]> git.saurik.com Git - apple/ipsec.git/blob - ipsec-tools/racoon/isakmp_inf.c
projects / apple / ipsec.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
ipsec-92.4.tar.gz
[apple/ipsec.git] / ipsec-tools / racoon / isakmp_inf.c
1 /* $NetBSD: isakmp_inf.c,v 1.14.4.8 2007/08/01 11:52:20 vanhu Exp $ */
2
3 /* Id: isakmp_inf.c,v 1.44 2006/05/06 20:45:52 manubsd Exp */
4
5 /*
6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the project nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34 #include "config.h"
35
36 #include <sys/types.h>
37 #include <sys/param.h>
38 #include <sys/socket.h>
39
40 #ifdef __APPLE__
41 #include <System/net/pfkeyv2.h>
42 #else
43 #include <net/pfkeyv2.h>
44 #endif
45 #include <netinet/in.h>
46 #include <sys/queue.h>
47 #ifndef HAVE_NETINET6_IPSEC
48 #include <netinet/ipsec.h>
49 #else
50 #include <netinet6/ipsec.h>
51 #endif
52
53 #include <stdlib.h>
54 #include <stdio.h>
55 #include <string.h>
56 #include <errno.h>
57 #if TIME_WITH_SYS_TIME
58 # include <sys/time.h>
59 # include <time.h>
60 #else
61 # if HAVE_SYS_TIME_H
62 # include <sys/time.h>
63 # else
64 # include <time.h>
65 # endif
66 #endif
67 #ifdef ENABLE_HYBRID
68 #include <resolv.h>
69 #endif
70
71 #include "libpfkey.h"
72
73 #include "var.h"
74 #include "vmbuf.h"
75 #include "schedule.h"
76 #include "str2val.h"
77 #include "misc.h"
78 #include "plog.h"
79 #include "debug.h"
80
81 #include "localconf.h"
82 #include "remoteconf.h"
83 #include "sockmisc.h"
84 #include "handler.h"
85 #include "policy.h"
86 #include "proposal.h"
87 #include "isakmp_var.h"
88 #include "evt.h"
89 #include "isakmp.h"
90 #ifdef ENABLE_HYBRID
91 #include "isakmp_xauth.h"
92 #include "isakmp_unity.h"
93 #include "isakmp_cfg.h"
94 #endif
95 #include "isakmp_inf.h"
96 #include "oakley.h"
97 #include "ipsec_doi.h"
98 #include "crypto_openssl.h"
99 #include "pfkey.h"
100 #include "policy.h"
101 #include "algorithm.h"
102 #include "proposal.h"
103 #include "admin.h"
104 #include "strnames.h"
105 #ifdef ENABLE_NATT
106 #include "nattraversal.h"
107 #endif
108 #include "vpn_control_var.h"
109 #include "vpn_control.h"
110 #include "ike_session.h"
111 #include "ipsecSessionTracer.h"
112 #include "ipsecMessageTracer.h"
113
114 /* information exchange */
115 static int isakmp_info_recv_n (struct ph1handle *, struct isakmp_pl_n *, u_int32_t, int);
116 static int isakmp_info_recv_d (struct ph1handle *, struct isakmp_pl_d *, u_int32_t, int);
117
118 #ifdef ENABLE_DPD
119 static int isakmp_info_recv_r_u __P((struct ph1handle *,
120 struct isakmp_pl_ru *, u_int32_t));
121 static int isakmp_info_recv_r_u_ack __P((struct ph1handle *,
122 struct isakmp_pl_ru *, u_int32_t));
123 #endif
124
125 #ifdef ENABLE_VPNCONTROL_PORT
126 static int isakmp_info_recv_lb __P((struct ph1handle *, struct isakmp_pl_lb *lb, int));
127 #endif
128
129 static void purge_isakmp_spi __P((int, isakmp_index *, size_t));
130 static void info_recv_initialcontact __P((struct ph1handle *));
131
132 static int
133 isakmp_ph1_responder_lifetime (struct ph1handle *iph1,
134 struct isakmp_pl_resp_lifetime *notify)
135 {
136 char *spi;
137
138 if (ntohs(notify->h.len) < sizeof(*notify) + notify->spi_size) {
139 plog(LLV_ERROR, LOCATION, iph1->remote,
140 "invalid spi_size in notification payload.\n");
141 return -1;
142 }
143 spi = val2str((char *)(notify + 1), notify->spi_size);
144
145 plog(LLV_DEBUG, LOCATION, iph1->remote,
146 "notification message ISAKMP-SA RESPONDER-LIFETIME, "
147 "doi=%d proto_id=%d spi=%s(size=%d).\n",
148 ntohl(notify->doi), notify->proto_id, spi, notify->spi_size);
149
150 /* TODO */
151 #if 0
152 struct isakmp_pl_attr *attrpl;
153 int len = ntohs(notify->h.len) - (sizeof(*notify) + notify->spi_size);
154
155 attrpl = (struct isakmp_pl_attr *)((char *)(notify + 1) + notify->spi_size);
156 while (len > 0) {
157 }
158 #endif
159
160 racoon_free(spi);
161 return 0;
162 }
163
164 static int
165 isakmp_ph2_responder_lifetime (struct ph2handle *iph2,
166 struct isakmp_pl_resp_lifetime *notify)
167 {
168 char *spi;
169
170 if (ntohs(notify->h.len) < sizeof(*notify) + notify->spi_size) {
171 plog(LLV_ERROR, LOCATION, iph2->dst,
172 "invalid spi_size in notification payload.\n");
173 return -1;
174 }
175 spi = val2str((char *)(notify + 1), notify->spi_size);
176
177 plog(LLV_DEBUG, LOCATION, iph2->dst,
178 "notification message IPSEC-SA RESPONDER-LIFETIME, "
179 "doi=%d proto_id=%d spi=%s(size=%d).\n",
180 ntohl(notify->doi), notify->proto_id, spi, notify->spi_size);
181
182 /* TODO */
183
184 racoon_free(spi);
185 return 0;
186 }
187
188 /* \f%%%
189 * Information Exchange
190 */
191 /*
192 * receive Information
193 */
194 int
195 isakmp_info_recv(iph1, msg0)
196 struct ph1handle *iph1;
197 vchar_t *msg0;
198 {
199 vchar_t *msg = NULL;
200 vchar_t *pbuf = NULL;
201 u_int32_t msgid = 0;
202 int error = -1;
203 struct isakmp *isakmp;
204 struct isakmp_gen *gen;
205 struct isakmp_parse_t *pa, *pap;
206 void *p;
207 vchar_t *hash, *payload;
208 struct isakmp_gen *nd;
209 u_int8_t np;
210 int encrypted;
211 int flag;
212
213 plog(LLV_DEBUG, LOCATION, NULL, "receive Information.\n");
214
215 encrypted = ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E);
216 msgid = ((struct isakmp *)msg0->v)->msgid;
217
218 /* Use new IV to decrypt Informational message. */
219 if (encrypted) {
220 struct isakmp_ivm *ivm;
221
222 if (iph1->ivm == NULL) {
223 plog(LLV_ERROR, LOCATION, NULL, "iph1->ivm == NULL\n");
224 IPSECSESSIONTRACEREVENT(iph1->parent_session,
225 IPSECSESSIONEVENTCODE_IKE_PACKET_RX_FAIL,
226 CONSTSTR("Information message"),
227 CONSTSTR("Failed to process Information Message (no IV)"));
228 return -1;
229 }
230
231 /* compute IV */
232 ivm = oakley_newiv2(iph1, ((struct isakmp *)msg0->v)->msgid);
233 if (ivm == NULL) {
234 plog(LLV_ERROR, LOCATION, NULL,
235 "failed to compute IV");
236 IPSECSESSIONTRACEREVENT(iph1->parent_session,
237 IPSECSESSIONEVENTCODE_IKE_PACKET_RX_FAIL,
238 CONSTSTR("Information message"),
239 CONSTSTR("Failed to process Information Message (can't compute IV)"));
240 return -1;
241 }
242
243 msg = oakley_do_decrypt(iph1, msg0, ivm->iv, ivm->ive);
244 oakley_delivm(ivm);
245 if (msg == NULL) {
246 plog(LLV_ERROR, LOCATION, NULL,
247 "failed to decrypt packet");
248 IPSECSESSIONTRACEREVENT(iph1->parent_session,
249 IPSECSESSIONEVENTCODE_IKE_PACKET_RX_FAIL,
250 CONSTSTR("Information message"),
251 CONSTSTR("Failed to decrypt Information message"));
252 return -1;
253 }
254
255 } else
256 msg = vdup(msg0);
257
258 /* Safety check */
259 if (msg->l < sizeof(*isakmp) + sizeof(*gen)) {
260 plog(LLV_ERROR, LOCATION, NULL,
261 "ignore information because the "
262 "message is way too short\n");
263 goto end;
264 }
265
266 isakmp = (struct isakmp *)msg->v;
267 gen = (struct isakmp_gen *)((caddr_t)isakmp + sizeof(struct isakmp));
268 np = gen->np;
269
270 if (encrypted) {
271 if (isakmp->np != ISAKMP_NPTYPE_HASH) {
272 plog(LLV_ERROR, LOCATION, NULL,
273 "ignore information because the "
274 "message has no hash payload.\n");
275 goto end;
276 }
277
278 if (iph1->status != PHASE1ST_ESTABLISHED &&
279 (!iph1->approval || !iph1->skeyid_a)) {
280 plog(LLV_ERROR, LOCATION, NULL,
281 "ignore information because ISAKMP-SA "
282 "has not been established yet.\n");
283 goto end;
284 }
285
286 /* Safety check */
287 if (msg->l < sizeof(*isakmp) + ntohs(gen->len) + sizeof(*nd)) {
288 plog(LLV_ERROR, LOCATION, NULL,
289 "ignore information because the "
290 "message is too short\n");
291 goto end;
292 }
293
294 p = (caddr_t) gen + sizeof(struct isakmp_gen);
295 nd = (struct isakmp_gen *) ((caddr_t) gen + ntohs(gen->len));
296
297 /* nd length check */
298 if (ntohs(nd->len) > msg->l - (sizeof(struct isakmp) +
299 ntohs(gen->len))) {
300 plog(LLV_ERROR, LOCATION, NULL,
301 "too long payload length (broken message?)\n");
302 goto end;
303 }
304
305 if (ntohs(nd->len) < sizeof(*nd)) {
306 plog(LLV_ERROR, LOCATION, NULL,
307 "too short payload length (broken message?)\n");
308 goto end;
309 }
310
311 payload = vmalloc(ntohs(nd->len));
312 if (payload == NULL) {
313 plog(LLV_ERROR, LOCATION, NULL,
314 "cannot allocate memory\n");
315 goto end;
316 }
317
318 memcpy(payload->v, (caddr_t) nd, ntohs(nd->len));
319
320 /* compute HASH */
321 hash = oakley_compute_hash1(iph1, isakmp->msgid, payload);
322 if (hash == NULL) {
323 plog(LLV_ERROR, LOCATION, NULL,
324 "cannot compute hash\n");
325
326 vfree(payload);
327 goto end;
328 }
