[apple/ipsec.git] / ipsec-tools / racoon / isakmp_newg.c

/*	$NetBSD: isakmp_newg.c,v 1.4 2006/09/09 16:22:09 manu Exp $	*/

/*	$KAME: isakmp_newg.c,v 1.10 2002/09/27 05:55:52 itojun Exp $	*/

/*
 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
 * All rights reserved.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the project nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 * 
 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#include "config.h"

#include <sys/types.h>
#include <sys/param.h>

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>

#include "var.h"
#include "misc.h"
#include "vmbuf.h"
#include "plog.h"
#include "sockmisc.h"
#include "debug.h"

#include "schedule.h"
#include "cfparse_proto.h"
#include "isakmp_var.h"
#include "isakmp.h"
#include "isakmp_newg.h"
#include "oakley.h"
#include "ipsec_doi.h"
#include "crypto_openssl.h"
#include "handler.h"
#include "pfkey.h"
#include "admin.h"
#include "str2val.h"
#include "vendorid.h"

/*
 * New group mode as responder
 */
int
isakmp_newgroup_r(iph1, msg)
	struct ph1handle *iph1;
	vchar_t *msg;
{
#if 0
	struct isakmp *isakmp = (struct isakmp *)msg->v;
	struct isakmp_pl_hash *hash = NULL;
	struct isakmp_pl_sa *sa = NULL;
	int error = -1;
	vchar_t *buf;
	struct oakley_sa *osa;
	int len;

	/* validate the type of next payload */
	/*
	 * ISAKMP_ETYPE_NEWGRP,
	 * ISAKMP_NPTYPE_HASH, (ISAKMP_NPTYPE_VID), ISAKMP_NPTYPE_SA,
	 * ISAKMP_NPTYPE_NONE
	 */
    {
	vchar_t *pbuf = NULL;
	struct isakmp_parse_t *pa;

	if ((pbuf = isakmp_parse(msg)) == NULL)
		goto end;

	for (pa = (struct isakmp_parse_t *)pbuf->v;
	     pa->type != ISAKMP_NPTYPE_NONE;
	     pa++) {

		switch (pa->type) {
		case ISAKMP_NPTYPE_HASH:
			if (hash) {
				isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL);
				plog(LLV_ERROR, LOCATION, iph1->remote,
					"received multiple payload type %d.\n",
					pa->type);
				vfree(pbuf);
				goto end;
			}
			hash = (struct isakmp_pl_hash *)pa->ptr;
			break;
		case ISAKMP_NPTYPE_SA:
			if (sa) {
				isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL);
				plog(LLV_ERROR, LOCATION, iph1->remote,
					"received multiple payload type %d.\n",
					pa->type);
				vfree(pbuf);
				goto end;
			}
			sa = (struct isakmp_pl_sa *)pa->ptr;
			break;
		case ISAKMP_NPTYPE_VID:
			(void)check_vendorid(pa->ptr);
			break;
		default:
			isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL);
			plog(LLV_ERROR, LOCATION, iph1->remote,
				"ignore the packet, "
				"received unexpecting payload type %d.\n",
				pa->type);
			vfree(pbuf);
			goto end;
		}
	}
	vfree(pbuf);

	if (!hash || !sa) {
		isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL);
		plog(LLV_ERROR, LOCATION, iph1->remote,
			"no HASH, or no SA payload.\n");
		goto end;
	}
    }

	/* validate HASH */
    {
	char *r_hash;
	vchar_t *my_hash = NULL;
	int result;

	plog(LLV_DEBUG, LOCATION, NULL, "validate HASH\n");

	len = sizeof(isakmp->msgid) + ntohs(sa->h.len);
	buf = vmalloc(len);
	if (buf == NULL) {
		plog(LLV_ERROR, LOCATION, NULL,
			"failed to get buffer to send.\n");
		goto end;
	}
	memcpy(buf->v, &isakmp->msgid, sizeof(isakmp->msgid));
	memcpy(buf->v + sizeof(isakmp->msgid), sa, ntohs(sa->h.len));

	plog(LLV_DEBUG, LOCATION, NULL, "hash source\n");
	plogdump(LLV_DEBUG, buf->v, buf->l);

	my_hash = isakmp_prf(iph1->skeyid_a, buf, iph1);
	vfree(buf);
	if (my_hash == NULL)
		goto end;

	plog(LLV_DEBUG, LOCATION, NULL, "hash result\n");
	plogdump(LLV_DEBUG, my_hash->v, my_hash->l);

	r_hash = (char *)hash + sizeof(*hash);

	plog(LLV_DEBUG, LOCATION, NULL, "original hash\n"));
	plogdump(LLV_DEBUG, r_hash, ntohs(hash->h.len) - sizeof(*hash)));

	result = memcmp(my_hash->v, r_hash, my_hash->l);
	vfree(my_hash);

	if (result) {
		plog(LLV_ERROR, LOCATION, iph1->remote,
			"HASH mismatch.\n");
		isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_HASH_INFORMATION, NULL);
		goto end;
	}
    }

