Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

When rekeying phase2 use phase1 used to negotiate phase2 as a hint to

Browse Source 
select the phase1 for rekeying the new phase2.
This commit is contained in:
tteras 2009-09-03 09:29:07 +00:00
parent e36a465d74
commit 63bcd231eb
6 changed files with 174 additions and 145 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
crypto/dist/ipsec-tools/src/racoon/admin.c vendored
View File

@ -1,11 +1,11 @@
/* $NetBSD: admin.c,v 1.31 2009/07/03 06:41:46 tteras Exp $ */ /* $NetBSD: admin.c,v 1.32 2009/09/03 09:29:07 tteras Exp $ */
/* Id: admin.c,v 1.25 2006/04/06 14:31:04 manubsd Exp */ /* Id: admin.c,v 1.25 2006/04/06 14:31:04 manubsd Exp */
/* /*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
* All rights reserved. * All rights reserved.
* *
* Redistribution and use in source and binary forms, with or without * Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions * modification, are permitted provided that the following conditions
* are met: * are met:
@ -17,7 +17,7 @@
* 3. Neither the name of the project nor the names of its contributors * 3. Neither the name of the project nor the names of its contributors
* may be used to endorse or promote products derived from this software * may be used to endorse or promote products derived from this software
* without specific prior written permission. * without specific prior written permission.
* *
* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@ -341,7 +341,7 @@ admin_process(so2, combuf)
user[len] = 0; user[len] = 0;
found = purgeph1bylogin(user); found = purgeph1bylogin(user);
plog(LLV_INFO, LOCATION, NULL, plog(LLV_INFO, LOCATION, NULL,
"deleted %d SA for user \"%s\"\n", found, user); "deleted %d SA for user \"%s\"\n", found, user);
break; break;
@ -360,7 +360,7 @@ admin_process(so2, combuf)
rem = racoon_strdup(saddrwop2str(dst)); rem = racoon_strdup(saddrwop2str(dst));
STRDUP_FATAL(rem); STRDUP_FATAL(rem);
plog(LLV_INFO, LOCATION, NULL, plog(LLV_INFO, LOCATION, NULL,
"Flushing all SAs for peer %s\n", rem); "Flushing all SAs for peer %s\n", rem);
while ((iph1 = getph1bydstaddr(dst)) != NULL) { while ((iph1 = getph1bydstaddr(dst)) != NULL) {
@ -373,7 +373,7 @@ admin_process(so2, combuf)
racoon_free(loc); racoon_free(loc);
} }
racoon_free(rem); racoon_free(rem);
break; break;
} }
@ -383,14 +383,14 @@ admin_process(so2, combuf)
char *data; char *data;
acp = (struct admin_com_psk *) acp = (struct admin_com_psk *)
((char *)com + sizeof(*com) + ((char *)com + sizeof(*com) +
sizeof(struct admin_com_indexes)); sizeof(struct admin_com_indexes));
idtype = acp->id_type; idtype = acp->id_type;
if ((id = vmalloc(acp->id_len)) == NULL) { if ((id = vmalloc(acp->id_len)) == NULL) {
plog(LLV_ERROR, LOCATION, NULL, plog(LLV_ERROR, LOCATION, NULL,
"cannot allocate memory: %s\n", "cannot allocate memory: %s\n",
strerror(errno)); strerror(errno));
break; break;
} }
@ -399,7 +399,7 @@ admin_process(so2, combuf)
if ((key = vmalloc(acp->key_len)) == NULL) { if ((key = vmalloc(acp->key_len)) == NULL) {
plog(LLV_ERROR, LOCATION, NULL, plog(LLV_ERROR, LOCATION, NULL,
"cannot allocate memory: %s\n", "cannot allocate memory: %s\n",
strerror(errno)); strerror(errno));
vfree(id); vfree(id);
id = NULL; id = NULL;
@ -474,7 +474,7 @@ admin_process(so2, combuf)
rmconf->xauth->pass = key; rmconf->xauth->pass = key;
} }
#endif #endif
plog(LLV_INFO, LOCATION, NULL, plog(LLV_INFO, LOCATION, NULL,
"accept a request to establish IKE-SA: " "accept a request to establish IKE-SA: "
"%s\n", saddrwop2str(dst)); "%s\n", saddrwop2str(dst));
@ -577,7 +577,7 @@ admin_process(so2, combuf)
} }
insph2(iph2); insph2(iph2);
if (isakmp_post_acquire(iph2) < 0) { if (isakmp_post_acquire(iph2, NULL) < 0) {
remph2(iph2); remph2(iph2);
delph2(iph2); delph2(iph2);
break; break;
@ -710,17 +710,17 @@ admin_init()
} }
if (chown(sunaddr.sun_path, adminsock_owner, adminsock_group) != 0) { if (chown(sunaddr.sun_path, adminsock_owner, adminsock_group) != 0) {
plog(LLV_ERROR, LOCATION, NULL, plog(LLV_ERROR, LOCATION, NULL,
"chown(%s, %d, %d): %s\n", "chown(%s, %d, %d): %s\n",
sunaddr.sun_path, adminsock_owner, sunaddr.sun_path, adminsock_owner,
adminsock_group, strerror(errno)); adminsock_group, strerror(errno));
(void)close(lcconf->sock_admin); (void)close(lcconf->sock_admin);
return -1; return -1;
} }
if (chmod(sunaddr.sun_path, adminsock_mode) != 0) { if (chmod(sunaddr.sun_path, adminsock_mode) != 0) {
plog(LLV_ERROR, LOCATION, NULL, plog(LLV_ERROR, LOCATION, NULL,
"chmod(%s, 0%03o): %s\n", "chmod(%s, 0%03o): %s\n",
sunaddr.sun_path, adminsock_mode, strerror(errno)); sunaddr.sun_path, adminsock_mode, strerror(errno));
(void)close(lcconf->sock_admin); (void)close(lcconf->sock_admin);
return -1; return -1;

54
crypto/dist/ipsec-tools/src/racoon/handler.c vendored
View File

@ -1,11 +1,11 @@
/* $NetBSD: handler.c,v 1.29 2009/07/03 06:41:46 tteras Exp $ */ /* $NetBSD: handler.c,v 1.30 2009/09/03 09:29:07 tteras Exp $ */
/* Id: handler.c,v 1.28 2006/05/26 12:17:29 manubsd Exp */ /* Id: handler.c,v 1.28 2006/05/26 12:17:29 manubsd Exp */
/* /*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
* All rights reserved. * All rights reserved.
* *
* Redistribution and use in source and binary forms, with or without * Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions * modification, are permitted provided that the following conditions
* are met: * are met:
@ -17,7 +17,7 @@
* 3. Neither the name of the project nor the names of its contributors * 3. Neither the name of the project nor the names of its contributors
* may be used to endorse or promote products derived from this software * may be used to endorse or promote products derived from this software
* without specific prior written permission. * without specific prior written permission.
* *
* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@ -64,7 +64,7 @@
#include "evt.h" #include "evt.h"
#include "isakmp.h" #include "isakmp.h"
#ifdef ENABLE_HYBRID #ifdef ENABLE_HYBRID
#include "isakmp_xauth.h" #include "isakmp_xauth.h"
#include "isakmp_cfg.h" #include "isakmp_cfg.h"
#endif #endif
#include "isakmp_inf.h" #include "isakmp_inf.h"
@ -177,8 +177,8 @@ getph1byindex0(index)
* with phase 2's destinaion. * with phase 2's destinaion.
