racoon.tproj/isakmp_inf.c

   1 /*      $KAME: isakmp_inf.c,v 1.81 2002/04/15 01:58:37 itojun Exp $     */
   2
   3 /*
   4  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. Neither the name of the project nor the names of its contributors
  16  *    may be used to endorse or promote products derived from this software
  17  *    without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGE.
  30  */
  31
  32 #include <sys/types.h>
  33 #include <sys/param.h>
  34 #include <sys/socket.h>
  35
  36 #include <net/pfkeyv2.h>
  37 #include <netkey/key_var.h>
  38 #include <netinet/in.h>
  39 #ifdef IPV6_INRIA_VERSION
  40 #include <sys/queue.h>
  41 #include <netinet/ipsec.h>
  42 #else
  43 #include <netinet6/ipsec.h>
  44 #endif
  45
  46 #include <stdlib.h>
  47 #include <stdio.h>
  48 #include <string.h>
  49 #include <errno.h>
  50 #if TIME_WITH_SYS_TIME
  51 # include <sys/time.h>
  52 # include <time.h>
  53 #else
  54 # if HAVE_SYS_TIME_H
  55 #  include <sys/time.h>
  56 # else
  57 #  include <time.h>
  58 # endif
  59 #endif
  60
  61 #include "libpfkey.h"
  62
  63 #include "var.h"
  64 #include "vmbuf.h"
  65 #include "schedule.h"
  66 #include "str2val.h"
  67 #include "misc.h"
  68 #include "plog.h"
  69 #include "debug.h"
  70
  71 #include "localconf.h"
  72 #include "remoteconf.h"
  73 #include "sockmisc.h"
  74 #include "isakmp_var.h"
  75 #include "isakmp.h"
  76 #include "isakmp_inf.h"
  77 #include "oakley.h"
  78 #include "handler.h"
  79 #include "ipsec_doi.h"
  80 #include "crypto_openssl.h"
  81 #include "pfkey.h"
  82 #include "policy.h"
  83 #include "algorithm.h"
  84 #include "proposal.h"
  85 #include "admin.h"
  86 #include "strnames.h"
  87
  88 /* information exchange */
  89 static int isakmp_info_recv_n __P((struct ph1handle *, vchar_t *));
  90 static int isakmp_info_recv_d __P((struct ph1handle *, vchar_t *));
  91
  92 static void purge_isakmp_spi __P((int, isakmp_index *, size_t));
  93 static void purge_ipsec_spi __P((struct sockaddr *, int, u_int32_t *, size_t));
  94 static void info_recv_initialcontact __P((struct ph1handle *));
  95
  96 /* \f%%%
  97  * Information Exchange
  98  */
  99 /*
 100  * receive Information
 101  */
 102 int
 103 isakmp_info_recv(iph1, msg0)
 104         struct ph1handle *iph1;
 105         vchar_t *msg0;
 106 {
 107         vchar_t *msg = NULL;
 108         int error = -1;
 109         struct isakmp *isakmp;
 110         struct isakmp_gen *gen;
 111         u_int8_t np;
 112         int encrypted;
 113
 114         plog(LLV_DEBUG, LOCATION, NULL, "receive Information.\n");
 115
 116         encrypted = ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E);
 117
 118         /* Use new IV to decrypt Informational message. */
 119         if (encrypted) {
 120
 121                 struct isakmp_ivm *ivm;
 122
 123                 /* compute IV */
 124                 ivm = oakley_newiv2(iph1, ((struct isakmp *)msg0->v)->msgid);
 125                 if (ivm == NULL)
 126                         return -1;
 127
 128                 msg = oakley_do_decrypt(iph1, msg0, ivm->iv, ivm->ive);
 129                 oakley_delivm(ivm);
 130                 if (msg == NULL)
 131                         return -1;
 132
 133         } else
 134                 msg = vdup(msg0);
 135
 136         isakmp = (struct isakmp *)msg->v;
 137         gen = (struct isakmp_gen *)((caddr_t)isakmp + sizeof(struct isakmp));
 138
 139
 140         if (isakmp->np != ISAKMP_NPTYPE_HASH) {
 141                 plog(LLV_ERROR, LOCATION, NULL,
 142                     "ignore information because the message has no hash payload.\n");
 143                 goto end;
 144         }
 145
 146         if (iph1->status != PHASE1ST_ESTABLISHED) {
 147                 plog(LLV_ERROR, LOCATION, NULL,
 148                     "ignore information because ISAKMP-SA has not been established yet.\n");
 149                 goto end;
 150         }
 151
 152         np = gen->np;
 153
 154         {
 155                 void *p;
 156                 vchar_t *hash, *payload;
 157                 struct isakmp_gen *nd;
 158
 159                 /*
 160                  * XXX: gen->len includes isakmp header length
 161                  */
 162                 p = (caddr_t) gen + sizeof(struct isakmp_gen);
 163                 nd = (struct isakmp_gen *) ((caddr_t) gen + ntohs(gen->len));
 164
 165                 /* nd length check */
 166                 if (ntohs(nd->len) > msg->l - (sizeof(struct isakmp) + ntohs(gen->len))) {
 167                         plog(LLV_ERROR, LOCATION, NULL,
 168                                  "too long payload length (broken message?)\n");
 169                         goto end;
 170                 }
 171
 172                 payload = vmalloc(ntohs(nd->len));
 173                 if (payload == NULL) {
 174                         plog(LLV_ERROR, LOCATION, NULL,
 175                             "cannot allocate memory\n");
 176                         goto end;
 177                 }
 178
 179                 memcpy(payload->v, (caddr_t) nd, ntohs(nd->len));
 180
 181                 /* compute HASH */
 182                 hash = oakley_compute_hash1(iph1, isakmp->msgid, payload);
 183                 if (hash == NULL) {
 184                         plog(LLV_ERROR, LOCATION, NULL,
 185                             "cannot compute hash\n");
 186
 187                         vfree(payload);
 188                         goto end;
 189                 }
 190
 191                 if (ntohs(gen->len) - sizeof(struct isakmp_gen) != hash->l) {
 192                         plog(LLV_ERROR, LOCATION, NULL,
 193                             "ignore information due to hash length mismatch\n");
 194
 195                         vfree(hash);
 196                         vfree(payload);
 197                         goto end;
 198                 }
 199
 200                 if (memcmp(p, hash->v, hash->l) != 0) {
 201                         plog(LLV_ERROR, LOCATION, NULL,
 202                             "ignore information due to hash mismatch\n");
