1 /* $NetBSD: isakmp_inf.c,v 1.14.4.17 2009/05/18 17:07:46 tteras Exp $ */ 2 3 /* Id: isakmp_inf.c,v 1.44 2006/05/06 20:45:52 manubsd Exp */ 4 5 /* 6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. Neither the name of the project nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #include "config.h" 35 36 #include <sys/types.h> 37 #include <sys/param.h> 38 #include <sys/socket.h> 39 40 #include <net/pfkeyv2.h> 41 #include <netinet/in.h> 42 #include <sys/queue.h> 43 #include PATH_IPSEC_H 44 45 #include <stdlib.h> 46 #include <stdio.h> 47 #include <string.h> 48 #include <errno.h> 49 #if TIME_WITH_SYS_TIME 50 # include <sys/time.h> 51 # include <time.h> 52 #else 53 # if HAVE_SYS_TIME_H 54 # include <sys/time.h> 55 # else 56 # include <time.h> 57 # endif 58 #endif 59 #ifdef ENABLE_HYBRID 60 #include <resolv.h> 61 #endif 62 63 #include "libpfkey.h" 64 65 #include "var.h" 66 #include "vmbuf.h" 67 #include "schedule.h" 68 #include "str2val.h" 69 #include "misc.h" 70 #include "plog.h" 71 #include "debug.h" 72 73 #include "localconf.h" 74 #include "remoteconf.h" 75 #include "sockmisc.h" 76 #include "handler.h" 77 #include "policy.h" 78 #include "proposal.h" 79 #include "isakmp_var.h" 80 #include "evt.h" 81 #include "isakmp.h" 82 #ifdef ENABLE_HYBRID 83 #include "isakmp_xauth.h" 84 #include "isakmp_unity.h" 85 #include "isakmp_cfg.h" 86 #endif 87 #include "isakmp_inf.h" 88 #include "oakley.h" 89 #include "ipsec_doi.h" 90 #include "crypto_openssl.h" 91 #include "pfkey.h" 92 #include "policy.h" 93 #include "algorithm.h" 94 #include "proposal.h" 95 #include "admin.h" 96 #include "strnames.h" 97 #ifdef ENABLE_NATT 98 #include "nattraversal.h" 99 #endif 100 101 /* information exchange */ 102 static int isakmp_info_recv_n (struct ph1handle *, struct isakmp_pl_n *, u_int32_t, int); 103 static int isakmp_info_recv_d (struct ph1handle *, struct isakmp_pl_d *, u_int32_t, int); 104 105 #ifdef ENABLE_DPD 106 static int isakmp_info_recv_r_u __P((struct ph1handle *, 107 struct isakmp_pl_ru *, u_int32_t)); 108 static int isakmp_info_recv_r_u_ack __P((struct ph1handle *, 109 struct isakmp_pl_ru *, u_int32_t)); 110 static void isakmp_info_send_r_u __P((void *)); 111 #endif 112 113 static void purge_isakmp_spi __P((int, isakmp_index *, size_t)); 114 static void info_recv_initialcontact __P((struct ph1handle *)); 115 116 /* %%% 118 * Information Exchange 119 */ 120 /* 121 * receive Information 122 */ 123 int 124 isakmp_info_recv(iph1, msg0) 125 struct ph1handle *iph1; 126 vchar_t *msg0; 127 { 128 vchar_t *msg = NULL; 129 vchar_t *pbuf = NULL; 130 u_int32_t msgid = 0; 131 int error = -1; 132 struct isakmp *isakmp; 133 struct isakmp_gen *gen; 134 struct isakmp_parse_t *pa, *pap; 135 void *p; 136 vchar_t *hash, *payload; 137 struct isakmp_gen *nd; 138 u_int8_t np; 139 int encrypted; 140 141 plog(LLV_DEBUG, LOCATION, NULL, "receive Information.