1: /* $NetBSD: isakmp_inf.c,v 1.47 2011/03/15 13:20:14 vanhu Exp $ */
2:
3: /* Id: isakmp_inf.c,v 1.44 2006/05/06 20:45:52 manubsd Exp */
4:
5: /*
6: * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
7: * All rights reserved.
8: *
9: * Redistribution and use in source and binary forms, with or without
10: * modification, are permitted provided that the following conditions
11: * are met:
12: * 1. Redistributions of source code must retain the above copyright
13: * notice, this list of conditions and the following disclaimer.
14: * 2. Redistributions in binary form must reproduce the above copyright
15: * notice, this list of conditions and the following disclaimer in the
16: * documentation and/or other materials provided with the distribution.
17: * 3. Neither the name of the project nor the names of its contributors
18: * may be used to endorse or promote products derived from this software
19: * without specific prior written permission.
20: *
21: * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22: * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23: * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24: * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25: * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26: * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27: * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28: * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29: * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30: * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31: * SUCH DAMAGE.
32: */
33:
34: #include "config.h"
35:
36: #include <sys/types.h>
37: #include <sys/param.h>
38: #include <sys/socket.h>
39:
40: #include <net/pfkeyv2.h>
41: #include <netinet/in.h>
42: #include <sys/queue.h>
43: #include PATH_IPSEC_H
44:
45: #include <stdlib.h>
46: #include <stdio.h>
47: #include <string.h>
48: #include <errno.h>
49: #if TIME_WITH_SYS_TIME
50: # include <sys/time.h>
51: # include <time.h>
52: #else
53: # if HAVE_SYS_TIME_H
54: # include <sys/time.h>
55: # else
56: # include <time.h>
57: # endif
58: #endif
59: #ifdef ENABLE_HYBRID
60: #include <resolv.h>
61: #endif
62:
63: #include "libpfkey.h"
64:
65: #include "var.h"
66: #include "vmbuf.h"
67: #include "schedule.h"
68: #include "str2val.h"
69: #include "misc.h"
70: #include "plog.h"
71: #include "debug.h"
72:
73: #include "localconf.h"
74: #include "remoteconf.h"
75: #include "sockmisc.h"
76: #include "handler.h"
77: #include "policy.h"
78: #include "proposal.h"
79: #include "isakmp_var.h"
80: #include "evt.h"
81: #include "isakmp.h"
82: #ifdef ENABLE_HYBRID
83: #include "isakmp_xauth.h"
84: #include "isakmp_unity.h"
85: #include "isakmp_cfg.h"
86: #endif
87: #include "isakmp_inf.h"
88: #include "oakley.h"
89: #include "ipsec_doi.h"
90: #include "crypto_openssl.h"
91: #include "pfkey.h"
92: #include "policy.h"
93: #include "algorithm.h"
94: #include "proposal.h"
95: #include "admin.h"
96: #include "strnames.h"
97: #ifdef ENABLE_NATT
98: #include "nattraversal.h"
99: #endif
100:
101: /* information exchange */
102: static int isakmp_info_recv_n (struct ph1handle *, struct isakmp_pl_n *, u_int32_t, int);
103: static int isakmp_info_recv_d (struct ph1handle *, struct isakmp_pl_d *, u_int32_t, int);
104:
105: #ifdef ENABLE_DPD
106: static int isakmp_info_recv_r_u __P((struct ph1handle *,
107: struct isakmp_pl_ru *, u_int32_t));
108: static int isakmp_info_recv_r_u_ack __P((struct ph1handle *,
109: struct isakmp_pl_ru *, u_int32_t));
110: static void isakmp_info_send_r_u __P((struct sched *));
111: #endif
112:
113: static void purge_isakmp_spi __P((int, isakmp_index *, size_t));
114:
115: /* %%%
116: * Information Exchange
117: */
118: /*
119: * receive Information
120: */
121: int
122: isakmp_info_recv(iph1, msg0)
123: struct ph1handle *iph1;
124: vchar_t *msg0;
125: {
126: vchar_t *msg = NULL;
127: vchar_t *pbuf = NULL;
128: u_int32_t msgid = 0;
129: int error = -1;
130: struct isakmp *isakmp;
131: struct isakmp_gen *gen;
132: struct isakmp_parse_t *pa, *pap;
133: void *p;
134: vchar_t *hash, *payload;
135: struct isakmp_gen *nd;
136: u_int8_t np;
137: int encrypted;
138:
139: plog(LLV_DEBUG, LOCATION, NULL, "receive Information.\n");
140:
141: encrypted = ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E);
142: msgid = ((struct isakmp *)msg0->v)->msgid;
143:
144: /* Use new IV to decrypt Informational message. */
145: if (encrypted) {
146: struct isakmp_ivm *ivm;
147:
148: if (iph1->ivm == NULL) {
149: plog(LLV_ERROR, LOCATION, NULL, "iph1->ivm == NULL\n");
150: return -1;
151: }
152:
153: /* compute IV */
154: ivm = oakley_newiv2(iph1, ((struct isakmp *)msg0->v)->msgid);
155: if (ivm == NULL)
156: return -1;
157:
158: msg = oakley_do_decrypt(iph1, msg0, ivm->iv, ivm->ive);
159: oakley_delivm(ivm);
160: if (msg == NULL)
161: return -1;
162:
163: } else
164: msg = vdup(msg0);
165:
166: /* Safety check */
167: if (msg->l < sizeof(*isakmp) + sizeof(*gen)) {
168: plog(LLV_ERROR, LOCATION, NULL,
169: "ignore information because the "
170: "message is way too short - %zu byte(s).\n",
171: msg->l);
172: goto end;
173: }
174:
175: isakmp = (struct isakmp *)msg->v;
176: gen = (struct isakmp_gen *)((caddr_t)isakmp + sizeof(struct isakmp));
177: np = gen->np;
178:
179: if (encrypted) {
180: if (isakmp->np != ISAKMP_NPTYPE_HASH) {
181: plog(LLV_ERROR, LOCATION, NULL,
182: "ignore information because the "
183: "message has no hash payload.\n");
184: goto end;
185: }
186:
187: if (iph1->status != PHASE1ST_ESTABLISHED &&
188: iph1->status != PHASE1ST_DYING) {
189: plog(LLV_ERROR, LOCATION, NULL,
190: "ignore information because ISAKMP-SA "
191: "has not been established yet.\n");
192: goto end;
193: }
194:
195: /* Safety check */
196: if (msg->l < sizeof(*isakmp) + ntohs(gen->len) + sizeof(*nd)) {
197: plog(LLV_ERROR, LOCATION, NULL,
198: "ignore information because the "
199: "message is too short - %zu byte(s).\n",
200: msg->l);
201: goto end;