 203
 204                         vfree(hash);
 205                         vfree(payload);
 206                         goto end;
 207                 }
 208
 209                 plog(LLV_DEBUG, LOCATION, NULL, "hash validated.\n");
 210
 211                 vfree(hash);
 212                 vfree(payload);
 213         }
 214
 215         /* make sure the packet were encrypted. */
 216         if (!encrypted) {
 217                 switch (iph1->etype) {
 218                 case ISAKMP_ETYPE_AGG:
 219                 case ISAKMP_ETYPE_BASE:
 220                 case ISAKMP_ETYPE_IDENT:
 221                         if ((iph1->side == INITIATOR && iph1->status < PHASE1ST_MSG3SENT)
 222                          || (iph1->side == RESPONDER && iph1->status < PHASE1ST_MSG2SENT)) {
 223                                 break;
 224                         }
 225                         /*FALLTHRU*/
 226                 default:
 227                         plog(LLV_ERROR, LOCATION, iph1->remote,
 228                                 "%s message must be encrypted\n",
 229                                 s_isakmp_nptype(np));
 230                         goto end;
 231                 }
 232         }
 233
 234         switch (np) {
 235         case ISAKMP_NPTYPE_N:
 236                 if (isakmp_info_recv_n(iph1, msg) < 0)
 237                         goto end;
 238                 break;
 239         case ISAKMP_NPTYPE_D:
 240                 if (isakmp_info_recv_d(iph1, msg) < 0)
 241                         goto end;
 242                 break;
 243         case ISAKMP_NPTYPE_NONCE:
 244                 /* XXX to be 6.4.2 ike-01.txt */
 245                 /* XXX IV is to be synchronized. */
 246                 plog(LLV_ERROR, LOCATION, iph1->remote,
 247                         "ignore Acknowledged Informational\n");
 248                 break;
 249         default:
 250                 /* don't send information, see isakmp_ident_r1() */
 251                 error = 0;
 252                 plog(LLV_ERROR, LOCATION, iph1->remote,
 253                         "reject the packet, "
 254                         "received unexpecting payload type %d.\n",
 255                         gen->np);
 256                 goto end;
 257         }
 258
 259     end:
 260         if (msg != NULL)
 261                 vfree(msg);
 262
 263         return 0;
 264 }
 265
 266 /*
 267  * send Delete payload (for ISAKMP SA) in Informational exchange.
 268  */
 269 int
 270 isakmp_info_send_d1(iph1)
 271         struct ph1handle *iph1;
 272 {
 273         struct isakmp_pl_d *d;
 274         vchar_t *payload = NULL;
 275         int tlen;
 276         int error = 0;
 277
 278         if (iph1->status != PHASE2ST_ESTABLISHED)
 279                 return 0;
 280
 281         /* create delete payload */
 282
 283         /* send SPIs of inbound SAs. */
 284         /* XXX should send outbound SAs's ? */
 285         tlen = sizeof(*d) + sizeof(isakmp_index);
 286         payload = vmalloc(tlen);
 287         if (payload == NULL) {
 288                 plog(LLV_ERROR, LOCATION, NULL,
 289                         "failed to get buffer for payload.\n");
 290                 return errno;
 291         }
 292
 293         d = (struct isakmp_pl_d *)payload->v;
 294         d->h.np = ISAKMP_NPTYPE_NONE;
 295         d->h.len = htons(tlen);
 296         d->doi = htonl(IPSEC_DOI);
 297         d->proto_id = IPSECDOI_PROTO_ISAKMP;
 298         d->spi_size = sizeof(isakmp_index);
 299         d->num_spi = htons(1);
 300         memcpy(d + 1, &iph1->index, sizeof(isakmp_index));
 301
 302         error = isakmp_info_send_common(iph1, payload,
 303                                         ISAKMP_NPTYPE_D, 0);
 304         vfree(payload);
 305
 306         return error;
 307 }
 308
 309 /*
 310  * send Delete payload (for IPsec SA) in Informational exchange, based on
 311  * pfkey msg.  It sends always single SPI.
 312  */
 313 int
 314 isakmp_info_send_d2(iph2)
 315         struct ph2handle *iph2;
 316 {
 317         struct ph1handle *iph1;
 318         struct saproto *pr;
 319         struct isakmp_pl_d *d;
 320         vchar_t *payload = NULL;
 321         int tlen;
 322         int error = 0;
 323         u_int8_t *spi;
 324
 325         if (iph2->status != PHASE2ST_ESTABLISHED)
 326                 return 0;
 327
 328         /*
 329          * don't send delete information if there is no phase 1 handler.
 330          * It's nonsensical to negotiate phase 1 to send the information.
 331          */
 332         iph1 = getph1byaddr(iph2->src, iph2->dst);
 333         if (iph1 == NULL)
 334                 return 0;
 335
 336         /* create delete payload */
 337         for (pr = iph2->approval->head; pr != NULL; pr = pr->next) {
 338
 339                 /* send SPIs of inbound SAs. */
 340                 /*
 341                  * XXX should I send outbound SAs's ?
 342                  * I send inbound SAs's SPI only at the moment because I can't
 343                  * decode any more if peer send encoded packet without aware of
 344                  * deletion of SA.  Outbound SAs don't come under the situation.
 345                  */
 346                 tlen = sizeof(*d) + pr->spisize;
 347                 payload = vmalloc(tlen);
 348                 if (payload == NULL) {
 349                         plog(LLV_ERROR, LOCATION, NULL,
 350                                 "failed to get buffer for payload.\n");
 351                         return errno;
 352                 }
 353
 354                 d = (struct isakmp_pl_d *)payload->v;
 355                 d->h.np = ISAKMP_NPTYPE_NONE;
 356                 d->h.len = htons(tlen);
 357                 d->doi = htonl(IPSEC_DOI);
 358                 d->proto_id = pr->proto_id;
 359                 d->spi_size = pr->spisize;
 360                 d->num_spi = htons(1);
 361                 /*
 362                  * XXX SPI bits are left-filled, for use with IPComp.
 363                  * we should be switching to variable-length spi field...
