![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to isakmp.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / ipsec-tools / src / racoon|
Return to isakmp.c CVS log | Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / ipsec-tools / src / racoon |
1.1 misho 1: /* $NetBSD: isakmp.c,v 1.71 2011/03/15 13:20:14 vanhu Exp $ */
2:
3: /* Id: isakmp.c,v 1.74 2006/05/07 21:32:59 manubsd Exp */
4:
5: /*
6: * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
7: * All rights reserved.
8: *
9: * Redistribution and use in source and binary forms, with or without
10: * modification, are permitted provided that the following conditions
11: * are met:
12: * 1. Redistributions of source code must retain the above copyright
13: * notice, this list of conditions and the following disclaimer.
14: * 2. Redistributions in binary form must reproduce the above copyright
15: * notice, this list of conditions and the following disclaimer in the
16: * documentation and/or other materials provided with the distribution.
17: * 3. Neither the name of the project nor the names of its contributors
18: * may be used to endorse or promote products derived from this software
19: * without specific prior written permission.
20: *
21: * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22: * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23: * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24: * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25: * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26: * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27: * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28: * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29: * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30: * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31: * SUCH DAMAGE.
32: */
33:
34: #include "config.h"
35:
36: #include <sys/types.h>
37: #include <sys/param.h>
38: #include <sys/socket.h>
39: #include <sys/queue.h>
40:
41: #include <netinet/in.h>
42: #include <arpa/inet.h>
43:
44: #include PATH_IPSEC_H
45:
46: #include <stdlib.h>
47: #include <stdio.h>
48: #include <string.h>
49: #include <errno.h>
50: #if TIME_WITH_SYS_TIME
51: # include <sys/time.h>
52: # include <time.h>
53: #else
54: # if HAVE_SYS_TIME_H
55: # include <sys/time.h>
56: # else
57: # include <time.h>
58: # endif
59: #endif
60: #include <netdb.h>
61: #ifdef HAVE_UNISTD_H
62: #include <unistd.h>
63: #endif
64: #include <ctype.h>
65: #ifdef ENABLE_HYBRID
66: #include <resolv.h>
67: #endif
68:
69: #include "var.h"
70: #include "misc.h"
71: #include "vmbuf.h"
72: #include "plog.h"
73: #include "sockmisc.h"
74: #include "schedule.h"
75: #include "session.h"
76: #include "debug.h"
77:
78: #include "remoteconf.h"
79: #include "localconf.h"
80: #include "grabmyaddr.h"
81: #include "admin.h"
82: #include "privsep.h"
83: #include "isakmp_var.h"
84: #include "isakmp.h"
85: #include "oakley.h"
86: #include "evt.h"
87: #include "handler.h"
88: #include "ipsec_doi.h"
89: #include "pfkey.h"
90: #include "crypto_openssl.h"
91: #include "policy.h"
92: #include "algorithm.h"
93: #include "proposal.h"
94: #include "sainfo.h"
95: #include "isakmp_ident.h"
96: #include "isakmp_agg.h"
97: #include "isakmp_base.h"
98: #include "isakmp_quick.h"
99: #include "isakmp_inf.h"
100: #include "isakmp_newg.h"
101: #ifdef ENABLE_HYBRID
102: #include "vendorid.h"
103: #include "isakmp_xauth.h"
104: #include "isakmp_unity.h"
105: #include "isakmp_cfg.h"
106: #endif
107: #ifdef ENABLE_FRAG
108: #include "isakmp_frag.h"
109: #endif
110: #include "strnames.h"
111:
112: #include <fcntl.h>
113:
114: #ifdef ENABLE_NATT
115: # include "nattraversal.h"
116: #endif
117: # ifdef __linux__
118: # include <linux/udp.h>
119: # include <linux/ip.h>
120: # ifndef SOL_UDP
121: # define SOL_UDP 17
122: # endif
123: # endif /* __linux__ */
124: # if defined(__NetBSD__) || defined(__FreeBSD__) || \
125: (defined(__APPLE__) && defined(__MACH__))
126: # include <netinet/in.h>
127: # include <netinet/udp.h>
128: # include <netinet/in_systm.h>
129: # include <netinet/ip.h>
130: # define SOL_UDP IPPROTO_UDP
131: # endif /* __NetBSD__ / __FreeBSD__ */
132:
133: static int nostate1 __P((struct ph1handle *, vchar_t *));
134: static int nostate2 __P((struct ph2handle *, vchar_t *));
135:
136: extern caddr_t val2str(const char *, size_t);
137:
138: static int (*ph1exchange[][2][PHASE1ST_MAX])
139: __P((struct ph1handle *, vchar_t *)) = {
140: /* error */
141: { { 0 }, { 0 }, },
142: /* Identity Protection exchange */
143: {
144: { nostate1, ident_i1send, nostate1, ident_i2recv, ident_i2send,
145: ident_i3recv, ident_i3send, ident_i4recv, ident_i4send, nostate1, nostate1,},
146: { nostate1, ident_r1recv, ident_r1send, ident_r2recv, ident_r2send,
147: ident_r3recv, ident_r3send, nostate1, nostate1, nostate1, nostate1, },
148: },
149: /* Aggressive exchange */
150: {
151: { nostate1, agg_i1send, nostate1, agg_i2recv, agg_i2send,
152: nostate1, nostate1, nostate1, nostate1, nostate1, nostate1, },
153: { nostate1, agg_r1recv, agg_r1send, agg_r2recv, agg_r2send,
154: nostate1, nostate1, nostate1, nostate1, nostate1, nostate1, },
155: },
156: /* Base exchange */
157: {
158: { nostate1, base_i1send, nostate1, base_i2recv, base_i2send,
159: base_i3recv, base_i3send, nostate1, nostate1, nostate1, nostate1, },
160: { nostate1, base_r1recv, base_r1send, base_r2recv, base_r2send,
161: nostate1, nostate1, nostate1, nostate1, nostate1, nostate1, },
162: },
163: };
164:
165: static int (*ph2exchange[][2][PHASE2ST_MAX])
166: __P((struct ph2handle *, vchar_t *)) = {
167: /* error */
168: { { 0 }, { 0 }, },
169: /* Quick mode for IKE */
170: {
171: { nostate2, nostate2, quick_i1prep, nostate2, quick_i1send,
172: quick_i2recv, quick_i2send, quick_i3recv, nostate2, nostate2, },
173: { nostate2, quick_r1recv, quick_r1prep, nostate2, quick_r2send,
174: quick_r3recv, quick_r3prep, quick_r3send, nostate2, nostate2, }
175: },
176: };
177:
178: static u_char r_ck0[] = { 0,0,0,0,0,0,0,0 }; /* used to verify the r_ck. */
179:
180: static int isakmp_main __P((vchar_t *, struct sockaddr *, struct sockaddr *));
181: static int ph1_main __P((struct ph1handle *, vchar_t *));
182: static int quick_main __P((struct ph2handle *, vchar_t *));
183: static int isakmp_ph1begin_r __P((vchar_t *,
184: struct sockaddr *, struct sockaddr *, u_int8_t));
185: static int isakmp_ph2begin_i __P((struct ph1handle *, struct ph2handle *));
186: static int isakmp_ph2begin_r __P((struct ph1handle *, vchar_t *));
187: static int etypesw1 __P((int));
188: static int etypesw2 __P((int));
189: static int isakmp_ph1resend __P((struct ph1handle *));
190: static int isakmp_ph2resend __P((struct ph2handle *));
191:
192: #ifdef ENABLE_FRAG
193: static int frag_handler(struct ph1handle *,
194: vchar_t *, struct sockaddr *, struct sockaddr *);
195: #endif
196:
197: /*
198: * isakmp packet handler
199: */
200: static int
201: isakmp_handler(ctx, so_isakmp)
202: void *ctx;
203: int so_isakmp;
204: {
205: struct isakmp isakmp;
206: union {
207: char buf[sizeof (isakmp) + 4];
208: u_int32_t non_esp[2];
209: struct {
210: struct udphdr udp;
211: #ifdef __linux
212: struct iphdr ip;
213: #else
214: struct ip ip;
215: #endif
216: char buf[sizeof(isakmp) + 4];
217: } lbuf;
218: } x;
219: struct sockaddr_storage remote;
220: struct sockaddr_storage local;
221: unsigned int remote_len = sizeof(remote);
222: unsigned int local_len = sizeof(local);
223: int len = 0, extralen = 0;
224: vchar_t *buf = NULL, *tmpbuf = NULL;
225: int error = -1, res;
226:
227: /* read message by MSG_PEEK */
228: while ((len = recvfromto(so_isakmp, x.buf, sizeof(x),
229: MSG_PEEK, (struct sockaddr *)&remote, &remote_len,
230: (struct sockaddr *)&local, &local_len)) < 0) {
231: if (errno == EINTR)
232: continue;
233: plog(LLV_ERROR, LOCATION, NULL,
234: "failed to receive isakmp packet: %s\n",
235: strerror (errno));
236: goto end;
237: }
238:
239: /* keep-alive packet - ignore */
240: if (len == 1 && (x.buf[0]&0xff) == 0xff) {
241: /* Pull the keep-alive packet */
242: if ((len = recvfrom(so_isakmp, (char *)x.buf, 1,
243: 0, (struct sockaddr *)&remote, &remote_len)) != 1) {
244: plog(LLV_ERROR, LOCATION, NULL,
245: "failed to receive keep alive packet: %s\n",
246: strerror (errno));
247: }
248: goto end;
249: }
250:
251: /* Lucent IKE in UDP encapsulation */
252: {
253: #ifdef __linux__
254: if (ntohs(x.lbuf.udp.dest) == 501) {
255: extralen += sizeof(x.lbuf.udp) + x.lbuf.ip.ihl;
256: }
257: #else
258: if (ntohs(x.lbuf.udp.uh_dport) == 501) {
259: extralen += sizeof(x.lbuf.udp) + x.lbuf.ip.ip_hl;
260: }
261: #endif
262: }
263:
264: #ifdef ENABLE_NATT
265: /* we don't know about portchange yet,
266: look for non-esp marker instead */
267: if (x.non_esp[0] == 0 && x.non_esp[1] != 0)
268: extralen = NON_ESP_MARKER_LEN;
269: #endif
270:
271: /* now we know if there is an extra non-esp
272: marker at the beginning or not */
273: memcpy ((char *)&isakmp, x.buf + extralen, sizeof (isakmp));
274:
275: /* check isakmp header length, as well as sanity of header length */
276: if (len < sizeof(isakmp) || ntohl(isakmp.len) < sizeof(isakmp)) {
277: plog(LLV_ERROR, LOCATION, (struct sockaddr *)&remote,
278: "packet shorter than isakmp header size (%u, %u, %zu)\n",
279: len, ntohl(isakmp.len), sizeof(isakmp));
280: /* dummy receive */
281: if ((len = recvfrom(so_isakmp, (char *)&isakmp, sizeof(isakmp),
282: 0, (struct sockaddr *)&remote, &remote_len)) < 0) {
283: plog(LLV_ERROR, LOCATION, NULL,
284: "failed to receive isakmp packet: %s\n",
285: strerror (errno));
286: }
287: goto end;
288: }
289:
290: /* reject it if the size is tooooo big. */
291: if (ntohl(isakmp.len) > 0xffff) {
292: plog(LLV_ERROR, LOCATION, NULL,
293: "the length in the isakmp header is too big.\n");
294: if ((len = recvfrom(so_isakmp, (char *)&isakmp, sizeof(isakmp),
295: 0, (struct sockaddr *)&remote, &remote_len)) < 0) {
296: plog(LLV_ERROR, LOCATION, NULL,
297: "failed to receive isakmp packet: %s\n",
298: strerror (errno));
299: }
300: goto end;
301: }
302:
303: /* read real message */
304: if ((tmpbuf = vmalloc(ntohl(isakmp.len) + extralen)) == NULL) {
305: plog(LLV_ERROR, LOCATION, NULL,
306: "failed to allocate reading buffer (%u Bytes)\n",
307: ntohl(isakmp.len) + extralen);
308: /* dummy receive */
309: if ((len = recvfrom(so_isakmp, (char *)&isakmp, sizeof(isakmp),
310: 0, (struct sockaddr *)&remote, &remote_len)) < 0) {
311: plog(LLV_ERROR, LOCATION, NULL,
312: "failed to receive isakmp packet: %s\n",
313: strerror (errno));
314: }
315: goto end;
316: }
317:
318: while ((len = recvfromto(so_isakmp, (char *)tmpbuf->v, tmpbuf->l,
319: 0, (struct sockaddr *)&remote, &remote_len,
320: (struct sockaddr *)&local, &local_len)) < 0) {
321: if (errno == EINTR)
322: continue;
323: plog(LLV_ERROR, LOCATION, NULL,
324: "failed to receive isakmp packet: %s\n",
325: strerror (errno));
326: goto end;
327: }
328:
329: if ((buf = vmalloc(len - extralen)) == NULL) {
330: plog(LLV_ERROR, LOCATION, NULL,
331: "failed to allocate reading buffer (%u Bytes)\n",
332: (len - extralen));
333: goto end;
334: }
335:
336: memcpy (buf->v, tmpbuf->v + extralen, buf->l);
337:
338: len -= extralen;
339:
340: if (len != buf->l) {
341: plog(LLV_ERROR, LOCATION, (struct sockaddr *)&remote,
342: "received invalid length (%d != %zu), why ?\n",
343: len, buf->l);
344: goto end;
345: }
346:
347: plog(LLV_DEBUG, LOCATION, NULL, "===\n");
348: plog(LLV_DEBUG, LOCATION, NULL,
349: "%d bytes message received %s\n",
350: len, saddr2str_fromto("from %s to %s",
351: (struct sockaddr *)&remote,
352: (struct sockaddr *)&local));
353: plogdump(LLV_DEBUG, buf->v, buf->l);
354:
355: /* avoid packets with malicious port/address */
356: if (extract_port((struct sockaddr *)&remote) == 0) {
357: plog(LLV_ERROR, LOCATION, (struct sockaddr *)&remote,
358: "src port == 0 (valid as UDP but not with IKE)\n");
359: goto end;
360: }
361:
362: /* XXX: check sender whether to be allowed or not to accept */
363:
364: /* XXX: I don't know how to check isakmp half connection attack. */
365:
366: /* simply reply if the packet was processed. */
367: res=check_recvdpkt((struct sockaddr *)&remote,(struct sockaddr *)&local, buf);
368: if (res) {
369: plog(LLV_NOTIFY, LOCATION, NULL,
370: "the packet is retransmitted by %s (%d).\n",
371: saddr2str((struct sockaddr *)&remote), res);
372: error = 0;
373: goto end;
374: }
375:
376: /* isakmp main routine */
377: if (isakmp_main(buf, (struct sockaddr *)&remote,
378: (struct sockaddr *)&local) != 0) goto end;
379:
380: error = 0;
381:
382: end:
383: if (tmpbuf != NULL)
384: vfree(tmpbuf);
385: if (buf != NULL)
386: vfree(buf);
387: return error;
388: }
389:
390: /*
391: * main processing to handle isakmp payload
392: */
393: static int
394: isakmp_main(msg, remote, local)
395: vchar_t *msg;
396: struct sockaddr *remote, *local;
397: {
398: struct isakmp *isakmp = (struct isakmp *)msg->v;
399: isakmp_index *index = (isakmp_index *)isakmp;
400: u_int32_t msgid = isakmp->msgid;
401: struct ph1handle *iph1;
402:
403: #ifdef HAVE_PRINT_ISAKMP_C
404: isakmp_printpacket(msg, remote, local, 0);
405: #endif
406:
407: /* the initiator's cookie must not be zero */
408: if (memcmp(&isakmp->i_ck, r_ck0, sizeof(cookie_t)) == 0) {
409: plog(LLV_ERROR, LOCATION, remote,
410: "malformed cookie received.\n");
411: return -1;
412: }
413:
414: /* Check the Major and Minor Version fields. */
415: /*
416: * XXX Is is right to check version here ?
417: * I think it may no be here because the version depends
418: * on exchange status.
