ipsec-tools/racoon/handler.c

   1 /*      $NetBSD: handler.c,v 1.9.6.6 2007/06/06 09:20:12 vanhu Exp $    */
   2
   3 /* Id: handler.c,v 1.28 2006/05/26 12:17:29 manubsd Exp */
   4
   5 /*
   6  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  * 3. Neither the name of the project nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "config.h"
  35
  36 #include <sys/types.h>
  37 #include <sys/param.h>
  38 #include <sys/socket.h>
  39
  40 #include <stdlib.h>
  41 #include <stdio.h>
  42 #include <string.h>
  43 #include <time.h>
  44 #include <errno.h>
  45
  46 #include "var.h"
  47 #include "misc.h"
  48 #include "vmbuf.h"
  49 #include "plog.h"
  50 #include "sockmisc.h"
  51 #include "debug.h"
  52
  53 #ifdef ENABLE_HYBRID
  54 #include <resolv.h>
  55 #endif
  56
  57 #include "schedule.h"
  58 #include "grabmyaddr.h"
  59 #include "algorithm.h"
  60 #include "crypto_openssl.h"
  61 #include "policy.h"
  62 #include "proposal.h"
  63 #include "isakmp_var.h"
  64 #include "evt.h"
  65 #include "isakmp.h"
  66 #ifdef ENABLE_HYBRID
  67 #include "isakmp_xauth.h"
  68 #include "isakmp_cfg.h"
  69 #endif
  70 #include "isakmp_inf.h"
  71 #include "oakley.h"
  72 #include "remoteconf.h"
  73 #include "localconf.h"
  74 #include "handler.h"
  75 #include "gcmalloc.h"
  76 #include "nattraversal.h"
  77 #include "ike_session.h"
  78
  79 #include "sainfo.h"
  80
  81 #ifdef HAVE_GSSAPI
  82 #include "gssapi.h"
  83 #endif
  84
  85 static LIST_HEAD(_ph1tree_, ph1handle) ph1tree;
  86 static LIST_HEAD(_ph2tree_, ph2handle) ph2tree;
  87 static LIST_HEAD(_ctdtree_, contacted) ctdtree;
  88 static LIST_HEAD(_rcptree_, recvdpkt) rcptree;
  89
  90 static void del_recvdpkt __P((struct recvdpkt *));
  91 static void rem_recvdpkt __P((struct recvdpkt *));
  92 static void sweep_recvdpkt __P((void *));
  93
  94 /*
  95  * functions about management of the isakmp status table
  96  */
  97 /* %%% management phase 1 handler */
  98 /*
  99  * search for isakmpsa handler with isakmp index.
 100  */
 101
 102 extern caddr_t val2str(const char *, size_t);
 103
 104 struct ph1handle *
 105 getph1byindex(index)
 106         isakmp_index *index;
 107 {
 108         struct ph1handle *p;
 109
 110         LIST_FOREACH(p, &ph1tree, chain) {
 111                 if (p->status == PHASE1ST_EXPIRED)
 112                         continue;
 113                 if (memcmp(&p->index, index, sizeof(*index)) == 0)
 114                         return p;
 115         }
 116
 117         return NULL;
 118 }
 119
 120 /*
 121  * search for isakmp handler by i_ck in index.
 122  */
 123 struct ph1handle *
 124 getph1byindex0(index)
 125         isakmp_index *index;
 126 {
 127         struct ph1handle *p;
 128
 129         LIST_FOREACH(p, &ph1tree, chain) {
 130                 if (p->status == PHASE1ST_EXPIRED)
 131                         continue;
 132                 if (memcmp(&p->index, index, sizeof(cookie_t)) == 0)
 133                         return p;
 134         }
 135
 136         return NULL;
 137 }
 138
 139 /*
 140  * search for isakmpsa handler by source and remote address.
 141  * don't use port number to search because this function search
 142  * with phase 2's destinaion.
 143  */
 144 struct ph1handle *
 145 getph1byaddr(local, remote)
 146         struct sockaddr *local, *remote;
 147 {
 148         struct ph1handle *p;
 149
 150         plog(LLV_DEBUG2, LOCATION, NULL, "getph1byaddr: start\n");
 151         plog(LLV_DEBUG2, LOCATION, NULL, "local: %s\n", saddr2str(local));
 152         plog(LLV_DEBUG2, LOCATION, NULL, "remote: %s\n", saddr2str(remote));
 153
 154         LIST_FOREACH(p, &ph1tree, chain) {
 155                 if (p->status == PHASE1ST_EXPIRED)
 156                         continue;
 157                 plog(LLV_DEBUG2, LOCATION, NULL, "p->local: %s\n", saddr2str(p->local));
 158                 plog(LLV_DEBUG2, LOCATION, NULL, "p->remote: %s\n", saddr2str(p->remote));
 159                 if (CMPSADDR(local, p->local) == 0
 160                         && CMPSADDR(remote, p->remote) == 0){
 161                         plog(LLV_DEBUG2, LOCATION, NULL, "matched\n");
 162                         return p;
 163                 }
 164         }
 165
 166         plog(LLV_DEBUG2, LOCATION, NULL, "no match\n");
 167
 168         return NULL;
 169 }
 170
 171 struct ph1handle *
 172 getph1byaddrwop(local, remote)
 173         struct sockaddr *local, *remote;
 174 {
 175         struct ph1handle *p;
 176
 177         LIST_FOREACH(p, &ph1tree, chain) {
 178                 if (p->status == PHASE1ST_EXPIRED)
 179                         continue;
 180                 if (cmpsaddrwop(local, p->local) == 0
 181                  && cmpsaddrwop(remote, p->remote) == 0)
 182                         return p;
 183         }
 184
 185         return NULL;
 186 }
 187
 188 /*
 189  * search for isakmpsa handler by remote address.
