]> git.saurik.com Git - apple/ipsec.git/blob - ipsec-tools/racoon/isakmp_inf.c
projects / apple / ipsec.git / blob
? search:


7c10ffd85238645eda2a64b62691a125539c9fad
[apple/ipsec.git] / ipsec-tools / racoon / isakmp_inf.c
1 /* $NetBSD: isakmp_inf.c,v 1.14.4.8 2007/08/01 11:52:20 vanhu Exp $ */
2
3 /* Id: isakmp_inf.c,v 1.44 2006/05/06 20:45:52 manubsd Exp */
4
5 /*
6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the project nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34 #include "config.h"
35 #include "racoon_types.h"
36
37 #include <sys/types.h>
38 #include <sys/param.h>
39 #include <sys/socket.h>
40
41 #include <net/pfkeyv2.h>
42 #include <netinet/in.h>
43 #include <sys/queue.h>
44 #ifndef HAVE_NETINET6_IPSEC
45 #include <netinet/ipsec.h>
46 #else
47 #include <netinet6/ipsec.h>
48 #endif
49
50 #include <stdlib.h>
51 #include <stdio.h>
52 #include <string.h>
53 #include <errno.h>
54 #if TIME_WITH_SYS_TIME
55 # include <sys/time.h>
56 # include <time.h>
57 #else
58 # if HAVE_SYS_TIME_H
59 # include <sys/time.h>
60 # else
61 # include <time.h>
62 # endif
63 #endif
64 #ifdef ENABLE_HYBRID
65 #include <resolv.h>
66 #endif
67
68 #include "libpfkey.h"
69
70 #include "var.h"
71 #include "vmbuf.h"
72 #include "schedule.h"
73 #include "str2val.h"
74 #include "misc.h"
75 #include "plog.h"
76 #include "debug.h"
77 #include "fsm.h"
78 #include "session.h"
79 #include "ike_session.h"
80
81 #include "localconf.h"
82 #include "remoteconf.h"
83 #include "sockmisc.h"
84 #include "handler.h"
85 #include "policy.h"
86 #include "proposal.h"
87 #include "isakmp_var.h"
88 #include "isakmp.h"
89 #ifdef ENABLE_HYBRID
90 #include "isakmp_xauth.h"
91 #include "isakmp_unity.h"
92 #include "isakmp_cfg.h"
93 #endif
94 #include "isakmp_inf.h"
95 #include "oakley.h"
96 #include "ipsec_doi.h"
97 #include "crypto_openssl.h"
98 #include "pfkey.h"
99 #include "policy.h"
100 #include "algorithm.h"
101 #include "proposal.h"
102 #include "strnames.h"
103 #ifdef ENABLE_NATT
104 #include "nattraversal.h"
105 #endif
106 #include "vpn_control_var.h"
107 #include "vpn_control.h"
108 #include "ike_session.h"
109 #include "ipsecSessionTracer.h"
110 #include "ipsecMessageTracer.h"
111
112 /* information exchange */
113 static int isakmp_info_recv_n (phase1_handle_t *, struct isakmp_pl_n *, u_int32_t, int);
114 static int isakmp_info_recv_d (phase1_handle_t *, struct isakmp_pl_d *, u_int32_t, int);
115
116 #ifdef ENABLE_DPD
117 static int isakmp_info_recv_r_u (phase1_handle_t *, struct isakmp_pl_ru *, u_int32_t);
118 static int isakmp_info_recv_r_u_ack (phase1_handle_t *, struct isakmp_pl_ru *, u_int32_t);
119 #endif
120
121 #ifdef ENABLE_VPNCONTROL_PORT
122 static int isakmp_info_recv_lb (phase1_handle_t *, struct isakmp_pl_lb *lb, int);
123 #endif
124
125 static int
126 isakmp_ph1_responder_lifetime (phase1_handle_t *iph1, struct isakmp_pl_resp_lifetime *notify)
127 {
128 char *spi;
129
130 if (ntohs(notify->h.len) < sizeof(*notify) + notify->spi_size) {
131 plog(ASL_LEVEL_ERR,
132 "invalid spi_size in notification payload.\n");
133 return -1;
134 }
135 spi = val2str((char *)(notify + 1), notify->spi_size);
136
137 plog(ASL_LEVEL_DEBUG,
138 "notification message ISAKMP-SA RESPONDER-LIFETIME, "
139 "doi=%d proto_id=%d spi=%s(size=%d).\n",
140 ntohl(notify->doi), notify->proto_id, spi, notify->spi_size);
141
142 /* TODO */
143 #if 0
144 struct isakmp_pl_attr *attrpl;
145 int len = ntohs(notify->h.len) - (sizeof(*notify) + notify->spi_size);
146
147 attrpl = (struct isakmp_pl_attr *)((char *)(notify + 1) + notify->spi_size);
148 while (len > 0) {
149 }
150 #endif
151
152 racoon_free(spi);
153 return 0;
154 }
155
156 static int
157 isakmp_ph2_responder_lifetime (phase2_handle_t *iph2, struct isakmp_pl_resp_lifetime *notify)
158 {
159 char *spi;
160
161 if (ntohs(notify->h.len) < sizeof(*notify) + notify->spi_size) {
162 plog(ASL_LEVEL_ERR,
163 "invalid spi_size in notification payload.\n");
164 return -1;
165 }
166 spi = val2str((char *)(notify + 1), notify->spi_size);
167
168 plog(ASL_LEVEL_DEBUG,
169 "notification message IPSEC-SA RESPONDER-LIFETIME, "
170 "doi=%d proto_id=%d spi=%s(size=%d).\n",
171 ntohl(notify->doi), notify->proto_id, spi, notify->spi_size);
172
173 /* TODO */
174
175 racoon_free(spi);
176 return 0;
177 }
178
179 /* \f%%%
180 * Information Exchange
181 */
182 /*
183 * receive Information
184 */
185 int
186 isakmp_info_recv(phase1_handle_t *iph1, vchar_t *msg0)
187 {
188 vchar_t *msg = NULL;
189 vchar_t *pbuf = NULL;
190 u_int32_t msgid = 0;
191 int error = -1;
192 struct isakmp *isakmp;
193 struct isakmp_gen *gen;
194 struct isakmp_parse_t *pa;
195 void *p;
196 vchar_t *hash, *payload;
197 struct isakmp_gen *nd;
198 u_int8_t np;
199 int encrypted;
200 int flag = 0;
201 int disconnect = 0;
202
203 plog(ASL_LEVEL_DEBUG, "receive Information.\n");
204
205 encrypted = ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E);
206 msgid = ((struct isakmp *)msg0->v)->msgid;
207
208 /* Use new IV to decrypt Informational message. */
209 if (encrypted) {
210 struct isakmp_ivm *ivm;
211
212 if (iph1->ivm == NULL) {
213 plog(ASL_LEVEL_ERR, "iph1->ivm == NULL\n");
214 IPSECSESSIONTRACEREVENT(iph1->parent_session,
215 IPSECSESSIONEVENTCODE_IKE_PACKET_RX_FAIL,
216 CONSTSTR("Information message"),
217 CONSTSTR("Failed to process Information Message (no IV)"));
218 return -1;
219 }
220
221 /* compute IV */
222 ivm = oakley_newiv2(iph1, ((struct isakmp *)msg0->v)->msgid);
223 if (ivm == NULL) {
224 plog(ASL_LEVEL_ERR,
225 "failed to compute IV\n");
226 IPSECSESSIONTRACEREVENT(iph1->parent_session,
227 IPSECSESSIONEVENTCODE_IKE_PACKET_RX_FAIL,
228 CONSTSTR("Information message"),
229 CONSTSTR("Failed to process Information Message (can't compute IV)"));
230 return -1;
231 }
232
233 msg = oakley_do_decrypt(iph1, msg0, ivm->iv, ivm->ive);
234 oakley_delivm(ivm);
235 if (msg == NULL) {
236 plog(ASL_LEVEL_ERR,
237 "failed to decrypt packet\n");
238 IPSECSESSIONTRACEREVENT(iph1->parent_session,
239 IPSECSESSIONEVENTCODE_IKE_PACKET_RX_FAIL,
240 CONSTSTR("Information message"),
241 CONSTSTR("Failed to decrypt Information message"));
242 return -1;
243 }
244
245 } else
246 msg = vdup(msg0);
247
248 /* Safety check */
249 if (msg->l < sizeof(*isakmp) + sizeof(*gen)) {
250 plog(ASL_LEVEL_ERR,
251 "ignore information because the "
252 "message is way too short\n");
253 goto end;
254 }
255
256 isakmp = (struct isakmp *)msg->v;
257 gen = (struct isakmp_gen *)((caddr_t)isakmp + sizeof(struct isakmp));
258 np = gen->np;
259
260 if (encrypted) {
261 if (isakmp->np != ISAKMP_NPTYPE_HASH) {
262 plog(ASL_LEVEL_ERR,
263 "ignore information because the "
264 "message has no hash payload.\n");
265 goto end;
266 }
267
268 if (!FSM_STATE_IS_ESTABLISHED(iph1->status) &&
269 (!iph1->approval || !iph1->skeyid_a)) {
270 plog(ASL_LEVEL_ERR,
271 "ignore information because ISAKMP-SA "
272 "has not been established yet.\n");
273 goto end;
274 }
275
276 /* Safety check */
277 if (msg->l < sizeof(*isakmp) + ntohs(gen->len) + sizeof(*nd)) {
278 plog(ASL_LEVEL_ERR,
279 "ignore information because the "
280 "message is too short\n");
281 goto end;
282 }
283
284 p = (caddr_t) gen + sizeof(struct isakmp_gen);
285 nd = (struct isakmp_gen *) ((caddr_t) gen + ntohs(gen->len));
286
287 /* nd length check */
288 if (ntohs(nd->len) > msg->l - (sizeof(struct isakmp) +
289 ntohs(gen->len))) {
290 plog(ASL_LEVEL_ERR,
291 "too long payload length (broken message?)\n");
292 goto end;
293 }
294
295 if (ntohs(nd->len) < sizeof(*nd)) {
296 plog(ASL_LEVEL_ERR,
297 "too short payload length (broken message?)\n");
298 goto end;
299 }
300
301 payload = vmalloc(ntohs(nd->len));
302 if (payload == NULL) {
303 plog(ASL_LEVEL_ERR,
304 "cannot allocate memory\n");
305 goto end;
306 }
307
308 memcpy(payload->v, (caddr_t) nd, ntohs(nd->len));
309
310 /* compute HASH */
311 hash = oakley_compute_hash1(iph1, isakmp->msgid, payload);
312 if (hash == NULL) {
313 plog(ASL_LEVEL_ERR,
314 "cannot compute hash\n");
315
316 vfree(payload);
317 goto end;
318 }
319
320 if (ntohs(gen->len) - sizeof(struct isakmp_gen) != hash->l) {
321 plog(ASL_LEVEL_ERR,
322 "ignore information due to hash length mismatch\n");
323
324 vfree(hash);
325 vfree(payload);
326 goto end;
327 }
328
329 if (timingsafe_bcmp(p, hash->v, hash->l) != 0) {
330 plog(ASL_LEVEL_ERR,
331 "ignore information due to hash mismatch\n");
332
333 vfree(hash);
334 vfree(payload);
335 goto end;
336 }
337
338 plog(ASL_LEVEL_DEBUG, "hash validated.\n");
339
340 vfree(hash);
341 vfree(payload);
342 } else {
343 /* make sure phase 1 was not yet at encrypted state */
344 switch (iph1->etype) {
345 case ISAKMP_ETYPE_AGG:
346 // %%%%% should also check for unity/mode cfg - last pkt is encrypted in such cases
347 if (!FSM_STATE_IS_ESTABLISHED(iph1->status) &&
348 ((iph1->side == INITIATOR && iph1->status == IKEV1_STATE_AGG_I_MSG3SENT) ||
349 (iph1->side == RESPONDER && iph1->status == IKEV1_STATE_AGG_R_MSG3RCVD))) {
350 break;
351 }
352 /*FALLTHRU*/
353 case ISAKMP_ETYPE_IDENT:
354 if (!FSM_STATE_IS_ESTABLISHED(iph1->status) &&
355 ((iph1->side == INITIATOR && (iph1->status == IKEV1_STATE_IDENT_I_MSG5SENT
356 || iph1->status == IKEV1_STATE_IDENT_I_MSG6RCVD)) ||
357 (iph1->side == RESPONDER && (iph1->status == IKEV1_STATE_IDENT_R_MSG5RCVD)))) {
358 break;
359 }
360 /*FALLTHRU*/
361 default:
362 if ((np == ISAKMP_NPTYPE_NONE) &&
363 !FSM_STATE_IS_ESTABLISHED(iph1->status) &&
364 (iph1->side == INITIATOR && (iph1->status == IKEV1_STATE_AGG_I_MSG1SENT))) {
365 // proposal rejected by peer, terminate now.