329
330 if (ntohs(gen->len) - sizeof(struct isakmp_gen) != hash->l) {
331 plog(LLV_ERROR, LOCATION, NULL,
332 "ignore information due to hash length mismatch\n");
333
334 vfree(hash);
335 vfree(payload);
336 goto end;
337 }
338
339 if (memcmp(p, hash->v, hash->l) != 0) {
340 plog(LLV_ERROR, LOCATION, NULL,
341 "ignore information due to hash mismatch\n");
342
343 vfree(hash);
344 vfree(payload);
345 goto end;
346 }
347
348 plog(LLV_DEBUG, LOCATION, NULL, "hash validated.\n");
349
350 vfree(hash);
351 vfree(payload);
352 } else {
353 /* make sure the packet was encrypted after the beginning of phase 1. */
354 switch (iph1->etype) {
355 case ISAKMP_ETYPE_AGG:
356 case ISAKMP_ETYPE_BASE:
357 case ISAKMP_ETYPE_IDENT:
358 if ((iph1->side == INITIATOR && iph1->status < PHASE1ST_MSG3SENT)
359 || (iph1->side == RESPONDER && iph1->status < PHASE1ST_MSG2SENT)) {
360 break;
361 }
362 /*FALLTHRU*/
363 default:
364 plog(LLV_ERROR, LOCATION, iph1->remote,
365 "%s message must be encrypted\n",
366 s_isakmp_nptype(np));
367 error = 0;
368 goto end;
369 }
370 }
371
372 if (!(pbuf = isakmp_parse(msg))) {
373 plog(LLV_ERROR, LOCATION, NULL,
374 "failed to parse msg");
375 error = -1;
376 goto end;
377 }
378
379 error = 0;
380 for (pa = (struct isakmp_parse_t *)pbuf->v; pa->type; pa++) {
381 switch (pa->type) {
382 case ISAKMP_NPTYPE_HASH:
383 /* Handled above */
384 break;
385 case ISAKMP_NPTYPE_N:
386 error = isakmp_info_recv_n(iph1,
387 (struct isakmp_pl_n *)pa->ptr,
388 msgid, encrypted);
389 break;
390 case ISAKMP_NPTYPE_D:
391 error = isakmp_info_recv_d(iph1,
392 (struct isakmp_pl_d *)pa->ptr,
393 msgid, encrypted);
394 break;
395 case ISAKMP_NPTYPE_NONCE:
396 /* XXX to be 6.4.2 ike-01.txt */
397 /* XXX IV is to be synchronized. */
398 plog(LLV_ERROR, LOCATION, iph1->remote,
399 "ignore Acknowledged Informational\n");
400 break;
401 default:
402 /* don't send information, see isakmp_ident_r1() */
403 error = 0;
404 plog(LLV_ERROR, LOCATION, iph1->remote,
405 "reject the packet, "
406 "received unexpected payload type %s.\n",
407 s_isakmp_nptype(gen->np));
408 }
409 if(error < 0) {
410 break;
411 } else {
412 flag |= error;
413 }
414 }
415 IPSECSESSIONTRACEREVENT(iph1->parent_session,
416 IPSECSESSIONEVENTCODE_IKE_PACKET_RX_SUCC,
417 CONSTSTR("Information message"),
418 CONSTSTR(NULL));
419
420 end:
421 if (error) {
422 IPSECSESSIONTRACEREVENT(iph1->parent_session,
423 IPSECSESSIONEVENTCODE_IKE_PACKET_RX_FAIL,
424 CONSTSTR("Information message"),
425 CONSTSTR("Failed to process Information Message"));
426 }
427 if (msg != NULL)
428 vfree(msg);
429 if (pbuf != NULL)
430 vfree(pbuf);
431 return error;
432 }
433
434 /*
435 * handling of Notification payload
436 */
437 static int
438 isakmp_info_recv_n(iph1, notify, msgid, encrypted)
439 struct ph1handle *iph1;
440 struct isakmp_pl_n *notify;
441 u_int32_t msgid;
442 int encrypted;
443 {
444 u_int type;
445 vchar_t *pbuf;
446 vchar_t *ndata;
447 char *nraw;
448 size_t l;
449 char *spi;
450
451 type = ntohs(notify->type);
452
453 switch (type) {
454 case ISAKMP_NTYPE_CONNECTED:
455 case ISAKMP_NTYPE_REPLAY_STATUS:
456 #ifdef ENABLE_HYBRID
457 case ISAKMP_NTYPE_UNITY_HEARTBEAT:
458 #endif
459 /* do something */
460 break;
461 case ISAKMP_NTYPE_RESPONDER_LIFETIME:
462 if (encrypted) {
463 return(isakmp_ph1_responder_lifetime(iph1,
464 (struct isakmp_pl_resp_lifetime *)notify));
465 }
466 break;
467 case ISAKMP_NTYPE_INITIAL_CONTACT:
468 if (encrypted)
469 info_recv_initialcontact(iph1);
470 return 0;
471 break;
472 #ifdef ENABLE_DPD
473 case ISAKMP_NTYPE_R_U_THERE:
474 if (encrypted)
475 return isakmp_info_recv_r_u(iph1,
476 (struct isakmp_pl_ru *)notify, msgid);
477 break;
478 case ISAKMP_NTYPE_R_U_THERE_ACK:
479 if (encrypted)
480 return isakmp_info_recv_r_u_ack(iph1,
481 (struct isakmp_pl_ru *)notify, msgid);
482 break;
483 #endif
484 #ifdef ENABLE_VPNCONTROL_PORT
485 case ISAKMP_NTYPE_LOAD_BALANCE:
486 isakmp_info_recv_lb(iph1, (struct isakmp_pl_lb *)notify, encrypted);
487 break;
488 #endif
489
490 default:
491 {
492 /* XXX there is a potential of dos attack. */
493 if(type >= ISAKMP_NTYPE_MINERROR &&
494 type <= ISAKMP_NTYPE_MAXERROR) {
495 if (msgid == 0) {
496 /* don't think this realy deletes ph1 ? */
497 plog(LLV_ERROR, LOCATION, iph1->remote,
498 "delete phase1 handle.\n");
499 return -1;
500 } else {
501 if (getph2bymsgid(iph1, msgid) == NULL) {
502 plog(LLV_ERROR, LOCATION, iph1->remote,
503 "fatal %s notify messsage, "
504 "phase1 should be deleted.\n",
505 s_isakmp_notify_msg(type));
506 } else {
507 plog(LLV_ERROR, LOCATION, iph1->remote,
508 "fatal %s notify messsage, "
509 "phase2 should be deleted.\n",
510 s_isakmp_notify_msg(type));
511 }
512 }
513 } else {
514 plog(LLV_ERROR, LOCATION, iph1->remote,
515 "unhandled notify message %s, "
516 "no phase2 handle found.\n",
517 s_isakmp_notify_msg(type));
518 }
519 }
520 break;
521 }
522
523 /* get spi if specified and allocate */
524 if(notify->spi_size > 0) {
525 if (ntohs(notify->h.len) < sizeof(*notify) + notify->spi_size) {
526 plog(LLV_ERROR, LOCATION, iph1->remote,
527 "invalid spi_size in notification payload.\n");
528 return -1;
529 }
530 spi = val2str((char *)(notify + 1), notify->spi_size);
531
532 plog(LLV_DEBUG, LOCATION, iph1->remote,
533 "notification message %d:%s, "
534 "doi=%d proto_id=%d spi=%s(size=%d).\n",
535 type, s_isakmp_notify_msg(type),
536 ntohl(notify->doi), notify->proto_id, spi, notify->spi_size);
537
538 racoon_free(spi);
539 }
540
541 /* Send the message data to the logs */
542 if(type >= ISAKMP_NTYPE_MINERROR &&
543 type <= ISAKMP_NTYPE_MAXERROR) {
544 l = ntohs(notify->h.len) - sizeof(*notify) - notify->spi_size;
545 if (l > 0) {
546 nraw = (char*)notify;
547 nraw += sizeof(*notify) + notify->spi_size;
548 if ((ndata = vmalloc(l)) != NULL) {
549 memcpy(ndata->v, nraw, ndata->l);
550 plog(LLV_ERROR, LOCATION, iph1->remote,
551 "Message: '%s'.\n",
552 binsanitize(ndata->v, ndata->l));
553 vfree(ndata);
554 } else {
555 plog(LLV_ERROR, LOCATION, iph1->remote,
556 "Cannot allocate memory\n");
557 }
558 }
559 }
560 return 0;
561 }
562
563 /*
564 * handling of Deletion payload
565 */
566 static int
567 isakmp_info_recv_d(iph1, delete, msgid, encrypted)
568 struct ph1handle *iph1;
569 struct isakmp_pl_d *delete;
570 u_int32_t msgid;
571 int encrypted;
572 {
573 int tlen, num_spi;
574 vchar_t *pbuf;
575 int protected = 0;
576 struct ph1handle *del_ph1;
577 struct ph2handle *iph2;
578 union {
579 u_int32_t spi32;
580 u_int16_t spi16[2];
581 } spi;
582
583 if (ntohl(delete->doi) != IPSEC_DOI) {
584 plog(LLV_ERROR, LOCATION, iph1->remote,
585 "delete payload with invalid doi:%d.\n",
586 ntohl(delete->doi));
587 #ifdef ENABLE_HYBRID
588 /*
589 * At deconnexion time, Cisco VPN client does this
590 * with a zero DOI. Don't give up in that situation.
591 */
592 if (((iph1->mode_cfg->flags &
593 ISAKMP_CFG_VENDORID_UNITY) == 0) || (delete->doi != 0))
594 return 0;
595 #else
596 return 0;
597 #endif
598 }
599
600 num_spi = ntohs(delete->num_spi);
601 tlen = ntohs(delete->h.len) - sizeof(struct isakmp_pl_d);
602
603 if (tlen != num_spi * delete->spi_size) {
604 plog(LLV_ERROR, LOCATION, iph1->remote,
605 "deletion payload with invalid length.\n");
606 return 0;
607 }
608
609 plog(LLV_DEBUG, LOCATION, iph1->remote,
610 "delete payload for protocol %s\n",
611 s_ipsecdoi_proto(delete->proto_id));
612
613 if(!iph1->rmconf->weak_phase1_check && !encrypted) {
614 plog(LLV_WARNING, LOCATION, iph1->remote,
615 "Ignoring unencrypted delete payload "
616 "(check the weak_phase1_check option)\n");
617 return 0;
618 }
619
620 switch (delete->proto_id) {
621 case IPSECDOI_PROTO_ISAKMP:
622 if (delete->spi_size != sizeof(isakmp_index)) {
623 plog(LLV_ERROR, LOCATION, iph1->remote,
624 "delete payload with strange spi "
625 "size %d(proto_id:%d)\n",
626 delete->spi_size, delete->proto_id);
627 return 0;
628 }
629
630 del_ph1=getph1byindex((isakmp_index *)(delete + 1));
631 if(del_ph1 != NULL){
632
633 // hack: start a rekey now, if one was pending (only for client).
634 if (del_ph1->sce_rekey &&
635 del_ph1->parent_session &&
636 del_ph1->parent_session->is_client &&
637 del_ph1->parent_session->established) {
638 isakmp_ph1rekeyexpire(del_ph1);
639 }
640
641 EVT_PUSH(del_ph1->local, del_ph1->remote,
642 EVTT_PEERPH1_NOPROP, NULL);
643 if (del_ph1->scr)
644 SCHED_KILL(del_ph1->scr);
645
646 /*
647 * Do not delete IPsec SAs when receiving an IKE delete notification.
