![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to isakmp_quick.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / ipsec-tools / src / racoon|
Return to isakmp_quick.c CVS log | Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / ipsec-tools / src / racoon |
1.1 misho 1: /* $NetBSD: isakmp_quick.c,v 1.29 2011/03/14 17:18:13 tteras Exp $ */
2:
3: /* Id: isakmp_quick.c,v 1.29 2006/08/22 18:17:17 manubsd Exp */
4:
5: /*
6: * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
7: * All rights reserved.
8: *
9: * Redistribution and use in source and binary forms, with or without
10: * modification, are permitted provided that the following conditions
11: * are met:
12: * 1. Redistributions of source code must retain the above copyright
13: * notice, this list of conditions and the following disclaimer.
14: * 2. Redistributions in binary form must reproduce the above copyright
15: * notice, this list of conditions and the following disclaimer in the
16: * documentation and/or other materials provided with the distribution.
17: * 3. Neither the name of the project nor the names of its contributors
18: * may be used to endorse or promote products derived from this software
19: * without specific prior written permission.
20: *
21: * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22: * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23: * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24: * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25: * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26: * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27: * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28: * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29: * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30: * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31: * SUCH DAMAGE.
32: */
33:
34: #include "config.h"
35:
36: #include <sys/types.h>
37: #include <sys/param.h>
38: #include <sys/socket.h>
39:
40: #include <netinet/in.h>
41:
42: #include <stdlib.h>
43: #include <stdio.h>
44: #include <string.h>
45: #include <errno.h>
46: #if TIME_WITH_SYS_TIME
47: # include <sys/time.h>
48: # include <time.h>
49: #else
50: # if HAVE_SYS_TIME_H
51: # include <sys/time.h>
52: # else
53: # include <time.h>
54: # endif
55: #endif
56:
57: #include PATH_IPSEC_H
58:
59: #include "var.h"
60: #include "vmbuf.h"
61: #include "schedule.h"
62: #include "misc.h"
63: #include "plog.h"
64: #include "debug.h"
65:
66: #include "localconf.h"
67: #include "remoteconf.h"
68: #include "handler.h"
69: #include "policy.h"
70: #include "proposal.h"
71: #include "isakmp_var.h"
72: #include "isakmp.h"
73: #include "isakmp_inf.h"
74: #include "isakmp_quick.h"
75: #include "oakley.h"
76: #include "ipsec_doi.h"
77: #include "crypto_openssl.h"
78: #include "pfkey.h"
79: #include "policy.h"
80: #include "algorithm.h"
81: #include "sockmisc.h"
82: #include "proposal.h"
83: #include "sainfo.h"
84: #include "admin.h"
85: #include "strnames.h"
86:
87: #ifdef ENABLE_HYBRID
88: #include <resolv.h>
89: #include "isakmp_xauth.h"
90: #include "isakmp_cfg.h"
91: #endif
92:
93: #ifdef ENABLE_NATT
94: #include "nattraversal.h"
95: #endif
96:
97: /* quick mode */
98: static vchar_t *quick_ir1mx __P((struct ph2handle *, vchar_t *, vchar_t *));
99: static int get_sainfo_r __P((struct ph2handle *));
100: static int get_proposal_r __P((struct ph2handle *));
101: static int ph2_recv_n __P((struct ph2handle *, struct isakmp_gen *));
102: static void quick_timeover_stub __P((struct sched *));
103: static void quick_timeover __P((struct ph2handle *));
104:
105: /* called from scheduler */
106: static void
107: quick_timeover_stub(p)
108: struct sched *p;
109: {
110: quick_timeover(container_of(p, struct ph2handle, sce));
111: }
112:
113: static void
114: quick_timeover(iph2)
115: struct ph2handle *iph2;
116: {
117: plog(LLV_ERROR, LOCATION, NULL,
118: "%s give up to get IPsec-SA due to time up to wait.\n",
119: saddrwop2str(iph2->dst));
120:
121: /* If initiator side, send error to kernel by SADB_ACQUIRE. */
122: if (iph2->side == INITIATOR)
123: pk_sendeacquire(iph2);
124:
125: remph2(iph2);
126: delph2(iph2);
127: }
128:
129: /* %%%
130: * Quick Mode
131: */
132: /*
133: * begin Quick Mode as initiator. send pfkey getspi message to kernel.
134: */
135: int
136: quick_i1prep(iph2, msg)
137: struct ph2handle *iph2;
138: vchar_t *msg; /* must be null pointer */
139: {
140: int error = ISAKMP_INTERNAL_ERROR;
141:
142: /* validity check */
143: if (iph2->status != PHASE2ST_STATUS2) {
144: plog(LLV_ERROR, LOCATION, NULL,
145: "status mismatched %d.\n", iph2->status);
146: goto end;
147: }
148:
149: iph2->msgid = isakmp_newmsgid2(iph2->ph1);
150: iph2->ivm = oakley_newiv2(iph2->ph1, iph2->msgid);
151: if (iph2->ivm == NULL)
152: return 0;
153:
154: iph2->status = PHASE2ST_GETSPISENT;
155:
156: /* don't anything if local test mode. */
157: if (f_local) {
158: error = 0;
159: goto end;
160: }
161:
162: /* send getspi message */
163: if (pk_sendgetspi(iph2) < 0)
164: goto end;
165:
166: plog(LLV_DEBUG, LOCATION, NULL, "pfkey getspi sent.\n");
167:
168: sched_schedule(&iph2->sce, lcconf->wait_ph2complete,
169: quick_timeover_stub);
170:
171: error = 0;
172:
173: end:
174: return error;
175: }
176:
177: /*
178: * send to responder
179: * HDR*, HASH(1), SA, Ni [, KE ] [, IDi2, IDr2 ] [, NAT-OAi, NAT-OAr ]
180: */
181: int
182: quick_i1send(iph2, msg)
183: struct ph2handle *iph2;
184: vchar_t *msg; /* must be null pointer */
185: {
186: vchar_t *body = NULL;
187: vchar_t *hash = NULL;
188: struct isakmp_gen *gen;
189: char *p;
190: int tlen;
191: int error = ISAKMP_INTERNAL_ERROR;
192: int natoa = ISAKMP_NPTYPE_NONE;
193: int pfsgroup, idci, idcr;
194: int np;
195: struct ipsecdoi_id_b *id, *id_p;
196: #ifdef ENABLE_NATT
197: vchar_t *nat_oai = NULL;
198: vchar_t *nat_oar = NULL;
199: #endif
200:
201: /* validity check */
202: if (msg != NULL) {
203: plog(LLV_ERROR, LOCATION, NULL,
204: "msg has to be NULL in this function.\n");
205: goto end;
206: }
207: if (iph2->status != PHASE2ST_GETSPIDONE) {
208: plog(LLV_ERROR, LOCATION, NULL,
209: "status mismatched %d.\n", iph2->status);
210: goto end;
211: }
212:
213: /* create SA payload for my proposal */
214: if (ipsecdoi_setph2proposal(iph2) < 0)
215: goto end;
216:
217: /* generate NONCE value */
218: iph2->nonce = eay_set_random(iph2->ph1->rmconf->nonce_size);
219: if (iph2->nonce == NULL)
220: goto end;
221:
222: /*
223: * DH value calculation is kicked out into cfparse.y.
224: * because pfs group can not be negotiated, it's only to be checked
225: * acceptable.
226: */
227: /* generate KE value if need */
228: pfsgroup = iph2->proposal->pfs_group;
229: if (pfsgroup) {
230: /* DH group settting if PFS is required. */
231: if (oakley_setdhgroup(pfsgroup, &iph2->pfsgrp) < 0) {
232: plog(LLV_ERROR, LOCATION, NULL,
233: "failed to set DH value.\n");
234: goto end;
235: }
236: if (oakley_dh_generate(iph2->pfsgrp,
237: &iph2->dhpub, &iph2->dhpriv) < 0) {
238: goto end;
239: }
240: }
241:
242: /* generate ID value */
243: if (ipsecdoi_setid2(iph2) < 0) {
244: plog(LLV_ERROR, LOCATION, NULL,
245: "failed to get ID.\n");
246: goto end;
247: }
248: plog(LLV_DEBUG, LOCATION, NULL, "IDci:\n");
249: plogdump(LLV_DEBUG, iph2->id->v, iph2->id->l);
250: plog(LLV_DEBUG, LOCATION, NULL, "IDcr:\n");
251: plogdump(LLV_DEBUG, iph2->id_p->v, iph2->id_p->l);
252:
253: /*
254: * we do not attach IDci nor IDcr, under the following condition:
255: * - all proposals are transport mode
256: * - no MIP6 or proxy
257: * - id payload suggests to encrypt all the traffic (no specific
258: * protocol type)
259: * - SA endpoints and IKE addresses for the nego are the same
260: * (iph2->src/dst)
261: */
262: id = (struct ipsecdoi_id_b *)iph2->id->v;
263: id_p = (struct ipsecdoi_id_b *)iph2->id_p->v;
264: if (id->proto_id == 0 &&
265: id_p->proto_id == 0 &&
266: iph2->ph1->rmconf->support_proxy == 0 &&
267: iph2->sa_src == NULL && iph2->sa_dst == NULL &&
268: ipsecdoi_transportmode(iph2->proposal)) {
269: idci = idcr = 0;
270: } else
271: idci = idcr = 1;
272:
273: #ifdef ENABLE_NATT
274: /*
275: * RFC3947 5.2. if we propose UDP-Encapsulated-Transport
276: * we should send NAT-OA
277: */
278: if (ipsecdoi_transportmode(iph2->proposal)
279: && (iph2->ph1->natt_flags & NAT_DETECTED)) {
280: natoa = iph2->ph1->natt_options->payload_nat_oa;
281:
282: nat_oai = ipsecdoi_sockaddr2id(iph2->src,
283: IPSECDOI_PREFIX_HOST, IPSEC_ULPROTO_ANY);
284: nat_oar = ipsecdoi_sockaddr2id(iph2->dst,
285: IPSECDOI_PREFIX_HOST, IPSEC_ULPROTO_ANY);
286:
287: if (nat_oai == NULL || nat_oar == NULL) {
288: plog(LLV_ERROR, LOCATION, NULL,
289: "failed to generate NAT-OA payload.\n");
290: goto end;
291: }
292:
293: plog(LLV_DEBUG, LOCATION, NULL, "NAT-OAi:\n");
294: plogdump(LLV_DEBUG, nat_oai->v, nat_oai->l);
295: plog(LLV_DEBUG, LOCATION, NULL, "NAT-OAr:\n");
296: plogdump(LLV_DEBUG, nat_oar->v, nat_oar->l);
297: } else {
298: natoa = ISAKMP_NPTYPE_NONE;
299: }
300: #endif
301:
302: /* create SA;NONCE payload, and KE if need, and IDii, IDir. */
303: tlen = + sizeof(*gen) + iph2->sa->l
304: + sizeof(*gen) + iph2->nonce->l;
305: if (pfsgroup)
306: tlen += (sizeof(*gen) + iph2->dhpub->l);
307: if (idci)
308: tlen += sizeof(*gen) + iph2->id->l;
309: if (idcr)
310: tlen += sizeof(*gen) + iph2->id_p->l;
311: #ifdef ENABLE_NATT
312: if (natoa != ISAKMP_NPTYPE_NONE)
313: tlen += 2 * sizeof(*gen) + nat_oai->l + nat_oar->l;
314: #endif
315:
316: body = vmalloc(tlen);
317: if (body == NULL) {
318: plog(LLV_ERROR, LOCATION, NULL,
319: "failed to get buffer to send.\n");
320: goto end;
321: }
322:
323: p = body->v;
324:
325: /* add SA payload */
326: p = set_isakmp_payload(p, iph2->sa, ISAKMP_NPTYPE_NONCE);
327:
328: /* add NONCE payload */
329: if (pfsgroup)
330: np = ISAKMP_NPTYPE_KE;
331: else if (idci || idcr)
332: np = ISAKMP_NPTYPE_ID;
333: else
334: np = natoa;
335: p = set_isakmp_payload(p, iph2->nonce, np);
336:
337: /* add KE payload if need. */
338: np = (idci || idcr) ? ISAKMP_NPTYPE_ID : natoa;
339: if (pfsgroup)
340: p = set_isakmp_payload(p, iph2->dhpub, np);
341:
342: /* IDci */
343: np = (idcr) ? ISAKMP_NPTYPE_ID : natoa;
344: if (idci)
345: p = set_isakmp_payload(p, iph2->id, np);
346:
347: /* IDcr */
348: if (idcr)
349: p = set_isakmp_payload(p, iph2->id_p, natoa);
350:
351: #ifdef ENABLE_NATT
352: /* NAT-OA */
353: if (natoa != ISAKMP_NPTYPE_NONE) {
354: p = set_isakmp_payload(p, nat_oai, natoa);
355: p = set_isakmp_payload(p, nat_oar, ISAKMP_NPTYPE_NONE);
356: }
357: #endif
358:
359: /* generate HASH(1) */
360: hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, body);
361: if (hash == NULL)
362: goto end;
363:
364: /* send isakmp payload */
365: iph2->sendbuf = quick_ir1mx(iph2, body, hash);
366: if (iph2->sendbuf == NULL)
367: goto end;
368:
369: /* send the packet, add to the schedule to resend */
370: if (isakmp_ph2send(iph2) == -1)
371: goto end;
372:
373: /* change status of isakmp status entry */
374: iph2->status = PHASE2ST_MSG1SENT;
375:
376: error = 0;
377:
378: end:
379: if (body != NULL)
380: vfree(body);
381: if (hash != NULL)
382: vfree(hash);
383: #ifdef ENABLE_NATT
384: if (nat_oai != NULL)
385: vfree(nat_oai);
386: if (nat_oar != NULL)
387: vfree(nat_oar);
388: #endif
389:
390: return error;
391: }
392:
393: /*
394: * receive from responder
395: * HDR*, HASH(2), SA, Nr [, KE ] [, IDi2, IDr2 ] [, NAT-OAi, NAT-OAr ]
396: */
397: int
398: quick_i2recv(iph2, msg0)
399: struct ph2handle *iph2;
400: vchar_t *msg0;
401: {
402: vchar_t *msg = NULL;
403: vchar_t *hbuf = NULL; /* for hash computing. */
404: vchar_t *pbuf = NULL; /* for payload parsing */
405: vchar_t *idci = NULL;
406: vchar_t *idcr = NULL;
407: struct isakmp_parse_t *pa;
408: struct isakmp *isakmp = (struct isakmp *)msg0->v;
409: struct isakmp_pl_hash *hash = NULL;
410: char *p;
411: int tlen;
412: int error = ISAKMP_INTERNAL_ERROR;
413:
414: /* validity check */
415: if (iph2->status != PHASE2ST_MSG1SENT) {
416: plog(LLV_ERROR, LOCATION, NULL,
417: "status mismatched %d.\n", iph2->status);
418: goto end;
419: }
420:
421: /* decrypt packet */
422: if (!ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E)) {
423: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
424: "Packet wasn't encrypted.\n");
425: goto end;
426: }
427: msg = oakley_do_decrypt(iph2->ph1, msg0, iph2->ivm->iv, iph2->ivm->ive);
428: if (msg == NULL)
429: goto end;
430:
431: /* create buffer for validating HASH(2) */
432: /*
433: * ordering rule:
434: * 1. the first one must be HASH
435: * 2. the second one must be SA (added in isakmp-oakley-05!)