366 disconnect = 1;
367 }
368
369 plog(ASL_LEVEL_ERR,
370 "%s message must be encrypted, status 0x%x, side %d\n",
371 s_isakmp_nptype(np), iph1->status, iph1->side);
372 error = 0;
373 goto end;
374 }
375 }
376
377 if (!(pbuf = isakmp_parse(msg))) {
378 plog(ASL_LEVEL_ERR,
379 "failed to parse msg");
380 error = -1;
381 goto end;
382 }
383
384 error = 0;
385 for (pa = ALIGNED_CAST(struct isakmp_parse_t *)pbuf->v; pa->type; pa++) { // Wcast-align fix (void*) - aligned buffer of aligned (unpacked) structs
386 switch (pa->type) {
387 case ISAKMP_NPTYPE_HASH:
388 /* Handled above */
389 break;
390 case ISAKMP_NPTYPE_N:
391 if ((ntohs(((struct isakmp_pl_n *)pa->ptr)->type) == ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN) &&
392 !FSM_STATE_IS_ESTABLISHED(iph1->status) &&
393 (iph1->side == INITIATOR && (iph1->status == IKEV1_STATE_AGG_I_MSG1SENT))) {
394 // proposal rejected by peer, terminate now.
395 disconnect = 1;
396 plog(ASL_LEVEL_ERR,
397 "%s message with %s notification receveid, status 0x%x, side %d\n",
398 s_isakmp_nptype(np), s_isakmp_notify_msg(ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN), iph1->status, iph1->side);
399 break;
400 }
401 error = isakmp_info_recv_n(iph1,
402 (struct isakmp_pl_n *)pa->ptr,
403 msgid, encrypted);
404 break;
405 case ISAKMP_NPTYPE_D:
406 error = isakmp_info_recv_d(iph1,
407 (struct isakmp_pl_d *)pa->ptr,
408 msgid, encrypted);
409 break;
410 case ISAKMP_NPTYPE_NONCE:
411 /* XXX to be 6.4.2 ike-01.txt */
412 /* XXX IV is to be synchronized. */
413 plog(ASL_LEVEL_ERR,
414 "ignore Acknowledged Informational\n");
415 break;
416 default:
417 /* don't send information, see isakmp_ident_r1() */
418 error = 0;
419 plog(ASL_LEVEL_ERR,
420 "reject the packet, "
421 "received unexpected payload type %s.\n",
422 s_isakmp_nptype(gen->np));
423 }
424 if(error < 0) {
425 break;
426 } else {
427 flag |= error;
428 }
429 }
430 IPSECSESSIONTRACEREVENT(iph1->parent_session,
431 IPSECSESSIONEVENTCODE_IKE_PACKET_RX_SUCC,
432 CONSTSTR("Information message"),
433 CONSTSTR(NULL));
434
435 end:
436 if (error) {
437 IPSECSESSIONTRACEREVENT(iph1->parent_session,
438 IPSECSESSIONEVENTCODE_IKE_PACKET_RX_FAIL,
439 CONSTSTR("Information message"),
440 CONSTSTR("Failed to process Information Message"));
441 }
442 if (msg != NULL)
443 vfree(msg);
444 if (pbuf != NULL)
445 vfree(pbuf);
446 if (disconnect) {
447 ike_session_t *session = NULL;
448
449 if (session = iph1->parent_session) {
450 gettimeofday(&session->stop_timestamp, NULL);
451 if (!session->term_reason) {
452 session->term_reason = ike_session_stopped_by_peer;
453 }
454 ike_session_purge_ph1s_by_session(session);
455 }
456 }
457 return error;
458 }
459
460 /*
461 * handling of Notification payload
462 */
463 static int
464 isakmp_info_recv_n(phase1_handle_t *iph1, struct isakmp_pl_n *notify, u_int32_t msgid, int encrypted)
465 {
466 u_int type;
467 vchar_t *ndata;
468 char *nraw;
469 size_t l;
470 char *spi;
471
472 type = ntohs(notify->type);
473
474 switch (type) {
475 case ISAKMP_NTYPE_CONNECTED:
476 case ISAKMP_NTYPE_REPLAY_STATUS:
477 #ifdef ENABLE_HYBRID
478 case ISAKMP_NTYPE_UNITY_HEARTBEAT:
479 #endif
480 /* do something */
481 break;
482 case ISAKMP_NTYPE_RESPONDER_LIFETIME:
483 if (encrypted) {
484 return(isakmp_ph1_responder_lifetime(iph1,
485 (struct isakmp_pl_resp_lifetime *)notify));
486 }
487 break;
488 case ISAKMP_NTYPE_INITIAL_CONTACT:
489 if (encrypted) {
490 info_recv_initialcontact(iph1);
491 return 0;
492 }
493 break;
494 #ifdef ENABLE_DPD
495 case ISAKMP_NTYPE_R_U_THERE:
496 if (encrypted)
497 return isakmp_info_recv_r_u(iph1,
498 (struct isakmp_pl_ru *)notify, msgid);
499 break;
500 case ISAKMP_NTYPE_R_U_THERE_ACK:
501 if (encrypted)
502 return isakmp_info_recv_r_u_ack(iph1,
503 (struct isakmp_pl_ru *)notify, msgid);
504 break;
505 #endif
506 #ifdef ENABLE_VPNCONTROL_PORT
507 case ISAKMP_NTYPE_LOAD_BALANCE:
508 isakmp_info_recv_lb(iph1, (struct isakmp_pl_lb *)notify, encrypted);
509 break;
510 #endif
511
512 default:
513 {
514 /* XXX there is a potential of dos attack. */
515 if(type >= ISAKMP_NTYPE_MINERROR &&
516 type <= ISAKMP_NTYPE_MAXERROR) {
517 if (msgid == 0) {
518 /* don't think this realy deletes ph1 ? */
519 plog(ASL_LEVEL_ERR,
520 "Delete Phase 1 handle.\n");
521 return -1;
522 } else {
523 if (ike_session_getph2bymsgid(iph1, msgid) == NULL) {
524 plog(ASL_LEVEL_ERR,
525 "Fatal %s notify messsage, "
526 "Phase 1 should be deleted.\n",
527 s_isakmp_notify_msg(type));
528 } else {
529 plog(ASL_LEVEL_ERR,
530 "Fatal %s notify messsage, "
531 "Phase 2 should be deleted.\n",
532 s_isakmp_notify_msg(type));
533 }
534 }
535 } else {
536 plog(ASL_LEVEL_ERR,
537 "Unhandled notify message %s, "
538 "no Phase 2 handle found.\n",
539 s_isakmp_notify_msg(type));
540 }
541 }
542 break;
543 }
544
545 /* get spi if specified and allocate */
546 if(notify->spi_size > 0) {
547 if (ntohs(notify->h.len) < sizeof(*notify) + notify->spi_size) {
548 plog(ASL_LEVEL_ERR,
549 "Invalid spi_size in notification payload.\n");
550 return -1;
551 }
552 spi = val2str((char *)(notify + 1), notify->spi_size);
553
554 plog(ASL_LEVEL_DEBUG,
555 "Notification message %d:%s, "
556 "doi=%d proto_id=%d spi=%s(size=%d).\n",
557 type, s_isakmp_notify_msg(type),
558 ntohl(notify->doi), notify->proto_id, spi, notify->spi_size);
559
560 racoon_free(spi);
561 }
562
563 /* Send the message data to the logs */
564 if(type >= ISAKMP_NTYPE_MINERROR &&
565 type <= ISAKMP_NTYPE_MAXERROR) {
566 l = ntohs(notify->h.len) - sizeof(*notify) - notify->spi_size;
567 if (l > 0) {
568 nraw = (char*)notify;
569 nraw += sizeof(*notify) + notify->spi_size;
570 if ((ndata = vmalloc(l)) != NULL) {
571 memcpy(ndata->v, nraw, ndata->l);
572 plog(ASL_LEVEL_ERR,
573 "Message: '%s'.\n",
574 binsanitize(ndata->v, ndata->l));
575 vfree(ndata);
576 } else {
577 plog(ASL_LEVEL_ERR,
578 "Cannot allocate memory\n");
579 }
580 }
581 }
582 return 0;
583 }
584
585 #ifdef ENABLE_VPNCONTROL_PORT
586 static void
587 isakmp_info_vpncontrol_notify_ike_failed (phase1_handle_t *iph1, int isakmp_info_initiator, int type, vchar_t *data)
588 {
589 u_int32_t address = iph1_get_remote_v4_address(iph1);
590 u_int32_t fail_reason;
591
592 /* notify the API that we have received the delete */
593
594 if (isakmp_info_initiator == FROM_REMOTE) {
595 int premature = oakley_find_status_in_certchain(iph1->cert, CERT_STATUS_PREMATURE);
596 int expired = oakley_find_status_in_certchain(iph1->cert, CERT_STATUS_EXPIRED);
597
598 if (premature) {
599 fail_reason = VPNCTL_NTYPE_LOCAL_CERT_PREMATURE;
600 plog(ASL_LEVEL_NOTICE, ">>> Server reports client's certificate is pre-mature\n");
601 } else if (expired) {
602 fail_reason = VPNCTL_NTYPE_LOCAL_CERT_EXPIRED;
603 plog(ASL_LEVEL_NOTICE, ">>> Server reports client's certificate is expired\n");
604 } else {
605 fail_reason = type;
606 }
607 vpncontrol_notify_ike_failed(fail_reason, isakmp_info_initiator, address, 0, NULL);
608 return;
609 } else {
610 /* FROM_LOCAL */
611 if (type == ISAKMP_INTERNAL_ERROR ||
612 type <= ISAKMP_NTYPE_UNEQUAL_PAYLOAD_LENGTHS) {
613 int premature = oakley_find_status_in_certchain(iph1->cert_p, CERT_STATUS_PREMATURE);
614 int expired = oakley_find_status_in_certchain(iph1->cert_p, CERT_STATUS_EXPIRED);
615 int subjname = oakley_find_status_in_certchain(iph1->cert_p, CERT_STATUS_INVALID_SUBJNAME);
616 int subjaltname = oakley_find_status_in_certchain(iph1->cert_p, CERT_STATUS_INVALID_SUBJALTNAME);
617
618 if (premature) {
619 fail_reason = VPNCTL_NTYPE_PEER_CERT_PREMATURE;
620 plog(ASL_LEVEL_NOTICE, ">>> Server's certificate is pre-mature\n");
621 } else if (expired) {
622 fail_reason = VPNCTL_NTYPE_PEER_CERT_EXPIRED;
623 plog(ASL_LEVEL_NOTICE, ">>> Server's certificate is expired\n");
624 } else if (subjname) {
625 fail_reason = VPNCTL_NTYPE_PEER_CERT_INVALID_SUBJNAME;
626 plog(ASL_LEVEL_NOTICE, ">>> Server's certificate subject name not valid\n");
627 } else if (subjaltname) {
628 fail_reason = VPNCTL_NTYPE_PEER_CERT_INVALID_SUBJALTNAME;
629 plog(ASL_LEVEL_NOTICE, ">>> Server's certificate subject alternate name not valid\n");
630 } else {
631 fail_reason = type;
632 }
633 (void)vpncontrol_notify_ike_failed(fail_reason, isakmp_info_initiator, address,
634 (data ? data->l : 0), (u_int8_t *)(data ? data->v : NULL));
635 return;
636 }
637 }
638 }
639 #endif /* ENABLE_VPNCONTROL_PORT */
640
641 /*
642 * handling of Deletion payload
643 */
644 static int
645 isakmp_info_recv_d(phase1_handle_t *iph1, struct isakmp_pl_d *delete, u_int32_t msgid, int encrypted)
646 {
647 int tlen, num_spi;
648 phase1_handle_t *del_ph1;
649 union {
650 u_int32_t spi32;
651 u_int16_t spi16[2];
652 } spi;
653
654 if (ntohl(delete->doi) != IPSEC_DOI) {
655 plog(ASL_LEVEL_ERR,
656 "delete payload with invalid doi:%d.\n",
657 ntohl(delete->doi));
658 #ifdef ENABLE_HYBRID
659 /*
660 * At deconnexion time, Cisco VPN client does this
661 * with a zero DOI. Don't give up in that situation.