202: }
203:
204: p = (caddr_t) gen + sizeof(struct isakmp_gen);
205: nd = (struct isakmp_gen *) ((caddr_t) gen + ntohs(gen->len));
206:
207: /* nd length check */
208: if (ntohs(nd->len) > msg->l - (sizeof(struct isakmp) +
209: ntohs(gen->len))) {
210: plog(LLV_ERROR, LOCATION, NULL,
211: "too long payload length (broken message?)\n");
212: goto end;
213: }
214:
215: if (ntohs(nd->len) < sizeof(*nd)) {
216: plog(LLV_ERROR, LOCATION, NULL,
217: "too short payload length (broken message?)\n");
218: goto end;
219: }
220:
221: payload = vmalloc(ntohs(nd->len));
222: if (payload == NULL) {
223: plog(LLV_ERROR, LOCATION, NULL,
224: "cannot allocate memory\n");
225: goto end;
226: }
227:
228: memcpy(payload->v, (caddr_t) nd, ntohs(nd->len));
229:
230: /* compute HASH */
231: hash = oakley_compute_hash1(iph1, isakmp->msgid, payload);
232: if (hash == NULL) {
233: plog(LLV_ERROR, LOCATION, NULL,
234: "cannot compute hash\n");
235:
236: vfree(payload);
237: goto end;
238: }
239:
240: if (ntohs(gen->len) - sizeof(struct isakmp_gen) != hash->l) {
241: plog(LLV_ERROR, LOCATION, NULL,
242: "ignore information due to hash length mismatch\n");
243:
244: vfree(hash);
245: vfree(payload);
246: goto end;
247: }
248:
249: if (memcmp(p, hash->v, hash->l) != 0) {
250: plog(LLV_ERROR, LOCATION, NULL,
251: "ignore information due to hash mismatch\n");
252:
253: vfree(hash);
254: vfree(payload);
255: goto end;
256: }
257:
258: plog(LLV_DEBUG, LOCATION, NULL, "hash validated.\n");
259:
260: vfree(hash);
261: vfree(payload);
262: } else {
263: /* make sure the packet was encrypted after the beginning of phase 1. */
264: switch (iph1->etype) {
265: case ISAKMP_ETYPE_AGG:
266: case ISAKMP_ETYPE_BASE:
267: case ISAKMP_ETYPE_IDENT:
268: if ((iph1->side == INITIATOR && iph1->status < PHASE1ST_MSG3SENT)
269: || (iph1->side == RESPONDER && iph1->status < PHASE1ST_MSG2SENT)) {
270: break;
271: }
272: /*FALLTHRU*/
273: default:
274: plog(LLV_ERROR, LOCATION, iph1->remote,
275: "%s message must be encrypted\n",
276: s_isakmp_nptype(np));
277: error = 0;
278: goto end;
279: }
280: }
281:
282: if (!(pbuf = isakmp_parse(msg))) {
283: error = -1;
284: goto end;
285: }
286:
287: error = 0;
288: for (pa = (struct isakmp_parse_t *)pbuf->v; pa->type; pa++) {
289: switch (pa->type) {
290: case ISAKMP_NPTYPE_HASH:
291: /* Handled above */
292: break;
293: case ISAKMP_NPTYPE_N:
294: error = isakmp_info_recv_n(iph1,
295: (struct isakmp_pl_n *)pa->ptr,
296: msgid, encrypted);
297: break;
298: case ISAKMP_NPTYPE_D:
299: error = isakmp_info_recv_d(iph1,
300: (struct isakmp_pl_d *)pa->ptr,
301: msgid, encrypted);
302: break;
303: case ISAKMP_NPTYPE_NONCE:
304: /* XXX to be 6.4.2 ike-01.txt */
305: /* XXX IV is to be synchronized. */
306: plog(LLV_ERROR, LOCATION, iph1->remote,
307: "ignore Acknowledged Informational\n");
308: break;
309: default:
310: /* don't send information, see isakmp_ident_r1() */
311: error = 0;
312: plog(LLV_ERROR, LOCATION, iph1->remote,
313: "reject the packet, "
314: "received unexpected payload type %s.\n",
315: s_isakmp_nptype(gen->np));
316: }
317: if (error < 0)
318: break;
319: }
320: end:
321: if (msg != NULL)
322: vfree(msg);
323: if (pbuf != NULL)
324: vfree(pbuf);
325: return error;
326: }
327:
328:
329: /*
330: * log unhandled / unallowed Notification payload
331: */
332: int
333: isakmp_log_notify(iph1, notify, exchange)
334: struct ph1handle *iph1;
335: struct isakmp_pl_n *notify;
336: const char *exchange;
337: {
338: u_int type;
339: char *nraw, *ndata, *nhex;
340: size_t l;
341:
342: type = ntohs(notify->type);
343: if (ntohs(notify->h.len) < sizeof(*notify) + notify->spi_size) {
344: plog(LLV_ERROR, LOCATION, iph1->remote,
345: "invalid spi_size in %s notification in %s.\n",
346: s_isakmp_notify_msg(type), exchange);
347: return -1;
348: }
349:
350: plog(LLV_ERROR, LOCATION, iph1->remote,
351: "notification %s received in %s.\n",
352: s_isakmp_notify_msg(type), exchange);
353:
354: nraw = ((char*) notify) + sizeof(*notify) + notify->spi_size;
355: l = ntohs(notify->h.len) - sizeof(*notify) - notify->spi_size;
356: if (l > 0) {
357: if (type >= ISAKMP_NTYPE_MINERROR &&
358: type <= ISAKMP_NTYPE_MAXERROR) {
359: ndata = binsanitize(nraw, l);
360: if (ndata != NULL) {
361: plog(LLV_ERROR, LOCATION, iph1->remote,
362: "error message: '%s'.\n",
363: ndata);
364: racoon_free(ndata);
365: } else {
366: plog(LLV_ERROR, LOCATION, iph1->remote,
367: "Cannot allocate memory\n");
368: }
369: } else {
370: nhex = val2str(nraw, l);
371: if (nhex != NULL) {
372: plog(LLV_ERROR, LOCATION, iph1->remote,
373: "notification payload: %s.\n",
374: nhex);
375: racoon_free(nhex);
376: } else {
377: plog(LLV_ERROR, LOCATION, iph1->remote,
378: "Cannot allocate memory\n");
379: }
380: }
381: }
382:
383: return 0;
384: }
385:
386:
387: /*
388: * handling of Notification payload
389: */
390: static int
391: isakmp_info_recv_n(iph1, notify, msgid, encrypted)
392: struct ph1handle *iph1;
393: struct isakmp_pl_n *notify;
394: u_int32_t msgid;
395: int encrypted;
396: {
397: u_int type;
398:
399: type = ntohs(notify->type);
400: switch (type) {
401: case ISAKMP_NTYPE_CONNECTED:
402: case ISAKMP_NTYPE_RESPONDER_LIFETIME:
403: case ISAKMP_NTYPE_REPLAY_STATUS:
404: #ifdef ENABLE_HYBRID
405: case ISAKMP_NTYPE_UNITY_HEARTBEAT:
406: #endif
407: /* do something */
408: break;
409: case ISAKMP_NTYPE_INITIAL_CONTACT:
410: if (encrypted)
411: return isakmp_info_recv_initialcontact(iph1, NULL);
412: break;
413: #ifdef ENABLE_DPD
414: case ISAKMP_NTYPE_R_U_THERE:
415: if (encrypted)
416: return isakmp_info_recv_r_u(iph1,
417: (struct isakmp_pl_ru *)notify, msgid);
418: break;
419: case ISAKMP_NTYPE_R_U_THERE_ACK:
420: if (encrypted)
421: return isakmp_info_recv_r_u_ack(iph1,
422: (struct isakmp_pl_ru *)notify, msgid);
423: break;
424: #endif
425: }
426:
427: /* If we receive a error notification we should delete the related
428: * phase1 / phase2 handle, and send an event to racoonctl.