419: */
420: if (isakmp->v < ISAKMP_VERSION_NUMBER) {
421: if (ISAKMP_GETMAJORV(isakmp->v) < ISAKMP_MAJOR_VERSION) {
422: plog(LLV_ERROR, LOCATION, remote,
423: "invalid major version %d.\n",
424: ISAKMP_GETMAJORV(isakmp->v));
425: return -1;
426: }
427: #if ISAKMP_MINOR_VERSION > 0
428: if (ISAKMP_GETMINORV(isakmp->v) < ISAKMP_MINOR_VERSION) {
429: plog(LLV_ERROR, LOCATION, remote,
430: "invalid minor version %d.\n",
431: ISAKMP_GETMINORV(isakmp->v));
432: return -1;
433: }
434: #endif
435: }
436:
437: /* check the Flags field. */
438: /* XXX How is the exclusive check, E and A ? */
439: if (isakmp->flags & ~(ISAKMP_FLAG_E | ISAKMP_FLAG_C | ISAKMP_FLAG_A)) {
440: plog(LLV_ERROR, LOCATION, remote,
441: "invalid flag 0x%02x.\n", isakmp->flags);
442: return -1;
443: }
444:
445: /* ignore commit bit. */
446: if (ISSET(isakmp->flags, ISAKMP_FLAG_C)) {
447: if (isakmp->msgid == 0) {
448: isakmp_info_send_nx(isakmp, remote, local,
449: ISAKMP_NTYPE_INVALID_FLAGS, NULL);
450: plog(LLV_ERROR, LOCATION, remote,
451: "Commit bit on phase1 forbidden.\n");
452: return -1;
453: }
454: }
455:
456: iph1 = getph1byindex(index);
457: if (iph1 != NULL) {
458: /* validity check */
459: if (memcmp(&isakmp->r_ck, r_ck0, sizeof(cookie_t)) == 0 &&
460: iph1->side == INITIATOR) {
461: plog(LLV_DEBUG, LOCATION, remote,
462: "malformed cookie received or "
463: "the initiator's cookies collide.\n");
464: return -1;
465: }
466:
467: #ifdef ENABLE_NATT
468: /* Floating ports for NAT-T */
469: if (NATT_AVAILABLE(iph1) &&
470: ! (iph1->natt_flags & NAT_PORTS_CHANGED) &&
471: ((cmpsaddr(iph1->remote, remote) != CMPSADDR_MATCH) ||
472: (cmpsaddr(iph1->local, local) != CMPSADDR_MATCH)))
473: {
474: /* prevent memory leak */
475: racoon_free(iph1->remote);
476: racoon_free(iph1->local);
477: iph1->remote = NULL;
478: iph1->local = NULL;
479:
480: /* copy-in new addresses */
481: iph1->remote = dupsaddr(remote);
482: if (iph1->remote == NULL) {
483: plog(LLV_ERROR, LOCATION, iph1->remote,
484: "phase1 failed: dupsaddr failed.\n");
485: remph1(iph1);
486: delph1(iph1);
487: return -1;
488: }
489: iph1->local = dupsaddr(local);
490: if (iph1->local == NULL) {
491: plog(LLV_ERROR, LOCATION, iph1->remote,
492: "phase1 failed: dupsaddr failed.\n");
493: remph1(iph1);
494: delph1(iph1);
495: return -1;
496: }
497:
498: /* set the flag to prevent further port floating
499: (FIXME: should we allow it? E.g. when the NAT gw
500: is rebooted?) */
501: iph1->natt_flags |= NAT_PORTS_CHANGED | NAT_ADD_NON_ESP_MARKER;
502:
503: /* print some neat info */
504: plog (LLV_INFO, LOCATION, NULL,
505: "NAT-T: ports changed to: %s\n",
506: saddr2str_fromto ("%s<->%s", iph1->remote, iph1->local));
507:
508: natt_keepalive_add_ph1 (iph1);
509: }
510: #endif
511:
512: /* must be same addresses in one stream of a phase at least. */
513: if (cmpsaddr(iph1->remote, remote) != CMPSADDR_MATCH) {
514: char *saddr_db, *saddr_act;
515:
516: saddr_db = racoon_strdup(saddr2str(iph1->remote));
517: saddr_act = racoon_strdup(saddr2str(remote));
518: STRDUP_FATAL(saddr_db);
519: STRDUP_FATAL(saddr_act);
520:
521: plog(LLV_WARNING, LOCATION, remote,
522: "remote address mismatched. db=%s, act=%s\n",
523: saddr_db, saddr_act);
524:
525: racoon_free(saddr_db);
526: racoon_free(saddr_act);
527: }
528:
529: /*
530: * don't check of exchange type here because other type will be
531: * with same index, for example, informational exchange.
532: */
533:
534: /* XXX more acceptable check */
535: }
536:
537: switch (isakmp->etype) {
538: case ISAKMP_ETYPE_IDENT:
539: case ISAKMP_ETYPE_AGG:
540: case ISAKMP_ETYPE_BASE:
541: /* phase 1 validity check */
542: if (isakmp->msgid != 0) {
543: plog(LLV_ERROR, LOCATION, remote,
544: "message id should be zero in phase1.\n");
545: return -1;
546: }
547:
548: /* search for isakmp status record of phase 1 */
549: if (iph1 == NULL) {
550: /*
551: * the packet must be the 1st message from a initiator
552: * or the 2nd message from the responder.
553: */
554:
555: /* search for phase1 handle by index without r_ck */
556: iph1 = getph1byindex0(index);
557: if (iph1 == NULL) {
558: /*it must be the 1st message from a initiator.*/
559: if (memcmp(&isakmp->r_ck, r_ck0,
560: sizeof(cookie_t)) != 0) {
561:
562: plog(LLV_DEBUG, LOCATION, remote,
563: "malformed cookie received "
564: "or the spi expired.\n");
565: return -1;
566: }
567:
568: /* it must be responder's 1st exchange. */
569: if (isakmp_ph1begin_r(msg, remote, local,
570: isakmp->etype) < 0)
571: return -1;
572: break;
573:
574: /*NOTREACHED*/
575: }
576:
577: /* it must be the 2nd message from the responder. */
578: if (iph1->side != INITIATOR) {
579: plog(LLV_DEBUG, LOCATION, remote,
580: "malformed cookie received. "
581: "it has to be as the initiator. %s\n",
582: isakmp_pindex(&iph1->index, 0));
583: return -1;
584: }
585: }
586:
587: /*
588: * Don't delete phase 1 handler when the exchange type
589: * in handler is not equal to packet's one because of no
590: * authencication completed.
591: */
592: if (iph1->etype != isakmp->etype) {
593: plog(LLV_ERROR, LOCATION, iph1->remote,
594: "exchange type is mismatched: "
595: "db=%s packet=%s, ignore it.\n",
596: s_isakmp_etype(iph1->etype),
597: s_isakmp_etype(isakmp->etype));
598: return -1;
599: }
600:
601: #ifdef ENABLE_FRAG
602: if (isakmp->np == ISAKMP_NPTYPE_FRAG)
603: return frag_handler(iph1, msg, remote, local);
604: #endif
605:
606: /* call main process of phase 1 */
607: if (ph1_main(iph1, msg) < 0) {
608: plog(LLV_ERROR, LOCATION, iph1->remote,
609: "phase1 negotiation failed.\n");
610: remph1(iph1);
611: delph1(iph1);
612: return -1;
613: }
614: break;
615:
616: case ISAKMP_ETYPE_AUTH:
617: plog(LLV_INFO, LOCATION, remote,
618: "unsupported exchange %d received.\n",
619: isakmp->etype);
620: break;
621:
622: case ISAKMP_ETYPE_INFO:
623: case ISAKMP_ETYPE_ACKINFO:
624: /*
625: * iph1 must be present for Information message.
626: * if iph1 is null then trying to get the phase1 status
627: * as the packet from responder againt initiator's 1st
628: * exchange in phase 1.
629: * NOTE: We think such informational exchange should be ignored.
630: */
631: if (iph1 == NULL) {
632: iph1 = getph1byindex0(index);
633: if (iph1 == NULL) {
634: plog(LLV_ERROR, LOCATION, remote,
635: "unknown Informational "
636: "exchange received.\n");
637: return -1;
638: }
639: if (cmpsaddr(iph1->remote, remote) != CMPSADDR_MATCH) {
640: plog(LLV_WARNING, LOCATION, remote,
641: "remote address mismatched. "
642: "db=%s\n",
643: saddr2str(iph1->remote));
644: }
645: }
646:
647: #ifdef ENABLE_FRAG
648: if (isakmp->np == ISAKMP_NPTYPE_FRAG)
649: return frag_handler(iph1, msg, remote, local);
650: #endif
651:
652: if (isakmp_info_recv(iph1, msg) < 0)
653: return -1;
654: break;
655:
656: case ISAKMP_ETYPE_QUICK:
657: {
658: struct ph2handle *iph2;
659:
660: if (iph1 == NULL) {
661: isakmp_info_send_nx(isakmp, remote, local,
662: ISAKMP_NTYPE_INVALID_COOKIE, NULL);
663: plog(LLV_ERROR, LOCATION, remote,
664: "can't start the quick mode, "
665: "there is no ISAKMP-SA, %s\n",
666: isakmp_pindex((isakmp_index *)&isakmp->i_ck,
667: isakmp->msgid));
668: return -1;
669: }
670: #ifdef ENABLE_HYBRID
671: /* Reinit the IVM if it's still there */
672: if (iph1->mode_cfg && iph1->mode_cfg->ivm) {
673: oakley_delivm(iph1->mode_cfg->ivm);
674: iph1->mode_cfg->ivm = NULL;
675: }
676: #endif
677: #ifdef ENABLE_FRAG
678: if (isakmp->np == ISAKMP_NPTYPE_FRAG)
679: return frag_handler(iph1, msg, remote, local);
680: #endif
681:
682: /* check status of phase 1 whether negotiated or not. */
683: if (iph1->status != PHASE1ST_ESTABLISHED &&
684: iph1->status != PHASE1ST_DYING) {
685: plog(LLV_ERROR, LOCATION, remote,
686: "can't start the quick mode, "
687: "there is no valid ISAKMP-SA, %s\n",
688: isakmp_pindex(&iph1->index, iph1->msgid));
689: return -1;
690: }
691:
692: /* search isakmp phase 2 stauts record. */
693: iph2 = getph2bymsgid(iph1, msgid);
694: if (iph2 == NULL) {
695: /* it must be new negotiation as responder */
696: if (isakmp_ph2begin_r(iph1, msg) < 0)
697: return -1;
698: return 0;
699: /*NOTREACHED*/
700: }
701:
702: /* commit bit. */
703: /* XXX
704: * we keep to set commit bit during negotiation.
705: * When SA is configured, bit will be reset.
706: * XXX
707: * don't initiate commit bit. should be fixed in the future.
708: */
709: if (ISSET(isakmp->flags, ISAKMP_FLAG_C))
710: iph2->flags |= ISAKMP_FLAG_C;
711:
712: /* call main process of quick mode */
713: if (quick_main(iph2, msg) < 0) {
714: plog(LLV_ERROR, LOCATION, iph1->remote,
715: "phase2 negotiation failed.\n");
716: remph2(iph2);
717: delph2(iph2);
718: return -1;
719: }
720: }
721: break;
722:
723: case ISAKMP_ETYPE_NEWGRP:
724: if (iph1 == NULL) {
725: plog(LLV_ERROR, LOCATION, remote,
726: "Unknown new group mode exchange, "
727: "there is no ISAKMP-SA.\n");
728: return -1;
729: }
730:
731: #ifdef ENABLE_FRAG
732: if (isakmp->np == ISAKMP_NPTYPE_FRAG)
733: return frag_handler(iph1, msg, remote, local);
734: #endif
735:
736: isakmp_newgroup_r(iph1, msg);
737: break;
738:
739: #ifdef ENABLE_HYBRID
740: case ISAKMP_ETYPE_CFG:
741: if (iph1 == NULL) {
742: plog(LLV_ERROR, LOCATION, NULL,
743: "mode config %d from %s, "
744: "but we have no ISAKMP-SA.\n",
745: isakmp->etype, saddr2str(remote));
746: return -1;
747: }
748:
749: #ifdef ENABLE_FRAG
750: if (isakmp->np == ISAKMP_NPTYPE_FRAG)
751: return frag_handler(iph1, msg, remote, local);
752: #endif
753:
754: isakmp_cfg_r(iph1, msg);
755: break;
756: #endif
757:
758: case ISAKMP_ETYPE_NONE:
759: default:
760: plog(LLV_ERROR, LOCATION, NULL,
761: "Invalid exchange type %d from %s.\n",
762: isakmp->etype, saddr2str(remote));
763: return -1;
764: }
765:
766: return 0;
767: }
768:
769: /*
770: * main function of phase 1.
771: */
772: static int
773: ph1_main(iph1, msg)
774: struct ph1handle *iph1;
775: vchar_t *msg;
776: {
777: int error;
778: #ifdef ENABLE_STATS
779: struct timeval start, end;
780: #endif
781:
782: /* ignore a packet */
783: if (iph1->status >= PHASE1ST_ESTABLISHED)
784: return 0;
785:
786: #ifdef ENABLE_STATS
787: gettimeofday(&start, NULL);
788: #endif
789: /* receive */
790: if (ph1exchange[etypesw1(iph1->etype)]
791: [iph1->side]
792: [iph1->status] == NULL) {
793: plog(LLV_ERROR, LOCATION, iph1->remote,
794: "why isn't the function defined.\n");
795: return -1;
796: }
797: error = (ph1exchange[etypesw1(iph1->etype)]
798: [iph1->side]
799: [iph1->status])(iph1, msg);
800: if (error != 0) {
801:
802: /* XXX
803: * When an invalid packet is received on phase1, it should
804: * be selected to process this packet. That is to respond
805: * with a notify and delete phase 1 handler, OR not to respond
806: * and keep phase 1 handler. However, in PHASE1ST_START when
807: * acting as RESPONDER we must not keep phase 1 handler or else
808: * it will stay forever.
809: */
810:
811: if (iph1->side == RESPONDER && iph1->status == PHASE1ST_START) {
812: plog(LLV_ERROR, LOCATION, iph1->remote,
813: "failed to pre-process ph1 packet (side: %d, status %d).\n",
814: iph1->side, iph1->status);
815: return -1;
816: } else {
817: /* ignore the error and keep phase 1 handler */
818: return 0;
819: }
820: }
821:
822: #ifndef ENABLE_FRAG
823: /* free resend buffer */
824: if (iph1->sendbuf == NULL) {
825: plog(LLV_ERROR, LOCATION, NULL,
826: "no buffer found as sendbuf\n");
827: return -1;
828: }
829: #endif
830:
831: VPTRINIT(iph1->sendbuf);
832:
833: /* turn off schedule */
834: sched_cancel(&iph1->scr);
835:
836: /* send */
837: plog(LLV_DEBUG, LOCATION, NULL, "===\n");
838: if ((ph1exchange[etypesw1(iph1->etype)]
839: [iph1->side]
840: [iph1->status])(iph1, msg) != 0) {
841: plog(LLV_ERROR, LOCATION, iph1->remote,
842: "failed to process ph1 packet (side: %d, status: %d).\n",
843: iph1->side, iph1->status);
844: return -1;
845: }
846:
847: #ifdef ENABLE_STATS
848: gettimeofday(&end, NULL);
849: syslog(LOG_NOTICE, "%s(%s): %8.6f",
850: "phase1", s_isakmp_state(iph1->etype, iph1->side, iph1->status),
851: timedelta(&start, &end));
852: #endif
853: if (iph1->status == PHASE1ST_ESTABLISHED) {
854:
855: #ifdef ENABLE_STATS
856: gettimeofday(&iph1->end, NULL);
857: syslog(LOG_NOTICE, "%s(%s): %8.6f",
858: "phase1", s_isakmp_etype(iph1->etype),
859: timedelta(&iph1->start, &iph1->end));
860: #endif
861:
862: /* save created date. */
863: (void)time(&iph1->created);
864:
865: /* migrate ph2s from dying ph1s */
866: migrate_dying_ph12(iph1);
867:
868: /* add to the schedule to expire, and seve back pointer. */
869: if (ph1_rekey_enabled(iph1)) {
870: sched_schedule(&iph1->sce,
871: iph1->approval->lifetime *
872: PFKEY_SOFT_LIFETIME_RATE / 100,
873: isakmp_ph1dying_stub);
874: } else {
875: sched_schedule(&iph1->sce, iph1->approval->lifetime,
876: isakmp_ph1expire_stub);
877: }
878:
879: #ifdef ENABLE_HYBRID
880: if (iph1->mode_cfg->flags & ISAKMP_CFG_VENDORID_XAUTH) {
881: switch (iph1->approval->authmethod) {
882: case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
883: case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
884: case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
885: case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
886: case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:
887: case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R:
888: case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R:
889: xauth_sendreq(iph1);
890: /* XXX Don't process INITIAL_CONTACT */
891: iph1->rmconf->ini_contact = 0;
892: break;
893: default:
894: break;
895: }
896: }
897: #endif
898: #ifdef ENABLE_DPD
899: /* Schedule the r_u_there.... */
900: if(iph1->dpd_support && iph1->rmconf->dpd_interval)
901: isakmp_sched_r_u(iph1, 0);
902: #endif
903:
904: /* INITIAL-CONTACT processing */
905: /* don't anything if local test mode. */
906: if (!f_local
907: && iph1->rmconf->ini_contact && !getcontacted(iph1->remote)) {
908: /* send INITIAL-CONTACT */
909: isakmp_info_send_n1(iph1,
910: ISAKMP_NTYPE_INITIAL_CONTACT, NULL);
911: /* insert a node into contacted list. */
912: if (inscontacted(iph1->remote) == -1) {
913: plog(LLV_ERROR, LOCATION, iph1->remote,
914: "failed to add contacted list.\n");
915: /* ignore */
916: }
917: }
918: if (iph1->initial_contact_received)
919: isakmp_info_recv_initialcontact(iph1, NULL);
920:
921: log_ph1established(iph1);
922: plog(LLV_DEBUG, LOCATION, NULL, "===\n");
923:
924: /*
925: * SA up shell script hook: do it now,except if
926: * ISAKMP mode config was requested. In the later
927: * case it is done when we receive the configuration.