662 */
663 if (((iph1->mode_cfg->flags &
664 ISAKMP_CFG_VENDORID_UNITY) == 0) || (delete->doi != 0))
665 return 0;
666 #else
667 return 0;
668 #endif
669 }
670
671 num_spi = ntohs(delete->num_spi);
672 tlen = ntohs(delete->h.len) - sizeof(struct isakmp_pl_d);
673
674 if (tlen != num_spi * delete->spi_size) {
675 plog(ASL_LEVEL_ERR,
676 "deletion payload with invalid length.\n");
677 return 0;
678 }
679
680 plog(ASL_LEVEL_DEBUG,
681 "delete payload for protocol %s\n",
682 s_ipsecdoi_proto(delete->proto_id));
683
684 if(!iph1->rmconf->weak_phase1_check && !encrypted) {
685 plog(ASL_LEVEL_WARNING,
686 "Ignoring unencrypted delete payload "
687 "(check the weak_phase1_check option)\n");
688 return 0;
689 }
690
691 switch (delete->proto_id) {
692 case IPSECDOI_PROTO_ISAKMP:
693 if (delete->spi_size != sizeof(isakmp_index)) {
694 plog(ASL_LEVEL_ERR,
695 "delete payload with strange spi "
696 "size %d(proto_id:%d)\n",
697 delete->spi_size, delete->proto_id);
698 return 0;
699 }
700
701 del_ph1 = ike_session_getph1byindex(iph1->parent_session, (isakmp_index *)(delete + 1));
702 if(del_ph1 != NULL){
703
704 // hack: start a rekey now, if one was pending (only for client).
705 if (del_ph1->sce_rekey &&
706 del_ph1->parent_session &&
707 del_ph1->parent_session->is_client &&
708 del_ph1->parent_session->established &&
709 !(del_ph1->rmconf->natt_multiple_user &&
710 del_ph1->parent_session->is_l2tpvpn_ipsec)) {
711 isakmp_ph1rekeyexpire(del_ph1, FALSE);
712 }
713
714 if (del_ph1->scr)
715 SCHED_KILL(del_ph1->scr);
716
717 /*
718 * Do not delete IPsec SAs when receiving an IKE delete notification.
719 * Just delete the IKE SA.
720 */
721 #ifdef ENABLE_VPNCONTROL_PORT
722 if (del_ph1->started_by_api || (del_ph1->is_rekey && del_ph1->parent_session && del_ph1->parent_session->is_client)) {
723 if (ike_session_islast_ph1(del_ph1)) {
724 isakmp_info_vpncontrol_notify_ike_failed(del_ph1, FROM_REMOTE, VPNCTL_NTYPE_PH1_DELETE, NULL);
725 }
726 }
727 #endif
728 if (del_ph1->rmconf->natt_multiple_user &&
729 del_ph1->parent_session->is_l2tpvpn_ipsec) {
730 plog(ASL_LEVEL_DEBUG, "Ignoring IKE delete from peer for L2TP server\n");
731 break;
732 }
733 isakmp_ph1expire(del_ph1);
734 }
735 break;
736
737 case IPSECDOI_PROTO_IPSEC_AH:
738 case IPSECDOI_PROTO_IPSEC_ESP:
739 if (delete->spi_size != sizeof(u_int32_t)) {
740 plog(ASL_LEVEL_ERR,
741 "delete payload with strange spi "
742 "size %d(proto_id:%d)\n",
743 delete->spi_size, delete->proto_id);
744 return 0;
745 }
746 if (iph1->rmconf->natt_multiple_user &&
747 iph1->parent_session->is_l2tpvpn_ipsec) {
748 uint32_t *ph2_spi = ALIGNED_CAST(u_int32_t *)(delete + 1);
749 phase2_handle_t *iph2 = ike_session_getph2bysaidx(iph1->local, iph1->remote, delete->proto_id, ph2_spi[0]);
750
751 if (iph2 != NULL) {
752 iph2->is_defunct = 1;
753 plog(ASL_LEVEL_DEBUG, "Ignoring SA delete from peer for L2TP server\n");
754 break;
755 }
756 }
757 purge_ipsec_spi(iph1->remote, delete->proto_id,
758 ALIGNED_CAST(u_int32_t *)(delete + 1), num_spi, NULL, NULL); // Wcast-align fix (void*) - delete payload is aligned
759 break;
760
761 case IPSECDOI_PROTO_IPCOMP:
762 /* need to handle both 16bit/32bit SPI */
763 memset(&spi, 0, sizeof(spi));
764 if (delete->spi_size == sizeof(spi.spi16[1])) {
765 memcpy(&spi.spi16[1], delete + 1,
766 sizeof(spi.spi16[1]));
767 } else if (delete->spi_size == sizeof(spi.spi32))
768 memcpy(&spi.spi32, delete + 1, sizeof(spi.spi32));
769 else {
770 plog(ASL_LEVEL_ERR,
771 "delete payload with strange spi "
772 "size %d(proto_id:%d)\n",
773 delete->spi_size, delete->proto_id);
774 return 0;
775 }
776 purge_ipsec_spi(iph1->remote, delete->proto_id,
777 &spi.spi32, num_spi, NULL, NULL);
778 break;
779
780 default:
781 plog(ASL_LEVEL_ERR,
782 "deletion message received, "
783 "invalid proto_id: %d\n",
784 delete->proto_id);
785 return 0;
786 }
787
788 plog(ASL_LEVEL_DEBUG, "purged SAs.\n");
789
790 return 0;
791 }
792
793 /*
794 * send Delete payload (for ISAKMP SA) in Informational exchange.
795 */
796 int
797 isakmp_info_send_d1(phase1_handle_t *iph1)
798 {
799 struct isakmp_pl_d *d;
800 vchar_t *payload = NULL;
801 int tlen;
802 int error = 0;
803
804 if (!FSM_STATE_IS_ESTABLISHED(iph1->status))
805 return 0;
806
807 /* create delete payload */
808
809 /* send SPIs of inbound SAs. */
810 /* XXX should send outbound SAs's ? */
811 tlen = sizeof(*d) + sizeof(isakmp_index);
812 payload = vmalloc(tlen);
813 if (payload == NULL) {
814 plog(ASL_LEVEL_ERR,
815 "failed to get buffer for payload.\n");
816 return errno;
817 }
818
819 d = (struct isakmp_pl_d *)payload->v;
820 d->h.np = ISAKMP_NPTYPE_NONE;
821 d->h.len = htons(tlen);
822 d->doi = htonl(IPSEC_DOI);
823 d->proto_id = IPSECDOI_PROTO_ISAKMP;
824 d->spi_size = sizeof(isakmp_index);
825 d->num_spi = htons(1);
826 memcpy(d + 1, &iph1->index, sizeof(isakmp_index));
827
828 error = isakmp_info_send_common(iph1, payload,
829 ISAKMP_NPTYPE_D, 0);
830 vfree(payload);
831 if (error) {
832 IPSECSESSIONTRACEREVENT(iph1->parent_session,
833 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_FAIL,
834 CONSTSTR("Delete ISAKMP-SA"),
835 CONSTSTR("Failed to transmit Delete-ISAKMP-SA message"));
836 } else {
837 IPSECSESSIONTRACEREVENT(iph1->parent_session,
838 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_SUCC,
839 CONSTSTR("Delete ISAKMP-SA"),
840 CONSTSTR(NULL));
841 }
842
843 return error;
844 }
845
846 /*
847 * send Delete payload (for IPsec SA) in Informational exchange, based on
848 * pfkey msg. It sends always single SPI.
849 */
850 int
851 isakmp_info_send_d2(phase2_handle_t *iph2)
852 {
853 phase1_handle_t *iph1;
854 struct saproto *pr;
855 struct isakmp_pl_d *d;
856 vchar_t *payload = NULL;
857 int tlen;
858 int error = 0;
859 u_int8_t *spi;
860
861 if (!FSM_STATE_IS_ESTABLISHED(iph2->status))
862 return 0;
863
864 /*
865 * don't send delete information if there is no phase 1 handler.
866 * It's nonsensical to negotiate phase 1 to send the information.
867 */
868 iph1 = ike_session_get_established_ph1(iph2->parent_session);
869 if (!iph1) {
870 iph1 = ike_session_getph1byaddr(iph2->parent_session, iph2->src, iph2->dst);
871 }
872 if (iph1 == NULL){
873 IPSECSESSIONTRACEREVENT(iph2->parent_session,
874 IPSECSESSIONEVENTCODE_IKE_PACKET_TX_FAIL,
875 CONSTSTR("Information message"),
876 CONSTSTR("Failed to transmit Information message"));
877 IPSECSESSIONTRACEREVENT(iph2->parent_session,
878 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_FAIL,
879 CONSTSTR("Delete IPSEC-SA"),
880 CONSTSTR("Failed to transmit Delete-IPSEC-SA message"));
881 plog(ASL_LEVEL_DEBUG,
882 "No ph1 handler found, could not send DELETE_SA\n");
883 return 0;
884 }
885
886 /* create delete payload */
887 for (pr = iph2->approval->head; pr != NULL; pr = pr->next) {
888
889 /* send SPIs of inbound SAs. */
890 /*
891 * XXX should I send outbound SAs's ?
892 * I send inbound SAs's SPI only at the moment because I can't
893 * decode any more if peer send encoded packet without aware of
894 * deletion of SA. Outbound SAs don't come under the situation.