436: * 3. two IDs must be considered as IDci, then IDcr
437: */
438: pbuf = isakmp_parse(msg);
439: if (pbuf == NULL)
440: goto end;
441: pa = (struct isakmp_parse_t *)pbuf->v;
442:
443: /* HASH payload is fixed postion */
444: if (pa->type != ISAKMP_NPTYPE_HASH) {
445: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
446: "received invalid next payload type %d, "
447: "expecting %d.\n",
448: pa->type, ISAKMP_NPTYPE_HASH);
449: goto end;
450: }
451: hash = (struct isakmp_pl_hash *)pa->ptr;
452: pa++;
453:
454: /*
455: * this restriction was introduced in isakmp-oakley-05.
456: * we do not check this for backward compatibility.
457: * TODO: command line/config file option to enable/disable this code
458: */
459: /* HASH payload is fixed postion */
460: if (pa->type != ISAKMP_NPTYPE_SA) {
461: plog(LLV_WARNING, LOCATION, iph2->ph1->remote,
462: "received invalid next payload type %d, "
463: "expecting %d.\n",
464: pa->type, ISAKMP_NPTYPE_HASH);
465: }
466:
467: /* allocate buffer for computing HASH(2) */
468: tlen = iph2->nonce->l
469: + ntohl(isakmp->len) - sizeof(*isakmp);
470: hbuf = vmalloc(tlen);
471: if (hbuf == NULL) {
472: plog(LLV_ERROR, LOCATION, NULL,
473: "failed to get hash buffer.\n");
474: goto end;
475: }
476: p = hbuf->v + iph2->nonce->l; /* retain the space for Ni_b */
477:
478: /*
479: * parse the payloads.
480: * copy non-HASH payloads into hbuf, so that we can validate HASH.
481: */
482: iph2->sa_ret = NULL;
483: tlen = 0; /* count payload length except of HASH payload. */
484: for (; pa->type; pa++) {
485:
486: /* copy to buffer for HASH */
487: /* Don't modify the payload */
488: memcpy(p, pa->ptr, pa->len);
489:
490: switch (pa->type) {
491: case ISAKMP_NPTYPE_SA:
492: if (iph2->sa_ret != NULL) {
493: plog(LLV_ERROR, LOCATION, NULL,
494: "Ignored, multiple SA "
495: "isn't supported.\n");
496: break;
497: }
498: if (isakmp_p2ph(&iph2->sa_ret, pa->ptr) < 0) {
499: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
500: "duplicate ISAKMP_NPTYPE_SA.\n");
501: goto end;
502: }
503: break;
504:
505: case ISAKMP_NPTYPE_NONCE:
506: if (isakmp_p2ph(&iph2->nonce_p, pa->ptr) < 0) {
507: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
508: "duplicate ISAKMP_NPTYPE_NONCE.\n");
509: goto end;
510: }
511: break;
512:
513: case ISAKMP_NPTYPE_KE:
514: if (isakmp_p2ph(&iph2->dhpub_p, pa->ptr) < 0) {
515: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
516: "duplicate ISAKMP_NPTYPE_KE.\n");
517: goto end;
518: }
519: break;
520:
521: case ISAKMP_NPTYPE_ID:
522: if (idci == NULL) {
523: if (isakmp_p2ph(&idci, pa->ptr) < 0)
524: goto end;
525: } else if (idcr == NULL) {
526: if (isakmp_p2ph(&idcr, pa->ptr) < 0)
527: goto end;
528: } else {
529: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
530: "too many ISAKMP_NPTYPE_ID payloads.\n");
531: goto end;
532: }
533: break;
534:
535: case ISAKMP_NPTYPE_N:
536: ph2_recv_n(iph2, pa->ptr);
537: break;
538:
539: #ifdef ENABLE_NATT
540: case ISAKMP_NPTYPE_NATOA_DRAFT:
541: case ISAKMP_NPTYPE_NATOA_RFC:
542: {
543: struct sockaddr_storage addr;
544: struct sockaddr *daddr;
545: u_int8_t prefix;
546: u_int16_t ul_proto;
547: vchar_t *vp = NULL;
548:
549: if (isakmp_p2ph(&vp, pa->ptr) < 0)
550: goto end;
551:
552: error = ipsecdoi_id2sockaddr(vp,
553: (struct sockaddr *) &addr,
554: &prefix, &ul_proto);
555:
556: vfree(vp);
557:
558: if (error)
559: goto end;
560:
561: daddr = dupsaddr((struct sockaddr *) &addr);
562: if (daddr == NULL)
563: goto end;
564:
565: if (iph2->natoa_src == NULL)
566: iph2->natoa_src = daddr;
567: else if (iph2->natoa_dst == NULL)
568: iph2->natoa_dst = daddr;
569: else {
570: racoon_free(daddr);
571: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
572: "too many ISAKMP_NPTYPE_NATOA payloads.\n");
573: goto end;
574: }
575: }
576: break;
577: #endif
578:
579: default:
580: /* don't send information, see ident_r1recv() */
581: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
582: "ignore the packet, "
583: "received unexpecting payload type %d.\n",
584: pa->type);
585: goto end;
586: }
587:
588: p += pa->len;
589:
590: /* compute true length of payload. */
591: tlen += pa->len;
592: }
593:
594: /* payload existency check */
595: if (hash == NULL || iph2->sa_ret == NULL || iph2->nonce_p == NULL) {
596: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
597: "few isakmp message received.\n");
598: goto end;
599: }
600:
601: /* identity check */
602: if (idci != NULL) {
603: struct sockaddr_storage proposed_addr, got_addr;
604: u_int8_t proposed_prefix, got_prefix;
605: u_int16_t proposed_ulproto, got_ulproto;
606:
607: error = ipsecdoi_id2sockaddr(iph2->id,
608: (struct sockaddr *) &proposed_addr,
609: &proposed_prefix, &proposed_ulproto);
610: if (error)
611: goto end;
612:
613: error = ipsecdoi_id2sockaddr(idci,
614: (struct sockaddr *) &got_addr,
615: &got_prefix, &got_ulproto);
616: if (error)
617: goto end;
618:
619: if (proposed_prefix != got_prefix
620: || proposed_ulproto != got_ulproto) {
621: plog(LLV_DEBUG, LOCATION, NULL,
622: "IDci prefix/ulproto does not match proposal.\n");
623: error = ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED;
624: goto end;
625: }
626: #ifdef ENABLE_NATT
627: set_port(iph2->natoa_src,
628: extract_port((struct sockaddr *) &proposed_addr));
629: #endif
630:
631: if (cmpsaddr((struct sockaddr *) &proposed_addr,
632: (struct sockaddr *) &got_addr) == CMPSADDR_MATCH) {
633: plog(LLV_DEBUG, LOCATION, NULL,
634: "IDci matches proposal.\n");
635: #ifdef ENABLE_NATT
636: } else if (iph2->natoa_src != NULL
637: && cmpsaddr(iph2->natoa_src,
638: (struct sockaddr *) &got_addr) == 0) {
639: plog(LLV_DEBUG, LOCATION, NULL,
640: "IDci matches NAT-OAi.\n");
641: #endif
642: } else {
643: plog(LLV_ERROR, LOCATION, NULL,
644: "mismatched IDci was returned.\n");
645: error = ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED;
646: goto end;
647: }
648: }
649: if (idcr != NULL) {
650: struct sockaddr_storage proposed_addr, got_addr;
651: u_int8_t proposed_prefix, got_prefix;
652: u_int16_t proposed_ulproto, got_ulproto;
653:
654: error = ipsecdoi_id2sockaddr(iph2->id_p,
655: (struct sockaddr *) &proposed_addr,
656: &proposed_prefix, &proposed_ulproto);
657: if (error)
658: goto end;
659:
660: error = ipsecdoi_id2sockaddr(idcr,
661: (struct sockaddr *) &got_addr,
662: &got_prefix, &got_ulproto);
663: if (error)
664: goto end;
665:
666: if (proposed_prefix != got_prefix
667: || proposed_ulproto != got_ulproto) {
668: plog(LLV_DEBUG, LOCATION, NULL,
669: "IDcr prefix/ulproto does not match proposal.\n");
670: error = ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED;
671: goto end;
672: }
673:
674: #ifdef ENABLE_NATT
675: set_port(iph2->natoa_dst,
676: extract_port((struct sockaddr *) &proposed_addr));
677: #endif
678:
679: if (cmpsaddr((struct sockaddr *) &proposed_addr,
680: (struct sockaddr *) &got_addr) == CMPSADDR_MATCH) {
681: plog(LLV_DEBUG, LOCATION, NULL,
682: "IDcr matches proposal.\n");
683: #ifdef ENABLE_NATT
684: } else if (iph2->natoa_dst != NULL
685: && cmpsaddr(iph2->natoa_dst,
686: (struct sockaddr *) &got_addr) == CMPSADDR_MATCH) {
687: plog(LLV_DEBUG, LOCATION, NULL,
688: "IDcr matches NAT-OAr.\n");
689: #endif
690: } else {
691: plog(LLV_ERROR, LOCATION, NULL,
692: "mismatched IDcr was returned.\n");
693: error = ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED;
694: goto end;
695: }
696: }
697:
698: /* Fixed buffer for calculating HASH */
699: memcpy(hbuf->v, iph2->nonce->v, iph2->nonce->l);
700: plog(LLV_DEBUG, LOCATION, NULL,
701: "HASH allocated:hbuf->l=%zu actual:tlen=%zu\n",
702: hbuf->l, tlen + iph2->nonce->l);
703: /* adjust buffer length for HASH */
704: hbuf->l = iph2->nonce->l + tlen;
705:
706: /* validate HASH(2) */
707: {
708: char *r_hash;
709: vchar_t *my_hash = NULL;
710: int result;
711:
712: r_hash = (char *)hash + sizeof(*hash);
713:
714: plog(LLV_DEBUG, LOCATION, NULL, "HASH(2) received:");
715: plogdump(LLV_DEBUG, r_hash, ntohs(hash->h.len) - sizeof(*hash));
716:
717: my_hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, hbuf);
718: if (my_hash == NULL)
719: goto end;
720:
721: result = memcmp(my_hash->v, r_hash, my_hash->l);
722: vfree(my_hash);
723:
724: if (result) {
725: plog(LLV_DEBUG, LOCATION, iph2->ph1->remote,
726: "HASH(2) mismatch.\n");
727: error = ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
728: goto end;
729: }
730: }
731:
732: /* validity check SA payload sent from responder */
733: if (ipsecdoi_checkph2proposal(iph2) < 0) {
734: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
735: "proposal check failed.\n");
736: error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
737: goto end;
738: }
739:
740: /* change status of isakmp status entry */
741: iph2->status = PHASE2ST_STATUS6;
742:
743: error = 0;
744:
745: end:
746: if (hbuf)
747: vfree(hbuf);
748: if (pbuf)
749: vfree(pbuf);
750: if (msg)
751: vfree(msg);
752: if (idci)
753: vfree(idci);
754: if (idcr)
755: vfree(idcr);
756:
757: if (error) {
758: VPTRINIT(iph2->sa_ret);
759: VPTRINIT(iph2->nonce_p);
760: VPTRINIT(iph2->dhpub_p);
761: VPTRINIT(iph2->id);
762: VPTRINIT(iph2->id_p);