429: * However, since phase1 error notifications are not encrypted and
430: * can not be authenticated, it would allow a DoS attack possibility
431: * to handle them.
432: * Phase2 error notifications should be encrypted, so we could handle
433: * those, but it needs implementing (the old code didn't implement
434: * that either).
435: * So we are good to just log the messages here.
436: */
437: if (encrypted)
438: isakmp_log_notify(iph1, notify, "informational exchange");
439: else
440: isakmp_log_notify(iph1, notify, "unencrypted informational exchange");
441:
442: return 0;
443: }
444:
445: /*
446: * handling of Deletion payload
447: */
448: static int
449: isakmp_info_recv_d(iph1, delete, msgid, encrypted)
450: struct ph1handle *iph1;
451: struct isakmp_pl_d *delete;
452: u_int32_t msgid;
453: int encrypted;
454: {
455: int tlen, num_spi;
456: vchar_t *pbuf;
457: int protected = 0;
458: struct ph1handle *del_ph1;
459: struct ph2handle *iph2;
460: union {
461: u_int32_t spi32;
462: u_int16_t spi16[2];
463: } spi;
464:
465: if (ntohl(delete->doi) != IPSEC_DOI) {
466: plog(LLV_ERROR, LOCATION, iph1->remote,
467: "delete payload with invalid doi:%d.\n",
468: ntohl(delete->doi));
469: #ifdef ENABLE_HYBRID
470: /*
471: * At deconnexion time, Cisco VPN client does this
472: * with a zero DOI. Don't give up in that situation.
473: */
474: if (((iph1->mode_cfg->flags &
475: ISAKMP_CFG_VENDORID_UNITY) == 0) || (delete->doi != 0))
476: return 0;
477: #else
478: return 0;
479: #endif
480: }
481:
482: num_spi = ntohs(delete->num_spi);
483: tlen = ntohs(delete->h.len) - sizeof(struct isakmp_pl_d);
484:
485: if (tlen != num_spi * delete->spi_size) {
486: plog(LLV_ERROR, LOCATION, iph1->remote,
487: "deletion payload with invalid length.\n");
488: return 0;
489: }
490:
491: plog(LLV_DEBUG, LOCATION, iph1->remote,
492: "delete payload for protocol %s\n",
493: s_ipsecdoi_proto(delete->proto_id));
494:
495: if(!iph1->rmconf->weak_phase1_check && !encrypted) {
496: plog(LLV_WARNING, LOCATION, iph1->remote,
497: "Ignoring unencrypted delete payload "
498: "(check the weak_phase1_check option)\n");
499: return 0;
500: }
501:
502: switch (delete->proto_id) {
503: case IPSECDOI_PROTO_ISAKMP:
504: if (delete->spi_size != sizeof(isakmp_index)) {
505: plog(LLV_ERROR, LOCATION, iph1->remote,
506: "delete payload with strange spi "
507: "size %d(proto_id:%d)\n",
508: delete->spi_size, delete->proto_id);
509: return 0;
510: }
511:
512: del_ph1=getph1byindex((isakmp_index *)(delete + 1));
513: if(del_ph1 != NULL){
514:
515: evt_phase1(iph1, EVT_PHASE1_PEER_DELETED, NULL);
516: sched_cancel(&del_ph1->scr);
517:
518: /*
519: * Delete also IPsec-SAs if rekeying is enabled.
520: */
521: if (ph1_rekey_enabled(del_ph1))
522: purge_remote(del_ph1);
523: else
524: isakmp_ph1expire(del_ph1);
525: }
526: break;
527:
528: case IPSECDOI_PROTO_IPSEC_AH:
529: case IPSECDOI_PROTO_IPSEC_ESP:
530: if (delete->spi_size != sizeof(u_int32_t)) {
531: plog(LLV_ERROR, LOCATION, iph1->remote,
532: "delete payload with strange spi "
533: "size %d(proto_id:%d)\n",
534: delete->spi_size, delete->proto_id);
535: return 0;
536: }
537: purge_ipsec_spi(iph1->remote, delete->proto_id,
538: (u_int32_t *)(delete + 1), num_spi);
539: break;
540:
541: case IPSECDOI_PROTO_IPCOMP:
542: /* need to handle both 16bit/32bit SPI */
543: memset(&spi, 0, sizeof(spi));
544: if (delete->spi_size == sizeof(spi.spi16[1])) {
545: memcpy(&spi.spi16[1], delete + 1,
546: sizeof(spi.spi16[1]));
547: } else if (delete->spi_size == sizeof(spi.spi32))
548: memcpy(&spi.spi32, delete + 1, sizeof(spi.spi32));
549: else {
550: plog(LLV_ERROR, LOCATION, iph1->remote,
551: "delete payload with strange spi "
552: "size %d(proto_id:%d)\n",
553: delete->spi_size, delete->proto_id);
554: return 0;
555: }
556: purge_ipsec_spi(iph1->remote, delete->proto_id,
557: &spi.spi32, num_spi);
558: break;
559:
560: default:
561: plog(LLV_ERROR, LOCATION, iph1->remote,
562: "deletion message received, "
563: "invalid proto_id: %d\n",
564: delete->proto_id);
565: return 0;
566: }
567:
568: plog(LLV_DEBUG, LOCATION, NULL, "purged SAs.\n");
569:
570: return 0;
571: }
572:
573: /*
574: * send Delete payload (for ISAKMP SA) in Informational exchange.
575: */
576: int
577: isakmp_info_send_d1(iph1)
578: struct ph1handle *iph1;
579: {
580: struct isakmp_pl_d *d;
581: vchar_t *payload = NULL;
582: int tlen;
583: int error = 0;
584:
585: if (iph1->status != PHASE2ST_ESTABLISHED)
586: return 0;
587:
588: /* create delete payload */
589:
590: /* send SPIs of inbound SAs. */
591: /* XXX should send outbound SAs's ? */
592: tlen = sizeof(*d) + sizeof(isakmp_index);
593: payload = vmalloc(tlen);
594: if (payload == NULL) {
595: plog(LLV_ERROR, LOCATION, NULL,
596: "failed to get buffer for payload.\n");
597: return errno;
598: }
599:
600: d = (struct isakmp_pl_d *)payload->v;
601: d->h.np = ISAKMP_NPTYPE_NONE;
602: d->h.len = htons(tlen);
603: d->doi = htonl(IPSEC_DOI);
604: d->proto_id = IPSECDOI_PROTO_ISAKMP;
605: d->spi_size = sizeof(isakmp_index);
606: d->num_spi = htons(1);
607: memcpy(d + 1, &iph1->index, sizeof(isakmp_index));
608:
609: error = isakmp_info_send_common(iph1, payload,
610: ISAKMP_NPTYPE_D, 0);
611: vfree(payload);
612:
613: return error;
614: }
615:
616: /*
617: * send Delete payload (for IPsec SA) in Informational exchange, based on
618: * pfkey msg. It sends always single SPI.
619: */
620: int
621: isakmp_info_send_d2(iph2)
622: struct ph2handle *iph2;
623: {
624: struct ph1handle *iph1;
625: struct saproto *pr;
626: struct isakmp_pl_d *d;
627: vchar_t *payload = NULL;
628: int tlen;
629: int error = 0;
630: u_int8_t *spi;
631:
632: if (iph2->status != PHASE2ST_ESTABLISHED)
633: return 0;
634:
635: /*
636: * don't send delete information if there is no phase 1 handler.