 364                  */
 365                 spi = (u_int8_t *)&pr->spi;
 366                 spi += sizeof(pr->spi);
 367                 spi -= pr->spisize;
 368                 memcpy(d + 1, spi, pr->spisize);
 369
 370                 error = isakmp_info_send_common(iph1, payload,
 371                                                 ISAKMP_NPTYPE_D, 0);
 372                 vfree(payload);
 373         }
 374
 375         return error;
 376 }
 377
 378 /*
 379  * send Notification payload (for without ISAKMP SA) in Informational exchange
 380  */
 381 int
 382 isakmp_info_send_nx(isakmp, remote, local, type, data)
 383         struct isakmp *isakmp;
 384         struct sockaddr *remote, *local;
 385         int type;
 386         vchar_t *data;
 387 {
 388         struct ph1handle *iph1 = NULL;
 389         struct remoteconf *rmconf;
 390         vchar_t *payload = NULL;
 391         int tlen;
 392         int error = -1;
 393         struct isakmp_pl_n *n;
 394         int spisiz = 0;         /* see below */
 395
 396         /* search appropreate configuration */
 397         rmconf = getrmconf(remote);
 398         if (rmconf == NULL) {
 399                 plog(LLV_ERROR, LOCATION, remote,
 400                         "no configuration found for peer address.\n");
 401                 goto end;
 402         }
 403
 404         /* add new entry to isakmp status table. */
 405         iph1 = newph1();
 406         if (iph1 == NULL)
 407                 return -1;
 408
 409         memcpy(&iph1->index.i_ck, &isakmp->i_ck, sizeof(cookie_t));
 410         isakmp_newcookie((char *)&iph1->index.r_ck, remote, local);
 411         iph1->status = PHASE1ST_START;
 412         iph1->rmconf = rmconf;
 413         iph1->side = INITIATOR;
 414         iph1->version = isakmp->v;
 415         iph1->flags = 0;
 416         iph1->msgid = 0;        /* XXX */
 417
 418         /* copy remote address */
 419         if (copy_ph1addresses(iph1, rmconf, remote, local) < 0)
 420                 return -1;
 421
 422         tlen = sizeof(*n) + spisiz;
 423         if (data)
 424                 tlen += data->l;
 425         payload = vmalloc(tlen);
 426         if (payload == NULL) {
 427                 plog(LLV_ERROR, LOCATION, NULL,
 428                         "failed to get buffer to send.\n");
 429                 goto end;
 430         }
 431
 432         n = (struct isakmp_pl_n *)payload->v;
 433         n->h.np = ISAKMP_NPTYPE_NONE;
 434         n->h.len = htons(tlen);
 435         n->doi = htonl(IPSEC_DOI);
 436         n->proto_id = IPSECDOI_KEY_IKE;
 437         n->spi_size = spisiz;
 438         n->type = htons(type);
 439         if (spisiz)
 440                 memset(n + 1, 0, spisiz);       /*XXX*/
 441         if (data)
 442                 memcpy((caddr_t)(n + 1) + spisiz, data->v, data->l);
 443
 444         error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 0);
 445         vfree(payload);
 446
 447     end:
 448         if (iph1 != NULL)
 449                 delph1(iph1);
 450
 451         return error;
 452 }
 453
 454 /*
 455  * send Notification payload (for ISAKMP SA) in Informational exchange
 456  */
 457 int
 458 isakmp_info_send_n1(iph1, type, data)
 459         struct ph1handle *iph1;
 460         int type;
 461         vchar_t *data;
 462 {
 463         vchar_t *payload = NULL;
 464         int tlen;
 465         int error = 0;
 466         struct isakmp_pl_n *n;
 467         int spisiz;
 468
 469         /*
 470          * note on SPI size: which description is correct?  I have chosen
 471          * this to be 0.
 472          *
 473          * RFC2408 3.1, 2nd paragraph says: ISAKMP SA is identified by
 474          * Initiator/Responder cookie and SPI has no meaning, SPI size = 0.
 475          * RFC2408 3.1, first paragraph on page 40: ISAKMP SA is identified
 476          * by cookie and SPI has no meaning, 0 <= SPI size <= 16.
 477          * RFC2407 4.6.3.3, INITIAL-CONTACT is required to set to 16.
 478          */
 479         if (type == ISAKMP_NTYPE_INITIAL_CONTACT)
 480                 spisiz = sizeof(isakmp_index);
 481         else
 482                 spisiz = 0;
 483
 484         tlen = sizeof(*n) + spisiz;
 485         if (data)
 486                 tlen += data->l;
 487         payload = vmalloc(tlen);
 488         if (payload == NULL) {
 489                 plog(LLV_ERROR, LOCATION, NULL,
 490                         "failed to get buffer to send.\n");
 491                 return errno;
 492         }
 493
 494         n = (struct isakmp_pl_n *)payload->v;
 495         n->h.np = ISAKMP_NPTYPE_NONE;
 496         n->h.len = htons(tlen);
 497         n->doi = htonl(iph1->rmconf->doitype);
 498         n->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX to be configurable ? */
 499         n->spi_size = spisiz;
 500         n->type = htons(type);
 501         if (spisiz)
 502                 memcpy(n + 1, &iph1->index, sizeof(isakmp_index));
 503         if (data)
 504                 memcpy((caddr_t)(n + 1) + spisiz, data->v, data->l);
 505
 506         error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, iph1->flags);
 507         vfree(payload);
 508
 509         return error;
 510 }
 511
 512 /*
 513  * send Notification payload (for IPsec SA) in Informational exchange
 514  */
 515 int
 516 isakmp_info_send_n2(iph2, type, data)
 517         struct ph2handle *iph2;
 518         int type;
 519         vchar_t *data;
 520 {
 521         struct ph1handle *iph1 = iph2->ph1;
 522         vchar_t *payload = NULL;
 523         int tlen;
 524         int error = 0;
 525         struct isakmp_pl_n *n;
 526         struct saproto *pr;
 527
 528         if (!iph2->approval)
 529                 return EINVAL;
 530
 531         pr = iph2->approval->head;
 532
 533         /* XXX must be get proper spi */
 534         tlen = sizeof(*n) + pr->spisize;
 535         if (data)
 536                 tlen += data->l;
 537         payload = vmalloc(tlen);
 538         if (payload == NULL) {
 539                 plog(LLV_ERROR, LOCATION, NULL,
 540                         "failed to get buffer to send.\n");
 541                 return errno;
 542         }
 543
 544         n = (struct isakmp_pl_n *)payload->v;
 545         n->h.np = ISAKMP_NPTYPE_NONE;
 546         n->h.len = htons(tlen);
 547         n->doi = htonl(IPSEC_DOI);              /* IPSEC DOI (1) */
 548         n->proto_id = pr->proto_id;             /* IPSEC AH/ESP/whatever*/
 549         n->spi_size = pr->spisize;
 550         n->type = htons(type);
 551         *(u_int32_t *)(n + 1) = pr->spi;
 552         if (data)
 553                 memcpy((caddr_t)(n + 1) + pr->spisize, data->v, data->l);
 554
 555         iph2->flags |= ISAKMP_FLAG_E;   /* XXX Should we do FLAG_A ? */
 556         error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, iph2->flags);
 557         vfree(payload);
 558
 559         return error;
 560 }
 561
 562 /*
 563  * send Information
 564  * When ph1->skeyid_a == NULL, send message without encoding.