895 */
896 tlen = sizeof(*d) + pr->spisize;
897 payload = vmalloc(tlen);
898 if (payload == NULL) {
899 IPSECSESSIONTRACEREVENT(iph2->parent_session,
900 IPSECSESSIONEVENTCODE_IKE_PACKET_TX_FAIL,
901 CONSTSTR("Information message"),
902 CONSTSTR("Failed to transmit Information message"));
903 IPSECSESSIONTRACEREVENT(iph2->parent_session,
904 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_FAIL,
905 CONSTSTR("Delete IPSEC-SA"),
906 CONSTSTR("Failed to transmit Delete-IPSEC-SA message"));
907 plog(ASL_LEVEL_ERR,
908 "failed to get buffer for payload.\n");
909 return errno;
910 }
911
912 d = (struct isakmp_pl_d *)payload->v;
913 d->h.np = ISAKMP_NPTYPE_NONE;
914 d->h.len = htons(tlen);
915 d->doi = htonl(IPSEC_DOI);
916 d->proto_id = pr->proto_id;
917 d->spi_size = pr->spisize;
918 d->num_spi = htons(1);
919 /*
920 * XXX SPI bits are left-filled, for use with IPComp.
921 * we should be switching to variable-length spi field...
922 */
923 spi = (u_int8_t *)&pr->spi;
924 spi += sizeof(pr->spi);
925 spi -= pr->spisize;
926 memcpy(d + 1, spi, pr->spisize);
927
928 error = isakmp_info_send_common(iph1, payload,
929 ISAKMP_NPTYPE_D, 0);
930 vfree(payload);
931 if (error) {
932 IPSECSESSIONTRACEREVENT(iph2->parent_session,
933 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_FAIL,
934 CONSTSTR("Delete IPSEC-SA"),
935 CONSTSTR("Failed to transmit Delete-IPSEC-SA"));
936 } else {
937 IPSECSESSIONTRACEREVENT(iph2->parent_session,
938 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_SUCC,
939 CONSTSTR("Delete IPSEC-SA"),
940 CONSTSTR(NULL));
941 }
942 }
943
944 return error;
945 }
946
947 /*
948 * send Notification payload (without ISAKMP SA) in an Informational exchange
949 */
950 int
951 isakmp_info_send_nx(struct isakmp *isakmp, struct sockaddr_storage *remote, struct sockaddr_storage *local,
952 int type, vchar_t *data)
953 {
954 phase1_handle_t *iph1 = NULL;
955 struct remoteconf *rmconf;
956 vchar_t *payload = NULL;
957 int tlen;
958 int error = -1;
959 struct isakmp_pl_n *n;
960 int spisiz = 0; /* see below */
961 ike_session_t *sess = ike_session_get_session(local, remote, FALSE, NULL);
962
963 /* search appropreate configuration */
964 rmconf = getrmconf(remote);
965 if (rmconf == NULL) {
966 IPSECSESSIONTRACEREVENT(sess,
967 IPSECSESSIONEVENTCODE_IKE_PACKET_TX_FAIL,
968 CONSTSTR("Information message"),
969 CONSTSTR("Failed to transmit Information message (no remote configuration)"));
970 plog(ASL_LEVEL_ERR,
971 "no configuration found for peer address.\n");
972 goto end;
973 }
974
975 /* add new entry to isakmp status table. */
976 iph1 = ike_session_newph1(ISAKMP_VERSION_NUMBER_IKEV1);
977 if (iph1 == NULL) {
978 IPSECSESSIONTRACEREVENT(sess,
979 IPSECSESSIONEVENTCODE_IKE_PACKET_TX_FAIL,
980 CONSTSTR("Information message"),
981 CONSTSTR("Failed to transmit Information message (no new Phase 1)"));
982 plog(ASL_LEVEL_ERR,
983 "failed to allocate ph1");
984 return -1;
985 }
986
987 memcpy(&iph1->index.i_ck, &isakmp->i_ck, sizeof(cookie_t));
988 isakmp_newcookie((char *)&iph1->index.r_ck, remote, local);
989 fsm_set_state(&iph1->status, IKEV1_STATE_INFO);
990 iph1->rmconf = rmconf;
991 retain_rmconf(iph1->rmconf);
992 iph1->side = INITIATOR;
993 iph1->version = isakmp->v;
994 iph1->flags = 0;
995 iph1->msgid = 0; /* XXX */
996 #ifdef ENABLE_HYBRID
997 if ((iph1->mode_cfg = isakmp_cfg_mkstate()) == NULL) {
998 error = -1;
999 goto end;
1000 }
1001 #endif
1002 #ifdef ENABLE_FRAG
1003 iph1->frag = 0;
1004 iph1->frag_chain = NULL;
1005 #endif
1006
1007 /* copy remote address */
1008 if (copy_ph1addresses(iph1, rmconf, remote, local) < 0) {
1009 IPSECSESSIONTRACEREVENT(sess,
1010 IPSECSESSIONEVENTCODE_IKE_PACKET_TX_FAIL,
1011 CONSTSTR("Information message"),
1012 CONSTSTR("Failed to transmit Information Message (can't copy Phase 1 addresses)"));
1013 plog(ASL_LEVEL_ERR,
1014 "failed to copy ph1 addresses");
1015 error = -1;
1016 iph1 = NULL; /* deleted in copy_ph1addresses */
1017 goto end;
1018 }
1019
1020 tlen = sizeof(*n) + spisiz;
1021 if (data)
1022 tlen += data->l;
1023 payload = vmalloc(tlen);
1024 if (payload == NULL) {
1025 IPSECSESSIONTRACEREVENT(sess,
1026 IPSECSESSIONEVENTCODE_IKE_PACKET_TX_FAIL,
1027 CONSTSTR("Information message"),
1028 CONSTSTR("Failed to transmit Information Message (can't allocate payload)"));
1029 plog(ASL_LEVEL_ERR,
1030 "failed to get buffer to send.\n");
1031 error = -1;
1032 goto end;
1033 }
1034
1035 n = (struct isakmp_pl_n *)payload->v;
1036 n->h.np = ISAKMP_NPTYPE_NONE;
1037 n->h.len = htons(tlen);
1038 n->doi = htonl(IPSEC_DOI);
1039 n->proto_id = IPSECDOI_KEY_IKE;
1040 n->spi_size = spisiz;
1041 n->type = htons(type);
1042 if (spisiz)
1043 memset(n + 1, 0, spisiz); /* XXX spisiz is always 0 */
1044 if (data)
1045 memcpy((caddr_t)(n + 1) + spisiz, data->v, data->l);
1046
1047 #ifdef ENABLE_VPNCONTROL_PORT
1048 isakmp_info_vpncontrol_notify_ike_failed(iph1, FROM_LOCAL, type, data);
1049 #endif
1050 if (ike_session_link_phase1(sess, iph1))
1051 fatal_error(-1);
1052
1053 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 0);
1054 vfree(payload);
1055 if (error) {
1056 IPSECSESSIONTRACEREVENT(sess,
1057 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_FAIL,
1058 CONSTSTR("Without ISAKMP-SA"),
1059 CONSTSTR("Failed to transmit Without-ISAKMP-SA message"));
1060 } else {
1061 IPSECSESSIONTRACEREVENT(sess,
1062 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_SUCC,
1063 CONSTSTR("Without ISAKMP-SA"),
1064 CONSTSTR(NULL));
1065 }
1066
1067 end:
1068 if (iph1 != NULL)
1069 ike_session_unlink_phase1(iph1);
1070
1071 return error;
1072 }
1073
1074 /*
1075 * send Notification payload (with ISAKMP SA) in an Informational exchange
1076 */
1077 int
1078 isakmp_info_send_n1(phase1_handle_t *iph1, int type, vchar_t *data)
1079 {
1080 vchar_t *payload = NULL;
1081 int tlen;
1082 int error = 0;
1083 struct isakmp_pl_n *n;
1084 int spisiz;
1085
1086 /*
1087 * note on SPI size: which description is correct? I have chosen
1088 * this to be 0.
1089 *
1090 * RFC2408 3.1, 2nd paragraph says: ISAKMP SA is identified by
1091 * Initiator/Responder cookie and SPI has no meaning, SPI size = 0.
1092 * RFC2408 3.1, first paragraph on page 40: ISAKMP SA is identified
1093 * by cookie and SPI has no meaning, 0 <= SPI size <= 16.
1094 * RFC2407 4.6.3.3, INITIAL-CONTACT is required to set to 16.
1095 */
1096 if (type == ISAKMP_NTYPE_INITIAL_CONTACT ||
1097 type == ISAKMP_NTYPE_LOAD_BALANCE)
1098 spisiz = sizeof(isakmp_index);
1099 else
1100 spisiz = 0;
1101
1102 tlen = sizeof(*n) + spisiz;
1103 if (data)
1104 tlen += data->l;
1105 payload = vmalloc(tlen);
1106 if (payload == NULL) {
1107 IPSECSESSIONTRACEREVENT(iph1->parent_session,
1108 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_FAIL,
1109 CONSTSTR("ISAKMP-SA"),
1110 CONSTSTR("Failed to transmit ISAKMP-SA message (can't allocate payload)"));
1111 plog(ASL_LEVEL_ERR,
1112 "failed to get buffer to send.\n");
1113 return errno;
1114 }
1115
1116 n = (struct isakmp_pl_n *)payload->v;
1117 n->h.np = ISAKMP_NPTYPE_NONE;
1118 n->h.len = htons(tlen);
1119 n->doi = htonl(iph1->rmconf->doitype);
1120 n->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX to be configurable ? */
1121 n->spi_size = spisiz;
1122 n->type = htons(type);
1123 if (spisiz)
1124 memcpy(n + 1, &iph1->index, sizeof(isakmp_index));
1125 if (data)
1126 memcpy((caddr_t)(n + 1) + spisiz, data->v, data->l);
1127
1128 #ifdef ENABLE_VPNCONTROL_PORT
1129 isakmp_info_vpncontrol_notify_ike_failed(iph1, FROM_LOCAL, type, data);
1130 #endif
1131
1132 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, iph1->flags);
1133 vfree(payload);
1134 if (error) {
1135 IPSECSESSIONTRACEREVENT(iph1->parent_session,
1136 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_FAIL,
1137 CONSTSTR("ISAKMP-SA"),
1138 CONSTSTR("Can't transmit ISAKMP-SA message"));
1139 } else {
1140 IPSECSESSIONTRACEREVENT(iph1->parent_session,
1141 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_SUCC,
1142 CONSTSTR("ISAKMP-SA"),
1143 CONSTSTR(NULL));
1144 }
1145
1146 return error;
1147 }
1148
1149 /*
1150 * send Notification payload (with IPsec SA) in an Informational exchange
1151 */
1152 int
1153 isakmp_info_send_n2(phase2_handle_t *iph2, int type, vchar_t *data)
1154 {
1155 phase1_handle_t *iph1 = iph2->ph1;
1156 vchar_t *payload = NULL;
1157 int tlen;
1158 int error = 0;
1159 struct isakmp_pl_n *n;
1160 struct saproto *pr;
1161
1162 if (!iph2->approval)
1163 return EINVAL;
1164
1165 pr = iph2->approval->head;
1166
1167 /* XXX must be get proper spi */
1168 tlen = sizeof(*n) + pr->spisize;
1169 if (data)
1170 tlen += data->l;
1171 payload = vmalloc(tlen);
1172 if (payload == NULL) {
1173 IPSECSESSIONTRACEREVENT(iph2->parent_session,
1174 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_FAIL,
1175 CONSTSTR("IPSEC-SA"),
1176 CONSTSTR("Failed to transmit IPSEC-SA message (can't allocate payload)"));
1177 plog(ASL_LEVEL_ERR,
1178 "failed to get buffer to send.\n");
1179 return errno;
1180 }
1181
1182 n = (struct isakmp_pl_n *)payload->v;
1183 n->h.np = ISAKMP_NPTYPE_NONE;
1184 n->h.len = htons(tlen);
1185 n->doi = htonl(IPSEC_DOI); /* IPSEC DOI (1) */
1186 n->proto_id = pr->proto_id; /* IPSEC AH/ESP/whatever*/
1187 n->spi_size = pr->spisize;
1188 n->type = htons(type);
1189 memcpy(n + 1, &pr->spi, sizeof(u_int32_t)); // Wcast-align fix - copy instead of assign
1190 if (data)
1191 memcpy((caddr_t)(n + 1) + pr->spisize, data->v, data->l);
1192
1193 iph2->flags |= ISAKMP_FLAG_E; /* XXX Should we do FLAG_A ? */
1194 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, iph2->flags);
1195 vfree(payload);
1196 if (error) {
1197 IPSECSESSIONTRACEREVENT(iph2->parent_session,
1198 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_FAIL,
1199 CONSTSTR("IPSEC-SA"),
1200 CONSTSTR("Failed to transmit IPSEC-SA message"));
1201 } else {
1202 IPSECSESSIONTRACEREVENT(iph2->parent_session,
1203 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_SUCC,
1204 CONSTSTR("IPSEC-SA"),
1205 CONSTSTR(NULL));
1206 }
1207
1208 return error;
1209 }
1210
1211 /*
1212 * send Information
1213 * When ph1->skeyid_a == NULL, send message without encoding.