637: * It's nonsensical to negotiate phase 1 to send the information.
638: */
639: iph1 = getph1byaddr(iph2->src, iph2->dst, 0);
640: if (iph1 == NULL){
641: plog(LLV_DEBUG2, LOCATION, NULL,
642: "No ph1 handler found, could not send DELETE_SA\n");
643: return 0;
644: }
645:
646: /* create delete payload */
647: for (pr = iph2->approval->head; pr != NULL; pr = pr->next) {
648:
649: /* send SPIs of inbound SAs. */
650: /*
651: * XXX should I send outbound SAs's ?
652: * I send inbound SAs's SPI only at the moment because I can't
653: * decode any more if peer send encoded packet without aware of
654: * deletion of SA. Outbound SAs don't come under the situation.
655: */
656: tlen = sizeof(*d) + pr->spisize;
657: payload = vmalloc(tlen);
658: if (payload == NULL) {
659: plog(LLV_ERROR, LOCATION, NULL,
660: "failed to get buffer for payload.\n");
661: return errno;
662: }
663:
664: d = (struct isakmp_pl_d *)payload->v;
665: d->h.np = ISAKMP_NPTYPE_NONE;
666: d->h.len = htons(tlen);
667: d->doi = htonl(IPSEC_DOI);
668: d->proto_id = pr->proto_id;
669: d->spi_size = pr->spisize;
670: d->num_spi = htons(1);
671: /*
672: * XXX SPI bits are left-filled, for use with IPComp.
673: * we should be switching to variable-length spi field...
674: */
675: spi = (u_int8_t *)&pr->spi;
676: spi += sizeof(pr->spi);
677: spi -= pr->spisize;
678: memcpy(d + 1, spi, pr->spisize);
679:
680: error = isakmp_info_send_common(iph1, payload,
681: ISAKMP_NPTYPE_D, 0);
682: vfree(payload);
683: }
684:
685: return error;
686: }
687:
688: /*
689: * send Notification payload (for without ISAKMP SA) in Informational exchange
690: */
691: int
692: isakmp_info_send_nx(isakmp, remote, local, type, data)
693: struct isakmp *isakmp;
694: struct sockaddr *remote, *local;
695: int type;
696: vchar_t *data;
697: {
698: struct ph1handle *iph1 = NULL;
699: vchar_t *payload = NULL;
700: int tlen;
701: int error = -1;
702: struct isakmp_pl_n *n;
703: int spisiz = 0; /* see below */
704:
705: /* add new entry to isakmp status table. */
706: iph1 = newph1();
707: if (iph1 == NULL)
708: return -1;
709:
710: memcpy(&iph1->index.i_ck, &isakmp->i_ck, sizeof(cookie_t));
711: isakmp_newcookie((char *)&iph1->index.r_ck, remote, local);
712: iph1->status = PHASE1ST_START;
713: iph1->side = INITIATOR;
714: iph1->version = isakmp->v;
715: iph1->flags = 0;
716: iph1->msgid = 0; /* XXX */
717: #ifdef ENABLE_HYBRID
718: if ((iph1->mode_cfg = isakmp_cfg_mkstate()) == NULL)
719: goto end;
720: #endif
721: #ifdef ENABLE_FRAG
722: iph1->frag = 0;
723: iph1->frag_chain = NULL;
724: #endif
725:
726: /* copy remote address */
727: if (copy_ph1addresses(iph1, NULL, remote, local) < 0)
728: goto end;
729:
730: tlen = sizeof(*n) + spisiz;
731: if (data)
732: tlen += data->l;
733: payload = vmalloc(tlen);
734: if (payload == NULL) {
735: plog(LLV_ERROR, LOCATION, NULL,
736: "failed to get buffer to send.\n");
737: goto end;
738: }
739:
740: n = (struct isakmp_pl_n *)payload->v;
741: n->h.np = ISAKMP_NPTYPE_NONE;
742: n->h.len = htons(tlen);
743: n->doi = htonl(IPSEC_DOI);
744: n->proto_id = IPSECDOI_KEY_IKE;
745: n->spi_size = spisiz;
746: n->type = htons(type);
747: if (spisiz)
748: memset(n + 1, 0, spisiz); /* XXX spisiz is always 0 */
749: if (data)
750: memcpy((caddr_t)(n + 1) + spisiz, data->v, data->l);
751:
752: error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 0);
753: vfree(payload);
754:
755: end:
756: if (iph1 != NULL)
757: delph1(iph1);
758:
759: return error;
760: }
761:
762: /*
763: * send Notification payload (for ISAKMP SA) in Informational exchange
764: */
765: int
766: isakmp_info_send_n1(iph1, type, data)
767: struct ph1handle *iph1;
768: int type;
769: vchar_t *data;
770: {
771: vchar_t *payload = NULL;
772: int tlen;
773: int error = 0;
774: struct isakmp_pl_n *n;
775: int spisiz;
776:
777: /*
778: * note on SPI size: which description is correct? I have chosen
779: * this to be 0.
780: *
781: * RFC2408 3.1, 2nd paragraph says: ISAKMP SA is identified by
782: * Initiator/Responder cookie and SPI has no meaning, SPI size = 0.
783: * RFC2408 3.1, first paragraph on page 40: ISAKMP SA is identified
784: * by cookie and SPI has no meaning, 0 <= SPI size <= 16.
785: * RFC2407 4.6.3.3, INITIAL-CONTACT is required to set to 16.
786: */
787: if (type == ISAKMP_NTYPE_INITIAL_CONTACT)
788: spisiz = sizeof(isakmp_index);
789: else
790: spisiz = 0;
791:
792: tlen = sizeof(*n) + spisiz;
793: if (data)
794: tlen += data->l;
795: payload = vmalloc(tlen);
796: if (payload == NULL) {
797: plog(LLV_ERROR, LOCATION, NULL,
798: "failed to get buffer to send.\n");
799: return errno;
800: }
801:
802: n = (struct isakmp_pl_n *)payload->v;
803: n->h.np = ISAKMP_NPTYPE_NONE;
804: n->h.len = htons(tlen);
805: n->doi = htonl(iph1->rmconf->doitype);
806: n->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX to be configurable ? */
807: n->spi_size = spisiz;
808: n->type = htons(type);
809: if (spisiz)
810: memcpy(n + 1, &iph1->index, sizeof(isakmp_index));
811: if (data)
812: memcpy((caddr_t)(n + 1) + spisiz, data->v, data->l);
813:
814: error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, iph1->flags);
815: vfree(payload);
816:
817: return error;
818: }
819:
820: /*
821: * send Notification payload (for IPsec SA) in Informational exchange
822: */
823: int
824: isakmp_info_send_n2(iph2, type, data)
825: struct ph2handle *iph2;
826: int type;
827: vchar_t *data;
828: {
829: struct ph1handle *iph1 = iph2->ph1;
830: vchar_t *payload = NULL;
831: int tlen;
832: int error = 0;
833: struct isakmp_pl_n *n;
834: struct saproto *pr;
835:
836: if (!iph2->approval)
837: return EINVAL;
838:
839: pr = iph2->approval->head;
840:
841: /* XXX must be get proper spi */
842: tlen = sizeof(*n) + pr->spisize;
843: if (data)
844: tlen += data->l;
845: payload = vmalloc(tlen);
846: if (payload == NULL) {
847: plog(LLV_ERROR, LOCATION, NULL,
848: "failed to get buffer to send.\n");
849: return errno;
850: }
851:
852: n = (struct isakmp_pl_n *)payload->v;
853: n->h.np = ISAKMP_NPTYPE_NONE;
854: n->h.len = htons(tlen);
855: n->doi = htonl(IPSEC_DOI); /* IPSEC DOI (1) */
856: n->proto_id = pr->proto_id; /* IPSEC AH/ESP/whatever*/
857: n->spi_size = pr->spisize;
858: n->type = htons(type);
859: *(u_int32_t *)(n + 1) = pr->spi;
860: if (data)
861: memcpy((caddr_t)(n + 1) + pr->spisize, data->v, data->l);
862:
863: iph2->flags |= ISAKMP_FLAG_E; /* XXX Should we do FLAG_A ? */
864: error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, iph2->flags);
865: vfree(payload);
866:
867: return error;
868: }
869:
870: /*
871: * send Information
872: * When ph1->skeyid_a == NULL, send message without encoding.