 565  */
 566 int
 567 isakmp_info_send_common(iph1, payload, np, flags)
 568         struct ph1handle *iph1;
 569         vchar_t *payload;
 570         u_int32_t np;
 571         int flags;
 572 {
 573         struct ph2handle *iph2 = NULL;
 574         vchar_t *hash = NULL;
 575         struct isakmp *isakmp;
 576         struct isakmp_gen *gen;
 577         char *p;
 578         int tlen;
 579         int error = -1;
 580
 581         /* add new entry to isakmp status table */
 582         iph2 = newph2();
 583         if (iph2 == NULL)
 584                 goto end;
 585
 586         iph2->dst = dupsaddr(iph1->remote);
 587         iph2->src = dupsaddr(iph1->local);
 588         switch (iph1->remote->sa_family) {
 589         case AF_INET:
 590                 ((struct sockaddr_in *)iph2->dst)->sin_port = 0;
 591                 ((struct sockaddr_in *)iph2->src)->sin_port = 0;
 592                 break;
 593 #ifdef INET6
 594         case AF_INET6:
 595                 ((struct sockaddr_in6 *)iph2->dst)->sin6_port = 0;
 596                 ((struct sockaddr_in6 *)iph2->src)->sin6_port = 0;
 597                 break;
 598 #endif
 599         default:
 600                 plog(LLV_ERROR, LOCATION, NULL,
 601                         "invalid family: %d\n", iph1->remote->sa_family);
 602                 delph2(iph2);
 603                 goto end;
 604         }
 605         iph2->ph1 = iph1;
 606         iph2->side = INITIATOR;
 607         iph2->status = PHASE2ST_START;
 608         iph2->msgid = isakmp_newmsgid2(iph1);
 609
 610         /* get IV and HASH(1) if skeyid_a was generated. */
 611         if (iph1->skeyid_a != NULL) {
 612                 iph2->ivm = oakley_newiv2(iph1, iph2->msgid);
 613                 if (iph2->ivm == NULL) {
 614                         delph2(iph2);
 615                         goto end;
 616                 }
 617
 618                 /* generate HASH(1) */
 619                 hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, payload);
 620                 if (hash == NULL) {
 621                         delph2(iph2);
 622                         goto end;
 623                 }
 624
 625                 /* initialized total buffer length */
 626                 tlen = hash->l;
 627                 tlen += sizeof(*gen);
 628         } else {
 629                 /* IKE-SA is not established */
 630                 hash = NULL;
 631
 632                 /* initialized total buffer length */
 633                 tlen = 0;
 634         }
 635         if ((flags & ISAKMP_FLAG_A) == 0)
 636                 iph2->flags = (hash == NULL ? 0 : ISAKMP_FLAG_E);
 637         else
 638                 iph2->flags = (hash == NULL ? 0 : ISAKMP_FLAG_A);
 639
 640         insph2(iph2);
 641         bindph12(iph1, iph2);
 642
 643         tlen += sizeof(*isakmp) + payload->l;
 644
 645         /* create buffer for isakmp payload */
 646         iph2->sendbuf = vmalloc(tlen);
 647         if (iph2->sendbuf == NULL) {
 648                 plog(LLV_ERROR, LOCATION, NULL,
 649                         "failed to get buffer to send.\n");
 650                 goto err;
 651         }
 652
 653         /* create isakmp header */
 654         isakmp = (struct isakmp *)iph2->sendbuf->v;
 655         memcpy(&isakmp->i_ck, &iph1->index.i_ck, sizeof(cookie_t));
 656         memcpy(&isakmp->r_ck, &iph1->index.r_ck, sizeof(cookie_t));
 657         isakmp->np = hash == NULL ? (np & 0xff) : ISAKMP_NPTYPE_HASH;
 658         isakmp->v = iph1->version;
 659         isakmp->etype = ISAKMP_ETYPE_INFO;
 660         isakmp->flags = iph2->flags;
 661         memcpy(&isakmp->msgid, &iph2->msgid, sizeof(isakmp->msgid));
 662         isakmp->len   = htonl(tlen);
 663         p = (char *)(isakmp + 1);
 664
 665         /* create HASH payload */
 666         if (hash != NULL) {
 667                 gen = (struct isakmp_gen *)p;
 668                 gen->np = np & 0xff;
 669                 gen->len = htons(sizeof(*gen) + hash->l);
 670                 p += sizeof(*gen);
 671                 memcpy(p, hash->v, hash->l);
 672                 p += hash->l;
 673         }
 674
 675         /* add payload */
 676         memcpy(p, payload->v, payload->l);
 677         p += payload->l;
 678
 679 #ifdef HAVE_PRINT_ISAKMP_C
 680         isakmp_printpacket(iph2->sendbuf, iph1->local, iph1->remote, 1);
 681 #endif
 682
 683         /* encoding */
 684         if (ISSET(isakmp->flags, ISAKMP_FLAG_E)) {
 685                 vchar_t *tmp;
 686
 687                 tmp = oakley_do_encrypt(iph2->ph1, iph2->sendbuf, iph2->ivm->ive,
 688                                 iph2->ivm->iv);
 689                 if (tmp == NULL) {
 690                         vfree(iph2->sendbuf);
 691                         iph2->sendbuf = NULL;
 692                         goto err;
 693                 }
 694                 vfree(iph2->sendbuf);
 695                 iph2->sendbuf = tmp;
 696         }
 697
 698         /* HDR*, HASH(1), N */
 699         if (isakmp_send(iph2->ph1, iph2->sendbuf) < 0) {
 700                 vfree(iph2->sendbuf);
 701                 iph2->sendbuf = NULL;
 702                 goto err;
 703         }
 704
 705         plog(LLV_DEBUG, LOCATION, NULL,
 706                 "sendto Information %s.\n", s_isakmp_nptype(np));
 707
 708         /*
 709          * don't resend notify message because peer can use Acknowledged
 710          * Informational if peer requires the reply of the notify message.