763: #ifdef ENABLE_NATT
764: if (iph2->natoa_src) {
765: racoon_free(iph2->natoa_src);
766: iph2->natoa_src = NULL;
767: }
768: if (iph2->natoa_dst) {
769: racoon_free(iph2->natoa_dst);
770: iph2->natoa_dst = NULL;
771: }
772: #endif
773: }
774:
775: return error;
776: }
777:
778: /*
779: * send to responder
780: * HDR*, HASH(3)
781: */
782: int
783: quick_i2send(iph2, msg0)
784: struct ph2handle *iph2;
785: vchar_t *msg0;
786: {
787: vchar_t *msg = NULL;
788: vchar_t *buf = NULL;
789: vchar_t *hash = NULL;
790: char *p = NULL;
791: int tlen;
792: int error = ISAKMP_INTERNAL_ERROR;
793:
794: /* validity check */
795: if (iph2->status != PHASE2ST_STATUS6) {
796: plog(LLV_ERROR, LOCATION, NULL,
797: "status mismatched %d.\n", iph2->status);
798: goto end;
799: }
800:
801: /* generate HASH(3) */
802: {
803: vchar_t *tmp = NULL;
804:
805: plog(LLV_DEBUG, LOCATION, NULL, "HASH(3) generate\n");
806:
807: tmp = vmalloc(iph2->nonce->l + iph2->nonce_p->l);
808: if (tmp == NULL) {
809: plog(LLV_ERROR, LOCATION, NULL,
810: "failed to get hash buffer.\n");
811: goto end;
812: }
813: memcpy(tmp->v, iph2->nonce->v, iph2->nonce->l);
814: memcpy(tmp->v + iph2->nonce->l, iph2->nonce_p->v, iph2->nonce_p->l);
815:
816: hash = oakley_compute_hash3(iph2->ph1, iph2->msgid, tmp);
817: vfree(tmp);
818:
819: if (hash == NULL)
820: goto end;
821: }
822:
823: /* create buffer for isakmp payload */
824: tlen = sizeof(struct isakmp)
825: + sizeof(struct isakmp_gen) + hash->l;
826: buf = vmalloc(tlen);
827: if (buf == NULL) {
828: plog(LLV_ERROR, LOCATION, NULL,
829: "failed to get buffer to send.\n");
830: goto end;
831: }
832:
833: /* create isakmp header */
834: p = set_isakmp_header2(buf, iph2, ISAKMP_NPTYPE_HASH);
835: if (p == NULL)
836: goto end;
837:
838: /* add HASH(3) payload */
839: p = set_isakmp_payload(p, hash, ISAKMP_NPTYPE_NONE);
840:
841: #ifdef HAVE_PRINT_ISAKMP_C
842: isakmp_printpacket(buf, iph2->ph1->local, iph2->ph1->remote, 1);
843: #endif
844:
845: /* encoding */
846: iph2->sendbuf = oakley_do_encrypt(iph2->ph1, buf, iph2->ivm->ive, iph2->ivm->iv);
847: if (iph2->sendbuf == NULL)
848: goto end;
849:
850: /* if there is commit bit, need resending */
851: if (ISSET(iph2->flags, ISAKMP_FLAG_C)) {
852: /* send the packet, add to the schedule to resend */
853: if (isakmp_ph2send(iph2) == -1)
854: goto end;
855: } else {
856: /* send the packet */
857: if (isakmp_send(iph2->ph1, iph2->sendbuf) < 0)
858: goto end;
859: }
860:
861: /* the sending message is added to the received-list. */
862: if (add_recvdpkt(iph2->ph1->remote, iph2->ph1->local,
863: iph2->sendbuf, msg0) == -1) {
864: plog(LLV_ERROR , LOCATION, NULL,
865: "failed to add a response packet to the tree.\n");
866: goto end;
867: }
868:
869: /* compute both of KEYMATs */
870: if (oakley_compute_keymat(iph2, INITIATOR) < 0)
871: goto end;
872:
873: iph2->status = PHASE2ST_ADDSA;
874:
875: /* don't anything if local test mode. */
876: if (f_local) {
877: error = 0;
878: goto end;
879: }
880:
881: /* if there is commit bit don't set up SA now. */
882: if (ISSET(iph2->flags, ISAKMP_FLAG_C)) {
883: iph2->status = PHASE2ST_COMMIT;
884: error = 0;
885: goto end;
886: }
887:
888: /* Do UPDATE for initiator */
889: plog(LLV_DEBUG, LOCATION, NULL, "call pk_sendupdate\n");
890: if (pk_sendupdate(iph2) < 0) {
891: plog(LLV_ERROR, LOCATION, NULL, "pfkey update failed.\n");
892: goto end;
893: }
894: plog(LLV_DEBUG, LOCATION, NULL, "pfkey update sent.\n");
895:
896: /* Do ADD for responder */
897: if (pk_sendadd(iph2) < 0) {
898: plog(LLV_ERROR, LOCATION, NULL, "pfkey add failed.\n");
899: goto end;
900: }
901: plog(LLV_DEBUG, LOCATION, NULL, "pfkey add sent.\n");
902:
903: error = 0;
904:
905: end:
906: if (buf != NULL)
907: vfree(buf);
908: if (msg != NULL)
909: vfree(msg);
910: if (hash != NULL)
911: vfree(hash);
912:
913: return error;
914: }
915:
916: /*
917: * receive from responder
918: * HDR#*, HASH(4), notify
919: */
920: int
921: quick_i3recv(iph2, msg0)
922: struct ph2handle *iph2;
923: vchar_t *msg0;
924: {
925: vchar_t *msg = NULL;
926: vchar_t *pbuf = NULL; /* for payload parsing */
927: struct isakmp_parse_t *pa;
928: struct isakmp_pl_hash *hash = NULL;
929: vchar_t *notify = NULL;
930: int error = ISAKMP_INTERNAL_ERROR;
931:
932: /* validity check */
933: if (iph2->status != PHASE2ST_COMMIT) {
934: plog(LLV_ERROR, LOCATION, NULL,
935: "status mismatched %d.\n", iph2->status);
936: goto end;
937: }
938:
939: /* decrypt packet */
940: if (!ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E)) {
941: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
942: "Packet wasn't encrypted.\n");
943: goto end;
944: }
945: msg = oakley_do_decrypt(iph2->ph1, msg0, iph2->ivm->iv, iph2->ivm->ive);
946: if (msg == NULL)
947: goto end;
948:
949: /* validate the type of next payload */
950: pbuf = isakmp_parse(msg);
951: if (pbuf == NULL)
952: goto end;
953:
954: for (pa = (struct isakmp_parse_t *)pbuf->v;
955: pa->type != ISAKMP_NPTYPE_NONE;
956: pa++) {
957:
958: switch (pa->type) {
959: case ISAKMP_NPTYPE_HASH:
960: hash = (struct isakmp_pl_hash *)pa->ptr;
961: break;
962: case ISAKMP_NPTYPE_N:
963: if (notify != NULL) {
964: plog(LLV_WARNING, LOCATION, NULL,
965: "Ignoring multiples notifications\n");
966: break;
967: }
968: ph2_recv_n(iph2, pa->ptr);
969: notify = vmalloc(pa->len);
970: if (notify == NULL) {
971: plog(LLV_ERROR, LOCATION, NULL,
972: "failed to get notify buffer.\n");
973: goto end;
974: }
975: memcpy(notify->v, pa->ptr, notify->l);
976: break;
977: default:
978: /* don't send information, see ident_r1recv() */
979: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
980: "ignore the packet, "
981: "received unexpecting payload type %d.\n",
982: pa->type);
983: goto end;
984: }
985: }
986:
987: /* payload existency check */
988: if (hash == NULL) {
989: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
990: "few isakmp message received.\n");
991: goto end;
992: }
993:
994: /* validate HASH(4) */
995: {
996: char *r_hash;
997: vchar_t *my_hash = NULL;
998: vchar_t *tmp = NULL;
999: int result;
1000:
1001: r_hash = (char *)hash + sizeof(*hash);
1002:
1003: plog(LLV_DEBUG, LOCATION, NULL, "HASH(4) validate:");
1004: plogdump(LLV_DEBUG, r_hash, ntohs(hash->h.len) - sizeof(*hash));
1005:
1006: my_hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, notify);
1007: vfree(tmp);
1008: if (my_hash == NULL)
1009: goto end;
1010:
1011: result = memcmp(my_hash->v, r_hash, my_hash->l);
1012: vfree(my_hash);
1013:
1014: if (result) {
1015: plog(LLV_DEBUG, LOCATION, iph2->ph1->remote,
1016: "HASH(4) mismatch.\n");
1017: error = ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
1018: goto end;
1019: }
1020: }
1021:
1022: iph2->status = PHASE2ST_ADDSA;
1023: iph2->flags ^= ISAKMP_FLAG_C; /* reset bit */
1024:
1025: /* don't anything if local test mode. */
1026: if (f_local) {
1027: error = 0;
1028: goto end;
1029: }
1030:
1031: /* Do UPDATE for initiator */
1032: plog(LLV_DEBUG, LOCATION, NULL, "call pk_sendupdate\n");
1033: if (pk_sendupdate(iph2) < 0) {
1034: plog(LLV_ERROR, LOCATION, NULL, "pfkey update failed.\n");
1035: goto end;
1036: }
1037: plog(LLV_DEBUG, LOCATION, NULL, "pfkey update sent.\n");
1038:
1039: /* Do ADD for responder */
1040: if (pk_sendadd(iph2) < 0) {
1041: plog(LLV_ERROR, LOCATION, NULL, "pfkey add failed.\n");
1042: goto end;
1043: }
1044: plog(LLV_DEBUG, LOCATION, NULL, "pfkey add sent.\n");
1045:
1046: error = 0;
1047:
1048: end:
1049: if (msg != NULL)
1050: vfree(msg);
1051: if (pbuf != NULL)
1052: vfree(pbuf);
1053: if (notify != NULL)
1054: vfree(notify);
1055:
1056: return error;
1057: }
1058:
1059: /*
1060: * receive from initiator
1061: * HDR*, HASH(1), SA, Ni [, KE ] [, IDi2, IDr2 ] [, NAT-OAi, NAT-OAr ]
1062: */
1063: int
1064: quick_r1recv(iph2, msg0)
1065: struct ph2handle *iph2;
1066: vchar_t *msg0;
1067: {
1068: vchar_t *msg = NULL;
1069: vchar_t *hbuf = NULL; /* for hash computing. */
1070: vchar_t *pbuf = NULL; /* for payload parsing */
1071: struct isakmp_parse_t *pa;
1072: struct isakmp *isakmp = (struct isakmp *)msg0->v;
1073: struct isakmp_pl_hash *hash = NULL;
1074: char *p;
1075: int tlen;
1076: int f_id_order; /* for ID payload detection */
1077: int error = ISAKMP_INTERNAL_ERROR;
1078:
1079: /* validity check */
1080: if (iph2->status != PHASE2ST_START) {
1081: plog(LLV_ERROR, LOCATION, NULL,
1082: "status mismatched %d.\n", iph2->status);
1083: goto end;
1084: }
1085:
1086: /* decrypting */
1087: if (!ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E)) {
1088: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1089: "Packet wasn't encrypted.\n");
1090: error = ISAKMP_NTYPE_PAYLOAD_MALFORMED;
1091: goto end;
1092: }
1093: /* decrypt packet */
1094: msg = oakley_do_decrypt(iph2->ph1, msg0, iph2->ivm->iv, iph2->ivm->ive);
1095: if (msg == NULL) {
1096: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1097: "Packet decryption failed.\n");
1098: goto end;
1099: }
1100:
1101: /* create buffer for using to validate HASH(1) */
1102: /*
1103: * ordering rule:
1104: * 1. the first one must be HASH
1105: * 2. the second one must be SA (added in isakmp-oakley-05!)