	/* check SA payload and get new one for use */
	buf = ipsecdoi_get_proposal((struct ipsecdoi_sa *)sa,
					OAKLEY_NEWGROUP_MODE);
	if (buf == NULL) {
		isakmp_info_send_n1(iph1, ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED, NULL);
		goto end;
	}

	/* save sa parameters */
	osa = ipsecdoi_get_oakley(buf);
	if (osa == NULL) {
		isakmp_info_send_n1(iph1, ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED, NULL);
		goto end;
	}
	vfree(buf);

	switch (osa->dhgrp) {
	case OAKLEY_ATTR_GRP_DESC_MODP768:
	case OAKLEY_ATTR_GRP_DESC_MODP1024:
	case OAKLEY_ATTR_GRP_DESC_MODP1536:
		/*XXX*/
	default:
		isakmp_info_send_n1(iph1, ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED, NULL);
		plog(LLV_ERROR, LOCATION, NULL,
			"dh group %d isn't supported.\n", osa->dhgrp);
		goto end;
	}

	plog(LLV_INFO, LOCATION, iph1->remote,
		"got new dh group %s.\n", isakmp_pindex(&iph1->index, 0));

	error = 0;

end:
	if (error) {
		if (iph1 != NULL)
			(void)isakmp_free_ph1(iph1);
	}
	return error;
#endif
	return 0;
}
Commit	Line	Data
d1e348cf A	1	/* $NetBSD: isakmp_newg.c,v 1.4 2006/09/09 16:22:09 manu Exp $ */
d1e348cf A	2
52b7d2ce A	3	/* $KAME: isakmp_newg.c,v 1.10 2002/09/27 05:55:52 itojun Exp $ */
	4
	5	/*
	6	* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
	7	* All rights reserved.
	8	*
	9	* Redistribution and use in source and binary forms, with or without
	10	* modification, are permitted provided that the following conditions
	11	* are met:
	12	* 1. Redistributions of source code must retain the above copyright
	13	* notice, this list of conditions and the following disclaimer.
	14	* 2. Redistributions in binary form must reproduce the above copyright
	15	* notice, this list of conditions and the following disclaimer in the
	16	* documentation and/or other materials provided with the distribution.
	17	* 3. Neither the name of the project nor the names of its contributors
	18	* may be used to endorse or promote products derived from this software
	19	* without specific prior written permission.
	20	*
	21	* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
	22	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	23	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	24	* ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
	25	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	26	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	27	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	28	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	29	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	30	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	31	* SUCH DAMAGE.
	32	*/
	33
	34	#include "config.h"
	35
	36	#include <sys/types.h>
	37	#include <sys/param.h>
	38
	39	#include <stdlib.h>
	40	#include <stdio.h>
	41	#include <string.h>
	42	#include <errno.h>
	43
	44	#include "var.h"
	45	#include "misc.h"
	46	#include "vmbuf.h"
	47	#include "plog.h"
	48	#include "sockmisc.h"
	49	#include "debug.h"
	50
	51	#include "schedule.h"
	52	#include "cfparse_proto.h"
	53	#include "isakmp_var.h"
	54	#include "isakmp.h"
	55	#include "isakmp_newg.h"
	56	#include "oakley.h"
	57	#include "ipsec_doi.h"
	58	#include "crypto_openssl.h"
	59	#include "handler.h"
	60	#include "pfkey.h"
	61	#include "admin.h"
	62	#include "str2val.h"
	63	#include "vendorid.h"
	64
	65	/*
	66	* New group mode as responder
67	*/
68	int
69	isakmp_newgroup_r(iph1, msg)
70	struct ph1handle *iph1;
71	vchar_t *msg;
72	{
73	#if 0
74	struct isakmp isakmp = (struct isakmp )msg->v;
75	struct isakmp_pl_hash *hash = NULL;
76	struct isakmp_pl_sa *sa = NULL;
77	int error = -1;
78	vchar_t *buf;
79	struct oakley_sa *osa;
80	int len;
81
82	/* validate the type of next payload */
83	/*
84	* ISAKMP_ETYPE_NEWGRP,
85	* ISAKMP_NPTYPE_HASH, (ISAKMP_NPTYPE_VID), ISAKMP_NPTYPE_SA,
