 } 669 670 /* initialized total buffer length */ 671 tlen = hash->l; 672 tlen += sizeof(*gen); 673 } else { 674 /* IKE-SA is not established */ 675 hash = NULL; 676 677 /* initialized total buffer length */ 678 tlen = 0; 679 } 680 if ((flags & ISAKMP_FLAG_A) == 0) 681 iph2->flags = (hash == NULL ? 0 : ISAKMP_FLAG_E); 682 else 683 iph2->flags = (hash == NULL ? 0 : ISAKMP_FLAG_A); 684 685 insph2(iph2); 686 bindph12(iph1, iph2); 687 688 tlen += sizeof(*isakmp) + payload->l; 689 690 /* create buffer for isakmp payload */ 691 iph2->sendbuf = vmalloc(tlen); 692 if (iph2->sendbuf == NULL) { 693 plog(LLV_ERROR, LOCATION, NULL, 694 "failed to get buffer to send.\n"); 695 goto err; 696 } 697 698 /* create isakmp header */ 699 isakmp = (struct isakmp *)iph2->sendbuf->v; 700 memcpy(&isakmp->i_ck, &iph1->index.i_ck, sizeof(cookie_t)); 701 memcpy(&isakmp->r_ck, &iph1->index.r_ck, sizeof(cookie_t)); 702 isakmp->np = hash == NULL ? (np & 0xff) : ISAKMP_NPTYPE_HASH; 703 isakmp->v = iph1->version; 704 isakmp->etype = ISAKMP_ETYPE_INFO; 705 isakmp->flags = iph2->flags; 706 memcpy(&isakmp->msgid, &iph2->msgid, sizeof(isakmp->msgid)); 707 isakmp->len = htonl(tlen); 708 p = (char *)(isakmp + 1); 709 710 /* create HASH payload */ 711 if (hash != NULL) { 712 gen = (struct isakmp_gen *)p; 713 gen->np = np & 0xff; 714 gen->len = htons(sizeof(*gen) + hash->l); 715 p += sizeof(*gen); 716 memcpy(p, hash->v, hash->l); 717 p += hash->l; 718 } 719 720 /* add payload */ 721 memcpy(p, payload->v, payload->l); 722 p += payload->l; 723 724#ifdef HAVE_PRINT_ISAKMP_C 725 isakmp_printpacket(iph2->sendbuf, iph1->local, iph1->remote, 1); 726#endif 727 728 /* encoding */ 729 if (ISSET(isakmp->flags, ISAKMP_FLAG_E)) { 730 vchar_t *tmp; 731 732 tmp = oakley_do_encrypt(iph2->ph1, iph2->sendbuf, iph2->ivm->ive, 733 iph2->ivm->iv); 734 VPTRINIT(iph2->sendbuf); 735 if (tmp == NULL) 736 goto err; 737 iph2->sendbuf = tmp; 738 } 739 740 /* HDR*, HASH(1), N */ 741 if (isakmp_send(iph2->ph1, iph2->sendbuf) < 0) { 742 VPTRINIT(iph2->sendbuf); 743 goto err; 744 } 745 746 plog(LLV_DEBUG, LOCATION, NULL, 747 "sendto Information %s.\n", s_isakmp_nptype(np)); 748 749 /* 750 * don't resend notify message because peer can use Acknowledged 751 * Informational if peer requires the reply of the notify message. 752 */ 753 754 /* XXX If Acknowledged Informational required, don't delete ph2handle */ 755 error = 0; 756 VPTRINIT(iph2->sendbuf); 757 goto err; /* XXX */ 758 759end: 760 if (hash) 761 vfree(hash); 762 return error; 763 764err: 765 unbindph12(iph2); 766 remph2(iph2); 767 delph2(iph2); 768 goto end; 769} 770 771/* 772 * add a notify payload to buffer by reallocating buffer. 773 * If buf == NULL, the function only create a notify payload. 774 * 775 * XXX Which is SPI to be included, inbound or outbound ? 776 */ 777vchar_t * 778isakmp_add_pl_n(buf0, np_p, type, pr, data) 779 vchar_t *buf0; 780 u_int8_t **np_p; 781 int type; 782 struct saproto *pr; 783 vchar_t *data; 784{ 785 vchar_t *buf = NULL; 786 struct isakmp_pl_n *n; 787 int tlen; 788 int oldlen = 0; 789 790 if (*np_p) 791 **np_p = ISAKMP_NPTYPE_N; 792 793 tlen = sizeof(*n) + pr->spisize; 794 795 if (data) 796 tlen += data->l; 797 if (buf0) { 798 oldlen = buf0->l; 799 buf = vrealloc(buf0, buf0->l + tlen); 800 } else 801 buf = vmalloc(tlen); 802 if (!buf) { 803 plog(LLV_ERROR, LOCATION, NULL, 804 "failed to get a payload buffer.