928: */
929: if ((iph1->status == PHASE1ST_ESTABLISHED) &&
930: !iph1->rmconf->mode_cfg) {
931: switch (iph1->approval->authmethod) {
932: #ifdef ENABLE_HYBRID
933: case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
934: case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
935: case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
936: /* Unimplemeted... */
937: case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
938: case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:
939: case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R:
940: case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R:
941: break;
942: #endif
943: default:
944: script_hook(iph1, SCRIPT_PHASE1_UP);
945: break;
946: }
947: }
948: }
949:
950: return 0;
951: }
952:
953: /*
954: * main function of quick mode.
955: */
956: static int
957: quick_main(iph2, msg)
958: struct ph2handle *iph2;
959: vchar_t *msg;
960: {
961: struct isakmp *isakmp = (struct isakmp *)msg->v;
962: int error;
963: #ifdef ENABLE_STATS
964: struct timeval start, end;
965: #endif
966:
967: /* ignore a packet */
968: if (iph2->status == PHASE2ST_ESTABLISHED
969: || iph2->status == PHASE2ST_GETSPISENT)
970: return 0;
971:
972: #ifdef ENABLE_STATS
973: gettimeofday(&start, NULL);
974: #endif
975:
976: /* receive */
977: if (ph2exchange[etypesw2(isakmp->etype)]
978: [iph2->side]
979: [iph2->status] == NULL) {
980: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
981: "why isn't the function defined.\n");
982: return -1;
983: }
984: error = (ph2exchange[etypesw2(isakmp->etype)]
985: [iph2->side]
986: [iph2->status])(iph2, msg);
987: if (error != 0) {
988: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
989: "failed to pre-process ph2 packet (side: %d, status %d).\n",
990: iph2->side, iph2->status);
991: if (error == ISAKMP_INTERNAL_ERROR)
992: return 0;
993: isakmp_info_send_n1(iph2->ph1, error, NULL);
994: return -1;
995: }
996:
997: /* when using commit bit, status will be reached here. */
998: if (iph2->status == PHASE2ST_ADDSA)
999: return 0;
1000:
1001: /* free resend buffer */
1002: if (iph2->sendbuf == NULL) {
1003: plog(LLV_ERROR, LOCATION, NULL,
1004: "no buffer found as sendbuf\n");
1005: return -1;
1006: }
1007: VPTRINIT(iph2->sendbuf);
1008:
1009: /* turn off schedule */
1010: sched_cancel(&iph2->scr);
1011:
1012: /* send */
1013: plog(LLV_DEBUG, LOCATION, NULL, "===\n");
1014: if ((ph2exchange[etypesw2(isakmp->etype)]
1015: [iph2->side]
1016: [iph2->status])(iph2, msg) != 0) {
1017: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1018: "failed to process ph2 packet (side: %d, status: %d).\n",
1019: iph2->side, iph2->status);
1020: return -1;
1021: }
1022:
1023: #ifdef ENABLE_STATS
1024: gettimeofday(&end, NULL);
1025: syslog(LOG_NOTICE, "%s(%s): %8.6f",
1026: "phase2",
1027: s_isakmp_state(ISAKMP_ETYPE_QUICK, iph2->side, iph2->status),
1028: timedelta(&start, &end));
1029: #endif
1030:
1031: return 0;
1032: }
1033:
1034: /* new negotiation of phase 1 for initiator */
1035: struct ph1handle *
1036: isakmp_ph1begin_i(rmconf, remote, local)
1037: struct remoteconf *rmconf;
1038: struct sockaddr *remote, *local;
1039: {
1040: struct ph1handle *iph1;
1041: #ifdef ENABLE_STATS
1042: struct timeval start, end;
1043: #endif
1044:
1045: /* get new entry to isakmp status table. */
1046: iph1 = newph1();
1047: if (iph1 == NULL)
1048: return NULL;
1049:
1050: iph1->status = PHASE1ST_START;
1051: iph1->rmconf = rmconf;
1052: iph1->side = INITIATOR;
1053: iph1->version = ISAKMP_VERSION_NUMBER;
1054: iph1->msgid = 0;
1055: iph1->flags = 0;
1056: iph1->ph2cnt = 0;
1057: #ifdef HAVE_GSSAPI
1058: iph1->gssapi_state = NULL;
1059: #endif
1060: #ifdef ENABLE_HYBRID
1061: if ((iph1->mode_cfg = isakmp_cfg_mkstate()) == NULL) {
1062: delph1(iph1);
1063: return NULL;
1064: }
1065: #endif
1066: #ifdef ENABLE_FRAG
1067:
1068: if(rmconf->ike_frag == ISAKMP_FRAG_FORCE)
1069: iph1->frag = 1;
1070: else
1071: iph1->frag = 0;
1072: iph1->frag_chain = NULL;
1073: #endif
1074: iph1->approval = NULL;
1075:
1076: /* XXX copy remote address */
1077: if (copy_ph1addresses(iph1, rmconf, remote, local) < 0) {
1078: delph1(iph1);
1079: return NULL;
1080: }
1081:
1082: (void)insph1(iph1);
1083:
1084: /* start phase 1 exchange */
1085: iph1->etype = rmconf->etypes->type;
1086:
1087: plog(LLV_DEBUG, LOCATION, NULL, "===\n");
1088: {
1089: char *a;
1090:
1091: a = racoon_strdup(saddr2str(iph1->local));
1092: STRDUP_FATAL(a);
1093:
1094: plog(LLV_INFO, LOCATION, NULL,
1095: "initiate new phase 1 negotiation: %s<=>%s\n",
1096: a, saddr2str(iph1->remote));
1097: racoon_free(a);
1098: }
1099: plog(LLV_INFO, LOCATION, NULL,
1100: "begin %s mode.\n",
1101: s_isakmp_etype(iph1->etype));
1102:
1103: #ifdef ENABLE_STATS
1104: gettimeofday(&iph1->start, NULL);
1105: gettimeofday(&start, NULL);
1106: #endif
1107: /* start exchange */
1108: if ((ph1exchange[etypesw1(iph1->etype)]
1109: [iph1->side]
1110: [iph1->status])(iph1, NULL) != 0) {
1111: /* failed to start phase 1 negotiation */
1112: remph1(iph1);
1113: delph1(iph1);
1114:
1115: return NULL;
1116: }
1117:
1118: #ifdef ENABLE_STATS
1119: gettimeofday(&end, NULL);
1120: syslog(LOG_NOTICE, "%s(%s): %8.6f",
1121: "phase1",
1122: s_isakmp_state(iph1->etype, iph1->side, iph1->status),
1123: timedelta(&start, &end));
1124: #endif
1125:
1126: return iph1;
1127: }
1128:
1129: /* new negotiation of phase 1 for responder */
1130: static int
1131: isakmp_ph1begin_r(msg, remote, local, etype)
1132: vchar_t *msg;
1133: struct sockaddr *remote, *local;
1134: u_int8_t etype;
1135: {
1136: struct isakmp *isakmp = (struct isakmp *)msg->v;
1137: struct ph1handle *iph1;
1138: struct rmconfselector rmsel;
1139: #ifdef ENABLE_STATS
1140: struct timeval start, end;
1141: #endif
1142:
1143: /* check if this etype is allowed */
1144: memset(&rmsel, 0, sizeof(rmsel));
1145: rmsel.remote = remote;
1146: if (enumrmconf(&rmsel, check_etypeok, (void *) (intptr_t) etype) == 0) {
1147: plog(LLV_ERROR, LOCATION, remote,
1148: "exchange %s not allowed in any applicable rmconf.\n",
1149: s_isakmp_etype(etype));
1150: return -1;
1151: }
1152:
1153: /* get new entry to isakmp status table. */
1154: iph1 = newph1();
1155: if (iph1 == NULL)
1156: return -1;
1157:
1158: memcpy(&iph1->index.i_ck, &isakmp->i_ck, sizeof(iph1->index.i_ck));
1159: iph1->status = PHASE1ST_START;
1160: iph1->flags = 0;
1161: iph1->side = RESPONDER;
1162: iph1->etype = etype;
1163: iph1->version = isakmp->v;
1164: iph1->msgid = 0;
1165: #ifdef HAVE_GSSAPI
1166: iph1->gssapi_state = NULL;
1167: #endif
1168: #ifdef ENABLE_HYBRID
1169: if ((iph1->mode_cfg = isakmp_cfg_mkstate()) == NULL) {
1170: delph1(iph1);
1171: return -1;
1172: }
1173: #endif
1174: #ifdef ENABLE_FRAG
1175: iph1->frag = 0;
1176: iph1->frag_chain = NULL;
1177: #endif
1178: iph1->approval = NULL;
1179:
1180: #ifdef ENABLE_NATT
1181: /* RFC3947 says that we MUST accept new phases1 on NAT-T floated port.
1182: * We have to setup this flag now to correctly generate the first reply.
1183: * Don't know if a better check could be done for that ?
1184: */
1185: if(extract_port(local) == lcconf->port_isakmp_natt)
1186: iph1->natt_flags |= (NAT_PORTS_CHANGED);
1187: #endif
1188:
1189: /* copy remote address; remote and local always contain
1190: * port numbers so rmconf is not needed */
1191: if (copy_ph1addresses(iph1, NULL, remote, local) < 0) {
1192: delph1(iph1);
1193: return -1;
1194: }
1195: (void)insph1(iph1);
1196:
1197: plog(LLV_DEBUG, LOCATION, NULL, "===\n");
1198: {
1199: char *a;
1200:
1201: a = racoon_strdup(saddr2str(iph1->local));
1202: STRDUP_FATAL(a);
1203:
1204: plog(LLV_INFO, LOCATION, NULL,
1205: "respond new phase 1 negotiation: %s<=>%s\n",
1206: a, saddr2str(iph1->remote));
1207: racoon_free(a);
1208: }
1209: plog(LLV_INFO, LOCATION, NULL,
1210: "begin %s mode.\n", s_isakmp_etype(etype));
1211:
1212: #ifdef ENABLE_STATS
1213: gettimeofday(&iph1->start, NULL);
1214: gettimeofday(&start, NULL);
1215: #endif
1216:
1217: #ifndef ENABLE_FRAG
1218:
1219: /* start exchange */
1220: if ((ph1exchange[etypesw1(iph1->etype)]
1221: [iph1->side]
1222: [iph1->status])(iph1, msg) < 0
1223: || (ph1exchange[etypesw1(iph1->etype)]
1224: [iph1->side]
1225: [iph1->status])(iph1, msg) < 0) {
1226: plog(LLV_ERROR, LOCATION, remote,
1227: "failed to process ph1 packet (side: %d, status: %d).\n",
1228: iph1->side, iph1->status);
1229: remph1(iph1);
1230: delph1(iph1);
1231: return -1;
1232: }
1233:
1234: #ifdef ENABLE_STATS
1235: gettimeofday(&end, NULL);
1236: syslog(LOG_NOTICE, "%s(%s): %8.6f",
1237: "phase1",
1238: s_isakmp_state(iph1->etype, iph1->side, iph1->status),
1239: timedelta(&start, &end));
1240: #endif
1241:
1242: return 0;
1243:
1244: #else /* ENABLE_FRAG */
1245:
1246: /* now that we have a phase1 handle, feed back into our
1247: * main receive function to catch fragmented packets
1248: */
1249:
1250: return isakmp_main(msg, remote, local);
1251:
1252: #endif /* ENABLE_FRAG */
1253:
1254: }
1255:
1256: /* new negotiation of phase 2 for initiator */
1257: static int
1258: isakmp_ph2begin_i(iph1, iph2)
1259: struct ph1handle *iph1;
1260: struct ph2handle *iph2;
1261: {
1262: #ifdef ENABLE_HYBRID
1263: if (xauth_check(iph1) != 0) {
1264: plog(LLV_ERROR, LOCATION, NULL,
1265: "Attempt to start phase 2 whereas Xauth failed\n");
1266: return -1;
1267: }
1268: #endif
1269:
1270: /* fixup ph2 ports for this ph1 */
1271: if (extract_port(iph2->src) == 0)
1272: set_port(iph2->src, extract_port(iph1->local));
1273: if (extract_port(iph2->dst) == 0)
1274: set_port(iph2->dst, extract_port(iph1->remote));
1275:
1276: /* found ISAKMP-SA. */
1277: plog(LLV_DEBUG, LOCATION, NULL, "===\n");
1278: plog(LLV_DEBUG, LOCATION, NULL, "begin QUICK mode.\n");
1279: {
1280: char *a;
1281: a = racoon_strdup(saddr2str(iph2->src));
1282: STRDUP_FATAL(a);
1283:
1284: plog(LLV_INFO, LOCATION, NULL,
1285: "initiate new phase 2 negotiation: %s<=>%s\n",
1286: a, saddr2str(iph2->dst));
1287: racoon_free(a);
1288: }
1289:
1290: #ifdef ENABLE_STATS
1291: gettimeofday(&iph2->start, NULL);
1292: #endif
1293: if (iph2->status != PHASE2ST_EXPIRED) /* Phase 1 is already bound (ongoing rekeying) */
1294: bindph12(iph1, iph2);
1295: iph2->status = PHASE2ST_STATUS2;
1296:
1297: if ((ph2exchange[etypesw2(ISAKMP_ETYPE_QUICK)]
1298: [iph2->side]
1299: [iph2->status])(iph2, NULL) < 0) {
1300: /* release ipsecsa handler due to internal error. */
1301: remph2(iph2);
1302: return -1;
1303: }
1304: return 0;
1305: }
1306:
1307: /* new negotiation of phase 2 for responder */
1308: static int
1309: isakmp_ph2begin_r(iph1, msg)
1310: struct ph1handle *iph1;
1311: vchar_t *msg;
1312: {
1313: struct isakmp *isakmp = (struct isakmp *)msg->v;
1314: struct ph2handle *iph2 = 0;
1315: int error;
1316: #ifdef ENABLE_STATS
1317: struct timeval start, end;
1318: #endif
1319: #ifdef ENABLE_HYBRID
1320: if (xauth_check(iph1) != 0) {
1321: plog(LLV_ERROR, LOCATION, NULL,
1322: "Attempt to start phase 2 whereas Xauth failed\n");
1323: return -1;
1324: }
1325: #endif
1326:
1327: iph2 = newph2();
1328: if (iph2 == NULL) {
1329: plog(LLV_ERROR, LOCATION, NULL,
1330: "failed to allocate phase2 entry.\n");
1331: return -1;
1332: }
1333:
1334: iph2->side = RESPONDER;
1335: iph2->status = PHASE2ST_START;
1336: iph2->flags = isakmp->flags;
1337: iph2->msgid = isakmp->msgid;
1338: iph2->seq = pk_getseq();
1339: iph2->ivm = oakley_newiv2(iph1, iph2->msgid);
1340: if (iph2->ivm == NULL) {
1341: delph2(iph2);
1342: return -1;
1343: }
1344: iph2->dst = dupsaddr(iph1->remote); /* XXX should be considered */
1345: if (iph2->dst == NULL) {
1346: delph2(iph2);
1347: return -1;
1348: }
1349: iph2->src = dupsaddr(iph1->local); /* XXX should be considered */
1350: if (iph2->src == NULL) {
1351: delph2(iph2);
1352: return -1;
1353: }
1354:
1355: /* add new entry to isakmp status table */
1356: insph2(iph2);
1357: bindph12(iph1, iph2);
1358:
1359: plog(LLV_DEBUG, LOCATION, NULL, "===\n");
1360: {
1361: char *a;
1362:
1363: a = racoon_strdup(saddr2str(iph2->src));
1364: STRDUP_FATAL(a);
1365:
1366: plog(LLV_INFO, LOCATION, NULL,
1367: "respond new phase 2 negotiation: %s<=>%s\n",
1368: a, saddr2str(iph2->dst));
1369: racoon_free(a);
1370: }
1371:
1372: #ifdef ENABLE_STATS
1373: gettimeofday(&start, NULL);
1374: #endif
1375:
1376: error = (ph2exchange[etypesw2(ISAKMP_ETYPE_QUICK)]
1377: [iph2->side]
1378: [iph2->status])(iph2, msg);
1379: if (error != 0) {
1380: plog(LLV_ERROR, LOCATION, iph1->remote,
1381: "failed to pre-process ph2 packet (side: %d, status: %d).\n",
1382: iph2->side, iph2->status);
1383: if (error != ISAKMP_INTERNAL_ERROR)
1384: isakmp_info_send_n1(iph2->ph1, error, NULL);
1385: /*
1386: * release handler because it's wrong that ph2handle is kept
1387: * after failed to check message for responder's.