1214 */
1215 int
1216 isakmp_info_send_common(phase1_handle_t *iph1, vchar_t *payload, u_int32_t np, int flags)
1217 {
1218 phase2_handle_t *iph2 = NULL;
1219 vchar_t *hash = NULL;
1220 struct isakmp *isakmp;
1221 struct isakmp_gen *gen;
1222 char *p;
1223 int tlen;
1224 int error = -1;
1225
1226 /* add new entry to isakmp status table */
1227 iph2 = ike_session_newph2(ISAKMP_VERSION_NUMBER_IKEV1, PHASE2_TYPE_INFO);
1228 if (iph2 == NULL) {
1229 plog(ASL_LEVEL_ERR,
1230 "failed to allocate ph2");
1231 goto end;
1232 }
1233
1234 iph2->dst = dupsaddr(iph1->remote);
1235 if (iph2->dst == NULL) {
1236 plog(ASL_LEVEL_ERR,
1237 "failed to duplicate remote address");
1238 ike_session_delph2(iph2);
1239 goto end;
1240 }
1241 iph2->src = dupsaddr(iph1->local);
1242 if (iph2->src == NULL) {
1243 plog(ASL_LEVEL_ERR,
1244 "failed to duplicate local address");
1245 ike_session_delph2(iph2);
1246 goto end;
1247 }
1248 switch (iph1->remote->ss_family) {
1249 case AF_INET:
1250 #if (!defined(ENABLE_NATT)) || (defined(BROKEN_NATT))
1251 ((struct sockaddr_in *)iph2->dst)->sin_port = 0;
1252 ((struct sockaddr_in *)iph2->src)->sin_port = 0;
1253 #endif
1254 break;
1255 #ifdef INET6
1256 case AF_INET6:
1257 #if (!defined(ENABLE_NATT)) || (defined(BROKEN_NATT))
1258 ((struct sockaddr_in6 *)iph2->dst)->sin6_port = 0;
1259 ((struct sockaddr_in6 *)iph2->src)->sin6_port = 0;
1260 #endif
1261 break;
1262 #endif
1263 default:
1264 plog(ASL_LEVEL_ERR,
1265 "invalid family: %d\n", iph1->remote->ss_family);
1266 ike_session_delph2(iph2);
1267 goto end;
1268 }
1269 iph2->side = INITIATOR;
1270 fsm_set_state(&iph2->status, IKEV1_STATE_INFO);
1271 iph2->msgid = isakmp_newmsgid2(iph1);
1272
1273 /* get IV and HASH(1) if skeyid_a was generated. */
1274 if (iph1->skeyid_a != NULL) {
1275 iph2->ivm = oakley_newiv2(iph1, iph2->msgid);
1276 if (iph2->ivm == NULL) {
1277 plog(ASL_LEVEL_ERR,
1278 "failed to generate IV");
1279 ike_session_delph2(iph2);
1280 goto end;
1281 }
1282
1283 /* generate HASH(1) */
1284 hash = oakley_compute_hash1(iph1, iph2->msgid, payload);
1285 if (hash == NULL) {
1286 plog(ASL_LEVEL_ERR,
1287 "failed to generate HASH");
1288 ike_session_delph2(iph2);
1289 goto end;
1290 }
1291
1292 /* initialized total buffer length */
1293 tlen = hash->l;
1294 tlen += sizeof(*gen);
1295 } else {
1296 /* IKE-SA is not established */
1297 hash = NULL;
1298
1299 /* initialized total buffer length */
1300 tlen = 0;
1301 }
1302 if ((flags & ISAKMP_FLAG_A) == 0)
1303 iph2->flags = (hash == NULL ? 0 : ISAKMP_FLAG_E);
1304 else
1305 iph2->flags = (hash == NULL ? 0 : ISAKMP_FLAG_A);
1306
1307 ike_session_link_ph2_to_ph1(iph1, iph2);
1308
1309 tlen += sizeof(*isakmp) + payload->l;
1310
1311 /* create buffer for isakmp payload */
1312 iph2->sendbuf = vmalloc(tlen);
1313 if (iph2->sendbuf == NULL) {
1314 plog(ASL_LEVEL_ERR,
1315 "failed to get buffer to send.\n");
1316 goto err;
1317 }
1318
1319 /* create isakmp header */
1320 isakmp = (struct isakmp *)iph2->sendbuf->v;
1321 memcpy(&isakmp->i_ck, &iph1->index.i_ck, sizeof(cookie_t));
1322 memcpy(&isakmp->r_ck, &iph1->index.r_ck, sizeof(cookie_t));
1323 isakmp->np = hash == NULL ? (np & 0xff) : ISAKMP_NPTYPE_HASH;
1324 isakmp->v = iph1->version;
1325 isakmp->etype = ISAKMP_ETYPE_INFO;
1326 isakmp->flags = iph2->flags;
1327 memcpy(&isakmp->msgid, &iph2->msgid, sizeof(isakmp->msgid));
1328 isakmp->len = htonl(tlen);
1329 p = (char *)(isakmp + 1);
1330
1331 /* create HASH payload */
1332 if (hash != NULL) {
1333 gen = (struct isakmp_gen *)p;
1334 gen->np = np & 0xff;
1335 gen->len = htons(sizeof(*gen) + hash->l);
1336 p += sizeof(*gen);
1337 memcpy(p, hash->v, hash->l);
1338 p += hash->l;
1339 }
1340
1341 /* add payload */
1342 memcpy(p, payload->v, payload->l);
1343 p += payload->l;
1344
1345 #ifdef HAVE_PRINT_ISAKMP_C
1346 isakmp_printpacket(iph2->sendbuf, iph1->local, iph1->remote, 1);
1347 #endif
1348
1349 /* encoding */
1350 if (ISSET(isakmp->flags, ISAKMP_FLAG_E)) {
1351 vchar_t *tmp;
1352
1353 tmp = oakley_do_encrypt(iph2->ph1, iph2->sendbuf, iph2->ivm->ive,
1354 iph2->ivm->iv);
1355 VPTRINIT(iph2->sendbuf);
1356 if (tmp == NULL) {
1357 plog(ASL_LEVEL_ERR,
1358 "failed to encrypt packet");
1359 goto err;
1360 }
1361 iph2->sendbuf = tmp;
1362 }
1363
1364 /* HDR*, HASH(1), N */
1365 if (isakmp_send(iph2->ph1, iph2->sendbuf) < 0) {
1366 plog(ASL_LEVEL_ERR,
1367 "failed to send packet");
1368 VPTRINIT(iph2->sendbuf);
1369 goto err;
1370 }
1371
1372 plog(ASL_LEVEL_DEBUG,
1373 "sendto Information %s.\n", s_isakmp_nptype(np));
1374
1375 /*
1376 * don't resend notify message because peer can use Acknowledged
1377 * Informational if peer requires the reply of the notify message.
1378 */
1379
1380 /* XXX If Acknowledged Informational required, don't delete ph2handle */
1381 error = 0;
1382 VPTRINIT(iph2->sendbuf);
1383 IPSECSESSIONTRACEREVENT(iph1->parent_session,
1384 IPSECSESSIONEVENTCODE_IKE_PACKET_TX_SUCC,
1385 CONSTSTR("Information message"),
1386 CONSTSTR(NULL));
1387
1388 goto err; /* XXX */
1389
1390 end:
1391 if (error) {
1392 IPSECSESSIONTRACEREVENT(iph1->parent_session,
1393 IPSECSESSIONEVENTCODE_IKE_PACKET_TX_FAIL,
1394 CONSTSTR("Information message"),
1395 CONSTSTR("Failed to transmit Information message"));
1396 }
1397 if (hash)
1398 vfree(hash);
1399 return error;
1400
1401 err:
1402 ike_session_unlink_phase2(iph2);
1403 goto end;
1404 }
1405
1406 /*
1407 * add a notify payload to buffer by reallocating buffer.
1408 * If buf == NULL, the function only create a notify payload.
1409 *
1410 * XXX Which is SPI to be included, inbound or outbound ?
