racoon.tproj/isakmp_inf.c

   1 /*      $KAME: isakmp_inf.c,v 1.81 2002/04/15 01:58:37 itojun Exp $     */
   2
   3 /*
   4  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. Neither the name of the project nor the names of its contributors
  16  *    may be used to endorse or promote products derived from this software
  17  *    without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGE.
  30  */
  31
  32 #include <sys/types.h>
  33 #include <sys/param.h>
  34 #include <sys/socket.h>
  35
  36 #include <net/pfkeyv2.h>
  37 #include <netkey/keydb.h>
  38 #include <netkey/key_var.h>
  39 #include <netinet/in.h>
  40 #ifdef IPV6_INRIA_VERSION
  41 #include <sys/queue.h>
  42 #include <netinet/ipsec.h>
  43 #else
  44 #include <netinet6/ipsec.h>
  45 #endif
  46
  47 #include <stdlib.h>
  48 #include <stdio.h>
  49 #include <string.h>
  50 #include <errno.h>
  51 #if TIME_WITH_SYS_TIME
  52 # include <sys/time.h>
  53 # include <time.h>
  54 #else
  55 # if HAVE_SYS_TIME_H
  56 #  include <sys/time.h>
  57 # else
  58 #  include <time.h>
  59 # endif
  60 #endif
  61
  62 #include "libpfkey.h"
  63
  64 #include "var.h"
  65 #include "vmbuf.h"
  66 #include "schedule.h"
  67 #include "str2val.h"
  68 #include "misc.h"
  69 #include "plog.h"
  70 #include "debug.h"
  71
  72 #include "localconf.h"
  73 #include "remoteconf.h"
  74 #include "sockmisc.h"
  75 #include "isakmp_var.h"
  76 #include "isakmp.h"
  77 #include "isakmp_inf.h"
  78 #include "oakley.h"
  79 #include "handler.h"
  80 #include "ipsec_doi.h"
  81 #include "crypto_openssl.h"
  82 #include "pfkey.h"
  83 #include "policy.h"
  84 #include "algorithm.h"
  85 #include "proposal.h"
  86 #include "admin.h"
  87 #include "strnames.h"
  88
  89 /* information exchange */
  90 static int isakmp_info_recv_n __P((struct ph1handle *, vchar_t *));
  91 static int isakmp_info_recv_d __P((struct ph1handle *, vchar_t *));
  92
  93 static void purge_isakmp_spi __P((int, isakmp_index *, size_t));
  94 static void purge_ipsec_spi __P((struct sockaddr *, int, u_int32_t *, size_t));
  95 static void info_recv_initialcontact __P((struct ph1handle *));
  96
  97 /* \f%%%
  98  * Information Exchange
  99  */
 100 /*
 101  * receive Information
 102  */
 103 int
 104 isakmp_info_recv(iph1, msg0)
 105         struct ph1handle *iph1;
 106         vchar_t *msg0;
 107 {
 108         vchar_t *msg = NULL;
 109         int error = -1;
 110         struct isakmp *isakmp;
 111         struct isakmp_gen *gen;
 112         u_int8_t np;
 113         int encrypted;
 114
 115         plog(LLV_DEBUG, LOCATION, NULL, "receive Information.\n");
 116
 117         encrypted = ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E);
 118
 119         /* Use new IV to decrypt Informational message. */
 120         if (encrypted) {
 121
 122                 struct isakmp_ivm *ivm;
 123
 124                 /* compute IV */
 125                 ivm = oakley_newiv2(iph1, ((struct isakmp *)msg0->v)->msgid);
 126                 if (ivm == NULL)
 127                         return -1;
 128
 129                 msg = oakley_do_decrypt(iph1, msg0, ivm->iv, ivm->ive);
 130                 oakley_delivm(ivm);
 131                 if (msg == NULL)
 132                         return -1;
 133
 134         } else
 135                 msg = vdup(msg0);
 136
 137         isakmp = (struct isakmp *)msg->v;
 138         gen = (struct isakmp_gen *)((caddr_t)isakmp + sizeof(struct isakmp));
 139
 140
 141         if (isakmp->np != ISAKMP_NPTYPE_HASH) {
 142                 plog(LLV_ERROR, LOCATION, NULL,
 143                     "ignore information because the message has no hash payload.\n");
 144                 goto end;
 145         }
 146
 147         if (iph1->status != PHASE1ST_ESTABLISHED) {
 148                 plog(LLV_ERROR, LOCATION, NULL,
 149                     "ignore information because ISAKMP-SA has not been established yet.\n");
 150                 goto end;
 151         }
 152
 153         np = gen->np;
 154
 155         {
 156                 void *p;
 157                 vchar_t *hash, *payload;
 158                 struct isakmp_gen *nd;
 159
 160                 /*
 161                  * XXX: gen->len includes isakmp header length
 162                  */
 163                 p = (caddr_t) gen + sizeof(struct isakmp_gen);
 164                 nd = (struct isakmp_gen *) ((caddr_t) gen + ntohs(gen->len));
 165
 166                 /* nd length check */
 167                 if (ntohs(nd->len) > msg->l - (sizeof(struct isakmp) + ntohs(gen->len))) {
 168                         plog(LLV_ERROR, LOCATION, NULL,
 169                                  "too long payload length (broken message?)\n");
 170                         goto end;
 171                 }
 172
 173                 payload = vmalloc(ntohs(nd->len));
 174                 if (payload == NULL) {
 175                         plog(LLV_ERROR, LOCATION, NULL,
 176                             "cannot allocate memory\n");
 177                         goto end;
 178                 }
 179
 180                 memcpy(payload->v, (caddr_t) nd, ntohs(nd->len));
 181
 182                 /* compute HASH */
 183                 hash = oakley_compute_hash1(iph1, isakmp->msgid, payload);
 184                 if (hash == NULL) {
 185                         plog(LLV_ERROR, LOCATION, NULL,
 186                             "cannot compute hash\n");
 187
 188                         vfree(payload);
 189                         goto end;
 190                 }
 191
 192                 if (ntohs(gen->len) - sizeof(struct isakmp_gen) != hash->l) {
 193                         plog(LLV_ERROR, LOCATION, NULL,
 194                             "ignore information due to hash length mismatch\n");
 195
 196                         vfree(hash);
 197                         vfree(payload);
 198                         goto end;
 199                 }
 200
 201                 if (memcmp(p, hash->v, hash->l) != 0) {
 202                         plog(LLV_ERROR, LOCATION, NULL,
 203                             "ignore information due to hash mismatch\n");