\n"); 805 return NULL; 806 } 807 808 n = (struct isakmp_pl_n *)(buf->v + oldlen); 809 n->h.np = ISAKMP_NPTYPE_NONE; 810 n->h.len = htons(tlen); 811 n->doi = htonl(IPSEC_DOI); /* IPSEC DOI (1) */ 812 n->proto_id = pr->proto_id; /* IPSEC AH/ESP/whatever*/ 813 n->spi_size = pr->spisize; 814 n->type = htons(type); 815 *(u_int32_t *)(n + 1) = pr->spi; /* XXX */ 816 if (data) 817 memcpy((caddr_t)(n + 1) + pr->spisize, data->v, data->l); 818 819 /* save the pointer of next payload type */ 820 *np_p = &n->h.np; 821 822 return buf; 823} 824 825/* 826 * handling to receive Notification payload 827 */ 828static int 829isakmp_info_recv_n(iph1, msg) 830 struct ph1handle *iph1; 831 vchar_t *msg; 832{ 833 struct isakmp_pl_n *n = NULL; 834 u_int type; 835 vchar_t *pbuf; 836 struct isakmp_parse_t *pa, *pap; 837 char *spi; 838 839 if (!(pbuf = isakmp_parse(msg))) 840 return -1; 841 pa = (struct isakmp_parse_t *)pbuf->v; 842 for (pap = pa; pap->type; pap++) { 843 switch (pap->type) { 844 case ISAKMP_NPTYPE_HASH: 845 /* do something here */ 846 break; 847 case ISAKMP_NPTYPE_NONCE: 848 /* send to ack */ 849 break; 850 case ISAKMP_NPTYPE_N: 851 n = (struct isakmp_pl_n *)pap->ptr; 852 break; 853 default: 854 vfree(pbuf); 855 return -1; 856 } 857 } 858 vfree(pbuf); 859 if (!n) 860 return -1; 861 862 type = ntohs(n->type); 863 864 switch (type) { 865 case ISAKMP_NTYPE_CONNECTED: 866 case ISAKMP_NTYPE_RESPONDER_LIFETIME: 867 case ISAKMP_NTYPE_REPLAY_STATUS: 868 /* do something */ 869 break; 870 case ISAKMP_NTYPE_INITIAL_CONTACT: 871 info_recv_initialcontact(iph1); 872 break; 873#ifdef ENABLE_DPD 874 case ISAKMP_NTYPE_R_U_THERE: 875 isakmp_info_recv_r_u(iph1, (struct isakmp_pl_ru *)n, 876 ((struct isakmp *)msg->v)->msgid); 877 break; 878 case ISAKMP_NTYPE_R_U_THERE_ACK: 879 isakmp_info_recv_r_u_ack(iph1, (struct isakmp_pl_ru *)n, 880 ((struct isakmp *)msg->v)->msgid); 881 break; 882#endif 883 884 default: 885 { 886 u_int32_t msgid = ((struct isakmp *)msg->v)->msgid; 887 struct ph2handle *iph2; 888 889 /* XXX there is a potential of dos attack. */ 890 if (msgid == 0) { 891 /* delete ph1 */ 892 plog(LLV_ERROR, LOCATION, iph1->remote, 893 "delete phase1 handle.\n"); 894 return -1; 895 } else { 896 iph2 = getph2bymsgid(iph1, msgid); 897 if (iph2 == NULL) { 898 plog(LLV_ERROR, LOCATION, iph1->remote, 899 "unknown notify message, " 900 "no phase2 handle found.\n"); 901 } else { 902 /* delete ph2 */ 903 unbindph12(iph2); 904 remph2(iph2); 905 delph2(iph2); 906 } 907 } 908 } 909 break; 910 } 911 912 /* get spi and allocate */ 913 if (ntohs(n->h.len) < sizeof(*n) + n->spi_size) { 914 plog(LLV_ERROR, LOCATION, iph1->remote, 915 "invalid spi_size in notification payload.\n"); 916 return -1; 917 } 918 spi = val2str((u_char *)(n + 1), n->spi_size); 919 920 plog(LLV_DEBUG, LOCATION, iph1->remote, 921 "notification message %d:%s, " 922 "doi=%d proto_id=%d spi=%s(size=%d).