1106: * 3. two IDs must be considered as IDci, then IDcr
1107: */
1108: pbuf = isakmp_parse(msg);
1109: if (pbuf == NULL)
1110: goto end;
1111: pa = (struct isakmp_parse_t *)pbuf->v;
1112:
1113: /* HASH payload is fixed postion */
1114: if (pa->type != ISAKMP_NPTYPE_HASH) {
1115: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1116: "received invalid next payload type %d, "
1117: "expecting %d.\n",
1118: pa->type, ISAKMP_NPTYPE_HASH);
1119: error = ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX;
1120: goto end;
1121: }
1122: hash = (struct isakmp_pl_hash *)pa->ptr;
1123: pa++;
1124:
1125: /*
1126: * this restriction was introduced in isakmp-oakley-05.
1127: * we do not check this for backward compatibility.
1128: * TODO: command line/config file option to enable/disable this code
1129: */
1130: /* HASH payload is fixed postion */
1131: if (pa->type != ISAKMP_NPTYPE_SA) {
1132: plog(LLV_WARNING, LOCATION, iph2->ph1->remote,
1133: "received invalid next payload type %d, "
1134: "expecting %d.\n",
1135: pa->type, ISAKMP_NPTYPE_SA);
1136: error = ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX;
1137: }
1138:
1139: /* allocate buffer for computing HASH(1) */
1140: tlen = ntohl(isakmp->len) - sizeof(*isakmp);
1141: hbuf = vmalloc(tlen);
1142: if (hbuf == NULL) {
1143: plog(LLV_ERROR, LOCATION, NULL,
1144: "failed to get hash buffer.\n");
1145: goto end;
1146: }
1147: p = hbuf->v;
1148:
1149: /*
1150: * parse the payloads.
1151: * copy non-HASH payloads into hbuf, so that we can validate HASH.
1152: */
1153: iph2->sa = NULL; /* we don't support multi SAs. */
1154: iph2->nonce_p = NULL;
1155: iph2->dhpub_p = NULL;
1156: iph2->id_p = NULL;
1157: iph2->id = NULL;
1158: tlen = 0; /* count payload length except of HASH payload. */
1159:
1160: /*
1161: * IDi2 MUST be immediatelly followed by IDr2. We allowed the
1162: * illegal case, but logged. First ID payload is to be IDi2.
1163: * And next ID payload is to be IDr2.
1164: */
1165: f_id_order = 0;
1166:
1167: for (; pa->type; pa++) {
1168:
1169: /* copy to buffer for HASH */
1170: /* Don't modify the payload */
1171: memcpy(p, pa->ptr, pa->len);
1172:
1173: if (pa->type != ISAKMP_NPTYPE_ID)
1174: f_id_order = 0;
1175:
1176: switch (pa->type) {
1177: case ISAKMP_NPTYPE_SA:
1178: if (iph2->sa != NULL) {
1179: plog(LLV_ERROR, LOCATION, NULL,
1180: "Multi SAs isn't supported.\n");
1181: goto end;
1182: }
1183: if (isakmp_p2ph(&iph2->sa, pa->ptr) < 0) {
1184: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1185: "duplicate ISAKMP_NPTYPE_SA.\n");
1186: goto end;
1187: }
1188: break;
1189:
1190: case ISAKMP_NPTYPE_NONCE:
1191: if (isakmp_p2ph(&iph2->nonce_p, pa->ptr) < 0) {
1192: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1193: "duplicate ISAKMP_NPTYPE_NONCE.\n");
1194: goto end;
1195: }
1196: break;
1197:
1198: case ISAKMP_NPTYPE_KE:
1199: if (isakmp_p2ph(&iph2->dhpub_p, pa->ptr) < 0) {
1200: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1201: "duplicate ISAKMP_NPTYPE_KE.\n");
1202: goto end;
1203: }
1204: break;
1205:
1206: case ISAKMP_NPTYPE_ID:
1207: if (iph2->id_p == NULL) {
1208: /* for IDci */
1209: f_id_order++;
1210:
1211: if (isakmp_p2ph(&iph2->id_p, pa->ptr) < 0)
1212: goto end;
1213:
1214: } else if (iph2->id == NULL) {
1215: /* for IDcr */
1216: if (f_id_order == 0) {
1217: plog(LLV_ERROR, LOCATION, NULL,
1218: "IDr2 payload is not "
1219: "immediatelly followed "
1220: "by IDi2. We allowed.\n");
1221: /* XXX we allowed in this case. */
1222: }
1223:
1224: if (isakmp_p2ph(&iph2->id, pa->ptr) < 0)
1225: goto end;
1226: } else {
1227: plog(LLV_ERROR, LOCATION, NULL,
1228: "received too many ID payloads.\n");
1229: plogdump(LLV_ERROR, iph2->id->v, iph2->id->l);
1230: error = ISAKMP_NTYPE_INVALID_ID_INFORMATION;
1231: goto end;
1232: }
1233: break;
1234:
1235: case ISAKMP_NPTYPE_N:
1236: ph2_recv_n(iph2, pa->ptr);
1237: break;
1238:
1239: #ifdef ENABLE_NATT
1240: case ISAKMP_NPTYPE_NATOA_DRAFT:
1241: case ISAKMP_NPTYPE_NATOA_RFC:
1242: {
1243: struct sockaddr_storage addr;
1244: struct sockaddr *daddr;
1245: u_int8_t prefix;
1246: u_int16_t ul_proto;
1247: vchar_t *vp = NULL;
1248:
1249: if (isakmp_p2ph(&vp, pa->ptr) < 0)
1250: goto end;
1251:
1252: error = ipsecdoi_id2sockaddr(vp,
1253: (struct sockaddr *) &addr,
1254: &prefix, &ul_proto);
1255:
1256: vfree(vp);
1257:
1258: if (error)
1259: goto end;
1260:
1261: daddr = dupsaddr((struct sockaddr *) &addr);
1262: if (daddr == NULL)
1263: goto end;
1264:
1265: if (iph2->natoa_dst == NULL)
1266: iph2->natoa_dst = daddr;
1267: else if (iph2->natoa_src == NULL)
1268: iph2->natoa_src = daddr;
1269: else {
1270: racoon_free(daddr);
1271: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1272: "received too many NAT-OA payloads.\n");
1273: error = ISAKMP_NTYPE_PAYLOAD_MALFORMED;
1274: goto end;
1275: }
1276: }
1277: break;
1278: #endif
1279:
1280: default:
1281: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1282: "ignore the packet, "
1283: "received unexpecting payload type %d.\n",
1284: pa->type);
1285: error = ISAKMP_NTYPE_PAYLOAD_MALFORMED;
1286: goto end;
1287: }
1288:
1289: p += pa->len;
1290:
1291: /* compute true length of payload. */
1292: tlen += pa->len;
1293: }
1294:
1295: /* payload existency check */
1296: if (hash == NULL || iph2->sa == NULL || iph2->nonce_p == NULL) {
1297: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1298: "few isakmp message received.\n");
1299: error = ISAKMP_NTYPE_PAYLOAD_MALFORMED;
1300: goto end;
1301: }
1302:
1303: if (iph2->id_p) {
1304: plog(LLV_DEBUG, LOCATION, NULL, "received IDci2:");
1305: plogdump(LLV_DEBUG, iph2->id_p->v, iph2->id_p->l);
1306: }
1307: if (iph2->id) {
1308: plog(LLV_DEBUG, LOCATION, NULL, "received IDcr2:");
1309: plogdump(LLV_DEBUG, iph2->id->v, iph2->id->l);
1310: }
1311:
1312: /* adjust buffer length for HASH */
1313: hbuf->l = tlen;
1314:
1315: /* validate HASH(1) */
1316: {
1317: char *r_hash;
1318: vchar_t *my_hash = NULL;
1319: int result;
1320:
1321: r_hash = (caddr_t)hash + sizeof(*hash);
1322:
1323: plog(LLV_DEBUG, LOCATION, NULL, "HASH(1) validate:");
1324: plogdump(LLV_DEBUG, r_hash, ntohs(hash->h.len) - sizeof(*hash));
1325:
1326: my_hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, hbuf);
1327: if (my_hash == NULL)
1328: goto end;
1329:
1330: result = memcmp(my_hash->v, r_hash, my_hash->l);
1331: vfree(my_hash);
1332:
1333: if (result) {
1334: plog(LLV_DEBUG, LOCATION, iph2->ph1->remote,
1335: "HASH(1) mismatch.\n");
1336: error = ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
1337: goto end;
1338: }
1339: }
1340:
1341: /* get sainfo */
1342: error = get_sainfo_r(iph2);
1343: if (error) {
1344: plog(LLV_ERROR, LOCATION, NULL,
1345: "failed to get sainfo.\n");
1346: goto end;
1347: }
1348:
1349:
1350: /* check the existence of ID payload and create responder's proposal */
1351: error = get_proposal_r(iph2);
1352: switch (error) {
1353: case -2:
1354: /* generate a policy template from peer's proposal */
1355: if (set_proposal_from_proposal(iph2)) {
1356: plog(LLV_ERROR, LOCATION, NULL,
1357: "failed to generate a proposal template "
1358: "from client's proposal.\n");
1359: error = ISAKMP_INTERNAL_ERROR;
1360: goto end;
1361: }
1362: /*FALLTHROUGH*/
1363: case 0:
1364: /* select single proposal or reject it. */
1365: if (ipsecdoi_selectph2proposal(iph2) < 0) {
1366: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1367: "no proposal chosen.\n");
1368: error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
1369: goto end;
1370: }
1371: break;
1372: default:
1373: plog(LLV_ERROR, LOCATION, NULL,
1374: "failed to get proposal for responder.\n");
1375: goto end;
1376: }
1377:
1378: /* check KE and attribute of PFS */
1379: if (iph2->dhpub_p != NULL && iph2->approval->pfs_group == 0) {
1380: plog(LLV_ERROR, LOCATION, NULL,
1381: "no PFS is specified, but peer sends KE.\n");
1382: error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
1383: goto end;
1384: }
1385: if (iph2->dhpub_p == NULL && iph2->approval->pfs_group != 0) {
1386: plog(LLV_ERROR, LOCATION, NULL,
1387: "PFS is specified, but peer doesn't sends KE.\n");
1388: error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
1389: goto end;
1390: }
1391:
1392: /*
1393: * save the packet from the initiator in order to resend the
1394: * responder's first packet against this packet.