648 * Just delete the IKE SA.
649 */
650 #ifdef ENABLE_VPNCONTROL_PORT
651
652 if (del_ph1->started_by_api)
653 if (islast_ph1(del_ph1)) {
654 u_int32_t address;
655
656 /* notify the API that we have received the delete */
657 if (iph1->remote->sa_family == AF_INET)
658 address = ((struct sockaddr_in *)(iph1->remote))->sin_addr.s_addr;
659 else
660 address = 0;
661 vpncontrol_notify_ike_failed(VPNCTL_NTYPE_PH1_DELETE, FROM_REMOTE, address, 0, NULL);
662 }
663 #endif
664 isakmp_ph1expire(del_ph1);
665 }
666 break;
667
668 case IPSECDOI_PROTO_IPSEC_AH:
669 case IPSECDOI_PROTO_IPSEC_ESP:
670 if (delete->spi_size != sizeof(u_int32_t)) {
671 plog(LLV_ERROR, LOCATION, iph1->remote,
672 "delete payload with strange spi "
673 "size %d(proto_id:%d)\n",
674 delete->spi_size, delete->proto_id);
675 return 0;
676 }
677 EVT_PUSH(iph1->local, iph1->remote,
678 EVTT_PEER_DELETE, NULL);
679 purge_ipsec_spi(iph1->remote, delete->proto_id,
680 (u_int32_t *)(delete + 1), num_spi);
681 break;
682
683 case IPSECDOI_PROTO_IPCOMP:
684 /* need to handle both 16bit/32bit SPI */
685 memset(&spi, 0, sizeof(spi));
686 if (delete->spi_size == sizeof(spi.spi16[1])) {
687 memcpy(&spi.spi16[1], delete + 1,
688 sizeof(spi.spi16[1]));
689 } else if (delete->spi_size == sizeof(spi.spi32))
690 memcpy(&spi.spi32, delete + 1, sizeof(spi.spi32));
691 else {
692 plog(LLV_ERROR, LOCATION, iph1->remote,
693 "delete payload with strange spi "
694 "size %d(proto_id:%d)\n",
695 delete->spi_size, delete->proto_id);
696 return 0;
697 }
698 purge_ipsec_spi(iph1->remote, delete->proto_id,
699 &spi.spi32, num_spi);
700 break;
701
702 default:
703 plog(LLV_ERROR, LOCATION, iph1->remote,
704 "deletion message received, "
705 "invalid proto_id: %d\n",
706 delete->proto_id);
707 return 0;
708 }
709
710 plog(LLV_DEBUG, LOCATION, NULL, "purged SAs.\n");
711
712 return 0;
713 }
714
715 /*
716 * send Delete payload (for ISAKMP SA) in Informational exchange.
717 */
718 int
719 isakmp_info_send_d1(iph1)
720 struct ph1handle *iph1;
721 {
722 struct isakmp_pl_d *d;
723 vchar_t *payload = NULL;
724 int tlen;
725 int error = 0;
726
727 if (iph1->status != PHASE2ST_ESTABLISHED)
728 return 0;
729
730 /* create delete payload */
731
732 /* send SPIs of inbound SAs. */
733 /* XXX should send outbound SAs's ? */
734 tlen = sizeof(*d) + sizeof(isakmp_index);
735 payload = vmalloc(tlen);
736 if (payload == NULL) {
737 plog(LLV_ERROR, LOCATION, NULL,
738 "failed to get buffer for payload.\n");
739 return errno;
740 }
741
742 d = (struct isakmp_pl_d *)payload->v;
743 d->h.np = ISAKMP_NPTYPE_NONE;
744 d->h.len = htons(tlen);
745 d->doi = htonl(IPSEC_DOI);
746 d->proto_id = IPSECDOI_PROTO_ISAKMP;
747 d->spi_size = sizeof(isakmp_index);
748 d->num_spi = htons(1);
749 memcpy(d + 1, &iph1->index, sizeof(isakmp_index));
750
751 error = isakmp_info_send_common(iph1, payload,
752 ISAKMP_NPTYPE_D, 0);
753 vfree(payload);
754 if (error) {
755 IPSECSESSIONTRACEREVENT(iph1->parent_session,
756 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_FAIL,
757 CONSTSTR("Delete ISAKMP-SA"),
758 CONSTSTR("Failed to transmit Delete-ISAKMP-SA message"));
759 } else {
760 IPSECSESSIONTRACEREVENT(iph1->parent_session,
761 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_SUCC,
762 CONSTSTR("Delete ISAKMP-SA"),
763 CONSTSTR(NULL));
764 }
765
766 return error;
767 }
768
769 /*
770 * send Delete payload (for IPsec SA) in Informational exchange, based on
771 * pfkey msg. It sends always single SPI.
772 */
773 int
774 isakmp_info_send_d2(iph2)
775 struct ph2handle *iph2;
776 {
777 struct ph1handle *iph1;
778 struct saproto *pr;
779 struct isakmp_pl_d *d;
780 vchar_t *payload = NULL;
781 int tlen;
782 int error = 0;
783 u_int8_t *spi;
784
785 if (iph2->status != PHASE2ST_ESTABLISHED)
786 return 0;
787
788 /*
789 * don't send delete information if there is no phase 1 handler.
790 * It's nonsensical to negotiate phase 1 to send the information.
791 */
792 iph1 = ike_session_get_established_ph1(iph2->parent_session);
793 if (!iph1) {
794 iph1 = getph1byaddr(iph2->src, iph2->dst);
795 }
796 if (iph1 == NULL){
797 IPSECSESSIONTRACEREVENT(iph2->parent_session,
798 IPSECSESSIONEVENTCODE_IKE_PACKET_TX_FAIL,
799 CONSTSTR("Information message"),
800 CONSTSTR("Failed to transmit Information message"));
801 IPSECSESSIONTRACEREVENT(iph2->parent_session,
802 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_FAIL,
803 CONSTSTR("Delete IPSEC-SA"),
804 CONSTSTR("Failed to transmit Delete-IPSEC-SA message"));
805 plog(LLV_DEBUG2, LOCATION, NULL,
806 "No ph1 handler found, could not send DELETE_SA\n");
807 return 0;
808 }
809
810 /* create delete payload */
811 for (pr = iph2->approval->head; pr != NULL; pr = pr->next) {
812
813 /* send SPIs of inbound SAs. */
814 /*
815 * XXX should I send outbound SAs's ?
816 * I send inbound SAs's SPI only at the moment because I can't
817 * decode any more if peer send encoded packet without aware of
818 * deletion of SA. Outbound SAs don't come under the situation.
819 */
820 tlen = sizeof(*d) + pr->spisize;
821 payload = vmalloc(tlen);
822 if (payload == NULL) {
823 IPSECSESSIONTRACEREVENT(iph2->parent_session,
824 IPSECSESSIONEVENTCODE_IKE_PACKET_TX_FAIL,
825 CONSTSTR("Information message"),
826 CONSTSTR("Failed to transmit Information message"));
827 IPSECSESSIONTRACEREVENT(iph2->parent_session,
828 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_FAIL,
829 CONSTSTR("Delete IPSEC-SA"),
830 CONSTSTR("Failed to transmit Delete-IPSEC-SA message"));
831 plog(LLV_ERROR, LOCATION, NULL,
832 "failed to get buffer for payload.\n");
833 return errno;
834 }
835
836 d = (struct isakmp_pl_d *)payload->v;
837 d->h.np = ISAKMP_NPTYPE_NONE;
838 d->h.len = htons(tlen);
839 d->doi = htonl(IPSEC_DOI);
840 d->proto_id = pr->proto_id;
841 d->spi_size = pr->spisize;
842 d->num_spi = htons(1);
843 /*
844 * XXX SPI bits are left-filled, for use with IPComp.
845 * we should be switching to variable-length spi field...
846 */
847 spi = (u_int8_t *)&pr->spi;
848 spi += sizeof(pr->spi);
849 spi -= pr->spisize;
850 memcpy(d + 1, spi, pr->spisize);
851
852 error = isakmp_info_send_common(iph1, payload,
853 ISAKMP_NPTYPE_D, 0);
854 vfree(payload);
855 if (error) {
856 IPSECSESSIONTRACEREVENT(iph2->parent_session,
857 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_FAIL,
858 CONSTSTR("Delete IPSEC-SA"),
859 CONSTSTR("Failed to transmit Delete-IPSEC-SA"));
860 } else {
861 IPSECSESSIONTRACEREVENT(iph2->parent_session,
862 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_SUCC,
863 CONSTSTR("Delete IPSEC-SA"),
864 CONSTSTR(NULL));
865 }
866 }
867
868 return error;
869 }
870
871 /*
872 * send Notification payload (for without ISAKMP SA) in Informational exchange
873 */
874 int
875 isakmp_info_send_nx(isakmp, remote, local, type, data)
876 struct isakmp *isakmp;
877 struct sockaddr *remote, *local;
878 int type;
879 vchar_t *data;
880 {
881 struct ph1handle *iph1 = NULL;
882 struct remoteconf *rmconf;
883 vchar_t *payload = NULL;
884 int tlen;
885 int error = -1;
886 struct isakmp_pl_n *n;
887 int spisiz = 0; /* see below */
888 ike_session_t *sess = ike_session_get_session(local, remote, FALSE);
889
890 /* search appropreate configuration */
891 rmconf = getrmconf(remote);
892 if (rmconf == NULL) {
893 IPSECSESSIONTRACEREVENT(sess,
894 IPSECSESSIONEVENTCODE_IKE_PACKET_TX_FAIL,
895 CONSTSTR("Information message"),
896 CONSTSTR("Failed to transmit Information message (no remote configuration)"));
897 plog(LLV_ERROR, LOCATION, remote,
898 "no configuration found for peer address.\n");
899 goto end;
900 }
901
902 /* add new entry to isakmp status table. */
903 iph1 = newph1();
904 if (iph1 == NULL) {
905 IPSECSESSIONTRACEREVENT(sess,
906 IPSECSESSIONEVENTCODE_IKE_PACKET_TX_FAIL,
907 CONSTSTR("Information message"),
908 CONSTSTR("Failed to transmit Information message (no new phase1)"));
909 plog(LLV_ERROR, LOCATION, NULL,
910 "failed to allocate ph1");
911 return -1;
912 }
913
914 memcpy(&iph1->index.i_ck, &isakmp->i_ck, sizeof(cookie_t));
915 isakmp_newcookie((char *)&iph1->index.r_ck, remote, local);