*/ */
struct ph1handle * struct ph1handle *
getph1(rmconf, local, remote, flags) getph1(ph1hint, local, remote, flags)
struct remoteconf *rmconf; struct ph1handle *ph1hint;
struct sockaddr *local, *remote; struct sockaddr *local, *remote;
int flags; int flags;
{ {
@ -202,12 +202,30 @@ getph1(rmconf, local, remote, flags)
continue; continue;
} }
if (local != NULL && cmpsaddr(local, p->local) != 0) if (local != NULL && cmpsaddr(local, p->local) == CMPSADDR_MISMATCH)
continue; continue;
if (remote != NULL && cmpsaddr(remote, p->remote) != 0) if (remote != NULL && cmpsaddr(remote, p->remote) == CMPSADDR_MISMATCH)
continue; continue;
if (ph1hint != NULL) {
if (ph1hint->id && ph1hint->id->l && p->id && p->id->l &&
(ph1hint->id->l != p->id->l ||
memcmp(ph1hint->id->v, p->id->v, p->id->l) != 0)) {
plog(LLV_DEBUG2, LOCATION, NULL,
"local identity does match hint\n");
continue;
}
if (ph1hint->id_p && ph1hint->id_p->l &&
p->id_p && p->id_p->l &&
(ph1hint->id_p->l != p->id_p->l ||
memcmp(ph1hint->id_p->v, p->id_p->v, p->id_p->l) != 0)) {
plog(LLV_DEBUG2, LOCATION, NULL,
"remote identity does match hint\n");
continue;
}
}
plog(LLV_DEBUG2, LOCATION, NULL, "matched\n"); plog(LLV_DEBUG2, LOCATION, NULL, "matched\n");
return p; return p;
} }
@ -1155,7 +1173,7 @@ init_recvdpkt()
} }
#ifdef ENABLE_HYBRID #ifdef ENABLE_HYBRID
/* /*
* Retruns 0 if the address was obtained by ISAKMP mode config, 1 otherwise * Retruns 0 if the address was obtained by ISAKMP mode config, 1 otherwise
* This should be in isakmp_cfg.c but ph1tree being private, it must be there * This should be in isakmp_cfg.c but ph1tree being private, it must be there
*/ */
@ -1182,7 +1200,7 @@ exclude_cfg_addr(addr)
/* /*
* Reload conf code * Reload conf code
*/ */
static int revalidate_ph2(struct ph2handle *iph2){ static int revalidate_ph2(struct ph2handle *iph2){
@ -1192,11 +1210,11 @@ static int revalidate_ph2(struct ph2handle *iph2){
struct saprop *approval; struct saprop *approval;
struct ph1handle *iph1; struct ph1handle *iph1;
/* /*
* Get the new sainfo using values of the old one * Get the new sainfo using values of the old one
*/ */
if (iph2->sainfo != NULL) { if (iph2->sainfo != NULL) {
iph2->sainfo = getsainfo(iph2->sainfo->idsrc, iph2->sainfo = getsainfo(iph2->sainfo->idsrc,
iph2->sainfo->iddst, iph2->sainfo->id_i, iph2->sainfo->iddst, iph2->sainfo->id_i,
NULL, iph2->sainfo->remoteid); NULL, iph2->sainfo->remoteid);
} }
@ -1204,7 +1222,7 @@ static int revalidate_ph2(struct ph2handle *iph2){
sainfo = iph2->sainfo; sainfo = iph2->sainfo;
if (sainfo == NULL) { if (sainfo == NULL) {
/* /*
* Sainfo has been removed * Sainfo has been removed
*/ */
plog(LLV_DEBUG, LOCATION, NULL, plog(LLV_DEBUG, LOCATION, NULL,
@ -1219,7 +1237,7 @@ static int revalidate_ph2(struct ph2handle *iph2){
plog(LLV_DEBUG, LOCATION, NULL, plog(LLV_DEBUG, LOCATION, NULL,
"No approval found !\n"); "No approval found !\n");
return 0; return 0;
} }
/* /*
* Don't care about proposals, should we do something ? * Don't care about proposals, should we do something ?
@ -1318,7 +1336,7 @@ static int revalidate_ph2(struct ph2handle *iph2){
} }
found = 0; found = 0;
for (alg = sainfo->algs[algclass_ipsec_enc]; for (alg = sainfo->algs[algclass_ipsec_enc];
(found == 0 && alg != NULL); alg = alg->next) { (found == 0 && alg != NULL); alg = alg->next) {
plog(LLV_DEBUG, LOCATION, NULL, plog(LLV_DEBUG, LOCATION, NULL,
"Reload: next ph2 enc alg...\n"); "Reload: next ph2 enc alg...\n");
@ -1351,7 +1369,7 @@ static int revalidate_ph2(struct ph2handle *iph2){
break; break;
default: default:
plog(LLV_ERROR, LOCATION, NULL, plog(LLV_ERROR, LOCATION, NULL,
"unexpected check_level\n"); "unexpected check_level\n");
continue; continue;
break; break;
@ -1375,7 +1393,7 @@ static int revalidate_ph2(struct ph2handle *iph2){
} }
static void static void
remove_ph2(struct ph2handle *iph2) remove_ph2(struct ph2handle *iph2)
{ {
u_int32_t spis[2]; u_int32_t spis[2];
@ -1467,7 +1485,7 @@ static int revalidate_ph2tree(void){
return 1; return 1;
} }
int int
revalidate_ph12(void) revalidate_ph12(void)
{ {

12
crypto/dist/ipsec-tools/src/racoon/handler.h vendored
View File

@ -1,11 +1,11 @@
/* $NetBSD: handler.h,v 1.21 2009/07/03 06:41:46 tteras Exp $ */ /* $NetBSD: handler.h,v 1.22 2009/09/03 09:29:07 tteras Exp $ */
/* Id: handler.h,v 1.19 2006/02/25 08:25:12 manubsd Exp */ /* Id: handler.h,v 1.19 2006/02/25 08:25:12 manubsd Exp */
/* /*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
* All rights reserved. * All rights reserved.
* *
* Redistribution and use in source and binary forms, with or without * Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions * modification, are permitted provided that the following conditions
* are met: * are met:
@ -17,7 +17,7 @@
* 3. Neither the name of the project nor the names of its contributors * 3. Neither the name of the project nor the names of its contributors
* may be used to endorse or promote products derived from this software * may be used to endorse or promote products derived from this software
* without specific prior written permission. * without specific prior written permission.