\n"); 142 143 encrypted = ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E); 144 msgid = ((struct isakmp *)msg0->v)->msgid; 145 146 /* Use new IV to decrypt Informational message. */ 147 if (encrypted) { 148 struct isakmp_ivm *ivm; 149 150 if (iph1->ivm == NULL) { 151 plog(LLV_ERROR, LOCATION, NULL, "iph1->ivm == NULL\n"); 152 return -1; 153 } 154 155 /* compute IV */ 156 ivm = oakley_newiv2(iph1, ((struct isakmp *)msg0->v)->msgid); 157 if (ivm == NULL) 158 return -1; 159 160 msg = oakley_do_decrypt(iph1, msg0, ivm->iv, ivm->ive); 161 oakley_delivm(ivm); 162 if (msg == NULL) 163 return -1; 164 165 } else 166 msg = vdup(msg0); 167 168 /* Safety check */ 169 if (msg->l < sizeof(*isakmp) + sizeof(*gen)) { 170 plog(LLV_ERROR, LOCATION, NULL, 171 "ignore information because the " 172 "message is way too short - %zu byte(s).\n", msg->l); 173 goto end; 174 } 175 176 isakmp = (struct isakmp *)msg->v; 177 gen = (struct isakmp_gen *)((caddr_t)isakmp + sizeof(struct isakmp)); 178 np = gen->np; 179 180 if (encrypted) { 181 if (isakmp->np != ISAKMP_NPTYPE_HASH) { 182 plog(LLV_ERROR, LOCATION, NULL, 183 "ignore information because the" 184 "message has no hash payload.\n"); 185 goto end; 186 } 187 188 if (iph1->status != PHASE1ST_ESTABLISHED) { 189 plog(LLV_ERROR, LOCATION, NULL, 190 "ignore information because ISAKMP-SA" 191 "has not been established yet.\n"); 192 goto end; 193 } 194 195 /* Safety check */ 196 if (msg->l < sizeof(*isakmp) + ntohs(gen->len) + sizeof(*nd)) { 197 plog(LLV_ERROR, LOCATION, NULL, 198 "ignore information because the " 199 "message is too short - %zu byte(s).\n", msg->l); 200 goto end; 201 } 202 203 p = (caddr_t) gen + sizeof(struct isakmp_gen); 204 nd = (struct isakmp_gen *) ((caddr_t) gen + ntohs(gen->len)); 205 206 /* nd length check */ 207 if (ntohs(nd->len) > msg->l - (sizeof(struct isakmp) + 208 ntohs(gen->len))) { 209 plog(LLV_ERROR, LOCATION, NULL, 210 "too long payload length (broken message?)\n"); 211 goto end; 212 } 213 214 if (ntohs(nd->len) < sizeof(*nd)) { 215 plog(LLV_ERROR, LOCATION, NULL, 216 "too short payload length (broken message?)\n"); 217 goto end; 218 } 219 220 payload = vmalloc(ntohs(nd->len)); 221 if (payload == NULL) { 222 plog(LLV_ERROR, LOCATION, NULL, 223 "cannot allocate memory\n"); 224 goto end; 225 } 226 227 memcpy(payload->v, (caddr_t) nd, ntohs(nd->len)); 228 229 /* compute HASH */ 230 hash = oakley_compute_hash1(iph1, isakmp->msgid, payload); 231 if (hash == NULL) { 232 plog(LLV_ERROR, LOCATION, NULL, 233 "cannot compute hash\n"); 234 235 vfree(payload); 236 goto end; 237 } 238 239 if (ntohs(gen->len) - sizeof(struct isakmp_gen) != hash->l) { 240 plog(LLV_ERROR, LOCATION, NULL, 241 "ignore information due to hash length mismatch\n"); 242 243 vfree(hash); 244 vfree(payload); 245 goto end; 246 } 247 248 if (memcmp(p, hash->v, hash->l) != 0) { 249 plog(LLV_ERROR, LOCATION, NULL, 250 "ignore information due to hash mismatch\n"); 251 252 vfree(hash); 253 vfree(payload); 254 goto end; 255 } 256 257 plog(LLV_DEBUG, LOCATION, NULL, "hash validated.