1388: */
1389: remph2(iph2);
1390: delph2(iph2);
1391: return -1;
1392: }
1393:
1394: /* send */
1395: plog(LLV_DEBUG, LOCATION, NULL, "===\n");
1396: if ((ph2exchange[etypesw2(isakmp->etype)]
1397: [iph2->side]
1398: [iph2->status])(iph2, msg) < 0) {
1399: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1400: "failed to process ph2 packet (side: %d, status: %d).\n",
1401: iph2->side, iph2->status);
1402: /* don't release handler */
1403: return -1;
1404: }
1405: #ifdef ENABLE_STATS
1406: gettimeofday(&end, NULL);
1407: syslog(LOG_NOTICE, "%s(%s): %8.6f",
1408: "phase2",
1409: s_isakmp_state(ISAKMP_ETYPE_QUICK, iph2->side, iph2->status),
1410: timedelta(&start, &end));
1411: #endif
1412:
1413: return 0;
1414: }
1415:
1416: /*
1417: * parse ISAKMP payloads, without ISAKMP base header.
1418: */
1419: vchar_t *
1420: isakmp_parsewoh(np0, gen, len)
1421: int np0;
1422: struct isakmp_gen *gen;
1423: int len;
1424: {
1425: u_char np = np0 & 0xff;
1426: int tlen, plen;
1427: vchar_t *result;
1428: struct isakmp_parse_t *p, *ep;
1429:
1430: plog(LLV_DEBUG, LOCATION, NULL, "begin.\n");
1431:
1432: /*
1433: * 5 is a magic number, but any value larger than 2 should be fine
1434: * as we do vrealloc() in the following loop.
1435: */
1436: result = vmalloc(sizeof(struct isakmp_parse_t) * 5);
1437: if (result == NULL) {
1438: plog(LLV_ERROR, LOCATION, NULL,
1439: "failed to get buffer.\n");
1440: return NULL;
1441: }
1442: p = (struct isakmp_parse_t *)result->v;
1443: ep = (struct isakmp_parse_t *)(result->v + result->l - sizeof(*ep));
1444:
1445: tlen = len;
1446:
1447: /* parse through general headers */
1448: while (0 < tlen && np != ISAKMP_NPTYPE_NONE) {
1449: if (tlen <= sizeof(struct isakmp_gen)) {
1450: /* don't send information, see isakmp_ident_r1() */
1451: plog(LLV_ERROR, LOCATION, NULL,
1452: "invalid length of payload\n");
1453: vfree(result);
1454: return NULL;
1455: }
1456:
1457: plog(LLV_DEBUG, LOCATION, NULL,
1458: "seen nptype=%u(%s)\n", np, s_isakmp_nptype(np));
1459:
1460: p->type = np;
1461: p->len = ntohs(gen->len);
1462: if (p->len < sizeof(struct isakmp_gen) || p->len > tlen) {
1463: plog(LLV_DEBUG, LOCATION, NULL,
1464: "invalid length of payload\n");
1465: vfree(result);
1466: return NULL;
1467: }
1468: p->ptr = gen;
1469: p++;
1470: if (ep <= p) {
1471: int off;
1472:
1473: off = p - (struct isakmp_parse_t *)result->v;
1474: result = vrealloc(result, result->l * 2);
1475: if (result == NULL) {
1476: plog(LLV_DEBUG, LOCATION, NULL,
1477: "failed to realloc buffer.\n");
1478: vfree(result);
1479: return NULL;
1480: }
1481: ep = (struct isakmp_parse_t *)
1482: (result->v + result->l - sizeof(*ep));
1483: p = (struct isakmp_parse_t *)result->v;
1484: p += off;
1485: }
1486:
1487: np = gen->np;
1488: plen = ntohs(gen->len);
1489: gen = (struct isakmp_gen *)((caddr_t)gen + plen);
1490: tlen -= plen;
1491: }
1492: p->type = ISAKMP_NPTYPE_NONE;
1493: p->len = 0;
1494: p->ptr = NULL;
1495:
1496: plog(LLV_DEBUG, LOCATION, NULL, "succeed.\n");
1497:
1498: return result;
1499: }
1500:
1501: /*
1502: * parse ISAKMP payloads, including ISAKMP base header.
1503: */
1504: vchar_t *
1505: isakmp_parse(buf)
1506: vchar_t *buf;
1507: {
1508: struct isakmp *isakmp = (struct isakmp *)buf->v;
1509: struct isakmp_gen *gen;
1510: int tlen;
1511: vchar_t *result;
1512: u_char np;
1513:
1514: np = isakmp->np;
1515: gen = (struct isakmp_gen *)(buf->v + sizeof(*isakmp));
1516: tlen = buf->l - sizeof(struct isakmp);
1517: result = isakmp_parsewoh(np, gen, tlen);
1518:
1519: return result;
1520: }
1521:
1522: /* %%% */
1523: int
1524: isakmp_init()
1525: {
1526: /* initialize a isakmp status table */
1527: initph1tree();
1528: initph2tree();
1529: initctdtree();
1530: init_recvdpkt();
1531:
1532: return 0;
1533: }
1534:
1535: /*
1536: * make strings containing i_cookie + r_cookie + msgid
1537: */
1538: const char *
1539: isakmp_pindex(index, msgid)
1540: const isakmp_index *index;
1541: const u_int32_t msgid;
1542: {
1543: static char buf[64];
1544: const u_char *p;
1545: int i, j;
1546:
1547: memset(buf, 0, sizeof(buf));
1548:
1549: /* copy index */
1550: p = (const u_char *)index;
1551: for (j = 0, i = 0; i < sizeof(isakmp_index); i++) {
1552: snprintf((char *)&buf[j], sizeof(buf) - j, "%02x", p[i]);
1553: j += 2;
1554: switch (i) {
1555: case 7:
1556: buf[j++] = ':';
1557: }
1558: }
1559:
1560: if (msgid == 0)
1561: return buf;
1562:
1563: /* copy msgid */
1564: snprintf((char *)&buf[j], sizeof(buf) - j, ":%08x", ntohs(msgid));
1565:
1566: return buf;
1567: }
1568:
1569: /* open ISAKMP sockets. */
1570: int
1571: isakmp_open(struct sockaddr *addr, int udp_encap)
1572: {
1573: const int yes = 1;
1574: int ifnum = 0, encap_ifnum = 0, fd;
1575: struct sockaddr_in *sin = (struct sockaddr_in *) addr;
1576: #ifdef INET6
1577: struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *) addr;
1578: int pktinfo;
1579: #endif
1580: #ifdef ENABLE_NATT
1581: int option = -1;
1582: #endif
1583:
1584: /* warn if wildcard address - should we forbid this? */
1585: switch (addr->sa_family) {
1586: case AF_INET:
1587: if (sin->sin_addr.s_addr == 0)
1588: plog(LLV_WARNING, LOCATION, NULL,
1589: "listening to wildcard address,"
1590: "broadcast IKE packet may kill you\n");
1591: break;
1592: #ifdef INET6
1593: case AF_INET6:
1594: if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
1595: plog(LLV_DEBUG, LOCATION, NULL,
1596: "ignoring multicast address %s\n",
1597: saddr2str(addr));
1598: return -1;
1599: }
1600:
1601: if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
1602: plog(LLV_WARNING, LOCATION, NULL,
1603: "listening to wildcard address, "
1604: "broadcast IKE packet may kill you\n");
1605: break;
1606: #endif
1607: default:
1608: plog(LLV_ERROR, LOCATION, NULL,
1609: "unsupported address family %d\n",
1610: addr->sa_family);
1611: return -1;
1612: }
1613:
1614: if ((fd = privsep_socket(addr->sa_family, SOCK_DGRAM, 0)) < 0) {
1615: plog(LLV_ERROR, LOCATION, NULL,
1616: "socket(%s)\n", strerror(errno));
1617: return -1;
1618: }
1619: close_on_exec(fd);
1620: if (fcntl(fd, F_SETFL, O_NONBLOCK) == -1)
1621: plog(LLV_WARNING, LOCATION, NULL,
1622: "failed to put socket in non-blocking mode\n");
1623:
1624: /* receive my interface address on inbound packets. */
1625: switch (addr->sa_family) {
1626: case AF_INET:
1627: if (setsockopt(fd, IPPROTO_IP,
1628: #ifdef __linux__
1629: IP_PKTINFO,
1630: #else
1631: IP_RECVDSTADDR,
1632: #endif
1633: (const void *) &yes, sizeof(yes)) < 0) {
1634: plog(LLV_ERROR, LOCATION, NULL,
1635: "setsockopt IP_RECVDSTADDR (%s)\n",
1636: strerror(errno));
1637: goto err;
1638: }
1639:
1640: #ifdef ENABLE_NATT
1641: if (udp_encap)
1642: option = UDP_ENCAP_ESPINUDP;
1643: #if defined(ENABLE_NATT_00) || defined(ENABLE_NATT_01)
1644: else
1645: option = UDP_ENCAP_ESPINUDP_NON_IKE;
1646: #endif
1647: if (option == -1)
1648: break;
1649:
1650: if (setsockopt(fd, SOL_UDP,
1651: UDP_ENCAP, &option,
1652: sizeof(option)) < 0) {
1653: plog(LLV_WARNING, LOCATION, NULL,
1654: "setsockopt(%s): UDP_ENCAP %s\n",
1655: option == UDP_ENCAP_ESPINUDP ? "UDP_ENCAP_ESPINUDP" : "UDP_ENCAP_ESPINUDP_NON_IKE",
1656: strerror(errno));
1657: } else {
1658: plog(LLV_INFO, LOCATION, NULL,
1659: "%s used for NAT-T\n",
1660: saddr2str(addr));
1661: }
1662: #endif
1663: break;
1664:
1665: #ifdef INET6
1666: case AF_INET6:
1667: #if defined(INET6_ADVAPI)
1668: #ifdef IPV6_RECVPKTINFO
1669: pktinfo = IPV6_RECVPKTINFO;
1670: #else /* old adv. API */
1671: pktinfo = IPV6_PKTINFO;
1672: #endif /* IPV6_RECVPKTINFO */
1673: #else
1674: pktinfo = IPV6_RECVDSTADDR;
1675: #endif
1676: if (setsockopt(fd, IPPROTO_IPV6, pktinfo,
1677: (const void *) &yes, sizeof(yes)) < 0) {
1678: plog(LLV_ERROR, LOCATION, NULL,
1679: "setsockopt IPV6_RECVDSTADDR (%d):%s\n",
1680: pktinfo, strerror(errno));
1681: goto err;
1682: }
1683:
1684: #ifdef IPV6_USE_MIN_MTU
1685: if (setsockopt(fd, IPPROTO_IPV6, IPV6_USE_MIN_MTU,
1686: (void *) &yes, sizeof(yes)) < 0) {
1687: plog(LLV_ERROR, LOCATION, NULL,
1688: "setsockopt IPV6_USE_MIN_MTU (%s)\n",
1689: strerror(errno));
1690: goto err;
1691: }
1692: #endif
1693: break;
1694: #endif
1695: }
1696:
1697: if (setsockopt(fd, SOL_SOCKET,
1698: #ifdef __linux__
1699: SO_REUSEADDR,
1700: #else
1701: SO_REUSEPORT,
1702: #endif
1703: (void *) &yes, sizeof(yes)) < 0) {
1704: plog(LLV_ERROR, LOCATION, NULL,
1705: "failed to set REUSE flag on %s (%s).\n",
1706: saddr2str(addr), strerror(errno));
1707: goto err;
1708: }
1709:
1710: if (setsockopt_bypass(fd, addr->sa_family) < 0)
1711: goto err;
1712:
1713: if (privsep_bind(fd, addr, sysdep_sa_len(addr)) < 0) {
1714: plog(LLV_ERROR, LOCATION, addr,
1715: "failed to bind to address %s (%s).\n",
1716: saddr2str(addr), strerror(errno));
1717: goto err;
1718: }
1719:
1720: plog(LLV_INFO, LOCATION, NULL,
1721: "%s used as isakmp port (fd=%d)\n",
1722: saddr2str(addr), fd);
1723:
1724: monitor_fd(fd, isakmp_handler, NULL, 1);
1725: return fd;
1726:
1727: err:
1728: close(fd);
1729: return -1;
1730: }
1731:
1732: void
1733: isakmp_close(int fd)
1734: {
1735: unmonitor_fd(fd);
1736: close(fd);
1737: }
1738:
1739: int
1740: isakmp_send(iph1, sbuf)
1741: struct ph1handle *iph1;
1742: vchar_t *sbuf;
1743: {
1744: int len = 0;
1745: int s;
1746: vchar_t *vbuf = NULL, swap;
1747:
1748: #ifdef ENABLE_NATT
1749: size_t extralen = NON_ESP_MARKER_USE(iph1) ? NON_ESP_MARKER_LEN : 0;
1750:
1751: /* Check if NON_ESP_MARKER_LEN is already there (happens when resending packets)
1752: */
1753: if(extralen == NON_ESP_MARKER_LEN &&
1754: *(u_int32_t *)sbuf->v == 0)
1755: extralen = 0;
1756:
1757: #ifdef ENABLE_FRAG
1758: /*
1759: * Do not add the non ESP marker for a packet that will
1760: * be fragmented. The non ESP marker should appear in
1761: * all fragment's packets, but not in the fragmented packet
1762: */
1763: if (iph1->frag && sbuf->l > ISAKMP_FRAG_MAXLEN)
1764: extralen = 0;
1765: #endif
1766: if (extralen)
1767: plog (LLV_DEBUG, LOCATION, NULL, "Adding NON-ESP marker\n");
1768:
1769: /* If NAT-T port floating is in use, 4 zero bytes (non-ESP marker)
1770: must added just before the packet itself. For this we must
1771: allocate a new buffer and release it at the end. */
1772: if (extralen) {
1773: if ((vbuf = vmalloc (sbuf->l + extralen)) == NULL) {
1774: plog(LLV_ERROR, LOCATION, NULL,
1775: "vbuf allocation failed\n");
1776: return -1;
1777: }
1778: *(u_int32_t *)vbuf->v = 0;
1779: memcpy (vbuf->v + extralen, sbuf->v, sbuf->l);
1780: /* ensures that the modified buffer will be sent back to the caller, so
1781: * add_recvdpkt() will add the correct buffer
1782: */
1783: swap = *sbuf;
1784: *sbuf = *vbuf;
1785: *vbuf = swap;
1786: vfree(vbuf);
1787: }
1788: #endif
1789:
1790: /* select the socket to be sent */
1791: s = myaddr_getfd(iph1->local);
1792: if (s == -1)
1793: return -1;
1794:
1795: plog (LLV_DEBUG, LOCATION, NULL, "%zu bytes %s\n", sbuf->l,
1796: saddr2str_fromto("from %s to %s", iph1->local, iph1->remote));
1797:
1798: #ifdef ENABLE_FRAG
1799: if (iph1->frag && sbuf->l > ISAKMP_FRAG_MAXLEN) {
1800: if (isakmp_sendfrags(iph1, sbuf) == -1) {
1801: plog(LLV_ERROR, LOCATION, NULL,
1802: "isakmp_sendfrags failed\n");
1803: return -1;
1804: }
1805: } else
1806: #endif
1807: {
1808: len = sendfromto(s, sbuf->v, sbuf->l,
1809: iph1->local, iph1->remote, lcconf->count_persend);
1810:
1811: if (len == -1) {
1812: plog(LLV_ERROR, LOCATION, NULL, "sendfromto failed\n");
1813: return -1;
1814: }
1815: }
1816:
1817: return 0;
1818: }
1819:
1820: /* called from scheduler */
1821: static void
1822: isakmp_ph1resend_stub(p)
1823: struct sched *p;
1824: {
1825: struct ph1handle *iph1 = container_of(p, struct ph1handle, scr);
1826:
1827: if (isakmp_ph1resend(iph1) < 0) {
1828: remph1(iph1);
1829: delph1(iph1);
1830: }
1831: }
1832:
1833: static int
1834: isakmp_ph1resend(iph1)
1835: struct ph1handle *iph1;
1836: {
1837: /* Note: NEVER do the rem/del here, it will be done by the caller or by the _stub function
1838: */
1839: if (iph1->retry_counter <= 0) {
1840: plog(LLV_ERROR, LOCATION, NULL,
1841: "phase1 negotiation failed due to time up. %s\n",
1842: isakmp_pindex(&iph1->index, iph1->msgid));
1843: /* XXX is the peer really "dead" here ??? */
1844: script_hook(iph1, SCRIPT_PHASE1_DEAD);
1845: evt_phase1(iph1, EVT_PHASE1_NO_RESPONSE, NULL);
1846:
1847: return -1;
1848: }
1849:
1850: if (isakmp_send(iph1, iph1->sendbuf) < 0){
1851: plog(LLV_ERROR, LOCATION, NULL,
1852: "phase1 negotiation failed due to send error. %s\n",