* *
* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@ -214,7 +214,7 @@ struct ph1handle {
LIST_ENTRY(ph1handle) chain; LIST_ENTRY(ph1handle) chain;
#ifdef ENABLE_HYBRID #ifdef ENABLE_HYBRID
struct isakmp_cfg_state *mode_cfg; /* ISAKMP mode config state */ struct isakmp_cfg_state *mode_cfg; /* ISAKMP mode config state */
#endif #endif
EVT_LISTENER_LIST(evt_listeners); EVT_LISTENER_LIST(evt_listeners);
}; };
@ -449,7 +449,7 @@ struct ph1dump {
struct sockaddr_storage remote; struct sockaddr_storage remote;
struct sockaddr_storage local; struct sockaddr_storage local;
u_int8_t version; u_int8_t version;
u_int8_t etype; u_int8_t etype;
time_t created; time_t created;
int ph2cnt; int ph2cnt;
}; };
@ -468,7 +468,7 @@ extern int enumph1 __P((struct ph1selector *ph1sel,
#define GETPH1_F_ESTABLISHED 0x0001 #define GETPH1_F_ESTABLISHED 0x0001
extern struct ph1handle *getph1 __P((struct remoteconf *rmconf, extern struct ph1handle *getph1 __P((struct ph1handle *ph1hint,
struct sockaddr *local, struct sockaddr *local,
struct sockaddr *remote, struct sockaddr *remote,
int flags)); int flags));

162
crypto/dist/ipsec-tools/src/racoon/isakmp.c vendored
View File

@ -1,11 +1,11 @@
/* $NetBSD: isakmp.c,v 1.59 2009/09/01 09:24:21 tteras Exp $ */ /* $NetBSD: isakmp.c,v 1.60 2009/09/03 09:29:07 tteras Exp $ */
/* Id: isakmp.c,v 1.74 2006/05/07 21:32:59 manubsd Exp */ /* Id: isakmp.c,v 1.74 2006/05/07 21:32:59 manubsd Exp */
/* /*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
* All rights reserved. * All rights reserved.
* *
* Redistribution and use in source and binary forms, with or without * Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions * modification, are permitted provided that the following conditions
* are met: * are met:
@ -17,7 +17,7 @@
* 3. Neither the name of the project nor the names of its contributors * 3. Neither the name of the project nor the names of its contributors
* may be used to endorse or promote products derived from this software * may be used to endorse or promote products derived from this software
* without specific prior written permission. * without specific prior written permission.
* *
* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@ -176,7 +176,7 @@ static int (*ph2exchange[][2][PHASE2ST_MAX])
}; };
static u_char r_ck0[] = { 0,0,0,0,0,0,0,0 }; /* used to verify the r_ck. */ static u_char r_ck0[] = { 0,0,0,0,0,0,0,0 }; /* used to verify the r_ck. */
static int isakmp_main __P((vchar_t *, struct sockaddr *, struct sockaddr *)); static int isakmp_main __P((vchar_t *, struct sockaddr *, struct sockaddr *));
static int ph1_main __P((struct ph1handle *, vchar_t *)); static int ph1_main __P((struct ph1handle *, vchar_t *));
static int quick_main __P((struct ph2handle *, vchar_t *)); static int quick_main __P((struct ph2handle *, vchar_t *));
@ -190,7 +190,7 @@ static int isakmp_ph1resend __P((struct ph1handle *));
static int isakmp_ph2resend __P((struct ph2handle *)); static int isakmp_ph2resend __P((struct ph2handle *));
#ifdef ENABLE_FRAG #ifdef ENABLE_FRAG
static int frag_handler(struct ph1handle *, static int frag_handler(struct ph1handle *,
vchar_t *, struct sockaddr *, struct sockaddr *); vchar_t *, struct sockaddr *, struct sockaddr *);
#endif #endif
@ -259,16 +259,16 @@ isakmp_handler(ctx, so_isakmp)
extralen += sizeof(x.lbuf.udp) + x.lbuf.ip.ip_hl; extralen += sizeof(x.lbuf.udp) + x.lbuf.ip.ip_hl;
} }
#endif #endif
} }
#ifdef ENABLE_NATT #ifdef ENABLE_NATT
/* we don't know about portchange yet, /* we don't know about portchange yet,
look for non-esp marker instead */ look for non-esp marker instead */
if (x.non_esp[0] == 0 && x.non_esp[1] != 0) if (x.non_esp[0] == 0 && x.non_esp[1] != 0)
extralen = NON_ESP_MARKER_LEN; extralen = NON_ESP_MARKER_LEN;
#endif #endif
/* now we know if there is an extra non-esp /* now we know if there is an extra non-esp
marker at the beginning or not */ marker at the beginning or not */
memcpy ((char *)&isakmp, x.buf + extralen, sizeof (isakmp)); memcpy ((char *)&isakmp, x.buf + extralen, sizeof (isakmp));
@ -309,7 +309,7 @@ isakmp_handler(ctx, so_isakmp)
if ((len = recvfrom(so_isakmp, (char *)&isakmp, sizeof(isakmp), if ((len = recvfrom(so_isakmp, (char *)&isakmp, sizeof(isakmp),
0, (struct sockaddr *)&remote, &remote_len)) < 0) { 0, (struct sockaddr *)&remote, &remote_len)) < 0) {
plog(LLV_ERROR, LOCATION, NULL, plog(LLV_ERROR, LOCATION, NULL,
"failed to receive isakmp packet: %s\n", "failed to receive isakmp packet: %s\n",
strerror (errno)); strerror (errno));
} }
goto end; goto end;
@ -332,11 +332,11 @@ isakmp_handler(ctx, so_isakmp)
(len - extralen)); (len - extralen));
goto end; goto end;
} }
memcpy (buf->v, tmpbuf->v + extralen, buf->l); memcpy (buf->v, tmpbuf->v + extralen, buf->l);
len -= extralen; len -= extralen;
if (len != buf->l) { if (len != buf->l) {
plog(LLV_ERROR, LOCATION, (struct sockaddr *)&remote, plog(LLV_ERROR, LOCATION, (struct sockaddr *)&remote,
"received invalid length (%d != %zu), why ?\n", "received invalid length (%d != %zu), why ?\n",
@ -347,7 +347,7 @@ isakmp_handler(ctx, so_isakmp)
plog(LLV_DEBUG, LOCATION, NULL, "===\n"); plog(LLV_DEBUG, LOCATION, NULL, "===\n");
plog(LLV_DEBUG, LOCATION, NULL, plog(LLV_DEBUG, LOCATION, NULL,
"%d bytes message received %s\n", "%d bytes message received %s\n",
len, saddr2str_fromto("from %s to %s", len, saddr2str_fromto("from %s to %s",
(struct sockaddr *)&remote, (struct sockaddr *)&remote,
(struct sockaddr *)&local)); (struct sockaddr *)&local));
plogdump(LLV_DEBUG, buf->v, buf->l); plogdump(LLV_DEBUG, buf->v, buf->l);
@ -496,12 +496,12 @@ isakmp_main(msg, remote, local)
} }
/* set the flag to prevent further port floating /* set the flag to prevent further port floating
(FIXME: should we allow it? E.g. when the NAT gw (FIXME: should we allow it? E.g. when the NAT gw
is rebooted?) */ is rebooted?) */
iph1->natt_flags |= NAT_PORTS_CHANGED | NAT_ADD_NON_ESP_MARKER; iph1->natt_flags |= NAT_PORTS_CHANGED | NAT_ADD_NON_ESP_MARKER;
/* print some neat info */ /* print some neat info */
plog (LLV_INFO, LOCATION, NULL, plog (LLV_INFO, LOCATION, NULL,
"NAT-T: ports changed to: %s\n", "NAT-T: ports changed to: %s\n",
saddr2str_fromto ("%s<->%s", iph1->remote, iph1->local)); saddr2str_fromto ("%s<->%s", iph1->remote, iph1->local));
@ -668,7 +668,7 @@ isakmp_main(msg, remote, local)
return -1; return -1;
} }
#ifdef ENABLE_HYBRID #ifdef ENABLE_HYBRID
/* Reinit the IVM if it's still there */ /* Reinit the IVM if it's still there */
if (iph1->mode_cfg && iph1->mode_cfg->ivm) { if (iph1->mode_cfg && iph1->mode_cfg->ivm) {
oakley_delivm(iph1->mode_cfg->ivm); oakley_delivm(iph1->mode_cfg->ivm);
iph1->mode_cfg->ivm = NULL; iph1->mode_cfg->ivm = NULL;
@ -753,7 +753,7 @@ isakmp_main(msg, remote, local)
isakmp_cfg_r(iph1, msg); isakmp_cfg_r(iph1, msg);
break; break;
#endif #endif
case ISAKMP_ETYPE_NONE: case ISAKMP_ETYPE_NONE:
default: default:
@ -822,7 +822,7 @@ ph1_main(iph1, msg)
/* free resend buffer */ /* free resend buffer */
if (iph1->sendbuf == NULL) { if (iph1->sendbuf == NULL) {
plog(LLV_ERROR, LOCATION, NULL, plog(LLV_ERROR, LOCATION, NULL,
"no buffer found as sendbuf\n"); "no buffer found as sendbuf\n");
return -1; return -1;
} }
#endif #endif
@ -925,13 +925,13 @@ ph1_main(iph1, msg)
log_ph1established(iph1); log_ph1established(iph1);
plog(LLV_DEBUG, LOCATION, NULL, "===\n"); plog(LLV_DEBUG, LOCATION, NULL, "===\n");
/* /*
* SA up shell script hook: do it now,except if * SA up shell script hook: do it now,except if
* ISAKMP mode config was requested. In the later * ISAKMP mode config was requested. In the later
* case it is done when we receive the configuration. * case it is done when we receive the configuration.