 190  * don't use port number to search because this function search
 191  * with phase 2's destinaion.
 192  */
 193 struct ph1handle *
 194 getph1bydstaddrwop(remote)
 195         struct sockaddr *remote;
 196 {
 197         struct ph1handle *p;
 198
 199         LIST_FOREACH(p, &ph1tree, chain) {
 200                 if (p->status == PHASE1ST_EXPIRED)
 201                         continue;
 202                 if (cmpsaddrwop(remote, p->remote) == 0)
 203                         return p;
 204         }
 205
 206         return NULL;
 207 }
 208
 209 int
 210 islast_ph1(ph1)
 211         struct ph1handle *ph1;
 212 {
 213         struct ph1handle *p;
 214
 215         LIST_FOREACH(p, &ph1tree, chain) {
 216                 if (p->status == PHASE1ST_EXPIRED)
 217                         continue;
 218                 if (CMPSADDR(ph1->remote, p->remote) == 0) {
 219                         if (p == ph1)
 220                                 continue;
 221                         return 0;
 222                 }
 223         }
 224         return 1;
 225 }
 226
 227 /*
 228  * dump isakmp-sa
 229  */
 230 vchar_t *
 231 dumpph1()
 232 {
 233         struct ph1handle *iph1;
 234         struct ph1dump *pd;
 235         int cnt = 0;
 236         vchar_t *buf;
 237
 238         /* get length of buffer */
 239         LIST_FOREACH(iph1, &ph1tree, chain)
 240                 cnt++;
 241
 242         buf = vmalloc(cnt * sizeof(struct ph1dump));
 243         if (buf == NULL) {
 244                 plog(LLV_ERROR, LOCATION, NULL,
 245                         "failed to get buffer\n");
 246                 return NULL;
 247         }
 248         pd = (struct ph1dump *)buf->v;
 249
 250         LIST_FOREACH(iph1, &ph1tree, chain) {
 251                 memcpy(&pd->index, &iph1->index, sizeof(iph1->index));
 252                 pd->status = iph1->status;
 253                 pd->side = iph1->side;
 254                 memcpy(&pd->remote, iph1->remote, sysdep_sa_len(iph1->remote));
 255                 memcpy(&pd->local, iph1->local, sysdep_sa_len(iph1->local));
 256                 pd->version = iph1->version;
 257                 pd->etype = iph1->etype;
 258                 pd->created = iph1->created;
 259                 pd->ph2cnt = iph1->ph2cnt;
 260                 pd++;
 261         }
 262
 263         return buf;
 264 }
 265
 266 /*
 267  * create new isakmp Phase 1 status record to handle isakmp in Phase1
 268  */
 269 struct ph1handle *
 270 newph1()
 271 {
 272         struct ph1handle *iph1;
 273
 274         /* create new iph1 */
 275         iph1 = racoon_calloc(1, sizeof(*iph1));
 276         if (iph1 == NULL)
 277                 return NULL;
 278
 279         iph1->status = PHASE1ST_SPAWN;
 280
 281 #ifdef ENABLE_DPD
 282         iph1->dpd_support = 0;
 283         iph1->dpd_lastack = 0;
 284         iph1->dpd_seq = 0;
 285         iph1->dpd_fails = 0;
 286     iph1->peer_sent_ike = 0;
 287         iph1->dpd_r_u = NULL;
 288 #endif
 289 #ifdef ENABLE_VPNCONTROL_PORT
 290         iph1->ping_sched = NULL;
 291 #endif
 292         iph1->is_dying = 0;
 293         return iph1;
 294 }
 295
 296 /*
 297  * delete new isakmp Phase 1 status record to handle isakmp in Phase1
 298  */
 299 void
 300 delph1(iph1)
 301         struct ph1handle *iph1;
 302 {
 303         if (iph1 == NULL)
 304                 return;
 305
 306         /* SA down shell script hook */
 307         script_hook(iph1, SCRIPT_PHASE1_DOWN);
 308
 309         EVT_PUSH(iph1->local, iph1->remote, EVTT_PHASE1_DOWN, NULL);
 310
 311 #ifdef ENABLE_NATT
 312 #ifndef __APPLE__
 313         if (iph1->natt_flags & NAT_KA_QUEUED)
 314                 natt_keepalive_remove (iph1->local, iph1->remote);
 315 #endif /* __APPLE__ */
 316         if (iph1->natt_options) {
 317                 racoon_free(iph1->natt_options);
 318                 iph1->natt_options = NULL;
 319         }
 320 #endif
 321
 322 #ifdef ENABLE_HYBRID
 323         if (iph1->mode_cfg)
 324                 isakmp_cfg_rmstate(iph1);
 325         VPTRINIT(iph1->xauth_awaiting_userinput_msg);
 326 #endif
 327
 328 #ifdef ENABLE_DPD
 329         if (iph1->dpd_r_u != NULL)
 330                 SCHED_KILL(iph1->dpd_r_u);
 331 #endif
 332 #ifdef ENABLE_VPNCONTROL_PORT
 333         if (iph1->ping_sched != NULL)
 334                 SCHED_KILL(iph1->ping_sched);
 335 #endif
 336
 337         if (iph1->remote) {
 338                 racoon_free(iph1->remote);
 339                 iph1->remote = NULL;
 340         }
 341         if (iph1->local) {
 342                 racoon_free(iph1->local);
 343                 iph1->local = NULL;
 344         }
 345
 346         if (iph1->approval) {
 347                 delisakmpsa(iph1->approval);
 348                 iph1->approval = NULL;
 349         }
 350
 351         VPTRINIT(iph1->authstr);
 352
 353         sched_scrub_param(iph1);
 354         iph1->sce = NULL;
