46 #include <stdio.h>
47 #include <string.h>
48 #include <errno.h>
49 #if TIME_WITH_SYS_TIME
50 # include <sys/time.h>
51 # include <time.h>
52 #else
53 # if HAVE_SYS_TIME_H
54 # include <sys/time.h>
55 # else
56 # include <time.h>
57 # endif
58 #endif
59
60 #ifdef HAVE_NETINET6_IPSEC_H
61 # include <netinet6/ipsec.h>
62 #else
63 # ifdef HAVE_NETIPSEC_IPSEC_H
64 # include <netipsec/ipsec.h>
65 # else
66 # include <linux/ipsec.h>
67 # endif
68 #endif
69
70 #include "racoon.h"
71
72 #include "var.h"
73 /* #include "vmbuf.h" */
74 /* #include "schedule.h" */
75 /* #include "misc.h" */
76 #include "plog.h"
77 #include "debug.h"
78
79 /* #include "localconf.h" */
80 #include "remoteconf.h"
81 #include "isakmp.h"
82 #include "isakmp_var.h"
83 #include "isakmp_impl.h"
84 #include "ikev1_impl.h"
85 #include "isakmp_inf.h"
86 #include "isakmp_quick.h"
87 #include "oakley.h"
88 #include "handler.h"
89 #include "ipsec_doi.h"
90 #include "crypto_impl.h"
91 #include "pfkey.h"
92 /* #include "policy.h" */
93 #include "algorithm.h"
94 #include "sockmisc.h"
95 #include "proposal.h"
96 /* #include "sainfo.h" */
97 /* #include "admin.h" */
98 #include "strnames.h"
99
100 #include "ike_conf.h"
101
102 /* quick mode */
103 static rc_vchar_t *quick_ir1mx (struct ph2handle *, rc_vchar_t *, rc_vchar_t *);
104 static int get_sainfo_r (struct ph2handle *);
105 static int get_proposal_r (struct ph2handle *);
106 #ifdef INET6
107 static uint32_t setscopeid (struct sockaddr *, struct sockaddr *)
108 GCC_ATTRIBUTE((unused));
109 #endif
110
111 /* called from scheduler */
112 void
113 pfkey_timeover_stub(p)
114 void *p;
115 {
116 void pfkey_timeover();
117
118 pfkey_timeover((struct ph2handle *)p);
119 }
170 }
171 #endif
172
173 /* send getspi message */
174 if (pk_sendgetspi(iph2) < 0)
175 goto end;
176
177 plog(PLOG_DEBUG, PLOGLOC, NULL, "pfkey getspi sent.\n");
178
179 iph2->sce = sched_new(ikev1_ipsec_sa_nego_time_limit(iph2->ph1->rmconf),
180 pfkey_timeover_stub, iph2);
181
182 error = 0;
183
184 end:
185 return error;
186 }
187
188 /*
189 * send to responder
190 * HDR*, HASH(1), SA, Ni [, KE ] [, IDi2, IDr2 ]
191 */
192 int
193 quick_i1send(struct ph2handle *iph2, rc_vchar_t *msg /* must be null pointer */)
194 {
195 rc_vchar_t *body = NULL;
196 rc_vchar_t *hash = NULL;
197 struct isakmp_gen *gen;
198 char *p;
199 int tlen;
200 int error = ISAKMP_INTERNAL_ERROR;
201 int pfsgroup, idci, idcr;
202 int np;
203 struct ipsecdoi_id_b *id, *id_p;
204
205 /* validity check */
206 if (msg != NULL) {
207 plog(PLOG_INTERR, PLOGLOC, NULL,
208 "msg has to be NULL in this function.\n");
209 goto end;
210 }
211 if (iph2->status != PHASE2ST_GETSPIDONE) {
212 plog(PLOG_INTERR, PLOGLOC, NULL,
213 "status mismatched %d.\n", iph2->status);
214 goto end;
215 }
216
217 /* create SA payload for my proposal */
218 if (ipsecdoi_setph2proposal(iph2) < 0)
219 goto end;
220
221 /* generate NONCE value */
222 iph2->nonce = eay_set_random(ikev1_nonce_size(iph2->ph1->rmconf));
223 if (iph2->nonce == NULL)
258 * we do not attach IDci nor IDcr, under the following condition:
259 * - all proposals are transport mode
260 * - no MIP6 or proxy
261 * - id payload suggests to encrypt all the traffic (no specific
262 * protocol type)
263 */
264 id = (struct ipsecdoi_id_b *)iph2->id->v;
265 id_p = (struct ipsecdoi_id_b *)iph2->id_p->v;
266 if (id->proto_id == 0
267 && id_p->proto_id == 0
268 && id->port == 0
269 && id_p->port == 0
270 && iph2->selector->pl != 0
271 && (iph2->selector->pl->my_sa_ipaddr != 0
272 || iph2->selector->pl->peers_sa_ipaddr != 0)
273 && ipsecdoi_transportmode(iph2->proposal)) {
274 idci = idcr = 0;
275 } else
276 idci = idcr = 1;
277
278 /* create SA;NONCE payload, and KE if need, and IDii, IDir. */
279 tlen = + sizeof(*gen) + iph2->sa->l
280 + sizeof(*gen) + iph2->nonce->l;
281 if (pfsgroup)
282 tlen += (sizeof(*gen) + iph2->dhpub->l);
283 if (idci)
284 tlen += sizeof(*gen) + iph2->id->l;
285 if (idcr)
286 tlen += sizeof(*gen) + iph2->id_p->l;
287
288 body = rc_vmalloc(tlen);
289 if (body == NULL) {
290 plog(PLOG_INTERR, PLOGLOC, NULL,
291 "failed to get buffer to send.\n");
292 goto end;
293 }
294
295 p = body->v;
296
297 /* add SA payload */
298 p = set_isakmp_payload(p, iph2->sa, ISAKMP_NPTYPE_NONCE);
299
300 /* add NONCE payload */
301 if (pfsgroup)
302 np = ISAKMP_NPTYPE_KE;
303 else if (idci || idcr)
304 np = ISAKMP_NPTYPE_ID;
305 else
306 np = ISAKMP_NPTYPE_NONE;
307 p = set_isakmp_payload(p, iph2->nonce, np);
308
309 /* add KE payload if need. */
310 np = (idci || idcr) ? ISAKMP_NPTYPE_ID : ISAKMP_NPTYPE_NONE;
311 if (pfsgroup)
312 p = set_isakmp_payload(p, iph2->dhpub, np);
313
314 /* IDci */
315 np = (idcr) ? ISAKMP_NPTYPE_ID : ISAKMP_NPTYPE_NONE;
316 if (idci)
317 p = set_isakmp_payload(p, iph2->id, np);
318
319 /* IDcr */
320 if (idcr)
321 p = set_isakmp_payload(p, iph2->id_p, ISAKMP_NPTYPE_NONE);
322
323 /* generate HASH(1) */
324 hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, body);
325 if (hash == NULL)
326 goto end;
327
328 /* send isakmp payload */
329 iph2->sendbuf = quick_ir1mx(iph2, body, hash);
330 if (iph2->sendbuf == NULL)
331 goto end;
332
333 /* send the packet, add to the schedule to resend */
334 iph2->retry_counter = ikev1_max_retry_to_send(iph2->ph1->rmconf);
335 if (isakmp_ph2resend(iph2) == -1)
336 goto end;
337
338 /* change status of isakmp status entry */
339 iph2->status = PHASE2ST_MSG1SENT;
340
341 error = 0;
342
343 end:
344 if (body != NULL)
345 rc_vfree(body);
346 if (hash != NULL)
347 rc_vfree(hash);
348
349 return error;
350 }
351
352 /*
353 * receive from responder
354 * HDR*, HASH(2), SA, Nr [, KE ] [, IDi2, IDr2 ]
355 */
356 int
357 quick_i2recv(struct ph2handle *iph2, rc_vchar_t *msg0)
358 {
359 rc_vchar_t *msg = NULL;
360 rc_vchar_t *hbuf = NULL; /* for hash computing. */
361 rc_vchar_t *pbuf = NULL; /* for payload parsing */
362 struct isakmp_parse_t *pa;
363 struct isakmp *isakmp = (struct isakmp *)msg0->v;
364 struct isakmp_pl_hash *hash = NULL;
365 int f_id;
366 char *p;
367 int tlen;
368 int error = ISAKMP_INTERNAL_ERROR;
369
370 /* validity check */
371 if (iph2->status != PHASE2ST_MSG1SENT) {
372 plog(PLOG_INTERR, PLOGLOC, NULL,
373 "status mismatched %d.\n", iph2->status);
374 goto end;
375 }
376
377 /* decrypt packet */
378 if (!ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E)) {
379 isakmp_log(0, 0, iph2->ph1->remote, 0,
380 PLOG_PROTOERR, PLOGLOC,
381 "Packet wasn't encrypted.\n");
382 goto end;
383 }
384 msg = oakley_do_decrypt(iph2->ph1, msg0, iph2->ivm->iv, iph2->ivm->ive);
385 if (msg == NULL)
422 "expecting %d.\n",
423 pa->type, ISAKMP_NPTYPE_HASH);
424 }
425
426 /* allocate buffer for computing HASH(2) */
427 tlen = iph2->nonce->l
428 + get_uint32(&isakmp->len) - sizeof(*isakmp);
429 hbuf = rc_vmalloc(tlen);
430 if (hbuf == NULL) {
431 plog(PLOG_INTERR, PLOGLOC, NULL,
432 "failed to get hash buffer.\n");
433 goto end;
434 }
435 p = hbuf->v + iph2->nonce->l; /* retain the space for Ni_b */
436
437 /*
438 * parse the payloads.
439 * copy non-HASH payloads into hbuf, so that we can validate HASH.