916 iph1->status = PHASE1ST_START;
917 iph1->rmconf = rmconf;
918 #ifdef __APPLE__
919 if (link_rmconf_to_ph1(rmconf) < 0) {
920 IPSECSESSIONTRACEREVENT(sess,
921 IPSECSESSIONEVENTCODE_IKE_PACKET_TX_FAIL,
922 CONSTSTR("Information message"),
923 CONSTSTR("Failed to transmit Information message (can't link remote configuration to phase1)"));
924 plog(LLV_ERROR, LOCATION, remote,
925 "couldn't link "
926 "configuration.\n");
927 iph1->rmconf = NULL;
928 error = -1;
929 goto end;
930 }
931 #endif
932 iph1->side = INITIATOR;
933 iph1->version = isakmp->v;
934 iph1->flags = 0;
935 iph1->msgid = 0; /* XXX */
936 #ifdef ENABLE_HYBRID
937 if ((iph1->mode_cfg = isakmp_cfg_mkstate()) == NULL) {
938 error = -1;
939 goto end;
940 }
941 #endif
942 #ifdef ENABLE_FRAG
943 iph1->frag = 0;
944 iph1->frag_chain = NULL;
945 #endif
946
947 /* copy remote address */
948 if (copy_ph1addresses(iph1, rmconf, remote, local) < 0) {
949 IPSECSESSIONTRACEREVENT(sess,
950 IPSECSESSIONEVENTCODE_IKE_PACKET_TX_FAIL,
951 CONSTSTR("Information message"),
952 CONSTSTR("Failed to transmit Information Message (can't copy phase1 addresses)"));
953 plog(LLV_ERROR, LOCATION, NULL,
954 "failed to copy ph1 addresses");
955 error = -1;
956 iph1 = NULL; /* deleted in copy_ph1addresses */
957 goto end;
958 }
959
960 tlen = sizeof(*n) + spisiz;
961 if (data)
962 tlen += data->l;
963 payload = vmalloc(tlen);
964 if (payload == NULL) {
965 IPSECSESSIONTRACEREVENT(sess,
966 IPSECSESSIONEVENTCODE_IKE_PACKET_TX_FAIL,
967 CONSTSTR("Information message"),
968 CONSTSTR("Failed to transmit Information Message (can't allocate payload)"));
969 plog(LLV_ERROR, LOCATION, NULL,
970 "failed to get buffer to send.\n");
971 error = -1;
972 goto end;
973 }
974
975 n = (struct isakmp_pl_n *)payload->v;
976 n->h.np = ISAKMP_NPTYPE_NONE;
977 n->h.len = htons(tlen);
978 n->doi = htonl(IPSEC_DOI);
979 n->proto_id = IPSECDOI_KEY_IKE;
980 n->spi_size = spisiz;
981 n->type = htons(type);
982 if (spisiz)
983 memset(n + 1, 0, spisiz); /* XXX spisiz is always 0 */
984 if (data)
985 memcpy((caddr_t)(n + 1) + spisiz, data->v, data->l);
986
987 #ifdef ENABLE_VPNCONTROL_PORT
988 {
989 u_int32_t address;
990 if (type == ISAKMP_INTERNAL_ERROR ||
991 type <= ISAKMP_NTYPE_UNEQUAL_PAYLOAD_LENGTHS) {
992 if (remote->sa_family == AF_INET)
993 address = ((struct sockaddr_in *)remote)->sin_addr.s_addr;
994 else
995 address = 0;
996 (void)vpncontrol_notify_ike_failed(type, FROM_LOCAL, address,
997 (data ? data->l : 0), (data ? data->v : NULL));
998 }
999 }
1000 #endif
1001
1002 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 0);
1003 vfree(payload);
1004 if (error) {
1005 IPSECSESSIONTRACEREVENT(sess,
1006 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_FAIL,
1007 CONSTSTR("Without ISAKMP-SA"),
1008 CONSTSTR("Failed to transmit Without-ISAKMP-SA message"));
1009 } else {
1010 IPSECSESSIONTRACEREVENT(sess,
1011 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_SUCC,
1012 CONSTSTR("Without ISAKMP-SA"),
1013 CONSTSTR(NULL));
1014 }
1015
1016 end:
1017 if (iph1 != NULL)
1018 delph1(iph1);
1019
1020 return error;
1021 }
1022
1023 /*
1024 * send Notification payload (for ISAKMP SA) in Informational exchange
1025 */
1026 int
1027 isakmp_info_send_n1(iph1, type, data)
1028 struct ph1handle *iph1;
1029 int type;
1030 vchar_t *data;
1031 {
1032 vchar_t *payload = NULL;
1033 int tlen;
1034 int error = 0;
1035 struct isakmp_pl_n *n;
1036 int spisiz;
1037
1038 /*
1039 * note on SPI size: which description is correct? I have chosen
1040 * this to be 0.
1041 *
1042 * RFC2408 3.1, 2nd paragraph says: ISAKMP SA is identified by
1043 * Initiator/Responder cookie and SPI has no meaning, SPI size = 0.
1044 * RFC2408 3.1, first paragraph on page 40: ISAKMP SA is identified
1045 * by cookie and SPI has no meaning, 0 <= SPI size <= 16.
1046 * RFC2407 4.6.3.3, INITIAL-CONTACT is required to set to 16.
1047 */
1048 if (type == ISAKMP_NTYPE_INITIAL_CONTACT ||
1049 type == ISAKMP_NTYPE_LOAD_BALANCE)
1050 spisiz = sizeof(isakmp_index);
1051 else
1052 spisiz = 0;
1053
1054 tlen = sizeof(*n) + spisiz;
1055 if (data)
1056 tlen += data->l;
1057 payload = vmalloc(tlen);
1058 if (payload == NULL) {
1059 IPSECSESSIONTRACEREVENT(iph1->parent_session,
1060 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_FAIL,
1061 CONSTSTR("ISAKMP-SA"),
1062 CONSTSTR("Failed to transmit ISAKMP-SA message (can't allocate payload)"));
1063 plog(LLV_ERROR, LOCATION, NULL,
1064 "failed to get buffer to send.\n");
1065 return errno;
1066 }
1067
1068 n = (struct isakmp_pl_n *)payload->v;
1069 n->h.np = ISAKMP_NPTYPE_NONE;
1070 n->h.len = htons(tlen);
1071 n->doi = htonl(iph1->rmconf->doitype);
1072 n->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX to be configurable ? */
1073 n->spi_size = spisiz;
1074 n->type = htons(type);
1075 if (spisiz)
1076 memcpy(n + 1, &iph1->index, sizeof(isakmp_index));
1077 if (data)
1078 memcpy((caddr_t)(n + 1) + spisiz, data->v, data->l);
1079
1080 #ifdef ENABLE_VPNCONTROL_PORT
1081 {
1082 u_int32_t address;
1083
1084 if (type == ISAKMP_INTERNAL_ERROR ||
1085 type <= ISAKMP_NTYPE_UNEQUAL_PAYLOAD_LENGTHS) {
1086 if (iph1->remote->sa_family == AF_INET)
1087 address = ((struct sockaddr_in *)iph1->remote)->sin_addr.s_addr;
1088 else
1089 address = 0;
1090 (void)vpncontrol_notify_ike_failed(type, FROM_LOCAL, address,
1091 (data ? data->l : 0), (data ? data->v : NULL));
1092 }
1093 }
1094 #endif
1095
1096 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, iph1->flags);
1097 vfree(payload);
1098 if (error) {
1099 IPSECSESSIONTRACEREVENT(iph1->parent_session,
1100 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_FAIL,
1101 CONSTSTR("ISAKMP-SA"),
1102 CONSTSTR("Can't transmit ISAKMP-SA message"));
1103 } else {
1104 IPSECSESSIONTRACEREVENT(iph1->parent_session,
1105 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_SUCC,
1106 CONSTSTR("ISAKMP-SA"),
1107 CONSTSTR(NULL));
1108 }
1109
1110 return error;
1111 }
1112
1113 /*
1114 * send Notification payload (for IPsec SA) in Informational exchange
1115 */
1116 int
1117 isakmp_info_send_n2(iph2, type, data)
1118 struct ph2handle *iph2;
1119 int type;
1120 vchar_t *data;
1121 {
1122 struct ph1handle *iph1 = iph2->ph1;
1123 vchar_t *payload = NULL;
1124 int tlen;
1125 int error = 0;
1126 struct isakmp_pl_n *n;
1127 struct saproto *pr;
1128
1129 if (!iph2->approval)
1130 return EINVAL;
1131
1132 pr = iph2->approval->head;
1133
1134 /* XXX must be get proper spi */
1135 tlen = sizeof(*n) + pr->spisize;
1136 if (data)
1137 tlen += data->l;
1138 payload = vmalloc(tlen);
1139 if (payload == NULL) {
1140 IPSECSESSIONTRACEREVENT(iph2->parent_session,
1141 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_FAIL,
1142 CONSTSTR("IPSEC-SA"),
1143 CONSTSTR("Failed to transmit IPSEC-SA message (can't allocate payload)"));
1144 plog(LLV_ERROR, LOCATION, NULL,
1145 "failed to get buffer to send.\n");
1146 return errno;
1147 }
1148
1149 n = (struct isakmp_pl_n *)payload->v;
1150 n->h.np = ISAKMP_NPTYPE_NONE;
1151 n->h.len = htons(tlen);
1152 n->doi = htonl(IPSEC_DOI); /* IPSEC DOI (1) */
1153 n->proto_id = pr->proto_id; /* IPSEC AH/ESP/whatever*/
1154 n->spi_size = pr->spisize;
1155 n->type = htons(type);
1156 *(u_int32_t *)(n + 1) = pr->spi;
1157 if (data)
1158 memcpy((caddr_t)(n + 1) + pr->spisize, data->v, data->l);
1159
1160 iph2->flags |= ISAKMP_FLAG_E; /* XXX Should we do FLAG_A ? */
1161 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, iph2->flags);
1162 vfree(payload);
1163 if (error) {
1164 IPSECSESSIONTRACEREVENT(iph2->parent_session,
1165 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_FAIL,
1166 CONSTSTR("IPSEC-SA"),
1167 CONSTSTR("Failed to transmit IPSEC-SA message"));
1168 } else {
1169 IPSECSESSIONTRACEREVENT(iph2->parent_session,
1170 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_SUCC,
1171 CONSTSTR("IPSEC-SA"),
1172 CONSTSTR(NULL));
1173 }
1174
1175 return error;
1176 }
1177
1178 /*
1179 * send Information
1180 * When ph1->skeyid_a == NULL, send message without encoding.