 355         iph1->sce_rekey = NULL;
 356         iph1->scr = NULL;
 357
 358         VPTRINIT(iph1->sendbuf);
 359
 360         VPTRINIT(iph1->dhpriv);
 361         VPTRINIT(iph1->dhpub);
 362         VPTRINIT(iph1->dhpub_p);
 363         VPTRINIT(iph1->dhgxy);
 364         VPTRINIT(iph1->nonce);
 365         VPTRINIT(iph1->nonce_p);
 366         VPTRINIT(iph1->skeyid);
 367         VPTRINIT(iph1->skeyid_d);
 368         VPTRINIT(iph1->skeyid_a);
 369         VPTRINIT(iph1->skeyid_e);
 370         VPTRINIT(iph1->key);
 371         VPTRINIT(iph1->hash);
 372         VPTRINIT(iph1->sig);
 373         VPTRINIT(iph1->sig_p);
 374         oakley_delcert(iph1->cert);
 375         iph1->cert = NULL;
 376         oakley_delcert(iph1->cert_p);
 377         iph1->cert_p = NULL;
 378         oakley_delcert(iph1->crl_p);
 379         iph1->crl_p = NULL;
 380         oakley_delcert(iph1->cr_p);
 381         iph1->cr_p = NULL;
 382         VPTRINIT(iph1->id);
 383         VPTRINIT(iph1->id_p);
 384
 385         if(iph1->approval != NULL)
 386                 delisakmpsa(iph1->approval);
 387
 388         if (iph1->ivm) {
 389                 oakley_delivm(iph1->ivm);
 390                 iph1->ivm = NULL;
 391         }
 392
 393         VPTRINIT(iph1->sa);
 394         VPTRINIT(iph1->sa_ret);
 395
 396 #ifdef HAVE_GSSAPI
 397         VPTRINIT(iph1->gi_i);
 398         VPTRINIT(iph1->gi_r);
 399
 400         gssapi_free_state(iph1);
 401 #endif
 402
 403 #ifdef __APPLE__
 404         if (iph1->parent_session) {
 405                 ike_session_unlink_ph1_from_session(iph1);
 406         }
 407         if (iph1->rmconf) {
 408                 unlink_rmconf_from_ph1(iph1->rmconf);
 409                 iph1->rmconf = NULL;
 410         }
 411 #endif
 412
 413         racoon_free(iph1);
 414 }
 415
 416 /*
 417  * create new isakmp Phase 1 status record to handle isakmp in Phase1
 418  */
 419 int
 420 insph1(iph1)
 421         struct ph1handle *iph1;
 422 {
 423         /* validity check */
 424         if (iph1->remote == NULL) {
 425                 plog(LLV_ERROR, LOCATION, NULL,
 426                         "invalid isakmp SA handler. no remote address.\n");
 427                 return -1;
 428         }
 429         LIST_INSERT_HEAD(&ph1tree, iph1, chain);
 430
 431         return 0;
 432 }
 433
 434 void
 435 remph1(iph1)
 436         struct ph1handle *iph1;
 437 {
 438         LIST_REMOVE(iph1, chain);
 439 }
 440
 441 /*
 442  * flush isakmp-sa
 443  */
 444 void
 445 flushph1(int ignore_established_handles)
 446 {
 447         struct ph1handle *p, *next;
 448
 449         for (p = LIST_FIRST(&ph1tree); p; p = next) {
 450                 next = LIST_NEXT(p, chain);
 451
 452                 /* send delete information */
 453                 if (p->status == PHASE1ST_ESTABLISHED) {
 454                         if (ignore_established_handles &&
 455                             (ike_session_has_negoing_ph2(p->parent_session) ||
 456                              p->mode_cfg->flags)) {
 457                                 plog(LLV_DEBUG2, LOCATION, NULL,
 458                                          "skipping ph1 handler that's established... because it's needed by children phase2s\n");
 459                             continue;
 460                     }
 461                         /* send delete information */
 462                         plog(LLV_DEBUG2, LOCATION, NULL,
 463                                  "got a ph1 handler to flush...\n");
 464                         isakmp_info_send_d1(p);
 465                 }
 466
 467                 ike_session_stopped_by_controller(p->parent_session,
 468                                                                                   ike_session_stopped_by_flush);
 469                 remph1(p);
 470                 delph1(p);
 471         }
 472 }
 473
 474 void
 475 initph1tree()
 476 {
 477         LIST_INIT(&ph1tree);
 478 }
 479
 480 /* %%% management phase 2 handler */
 481 /*
 482  * search ph2handle with policy id.
 483  */
 484 struct ph2handle *
 485 getph2byspid(spid)
 486       u_int32_t spid;
 487 {
 488         struct ph2handle *p;
 489
 490         LIST_FOREACH(p, &ph2tree, chain) {
 491                 /*
 492                  * there are ph2handle independent on policy
 493                  * such like informational exchange.
 494                  */
 495                 if (p->spid == spid)
 496                         return p;
 497         }
 498
 499         return NULL;
 500 }
 501
 502 /*
 503  * search ph2handle with sequence number.
 504  */
 505 struct ph2handle *
 506 getph2byseq(seq)
 507         u_int32_t seq;
 508 {
 509         struct ph2handle *p;
 510
 511         LIST_FOREACH(p, &ph2tree, chain) {
 512                 if (p->seq == seq)
 513                         return p;
 514         }
 515
 516         return NULL;
 517 }
 518
 519 /*
 520  * search ph2handle with message id.