1853: isakmp_pindex(&iph1->index, iph1->msgid));
1854: evt_phase1(iph1, EVT_PHASE1_NO_RESPONSE, NULL);
1855: return -1;
1856: }
1857:
1858: plog(LLV_DEBUG, LOCATION, NULL,
1859: "resend phase1 packet %s\n",
1860: isakmp_pindex(&iph1->index, iph1->msgid));
1861:
1862: iph1->retry_counter--;
1863:
1864: sched_schedule(&iph1->scr, lcconf->retry_interval,
1865: isakmp_ph1resend_stub);
1866:
1867: return 0;
1868: }
1869:
1870: int
1871: isakmp_ph1send(iph1)
1872: struct ph1handle *iph1;
1873: {
1874: iph1->retry_counter = lcconf->retry_counter;
1875: return isakmp_ph1resend(iph1);
1876: }
1877:
1878: /* called from scheduler */
1879: static void
1880: isakmp_ph2resend_stub(p)
1881: struct sched *p;
1882: {
1883: struct ph2handle *iph2 = container_of(p, struct ph2handle, scr);
1884:
1885: if (isakmp_ph2resend(iph2) < 0) {
1886: remph2(iph2);
1887: delph2(iph2);
1888: }
1889: }
1890:
1891: static int
1892: isakmp_ph2resend(iph2)
1893: struct ph2handle *iph2;
1894: {
1895: /* Note: NEVER do the unbind/rem/del here, it will be done by the caller or by the _stub function
1896: */
1897: if (iph2->ph1->status >= PHASE1ST_EXPIRED) {
1898: plog(LLV_ERROR, LOCATION, NULL,
1899: "phase2 negotiation failed due to phase1 expired. %s\n",
1900: isakmp_pindex(&iph2->ph1->index, iph2->msgid));
1901: return -1;
1902: }
1903:
1904: if (iph2->retry_counter <= 0) {
1905: plog(LLV_ERROR, LOCATION, NULL,
1906: "phase2 negotiation failed due to time up. %s\n",
1907: isakmp_pindex(&iph2->ph1->index, iph2->msgid));
1908: evt_phase2(iph2, EVT_PHASE2_NO_RESPONSE, NULL);
1909: unbindph12(iph2);
1910: return -1;
1911: }
1912:
1913: if (isakmp_send(iph2->ph1, iph2->sendbuf) < 0){
1914: plog(LLV_ERROR, LOCATION, NULL,
1915: "phase2 negotiation failed due to send error. %s\n",
1916: isakmp_pindex(&iph2->ph1->index, iph2->msgid));
1917: evt_phase2(iph2, EVT_PHASE2_NO_RESPONSE, NULL);
1918: return -1;
1919: }
1920:
1921: plog(LLV_DEBUG, LOCATION, NULL,
1922: "resend phase2 packet %s\n",
1923: isakmp_pindex(&iph2->ph1->index, iph2->msgid));
1924:
1925: iph2->retry_counter--;
1926:
1927: sched_schedule(&iph2->scr, lcconf->retry_interval,
1928: isakmp_ph2resend_stub);
1929:
1930: return 0;
1931: }
1932:
1933: int
1934: isakmp_ph2send(iph2)
1935: struct ph2handle *iph2;
1936: {
1937: iph2->retry_counter = lcconf->retry_counter;
1938: return isakmp_ph2resend(iph2);
1939: }
1940:
1941: /* called from scheduler */
1942: void
1943: isakmp_ph1dying_stub(p)
1944: struct sched *p;
1945: {
1946:
1947: isakmp_ph1dying(container_of(p, struct ph1handle, sce));
1948: }
1949:
1950: void
1951: isakmp_ph1dying(iph1)
1952: struct ph1handle *iph1;
1953: {
1954: struct ph1handle *new_iph1;
1955: struct ph2handle *p;
1956: struct remoteconf *rmconf;
1957:
1958: if (iph1->status >= PHASE1ST_DYING)
1959: return;
1960:
1961: /* Going away in after a while... */
1962: iph1->status = PHASE1ST_DYING;
1963:
1964: /* Any fresh phase1s? */
1965: new_iph1 = getph1(iph1, iph1->local, iph1->remote, 1);
1966: if (new_iph1 == NULL) {
1967: LIST_FOREACH(p, &iph1->ph2tree, ph1bind) {
1968: if (p->status != PHASE2ST_ESTABLISHED)
1969: continue;
1970:
1971: plog(LLV_INFO, LOCATION, NULL,
1972: "renegotiating phase1 to %s due to "
1973: "active phase2\n",
1974: saddrwop2str(iph1->remote));
1975:
1976: if (iph1->side == INITIATOR)
1977: isakmp_ph1begin_i(iph1->rmconf, iph1->remote,
1978: iph1->local);
1979:
1980: break;
1981: }
1982: } else {
1983: migrate_ph12(iph1, new_iph1);
1984: }
1985:
1986: /* Schedule for expiration */
1987: sched_schedule(&iph1->sce, iph1->approval->lifetime *
1988: (100 - PFKEY_SOFT_LIFETIME_RATE) / 100,
1989: isakmp_ph1expire_stub);
1990: }
1991:
1992: /* called from scheduler */
1993: void
1994: isakmp_ph1expire_stub(p)
1995: struct sched *p;
1996: {
1997: isakmp_ph1expire(container_of(p, struct ph1handle, sce));
1998: }
1999:
2000: void
2001: isakmp_ph1expire(iph1)
2002: struct ph1handle *iph1;
2003: {
2004: char *src, *dst;
2005:
2006: if (iph1->status < PHASE1ST_EXPIRED) {
2007: src = racoon_strdup(saddr2str(iph1->local));
2008: dst = racoon_strdup(saddr2str(iph1->remote));
2009: STRDUP_FATAL(src);
2010: STRDUP_FATAL(dst);
2011:
2012: plog(LLV_INFO, LOCATION, NULL,
2013: "ISAKMP-SA expired %s-%s spi:%s\n",
2014: src, dst,
2015: isakmp_pindex(&iph1->index, 0));
2016: racoon_free(src);
2017: racoon_free(dst);
2018: iph1->status = PHASE1ST_EXPIRED;
2019: }
2020:
2021: isakmp_ph1delete(iph1);
2022: }
2023:
2024: /* called from scheduler */
2025: void
2026: isakmp_ph1delete_stub(p)
2027: struct sched *p;
2028: {
2029:
2030: isakmp_ph1delete(container_of(p, struct ph1handle, sce));
2031: }
2032:
2033: void
2034: isakmp_ph1delete(iph1)
2035: struct ph1handle *iph1;
2036: {
2037: struct ph2handle *p, *next;
2038: struct ph1handle *new_iph1;
2039: char *src, *dst;
2040:
2041: /* Migrate established phase2s. Any fresh phase1s? */
2042: new_iph1 = getph1(iph1, iph1->local, iph1->remote, 1);
2043: if (new_iph1 != NULL)
2044: migrate_ph12(iph1, new_iph1);
2045:
2046: /* Discard any left phase2s */
2047: for (p = LIST_FIRST(&iph1->ph2tree); p; p = next) {
2048: next = LIST_NEXT(p, ph1bind);
2049: if (p->status == PHASE2ST_ESTABLISHED)
2050: isakmp_info_send_d2(p);
2051: /* remove all ph2 handles,
2052: * as ph1handle will be expired soon
2053: */
2054: delete_spd(p, 1);
2055: remph2(p);
2056: delph2(p);
2057: }
2058:
2059: src = racoon_strdup(saddr2str(iph1->local));
2060: dst = racoon_strdup(saddr2str(iph1->remote));
2061: STRDUP_FATAL(src);
2062: STRDUP_FATAL(dst);
2063:
2064: plog(LLV_INFO, LOCATION, NULL,
2065: "ISAKMP-SA deleted %s-%s spi:%s\n",
2066: src, dst, isakmp_pindex(&iph1->index, 0));
2067:
2068: evt_phase1(iph1, EVT_PHASE1_DOWN, NULL);
2069: if (new_iph1 == NULL && ph1_rekey_enabled(iph1))
2070: script_hook(iph1, SCRIPT_PHASE1_DEAD);
2071:
2072: racoon_free(src);
2073: racoon_free(dst);
2074:
2075: remph1(iph1);
2076: delph1(iph1);
2077: }
2078:
2079: /* called from scheduler.
2080: * this function will call only isakmp_ph2delete().
2081: * phase 2 handler remain forever if kernel doesn't cry a expire of phase 2 SA
2082: * by something cause. That's why this function is called after phase 2 SA
2083: * expires in the userland.
2084: */
2085: void
2086: isakmp_ph2expire_stub(p)
2087: struct sched *p;
2088: {
2089:
2090: isakmp_ph2expire(container_of(p, struct ph2handle, sce));
2091: }
2092:
2093: void
2094: isakmp_ph2expire(iph2)
2095: struct ph2handle *iph2;
2096: {
2097: char *src, *dst;
2098:
2099: src = racoon_strdup(saddrwop2str(iph2->src));
2100: dst = racoon_strdup(saddrwop2str(iph2->dst));
2101: STRDUP_FATAL(src);
2102: STRDUP_FATAL(dst);
2103:
2104: plog(LLV_INFO, LOCATION, NULL,
2105: "phase2 sa expired %s-%s\n", src, dst);
2106: racoon_free(src);
2107: racoon_free(dst);
2108:
2109: iph2->status = PHASE2ST_EXPIRED;
2110: sched_schedule(&iph2->sce, 1, isakmp_ph2delete_stub);
2111: }
2112:
2113: /* called from scheduler */
2114: void
2115: isakmp_ph2delete_stub(p)
2116: struct sched *p;
2117: {
2118:
2119: isakmp_ph2delete(container_of(p, struct ph2handle, sce));
2120: }
2121:
2122: void
2123: isakmp_ph2delete(iph2)
2124: struct ph2handle *iph2;
2125: {
2126: char *src, *dst;
2127:
2128: src = racoon_strdup(saddrwop2str(iph2->src));
2129: dst = racoon_strdup(saddrwop2str(iph2->dst));
2130: STRDUP_FATAL(src);
2131: STRDUP_FATAL(dst);
2132:
2133: plog(LLV_INFO, LOCATION, NULL,
2134: "phase2 sa deleted %s-%s\n", src, dst);
2135: racoon_free(src);
2136: racoon_free(dst);
2137:
2138: remph2(iph2);
2139: delph2(iph2);
2140:
2141: return;
2142: }
2143:
2144: /* %%%
2145: * Interface between PF_KEYv2 and ISAKMP
2146: */
2147: /*
2148: * receive ACQUIRE from kernel, and begin either phase1 or phase2.
2149: * if phase1 has been finished, begin phase2.
2150: */
2151: int
2152: isakmp_post_acquire(iph2, iph1hint, nopassive)
2153: struct ph2handle *iph2;
2154: struct ph1handle *iph1hint;
2155: int nopassive;
2156: {
2157: struct remoteconf *rmconf;
2158: struct ph1handle *iph1 = NULL;
2159:
2160: plog(LLV_DEBUG, LOCATION, NULL, "in post_acquire\n");
2161:
2162: /* Search appropriate configuration with masking port. Note that
2163: * we always use iph2->dst, and not iph2->sa_dst.
2164: *
2165: * XXX One possible need for using iph2->sa_dst if not NULL would
2166: * be for selecting a remote configuration based on a stable
2167: * address of a mobile node (not a CoA provided by MIGRATE/KMADDRESS
2168: * as iph2->dst hint). This scenario would require additional changes,
2169: * so no need to bother yet. --arno */
2170:
2171: if (iph1hint == NULL || iph1hint->rmconf == NULL) {
2172: rmconf = getrmconf(iph2->dst, nopassive ? GETRMCONF_F_NO_PASSIVE : 0);
2173: if (rmconf == NULL) {
2174: plog(LLV_ERROR, LOCATION, NULL,
2175: "no configuration found for %s.\n",
2176: saddrwop2str(iph2->dst));
2177: return -1;
2178: }
2179: } else {
2180: rmconf = iph1hint->rmconf;
2181: }
2182:
2183: /* if passive mode, ignore the acquire message */
2184: if (nopassive && rmconf->passive) {
2185: plog(LLV_DEBUG, LOCATION, NULL,
2186: "because of passive mode, "
2187: "ignore the acquire message for %s.\n",
2188: saddrwop2str(iph2->dst));
2189: return 0;
2190: }
2191:
2192: /*
2193: * XXX Searching by IP addresses + ports might fail on
2194: * some cases, we should use the ISAKMP identity to search
2195: * matching ISAKMP.
2196: */
2197: iph1 = getph1(iph1hint, iph2->src, iph2->dst, 0);
2198:
2199: /* no ISAKMP-SA found. */
2200: if (iph1 == NULL) {
2201: iph2->retry_checkph1 = lcconf->retry_checkph1;
2202: sched_schedule(&iph2->sce, 1, isakmp_chkph1there_stub);
2203: plog(LLV_INFO, LOCATION, NULL,
2204: "IPsec-SA request for %s queued "
2205: "due to no phase1 found.\n",
2206: saddrwop2str(iph2->dst));
2207:
2208: /* start phase 1 negotiation as a initiator. */
2209: if (isakmp_ph1begin_i(rmconf, iph2->dst, iph2->src) == NULL) {
2210: sched_cancel(&iph2->sce);
2211: return -1;
2212: }
2213:
2214: return 0;
2215: /*NOTREACHED*/
2216: }
2217:
2218: /* found ISAKMP-SA, but on negotiation. */
2219: if (iph1->status < PHASE1ST_ESTABLISHED) {
2220: iph2->retry_checkph1 = lcconf->retry_checkph1;
2221: sched_schedule(&iph2->sce, 1, isakmp_chkph1there_stub);
2222: plog(LLV_INFO, LOCATION, iph2->dst,
2223: "request for establishing IPsec-SA was queued "
2224: "due to no phase1 found.\n");
2225: return 0;
2226: /*NOTREACHED*/
2227: }
2228:
2229: /* found established ISAKMP-SA */
2230: /* i.e. iph1->status == PHASE1ST_ESTABLISHED */
2231:
2232: /* found ISAKMP-SA. */
2233: plog(LLV_DEBUG, LOCATION, NULL, "begin QUICK mode.\n");
2234:
2235: /* begin quick mode */
2236: if (isakmp_ph2begin_i(iph1, iph2))
2237: return -1;
2238:
2239: return 0;
2240: }
2241:
2242: int
2243: isakmp_get_sainfo(iph2, sp_out, sp_in)
2244: struct ph2handle *iph2;
2245: struct secpolicy *sp_out, *sp_in;
2246: {
2247: struct remoteconf *conf;
2248: uint32_t remoteid = 0;
2249:
2250: plog(LLV_DEBUG, LOCATION, NULL,
2251: "new acquire %s\n", spidx2str(&sp_out->spidx));
2252:
2253: /* get sainfo */
2254: {
2255: vchar_t *idsrc, *iddst;
2256:
2257: idsrc = ipsecdoi_sockaddr2id((struct sockaddr *)&sp_out->spidx.src,
2258: sp_out->spidx.prefs, sp_out->spidx.ul_proto);
2259: if (idsrc == NULL) {
2260: plog(LLV_ERROR, LOCATION, NULL,
2261: "failed to get ID for %s\n",
2262: spidx2str(&sp_out->spidx));
2263: return -1;
2264: }
2265: iddst = ipsecdoi_sockaddr2id((struct sockaddr *)&sp_out->spidx.dst,
2266: sp_out->spidx.prefd, sp_out->spidx.ul_proto);
2267: if (iddst == NULL) {
2268: plog(LLV_ERROR, LOCATION, NULL,
2269: "failed to get ID for %s\n",
2270: spidx2str(&sp_out->spidx));
2271: vfree(idsrc);
2272: return -1;
2273: }
2274:
2275: conf = getrmconf(iph2->dst, 0);
2276: if (conf != NULL)
2277: remoteid = conf->ph1id;
2278: else
2279: plog(LLV_DEBUG, LOCATION, NULL, "Warning: no valid rmconf !\n");
2280:
2281: iph2->sainfo = getsainfo(idsrc, iddst, NULL, NULL, remoteid);
2282: vfree(idsrc);
2283: vfree(iddst);
2284: if (iph2->sainfo == NULL) {
2285: plog(LLV_ERROR, LOCATION, NULL,
2286: "failed to get sainfo.\n");
2287: return -1;
2288: /* XXX should use the algorithm list from register message */
2289: }
2290:
2291: plog(LLV_DEBUG, LOCATION, NULL,
2292: "selected sainfo: %s\n", sainfo2str(iph2->sainfo));
2293: }
2294:
2295: if (set_proposal_from_policy(iph2, sp_out, sp_in) < 0) {
2296: plog(LLV_ERROR, LOCATION, NULL,
2297: "failed to create saprop.\n");
2298: return -1;
2299: }
2300:
2301: return 0;
2302: }
2303:
2304:
2305: /*
2306: * receive GETSPI from kernel.