1181 */
1182 int
1183 isakmp_info_send_common(iph1, payload, np, flags)
1184 struct ph1handle *iph1;
1185 vchar_t *payload;
1186 u_int32_t np;
1187 int flags;
1188 {
1189 struct ph2handle *iph2 = NULL;
1190 vchar_t *hash = NULL;
1191 struct isakmp *isakmp;
1192 struct isakmp_gen *gen;
1193 char *p;
1194 int tlen;
1195 int error = -1;
1196
1197 /* add new entry to isakmp status table */
1198 iph2 = newph2();
1199 if (iph2 == NULL) {
1200 plog(LLV_ERROR, LOCATION, NULL,
1201 "failed to allocate ph2");
1202 goto end;
1203 }
1204
1205 iph2->dst = dupsaddr(iph1->remote);
1206 if (iph2->dst == NULL) {
1207 plog(LLV_ERROR, LOCATION, NULL,
1208 "failed to duplicate remote address");
1209 delph2(iph2);
1210 goto end;
1211 }
1212 iph2->src = dupsaddr(iph1->local);
1213 if (iph2->src == NULL) {
1214 plog(LLV_ERROR, LOCATION, NULL,
1215 "failed to duplicate local address");
1216 delph2(iph2);
1217 goto end;
1218 }
1219 switch (iph1->remote->sa_family) {
1220 case AF_INET:
1221 #if (!defined(ENABLE_NATT)) || (defined(BROKEN_NATT))
1222 ((struct sockaddr_in *)iph2->dst)->sin_port = 0;
1223 ((struct sockaddr_in *)iph2->src)->sin_port = 0;
1224 #endif
1225 break;
1226 #ifdef INET6
1227 case AF_INET6:
1228 #if (!defined(ENABLE_NATT)) || (defined(BROKEN_NATT))
1229 ((struct sockaddr_in6 *)iph2->dst)->sin6_port = 0;
1230 ((struct sockaddr_in6 *)iph2->src)->sin6_port = 0;
1231 #endif
1232 break;
1233 #endif
1234 default:
1235 plog(LLV_ERROR, LOCATION, NULL,
1236 "invalid family: %d\n", iph1->remote->sa_family);
1237 delph2(iph2);
1238 goto end;
1239 }
1240 iph2->ph1 = iph1;
1241 iph2->side = INITIATOR;
1242 iph2->status = PHASE2ST_START;
1243 iph2->msgid = isakmp_newmsgid2(iph1);
1244
1245 /* get IV and HASH(1) if skeyid_a was generated. */
1246 if (iph1->skeyid_a != NULL) {
1247 iph2->ivm = oakley_newiv2(iph1, iph2->msgid);
1248 if (iph2->ivm == NULL) {
1249 plog(LLV_ERROR, LOCATION, NULL,
1250 "failed to generate IV");
1251 delph2(iph2);
1252 goto end;
1253 }
1254
1255 /* generate HASH(1) */
1256 hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, payload);
1257 if (hash == NULL) {
1258 plog(LLV_ERROR, LOCATION, NULL,
1259 "failed to generate HASH");
1260 delph2(iph2);
1261 goto end;
1262 }
1263
1264 /* initialized total buffer length */
1265 tlen = hash->l;
1266 tlen += sizeof(*gen);
1267 } else {
1268 /* IKE-SA is not established */
1269 hash = NULL;
1270
1271 /* initialized total buffer length */
1272 tlen = 0;
1273 }
1274 if ((flags & ISAKMP_FLAG_A) == 0)
1275 iph2->flags = (hash == NULL ? 0 : ISAKMP_FLAG_E);
1276 else
1277 iph2->flags = (hash == NULL ? 0 : ISAKMP_FLAG_A);
1278
1279 insph2(iph2);
1280 bindph12(iph1, iph2);
1281
1282 tlen += sizeof(*isakmp) + payload->l;
1283
1284 /* create buffer for isakmp payload */
1285 iph2->sendbuf = vmalloc(tlen);
1286 if (iph2->sendbuf == NULL) {
1287 plog(LLV_ERROR, LOCATION, NULL,
1288 "failed to get buffer to send.\n");
1289 goto err;
1290 }
1291
1292 /* create isakmp header */
1293 isakmp = (struct isakmp *)iph2->sendbuf->v;
1294 memcpy(&isakmp->i_ck, &iph1->index.i_ck, sizeof(cookie_t));
1295 memcpy(&isakmp->r_ck, &iph1->index.r_ck, sizeof(cookie_t));
1296 isakmp->np = hash == NULL ? (np & 0xff) : ISAKMP_NPTYPE_HASH;
1297 isakmp->v = iph1->version;
1298 isakmp->etype = ISAKMP_ETYPE_INFO;
1299 isakmp->flags = iph2->flags;
1300 memcpy(&isakmp->msgid, &iph2->msgid, sizeof(isakmp->msgid));
1301 isakmp->len = htonl(tlen);
1302 p = (char *)(isakmp + 1);
1303
1304 /* create HASH payload */
1305 if (hash != NULL) {
1306 gen = (struct isakmp_gen *)p;
1307 gen->np = np & 0xff;
1308 gen->len = htons(sizeof(*gen) + hash->l);
1309 p += sizeof(*gen);
1310 memcpy(p, hash->v, hash->l);
1311 p += hash->l;
1312 }
1313
1314 /* add payload */
1315 memcpy(p, payload->v, payload->l);
1316 p += payload->l;
1317
1318 #ifdef HAVE_PRINT_ISAKMP_C
1319 isakmp_printpacket(iph2->sendbuf, iph1->local, iph1->remote, 1);
1320 #endif
1321
1322 /* encoding */
1323 if (ISSET(isakmp->flags, ISAKMP_FLAG_E)) {
1324 vchar_t *tmp;
1325
1326 tmp = oakley_do_encrypt(iph2->ph1, iph2->sendbuf, iph2->ivm->ive,
1327 iph2->ivm->iv);
1328 VPTRINIT(iph2->sendbuf);
1329 if (tmp == NULL) {
1330 plog(LLV_ERROR, LOCATION, NULL,
1331 "failed to encrypt packet");
1332 goto err;
1333 }
1334 iph2->sendbuf = tmp;
1335 }
1336
1337 /* HDR*, HASH(1), N */
1338 if (isakmp_send(iph2->ph1, iph2->sendbuf) < 0) {
1339 plog(LLV_ERROR, LOCATION, NULL,
1340 "failed to send packet");
1341 VPTRINIT(iph2->sendbuf);
1342 goto err;
1343 }
1344
1345 plog(LLV_DEBUG, LOCATION, NULL,
1346 "sendto Information %s.\n", s_isakmp_nptype(np));
1347
1348 /*
1349 * don't resend notify message because peer can use Acknowledged
1350 * Informational if peer requires the reply of the notify message.
1351 */
1352
1353 /* XXX If Acknowledged Informational required, don't delete ph2handle */
1354 error = 0;
1355 VPTRINIT(iph2->sendbuf);
1356 IPSECSESSIONTRACEREVENT(iph1->parent_session,
1357 IPSECSESSIONEVENTCODE_IKE_PACKET_TX_SUCC,
1358 CONSTSTR("Information message"),
1359 CONSTSTR(NULL));
1360
1361 goto err; /* XXX */
1362
1363 end:
1364 if (error) {
1365 IPSECSESSIONTRACEREVENT(iph1->parent_session,
1366 IPSECSESSIONEVENTCODE_IKE_PACKET_TX_FAIL,
1367 CONSTSTR("Information message"),
1368 CONSTSTR("Failed to transmit Information message"));
1369 }
1370 if (hash)
1371 vfree(hash);
1372 return error;
1373
1374 err:
1375 unbindph12(iph2);
1376 remph2(iph2);
1377 delph2(iph2);
1378 goto end;
1379 }
1380
1381 /*
1382 * add a notify payload to buffer by reallocating buffer.
1383 * If buf == NULL, the function only create a notify payload.
1384 *
1385 * XXX Which is SPI to be included, inbound or outbound ?
1386 */
1387 vchar_t *
1388 isakmp_add_pl_n(buf0, np_p, type, pr, data)
1389 vchar_t *buf0;
1390 u_int8_t **np_p;
1391 int type;
1392 struct saproto *pr;
1393 vchar_t *data;
1394 {
1395 vchar_t *buf = NULL;
1396 struct isakmp_pl_n *n;
1397 int tlen;
1398 int oldlen = 0;
1399
1400 if (*np_p)
1401 **np_p = ISAKMP_NPTYPE_N;
1402
1403 tlen = sizeof(*n) + pr->spisize;
1404
1405 if (data)
1406 tlen += data->l;
1407 if (buf0) {
1408 oldlen = buf0->l;
1409 buf = vrealloc(buf0, buf0->l + tlen);
1410 } else
1411 buf = vmalloc(tlen);
1412 if (!buf) {
1413 plog(LLV_ERROR, LOCATION, NULL,
1414 "failed to get a payload buffer.\n");
1415 return NULL;
1416 }
1417
1418 n = (struct isakmp_pl_n *)(buf->v + oldlen);
1419 n->h.np = ISAKMP_NPTYPE_NONE;
1420 n->h.len = htons(tlen);
1421 n->doi = htonl(IPSEC_DOI); /* IPSEC DOI (1) */
1422 n->proto_id = pr->proto_id; /* IPSEC AH/ESP/whatever*/
1423 n->spi_size = pr->spisize;
1424 n->type = htons(type);
1425 *(u_int32_t *)(n + 1) = pr->spi; /* XXX */
1426 if (data)
1427 memcpy((caddr_t)(n + 1) + pr->spisize, data->v, data->l);
1428
1429 /* save the pointer of next payload type */
1430 *np_p = &n->h.np;
1431
1432 return buf;
1433 }
1434
1435 static void
1436 purge_isakmp_spi(proto, spi, n)
1437 int proto;
1438 isakmp_index *spi; /*network byteorder*/
1439 size_t n;
1440 {
1441 struct ph1handle *iph1;
1442 size_t i;
1443
1444 for (i = 0; i < n; i++) {
1445 iph1 = getph1byindex(&spi[i]);
1446 if (!iph1)
1447 continue;
1448
1449 plog(LLV_INFO, LOCATION, NULL,
1450 "purged ISAKMP-SA proto_id=%s spi=%s.\n",
1451 s_ipsecdoi_proto(proto),
1452 isakmp_pindex(&spi[i], 0));
1453
1454 SCHED_KILL(iph1->sce);
1455 SCHED_KILL(iph1->sce_rekey);
1456 iph1->status = PHASE1ST_EXPIRED;
1457 ike_session_update_ph1_ph2tree(iph1); // move unbind/rebind ph2s to from current ph1
1458 iph1->sce = sched_new(1, isakmp_ph1delete_stub, iph1);
1459 }
1460 }
1461
1462
1463
1464 void
1465 purge_ipsec_spi(dst0, proto, spi, n)
1466 struct sockaddr *dst0;
1467 int proto;
1468 u_int32_t *spi; /*network byteorder*/
1469 size_t n;
1470 {
1471 vchar_t *buf = NULL;
1472 struct sadb_msg *msg, *next, *end;
1473 struct sadb_sa *sa;
1474 struct sadb_lifetime *lt;
1475 struct sockaddr *src, *dst;
1476 struct ph2handle *iph2;
1477 u_int64_t created;
1478 size_t i;
1479 caddr_t mhp[SADB_EXT_MAX + 1];
1480
1481 plog(LLV_DEBUG2, LOCATION, NULL,
1482 "purge_ipsec_spi:\n");
1483 plog(LLV_DEBUG2, LOCATION, NULL, "dst0: %s\n", saddr2str(dst0));
1484 plog(LLV_DEBUG2, LOCATION, NULL, "SPI: %08X\n", ntohl(spi[0]));
1485
1486 buf = pfkey_dump_sadb(ipsecdoi2pfkey_proto(proto));
1487 if (buf == NULL) {
1488 plog(LLV_DEBUG, LOCATION, NULL,
1489 "pfkey_dump_sadb returned nothing.\n");
1490 return;
1491 }
1492
1493 msg = (struct sadb_msg *)buf->v;
1494 end = (struct sadb_msg *)(buf->v + buf->l);
1495
1496 while (msg < end) {
1497 if ((msg->sadb_msg_len << 3) < sizeof(*msg))
1498 break;
1499 next = (struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3));
1500 if (msg->sadb_msg_type != SADB_DUMP) {
1501 msg = next;
1502 continue;
1503 }
1504
1505 if (pfkey_align(msg, mhp) || pfkey_check(mhp)) {
1506 plog(LLV_ERROR, LOCATION, NULL,
1507 "pfkey_check (%s)\n", ipsec_strerror());
1508 msg = next;
1509 continue;
1510 }
1511
1512 sa = (struct sadb_sa *)(mhp[SADB_EXT_SA]);
1513 if (!sa
1514 || !mhp[SADB_EXT_ADDRESS_SRC]
1515 || !mhp[SADB_EXT_ADDRESS_DST]) {
1516 msg = next;
1517 continue;
1518 }
1519 src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
1520 dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
1521 lt = (struct sadb_lifetime*)mhp[SADB_EXT_LIFETIME_HARD];
1522 if(lt != NULL)
1523 created = lt->sadb_lifetime_addtime;
1524 else
1525 created = 0;
1526
1527 if (sa->sadb_sa_state != SADB_SASTATE_MATURE
1528 && sa->sadb_sa_state != SADB_SASTATE_DYING) {
1529 msg = next;
1530 continue;
1531 }
1532 plog(LLV_DEBUG2, LOCATION, NULL, "src: %s\n", saddr2str(src));
1533 plog(LLV_DEBUG2, LOCATION, NULL, "dst: %s\n", saddr2str(dst));
1534
1535
1536
1537 /* XXX n^2 algorithm, inefficient */
1538
1539 /* don't delete inbound SAs at the moment */
1540 /* XXX should we remove SAs with opposite direction as well? */
1541 if (CMPSADDR2(dst0, dst)) {
1542 msg = next;
1543 continue;
1544 }
1545
1546 for (i = 0; i < n; i++) {
1547 plog(LLV_DEBUG, LOCATION, NULL,
1548 "check spi(packet)=%u spi(db)=%u.\n",
1549 ntohl(spi[i]), ntohl(sa->sadb_sa_spi));
1550 if (spi[i] != sa->sadb_sa_spi)
1551 continue;
1552
1553 pfkey_send_delete(lcconf->sock_pfkey,
1554 msg->sadb_msg_satype,
1555 IPSEC_MODE_ANY,
1556 src, dst, sa->sadb_sa_spi);
1557
1558 /*
1559 * delete a relative phase 2 handler.