 521  */
 522 struct ph2handle *
 523 getph2bymsgid(iph1, msgid)
 524         struct ph1handle *iph1;
 525         u_int32_t msgid;
 526 {
 527         struct ph2handle *p;
 528
 529         LIST_FOREACH(p, &ph2tree, chain) {
 530                 if (p->msgid == msgid)
 531                         return p;
 532         }
 533
 534         return NULL;
 535 }
 536
 537 struct ph2handle *
 538 getph2byid(src, dst, spid)
 539         struct sockaddr *src, *dst;
 540         u_int32_t spid;
 541 {
 542         struct ph2handle *p;
 543
 544         LIST_FOREACH(p, &ph2tree, chain) {
 545                 if (spid == p->spid &&
 546                     CMPSADDR(src, p->src) == 0 &&
 547                     CMPSADDR(dst, p->dst) == 0){
 548                         /* Sanity check to detect zombie handlers
 549                          * XXX Sould be done "somewhere" more interesting,
 550                          * because we have lots of getph2byxxxx(), but this one
 551                          * is called by pk_recvacquire(), so is the most important.
 552                          */
 553                         if(p->status < PHASE2ST_ESTABLISHED &&
 554                            p->retry_counter == 0
 555                            && p->sce == NULL && p->scr == NULL){
 556                                 plog(LLV_DEBUG, LOCATION, NULL,
 557                                          "Zombie ph2 found, expiring it\n");
 558                                 isakmp_ph2expire(p);
 559                         }else
 560                                 return p;
 561                 }
 562         }
 563
 564         return NULL;
 565 }
 566
 567 struct ph2handle *
 568 getph2bysaddr(src, dst)
 569         struct sockaddr *src, *dst;
 570 {
 571         struct ph2handle *p;
 572
 573         LIST_FOREACH(p, &ph2tree, chain) {
 574                 if (cmpsaddrstrict(src, p->src) == 0 &&
 575                     cmpsaddrstrict(dst, p->dst) == 0)
 576                         return p;
 577         }
 578
 579         return NULL;
 580 }
 581
 582 /*
 583  * call by pk_recvexpire().
 584  */
 585 struct ph2handle *
 586 getph2bysaidx(src, dst, proto_id, spi)
 587         struct sockaddr *src, *dst;
 588         u_int proto_id;
 589         u_int32_t spi;
 590 {
 591         struct ph2handle *iph2;
 592         struct saproto *pr;
 593
 594         LIST_FOREACH(iph2, &ph2tree, chain) {
 595                 if (iph2->proposal == NULL && iph2->approval == NULL)
 596                         continue;
 597                 if (iph2->approval != NULL) {
 598                         for (pr = iph2->approval->head; pr != NULL;
 599                              pr = pr->next) {
 600                                 if (proto_id != pr->proto_id)
 601                                         break;
 602                                 if (spi == pr->spi || spi == pr->spi_p)
 603                                         return iph2;
 604                         }
 605                 } else if (iph2->proposal != NULL) {
 606                         for (pr = iph2->proposal->head; pr != NULL;
 607                              pr = pr->next) {
 608                                 if (proto_id != pr->proto_id)
 609                                         break;
 610                                 if (spi == pr->spi)
 611                                         return iph2;
 612                         }
 613                 }
 614         }
 615
 616         return NULL;
 617 }
 618
 619 /*
 620  * create new isakmp Phase 2 status record to handle isakmp in Phase2
 621  */
 622 struct ph2handle *
 623 newph2()
 624 {
 625         struct ph2handle *iph2 = NULL;
 626
 627         /* create new iph2 */
 628         iph2 = racoon_calloc(1, sizeof(*iph2));
 629         if (iph2 == NULL)
 630                 return NULL;
 631
 632         iph2->status = PHASE1ST_SPAWN;
 633         iph2->is_dying = 0;
 634
 635         return iph2;
 636 }
 637
 638 /*
 639  * initialize ph2handle
 640  * NOTE: don't initialize src/dst.
 641  *       SPI in the proposal is cleared.
 642  */
 643 void
 644 initph2(iph2)
 645         struct ph2handle *iph2;
 646 {
 647         sched_scrub_param(iph2);
 648         iph2->sce = NULL;
 649         iph2->scr = NULL;
 650
 651         VPTRINIT(iph2->sendbuf);
 652         VPTRINIT(iph2->msg1);
 653
 654         /* clear spi, keep variables in the proposal */
 655         if (iph2->proposal) {
 656                 struct saproto *pr;
 657                 for (pr = iph2->proposal->head; pr != NULL; pr = pr->next)
 658                         pr->spi = 0;
 659         }
 660
 661         /* clear approval */
 662         if (iph2->approval) {
 663                 flushsaprop(iph2->approval);
 664                 iph2->approval = NULL;
 665         }
 666
 667         /* clear the generated policy */
 668         if (iph2->spidx_gen) {
 669                 delsp_bothdir((struct policyindex *)iph2->spidx_gen);
 670                 racoon_free(iph2->spidx_gen);
 671                 iph2->spidx_gen = NULL;
 672         }
 673
 674         if (iph2->pfsgrp) {
 675                 oakley_dhgrp_free(iph2->pfsgrp);
 676                 iph2->pfsgrp = NULL;
 677         }
 678
 679         VPTRINIT(iph2->dhpriv);
 680         VPTRINIT(iph2->dhpub);
 681         VPTRINIT(iph2->dhpub_p);
 682         VPTRINIT(iph2->dhgxy);
 683         VPTRINIT(iph2->id);
 684         VPTRINIT(iph2->id_p);
 685         VPTRINIT(iph2->nonce);