1411 */
1412 vchar_t *
1413 isakmp_add_pl_n(vchar_t *buf0, u_int8_t **np_p, int type, struct saproto *pr, vchar_t *data)
1414 {
1415 vchar_t *buf = NULL;
1416 struct isakmp_pl_n *n;
1417 int tlen;
1418 int oldlen = 0;
1419
1420 if (*np_p)
1421 **np_p = ISAKMP_NPTYPE_N;
1422
1423 tlen = sizeof(*n) + pr->spisize;
1424
1425 if (data)
1426 tlen += data->l;
1427 if (buf0) {
1428 oldlen = buf0->l;
1429 buf = vrealloc(buf0, buf0->l + tlen);
1430 } else
1431 buf = vmalloc(tlen);
1432 if (!buf) {
1433 plog(ASL_LEVEL_ERR,
1434 "failed to get a payload buffer.\n");
1435 return NULL;
1436 }
1437
1438 n = (struct isakmp_pl_n *)(buf->v + oldlen);
1439 n->h.np = ISAKMP_NPTYPE_NONE;
1440 n->h.len = htons(tlen);
1441 n->doi = htonl(IPSEC_DOI); /* IPSEC DOI (1) */
1442 n->proto_id = pr->proto_id; /* IPSEC AH/ESP/whatever*/
1443 n->spi_size = pr->spisize;
1444 n->type = htons(type);
1445 memcpy(n + 1, &pr->spi, sizeof(u_int32_t)); // Wcast-align fix - copy instead of assign with cast
1446 if (data)
1447 memcpy((caddr_t)(n + 1) + pr->spisize, data->v, data->l);
1448
1449 /* save the pointer of next payload type */
1450 *np_p = &n->h.np;
1451
1452 return buf;
1453 }
1454
1455
1456 void
1457 purge_ipsec_spi(struct sockaddr_storage *dst0, int proto, u_int32_t *spi /*network byteorder*/, size_t n, u_int32_t *inbound_spi, size_t *max_inbound_spi)
1458 {
1459 vchar_t *buf = NULL;
1460 struct sadb_msg *msg, *next, *end;
1461 struct sadb_sa *sa;
1462 struct sadb_lifetime *lt;
1463 struct sockaddr_storage *src, *dst;
1464 phase2_handle_t *iph2;
1465 u_int64_t created;
1466 size_t i, j = 0;
1467 caddr_t mhp[SADB_EXT_MAX + 1];
1468
1469 buf = pfkey_dump_sadb(ipsecdoi2pfkey_proto(proto));
1470 if (buf == NULL) {
1471 plog(ASL_LEVEL_DEBUG,
1472 "pfkey_dump_sadb returned nothing.\n");
1473 return;
1474 }
1475
1476 msg = ALIGNED_CAST(struct sadb_msg *)buf->v;
1477 end = ALIGNED_CAST(struct sadb_msg *)(buf->v + buf->l);
1478
1479 while (msg < end) {
1480 if ((msg->sadb_msg_len << 3) < sizeof(*msg))
1481 break;
1482 next = ALIGNED_CAST(struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3));
1483 if (msg->sadb_msg_type != SADB_DUMP) {
1484 msg = next;
1485 continue;
1486 }
1487
1488 if (pfkey_align(msg, mhp) || pfkey_check(mhp)) {
1489 plog(ASL_LEVEL_ERR,
1490 "pfkey_check (%s)\n", ipsec_strerror());
1491 msg = next;
1492 continue;
1493 }
1494
1495 sa = ALIGNED_CAST(struct sadb_sa *)(mhp[SADB_EXT_SA]); // Wcast-align fix (void*) - buffer of pointers to aligned structs
1496 if (!sa
1497 || !mhp[SADB_EXT_ADDRESS_SRC]
1498 || !mhp[SADB_EXT_ADDRESS_DST]) {
1499 msg = next;
1500 continue;
1501 }
1502 src = ALIGNED_CAST(struct sockaddr_storage*)PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]); // Wcast-align fix (void*) - buffer of pointers to aligned structs
1503 dst = ALIGNED_CAST(struct sockaddr_storage*)PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
1504 lt = ALIGNED_CAST(struct sadb_lifetime*)mhp[SADB_EXT_LIFETIME_HARD];
1505 if(lt != NULL)
1506 created = lt->sadb_lifetime_addtime;
1507 else
1508 created = 0;
1509
1510 if (sa->sadb_sa_state != SADB_SASTATE_MATURE
1511 && sa->sadb_sa_state != SADB_SASTATE_DYING) {
1512 msg = next;
1513 continue;
1514 }
1515
1516 /* XXX n^2 algorithm, inefficient */
1517
1518 /* don't delete inbound SAs at the moment (just save them in inbound_spi) */
1519 /* XXX should we remove SAs with opposite direction as well? */
1520 if (CMPSADDR2(dst0, dst)) {
1521 msg = next;
1522 continue;
1523 }
1524
1525 for (i = 0; i < n; i++) {
1526 u_int32_t *i_spi;
1527
1528 if (spi[i] != sa->sadb_sa_spi)
1529 continue;
1530
1531 /*
1532 * delete a relative phase 2 handler.
1533 * continue to process if no relative phase 2 handler
1534 * exists.
1535 */
1536 if (inbound_spi && max_inbound_spi && j < *max_inbound_spi) {
1537 i_spi = &inbound_spi[j];
1538 } else {
1539 i_spi = NULL;
1540 }
1541 iph2 = ike_session_getph2bysaidx2(src, dst, proto, spi[i], i_spi);
1542
1543 pfkey_send_delete(lcconf->sock_pfkey,
1544 msg->sadb_msg_satype,
1545 IPSEC_MODE_ANY,
1546 src, dst, sa->sadb_sa_spi);
1547
1548 if(iph2 != NULL){
1549 delete_spd(iph2);
1550 ike_session_unlink_phase2(iph2);
1551 if (i_spi) {
1552 j++;
1553 }
1554 }
1555
1556 plog(ASL_LEVEL_INFO, "Purged IPsec-SA proto_id=%s spi=%u.\n",
1557 s_ipsecdoi_proto(proto),
1558 ntohl(spi[i]));
1559 }
1560
1561 msg = next;
1562 }
1563
1564 if (max_inbound_spi) {
1565 *max_inbound_spi = j;
1566 }
1567
1568 if (buf)
1569 vfree(buf);
1570 }
1571
1572 /*
1573 * delete all phase2 sa relatived to the destination address.
1574 * Don't delete Phase 1 handlers on INITIAL-CONTACT, and don't ignore
1575 * an INITIAL-CONTACT if we have contacted the peer. This matches the
1576 * Sun IKE behavior, and makes rekeying work much better when the peer
1577 * restarts.
1578 */
1579 void
1580 info_recv_initialcontact(phase1_handle_t *iph1)
1581 {
1582 vchar_t *buf = NULL;
1583 struct sadb_msg *msg, *next, *end;
1584 struct sadb_sa *sa;
1585 struct sockaddr_storage *src, *dst;
1586 caddr_t mhp[SADB_EXT_MAX + 1];
1587 int proto_id, i;
1588 phase2_handle_t *iph2;
1589 #if 0
1590 char *loc, *rem;
1591 #endif
1592
1593 if (f_local)
1594 return;
1595
1596 // TODO: make sure that is_rekey is cleared for this. and session indicates the same
1597 #if 0
1598 loc = racoon_strdup(saddrwop2str(iph1->local));
1599 rem = racoon_strdup(saddrwop2str(iph1->remote));
1600 STRDUP_FATAL(loc);
1601 STRDUP_FATAL(rem);
1602
1603 /*
1604 * Purge all IPSEC-SAs for the peer. We can do this
1605 * the easy way (using a PF_KEY SADB_DELETE extension)
1606 * or we can do it the hard way.
1607 */
1608 for (i = 0; i < pfkey_nsatypes; i++) {
1609 proto_id = pfkey2ipsecdoi_proto(pfkey_satypes[i].ps_satype);
1610
1611 plog(ASL_LEVEL_INFO,
1612 "purging %s SAs for %s -> %s\n",
1613 pfkey_satypes[i].ps_name, loc, rem);
1614 if (pfkey_send_delete_all(lcconf->sock_pfkey,
1615 pfkey_satypes[i].ps_satype, IPSEC_MODE_ANY,
1616 iph1->local, iph1->remote) == -1) {
1617 plog(ASL_LEVEL_ERR,
1618 "delete_all %s -> %s failed for %s (%s)\n",
1619 loc, rem,
1620 pfkey_satypes[i].ps_name, ipsec_strerror());
1621 goto the_hard_way;
1622 }
1623
1624 ike_session_deleteallph2(iph1->local, iph1->remote, proto_id);
1625
1626 plog(ASL_LEVEL_INFO,
1627 "purging %s SAs for %s -> %s\n",
1628 pfkey_satypes[i].ps_name, rem, loc);
1629 if (pfkey_send_delete_all(lcconf->sock_pfkey,
1630 pfkey_satypes[i].ps_satype, IPSEC_MODE_ANY,
1631 iph1->remote, iph1->local) == -1) {
1632 plog(ASL_LEVEL_ERR,
1633 "delete_all %s -> %s failed for %s (%s)\n",
1634 rem, loc,
1635 pfkey_satypes[i].ps_name, ipsec_strerror());
1636 goto the_hard_way;
1637 }
1638
1639 ike_session_deleteallph2(iph1->remote, iph1->local, proto_id);
1640 }
1641
1642 racoon_free(loc);
1643 racoon_free(rem);
1644 return;
1645
1646 the_hard_way:
1647 racoon_free(loc);
1648 racoon_free(rem);
1649 #endif
1650
1651 buf = pfkey_dump_sadb(SADB_SATYPE_UNSPEC);
1652 if (buf == NULL) {
1653 plog(ASL_LEVEL_DEBUG,
1654 "pfkey_dump_sadb returned nothing.\n");
1655 return;
1656 }
1657
1658 msg = ALIGNED_CAST(struct sadb_msg *)buf->v;
1659 end = ALIGNED_CAST(struct sadb_msg *)(buf->v + buf->l);
1660
1661 while (msg < end) {
1662 if ((msg->sadb_msg_len << 3) < sizeof(*msg))
1663 break;
1664 next = ALIGNED_CAST(struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3));
1665 if (msg->sadb_msg_type != SADB_DUMP) {
1666 msg = next;
1667 continue;
1668 }
1669
1670 if (pfkey_align(msg, mhp) || pfkey_check(mhp)) {
1671 plog(ASL_LEVEL_ERR,
1672 "pfkey_check (%s)\n", ipsec_strerror());
1673 msg = next;
1674 continue;
1675 }
1676
1677 if (mhp[SADB_EXT_SA] == NULL
1678 || mhp[SADB_EXT_ADDRESS_SRC] == NULL
1679 || mhp[SADB_EXT_ADDRESS_DST] == NULL) {
1680 msg = next;
1681 continue;
1682 }
1683 sa = ALIGNED_CAST(struct sadb_sa *)mhp[SADB_EXT_SA]; // Wcast-align fix (void*) - buffer of pointers to aligned structs
1684 src = ALIGNED_CAST(struct sockaddr_storage *)PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
1685 dst = ALIGNED_CAST(struct sockaddr_storage *)PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
1686
1687 if (sa->sadb_sa_state != SADB_SASTATE_MATURE
1688 && sa->sadb_sa_state != SADB_SASTATE_DYING) {
1689 msg = next;
1690 continue;
1691 }
1692
1693 /*
1694 * RFC2407 4.6.3.3 INITIAL-CONTACT is the message that
1695 * announces the sender of the message was rebooted.
1696 * it is interpreted to delete all SAs which source address
1697 * is the sender of the message.
1698 * racoon only deletes SA which is matched both the
1699 * source address and the destination accress.
1700 */
1701 #ifdef ENABLE_NATT
1702 /*
1703 * XXX RFC 3947 says that whe MUST NOT use IP+port to find old SAs
1704 * from this peer !
1705 */
1706 if(iph1->natt_flags & NAT_DETECTED){
1707 if (CMPSADDR(iph1->local, src) == 0 &&
1708 CMPSADDR(iph1->remote, dst) == 0)
1709 ;
1710 else if (CMPSADDR(iph1->remote, src) == 0 &&
1711 CMPSADDR(iph1->local, dst) == 0)
1712 ;
1713 else {
1714 msg = next;
1715 continue;
1716 }
1717 } else
1718 #endif
1719 /* If there is no NAT-T, we don't have to check addr + port...
1720 * XXX what about a configuration with a remote peers which is not
1721 * NATed, but which NATs some other peers ?
1722 * Here, the INITIAl-CONTACT would also flush all those NATed peers !!
1723 */
1724 if (cmpsaddrwop(iph1->local, src) == 0 &&
1725 cmpsaddrwop(iph1->remote, dst) == 0)
1726 ;
1727 else if (cmpsaddrwop(iph1->remote, src) == 0 &&
1728 cmpsaddrwop(iph1->local, dst) == 0)
1729 ;
1730 else {
1731 msg = next;
1732 continue;
1733 }
1734
1735 /*
1736 * Make sure this is an SATYPE that we manage.
1737 * This is gross; too bad we couldn't do it the
1738 * easy way.