873: */
874: int
875: isakmp_info_send_common(iph1, payload, np, flags)
876: struct ph1handle *iph1;
877: vchar_t *payload;
878: u_int32_t np;
879: int flags;
880: {
881: struct ph2handle *iph2 = NULL;
882: vchar_t *hash = NULL;
883: struct isakmp *isakmp;
884: struct isakmp_gen *gen;
885: char *p;
886: int tlen;
887: int error = -1;
888:
889: /* add new entry to isakmp status table */
890: iph2 = newph2();
891: if (iph2 == NULL)
892: goto end;
893:
894: iph2->dst = dupsaddr(iph1->remote);
895: if (iph2->dst == NULL) {
896: delph2(iph2);
897: goto end;
898: }
899: iph2->src = dupsaddr(iph1->local);
900: if (iph2->src == NULL) {
901: delph2(iph2);
902: goto end;
903: }
904: iph2->side = INITIATOR;
905: iph2->status = PHASE2ST_START;
906: iph2->msgid = isakmp_newmsgid2(iph1);
907:
908: /* get IV and HASH(1) if skeyid_a was generated. */
909: if (iph1->skeyid_a != NULL) {
910: iph2->ivm = oakley_newiv2(iph1, iph2->msgid);
911: if (iph2->ivm == NULL) {
912: delph2(iph2);
913: goto end;
914: }
915:
916: /* generate HASH(1) */
917: hash = oakley_compute_hash1(iph1, iph2->msgid, payload);
918: if (hash == NULL) {
919: delph2(iph2);
920: goto end;
921: }
922:
923: /* initialized total buffer length */
924: tlen = hash->l;
925: tlen += sizeof(*gen);
926: } else {
927: /* IKE-SA is not established */
928: hash = NULL;
929:
930: /* initialized total buffer length */
931: tlen = 0;
932: }
933: if ((flags & ISAKMP_FLAG_A) == 0)
934: iph2->flags = (hash == NULL ? 0 : ISAKMP_FLAG_E);
935: else
936: iph2->flags = (hash == NULL ? 0 : ISAKMP_FLAG_A);
937:
938: insph2(iph2);
939: bindph12(iph1, iph2);
940:
941: tlen += sizeof(*isakmp) + payload->l;
942:
943: /* create buffer for isakmp payload */
944: iph2->sendbuf = vmalloc(tlen);
945: if (iph2->sendbuf == NULL) {
946: plog(LLV_ERROR, LOCATION, NULL,
947: "failed to get buffer to send.\n");
948: goto err;
949: }
950:
951: /* create isakmp header */
952: isakmp = (struct isakmp *)iph2->sendbuf->v;
953: memcpy(&isakmp->i_ck, &iph1->index.i_ck, sizeof(cookie_t));
954: memcpy(&isakmp->r_ck, &iph1->index.r_ck, sizeof(cookie_t));
955: isakmp->np = hash == NULL ? (np & 0xff) : ISAKMP_NPTYPE_HASH;
956: isakmp->v = iph1->version;
957: isakmp->etype = ISAKMP_ETYPE_INFO;
958: isakmp->flags = iph2->flags;
959: memcpy(&isakmp->msgid, &iph2->msgid, sizeof(isakmp->msgid));
960: isakmp->len = htonl(tlen);
961: p = (char *)(isakmp + 1);
962:
963: /* create HASH payload */
964: if (hash != NULL) {
965: gen = (struct isakmp_gen *)p;
966: gen->np = np & 0xff;
967: gen->len = htons(sizeof(*gen) + hash->l);
968: p += sizeof(*gen);
969: memcpy(p, hash->v, hash->l);
970: p += hash->l;
971: }
972:
973: /* add payload */
974: memcpy(p, payload->v, payload->l);
975: p += payload->l;
976:
977: #ifdef HAVE_PRINT_ISAKMP_C
978: isakmp_printpacket(iph2->sendbuf, iph1->local, iph1->remote, 1);
979: #endif
980:
981: /* encoding */
982: if (ISSET(isakmp->flags, ISAKMP_FLAG_E)) {
983: vchar_t *tmp;
984:
985: tmp = oakley_do_encrypt(iph2->ph1, iph2->sendbuf, iph2->ivm->ive,
986: iph2->ivm->iv);
987: VPTRINIT(iph2->sendbuf);
988: if (tmp == NULL)
989: goto err;
990: iph2->sendbuf = tmp;
991: }
992:
993: /* HDR*, HASH(1), N */
994: if (isakmp_send(iph2->ph1, iph2->sendbuf) < 0) {
995: VPTRINIT(iph2->sendbuf);
996: goto err;
997: }
998:
999: plog(LLV_DEBUG, LOCATION, NULL,
1000: "sendto Information %s.\n", s_isakmp_nptype(np));
1001:
1002: /*
1003: * don't resend notify message because peer can use Acknowledged
1004: * Informational if peer requires the reply of the notify message.
1005: */
1006:
1007: /* XXX If Acknowledged Informational required, don't delete ph2handle */
1008: error = 0;
1009: VPTRINIT(iph2->sendbuf);
1010: goto err; /* XXX */
1011:
1012: end:
1013: if (hash)
1014: vfree(hash);
1015: return error;
1016:
1017: err:
1018: remph2(iph2);
1019: delph2(iph2);
1020: goto end;
1021: }
1022:
1023: /*
1024: * add a notify payload to buffer by reallocating buffer.
1025: * If buf == NULL, the function only create a notify payload.
1026: *
1027: * XXX Which is SPI to be included, inbound or outbound ?