 686         VPTRINIT(iph2->nonce_p);
 687         VPTRINIT(iph2->sa);
 688         VPTRINIT(iph2->sa_ret);
 689
 690         if (iph2->ivm) {
 691                 oakley_delivm(iph2->ivm);
 692                 iph2->ivm = NULL;
 693         }
 694 }
 695
 696 /*
 697  * delete new isakmp Phase 2 status record to handle isakmp in Phase2
 698  */
 699 void
 700 delph2(iph2)
 701         struct ph2handle *iph2;
 702 {
 703         initph2(iph2);
 704
 705         if (iph2->src) {
 706                 racoon_free(iph2->src);
 707                 iph2->src = NULL;
 708         }
 709         if (iph2->dst) {
 710                 racoon_free(iph2->dst);
 711                 iph2->dst = NULL;
 712         }
 713         if (iph2->src_id) {
 714               racoon_free(iph2->src_id);
 715               iph2->src_id = NULL;
 716         }
 717         if (iph2->dst_id) {
 718               racoon_free(iph2->dst_id);
 719               iph2->dst_id = NULL;
 720         }
 721
 722         if (iph2->proposal) {
 723                 flushsaprop(iph2->proposal);
 724                 iph2->proposal = NULL;
 725         }
 726
 727 #ifdef __APPLE__
 728         if (iph2->parent_session) {
 729                 ike_session_unlink_ph2_from_session(iph2);
 730         }
 731         if (iph2->sainfo) {
 732                 unlink_sainfo_from_ph2(iph2->sainfo);
 733                 iph2->sainfo = NULL;
 734         }
 735 #endif
 736
 737         racoon_free(iph2);
 738 }
 739
 740 /*
 741  * create new isakmp Phase 2 status record to handle isakmp in Phase2
 742  */
 743 int
 744 insph2(iph2)
 745         struct ph2handle *iph2;
 746 {
 747         LIST_INSERT_HEAD(&ph2tree, iph2, chain);
 748
 749         return 0;
 750 }
 751
 752 void
 753 remph2(iph2)
 754         struct ph2handle *iph2;
 755 {
 756         LIST_REMOVE(iph2, chain);
 757 }
 758
 759 void
 760 initph2tree()
 761 {
 762         LIST_INIT(&ph2tree);
 763 }
 764
 765 void
 766 flushph2(int ignore_established_handles)
 767 {
 768         struct ph2handle *p, *next;
 769
 770         plog(LLV_DEBUG2, LOCATION, NULL,
 771                  "flushing all ph2 handlers...\n");
 772
 773         for (p = LIST_FIRST(&ph2tree); p; p = next) {
 774                 next = LIST_NEXT(p, chain);
 775
 776                 if (p->status == PHASE2ST_ESTABLISHED){
 777                         if (ignore_established_handles) {
 778                                 plog(LLV_DEBUG2, LOCATION, NULL,
 779                                          "skipping ph2 handler that's established...\n");
 780                             continue;
 781                     }
 782                         /* send delete information */
 783                         plog(LLV_DEBUG2, LOCATION, NULL,
 784                                  "got an established ph2 handler to flush...\n");
 785                         isakmp_info_send_d2(p);
 786                 }else{
 787                         plog(LLV_DEBUG2, LOCATION, NULL,
 788                                  "got a ph2 handler to flush (state %d)\n", p->status);
 789                 }
 790
 791                 ike_session_stopped_by_controller(p->parent_session,
 792                                                                                   ike_session_stopped_by_flush);
 793                 delete_spd(p);
 794                 unbindph12(p);
 795                 remph2(p);
 796                 delph2(p);
 797         }
 798 }
 799
 800 /*
 801  * Delete all Phase 2 handlers for this src/dst/proto.  This
 802  * is used during INITIAL-CONTACT processing (so no need to
 803  * send a message to the peer).
 804  */
 805 void
 806 deleteallph2(src, dst, proto_id)
 807         struct sockaddr *src, *dst;
 808         u_int proto_id;
 809 {
 810         struct ph2handle *iph2, *next;
 811         struct saproto *pr;
 812
 813         for (iph2 = LIST_FIRST(&ph2tree); iph2 != NULL; iph2 = next) {
 814                 next = LIST_NEXT(iph2, chain);
 815                 if (iph2->proposal == NULL && iph2->approval == NULL)
 816                         continue;
 817                 if (cmpsaddrwop(src, iph2->src) != 0 ||
 818                     cmpsaddrwop(dst, iph2->dst) != 0) {
 819             continue;
 820         }
 821         if (iph2->approval != NULL) {
 822                         for (pr = iph2->approval->head; pr != NULL;
 823                              pr = pr->next) {
 824                                 if (proto_id == pr->proto_id)
 825                                         goto zap_it;
 826                         }
 827                 } else if (iph2->proposal != NULL) {
 828                         for (pr = iph2->proposal->head; pr != NULL;
 829                              pr = pr->next) {
 830                                 if (proto_id == pr->proto_id)
 831                                         goto zap_it;
 832                         }
 833                 }
 834                 continue;
 835  zap_it:
 836         plog(LLV_DEBUG2, LOCATION, NULL,
 837              "deleteallph2: got a ph2 handler...\n");
 838         if (iph2->status == PHASE2ST_ESTABLISHED)
 839             isakmp_info_send_d2(iph2);
 840         ike_session_stopped_by_controller(iph2->parent_session,
 841                                           ike_session_stopped_by_flush);
 842                 unbindph12(iph2);
 843                 remph2(iph2);
 844                 delph2(iph2);
 845         }
 846 }
 847
 848 /*
 849  * Delete all Phase 1 handlers for this src/dst.