440 */
441 iph2->sa_ret = NULL;
442 f_id = 0; /* flag to use checking ID */
443 tlen = 0; /* count payload length except of HASH payload. */
444 for (; pa->type; pa++) {
445
446 /* copy to buffer for HASH */
447 /* Don't modify the payload */
448 memcpy(p, pa->ptr, pa->len);
449
450 switch (pa->type) {
451 case ISAKMP_NPTYPE_SA:
452 if (iph2->sa_ret != NULL) {
453 plog(PLOG_PROTOERR, PLOGLOC, NULL,
454 "Ignored, multiple SA "
455 "isn't supported.\n");
456 break;
457 }
458 if (isakmp_p2ph(&iph2->sa_ret, pa->ptr) < 0)
459 goto end;
460 break;
461
462 case ISAKMP_NPTYPE_NONCE:
463 if (isakmp_p2ph(&iph2->nonce_p, pa->ptr) < 0)
464 goto end;
465 break;
466
467 case ISAKMP_NPTYPE_KE:
468 if (isakmp_p2ph(&iph2->dhpub_p, pa->ptr) < 0)
469 goto end;
470 break;
471
472 case ISAKMP_NPTYPE_ID:
473 {
474 rc_vchar_t *vp;
475
476 /* check ID value */
477 if (f_id == 0) {
478 /* for IDci */
479 f_id = 1;
480 vp = iph2->id;
481 } else {
482 /* for IDcr */
483 vp = iph2->id_p;
484 }
485
486 if (memcmp(vp->v, (caddr_t)pa->ptr + sizeof(struct isakmp_gen), vp->l)) {
487
488 plog(PLOG_PROTOERR, PLOGLOC, NULL,
489 "mismatched ID was returned.\n");
490 error = ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED;
491 goto end;
492 }
493 }
494 break;
495
496 case ISAKMP_NPTYPE_N:
497 isakmp_check_notify(pa->ptr, iph2->ph1);
498 break;
499
500 #ifdef ENABLE_NATT
501 case ISAKMP_NPTYPE_NATOA_DRAFT:
502 case ISAKMP_NPTYPE_NATOA_RFC:
503 /* Ignore original source/destination messages */
504 break;
505 #endif
506
507 default:
508 /* don't send information, see ident_r1recv() */
509 isakmp_log(0, 0, iph2->ph1->remote, 0,
510 PLOG_PROTOERR, PLOGLOC,
511 "ignore the packet, "
512 "received unexpecting payload type %d.\n",
513 pa->type);
514 goto end;
515 }
516
517 p += pa->len;
518
519 /* compute true length of payload. */
520 tlen += pa->len;
521 }
522
523 /* payload existency check */
524 if (hash == NULL || iph2->sa_ret == NULL || iph2->nonce_p == NULL) {
525 isakmp_log(0, 0, iph2->ph1->remote, 0,
526 PLOG_PROTOERR, PLOGLOC,
527 "few isakmp message received.\n");
528 goto end;
529 }
530
531 /* Fixed buffer for calculating HASH */
532 memcpy(hbuf->v, iph2->nonce->v, iph2->nonce->l);
533 plog(PLOG_DEBUG, PLOGLOC, NULL,
534 "HASH allocated:hbuf->l=%d actual:tlen=%d\n",
535 hbuf->l, tlen + iph2->nonce->l);
536 /* adjust buffer length for HASH */
537 hbuf->l = iph2->nonce->l + tlen;
538
539 /* validate HASH(2) */
540 {
541 char *r_hash;
542 rc_vchar_t *my_hash = NULL;
543 int result;
544
545 r_hash = (char *)hash + sizeof(*hash);
546
547 plog(PLOG_DEBUG, PLOGLOC, NULL, "HASH(2) received:");
548 plogdump(PLOG_DEBUG, PLOGLOC, 0, r_hash, get_uint16(&hash->h.len) - sizeof(*hash));
549
550 my_hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, hbuf);
564 }
565
566 /* validity check SA payload sent from responder */
567 if (ipsecdoi_checkph2proposal(iph2) < 0) {
568 error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
569 goto end;
570 }
571
572 /* change status of isakmp status entry */
573 iph2->status = PHASE2ST_STATUS6;
574
575 error = 0;
576
577 end:
578 if (hbuf)
579 rc_vfree(hbuf);
580 if (pbuf)
581 rc_vfree(pbuf);
582 if (msg)
583 rc_vfree(msg);
584
585 if (error) {
586 VPTRINIT(iph2->sa_ret);
587 VPTRINIT(iph2->nonce_p);
588 VPTRINIT(iph2->dhpub_p);
589 VPTRINIT(iph2->id);
590 VPTRINIT(iph2->id_p);
591 }
592
593 return error;
594 }
595
596 /*
597 * send to responder
598 * HDR*, HASH(3)
599 */
600 int
601 quick_i2send(struct ph2handle *iph2, rc_vchar_t *msg0)
602 {
603 rc_vchar_t *msg = NULL;
604 rc_vchar_t *buf = NULL;
605 rc_vchar_t *hash = NULL;
606 char *p = NULL;
607 int tlen;
608 int error = ISAKMP_INTERNAL_ERROR;
609
610 /* validity check */
611 if (iph2->status != PHASE2ST_STATUS6) {
612 plog(PLOG_INTERR, PLOGLOC, NULL,
613 "status mismatched %d.\n", iph2->status);
614 goto end;
615 }
687 if (oakley_compute_keymat(iph2, INITIATOR) < 0)
688 goto end;
689
690 iph2->status = PHASE2ST_ADDSA;
691
692 #if 0
693 /* don't anything if local test mode. */
694 if (f_local) {
695 error = 0;
696 goto end;
697 }
698 #endif
699
700 /* if there is commit bit don't set up SA now. */
701 if (ISSET(iph2->flags, ISAKMP_FLAG_C)) {
702 iph2->status = PHASE2ST_COMMIT;
703 error = 0;
704 goto end;
705 }
706
707 /* Do UPDATE for initiator */
708 plog(PLOG_DEBUG, PLOGLOC, NULL, "call pk_sendupdate\n");
709 if (pk_sendupdate(iph2) < 0) {
710 plog(PLOG_INTERR, PLOGLOC, NULL, "pfkey update failed.\n");
711 goto end;
712 }
713 plog(PLOG_DEBUG, PLOGLOC, NULL, "pfkey update sent.\n");
714
715 /* Do ADD for responder */
716 if (pk_sendadd(iph2) < 0) {
717 plog(PLOG_INTERR, PLOGLOC, NULL, "pfkey add failed.\n");
718 goto end;
719 }
720 plog(PLOG_DEBUG, PLOGLOC, NULL, "pfkey add sent.\n");
721
722 error = 0;
723
724 end:
725 if (buf != NULL)
726 rc_vfree(buf);
727 if (msg != NULL)
728 rc_vfree(msg);
729 if (hash != NULL)
730 rc_vfree(hash);
731
732 return error;
733 }
734
735 /*
736 * receive from responder
737 * HDR#*, HASH(4), notify
738 */
739 int
740 quick_i3recv(struct ph2handle *iph2, rc_vchar_t *msg0)
741 {
742 rc_vchar_t *msg = NULL;
743 rc_vchar_t *pbuf = NULL; /* for payload parsing */
834 if (result) {
835 isakmp_log(0, 0, iph2->ph1->remote, 0,
836 PLOG_PROTOERR, PLOGLOC,
837 "HASH(4) mismatch.\n");
838 error = ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
839 goto end;
840 }
841 }
842
843 iph2->status = PHASE2ST_ADDSA;
844 iph2->flags ^= ISAKMP_FLAG_C; /* reset bit */
845
846 #if 0
847 /* don't anything if local test mode. */
848 if (f_local) {
849 error = 0;
850 goto end;
851 }
852 #endif
853
854 /* Do UPDATE for initiator */
855 plog(PLOG_DEBUG, PLOGLOC, NULL, "call pk_sendupdate\n");
856 if (pk_sendupdate(iph2) < 0) {
857 plog(PLOG_INTERR, PLOGLOC, NULL, "pfkey update failed.\n");
858 goto end;
859 }
860 plog(PLOG_DEBUG, PLOGLOC, NULL, "pfkey update sent.\n");
861
862 /* Do ADD for responder */
863 if (pk_sendadd(iph2) < 0) {
864 plog(PLOG_INTERR, PLOGLOC, NULL, "pfkey add failed.\n");
865 goto end;
866 }
867 plog(PLOG_DEBUG, PLOGLOC, NULL, "pfkey add sent.\n");
868
869 error = 0;
870
871 end:
872 if (msg != NULL)
873 rc_vfree(msg);
874 if (pbuf != NULL)
875 rc_vfree(pbuf);
876 if (notify != NULL)
877 rc_vfree(notify);
878
879 return error;
880 }
881
882 /*
883 * receive from initiator
884 * HDR*, HASH(1), SA, Ni [, KE ] [, IDi2, IDr2 ]
885 */
886 int
887 quick_r1recv(struct ph2handle *iph2, rc_vchar_t *msg0)
888 {
889 rc_vchar_t *msg = NULL;
890 rc_vchar_t *hbuf = NULL; /* for hash computing. */
891 rc_vchar_t *pbuf = NULL; /* for payload parsing */
892 struct isakmp_parse_t *pa;
893 struct isakmp *isakmp = (struct isakmp *)msg0->v;
894 struct isakmp_pl_hash *hash = NULL;
895 char *p;
896 int tlen;
897 int f_id_order; /* for ID payload detection */
898 int error = ISAKMP_INTERNAL_ERROR;
899
900 /* validity check */
901 if (iph2->status != PHASE2ST_START) {
902 plog(PLOG_INTERR, PLOGLOC, NULL,
903 "status mismatched %d.\n", iph2->status);
904 goto end;
1034 }
1035
1036 if (isakmp_p2ph(&iph2->id, pa->ptr) < 0)
1037 goto end;
1038 } else {
1039 plog(PLOG_PROTOERR, PLOGLOC, NULL,
1040 "received too many ID payloads.\n");
1041 plogdump(PLOG_PROTOERR, PLOGLOC, 0, iph2->id->v, iph2->id->l);
1042 error = ISAKMP_NTYPE_INVALID_ID_INFORMATION;
1043 goto end;
1044 }
1045 break;
1046
1047 case ISAKMP_NPTYPE_N:
1048 isakmp_check_notify(pa->ptr, iph2->ph1);
1049 break;
1050
1051 #ifdef ENABLE_NATT
1052 case ISAKMP_NPTYPE_NATOA_DRAFT:
1053 case ISAKMP_NPTYPE_NATOA_RFC:
1054 /* Ignore original source/destination messages */
1055 break;
1056 #endif
1057
1058 default:
1059 isakmp_log(0, 0, iph2->ph1->remote, 0,
1060 PLOG_PROTOERR, PLOGLOC,
1061 "ignore the packet, "
1062 "received unexpecting payload type %d.\n",
1063 pa->type);
1064 error = ISAKMP_NTYPE_PAYLOAD_MALFORMED;
1065 goto end;
1066 }
1067
1068 p += pa->len;
1069
1070 /* compute true length of payload. */
1071 tlen += pa->len;
1072 }
1073
1074 /* payload existency check */
1102
1103 plog(PLOG_DEBUG, PLOGLOC, NULL, "HASH(1) validate:");
1104 plogdump(PLOG_DEBUG, PLOGLOC, 0, r_hash, get_uint16(&hash->h.len) - sizeof(*hash));
1105
1106 my_hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, hbuf);
1107 if (my_hash == NULL)
1108 goto end;
1109
1110 result = memcmp(my_hash->v, r_hash, my_hash->l);
1111 rc_vfree(my_hash);
1112
1113 if (result) {
1114 isakmp_log(0, 0, iph2->ph1->remote, 0,
1115 PLOG_DEBUG, PLOGLOC,
1116 "HASH(1) mismatch.\n");
1117 error = ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
1118 goto end;
1119 }
1120 }
1121
1122 /* get sainfo */
1123 error = get_sainfo_r(iph2);
1124 if (error) {
1125 plog(PLOG_PROTOERR, PLOGLOC, NULL,
1126 "failed to get sainfo.\n");
1127 goto end;
1128 }
1129
1130 /* check the existence of ID payload and create responder's proposal */
1131 error = get_proposal_r(iph2);
1132 switch (error) {
1133 #ifdef notyet
1134 case -2:
1135 /* generate a policy template from peer's proposal */
1136 if (set_proposal_from_proposal(iph2)) {
1137 plog(PLOG_INTERR, PLOGLOC, NULL,
1138 "failed to generate a proposal template "
1139 "from client's proposal.\n");
1140 return ISAKMP_INTERNAL_ERROR;
1141 }
1150 break;
1151 default:
1152 plog(PLOG_INTERR, PLOGLOC, NULL,
1153 "failed to get proposal for responder.\n");
1154 goto end;
1155 }
1156
1157 /* check KE and attribute of PFS */
1158 if (iph2->dhpub_p != NULL && iph2->approval->pfs_group == 0) {
1159 plog(PLOG_PROTOERR, PLOGLOC, NULL,
1160 "no PFS is specified, but peer sends KE.\n");
1161 error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
1162 goto end;
1163 }
1164 if (iph2->dhpub_p == NULL && iph2->approval->pfs_group != 0) {
1165 plog(PLOG_PROTOERR, PLOGLOC, NULL,
1166 "PFS is specified, but peer doesn't sends KE.\n");
1167 error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
1168 goto end;
1169 }
1170
1171 /*
1172 * save the packet from the initiator in order to resend the
1173 * responder's first packet against this packet.