1739 */
1740 for (i = 0; i < pfkey_nsatypes; i++) {
1741 if (pfkey_satypes[i].ps_satype ==
1742 msg->sadb_msg_satype)
1743 break;
1744 }
1745 if (i == pfkey_nsatypes) {
1746 msg = next;
1747 continue;
1748 }
1749
1750 plog(ASL_LEVEL_INFO,
1751 "purging spi=%u.\n", ntohl(sa->sadb_sa_spi));
1752 pfkey_send_delete(lcconf->sock_pfkey,
1753 msg->sadb_msg_satype,
1754 IPSEC_MODE_ANY, src, dst, sa->sadb_sa_spi);
1755
1756 /*
1757 * delete a relative phase 2 handler.
1758 * continue to process if no relative phase 2 handler
1759 * exists.
1760 */
1761 proto_id = pfkey2ipsecdoi_proto(msg->sadb_msg_satype);
1762 iph2 = ike_session_getph2bysaidx(src, dst, proto_id, sa->sadb_sa_spi);
1763 if (iph2) {
1764 delete_spd(iph2);
1765 ike_session_unlink_phase2(iph2);
1766 }
1767
1768 msg = next;
1769 }
1770
1771 vfree(buf);
1772 }
1773
1774 void
1775 isakmp_check_notify(struct isakmp_gen *gen /* points to Notify payload */, phase1_handle_t *iph1)
1776 {
1777 struct isakmp_pl_n *notify = (struct isakmp_pl_n *)gen;
1778
1779 plog(ASL_LEVEL_DEBUG,
1780 "Notify Message received\n");
1781
1782 switch (ntohs(notify->type)) {
1783 case ISAKMP_NTYPE_CONNECTED:
1784 case ISAKMP_NTYPE_RESPONDER_LIFETIME:
1785 case ISAKMP_NTYPE_REPLAY_STATUS:
1786 case ISAKMP_NTYPE_HEARTBEAT:
1787 #ifdef ENABLE_HYBRID
1788 case ISAKMP_NTYPE_UNITY_HEARTBEAT:
1789 #endif
1790 plog(ASL_LEVEL_WARNING,
1791 "Ignore %s notification.\n",
1792 s_isakmp_notify_msg(ntohs(notify->type)));
1793 break;
1794 case ISAKMP_NTYPE_INITIAL_CONTACT:
1795 plog(ASL_LEVEL_WARNING,
1796 "Ignore INITIAL-CONTACT notification, "
1797 "because it is only accepted after Phase 1.\n");
1798 break;
1799 case ISAKMP_NTYPE_LOAD_BALANCE:
1800 plog(ASL_LEVEL_WARNING,
1801 "Ignore LOAD-BALANCE notification, "
1802 "because it is only accepted after Phase 1.\n");
1803 break;
1804 default:
1805 isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL);
1806 plog(ASL_LEVEL_ERR,
1807 "Received unknown notification type %s.\n",
1808 s_isakmp_notify_msg(ntohs(notify->type)));
1809 }
1810
1811 return;
1812 }
1813
1814 void
1815 isakmp_check_ph2_notify(struct isakmp_gen *gen /* points to Notify payload */, phase2_handle_t *iph2)
1816 {
1817 struct isakmp_pl_n *notify = (struct isakmp_pl_n *)gen;
1818
1819 plog(ASL_LEVEL_DEBUG,
1820 "Phase 2 Notify Message received\n");
1821
1822 switch (ntohs(notify->type)) {
1823 case ISAKMP_NTYPE_RESPONDER_LIFETIME:
1824 return((void)isakmp_ph2_responder_lifetime(iph2,
1825 (struct isakmp_pl_resp_lifetime *)notify));
1826 break;
1827 case ISAKMP_NTYPE_CONNECTED:
1828 case ISAKMP_NTYPE_REPLAY_STATUS:
1829 case ISAKMP_NTYPE_HEARTBEAT:
1830 #ifdef ENABLE_HYBRID
1831 case ISAKMP_NTYPE_UNITY_HEARTBEAT:
1832 #endif
1833 plog(ASL_LEVEL_WARNING,
1834 "Ignore %s notification.\n",
1835 s_isakmp_notify_msg(ntohs(notify->type)));
1836 break;
1837 case ISAKMP_NTYPE_INITIAL_CONTACT:
1838 plog(ASL_LEVEL_WARNING,
1839 "Ignore INITIAL-CONTACT notification, "
1840 "because it is only accepted after Phase 1.\n");
1841 break;
1842 case ISAKMP_NTYPE_LOAD_BALANCE:
1843 plog(ASL_LEVEL_WARNING,
1844 "Ignore LOAD-BALANCE notification, "
1845 "because it is only accepted after Phase 1.\n");
1846 break;
1847 default:
1848 isakmp_info_send_n1(iph2->ph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL);
1849 plog(ASL_LEVEL_ERR,
1850 "Received unknown notification type %s.\n",
1851 s_isakmp_notify_msg(ntohs(notify->type)));
1852 }
1853
1854 return;
1855 }
1856
1857 #ifdef ENABLE_VPNCONTROL_PORT
1858 static int
1859 isakmp_info_recv_lb(phase1_handle_t *iph1, struct isakmp_pl_lb *n, int encrypted)
1860 {
1861
1862 if (iph1->side != INITIATOR)
1863 {
1864 plog(ASL_LEVEL_DEBUG,
1865 "LOAD-BALANCE notification ignored - we are not the initiator.\n");
1866 return 0;
1867 }
1868 if (!encrypted) {
1869 plog(ASL_LEVEL_DEBUG,
1870 "LOAD-BALANCE notification ignored - not protected.\n");
1871 return 0;
1872 }
1873 if (ntohs(n->h.len) != sizeof(struct isakmp_pl_lb)) {
1874 plog(ASL_LEVEL_DEBUG,
1875 "Invalid length of payload\n");
1876 return -1;
1877 }
1878
1879 vpncontrol_notify_ike_failed(ISAKMP_NTYPE_LOAD_BALANCE, FROM_REMOTE,
1880 iph1_get_remote_v4_address(iph1), 4, (u_int8_t*)(&(n->address)));
1881
1882 plog(ASL_LEVEL_NOTICE,
1883 "Received LOAD_BALANCE notification.\n");
1884
1885 if (((struct sockaddr_in*)iph1->remote)->sin_addr.s_addr != ntohl(n->address)) {
1886 plog(ASL_LEVEL_DEBUG,
1887 "Deleting old Phase 1 because of LOAD_BALANCE notification - redirect address=%x.\n",
1888 ntohl(n->address));
1889
1890 if (FSM_STATE_IS_ESTABLISHED(iph1->status)) {
1891 isakmp_info_send_d1(iph1);
1892 }
1893 isakmp_ph1expire(iph1);
1894 }
1895
1896 return 0;
1897 }
1898 #endif
1899
1900 #ifdef ENABLE_DPD
1901 static int
1902 isakmp_info_recv_r_u (phase1_handle_t *iph1, struct isakmp_pl_ru *ru, u_int32_t msgid)
1903 {
1904 struct isakmp_pl_ru *ru_ack;
1905 vchar_t *payload = NULL;
1906 int tlen;
1907 int error = 0;
1908
1909 plog(ASL_LEVEL_DEBUG,
1910 "DPD R-U-There received\n");
1911
1912 /* XXX should compare cookies with iph1->index?
1913 Or is this already done by calling function? */
1914 tlen = sizeof(*ru_ack);
1915 payload = vmalloc(tlen);
1916 if (payload == NULL) {
1917 IPSECSESSIONTRACEREVENT(iph1->parent_session,
1918 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_FAIL,
1919 CONSTSTR("R-U-THERE? ACK"),
1920 CONSTSTR("Failed to transmit DPD response"));
1921 plog(ASL_LEVEL_ERR,
1922 "failed to get buffer to send.\n");
1923 return errno;
1924 }
1925
1926 ru_ack = (struct isakmp_pl_ru *)payload->v;
1927 ru_ack->h.np = ISAKMP_NPTYPE_NONE;
1928 ru_ack->h.len = htons(tlen);
1929 ru_ack->doi = htonl(IPSEC_DOI);
1930 ru_ack->type = htons(ISAKMP_NTYPE_R_U_THERE_ACK);
1931 ru_ack->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX ? */
1932 ru_ack->spi_size = sizeof(isakmp_index);
1933 memcpy(ru_ack->i_ck, ru->i_ck, sizeof(cookie_t));
1934 memcpy(ru_ack->r_ck, ru->r_ck, sizeof(cookie_t));
1935 ru_ack->data = ru->data;
1936
1937 /* XXX Should we do FLAG_A ? */
1938 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N,
1939 ISAKMP_FLAG_E);
1940 vfree(payload);
1941 if (error) {
1942 IPSECSESSIONTRACEREVENT(iph1->parent_session,
1943 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_FAIL,
1944 CONSTSTR("R-U-THERE? ACK"),
1945 CONSTSTR("Failed to transmit DPD ack"));
1946 } else {
1947 IPSECSESSIONTRACEREVENT(iph1->parent_session,
1948 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_SUCC,
1949 CONSTSTR("R-U-THERE? ACK"),
1950 CONSTSTR(NULL));
1951 }
1952
1953 plog(ASL_LEVEL_DEBUG, "received a valid R-U-THERE, ACK sent\n");
1954
1955 /* Should we mark tunnel as active ? */
1956 return error;
1957 }
1958
1959 static int
1960 isakmp_info_recv_r_u_ack (phase1_handle_t *iph1, struct isakmp_pl_ru *ru, u_int32_t msgid)
1961 {
1962
1963 plog(ASL_LEVEL_DEBUG,
1964 "DPD R-U-There-Ack received\n");
1965
1966 /* XXX Maintain window of acceptable sequence numbers ?
1967 * => ru->data <= iph2->dpd_seq &&
1968 * ru->data >= iph2->dpd_seq - iph2->dpd_fails ? */
1969 if (ntohl(ru->data) != iph1->dpd_seq) {
1970 plog(ASL_LEVEL_ERR,
1971 "Wrong DPD sequence number (%d, %d expected).\n",
1972 ntohl(ru->data), iph1->dpd_seq);
1973 return 0;
1974 }
1975
1976 if (memcmp(ru->i_ck, iph1->index.i_ck, sizeof(cookie_t)) ||
1977 memcmp(ru->r_ck, iph1->index.r_ck, sizeof(cookie_t))) {
1978 plog(ASL_LEVEL_ERR,
1979 "Cookie mismatch in DPD ACK!.\n");
1980 return 0;
1981 }
1982
1983 iph1->dpd_fails = 0;
1984
1985 iph1->dpd_seq++;
1986
1987 /* Useless ??? */
1988 iph1->dpd_lastack = time(NULL);
1989
1990 SCHED_KILL(iph1->dpd_r_u);
1991
1992 isakmp_sched_r_u(iph1, 0);
1993
1994 if (iph1->side == INITIATOR) {
1995 IPSECSESSIONTRACEREVENT(iph1->parent_session,
1996 IPSECSESSIONEVENTCODE_IKEV1_DPD_INIT_RESP,
1997 CONSTSTR("Initiator DPD Response"),
1998 CONSTSTR(NULL));
1999 } else {
2000 IPSECSESSIONTRACEREVENT(iph1->parent_session,
2001 IPSECSESSIONEVENTCODE_IKEV1_DPD_RESP_RESP,
2002 CONSTSTR("Responder DPD Response"),
2003 CONSTSTR(NULL));
2004 }
2005 plog(ASL_LEVEL_DEBUG, "received an R-U-THERE-ACK\n");
2006
2007 #ifdef ENABLE_VPNCONTROL_PORT
2008 vpncontrol_notify_peer_resp_ph1(1, iph1);
2009 #endif /* ENABLE_VPNCONTROL_PORT */
2010
2011 return 0;
2012 }
2013
2014
2015 /*
2016 * send Delete payload (for ISAKMP SA) in Informational exchange.