 850  */
 851 void
 852 deleteallph1(src, dst)
 853 struct sockaddr *src, *dst;
 854 {
 855         struct ph1handle *iph1, *next;
 856
 857         for (iph1 = LIST_FIRST(&ph1tree); iph1 != NULL; iph1 = next) {
 858                 next = LIST_NEXT(iph1, chain);
 859                 if (cmpsaddrwop(src, iph1->local) != 0 ||
 860                     cmpsaddrwop(dst, iph1->remote) != 0) {
 861                         continue;
 862         }
 863         plog(LLV_DEBUG2, LOCATION, NULL,
 864              "deleteallph1: got a ph1 handler...\n");
 865         if (iph1->status == PHASE2ST_ESTABLISHED)
 866                 isakmp_info_send_d1(iph1);
 867
 868                 ike_session_stopped_by_controller(iph1->parent_session,
 869                                                   ike_session_stopped_by_flush);
 870                 remph1(iph1);
 871                 delph1(iph1);
 872         }
 873 }
 874
 875 /* %%% */
 876 void
 877 bindph12(iph1, iph2)
 878         struct ph1handle *iph1;
 879         struct ph2handle *iph2;
 880 {
 881         if (iph2->ph1 && (struct ph1handle *)iph2->ph1bind.le_next == iph1) {
 882                 plog(LLV_ERROR, LOCATION, NULL, "duplicate %s.\n", __FUNCTION__);
 883         }
 884         iph2->ph1 = iph1;
 885         LIST_INSERT_HEAD(&iph1->ph2tree, iph2, ph1bind);
 886 }
 887
 888 void
 889 unbindph12(iph2)
 890         struct ph2handle *iph2;
 891 {
 892         if (iph2->ph1 != NULL) {
 893                 plog(LLV_DEBUG, LOCATION, NULL, "unbindph12.\n");
 894                 iph2->ph1 = NULL;
 895                 LIST_REMOVE(iph2, ph1bind);
 896         }
 897 }
 898
 899 void
 900 rebindph12(new_ph1, iph2)
 901 struct ph1handle *new_ph1;
 902 struct ph2handle *iph2;
 903 {
 904         if (!new_ph1) {
 905                 return;
 906         }
 907
 908         // reconcile the ph1-to-ph2 binding
 909         plog(LLV_DEBUG, LOCATION, NULL, "rebindph12.\n");
 910         unbindph12(iph2);
 911         bindph12(new_ph1, iph2);
 912         // recalculate ivm since ph1 binding has changed
 913         if (iph2->ivm != NULL) {
 914                 oakley_delivm(iph2->ivm);
 915                 if (new_ph1->status == PHASE1ST_ESTABLISHED) {
 916                         iph2->ivm = oakley_newiv2(new_ph1, iph2->msgid);
 917                         plog(LLV_DEBUG, LOCATION, NULL, "ph12 binding changed... recalculated ivm.\n");
 918                 } else {
 919                         iph2->ivm = NULL;
 920                 }
 921         }
 922 }
 923
 924 /* %%% management contacted list */
 925 /*
 926  * search contacted list.
 927  */
 928 struct contacted *
 929 getcontacted(remote)
 930         struct sockaddr *remote;
 931 {
 932         struct contacted *p;
 933
 934         LIST_FOREACH(p, &ctdtree, chain) {
 935                 if (cmpsaddrstrict(remote, p->remote) == 0)
 936                         return p;
 937         }
 938
 939         return NULL;
 940 }
 941
 942 /*
 943  * create new isakmp Phase 2 status record to handle isakmp in Phase2
 944  */
 945 int
 946 inscontacted(remote)
 947         struct sockaddr *remote;
 948 {
 949         struct contacted *new;
 950
 951         /* create new iph2 */
 952         new = racoon_calloc(1, sizeof(*new));
 953         if (new == NULL)
 954                 return -1;
 955
 956         new->remote = dupsaddr(remote);
 957         if (new->remote == NULL) {
 958                 plog(LLV_ERROR, LOCATION, NULL,
 959                         "failed to allocate buffer.\n");
 960                 racoon_free(new);
 961                 return -1;
 962         }
 963
 964         LIST_INSERT_HEAD(&ctdtree, new, chain);
 965
 966         return 0;
 967 }
 968
 969
 970 void
 971 clear_contacted()
 972 {
 973         struct contacted *c, *next;
 974
 975         for (c = LIST_FIRST(&ctdtree); c; c = next) {
 976                 next = LIST_NEXT(c, chain);
 977                 LIST_REMOVE(c, chain);
 978                 racoon_free(c->remote);
 979                 racoon_free(c);
 980         }
 981 }
 982
 983 void
 984 initctdtree()
 985 {
 986         LIST_INIT(&ctdtree);
 987 }
 988
 989 /*
 990  * check the response has been sent to the peer.  when not, simply reply
 991  * the buffered packet to the peer.
 992  * OUT:
 993  *       0:     the packet is received at the first time.
 994  *       1:     the packet was processed before.
 995  *       2:     the packet was processed before, but the address mismatches.
 996  *      -1:     error happened.
 997  */
 998 int
 999 check_recvdpkt(remote, local, rbuf)
1000         struct sockaddr *remote, *local;
1001         vchar_t *rbuf;
1002 {
1003         vchar_t *hash;
1004         struct recvdpkt *r;
1005         time_t t;
1006         int len, s;
1007
1008         /* set current time */
1009         t = time(NULL);
1010
1011         hash = eay_md5_one(rbuf);
1012         if (!hash) {
1013                 plog(LLV_ERROR, LOCATION, NULL,
1014                         "failed to allocate buffer.\n");
1015                 return -1;
1016         }
1017
1018         LIST_FOREACH(r, &rcptree, chain) {
1019                 if (memcmp(hash->v, r->hash->v, r->hash->l) == 0)
1020                         break;
1021         }
1022         vfree(hash);
1023
1024         /* this is the first time to receive the packet */
1025         if (r == NULL)
1026                 return 0;
1027
1028         /*
1029          * the packet was processed before, but the remote address mismatches.
1030          * ignore the port to accomodate port changes (e.g. floating).
1031          */
1032         if (cmpsaddrwop(remote, r->remote) != 0) {
1033                 return 2;
1034         }
1035
1036         /*
1037          * it should not check the local address because the packet
1038          * may arrive at other interface.