1174 */
1175 iph2->msg1 = rc_vdup(msg0);
1176
1177 /* change status of isakmp status entry */
1178 iph2->status = PHASE2ST_STATUS2;
1179
1180 error = 0;
1181
1182 end:
1183 if (hbuf)
1184 rc_vfree(hbuf);
1185 if (msg)
1186 rc_vfree(msg);
1187 if (pbuf)
1188 rc_vfree(pbuf);
1189
1190 if (error) {
1191 VPTRINIT(iph2->sa);
1192 VPTRINIT(iph2->nonce_p);
1193 VPTRINIT(iph2->dhpub_p);
1194 VPTRINIT(iph2->id);
1195 VPTRINIT(iph2->id_p);
1196 }
1197
1198 return error;
1199 }
1200
1201 /*
1202 * call pfkey_getspi.
1203 */
1204 int
1205 quick_r1prep(struct ph2handle *iph2, rc_vchar_t *msg)
1206 {
1207 int error = ISAKMP_INTERNAL_ERROR;
1208
1209 /* validity check */
1210 if (iph2->status != PHASE2ST_STATUS2) {
1211 plog(PLOG_INTERR, PLOGLOC, NULL,
1212 "status mismatched %d.\n", iph2->status);
1213 goto end;
1214 }
1215
1216 iph2->status = PHASE2ST_GETSPISENT;
1217
1218 /* send getspi message */
1219 if (pk_sendgetspi(iph2) < 0)
1220 goto end;
1221
1222 plog(PLOG_DEBUG, PLOGLOC, NULL, "pfkey getspi sent.\n");
1223
1224 iph2->sce = sched_new(ikev1_ipsec_sa_nego_time_limit(iph2->ph1->rmconf),
1225 pfkey_timeover_stub, iph2);
1226
1227 error = 0;
1228
1229 end:
1230 return error;
1231 }
1232
1233 /*
1234 * send to initiator
1235 * HDR*, HASH(2), SA, Nr [, KE ] [, IDi2, IDr2 ]
1236 */
1237 int
1238 quick_r2send(struct ph2handle *iph2, rc_vchar_t *msg)
1239 {
1240 rc_vchar_t *body = NULL;
1241 rc_vchar_t *hash = NULL;
1242 struct isakmp_gen *gen;
1243 char *p;
1244 int tlen;
1245 int error = ISAKMP_INTERNAL_ERROR;
1246 int pfsgroup;
1247 uint8_t *np_p = NULL;
1248
1249 /* validity check */
1250 if (msg != NULL) {
1251 plog(PLOG_INTERR, PLOGLOC, NULL,
1252 "msg has to be NULL in this function.\n");
1253 goto end;
1254 }
1255 if (iph2->status != PHASE2ST_GETSPIDONE) {
1256 plog(PLOG_INTERR, PLOGLOC, NULL,
1257 "status mismatched %d.\n", iph2->status);
1258 goto end;
1259 }
1260
1261 /* update responders SPI */
1262 if (ipsecdoi_updatespi(iph2) < 0) {
1263 plog(PLOG_INTERR, PLOGLOC, NULL, "failed to update spi.\n");
1264 goto end;
1265 }
1266
1267 /* generate NONCE value */
1268 iph2->nonce = eay_set_random(ikev1_nonce_size(iph2->ph1->rmconf));
1269 if (iph2->nonce == NULL)
1270 goto end;
1271
1272 /* generate KE value if need */
1273 pfsgroup = iph2->approval->pfs_group;
1274 if (iph2->dhpub_p != NULL && pfsgroup != 0) {
1275 /* DH group settting if PFS is required. */
1276 if (oakley_setdhgroup(pfsgroup, &iph2->pfsgrp) < 0) {
1277 plog(PLOG_INTERR, PLOGLOC, NULL,
1278 "failed to set DH value.\n");
1279 goto end;
1280 }
1281 /* generate DH public value */
1282 if (oakley_dh_generate(iph2->pfsgrp,
1283 &iph2->dhpub, &iph2->dhpriv) < 0) {
1284 goto end;
1285 }
1286 }
1287
1288 /* create SA;NONCE payload, and KE and ID if need */
1289 tlen = sizeof(*gen) + iph2->sa_ret->l
1290 + sizeof(*gen) + iph2->nonce->l;
1291 if (iph2->dhpub_p != NULL && pfsgroup != 0)
1292 tlen += (sizeof(*gen) + iph2->dhpub->l);
1293 if (iph2->id_p != NULL)
1294 tlen += (sizeof(*gen) + iph2->id_p->l
1295 + sizeof(*gen) + iph2->id->l);
1296
1297 body = rc_vmalloc(tlen);
1298 if (body == NULL) {
1299 plog(PLOG_INTERR, PLOGLOC, NULL,
1300 "failed to get buffer to send.\n");
1301 goto end;
1302 }
1303 p = body->v;
1304
1305 /* make SA payload */
1306 p = set_isakmp_payload(body->v, iph2->sa_ret, ISAKMP_NPTYPE_NONCE);
1307
1308 /* add NONCE payload */
1309 np_p = &((struct isakmp_gen *)p)->np; /* XXX */
1310 p = set_isakmp_payload(p, iph2->nonce,
1311 (iph2->dhpub_p != NULL && pfsgroup != 0)
1312 ? ISAKMP_NPTYPE_KE
1313 : (iph2->id_p != NULL
1314 ? ISAKMP_NPTYPE_ID
1315 : ISAKMP_NPTYPE_NONE));
1316
1317 /* add KE payload if need. */
1318 if (iph2->dhpub_p != NULL && pfsgroup != 0) {
1319 np_p = &((struct isakmp_gen *)p)->np; /* XXX */
1320 p = set_isakmp_payload(p, iph2->dhpub,
1321 (iph2->id_p == NULL)
1322 ? ISAKMP_NPTYPE_NONE
1323 : ISAKMP_NPTYPE_ID);
1324 }
1325
1326 /* add ID payloads received. */
1327 if (iph2->id_p != NULL) {
1328 /* IDci */
1329 p = set_isakmp_payload(p, iph2->id_p, ISAKMP_NPTYPE_ID);
1330 /* IDcr */
1331 np_p = &((struct isakmp_gen *)p)->np; /* XXX */
1332 p = set_isakmp_payload(p, iph2->id, ISAKMP_NPTYPE_NONE);
1333 }
1334
1335 /* add a RESPONDER-LIFETIME notify payload if needed */
1336 {
1337 rc_vchar_t *data = NULL;
1338 struct saprop *pp = iph2->approval;
1339 struct saproto *pr;
1340
1341 if (pp->claim & IPSECDOI_ATTR_SA_LD_TYPE_SEC) {
1342 uint32_t v = htonl((uint32_t)pp->lifetime);
1343 data = isakmp_add_attr_l(data, IPSECDOI_ATTR_SA_LD_TYPE,
1344 IPSECDOI_ATTR_SA_LD_TYPE_SEC);
1345 if (!data)
1346 goto end;
1347 data = isakmp_add_attr_v(data, IPSECDOI_ATTR_SA_LD,
1348 (caddr_t)&v, sizeof(v));
1349 if (!data)
1350 goto end;
1351 }
1352 if (pp->claim & IPSECDOI_ATTR_SA_LD_TYPE_KB) {
1353 uint32_t v = htonl((uint32_t)pp->lifebyte);
1408 if (isakmp_ph2resend(iph2) == -1)
1409 goto end;
1410
1411 /* the sending message is added to the received-list. */
1412 if (add_recvdpkt(iph2->ph1->remote, iph2->ph1->local, iph2->sendbuf, iph2->msg1, iph2->ph1->rmconf) == -1) {
1413 plog(PLOG_INTERR , PLOGLOC, NULL,
1414 "failed to add a response packet to the tree.\n");
1415 goto end;
1416 }
1417
1418 /* change status of isakmp status entry */
1419 iph2->status = PHASE2ST_MSG1SENT;
1420
1421 error = 0;
1422
1423 end:
1424 if (body != NULL)
1425 rc_vfree(body);
1426 if (hash != NULL)
1427 rc_vfree(hash);
1428
1429 return error;
1430 }
1431
1432 /*
1433 * receive from initiator
1434 * HDR*, HASH(3)
1435 */
1436 int
1437 quick_r3recv(struct ph2handle *iph2, rc_vchar_t *msg0)
1438 {
1439 rc_vchar_t *msg = NULL;
1440 rc_vchar_t *pbuf = NULL; /* for payload parsing */
1441 struct isakmp_parse_t *pa;
1442 struct isakmp_pl_hash *hash = NULL;
1443 int error = ISAKMP_INTERNAL_ERROR;
1444
1445 /* validity check */
1446 if (iph2->status != PHASE2ST_MSG1SENT) {
1447 plog(PLOG_INTERR, PLOGLOC, NULL,
1677 if (oakley_compute_keymat(iph2, RESPONDER) < 0)
1678 goto end;
1679
1680 iph2->status = PHASE2ST_ADDSA;
1681 iph2->flags ^= ISAKMP_FLAG_C; /* reset bit */
1682
1683 /* generate policy */
1684 if (rcs_is_addr_rw(iph2->selector->pl->peers_sa_ipaddr)) {
1685 IPSEC_CONF(lifetime, iph2->selector->pl->ips,
1686 ipsec_sa_lifetime_time, 0);
1687 if (ike_spmif_post_policy_add(iph2->selector,
1688 ike_ipsec_mode(iph2->selector->pl),
1689 lifetime, iph2->src, iph2->dst,
1690 iph2->ph1->rmconf) < 0) {
1691 plog(PLOG_INTERR, PLOGLOC, NULL,
1692 "generate policy failed.\n");
1693 goto end;
1694 }
1695 }
1696
1697 /* Do UPDATE as responder */
1698 plog(PLOG_DEBUG, PLOGLOC, NULL, "call pk_sendupdate\n");
1699 if (pk_sendupdate(iph2) < 0) {
1700 plog(PLOG_INTERR, PLOGLOC, NULL, "pfkey update failed.\n");
1701 goto end;
1702 }
1703 plog(PLOG_DEBUG, PLOGLOC, NULL, "pfkey update sent.\n");
1704
1705 /* Do ADD for responder */
1706 if (pk_sendadd(iph2) < 0) {
1707 plog(PLOG_INTERR, PLOGLOC, NULL, "pfkey add failed.\n");
1708 goto end;
1709 }
1710 plog(PLOG_DEBUG, PLOGLOC, NULL, "pfkey add sent.\n");
1711
1712 error = 0;
1713
1714 end:
1715 if (msg != NULL)
1716 rc_vfree(msg);
1717
1718 return error;
1719 }
1720
1721
1722 /*
1723 * create HASH, body (SA, NONCE) payload with isakmp header.