2307: */
2308: int
2309: isakmp_post_getspi(iph2)
2310: struct ph2handle *iph2;
2311: {
2312: #ifdef ENABLE_STATS
2313: struct timeval start, end;
2314: #endif
2315:
2316: /* don't process it because there is no suitable phase1-sa. */
2317: if (iph2->ph1->status >= PHASE1ST_EXPIRED) {
2318: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
2319: "the negotiation is stopped, "
2320: "because there is no suitable ISAKMP-SA.\n");
2321: return -1;
2322: }
2323:
2324: #ifdef ENABLE_STATS
2325: gettimeofday(&start, NULL);
2326: #endif
2327: if ((ph2exchange[etypesw2(ISAKMP_ETYPE_QUICK)]
2328: [iph2->side]
2329: [iph2->status])(iph2, NULL) != 0)
2330: return -1;
2331: #ifdef ENABLE_STATS
2332: gettimeofday(&end, NULL);
2333: syslog(LOG_NOTICE, "%s(%s): %8.6f",
2334: "phase2",
2335: s_isakmp_state(ISAKMP_ETYPE_QUICK, iph2->side, iph2->status),
2336: timedelta(&start, &end));
2337: #endif
2338:
2339: return 0;
2340: }
2341:
2342: /* called by scheduler */
2343: void
2344: isakmp_chkph1there_stub(p)
2345: struct sched *p;
2346: {
2347: isakmp_chkph1there(container_of(p, struct ph2handle, sce));
2348: }
2349:
2350: void
2351: isakmp_chkph1there(iph2)
2352: struct ph2handle *iph2;
2353: {
2354: struct ph1handle *iph1;
2355:
2356: iph2->retry_checkph1--;
2357: if (iph2->retry_checkph1 < 0) {
2358: plog(LLV_ERROR, LOCATION, iph2->dst,
2359: "phase2 negotiation failed "
2360: "due to time up waiting for phase1. %s\n",
2361: sadbsecas2str(iph2->dst, iph2->src,
2362: iph2->satype, 0, 0));
2363: plog(LLV_INFO, LOCATION, NULL,
2364: "delete phase 2 handler.\n");
2365:
2366: /* send acquire to kernel as error */
2367: pk_sendeacquire(iph2);
2368:
2369: remph2(iph2);
2370: delph2(iph2);
2371:
2372: return;
2373: }
2374:
2375: /* Search isakmp status table by address and port */
2376: iph1 = getph1byaddr(iph2->src, iph2->dst, 0);
2377:
2378: /* XXX Even if ph1 as responder is there, should we not start
2379: * phase 2 negotiation ? */
2380: if (iph1 != NULL
2381: && iph1->status == PHASE1ST_ESTABLISHED) {
2382: /* found isakmp-sa */
2383:
2384: plog(LLV_DEBUG2, LOCATION, NULL, "CHKPH1THERE: got a ph1 handler, setting ports.\n");
2385: plog(LLV_DEBUG2, LOCATION, NULL, "iph1->local: %s\n", saddr2str(iph1->local));
2386: plog(LLV_DEBUG2, LOCATION, NULL, "iph1->remote: %s\n", saddr2str(iph1->remote));
2387: plog(LLV_DEBUG2, LOCATION, NULL, "before:\n");
2388: plog(LLV_DEBUG2, LOCATION, NULL, "src: %s\n", saddr2str(iph2->src));
2389: plog(LLV_DEBUG2, LOCATION, NULL, "dst: %s\n", saddr2str(iph2->dst));
2390: set_port(iph2->src, extract_port(iph1->local));
2391: set_port(iph2->dst, extract_port(iph1->remote));
2392: plog(LLV_DEBUG2, LOCATION, NULL, "After:\n");
2393: plog(LLV_DEBUG2, LOCATION, NULL, "src: %s\n", saddr2str(iph2->src));
2394: plog(LLV_DEBUG2, LOCATION, NULL, "dst: %s\n", saddr2str(iph2->dst));
2395:
2396: /* begin quick mode */
2397: (void)isakmp_ph2begin_i(iph1, iph2);
2398: return;
2399: }
2400:
2401: plog(LLV_DEBUG2, LOCATION, NULL, "CHKPH1THERE: no established ph1 handler found\n");
2402:
2403: /* no isakmp-sa found */
2404: sched_schedule(&iph2->sce, 1, isakmp_chkph1there_stub);
2405:
2406: return;
2407: }
2408:
2409: /* copy variable data into ALLOCATED buffer. */
2410: caddr_t
2411: isakmp_set_attr_v(buf, type, val, len)
2412: caddr_t buf;
2413: int type;
2414: caddr_t val;
2415: int len;
2416: {
2417: struct isakmp_data *data;
2418:
2419: data = (struct isakmp_data *)buf;
2420: data->type = htons((u_int16_t)type | ISAKMP_GEN_TLV);
2421: data->lorv = htons((u_int16_t)len);
2422: memcpy(data + 1, val, len);
2423:
2424: return buf + sizeof(*data) + len;
2425: }
2426:
2427: /* copy fixed length data into ALLOCATED buffer. */
2428: caddr_t
2429: isakmp_set_attr_l(buf, type, val)
2430: caddr_t buf;
2431: int type;
2432: u_int32_t val;
2433: {
2434: struct isakmp_data *data;
2435:
2436: data = (struct isakmp_data *)buf;
2437: data->type = htons((u_int16_t)type | ISAKMP_GEN_TV);
2438: data->lorv = htons((u_int16_t)val);
2439:
2440: return buf + sizeof(*data);
2441: }
2442:
2443: /* add a variable data attribute to the buffer by reallocating it. */
2444: vchar_t *
2445: isakmp_add_attr_v(buf0, type, val, len)
2446: vchar_t *buf0;
2447: int type;
2448: caddr_t val;
2449: int len;
2450: {
2451: vchar_t *buf = NULL;
2452: struct isakmp_data *data;
2453: int tlen;
2454: int oldlen = 0;
2455:
2456: tlen = sizeof(*data) + len;
2457:
2458: if (buf0) {
2459: oldlen = buf0->l;
2460: buf = vrealloc(buf0, oldlen + tlen);
2461: } else
2462: buf = vmalloc(tlen);
2463: if (!buf) {
2464: plog(LLV_ERROR, LOCATION, NULL,
2465: "failed to get a attribute buffer.\n");
2466: return NULL;
2467: }
2468:
2469: data = (struct isakmp_data *)(buf->v + oldlen);
2470: data->type = htons((u_int16_t)type | ISAKMP_GEN_TLV);
2471: data->lorv = htons((u_int16_t)len);
2472: memcpy(data + 1, val, len);
2473:
2474: return buf;
2475: }
2476:
2477: /* add a fixed data attribute to the buffer by reallocating it. */
2478: vchar_t *
2479: isakmp_add_attr_l(buf0, type, val)
2480: vchar_t *buf0;
2481: int type;
2482: u_int32_t val;
2483: {
2484: vchar_t *buf = NULL;
2485: struct isakmp_data *data;
2486: int tlen;
2487: int oldlen = 0;
2488:
2489: tlen = sizeof(*data);
2490:
2491: if (buf0) {
2492: oldlen = buf0->l;
2493: buf = vrealloc(buf0, oldlen + tlen);
2494: } else
2495: buf = vmalloc(tlen);
2496: if (!buf) {
2497: plog(LLV_ERROR, LOCATION, NULL,
2498: "failed to get a attribute buffer.\n");
2499: return NULL;
2500: }
2501:
2502: data = (struct isakmp_data *)(buf->v + oldlen);
2503: data->type = htons((u_int16_t)type | ISAKMP_GEN_TV);
2504: data->lorv = htons((u_int16_t)val);
2505:
2506: return buf;
2507: }
2508:
2509: /*
2510: * calculate cookie and set.
2511: */
2512: int
2513: isakmp_newcookie(place, remote, local)
2514: caddr_t place;
2515: struct sockaddr *remote;
2516: struct sockaddr *local;
2517: {
2518: vchar_t *buf = NULL, *buf2 = NULL;
2519: char *p;
2520: int blen;
2521: int alen;
2522: caddr_t sa1, sa2;
2523: time_t t;
2524: int error = -1;
2525: u_short port;
2526:
2527:
2528: if (remote->sa_family != local->sa_family) {
2529: plog(LLV_ERROR, LOCATION, NULL,
2530: "address family mismatch, remote:%d local:%d\n",
2531: remote->sa_family, local->sa_family);
2532: goto end;
2533: }
2534: switch (remote->sa_family) {
2535: case AF_INET:
2536: alen = sizeof(struct in_addr);
2537: sa1 = (caddr_t)&((struct sockaddr_in *)remote)->sin_addr;
2538: sa2 = (caddr_t)&((struct sockaddr_in *)local)->sin_addr;
2539: break;
2540: #ifdef INET6
2541: case AF_INET6:
2542: alen = sizeof(struct in6_addr);
2543: sa1 = (caddr_t)&((struct sockaddr_in6 *)remote)->sin6_addr;
2544: sa2 = (caddr_t)&((struct sockaddr_in6 *)local)->sin6_addr;
2545: break;
2546: #endif
2547: default:
2548: plog(LLV_ERROR, LOCATION, NULL,
2549: "invalid family: %d\n", remote->sa_family);
2550: goto end;
2551: }
2552: blen = (alen + sizeof(u_short)) * 2
2553: + sizeof(time_t) + lcconf->secret_size;
2554: buf = vmalloc(blen);
2555: if (buf == NULL) {
2556: plog(LLV_ERROR, LOCATION, NULL,
2557: "failed to get a cookie.\n");
2558: goto end;
2559: }
2560: p = buf->v;
2561:
2562: /* copy my address */
2563: memcpy(p, sa1, alen);
2564: p += alen;
2565: port = ((struct sockaddr_in *)remote)->sin_port;
2566: memcpy(p, &port, sizeof(u_short));
2567: p += sizeof(u_short);
2568:
2569: /* copy target address */
2570: memcpy(p, sa2, alen);
2571: p += alen;
2572: port = ((struct sockaddr_in *)local)->sin_port;
2573: memcpy(p, &port, sizeof(u_short));
2574: p += sizeof(u_short);
2575:
2576: /* copy time */
2577: t = time(0);
2578: memcpy(p, (caddr_t)&t, sizeof(t));
2579: p += sizeof(t);
2580:
2581: /* copy random value */
2582: buf2 = eay_set_random(lcconf->secret_size);
2583: if (buf2 == NULL)
2584: goto end;
2585: memcpy(p, buf2->v, lcconf->secret_size);
2586: p += lcconf->secret_size;
2587: vfree(buf2);
2588:
2589: buf2 = eay_sha1_one(buf);
2590: memcpy(place, buf2->v, sizeof(cookie_t));
2591:
2592: sa1 = val2str(place, sizeof (cookie_t));
2593: plog(LLV_DEBUG, LOCATION, NULL, "new cookie:\n%s\n", sa1);
2594: racoon_free(sa1);
2595:
2596: error = 0;
2597: end:
2598: if (buf != NULL)
2599: vfree(buf);
2600: if (buf2 != NULL)
2601: vfree(buf2);
2602: return error;
2603: }
2604:
2605: /*
2606: * save partner's(payload) data into phhandle.
2607: */
2608: int
2609: isakmp_p2ph(buf, gen)
2610: vchar_t **buf;
2611: struct isakmp_gen *gen;
2612: {
2613: /* XXX to be checked in each functions for logging. */
2614: if (*buf) {
2615: plog(LLV_WARNING, LOCATION, NULL,
2616: "ignore this payload, same payload type exist.\n");
2617: return -1;
2618: }
2619:
2620: *buf = vmalloc(ntohs(gen->len) - sizeof(*gen));
2621: if (*buf == NULL) {
2622: plog(LLV_ERROR, LOCATION, NULL,
2623: "failed to get buffer.\n");
2624: return -1;
2625: }
2626: memcpy((*buf)->v, gen + 1, (*buf)->l);
2627:
2628: return 0;
2629: }
2630:
2631: u_int32_t
2632: isakmp_newmsgid2(iph1)
2633: struct ph1handle *iph1;
2634: {
2635: u_int32_t msgid2;
2636:
2637: do {
2638: msgid2 = eay_random();
2639: } while (getph2bymsgid(iph1, msgid2));
2640:
2641: return msgid2;
2642: }
2643:
2644: /*
2645: * set values into allocated buffer of isakmp header for phase 1
2646: */
2647: static caddr_t
2648: set_isakmp_header(vbuf, iph1, nptype, etype, flags, msgid)
2649: vchar_t *vbuf;
2650: struct ph1handle *iph1;
2651: int nptype;
2652: u_int8_t etype;
2653: u_int8_t flags;
2654: u_int32_t msgid;
2655: {
2656: struct isakmp *isakmp;
2657:
2658: if (vbuf->l < sizeof(*isakmp))
2659: return NULL;
2660:
2661: isakmp = (struct isakmp *)vbuf->v;
2662:
2663: memcpy(&isakmp->i_ck, &iph1->index.i_ck, sizeof(cookie_t));
2664: memcpy(&isakmp->r_ck, &iph1->index.r_ck, sizeof(cookie_t));
2665: isakmp->np = nptype;
2666: isakmp->v = iph1->version;
2667: isakmp->etype = etype;
2668: isakmp->flags = flags;
2669: isakmp->msgid = msgid;
2670: isakmp->len = htonl(vbuf->l);
2671:
2672: return vbuf->v + sizeof(*isakmp);
2673: }
2674:
2675: /*
2676: * set values into allocated buffer of isakmp header for phase 1
2677: */
2678: caddr_t
2679: set_isakmp_header1(vbuf, iph1, nptype)
2680: vchar_t *vbuf;
2681: struct ph1handle *iph1;
2682: int nptype;
2683: {
2684: return set_isakmp_header (vbuf, iph1, nptype, iph1->etype, iph1->flags, iph1->msgid);
2685: }
2686:
2687: /*
2688: * set values into allocated buffer of isakmp header for phase 2
2689: */
2690: caddr_t
2691: set_isakmp_header2(vbuf, iph2, nptype)
2692: vchar_t *vbuf;
2693: struct ph2handle *iph2;
2694: int nptype;
2695: {
2696: return set_isakmp_header (vbuf, iph2->ph1, nptype, ISAKMP_ETYPE_QUICK, iph2->flags, iph2->msgid);
2697: }
2698:
2699: /*
2700: * set values into allocated buffer of isakmp payload.
2701: */
2702: caddr_t
2703: set_isakmp_payload(buf, src, nptype)
2704: caddr_t buf;
2705: vchar_t *src;
2706: int nptype;
2707: {
2708: struct isakmp_gen *gen;
2709: caddr_t p = buf;
2710:
2711: plog(LLV_DEBUG, LOCATION, NULL, "add payload of len %zu, next type %d\n",
2712: src->l, nptype);
2713:
2714: gen = (struct isakmp_gen *)p;
2715: gen->np = nptype;
2716: gen->len = htons(sizeof(*gen) + src->l);
2717: p += sizeof(*gen);
2718: memcpy(p, src->v, src->l);
2719: p += src->l;
2720:
2721: return p;
2722: }
2723:
2724: static int
2725: etypesw1(etype)
2726: int etype;
2727: {
2728: switch (etype) {
2729: case ISAKMP_ETYPE_IDENT:
2730: return 1;
2731: case ISAKMP_ETYPE_AGG:
2732: return 2;
2733: case ISAKMP_ETYPE_BASE:
2734: return 3;
2735: default:
2736: return 0;
2737: }
2738: /*NOTREACHED*/
2739: }
2740:
2741: static int
2742: etypesw2(etype)
2743: int etype;
2744: {
2745: switch (etype) {
2746: case ISAKMP_ETYPE_QUICK:
2747: return 1;
2748: default:
2749: return 0;
2750: }
2751: /*NOTREACHED*/
2752: }
2753:
2754: #ifdef HAVE_PRINT_ISAKMP_C
2755: /* for print-isakmp.c */
2756: char *snapend;
2757: extern void isakmp_print __P((const u_char *, u_int, const u_char *));
2758:
2759: char *getname __P((const u_char *));
2760: #ifdef INET6
2761: char *getname6 __P((const u_char *));
2762: #endif
2763: int safeputchar __P((int));
2764:
2765: /*
2766: * Return a name for the IP address pointed to by ap. This address
2767: * is assumed to be in network byte order.