\n", 923 type, s_isakmp_notify_msg(type), 924 ntohl(n->doi), n->proto_id, spi, n->spi_size); 925 926 racoon_free(spi); 927 928 return(0); 929} 930 931void 932purge_isakmp_spi(proto, spi, n) 933 int proto; 934 isakmp_index *spi; /*network byteorder*/ 935 size_t n; 936{ 937 struct ph1handle *iph1; 938 size_t i; 939 940 for (i = 0; i < n; i++) { 941 iph1 = getph1byindex(&spi[i]); 942 if (!iph1) 943 continue; 944 945 plog(LLV_INFO, LOCATION, NULL, 946 "purged ISAKMP-SA proto_id=%s spi=%s.\n", 947 s_ipsecdoi_proto(proto), 948 isakmp_pindex(&spi[i], 0)); 949 950 if (iph1->sce) 951 SCHED_KILL(iph1->sce); 952 iph1->status = PHASE1ST_EXPIRED; 953 iph1->sce = sched_new(1, isakmp_ph1delete_stub, iph1); 954 } 955} 956 957static void 958purge_ipsec_spi(dst0, proto, spi, n) 959 struct sockaddr *dst0; 960 int proto; 961 u_int32_t *spi; /*network byteorder*/ 962 size_t n; 963{ 964 vchar_t *buf = NULL; 965 struct sadb_msg *msg, *next, *end; 966 struct sadb_sa *sa; 967 struct sockaddr *src, *dst; 968 struct ph2handle *iph2; 969 size_t i; 970 caddr_t mhp[SADB_EXT_MAX + 1]; 971 972 buf = pfkey_dump_sadb(ipsecdoi2pfkey_proto(proto)); 973 if (buf == NULL) { 974 plog(LLV_DEBUG, LOCATION, NULL, 975 "pfkey_dump_sadb returned nothing.\n"); 976 return; 977 } 978 979 msg = (struct sadb_msg *)buf->v; 980 end = (struct sadb_msg *)(buf->v + buf->l); 981 982 while (msg < end) { 983 if ((msg->sadb_msg_len << 3) < sizeof(*msg)) 984 break; 985 next = (struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3)); 986 if (msg->sadb_msg_type != SADB_DUMP) { 987 msg = next; 988 continue; 989 } 990 991 if (pfkey_align(msg, mhp) || pfkey_check(mhp)) { 992 plog(LLV_ERROR, LOCATION, NULL, 993 "pfkey_check (%s)\n", ipsec_strerror()); 994 msg = next; 995 continue; 996 } 997 998 sa = (struct sadb_sa *)(mhp[SADB_EXT_SA]); 999 if (!sa 1000 || !mhp[SADB_EXT_ADDRESS_SRC] 1001 || !mhp[SADB_EXT_ADDRESS_DST]) { 1002 msg = next; 1003 continue; 1004 } 1005 src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]); 1006 dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]); 1007 1008 if (sa->sadb_sa_state != SADB_SASTATE_MATURE 1009 && sa->sadb_sa_state != SADB_SASTATE_DYING) { 1010 msg = next; 1011 continue; 1012 } 1013 1014 /* XXX n^2 algorithm, inefficient */ 1015 1016 /* don't delete inbound SAs at the moment */ 1017 /* XXX should we remove SAs with opposite direction as well? */ 1018 if (CMPSADDR(dst0, dst)) { 1019 msg = next; 1020 continue; 1021 } 1022 1023 for (i = 0; i < n; i++) { 1024 plog(LLV_DEBUG, LOCATION, NULL, 1025 "check spi(packet)=%u spi(db)=%u.\n", 1026 ntohl(spi[i]), ntohl(sa->sadb_sa_spi)); 1027 if (spi[i] != sa->sadb_sa_spi) 1028 continue; 1029 1030 pfkey_send_delete(lcconf->sock_pfkey, 1031 msg->sadb_msg_satype, 1032 IPSEC_MODE_ANY, 1033 src, dst, sa->sadb_sa_spi); 1034 1035 /* 1036 * delete a relative phase 2 handler. 1037 * continue to process if no relative phase 2 handler 1038 * exists. 1039 */ 1040 iph2 = getph2bysaidx(src, dst, proto, spi[i]); 1041 if (iph2) { 1042 delete_spd(iph2); 1043 unbindph12(iph2); 1044 remph2(iph2); 1045 delph2(iph2); 1046 } 1047 1048 plog(LLV_INFO, LOCATION, NULL, 1049 "purged IPsec-SA proto_id=%s spi=%u.\n", 1050 s_ipsecdoi_proto(proto), 1051 ntohl(spi[i])); 1052 } 1053 1054 msg = next; 1055 } 1056 1057 if (buf) 1058 vfree(buf); 1059} 1060 1061/* 1062 * delete all phase2 sa relatived to the destination address. 