1560 * continue to process if no relative phase 2 handler
1561 * exists.
1562 */
1563 iph2 = getph2bysaidx(src, dst, proto, spi[i]);
1564 if(iph2 != NULL){
1565 delete_spd(iph2);
1566 unbindph12(iph2);
1567 remph2(iph2);
1568 delph2(iph2);
1569 }
1570
1571 plog(LLV_INFO, LOCATION, NULL,
1572 "purged IPsec-SA proto_id=%s spi=%u.\n",
1573 s_ipsecdoi_proto(proto),
1574 ntohl(spi[i]));
1575 }
1576
1577 msg = next;
1578 }
1579
1580 if (buf)
1581 vfree(buf);
1582 }
1583
1584 /*
1585 * delete all phase2 sa relatived to the destination address.
1586 * Don't delete Phase 1 handlers on INITIAL-CONTACT, and don't ignore
1587 * an INITIAL-CONTACT if we have contacted the peer. This matches the
1588 * Sun IKE behavior, and makes rekeying work much better when the peer
1589 * restarts.
1590 */
1591 static void
1592 info_recv_initialcontact(iph1)
1593 struct ph1handle *iph1;
1594 {
1595 vchar_t *buf = NULL;
1596 struct sadb_msg *msg, *next, *end;
1597 struct sadb_sa *sa;
1598 struct sockaddr *src, *dst;
1599 caddr_t mhp[SADB_EXT_MAX + 1];
1600 int proto_id, i;
1601 struct ph2handle *iph2;
1602 #if 0
1603 char *loc, *rem;
1604 #endif
1605
1606 if (f_local)
1607 return;
1608
1609 // TODO: make sure that is_rekey is cleared for this. and session indicates the same
1610 #if 0
1611 loc = racoon_strdup(saddrwop2str(iph1->local));
1612 rem = racoon_strdup(saddrwop2str(iph1->remote));
1613 STRDUP_FATAL(loc);
1614 STRDUP_FATAL(rem);
1615
1616 /*
1617 * Purge all IPSEC-SAs for the peer. We can do this
1618 * the easy way (using a PF_KEY SADB_DELETE extension)
1619 * or we can do it the hard way.
1620 */
1621 for (i = 0; i < pfkey_nsatypes; i++) {
1622 proto_id = pfkey2ipsecdoi_proto(pfkey_satypes[i].ps_satype);
1623
1624 plog(LLV_INFO, LOCATION, NULL,
1625 "purging %s SAs for %s -> %s\n",
1626 pfkey_satypes[i].ps_name, loc, rem);
1627 if (pfkey_send_delete_all(lcconf->sock_pfkey,
1628 pfkey_satypes[i].ps_satype, IPSEC_MODE_ANY,
1629 iph1->local, iph1->remote) == -1) {
1630 plog(LLV_ERROR, LOCATION, NULL,
1631 "delete_all %s -> %s failed for %s (%s)\n",
1632 loc, rem,
1633 pfkey_satypes[i].ps_name, ipsec_strerror());
1634 goto the_hard_way;
1635 }
1636
1637 deleteallph2(iph1->local, iph1->remote, proto_id);
1638
1639 plog(LLV_INFO, LOCATION, NULL,
1640 "purging %s SAs for %s -> %s\n",
1641 pfkey_satypes[i].ps_name, rem, loc);
1642 if (pfkey_send_delete_all(lcconf->sock_pfkey,
1643 pfkey_satypes[i].ps_satype, IPSEC_MODE_ANY,
1644 iph1->remote, iph1->local) == -1) {
1645 plog(LLV_ERROR, LOCATION, NULL,
1646 "delete_all %s -> %s failed for %s (%s)\n",
1647 rem, loc,
1648 pfkey_satypes[i].ps_name, ipsec_strerror());
1649 goto the_hard_way;
1650 }
1651
1652 deleteallph2(iph1->remote, iph1->local, proto_id);
1653 }
1654
1655 racoon_free(loc);
1656 racoon_free(rem);
1657 return;
1658
1659 the_hard_way:
1660 racoon_free(loc);
1661 racoon_free(rem);
1662 #endif
1663
1664 buf = pfkey_dump_sadb(SADB_SATYPE_UNSPEC);
1665 if (buf == NULL) {
1666 plog(LLV_DEBUG, LOCATION, NULL,
1667 "pfkey_dump_sadb returned nothing.\n");
1668 return;
1669 }
1670
1671 msg = (struct sadb_msg *)buf->v;
1672 end = (struct sadb_msg *)(buf->v + buf->l);
1673
1674 while (msg < end) {
1675 if ((msg->sadb_msg_len << 3) < sizeof(*msg))
1676 break;
1677 next = (struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3));
1678 if (msg->sadb_msg_type != SADB_DUMP) {
1679 msg = next;
1680 continue;
1681 }
1682
1683 if (pfkey_align(msg, mhp) || pfkey_check(mhp)) {
1684 plog(LLV_ERROR, LOCATION, NULL,
1685 "pfkey_check (%s)\n", ipsec_strerror());
1686 msg = next;
1687 continue;
1688 }
1689
1690 if (mhp[SADB_EXT_SA] == NULL
1691 || mhp[SADB_EXT_ADDRESS_SRC] == NULL
1692 || mhp[SADB_EXT_ADDRESS_DST] == NULL) {
1693 msg = next;
1694 continue;
1695 }
1696 sa = (struct sadb_sa *)mhp[SADB_EXT_SA];
1697 src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
1698 dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
1699
1700 if (sa->sadb_sa_state != SADB_SASTATE_MATURE
1701 && sa->sadb_sa_state != SADB_SASTATE_DYING) {
1702 msg = next;
1703 continue;
1704 }
1705
1706 /*
1707 * RFC2407 4.6.3.3 INITIAL-CONTACT is the message that
1708 * announces the sender of the message was rebooted.
1709 * it is interpreted to delete all SAs which source address
1710 * is the sender of the message.
1711 * racoon only deletes SA which is matched both the
1712 * source address and the destination accress.
1713 */
1714 #ifdef ENABLE_NATT
1715 /*
1716 * XXX RFC 3947 says that whe MUST NOT use IP+port to find old SAs
1717 * from this peer !
1718 */
1719 if(iph1->natt_flags & NAT_DETECTED){
1720 if (CMPSADDR(iph1->local, src) == 0 &&
1721 CMPSADDR(iph1->remote, dst) == 0)
1722 ;
1723 else if (CMPSADDR(iph1->remote, src) == 0 &&
1724 CMPSADDR(iph1->local, dst) == 0)
1725 ;
1726 else {
1727 msg = next;
1728 continue;
1729 }
1730 } else
1731 #endif
1732 /* If there is no NAT-T, we don't have to check addr + port...
1733 * XXX what about a configuration with a remote peers which is not
1734 * NATed, but which NATs some other peers ?
1735 * Here, the INITIAl-CONTACT would also flush all those NATed peers !!
1736 */
1737 if (cmpsaddrwop(iph1->local, src) == 0 &&
1738 cmpsaddrwop(iph1->remote, dst) == 0)
1739 ;
1740 else if (cmpsaddrwop(iph1->remote, src) == 0 &&
1741 cmpsaddrwop(iph1->local, dst) == 0)
1742 ;
1743 else {
1744 msg = next;
1745 continue;
1746 }
1747
1748 /*
1749 * Make sure this is an SATYPE that we manage.
1750 * This is gross; too bad we couldn't do it the
1751 * easy way.
1752 */
1753 for (i = 0; i < pfkey_nsatypes; i++) {
1754 if (pfkey_satypes[i].ps_satype ==
1755 msg->sadb_msg_satype)
1756 break;
1757 }
1758 if (i == pfkey_nsatypes) {
1759 msg = next;
1760 continue;
1761 }
1762
1763 plog(LLV_INFO, LOCATION, NULL,
1764 "purging spi=%u.\n", ntohl(sa->sadb_sa_spi));
1765 pfkey_send_delete(lcconf->sock_pfkey,
1766 msg->sadb_msg_satype,
1767 IPSEC_MODE_ANY, src, dst, sa->sadb_sa_spi);
1768
1769 /*
1770 * delete a relative phase 2 handler.
1771 * continue to process if no relative phase 2 handler
1772 * exists.