2768: */
2769: char *
2770: getname(ap)
2771: const u_char *ap;
2772: {
2773: struct sockaddr_in addr;
2774: static char ntop_buf[NI_MAXHOST];
2775:
2776: memset(&addr, 0, sizeof(addr));
2777: #ifndef __linux__
2778: addr.sin_len = sizeof(struct sockaddr_in);
2779: #endif
2780: addr.sin_family = AF_INET;
2781: memcpy(&addr.sin_addr, ap, sizeof(addr.sin_addr));
2782: if (getnameinfo((struct sockaddr *)&addr, sizeof(addr),
2783: ntop_buf, sizeof(ntop_buf), NULL, 0,
2784: NI_NUMERICHOST | niflags))
2785: strlcpy(ntop_buf, "?", sizeof(ntop_buf));
2786:
2787: return ntop_buf;
2788: }
2789:
2790: #ifdef INET6
2791: /*
2792: * Return a name for the IP6 address pointed to by ap. This address
2793: * is assumed to be in network byte order.
2794: */
2795: char *
2796: getname6(ap)
2797: const u_char *ap;
2798: {
2799: struct sockaddr_in6 addr;
2800: static char ntop_buf[NI_MAXHOST];
2801:
2802: memset(&addr, 0, sizeof(addr));
2803: addr.sin6_len = sizeof(struct sockaddr_in6);
2804: addr.sin6_family = AF_INET6;
2805: memcpy(&addr.sin6_addr, ap, sizeof(addr.sin6_addr));
2806: if (getnameinfo((struct sockaddr *)&addr, addr.sin6_len,
2807: ntop_buf, sizeof(ntop_buf), NULL, 0,
2808: NI_NUMERICHOST | niflags))
2809: strlcpy(ntop_buf, "?", sizeof(ntop_buf));
2810:
2811: return ntop_buf;
2812: }
2813: #endif /* INET6 */
2814:
2815: int
2816: safeputchar(c)
2817: int c;
2818: {
2819: unsigned char ch;
2820:
2821: ch = (unsigned char)(c & 0xff);
2822: if (c < 0x80 && isprint(c))
2823: return printf("%c", c & 0xff);
2824: else
2825: return printf("\\%03o", c & 0xff);
2826: }
2827:
2828: void
2829: isakmp_printpacket(msg, from, my, decoded)
2830: vchar_t *msg;
2831: struct sockaddr *from;
2832: struct sockaddr *my;
2833: int decoded;
2834: {
2835: #ifdef YIPS_DEBUG
2836: struct timeval tv;
2837: int s;
2838: char hostbuf[NI_MAXHOST];
2839: char portbuf[NI_MAXSERV];
2840: struct isakmp *isakmp;
2841: vchar_t *buf;
2842: #endif
2843:
2844: if (loglevel < LLV_DEBUG)
2845: return;
2846:
2847: #ifdef YIPS_DEBUG
2848: plog(LLV_DEBUG, LOCATION, NULL, "begin.\n");
2849:
2850: gettimeofday(&tv, NULL);
2851: s = tv.tv_sec % 3600;
2852: printf("%02d:%02d.%06u ", s / 60, s % 60, (u_int32_t)tv.tv_usec);
2853:
2854: if (from) {
2855: if (getnameinfo(from, sysdep_sa_len(from), hostbuf, sizeof(hostbuf),
2856: portbuf, sizeof(portbuf),
2857: NI_NUMERICHOST | NI_NUMERICSERV | niflags)) {
2858: strlcpy(hostbuf, "?", sizeof(hostbuf));
2859: strlcpy(portbuf, "?", sizeof(portbuf));
2860: }
2861: printf("%s:%s", hostbuf, portbuf);
2862: } else
2863: printf("?");
2864: printf(" -> ");
2865: if (my) {
2866: if (getnameinfo(my, sysdep_sa_len(my), hostbuf, sizeof(hostbuf),
2867: portbuf, sizeof(portbuf),
2868: NI_NUMERICHOST | NI_NUMERICSERV | niflags)) {
2869: strlcpy(hostbuf, "?", sizeof(hostbuf));
2870: strlcpy(portbuf, "?", sizeof(portbuf));
2871: }
2872: printf("%s:%s", hostbuf, portbuf);
2873: } else
2874: printf("?");
2875: printf(": ");
2876:
2877: buf = vdup(msg);
2878: if (!buf) {
2879: printf("(malloc fail)\n");
2880: return;
2881: }
2882: if (decoded) {
2883: isakmp = (struct isakmp *)buf->v;
2884: if (isakmp->flags & ISAKMP_FLAG_E) {
2885: #if 0
2886: int pad;
2887: pad = *(u_char *)(buf->v + buf->l - 1);
2888: if (buf->l < pad && 2 < vflag)
2889: printf("(wrong padding)");
2890: #endif
2891: isakmp->flags &= ~ISAKMP_FLAG_E;
2892: }
2893: }
2894:
2895: snapend = buf->v + buf->l;
2896: isakmp_print(buf->v, buf->l, NULL);
2897: vfree(buf);
2898: printf("\n");
2899: fflush(stdout);
2900:
2901: return;
2902: #endif
2903: }
2904: #endif /*HAVE_PRINT_ISAKMP_C*/
2905:
2906: int
2907: copy_ph1addresses(iph1, rmconf, remote, local)
2908: struct ph1handle *iph1;
2909: struct remoteconf *rmconf;
2910: struct sockaddr *remote, *local;
2911: {
2912: u_int16_t port;
2913:
2914: /* address portion must be grabbed from real remote address "remote" */
2915: iph1->remote = dupsaddr(remote);
2916: if (iph1->remote == NULL)
2917: return -1;
2918:
2919: /*
2920: * if remote has no port # (in case of initiator - from ACQUIRE msg)
2921: * - if remote.conf specifies port #, use that
2922: * - if remote.conf does not, use 500
2923: * if remote has port # (in case of responder - from recvfrom(2))
2924: * respect content of "remote".
2925: */
2926: if (extract_port(iph1->remote) == 0) {
2927: port = 0;
2928: if (rmconf != NULL)
2929: port = extract_port(rmconf->remote);
2930: if (port == 0)
2931: port = PORT_ISAKMP;
2932: set_port(iph1->remote, port);
2933: }
2934:
2935: if (local == NULL)
2936: iph1->local = getlocaladdr(iph1->remote);
2937: else
2938: iph1->local = dupsaddr(local);
2939: if (iph1->local == NULL)
2940: return -1;
2941:
2942: if (extract_port(iph1->local) == 0) {
2943: port = myaddr_getsport(iph1->local);
2944: if (port == 0)
2945: port = PORT_ISAKMP;
2946: set_port(iph1->local, PORT_ISAKMP);
2947: }
2948:
2949: #ifdef ENABLE_NATT
2950: if (extract_port(iph1->local) == lcconf->port_isakmp_natt) {
2951: plog(LLV_DEBUG, LOCATION, NULL, "Marking ports as changed\n");
2952: iph1->natt_flags |= NAT_ADD_NON_ESP_MARKER;
2953: }
2954: #endif
2955:
2956: return 0;
2957: }
2958:
2959: static int
2960: nostate1(iph1, msg)
2961: struct ph1handle *iph1;
2962: vchar_t *msg;
2963: {
2964: plog(LLV_ERROR, LOCATION, iph1->remote, "wrong state %u.\n",
2965: iph1->status);
2966: return -1;
2967: }
2968:
2969: static int
2970: nostate2(iph2, msg)
2971: struct ph2handle *iph2;
2972: vchar_t *msg;
2973: {
2974: plog(LLV_ERROR, LOCATION, iph2->ph1->remote, "wrong state %u.\n",
2975: iph2->status);
2976: return -1;
2977: }
2978:
2979: void
2980: log_ph1established(iph1)
2981: const struct ph1handle *iph1;
2982: {
2983: char *src, *dst;
2984:
2985: src = racoon_strdup(saddr2str(iph1->local));
2986: dst = racoon_strdup(saddr2str(iph1->remote));
2987: STRDUP_FATAL(src);
2988: STRDUP_FATAL(dst);
2989:
2990: plog(LLV_INFO, LOCATION, NULL,
2991: "ISAKMP-SA established %s-%s spi:%s\n",
2992: src, dst,
2993: isakmp_pindex(&iph1->index, 0));
2994:
2995: evt_phase1(iph1, EVT_PHASE1_UP, NULL);
2996: if(!iph1->rmconf->mode_cfg)
2997: evt_phase1(iph1, EVT_PHASE1_MODE_CFG, NULL);
2998:
2999: racoon_free(src);
3000: racoon_free(dst);
3001:
3002: return;
3003: }
3004:
3005: struct payload_list *
3006: isakmp_plist_append_full (struct payload_list *plist, vchar_t *payload,
3007: u_int8_t payload_type, u_int8_t free_payload)
3008: {
3009: if (! plist) {
3010: plist = racoon_malloc (sizeof (struct payload_list));
3011: plist->prev = NULL;
3012: }
3013: else {
3014: plist->next = racoon_malloc (sizeof (struct payload_list));
3015: plist->next->prev = plist;
3016: plist = plist->next;
3017: }
3018:
3019: plist->next = NULL;
3020: plist->payload = payload;
3021: plist->payload_type = payload_type;
3022: plist->free_payload = free_payload;
3023:
3024: return plist;
3025: }
3026:
3027: vchar_t *
3028: isakmp_plist_set_all (struct payload_list **plist, struct ph1handle *iph1)
3029: {
3030: struct payload_list *ptr = *plist, *first;
3031: size_t tlen = sizeof (struct isakmp), n = 0;
3032: vchar_t *buf = NULL;
3033: char *p;
3034:
3035: /* Seek to the first item. */
3036: while (ptr->prev) ptr = ptr->prev;
3037: first = ptr;
3038:
3039: /* Compute the whole length. */
3040: while (ptr) {
3041: tlen += ptr->payload->l + sizeof (struct isakmp_gen);
3042: ptr = ptr->next;
3043: }
3044:
3045: buf = vmalloc(tlen);
3046: if (buf == NULL) {
3047: plog(LLV_ERROR, LOCATION, NULL,
3048: "failed to get buffer to send.\n");
3049: goto end;
3050: }
3051:
3052: ptr = first;
3053:
3054: p = set_isakmp_header1(buf, iph1, ptr->payload_type);
3055: if (p == NULL)
3056: goto end;
3057:
3058: while (ptr)
3059: {
3060: p = set_isakmp_payload (p, ptr->payload, ptr->next ? ptr->next->payload_type : ISAKMP_NPTYPE_NONE);
3061: first = ptr;
3062: ptr = ptr->next;
3063: if (first->free_payload)
3064: vfree(first->payload);
3065: racoon_free (first);
3066: /* ptr->prev = NULL; first = NULL; ... omitted. */
3067: n++;
3068: }
3069:
3070: *plist = NULL;
3071:
3072: return buf;
3073: end:
3074: if (buf != NULL)
3075: vfree(buf);
3076: return NULL;
3077: }
3078:
3079: #ifdef ENABLE_FRAG
3080: int
3081: frag_handler(iph1, msg, remote, local)
3082: struct ph1handle *iph1;
3083: vchar_t *msg;
3084: struct sockaddr *remote;
3085: struct sockaddr *local;
3086: {
3087: vchar_t *newmsg;
3088:
3089: if (isakmp_frag_extract(iph1, msg) == 1) {
3090: if ((newmsg = isakmp_frag_reassembly(iph1)) == NULL) {
3091: plog(LLV_ERROR, LOCATION, remote,
3092: "Packet reassembly failed\n");
3093: return -1;
3094: }
3095: return isakmp_main(newmsg, remote, local);
3096: }
3097:
3098: return 0;
3099: }
3100: #endif
3101:
3102: void
3103: script_hook(iph1, script)
3104: struct ph1handle *iph1;
3105: int script;
3106: {
3107: #define IP_MAX 40
3108: #define PORT_MAX 6
3109: char addrstr[IP_MAX];
3110: char portstr[PORT_MAX];
3111: char **envp = NULL;
3112: int envc = 1;
3113: char **c;
3114:
3115: if (iph1 == NULL ||
3116: iph1->rmconf == NULL ||
3117: iph1->rmconf->script[script] == NULL)
3118: return;
3119:
3120: #ifdef ENABLE_HYBRID
3121: (void)isakmp_cfg_setenv(iph1, &envp, &envc);
3122: #endif
3123:
3124: /* local address */
3125: GETNAMEINFO(iph1->local, addrstr, portstr);
3126:
3127: if (script_env_append(&envp, &envc, "LOCAL_ADDR", addrstr) != 0) {
3128: plog(LLV_ERROR, LOCATION, NULL, "Cannot set LOCAL_ADDR\n");
3129: goto out;
3130: }
3131:
3132: if (script_env_append(&envp, &envc, "LOCAL_PORT", portstr) != 0) {
3133: plog(LLV_ERROR, LOCATION, NULL, "Cannot set LOCAL_PORT\n");
3134: goto out;
3135: }
3136:
3137: /* Peer address */
3138: if (iph1->remote != NULL) {
3139: GETNAMEINFO(iph1->remote, addrstr, portstr);
3140:
3141: if (script_env_append(&envp, &envc,
3142: "REMOTE_ADDR", addrstr) != 0) {
3143: plog(LLV_ERROR, LOCATION, NULL,
3144: "Cannot set REMOTE_ADDR\n");
3145: goto out;
3146: }
3147:
3148: if (script_env_append(&envp, &envc,
3149: "REMOTE_PORT", portstr) != 0) {
3150: plog(LLV_ERROR, LOCATION, NULL,
3151: "Cannot set REMOTEL_PORT\n");
3152: goto out;
3153: }
3154: }
3155:
3156: /* Peer identity. */
3157: if (iph1->id_p != NULL) {
3158: if (script_env_append(&envp, &envc, "REMOTE_ID",
3159: ipsecdoi_id2str(iph1->id_p)) != 0) {
3160: plog(LLV_ERROR, LOCATION, NULL,
3161: "Cannot set REMOTE_ID\n");
3162: goto out;
3163: }
3164: }
3165:
3166: if (privsep_script_exec(iph1->rmconf->script[script]->v,
3167: script, envp) != 0)
3168: plog(LLV_ERROR, LOCATION, NULL,
3169: "Script %s execution failed\n", script_names[script]);
3170:
3171: out:
3172: for (c = envp; *c; c++)
3173: racoon_free(*c);
3174:
3175: racoon_free(envp);
3176:
3177: return;
3178: }
3179:
3180: int
3181: script_env_append(envp, envc, name, value)
3182: char ***envp;
3183: int *envc;
3184: char *name;
3185: char *value;
3186: {
3187: char *envitem;
3188: char **newenvp;
3189: int newenvc;
3190:
3191: envitem = racoon_malloc(strlen(name) + 1 + strlen(value) + 1);
3192: if (envitem == NULL) {
3193: plog(LLV_ERROR, LOCATION, NULL,
3194: "Cannot allocate memory: %s\n", strerror(errno));
3195: return -1;
3196: }
3197: sprintf(envitem, "%s=%s", name, value);
3198:
3199: newenvc = (*envc) + 1;
3200: newenvp = racoon_realloc(*envp, newenvc * sizeof(char *));
3201: if (newenvp == NULL) {
3202: plog(LLV_ERROR, LOCATION, NULL,
3203: "Cannot allocate memory: %s\n", strerror(errno));
3204: racoon_free(envitem);
3205: return -1;
3206: }
3207:
3208: newenvp[newenvc - 2] = envitem;
3209: newenvp[newenvc - 1] = NULL;
3210:
3211: *envp = newenvp;
3212: *envc = newenvc;
3213: return 0;
3214: }
3215:
3216: int
3217: script_exec(script, name, envp)
3218: char *script;
3219: int name;
3220: char *const envp[];
3221: {
3222: char *argv[] = { NULL, NULL, NULL };
3223:
3224: argv[0] = script;
3225: argv[1] = script_names[name];
3226: argv[2] = NULL;
3227:
3228: switch (fork()) {
3229: case 0:
3230: execve(argv[0], argv, envp);
3231: plog(LLV_ERROR, LOCATION, NULL,
3232: "execve(\"%s\") failed: %s\n",
3233: argv[0], strerror(errno));
3234: _exit(1);
3235: break;
3236: case -1:
3237: plog(LLV_ERROR, LOCATION, NULL,
3238: "Cannot fork: %s\n", strerror(errno));
3239: return -1;
3240: break;
3241: default:
3242: break;
3243: }
3244: return 0;
3245:
3246: }
3247:
3248: void
3249: purge_remote(iph1)
3250: struct ph1handle *iph1;
3251: {
3252: vchar_t *buf = NULL;
3253: struct sadb_msg *msg, *next, *end;
3254: struct sadb_sa *sa;
3255: struct sockaddr *src, *dst;
3256: caddr_t mhp[SADB_EXT_MAX + 1];
3257: u_int proto_id;
3258: struct ph2handle *iph2;
3259: struct ph1handle *new_iph1;
3260:
3261: plog(LLV_INFO, LOCATION, NULL,
3262: "purging ISAKMP-SA spi=%s.\n",
3263: isakmp_pindex(&(iph1->index), iph1->msgid));
3264:
3265: /* Mark as expired. */
3266: iph1->status = PHASE1ST_EXPIRED;
3267:
3268: /* Check if we have another, still valid, phase1 SA. */
3269: new_iph1 = getph1(iph1, iph1->local, iph1->remote, GETPH1_F_ESTABLISHED);
3270:
3271: /*
3272: * Delete all orphaned or binded to the deleting ph1handle phase2 SAs.