1395: */
1396: iph2->msg1 = vdup(msg0);
1397:
1398: /* change status of isakmp status entry */
1399: iph2->status = PHASE2ST_STATUS2;
1400:
1401: error = 0;
1402:
1403: end:
1404: if (hbuf)
1405: vfree(hbuf);
1406: if (msg)
1407: vfree(msg);
1408: if (pbuf)
1409: vfree(pbuf);
1410:
1411: if (error) {
1412: VPTRINIT(iph2->sa);
1413: VPTRINIT(iph2->nonce_p);
1414: VPTRINIT(iph2->dhpub_p);
1415: VPTRINIT(iph2->id);
1416: VPTRINIT(iph2->id_p);
1417: #ifdef ENABLE_NATT
1418: if (iph2->natoa_src) {
1419: racoon_free(iph2->natoa_src);
1420: iph2->natoa_src = NULL;
1421: }
1422: if (iph2->natoa_dst) {
1423: racoon_free(iph2->natoa_dst);
1424: iph2->natoa_dst = NULL;
1425: }
1426: #endif
1427: }
1428:
1429: return error;
1430: }
1431:
1432: /*
1433: * call pfkey_getspi.
1434: */
1435: int
1436: quick_r1prep(iph2, msg)
1437: struct ph2handle *iph2;
1438: vchar_t *msg;
1439: {
1440: int error = ISAKMP_INTERNAL_ERROR;
1441:
1442: /* validity check */
1443: if (iph2->status != PHASE2ST_STATUS2) {
1444: plog(LLV_ERROR, LOCATION, NULL,
1445: "status mismatched %d.\n", iph2->status);
1446: goto end;
1447: }
1448:
1449: iph2->status = PHASE2ST_GETSPISENT;
1450:
1451: /* send getspi message */
1452: if (pk_sendgetspi(iph2) < 0)
1453: goto end;
1454:
1455: plog(LLV_DEBUG, LOCATION, NULL, "pfkey getspi sent.\n");
1456:
1457: sched_schedule(&iph2->sce, lcconf->wait_ph2complete,
1458: quick_timeover_stub);
1459:
1460: error = 0;
1461:
1462: end:
1463: return error;
1464: }
1465:
1466: /*
1467: * send to initiator
1468: * HDR*, HASH(2), SA, Nr [, KE ] [, IDi2, IDr2 ] [, NAT-OAi, NAT-OAr ]
1469: */
1470: int
1471: quick_r2send(iph2, msg)
1472: struct ph2handle *iph2;
1473: vchar_t *msg;
1474: {
1475: vchar_t *body = NULL;
1476: vchar_t *hash = NULL;
1477: struct isakmp_gen *gen;
1478: char *p;
1479: int tlen;
1480: int error = ISAKMP_INTERNAL_ERROR;
1481: int natoa = ISAKMP_NPTYPE_NONE;
1482: int pfsgroup;
1483: u_int8_t *np_p = NULL;
1484: #ifdef ENABLE_NATT
1485: vchar_t *nat_oai = NULL;
1486: vchar_t *nat_oar = NULL;
1487: #endif
1488:
1489: /* validity check */
1490: if (msg != NULL) {
1491: plog(LLV_ERROR, LOCATION, NULL,
1492: "msg has to be NULL in this function.\n");
1493: goto end;
1494: }
1495: if (iph2->status != PHASE2ST_GETSPIDONE) {
1496: plog(LLV_ERROR, LOCATION, NULL,
1497: "status mismatched %d.\n", iph2->status);
1498: goto end;
1499: }
1500:
1501: /* update responders SPI */
1502: if (ipsecdoi_updatespi(iph2) < 0) {
1503: plog(LLV_ERROR, LOCATION, NULL, "failed to update spi.\n");
1504: goto end;
1505: }
1506:
1507: /* generate NONCE value */
1508: iph2->nonce = eay_set_random(iph2->ph1->rmconf->nonce_size);
1509: if (iph2->nonce == NULL)
1510: goto end;
1511:
1512: /* generate KE value if need */
1513: pfsgroup = iph2->approval->pfs_group;
1514: if (iph2->dhpub_p != NULL && pfsgroup != 0) {
1515: /* DH group settting if PFS is required. */
1516: if (oakley_setdhgroup(pfsgroup, &iph2->pfsgrp) < 0) {
1517: plog(LLV_ERROR, LOCATION, NULL,
1518: "failed to set DH value.\n");
1519: goto end;
1520: }
1521: /* generate DH public value */
1522: if (oakley_dh_generate(iph2->pfsgrp,
1523: &iph2->dhpub, &iph2->dhpriv) < 0) {
1524: goto end;
1525: }
1526: }
1527:
1528: #ifdef ENABLE_NATT
1529: /*
1530: * RFC3947 5.2. if we chose UDP-Encapsulated-Transport
1531: * we should send NAT-OA
1532: */
1533: if (ipsecdoi_transportmode(iph2->proposal)
1534: && (iph2->ph1->natt_flags & NAT_DETECTED)) {
1535: natoa = iph2->ph1->natt_options->payload_nat_oa;
1536:
1537: nat_oai = ipsecdoi_sockaddr2id(iph2->dst,
1538: IPSECDOI_PREFIX_HOST, IPSEC_ULPROTO_ANY);
1539: nat_oar = ipsecdoi_sockaddr2id(iph2->src,
1540: IPSECDOI_PREFIX_HOST, IPSEC_ULPROTO_ANY);
1541:
1542: if (nat_oai == NULL || nat_oar == NULL) {
1543: plog(LLV_ERROR, LOCATION, NULL,
1544: "failed to generate NAT-OA payload.\n");
1545: goto end;
1546: }
1547:
1548: plog(LLV_DEBUG, LOCATION, NULL, "NAT-OAi:\n");
1549: plogdump(LLV_DEBUG, nat_oai->v, nat_oai->l);
1550: plog(LLV_DEBUG, LOCATION, NULL, "NAT-OAr:\n");
1551: plogdump(LLV_DEBUG, nat_oar->v, nat_oar->l);
1552: }
1553: #endif
1554:
1555: /* create SA;NONCE payload, and KE and ID if need */
1556: tlen = sizeof(*gen) + iph2->sa_ret->l
1557: + sizeof(*gen) + iph2->nonce->l;
1558: if (iph2->dhpub_p != NULL && pfsgroup != 0)
1559: tlen += (sizeof(*gen) + iph2->dhpub->l);
1560: if (iph2->id_p != NULL)
1561: tlen += (sizeof(*gen) + iph2->id_p->l
1562: + sizeof(*gen) + iph2->id->l);
1563: #ifdef ENABLE_NATT
1564: if (natoa != ISAKMP_NPTYPE_NONE)
1565: tlen += 2 * sizeof(*gen) + nat_oai->l + nat_oar->l;
1566: #endif
1567:
1568: body = vmalloc(tlen);
1569: if (body == NULL) {
1570: plog(LLV_ERROR, LOCATION, NULL,
1571: "failed to get buffer to send.\n");
1572: goto end;
1573: }
1574: p = body->v;
1575:
1576: /* make SA payload */
1577: p = set_isakmp_payload(body->v, iph2->sa_ret, ISAKMP_NPTYPE_NONCE);
1578:
1579: /* add NONCE payload */
1580: np_p = &((struct isakmp_gen *)p)->np; /* XXX */
1581: p = set_isakmp_payload(p, iph2->nonce,
1582: (iph2->dhpub_p != NULL && pfsgroup != 0)
1583: ? ISAKMP_NPTYPE_KE
1584: : (iph2->id_p != NULL
1585: ? ISAKMP_NPTYPE_ID
1586: : natoa));
1587:
1588: /* add KE payload if need. */
1589: if (iph2->dhpub_p != NULL && pfsgroup != 0) {
1590: np_p = &((struct isakmp_gen *)p)->np; /* XXX */
1591: p = set_isakmp_payload(p, iph2->dhpub,
1592: (iph2->id_p == NULL)
1593: ? natoa
1594: : ISAKMP_NPTYPE_ID);
1595: }
1596:
1597: /* add ID payloads received. */
1598: if (iph2->id_p != NULL) {
1599: /* IDci */
1600: p = set_isakmp_payload(p, iph2->id_p, ISAKMP_NPTYPE_ID);
1601: /* IDcr */
1602: np_p = &((struct isakmp_gen *)p)->np; /* XXX */
1603: p = set_isakmp_payload(p, iph2->id, natoa);
1604: }
1605:
1606: #ifdef ENABLE_NATT
1607: /* NAT-OA */
1608: if (natoa != ISAKMP_NPTYPE_NONE) {
1609: p = set_isakmp_payload(p, nat_oai, natoa);
1610: p = set_isakmp_payload(p, nat_oar, ISAKMP_NPTYPE_NONE);
1611: }
1612: #endif
1613:
1614: /* add a RESPONDER-LIFETIME notify payload if needed */
1615: {
1616: vchar_t *data = NULL;
1617: struct saprop *pp = iph2->approval;
1618: struct saproto *pr;
1619:
1620: if (pp->claim & IPSECDOI_ATTR_SA_LD_TYPE_SEC) {
1621: u_int32_t v = htonl((u_int32_t)pp->lifetime);
1622: data = isakmp_add_attr_l(data, IPSECDOI_ATTR_SA_LD_TYPE,
1623: IPSECDOI_ATTR_SA_LD_TYPE_SEC);
1624: if (!data)
1625: goto end;
1626: data = isakmp_add_attr_v(data, IPSECDOI_ATTR_SA_LD,
1627: (caddr_t)&v, sizeof(v));
1628: if (!data)
1629: goto end;
1630: }
1631: if (pp->claim & IPSECDOI_ATTR_SA_LD_TYPE_KB) {
1632: u_int32_t v = htonl((u_int32_t)pp->lifebyte);
1633: data = isakmp_add_attr_l(data, IPSECDOI_ATTR_SA_LD_TYPE,
1634: IPSECDOI_ATTR_SA_LD_TYPE_KB);
1635: if (!data)
1636: goto end;
1637: data = isakmp_add_attr_v(data, IPSECDOI_ATTR_SA_LD,
1638: (caddr_t)&v, sizeof(v));
1639: if (!data)
1640: goto end;
1641: }
1642:
1643: /*
1644: * XXX Is there only single RESPONDER-LIFETIME payload in a IKE message
1645: * in the case of SA bundle ?