1039          */
1040
1041         /* check the previous time to send */
1042         if (t - r->time_send < 1) {
1043                 plog(LLV_WARNING, LOCATION, NULL,
1044                         "the packet retransmitted in a short time from %s\n",
1045                         saddr2str(remote));
1046                 /*XXX should it be error ? */
1047         }
1048
1049         /* select the socket to be sent */
1050         s = getsockmyaddr(r->local);
1051         if (s == -1)
1052                 return -1;
1053
1054         /* resend the packet if needed */
1055         len = sendfromto(s, r->sendbuf->v, r->sendbuf->l,
1056                         r->local, r->remote, lcconf->count_persend);
1057         if (len == -1) {
1058                 plog(LLV_ERROR, LOCATION, NULL, "sendfromto failed\n");
1059                 return -1;
1060         }
1061
1062         /* check the retry counter */
1063         r->retry_counter--;
1064         if (r->retry_counter <= 0) {
1065                 rem_recvdpkt(r);
1066                 del_recvdpkt(r);
1067                 plog(LLV_DEBUG, LOCATION, NULL,
1068                         "deleted the retransmission packet to %s.\n",
1069                         saddr2str(remote));
1070         } else
1071                 r->time_send = t;
1072
1073         return 1;
1074 }
1075
1076 /*
1077  * adding a hash of received packet into the received list.
1078  */
1079 int
1080 add_recvdpkt(remote, local, sbuf, rbuf, non_esp)
1081         struct sockaddr *remote, *local;
1082         vchar_t *sbuf, *rbuf;
1083     size_t non_esp;
1084 {
1085         struct recvdpkt *new = NULL;
1086
1087         if (lcconf->retry_counter == 0) {
1088                 /* no need to add it */
1089                 return 0;
1090         }
1091
1092         new = racoon_calloc(1, sizeof(*new));
1093         if (!new) {
1094                 plog(LLV_ERROR, LOCATION, NULL,
1095                         "failed to allocate buffer.\n");
1096                 return -1;
1097         }
1098
1099         new->hash = eay_md5_one(rbuf);
1100         if (!new->hash) {
1101                 plog(LLV_ERROR, LOCATION, NULL,
1102                         "failed to allocate buffer.\n");
1103                 del_recvdpkt(new);
1104                 return -1;
1105         }
1106         new->remote = dupsaddr(remote);
1107         if (new->remote == NULL) {
1108                 plog(LLV_ERROR, LOCATION, NULL,
1109                         "failed to allocate buffer.\n");
1110                 del_recvdpkt(new);
1111                 return -1;
1112         }
1113         new->local = dupsaddr(local);
1114         if (new->local == NULL) {
1115                 plog(LLV_ERROR, LOCATION, NULL,
1116                         "failed to allocate buffer.\n");
1117                 del_recvdpkt(new);
1118                 return -1;
1119         }
1120
1121         if (non_esp) {
1122                 plog (LLV_DEBUG, LOCATION, NULL, "Adding NON-ESP marker\n");
1123
1124         /* If NAT-T port floating is in use, 4 zero bytes (non-ESP marker)
1125          must added just before the packet itself. For this we must
1126          allocate a new buffer and release it at the end. */
1127         if ((new->sendbuf = vmalloc (sbuf->l + non_esp)) == NULL) {
1128             plog(LLV_ERROR, LOCATION, NULL,
1129                  "failed to allocate extra buf for non-esp\n");
1130             del_recvdpkt(new);
1131             return -1;
1132         }
1133         *(u_int32_t *)new->sendbuf->v = 0;
1134         memcpy(new->sendbuf->v + non_esp, sbuf->v, sbuf->l);
1135     } else {
1136         new->sendbuf = vdup(sbuf);
1137         if (new->sendbuf == NULL) {
1138             plog(LLV_ERROR, LOCATION, NULL,
1139                  "failed to allocate buffer.\n");
1140             del_recvdpkt(new);
1141             return -1;
1142         }
1143     }
1144
1145         new->retry_counter = lcconf->retry_counter;
1146         new->time_send = 0;
1147         new->created = time(NULL);
1148
1149         LIST_INSERT_HEAD(&rcptree, new, chain);
1150
1151         return 0;
1152 }
1153
1154 void
1155 del_recvdpkt(r)
1156         struct recvdpkt *r;
1157 {
1158         if (r->remote)
1159                 racoon_free(r->remote);
1160         if (r->local)
1161                 racoon_free(r->local);
1162         if (r->hash)
1163                 vfree(r->hash);
1164         if (r->sendbuf)
1165                 vfree(r->sendbuf);
1166         racoon_free(r);
1167 }
1168
1169 void
1170 rem_recvdpkt(r)
1171         struct recvdpkt *r;
1172 {
1173         LIST_REMOVE(r, chain);
1174 }
1175
1176 void
1177 sweep_recvdpkt(dummy)
1178         void *dummy;
1179 {
1180         struct recvdpkt *r, *next;
1181         time_t t, lt;
1182
1183         /* set current time */
1184         t = time(NULL);
1185
1186         /* set the lifetime of the retransmission */
1187         lt = lcconf->retry_counter * lcconf->retry_interval;
1188
1189         for (r = LIST_FIRST(&rcptree); r; r = next) {
1190                 next = LIST_NEXT(r, chain);
1191
1192                 if (t - r->created > lt) {
1193                         rem_recvdpkt(r);
1194                         del_recvdpkt(r);
1195                 }
1196         }
1197
1198         sched_new(lt, sweep_recvdpkt, NULL);
1199 }
1200
1201 void
1202 clear_recvdpkt()
1203 {
1204         struct recvdpkt *r, *next;
1205
1206         for (r = LIST_FIRST(&rcptree); r; r = next) {
1207                 next = LIST_NEXT(r, chain);