3273: * Keep all others phase2 SAs.
3274: */
3275: buf = pfkey_dump_sadb(SADB_SATYPE_UNSPEC);
3276: if (buf == NULL) {
3277: plog(LLV_DEBUG, LOCATION, NULL,
3278: "pfkey_dump_sadb returned nothing.\n");
3279: return;
3280: }
3281:
3282: msg = (struct sadb_msg *)buf->v;
3283: end = (struct sadb_msg *)(buf->v + buf->l);
3284:
3285: while (msg < end) {
3286: if ((msg->sadb_msg_len << 3) < sizeof(*msg))
3287: break;
3288: next = (struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3));
3289: if (msg->sadb_msg_type != SADB_DUMP) {
3290: msg = next;
3291: continue;
3292: }
3293:
3294: if (pfkey_align(msg, mhp) || pfkey_check(mhp)) {
3295: plog(LLV_ERROR, LOCATION, NULL,
3296: "pfkey_check (%s)\n", ipsec_strerror());
3297: msg = next;
3298: continue;
3299: }
3300:
3301: sa = (struct sadb_sa *)(mhp[SADB_EXT_SA]);
3302: if (!sa ||
3303: !mhp[SADB_EXT_ADDRESS_SRC] ||
3304: !mhp[SADB_EXT_ADDRESS_DST]) {
3305: msg = next;
3306: continue;
3307: }
3308: pk_fixup_sa_addresses(mhp);
3309: src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
3310: dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
3311:
3312: if (sa->sadb_sa_state != SADB_SASTATE_LARVAL &&
3313: sa->sadb_sa_state != SADB_SASTATE_MATURE &&
3314: sa->sadb_sa_state != SADB_SASTATE_DYING) {
3315: msg = next;
3316: continue;
3317: }
3318:
3319: /*
3320: * check in/outbound SAs.
3321: * Select only SAs where src == local and dst == remote (outgoing)
3322: * or src == remote and dst == local (incoming).
3323: */
3324: if ((cmpsaddr(iph1->local, src) != CMPSADDR_MATCH ||
3325: cmpsaddr(iph1->remote, dst) != CMPSADDR_MATCH) &&
3326: (cmpsaddr(iph1->local, dst) != CMPSADDR_MATCH ||
3327: cmpsaddr(iph1->remote, src) != CMPSADDR_MATCH)) {
3328: msg = next;
3329: continue;
3330: }
3331:
3332: proto_id = pfkey2ipsecdoi_proto(msg->sadb_msg_satype);
3333: iph2 = getph2bysaidx(src, dst, proto_id, sa->sadb_sa_spi);
3334:
3335: /* Check if there is another valid ISAKMP-SA */
3336: if (new_iph1 != NULL) {
3337:
3338: if (iph2 == NULL) {
3339: /* No handler... still send a pfkey_delete message, but log this !*/
3340: plog(LLV_INFO, LOCATION, NULL,
3341: "Unknown IPsec-SA spi=%u, hmmmm?\n",
3342: ntohl(sa->sadb_sa_spi));
3343: }else{
3344:
3345: /*
3346: * If we have a new ph1, do not purge IPsec-SAs binded
3347: * to a different ISAKMP-SA
3348: */
3349: if (iph2->ph1 != NULL && iph2->ph1 != iph1){
3350: msg = next;
3351: continue;
3352: }
3353:
3354: /* If the ph2handle is established, do not purge IPsec-SA */
3355: if (iph2->status == PHASE2ST_ESTABLISHED ||
3356: iph2->status == PHASE2ST_EXPIRED) {
3357:
3358: plog(LLV_INFO, LOCATION, NULL,
3359: "keeping IPsec-SA spi=%u - found valid ISAKMP-SA spi=%s.\n",
3360: ntohl(sa->sadb_sa_spi),
3361: isakmp_pindex(&(new_iph1->index), new_iph1->msgid));
3362: msg = next;
3363: continue;
3364: }
3365: }
3366: }
3367:
3368:
3369: pfkey_send_delete(lcconf->sock_pfkey,
3370: msg->sadb_msg_satype,
3371: IPSEC_MODE_ANY,
3372: src, dst, sa->sadb_sa_spi);
3373:
3374: /* delete a relative phase 2 handle. */
3375: if (iph2 != NULL) {
3376: delete_spd(iph2, 0);
3377: remph2(iph2);
3378: delph2(iph2);
3379: }
3380:
3381: plog(LLV_INFO, LOCATION, NULL,
3382: "purged IPsec-SA spi=%u.\n",
3383: ntohl(sa->sadb_sa_spi));
3384:
3385: msg = next;
3386: }
3387:
3388: if (buf)
3389: vfree(buf);
3390:
3391: /* Mark the phase1 handler as EXPIRED */
3392: plog(LLV_INFO, LOCATION, NULL,
3393: "purged ISAKMP-SA spi=%s.\n",
3394: isakmp_pindex(&(iph1->index), iph1->msgid));
3395:
3396: isakmp_ph1delete(iph1);
3397: }
3398:
3399: void
3400: delete_spd(iph2, created)
3401: struct ph2handle *iph2;
3402: u_int64_t created;
3403: {
3404: struct policyindex spidx;
3405: struct sockaddr_storage addr;
3406: u_int8_t pref;
3407: struct sockaddr *src;
3408: struct sockaddr *dst;
3409: int error;
3410: int idi2type = 0;/* switch whether copy IDs into id[src,dst]. */
3411:
3412: if (iph2 == NULL)
3413: return;
3414:
3415: /* Delete the SPD entry if we generated it
3416: */
3417: if (! iph2->generated_spidx )
3418: return;
3419:
3420: src = iph2->src;
3421: dst = iph2->dst;
3422:
3423: plog(LLV_INFO, LOCATION, NULL,
3424: "deleting a generated policy.\n");
3425:
3426: memset(&spidx, 0, sizeof(spidx));
3427: iph2->spidx_gen = (caddr_t )&spidx;
3428:
3429: /* make inbound policy */
3430: iph2->src = dst;
3431: iph2->dst = src;
3432: spidx.dir = IPSEC_DIR_INBOUND;
3433: spidx.ul_proto = 0;
3434:
3435: /*
3436: * Note: code from get_proposal_r
3437: */
3438:
3439: #define _XIDT(d) ((struct ipsecdoi_id_b *)(d)->v)->type
3440:
3441: /*
3442: * make destination address in spidx from either ID payload
3443: * or phase 1 address into a address in spidx.
3444: */
3445: if (iph2->id != NULL
3446: && (_XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR
3447: || _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR
3448: || _XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR_SUBNET
3449: || _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR_SUBNET)) {
3450: /* get a destination address of a policy */
3451: error = ipsecdoi_id2sockaddr(iph2->id,
3452: (struct sockaddr *)&spidx.dst,
3453: &spidx.prefd, &spidx.ul_proto);
3454: if (error)
3455: goto purge;
3456:
3457: #ifdef INET6
3458: /*
3459: * get scopeid from the SA address.
3460: * note that the phase 1 source address is used as
3461: * a destination address to search for a inbound
3462: * policy entry because rcoon is responder.
3463: */
3464: if (_XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR) {
3465: if ((error =
3466: setscopeid((struct sockaddr *)&spidx.dst,
3467: iph2->src)) != 0)
3468: goto purge;
3469: }
3470: #endif
3471:
3472: if (_XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR
3473: || _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR)
3474: idi2type = _XIDT(iph2->id);
3475:
3476: } else {
3477:
3478: plog(LLV_DEBUG, LOCATION, NULL,
3479: "get a destination address of SP index "
3480: "from phase1 address "
3481: "due to no ID payloads found "
3482: "OR because ID type is not address.\n");
3483:
3484: /*
3485: * copy the SOURCE address of IKE into the
3486: * DESTINATION address of the key to search the
3487: * SPD because the direction of policy is inbound.
3488: */
3489: memcpy(&spidx.dst, iph2->src, sysdep_sa_len(iph2->src));
3490: switch (spidx.dst.ss_family) {
3491: case AF_INET:
3492: spidx.prefd =
3493: sizeof(struct in_addr) << 3;
3494: break;
3495: #ifdef INET6
3496: case AF_INET6:
3497: spidx.prefd =
3498: sizeof(struct in6_addr) << 3;
3499: break;
3500: #endif
3501: default:
3502: spidx.prefd = 0;
3503: break;
3504: }
3505: }
3506:
3507: /* make source address in spidx */
3508: if (iph2->id_p != NULL
3509: && (_XIDT(iph2->id_p) == IPSECDOI_ID_IPV4_ADDR
3510: || _XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR
3511: || _XIDT(iph2->id_p) == IPSECDOI_ID_IPV4_ADDR_SUBNET
3512: || _XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR_SUBNET)) {
3513: /* get a source address of inbound SA */
3514: error = ipsecdoi_id2sockaddr(iph2->id_p,
3515: (struct sockaddr *)&spidx.src,
3516: &spidx.prefs, &spidx.ul_proto);
3517: if (error)
3518: goto purge;
3519:
3520: #ifdef INET6
3521: /*
3522: * get scopeid from the SA address.
3523: * for more detail, see above of this function.
3524: */
3525: if (_XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR) {
3526: error =
3527: setscopeid((struct sockaddr *)&spidx.src,
3528: iph2->dst);
3529: if (error)
3530: goto purge;
3531: }
3532: #endif
3533:
3534: /* make sa_[src,dst] if both ID types are IP address and same */
3535: if (_XIDT(iph2->id_p) == idi2type
3536: && spidx.dst.ss_family == spidx.src.ss_family) {
3537: iph2->sa_src =
3538: dupsaddr((struct sockaddr *)&spidx.dst);
3539: if (iph2->sa_src == NULL) {
3540: plog(LLV_ERROR, LOCATION, NULL,
3541: "allocation failed\n");
3542: goto purge;
3543: }
3544: iph2->sa_dst =
3545: dupsaddr((struct sockaddr *)&spidx.src);
3546: if (iph2->sa_dst == NULL) {
3547: plog(LLV_ERROR, LOCATION, NULL,
3548: "allocation failed\n");
3549: goto purge;
3550: }
3551: }
3552:
3553: } else {
3554: plog(LLV_DEBUG, LOCATION, NULL,
3555: "get a source address of SP index "
3556: "from phase1 address "
3557: "due to no ID payloads found "
3558: "OR because ID type is not address.\n");
3559:
3560: /* see above comment. */
3561: memcpy(&spidx.src, iph2->dst, sysdep_sa_len(iph2->dst));
3562: switch (spidx.src.ss_family) {
3563: case AF_INET:
3564: spidx.prefs =
3565: sizeof(struct in_addr) << 3;
3566: break;
3567: #ifdef INET6
3568: case AF_INET6:
3569: spidx.prefs =
3570: sizeof(struct in6_addr) << 3;
3571: break;
3572: #endif
3573: default:
3574: spidx.prefs = 0;
3575: break;
3576: }
3577: }
3578:
3579: #undef _XIDT
3580:
3581: plog(LLV_DEBUG, LOCATION, NULL,
3582: "get a src address from ID payload "
3583: "%s prefixlen=%u ul_proto=%u\n",
3584: saddr2str((struct sockaddr *)&spidx.src),
3585: spidx.prefs, spidx.ul_proto);
3586: plog(LLV_DEBUG, LOCATION, NULL,
3587: "get dst address from ID payload "
3588: "%s prefixlen=%u ul_proto=%u\n",
3589: saddr2str((struct sockaddr *)&spidx.dst),
3590: spidx.prefd, spidx.ul_proto);
3591:
3592: /*
3593: * convert the ul_proto if it is 0
3594: * because 0 in ID payload means a wild card.
3595: */
3596: if (spidx.ul_proto == 0)
3597: spidx.ul_proto = IPSEC_ULPROTO_ANY;
3598:
3599: #undef _XIDT
3600:
3601: /* Check if the generated SPD has the same timestamp as the SA.
3602: * If timestamps are different, this means that the SPD entry has been
3603: * refreshed by another SA, and should NOT be deleted with the current SA.
3604: */
3605: if( created ){
3606: struct secpolicy *p;
3607:
3608: p = getsp(&spidx);
3609: if(p != NULL){
3610: /* just do no test if p is NULL, because this probably just means
3611: * that the policy has already be deleted for some reason.
3612: */
3613: if(p->spidx.created != created)
3614: goto purge;
3615: }
3616: }
3617:
3618: /* End of code from get_proposal_r
3619: */
3620:
3621: if (pk_sendspddelete(iph2) < 0) {
3622: plog(LLV_ERROR, LOCATION, NULL,
3623: "pfkey spddelete(inbound) failed.\n");
3624: }else{
3625: plog(LLV_DEBUG, LOCATION, NULL,
3626: "pfkey spddelete(inbound) sent.\n");
3627: }
3628:
3629: #ifdef HAVE_POLICY_FWD
3630: /* make forward policy if required */
3631: if (tunnel_mode_prop(iph2->approval)) {
3632: spidx.dir = IPSEC_DIR_FWD;
3633: if (pk_sendspddelete(iph2) < 0) {
3634: plog(LLV_ERROR, LOCATION, NULL,
3635: "pfkey spddelete(forward) failed.\n");
3636: }else{
3637: plog(LLV_DEBUG, LOCATION, NULL,
3638: "pfkey spddelete(forward) sent.\n");
3639: }
3640: }
3641: #endif
3642:
3643: /* make outbound policy */
3644: iph2->src = src;
3645: iph2->dst = dst;
3646: spidx.dir = IPSEC_DIR_OUTBOUND;
3647: addr = spidx.src;
3648: spidx.src = spidx.dst;
3649: spidx.dst = addr;
3650: pref = spidx.prefs;
3651: spidx.prefs = spidx.prefd;
3652: spidx.prefd = pref;
3653:
3654: if (pk_sendspddelete(iph2) < 0) {
3655: plog(LLV_ERROR, LOCATION, NULL,
3656: "pfkey spddelete(outbound) failed.\n");
3657: }else{
3658: plog(LLV_DEBUG, LOCATION, NULL,
3659: "pfkey spddelete(outbound) sent.\n");
3660: }
3661: purge:
3662: iph2->spidx_gen=NULL;
3663: }
3664:
3665:
3666: #ifdef INET6
3667: u_int32_t
3668: setscopeid(sp_addr0, sa_addr0)
3669: struct sockaddr *sp_addr0, *sa_addr0;
3670: {
3671: struct sockaddr_in6 *sp_addr, *sa_addr;
3672:
3673: sp_addr = (struct sockaddr_in6 *)sp_addr0;
3674: sa_addr = (struct sockaddr_in6 *)sa_addr0;
3675:
3676: if (!IN6_IS_ADDR_LINKLOCAL(&sp_addr->sin6_addr)
3677: && !IN6_IS_ADDR_SITELOCAL(&sp_addr->sin6_addr)
3678: && !IN6_IS_ADDR_MULTICAST(&sp_addr->sin6_addr))
3679: return 0;
3680:
3681: /* this check should not be here ? */
3682: if (sa_addr->sin6_family != AF_INET6) {
3683: plog(LLV_ERROR, LOCATION, NULL,
3684: "can't get scope ID: family mismatch\n");
3685: return -1;
3686: }
3687:
3688: if (!IN6_IS_ADDR_LINKLOCAL(&sa_addr->sin6_addr)) {
3689: plog(LLV_ERROR, LOCATION, NULL,
3690: "scope ID is not supported except of lladdr.\n");
3691: return -1;
3692: }
3693:
3694: sp_addr->sin6_scope_id = sa_addr->sin6_scope_id;
3695:
3696: return 0;
3697: }
3698: #endif