1724 */
1725 static rc_vchar_t *
1726 quick_ir1mx(struct ph2handle *iph2, rc_vchar_t *body, rc_vchar_t *hash)
1727 {
1728 struct isakmp *isakmp;
1729 rc_vchar_t *buf = NULL, *new = NULL;
1730 char *p;
1731 int tlen;
1732 struct isakmp_gen *gen;
1733 int error = ISAKMP_INTERNAL_ERROR;
2109 if (!iph2->spidx_gen) {
2110 plog(PLOG_INTERR, PLOGLOC, NULL,
2111 "buffer allocation failed.\n");
2112 return ISAKMP_INTERNAL_ERROR;
2113 }
2114 memcpy(iph2->spidx_gen, &spidx, sizeof(spidx));
2115 return -2; /* special value */
2116 }
2117 plog(PLOG_INTERR, PLOGLOC, NULL,
2118 "no policy found: %s\n", spidx2str(&spidx));
2119 return ISAKMP_INTERNAL_ERROR;
2120 }
2121 /* Refresh existing generated policies
2122 */
2123 if (iph2->ph1->rmconf->gen_policy) {
2124 plog(LLV_INFO, LOCATION, NULL,
2125 "Update the generated policy : %s\n",
2126 spidx2str(&spidx));
2127 iph2->spidx_gen = racoon_malloc(sizeof(spidx));
2128 if (!iph2->spidx_gen) {
2129 plog(LLV_ERROR, LOCATION, NULL,
2130 "buffer allocation failed.\n");
2131 return ISAKMP_INTERNAL_ERROR;
2132 }
2133 memcpy(iph2->spidx_gen, &spidx, sizeof(spidx));
2134 }
2135
2136 /* get outbound policy */
2137 {
2138 struct sockaddr_storage addr;
2139 uint8_t pref;
2140
2141 spidx.dir = IPSEC_DIR_OUTBOUND;
2142 addr = spidx.src;
2143 spidx.src = spidx.dst;
2144 spidx.dst = addr;
2145 pref = spidx.prefs;
2146 spidx.prefs = spidx.prefd;
2147 spidx.prefd = pref;
2148
2149 sp_out = getsp_r(&spidx);
2159
2160 /*
2161 * In the responder side, the inbound policy should be using IPsec.
2162 * outbound policy is not checked currently.
2163 */
2164 if (sp_in->policy != IPSEC_POLICY_IPSEC) {
2165 plog(PLOG_INTERR, PLOGLOC, NULL,
2166 "policy found, but no IPsec required: %s\n",
2167 spidx2str(&spidx));
2168 return ISAKMP_INTERNAL_ERROR;
2169 }
2170
2171 /* set new proposal derived from a policy into the iph2->proposal. */
2172 if (set_proposal_from_policy(iph2, sp_in, sp_out) < 0) {
2173 plog(PLOG_INTERR, PLOGLOC, NULL,
2174 "failed to create saprop.\n");
2175 return ISAKMP_INTERNAL_ERROR;
2176 }
2177
2178 return 0;
2179 #endif
2180 }
2181
2182 #ifdef INET6
2183 static uint32_t
2184 setscopeid(struct sockaddr *sp_addr0, struct sockaddr *sa_addr0)
2185 {
2186 struct sockaddr_in6 *sp_addr, *sa_addr;
2187
2188 sp_addr = (struct sockaddr_in6 *)sp_addr0;
2189 sa_addr = (struct sockaddr_in6 *)sa_addr0;
2190
2191 if (!IN6_IS_ADDR_LINKLOCAL(&sp_addr->sin6_addr)
2192 && !IN6_IS_ADDR_SITELOCAL(&sp_addr->sin6_addr)
2193 && !IN6_IS_ADDR_MULTICAST(&sp_addr->sin6_addr))
2194 return 0;
2195
2196 /* this check should not be here ? */
2197 if (sa_addr->sin6_family != AF_INET6) {
2198 plog(PLOG_INTERR, PLOGLOC, NULL,
2199 "can't get scope ID: family mismatch\n");
|
46 #include <stdio.h>
47 #include <string.h>
48 #include <errno.h>
49 #if TIME_WITH_SYS_TIME
50 # include <sys/time.h>
51 # include <time.h>
52 #else
53 # if HAVE_SYS_TIME_H
54 # include <sys/time.h>
55 # else
56 # include <time.h>
57 # endif
58 #endif
59
60 #ifdef HAVE_NETINET6_IPSEC_H
61 # include <netinet6/ipsec.h>
62 #else
63 # ifdef HAVE_NETIPSEC_IPSEC_H
64 # include <netipsec/ipsec.h>
65 # else
66 # ifndef sun /* XXX KEBE SAYS OpenSolaris */
67 # include <linux/ipsec.h>
68 # endif
69 # endif
70 #endif
71
72 #ifdef sun /* XXX KEBE SAYS OpenSolaris */
73 #define IPSEC_ULPROTO_ANY 0
74 #endif
75
76 #include "racoon.h"
77
78 #include "var.h"
79 /* #include "vmbuf.h" */
80 /* #include "schedule.h" */
81 /* #include "misc.h" */
82 #include "plog.h"
83 #include "debug.h"
84
85 /* #include "localconf.h" */
86 #include "remoteconf.h"
87 #include "isakmp.h"
88 #include "isakmp_var.h"
89 #include "isakmp_impl.h"
90 #include "ikev1_impl.h"
91 #include "isakmp_inf.h"
92 #include "isakmp_quick.h"
93 #include "oakley.h"
94 #include "handler.h"
95 #include "ipsec_doi.h"
96 #include "crypto_impl.h"
97 #include "pfkey.h"
98 /* #include "policy.h" */
99 #include "algorithm.h"
100 #include "sockmisc.h"
101 #include "proposal.h"
102 /* #include "sainfo.h" */
103 /* #include "admin.h" */
104 #include "strnames.h"
105
106 #ifdef sun
107 #include "ikev1_natt.h"
108 #define IPSECDOI_PREFIX_HOST 32 /* Hack for port of NAT-OA from ipsec-tools. */
109 #endif
110
111 #include "ike_conf.h"
112
113 /* quick mode */
114 static rc_vchar_t *quick_ir1mx (struct ph2handle *, rc_vchar_t *, rc_vchar_t *);
115 static int get_sainfo_r (struct ph2handle *);
116 static int get_proposal_r (struct ph2handle *);
117 #ifdef INET6
118 static uint32_t setscopeid (struct sockaddr *, struct sockaddr *)
119 GCC_ATTRIBUTE((unused));
120 #endif
121
122 /* called from scheduler */
123 void
124 pfkey_timeover_stub(p)
125 void *p;
126 {
127 void pfkey_timeover();
128
129 pfkey_timeover((struct ph2handle *)p);
130 }
181 }
182 #endif
183
184 /* send getspi message */
185 if (pk_sendgetspi(iph2) < 0)
186 goto end;
187
188 plog(PLOG_DEBUG, PLOGLOC, NULL, "pfkey getspi sent.\n");
189
190 iph2->sce = sched_new(ikev1_ipsec_sa_nego_time_limit(iph2->ph1->rmconf),
191 pfkey_timeover_stub, iph2);
192
193 error = 0;
194
195 end:
196 return error;
197 }
198
199 /*
200 * send to responder
201 * HDR*, HASH(1), SA, Ni [, KE ] [, IDi2, IDr2 ] [, NAT-OAi, NAT-OAr ]
202 */
203 int
204 quick_i1send(struct ph2handle *iph2, rc_vchar_t *msg /* must be null pointer */)
205 {
206 rc_vchar_t *body = NULL;
207 rc_vchar_t *hash = NULL;
208 struct isakmp_gen *gen;
209 char *p;
210 int tlen;
211 int error = ISAKMP_INTERNAL_ERROR;
212 int pfsgroup, idci, idcr;
213 int np;
214 struct ipsecdoi_id_b *id, *id_p;
215 #ifdef sun
216 int natoa = ISAKMP_NPTYPE_NONE;
217 rc_vchar_t *nat_oai = NULL;
218 rc_vchar_t *nat_oar = NULL;
219 #endif
220
221 /* validity check */
222 if (msg != NULL) {
223 plog(PLOG_INTERR, PLOGLOC, NULL,
224 "msg has to be NULL in this function.\n");
225 goto end;
226 }
227 if (iph2->status != PHASE2ST_GETSPIDONE) {
228 plog(PLOG_INTERR, PLOGLOC, NULL,
229 "status mismatched %d.\n", iph2->status);
230 goto end;
231 }
232
233 /* create SA payload for my proposal */
234 if (ipsecdoi_setph2proposal(iph2) < 0)
235 goto end;
236
237 /* generate NONCE value */
238 iph2->nonce = eay_set_random(ikev1_nonce_size(iph2->ph1->rmconf));
239 if (iph2->nonce == NULL)
274 * we do not attach IDci nor IDcr, under the following condition:
275 * - all proposals are transport mode
276 * - no MIP6 or proxy
277 * - id payload suggests to encrypt all the traffic (no specific
278 * protocol type)
279 */
280 id = (struct ipsecdoi_id_b *)iph2->id->v;
281 id_p = (struct ipsecdoi_id_b *)iph2->id_p->v;
282 if (id->proto_id == 0
283 && id_p->proto_id == 0
284 && id->port == 0
285 && id_p->port == 0
286 && iph2->selector->pl != 0
287 && (iph2->selector->pl->my_sa_ipaddr != 0
288 || iph2->selector->pl->peers_sa_ipaddr != 0)
289 && ipsecdoi_transportmode(iph2->proposal)) {
290 idci = idcr = 0;
291 } else
292 idci = idcr = 1;
293
294 #ifdef sun
295 /*
296 * RFC3947 5.2. if we propose UDP-Encapsulated-Transport
297 * we should send NAT-OA
298 *
299 * XXX KEBE ASKS if we should send it for tunnel mode anyway, like
300 * we do with in.iked?