 204
 205                         vfree(hash);
 206                         vfree(payload);
 207                         goto end;
 208                 }
 209
 210                 plog(LLV_DEBUG, LOCATION, NULL, "hash validated.\n");
 211
 212                 vfree(hash);
 213                 vfree(payload);
 214         }
 215
 216         /* make sure the packet were encrypted. */
 217         if (!encrypted) {
 218                 switch (iph1->etype) {
 219                 case ISAKMP_ETYPE_AGG:
 220                 case ISAKMP_ETYPE_BASE:
 221                 case ISAKMP_ETYPE_IDENT:
 222                         if ((iph1->side == INITIATOR && iph1->status < PHASE1ST_MSG3SENT)
 223                          || (iph1->side == RESPONDER && iph1->status < PHASE1ST_MSG2SENT)) {
 224                                 break;
 225                         }
 226                         /*FALLTHRU*/
 227                 default:
 228                         plog(LLV_ERROR, LOCATION, iph1->remote,
 229                                 "%s message must be encrypted\n",
 230                                 s_isakmp_nptype(np));
 231                         goto end;
 232                 }
 233         }
 234
 235         switch (np) {
 236         case ISAKMP_NPTYPE_N:
 237                 if (isakmp_info_recv_n(iph1, msg) < 0)
 238                         goto end;
 239                 break;
 240         case ISAKMP_NPTYPE_D:
 241                 if (isakmp_info_recv_d(iph1, msg) < 0)
 242                         goto end;
 243                 break;
 244         case ISAKMP_NPTYPE_NONCE:
 245                 /* XXX to be 6.4.2 ike-01.txt */
 246                 /* XXX IV is to be synchronized. */
 247                 plog(LLV_ERROR, LOCATION, iph1->remote,
 248                         "ignore Acknowledged Informational\n");
 249                 break;
 250         default:
 251                 /* don't send information, see isakmp_ident_r1() */
 252                 error = 0;
 253                 plog(LLV_ERROR, LOCATION, iph1->remote,
 254                         "reject the packet, "
 255                         "received unexpecting payload type %d.\n",
 256                         gen->np);
 257                 goto end;
 258         }
 259
 260     end:
 261         if (msg != NULL)
 262                 vfree(msg);
 263
 264         return 0;
 265 }
 266
 267 /*
 268  * send Delete payload (for ISAKMP SA) in Informational exchange.
 269  */
 270 int
 271 isakmp_info_send_d1(iph1)
 272         struct ph1handle *iph1;
 273 {
 274         struct isakmp_pl_d *d;
 275         vchar_t *payload = NULL;
 276         int tlen;
 277         int error = 0;
 278
 279         if (iph1->status != PHASE2ST_ESTABLISHED)
 280                 return 0;
 281
 282         /* create delete payload */
 283
 284         /* send SPIs of inbound SAs. */
 285         /* XXX should send outbound SAs's ? */
 286         tlen = sizeof(*d) + sizeof(isakmp_index);
 287         payload = vmalloc(tlen);
 288         if (payload == NULL) {
 289                 plog(LLV_ERROR, LOCATION, NULL,
 290                         "failed to get buffer for payload.\n");
 291                 return errno;
 292         }
 293
 294         d = (struct isakmp_pl_d *)payload->v;
 295         d->h.np = ISAKMP_NPTYPE_NONE;
 296         d->h.len = htons(tlen);
 297         d->doi = htonl(IPSEC_DOI);
 298         d->proto_id = IPSECDOI_PROTO_ISAKMP;
 299         d->spi_size = sizeof(isakmp_index);
 300         d->num_spi = htons(1);
 301         memcpy(d + 1, &iph1->index, sizeof(isakmp_index));
 302
 303         error = isakmp_info_send_common(iph1, payload,
 304                                         ISAKMP_NPTYPE_D, 0);
 305         vfree(payload);
 306
 307         return error;
 308 }
 309
 310 /*
 311  * send Delete payload (for IPsec SA) in Informational exchange, based on
 312  * pfkey msg.  It sends always single SPI.
 313  */
 314 int
 315 isakmp_info_send_d2(iph2)
 316         struct ph2handle *iph2;
 317 {
 318         struct ph1handle *iph1;
 319         struct saproto *pr;
 320         struct isakmp_pl_d *d;
 321         vchar_t *payload = NULL;
 322         int tlen;
 323         int error = 0;
 324         u_int8_t *spi;
 325
 326         if (iph2->status != PHASE2ST_ESTABLISHED)
 327                 return 0;
 328
 329         /*
 330          * don't send delete information if there is no phase 1 handler.
 331          * It's nonsensical to negotiate phase 1 to send the information.
 332          */
 333         iph1 = getph1byaddr(iph2->src, iph2->dst);
 334         if (iph1 == NULL)
 335                 return 0;
 336
 337         /* create delete payload */
 338         for (pr = iph2->approval->head; pr != NULL; pr = pr->next) {
 339
 340                 /* send SPIs of inbound SAs. */
 341                 /*
 342                  * XXX should I send outbound SAs's ?
 343                  * I send inbound SAs's SPI only at the moment because I can't
 344                  * decode any more if peer send encoded packet without aware of
 345                  * deletion of SA.  Outbound SAs don't come under the situation.
 346                  */
 347                 tlen = sizeof(*d) + pr->spisize;
 348                 payload = vmalloc(tlen);
 349                 if (payload == NULL) {
 350                         plog(LLV_ERROR, LOCATION, NULL,
 351                                 "failed to get buffer for payload.\n");
 352                         return errno;
 353                 }
 354
 355                 d = (struct isakmp_pl_d *)payload->v;
 356                 d->h.np = ISAKMP_NPTYPE_NONE;
 357                 d->h.len = htons(tlen);
 358                 d->doi = htonl(IPSEC_DOI);
 359                 d->proto_id = pr->proto_id;
 360                 d->spi_size = pr->spisize;
 361                 d->num_spi = htons(1);
 362                 /*
 363                  * XXX SPI bits are left-filled, for use with IPComp.
 364                  * we should be switching to variable-length spi field...