 711          */
 712
 713         /* XXX If Acknowledged Informational required, don't delete ph2handle */
 714         error = 0;
 715         vfree(iph2->sendbuf);
 716         iph2->sendbuf = NULL;
 717         goto err;       /* XXX */
 718
 719 end:
 720         if (hash)
 721                 vfree(hash);
 722         return error;
 723
 724 err:
 725         unbindph12(iph2);
 726         remph2(iph2);
 727         delph2(iph2);
 728         goto end;
 729 }
 730
 731 /*
 732  * add a notify payload to buffer by reallocating buffer.
 733  * If buf == NULL, the function only create a notify payload.
 734  *
 735  * XXX Which is SPI to be included, inbound or outbound ?
 736  */
 737 vchar_t *
 738 isakmp_add_pl_n(buf0, np_p, type, pr, data)
 739         vchar_t *buf0;
 740         u_int8_t **np_p;
 741         int type;
 742         struct saproto *pr;
 743         vchar_t *data;
 744 {
 745         vchar_t *buf = NULL;
 746         struct isakmp_pl_n *n;
 747         int tlen;
 748         int oldlen = 0;
 749
 750         if (*np_p)
 751                 **np_p = ISAKMP_NPTYPE_N;
 752
 753         tlen = sizeof(*n) + pr->spisize;
 754
 755         if (data)
 756                 tlen += data->l;
 757         if (buf0) {
 758                 oldlen = buf0->l;
 759                 buf = vrealloc(buf0, buf0->l + tlen);
 760         } else
 761                 buf = vmalloc(tlen);
 762         if (!buf) {
 763                 plog(LLV_ERROR, LOCATION, NULL,
 764                         "failed to get a payload buffer.\n");
 765                 return NULL;
 766         }
 767
 768         n = (struct isakmp_pl_n *)(buf->v + oldlen);
 769         n->h.np = ISAKMP_NPTYPE_NONE;
 770         n->h.len = htons(tlen);
 771         n->doi = htonl(IPSEC_DOI);              /* IPSEC DOI (1) */
 772         n->proto_id = pr->proto_id;             /* IPSEC AH/ESP/whatever*/
 773         n->spi_size = pr->spisize;
 774         n->type = htons(type);
 775         *(u_int32_t *)(n + 1) = pr->spi;        /* XXX */
 776         if (data)
 777                 memcpy((caddr_t)(n + 1) + pr->spisize, data->v, data->l);
 778
 779         /* save the pointer of next payload type */
 780         *np_p = &n->h.np;
 781
 782         return buf;
 783 }
 784
 785 /*
 786  * handling to receive Notification payload
 787  */
 788 static int
 789 isakmp_info_recv_n(iph1, msg)
 790         struct ph1handle *iph1;
 791         vchar_t *msg;
 792 {
 793         struct isakmp_pl_n *n = NULL;
 794         u_int type;
 795         vchar_t *pbuf;
 796         struct isakmp_parse_t *pa, *pap;
 797         char *spi;
 798
 799         if (!(pbuf = isakmp_parse(msg)))
 800                 return -1;
 801         pa = (struct isakmp_parse_t *)pbuf->v;
 802         for (pap = pa; pap->type; pap++) {
 803                 switch (pap->type) {
 804                 case ISAKMP_NPTYPE_HASH:
 805                         /* do something here */
 806                         break;
 807                 case ISAKMP_NPTYPE_NONCE:
 808                         /* send to ack */
 809                         break;
 810                 case ISAKMP_NPTYPE_N:
 811                         n = (struct isakmp_pl_n *)pap->ptr;
 812                         break;
 813                 default:
 814                         vfree(pbuf);
 815                         return -1;
 816                 }
 817         }
 818         vfree(pbuf);
 819         if (!n)
 820                 return -1;
 821
 822         type = ntohs(n->type);
 823
 824         switch (type) {
 825         case ISAKMP_NTYPE_CONNECTED:
 826         case ISAKMP_NTYPE_RESPONDER_LIFETIME:
 827         case ISAKMP_NTYPE_REPLAY_STATUS:
 828                 /* do something */
 829                 break;
 830         case ISAKMP_NTYPE_INITIAL_CONTACT:
 831                 info_recv_initialcontact(iph1);
 832                 break;
 833         default:
 834             {
 835                 u_int32_t msgid = ((struct isakmp *)msg->v)->msgid;
 836                 struct ph2handle *iph2;
 837
 838                 /* XXX there is a potential of dos attack. */
 839                 if (msgid == 0) {
 840                         /* delete ph1 */
 841                         plog(LLV_ERROR, LOCATION, iph1->remote,
 842                                 "delete phase1 handle.\n");
 843                         return -1;
 844                 } else {
 845                         iph2 = getph2bymsgid(iph1, msgid);
 846                         if (iph2 == NULL) {
 847                                 plog(LLV_ERROR, LOCATION, iph1->remote,
 848                                         "unknown notify message, "
 849                                         "no phase2 handle found.\n");
 850                         } else {
 851                                 /* delete ph2 */
 852                                 unbindph12(iph2);
 853                                 remph2(iph2);
 854                                 delph2(iph2);
 855                         }
 856                 }
 857             }
 858                 break;
 859         }
 860
 861         /* get spi and allocate */
 862         if (ntohs(n->h.len) < sizeof(*n) + n->spi_size) {
 863                 plog(LLV_ERROR, LOCATION, iph1->remote,
 864                         "invalid spi_size in notification payload.\n");
 865                 return -1;
 866         }
 867         spi = val2str((u_char *)(n + 1), n->spi_size);
 868
 869         plog(LLV_DEBUG, LOCATION, iph1->remote,
 870                 "notification message %d:%s, "
 871                 "doi=%d proto_id=%d spi=%s(size=%d).\n",
 872                 type, s_isakmp_notify_msg(type),
 873                 ntohl(n->doi), n->proto_id, spi, n->spi_size);
 874
 875         racoon_free(spi);
 876
 877         return(0);
 878 }
 879
 880 static void
 881 purge_isakmp_spi(proto, spi, n)
 882         int proto;
 883         isakmp_index *spi;      /*network byteorder*/
 884         size_t n;
 885 {
 886         struct ph1handle *iph1;