\n"); 258 259 vfree(hash); 260 vfree(payload); 261 } else { 262 /* make sure the packet was encrypted after the beginning of phase 1. */ 263 switch (iph1->etype) { 264 case ISAKMP_ETYPE_AGG: 265 case ISAKMP_ETYPE_BASE: 266 case ISAKMP_ETYPE_IDENT: 267 if ((iph1->side == INITIATOR && iph1->status < PHASE1ST_MSG3SENT) 268 || (iph1->side == RESPONDER && iph1->status < PHASE1ST_MSG2SENT)) { 269 break; 270 } 271 /*FALLTHRU*/ 272 default: 273 plog(LLV_ERROR, LOCATION, iph1->remote, 274 "%s message must be encrypted\n", 275 s_isakmp_nptype(np)); 276 error = 0; 277 goto end; 278 } 279 } 280 281 if (!(pbuf = isakmp_parse(msg))) { 282 error = -1; 283 goto end; 284 } 285 286 error = 0; 287 for (pa = (struct isakmp_parse_t *)pbuf->v; pa->type; pa++) { 288 switch (pa->type) { 289 case ISAKMP_NPTYPE_HASH: 290 /* Handled above */ 291 break; 292 case ISAKMP_NPTYPE_N: 293 error = isakmp_info_recv_n(iph1, 294 (struct isakmp_pl_n *)pa->ptr, 295 msgid, encrypted); 296 break; 297 case ISAKMP_NPTYPE_D: 298 error = isakmp_info_recv_d(iph1, 299 (struct isakmp_pl_d *)pa->ptr, 300 msgid, encrypted); 301 break; 302 case ISAKMP_NPTYPE_NONCE: 303 /* XXX to be 6.4.2 ike-01.txt */ 304 /* XXX IV is to be synchronized. */ 305 plog(LLV_ERROR, LOCATION, iph1->remote, 306 "ignore Acknowledged Informational\n"); 307 break; 308 default: 309 /* don't send information, see isakmp_ident_r1() */ 310 error = 0; 311 plog(LLV_ERROR, LOCATION, iph1->remote, 312 "reject the packet, " 313 "received unexpected payload type %s.\n", 314 s_isakmp_nptype(gen->np)); 315 } 316 if (error < 0) 317 break; 318 } 319 end: 320 if (msg != NULL) 321 vfree(msg); 322 if (pbuf != NULL) 323 vfree(pbuf); 324 return error; 325 } 326 327 /* 328 * handling of Notification payload 329 */ 330 static int 331 isakmp_info_recv_n(iph1, notify, msgid, encrypted) 332 struct ph1handle *iph1; 333 struct isakmp_pl_n *notify; 334 u_int32_t msgid; 335 int encrypted; 336 { 337 u_int type; 338 vchar_t *pbuf; 339 char *nraw, *ndata; 340 size_t l; 341 char *spi; 342 343 type = ntohs(notify->type); 344 345 switch (type) { 346 case ISAKMP_NTYPE_CONNECTED: 347 case ISAKMP_NTYPE_RESPONDER_LIFETIME: 348 case ISAKMP_NTYPE_REPLAY_STATUS: 349 #ifdef ENABLE_HYBRID 350 case ISAKMP_NTYPE_UNITY_HEARTBEAT: 351 #endif 352 /* do something */ 353 break; 354 case ISAKMP_NTYPE_INITIAL_CONTACT: 355 if (encrypted) 356 info_recv_initialcontact(iph1); 357 return 0; 358 break; 359 #ifdef ENABLE_DPD 360 case ISAKMP_NTYPE_R_U_THERE: 361 if (encrypted) 362 return isakmp_info_recv_r_u(iph1, 363 (struct isakmp_pl_ru *)notify, msgid); 364 break; 365 case ISAKMP_NTYPE_R_U_THERE_ACK: 366 if (encrypted) 367 return isakmp_info_recv_r_u_ack(iph1, 368 (struct isakmp_pl_ru *)notify, msgid); 369 break; 370 #endif 371 default: 372 { 373 /* XXX there is a potential of dos attack. */ 374 if(type >= ISAKMP_NTYPE_MINERROR && 375 type <= ISAKMP_NTYPE_MAXERROR) { 376 if (msgid == 0) { 377 /* don't think this realy deletes ph1 ? */ 378 plog(LLV_ERROR, LOCATION, iph1->remote, 379 "delete phase1 handle.