1028: */
1029: vchar_t *
1030: isakmp_add_pl_n(buf0, np_p, type, pr, data)
1031: vchar_t *buf0;
1032: u_int8_t **np_p;
1033: int type;
1034: struct saproto *pr;
1035: vchar_t *data;
1036: {
1037: vchar_t *buf = NULL;
1038: struct isakmp_pl_n *n;
1039: int tlen;
1040: int oldlen = 0;
1041:
1042: if (*np_p)
1043: **np_p = ISAKMP_NPTYPE_N;
1044:
1045: tlen = sizeof(*n) + pr->spisize;
1046:
1047: if (data)
1048: tlen += data->l;
1049: if (buf0) {
1050: oldlen = buf0->l;
1051: buf = vrealloc(buf0, buf0->l + tlen);
1052: } else
1053: buf = vmalloc(tlen);
1054: if (!buf) {
1055: plog(LLV_ERROR, LOCATION, NULL,
1056: "failed to get a payload buffer.\n");
1057: return NULL;
1058: }
1059:
1060: n = (struct isakmp_pl_n *)(buf->v + oldlen);
1061: n->h.np = ISAKMP_NPTYPE_NONE;
1062: n->h.len = htons(tlen);
1063: n->doi = htonl(IPSEC_DOI); /* IPSEC DOI (1) */
1064: n->proto_id = pr->proto_id; /* IPSEC AH/ESP/whatever*/
1065: n->spi_size = pr->spisize;
1066: n->type = htons(type);
1067: *(u_int32_t *)(n + 1) = pr->spi; /* XXX */
1068: if (data)
1069: memcpy((caddr_t)(n + 1) + pr->spisize, data->v, data->l);
1070:
1071: /* save the pointer of next payload type */
1072: *np_p = &n->h.np;
1073:
1074: return buf;
1075: }
1076:
1077: static void
1078: purge_isakmp_spi(proto, spi, n)
1079: int proto;
1080: isakmp_index *spi; /*network byteorder*/
1081: size_t n;
1082: {
1083: struct ph1handle *iph1;
1084: size_t i;
1085:
1086: for (i = 0; i < n; i++) {
1087: iph1 = getph1byindex(&spi[i]);
1088: if (!iph1)
1089: continue;
1090:
1091: plog(LLV_INFO, LOCATION, NULL,
1092: "purged ISAKMP-SA proto_id=%s spi=%s.\n",
1093: s_ipsecdoi_proto(proto),
1094: isakmp_pindex(&spi[i], 0));
1095:
1096: iph1->status = PHASE1ST_EXPIRED;
1097: isakmp_ph1delete(iph1);
1098: }
1099: }
1100:
1101:
1102:
1103: void
1104: purge_ipsec_spi(dst0, proto, spi, n)
1105: struct sockaddr *dst0;
1106: int proto;
1107: u_int32_t *spi; /*network byteorder*/
1108: size_t n;
1109: {
1110: vchar_t *buf = NULL;
1111: struct sadb_msg *msg, *next, *end;
1112: struct sadb_sa *sa;
1113: struct sadb_lifetime *lt;
1114: struct sockaddr *src, *dst;
1115: struct ph2handle *iph2;
1116: u_int64_t created;
1117: size_t i;
1118: caddr_t mhp[SADB_EXT_MAX + 1];
1119:
1120: plog(LLV_DEBUG2, LOCATION, NULL,
1121: "purge_ipsec_spi:\n");
1122: plog(LLV_DEBUG2, LOCATION, NULL, "dst0: %s\n", saddr2str(dst0));
1123: plog(LLV_DEBUG2, LOCATION, NULL, "SPI: %08X\n", ntohl(spi[0]));
1124:
1125: buf = pfkey_dump_sadb(ipsecdoi2pfkey_proto(proto));
1126: if (buf == NULL) {
1127: plog(LLV_DEBUG, LOCATION, NULL,
1128: "pfkey_dump_sadb returned nothing.\n");
1129: return;
1130: }
1131:
1132: msg = (struct sadb_msg *)buf->v;
1133: end = (struct sadb_msg *)(buf->v + buf->l);
1134:
1135: while (msg < end) {
1136: if ((msg->sadb_msg_len << 3) < sizeof(*msg))
1137: break;
1138: next = (struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3));
1139: if (msg->sadb_msg_type != SADB_DUMP) {
1140: msg = next;
1141: continue;
1142: }
1143:
1144: if (pfkey_align(msg, mhp) || pfkey_check(mhp)) {
1145: plog(LLV_ERROR, LOCATION, NULL,
1146: "pfkey_check (%s)\n", ipsec_strerror());
1147: msg = next;
1148: continue;
1149: }
1150:
1151: sa = (struct sadb_sa *)(mhp[SADB_EXT_SA]);
1152: if (!sa
1153: || !mhp[SADB_EXT_ADDRESS_SRC]
1154: || !mhp[SADB_EXT_ADDRESS_DST]) {
1155: msg = next;
1156: continue;
1157: }
1158: pk_fixup_sa_addresses(mhp);
1159: src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
1160: dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
1161: lt = (struct sadb_lifetime*)mhp[SADB_EXT_LIFETIME_HARD];
1162: if(lt != NULL)
1163: created = lt->sadb_lifetime_addtime;
1164: else
1165: created = 0;
1166:
1167: if (sa->sadb_sa_state != SADB_SASTATE_MATURE
1168: && sa->sadb_sa_state != SADB_SASTATE_DYING) {
1169: msg = next;
1170: continue;
1171: }
1172:
1173: plog(LLV_DEBUG2, LOCATION, NULL, "src: %s\n", saddr2str(src));
1174: plog(LLV_DEBUG2, LOCATION, NULL, "dst: %s\n", saddr2str(dst));
1175:
1176: /* XXX n^2 algorithm, inefficient */
1177:
1178: /* don't delete inbound SAs at the moment */
1179: /* XXX should we remove SAs with opposite direction as well? */
1180: if (cmpsaddr(dst0, dst) != CMPSADDR_MATCH) {
1181: msg = next;
1182: continue;
1183: }
1184:
1185: for (i = 0; i < n; i++) {
1186: plog(LLV_DEBUG, LOCATION, NULL,
1187: "check spi(packet)=%u spi(db)=%u.\n",
1188: ntohl(spi[i]), ntohl(sa->sadb_sa_spi));
1189: if (spi[i] != sa->sadb_sa_spi)
1190: continue;
1191:
1192: pfkey_send_delete(lcconf->sock_pfkey,
1193: msg->sadb_msg_satype,
1194: IPSEC_MODE_ANY,
1195: src, dst, sa->sadb_sa_spi);
1196:
1197: /*
1198: * delete a relative phase 2 handler.
1199: * continue to process if no relative phase 2 handler
1200: * exists.
1201: */
1202: iph2 = getph2bysaidx(src, dst, proto, spi[i]);
1203: if(iph2 != NULL){
1204: delete_spd(iph2, created);
1205: remph2(iph2);
1206: delph2(iph2);
1207: }
1208:
1209: plog(LLV_INFO, LOCATION, NULL,
1210: "purged IPsec-SA proto_id=%s spi=%u.\n",
1211: s_ipsecdoi_proto(proto),
1212: ntohl(spi[i]));
1213: }
1214:
1215: msg = next;
1216: }
1217:
1218: if (buf)
1219: vfree(buf);
1220: }
1221:
1222: /*
1223: * delete all phase2 sa relatived to the destination address
1224: * (except the phase2 within which the INITIAL-CONTACT was received).
1225: * Don't delete Phase 1 handlers on INITIAL-CONTACT, and don't ignore
1226: * an INITIAL-CONTACT if we have contacted the peer. This matches the
1227: * Sun IKE behavior, and makes rekeying work much better when the peer
1228: * restarts.