301 */
302 if (ipsecdoi_transportmode(iph2->proposal)
303 && (iph2->ph1->natt_flags & NAT_DETECTED)) {
304 natoa = iph2->ph1->natt_options->payload_nat_oa;
305
306 nat_oai = ipsecdoi_sockaddr2id(iph2->src,
307 IPSECDOI_PREFIX_HOST, IPSEC_ULPROTO_ANY);
308 nat_oar = ipsecdoi_sockaddr2id(iph2->dst,
309 IPSECDOI_PREFIX_HOST, IPSEC_ULPROTO_ANY);
310
311 if (nat_oai == NULL || nat_oar == NULL) {
312 plog(PLOG_INTERR, PLOGLOC, NULL,
313 "failed to generate NAT-OA payload.\n");
314 goto end;
315 }
316
317 plog(PLOG_INFO, PLOGLOC, NULL, "Using NAT-OA.\n");
318 plog(PLOG_DEBUG, PLOGLOC, NULL, "NAT-OAi:\n");
319 plogdump(PLOG_DEBUG, PLOGLOC, 0, nat_oai->v, nat_oai->l);
320 plog(PLOG_DEBUG, PLOGLOC, NULL, "NAT-OAr:\n");
321 plogdump(PLOG_DEBUG, PLOGLOC, 0, nat_oar->v, nat_oar->l);
322 } else {
323 plog(PLOG_INFO, PLOGLOC, NULL, "Not using NAT-OA.\n");
324 plog(PLOG_INFO, PLOGLOC, NULL, "transportmode == %d, "
325 "natt_flags == 0x%x\n",
326 ipsecdoi_transportmode(iph2->proposal),
327 iph2->ph1->natt_flags & NAT_DETECTED);
328 natoa = ISAKMP_NPTYPE_NONE;
329 }
330 #endif
331
332 /* create SA;NONCE payload, and KE if need, and IDii, IDir. */
333 tlen = + sizeof(*gen) + iph2->sa->l
334 + sizeof(*gen) + iph2->nonce->l;
335 if (pfsgroup)
336 tlen += (sizeof(*gen) + iph2->dhpub->l);
337 if (idci)
338 tlen += sizeof(*gen) + iph2->id->l;
339 if (idcr)
340 tlen += sizeof(*gen) + iph2->id_p->l;
341 #ifdef sun
342 if (natoa != ISAKMP_NPTYPE_NONE)
343 tlen += 2 * sizeof(*gen) + nat_oai->l + nat_oar->l;
344 #endif
345
346 body = rc_vmalloc(tlen);
347 if (body == NULL) {
348 plog(PLOG_INTERR, PLOGLOC, NULL,
349 "failed to get buffer to send.\n");
350 goto end;
351 }
352
353 p = body->v;
354
355 /* add SA payload */
356 p = set_isakmp_payload(p, iph2->sa, ISAKMP_NPTYPE_NONCE);
357
358 /* add NONCE payload */
359 if (pfsgroup)
360 np = ISAKMP_NPTYPE_KE;
361 else if (idci || idcr)
362 np = ISAKMP_NPTYPE_ID;
363 else
364 np = natoa;
365 p = set_isakmp_payload(p, iph2->nonce, np);
366
367 /* add KE payload if need. */
368 np = (idci || idcr) ? ISAKMP_NPTYPE_ID : natoa;
369 if (pfsgroup)
370 p = set_isakmp_payload(p, iph2->dhpub, np);
371
372 /* IDci */
373 np = (idcr) ? ISAKMP_NPTYPE_ID : natoa;
374 if (idci)
375 p = set_isakmp_payload(p, iph2->id, np);
376
377 /* IDcr */
378 if (idcr)
379 p = set_isakmp_payload(p, iph2->id_p, natoa);
380
381 #ifdef sun
382 /* NAT-OA */
383 if (natoa != ISAKMP_NPTYPE_NONE) {
384 p = set_isakmp_payload(p, nat_oai, natoa);
385 p = set_isakmp_payload(p, nat_oar, ISAKMP_NPTYPE_NONE);
386 }
387 #endif
388
389 /* generate HASH(1) */
390 hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, body);
391 if (hash == NULL)
392 goto end;
393
394 /* send isakmp payload */
395 iph2->sendbuf = quick_ir1mx(iph2, body, hash);
396 if (iph2->sendbuf == NULL)
397 goto end;
398
399 /* send the packet, add to the schedule to resend */
400 iph2->retry_counter = ikev1_max_retry_to_send(iph2->ph1->rmconf);
401 if (isakmp_ph2resend(iph2) == -1)
402 goto end;
403
404 /* change status of isakmp status entry */
405 iph2->status = PHASE2ST_MSG1SENT;
406
407 error = 0;
408
409 end:
410 if (body != NULL)
411 rc_vfree(body);
412 if (hash != NULL)
413 rc_vfree(hash);
414 if (nat_oai != NULL)
415 rc_vfree(nat_oai);
416 if (nat_oar != NULL)
417 rc_vfree(nat_oar);
418
419 return error;
420 }
421
422 /*
423 * receive from responder
424 * HDR*, HASH(2), SA, Nr [, KE ] [, IDi2, IDr2 ] [, NAT-OAi, NAT-OAr ]
425 */
426 int
427 quick_i2recv(struct ph2handle *iph2, rc_vchar_t *msg0)
428 {
429 rc_vchar_t *msg = NULL;
430 rc_vchar_t *hbuf = NULL; /* for hash computing. */
431 rc_vchar_t *pbuf = NULL; /* for payload parsing */
432 rc_vchar_t *idci = NULL;
433 rc_vchar_t *idcr = NULL;
434 struct isakmp_parse_t *pa;
435 struct isakmp *isakmp = (struct isakmp *)msg0->v;
436 struct isakmp_pl_hash *hash = NULL;
437 char *p;
438 int tlen;
439 int error = ISAKMP_INTERNAL_ERROR;
440
441 /* validity check */
442 if (iph2->status != PHASE2ST_MSG1SENT) {
443 plog(PLOG_INTERR, PLOGLOC, NULL,
444 "status mismatched %d.\n", iph2->status);
445 goto end;
446 }
447
448 /* decrypt packet */
449 if (!ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E)) {
450 isakmp_log(0, 0, iph2->ph1->remote, 0,
451 PLOG_PROTOERR, PLOGLOC,
452 "Packet wasn't encrypted.\n");
453 goto end;
454 }
455 msg = oakley_do_decrypt(iph2->ph1, msg0, iph2->ivm->iv, iph2->ivm->ive);
456 if (msg == NULL)
493 "expecting %d.\n",
494 pa->type, ISAKMP_NPTYPE_HASH);
495 }
496
497 /* allocate buffer for computing HASH(2) */
498 tlen = iph2->nonce->l
499 + get_uint32(&isakmp->len) - sizeof(*isakmp);
500 hbuf = rc_vmalloc(tlen);
501 if (hbuf == NULL) {
502 plog(PLOG_INTERR, PLOGLOC, NULL,
503 "failed to get hash buffer.\n");
504 goto end;
505 }
506 p = hbuf->v + iph2->nonce->l; /* retain the space for Ni_b */
507
508 /*
509 * parse the payloads.
510 * copy non-HASH payloads into hbuf, so that we can validate HASH.
511 */
512 iph2->sa_ret = NULL;
513 tlen = 0; /* count payload length except of HASH payload. */
514 for (; pa->type; pa++) {
515
516 /* copy to buffer for HASH */
517 /* Don't modify the payload */
518 memcpy(p, pa->ptr, pa->len);
519
520 switch (pa->type) {
521 case ISAKMP_NPTYPE_SA:
522 if (iph2->sa_ret != NULL) {
523 plog(PLOG_PROTOERR, PLOGLOC, NULL,
524 "Ignored, multiple SA "
525 "isn't supported.\n");
526 break;
527 }
528 if (isakmp_p2ph(&iph2->sa_ret, pa->ptr) < 0)
529 goto end;
530 break;
531
532 case ISAKMP_NPTYPE_NONCE:
533 if (isakmp_p2ph(&iph2->nonce_p, pa->ptr) < 0)
534 goto end;
535 break;
536
537 case ISAKMP_NPTYPE_KE:
538 if (isakmp_p2ph(&iph2->dhpub_p, pa->ptr) < 0)
539 goto end;
540 break;
541
542 case ISAKMP_NPTYPE_ID:
543 if (idci == NULL) {
544 if (isakmp_p2ph(&idci, pa->ptr) < 0)
545 goto end;
546 } else if (idcr == NULL) {
547 if (isakmp_p2ph(&idcr, pa->ptr) < 0)
548 goto end;
549 } else {
550 }
551 break;
552
553 case ISAKMP_NPTYPE_N:
554 isakmp_check_notify(pa->ptr, iph2->ph1);
555 break;
556
557 #ifdef ENABLE_NATT
558 case ISAKMP_NPTYPE_NATOA_DRAFT:
559 case ISAKMP_NPTYPE_NATOA_RFC:
560 #ifdef sun
561 /* DON'T ignore original source/destination. */
562 {
563 struct sockaddr_storage addr;
564 struct sockaddr *daddr;
565 uint8_t prefix;
566 uint16_t ul_proto;
567 rc_vchar_t *vp = NULL;
568
569 if (isakmp_p2ph(&vp, pa->ptr) < 0)
570 goto end;
571
572 error = ipsecdoi_id2sockaddr(vp,
573 (struct sockaddr *) &addr,
574 &prefix, &ul_proto);
575
576 rc_vfree(vp);
577
578 if (error)
579 goto end;
580
581 daddr = rcs_sadup((struct sockaddr *) &addr);
582 if (daddr == NULL)
583 goto end;
584
585 if (iph2->natoa_src == NULL)
586 iph2->natoa_src = daddr;
587 else if (iph2->natoa_dst == NULL)
588 iph2->natoa_dst = daddr;
589 else {
590 racoon_free(daddr);
591 goto end;
592 }
593 }
594 #else
595 /* Ignore original source/destination messages */
596 #endif
597 break;
598 #endif
599
600 default:
601 /* don't send information, see ident_r1recv() */
602 isakmp_log(0, 0, iph2->ph1->remote, 0,
603 PLOG_PROTOERR, PLOGLOC,
604 "ignore the packet, "
605 "received unexpecting payload type %d.\n",
606 pa->type);
607 goto end;
608 }
609
610 p += pa->len;
611
612 /* compute true length of payload. */
613 tlen += pa->len;
614 }
615
616 /* payload existency check */
617 if (hash == NULL || iph2->sa_ret == NULL || iph2->nonce_p == NULL) {
618 isakmp_log(0, 0, iph2->ph1->remote, 0,
619 PLOG_PROTOERR, PLOGLOC,
620 "few isakmp message received.\n");
621 goto end;
622 }
623
624 /* identity check */
625 if (idci != NULL) {
626 struct sockaddr_storage proposed_addr, got_addr;
627 uint8_t proposed_prefix, got_prefix;
628 uint16_t proposed_ulproto, got_ulproto;
629
630 error = ipsecdoi_id2sockaddr(iph2->id,
631 (struct sockaddr *) &proposed_addr,