1773 */
1774 proto_id = pfkey2ipsecdoi_proto(msg->sadb_msg_satype);
1775 iph2 = getph2bysaidx(src, dst, proto_id, sa->sadb_sa_spi);
1776 if (iph2) {
1777 delete_spd(iph2);
1778 unbindph12(iph2);
1779 remph2(iph2);
1780 delph2(iph2);
1781 }
1782
1783 msg = next;
1784 }
1785
1786 vfree(buf);
1787 }
1788
1789 void
1790 isakmp_check_notify(gen, iph1)
1791 struct isakmp_gen *gen; /* points to Notify payload */
1792 struct ph1handle *iph1;
1793 {
1794 struct isakmp_pl_n *notify = (struct isakmp_pl_n *)gen;
1795
1796 plog(LLV_DEBUG, LOCATION, iph1->remote,
1797 "Notify Message received\n");
1798
1799 switch (ntohs(notify->type)) {
1800 case ISAKMP_NTYPE_CONNECTED:
1801 case ISAKMP_NTYPE_RESPONDER_LIFETIME:
1802 case ISAKMP_NTYPE_REPLAY_STATUS:
1803 case ISAKMP_NTYPE_HEARTBEAT:
1804 #ifdef ENABLE_HYBRID
1805 case ISAKMP_NTYPE_UNITY_HEARTBEAT:
1806 #endif
1807 plog(LLV_WARNING, LOCATION, iph1->remote,
1808 "ignore %s notification.\n",
1809 s_isakmp_notify_msg(ntohs(notify->type)));
1810 break;
1811 case ISAKMP_NTYPE_INITIAL_CONTACT:
1812 plog(LLV_WARNING, LOCATION, iph1->remote,
1813 "ignore INITIAL-CONTACT notification, "
1814 "because it is only accepted after phase1.\n");
1815 break;
1816 case ISAKMP_NTYPE_LOAD_BALANCE:
1817 plog(LLV_WARNING, LOCATION, iph1->remote,
1818 "ignore LOAD-BALANCE notification, "
1819 "because it is only accepted after phase1.\n");
1820 break;
1821 default:
1822 isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL);
1823 plog(LLV_ERROR, LOCATION, iph1->remote,
1824 "received unknown notification type %s.\n",
1825 s_isakmp_notify_msg(ntohs(notify->type)));
1826 }
1827
1828 return;
1829 }
1830
1831 void
1832 isakmp_check_ph2_notify(gen, iph2)
1833 struct isakmp_gen *gen; /* points to Notify payload */
1834 struct ph2handle *iph2;
1835 {
1836 struct isakmp_pl_n *notify = (struct isakmp_pl_n *)gen;
1837
1838 plog(LLV_DEBUG, LOCATION, iph2->dst,
1839 "Phase2 Notify Message received\n");
1840
1841 switch (ntohs(notify->type)) {
1842 case ISAKMP_NTYPE_RESPONDER_LIFETIME:
1843 return((void)isakmp_ph2_responder_lifetime(iph2,
1844 (struct isakmp_pl_resp_lifetime *)notify));
1845 break;
1846 case ISAKMP_NTYPE_CONNECTED:
1847 case ISAKMP_NTYPE_REPLAY_STATUS:
1848 case ISAKMP_NTYPE_HEARTBEAT:
1849 #ifdef ENABLE_HYBRID
1850 case ISAKMP_NTYPE_UNITY_HEARTBEAT:
1851 #endif
1852 plog(LLV_WARNING, LOCATION, iph2->dst,
1853 "ignore %s notification.\n",
1854 s_isakmp_notify_msg(ntohs(notify->type)));
1855 break;
1856 case ISAKMP_NTYPE_INITIAL_CONTACT:
1857 plog(LLV_WARNING, LOCATION, iph2->dst,
1858 "ignore INITIAL-CONTACT notification, "
1859 "because it is only accepted after phase1.\n");
1860 break;
1861 case ISAKMP_NTYPE_LOAD_BALANCE:
1862 plog(LLV_WARNING, LOCATION, iph2->dst,
1863 "ignore LOAD-BALANCE notification, "
1864 "because it is only accepted after phase1.\n");
1865 break;
1866 default:
1867 isakmp_info_send_n1(iph2->ph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL);
1868 plog(LLV_ERROR, LOCATION, iph2->dst,
1869 "received unknown notification type %s.\n",
1870 s_isakmp_notify_msg(ntohs(notify->type)));
1871 }
1872
1873 return;
1874 }
1875
1876 #ifdef ENABLE_VPNCONTROL_PORT
1877 static int
1878 isakmp_info_recv_lb(iph1, n, encrypted)
1879 struct ph1handle *iph1;
1880 struct isakmp_pl_lb *n;
1881 int encrypted;
1882 {
1883
1884 if (iph1->side != INITIATOR)
1885 {
1886 plog(LLV_DEBUG, LOCATION, NULL,
1887 "LOAD-BALANCE notification ignored - we are not the initiator.\n");
1888 return 0;
1889 }
1890 if (iph1->remote->sa_family != AF_INET) {
1891 plog(LLV_DEBUG, LOCATION, NULL,
1892 "LOAD-BALANCE notification ignored - only supported for IPv4.\n");
1893 return 0;
1894 }
1895 if (!encrypted) {
1896 plog(LLV_DEBUG, LOCATION, NULL,
1897 "LOAD-BALANCE notification ignored - not protected.\n");
1898 return 0;
1899 }
1900 if (ntohs(n->h.len) != sizeof(struct isakmp_pl_lb)) {
1901 plog(LLV_DEBUG, LOCATION, NULL,
1902 "Invalid length of payload\n");
1903 return -1;
1904 }
1905 vpncontrol_notify_ike_failed(ISAKMP_NTYPE_LOAD_BALANCE, FROM_REMOTE,
1906 ((struct sockaddr_in*)iph1->remote)->sin_addr.s_addr, 4, (u_int8_t*)(&(n->address)));
1907
1908 plog(LLV_DEBUG, LOCATION, iph1->remote,
1909 "received LOAD_BALANCE notification - redirect address=%x.\n",
1910 ntohl(n->address));
1911
1912 if (((struct sockaddr_in*)iph1->remote)->sin_addr.s_addr != ntohl(n->address)) {
1913 plog(LLV_DEBUG, LOCATION, iph1->remote,
1914 "deleting old phase1 because of LOAD_BALANCE notification - redirect address=%x.\n",
1915 ntohl(n->address));
1916
1917 if (iph1->status == PHASE1ST_ESTABLISHED) {
1918 isakmp_info_send_d1(iph1);
1919 }
1920 isakmp_ph1expire(iph1);
1921 }
1922
1923 return 0;
1924 }
1925 #endif
1926
1927 #ifdef ENABLE_DPD
1928 static int
1929 isakmp_info_recv_r_u (iph1, ru, msgid)
1930 struct ph1handle *iph1;
1931 struct isakmp_pl_ru *ru;
1932 u_int32_t msgid;
1933 {
1934 struct isakmp_pl_ru *ru_ack;
1935 vchar_t *payload = NULL;
1936 int tlen;
1937 int error = 0;
1938
1939 plog(LLV_DEBUG, LOCATION, iph1->remote,
1940 "DPD R-U-There received\n");
1941
1942 /* XXX should compare cookies with iph1->index?
1943 Or is this already done by calling function? */
1944 tlen = sizeof(*ru_ack);
1945 payload = vmalloc(tlen);
1946 if (payload == NULL) {
1947 IPSECSESSIONTRACEREVENT(iph1->parent_session,
1948 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_FAIL,
1949 CONSTSTR("R-U-THERE? ACK"),
1950 CONSTSTR("Failed to transmit DPD response"));
1951 plog(LLV_ERROR, LOCATION, NULL,
1952 "failed to get buffer to send.\n");
1953 return errno;
1954 }
1955
1956 ru_ack = (struct isakmp_pl_ru *)payload->v;
1957 ru_ack->h.np = ISAKMP_NPTYPE_NONE;
1958 ru_ack->h.len = htons(tlen);
1959 ru_ack->doi = htonl(IPSEC_DOI);
1960 ru_ack->type = htons(ISAKMP_NTYPE_R_U_THERE_ACK);
1961 ru_ack->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX ? */
1962 ru_ack->spi_size = sizeof(isakmp_index);
1963 memcpy(ru_ack->i_ck, ru->i_ck, sizeof(cookie_t));
1964 memcpy(ru_ack->r_ck, ru->r_ck, sizeof(cookie_t));
1965 ru_ack->data = ru->data;
1966
1967 /* XXX Should we do FLAG_A ? */
1968 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N,
1969 ISAKMP_FLAG_E);
1970 vfree(payload);
1971 if (error) {
1972 IPSECSESSIONTRACEREVENT(iph1->parent_session,
1973 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_FAIL,
1974 CONSTSTR("R-U-THERE? ACK"),
1975 CONSTSTR("Failed to transmit DPD ack"));
1976 } else {
1977 IPSECSESSIONTRACEREVENT(iph1->parent_session,
1978 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_SUCC,
1979 CONSTSTR("R-U-THERE? ACK"),
1980 CONSTSTR(NULL));
1981 }
1982
1983 plog(LLV_DEBUG, LOCATION, NULL, "received a valid R-U-THERE, ACK sent\n");
1984
1985 /* Should we mark tunnel as active ? */
1986 return error;
1987 }
1988
1989 static int
1990 isakmp_info_recv_r_u_ack (iph1, ru, msgid)
1991 struct ph1handle *iph1;
1992 struct isakmp_pl_ru *ru;
1993 u_int32_t msgid;
1994 {
1995
1996 plog(LLV_DEBUG, LOCATION, iph1->remote,
1997 "DPD R-U-There-Ack received\n");
1998
1999 /* XXX Maintain window of acceptable sequence numbers ?
2000 * => ru->data <= iph2->dpd_seq &&
2001 * ru->data >= iph2->dpd_seq - iph2->dpd_fails ? */
2002 if (ntohl(ru->data) != iph1->dpd_seq) {
2003 plog(LLV_ERROR, LOCATION, iph1->remote,
2004 "Wrong DPD sequence number (%d, %d expected).\n",
2005 ntohl(ru->data), iph1->dpd_seq);
2006 return 0;
2007 }
2008
2009 if (memcmp(ru->i_ck, iph1->index.i_ck, sizeof(cookie_t)) ||
2010 memcmp(ru->r_ck, iph1->index.r_ck, sizeof(cookie_t))) {
2011 plog(LLV_ERROR, LOCATION, iph1->remote,
2012 "Cookie mismatch in DPD ACK!.\n");
2013 return 0;
2014 }
2015
2016 iph1->dpd_fails = 0;
2017
2018 iph1->dpd_seq++;
2019
2020 /* Useless ??? */
2021 iph1->dpd_lastack = time(NULL);
2022
2023 SCHED_KILL(iph1->dpd_r_u);
2024
2025 isakmp_sched_r_u(iph1, 0);
2026
2027 if (iph1->side == INITIATOR) {
2028 IPSECSESSIONTRACEREVENT(iph1->parent_session,
2029 IPSECSESSIONEVENTCODE_IKEV1_DPD_INIT_RESP,
2030 CONSTSTR("Initiator DPD Response"),
2031 CONSTSTR(NULL));
2032 } else {
2033 IPSECSESSIONTRACEREVENT(iph1->parent_session,
2034 IPSECSESSIONEVENTCODE_IKEV1_DPD_RESP_RESP,
2035 CONSTSTR("Responder DPD Response"),
2036 CONSTSTR(NULL));
2037 }
2038 plog(LLV_DEBUG, LOCATION, NULL, "received an R-U-THERE-ACK\n");
2039
2040 return 0;
2041 }
2042
2043
2044 /*
2045 * send Delete payload (for ISAKMP SA) in Informational exchange.