1229: */
1230: int
1231: isakmp_info_recv_initialcontact(iph1, protectedph2)
1232: struct ph1handle *iph1;
1233: struct ph2handle *protectedph2;
1234: {
1235: vchar_t *buf = NULL;
1236: struct sadb_msg *msg, *next, *end;
1237: struct sadb_sa *sa;
1238: struct sockaddr *src, *dst;
1239: caddr_t mhp[SADB_EXT_MAX + 1];
1240: int proto_id, i;
1241: struct ph2handle *iph2;
1242: #if 0
1243: char *loc, *rem;
1244: #endif
1245:
1246: plog(LLV_INFO, LOCATION, iph1->remote, "received INITIAL-CONTACT\n");
1247:
1248: if (f_local)
1249: return 0;
1250:
1251: #if 0
1252: loc = racoon_strdup(saddrwop2str(iph1->local));
1253: rem = racoon_strdup(saddrwop2str(iph1->remote));
1254: STRDUP_FATAL(loc);
1255: STRDUP_FATAL(rem);
1256:
1257: /*
1258: * Purge all IPSEC-SAs for the peer. We can do this
1259: * the easy way (using a PF_KEY SADB_DELETE extension)
1260: * or we can do it the hard way.
1261: */
1262: for (i = 0; i < pfkey_nsatypes; i++) {
1263: proto_id = pfkey2ipsecdoi_proto(pfkey_satypes[i].ps_satype);
1264:
1265: plog(LLV_INFO, LOCATION, NULL,
1266: "purging %s SAs for %s -> %s\n",
1267: pfkey_satypes[i].ps_name, loc, rem);
1268: if (pfkey_send_delete_all(lcconf->sock_pfkey,
1269: pfkey_satypes[i].ps_satype, IPSEC_MODE_ANY,
1270: iph1->local, iph1->remote) == -1) {
1271: plog(LLV_ERROR, LOCATION, NULL,
1272: "delete_all %s -> %s failed for %s (%s)\n",
1273: loc, rem,
1274: pfkey_satypes[i].ps_name, ipsec_strerror());
1275: goto the_hard_way;
1276: }
1277:
1278: deleteallph2(iph1->local, iph1->remote, proto_id);
1279:
1280: plog(LLV_INFO, LOCATION, NULL,
1281: "purging %s SAs for %s -> %s\n",
1282: pfkey_satypes[i].ps_name, rem, loc);
1283: if (pfkey_send_delete_all(lcconf->sock_pfkey,
1284: pfkey_satypes[i].ps_satype, IPSEC_MODE_ANY,
1285: iph1->remote, iph1->local) == -1) {
1286: plog(LLV_ERROR, LOCATION, NULL,
1287: "delete_all %s -> %s failed for %s (%s)\n",
1288: rem, loc,
1289: pfkey_satypes[i].ps_name, ipsec_strerror());
1290: goto the_hard_way;
1291: }
1292:
1293: deleteallph2(iph1->remote, iph1->local, proto_id);
1294: }
1295:
1296: racoon_free(loc);
1297: racoon_free(rem);
1298: return 0;
1299:
1300: the_hard_way:
1301: racoon_free(loc);
1302: racoon_free(rem);
1303: #endif
1304:
1305: buf = pfkey_dump_sadb(SADB_SATYPE_UNSPEC);
1306: if (buf == NULL) {
1307: plog(LLV_DEBUG, LOCATION, NULL,
1308: "pfkey_dump_sadb returned nothing.\n");
1309: return 0;
1310: }
1311:
1312: msg = (struct sadb_msg *)buf->v;
1313: end = (struct sadb_msg *)(buf->v + buf->l);
1314:
1315: for (; msg < end; msg = next) {
1316: if ((msg->sadb_msg_len << 3) < sizeof(*msg))
1317: break;
1318:
1319: next = (struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3));
1320: if (msg->sadb_msg_type != SADB_DUMP)
1321: continue;
1322:
1323: if (pfkey_align(msg, mhp) || pfkey_check(mhp)) {
1324: plog(LLV_ERROR, LOCATION, NULL,
1325: "pfkey_check (%s)\n", ipsec_strerror());
1326: continue;
1327: }
1328:
1329: if (mhp[SADB_EXT_SA] == NULL
1330: || mhp[SADB_EXT_ADDRESS_SRC] == NULL
1331: || mhp[SADB_EXT_ADDRESS_DST] == NULL)
1332: continue;
1333:
1334: sa = (struct sadb_sa *)mhp[SADB_EXT_SA];
1335: pk_fixup_sa_addresses(mhp);
1336: src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
1337: dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
1338:
1339: if (sa->sadb_sa_state != SADB_SASTATE_MATURE
1340: && sa->sadb_sa_state != SADB_SASTATE_DYING)
1341: continue;
1342:
1343: /*
1344: * RFC2407 4.6.3.3 INITIAL-CONTACT is the message that
1345: * announces the sender of the message was rebooted.
1346: * it is interpreted to delete all SAs which source address
1347: * is the sender of the message.
1348: * racoon only deletes SA which is matched both the
1349: * source address and the destination accress.
1350: */
1351:
1352: /*
1353: * Check that the IP and port match. But this is not optimal,
1354: * since NAT-T can make the peer have multiple different
1355: * ports. Correct thing to do is delete all entries with
1356: * same identity. -TT
1357: */
1358: if ((cmpsaddr(iph1->local, src) != CMPSADDR_MATCH ||
1359: cmpsaddr(iph1->remote, dst) != CMPSADDR_MATCH) &&
1360: (cmpsaddr(iph1->local, dst) != CMPSADDR_MATCH ||
1361: cmpsaddr(iph1->remote, src) != CMPSADDR_MATCH))
1362: continue;
1363:
1364: /*
1365: * Make sure this is an SATYPE that we manage.
1366: * This is gross; too bad we couldn't do it the
1367: * easy way.
1368: */
1369: for (i = 0; i < pfkey_nsatypes; i++) {
1370: if (pfkey_satypes[i].ps_satype ==
1371: msg->sadb_msg_satype)
1372: break;
1373: }
1374: if (i == pfkey_nsatypes)
1375: continue;
1376:
1377: plog(LLV_INFO, LOCATION, NULL,
1378: "purging spi=%u.\n", ntohl(sa->sadb_sa_spi));
1379: pfkey_send_delete(lcconf->sock_pfkey,
1380: msg->sadb_msg_satype,
1381: IPSEC_MODE_ANY, src, dst, sa->sadb_sa_spi);
1382:
1383: /*
1384: * delete a relative phase 2 handler.
1385: * continue to process if no relative phase 2 handler
1386: * exists.
1387: */
1388: proto_id = pfkey2ipsecdoi_proto(msg->sadb_msg_satype);
1389: iph2 = getph2bysaidx(src, dst, proto_id, sa->sadb_sa_spi);
1390: if (iph2 && iph2 != protectedph2) {
1391: delete_spd(iph2, 0);
1392: remph2(iph2);
1393: delph2(iph2);
1394: }
1395: }
1396:
1397: vfree(buf);
1398: return 0;
1399: }
1400:
1401:
1402: #ifdef ENABLE_DPD
1403: static int
1404: isakmp_info_recv_r_u (iph1, ru, msgid)
1405: struct ph1handle *iph1;
1406: struct isakmp_pl_ru *ru;
1407: u_int32_t msgid;
1408: {
1409: struct isakmp_pl_ru *ru_ack;
1410: vchar_t *payload = NULL;
1411: int tlen;
1412: int error = 0;
1413:
1414: plog(LLV_DEBUG, LOCATION, iph1->remote,
1415: "DPD R-U-There received\n");
1416:
1417: /* XXX should compare cookies with iph1->index?