1063 * Don't delete Phase 1 handlers on INITIAL-CONTACT, and don't ignore 1064 * an INITIAL-CONTACT if we have contacted the peer. This matches the 1065 * Sun IKE behavior, and makes rekeying work much better when the peer 1066 * restarts. 1067 */ 1068static void 1069info_recv_initialcontact(iph1) 1070 struct ph1handle *iph1; 1071{ 1072 vchar_t *buf = NULL; 1073 struct sadb_msg *msg, *next, *end; 1074 struct sadb_sa *sa; 1075 struct sockaddr *src, *dst; 1076 caddr_t mhp[SADB_EXT_MAX + 1]; 1077 int proto_id, i; 1078 struct ph2handle *iph2; 1079#if 0 1080 char *loc, *rem; 1081#endif 1082 1083 if (f_local) 1084 return; 1085 1086#if 0 1087 loc = strdup(saddrwop2str(iph1->local)); 1088 rem = strdup(saddrwop2str(iph1->remote)); 1089 1090 /* 1091 * Purge all IPSEC-SAs for the peer. We can do this 1092 * the easy way (using a PF_KEY SADB_DELETE extension) 1093 * or we can do it the hard way. 1094 */ 1095 for (i = 0; i < pfkey_nsatypes; i++) { 1096 proto_id = pfkey2ipsecdoi_proto(pfkey_satypes[i].ps_satype); 1097 1098 plog(LLV_INFO, LOCATION, NULL, 1099 "purging %s SAs for %s -> %s\n", 1100 pfkey_satypes[i].ps_name, loc, rem); 1101 if (pfkey_send_delete_all(lcconf->sock_pfkey, 1102 pfkey_satypes[i].ps_satype, IPSEC_MODE_ANY, 1103 iph1->local, iph1->remote) == -1) { 1104 plog(LLV_ERROR, LOCATION, NULL, 1105 "delete_all %s -> %s failed for %s (%s)\n", 1106 loc, rem, 1107 pfkey_satypes[i].ps_name, ipsec_strerror()); 1108 goto the_hard_way; 1109 } 1110 1111 deleteallph2(iph1->local, iph1->remote, proto_id); 1112 1113 plog(LLV_INFO, LOCATION, NULL, 1114 "purging %s SAs for %s -> %s\n", 1115 pfkey_satypes[i].ps_name, rem, loc); 1116 if (pfkey_send_delete_all(lcconf->sock_pfkey, 1117 pfkey_satypes[i].ps_satype, IPSEC_MODE_ANY, 1118 iph1->remote, iph1->local) == -1) { 1119 plog(LLV_ERROR, LOCATION, NULL, 1120 "delete_all %s -> %s failed for %s (%s)\n", 1121 rem, loc, 1122 pfkey_satypes[i].ps_name, ipsec_strerror()); 1123 goto the_hard_way; 1124 } 1125 1126 deleteallph2(iph1->remote, iph1->local, proto_id); 1127 } 1128 1129 racoon_free(loc); 1130 racoon_free(rem); 1131 return; 1132 1133 the_hard_way: 1134 racoon_free(loc); 1135 racoon_free(rem); 1136#endif 1137 1138 buf = pfkey_dump_sadb(SADB_SATYPE_UNSPEC); 1139 if (buf == NULL) { 1140 plog(LLV_DEBUG, LOCATION, NULL, 1141 "pfkey_dump_sadb returned nothing.\n"); 1142 return; 1143 } 1144 1145 msg = (struct sadb_msg *)buf->v; 1146 end = (struct sadb_msg *)(buf->v + buf->l); 1147 1148 while (msg < end) { 1149 if ((msg->sadb_msg_len << 3) < sizeof(*msg)) 1150 break; 1151 next = (struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3)); 1152 if (msg->sadb_msg_type != SADB_DUMP) { 1153 msg = next; 1154 continue; 1155 } 1156 1157 if (pfkey_align(msg, mhp) || pfkey_check(mhp)) { 1158 plog(LLV_ERROR, LOCATION, NULL, 1159 "pfkey_check (%s)\n", ipsec_strerror()); 1160 msg = next; 1161 continue; 1162 } 1163 1164 if (mhp[SADB_EXT_SA] == NULL 1165 || mhp[SADB_EXT_ADDRESS_SRC] == NULL 1166 || mhp[SADB_EXT_ADDRESS_DST] == NULL) { 1167 msg = next; 1168 continue; 1169 } 1170 sa = (struct sadb_sa *)mhp[SADB_EXT_SA]; 1171 src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]); 1172 dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]); 1173 1174 if (sa->sadb_sa_state != SADB_SASTATE_MATURE 1175 && sa->sadb_sa_state != SADB_SASTATE_DYING) { 1176 msg = next; 1177 continue; 1178 } 1179 1180 /* 1181 * RFC2407 4.6.3.3 INITIAL-CONTACT is the message that 1182 * announces the sender of the message was rebooted. 