*/ */
if ((iph1->status == PHASE1ST_ESTABLISHED) && if ((iph1->status == PHASE1ST_ESTABLISHED) &&
!iph1->rmconf->mode_cfg) { !iph1->rmconf->mode_cfg) {
switch (iph1->approval->authmethod) { switch (iph1->approval->authmethod) {
#ifdef ENABLE_HYBRID #ifdef ENABLE_HYBRID
case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R: case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
@ -1004,7 +1004,7 @@ quick_main(iph2, msg)
/* free resend buffer */ /* free resend buffer */
if (iph2->sendbuf == NULL) { if (iph2->sendbuf == NULL) {
plog(LLV_ERROR, LOCATION, NULL, plog(LLV_ERROR, LOCATION, NULL,
"no buffer found as sendbuf\n"); "no buffer found as sendbuf\n");
return -1; return -1;
} }
VPTRINIT(iph2->sendbuf); VPTRINIT(iph2->sendbuf);
@ -1754,23 +1754,23 @@ isakmp_send(iph1, sbuf)
extralen = 0; extralen = 0;
#ifdef ENABLE_FRAG #ifdef ENABLE_FRAG
/* /*
* Do not add the non ESP marker for a packet that will * Do not add the non ESP marker for a packet that will
* be fragmented. The non ESP marker should appear in * be fragmented. The non ESP marker should appear in
* all fragment's packets, but not in the fragmented packet * all fragment's packets, but not in the fragmented packet
*/ */
if (iph1->frag && sbuf->l > ISAKMP_FRAG_MAXLEN) if (iph1->frag && sbuf->l > ISAKMP_FRAG_MAXLEN)
extralen = 0; extralen = 0;
#endif #endif
if (extralen) if (extralen)
plog (LLV_DEBUG, LOCATION, NULL, "Adding NON-ESP marker\n"); plog (LLV_DEBUG, LOCATION, NULL, "Adding NON-ESP marker\n");
/* If NAT-T port floating is in use, 4 zero bytes (non-ESP marker) /* If NAT-T port floating is in use, 4 zero bytes (non-ESP marker)
must added just before the packet itself. For this we must must added just before the packet itself. For this we must
allocate a new buffer and release it at the end. */ allocate a new buffer and release it at the end. */
if (extralen) { if (extralen) {
if ((vbuf = vmalloc (sbuf->l + extralen)) == NULL) { if ((vbuf = vmalloc (sbuf->l + extralen)) == NULL) {
plog(LLV_ERROR, LOCATION, NULL, plog(LLV_ERROR, LOCATION, NULL,
"vbuf allocation failed\n"); "vbuf allocation failed\n");
return -1; return -1;
} }
@ -1791,17 +1791,17 @@ isakmp_send(iph1, sbuf)
if (s == -1) if (s == -1)
return -1; return -1;
plog (LLV_DEBUG, LOCATION, NULL, "%zu bytes %s\n", sbuf->l, plog (LLV_DEBUG, LOCATION, NULL, "%zu bytes %s\n", sbuf->l,
saddr2str_fromto("from %s to %s", iph1->local, iph1->remote)); saddr2str_fromto("from %s to %s", iph1->local, iph1->remote));
#ifdef ENABLE_FRAG #ifdef ENABLE_FRAG
if (iph1->frag && sbuf->l > ISAKMP_FRAG_MAXLEN) { if (iph1->frag && sbuf->l > ISAKMP_FRAG_MAXLEN) {
if (isakmp_sendfrags(iph1, sbuf) == -1) { if (isakmp_sendfrags(iph1, sbuf) == -1) {
plog(LLV_ERROR, LOCATION, NULL, plog(LLV_ERROR, LOCATION, NULL,
"isakmp_sendfrags failed\n"); "isakmp_sendfrags failed\n");
return -1; return -1;
} }
} else } else
#endif #endif
{ {
len = sendfromto(s, sbuf->v, sbuf->l, len = sendfromto(s, sbuf->v, sbuf->l,
@ -1812,7 +1812,7 @@ isakmp_send(iph1, sbuf)
return -1; return -1;
} }
} }
return 0; return 0;
} }
@ -1959,7 +1959,7 @@ isakmp_ph1dying(iph1)
iph1->status = PHASE1ST_DYING; iph1->status = PHASE1ST_DYING;
/* Any fresh phase1s? */ /* Any fresh phase1s? */
new_iph1 = getph1(iph1->rmconf, iph1->local, iph1->remote, 1); new_iph1 = getph1(iph1, iph1->local, iph1->remote, 1);
if (new_iph1 == NULL) { if (new_iph1 == NULL) {
LIST_FOREACH(p, &iph1->ph2tree, ph1bind) { LIST_FOREACH(p, &iph1->ph2tree, ph1bind) {
if (p->status != PHASE2ST_ESTABLISHED) if (p->status != PHASE2ST_ESTABLISHED)
@ -2036,7 +2036,7 @@ isakmp_ph1delete(iph1)
char *src, *dst; char *src, *dst;
/* Migrate established phase2s. Any fresh phase1s? */ /* Migrate established phase2s. Any fresh phase1s? */
new_iph1 = getph1byaddr(iph1->local, iph1->remote, 1); new_iph1 = getph1(iph1, iph1->local, iph1->remote, 1);
if (new_iph1 != NULL) if (new_iph1 != NULL)
migrate_ph12(iph1, new_iph1); migrate_ph12(iph1, new_iph1);
@ -2143,12 +2143,13 @@ isakmp_ph2delete(iph2)
* if phase1 has been finished, begin phase2. * if phase1 has been finished, begin phase2.