 887         size_t i;
 888
 889         for (i = 0; i < n; i++) {
 890                 iph1 = getph1byindex(&spi[i]);
 891                 if (!iph1)
 892                         continue;
 893
 894                 plog(LLV_INFO, LOCATION, NULL,
 895                         "purged ISAKMP-SA proto_id=%s spi=%s.\n",
 896                         s_ipsecdoi_proto(proto),
 897                         isakmp_pindex(&spi[i], 0));
 898
 899                 if (iph1->sce)
 900                         SCHED_KILL(iph1->sce);
 901                 iph1->status = PHASE1ST_EXPIRED;
 902                 iph1->sce = sched_new(1, isakmp_ph1delete_stub, iph1);
 903         }
 904 }
 905
 906 static void
 907 purge_ipsec_spi(dst0, proto, spi, n)
 908         struct sockaddr *dst0;
 909         int proto;
 910         u_int32_t *spi; /*network byteorder*/
 911         size_t n;
 912 {
 913         vchar_t *buf = NULL;
 914         struct sadb_msg *msg, *next, *end;
 915         struct sadb_sa *sa;
 916         struct sockaddr *src, *dst;
 917         struct ph2handle *iph2;
 918         size_t i;
 919         caddr_t mhp[SADB_EXT_MAX + 1];
 920
 921         buf = pfkey_dump_sadb(ipsecdoi2pfkey_proto(proto));
 922         if (buf == NULL) {
 923                 plog(LLV_DEBUG, LOCATION, NULL,
 924                         "pfkey_dump_sadb returned nothing.\n");
 925                 return;
 926         }
 927
 928         msg = (struct sadb_msg *)buf->v;
 929         end = (struct sadb_msg *)(buf->v + buf->l);
 930
 931         while (msg < end) {
 932                 if ((msg->sadb_msg_len << 3) < sizeof(*msg))
 933                         break;
 934                 next = (struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3));
 935                 if (msg->sadb_msg_type != SADB_DUMP) {
 936                         msg = next;
 937                         continue;
 938                 }
 939
 940                 if (pfkey_align(msg, mhp) || pfkey_check(mhp)) {
 941                         plog(LLV_ERROR, LOCATION, NULL,
 942                                 "pfkey_check (%s)\n", ipsec_strerror());
 943                         msg = next;
 944                         continue;
 945                 }
 946
 947                 sa = (struct sadb_sa *)(mhp[SADB_EXT_SA]);
 948                 if (!sa
 949                  || !mhp[SADB_EXT_ADDRESS_SRC]
 950                  || !mhp[SADB_EXT_ADDRESS_DST]) {
 951                         msg = next;
 952                         continue;
 953                 }
 954                 src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
 955                 dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
 956
 957                 if (sa->sadb_sa_state != SADB_SASTATE_MATURE
 958                  && sa->sadb_sa_state != SADB_SASTATE_DYING) {
 959                         msg = next;
 960                         continue;
 961                 }
 962
 963                 /* XXX n^2 algorithm, inefficient */
 964
 965                 /* don't delete inbound SAs at the moment */
 966                 /* XXX should we remove SAs with opposite direction as well? */
 967                 if (cmpsaddrwop(dst0, dst)) {
 968                         msg = next;
 969                         continue;
 970                 }
 971
 972                 for (i = 0; i < n; i++) {
 973                         plog(LLV_DEBUG, LOCATION, NULL,
 974                                 "check spi(packet)=%u spi(db)=%u.\n",
 975                                 ntohl(spi[i]), ntohl(sa->sadb_sa_spi));
 976                         if (spi[i] != sa->sadb_sa_spi)
 977                                 continue;
 978
 979                         pfkey_send_delete(lcconf->sock_pfkey,
 980                                 msg->sadb_msg_satype,
 981                                 IPSEC_MODE_ANY,
 982                                 src, dst, sa->sadb_sa_spi);
 983
 984                         /*
 985                          * delete a relative phase 2 handler.
 986                          * continue to process if no relative phase 2 handler
 987                          * exists.
 988                          */
 989                         iph2 = getph2bysaidx(src, dst, proto, spi[i]);
 990                         if (iph2) {
 991                                 unbindph12(iph2);
 992                                 remph2(iph2);
 993                                 delph2(iph2);
 994                         }
 995
 996                         plog(LLV_INFO, LOCATION, NULL,
 997                                 "purged IPsec-SA proto_id=%s spi=%u.\n",
 998                                 s_ipsecdoi_proto(proto),
 999                                 ntohl(spi[i]));
1000                 }
1001
1002                 msg = next;
1003         }
1004
1005         if (buf)
1006                 vfree(buf);
1007 }
1008
1009 /*
1010  * delete all phase2 sa relatived to the destination address.
1011  * Don't delete Phase 1 handlers on INITIAL-CONTACT, and don't ignore
1012  * an INITIAL-CONTACT if we have contacted the peer.  This matches the
1013  * Sun IKE behavior, and makes rekeying work much better when the peer
1014  * restarts.
1015  */
1016 static void
1017 info_recv_initialcontact(iph1)
1018         struct ph1handle *iph1;
1019 {
1020         vchar_t *buf = NULL;
1021         struct sadb_msg *msg, *next, *end;
1022         struct sadb_sa *sa;
1023         struct sockaddr *src, *dst;
1024         caddr_t mhp[SADB_EXT_MAX + 1];
1025         int proto_id, i;
1026         struct ph2handle *iph2;
1027 #if 0
1028         char *loc, *rem;
1029 #endif
1030
1031         if (f_local)
1032                 return;
1033
1034 #if 0
1035         loc = strdup(saddrwop2str(iph1->local));
1036         rem = strdup(saddrwop2str(iph1->remote));
1037
1038         /*
1039          * Purge all IPSEC-SAs for the peer.  We can do this
1040          * the easy way (using a PF_KEY SADB_DELETE extension)
1041          * or we can do it the hard way.