1183 * it is interpreted to delete all SAs which source address 1184 * is the sender of the message. 1185 * racoon only deletes SA which is matched both the 1186 * source address and the destination accress. 1187 */ 1188 if (CMPSADDR(iph1->local, src) == 0 && 1189 CMPSADDR(iph1->remote, dst) == 0) 1190 ; 1191 else if (CMPSADDR(iph1->remote, src) == 0 && 1192 CMPSADDR(iph1->local, dst) == 0) 1193 ; 1194 else { 1195 msg = next; 1196 continue; 1197 } 1198 1199 /* 1200 * Make sure this is an SATYPE that we manage. 1201 * This is gross; too bad we couldn't do it the 1202 * easy way. 1203 */ 1204 for (i = 0; i < pfkey_nsatypes; i++) { 1205 if (pfkey_satypes[i].ps_satype == 1206 msg->sadb_msg_satype) 1207 break; 1208 } 1209 if (i == pfkey_nsatypes) { 1210 msg = next; 1211 continue; 1212 } 1213 1214 plog(LLV_INFO, LOCATION, NULL, 1215 "purging spi=%u.\n", ntohl(sa->sadb_sa_spi)); 1216 pfkey_send_delete(lcconf->sock_pfkey, 1217 msg->sadb_msg_satype, 1218 IPSEC_MODE_ANY, src, dst, sa->sadb_sa_spi); 1219 1220 /* 1221 * delete a relative phase 2 handler. 1222 * continue to process if no relative phase 2 handler 1223 * exists. 1224 */ 1225 proto_id = pfkey2ipsecdoi_proto(msg->sadb_msg_satype); 1226 iph2 = getph2bysaidx(src, dst, proto_id, sa->sadb_sa_spi); 1227 if (iph2) { 1228 delete_spd(iph2); 1229 unbindph12(iph2); 1230 remph2(iph2); 1231 delph2(iph2); 1232 } 1233 1234 msg = next; 1235 } 1236 1237 vfree(buf); 1238} 1239 1240/* 1241 * handling to receive Deletion payload 1242 */ 1243static int 1244isakmp_info_recv_d(iph1, msg) 1245 struct ph1handle *iph1; 1246 vchar_t *msg; 1247{ 1248 struct isakmp_pl_d *d; 1249 int tlen, num_spi; 1250 vchar_t *pbuf; 1251 struct isakmp_parse_t *pa, *pap; 1252 int protected = 0; 1253 union { 1254 u_int32_t spi32; 1255 u_int16_t spi16[2]; 1256 } spi; 1257 1258 /* validate the type of next payload */ 1259 if (!(pbuf = isakmp_parse(msg))) 1260 return -1; 1261 pa = (struct isakmp_parse_t *)pbuf->v; 1262 for (pap = pa; pap->type; pap++) { 1263 switch (pap->type) { 1264 case ISAKMP_NPTYPE_D: 1265 break; 1266 case ISAKMP_NPTYPE_HASH: 1267 if (pap == pa) { 1268 protected++; 1269 break; 1270 } 1271 plog(LLV_ERROR, LOCATION, iph1->remote, 1272 "received next payload type %d " 1273 "in wrong place (must be the first payload).\n", 1274 pap->type); 1275 vfree(pbuf); 1276 return -1; 1277 default: 1278 /* don't send information, see isakmp_ident_r1() */ 1279 plog(LLV_ERROR, LOCATION, iph1->remote, 1280 "reject the packet, " 1281 "received unexpecting payload type %d.\n", 1282 pap->type); 1283 vfree(pbuf); 1284 return 0; 1285 } 1286 } 1287 1288 if (!protected) { 1289 plog(LLV_ERROR, LOCATION, NULL, 1290 "delete payload is not proteted, " 1291 "ignored.\n"); 1292 vfree(pbuf); 1293 return -1; 1294 } 1295 1296 /* process a delete payload */ 1297 for (pap = pa; pap->type; pap++) { 1298 if (pap->type != ISAKMP_NPTYPE_D) 1299 continue; 1300 1301 d = (struct isakmp_pl_d *)pap->ptr; 1302 1303 if (ntohl(d->doi) != IPSEC_DOI) { 1304 plog(LLV_ERROR, LOCATION, iph1->remote, 1305 "delete payload with invalid doi:%d.