1208                 rem_recvdpkt(r);
1209                 del_recvdpkt(r);
1210         }
1211 }
1212
1213 void
1214 init_recvdpkt()
1215 {
1216         time_t lt = lcconf->retry_counter * lcconf->retry_interval;
1217
1218         LIST_INIT(&rcptree);
1219
1220         sched_new(lt, sweep_recvdpkt, NULL);
1221 }
1222
1223 #ifdef ENABLE_HYBRID
1224 /*
1225  * Returns 0 if the address was obtained by ISAKMP mode config, 1 otherwise
1226  * This should be in isakmp_cfg.c but ph1tree being private, it must be there
1227  */
1228 int
1229 exclude_cfg_addr(addr)
1230         const struct sockaddr *addr;
1231 {
1232         struct ph1handle *p;
1233         struct sockaddr_in *sin;
1234
1235         LIST_FOREACH(p, &ph1tree, chain) {
1236                 if ((p->mode_cfg != NULL) &&
1237                     (p->mode_cfg->flags & ISAKMP_CFG_GOT_ADDR4) &&
1238                     (addr->sa_family == AF_INET)) {
1239                         sin = (struct sockaddr_in *)addr;
1240                         if (sin->sin_addr.s_addr == p->mode_cfg->addr4.s_addr)
1241                                 return 0;
1242                 }
1243         }
1244
1245         return 1;
1246 }
1247 #endif
1248
1249 #ifdef ENABLE_HYBRID
1250 struct ph1handle *
1251 getph1bylogin(login)
1252         char *login;
1253 {
1254         struct ph1handle *p;
1255
1256         LIST_FOREACH(p, &ph1tree, chain) {
1257                 if (p->mode_cfg == NULL)
1258                         continue;
1259                 if (strncmp(p->mode_cfg->login, login, LOGINLEN) == 0)
1260                         return p;
1261         }
1262
1263         return NULL;
1264 }
1265
1266 int
1267 purgeph1bylogin(login)
1268         char *login;
1269 {
1270         struct ph1handle *p;
1271         int found = 0;
1272
1273         LIST_FOREACH(p, &ph1tree, chain) {
1274                 if (p->mode_cfg == NULL)
1275                         continue;
1276                 if (strncmp(p->mode_cfg->login, login, LOGINLEN) == 0) {
1277                         if (p->status == PHASE1ST_ESTABLISHED)
1278                                 isakmp_info_send_d1(p);
1279                         purge_remote(p);
1280                         found++;
1281                 }
1282         }
1283
1284         return found;
1285 }
1286
1287 int
1288 purgephXbydstaddrwop(remote)
1289 struct sockaddr *remote;
1290 {
1291         int    found = 0;
1292         struct ph1handle *p;
1293
1294         LIST_FOREACH(p, &ph1tree, chain) {
1295                 if (cmpsaddrwop(remote, p->remote) == 0) {
1296             plog(LLV_WARNING, LOCATION, NULL,
1297                  "in %s... purging phase1 and related phase2s\n", __FUNCTION__);
1298             ike_session_purge_ph2s_by_ph1(p);
1299                         if (p->status == PHASE1ST_ESTABLISHED)
1300                                 isakmp_info_send_d1(p);
1301             isakmp_ph1expire(p);
1302                         found++;
1303                 }
1304         }
1305
1306         return found;
1307 }
1308
1309 void
1310 purgephXbyspid(u_int32_t spid,
1311                int       del_boundph1)
1312 {
1313         struct ph2handle *iph2;
1314     struct ph1handle *iph1;
1315
1316     // do ph2's first... we need the ph1s for notifications
1317         LIST_FOREACH(iph2, &ph2tree, chain) {
1318                 if (spid == iph2->spid) {
1319             if (iph2->status == PHASE2ST_ESTABLISHED) {
1320                 isakmp_info_send_d2(iph2);
1321             }
1322             isakmp_ph2expire(iph2); // iph2 will go down 1 second later.
1323             ike_session_stopped_by_controller(iph2->parent_session,
1324                                               ike_session_stopped_by_flush);
1325         }
1326     }
1327
1328     // do the ph1s last.
1329         LIST_FOREACH(iph2, &ph2tree, chain) {
1330                 if (spid == iph2->spid) {
1331             if (del_boundph1 && iph2->parent_session) {
1332                 for (iph1 = LIST_FIRST(&iph2->parent_session->ikev1_state.ph1tree); iph1; iph1 = LIST_NEXT(iph1, ph1ofsession_chain)) {
1333                     if (iph1->status == PHASE1ST_ESTABLISHED) {
1334                         isakmp_info_send_d1(iph1);
1335                     }
1336                     isakmp_ph1expire(iph1);
1337                 }
1338             }
1339                 }
1340         }
1341 }
1342
1343 #endif
1344
1345 #ifdef ENABLE_DPD
1346 int
1347 ph1_force_dpd (struct sockaddr *remote)
1348 {
1349     int status = -1;
1350     struct ph1handle *p;
1351
1352     LIST_FOREACH(p, &ph1tree, chain) {
1353         if (cmpsaddrwop(remote, p->remote) == 0) {
1354             if (p->status == PHASE1ST_ESTABLISHED &&
1355                 !p->is_dying &&
1356                 p->dpd_support &&
1357                 p->rmconf->dpd_interval) {
1358                 if(!p->dpd_fails) {
1359                     isakmp_info_send_r_u(p);
1360                     status = 0;
1361                 } else {
1362                     plog(LLV_DEBUG2, LOCATION, NULL, "skipping forced-DPD for phase1 (dpd already in progress).\n");
1363                 }
1364             } else {
1365                 plog(LLV_DEBUG2, LOCATION, NULL, "skipping forced-DPD for phase1 (status %d, dying %d, dpd-support %d, dpd-interval %d).\n",
1366                      p->status, p->is_dying, p->dpd_support, p->rmconf->dpd_interval);
1367             }
1368         }
1369     }
1370
1371         return status;
1372 }
1373 #endif