*/ */
int int
isakmp_post_acquire(iph2) isakmp_post_acquire(iph2, iph1hint)
struct ph2handle *iph2; struct ph2handle *iph2;
struct ph1handle *iph1hint;
{ {
struct remoteconf *rmconf; struct remoteconf *rmconf;
struct ph1handle *iph1 = NULL; struct ph1handle *iph1 = NULL;
plog(LLV_DEBUG, LOCATION, NULL, "in post_acquire\n"); plog(LLV_DEBUG, LOCATION, NULL, "in post_acquire\n");
/* Search appropriate configuration with masking port. Note that /* Search appropriate configuration with masking port. Note that
@ -2159,12 +2160,17 @@ isakmp_post_acquire(iph2)
* address of a mobile node (not a CoA provided by MIGRATE/KMADDRESS * address of a mobile node (not a CoA provided by MIGRATE/KMADDRESS
* as iph2->dst hint). This scenario would require additional changes, * as iph2->dst hint). This scenario would require additional changes,
* so no need to bother yet. --arno */ * so no need to bother yet. --arno */
rmconf = getrmconf(iph2->dst, GETRMCONF_F_NO_PASSIVE);
if (rmconf == NULL) { if (iph1hint == NULL || iph1hint->rmconf == NULL) {
plog(LLV_ERROR, LOCATION, NULL, rmconf = getrmconf(iph2->dst, GETRMCONF_F_NO_PASSIVE);
"no configuration found for %s.\n", if (rmconf == NULL) {
saddrwop2str(iph2->dst)); plog(LLV_ERROR, LOCATION, NULL,
return -1; "no configuration found for %s.\n",
saddrwop2str(iph2->dst));
return -1;
}
} else {
rmconf = iph1hint->rmconf;
} }
/* if passive mode, ignore the acquire message */ /* if passive mode, ignore the acquire message */
@ -2181,7 +2187,7 @@ isakmp_post_acquire(iph2)
* some cases, we should use the ISAKMP identity to search * some cases, we should use the ISAKMP identity to search
* matching ISAKMP. * matching ISAKMP.
*/ */
iph1 = getph1byaddr(iph2->src, iph2->dst, 0); iph1 = getph1(iph1hint, iph2->src, iph2->dst, 0);
/* no ISAKMP-SA found. */ /* no ISAKMP-SA found. */
if (iph1 == NULL) { if (iph1 == NULL) {
@ -2978,7 +2984,7 @@ log_ph1established(iph1)
"ISAKMP-SA established %s-%s spi:%s\n", "ISAKMP-SA established %s-%s spi:%s\n",
src, dst, src, dst,
isakmp_pindex(&iph1->index, 0)); isakmp_pindex(&iph1->index, 0));
evt_phase1(iph1, EVT_PHASE1_UP, NULL); evt_phase1(iph1, EVT_PHASE1_UP, NULL);
if(!iph1->rmconf->mode_cfg) if(!iph1->rmconf->mode_cfg)
evt_phase1(iph1, EVT_PHASE1_MODE_CFG, NULL); evt_phase1(iph1, EVT_PHASE1_MODE_CFG, NULL);
@ -3011,7 +3017,7 @@ isakmp_plist_append_full (struct payload_list *plist, vchar_t *payload,
return plist; return plist;
} }
vchar_t * vchar_t *
isakmp_plist_set_all (struct payload_list **plist, struct ph1handle *iph1) isakmp_plist_set_all (struct payload_list **plist, struct ph1handle *iph1)
{ {
struct payload_list *ptr = *plist, *first; struct payload_list *ptr = *plist, *first;
@ -3022,7 +3028,7 @@ isakmp_plist_set_all (struct payload_list **plist, struct ph1handle *iph1)
/* Seek to the first item. */ /* Seek to the first item. */
while (ptr->prev) ptr = ptr->prev; while (ptr->prev) ptr = ptr->prev;
first = ptr; first = ptr;
/* Compute the whole length. */ /* Compute the whole length. */
while (ptr) { while (ptr) {
tlen += ptr->payload->l + sizeof (struct isakmp_gen); tlen += ptr->payload->l + sizeof (struct isakmp_gen);
@ -3064,7 +3070,7 @@ end:
} }
#ifdef ENABLE_FRAG #ifdef ENABLE_FRAG
int int
frag_handler(iph1, msg, remote, local) frag_handler(iph1, msg, remote, local)
struct ph1handle *iph1; struct ph1handle *iph1;
vchar_t *msg; vchar_t *msg;
@ -3075,7 +3081,7 @@ frag_handler(iph1, msg, remote, local)
if (isakmp_frag_extract(iph1, msg) == 1) { if (isakmp_frag_extract(iph1, msg) == 1) {
if ((newmsg = isakmp_frag_reassembly(iph1)) == NULL) { if ((newmsg = isakmp_frag_reassembly(iph1)) == NULL) {
plog(LLV_ERROR, LOCATION, remote, plog(LLV_ERROR, LOCATION, remote,
"Packet reassembly failed\n"); "Packet reassembly failed\n");
return -1; return -1;
} }
@ -3212,7 +3218,7 @@ script_exec(script, name, envp)
argv[1] = script_names[name]; argv[1] = script_names[name];
argv[2] = NULL; argv[2] = NULL;
switch (fork()) { switch (fork()) {
case 0: case 0:
execve(argv[0], argv, envp); execve(argv[0], argv, envp);
plog(LLV_ERROR, LOCATION, NULL, plog(LLV_ERROR, LOCATION, NULL,
@ -3227,7 +3233,7 @@ script_exec(script, name, envp)
break; break;
default: default:
break; break;
} }
return 0; return 0;
} }
@ -3253,7 +3259,7 @@ purge_remote(iph1)
iph1->status = PHASE1ST_EXPIRED; iph1->status = PHASE1ST_EXPIRED;
/* Check if we have another, still valid, phase1 SA. */ /* Check if we have another, still valid, phase1 SA. */
new_iph1 = getph1byaddr(iph1->local, iph1->remote, 1); new_iph1 = getph1(iph1, iph1->local, iph1->remote, GETPH1_F_ESTABLISHED);
/* /*
* Delete all orphaned or binded to the deleting ph1handle phase2 SAs. * Delete all orphaned or binded to the deleting ph1handle phase2 SAs.
@ -3329,7 +3335,7 @@ purge_remote(iph1)
ntohl(sa->sadb_sa_spi)); ntohl(sa->sadb_sa_spi));
}else{ }else{
/* /*
* If we have a new ph1, do not purge IPsec-SAs binded * If we have a new ph1, do not purge IPsec-SAs binded
* to a different ISAKMP-SA * to a different ISAKMP-SA
*/ */
@ -3341,7 +3347,7 @@ purge_remote(iph1)
/* If the ph2handle is established, do not purge IPsec-SA */ /* If the ph2handle is established, do not purge IPsec-SA */
if (iph2->status == PHASE2ST_ESTABLISHED || if (iph2->status == PHASE2ST_ESTABLISHED ||
iph2->status == PHASE2ST_EXPIRED) { iph2->status == PHASE2ST_EXPIRED) {
plog(LLV_INFO, LOCATION, NULL, plog(LLV_INFO, LOCATION, NULL,
"keeping IPsec-SA spi=%u - found valid ISAKMP-SA spi=%s.\n", "keeping IPsec-SA spi=%u - found valid ISAKMP-SA spi=%s.\n",
ntohl(sa->sadb_sa_spi), ntohl(sa->sadb_sa_spi),
@ -3352,7 +3358,7 @@ purge_remote(iph1)
} }
} }
pfkey_send_delete(lcconf->sock_pfkey, pfkey_send_delete(lcconf->sock_pfkey,
msg->sadb_msg_satype, msg->sadb_msg_satype,
IPSEC_MODE_ANY, IPSEC_MODE_ANY,
@ -3383,7 +3389,7 @@ purge_remote(iph1)
sched_schedule(&iph1->sce, 1, isakmp_ph1delete_stub); sched_schedule(&iph1->sce, 1, isakmp_ph1delete_stub);
} }
void void
delete_spd(iph2, created) delete_spd(iph2, created)
struct ph2handle *iph2; struct ph2handle *iph2;
u_int64_t created; u_int64_t created;
@ -3409,22 +3415,22 @@ delete_spd(iph2, created)
plog(LLV_INFO, LOCATION, NULL, plog(LLV_INFO, LOCATION, NULL,
"generated policy, deleting it.\n"); "generated policy, deleting it.\n");
memset(&spidx, 0, sizeof(spidx)); memset(&spidx, 0, sizeof(spidx));
iph2->spidx_gen = (caddr_t )&spidx; iph2->spidx_gen = (caddr_t )&spidx;
/* make inbound policy */ /* make inbound policy */
iph2->src = dst; iph2->src = dst;
iph2->dst = src; iph2->dst = src;
spidx.dir = IPSEC_DIR_INBOUND; spidx.dir = IPSEC_DIR_INBOUND;
spidx.ul_proto = 0; spidx.ul_proto = 0;
/* /*
* Note: code from get_proposal_r * Note: code from get_proposal_r
*/ */
#define _XIDT(d) ((struct ipsecdoi_id_b *)(d)->v)->type #define _XIDT(d) ((struct ipsecdoi_id_b *)(d)->v)->type
/* /*
* make destination address in spidx from either ID payload * make destination address in spidx from either ID payload
* or phase 1 address into a address in spidx. * or phase 1 address into a address in spidx.
@ -3440,48 +3446,48 @@ delete_spd(iph2, created)
&spidx.prefd, &spidx.ul_proto); &spidx.prefd, &spidx.ul_proto);
if (error) if (error)
goto purge; goto purge;
#ifdef INET6 #ifdef INET6
/* /*
* get scopeid from the SA address. * get scopeid from the SA address.
* note that the phase 1 source address is used as * note that the phase 1 source address is used as
* a destination address to search for a inbound * a destination address to search for a inbound
* policy entry because rcoon is responder. * policy entry because rcoon is responder.
*/ */
if (_XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR) { if (_XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR) {
if ((error = if ((error =
setscopeid((struct sockaddr *)&spidx.dst, setscopeid((struct sockaddr *)&spidx.dst,
iph2->src)) != 0) iph2->src)) != 0)
goto purge; goto purge;
} }
#endif #endif
if (_XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR if (_XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR
|| _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR) || _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR)
idi2type = _XIDT(iph2->id); idi2type = _XIDT(iph2->id);
} else { } else {
plog(LLV_DEBUG, LOCATION, NULL, plog(LLV_DEBUG, LOCATION, NULL,
"get a destination address of SP index " "get a destination address of SP index "
"from phase1 address " "from phase1 address "
"due to no ID payloads found " "due to no ID payloads found "
"OR because ID type is not address.\n"); "OR because ID type is not address.\n");
/* /*
* copy the SOURCE address of IKE into the * copy the SOURCE address of IKE into the
* DESTINATION address of the key to search the * DESTINATION address of the key to search the
* SPD because the direction of policy is inbound. * SPD because the direction of policy is inbound.
*/ */
memcpy(&spidx.dst, iph2->src, sysdep_sa_len(iph2->src)); memcpy(&spidx.dst, iph2->src, sysdep_sa_len(iph2->src));
switch (spidx.dst.ss_family) { switch (spidx.dst.ss_family) {
case AF_INET: case AF_INET:
spidx.prefd = spidx.prefd =
sizeof(struct in_addr) << 3; sizeof(struct in_addr) << 3;
break; break;
#ifdef INET6 #ifdef INET6
case AF_INET6: case AF_INET6:
spidx.prefd = spidx.prefd =
sizeof(struct in6_addr) << 3; sizeof(struct in6_addr) << 3;
break; break;
#endif #endif
@ -3490,7 +3496,7 @@ delete_spd(iph2, created)
break; break;
} }
} }
/* make source address in spidx */ /* make source address in spidx */
if (iph2->id_p != NULL if (iph2->id_p != NULL
&& (_XIDT(iph2->id_p) == IPSECDOI_ID_IPV4_ADDR && (_XIDT(iph2->id_p) == IPSECDOI_ID_IPV4_ADDR
@ -3510,7 +3516,7 @@ delete_spd(iph2, created)
* for more detail, see above of this function. * for more detail, see above of this function.
*/ */
if (_XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR) { if (_XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR) {
error = error =
setscopeid((struct sockaddr *)&spidx.src, setscopeid((struct sockaddr *)&spidx.src,
iph2->dst); iph2->dst);
if (error) if (error)
@ -3548,12 +3554,12 @@ delete_spd(iph2, created)
memcpy(&spidx.src, iph2->dst, sysdep_sa_len(iph2->dst)); memcpy(&spidx.src, iph2->dst, sysdep_sa_len(iph2->dst));
switch (spidx.src.ss_family) { switch (spidx.src.ss_family) {
case AF_INET: case AF_INET:
spidx.prefs = spidx.prefs =
sizeof(struct in_addr) << 3; sizeof(struct in_addr) << 3;
break; break;
#ifdef INET6 #ifdef INET6
case AF_INET6: case AF_INET6:
spidx.prefs = spidx.prefs =
sizeof(struct in6_addr) << 3; sizeof(struct in6_addr) << 3;
break; break;
#endif #endif
@ -3584,14 +3590,14 @@ delete_spd(iph2, created)
spidx.ul_proto = IPSEC_ULPROTO_ANY; spidx.ul_proto = IPSEC_ULPROTO_ANY;
#undef _XIDT #undef _XIDT
/* Check if the generated SPD has the same timestamp as the SA. /* Check if the generated SPD has the same timestamp as the SA.
* If timestamps are different, this means that the SPD entry has been * If timestamps are different, this means that the SPD entry has been
* refreshed by another SA, and should NOT be deleted with the current SA. * refreshed by another SA, and should NOT be deleted with the current SA.
*/ */
if( created ){ if( created ){
struct secpolicy *p; struct secpolicy *p;
p = getsp(&spidx); p = getsp(&spidx);
if(p != NULL){ if(p != NULL){
/* just do no test if p is NULL, because this probably just means /* just do no test if p is NULL, because this probably just means
@ -3656,7 +3662,7 @@ setscopeid(sp_addr0, sa_addr0)
struct sockaddr *sp_addr0, *sa_addr0; struct sockaddr *sp_addr0, *sa_addr0;
{ {
struct sockaddr_in6 *sp_addr, *sa_addr; struct sockaddr_in6 *sp_addr, *sa_addr;
sp_addr = (struct sockaddr_in6 *)sp_addr0; sp_addr = (struct sockaddr_in6 *)sp_addr0;
sa_addr = (struct sockaddr_in6 *)sa_addr0; sa_addr = (struct sockaddr_in6 *)sa_addr0;

10
crypto/dist/ipsec-tools/src/racoon/isakmp_var.h vendored
View File

@ -1,11 +1,11 @@
/* $NetBSD: isakmp_var.h,v 1.15 2009/04/20 13:24:36 tteras Exp $ */ /* $NetBSD: isakmp_var.h,v 1.16 2009/09/03 09:29:07 tteras Exp $ */
/* Id: isakmp_var.h,v 1.12 2005/05/07 14:45:31 manubsd Exp */ /* Id: isakmp_var.h,v 1.12 2005/05/07 14:45:31 manubsd Exp */
/* /*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
* All rights reserved. * All rights reserved.
* *
* Redistribution and use in source and binary forms, with or without * Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions * modification, are permitted provided that the following conditions
* are met: * are met:
@ -17,7 +17,7 @@
* 3. Neither the name of the project nor the names of its contributors * 3. Neither the name of the project nor the names of its contributors
* may be used to endorse or promote products derived from this software * may be used to endorse or promote products derived from this software
* without specific prior written permission. * without specific prior written permission.
* *
* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@ -87,7 +87,7 @@ extern void isakmp_ph2delete_stub __P((struct sched *));
extern void isakmp_ph2delete __P((struct ph2handle *)); extern void isakmp_ph2delete __P((struct ph2handle *));
extern int isakmp_get_sainfo __P((struct ph2handle *, struct secpolicy *, struct secpolicy *)); extern int isakmp_get_sainfo __P((struct ph2handle *, struct secpolicy *, struct secpolicy *));
extern int isakmp_post_acquire __P((struct ph2handle *)); extern int isakmp_post_acquire __P((struct ph2handle *, struct ph1handle *));
extern int isakmp_post_getspi __P((struct ph2handle *)); extern int isakmp_post_getspi __P((struct ph2handle *));
extern void isakmp_chkph1there_stub __P((struct sched *)); extern void isakmp_chkph1there_stub __P((struct sched *));
extern void isakmp_chkph1there __P((struct ph2handle *)); extern void isakmp_chkph1there __P((struct ph2handle *));
@ -131,7 +131,7 @@ extern int copy_ph1addresses __P(( struct ph1handle *,
struct remoteconf *, struct sockaddr *, struct sockaddr *)); struct remoteconf *, struct sockaddr *, struct sockaddr *));
extern void log_ph1established __P((const struct ph1handle *)); extern void log_ph1established __P((const struct ph1handle *));
extern void script_hook __P((struct ph1handle *, int)); extern void script_hook __P((struct ph1handle *, int));
extern int script_env_append __P((char ***, int *, char *, char *)); extern int script_env_append __P((char ***, int *, char *, char *));
extern int script_exec __P((char *, int, char * const *)); extern int script_exec __P((char *, int, char * const *));

49
crypto/dist/ipsec-tools/src/racoon/pfkey.c vendored
View File

@ -1,11 +1,11 @@
/* $NetBSD: pfkey.c,v 1.50 2009/08/10 08:22:13 tteras Exp $ */ /* $NetBSD: pfkey.c,v 1.51 2009/09/03 09:29:07 tteras Exp $ */
/* $Id: pfkey.c,v 1.50 2009/08/10 08:22:13 tteras Exp $ */ /* $Id: pfkey.c,v 1.51 2009/09/03 09:29:07 tteras Exp $ */
/* /*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
* All rights reserved. * All rights reserved.
* *
* Redistribution and use in source and binary forms, with or without * Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions * modification, are permitted provided that the following conditions
* are met: * are met:
@ -17,7 +17,7 @@
* 3. Neither the name of the project nor the names of its contributors * 3. Neither the name of the project nor the names of its contributors
* may be used to endorse or promote products derived from this software * may be used to endorse or promote products derived from this software
* without specific prior written permission. * without specific prior written permission.
* *
* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@ -173,7 +173,7 @@ static int addnewsp __P((caddr_t *, struct sockaddr *, struct sockaddr *));
/* cope with old kame headers - ugly */ /* cope with old kame headers - ugly */
#ifndef SADB_X_AALG_MD5 #ifndef SADB_X_AALG_MD5
#define SADB_X_AALG_MD5 SADB_AALG_MD5 #define SADB_X_AALG_MD5 SADB_AALG_MD5
#endif #endif
#ifndef SADB_X_AALG_SHA #ifndef SADB_X_AALG_SHA
#define SADB_X_AALG_SHA SADB_AALG_SHA #define SADB_X_AALG_SHA SADB_AALG_SHA
@ -353,7 +353,7 @@ pfkey_dump_sadb(satype)
"type %i, pid %i\n", msg->sadb_msg_type, msg->sadb_msg_pid); "type %i, pid %i\n", msg->sadb_msg_type, msg->sadb_msg_pid);
continue; continue;
} }
ml = msg->sadb_msg_len << 3; ml = msg->sadb_msg_len << 3;
bl = buf ? buf->l : 0; bl = buf ? buf->l : 0;
@ -839,7 +839,7 @@ pfkey_convertfromipsecdoi(proto_id, t_id, hashtype,
goto bad; goto bad;
*a_keylen >>= 3; *a_keylen >>= 3;
if (t_id == IPSECDOI_ATTR_AUTH_HMAC_MD5 if (t_id == IPSECDOI_ATTR_AUTH_HMAC_MD5
&& hashtype == IPSECDOI_ATTR_AUTH_KPDK) { && hashtype == IPSECDOI_ATTR_AUTH_KPDK) {
/* AH_MD5 + Auth(KPDK) = RFC1826 keyed-MD5 */ /* AH_MD5 + Auth(KPDK) = RFC1826 keyed-MD5 */
*a_type = SADB_X_AALG_MD5; *a_type = SADB_X_AALG_MD5;
@ -919,7 +919,7 @@ pk_sendgetspi(iph2)
racoon_free(dst); racoon_free(dst);
return -1; return -1;
} }
for (pr = pp->head; pr != NULL; pr = pr->next) { for (pr = pp->head; pr != NULL; pr = pr->next) {
/* validity check */ /* validity check */
@ -991,7 +991,7 @@ pk_sendgetspi(iph2)
* receive GETSPI from kernel. * receive GETSPI from kernel.
*/ */
static int static int
pk_recvgetspi(mhp) pk_recvgetspi(mhp)
caddr_t *mhp; caddr_t *mhp;
{ {
struct sadb_msg *msg; struct sadb_msg *msg;
@ -1111,7 +1111,7 @@ pk_sendupdate(iph2)
sa_args.l_addtime = iph2->lifetime_secs; sa_args.l_addtime = iph2->lifetime_secs;
else else
sa_args.l_addtime = iph2->approval->lifetime; sa_args.l_addtime = iph2->approval->lifetime;
sa_args.seq = iph2->seq; sa_args.seq = iph2->seq;
sa_args.wsize = 4; sa_args.wsize = 4;
if (iph2->sa_src && iph2->sa_dst) { if (iph2->sa_src && iph2->sa_dst) {
@ -1163,7 +1163,7 @@ pk_sendupdate(iph2)
pr->head->trns_id, pr->head->trns_id,
pr->head->authtype, pr->head->authtype,
&sa_args.e_type, &sa_args.e_keylen, &sa_args.e_type, &sa_args.e_keylen,
&sa_args.a_type, &sa_args.a_keylen, &sa_args.a_type, &sa_args.a_keylen,
&sa_args.flags) < 0){ &sa_args.flags) < 0){
racoon_free(sa_args.src); racoon_free(sa_args.src);
racoon_free(sa_args.dst); racoon_free(sa_args.dst);
@ -1221,11 +1221,11 @@ pk_sendupdate(iph2)
* But it is impossible because there is not key in the * But it is impossible because there is not key in the
* information from the kernel. * information from the kernel.