\n", 1306 ntohl(d->doi)); 1307#ifdef ENABLE_HYBRID 1308 /* 1309 * At deconnexion time, Cisco VPN client does this 1310 * with a zero DOI. Don't give up in that situation. 1311 */ 1312 if (((iph1->mode_cfg->flags & 1313 ISAKMP_CFG_VENDORID_UNITY) == 0) || (d->doi != 0)) 1314 continue; 1315#else 1316 continue; 1317#endif 1318 } 1319 1320 num_spi = ntohs(d->num_spi); 1321 tlen = ntohs(d->h.len) - sizeof(struct isakmp_pl_d); 1322 1323 if (tlen != num_spi * d->spi_size) { 1324 plog(LLV_ERROR, LOCATION, iph1->remote, 1325 "deletion payload with invalid length.\n"); 1326 vfree(pbuf); 1327 return -1; 1328 } 1329 1330 switch (d->proto_id) { 1331 case IPSECDOI_PROTO_ISAKMP: 1332 if (d->spi_size != sizeof(isakmp_index)) { 1333 plog(LLV_ERROR, LOCATION, iph1->remote, 1334 "delete payload with strange spi " 1335 "size %d(proto_id:%d)\n", 1336 d->spi_size, d->proto_id); 1337 continue; 1338 } 1339 1340 if (iph1->scr) 1341 SCHED_KILL(iph1->scr); 1342 1343 purge_remote(iph1); 1344 break; 1345 1346 case IPSECDOI_PROTO_IPSEC_AH: 1347 case IPSECDOI_PROTO_IPSEC_ESP: 1348 if (d->spi_size != sizeof(u_int32_t)) { 1349 plog(LLV_ERROR, LOCATION, iph1->remote, 1350 "delete payload with strange spi " 1351 "size %d(proto_id:%d)\n", 1352 d->spi_size, d->proto_id); 1353 continue; 1354 } 1355 EVT_PUSH(iph1->local, iph1->remote, 1356 EVTT_PEER_DELETE, NULL); 1357 purge_ipsec_spi(iph1->remote, d->proto_id, 1358 (u_int32_t *)(d + 1), num_spi); 1359 break; 1360 1361 case IPSECDOI_PROTO_IPCOMP: 1362 /* need to handle both 16bit/32bit SPI */ 1363 memset(&spi, 0, sizeof(spi)); 1364 if (d->spi_size == sizeof(spi.spi16[1])) { 1365 memcpy(&spi.spi16[1], d + 1, 1366 sizeof(spi.spi16[1])); 1367 } else if (d->spi_size == sizeof(spi.spi32)) 1368 memcpy(&spi.spi32, d + 1, sizeof(spi.spi32)); 1369 else { 1370 plog(LLV_ERROR, LOCATION, iph1->remote, 1371 "delete payload with strange spi " 1372 "size %d(proto_id:%d)\n", 1373 d->spi_size, d->proto_id); 1374 continue; 1375 } 1376 purge_ipsec_spi(iph1->remote, d->proto_id, 1377 &spi.spi32, num_spi); 1378 break; 1379 1380 default: 1381 plog(LLV_ERROR, LOCATION, iph1->remote, 1382 "deletion message received, " 1383 "invalid proto_id: %d\n", 1384 d->proto_id); 1385 continue; 1386 } 1387 1388 plog(LLV_DEBUG, LOCATION, NULL, "purged SAs.\n"); 1389 } 1390 1391 vfree(pbuf); 1392 1393 return 0; 1394} 1395 1396void 1397isakmp_check_notify(gen, iph1) 1398 struct isakmp_gen *gen; /* points to Notify payload */ 1399 struct ph1handle *iph1; 1400{ 1401 struct isakmp_pl_n *notify = (struct isakmp_pl_n *)gen; 1402 1403 plog(LLV_DEBUG, LOCATION, iph1->remote, 1404 "Notify Message received\n"); 1405 1406 switch (ntohs(notify->type)) { 1407 case ISAKMP_NTYPE_CONNECTED: 1408 plog(LLV_WARNING, LOCATION, iph1->remote, 1409 "ignore CONNECTED notification.\n"); 1410 break; 1411 case ISAKMP_NTYPE_RESPONDER_LIFETIME: 1412 plog(LLV_WARNING, LOCATION, iph1->remote, 1413 "ignore RESPONDER-LIFETIME notification.\n"); 1414 break; 1415 case ISAKMP_NTYPE_REPLAY_STATUS: 1416 plog(LLV_WARNING, LOCATION, iph1->remote, 1417 "ignore REPLAY-STATUS notification.