1646: */
1647: if (data) {
1648: for (pr = pp->head; pr; pr = pr->next) {
1649: body = isakmp_add_pl_n(body, &np_p,
1650: ISAKMP_NTYPE_RESPONDER_LIFETIME, pr, data);
1651: if (!body) {
1652: vfree(data);
1653: return error; /* XXX */
1654: }
1655: }
1656: vfree(data);
1657: }
1658: }
1659:
1660: /* generate HASH(2) */
1661: {
1662: vchar_t *tmp;
1663:
1664: tmp = vmalloc(iph2->nonce_p->l + body->l);
1665: if (tmp == NULL) {
1666: plog(LLV_ERROR, LOCATION, NULL,
1667: "failed to get hash buffer.\n");
1668: goto end;
1669: }
1670: memcpy(tmp->v, iph2->nonce_p->v, iph2->nonce_p->l);
1671: memcpy(tmp->v + iph2->nonce_p->l, body->v, body->l);
1672:
1673: hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, tmp);
1674: vfree(tmp);
1675:
1676: if (hash == NULL)
1677: goto end;
1678: }
1679:
1680: /* send isakmp payload */
1681: iph2->sendbuf = quick_ir1mx(iph2, body, hash);
1682: if (iph2->sendbuf == NULL)
1683: goto end;
1684:
1685: /* send the packet, add to the schedule to resend */
1686: if (isakmp_ph2send(iph2) == -1)
1687: goto end;
1688:
1689: /* the sending message is added to the received-list. */
1690: if (add_recvdpkt(iph2->ph1->remote, iph2->ph1->local, iph2->sendbuf, iph2->msg1) == -1) {
1691: plog(LLV_ERROR , LOCATION, NULL,
1692: "failed to add a response packet to the tree.\n");
1693: goto end;
1694: }
1695:
1696: /* change status of isakmp status entry */
1697: iph2->status = PHASE2ST_MSG1SENT;
1698:
1699: error = 0;
1700:
1701: end:
1702: if (body != NULL)
1703: vfree(body);
1704: if (hash != NULL)
1705: vfree(hash);
1706: #ifdef ENABLE_NATT
1707: if (nat_oai != NULL)
1708: vfree(nat_oai);
1709: if (nat_oar != NULL)
1710: vfree(nat_oar);
1711: #endif
1712:
1713: return error;
1714: }
1715:
1716: /*
1717: * receive from initiator
1718: * HDR*, HASH(3)
1719:
1720: */
1721: int
1722: quick_r3recv(iph2, msg0)
1723: struct ph2handle *iph2;
1724: vchar_t *msg0;
1725: {
1726: vchar_t *msg = NULL;
1727: vchar_t *pbuf = NULL; /* for payload parsing */
1728: struct isakmp_parse_t *pa;
1729: struct isakmp_pl_hash *hash = NULL;
1730: int error = ISAKMP_INTERNAL_ERROR;
1731:
1732: /* validity check */
1733: if (iph2->status != PHASE2ST_MSG1SENT) {
1734: plog(LLV_ERROR, LOCATION, NULL,
1735: "status mismatched %d.\n", iph2->status);
1736: goto end;
1737: }
1738:
1739: /* decrypt packet */
1740: if (!ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E)) {
1741: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1742: "Packet wasn't encrypted.\n");
1743: goto end;
1744: }
1745: msg = oakley_do_decrypt(iph2->ph1, msg0, iph2->ivm->iv, iph2->ivm->ive);
1746: if (msg == NULL)
1747: goto end;
1748:
1749: /* validate the type of next payload */
1750: pbuf = isakmp_parse(msg);
1751: if (pbuf == NULL)
1752: goto end;
1753:
1754: for (pa = (struct isakmp_parse_t *)pbuf->v;
1755: pa->type != ISAKMP_NPTYPE_NONE;
1756: pa++) {
1757:
1758: switch (pa->type) {
1759: case ISAKMP_NPTYPE_HASH:
1760: hash = (struct isakmp_pl_hash *)pa->ptr;
1761: break;
1762: case ISAKMP_NPTYPE_N:
1763: ph2_recv_n(iph2, pa->ptr);
1764: break;
1765: default:
1766: /* don't send information, see ident_r1recv() */
1767: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1768: "ignore the packet, "
1769: "received unexpecting payload type %d.\n",
1770: pa->type);
1771: goto end;
1772: }
1773: }
1774:
1775: /* payload existency check */
1776: if (hash == NULL) {
1777: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1778: "few isakmp message received.\n");
1779: goto end;
1780: }
1781:
1782: /* validate HASH(3) */
1783: /* HASH(3) = prf(SKEYID_a, 0 | M-ID | Ni_b | Nr_b) */
1784: {
1785: char *r_hash;
1786: vchar_t *my_hash = NULL;
1787: vchar_t *tmp = NULL;
1788: int result;
1789:
1790: r_hash = (char *)hash + sizeof(*hash);
1791:
1792: plog(LLV_DEBUG, LOCATION, NULL, "HASH(3) validate:");
1793: plogdump(LLV_DEBUG, r_hash, ntohs(hash->h.len) - sizeof(*hash));
1794:
1795: tmp = vmalloc(iph2->nonce_p->l + iph2->nonce->l);
1796: if (tmp == NULL) {
1797: plog(LLV_ERROR, LOCATION, NULL,
1798: "failed to get hash buffer.\n");
1799: goto end;
1800: }
1801: memcpy(tmp->v, iph2->nonce_p->v, iph2->nonce_p->l);
1802: memcpy(tmp->v + iph2->nonce_p->l, iph2->nonce->v, iph2->nonce->l);
1803:
1804: my_hash = oakley_compute_hash3(iph2->ph1, iph2->msgid, tmp);
1805: vfree(tmp);
1806: if (my_hash == NULL)
1807: goto end;
1808:
1809: result = memcmp(my_hash->v, r_hash, my_hash->l);
1810: vfree(my_hash);
1811:
1812: if (result) {
1813: plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1814: "HASH(3) mismatch.\n");
1815: error = ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
1816: goto end;
1817: }
1818: }
1819:
1820: /* if there is commit bit, don't set up SA now. */
1821: if (ISSET(iph2->flags, ISAKMP_FLAG_C)) {
1822: iph2->status = PHASE2ST_COMMIT;
1823: } else
1824: iph2->status = PHASE2ST_STATUS6;
1825:
1826: error = 0;
1827:
1828: end:
1829: if (pbuf != NULL)
1830: vfree(pbuf);
1831: if (msg != NULL)
1832: vfree(msg);
1833:
1834: return error;
1835: }
1836:
1837: /*
1838: * send to initiator
1839: * HDR#*, HASH(4), notify
1840: */
1841: int
1842: quick_r3send(iph2, msg0)
1843: struct ph2handle *iph2;
1844: vchar_t *msg0;
1845: {
1846: vchar_t *buf = NULL;
1847: vchar_t *myhash = NULL;
1848: struct isakmp_pl_n *n;
1849: vchar_t *notify = NULL;
1850: char *p;
1851: int tlen;
1852: int error = ISAKMP_INTERNAL_ERROR;
1853:
1854: /* validity check */
1855: if (iph2->status != PHASE2ST_COMMIT) {
1856: plog(LLV_ERROR, LOCATION, NULL,
1857: "status mismatched %d.\n", iph2->status);
1858: goto end;
1859: }
1860:
1861: /* generate HASH(4) */
1862: /* XXX What can I do in the case of multiple different SA */
1863: plog(LLV_DEBUG, LOCATION, NULL, "HASH(4) generate\n");
1864:
1865: /* XXX What should I do if there are multiple SAs ? */
1866: tlen = sizeof(struct isakmp_pl_n) + iph2->approval->head->spisize;
1867: notify = vmalloc(tlen);
1868: if (notify == NULL) {
1869: plog(LLV_ERROR, LOCATION, NULL,
1870: "failed to get notify buffer.\n");
1871: goto end;
1872: }
1873: n = (struct isakmp_pl_n *)notify->v;
1874: n->h.np = ISAKMP_NPTYPE_NONE;
1875: n->h.len = htons(tlen);
1876: n->doi = htonl(IPSEC_DOI);
1877: n->proto_id = iph2->approval->head->proto_id;
1878: n->spi_size = sizeof(iph2->approval->head->spisize);
1879: n->type = htons(ISAKMP_NTYPE_CONNECTED);
1880: memcpy(n + 1, &iph2->approval->head->spi, iph2->approval->head->spisize);
1881:
1882: myhash = oakley_compute_hash1(iph2->ph1, iph2->msgid, notify);
1883: if (myhash == NULL)
1884: goto end;
1885:
1886: /* create buffer for isakmp payload */
1887: tlen = sizeof(struct isakmp)
1888: + sizeof(struct isakmp_gen) + myhash->l
1889: + notify->l;
1890: buf = vmalloc(tlen);
1891: if (buf == NULL) {
1892: plog(LLV_ERROR, LOCATION, NULL,
1893: "failed to get buffer to send.\n");
1894: goto end;
1895: }
1896:
1897: /* create isakmp header */
1898: p = set_isakmp_header2(buf, iph2, ISAKMP_NPTYPE_HASH);
1899: if (p == NULL)
1900: goto end;
1901:
1902: /* add HASH(4) payload */
1903: p = set_isakmp_payload(p, myhash, ISAKMP_NPTYPE_N);
1904:
1905: /* add notify payload */
1906: memcpy(p, notify->v, notify->l);
1907:
1908: #ifdef HAVE_PRINT_ISAKMP_C
1909: isakmp_printpacket(buf, iph2->ph1->local, iph2->ph1->remote, 1);
1910: #endif
1911:
1912: /* encoding */
1913: iph2->sendbuf = oakley_do_encrypt(iph2->ph1, buf, iph2->ivm->ive, iph2->ivm->iv);
1914: if (iph2->sendbuf == NULL)
1915: goto end;
1916:
1917: /* send the packet */
1918: if (isakmp_send(iph2->ph1, iph2->sendbuf) < 0)
1919: goto end;
1920:
1921: /* the sending message is added to the received-list. */
1922: if (add_recvdpkt(iph2->ph1->remote, iph2->ph1->local, iph2->sendbuf, msg0) == -1) {
1923: plog(LLV_ERROR , LOCATION, NULL,
1924: "failed to add a response packet to the tree.\n");
1925: goto end;
1926: }
1927:
1928: iph2->status = PHASE2ST_COMMIT;
1929:
1930: error = 0;
1931:
1932: end:
1933: if (buf != NULL)
1934: vfree(buf);
1935: if (myhash != NULL)
1936: vfree(myhash);
1937: if (notify != NULL)
1938: vfree(notify);
1939:
1940: return error;
1941: }
1942:
1943: int
1944: tunnel_mode_prop(p)
1945: struct saprop *p;
1946: {
1947: struct saproto *pr;
1948:
1949: for (pr = p->head; pr; pr = pr->next)
1950: if (pr->encmode == IPSECDOI_ATTR_ENC_MODE_TUNNEL)
1951: return 1;
1952: return 0;
1953: }
1954:
1955: /*
1956: * set SA to kernel.
1957: */
1958: int
1959: quick_r3prep(iph2, msg0)
1960: struct ph2handle *iph2;
1961: vchar_t *msg0;
1962: {
1963: int error = ISAKMP_INTERNAL_ERROR;
1964:
1965: /* validity check */
1966: if (iph2->status != PHASE2ST_STATUS6) {
1967: plog(LLV_ERROR, LOCATION, NULL,
1968: "status mismatched %d.\n", iph2->status);
1969: goto end;
1970: }
1971:
1972: /* compute both of KEYMATs */
1973: if (oakley_compute_keymat(iph2, RESPONDER) < 0)
1974: goto end;
1975:
1976: iph2->status = PHASE2ST_ADDSA;
1977: iph2->flags ^= ISAKMP_FLAG_C; /* reset bit */
1978:
1979: /* don't anything if local test mode. */
1980: if (f_local) {
1981: error = 0;
1982: goto end;
1983: }
1984:
1985: /* Do UPDATE as responder */
1986: plog(LLV_DEBUG, LOCATION, NULL, "call pk_sendupdate\n");
1987: if (pk_sendupdate(iph2) < 0) {
1988: plog(LLV_ERROR, LOCATION, NULL, "pfkey update failed.\n");
1989: goto end;
1990: }
1991: plog(LLV_DEBUG, LOCATION, NULL, "pfkey update sent.\n");
1992:
1993: /* Do ADD for responder */
1994: if (pk_sendadd(iph2) < 0) {
1995: plog(LLV_ERROR, LOCATION, NULL, "pfkey add failed.\n");
1996: goto end;
1997: }
1998: plog(LLV_DEBUG, LOCATION, NULL, "pfkey add sent.\n");
1999:
2000: /*
2001: * set policies into SPD if the policy is generated
2002: * from peer's policy.