2046 */
2047 void
2048 isakmp_info_send_r_u(arg)
2049 void *arg;
2050 {
2051 struct ph1handle *iph1 = arg;
2052
2053 /* create R-U-THERE payload */
2054 struct isakmp_pl_ru *ru;
2055 vchar_t *payload = NULL;
2056 int tlen;
2057 int error = 0;
2058
2059 if (iph1->status != PHASE1ST_ESTABLISHED) {
2060 plog(LLV_DEBUG, LOCATION, iph1->remote, "DPD r-u send aborted, invalid phase1 status %d....\n",
2061 iph1->status);
2062 return;
2063 }
2064
2065 if (iph1->dpd_fails >= iph1->rmconf->dpd_maxfails) {
2066 u_int32_t address;
2067
2068 IPSECSESSIONTRACEREVENT(iph1->parent_session,
2069 IPSECSESSIONEVENTCODE_IKEV1_DPD_MAX_RETRANSMIT,
2070 CONSTSTR("DPD maximum retransmits"),
2071 CONSTSTR("maxed-out of DPD requests without receiving an ack"));
2072
2073 EVT_PUSH(iph1->local, iph1->remote, EVTT_DPD_TIMEOUT, NULL);
2074 if (iph1->remote->sa_family == AF_INET)
2075 address = ((struct sockaddr_in *)iph1->remote)->sin_addr.s_addr;
2076 else
2077 address = 0;
2078 (void)vpncontrol_notify_ike_failed(VPNCTL_NTYPE_PEER_DEAD, FROM_LOCAL, address, 0, NULL);
2079
2080 purge_remote(iph1);
2081 plog(LLV_DEBUG, LOCATION, iph1->remote,
2082 "DPD: remote seems to be dead\n");
2083
2084 /* Do not reschedule here: phase1 is deleted,
2085 * DPD will be reactivated when a new ph1 will be negociated
2086 */
2087 return;
2088 }
2089
2090 tlen = sizeof(*ru);
2091 payload = vmalloc(tlen);
2092 if (payload == NULL) {
2093 IPSECSESSIONTRACEREVENT(iph1->parent_session,
2094 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_FAIL,
2095 CONSTSTR("R-U-THERE?"),
2096 CONSTSTR("Failed to transmit DPD request"));
2097 plog(LLV_ERROR, LOCATION, NULL,
2098 "failed to get buffer for payload.\n");
2099 return;
2100 }
2101 ru = (struct isakmp_pl_ru *)payload->v;
2102 ru->h.np = ISAKMP_NPTYPE_NONE;
2103 ru->h.len = htons(tlen);
2104 ru->doi = htonl(IPSEC_DOI);
2105 ru->type = htons(ISAKMP_NTYPE_R_U_THERE);
2106 ru->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX ?*/
2107 ru->spi_size = sizeof(isakmp_index);
2108
2109 memcpy(ru->i_ck, iph1->index.i_ck, sizeof(cookie_t));
2110 memcpy(ru->r_ck, iph1->index.r_ck, sizeof(cookie_t));
2111
2112 if (iph1->dpd_seq == 0){
2113 /* generate a random seq which is not too big */
2114 srand(time(NULL));
2115 iph1->dpd_seq = rand() & 0x0fff;
2116 }
2117
2118 ru->data = htonl(iph1->dpd_seq);
2119
2120 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 0);
2121 vfree(payload);
2122 if (error) {
2123 IPSECSESSIONTRACEREVENT(iph1->parent_session,
2124 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_FAIL,
2125 CONSTSTR("R-U-THERE?"),
2126 CONSTSTR("Failed to transmit DPD request"));
2127 } else {
2128 IPSECSESSIONTRACEREVENT(iph1->parent_session,
2129 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_SUCC,
2130 CONSTSTR("R-U-THERE?"),
2131 CONSTSTR(NULL));
2132 }
2133
2134 if (iph1->side == INITIATOR) {
2135 IPSECSESSIONTRACEREVENT(iph1->parent_session,
2136 iph1->dpd_fails? IPSECSESSIONEVENTCODE_IKEV1_DPD_INIT_RETRANSMIT : IPSECSESSIONEVENTCODE_IKEV1_DPD_INIT_REQ,
2137 CONSTSTR("Initiator DPD Request"),
2138 CONSTSTR(NULL));
2139 } else {
2140 IPSECSESSIONTRACEREVENT(iph1->parent_session,
2141 iph1->dpd_fails? IPSECSESSIONEVENTCODE_IKEV1_DPD_RESP_RETRANSMIT : IPSECSESSIONEVENTCODE_IKEV1_DPD_RESP_REQ,
2142 CONSTSTR("Responder DPD Request"),
2143 CONSTSTR(NULL));
2144 }
2145 plog(LLV_DEBUG, LOCATION, iph1->remote,
2146 "DPD R-U-There sent (%d)\n", error);
2147
2148 /* will be decreased if ACK received... */
2149 iph1->dpd_fails++;
2150
2151 /* Reschedule the r_u_there with a short delay,
2152 * will be deleted/rescheduled if ACK received before */
2153 isakmp_sched_r_u(iph1, 1);
2154
2155 plog(LLV_DEBUG, LOCATION, iph1->remote,
2156 "rescheduling send_r_u (%d).\n", iph1->rmconf->dpd_retry);
2157 }
2158
2159 /*
2160 * monitor DPD (ALGORITHM_INBOUND_DETECT) Informational exchange.
2161 */
2162 static void
2163 isakmp_info_monitor_r_u_algo_inbound_detect (struct ph1handle *iph1)
2164 {
2165 if (iph1->status != PHASE1ST_ESTABLISHED) {
2166 plog(LLV_DEBUG, LOCATION, iph1->remote, "DPD monitoring (for ALGORITHM_INBOUND_DETECT) aborted, invalid phase1 status %d....\n",
2167 iph1->status);
2168 return;
2169 }
2170
2171 plog(LLV_DEBUG, LOCATION, iph1->remote, "DPD monitoring (for ALGORITHM_INBOUND_DETECT) ....\n");
2172
2173 // check phase1 for ike packets received from peer
2174 if (iph1->peer_sent_ike) {
2175 // yes, reshedule check
2176 iph1->peer_sent_ike = 0;
2177
2178 /* ike packets received from peer... reschedule dpd */
2179 isakmp_sched_r_u(iph1, 0);
2180
2181 plog(LLV_DEBUG, LOCATION, iph1->remote,
2182 "ike packets received from peer... reschedule monitor.\n");
2183
2184 return;
2185 }
2186
2187 // after ike packets, next we check if any data was received
2188 if (!iph1->parent_session->peer_sent_data_sc_dpd) {
2189 isakmp_info_send_r_u(iph1);
2190 } else {
2191 isakmp_sched_r_u(iph1, 0);
2192
2193 plog(LLV_DEBUG, LOCATION, iph1->remote,
2194 "rescheduling DPD monitoring (for ALGORITHM_INBOUND_DETECT).\n");
2195 }
2196 iph1->parent_session->peer_sent_data_sc_dpd = 0;
2197 }
2198
2199 /*
2200 * monitor DPD (ALGORITHM_INBOUND_DETECT) Informational exchange.
2201 */
2202 static void
2203 isakmp_info_monitor_r_u_algo_blackhole_detect (struct ph1handle *iph1)
2204 {
2205 if (iph1->status != PHASE1ST_ESTABLISHED) {
2206 plog(LLV_DEBUG, LOCATION, iph1->remote, "DPD monitoring (for ALGORITHM_BLACKHOLE_DETECT) aborted, invalid phase1 status %d....\n",
2207 iph1->status);
2208 return;
2209 }
2210
2211 plog(LLV_DEBUG, LOCATION, iph1->remote, "DPD monitoring (for ALGORITHM_BLACKHOLE_DETECT) ....\n");
2212
2213 // check if data was sent but none was received
2214 if (iph1->parent_session->i_sent_data_sc_dpd &&
2215 !iph1->parent_session->peer_sent_data_sc_dpd) {
2216 isakmp_info_send_r_u(iph1);
2217 } else {
2218 isakmp_sched_r_u(iph1, 0);
2219
2220 plog(LLV_DEBUG, LOCATION, iph1->remote,
2221 "rescheduling DPD monitoring (for ALGORITHM_BLACKHOLE_DETECT) i = %d, peer %d.\n",
2222 iph1->parent_session->i_sent_data_sc_dpd,
2223 iph1->parent_session->peer_sent_data_sc_dpd);
2224 }
2225 iph1->parent_session->i_sent_data_sc_dpd = 0;
2226 iph1->parent_session->peer_sent_data_sc_dpd = 0;
2227 }
2228
2229 /*
2230 * monitor DPD Informational exchange.
2231 */
2232 static void
2233 isakmp_info_monitor_r_u(arg)
2234 void *arg;
2235 {
2236 struct ph1handle *iph1 = arg;
2237
2238 if (iph1 && iph1->rmconf) {
2239 if (iph1->rmconf->dpd_algo == DPD_ALGO_INBOUND_DETECT) {
2240 isakmp_info_monitor_r_u_algo_inbound_detect(iph1);
2241 } else if (iph1->rmconf->dpd_algo == DPD_ALGO_BLACKHOLE_DETECT) {
2242 isakmp_info_monitor_r_u_algo_blackhole_detect(iph1);
2243 } else {
2244 plog(LLV_DEBUG, LOCATION, iph1->remote, "DPD monitoring aborted, invalid algorithm %d....\n",
2245 iph1->rmconf->dpd_algo);
2246 }
2247 }
2248 }
2249
2250 /* Schedule a new R-U-THERE */
2251 int
2252 isakmp_sched_r_u(iph1, retry)
2253 struct ph1handle *iph1;
2254 int retry;
2255 {
2256 if(iph1 == NULL ||
2257 iph1->rmconf == NULL)
2258 return 1;
2259
2260
2261 if(iph1->dpd_support == 0 ||
2262 iph1->rmconf->dpd_interval == 0)
2263 return 0;
2264
2265 if(retry) {
2266 iph1->dpd_r_u = sched_new(iph1->rmconf->dpd_retry,
2267 isakmp_info_send_r_u, iph1);
2268 } else {
2269 if (iph1->rmconf->dpd_algo == DPD_ALGO_INBOUND_DETECT ||
2270 iph1->rmconf->dpd_algo == DPD_ALGO_BLACKHOLE_DETECT) {
2271 iph1->dpd_r_u = sched_new(iph1->rmconf->dpd_interval,
2272 isakmp_info_monitor_r_u, iph1);
2273 } else {
2274 iph1->dpd_r_u = sched_new(iph1->rmconf->dpd_interval,
2275 isakmp_info_send_r_u, iph1);
2276 }
2277 }
2278
2279 return 0;
2280 }
2281
2282 /*
2283 * punts dpd for later because of some activity that:
2284 * 1) implicitly does dpd (e.g. phase2 exchanges), or
2285 * 2) indicates liveness (e.g. received ike packets).
2286 */
2287 void
2288 isakmp_reschedule_info_monitor_if_pending (struct ph1handle *iph1,
2289 char *reason)
2290 {
2291 if (!iph1 ||
2292 iph1->status != PHASE1ST_ESTABLISHED ||
2293 !iph1->dpd_support ||
2294 !iph1->rmconf->dpd_interval ||
2295 iph1->rmconf->dpd_algo == DPD_ALGO_DEFAULT) {
2296 return;
2297 }
2298
2299 if (!iph1->peer_sent_ike) {
2300 SCHED_KILL(iph1->dpd_r_u);
2301
2302 isakmp_sched_r_u(iph1, 0);
2303
2304 plog(LLV_DEBUG, LOCATION, iph1->remote,
2305 "%s... rescheduling send_r_u.\n",
2306 reason);
2307 }
2308 iph1->peer_sent_ike++;
2309 }
2310 #endif
mirror of ipsec