\n"); 1418 break; 1419 case ISAKMP_NTYPE_INITIAL_CONTACT: 1420 plog(LLV_WARNING, LOCATION, iph1->remote, 1421 "ignore INITIAL-CONTACT notification, " 1422 "because it is only accepted after phase1.\n"); 1423 break; 1424 case ISAKMP_NTYPE_HEARTBEAT: 1425 plog(LLV_WARNING, LOCATION, iph1->remote, 1426 "ignore HEARTBEAT notification\n"); 1427 break; 1428 default: 1429 isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL); 1430 plog(LLV_ERROR, LOCATION, iph1->remote, 1431 "received unknown notification type %u.\n", 1432 ntohs(notify->type)); 1433 } 1434 1435 return; 1436} 1437 1438 1439#ifdef ENABLE_DPD 1440static int 1441isakmp_info_recv_r_u (iph1, ru, msgid) 1442 struct ph1handle *iph1; 1443 struct isakmp_pl_ru *ru; 1444 u_int32_t msgid; 1445{ 1446 struct isakmp_pl_ru *ru_ack; 1447 vchar_t *payload = NULL; 1448 int tlen; 1449 int error = 0; 1450 1451 plog(LLV_DEBUG, LOCATION, iph1->remote, 1452 "DPD R-U-There received\n"); 1453 1454 /* XXX should compare cookies with iph1->index? 1455 Or is this already done by calling function? */ 1456 tlen = sizeof(*ru_ack); 1457 payload = vmalloc(tlen); 1458 if (payload == NULL) { 1459 plog(LLV_ERROR, LOCATION, NULL, 1460 "failed to get buffer to send.\n"); 1461 return errno; 1462 } 1463 1464 ru_ack = (struct isakmp_pl_ru *)payload->v; 1465 ru_ack->h.np = ISAKMP_NPTYPE_NONE; 1466 ru_ack->h.len = htons(tlen); 1467 ru_ack->doi = htonl(IPSEC_DOI); 1468 ru_ack->type = htons(ISAKMP_NTYPE_R_U_THERE_ACK); 1469 ru_ack->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX ? */ 1470 ru_ack->spi_size = sizeof(isakmp_index); 1471 memcpy(ru_ack->i_ck, ru->i_ck, sizeof(cookie_t)); 1472 memcpy(ru_ack->r_ck, ru->r_ck, sizeof(cookie_t)); 1473 ru_ack->data = ru->data; 1474 1475 /* XXX Should we do FLAG_A ? */ 1476 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 1477 ISAKMP_FLAG_E); 1478 vfree(payload); 1479 1480 plog(LLV_DEBUG, LOCATION, NULL, "received a valid R-U-THERE, ACK sent\n"); 1481 1482 /* Should we mark tunnel as active ? */ 1483 return error; 1484} 1485 1486static int 1487isakmp_info_recv_r_u_ack (iph1, ru, msgid) 1488 struct ph1handle *iph1; 1489 struct isakmp_pl_ru *ru; 1490 u_int32_t msgid; 1491{ 1492 1493 plog(LLV_DEBUG, LOCATION, iph1->remote, 1494 "DPD R-U-There-Ack received\n"); 1495 1496 /* XXX Maintain window of acceptable sequence numbers ? 1497 * => ru->data <= iph2->dpd_seq && 1498 * ru->data >= iph2->dpd_seq - iph2->dpd_fails ? */ 1499 if (ntohl(ru->data) != iph1->dpd_seq-1) { 1500 plog(LLV_ERROR, LOCATION, iph1->remote, 1501 "Wrong DPD sequence number (%d, %d expected).\n", 1502 ntohl(ru->data), iph1->dpd_seq-1); 1503 return 0; 1504 } 1505 1506 if (memcmp(ru->i_ck, iph1->index.i_ck, sizeof(cookie_t)) || 1507 memcmp(ru->r_ck, iph1->index.r_ck, sizeof(cookie_t))) { 1508 plog(LLV_ERROR, LOCATION, iph1->remote, 1509 "Cookie mismatch in DPD ACK!.\n"); 1510 return 0; 1511 } 1512 1513 iph1->dpd_fails = 0; 1514 1515 /* Useless ??? */ 1516 iph1->dpd_lastack = time(NULL); 1517 1518 if (iph1->dpd_r_u != NULL) 1519 SCHED_KILL(iph1->dpd_r_u); 1520 1521 isakmp_sched_r_u(iph1, 0); 1522 1523 plog(LLV_DEBUG, LOCATION, NULL, "received an R-U-THERE-ACK\n"); 1524 1525 return 0; 1526} 1527 1528 1529/* 1530 * send Delete payload (for ISAKMP SA) in Informational exchange. 