2003: */
2004: if (iph2->spidx_gen) {
2005:
2006: struct policyindex *spidx;
2007: struct sockaddr_storage addr;
2008: u_int8_t pref;
2009: struct sockaddr *src = iph2->src;
2010: struct sockaddr *dst = iph2->dst;
2011:
2012: /* make inbound policy */
2013: iph2->src = dst;
2014: iph2->dst = src;
2015: if (pk_sendspdupdate2(iph2) < 0) {
2016: plog(LLV_ERROR, LOCATION, NULL,
2017: "pfkey spdupdate2(inbound) failed.\n");
2018: goto end;
2019: }
2020: plog(LLV_DEBUG, LOCATION, NULL,
2021: "pfkey spdupdate2(inbound) sent.\n");
2022:
2023: spidx = (struct policyindex *)iph2->spidx_gen;
2024: #ifdef HAVE_POLICY_FWD
2025: /* make forward policy if required */
2026: if (tunnel_mode_prop(iph2->approval)) {
2027: spidx->dir = IPSEC_DIR_FWD;
2028: if (pk_sendspdupdate2(iph2) < 0) {
2029: plog(LLV_ERROR, LOCATION, NULL,
2030: "pfkey spdupdate2(forward) failed.\n");
2031: goto end;
2032: }
2033: plog(LLV_DEBUG, LOCATION, NULL,
2034: "pfkey spdupdate2(forward) sent.\n");
2035: }
2036: #endif
2037:
2038: /* make outbound policy */
2039: iph2->src = src;
2040: iph2->dst = dst;
2041: spidx->dir = IPSEC_DIR_OUTBOUND;
2042: addr = spidx->src;
2043: spidx->src = spidx->dst;
2044: spidx->dst = addr;
2045: pref = spidx->prefs;
2046: spidx->prefs = spidx->prefd;
2047: spidx->prefd = pref;
2048:
2049: if (pk_sendspdupdate2(iph2) < 0) {
2050: plog(LLV_ERROR, LOCATION, NULL,
2051: "pfkey spdupdate2(outbound) failed.\n");
2052: goto end;
2053: }
2054: plog(LLV_DEBUG, LOCATION, NULL,
2055: "pfkey spdupdate2(outbound) sent.\n");
2056:
2057: /* spidx_gen is unnecessary any more */
2058: delsp_bothdir((struct policyindex *)iph2->spidx_gen);
2059: racoon_free(iph2->spidx_gen);
2060: iph2->spidx_gen = NULL;
2061: iph2->generated_spidx=1;
2062: }
2063:
2064: error = 0;
2065:
2066: end:
2067: return error;
2068: }
2069:
2070: /*
2071: * create HASH, body (SA, NONCE) payload with isakmp header.
2072: */
2073: static vchar_t *
2074: quick_ir1mx(iph2, body, hash)
2075: struct ph2handle *iph2;
2076: vchar_t *body, *hash;
2077: {
2078: struct isakmp *isakmp;
2079: vchar_t *buf = NULL, *new = NULL;
2080: char *p;
2081: int tlen;
2082: struct isakmp_gen *gen;
2083: int error = ISAKMP_INTERNAL_ERROR;
2084:
2085: /* create buffer for isakmp payload */
2086: tlen = sizeof(*isakmp)
2087: + sizeof(*gen) + hash->l
2088: + body->l;
2089: buf = vmalloc(tlen);
2090: if (buf == NULL) {
2091: plog(LLV_ERROR, LOCATION, NULL,
2092: "failed to get buffer to send.\n");
2093: goto end;
2094: }
2095:
2096: /* re-set encryption flag, for serurity. */
2097: iph2->flags |= ISAKMP_FLAG_E;
2098:
2099: /* set isakmp header */
2100: p = set_isakmp_header2(buf, iph2, ISAKMP_NPTYPE_HASH);
2101: if (p == NULL)
2102: goto end;
2103:
2104: /* add HASH payload */
2105: /* XXX is next type always SA ? */
2106: p = set_isakmp_payload(p, hash, ISAKMP_NPTYPE_SA);
2107:
2108: /* add body payload */
2109: memcpy(p, body->v, body->l);
2110:
2111: #ifdef HAVE_PRINT_ISAKMP_C
2112: isakmp_printpacket(buf, iph2->ph1->local, iph2->ph1->remote, 1);
2113: #endif
2114:
2115: /* encoding */
2116: new = oakley_do_encrypt(iph2->ph1, buf, iph2->ivm->ive, iph2->ivm->iv);
2117:
2118: if (new == NULL)
2119: goto end;
2120:
2121: vfree(buf);
2122:
2123: buf = new;
2124:
2125: error = 0;
2126:
2127: end:
2128: if (error && buf != NULL) {
2129: vfree(buf);
2130: buf = NULL;
2131: }
2132:
2133: return buf;
2134: }
2135:
2136: /*
2137: * get remote's sainfo.
2138: * NOTE: this function is for responder.
2139: */
2140: static int
2141: get_sainfo_r(iph2)
2142: struct ph2handle *iph2;
2143: {
2144: vchar_t *idsrc = NULL, *iddst = NULL, *client = NULL;
2145: int error = ISAKMP_INTERNAL_ERROR;
2146:
2147: if (iph2->id == NULL) {
2148: idsrc = ipsecdoi_sockaddr2id(iph2->src, IPSECDOI_PREFIX_HOST,
2149: IPSEC_ULPROTO_ANY);
2150: } else {
2151: idsrc = vdup(iph2->id);
2152: }
2153: if (idsrc == NULL) {
2154: plog(LLV_ERROR, LOCATION, NULL,
2155: "failed to set ID for source.\n");
2156: goto end;
2157: }
2158:
2159: if (iph2->id_p == NULL) {
2160: iddst = ipsecdoi_sockaddr2id(iph2->dst, IPSECDOI_PREFIX_HOST,
2161: IPSEC_ULPROTO_ANY);
2162: } else {
2163: iddst = vdup(iph2->id_p);
2164: }
2165: if (iddst == NULL) {
2166: plog(LLV_ERROR, LOCATION, NULL,
2167: "failed to set ID for destination.\n");
2168: goto end;
2169: }
2170:
2171: #ifdef ENABLE_HYBRID
2172:
2173: /* clientaddr check : obtain modecfg address */
2174: if (iph2->ph1->mode_cfg != NULL) {
2175: if ((iph2->ph1->mode_cfg->flags & ISAKMP_CFG_ADDR4_EXTERN) ||
2176: (iph2->ph1->mode_cfg->flags & ISAKMP_CFG_ADDR4_LOCAL)){
2177: struct sockaddr saddr;
2178: saddr.sa_family = AF_INET;
2179: #ifndef __linux__
2180: saddr.sa_len = sizeof(struct sockaddr_in);
2181: #endif
2182: ((struct sockaddr_in *)&saddr)->sin_port = IPSEC_PORT_ANY;
2183: memcpy(&((struct sockaddr_in *)&saddr)->sin_addr,
2184: &iph2->ph1->mode_cfg->addr4, sizeof(struct in_addr));
2185: client = ipsecdoi_sockaddr2id(&saddr, 32, IPSEC_ULPROTO_ANY);
2186: }
2187: }
2188:
2189: /* clientaddr check, fallback to peer address */
2190: if (client == NULL)
2191: {
2192: client = ipsecdoi_sockaddr2id(iph2->dst, IPSECDOI_PREFIX_HOST,
2193: IPSEC_ULPROTO_ANY);
2194: }
2195: #endif
2196:
2197: /* obtain a matching sainfo section */
2198: iph2->sainfo = getsainfo(idsrc, iddst, iph2->ph1->id_p, client, iph2->ph1->rmconf->ph1id);
2199: if (iph2->sainfo == NULL) {
2200: plog(LLV_ERROR, LOCATION, NULL,
2201: "failed to get sainfo.\n");
2202: goto end;
2203: }
2204:
2205: #ifdef ENABLE_HYBRID
2206: /* xauth group inclusion check */
2207: if (iph2->sainfo->group != NULL)
2208: if(group_check(iph2->ph1,&iph2->sainfo->group->v,1))
2209: goto end;
2210: #endif
2211:
2212: plog(LLV_DEBUG, LOCATION, NULL,
2213: "selected sainfo: %s\n", sainfo2str(iph2->sainfo));
2214:
2215: error = 0;
2216: end:
2217: if (idsrc)
2218: vfree(idsrc);
2219: if (iddst)
2220: vfree(iddst);
2221: if (client)
2222: vfree(client);
2223:
2224: return error;
2225: }
2226:
2227: /*
2228: * Copy both IP addresses in ID payloads into [src,dst]_id if both ID types
2229: * are IP address and same address family.
2230: * Then get remote's policy from SPD copied from kernel.
2231: * If the type of ID payload is address or subnet type, then the index is
2232: * made from the payload. If there is no ID payload, or the type of ID
2233: * payload is NOT address type, then the index is made from the address
2234: * pair of phase 1.
2235: * NOTE: This function is only for responder.
2236: */
2237: static int
2238: get_proposal_r(iph2)
2239: struct ph2handle *iph2;
2240: {
2241: struct policyindex spidx;
2242: struct secpolicy *sp_in, *sp_out;
2243: int idi2type = 0; /* switch whether copy IDs into id[src,dst]. */
2244: int error = ISAKMP_INTERNAL_ERROR;
2245:
2246: /* check the existence of ID payload */
2247: if ((iph2->id_p != NULL && iph2->id == NULL)
2248: || (iph2->id_p == NULL && iph2->id != NULL)) {
2249: plog(LLV_ERROR, LOCATION, NULL,
2250: "Both IDs wasn't found in payload.\n");
2251: return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
2252: }
2253:
2254: /* make sure if sa_[src, dst] are null. */
2255: if (iph2->sa_src || iph2->sa_dst) {
2256: plog(LLV_ERROR, LOCATION, NULL,
2257: "Why do ID[src,dst] exist already.\n");
2258: return ISAKMP_INTERNAL_ERROR;
2259: }
2260:
2261: memset(&spidx, 0, sizeof(spidx));
2262:
2263: #define _XIDT(d) ((struct ipsecdoi_id_b *)(d)->v)->type
2264:
2265: /* make a spidx; a key to search SPD */
2266: spidx.dir = IPSEC_DIR_INBOUND;
2267: spidx.ul_proto = 0;
2268:
2269: /*
2270: * make destination address in spidx from either ID payload
2271: * or phase 1 address into a address in spidx.
2272: */
2273: if (iph2->id != NULL
2274: && (_XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR
2275: || _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR
2276: || _XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR_SUBNET
2277: || _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR_SUBNET)) {
2278: /* get a destination address of a policy */
2279: error = ipsecdoi_id2sockaddr(iph2->id,
2280: (struct sockaddr *)&spidx.dst,
2281: &spidx.prefd, &spidx.ul_proto);
2282: if (error)
2283: return error;
2284:
2285: #ifdef INET6
2286: /*
2287: * get scopeid from the SA address.
2288: * note that the phase 1 source address is used as
2289: * a destination address to search for a inbound policy entry
2290: * because rcoon is responder.
2291: */
2292: if (_XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR) {
2293: error = setscopeid((struct sockaddr *)&spidx.dst,
2294: iph2->src);
2295: if (error)
2296: return error;
2297: }
2298: #endif
2299:
2300: if (_XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR
2301: || _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR)
2302: idi2type = _XIDT(iph2->id);
2303:
2304: } else {
2305:
2306: plog(LLV_DEBUG, LOCATION, NULL,
2307: "get a destination address of SP index "
2308: "from phase1 address "
2309: "due to no ID payloads found "
2310: "OR because ID type is not address.\n");
2311:
2312: /*
2313: * copy the SOURCE address of IKE into the DESTINATION address
2314: * of the key to search the SPD because the direction of policy
2315: * is inbound.