1042          */
1043         for (i = 0; i < pfkey_nsatypes; i++) {
1044                 proto_id = pfkey2ipsecdoi_proto(pfkey_satypes[i].ps_satype);
1045
1046                 plog(LLV_INFO, LOCATION, NULL,
1047                     "purging %s SAs for %s -> %s\n",
1048                     pfkey_satypes[i].ps_name, loc, rem);
1049                 if (pfkey_send_delete_all(lcconf->sock_pfkey,
1050                     pfkey_satypes[i].ps_satype, IPSEC_MODE_ANY,
1051                     iph1->local, iph1->remote) == -1) {
1052                         plog(LLV_ERROR, LOCATION, NULL,
1053                             "delete_all %s -> %s failed for %s (%s)\n",
1054                             loc, rem,
1055                             pfkey_satypes[i].ps_name, ipsec_strerror());
1056                         goto the_hard_way;
1057                 }
1058
1059                 deleteallph2(iph1->local, iph1->remote, proto_id);
1060
1061                 plog(LLV_INFO, LOCATION, NULL,
1062                     "purging %s SAs for %s -> %s\n",
1063                     pfkey_satypes[i].ps_name, rem, loc);
1064                 if (pfkey_send_delete_all(lcconf->sock_pfkey,
1065                     pfkey_satypes[i].ps_satype, IPSEC_MODE_ANY,
1066                     iph1->remote, iph1->local) == -1) {
1067                         plog(LLV_ERROR, LOCATION, NULL,
1068                             "delete_all %s -> %s failed for %s (%s)\n",
1069                             rem, loc,
1070                             pfkey_satypes[i].ps_name, ipsec_strerror());
1071                         goto the_hard_way;
1072                 }
1073
1074                 deleteallph2(iph1->remote, iph1->local, proto_id);
1075         }
1076
1077         racoon_free(loc);
1078         racoon_free(rem);
1079         return;
1080
1081  the_hard_way:
1082         racoon_free(loc);
1083         racoon_free(rem);
1084 #endif
1085
1086         buf = pfkey_dump_sadb(SADB_SATYPE_UNSPEC);
1087         if (buf == NULL) {
1088                 plog(LLV_DEBUG, LOCATION, NULL,
1089                         "pfkey_dump_sadb returned nothing.\n");
1090                 return;
1091         }
1092
1093         msg = (struct sadb_msg *)buf->v;
1094         end = (struct sadb_msg *)(buf->v + buf->l);
1095
1096         while (msg < end) {
1097                 if ((msg->sadb_msg_len << 3) < sizeof(*msg))
1098                         break;
1099                 next = (struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3));
1100                 if (msg->sadb_msg_type != SADB_DUMP) {
1101                         msg = next;
1102                         continue;
1103                 }
1104
1105                 if (pfkey_align(msg, mhp) || pfkey_check(mhp)) {
1106                         plog(LLV_ERROR, LOCATION, NULL,
1107                                 "pfkey_check (%s)\n", ipsec_strerror());
1108                         msg = next;
1109                         continue;
1110                 }
1111
1112                 if (mhp[SADB_EXT_SA] == NULL
1113                  || mhp[SADB_EXT_ADDRESS_SRC] == NULL
1114                  || mhp[SADB_EXT_ADDRESS_DST] == NULL) {
1115                         msg = next;
1116                         continue;
1117                 }
1118                 sa = (struct sadb_sa *)mhp[SADB_EXT_SA];
1119                 src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
1120                 dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
1121
1122                 if (sa->sadb_sa_state != SADB_SASTATE_MATURE
1123                  && sa->sadb_sa_state != SADB_SASTATE_DYING) {
1124                         msg = next;
1125                         continue;
1126                 }
1127
1128                 /*
1129                  * RFC2407 4.6.3.3 INITIAL-CONTACT is the message that
1130                  * announces the sender of the message was rebooted.
1131                  * it is interpreted to delete all SAs which source address
1132                  * is the sender of the message.
1133                  * racoon only deletes SA which is matched both the
1134                  * source address and the destination accress.
1135                  */
1136                 if (cmpsaddrwop(iph1->local, src) == 0 &&
1137                     cmpsaddrwop(iph1->remote, dst) == 0)
1138                         ;
1139                 else if (cmpsaddrwop(iph1->remote, src) == 0 &&
1140                     cmpsaddrwop(iph1->local, dst) == 0)
1141                         ;
1142                 else {
1143                         msg = next;
1144                         continue;
1145                 }
1146
1147                 /*
1148                  * Make sure this is an SATYPE that we manage.
1149                  * This is gross; too bad we couldn't do it the
1150                  * easy way.
1151                  */
1152                 for (i = 0; i < pfkey_nsatypes; i++) {
1153                         if (pfkey_satypes[i].ps_satype ==
1154                             msg->sadb_msg_satype)
1155                                 break;
1156                 }
1157                 if (i == pfkey_nsatypes) {
1158                         msg = next;
1159                         continue;
1160                 }
1161
1162                 plog(LLV_INFO, LOCATION, NULL,
1163                         "purging spi=%u.\n", ntohl(sa->sadb_sa_spi));
1164                 pfkey_send_delete(lcconf->sock_pfkey,
1165                         msg->sadb_msg_satype,
1166                         IPSEC_MODE_ANY, src, dst, sa->sadb_sa_spi);
1167
1168                 /*
1169                  * delete a relative phase 2 handler.
1170                  * continue to process if no relative phase 2 handler
1171                  * exists.