632 &proposed_prefix, &proposed_ulproto);
633 if (error)
634 goto end;
635
636 error = ipsecdoi_id2sockaddr(idci,
637 (struct sockaddr *) &got_addr,
638 &got_prefix, &got_ulproto);
639 if (error)
640 goto end;
641
642 if (proposed_prefix != got_prefix
643 || proposed_ulproto != got_ulproto) {
644 plog(PLOG_DEBUG, PLOGLOC, NULL,
645 "IDci prefix/ulproto does not match proposal.\n");
646 error = ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED;
647 goto end;
648 }
649
650 if (rcs_cmpsa((struct sockaddr *) &proposed_addr,
651 (struct sockaddr *) &got_addr) == 0) {
652 plog(PLOG_DEBUG, PLOGLOC, NULL,
653 "IDci matches proposal.\n");
654 #ifdef ENABLE_NATT
655 } else if (iph2->natoa_src != NULL
656 && rcs_cmpsa_wop(iph2->natoa_src,
657 (struct sockaddr *) &got_addr) == 0
658 && extract_port((struct sockaddr *) &proposed_addr) ==
659 extract_port((struct sockaddr *) &got_addr)) {
660 plog(PLOG_DEBUG, PLOGLOC, NULL,
661 "IDci matches NAT-OAi.\n");
662 #endif
663 } else {
664 plog(PLOG_INTERR, PLOGLOC, NULL,
665 "mismatched IDci was returned.\n");
666 error = ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED;
667 goto end;
668 }
669 }
670 if (idcr != NULL) {
671 struct sockaddr_storage proposed_addr, got_addr;
672 uint8_t proposed_prefix, got_prefix;
673 uint16_t proposed_ulproto, got_ulproto;
674
675 error = ipsecdoi_id2sockaddr(iph2->id_p,
676 (struct sockaddr *) &proposed_addr,
677 &proposed_prefix, &proposed_ulproto);
678 if (error)
679 goto end;
680
681 error = ipsecdoi_id2sockaddr(idcr,
682 (struct sockaddr *) &got_addr,
683 &got_prefix, &got_ulproto);
684 if (error)
685 goto end;
686
687 if (proposed_prefix != got_prefix
688 || proposed_ulproto != got_ulproto) {
689 plog(PLOG_DEBUG, PLOGLOC, NULL,
690 "IDcr prefix/ulproto does not match proposal.\n");
691 error = ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED;
692 goto end;
693 }
694
695 if (rcs_cmpsa((struct sockaddr *) &proposed_addr,
696 (struct sockaddr *) &got_addr) == 0) {
697 plog(PLOG_DEBUG, PLOGLOC, NULL,
698 "IDcr matches proposal.\n");
699 #ifdef ENABLE_NATT
700 } else if (iph2->natoa_dst != NULL
701 && rcs_cmpsa_wop(iph2->natoa_dst,
702 (struct sockaddr *) &got_addr) == 0
703 && extract_port((struct sockaddr *) &proposed_addr) ==
704 extract_port((struct sockaddr *) &got_addr)) {
705 plog(PLOG_DEBUG, PLOGLOC, NULL,
706 "IDcr matches NAT-OAr.\n");
707 #endif
708 } else {
709 plog(PLOG_INTERR, PLOGLOC, NULL,
710 "mismatched IDcr was returned.\n");
711 error = ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED;
712 goto end;
713 }
714 }
715
716 /* Fixed buffer for calculating HASH */
717 memcpy(hbuf->v, iph2->nonce->v, iph2->nonce->l);
718 plog(PLOG_DEBUG, PLOGLOC, NULL,
719 "HASH allocated:hbuf->l=%d actual:tlen=%d\n",
720 hbuf->l, tlen + iph2->nonce->l);
721 /* adjust buffer length for HASH */
722 hbuf->l = iph2->nonce->l + tlen;
723
724 /* validate HASH(2) */
725 {
726 char *r_hash;
727 rc_vchar_t *my_hash = NULL;
728 int result;
729
730 r_hash = (char *)hash + sizeof(*hash);
731
732 plog(PLOG_DEBUG, PLOGLOC, NULL, "HASH(2) received:");
733 plogdump(PLOG_DEBUG, PLOGLOC, 0, r_hash, get_uint16(&hash->h.len) - sizeof(*hash));
734
735 my_hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, hbuf);
749 }
750
751 /* validity check SA payload sent from responder */
752 if (ipsecdoi_checkph2proposal(iph2) < 0) {
753 error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
754 goto end;
755 }
756
757 /* change status of isakmp status entry */
758 iph2->status = PHASE2ST_STATUS6;
759
760 error = 0;
761
762 end:
763 if (hbuf)
764 rc_vfree(hbuf);
765 if (pbuf)
766 rc_vfree(pbuf);
767 if (msg)
768 rc_vfree(msg);
769 if (idci)
770 rc_vfree(idci);
771 if (idcr)
772 rc_vfree(idcr);
773
774 if (error) {
775 VPTRINIT(iph2->sa_ret);
776 VPTRINIT(iph2->nonce_p);
777 VPTRINIT(iph2->dhpub_p);
778 VPTRINIT(iph2->id);
779 VPTRINIT(iph2->id_p);
780 #ifdef ENABLE_NATT
781 if (iph2->natoa_src) {
782 racoon_free(iph2->natoa_src);
783 iph2->natoa_src = NULL;
784 }
785 if (iph2->natoa_dst) {
786 racoon_free(iph2->natoa_dst);
787 iph2->natoa_dst = NULL;
788 }
789 #endif
790 }
791
792 return error;
793 }
794
795 static int
796 fill_in_ipsec_sas(struct ph2handle *iph2)
797 {
798 /*
799 * NOTE: The OpenSolaris kernel can queue up packets on a larval SA
800 * such that when the SA is filled-in via SADB_UPDATE, these packets
801 * can be immediately processed. If the reply packet is generated
802 * in-kernel (e.g. ICMP_ECHO processing), an additonal ACQUIRE can
803 * be sent if there is not a corresponding outbound SA waiting in
804 * the wings. We therefore perform SADB_ADD first so that if an
805 * outbound SA is needed immediately during SADB_UPDATE processing,
806 * it is ready.
807 */
808
809 plog(PLOG_DEBUG, PLOGLOC, NULL, "call pk_sendadd\n");
810 if (pk_sendadd(iph2) < 0) {
811 plog(PLOG_INTERR, PLOGLOC, NULL, "pfkey add failed.\n");
812 return (-1);
813 }
814 plog(PLOG_DEBUG, PLOGLOC, NULL, "pfkey add sent.\n");
815
816 plog(PLOG_DEBUG, PLOGLOC, NULL, "call pk_sendupdate\n");
817 if (pk_sendupdate(iph2) < 0) {
818 plog(PLOG_INTERR, PLOGLOC, NULL, "pfkey update failed.\n");
819 return (-1);
820 }
821 plog(PLOG_DEBUG, PLOGLOC, NULL, "pfkey update sent.\n");
822
823 return (0);
824 }
825
826 /*
827 * send to responder
828 * HDR*, HASH(3)
829 */
830 int
831 quick_i2send(struct ph2handle *iph2, rc_vchar_t *msg0)
832 {
833 rc_vchar_t *msg = NULL;
834 rc_vchar_t *buf = NULL;
835 rc_vchar_t *hash = NULL;
836 char *p = NULL;
837 int tlen;
838 int error = ISAKMP_INTERNAL_ERROR;
839
840 /* validity check */
841 if (iph2->status != PHASE2ST_STATUS6) {
842 plog(PLOG_INTERR, PLOGLOC, NULL,
843 "status mismatched %d.\n", iph2->status);
844 goto end;
845 }
917 if (oakley_compute_keymat(iph2, INITIATOR) < 0)
918 goto end;
919
920 iph2->status = PHASE2ST_ADDSA;
921
922 #if 0
923 /* don't anything if local test mode. */
924 if (f_local) {
925 error = 0;
926 goto end;
927 }
928 #endif
929
930 /* if there is commit bit don't set up SA now. */
931 if (ISSET(iph2->flags, ISAKMP_FLAG_C)) {
932 iph2->status = PHASE2ST_COMMIT;
933 error = 0;
934 goto end;
935 }
936
937 plog(PLOG_DEBUG, PLOGLOC, NULL, "call fill_in_ipsec_sas");
938 error = fill_in_ipsec_sas(iph2);
939
940 end:
941 if (buf != NULL)
942 rc_vfree(buf);
943 if (msg != NULL)
944 rc_vfree(msg);
945 if (hash != NULL)
946 rc_vfree(hash);
947
948 return error;
949 }
950
951 /*
952 * receive from responder
953 * HDR#*, HASH(4), notify
954 */
955 int
956 quick_i3recv(struct ph2handle *iph2, rc_vchar_t *msg0)
957 {
958 rc_vchar_t *msg = NULL;
959 rc_vchar_t *pbuf = NULL; /* for payload parsing */
1050 if (result) {
1051 isakmp_log(0, 0, iph2->ph1->remote, 0,
1052 PLOG_PROTOERR, PLOGLOC,
1053 "HASH(4) mismatch.\n");
1054 error = ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
1055 goto end;
1056 }
1057 }
1058
1059 iph2->status = PHASE2ST_ADDSA;
1060 iph2->flags ^= ISAKMP_FLAG_C; /* reset bit */
1061
1062 #if 0
1063 /* don't anything if local test mode. */
1064 if (f_local) {
1065 error = 0;
1066 goto end;
1067 }
1068 #endif
1069
1070 plog(PLOG_DEBUG, PLOGLOC, NULL, "call fill_in_ipsec_sas");
1071 error = fill_in_ipsec_sas(iph2);
1072
1073 end:
1074 if (msg != NULL)
1075 rc_vfree(msg);
1076 if (pbuf != NULL)
1077 rc_vfree(pbuf);
1078 if (notify != NULL)
1079 rc_vfree(notify);
1080
1081 return error;
1082 }
1083
1084 /*
1085 * receive from initiator
1086 * HDR*, HASH(1), SA, Ni [, KE ] [, IDi2, IDr2 ] [, NAT-OAi, NAT-OAr ]
1087 */
1088 int
1089 quick_r1recv(struct ph2handle *iph2, rc_vchar_t *msg0)
1090 {
1091 rc_vchar_t *msg = NULL;
1092 rc_vchar_t *hbuf = NULL; /* for hash computing. */
1093 rc_vchar_t *pbuf = NULL; /* for payload parsing */