 365                  */
 366                 spi = (u_int8_t *)&pr->spi;
 367                 spi += sizeof(pr->spi);
 368                 spi -= pr->spisize;
 369                 memcpy(d + 1, spi, pr->spisize);
 370
 371                 error = isakmp_info_send_common(iph1, payload,
 372                                                 ISAKMP_NPTYPE_D, 0);
 373                 vfree(payload);
 374         }
 375
 376         return error;
 377 }
 378
 379 /*
 380  * send Notification payload (for without ISAKMP SA) in Informational exchange
 381  */
 382 int
 383 isakmp_info_send_nx(isakmp, remote, local, type, data)
 384         struct isakmp *isakmp;
 385         struct sockaddr *remote, *local;
 386         int type;
 387         vchar_t *data;
 388 {
 389         struct ph1handle *iph1 = NULL;
 390         struct remoteconf *rmconf;
 391         vchar_t *payload = NULL;
 392         int tlen;
 393         int error = -1;
 394         struct isakmp_pl_n *n;
 395         int spisiz = 0;         /* see below */
 396
 397         /* search appropreate configuration */
 398         rmconf = getrmconf(remote);
 399         if (rmconf == NULL) {
 400                 plog(LLV_ERROR, LOCATION, remote,
 401                         "no configuration found for peer address.\n");
 402                 goto end;
 403         }
 404
 405         /* add new entry to isakmp status table. */
 406         iph1 = newph1();
 407         if (iph1 == NULL)
 408                 return -1;
 409
 410         memcpy(&iph1->index.i_ck, &isakmp->i_ck, sizeof(cookie_t));
 411         isakmp_newcookie((char *)&iph1->index.r_ck, remote, local);
 412         iph1->status = PHASE1ST_START;
 413         iph1->rmconf = rmconf;
 414         iph1->side = INITIATOR;
 415         iph1->version = isakmp->v;
 416         iph1->flags = 0;
 417         iph1->msgid = 0;        /* XXX */
 418
 419         /* copy remote address */
 420         if (copy_ph1addresses(iph1, rmconf, remote, local) < 0)
 421                 return -1;
 422
 423         tlen = sizeof(*n) + spisiz;
 424         if (data)
 425                 tlen += data->l;
 426         payload = vmalloc(tlen);
 427         if (payload == NULL) {
 428                 plog(LLV_ERROR, LOCATION, NULL,
 429                         "failed to get buffer to send.\n");
 430                 goto end;
 431         }
 432
 433         n = (struct isakmp_pl_n *)payload->v;
 434         n->h.np = ISAKMP_NPTYPE_NONE;
 435         n->h.len = htons(tlen);
 436         n->doi = htonl(IPSEC_DOI);
 437         n->proto_id = IPSECDOI_KEY_IKE;
 438         n->spi_size = spisiz;
 439         n->type = htons(type);
 440         if (spisiz)
 441                 memset(n + 1, 0, spisiz);       /*XXX*/
 442         if (data)
 443                 memcpy((caddr_t)(n + 1) + spisiz, data->v, data->l);
 444
 445         error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 0);
 446         vfree(payload);
 447
 448     end:
 449         if (iph1 != NULL)
 450                 delph1(iph1);
 451
 452         return error;
 453 }
 454
 455 /*
 456  * send Notification payload (for ISAKMP SA) in Informational exchange
 457  */
 458 int
 459 isakmp_info_send_n1(iph1, type, data)
 460         struct ph1handle *iph1;
 461         int type;
 462         vchar_t *data;
 463 {
 464         vchar_t *payload = NULL;
 465         int tlen;
 466         int error = 0;
 467         struct isakmp_pl_n *n;
 468         int spisiz;
 469
 470         /*
 471          * note on SPI size: which description is correct?  I have chosen
 472          * this to be 0.
 473          *
 474          * RFC2408 3.1, 2nd paragraph says: ISAKMP SA is identified by
 475          * Initiator/Responder cookie and SPI has no meaning, SPI size = 0.
 476          * RFC2408 3.1, first paragraph on page 40: ISAKMP SA is identified
 477          * by cookie and SPI has no meaning, 0 <= SPI size <= 16.
 478          * RFC2407 4.6.3.3, INITIAL-CONTACT is required to set to 16.
 479          */
 480         if (type == ISAKMP_NTYPE_INITIAL_CONTACT)
 481                 spisiz = sizeof(isakmp_index);
 482         else
 483                 spisiz = 0;
 484
 485         tlen = sizeof(*n) + spisiz;
 486         if (data)
 487                 tlen += data->l;
 488         payload = vmalloc(tlen);
 489         if (payload == NULL) {
 490                 plog(LLV_ERROR, LOCATION, NULL,
 491                         "failed to get buffer to send.\n");
 492                 return errno;
 493         }
 494
 495         n = (struct isakmp_pl_n *)payload->v;
 496         n->h.np = ISAKMP_NPTYPE_NONE;
 497         n->h.len = htons(tlen);
 498         n->doi = htonl(iph1->rmconf->doitype);
 499         n->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX to be configurable ? */
 500         n->spi_size = spisiz;
 501         n->type = htons(type);
 502         if (spisiz)
 503                 memcpy(n + 1, &iph1->index, sizeof(isakmp_index));
 504         if (data)
 505                 memcpy((caddr_t)(n + 1) + spisiz, data->v, data->l);
 506
 507         error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, iph1->flags);
 508         vfree(payload);
 509
 510         return error;
 511 }
 512
 513 /*
 514  * send Notification payload (for IPsec SA) in Informational exchange
 515  */
 516 int
 517 isakmp_info_send_n2(iph2, type, data)
 518         struct ph2handle *iph2;
 519         int type;
 520         vchar_t *data;
 521 {
 522         struct ph1handle *iph1 = iph2->ph1;
 523         vchar_t *payload = NULL;
 524         int tlen;
 525         int error = 0;
 526         struct isakmp_pl_n *n;
 527         struct saproto *pr;
 528
 529         if (!iph2->approval)
 530                 return EINVAL;
 531
 532         pr = iph2->approval->head;
 533
 534         /* XXX must be get proper spi */
 535         tlen = sizeof(*n) + pr->spisize;
 536         if (data)
 537                 tlen += data->l;
 538         payload = vmalloc(tlen);
 539         if (payload == NULL) {
 540                 plog(LLV_ERROR, LOCATION, NULL,
 541                         "failed to get buffer to send.\n");
 542                 return errno;
 543         }
 544
 545         n = (struct isakmp_pl_n *)payload->v;
 546         n->h.np = ISAKMP_NPTYPE_NONE;
 547         n->h.len = htons(tlen);
 548         n->doi = htonl(IPSEC_DOI);              /* IPSEC DOI (1) */
 549         n->proto_id = pr->proto_id;             /* IPSEC AH/ESP/whatever*/
 550         n->spi_size = pr->spisize;
 551         n->type = htons(type);
 552         *(u_int32_t *)(n + 1) = pr->spi;
 553         if (data)
 554                 memcpy((caddr_t)(n + 1) + pr->spisize, data->v, data->l);
 555
 556         iph2->flags |= ISAKMP_FLAG_E;   /* XXX Should we do FLAG_A ? */
 557         error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, iph2->flags);
 558         vfree(payload);
 559
 560         return error;
 561 }
 562
 563 /*
 564  * send Information
 565  * When ph1->skeyid_a == NULL, send message without encoding.
 566  */
 567 int
 568 isakmp_info_send_common(iph1, payload, np, flags)
 569         struct ph1handle *iph1;
 570         vchar_t *payload;
 571         u_int32_t np;
 572         int flags;
 573 {
 574         struct ph2handle *iph2 = NULL;
 575         vchar_t *hash = NULL;
 576         struct isakmp *isakmp;
 577         struct isakmp_gen *gen;
 578         char *p;
 579         int tlen;
 580         int error = -1;
 581
 582         /* add new entry to isakmp status table */
 583         iph2 = newph2();
 584         if (iph2 == NULL)
 585                 goto end;
 586
 587         iph2->dst = dupsaddr(iph1->remote);
 588         iph2->src = dupsaddr(iph1->local);
 589         switch (iph1->remote->sa_family) {
 590         case AF_INET:
 591                 ((struct sockaddr_in *)iph2->dst)->sin_port = 0;
 592                 ((struct sockaddr_in *)iph2->src)->sin_port = 0;
 593                 break;
 594 #ifdef INET6
 595         case AF_INET6:
 596                 ((struct sockaddr_in6 *)iph2->dst)->sin6_port = 0;
 597                 ((struct sockaddr_in6 *)iph2->src)->sin6_port = 0;
 598                 break;
 599 #endif
 600         default:
 601                 plog(LLV_ERROR, LOCATION, NULL,
 602                         "invalid family: %d\n", iph1->remote->sa_family);
 603                 delph2(iph2);
 604                 goto end;
 605         }
 606         iph2->ph1 = iph1;
 607         iph2->side = INITIATOR;
 608         iph2->status = PHASE2ST_START;
 609         iph2->msgid = isakmp_newmsgid2(iph1);
 610
 611         /* get IV and HASH(1) if skeyid_a was generated. */
 612         if (iph1->skeyid_a != NULL) {
 613                 iph2->ivm = oakley_newiv2(iph1, iph2->msgid);
 614                 if (iph2->ivm == NULL) {
 615                         delph2(iph2);
 616                         goto end;
 617                 }
 618
 619                 /* generate HASH(1) */
 620                 hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, payload);
 621                 if (hash == NULL) {
 622                         delph2(iph2);
 623                         goto end;
 624                 }
 625
 626                 /* initialized total buffer length */
 627                 tlen = hash->l;
 628                 tlen += sizeof(*gen);
 629         } else {
 630                 /* IKE-SA is not established */
 631                 hash = NULL;
 632
 633                 /* initialized total buffer length */
 634                 tlen = 0;
 635         }
 636         if ((flags & ISAKMP_FLAG_A) == 0)
 637                 iph2->flags = (hash == NULL ? 0 : ISAKMP_FLAG_E);
 638         else
 639                 iph2->flags = (hash == NULL ? 0 : ISAKMP_FLAG_A);
 640
 641         insph2(iph2);
 642         bindph12(iph1, iph2);
 643
 644         tlen += sizeof(*isakmp) + payload->l;
 645
 646         /* create buffer for isakmp payload */
 647         iph2->sendbuf = vmalloc(tlen);
 648         if (iph2->sendbuf == NULL) {
 649                 plog(LLV_ERROR, LOCATION, NULL,
 650                         "failed to get buffer to send.\n");
 651                 goto err;
 652         }
 653
 654         /* create isakmp header */
 655         isakmp = (struct isakmp *)iph2->sendbuf->v;
 656         memcpy(&isakmp->i_ck, &iph1->index.i_ck, sizeof(cookie_t));
 657         memcpy(&isakmp->r_ck, &iph1->index.r_ck, sizeof(cookie_t));
 658         isakmp->np = hash == NULL ? (np & 0xff) : ISAKMP_NPTYPE_HASH;
 659         isakmp->v = iph1->version;
 660         isakmp->etype = ISAKMP_ETYPE_INFO;
 661         isakmp->flags = iph2->flags;
 662         memcpy(&isakmp->msgid, &iph2->msgid, sizeof(isakmp->msgid));
 663         isakmp->len   = htonl(tlen);
 664         p = (char *)(isakmp + 1);
 665
 666         /* create HASH payload */
 667         if (hash != NULL) {
 668                 gen = (struct isakmp_gen *)p;
 669                 gen->np = np & 0xff;
 670                 gen->len = htons(sizeof(*gen) + hash->l);
 671                 p += sizeof(*gen);
 672                 memcpy(p, hash->v, hash->l);
 673                 p += hash->l;
 674         }
 675
 676         /* add payload */
 677         memcpy(p, payload->v, payload->l);
 678         p += payload->l;
 679
 680 #ifdef HAVE_PRINT_ISAKMP_C
 681         isakmp_printpacket(iph2->sendbuf, iph1->local, iph1->remote, 1);
 682 #endif
 683
 684         /* encoding */
 685         if (ISSET(isakmp->flags, ISAKMP_FLAG_E)) {
 686                 vchar_t *tmp;
 687
 688                 tmp = oakley_do_encrypt(iph2->ph1, iph2->sendbuf, iph2->ivm->ive,
 689                                 iph2->ivm->iv);
 690                 if (tmp == NULL) {
 691                         vfree(iph2->sendbuf);
 692                         iph2->sendbuf = NULL;
 693                         goto err;
 694                 }
 695                 vfree(iph2->sendbuf);
 696                 iph2->sendbuf = tmp;
 697         }
 698
 699         /* HDR*, HASH(1), N */
 700         if (isakmp_send(iph2->ph1, iph2->sendbuf) < 0) {
 701                 vfree(iph2->sendbuf);
 702                 iph2->sendbuf = NULL;
 703                 goto err;
 704         }
 705
 706         plog(LLV_DEBUG, LOCATION, NULL,
 707                 "sendto Information %s.\n", s_isakmp_nptype(np));
 708
 709         /*
 710          * don't resend notify message because peer can use Acknowledged
 711          * Informational if peer requires the reply of the notify message.
 712          */
 713
 714         /* XXX If Acknowledged Informational required, don't delete ph2handle */
 715         error = 0;
 716         vfree(iph2->sendbuf);
 717         iph2->sendbuf = NULL;
 718         goto err;       /* XXX */
 719
 720 end:
 721         if (hash)
 722                 vfree(hash);
 723         return error;
 724
 725 err:
 726         unbindph12(iph2);
 727         remph2(iph2);
 728         delph2(iph2);
 729         goto end;
 730 }
 731
 732 /*
 733  * add a notify payload to buffer by reallocating buffer.
 734  * If buf == NULL, the function only create a notify payload.
 735  *
 736  * XXX Which is SPI to be included, inbound or outbound ?
 737  */
 738 vchar_t *
 739 isakmp_add_pl_n(buf0, np_p, type, pr, data)
 740         vchar_t *buf0;
 741         u_int8_t **np_p;
 742         int type;
 743         struct saproto *pr;
 744         vchar_t *data;
 745 {
 746         vchar_t *buf = NULL;
 747         struct isakmp_pl_n *n;
 748         int tlen;
 749         int oldlen = 0;
 750
 751         if (*np_p)
 752                 **np_p = ISAKMP_NPTYPE_N;
 753
 754         tlen = sizeof(*n) + pr->spisize;
 755
 756         if (data)
 757                 tlen += data->l;
 758         if (buf0) {
 759                 oldlen = buf0->l;
 760                 buf = vrealloc(buf0, buf0->l + tlen);
 761         } else
 762                 buf = vmalloc(tlen);
 763         if (!buf) {
 764                 plog(LLV_ERROR, LOCATION, NULL,
 765                         "failed to get a payload buffer.\n");
 766                 return NULL;
 767         }
 768
 769         n = (struct isakmp_pl_n *)(buf->v + oldlen);
 770         n->h.np = ISAKMP_NPTYPE_NONE;
 771         n->h.len = htons(tlen);
 772         n->doi = htonl(IPSEC_DOI);              /* IPSEC DOI (1) */
 773         n->proto_id = pr->proto_id;             /* IPSEC AH/ESP/whatever*/
 774         n->spi_size = pr->spisize;
 775         n->type = htons(type);
 776         *(u_int32_t *)(n + 1) = pr->spi;        /* XXX */
 777         if (data)
 778                 memcpy((caddr_t)(n + 1) + pr->spisize, data->v, data->l);
 779
 780         /* save the pointer of next payload type */
 781         *np_p = &n->h.np;
 782
 783         return buf;
 784 }
 785
 786 /*
 787  * handling to receive Notification payload
 788  */
 789 static int
 790 isakmp_info_recv_n(iph1, msg)
 791         struct ph1handle *iph1;
 792         vchar_t *msg;
 793 {
 794         struct isakmp_pl_n *n = NULL;
 795         u_int type;
 796         vchar_t *pbuf;
 797         struct isakmp_parse_t *pa, *pap;
 798         char *spi;
 799
 800         if (!(pbuf = isakmp_parse(msg)))
 801                 return -1;
 802         pa = (struct isakmp_parse_t *)pbuf->v;
 803         for (pap = pa; pap->type; pap++) {
 804                 switch (pap->type) {
 805                 case ISAKMP_NPTYPE_HASH:
 806                         /* do something here */
 807                         break;
 808                 case ISAKMP_NPTYPE_NONCE:
 809                         /* send to ack */
 810                         break;
 811                 case ISAKMP_NPTYPE_N:
 812                         n = (struct isakmp_pl_n *)pap->ptr;
 813                         break;
 814                 default:
 815                         vfree(pbuf);
 816                         return -1;
 817                 }
 818         }
 819         vfree(pbuf);
 820         if (!n)
 821                 return -1;
 822
 823         type = ntohs(n->type);
 824
 825         switch (type) {
 826         case ISAKMP_NTYPE_CONNECTED:
 827         case ISAKMP_NTYPE_RESPONDER_LIFETIME:
 828         case ISAKMP_NTYPE_REPLAY_STATUS:
 829                 /* do something */
 830                 break;
 831         case ISAKMP_NTYPE_INITIAL_CONTACT:
 832                 info_recv_initialcontact(iph1);
 833                 break;
 834         default:
 835             {
 836                 u_int32_t msgid = ((struct isakmp *)msg->v)->msgid;
 837                 struct ph2handle *iph2;
 838
 839                 /* XXX there is a potential of dos attack. */
 840                 if (msgid == 0) {
 841                         /* delete ph1 */
 842                         plog(LLV_ERROR, LOCATION, iph1->remote,
 843                                 "delete phase1 handle.\n");
 844                         return -1;
 845                 } else {
 846                         iph2 = getph2bymsgid(iph1, msgid);
 847                         if (iph2 == NULL) {
 848                                 plog(LLV_ERROR, LOCATION, iph1->remote,
 849                                         "unknown notify message, "
 850                                         "no phase2 handle found.\n");
 851                         } else {
 852                                 /* delete ph2 */
 853                                 unbindph12(iph2);
 854                                 remph2(iph2);
 855                                 delph2(iph2);
 856                         }
 857                 }
 858             }
 859                 break;
 860         }
 861
 862         /* get spi and allocate */
 863         if (ntohs(n->h.len) < sizeof(*n) + n->spi_size) {
 864                 plog(LLV_ERROR, LOCATION, iph1->remote,
 865                         "invalid spi_size in notification payload.\n");
 866                 return -1;
 867         }
 868         spi = val2str((u_char *)(n + 1), n->spi_size);
 869
 870         plog(LLV_DEBUG, LOCATION, iph1->remote,
 871                 "notification message %d:%s, "
 872                 "doi=%d proto_id=%d spi=%s(size=%d).\n",
 873                 type, s_isakmp_notify_msg(type),
 874                 ntohl(n->doi), n->proto_id, spi, n->spi_size);
 875
 876         racoon_free(spi);
 877
 878         return(0);
 879 }
 880
 881 static void
 882 purge_isakmp_spi(proto, spi, n)
 883         int proto;
 884         isakmp_index *spi;      /*network byteorder*/
 885         size_t n;
 886 {
 887         struct ph1handle *iph1;
 888         size_t i;
 889
 890         for (i = 0; i < n; i++) {
 891                 iph1 = getph1byindex(&spi[i]);
 892                 if (!iph1)
 893                         continue;
 894
 895                 plog(LLV_INFO, LOCATION, NULL,
 896                         "purged ISAKMP-SA proto_id=%s spi=%s.\n",
 897                         s_ipsecdoi_proto(proto),
 898                         isakmp_pindex(&spi[i], 0));
 899
 900                 if (iph1->sce)
 901                         SCHED_KILL(iph1->sce);
 902                 iph1->status = PHASE1ST_EXPIRED;
 903                 iph1->sce = sched_new(1, isakmp_ph1delete_stub, iph1);
 904         }
 905 }
 906
 907 static void
 908 purge_ipsec_spi(dst0, proto, spi, n)
 909         struct sockaddr *dst0;
 910         int proto;
 911         u_int32_t *spi; /*network byteorder*/
 912         size_t n;
 913 {
 914         vchar_t *buf = NULL;
 915         struct sadb_msg *msg, *next, *end;
 916         struct sadb_sa *sa;
 917         struct sockaddr *src, *dst;
 918         struct ph2handle *iph2;
 919         size_t i;
 920         caddr_t mhp[SADB_EXT_MAX + 1];
 921
 922         buf = pfkey_dump_sadb(ipsecdoi2pfkey_proto(proto));
 923         if (buf == NULL) {
 924                 plog(LLV_DEBUG, LOCATION, NULL,
 925                         "pfkey_dump_sadb returned nothing.\n");
 926                 return;
 927         }
 928
 929         msg = (struct sadb_msg *)buf->v;
 930         end = (struct sadb_msg *)(buf->v + buf->l);
 931
 932         while (msg < end) {
 933                 if ((msg->sadb_msg_len << 3) < sizeof(*msg))
 934                         break;
 935                 next = (struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3));
 936                 if (msg->sadb_msg_type != SADB_DUMP) {
 937                         msg = next;
 938                         continue;
 939                 }
 940
 941                 if (pfkey_align(msg, mhp) || pfkey_check(mhp)) {
 942                         plog(LLV_ERROR, LOCATION, NULL,
 943                                 "pfkey_check (%s)\n", ipsec_strerror());
 944                         msg = next;
 945                         continue;
 946                 }
 947
 948                 sa = (struct sadb_sa *)(mhp[SADB_EXT_SA]);
 949                 if (!sa
 950                  || !mhp[SADB_EXT_ADDRESS_SRC]
 951                  || !mhp[SADB_EXT_ADDRESS_DST]) {
 952                         msg = next;
 953                         continue;
 954                 }
 955                 src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
 956                 dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
 957
 958                 if (sa->sadb_sa_state != SADB_SASTATE_MATURE
 959                  && sa->sadb_sa_state != SADB_SASTATE_DYING) {
 960                         msg = next;
 961                         continue;
 962                 }
 963
 964                 /* XXX n^2 algorithm, inefficient */
 965
 966                 /* don't delete inbound SAs at the moment */
 967                 /* XXX should we remove SAs with opposite direction as well? */
 968                 if (cmpsaddrwop(dst0, dst)) {
 969                         msg = next;
 970                         continue;
 971                 }
 972
 973                 for (i = 0; i < n; i++) {
 974                         plog(LLV_DEBUG, LOCATION, NULL,
 975                                 "check spi(packet)=%u spi(db)=%u.\n",
 976                                 ntohl(spi[i]), ntohl(sa->sadb_sa_spi));
 977                         if (spi[i] != sa->sadb_sa_spi)
 978                                 continue;
 979
 980                         pfkey_send_delete(lcconf->sock_pfkey,
 981                                 msg->sadb_msg_satype,
 982                                 IPSEC_MODE_ANY,
 983                                 src, dst, sa->sadb_sa_spi);
 984
 985                         /*
 986                          * delete a relative phase 2 handler.
 987                          * continue to process if no relative phase 2 handler
 988                          * exists.
 989                          */
 990                         iph2 = getph2bysaidx(src, dst, proto, spi[i]);
 991                         if (iph2) {
 992                                 unbindph12(iph2);
 993                                 remph2(iph2);
 994                                 delph2(iph2);
 995                         }
 996
 997                         plog(LLV_INFO, LOCATION, NULL,
 998                                 "purged IPsec-SA proto_id=%s spi=%u.\n",
 999                                 s_ipsecdoi_proto(proto),
1000                                 ntohl(spi[i]));
1001                 }
1002
1003                 msg = next;
1004         }
1005
1006         if (buf)
1007                 vfree(buf);
1008 }
1009
1010 /*
1011  * delete all phase2 sa relatived to the destination address.
1012  * Don't delete Phase 1 handlers on INITIAL-CONTACT, and don't ignore
1013  * an INITIAL-CONTACT if we have contacted the peer.  This matches the
1014  * Sun IKE behavior, and makes rekeying work much better when the peer
1015  * restarts.
1016  */
1017 static void
1018 info_recv_initialcontact(iph1)
1019         struct ph1handle *iph1;
1020 {
1021         vchar_t *buf = NULL;
1022         struct sadb_msg *msg, *next, *end;
1023         struct sadb_sa *sa;
1024         struct sockaddr *src, *dst;
1025         caddr_t mhp[SADB_EXT_MAX + 1];
1026         int proto_id, i;
1027         struct ph2handle *iph2;
1028 #if 0
1029         char *loc, *rem;
1030 #endif
1031
1032         if (f_local)
1033                 return;
1034
1035 #if 0
1036         loc = strdup(saddrwop2str(iph1->local));
1037         rem = strdup(saddrwop2str(iph1->remote));
1038
1039         /*
1040          * Purge all IPSEC-SAs for the peer.  We can do this
1041          * the easy way (using a PF_KEY SADB_DELETE extension)
1042          * or we can do it the hard way.
1043          */
1044         for (i = 0; i < pfkey_nsatypes; i++) {
1045                 proto_id = pfkey2ipsecdoi_proto(pfkey_satypes[i].ps_satype);
1046
1047                 plog(LLV_INFO, LOCATION, NULL,
1048                     "purging %s SAs for %s -> %s\n",
1049                     pfkey_satypes[i].ps_name, loc, rem);
1050                 if (pfkey_send_delete_all(lcconf->sock_pfkey,
1051                     pfkey_satypes[i].ps_satype, IPSEC_MODE_ANY,
1052                     iph1->local, iph1->remote) == -1) {
1053                         plog(LLV_ERROR, LOCATION, NULL,
1054                             "delete_all %s -> %s failed for %s (%s)\n",
1055                             loc, rem,
1056                             pfkey_satypes[i].ps_name, ipsec_strerror());
1057                         goto the_hard_way;
1058                 }
1059
1060                 deleteallph2(iph1->local, iph1->remote, proto_id);
1061
1062                 plog(LLV_INFO, LOCATION, NULL,
1063                     "purging %s SAs for %s -> %s\n",
1064                     pfkey_satypes[i].ps_name, rem, loc);
1065                 if (pfkey_send_delete_all(lcconf->sock_pfkey,
1066                     pfkey_satypes[i].ps_satype, IPSEC_MODE_ANY,
1067                     iph1->remote, iph1->local) == -1) {
1068                         plog(LLV_ERROR, LOCATION, NULL,
1069                             "delete_all %s -> %s failed for %s (%s)\n",
1070                             rem, loc,
1071                             pfkey_satypes[i].ps_name, ipsec_strerror());
1072                         goto the_hard_way;
1073                 }
1074
1075                 deleteallph2(iph1->remote, iph1->local, proto_id);
1076         }
1077
1078         racoon_free(loc);
1079         racoon_free(rem);
1080         return;
1081
1082  the_hard_way:
1083         racoon_free(loc);
1084         racoon_free(rem);
1085 #endif
1086
1087         buf = pfkey_dump_sadb(SADB_SATYPE_UNSPEC);
1088         if (buf == NULL) {
1089                 plog(LLV_DEBUG, LOCATION, NULL,
1090                         "pfkey_dump_sadb returned nothing.\n");
1091                 return;
1092         }
1093
1094         msg = (struct sadb_msg *)buf->v;
1095         end = (struct sadb_msg *)(buf->v + buf->l);
1096
1097         while (msg < end) {
1098                 if ((msg->sadb_msg_len << 3) < sizeof(*msg))
1099                         break;
1100                 next = (struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3));
1101                 if (msg->sadb_msg_type != SADB_DUMP) {
1102                         msg = next;
1103                         continue;
1104                 }
1105
1106                 if (pfkey_align(msg, mhp) || pfkey_check(mhp)) {
1107                         plog(LLV_ERROR, LOCATION, NULL,
1108                                 "pfkey_check (%s)\n", ipsec_strerror());
1109                         msg = next;
1110                         continue;
1111                 }
1112
1113                 if (mhp[SADB_EXT_SA] == NULL
1114                  || mhp[SADB_EXT_ADDRESS_SRC] == NULL
1115                  || mhp[SADB_EXT_ADDRESS_DST] == NULL) {
1116                         msg = next;
1117                         continue;
1118                 }
1119                 sa = (struct sadb_sa *)mhp[SADB_EXT_SA];
1120                 src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
1121                 dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
1122
1123                 if (sa->sadb_sa_state != SADB_SASTATE_MATURE
1124                  && sa->sadb_sa_state != SADB_SASTATE_DYING) {
1125                         msg = next;
1126                         continue;
1127                 }
1128
1129                 /*
1130                  * RFC2407 4.6.3.3 INITIAL-CONTACT is the message that
1131                  * announces the sender of the message was rebooted.
1132                  * it is interpreted to delete all SAs which source address
1133                  * is the sender of the message.
1134                  * racoon only deletes SA which is matched both the
1135                  * source address and the destination accress.
1136                  */
1137                 if (cmpsaddrwop(iph1->local, src) == 0 &&
1138                     cmpsaddrwop(iph1->remote, dst) == 0)
1139                         ;
1140                 else if (cmpsaddrwop(iph1->remote, src) == 0 &&
1141                     cmpsaddrwop(iph1->local, dst) == 0)
1142                         ;
1143                 else {
1144                         msg = next;
1145                         continue;
1146                 }
1147
1148                 /*
1149                  * Make sure this is an SATYPE that we manage.
1150                  * This is gross; too bad we couldn't do it the
1151                  * easy way.
1152                  */
1153                 for (i = 0; i < pfkey_nsatypes; i++) {
1154                         if (pfkey_satypes[i].ps_satype ==
1155                             msg->sadb_msg_satype)
1156                                 break;
1157                 }
1158                 if (i == pfkey_nsatypes) {
1159                         msg = next;
1160                         continue;
1161                 }
1162
1163                 plog(LLV_INFO, LOCATION, NULL,
1164                         "purging spi=%u.\n", ntohl(sa->sadb_sa_spi));
1165                 pfkey_send_delete(lcconf->sock_pfkey,
1166                         msg->sadb_msg_satype,
1167                         IPSEC_MODE_ANY, src, dst, sa->sadb_sa_spi);
1168
1169                 /*
1170                  * delete a relative phase 2 handler.
1171                  * continue to process if no relative phase 2 handler
1172                  * exists.
1173                  */
1174                 proto_id = pfkey2ipsecdoi_proto(msg->sadb_msg_satype);
1175                 iph2 = getph2bysaidx(src, dst, proto_id, sa->sadb_sa_spi);
1176                 if (iph2) {
1177                         unbindph12(iph2);
1178                         remph2(iph2);
1179                         delph2(iph2);
1180                 }
1181
1182                 msg = next;
1183         }
1184
1185         vfree(buf);
1186 }
1187
1188 /*
1189  * handling to receive Deletion payload
1190  */
1191 static int
1192 isakmp_info_recv_d(iph1, msg)
1193         struct ph1handle *iph1;
1194         vchar_t *msg;
1195 {
1196         struct isakmp_pl_d *d;
1197         int tlen, num_spi;
1198         vchar_t *pbuf;
1199         struct isakmp_parse_t *pa, *pap;
1200         int protected = 0;
1201         union {
1202                 u_int32_t spi32;
1203                 u_int16_t spi16[2];
1204         } spi;
1205
1206         /* validate the type of next payload */
1207         if (!(pbuf = isakmp_parse(msg)))
1208                 return -1;
1209         pa = (struct isakmp_parse_t *)pbuf->v;
1210         for (pap = pa; pap->type; pap++) {
1211                 switch (pap->type) {
1212                 case ISAKMP_NPTYPE_D:
1213                         break;
1214                 case ISAKMP_NPTYPE_HASH:
1215                         if (pap == pa) {
1216                                 protected++;
1217                                 break;
1218                         }
1219                         plog(LLV_ERROR, LOCATION, iph1->remote,
1220                                 "received next payload type %d "
1221                                 "in wrong place (must be the first payload).\n",
1222                                 pap->type);
1223                         vfree(pbuf);
1224                         return -1;
1225                 default:
1226                         /* don't send information, see isakmp_ident_r1() */
1227                         plog(LLV_ERROR, LOCATION, iph1->remote,
1228                                 "reject the packet, "
1229                                 "received unexpecting payload type %d.\n",
1230                                 pap->type);
1231                         vfree(pbuf);
1232                         return 0;
1233                 }
1234         }
1235
1236         if (!protected) {
1237                 plog(LLV_ERROR, LOCATION, NULL,
1238                         "delete payload is not proteted, "
1239                         "ignored.\n");
1240                 vfree(pbuf);
1241                 return -1;
1242         }
1243
1244         /* process a delete payload */
1245         for (pap = pa; pap->type; pap++) {
1246                 if (pap->type != ISAKMP_NPTYPE_D)
1247                         continue;
1248
1249                 d = (struct isakmp_pl_d *)pap->ptr;
1250
1251                 if (ntohl(d->doi) != IPSEC_DOI) {
1252                         plog(LLV_ERROR, LOCATION, iph1->remote,
1253                                 "delete payload with invalid doi:%d.\n",
1254                                 ntohl(d->doi));
1255                         continue;
1256                 }
1257
1258                 num_spi = ntohs(d->num_spi);
1259                 tlen = ntohs(d->h.len) - sizeof(struct isakmp_pl_d);
1260
1261                 if (tlen != num_spi * d->spi_size) {
1262                         plog(LLV_ERROR, LOCATION, iph1->remote,
1263                                 "deletion payload with invalid length.\n");
1264                         vfree(pbuf);
1265                         return -1;
1266                 }
1267
1268                 switch (d->proto_id) {
1269                 case IPSECDOI_PROTO_ISAKMP:
1270                         if (d->spi_size != sizeof(isakmp_index)) {
1271                                 plog(LLV_ERROR, LOCATION, iph1->remote,
1272                                         "delete payload with strange spi "
1273                                         "size %d(proto_id:%d)\n",
1274                                         d->spi_size, d->proto_id);
1275                                 continue;
1276                         }
1277                         purge_isakmp_spi(d->proto_id,
1278                                         (isakmp_index *)(d + 1), num_spi);
1279                         break;
1280
1281                 case IPSECDOI_PROTO_IPSEC_AH:
1282                 case IPSECDOI_PROTO_IPSEC_ESP:
1283                         if (d->spi_size != sizeof(u_int32_t)) {
1284                                 plog(LLV_ERROR, LOCATION, iph1->remote,
1285                                         "delete payload with strange spi "
1286                                         "size %d(proto_id:%d)\n",
1287                                         d->spi_size, d->proto_id);
1288                                 continue;
1289                         }
1290                         purge_ipsec_spi(iph1->remote, d->proto_id,
1291                             (u_int32_t *)(d + 1), num_spi);
1292                         break;
1293
1294                 case IPSECDOI_PROTO_IPCOMP:
1295                         /* need to handle both 16bit/32bit SPI */
1296                         memset(&spi, 0, sizeof(spi));
1297                         if (d->spi_size == sizeof(spi.spi16[1])) {
1298                                 memcpy(&spi.spi16[1], d + 1,
1299                                     sizeof(spi.spi16[1]));
1300                         } else if (d->spi_size == sizeof(spi.spi32))
1301                                 memcpy(&spi.spi32, d + 1, sizeof(spi.spi32));
1302                         else {
1303                                 plog(LLV_ERROR, LOCATION, iph1->remote,
1304                                         "delete payload with strange spi "
1305                                         "size %d(proto_id:%d)\n",
1306                                         d->spi_size, d->proto_id);
1307                                 continue;
1308                         }
1309                         purge_ipsec_spi(iph1->remote, d->proto_id,
1310                             &spi.spi32, num_spi);
1311                         break;
1312
1313                 default:
1314                         plog(LLV_ERROR, LOCATION, iph1->remote,
1315                                 "deletion message received, "
1316                                 "invalid proto_id: %d\n",
1317                                 d->proto_id);
1318                         continue;
1319                 }
1320
1321                 plog(LLV_DEBUG, LOCATION, NULL, "purged SAs.\n");
1322         }
1323
1324         vfree(pbuf);
1325
1326         return 0;
1327 }
1328
1329 void
1330 isakmp_check_notify(gen, iph1)
1331         struct isakmp_gen *gen;         /* points to Notify payload */
1332         struct ph1handle *iph1;
1333 {
1334         struct isakmp_pl_n *notify = (struct isakmp_pl_n *)gen;
1335
1336         plog(LLV_DEBUG, LOCATION, iph1->remote,
1337                 "Notify Message received\n");
1338
1339         switch (ntohs(notify->type)) {
1340         case ISAKMP_NTYPE_CONNECTED:
1341                 plog(LLV_WARNING, LOCATION, iph1->remote,
1342                         "ignore CONNECTED notification.\n");
1343                 break;
1344         case ISAKMP_NTYPE_RESPONDER_LIFETIME:
1345                 plog(LLV_WARNING, LOCATION, iph1->remote,
1346                         "ignore RESPONDER-LIFETIME notification.\n");
1347                 break;
1348         case ISAKMP_NTYPE_REPLAY_STATUS:
1349                 plog(LLV_WARNING, LOCATION, iph1->remote,
1350                         "ignore REPLAY-STATUS notification.\n");
1351                 break;
1352         case ISAKMP_NTYPE_INITIAL_CONTACT:
1353                 plog(LLV_WARNING, LOCATION, iph1->remote,
1354                         "ignore INITIAL-CONTACT notification, "
1355                         "because it is only accepted after phase1.\n");
1356                 break;
1357         default:
1358                 isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL);
1359                 plog(LLV_ERROR, LOCATION, iph1->remote,
1360                         "received unknown notification type %u.\n",
1361                     ntohs(notify->type));
1362         }
1363
1364         return;
1365 }
1366