2316: */
2317: memcpy(&spidx.dst, iph2->src, sysdep_sa_len(iph2->src));
2318: switch (spidx.dst.ss_family) {
2319: case AF_INET:
2320: spidx.prefd = sizeof(struct in_addr) << 3;
2321: break;
2322: #ifdef INET6
2323: case AF_INET6:
2324: spidx.prefd = sizeof(struct in6_addr) << 3;
2325: break;
2326: #endif
2327: default:
2328: spidx.prefd = 0;
2329: break;
2330: }
2331: }
2332:
2333: /* make source address in spidx */
2334: if (iph2->id_p != NULL
2335: && (_XIDT(iph2->id_p) == IPSECDOI_ID_IPV4_ADDR
2336: || _XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR
2337: || _XIDT(iph2->id_p) == IPSECDOI_ID_IPV4_ADDR_SUBNET
2338: || _XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR_SUBNET)) {
2339: /* get a source address of inbound SA */
2340: error = ipsecdoi_id2sockaddr(iph2->id_p,
2341: (struct sockaddr *)&spidx.src,
2342: &spidx.prefs, &spidx.ul_proto);
2343: if (error)
2344: return error;
2345:
2346: #ifdef INET6
2347: /*
2348: * get scopeid from the SA address.
2349: * for more detail, see above of this function.
2350: */
2351: if (_XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR) {
2352: error = setscopeid((struct sockaddr *)&spidx.src,
2353: iph2->dst);
2354: if (error)
2355: return error;
2356: }
2357: #endif
2358:
2359: /* Before setting iph2->[sa_src, sa_dst] with the addresses
2360: * provided in ID payloads, we check:
2361: * - they are both addresses of same family
2362: * - sainfo has not been selected only based on ID payload
2363: * information but also based on specific Phase 1
2364: * credentials (iph2->sainfo->id_i is defined), i.e.
2365: * local configuration _explicitly_ expect that user
2366: * (e.g. from asn1dn "C=FR, ...") with those IDs) */
2367: if (_XIDT(iph2->id_p) == idi2type &&
2368: spidx.dst.ss_family == spidx.src.ss_family &&
2369: iph2->sainfo && iph2->sainfo->id_i) {
2370:
2371: iph2->sa_src = dupsaddr((struct sockaddr *)&spidx.dst);
2372: if (iph2->sa_src == NULL) {
2373: plog(LLV_ERROR, LOCATION, NULL,
2374: "buffer allocation failed.\n");
2375: return ISAKMP_INTERNAL_ERROR;
2376: }
2377:
2378: iph2->sa_dst = dupsaddr((struct sockaddr *)&spidx.src);
2379: if (iph2->sa_dst == NULL) {
2380: plog(LLV_ERROR, LOCATION, NULL,
2381: "buffer allocation failed.\n");
2382: return ISAKMP_INTERNAL_ERROR;
2383: }
2384: } else {
2385: plog(LLV_DEBUG, LOCATION, NULL,
2386: "Either family (%d - %d), types (%d - %d) of ID "
2387: "from initiator differ or matching sainfo "
2388: "has no id_i defined for the peer. Not filling "
2389: "iph2->sa_src and iph2->sa_dst.\n",
2390: spidx.src.ss_family, spidx.dst.ss_family,
2391: _XIDT(iph2->id_p),idi2type);
2392: }
2393: } else {
2394: plog(LLV_DEBUG, LOCATION, NULL,
2395: "get a source address of SP index from Phase 1"
2396: "addresses due to no ID payloads found"
2397: "OR because ID type is not address.\n");
2398:
2399: /* see above comment. */
2400: memcpy(&spidx.src, iph2->dst, sysdep_sa_len(iph2->dst));
2401: switch (spidx.src.ss_family) {
2402: case AF_INET:
2403: spidx.prefs = sizeof(struct in_addr) << 3;
2404: break;
2405: #ifdef INET6
2406: case AF_INET6:
2407: spidx.prefs = sizeof(struct in6_addr) << 3;
2408: break;
2409: #endif
2410: default:
2411: spidx.prefs = 0;
2412: break;
2413: }
2414: }
2415:
2416: #undef _XIDT
2417:
2418: plog(LLV_DEBUG, LOCATION, NULL,
2419: "get src address from ID payload "
2420: "%s prefixlen=%u ul_proto=%u\n",
2421: saddr2str((struct sockaddr *)&spidx.src),
2422: spidx.prefs, spidx.ul_proto);
2423: plog(LLV_DEBUG, LOCATION, NULL,
2424: "get dst address from ID payload "
2425: "%s prefixlen=%u ul_proto=%u\n",
2426: saddr2str((struct sockaddr *)&spidx.dst),
2427: spidx.prefd, spidx.ul_proto);
2428:
2429: /*
2430: * convert the ul_proto if it is 0
2431: * because 0 in ID payload means a wild card.
2432: */
2433: if (spidx.ul_proto == 0)
2434: spidx.ul_proto = IPSEC_ULPROTO_ANY;
2435:
2436: #ifdef HAVE_SECCTX
2437: /*
2438: * Need to use security context in spidx to ensure the correct
2439: * policy is selected. The only way to get the security context
2440: * is to look into the proposal sent by peer ahead of time.
2441: */
2442: if (get_security_context(iph2->sa, &spidx)) {
2443: plog(LLV_ERROR, LOCATION, NULL,
2444: "error occurred trying to get security context.\n");
2445: return ISAKMP_INTERNAL_ERROR;
2446: }
2447: #endif /* HAVE_SECCTX */
2448:
2449: /* get inbound policy */
2450: sp_in = getsp_r(&spidx);
2451: if (sp_in == NULL) {
2452: if (iph2->ph1->rmconf->gen_policy) {
2453: plog(LLV_INFO, LOCATION, NULL,
2454: "no policy found, "
2455: "try to generate the policy : %s\n",
2456: spidx2str(&spidx));
2457: iph2->spidx_gen = racoon_malloc(sizeof(spidx));
2458: if (!iph2->spidx_gen) {
2459: plog(LLV_ERROR, LOCATION, NULL,
2460: "buffer allocation failed.\n");
2461: return ISAKMP_INTERNAL_ERROR;
2462: }
2463: memcpy(iph2->spidx_gen, &spidx, sizeof(spidx));
2464: return -2; /* special value */
2465: }
2466: plog(LLV_ERROR, LOCATION, NULL,
2467: "no policy found: %s\n", spidx2str(&spidx));
2468: return ISAKMP_INTERNAL_ERROR;
2469: }
2470: /* Refresh existing generated policies
2471: */
2472: if (iph2->ph1->rmconf->gen_policy) {
2473: plog(LLV_INFO, LOCATION, NULL,
2474: "Update the generated policy : %s\n",
2475: spidx2str(&spidx));
2476: iph2->spidx_gen = racoon_malloc(sizeof(spidx));
2477: if (!iph2->spidx_gen) {
2478: plog(LLV_ERROR, LOCATION, NULL,
2479: "buffer allocation failed.\n");
2480: return ISAKMP_INTERNAL_ERROR;
2481: }
2482: memcpy(iph2->spidx_gen, &spidx, sizeof(spidx));
2483: }
2484:
2485: /* get outbound policy */
2486: {
2487: struct sockaddr_storage addr;
2488: u_int8_t pref;
2489:
2490: spidx.dir = IPSEC_DIR_OUTBOUND;
2491: addr = spidx.src;
2492: spidx.src = spidx.dst;
2493: spidx.dst = addr;
2494: pref = spidx.prefs;
2495: spidx.prefs = spidx.prefd;
2496: spidx.prefd = pref;
2497:
2498: sp_out = getsp_r(&spidx);
2499: if (!sp_out) {
2500: plog(LLV_WARNING, LOCATION, NULL,
2501: "no outbound policy found: %s\n",
2502: spidx2str(&spidx));
2503: }
2504: }
2505:
2506: plog(LLV_DEBUG, LOCATION, NULL,
2507: "suitable SP found:%s\n", spidx2str(&spidx));
2508:
2509: /*
2510: * In the responder side, the inbound policy should be using IPsec.
2511: * outbound policy is not checked currently.
2512: */
2513: if (sp_in->policy != IPSEC_POLICY_IPSEC) {
2514: plog(LLV_ERROR, LOCATION, NULL,
2515: "policy found, but no IPsec required: %s\n",
2516: spidx2str(&spidx));
2517: return ISAKMP_INTERNAL_ERROR;
2518: }
2519:
2520: /* set new proposal derived from a policy into the iph2->proposal. */
2521: if (set_proposal_from_policy(iph2, sp_in, sp_out) < 0) {
2522: plog(LLV_ERROR, LOCATION, NULL,
2523: "failed to create saprop.\n");
2524: return ISAKMP_INTERNAL_ERROR;
2525: }
2526:
2527: #ifdef HAVE_SECCTX
2528: if (spidx.sec_ctx.ctx_str) {
2529: set_secctx_in_proposal(iph2, spidx);
2530: }
2531: #endif /* HAVE_SECCTX */
2532:
2533: iph2->spid = sp_in->id;
2534:
2535: return 0;
2536: }
2537:
2538: /*
2539: * handle a notification payload inside phase2 exchange.
2540: * phase2 is always encrypted, so it does not need to be checked
2541: * for explicitely.
2542: */
2543: static int
2544: ph2_recv_n(iph2, gen)
2545: struct ph2handle *iph2;
2546: struct isakmp_gen *gen;
2547: {
2548: struct ph1handle *iph1 = iph2->ph1;
2549: struct isakmp_pl_n *notify = (struct isakmp_pl_n *) gen;
2550: u_int type;
2551: int check_level;
2552:
2553: type = ntohs(notify->type);
2554: switch (type) {
2555: case ISAKMP_NTYPE_CONNECTED:
2556: break;
2557: case ISAKMP_NTYPE_INITIAL_CONTACT:
2558: return isakmp_info_recv_initialcontact(iph1, iph2);
2559: case ISAKMP_NTYPE_RESPONDER_LIFETIME:
2560: ipsecdoi_parse_responder_lifetime(notify,
2561: &iph2->lifetime_secs, &iph2->lifetime_kb);
2562:
2563: if (iph1 != NULL && iph1->rmconf != NULL) {
2564: check_level = iph1->rmconf->pcheck_level;
2565: } else {
2566: if (iph1 != NULL)
2567: plog(LLV_DEBUG, LOCATION, NULL,
2568: "No phase1 rmconf found !\n");
2569: else
2570: plog(LLV_DEBUG, LOCATION, NULL,
2571: "No phase1 found !\n");
2572: check_level = PROP_CHECK_EXACT;
2573: }
2574:
2575: switch (check_level) {
2576: case PROP_CHECK_OBEY:
2577: break;
2578: case PROP_CHECK_STRICT:
2579: case PROP_CHECK_CLAIM:
2580: if (iph2->sainfo == NULL
2581: || iph2->sainfo->lifetime <= iph2->lifetime_secs) {
2582: plog(LLV_WARNING, LOCATION, NULL,
2583: "RESPONDER-LIFETIME: lifetime mismatch\n");
2584: iph2->lifetime_secs = 0;
2585: }
2586: break;
2587: case PROP_CHECK_EXACT:
2588: if (iph2->sainfo == NULL
2589: || iph2->sainfo->lifetime != iph2->lifetime_secs) {
2590: plog(LLV_WARNING, LOCATION, NULL,
2591: "RESPONDER-LIFETIME: lifetime mismatch\n");
2592: iph2->lifetime_secs = 0;
2593: }
2594: break;
2595: }
2596: break;
2597: default:
2598: isakmp_log_notify(iph2->ph1, notify, "phase2 exchange");
2599: isakmp_info_send_n2(iph2, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE,
2600: NULL);
2601: break;
2602: }
2603: return 0;
2604: }
2605: