2116 lines
49 KiB
C
2116 lines
49 KiB
C
/* $KAME: isakmp_quick.c,v 1.94 2003/06/27 07:32:38 sakane Exp $ */
|
||
|
||
/*
|
||
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
|
||
* All rights reserved.
|
||
*
|
||
* Redistribution and use in source and binary forms, with or without
|
||
* modification, are permitted provided that the following conditions
|
||
* are met:
|
||
* 1. Redistributions of source code must retain the above copyright
|
||
* notice, this list of conditions and the following disclaimer.
|
||
* 2. Redistributions in binary form must reproduce the above copyright
|
||
* notice, this list of conditions and the following disclaimer in the
|
||
* documentation and/or other materials provided with the distribution.
|
||
* 3. Neither the name of the project nor the names of its contributors
|
||
* may be used to endorse or promote products derived from this software
|
||
* without specific prior written permission.
|
||
*
|
||
* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
|
||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||
* ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
|
||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||
* SUCH DAMAGE.
|
||
*/
|
||
|
||
#include <sys/cdefs.h>
|
||
__RCSID("$NetBSD: isakmp_quick.c,v 1.6 2003/07/12 09:37:10 itojun Exp $");
|
||
|
||
#include <sys/types.h>
|
||
#include <sys/param.h>
|
||
#include <sys/socket.h>
|
||
|
||
#include <netkey/key_var.h>
|
||
#include <netinet/in.h>
|
||
|
||
#include <stdlib.h>
|
||
#include <stdio.h>
|
||
#include <string.h>
|
||
#include <errno.h>
|
||
#if TIME_WITH_SYS_TIME
|
||
# include <sys/time.h>
|
||
# include <time.h>
|
||
#else
|
||
# if HAVE_SYS_TIME_H
|
||
# include <sys/time.h>
|
||
# else
|
||
# include <time.h>
|
||
# endif
|
||
#endif
|
||
|
||
#ifdef IPV6_INRIA_VERSION
|
||
#include <netinet/ipsec.h>
|
||
#else
|
||
#include <netinet6/ipsec.h>
|
||
#endif
|
||
|
||
#include "var.h"
|
||
#include "vmbuf.h"
|
||
#include "schedule.h"
|
||
#include "misc.h"
|
||
#include "plog.h"
|
||
#include "debug.h"
|
||
|
||
#include "localconf.h"
|
||
#include "remoteconf.h"
|
||
#include "isakmp_var.h"
|
||
#include "isakmp.h"
|
||
#include "isakmp_inf.h"
|
||
#include "isakmp_quick.h"
|
||
#include "oakley.h"
|
||
#include "handler.h"
|
||
#include "ipsec_doi.h"
|
||
#include "crypto_openssl.h"
|
||
#include "pfkey.h"
|
||
#include "policy.h"
|
||
#include "algorithm.h"
|
||
#include "sockmisc.h"
|
||
#include "proposal.h"
|
||
#include "sainfo.h"
|
||
#include "admin.h"
|
||
#include "strnames.h"
|
||
|
||
/* quick mode */
|
||
static vchar_t *quick_ir1mx __P((struct ph2handle *, vchar_t *, vchar_t *));
|
||
static int get_sainfo_r __P((struct ph2handle *));
|
||
static int get_proposal_r __P((struct ph2handle *));
|
||
#ifdef INET6
|
||
static u_int32_t setscopeid __P((struct sockaddr *, struct sockaddr *));
|
||
#endif
|
||
|
||
/* %%%
|
||
* Quick Mode
|
||
*/
|
||
/*
|
||
* begin Quick Mode as initiator. send pfkey getspi message to kernel.
|
||
*/
|
||
int
|
||
quick_i1prep(iph2, msg)
|
||
struct ph2handle *iph2;
|
||
vchar_t *msg; /* must be null pointer */
|
||
{
|
||
int error = ISAKMP_INTERNAL_ERROR;
|
||
|
||
/* validity check */
|
||
if (iph2->status != PHASE2ST_STATUS2) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"status mismatched %d.\n", iph2->status);
|
||
goto end;
|
||
}
|
||
|
||
iph2->msgid = isakmp_newmsgid2(iph2->ph1);
|
||
iph2->ivm = oakley_newiv2(iph2->ph1, iph2->msgid);
|
||
if (iph2->ivm == NULL)
|
||
return NULL;
|
||
|
||
iph2->status = PHASE2ST_GETSPISENT;
|
||
|
||
/* don't anything if local test mode. */
|
||
if (f_local) {
|
||
error = 0;
|
||
goto end;
|
||
}
|
||
|
||
/* send getspi message */
|
||
if (pk_sendgetspi(iph2) < 0)
|
||
goto end;
|
||
|
||
plog(LLV_DEBUG, LOCATION, NULL, "pfkey getspi sent.\n");
|
||
|
||
iph2->sce = sched_new(lcconf->wait_ph2complete,
|
||
pfkey_timeover_stub, iph2);
|
||
|
||
error = 0;
|
||
|
||
end:
|
||
return error;
|
||
}
|
||
|
||
/*
|
||
* send to responder
|
||
* HDR*, HASH(1), SA, Ni [, KE ] [, IDi2, IDr2 ]
|
||
*/
|
||
int
|
||
quick_i1send(iph2, msg)
|
||
struct ph2handle *iph2;
|
||
vchar_t *msg; /* must be null pointer */
|
||
{
|
||
vchar_t *body = NULL;
|
||
vchar_t *hash = NULL;
|
||
struct isakmp_gen *gen;
|
||
char *p;
|
||
int tlen;
|
||
int error = ISAKMP_INTERNAL_ERROR;
|
||
int pfsgroup, idci, idcr;
|
||
int np;
|
||
struct ipsecdoi_id_b *id, *id_p;
|
||
|
||
/* validity check */
|
||
if (msg != NULL) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"msg has to be NULL in this function.\n");
|
||
goto end;
|
||
}
|
||
if (iph2->status != PHASE2ST_GETSPIDONE) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"status mismatched %d.\n", iph2->status);
|
||
goto end;
|
||
}
|
||
|
||
/* create SA payload for my proposal */
|
||
if (ipsecdoi_setph2proposal(iph2) < 0)
|
||
goto end;
|
||
|
||
/* generate NONCE value */
|
||
iph2->nonce = eay_set_random(iph2->ph1->rmconf->nonce_size);
|
||
if (iph2->nonce == NULL)
|
||
goto end;
|
||
|
||
/*
|
||
* DH value calculation is kicked out into cfparse.y.
|
||
* because pfs group can not be negotiated, it's only to be checked
|
||
* acceptable.
|
||
*/
|
||
/* generate KE value if need */
|
||
pfsgroup = iph2->proposal->pfs_group;
|
||
if (pfsgroup) {
|
||
/* DH group settting if PFS is required. */
|
||
if (oakley_setdhgroup(pfsgroup, &iph2->pfsgrp) < 0) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"failed to set DH value.\n");
|
||
goto end;
|
||
}
|
||
if (oakley_dh_generate(iph2->pfsgrp,
|
||
&iph2->dhpub, &iph2->dhpriv) < 0) {
|
||
goto end;
|
||
}
|
||
}
|
||
|
||
/* generate ID value */
|
||
if (ipsecdoi_setid2(iph2) < 0) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"failed to get ID.\n");
|
||
goto end;
|
||
}
|
||
plog(LLV_DEBUG, LOCATION, NULL, "IDci:");
|
||
plogdump(LLV_DEBUG, iph2->id->v, iph2->id->l);
|
||
plog(LLV_DEBUG, LOCATION, NULL, "IDcr:");
|
||
plogdump(LLV_DEBUG, iph2->id_p->v, iph2->id_p->l);
|
||
|
||
/*
|
||
* we do not attach IDci nor IDcr, under the following condition:
|
||
* - all proposals are transport mode
|
||
* - no MIP6 or proxy
|
||
* - id payload suggests to encrypt all the traffic (no specific
|
||
* protocol type)
|
||
*/
|
||
id = (struct ipsecdoi_id_b *)iph2->id->v;
|
||
id_p = (struct ipsecdoi_id_b *)iph2->id_p->v;
|
||
if (id->proto_id == 0
|
||
&& id_p->proto_id == 0
|
||
&& iph2->ph1->rmconf->support_proxy == 0
|
||
&& ipsecdoi_transportmode(iph2->proposal)) {
|
||
idci = idcr = 0;
|
||
} else
|
||
idci = idcr = 1;
|
||
|
||
/* create SA;NONCE payload, and KE if need, and IDii, IDir. */
|
||
tlen = + sizeof(*gen) + iph2->sa->l
|
||
+ sizeof(*gen) + iph2->nonce->l;
|
||
if (pfsgroup)
|
||
tlen += (sizeof(*gen) + iph2->dhpub->l);
|
||
if (idci)
|
||
tlen += sizeof(*gen) + iph2->id->l;
|
||
if (idcr)
|
||
tlen += sizeof(*gen) + iph2->id_p->l;
|
||
|
||
body = vmalloc(tlen);
|
||
if (body == NULL) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"failed to get buffer to send.\n");
|
||
goto end;
|
||
}
|
||
|
||
p = body->v;
|
||
|
||
/* add SA payload */
|
||
p = set_isakmp_payload(p, iph2->sa, ISAKMP_NPTYPE_NONCE);
|
||
|
||
/* add NONCE payload */
|
||
if (pfsgroup)
|
||
np = ISAKMP_NPTYPE_KE;
|
||
else if (idci || idcr)
|
||
np = ISAKMP_NPTYPE_ID;
|
||
else
|
||
np = ISAKMP_NPTYPE_NONE;
|
||
p = set_isakmp_payload(p, iph2->nonce, np);
|
||
|
||
/* add KE payload if need. */
|
||
np = (idci || idcr) ? ISAKMP_NPTYPE_ID : ISAKMP_NPTYPE_NONE;
|
||
if (pfsgroup)
|
||
p = set_isakmp_payload(p, iph2->dhpub, np);
|
||
|
||
/* IDci */
|
||
np = (idcr) ? ISAKMP_NPTYPE_ID : ISAKMP_NPTYPE_NONE;
|
||
if (idci)
|
||
p = set_isakmp_payload(p, iph2->id, np);
|
||
|
||
/* IDcr */
|
||
if (idcr)
|
||
p = set_isakmp_payload(p, iph2->id_p, ISAKMP_NPTYPE_NONE);
|
||
|
||
/* generate HASH(1) */
|
||
hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, body);
|
||
if (hash == NULL)
|
||
goto end;
|
||
|
||
/* send isakmp payload */
|
||
iph2->sendbuf = quick_ir1mx(iph2, body, hash);
|
||
if (iph2->sendbuf == NULL)
|
||
goto end;
|
||
|
||
/* send the packet, add to the schedule to resend */
|
||
iph2->retry_counter = iph2->ph1->rmconf->retry_counter;
|
||
if (isakmp_ph2resend(iph2) == -1)
|
||
goto end;
|
||
|
||
/* change status of isakmp status entry */
|
||
iph2->status = PHASE2ST_MSG1SENT;
|
||
|
||
error = 0;
|
||
|
||
end:
|
||
if (body != NULL)
|
||
vfree(body);
|
||
if (hash != NULL)
|
||
vfree(hash);
|
||
|
||
return error;
|
||
}
|
||
|
||
/*
|
||
* receive from responder
|
||
* HDR*, HASH(2), SA, Nr [, KE ] [, IDi2, IDr2 ]
|
||
*/
|
||
int
|
||
quick_i2recv(iph2, msg0)
|
||
struct ph2handle *iph2;
|
||
vchar_t *msg0;
|
||
{
|
||
vchar_t *msg = NULL;
|
||
vchar_t *hbuf = NULL; /* for hash computing. */
|
||
vchar_t *pbuf = NULL; /* for payload parsing */
|
||
struct isakmp_parse_t *pa;
|
||
struct isakmp *isakmp = (struct isakmp *)msg0->v;
|
||
struct isakmp_pl_hash *hash = NULL;
|
||
int f_id;
|
||
char *p;
|
||
int tlen;
|
||
int error = ISAKMP_INTERNAL_ERROR;
|
||
|
||
/* validity check */
|
||
if (iph2->status != PHASE2ST_MSG1SENT) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"status mismatched %d.\n", iph2->status);
|
||
goto end;
|
||
}
|
||
|
||
/* decrypt packet */
|
||
if (!ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E)) {
|
||
plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
|
||
"Packet wasn't encrypted.\n");
|
||
goto end;
|
||
}
|
||
msg = oakley_do_decrypt(iph2->ph1, msg0, iph2->ivm->iv, iph2->ivm->ive);
|
||
if (msg == NULL)
|
||
goto end;
|
||
|
||
/* create buffer for validating HASH(2) */
|
||
/*
|
||
* ordering rule:
|
||
* 1. the first one must be HASH
|
||
* 2. the second one must be SA (added in isakmp-oakley-05!)
|
||
* 3. two IDs must be considered as IDci, then IDcr
|
||
*/
|
||
pbuf = isakmp_parse(msg);
|
||
if (pbuf == NULL)
|
||
goto end;
|
||
pa = (struct isakmp_parse_t *)pbuf->v;
|
||
|
||
/* HASH payload is fixed postion */
|
||
if (pa->type != ISAKMP_NPTYPE_HASH) {
|
||
plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
|
||
"received invalid next payload type %d, "
|
||
"expecting %d.\n",
|
||
pa->type, ISAKMP_NPTYPE_HASH);
|
||
goto end;
|
||
}
|
||
hash = (struct isakmp_pl_hash *)pa->ptr;
|
||
pa++;
|
||
|
||
/*
|
||
* this restriction was introduced in isakmp-oakley-05.
|
||
* we do not check this for backward compatibility.
|
||
* TODO: command line/config file option to enable/disable this code
|
||
*/
|
||
/* HASH payload is fixed postion */
|
||
if (pa->type != ISAKMP_NPTYPE_SA) {
|
||
plog(LLV_WARNING, LOCATION, iph2->ph1->remote,
|
||
"received invalid next payload type %d, "
|
||
"expecting %d.\n",
|
||
pa->type, ISAKMP_NPTYPE_HASH);
|
||
}
|
||
|
||
/* allocate buffer for computing HASH(2) */
|
||
tlen = iph2->nonce->l
|
||
+ ntohl(isakmp->len) - sizeof(*isakmp);
|
||
hbuf = vmalloc(tlen);
|
||
if (hbuf == NULL) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"failed to get hash buffer.\n");
|
||
goto end;
|
||
}
|
||
p = hbuf->v + iph2->nonce->l; /* retain the space for Ni_b */
|
||
|
||
/*
|
||
* parse the payloads.
|
||
* copy non-HASH payloads into hbuf, so that we can validate HASH.
|
||
*/
|
||
iph2->sa_ret = NULL;
|
||
f_id = 0; /* flag to use checking ID */
|
||
tlen = 0; /* count payload length except of HASH payload. */
|
||
for (; pa->type; pa++) {
|
||
|
||
/* copy to buffer for HASH */
|
||
/* Don't modify the payload */
|
||
memcpy(p, pa->ptr, pa->len);
|
||
|
||
switch (pa->type) {
|
||
case ISAKMP_NPTYPE_SA:
|
||
if (iph2->sa_ret != NULL) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"Ignored, multiple SA "
|
||
"isn't supported.\n");
|
||
break;
|
||
}
|
||
if (isakmp_p2ph(&iph2->sa_ret, pa->ptr) < 0)
|
||
goto end;
|
||
break;
|
||
|
||
case ISAKMP_NPTYPE_NONCE:
|
||
if (isakmp_p2ph(&iph2->nonce_p, pa->ptr) < 0)
|
||
goto end;
|
||
break;
|
||
|
||
case ISAKMP_NPTYPE_KE:
|
||
if (isakmp_p2ph(&iph2->dhpub_p, pa->ptr) < 0)
|
||
goto end;
|
||
break;
|
||
|
||
case ISAKMP_NPTYPE_ID:
|
||
{
|
||
vchar_t *vp;
|
||
|
||
/* check ID value */
|
||
if (f_id == 0) {
|
||
/* for IDci */
|
||
f_id = 1;
|
||
vp = iph2->id;
|
||
} else {
|
||
/* for IDcr */
|
||
vp = iph2->id_p;
|
||
}
|
||
|
||
if (memcmp(vp->v, (caddr_t)pa->ptr + sizeof(struct isakmp_gen), vp->l)) {
|
||
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"mismatched ID was returned.\n");
|
||
error = ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED;
|
||
goto end;
|
||
}
|
||
}
|
||
break;
|
||
|
||
case ISAKMP_NPTYPE_N:
|
||
isakmp_check_notify(pa->ptr, iph2->ph1);
|
||
break;
|
||
|
||
default:
|
||
/* don't send information, see ident_r1recv() */
|
||
plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
|
||
"ignore the packet, "
|
||
"received unexpecting payload type %d.\n",
|
||
pa->type);
|
||
goto end;
|
||
}
|
||
|
||
p += pa->len;
|
||
|
||
/* compute true length of payload. */
|
||
tlen += pa->len;
|
||
}
|
||
|
||
/* payload existency check */
|
||
if (hash == NULL || iph2->sa_ret == NULL || iph2->nonce_p == NULL) {
|
||
plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
|
||
"few isakmp message received.\n");
|
||
goto end;
|
||
}
|
||
|
||
/* Fixed buffer for calculating HASH */
|
||
memcpy(hbuf->v, iph2->nonce->v, iph2->nonce->l);
|
||
plog(LLV_DEBUG, LOCATION, NULL,
|
||
"HASH allocated:hbuf->l=%d actual:tlen=%d\n",
|
||
hbuf->l, tlen + iph2->nonce->l);
|
||
/* adjust buffer length for HASH */
|
||
hbuf->l = iph2->nonce->l + tlen;
|
||
|
||
/* validate HASH(2) */
|
||
{
|
||
char *r_hash;
|
||
vchar_t *my_hash = NULL;
|
||
int result;
|
||
|
||
r_hash = (char *)hash + sizeof(*hash);
|
||
|
||
plog(LLV_DEBUG, LOCATION, NULL, "HASH(2) received:");
|
||
plogdump(LLV_DEBUG, r_hash, ntohs(hash->h.len) - sizeof(*hash));
|
||
|
||
my_hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, hbuf);
|
||
if (my_hash == NULL)
|
||
goto end;
|
||
|
||
result = memcmp(my_hash->v, r_hash, my_hash->l);
|
||
vfree(my_hash);
|
||
|
||
if (result) {
|
||
plog(LLV_DEBUG, LOCATION, iph2->ph1->remote,
|
||
"HASH(2) mismatch.\n");
|
||
error = ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
|
||
goto end;
|
||
}
|
||
}
|
||
|
||
/* validity check SA payload sent from responder */
|
||
if (ipsecdoi_checkph2proposal(iph2) < 0) {
|
||
error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
|
||
goto end;
|
||
}
|
||
|
||
/* change status of isakmp status entry */
|
||
iph2->status = PHASE2ST_STATUS6;
|
||
|
||
error = 0;
|
||
|
||
end:
|
||
if (hbuf)
|
||
vfree(hbuf);
|
||
if (pbuf)
|
||
vfree(pbuf);
|
||
if (msg)
|
||
vfree(msg);
|
||
|
||
if (error) {
|
||
VPTRINIT(iph2->sa_ret);
|
||
VPTRINIT(iph2->nonce_p);
|
||
VPTRINIT(iph2->dhpub_p);
|
||
VPTRINIT(iph2->id);
|
||
VPTRINIT(iph2->id_p);
|
||
}
|
||
|
||
return error;
|
||
}
|
||
|
||
/*
|
||
* send to responder
|
||
* HDR*, HASH(3)
|
||
*/
|
||
int
|
||
quick_i2send(iph2, msg0)
|
||
struct ph2handle *iph2;
|
||
vchar_t *msg0;
|
||
{
|
||
vchar_t *msg = NULL;
|
||
vchar_t *buf = NULL;
|
||
vchar_t *hash = NULL;
|
||
char *p = NULL;
|
||
int tlen;
|
||
int error = ISAKMP_INTERNAL_ERROR;
|
||
|
||
/* validity check */
|
||
if (iph2->status != PHASE2ST_STATUS6) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"status mismatched %d.\n", iph2->status);
|
||
goto end;
|
||
}
|
||
|
||
/* generate HASH(3) */
|
||
{
|
||
vchar_t *tmp = NULL;
|
||
|
||
plog(LLV_DEBUG, LOCATION, NULL, "HASH(3) generate\n");
|
||
|
||
tmp = vmalloc(iph2->nonce->l + iph2->nonce_p->l);
|
||
if (tmp == NULL) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"failed to get hash buffer.\n");
|
||
goto end;
|
||
}
|
||
memcpy(tmp->v, iph2->nonce->v, iph2->nonce->l);
|
||
memcpy(tmp->v + iph2->nonce->l, iph2->nonce_p->v, iph2->nonce_p->l);
|
||
|
||
hash = oakley_compute_hash3(iph2->ph1, iph2->msgid, tmp);
|
||
vfree(tmp);
|
||
|
||
if (hash == NULL)
|
||
goto end;
|
||
}
|
||
|
||
/* create buffer for isakmp payload */
|
||
tlen = sizeof(struct isakmp)
|
||
+ sizeof(struct isakmp_gen) + hash->l;
|
||
buf = vmalloc(tlen);
|
||
if (buf == NULL) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"failed to get buffer to send.\n");
|
||
goto end;
|
||
}
|
||
|
||
/* create isakmp header */
|
||
p = set_isakmp_header2(buf, iph2, ISAKMP_NPTYPE_HASH);
|
||
if (p == NULL)
|
||
goto end;
|
||
|
||
/* add HASH(3) payload */
|
||
p = set_isakmp_payload(p, hash, ISAKMP_NPTYPE_NONE);
|
||
|
||
#ifdef HAVE_PRINT_ISAKMP_C
|
||
isakmp_printpacket(buf, iph2->ph1->local, iph2->ph1->remote, 1);
|
||
#endif
|
||
|
||
/* encoding */
|
||
iph2->sendbuf = oakley_do_encrypt(iph2->ph1, buf, iph2->ivm->ive, iph2->ivm->iv);
|
||
if (iph2->sendbuf == NULL)
|
||
goto end;
|
||
|
||
/* if there is commit bit, need resending */
|
||
if (ISSET(iph2->flags, ISAKMP_FLAG_C)) {
|
||
/* send the packet, add to the schedule to resend */
|
||
iph2->retry_counter = iph2->ph1->rmconf->retry_counter;
|
||
if (isakmp_ph2resend(iph2) == -1)
|
||
goto end;
|
||
} else {
|
||
/* send the packet */
|
||
if (isakmp_send(iph2->ph1, iph2->sendbuf) < 0)
|
||
goto end;
|
||
}
|
||
|
||
/* the sending message is added to the received-list. */
|
||
if (add_recvdpkt(iph2->ph1->remote, iph2->ph1->local,
|
||
iph2->sendbuf, msg0) == -1) {
|
||
plog(LLV_ERROR , LOCATION, NULL,
|
||
"failed to add a response packet to the tree.\n");
|
||
goto end;
|
||
}
|
||
|
||
/* compute both of KEYMATs */
|
||
if (oakley_compute_keymat(iph2, INITIATOR) < 0)
|
||
goto end;
|
||
|
||
iph2->status = PHASE2ST_ADDSA;
|
||
|
||
/* don't anything if local test mode. */
|
||
if (f_local) {
|
||
error = 0;
|
||
goto end;
|
||
}
|
||
|
||
/* if there is commit bit don't set up SA now. */
|
||
if (ISSET(iph2->flags, ISAKMP_FLAG_C)) {
|
||
iph2->status = PHASE2ST_COMMIT;
|
||
error = 0;
|
||
goto end;
|
||
}
|
||
|
||
/* Do UPDATE for initiator */
|
||
plog(LLV_DEBUG, LOCATION, NULL, "call pk_sendupdate\n");
|
||
if (pk_sendupdate(iph2) < 0) {
|
||
plog(LLV_ERROR, LOCATION, NULL, "pfkey update failed.\n");
|
||
goto end;
|
||
}
|
||
plog(LLV_DEBUG, LOCATION, NULL, "pfkey update sent.\n");
|
||
|
||
/* Do ADD for responder */
|
||
if (pk_sendadd(iph2) < 0) {
|
||
plog(LLV_ERROR, LOCATION, NULL, "pfkey add failed.\n");
|
||
goto end;
|
||
}
|
||
plog(LLV_DEBUG, LOCATION, NULL, "pfkey add sent.\n");
|
||
|
||
error = 0;
|
||
|
||
end:
|
||
if (buf != NULL)
|
||
vfree(buf);
|
||
if (msg != NULL)
|
||
vfree(msg);
|
||
if (hash != NULL)
|
||
vfree(hash);
|
||
|
||
return error;
|
||
}
|
||
|
||
/*
|
||
* receive from responder
|
||
* HDR#*, HASH(4), notify
|
||
*/
|
||
int
|
||
quick_i3recv(iph2, msg0)
|
||
struct ph2handle *iph2;
|
||
vchar_t *msg0;
|
||
{
|
||
vchar_t *msg = NULL;
|
||
vchar_t *pbuf = NULL; /* for payload parsing */
|
||
struct isakmp_parse_t *pa;
|
||
struct isakmp_pl_hash *hash = NULL;
|
||
vchar_t *notify = NULL;
|
||
int error = ISAKMP_INTERNAL_ERROR;
|
||
|
||
/* validity check */
|
||
if (iph2->status != PHASE2ST_COMMIT) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"status mismatched %d.\n", iph2->status);
|
||
goto end;
|
||
}
|
||
|
||
/* decrypt packet */
|
||
if (!ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E)) {
|
||
plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
|
||
"Packet wasn't encrypted.\n");
|
||
goto end;
|
||
}
|
||
msg = oakley_do_decrypt(iph2->ph1, msg0, iph2->ivm->iv, iph2->ivm->ive);
|
||
if (msg == NULL)
|
||
goto end;
|
||
|
||
/* validate the type of next payload */
|
||
pbuf = isakmp_parse(msg);
|
||
if (pbuf == NULL)
|
||
goto end;
|
||
|
||
for (pa = (struct isakmp_parse_t *)pbuf->v;
|
||
pa->type != ISAKMP_NPTYPE_NONE;
|
||
pa++) {
|
||
|
||
switch (pa->type) {
|
||
case ISAKMP_NPTYPE_HASH:
|
||
hash = (struct isakmp_pl_hash *)pa->ptr;
|
||
break;
|
||
case ISAKMP_NPTYPE_N:
|
||
isakmp_check_notify(pa->ptr, iph2->ph1);
|
||
notify = vmalloc(pa->len);
|
||
if (notify == NULL) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"failed to get notify buffer.\n");
|
||
goto end;
|
||
}
|
||
memcpy(notify->v, pa->ptr, notify->l);
|
||
break;
|
||
default:
|
||
/* don't send information, see ident_r1recv() */
|
||
plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
|
||
"ignore the packet, "
|
||
"received unexpecting payload type %d.\n",
|
||
pa->type);
|
||
goto end;
|
||
}
|
||
}
|
||
|
||
/* payload existency check */
|
||
if (hash == NULL) {
|
||
plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
|
||
"few isakmp message received.\n");
|
||
goto end;
|
||
}
|
||
|
||
/* validate HASH(4) */
|
||
{
|
||
char *r_hash;
|
||
vchar_t *my_hash = NULL;
|
||
vchar_t *tmp = NULL;
|
||
int result;
|
||
|
||
r_hash = (char *)hash + sizeof(*hash);
|
||
|
||
plog(LLV_DEBUG, LOCATION, NULL, "HASH(4) validate:");
|
||
plogdump(LLV_DEBUG, r_hash, ntohs(hash->h.len) - sizeof(*hash));
|
||
|
||
my_hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, notify);
|
||
vfree(tmp);
|
||
if (my_hash == NULL)
|
||
goto end;
|
||
|
||
result = memcmp(my_hash->v, r_hash, my_hash->l);
|
||
vfree(my_hash);
|
||
|
||
if (result) {
|
||
plog(LLV_DEBUG, LOCATION, iph2->ph1->remote,
|
||
"HASH(4) mismatch.\n");
|
||
error = ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
|
||
goto end;
|
||
}
|
||
}
|
||
|
||
iph2->status = PHASE2ST_ADDSA;
|
||
iph2->flags ^= ISAKMP_FLAG_C; /* reset bit */
|
||
|
||
/* don't anything if local test mode. */
|
||
if (f_local) {
|
||
error = 0;
|
||
goto end;
|
||
}
|
||
|
||
/* Do UPDATE for initiator */
|
||
plog(LLV_DEBUG, LOCATION, NULL, "call pk_sendupdate\n");
|
||
if (pk_sendupdate(iph2) < 0) {
|
||
plog(LLV_ERROR, LOCATION, NULL, "pfkey update failed.\n");
|
||
goto end;
|
||
}
|
||
plog(LLV_DEBUG, LOCATION, NULL, "pfkey update sent.\n");
|
||
|
||
/* Do ADD for responder */
|
||
if (pk_sendadd(iph2) < 0) {
|
||
plog(LLV_ERROR, LOCATION, NULL, "pfkey add failed.\n");
|
||
goto end;
|
||
}
|
||
plog(LLV_DEBUG, LOCATION, NULL, "pfkey add sent.\n");
|
||
|
||
error = 0;
|
||
|
||
end:
|
||
if (msg != NULL)
|
||
vfree(msg);
|
||
if (pbuf != NULL)
|
||
vfree(pbuf);
|
||
if (notify != NULL)
|
||
vfree(notify);
|
||
|
||
return error;
|
||
}
|
||
|
||
/*
|
||
* receive from initiator
|
||
* HDR*, HASH(1), SA, Ni [, KE ] [, IDi2, IDr2 ]
|
||
*/
|
||
int
|
||
quick_r1recv(iph2, msg0)
|
||
struct ph2handle *iph2;
|
||
vchar_t *msg0;
|
||
{
|
||
vchar_t *msg = NULL;
|
||
vchar_t *hbuf = NULL; /* for hash computing. */
|
||
vchar_t *pbuf = NULL; /* for payload parsing */
|
||
struct isakmp_parse_t *pa;
|
||
struct isakmp *isakmp = (struct isakmp *)msg0->v;
|
||
struct isakmp_pl_hash *hash = NULL;
|
||
char *p;
|
||
int tlen;
|
||
int f_id_order; /* for ID payload detection */
|
||
int error = ISAKMP_INTERNAL_ERROR;
|
||
|
||
/* validity check */
|
||
if (iph2->status != PHASE2ST_START) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"status mismatched %d.\n", iph2->status);
|
||
goto end;
|
||
}
|
||
|
||
/* decrypting */
|
||
if (!ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E)) {
|
||
plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
|
||
"Packet wasn't encrypted.\n");
|
||
error = ISAKMP_NTYPE_PAYLOAD_MALFORMED;
|
||
goto end;
|
||
}
|
||
/* decrypt packet */
|
||
msg = oakley_do_decrypt(iph2->ph1, msg0, iph2->ivm->iv, iph2->ivm->ive);
|
||
if (msg == NULL)
|
||
goto end;
|
||
|
||
/* create buffer for using to validate HASH(1) */
|
||
/*
|
||
* ordering rule:
|
||
* 1. the first one must be HASH
|
||
* 2. the second one must be SA (added in isakmp-oakley-05!)
|
||
* 3. two IDs must be considered as IDci, then IDcr
|
||
*/
|
||
pbuf = isakmp_parse(msg);
|
||
if (pbuf == NULL)
|
||
goto end;
|
||
pa = (struct isakmp_parse_t *)pbuf->v;
|
||
|
||
/* HASH payload is fixed postion */
|
||
if (pa->type != ISAKMP_NPTYPE_HASH) {
|
||
plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
|
||
"received invalid next payload type %d, "
|
||
"expecting %d.\n",
|
||
pa->type, ISAKMP_NPTYPE_HASH);
|
||
error = ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX;
|
||
goto end;
|
||
}
|
||
hash = (struct isakmp_pl_hash *)pa->ptr;
|
||
pa++;
|
||
|
||
/*
|
||
* this restriction was introduced in isakmp-oakley-05.
|
||
* we do not check this for backward compatibility.
|
||
* TODO: command line/config file option to enable/disable this code
|
||
*/
|
||
/* HASH payload is fixed postion */
|
||
if (pa->type != ISAKMP_NPTYPE_SA) {
|
||
plog(LLV_WARNING, LOCATION, iph2->ph1->remote,
|
||
"received invalid next payload type %d, "
|
||
"expecting %d.\n",
|
||
pa->type, ISAKMP_NPTYPE_HASH);
|
||
error = ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX;
|
||
}
|
||
|
||
/* allocate buffer for computing HASH(1) */
|
||
tlen = ntohl(isakmp->len) - sizeof(*isakmp);
|
||
hbuf = vmalloc(tlen);
|
||
if (hbuf == NULL) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"failed to get hash buffer.\n");
|
||
goto end;
|
||
}
|
||
p = hbuf->v;
|
||
|
||
/*
|
||
* parse the payloads.
|
||
* copy non-HASH payloads into hbuf, so that we can validate HASH.
|
||
*/
|
||
iph2->sa = NULL; /* we don't support multi SAs. */
|
||
iph2->nonce_p = NULL;
|
||
iph2->dhpub_p = NULL;
|
||
iph2->id_p = NULL;
|
||
iph2->id = NULL;
|
||
tlen = 0; /* count payload length except of HASH payload. */
|
||
|
||
/*
|
||
* IDi2 MUST be immediatelly followed by IDr2. We allowed the
|
||
* illegal case, but logged. First ID payload is to be IDi2.
|
||
* And next ID payload is to be IDr2.
|
||
*/
|
||
f_id_order = 0;
|
||
|
||
for (; pa->type; pa++) {
|
||
|
||
/* copy to buffer for HASH */
|
||
/* Don't modify the payload */
|
||
memcpy(p, pa->ptr, pa->len);
|
||
|
||
if (pa->type != ISAKMP_NPTYPE_ID)
|
||
f_id_order = 0;
|
||
|
||
switch (pa->type) {
|
||
case ISAKMP_NPTYPE_SA:
|
||
if (iph2->sa != NULL) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"Multi SAs isn't supported.\n");
|
||
goto end;
|
||
}
|
||
if (isakmp_p2ph(&iph2->sa, pa->ptr) < 0)
|
||
goto end;
|
||
break;
|
||
|
||
case ISAKMP_NPTYPE_NONCE:
|
||
if (isakmp_p2ph(&iph2->nonce_p, pa->ptr) < 0)
|
||
goto end;
|
||
break;
|
||
|
||
case ISAKMP_NPTYPE_KE:
|
||
if (isakmp_p2ph(&iph2->dhpub_p, pa->ptr) < 0)
|
||
goto end;
|
||
break;
|
||
|
||
case ISAKMP_NPTYPE_ID:
|
||
if (iph2->id_p == NULL) {
|
||
/* for IDci */
|
||
f_id_order++;
|
||
|
||
if (isakmp_p2ph(&iph2->id_p, pa->ptr) < 0)
|
||
goto end;
|
||
|
||
} else if (iph2->id == NULL) {
|
||
/* for IDcr */
|
||
if (f_id_order == 0) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"IDr2 payload is not "
|
||
"immediatelly followed "
|
||
"by IDi2. We allowed.\n");
|
||
/* XXX we allowed in this case. */
|
||
}
|
||
|
||
if (isakmp_p2ph(&iph2->id, pa->ptr) < 0)
|
||
goto end;
|
||
} else {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"received too many ID payloads.\n");
|
||
plogdump(LLV_ERROR, iph2->id->v, iph2->id->l);
|
||
error = ISAKMP_NTYPE_INVALID_ID_INFORMATION;
|
||
goto end;
|
||
}
|
||
break;
|
||
|
||
case ISAKMP_NPTYPE_N:
|
||
isakmp_check_notify(pa->ptr, iph2->ph1);
|
||
break;
|
||
|
||
default:
|
||
plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
|
||
"ignore the packet, "
|
||
"received unexpecting payload type %d.\n",
|
||
pa->type);
|
||
error = ISAKMP_NTYPE_PAYLOAD_MALFORMED;
|
||
goto end;
|
||
}
|
||
|
||
p += pa->len;
|
||
|
||
/* compute true length of payload. */
|
||
tlen += pa->len;
|
||
}
|
||
|
||
/* payload existency check */
|
||
if (hash == NULL || iph2->sa == NULL || iph2->nonce_p == NULL) {
|
||
plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
|
||
"few isakmp message received.\n");
|
||
error = ISAKMP_NTYPE_PAYLOAD_MALFORMED;
|
||
goto end;
|
||
}
|
||
|
||
if (iph2->id_p) {
|
||
plog(LLV_DEBUG, LOCATION, NULL, "received IDci2:");
|
||
plogdump(LLV_DEBUG, iph2->id_p->v, iph2->id_p->l);
|
||
}
|
||
if (iph2->id) {
|
||
plog(LLV_DEBUG, LOCATION, NULL, "received IDcr2:");
|
||
plogdump(LLV_DEBUG, iph2->id->v, iph2->id->l);
|
||
}
|
||
|
||
/* adjust buffer length for HASH */
|
||
hbuf->l = tlen;
|
||
|
||
/* validate HASH(1) */
|
||
{
|
||
char *r_hash;
|
||
vchar_t *my_hash = NULL;
|
||
int result;
|
||
|
||
r_hash = (caddr_t)hash + sizeof(*hash);
|
||
|
||
plog(LLV_DEBUG, LOCATION, NULL, "HASH(1) validate:");
|
||
plogdump(LLV_DEBUG, r_hash, ntohs(hash->h.len) - sizeof(*hash));
|
||
|
||
my_hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, hbuf);
|
||
if (my_hash == NULL)
|
||
goto end;
|
||
|
||
result = memcmp(my_hash->v, r_hash, my_hash->l);
|
||
vfree(my_hash);
|
||
|
||
if (result) {
|
||
plog(LLV_DEBUG, LOCATION, iph2->ph1->remote,
|
||
"HASH(1) mismatch.\n");
|
||
error = ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
|
||
goto end;
|
||
}
|
||
}
|
||
|
||
/* get sainfo */
|
||
error = get_sainfo_r(iph2);
|
||
if (error) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"failed to get sainfo.\n");
|
||
goto end;
|
||
}
|
||
|
||
/* check the existence of ID payload and create responder's proposal */
|
||
error = get_proposal_r(iph2);
|
||
switch (error) {
|
||
case -2:
|
||
/* generate a policy template from peer's proposal */
|
||
if (set_proposal_from_proposal(iph2)) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"failed to generate a proposal template "
|
||
"from client's proposal.\n");
|
||
return ISAKMP_INTERNAL_ERROR;
|
||
}
|
||
/*FALLTHROUGH*/
|
||
case 0:
|
||
/* select single proposal or reject it. */
|
||
if (ipsecdoi_selectph2proposal(iph2) < 0) {
|
||
error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
|
||
goto end;
|
||
}
|
||
break;
|
||
default:
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"failed to get proposal for responder.\n");
|
||
goto end;
|
||
}
|
||
|
||
/* check KE and attribute of PFS */
|
||
if (iph2->dhpub_p != NULL && iph2->approval->pfs_group == 0) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"no PFS is specified, but peer sends KE.\n");
|
||
error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
|
||
goto end;
|
||
}
|
||
if (iph2->dhpub_p == NULL && iph2->approval->pfs_group != 0) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"PFS is specified, but peer doesn't sends KE.\n");
|
||
error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
|
||
goto end;
|
||
}
|
||
|
||
/*
|
||
* save the packet from the initiator in order to resend the
|
||
* responder's first packet against this packet.
|
||
*/
|
||
iph2->msg1 = vdup(msg0);
|
||
|
||
/* change status of isakmp status entry */
|
||
iph2->status = PHASE2ST_STATUS2;
|
||
|
||
error = 0;
|
||
|
||
end:
|
||
if (hbuf)
|
||
vfree(hbuf);
|
||
if (msg)
|
||
vfree(msg);
|
||
if (pbuf)
|
||
vfree(pbuf);
|
||
|
||
if (error) {
|
||
VPTRINIT(iph2->sa);
|
||
VPTRINIT(iph2->nonce_p);
|
||
VPTRINIT(iph2->dhpub_p);
|
||
VPTRINIT(iph2->id);
|
||
VPTRINIT(iph2->id_p);
|
||
}
|
||
|
||
return error;
|
||
}
|
||
|
||
/*
|
||
* call pfkey_getspi.
|
||
*/
|
||
int
|
||
quick_r1prep(iph2, msg)
|
||
struct ph2handle *iph2;
|
||
vchar_t *msg;
|
||
{
|
||
int error = ISAKMP_INTERNAL_ERROR;
|
||
|
||
/* validity check */
|
||
if (iph2->status != PHASE2ST_STATUS2) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"status mismatched %d.\n", iph2->status);
|
||
goto end;
|
||
}
|
||
|
||
iph2->status = PHASE2ST_GETSPISENT;
|
||
|
||
/* send getspi message */
|
||
if (pk_sendgetspi(iph2) < 0)
|
||
goto end;
|
||
|
||
plog(LLV_DEBUG, LOCATION, NULL, "pfkey getspi sent.\n");
|
||
|
||
iph2->sce = sched_new(lcconf->wait_ph2complete,
|
||
pfkey_timeover_stub, iph2);
|
||
|
||
error = 0;
|
||
|
||
end:
|
||
return error;
|
||
}
|
||
|
||
/*
|
||
* send to initiator
|
||
* HDR*, HASH(2), SA, Nr [, KE ] [, IDi2, IDr2 ]
|
||
*/
|
||
int
|
||
quick_r2send(iph2, msg)
|
||
struct ph2handle *iph2;
|
||
vchar_t *msg;
|
||
{
|
||
vchar_t *body = NULL;
|
||
vchar_t *hash = NULL;
|
||
struct isakmp_gen *gen;
|
||
char *p;
|
||
int tlen;
|
||
int error = ISAKMP_INTERNAL_ERROR;
|
||
int pfsgroup;
|
||
u_int8_t *np_p = NULL;
|
||
|
||
/* validity check */
|
||
if (msg != NULL) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"msg has to be NULL in this function.\n");
|
||
goto end;
|
||
}
|
||
if (iph2->status != PHASE2ST_GETSPIDONE) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"status mismatched %d.\n", iph2->status);
|
||
goto end;
|
||
}
|
||
|
||
/* update responders SPI */
|
||
if (ipsecdoi_updatespi(iph2) < 0) {
|
||
plog(LLV_ERROR, LOCATION, NULL, "failed to update spi.\n");
|
||
goto end;
|
||
}
|
||
|
||
/* generate NONCE value */
|
||
iph2->nonce = eay_set_random(iph2->ph1->rmconf->nonce_size);
|
||
if (iph2->nonce == NULL)
|
||
goto end;
|
||
|
||
/* generate KE value if need */
|
||
pfsgroup = iph2->approval->pfs_group;
|
||
if (iph2->dhpub_p != NULL && pfsgroup != 0) {
|
||
/* DH group settting if PFS is required. */
|
||
if (oakley_setdhgroup(pfsgroup, &iph2->pfsgrp) < 0) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"failed to set DH value.\n");
|
||
goto end;
|
||
}
|
||
/* generate DH public value */
|
||
if (oakley_dh_generate(iph2->pfsgrp,
|
||
&iph2->dhpub, &iph2->dhpriv) < 0) {
|
||
goto end;
|
||
}
|
||
}
|
||
|
||
/* create SA;NONCE payload, and KE and ID if need */
|
||
tlen = sizeof(*gen) + iph2->sa_ret->l
|
||
+ sizeof(*gen) + iph2->nonce->l;
|
||
if (iph2->dhpub_p != NULL && pfsgroup != 0)
|
||
tlen += (sizeof(*gen) + iph2->dhpub->l);
|
||
if (iph2->id_p != NULL)
|
||
tlen += (sizeof(*gen) + iph2->id_p->l
|
||
+ sizeof(*gen) + iph2->id->l);
|
||
|
||
body = vmalloc(tlen);
|
||
if (body == NULL) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"failed to get buffer to send.\n");
|
||
goto end;
|
||
}
|
||
p = body->v;
|
||
|
||
/* make SA payload */
|
||
p = set_isakmp_payload(body->v, iph2->sa_ret, ISAKMP_NPTYPE_NONCE);
|
||
|
||
/* add NONCE payload */
|
||
np_p = &((struct isakmp_gen *)p)->np; /* XXX */
|
||
p = set_isakmp_payload(p, iph2->nonce,
|
||
(iph2->dhpub_p != NULL && pfsgroup != 0)
|
||
? ISAKMP_NPTYPE_KE
|
||
: (iph2->id_p != NULL
|
||
? ISAKMP_NPTYPE_ID
|
||
: ISAKMP_NPTYPE_NONE));
|
||
|
||
/* add KE payload if need. */
|
||
if (iph2->dhpub_p != NULL && pfsgroup != 0) {
|
||
np_p = &((struct isakmp_gen *)p)->np; /* XXX */
|
||
p = set_isakmp_payload(p, iph2->dhpub,
|
||
(iph2->id_p == NULL)
|
||
? ISAKMP_NPTYPE_NONE
|
||
: ISAKMP_NPTYPE_ID);
|
||
}
|
||
|
||
/* add ID payloads received. */
|
||
if (iph2->id_p != NULL) {
|
||
/* IDci */
|
||
p = set_isakmp_payload(p, iph2->id_p, ISAKMP_NPTYPE_ID);
|
||
/* IDcr */
|
||
np_p = &((struct isakmp_gen *)p)->np; /* XXX */
|
||
p = set_isakmp_payload(p, iph2->id, ISAKMP_NPTYPE_NONE);
|
||
}
|
||
|
||
/* add a RESPONDER-LIFETIME notify payload if needed */
|
||
{
|
||
vchar_t *data = NULL;
|
||
struct saprop *pp = iph2->approval;
|
||
struct saproto *pr;
|
||
|
||
if (pp->claim & IPSECDOI_ATTR_SA_LD_TYPE_SEC) {
|
||
u_int32_t v = htonl((u_int32_t)pp->lifetime);
|
||
data = isakmp_add_attr_l(data, IPSECDOI_ATTR_SA_LD_TYPE,
|
||
IPSECDOI_ATTR_SA_LD_TYPE_SEC);
|
||
if (!data)
|
||
goto end;
|
||
data = isakmp_add_attr_v(data, IPSECDOI_ATTR_SA_LD,
|
||
(caddr_t)&v, sizeof(v));
|
||
if (!data)
|
||
goto end;
|
||
}
|
||
if (pp->claim & IPSECDOI_ATTR_SA_LD_TYPE_KB) {
|
||
u_int32_t v = htonl((u_int32_t)pp->lifebyte);
|
||
data = isakmp_add_attr_l(data, IPSECDOI_ATTR_SA_LD_TYPE,
|
||
IPSECDOI_ATTR_SA_LD_TYPE_KB);
|
||
if (!data)
|
||
goto end;
|
||
data = isakmp_add_attr_v(data, IPSECDOI_ATTR_SA_LD,
|
||
(caddr_t)&v, sizeof(v));
|
||
if (!data)
|
||
goto end;
|
||
}
|
||
|
||
/*
|
||
* XXX Is there only single RESPONDER-LIFETIME payload in a IKE message
|
||
* in the case of SA bundle ?
|
||
*/
|
||
if (data) {
|
||
for (pr = pp->head; pr; pr = pr->next) {
|
||
body = isakmp_add_pl_n(body, &np_p,
|
||
ISAKMP_NTYPE_RESPONDER_LIFETIME, pr, data);
|
||
if (!body) {
|
||
vfree(data);
|
||
return error; /* XXX */
|
||
}
|
||
}
|
||
vfree(data);
|
||
}
|
||
}
|
||
|
||
/* generate HASH(2) */
|
||
{
|
||
vchar_t *tmp;
|
||
|
||
tmp = vmalloc(iph2->nonce_p->l + body->l);
|
||
if (tmp == NULL) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"failed to get hash buffer.\n");
|
||
goto end;
|
||
}
|
||
memcpy(tmp->v, iph2->nonce_p->v, iph2->nonce_p->l);
|
||
memcpy(tmp->v + iph2->nonce_p->l, body->v, body->l);
|
||
|
||
hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, tmp);
|
||
vfree(tmp);
|
||
|
||
if (hash == NULL)
|
||
goto end;
|
||
}
|
||
|
||
/* send isakmp payload */
|
||
iph2->sendbuf = quick_ir1mx(iph2, body, hash);
|
||
if (iph2->sendbuf == NULL)
|
||
goto end;
|
||
|
||
/* send the packet, add to the schedule to resend */
|
||
iph2->retry_counter = iph2->ph1->rmconf->retry_counter;
|
||
if (isakmp_ph2resend(iph2) == -1)
|
||
goto end;
|
||
|
||
/* the sending message is added to the received-list. */
|
||
if (add_recvdpkt(iph2->ph1->remote, iph2->ph1->local, iph2->sendbuf, iph2->msg1) == -1) {
|
||
plog(LLV_ERROR , LOCATION, NULL,
|
||
"failed to add a response packet to the tree.\n");
|
||
goto end;
|
||
}
|
||
|
||
/* change status of isakmp status entry */
|
||
iph2->status = PHASE2ST_MSG1SENT;
|
||
|
||
error = 0;
|
||
|
||
end:
|
||
if (body != NULL)
|
||
vfree(body);
|
||
if (hash != NULL)
|
||
vfree(hash);
|
||
|
||
return error;
|
||
}
|
||
|
||
/*
|
||
* receive from initiator
|
||
* HDR*, HASH(3)
|
||
*/
|
||
int
|
||
quick_r3recv(iph2, msg0)
|
||
struct ph2handle *iph2;
|
||
vchar_t *msg0;
|
||
{
|
||
vchar_t *msg = NULL;
|
||
vchar_t *pbuf = NULL; /* for payload parsing */
|
||
struct isakmp_parse_t *pa;
|
||
struct isakmp_pl_hash *hash = NULL;
|
||
int error = ISAKMP_INTERNAL_ERROR;
|
||
|
||
/* validity check */
|
||
if (iph2->status != PHASE2ST_MSG1SENT) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"status mismatched %d.\n", iph2->status);
|
||
goto end;
|
||
}
|
||
|
||
/* decrypt packet */
|
||
if (!ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E)) {
|
||
plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
|
||
"Packet wasn't encrypted.\n");
|
||
goto end;
|
||
}
|
||
msg = oakley_do_decrypt(iph2->ph1, msg0, iph2->ivm->iv, iph2->ivm->ive);
|
||
if (msg == NULL)
|
||
goto end;
|
||
|
||
/* validate the type of next payload */
|
||
pbuf = isakmp_parse(msg);
|
||
if (pbuf == NULL)
|
||
goto end;
|
||
|
||
for (pa = (struct isakmp_parse_t *)pbuf->v;
|
||
pa->type != ISAKMP_NPTYPE_NONE;
|
||
pa++) {
|
||
|
||
switch (pa->type) {
|
||
case ISAKMP_NPTYPE_HASH:
|
||
hash = (struct isakmp_pl_hash *)pa->ptr;
|
||
break;
|
||
case ISAKMP_NPTYPE_N:
|
||
isakmp_check_notify(pa->ptr, iph2->ph1);
|
||
break;
|
||
default:
|
||
/* don't send information, see ident_r1recv() */
|
||
plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
|
||
"ignore the packet, "
|
||
"received unexpecting payload type %d.\n",
|
||
pa->type);
|
||
goto end;
|
||
}
|
||
}
|
||
|
||
/* payload existency check */
|
||
if (hash == NULL) {
|
||
plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
|
||
"few isakmp message received.\n");
|
||
goto end;
|
||
}
|
||
|
||
/* validate HASH(3) */
|
||
/* HASH(3) = prf(SKEYID_a, 0 | M-ID | Ni_b | Nr_b) */
|
||
{
|
||
char *r_hash;
|
||
vchar_t *my_hash = NULL;
|
||
vchar_t *tmp = NULL;
|
||
int result;
|
||
|
||
r_hash = (char *)hash + sizeof(*hash);
|
||
|
||
plog(LLV_DEBUG, LOCATION, NULL, "HASH(3) validate:");
|
||
plogdump(LLV_DEBUG, r_hash, ntohs(hash->h.len) - sizeof(*hash));
|
||
|
||
tmp = vmalloc(iph2->nonce_p->l + iph2->nonce->l);
|
||
if (tmp == NULL) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"failed to get hash buffer.\n");
|
||
goto end;
|
||
}
|
||
memcpy(tmp->v, iph2->nonce_p->v, iph2->nonce_p->l);
|
||
memcpy(tmp->v + iph2->nonce_p->l, iph2->nonce->v, iph2->nonce->l);
|
||
|
||
my_hash = oakley_compute_hash3(iph2->ph1, iph2->msgid, tmp);
|
||
vfree(tmp);
|
||
if (my_hash == NULL)
|
||
goto end;
|
||
|
||
result = memcmp(my_hash->v, r_hash, my_hash->l);
|
||
vfree(my_hash);
|
||
|
||
if (result) {
|
||
plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
|
||
"HASH(3) mismatch.\n");
|
||
error = ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
|
||
goto end;
|
||
}
|
||
}
|
||
|
||
/* if there is commit bit, don't set up SA now. */
|
||
if (ISSET(iph2->flags, ISAKMP_FLAG_C)) {
|
||
iph2->status = PHASE2ST_COMMIT;
|
||
} else
|
||
iph2->status = PHASE2ST_STATUS6;
|
||
|
||
error = 0;
|
||
|
||
end:
|
||
if (pbuf != NULL)
|
||
vfree(pbuf);
|
||
if (msg != NULL)
|
||
vfree(msg);
|
||
|
||
return error;
|
||
}
|
||
|
||
/*
|
||
* send to initiator
|
||
* HDR#*, HASH(4), notify
|
||
*/
|
||
int
|
||
quick_r3send(iph2, msg0)
|
||
struct ph2handle *iph2;
|
||
vchar_t *msg0;
|
||
{
|
||
vchar_t *buf = NULL;
|
||
vchar_t *myhash = NULL;
|
||
struct isakmp_pl_n *n;
|
||
vchar_t *notify = NULL;
|
||
char *p;
|
||
int tlen;
|
||
int error = ISAKMP_INTERNAL_ERROR;
|
||
|
||
/* validity check */
|
||
if (iph2->status != PHASE2ST_COMMIT) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"status mismatched %d.\n", iph2->status);
|
||
goto end;
|
||
}
|
||
|
||
/* generate HASH(4) */
|
||
/* XXX What can I do in the case of multiple different SA */
|
||
plog(LLV_DEBUG, LOCATION, NULL, "HASH(4) generate\n");
|
||
|
||
/* XXX What should I do if there are multiple SAs ? */
|
||
tlen = sizeof(struct isakmp_pl_n) + iph2->approval->head->spisize;
|
||
notify = vmalloc(tlen);
|
||
if (notify == NULL) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"failed to get notify buffer.\n");
|
||
goto end;
|
||
}
|
||
n = (struct isakmp_pl_n *)notify->v;
|
||
n->h.np = ISAKMP_NPTYPE_NONE;
|
||
n->h.len = htons(tlen);
|
||
n->doi = IPSEC_DOI;
|
||
n->proto_id = iph2->approval->head->proto_id;
|
||
n->spi_size = sizeof(iph2->approval->head->spisize);
|
||
n->type = htons(ISAKMP_NTYPE_CONNECTED);
|
||
memcpy(n + 1, &iph2->approval->head->spi, iph2->approval->head->spisize);
|
||
|
||
myhash = oakley_compute_hash1(iph2->ph1, iph2->msgid, notify);
|
||
if (myhash == NULL)
|
||
goto end;
|
||
|
||
/* create buffer for isakmp payload */
|
||
tlen = sizeof(struct isakmp)
|
||
+ sizeof(struct isakmp_gen) + myhash->l
|
||
+ notify->l;
|
||
buf = vmalloc(tlen);
|
||
if (buf == NULL) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"failed to get buffer to send.\n");
|
||
goto end;
|
||
}
|
||
|
||
/* create isakmp header */
|
||
p = set_isakmp_header2(buf, iph2, ISAKMP_NPTYPE_HASH);
|
||
if (p == NULL)
|
||
goto end;
|
||
|
||
/* add HASH(4) payload */
|
||
p = set_isakmp_payload(p, myhash, ISAKMP_NPTYPE_N);
|
||
|
||
/* add notify payload */
|
||
memcpy(p, notify->v, notify->l);
|
||
|
||
#ifdef HAVE_PRINT_ISAKMP_C
|
||
isakmp_printpacket(buf, iph2->ph1->local, iph2->ph1->remote, 1);
|
||
#endif
|
||
|
||
/* encoding */
|
||
iph2->sendbuf = oakley_do_encrypt(iph2->ph1, buf, iph2->ivm->ive, iph2->ivm->iv);
|
||
if (iph2->sendbuf == NULL)
|
||
goto end;
|
||
|
||
/* send the packet */
|
||
if (isakmp_send(iph2->ph1, iph2->sendbuf) < 0)
|
||
goto end;
|
||
|
||
/* the sending message is added to the received-list. */
|
||
if (add_recvdpkt(iph2->ph1->remote, iph2->ph1->local, iph2->sendbuf, msg0) == -1) {
|
||
plog(LLV_ERROR , LOCATION, NULL,
|
||
"failed to add a response packet to the tree.\n");
|
||
goto end;
|
||
}
|
||
|
||
iph2->status = PHASE2ST_COMMIT;
|
||
|
||
error = 0;
|
||
|
||
end:
|
||
if (buf != NULL)
|
||
vfree(buf);
|
||
if (myhash != NULL)
|
||
vfree(myhash);
|
||
if (notify != NULL)
|
||
vfree(notify);
|
||
|
||
return error;
|
||
}
|
||
|
||
/*
|
||
* set SA to kernel.
|
||
*/
|
||
int
|
||
quick_r3prep(iph2, msg0)
|
||
struct ph2handle *iph2;
|
||
vchar_t *msg0;
|
||
{
|
||
vchar_t *msg = NULL;
|
||
int error = ISAKMP_INTERNAL_ERROR;
|
||
|
||
/* validity check */
|
||
if (iph2->status != PHASE2ST_STATUS6) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"status mismatched %d.\n", iph2->status);
|
||
goto end;
|
||
}
|
||
|
||
/* compute both of KEYMATs */
|
||
if (oakley_compute_keymat(iph2, RESPONDER) < 0)
|
||
goto end;
|
||
|
||
iph2->status = PHASE2ST_ADDSA;
|
||
iph2->flags ^= ISAKMP_FLAG_C; /* reset bit */
|
||
|
||
/* don't anything if local test mode. */
|
||
if (f_local) {
|
||
error = 0;
|
||
goto end;
|
||
}
|
||
|
||
/* Do UPDATE as responder */
|
||
plog(LLV_DEBUG, LOCATION, NULL, "call pk_sendupdate\n");
|
||
if (pk_sendupdate(iph2) < 0) {
|
||
plog(LLV_ERROR, LOCATION, NULL, "pfkey update failed.\n");
|
||
goto end;
|
||
}
|
||
plog(LLV_DEBUG, LOCATION, NULL, "pfkey update sent.\n");
|
||
|
||
/* Do ADD for responder */
|
||
if (pk_sendadd(iph2) < 0) {
|
||
plog(LLV_ERROR, LOCATION, NULL, "pfkey add failed.\n");
|
||
goto end;
|
||
}
|
||
plog(LLV_DEBUG, LOCATION, NULL, "pfkey add sent.\n");
|
||
|
||
/*
|
||
* set policies into SPD if the policy is generated
|
||
* from peer's policy.
|
||
*/
|
||
if (iph2->spidx_gen) {
|
||
|
||
struct policyindex *spidx;
|
||
struct sockaddr_storage addr;
|
||
u_int8_t pref;
|
||
struct sockaddr *src = iph2->src;
|
||
struct sockaddr *dst = iph2->dst;
|
||
|
||
/* make inbound policy */
|
||
iph2->src = dst;
|
||
iph2->dst = src;
|
||
if (pk_sendspdupdate2(iph2) < 0) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"pfkey spdupdate2(inbound) failed.\n");
|
||
goto end;
|
||
}
|
||
plog(LLV_DEBUG, LOCATION, NULL,
|
||
"pfkey spdupdate2(inbound) sent.\n");
|
||
|
||
/* make outbound policy */
|
||
iph2->src = src;
|
||
iph2->dst = dst;
|
||
spidx = (struct policyindex *)iph2->spidx_gen;
|
||
spidx->dir = IPSEC_DIR_OUTBOUND;
|
||
addr = spidx->src;
|
||
spidx->src = spidx->dst;
|
||
spidx->dst = addr;
|
||
pref = spidx->prefs;
|
||
spidx->prefs = spidx->prefd;
|
||
spidx->prefd = pref;
|
||
|
||
if (pk_sendspdupdate2(iph2) < 0) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"pfkey spdupdate2(outbound) failed.\n");
|
||
goto end;
|
||
}
|
||
plog(LLV_DEBUG, LOCATION, NULL,
|
||
"pfkey spdupdate2(outbound) sent.\n");
|
||
|
||
/* spidx_gen is unnecessary any more */
|
||
delsp_bothdir((struct policyindex *)iph2->spidx_gen);
|
||
racoon_free(iph2->spidx_gen);
|
||
iph2->spidx_gen = NULL;
|
||
}
|
||
|
||
error = 0;
|
||
|
||
end:
|
||
if (msg != NULL)
|
||
vfree(msg);
|
||
|
||
return error;
|
||
}
|
||
|
||
/*
|
||
* create HASH, body (SA, NONCE) payload with isakmp header.
|
||
*/
|
||
static vchar_t *
|
||
quick_ir1mx(iph2, body, hash)
|
||
struct ph2handle *iph2;
|
||
vchar_t *body, *hash;
|
||
{
|
||
struct isakmp *isakmp;
|
||
vchar_t *buf = NULL, *new = NULL;
|
||
char *p;
|
||
int tlen;
|
||
struct isakmp_gen *gen;
|
||
int error = ISAKMP_INTERNAL_ERROR;
|
||
|
||
/* create buffer for isakmp payload */
|
||
tlen = sizeof(*isakmp)
|
||
+ sizeof(*gen) + hash->l
|
||
+ body->l;
|
||
buf = vmalloc(tlen);
|
||
if (buf == NULL) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"failed to get buffer to send.\n");
|
||
goto end;
|
||
}
|
||
|
||
/* re-set encryption flag, for serurity. */
|
||
iph2->flags |= ISAKMP_FLAG_E;
|
||
|
||
/* set isakmp header */
|
||
p = set_isakmp_header2(buf, iph2, ISAKMP_NPTYPE_HASH);
|
||
if (p == NULL)
|
||
goto end;
|
||
|
||
/* add HASH payload */
|
||
/* XXX is next type always SA ? */
|
||
p = set_isakmp_payload(p, hash, ISAKMP_NPTYPE_SA);
|
||
|
||
/* add body payload */
|
||
memcpy(p, body->v, body->l);
|
||
|
||
#ifdef HAVE_PRINT_ISAKMP_C
|
||
isakmp_printpacket(buf, iph2->ph1->local, iph2->ph1->remote, 1);
|
||
#endif
|
||
|
||
/* encoding */
|
||
new = oakley_do_encrypt(iph2->ph1, buf, iph2->ivm->ive, iph2->ivm->iv);
|
||
if (new == NULL)
|
||
goto end;
|
||
|
||
vfree(buf);
|
||
|
||
buf = new;
|
||
|
||
error = 0;
|
||
|
||
end:
|
||
if (error && buf != NULL) {
|
||
vfree(buf);
|
||
buf = NULL;
|
||
}
|
||
|
||
return buf;
|
||
}
|
||
|
||
/*
|
||
* get remote's sainfo.
|
||
* NOTE: this function is for responder.
|
||
*/
|
||
static int
|
||
get_sainfo_r(iph2)
|
||
struct ph2handle *iph2;
|
||
{
|
||
vchar_t *idsrc = NULL, *iddst = NULL;
|
||
int prefixlen;
|
||
int error = ISAKMP_INTERNAL_ERROR;
|
||
|
||
if (iph2->id_p == NULL) {
|
||
switch (iph2->src->sa_family) {
|
||
case AF_INET:
|
||
prefixlen = sizeof(struct in_addr) << 3;
|
||
break;
|
||
case AF_INET6:
|
||
prefixlen = sizeof(struct in6_addr) << 3;
|
||
break;
|
||
default:
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"invalid family: %d\n", iph2->src->sa_family);
|
||
goto end;
|
||
}
|
||
idsrc = ipsecdoi_sockaddr2id(iph2->src, prefixlen,
|
||
IPSEC_ULPROTO_ANY);
|
||
} else {
|
||
idsrc = vdup(iph2->id);
|
||
}
|
||
if (idsrc == NULL) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"failed to set ID for source.\n");
|
||
goto end;
|
||
}
|
||
|
||
if (iph2->id == NULL) {
|
||
switch (iph2->dst->sa_family) {
|
||
case AF_INET:
|
||
prefixlen = sizeof(struct in_addr) << 3;
|
||
break;
|
||
case AF_INET6:
|
||
prefixlen = sizeof(struct in6_addr) << 3;
|
||
break;
|
||
default:
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"invalid family: %d\n", iph2->dst->sa_family);
|
||
goto end;
|
||
}
|
||
iddst = ipsecdoi_sockaddr2id(iph2->dst, prefixlen,
|
||
IPSEC_ULPROTO_ANY);
|
||
} else {
|
||
iddst = vdup(iph2->id_p);
|
||
}
|
||
if (iddst == NULL) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"failed to set ID for destination.\n");
|
||
goto end;
|
||
}
|
||
|
||
iph2->sainfo = getsainfo(idsrc, iddst, iph2->ph1->id_p);
|
||
if (iph2->sainfo == NULL) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"failed to get sainfo.\n");
|
||
goto end;
|
||
}
|
||
|
||
plog(LLV_DEBUG, LOCATION, NULL,
|
||
"get sa info: %s\n", sainfo2str(iph2->sainfo));
|
||
|
||
error = 0;
|
||
end:
|
||
if (idsrc)
|
||
vfree(idsrc);
|
||
if (iddst)
|
||
vfree(iddst);
|
||
|
||
return error;
|
||
}
|
||
|
||
/*
|
||
* Copy both IP addresses in ID payloads into [src,dst]_id if both ID types
|
||
* are IP address and same address family.
|
||
* Then get remote's policy from SPD copied from kernel.
|
||
* If the type of ID payload is address or subnet type, then the index is
|
||
* made from the payload. If there is no ID payload, or the type of ID
|
||
* payload is NOT address type, then the index is made from the address
|
||
* pair of phase 1.
|
||
* NOTE: This function is only for responder.
|
||
*/
|
||
static int
|
||
get_proposal_r(iph2)
|
||
struct ph2handle *iph2;
|
||
{
|
||
struct policyindex spidx;
|
||
struct secpolicy *sp_in, *sp_out;
|
||
int idi2type = 0; /* switch whether copy IDs into id[src,dst]. */
|
||
int error = ISAKMP_INTERNAL_ERROR;
|
||
|
||
/* check the existence of ID payload */
|
||
if ((iph2->id_p != NULL && iph2->id == NULL)
|
||
|| (iph2->id_p == NULL && iph2->id != NULL)) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"Both IDs wasn't found in payload.\n");
|
||
return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
|
||
}
|
||
|
||
/* make sure if id[src,dst] is null. */
|
||
if (iph2->src_id || iph2->dst_id) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"Why do ID[src,dst] exist already.\n");
|
||
return ISAKMP_INTERNAL_ERROR;
|
||
}
|
||
|
||
memset(&spidx, 0, sizeof(spidx));
|
||
|
||
#define _XIDT(d) ((struct ipsecdoi_id_b *)(d)->v)->type
|
||
|
||
/* make a spidx; a key to search SPD */
|
||
spidx.dir = IPSEC_DIR_INBOUND;
|
||
spidx.ul_proto = 0;
|
||
|
||
/*
|
||
* make destination address in spidx from either ID payload
|
||
* or phase 1 address into a address in spidx.
|
||
*/
|
||
if (iph2->id != NULL
|
||
&& (_XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR
|
||
|| _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR
|
||
|| _XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR_SUBNET
|
||
|| _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR_SUBNET)) {
|
||
/* get a destination address of a policy */
|
||
error = ipsecdoi_id2sockaddr(iph2->id,
|
||
(struct sockaddr *)&spidx.dst,
|
||
&spidx.prefd, &spidx.ul_proto);
|
||
if (error)
|
||
return error;
|
||
|
||
#ifdef INET6
|
||
/*
|
||
* get scopeid from the SA address.
|
||
* note that the phase 1 source address is used as
|
||
* a destination address to search for a inbound policy entry
|
||
* because rcoon is responder.
|
||
*/
|
||
if (_XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR) {
|
||
error = setscopeid((struct sockaddr *)&spidx.dst,
|
||
iph2->src);
|
||
if (error)
|
||
return error;
|
||
}
|
||
#endif
|
||
|
||
if (_XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR
|
||
|| _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR)
|
||
idi2type = _XIDT(iph2->id);
|
||
|
||
} else {
|
||
|
||
plog(LLV_DEBUG, LOCATION, NULL,
|
||
"get a destination address of SP index "
|
||
"from phase1 address "
|
||
"due to no ID payloads found "
|
||
"OR because ID type is not address.\n");
|
||
|
||
/*
|
||
* copy the SOURCE address of IKE into the DESTINATION address
|
||
* of the key to search the SPD because the direction of policy
|
||
* is inbound.
|
||
*/
|
||
memcpy(&spidx.dst, iph2->src, iph2->src->sa_len);
|
||
switch (spidx.dst.ss_family) {
|
||
case AF_INET:
|
||
spidx.prefd = sizeof(struct in_addr) << 3;
|
||
break;
|
||
#ifdef INET6
|
||
case AF_INET6:
|
||
spidx.prefd = sizeof(struct in6_addr) << 3;
|
||
break;
|
||
#endif
|
||
default:
|
||
spidx.prefd = 0;
|
||
break;
|
||
}
|
||
}
|
||
|
||
/* make source address in spidx */
|
||
if (iph2->id_p != NULL
|
||
&& (_XIDT(iph2->id_p) == IPSECDOI_ID_IPV4_ADDR
|
||
|| _XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR
|
||
|| _XIDT(iph2->id_p) == IPSECDOI_ID_IPV4_ADDR_SUBNET
|
||
|| _XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR_SUBNET)) {
|
||
/* get a source address of inbound SA */
|
||
error = ipsecdoi_id2sockaddr(iph2->id_p,
|
||
(struct sockaddr *)&spidx.src,
|
||
&spidx.prefs, &spidx.ul_proto);
|
||
if (error)
|
||
return error;
|
||
|
||
#ifdef INET6
|
||
/*
|
||
* get scopeid from the SA address.
|
||
* for more detail, see above of this function.
|
||
*/
|
||
if (_XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR) {
|
||
error = setscopeid((struct sockaddr *)&spidx.src,
|
||
iph2->dst);
|
||
if (error)
|
||
return error;
|
||
}
|
||
#endif
|
||
|
||
/* make id[src,dst] if both ID types are IP address and same */
|
||
if (_XIDT(iph2->id_p) == idi2type
|
||
&& spidx.dst.ss_family == spidx.src.ss_family) {
|
||
iph2->src_id = dupsaddr((struct sockaddr *)&spidx.dst);
|
||
iph2->dst_id = dupsaddr((struct sockaddr *)&spidx.src);
|
||
}
|
||
|
||
} else {
|
||
plog(LLV_DEBUG, LOCATION, NULL,
|
||
"get a source address of SP index "
|
||
"from phase1 address "
|
||
"due to no ID payloads found "
|
||
"OR because ID type is not address.\n");
|
||
|
||
/* see above comment. */
|
||
memcpy(&spidx.src, iph2->dst, iph2->dst->sa_len);
|
||
switch (spidx.src.ss_family) {
|
||
case AF_INET:
|
||
spidx.prefs = sizeof(struct in_addr) << 3;
|
||
break;
|
||
#ifdef INET6
|
||
case AF_INET6:
|
||
spidx.prefs = sizeof(struct in6_addr) << 3;
|
||
break;
|
||
#endif
|
||
default:
|
||
spidx.prefs = 0;
|
||
break;
|
||
}
|
||
}
|
||
|
||
#undef _XIDT
|
||
|
||
plog(LLV_DEBUG, LOCATION, NULL,
|
||
"get a src address from ID payload "
|
||
"%s prefixlen=%u ul_proto=%u\n",
|
||
saddr2str((struct sockaddr *)&spidx.src),
|
||
spidx.prefs, spidx.ul_proto);
|
||
plog(LLV_DEBUG, LOCATION, NULL,
|
||
"get dst address from ID payload "
|
||
"%s prefixlen=%u ul_proto=%u\n",
|
||
saddr2str((struct sockaddr *)&spidx.dst),
|
||
spidx.prefd, spidx.ul_proto);
|
||
|
||
/*
|
||
* convert the ul_proto if it is 0
|
||
* because 0 in ID payload means a wild card.
|
||
*/
|
||
if (spidx.ul_proto == 0)
|
||
spidx.ul_proto = IPSEC_ULPROTO_ANY;
|
||
|
||
/* get inbound policy */
|
||
sp_in = getsp_r(&spidx);
|
||
if (sp_in == NULL) {
|
||
if (iph2->ph1->rmconf->gen_policy) {
|
||
plog(LLV_INFO, LOCATION, NULL,
|
||
"no policy found, "
|
||
"try to generate the policy : %s\n",
|
||
spidx2str(&spidx));
|
||
iph2->spidx_gen = racoon_malloc(sizeof(spidx));
|
||
if (!iph2->spidx_gen) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"buffer allocation failed.\n");
|
||
return ISAKMP_INTERNAL_ERROR;
|
||
}
|
||
memcpy(iph2->spidx_gen, &spidx, sizeof(spidx));
|
||
return -2; /* special value */
|
||
}
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"no policy found: %s\n", spidx2str(&spidx));
|
||
return ISAKMP_INTERNAL_ERROR;
|
||
}
|
||
|
||
/* get outbound policy */
|
||
{
|
||
struct sockaddr_storage addr;
|
||
u_int8_t pref;
|
||
|
||
spidx.dir = IPSEC_DIR_OUTBOUND;
|
||
addr = spidx.src;
|
||
spidx.src = spidx.dst;
|
||
spidx.dst = addr;
|
||
pref = spidx.prefs;
|
||
spidx.prefs = spidx.prefd;
|
||
spidx.prefd = pref;
|
||
|
||
sp_out = getsp_r(&spidx);
|
||
if (!sp_out) {
|
||
plog(LLV_WARNING, LOCATION, NULL,
|
||
"no outbound policy found: %s\n",
|
||
spidx2str(&spidx));
|
||
}
|
||
}
|
||
|
||
plog(LLV_DEBUG, LOCATION, NULL,
|
||
"suitable SP found:%s\n", spidx2str(&spidx));
|
||
|
||
/*
|
||
* In the responder side, the inbound policy should be using IPsec.
|
||
* outbound policy is not checked currently.
|
||
*/
|
||
if (sp_in->policy != IPSEC_POLICY_IPSEC) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"policy found, but no IPsec required: %s\n",
|
||
spidx2str(&spidx));
|
||
return ISAKMP_INTERNAL_ERROR;
|
||
}
|
||
|
||
/* set new proposal derived from a policy into the iph2->proposal. */
|
||
if (set_proposal_from_policy(iph2, sp_in, sp_out) < 0) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"failed to create saprop.\n");
|
||
return ISAKMP_INTERNAL_ERROR;
|
||
}
|
||
|
||
return 0;
|
||
}
|
||
|
||
#ifdef INET6
|
||
static u_int32_t
|
||
setscopeid(sp_addr0, sa_addr0)
|
||
struct sockaddr *sp_addr0, *sa_addr0;
|
||
{
|
||
struct sockaddr_in6 *sp_addr, *sa_addr;
|
||
|
||
sp_addr = (struct sockaddr_in6 *)sp_addr0;
|
||
sa_addr = (struct sockaddr_in6 *)sa_addr0;
|
||
|
||
if (!IN6_IS_ADDR_LINKLOCAL(&sp_addr->sin6_addr)
|
||
&& !IN6_IS_ADDR_SITELOCAL(&sp_addr->sin6_addr)
|
||
&& !IN6_IS_ADDR_MULTICAST(&sp_addr->sin6_addr))
|
||
return 0;
|
||
|
||
/* this check should not be here ? */
|
||
if (sa_addr->sin6_family != AF_INET6) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"can't get scope ID: family mismatch\n");
|
||
return -1;
|
||
}
|
||
|
||
if (!IN6_IS_ADDR_LINKLOCAL(&sa_addr->sin6_addr)) {
|
||
plog(LLV_ERROR, LOCATION, NULL,
|
||
"scope ID is not supported except of lladdr.\n");
|
||
return -1;
|
||
}
|
||
|
||
sp_addr->sin6_scope_id = sa_addr->sin6_scope_id;
|
||
|
||
return 0;
|
||
}
|
||
#endif
|