1172                  */
1173                 proto_id = pfkey2ipsecdoi_proto(msg->sadb_msg_satype);
1174                 iph2 = getph2bysaidx(src, dst, proto_id, sa->sadb_sa_spi);
1175                 if (iph2) {
1176                         unbindph12(iph2);
1177                         remph2(iph2);
1178                         delph2(iph2);
1179                 }
1180
1181                 msg = next;
1182         }
1183
1184         vfree(buf);
1185 }
1186
1187 /*
1188  * handling to receive Deletion payload
1189  */
1190 static int
1191 isakmp_info_recv_d(iph1, msg)
1192         struct ph1handle *iph1;
1193         vchar_t *msg;
1194 {
1195         struct isakmp_pl_d *d;
1196         int tlen, num_spi;
1197         vchar_t *pbuf;
1198         struct isakmp_parse_t *pa, *pap;
1199         int protected = 0;
1200         union {
1201                 u_int32_t spi32;
1202                 u_int16_t spi16[2];
1203         } spi;
1204
1205         /* validate the type of next payload */
1206         if (!(pbuf = isakmp_parse(msg)))
1207                 return -1;
1208         pa = (struct isakmp_parse_t *)pbuf->v;
1209         for (pap = pa; pap->type; pap++) {
1210                 switch (pap->type) {
1211                 case ISAKMP_NPTYPE_D:
1212                         break;
1213                 case ISAKMP_NPTYPE_HASH:
1214                         if (pap == pa) {
1215                                 protected++;
1216                                 break;
1217                         }
1218                         plog(LLV_ERROR, LOCATION, iph1->remote,
1219                                 "received next payload type %d "
1220                                 "in wrong place (must be the first payload).\n",
1221                                 pap->type);
1222                         vfree(pbuf);
1223                         return -1;
1224                 default:
1225                         /* don't send information, see isakmp_ident_r1() */
1226                         plog(LLV_ERROR, LOCATION, iph1->remote,
1227                                 "reject the packet, "
1228                                 "received unexpecting payload type %d.\n",
1229                                 pap->type);
1230                         vfree(pbuf);
1231                         return 0;
1232                 }
1233         }
1234
1235         if (!protected) {
1236                 plog(LLV_ERROR, LOCATION, NULL,
1237                         "delete payload is not proteted, "
1238                         "ignored.\n");
1239                 vfree(pbuf);
1240                 return -1;
1241         }
1242
1243         /* process a delete payload */
1244         for (pap = pa; pap->type; pap++) {
1245                 if (pap->type != ISAKMP_NPTYPE_D)
1246                         continue;
1247
1248                 d = (struct isakmp_pl_d *)pap->ptr;
1249
1250                 if (ntohl(d->doi) != IPSEC_DOI) {
1251                         plog(LLV_ERROR, LOCATION, iph1->remote,
1252                                 "delete payload with invalid doi:%d.\n",
1253                                 ntohl(d->doi));
1254                         continue;
1255                 }
1256
1257                 num_spi = ntohs(d->num_spi);
1258                 tlen = ntohs(d->h.len) - sizeof(struct isakmp_pl_d);
1259
1260                 if (tlen != num_spi * d->spi_size) {
1261                         plog(LLV_ERROR, LOCATION, iph1->remote,
1262                                 "deletion payload with invalid length.\n");
1263                         vfree(pbuf);
1264                         return -1;
1265                 }
1266
1267                 switch (d->proto_id) {
1268                 case IPSECDOI_PROTO_ISAKMP:
1269                         if (d->spi_size != sizeof(isakmp_index)) {
1270                                 plog(LLV_ERROR, LOCATION, iph1->remote,
1271                                         "delete payload with strange spi "
1272                                         "size %d(proto_id:%d)\n",
1273                                         d->spi_size, d->proto_id);
1274                                 continue;
1275                         }
1276                         purge_isakmp_spi(d->proto_id,
1277                                         (isakmp_index *)(d + 1), num_spi);
1278                         break;
1279
1280                 case IPSECDOI_PROTO_IPSEC_AH:
1281                 case IPSECDOI_PROTO_IPSEC_ESP:
1282                         if (d->spi_size != sizeof(u_int32_t)) {
1283                                 plog(LLV_ERROR, LOCATION, iph1->remote,
1284                                         "delete payload with strange spi "
1285                                         "size %d(proto_id:%d)\n",
1286                                         d->spi_size, d->proto_id);
1287                                 continue;
1288                         }
1289                         purge_ipsec_spi(iph1->remote, d->proto_id,
1290                             (u_int32_t *)(d + 1), num_spi);
1291                         break;
1292
1293                 case IPSECDOI_PROTO_IPCOMP:
1294                         /* need to handle both 16bit/32bit SPI */
1295                         memset(&spi, 0, sizeof(spi));
1296                         if (d->spi_size == sizeof(spi.spi16[1])) {
1297                                 memcpy(&spi.spi16[1], d + 1,
1298                                     sizeof(spi.spi16[1]));
1299                         } else if (d->spi_size == sizeof(spi.spi32))
1300                                 memcpy(&spi.spi32, d + 1, sizeof(spi.spi32));
1301                         else {
1302                                 plog(LLV_ERROR, LOCATION, iph1->remote,
1303                                         "delete payload with strange spi "
1304                                         "size %d(proto_id:%d)\n",
1305                                         d->spi_size, d->proto_id);
1306                                 continue;
1307                         }
1308                         purge_ipsec_spi(iph1->remote, d->proto_id,
1309                             &spi.spi32, num_spi);
1310                         break;
1311
1312                 default:
1313                         plog(LLV_ERROR, LOCATION, iph1->remote,
1314                                 "deletion message received, "
1315                                 "invalid proto_id: %d\n",
1316                                 d->proto_id);
1317                         continue;
1318                 }
1319
1320                 plog(LLV_DEBUG, LOCATION, NULL, "purged SAs.\n");
1321         }
1322
1323         vfree(pbuf);
1324
1325         return 0;
1326 }
1327
1328 void
1329 isakmp_check_notify(gen, iph1)
1330         struct isakmp_gen *gen;         /* points to Notify payload */
1331         struct ph1handle *iph1;
1332 {
1333         struct isakmp_pl_n *notify = (struct isakmp_pl_n *)gen;
1334
1335         plog(LLV_DEBUG, LOCATION, iph1->remote,
1336                 "Notify Message received\n");
1337
1338         switch (ntohs(notify->type)) {
1339         case ISAKMP_NTYPE_CONNECTED:
1340                 plog(LLV_WARNING, LOCATION, iph1->remote,
1341                         "ignore CONNECTED notification.\n");
1342                 break;
1343         case ISAKMP_NTYPE_RESPONDER_LIFETIME:
1344                 plog(LLV_WARNING, LOCATION, iph1->remote,
1345                         "ignore RESPONDER-LIFETIME notification.\n");
1346                 break;
1347         case ISAKMP_NTYPE_REPLAY_STATUS:
1348                 plog(LLV_WARNING, LOCATION, iph1->remote,
1349                         "ignore REPLAY-STATUS notification.\n");
1350                 break;
1351         case ISAKMP_NTYPE_INITIAL_CONTACT:
1352                 plog(LLV_WARNING, LOCATION, iph1->remote,
1353                         "ignore INITIAL-CONTACT notification, "
1354                         "because it is only accepted after phase1.\n");
1355                 break;
1356         default:
1357                 isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL);
1358                 plog(LLV_ERROR, LOCATION, iph1->remote,
1359                         "received unknown notification type %u.\n",
1360                     ntohs(notify->type));
1361         }
1362
1363         return;
1364 }
1365