1418: Or is this already done by calling function? */
1419: tlen = sizeof(*ru_ack);
1420: payload = vmalloc(tlen);
1421: if (payload == NULL) {
1422: plog(LLV_ERROR, LOCATION, NULL,
1423: "failed to get buffer to send.\n");
1424: return errno;
1425: }
1426:
1427: ru_ack = (struct isakmp_pl_ru *)payload->v;
1428: ru_ack->h.np = ISAKMP_NPTYPE_NONE;
1429: ru_ack->h.len = htons(tlen);
1430: ru_ack->doi = htonl(IPSEC_DOI);
1431: ru_ack->type = htons(ISAKMP_NTYPE_R_U_THERE_ACK);
1432: ru_ack->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX ? */
1433: ru_ack->spi_size = sizeof(isakmp_index);
1434: memcpy(ru_ack->i_ck, ru->i_ck, sizeof(cookie_t));
1435: memcpy(ru_ack->r_ck, ru->r_ck, sizeof(cookie_t));
1436: ru_ack->data = ru->data;
1437:
1438: /* XXX Should we do FLAG_A ? */
1439: error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N,
1440: ISAKMP_FLAG_E);
1441: vfree(payload);
1442:
1443: plog(LLV_DEBUG, LOCATION, NULL, "received a valid R-U-THERE, ACK sent\n");
1444:
1445: /* Should we mark tunnel as active ? */
1446: return error;
1447: }
1448:
1449: static int
1450: isakmp_info_recv_r_u_ack (iph1, ru, msgid)
1451: struct ph1handle *iph1;
1452: struct isakmp_pl_ru *ru;
1453: u_int32_t msgid;
1454: {
1455: u_int32_t seq;
1456:
1457: plog(LLV_DEBUG, LOCATION, iph1->remote,
1458: "DPD R-U-There-Ack received\n");
1459:
1460: seq = ntohl(ru->data);
1461: if (seq <= iph1->dpd_last_ack || seq > iph1->dpd_seq) {
1462: plog(LLV_ERROR, LOCATION, iph1->remote,
1463: "Wrong DPD sequence number (%d; last_ack=%d, seq=%d).\n",
1464: seq, iph1->dpd_last_ack, iph1->dpd_seq);
1465: return 0;
1466: }
1467:
1468: if (memcmp(ru->i_ck, iph1->index.i_ck, sizeof(cookie_t)) ||
1469: memcmp(ru->r_ck, iph1->index.r_ck, sizeof(cookie_t))) {
1470: plog(LLV_ERROR, LOCATION, iph1->remote,
1471: "Cookie mismatch in DPD ACK!.\n");
1472: return 0;
1473: }
1474:
1475: iph1->dpd_fails = 0;
1476: iph1->dpd_last_ack = seq;
1477: sched_cancel(&iph1->dpd_r_u);
1478: isakmp_sched_r_u(iph1, 0);
1479:
1480: plog(LLV_DEBUG, LOCATION, NULL, "received an R-U-THERE-ACK\n");
1481:
1482: return 0;
1483: }
1484:
1485:
1486:
1487:
1488: /*
1489: * send DPD R-U-THERE payload in Informational exchange.
1490: */
1491: static void
1492: isakmp_info_send_r_u(sc)
1493: struct sched *sc;
1494: {
1495: struct ph1handle *iph1 = container_of(sc, struct ph1handle, dpd_r_u);
1496:
1497: /* create R-U-THERE payload */
1498: struct isakmp_pl_ru *ru;
1499: vchar_t *payload = NULL;
1500: int tlen;
1501: int error = 0;
1502:
1503: plog(LLV_DEBUG, LOCATION, iph1->remote, "DPD monitoring....\n");
1504:
1505: if (iph1->status == PHASE1ST_EXPIRED) {
1506: /* This can happen after removing tunnels from the
1507: * config file and then reloading.
1508: * Such iph1 have rmconf=NULL, so return before the if
1509: * block below.
1510: */
1511: return;
1512: }
1513:
1514: if (iph1->dpd_fails >= iph1->rmconf->dpd_maxfails) {
1515:
1516: plog(LLV_INFO, LOCATION, iph1->remote,
1517: "DPD: remote (ISAKMP-SA spi=%s) seems to be dead.\n",
1518: isakmp_pindex(&iph1->index, 0));
1519:
1520: script_hook(iph1, SCRIPT_PHASE1_DEAD);
1521: evt_phase1(iph1, EVT_PHASE1_DPD_TIMEOUT, NULL);
1522: purge_remote(iph1);
1523:
1524: /* Do not reschedule here: phase1 is deleted,
1525: * DPD will be reactivated when a new ph1 will be negociated
1526: */
1527: return;
1528: }
1529:
1530: /* TODO: check recent activity to avoid useless sends... */
1531:
1532: tlen = sizeof(*ru);
1533: payload = vmalloc(tlen);
1534: if (payload == NULL) {
1535: plog(LLV_ERROR, LOCATION, NULL,
1536: "failed to get buffer for payload.\n");
1537: return;
1538: }
1539: ru = (struct isakmp_pl_ru *)payload->v;
1540: ru->h.np = ISAKMP_NPTYPE_NONE;
1541: ru->h.len = htons(tlen);
1542: ru->doi = htonl(IPSEC_DOI);
1543: ru->type = htons(ISAKMP_NTYPE_R_U_THERE);
1544: ru->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX ?*/
1545: ru->spi_size = sizeof(isakmp_index);
1546:
1547: memcpy(ru->i_ck, iph1->index.i_ck, sizeof(cookie_t));
1548: memcpy(ru->r_ck, iph1->index.r_ck, sizeof(cookie_t));
1549:
1550: if (iph1->dpd_seq == 0) {
1551: /* generate a random seq which is not too big */
1552: iph1->dpd_seq = iph1->dpd_last_ack = rand() & 0x0fff;
1553: }
1554:
1555: iph1->dpd_seq++;
1556: iph1->dpd_fails++;
1557: ru->data = htonl(iph1->dpd_seq);
1558:
1559: error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 0);
1560: vfree(payload);
1561:
1562: plog(LLV_DEBUG, LOCATION, iph1->remote,
1563: "DPD R-U-There sent (%d)\n", error);
1564:
1565: /* Reschedule the r_u_there with a short delay,
1566: * will be deleted/rescheduled if ACK received before */
1567: isakmp_sched_r_u(iph1, 1);
1568:
1569: plog(LLV_DEBUG, LOCATION, iph1->remote,
1570: "rescheduling send_r_u (%d).\n", iph1->rmconf->dpd_retry);
1571: }
1572:
1573: /* Schedule a new R-U-THERE */
1574: int
1575: isakmp_sched_r_u(iph1, retry)
1576: struct ph1handle *iph1;
1577: int retry;
1578: {
1579: if(iph1 == NULL ||
1580: iph1->rmconf == NULL)
1581: return 1;
1582:
1583:
1584: if(iph1->dpd_support == 0 ||
1585: iph1->rmconf->dpd_interval == 0)
1586: return 0;
1587:
1588: if(retry)
1589: sched_schedule(&iph1->dpd_r_u, iph1->rmconf->dpd_retry,
1590: isakmp_info_send_r_u);
1591: else
1592: sched_schedule(&iph1->dpd_r_u, iph1->rmconf->dpd_interval,
1593: isakmp_info_send_r_u);
1594:
1595: return 0;
1596: }
1597: #endif
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to isakmp_inf.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / ipsec-tools / src / racoon