*/ */
/* change some things before backing up */ /* change some things before backing up */
sa_args.wsize = 4; sa_args.wsize = 4;
sa_args.l_bytes = iph2->approval->lifebyte * 1024; sa_args.l_bytes = iph2->approval->lifebyte * 1024;
if (backupsa_to_file(&sa_args) < 0) { if (backupsa_to_file(&sa_args) < 0) {
plog(LLV_ERROR, LOCATION, NULL, plog(LLV_ERROR, LOCATION, NULL,
"backuped SA failed: %s\n", "backuped SA failed: %s\n",
@ -1447,7 +1447,7 @@ pk_sendadd(iph2)
pr->head->trns_id, pr->head->trns_id,
pr->head->authtype, pr->head->authtype,
&sa_args.e_type, &sa_args.e_keylen, &sa_args.e_type, &sa_args.e_keylen,
&sa_args.a_type, &sa_args.a_keylen, &sa_args.a_type, &sa_args.a_keylen,
&sa_args.flags) < 0){ &sa_args.flags) < 0){
racoon_free(sa_args.src); racoon_free(sa_args.src);
racoon_free(sa_args.dst); racoon_free(sa_args.dst);
@ -1668,11 +1668,12 @@ pk_recvexpire(mhp)
" being negotiated. Stopping negotiation.\n"); " being negotiated. Stopping negotiation.\n");
} }
/* turn off the timer for calling isakmp_ph2expire() */ /* turn off the timer for calling isakmp_ph2expire() */
sched_cancel(&iph2->sce); sched_cancel(&iph2->sce);
if (iph2->status == PHASE2ST_ESTABLISHED && if (iph2->status == PHASE2ST_ESTABLISHED &&
iph2->side == INITIATOR) { iph2->side == INITIATOR) {
struct ph1handle *iph1hint;
/* /*
* Active phase 2 expired and we were initiator. * Active phase 2 expired and we were initiator.
* Begin new phase 2 exchange, so we can keep on sending * Begin new phase 2 exchange, so we can keep on sending
@ -1680,11 +1681,12 @@ pk_recvexpire(mhp)
*/ */
/* update status for re-use */ /* update status for re-use */
iph1hint = iph2->ph1;
initph2(iph2); initph2(iph2);
iph2->status = PHASE2ST_STATUS2; iph2->status = PHASE2ST_STATUS2;
/* start quick exchange */ /* start quick exchange */
if (isakmp_post_acquire(iph2) < 0) { if (isakmp_post_acquire(iph2, iph1hint) < 0) {
plog(LLV_ERROR, LOCATION, iph2->dst, plog(LLV_ERROR, LOCATION, iph2->dst,
"failed to begin ipsec sa " "failed to begin ipsec sa "
"re-negotication.\n"); "re-negotication.\n");
@ -1750,7 +1752,7 @@ pk_recvacquire(mhp)
if (m_sec_ctx != NULL) { if (m_sec_ctx != NULL) {
plog(LLV_INFO, LOCATION, NULL, "security context doi: %u\n", plog(LLV_INFO, LOCATION, NULL, "security context doi: %u\n",
m_sec_ctx->sadb_x_ctx_doi); m_sec_ctx->sadb_x_ctx_doi);
plog(LLV_INFO, LOCATION, NULL, plog(LLV_INFO, LOCATION, NULL,
"security context algorithm: %u\n", "security context algorithm: %u\n",
m_sec_ctx->sadb_x_ctx_alg); m_sec_ctx->sadb_x_ctx_alg);
plog(LLV_INFO, LOCATION, NULL, "security context length: %u\n", plog(LLV_INFO, LOCATION, NULL, "security context length: %u\n",
@ -1960,7 +1962,7 @@ pk_recvacquire(mhp)
/* start isakmp initiation by using ident exchange */ /* start isakmp initiation by using ident exchange */
/* XXX should be looped if there are multiple phase 2 handler. */ /* XXX should be looped if there are multiple phase 2 handler. */
if (isakmp_post_acquire(iph2) < 0) { if (isakmp_post_acquire(iph2, NULL) < 0) {
plog(LLV_ERROR, LOCATION, NULL, plog(LLV_ERROR, LOCATION, NULL,
"failed to begin ipsec sa negotication.\n"); "failed to begin ipsec sa negotication.\n");
remph2(iph2); remph2(iph2);
@ -2145,7 +2147,7 @@ getsadbpolicy(policy0, policylen0, type, iph2)
p->sadb_x_ctx_len = spidx->sec_ctx.ctx_strlen; p->sadb_x_ctx_len = spidx->sec_ctx.ctx_strlen;
p->sadb_x_ctx_doi = spidx->sec_ctx.ctx_doi; p->sadb_x_ctx_doi = spidx->sec_ctx.ctx_doi;
p->sadb_x_ctx_alg = spidx->sec_ctx.ctx_alg; p->sadb_x_ctx_alg = spidx->sec_ctx.ctx_alg;
memcpy(p + 1,spidx->sec_ctx.ctx_str,spidx->sec_ctx.ctx_strlen); memcpy(p + 1,spidx->sec_ctx.ctx_str,spidx->sec_ctx.ctx_strlen);
len += ctxlen; len += ctxlen;
} }
@ -2184,7 +2186,7 @@ getsadbpolicy(policy0, policylen0, type, iph2)
goto err; goto err;
} }
/* /*
* the policy level cannot be unique because the policy * the policy level cannot be unique because the policy
* is defined later than SA, so req_id cannot be bound to SA. * is defined later than SA, so req_id cannot be bound to SA.
*/ */
@ -2217,7 +2219,7 @@ getsadbpolicy(policy0, policylen0, type, iph2)
xisr->sadb_x_ipsecrequest_len = PFKEY_ALIGN8(xisrlen); xisr->sadb_x_ipsecrequest_len = PFKEY_ALIGN8(xisrlen);
xisr = (struct sadb_x_ipsecrequest *)p; xisr = (struct sadb_x_ipsecrequest *)p;
} }
racoon_free(pr_rlist); racoon_free(pr_rlist);
@ -3070,6 +3072,8 @@ migrate_ph2_sa_addresses(iph2, args)
rmconf = getrmconf(iph2->dst, 0); rmconf = getrmconf(iph2->dst, 0);
if (rmconf && !rmconf->passive) { if (rmconf && !rmconf->passive) {
struct ph1handle *iph1hint;
plog(LLV_WARNING, LOCATION, iph2->dst, "MIGRATE received " plog(LLV_WARNING, LOCATION, iph2->dst, "MIGRATE received "
"*during* IPsec SA negotiation. As initiator, " "*during* IPsec SA negotiation. As initiator, "
"restarting it.\n"); "restarting it.\n");
@ -3079,11 +3083,12 @@ migrate_ph2_sa_addresses(iph2, args)
iph2->status = PHASE2ST_EXPIRED; iph2->status = PHASE2ST_EXPIRED;
/* ... clean Phase 2 handle ... */ /* ... clean Phase 2 handle ... */
iph1hint = iph2->ph1;
initph2(iph2); initph2(iph2);
iph2->status = PHASE2ST_STATUS2; iph2->status = PHASE2ST_STATUS2;
/* and start a new negotiation */ /* and start a new negotiation */
if (isakmp_post_acquire(iph2) < 0) { if (isakmp_post_acquire(iph2, iph1hint) < 0) {
plog(LLV_ERROR, LOCATION, iph2->dst, "failed " plog(LLV_ERROR, LOCATION, iph2->dst, "failed "
"to begin IPsec SA renegotiation after " "to begin IPsec SA renegotiation after "
"MIGRATE reception.\n"); "MIGRATE reception.\n");