1094 struct isakmp_parse_t *pa;
1095 struct isakmp *isakmp = (struct isakmp *)msg0->v;
1096 struct isakmp_pl_hash *hash = NULL;
1097 char *p;
1098 int tlen;
1099 int f_id_order; /* for ID payload detection */
1100 int error = ISAKMP_INTERNAL_ERROR;
1101
1102 /* validity check */
1103 if (iph2->status != PHASE2ST_START) {
1104 plog(PLOG_INTERR, PLOGLOC, NULL,
1105 "status mismatched %d.\n", iph2->status);
1106 goto end;
1236 }
1237
1238 if (isakmp_p2ph(&iph2->id, pa->ptr) < 0)
1239 goto end;
1240 } else {
1241 plog(PLOG_PROTOERR, PLOGLOC, NULL,
1242 "received too many ID payloads.\n");
1243 plogdump(PLOG_PROTOERR, PLOGLOC, 0, iph2->id->v, iph2->id->l);
1244 error = ISAKMP_NTYPE_INVALID_ID_INFORMATION;
1245 goto end;
1246 }
1247 break;
1248
1249 case ISAKMP_NPTYPE_N:
1250 isakmp_check_notify(pa->ptr, iph2->ph1);
1251 break;
1252
1253 #ifdef ENABLE_NATT
1254 case ISAKMP_NPTYPE_NATOA_DRAFT:
1255 case ISAKMP_NPTYPE_NATOA_RFC:
1256 #ifdef sun
1257 {
1258 struct sockaddr_storage addr;
1259 struct sockaddr *daddr;
1260 uint8_t prefix;
1261 uint16_t ul_proto;
1262 rc_vchar_t *vp = NULL;
1263
1264 if (isakmp_p2ph(&vp, pa->ptr) < 0)
1265 goto end;
1266
1267 error = ipsecdoi_id2sockaddr(vp,
1268 (struct sockaddr *) &addr,
1269 &prefix, &ul_proto);
1270
1271 rc_vfree(vp);
1272
1273 if (error)
1274 goto end;
1275
1276 daddr = rcs_sadup((struct sockaddr *) &addr);
1277 if (daddr == NULL)
1278 goto end;
1279
1280 if (iph2->natoa_dst == NULL)
1281 iph2->natoa_dst = daddr;
1282 else if (iph2->natoa_src == NULL)
1283 iph2->natoa_src = daddr;
1284 else {
1285 racoon_free(daddr);
1286 goto end;
1287 }
1288 }
1289 #else
1290 /* Ignore original source/destination messages */
1291 #endif
1292 break;
1293 #endif
1294
1295 default:
1296 isakmp_log(0, 0, iph2->ph1->remote, 0,
1297 PLOG_PROTOERR, PLOGLOC,
1298 "ignore the packet, "
1299 "received unexpecting payload type %d.\n",
1300 pa->type);
1301 error = ISAKMP_NTYPE_PAYLOAD_MALFORMED;
1302 goto end;
1303 }
1304
1305 p += pa->len;
1306
1307 /* compute true length of payload. */
1308 tlen += pa->len;
1309 }
1310
1311 /* payload existency check */
1339
1340 plog(PLOG_DEBUG, PLOGLOC, NULL, "HASH(1) validate:");
1341 plogdump(PLOG_DEBUG, PLOGLOC, 0, r_hash, get_uint16(&hash->h.len) - sizeof(*hash));
1342
1343 my_hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, hbuf);
1344 if (my_hash == NULL)
1345 goto end;
1346
1347 result = memcmp(my_hash->v, r_hash, my_hash->l);
1348 rc_vfree(my_hash);
1349
1350 if (result) {
1351 isakmp_log(0, 0, iph2->ph1->remote, 0,
1352 PLOG_DEBUG, PLOGLOC,
1353 "HASH(1) mismatch.\n");
1354 error = ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
1355 goto end;
1356 }
1357 }
1358
1359 #ifndef sun
1360 /* get sainfo */
1361 error = get_sainfo_r(iph2);
1362 if (error) {
1363 plog(PLOG_PROTOERR, PLOGLOC, NULL,
1364 "failed to get sainfo.\n");
1365 goto end;
1366 }
1367
1368 /* check the existence of ID payload and create responder's proposal */
1369 error = get_proposal_r(iph2);
1370 switch (error) {
1371 #ifdef notyet
1372 case -2:
1373 /* generate a policy template from peer's proposal */
1374 if (set_proposal_from_proposal(iph2)) {
1375 plog(PLOG_INTERR, PLOGLOC, NULL,
1376 "failed to generate a proposal template "
1377 "from client's proposal.\n");
1378 return ISAKMP_INTERNAL_ERROR;
1379 }
1388 break;
1389 default:
1390 plog(PLOG_INTERR, PLOGLOC, NULL,
1391 "failed to get proposal for responder.\n");
1392 goto end;
1393 }
1394
1395 /* check KE and attribute of PFS */
1396 if (iph2->dhpub_p != NULL && iph2->approval->pfs_group == 0) {
1397 plog(PLOG_PROTOERR, PLOGLOC, NULL,
1398 "no PFS is specified, but peer sends KE.\n");
1399 error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
1400 goto end;
1401 }
1402 if (iph2->dhpub_p == NULL && iph2->approval->pfs_group != 0) {
1403 plog(PLOG_PROTOERR, PLOGLOC, NULL,
1404 "PFS is specified, but peer doesn't sends KE.\n");
1405 error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
1406 goto end;
1407 }
1408 /* change status of isakmp status entry */
1409 iph2->status = PHASE2ST_STATUS2;
1410
1411 #endif /* sun/OpenSolaris */
1412
1413 /*
1414 * save the packet from the initiator in order to resend the
1415 * responder's first packet against this packet.
1416 */
1417 iph2->msg1 = rc_vdup(msg0);
1418
1419 error = 0;
1420
1421 end:
1422 if (hbuf)
1423 rc_vfree(hbuf);
1424 if (msg)
1425 rc_vfree(msg);
1426 if (pbuf)
1427 rc_vfree(pbuf);
1428
1429 if (error) {
1430 VPTRINIT(iph2->sa);
1431 VPTRINIT(iph2->nonce_p);
1432 VPTRINIT(iph2->dhpub_p);
1433 VPTRINIT(iph2->id);
1434 VPTRINIT(iph2->id_p);
1435 #ifdef ENABLE_NATT
1436 if (iph2->natoa_src) {
1437 racoon_free(iph2->natoa_src);
1438 iph2->natoa_src = NULL;
1439 }
1440 if (iph2->natoa_dst) {
1441 racoon_free(iph2->natoa_dst);
1442 iph2->natoa_dst = NULL;
1443 }
1444 #endif
1445 }
1446
1447 return error;
1448 }
1449
1450 /*
1451 * call pfkey_getspi.
1452 */
1453 int
1454 quick_r1prep(struct ph2handle *iph2, rc_vchar_t *msg)
1455 {
1456 int error = ISAKMP_INTERNAL_ERROR;
1457
1458 /* validity check */
1459 if (iph2->status != PHASE2ST_STATUS2) {
1460 plog(PLOG_INTERR, PLOGLOC, NULL,
1461 "status mismatched %d.\n", iph2->status);
1462 goto end;
1463 }
1464
1465 iph2->status = PHASE2ST_GETSPISENT;
1466
1467 /* send getspi message */
1468 if (pk_sendgetspi(iph2) < 0)
1469 goto end;
1470
1471 plog(PLOG_DEBUG, PLOGLOC, NULL, "pfkey getspi sent.\n");
1472
1473 iph2->sce = sched_new(ikev1_ipsec_sa_nego_time_limit(iph2->ph1->rmconf),
1474 pfkey_timeover_stub, iph2);
1475
1476 error = 0;
1477
1478 end:
1479 return error;
1480 }
1481
1482 /*
1483 * send to initiator
1484 * HDR*, HASH(2), SA, Nr [, KE ] [, IDi2, IDr2 ] [, NAT-OAi, NAT-OAr ]
1485 */
1486 int
1487 quick_r2send(struct ph2handle *iph2, rc_vchar_t *msg)
1488 {
1489 rc_vchar_t *body = NULL;
1490 rc_vchar_t *hash = NULL;
1491 struct isakmp_gen *gen;
1492 char *p;
1493 int tlen;
1494 int error = ISAKMP_INTERNAL_ERROR;
1495 int natoa = ISAKMP_NPTYPE_NONE;
1496 int pfsgroup;
1497 uint8_t *np_p = NULL;
1498 #ifdef ENABLE_NATT
1499 rc_vchar_t *nat_oai = NULL;
1500 rc_vchar_t *nat_oar = NULL;
1501 #endif
1502
1503 /* validity check */
1504 if (msg != NULL) {
1505 plog(PLOG_INTERR, PLOGLOC, NULL,
1506 "msg has to be NULL in this function.\n");
1507 goto end;
1508 }
1509 if (iph2->status != PHASE2ST_GETSPIDONE) {
1510 plog(PLOG_INTERR, PLOGLOC, NULL,
1511 "status mismatched %d.\n", iph2->status);
1512 goto end;
1513 }
1514
1515 /* update responders SPI */
1516 if (ipsecdoi_updatespi(iph2) < 0) {
1517 plog(PLOG_INTERR, PLOGLOC, NULL, "failed to update spi.\n");
1518 goto end;
1519 }
1520
1521 /* generate NONCE value */
1522 iph2->nonce = eay_set_random(ikev1_nonce_size(iph2->ph1->rmconf));
1523 if (iph2->nonce == NULL)
1524 goto end;
1525
1526 /* generate KE value if need */
1527 pfsgroup = iph2->approval->pfs_group;
1528 if (iph2->dhpub_p != NULL && pfsgroup != 0) {
1529 /* DH group settting if PFS is required. */
1530 if (oakley_setdhgroup(pfsgroup, &iph2->pfsgrp) < 0) {
1531 plog(PLOG_INTERR, PLOGLOC, NULL,
1532 "failed to set DH value.\n");
1533 goto end;
1534 }
1535 /* generate DH public value */
1536 if (oakley_dh_generate(iph2->pfsgrp,
1537 &iph2->dhpub, &iph2->dhpriv) < 0) {
1538 goto end;
1539 }
1540 }
1541
1542 #ifdef ENABLE_NATT
1543 /*
1544 * RFC3947 5.2. if we chose UDP-Encapsulated-Transport
1545 * we should send NAT-OA
1546 */
1547 if (ipsecdoi_transportmode(iph2->proposal)
1548 && (iph2->ph1->natt_flags & NAT_DETECTED)) {
1549 natoa = iph2->ph1->natt_options->payload_nat_oa;
1550
1551 nat_oai = ipsecdoi_sockaddr2id(iph2->dst,
1552 IPSECDOI_PREFIX_HOST, IPSEC_ULPROTO_ANY);
1553 nat_oar = ipsecdoi_sockaddr2id(iph2->src,