86	* ISAKMP_NPTYPE_NONE
87	*/
88	{
89	vchar_t *pbuf = NULL;
90	struct isakmp_parse_t *pa;
91
92	if ((pbuf = isakmp_parse(msg)) == NULL)
93	goto end;
94
95	for (pa = (struct isakmp_parse_t *)pbuf->v;
96	pa->type != ISAKMP_NPTYPE_NONE;
97	pa++) {
98
99	switch (pa->type) {
100	case ISAKMP_NPTYPE_HASH:
101	if (hash) {
102	isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL);
103	plog(LLV_ERROR, LOCATION, iph1->remote,
104	"received multiple payload type %d.\n",
105	pa->type);
106	vfree(pbuf);
107	goto end;
108	}
109	hash = (struct isakmp_pl_hash *)pa->ptr;
110	break;
111	case ISAKMP_NPTYPE_SA:
112	if (sa) {
113	isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL);
114	plog(LLV_ERROR, LOCATION, iph1->remote,
115	"received multiple payload type %d.\n",
116	pa->type);
117	vfree(pbuf);
118	goto end;
119	}
120	sa = (struct isakmp_pl_sa *)pa->ptr;
121	break;
122	case ISAKMP_NPTYPE_VID:
123	(void)check_vendorid(pa->ptr);
124	break;
125	default:
126	isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL);
127	plog(LLV_ERROR, LOCATION, iph1->remote,
128	"ignore the packet, "
129	"received unexpecting payload type %d.\n",
130	pa->type);
131	vfree(pbuf);
132	goto end;
133	}
134	}
135	vfree(pbuf);
136
137	if (!hash \|\| !sa) {
138	isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL);
139	plog(LLV_ERROR, LOCATION, iph1->remote,
140	"no HASH, or no SA payload.\n");
141	goto end;
142	}
143	}
144
145	/* validate HASH */
146	{
147	char *r_hash;
148	vchar_t *my_hash = NULL;
149	int result;
150
151	plog(LLV_DEBUG, LOCATION, NULL, "validate HASH\n");
152
153	len = sizeof(isakmp->msgid) + ntohs(sa->h.len);
154	buf = vmalloc(len);
155	if (buf == NULL) {
156	plog(LLV_ERROR, LOCATION, NULL,
157	"failed to get buffer to send.\n");
158	goto end;
159	}
160	memcpy(buf->v, &isakmp->msgid, sizeof(isakmp->msgid));
161	memcpy(buf->v + sizeof(isakmp->msgid), sa, ntohs(sa->h.len));
162
163	plog(LLV_DEBUG, LOCATION, NULL, "hash source\n");
164	plogdump(LLV_DEBUG, buf->v, buf->l);
165
166	my_hash = isakmp_prf(iph1->skeyid_a, buf, iph1);
167	vfree(buf);
168	if (my_hash == NULL)
169	goto end;
170
171	plog(LLV_DEBUG, LOCATION, NULL, "hash result\n");
172	plogdump(LLV_DEBUG, my_hash->v, my_hash->l);
173
174	r_hash = (char )hash + sizeof(hash);
175
176	plog(LLV_DEBUG, LOCATION, NULL, "original hash\n"));
177	plogdump(LLV_DEBUG, r_hash, ntohs(hash->h.len) - sizeof(*hash)));
178
179	result = memcmp(my_hash->v, r_hash, my_hash->l);
180	vfree(my_hash);
181
182	if (result) {
183	plog(LLV_ERROR, LOCATION, iph1->remote,
184	"HASH mismatch.\n");
185	isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_HASH_INFORMATION, NULL);
186	goto end;
187	}
188	}
189
190	/* check SA payload and get new one for use */
191	buf = ipsecdoi_get_proposal((struct ipsecdoi_sa *)sa,
192	OAKLEY_NEWGROUP_MODE);
193	if (buf == NULL) {
194	isakmp_info_send_n1(iph1, ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED, NULL);
195	goto end;
196	}
197
198	/* save sa parameters */
199	osa = ipsecdoi_get_oakley(buf);
200	if (osa == NULL) {
201	isakmp_info_send_n1(iph1, ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED, NULL);
202	goto end;
203	}
204	vfree(buf);
205
206	switch (osa->dhgrp) {
207	case OAKLEY_ATTR_GRP_DESC_MODP768:
208	case OAKLEY_ATTR_GRP_DESC_MODP1024:
209	case OAKLEY_ATTR_GRP_DESC_MODP1536:
210	/XXX/
211	default:
212	isakmp_info_send_n1(iph1, ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED, NULL);
213	plog(LLV_ERROR, LOCATION, NULL,
214	"dh group %d isn't supported.\n", osa->dhgrp);
215	goto end;
216	}
217
218	plog(LLV_INFO, LOCATION, iph1->remote,
219	"got new dh group %s.\n", isakmp_pindex(&iph1->index, 0));
220
221	error = 0;
222
223	end:
224	if (error) {
225	if (iph1 != NULL)
226	(void)isakmp_free_ph1(iph1);
227	}
228	return error;
229	#endif
230	return 0;
231	}
232