1531 */ 1532static void 1533isakmp_info_send_r_u(arg) 1534 void *arg; 1535{ 1536 struct ph1handle *iph1 = arg; 1537 1538 /* create R-U-THERE payload */ 1539 struct isakmp_pl_ru *ru; 1540 vchar_t *payload = NULL; 1541 int tlen; 1542 int error = 0; 1543 1544 plog(LLV_DEBUG, LOCATION, iph1->remote, "DPD monitoring....\n"); 1545 1546 if (iph1->dpd_fails >= iph1->rmconf->dpd_maxfails) { 1547 EVT_PUSH(iph1->local, iph1->remote, EVTT_DPD_TIMEOUT, NULL); 1548 purge_remote(iph1); 1549 plog(LLV_DEBUG, LOCATION, iph1->remote, 1550 "DPD: remote seems to be dead\n"); 1551 1552 /* Do not reschedule here: phase1 is deleted, 1553 * DPD will be reactivated when a new ph1 will be negociated 1554 */ 1555 return; 1556 } 1557 1558 /* TODO: check recent activity to avoid useless sends... */ 1559 1560 /* XXX: why do we have a NULL LIST_FIRST even when a Phase2 exists ??? */ 1561#if 0 1562 if (LIST_FIRST(&iph1->ph2tree) == NULL){ 1563 /* XXX: No Ph2 => no need to test ph1 ? 1564 */ 1565 /* Reschedule the r_u_there.... 1566 XXX: reschedule when a new ph2 ? 1567 */ 1568 isakmp_sched_r_u(iph1, 0); 1569 plog(LLV_DEBUG, LOCATION, iph1->remote, 1570 "no phase2 handler, rescheduling send_r_u (%d).\n", iph1->rmconf->dpd_interval); 1571 return 0; 1572 } 1573#endif 1574 1575 tlen = sizeof(*ru); 1576 payload = vmalloc(tlen); 1577 if (payload == NULL) { 1578 plog(LLV_ERROR, LOCATION, NULL, 1579 "failed to get buffer for payload.\n"); 1580 return; 1581 } 1582 ru = (struct isakmp_pl_ru *)payload->v; 1583 ru->h.np = ISAKMP_NPTYPE_NONE; 1584 ru->h.len = htons(tlen); 1585 ru->doi = htonl(IPSEC_DOI); 1586 ru->type = htons(ISAKMP_NTYPE_R_U_THERE); 1587 ru->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX ?*/ 1588 ru->spi_size = sizeof(isakmp_index); 1589 1590 memcpy(ru->i_ck, iph1->index.i_ck, sizeof(cookie_t)); 1591 memcpy(ru->r_ck, iph1->index.r_ck, sizeof(cookie_t)); 1592 1593 if (iph1->dpd_seq == 0){ 1594 /* generate a random seq which is not too big */ 1595 srand(time(NULL)); 1596 iph1->dpd_seq = rand() & 0x0fff; 1597 } 1598 1599 ru->data = htonl(iph1->dpd_seq); 1600 1601 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 0); 1602 vfree(payload); 1603 1604 plog(LLV_DEBUG, LOCATION, iph1->remote, 1605 "DPD R-U-There sent (%d)\n", error); 1606 1607 /* will be decreased if ACK received... */ 1608 iph1->dpd_fails++; 1609 1610 /* XXX should be increased only when ACKed ? */ 1611 iph1->dpd_seq++; 1612 1613 /* Reschedule the r_u_there with a short delay, 1614 * will be deleted/rescheduled if ACK received before */ 1615 isakmp_sched_r_u(iph1, 1); 1616 1617 plog(LLV_DEBUG, LOCATION, iph1->remote, 1618 "rescheduling send_r_u (%d).\n", iph1->rmconf->dpd_retry); 1619} 1620 1621/* Schedule a new R-U-THERE */ 1622int 1623isakmp_sched_r_u(iph1, retry) 1624 struct ph1handle *iph1; 1625 int retry; 1626{ 1627 if(iph1 == NULL || 1628 iph1->rmconf == NULL) 1629 return 1; 1630 1631 1632 if(iph1->dpd_support == 0 || 1633 iph1->rmconf->dpd_interval == 0) 1634 return 0; 1635 1636 if(retry) 1637 iph1->dpd_r_u = sched_new(iph1->rmconf->dpd_retry, 1638 isakmp_info_send_r_u, iph1); 1639 else 1640 sched_new(iph1->rmconf->dpd_interval, 1641 isakmp_info_send_r_u, iph1); 1642 1643 return 0; 1644} 1645#endif 1646