1554 IPSECDOI_PREFIX_HOST, IPSEC_ULPROTO_ANY);
1555
1556 if (nat_oai == NULL || nat_oar == NULL) {
1557 plog(PLOG_INTERR, PLOGLOC, NULL,
1558 "failed to generate NAT-OA payload.\n");
1559 goto end;
1560 }
1561
1562 plog(PLOG_DEBUG, PLOGLOC, NULL, "NAT-OAi:\n");
1563 plogdump(PLOG_DEBUG, PLOGLOC, 0, nat_oai->v, nat_oai->l);
1564 plog(PLOG_DEBUG, PLOGLOC, 0, NULL, "NAT-OAr:\n");
1565 plogdump(PLOG_DEBUG, PLOGLOC, 0, nat_oar->v, nat_oar->l);
1566 }
1567 #endif
1568
1569 /* create SA;NONCE payload, and KE and ID if need */
1570 tlen = sizeof(*gen) + iph2->sa_ret->l
1571 + sizeof(*gen) + iph2->nonce->l;
1572 if (iph2->dhpub_p != NULL && pfsgroup != 0)
1573 tlen += (sizeof(*gen) + iph2->dhpub->l);
1574 if (iph2->id_p != NULL)
1575 tlen += (sizeof(*gen) + iph2->id_p->l
1576 + sizeof(*gen) + iph2->id->l);
1577
1578 #ifdef ENABLE_NATT
1579 if (natoa != ISAKMP_NPTYPE_NONE)
1580 tlen += 2 * sizeof(*gen) + nat_oai->l + nat_oar->l;
1581 #endif
1582
1583 body = rc_vmalloc(tlen);
1584 if (body == NULL) {
1585 plog(PLOG_INTERR, PLOGLOC, NULL,
1586 "failed to get buffer to send.\n");
1587 goto end;
1588 }
1589 p = body->v;
1590
1591 /* make SA payload */
1592 p = set_isakmp_payload(body->v, iph2->sa_ret, ISAKMP_NPTYPE_NONCE);
1593
1594 /* add NONCE payload */
1595 np_p = &((struct isakmp_gen *)p)->np; /* XXX */
1596 p = set_isakmp_payload(p, iph2->nonce,
1597 (iph2->dhpub_p != NULL && pfsgroup != 0)
1598 ? ISAKMP_NPTYPE_KE
1599 : (iph2->id_p != NULL
1600 ? ISAKMP_NPTYPE_ID
1601 : natoa));
1602
1603 /* add KE payload if need. */
1604 if (iph2->dhpub_p != NULL && pfsgroup != 0) {
1605 np_p = &((struct isakmp_gen *)p)->np; /* XXX */
1606 p = set_isakmp_payload(p, iph2->dhpub,
1607 (iph2->id_p == NULL)
1608 ? natoa
1609 : ISAKMP_NPTYPE_ID);
1610 }
1611
1612 /* add ID payloads received. */
1613 if (iph2->id_p != NULL) {
1614 /* IDci */
1615 p = set_isakmp_payload(p, iph2->id_p, ISAKMP_NPTYPE_ID);
1616 /* IDcr */
1617 np_p = &((struct isakmp_gen *)p)->np; /* XXX */
1618 p = set_isakmp_payload(p, iph2->id, natoa);
1619 }
1620 #ifdef ENABLE_NATT
1621 /* NAT-OA */
1622 if (natoa != ISAKMP_NPTYPE_NONE) {
1623 p = set_isakmp_payload(p, nat_oai, natoa);
1624 p = set_isakmp_payload(p, nat_oar, ISAKMP_NPTYPE_NONE);
1625 }
1626 #endif
1627
1628 /* add a RESPONDER-LIFETIME notify payload if needed */
1629 {
1630 rc_vchar_t *data = NULL;
1631 struct saprop *pp = iph2->approval;
1632 struct saproto *pr;
1633
1634 if (pp->claim & IPSECDOI_ATTR_SA_LD_TYPE_SEC) {
1635 uint32_t v = htonl((uint32_t)pp->lifetime);
1636 data = isakmp_add_attr_l(data, IPSECDOI_ATTR_SA_LD_TYPE,
1637 IPSECDOI_ATTR_SA_LD_TYPE_SEC);
1638 if (!data)
1639 goto end;
1640 data = isakmp_add_attr_v(data, IPSECDOI_ATTR_SA_LD,
1641 (caddr_t)&v, sizeof(v));
1642 if (!data)
1643 goto end;
1644 }
1645 if (pp->claim & IPSECDOI_ATTR_SA_LD_TYPE_KB) {
1646 uint32_t v = htonl((uint32_t)pp->lifebyte);
1701 if (isakmp_ph2resend(iph2) == -1)
1702 goto end;
1703
1704 /* the sending message is added to the received-list. */
1705 if (add_recvdpkt(iph2->ph1->remote, iph2->ph1->local, iph2->sendbuf, iph2->msg1, iph2->ph1->rmconf) == -1) {
1706 plog(PLOG_INTERR , PLOGLOC, NULL,
1707 "failed to add a response packet to the tree.\n");
1708 goto end;
1709 }
1710
1711 /* change status of isakmp status entry */
1712 iph2->status = PHASE2ST_MSG1SENT;
1713
1714 error = 0;
1715
1716 end:
1717 if (body != NULL)
1718 rc_vfree(body);
1719 if (hash != NULL)
1720 rc_vfree(hash);
1721 #ifdef ENABLE_NATT
1722 if (nat_oai != NULL)
1723 rc_vfree(nat_oai);
1724 if (nat_oar != NULL)
1725 rc_vfree(nat_oar);
1726 #endif
1727
1728 return error;
1729 }
1730
1731 /*
1732 * receive from initiator
1733 * HDR*, HASH(3)
1734 */
1735 int
1736 quick_r3recv(struct ph2handle *iph2, rc_vchar_t *msg0)
1737 {
1738 rc_vchar_t *msg = NULL;
1739 rc_vchar_t *pbuf = NULL; /* for payload parsing */
1740 struct isakmp_parse_t *pa;
1741 struct isakmp_pl_hash *hash = NULL;
1742 int error = ISAKMP_INTERNAL_ERROR;
1743
1744 /* validity check */
1745 if (iph2->status != PHASE2ST_MSG1SENT) {
1746 plog(PLOG_INTERR, PLOGLOC, NULL,
1976 if (oakley_compute_keymat(iph2, RESPONDER) < 0)
1977 goto end;
1978
1979 iph2->status = PHASE2ST_ADDSA;
1980 iph2->flags ^= ISAKMP_FLAG_C; /* reset bit */
1981
1982 /* generate policy */
1983 if (rcs_is_addr_rw(iph2->selector->pl->peers_sa_ipaddr)) {
1984 IPSEC_CONF(lifetime, iph2->selector->pl->ips,
1985 ipsec_sa_lifetime_time, 0);
1986 if (ike_spmif_post_policy_add(iph2->selector,
1987 ike_ipsec_mode(iph2->selector->pl),
1988 lifetime, iph2->src, iph2->dst,
1989 iph2->ph1->rmconf) < 0) {
1990 plog(PLOG_INTERR, PLOGLOC, NULL,
1991 "generate policy failed.\n");
1992 goto end;
1993 }
1994 }
1995
1996 plog(PLOG_DEBUG, PLOGLOC, NULL, "call fill_in_ipsec_sas");
1997 error = fill_in_ipsec_sas(iph2);
1998
1999 end:
2000 if (msg != NULL)
2001 rc_vfree(msg);
2002
2003 return error;
2004 }
2005
2006
2007 /*
2008 * create HASH, body (SA, NONCE) payload with isakmp header.
2009 */
2010 static rc_vchar_t *
2011 quick_ir1mx(struct ph2handle *iph2, rc_vchar_t *body, rc_vchar_t *hash)
2012 {
2013 struct isakmp *isakmp;
2014 rc_vchar_t *buf = NULL, *new = NULL;
2015 char *p;
2016 int tlen;
2017 struct isakmp_gen *gen;
2018 int error = ISAKMP_INTERNAL_ERROR;
2394 if (!iph2->spidx_gen) {
2395 plog(PLOG_INTERR, PLOGLOC, NULL,
2396 "buffer allocation failed.\n");
2397 return ISAKMP_INTERNAL_ERROR;
2398 }
2399 memcpy(iph2->spidx_gen, &spidx, sizeof(spidx));
2400 return -2; /* special value */
2401 }
2402 plog(PLOG_INTERR, PLOGLOC, NULL,
2403 "no policy found: %s\n", spidx2str(&spidx));
2404 return ISAKMP_INTERNAL_ERROR;
2405 }
2406 /* Refresh existing generated policies
2407 */
2408 if (iph2->ph1->rmconf->gen_policy) {
2409 plog(LLV_INFO, LOCATION, NULL,
2410 "Update the generated policy : %s\n",
2411 spidx2str(&spidx));
2412 iph2->spidx_gen = racoon_malloc(sizeof(spidx));
2413 if (!iph2->spidx_gen) {
2414 plog(PLOG_INTERR, PLOGLOC, NULL,
2415 "buffer allocation failed.\n");
2416 return ISAKMP_INTERNAL_ERROR;
2417 }
2418 memcpy(iph2->spidx_gen, &spidx, sizeof(spidx));
2419 }
2420
2421 /* get outbound policy */
2422 {
2423 struct sockaddr_storage addr;
2424 uint8_t pref;
2425
2426 spidx.dir = IPSEC_DIR_OUTBOUND;
2427 addr = spidx.src;
2428 spidx.src = spidx.dst;
2429 spidx.dst = addr;
2430 pref = spidx.prefs;
2431 spidx.prefs = spidx.prefd;
2432 spidx.prefd = pref;
2433
2434 sp_out = getsp_r(&spidx);
2444
2445 /*
2446 * In the responder side, the inbound policy should be using IPsec.
2447 * outbound policy is not checked currently.
2448 */
2449 if (sp_in->policy != IPSEC_POLICY_IPSEC) {
2450 plog(PLOG_INTERR, PLOGLOC, NULL,
2451 "policy found, but no IPsec required: %s\n",
2452 spidx2str(&spidx));
2453 return ISAKMP_INTERNAL_ERROR;
2454 }
2455
2456 /* set new proposal derived from a policy into the iph2->proposal. */
2457 if (set_proposal_from_policy(iph2, sp_in, sp_out) < 0) {
2458 plog(PLOG_INTERR, PLOGLOC, NULL,
2459 "failed to create saprop.\n");
2460 return ISAKMP_INTERNAL_ERROR;
2461 }
2462
2463 return 0;
2464 #endif /* 0 */
2465 }
2466
2467 #ifdef INET6
2468 static uint32_t
2469 setscopeid(struct sockaddr *sp_addr0, struct sockaddr *sa_addr0)
2470 {
2471 struct sockaddr_in6 *sp_addr, *sa_addr;
2472
2473 sp_addr = (struct sockaddr_in6 *)sp_addr0;
2474 sa_addr = (struct sockaddr_in6 *)sa_addr0;
2475
2476 if (!IN6_IS_ADDR_LINKLOCAL(&sp_addr->sin6_addr)
2477 && !IN6_IS_ADDR_SITELOCAL(&sp_addr->sin6_addr)
2478 && !IN6_IS_ADDR_MULTICAST(&sp_addr->sin6_addr))
2479 return 0;
2480
2481 /* this check should not be here ? */
2482 if (sa_addr->sin6_family != AF_INET6) {
2483 plog(PLOG_INTERR, PLOGLOC, NULL,
2484 "can't get scope ID: family mismatch\n");
|