2017 */
2018 void
2019 isakmp_info_send_r_u(void *arg)
2020 {
2021 phase1_handle_t *iph1 = arg;
2022
2023 /* create R-U-THERE payload */
2024 struct isakmp_pl_ru *ru;
2025 vchar_t *payload = NULL;
2026 int tlen;
2027 int error = 0;
2028
2029 if (!FSM_STATE_IS_ESTABLISHED(iph1->status)) {
2030 plog(ASL_LEVEL_DEBUG, "DPD r-u send aborted, invalid Phase 1 status %d....\n",
2031 iph1->status);
2032 return;
2033 }
2034
2035 if (iph1->dpd_fails >= iph1->rmconf->dpd_maxfails) {
2036 IPSECSESSIONTRACEREVENT(iph1->parent_session,
2037 IPSECSESSIONEVENTCODE_IKEV1_DPD_MAX_RETRANSMIT,
2038 CONSTSTR("DPD maximum retransmits"),
2039 CONSTSTR("maxed-out of DPD requests without receiving an ack"));
2040
2041 (void)vpncontrol_notify_ike_failed(VPNCTL_NTYPE_PEER_DEAD, FROM_LOCAL, iph1_get_remote_v4_address(iph1), 0, NULL);
2042
2043 purge_remote(iph1);
2044 plog(ASL_LEVEL_DEBUG,
2045 "DPD: remote seems to be dead\n");
2046
2047 /* Do not reschedule here: phase1 is deleted,
2048 * DPD will be reactivated when a new ph1 will be negociated
2049 */
2050 return;
2051 }
2052
2053 tlen = sizeof(*ru);
2054 payload = vmalloc(tlen);
2055 if (payload == NULL) {
2056 IPSECSESSIONTRACEREVENT(iph1->parent_session,
2057 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_FAIL,
2058 CONSTSTR("R-U-THERE?"),
2059 CONSTSTR("Failed to transmit DPD request"));
2060 plog(ASL_LEVEL_ERR,
2061 "failed to get buffer for payload.\n");
2062 return;
2063 }
2064 ru = (struct isakmp_pl_ru *)payload->v;
2065 ru->h.np = ISAKMP_NPTYPE_NONE;
2066 ru->h.len = htons(tlen);
2067 ru->doi = htonl(IPSEC_DOI);
2068 ru->type = htons(ISAKMP_NTYPE_R_U_THERE);
2069 ru->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX ?*/
2070 ru->spi_size = sizeof(isakmp_index);
2071
2072 memcpy(ru->i_ck, iph1->index.i_ck, sizeof(cookie_t));
2073 memcpy(ru->r_ck, iph1->index.r_ck, sizeof(cookie_t));
2074
2075 if (iph1->dpd_seq == 0){
2076 /* generate a random seq which is not too big */
2077 srand(time(NULL));
2078 iph1->dpd_seq = rand() & 0x0fff;
2079 }
2080
2081 ru->data = htonl(iph1->dpd_seq);
2082
2083 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 0);
2084 vfree(payload);
2085 if (error) {
2086 IPSECSESSIONTRACEREVENT(iph1->parent_session,
2087 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_FAIL,
2088 CONSTSTR("R-U-THERE?"),
2089 CONSTSTR("Failed to transmit DPD request"));
2090 } else {
2091 IPSECSESSIONTRACEREVENT(iph1->parent_session,
2092 IPSECSESSIONEVENTCODE_IKEV1_INFO_NOTICE_TX_SUCC,
2093 CONSTSTR("R-U-THERE?"),
2094 CONSTSTR(NULL));
2095 }
2096
2097 if (iph1->side == INITIATOR) {
2098 IPSECSESSIONTRACEREVENT(iph1->parent_session,
2099 iph1->dpd_fails? IPSECSESSIONEVENTCODE_IKEV1_DPD_INIT_RETRANSMIT : IPSECSESSIONEVENTCODE_IKEV1_DPD_INIT_REQ,
2100 CONSTSTR("Initiator DPD Request"),
2101 CONSTSTR(NULL));
2102 } else {
2103 IPSECSESSIONTRACEREVENT(iph1->parent_session,
2104 iph1->dpd_fails? IPSECSESSIONEVENTCODE_IKEV1_DPD_RESP_RETRANSMIT : IPSECSESSIONEVENTCODE_IKEV1_DPD_RESP_REQ,
2105 CONSTSTR("Responder DPD Request"),
2106 CONSTSTR(NULL));
2107 }
2108 plog(ASL_LEVEL_DEBUG,
2109 "DPD R-U-There sent (%d)\n", error);
2110
2111 /* will be decreased if ACK received... */
2112 iph1->dpd_fails++;
2113
2114 /* Reschedule the r_u_there with a short delay,
2115 * will be deleted/rescheduled if ACK received before */
2116 isakmp_sched_r_u(iph1, 1);
2117
2118 plog(ASL_LEVEL_DEBUG,
2119 "rescheduling send_r_u (%d).\n", iph1->rmconf->dpd_retry);
2120 }
2121
2122 /*
2123 * monitor DPD (ALGORITHM_INBOUND_DETECT) Informational exchange.
2124 */
2125 static void
2126 isakmp_info_monitor_r_u_algo_inbound_detect (phase1_handle_t *iph1)
2127 {
2128 if (!FSM_STATE_IS_ESTABLISHED(iph1->status)) {
2129 plog(ASL_LEVEL_DEBUG, "DPD monitoring (for ALGORITHM_INBOUND_DETECT) aborted, invalid Phase 1 status %d....\n",
2130 iph1->status);
2131 return;
2132 }
2133
2134 plog(ASL_LEVEL_DEBUG, "DPD monitoring (for ALGORITHM_INBOUND_DETECT) ....\n");
2135
2136 // check phase1 for ike packets received from peer
2137 if (iph1->peer_sent_ike) {
2138 // yes, reshedule check
2139 iph1->peer_sent_ike = 0;
2140
2141 /* ike packets received from peer... reschedule dpd */
2142 isakmp_sched_r_u(iph1, 0);
2143
2144 plog(ASL_LEVEL_DEBUG,
2145 "ike packets received from peer... reschedule monitor.\n");
2146
2147 return;
2148 }
2149
2150 // after ike packets, next we check if any data was received
2151 if (!iph1->parent_session->peer_sent_data_sc_dpd) {
2152 isakmp_info_send_r_u(iph1);
2153 } else {
2154 isakmp_sched_r_u(iph1, 0);
2155
2156 plog(ASL_LEVEL_DEBUG,
2157 "rescheduling DPD monitoring (for ALGORITHM_INBOUND_DETECT).\n");
2158 }
2159 iph1->parent_session->peer_sent_data_sc_dpd = 0;
2160 }
2161
2162 /*
2163 * monitor DPD (ALGORITHM_BLACKHOLE_DETECT) Informational exchange.
2164 */
2165 static void
2166 isakmp_info_monitor_r_u_algo_blackhole_detect (phase1_handle_t *iph1)
2167 {
2168 if (!FSM_STATE_IS_ESTABLISHED(iph1->status)) {
2169 plog(ASL_LEVEL_DEBUG, "DPD monitoring (for ALGORITHM_BLACKHOLE_DETECT) aborted, invalid Phase 1 status %d....\n",
2170 iph1->status);
2171 return;
2172 }
2173
2174 plog(ASL_LEVEL_DEBUG, "DPD monitoring (for ALGORITHM_BLACKHOLE_DETECT) ....\n");
2175
2176 // check if data was sent but none was received
2177 if (iph1->parent_session->i_sent_data_sc_dpd &&
2178 !iph1->parent_session->peer_sent_data_sc_dpd) {
2179 isakmp_info_send_r_u(iph1);
2180 } else {
2181 isakmp_sched_r_u(iph1, 0);
2182
2183 plog(ASL_LEVEL_DEBUG,
2184 "rescheduling DPD monitoring (for ALGORITHM_BLACKHOLE_DETECT) i = %d, peer %d.\n",
2185 iph1->parent_session->i_sent_data_sc_dpd,
2186 iph1->parent_session->peer_sent_data_sc_dpd);
2187 }
2188 iph1->parent_session->i_sent_data_sc_dpd = 0;
2189 iph1->parent_session->peer_sent_data_sc_dpd = 0;
2190 }
2191
2192 /*
2193 * monitor DPD Informational exchange.
2194 */
2195 static void
2196 isakmp_info_monitor_r_u(void *arg)
2197 {
2198 phase1_handle_t *iph1 = arg;
2199
2200 if (iph1 && iph1->rmconf) {
2201 if (iph1->rmconf->dpd_algo == DPD_ALGO_INBOUND_DETECT) {
2202 isakmp_info_monitor_r_u_algo_inbound_detect(iph1);
2203 } else if (iph1->rmconf->dpd_algo == DPD_ALGO_BLACKHOLE_DETECT) {
2204 isakmp_info_monitor_r_u_algo_blackhole_detect(iph1);
2205 } else {
2206 plog(ASL_LEVEL_DEBUG, "DPD monitoring aborted, invalid algorithm %d....\n",
2207 iph1->rmconf->dpd_algo);
2208 }
2209 }
2210 }
2211
2212 /* Schedule a new R-U-THERE */
2213 int
2214 isakmp_sched_r_u(phase1_handle_t *iph1, int retry)
2215 {
2216 if(iph1 == NULL ||
2217 iph1->rmconf == NULL)
2218 return 1;
2219
2220
2221 if(iph1->dpd_support == 0 ||
2222 iph1->rmconf->dpd_interval == 0)
2223 return 0;
2224
2225 if(retry) {
2226 iph1->dpd_r_u = sched_new(iph1->rmconf->dpd_retry,
2227 isakmp_info_send_r_u, iph1);
2228 } else {
2229 if (iph1->rmconf->dpd_algo == DPD_ALGO_INBOUND_DETECT ||
2230 iph1->rmconf->dpd_algo == DPD_ALGO_BLACKHOLE_DETECT) {
2231 iph1->dpd_r_u = sched_new(iph1->rmconf->dpd_interval,
2232 isakmp_info_monitor_r_u, iph1);
2233 } else {
2234 iph1->dpd_r_u = sched_new(iph1->rmconf->dpd_interval,
2235 isakmp_info_send_r_u, iph1);
2236 }
2237 }
2238
2239 return 0;
2240 }
2241
2242 /*
2243 * punts dpd for later because of some activity that:
2244 * 1) implicitly does dpd (e.g. phase2 exchanges), or
2245 * 2) indicates liveness (e.g. received ike packets).
2246 */
2247 void
2248 isakmp_reschedule_info_monitor_if_pending (phase1_handle_t *iph1, char *reason)
2249 {
2250 if (!iph1 ||
2251 !FSM_STATE_IS_ESTABLISHED(iph1->status) ||
2252 !iph1->dpd_support ||
2253 !iph1->rmconf->dpd_interval ||
2254 iph1->rmconf->dpd_algo == DPD_ALGO_DEFAULT) {
2255 return;
2256 }
2257
2258 if (!iph1->peer_sent_ike) {
2259 SCHED_KILL(iph1->dpd_r_u);
2260
2261 isakmp_sched_r_u(iph1, 0);
2262
2263 plog(ASL_LEVEL_DEBUG,
2264 "%s... rescheduling send_r_u.\n",
2265 reason);
2266 }
2267 iph1->peer_sent_ike++;
2268 }
2269 #endif
mirror of ipsec