\n"); 380 return -1; 381 } else { 382 if (getph2bymsgid(iph1, msgid) == NULL) { 383 plog(LLV_ERROR, LOCATION, iph1->remote, 384 "fatal %s notify messsage, " 385 "phase1 should be deleted.\n", 386 s_isakmp_notify_msg(type)); 387 } else { 388 plog(LLV_ERROR, LOCATION, iph1->remote, 389 "fatal %s notify messsage, " 390 "phase2 should be deleted.\n", 391 s_isakmp_notify_msg(type)); 392 } 393 } 394 } else { 395 plog(LLV_ERROR, LOCATION, iph1->remote, 396 "unhandled notify message %s, " 397 "no phase2 handle found.\n", 398 s_isakmp_notify_msg(type)); 399 } 400 } 401 break; 402 } 403 404 /* get spi if specified and allocate */ 405 if(notify->spi_size > 0) { 406 if (ntohs(notify->h.len) < sizeof(*notify) + notify->spi_size) { 407 plog(LLV_ERROR, LOCATION, iph1->remote, 408 "invalid spi_size in notification payload.\n"); 409 return -1; 410 } 411 spi = val2str((char *)(notify + 1), notify->spi_size); 412 413 plog(LLV_DEBUG, LOCATION, iph1->remote, 414 "notification message %d:%s, " 415 "doi=%d proto_id=%d spi=%s(size=%d).\n", 416 type, s_isakmp_notify_msg(type), 417 ntohl(notify->doi), notify->proto_id, spi, notify->spi_size); 418 419 racoon_free(spi); 420 } 421 422 /* Send the message data to the logs */ 423 if(type >= ISAKMP_NTYPE_MINERROR && 424 type <= ISAKMP_NTYPE_MAXERROR) { 425 l = ntohs(notify->h.len) - sizeof(*notify) - notify->spi_size; 426 if (l > 0) { 427 nraw = (char*)notify; 428 nraw += sizeof(*notify) + notify->spi_size; 429 ndata = binsanitize(nraw, l); 430 if (ndata != NULL) { 431 plog(LLV_ERROR, LOCATION, iph1->remote, 432 "Message: '%s'.\n", 433 ndata); 434 racoon_free(ndata); 435 } else { 436 plog(LLV_ERROR, LOCATION, iph1->remote, 437 "Cannot allocate memory\n"); 438 } 439 } 440 } 441 return 0; 442 } 443 444 /* 445 * handling of Deletion payload 446 */ 447 static int 448 isakmp_info_recv_d(iph1, delete, msgid, encrypted) 449 struct ph1handle *iph1; 450 struct isakmp_pl_d *delete; 451 u_int32_t msgid; 452 int encrypted; 453 { 454 int tlen, num_spi; 455 vchar_t *pbuf; 456 int protected = 0; 457 struct ph1handle *del_ph1; 458 struct ph2handle *iph2; 459 union { 460 u_int32_t spi32; 461 u_int16_t spi16[2]; 462 } spi; 463 464 if (ntohl(delete->doi) != IPSEC_DOI) { 465 plog(LLV_ERROR, LOCATION, iph1->remote, 466 "delete payload with invalid doi:%d.\n", 467 ntohl(delete->doi)); 468 #ifdef ENABLE_HYBRID 469 /* 470 * At deconnexion time, Cisco VPN client does this 471 * with a zero DOI. Don't give up in that situation. 472 */ 473 if (((iph1->mode_cfg->flags & 474 ISAKMP_CFG_VENDORID_UNITY) == 0) || (delete->doi != 0)) 475 return 0; 476 #else 477 return 0; 478 #endif 479 } 480 481 num_spi = ntohs(delete->num_spi); 482 tlen = ntohs(delete->h.len) - sizeof(struct isakmp_pl_d); 483 484 if (tlen != num_spi * delete->spi_size) { 485 plog(LLV_ERROR, LOCATION, iph1->remote, 486 "deletion payload with invalid length.\n"); 487 return 0; 488 } 489 490 plog(LLV_DEBUG, LOCATION, iph1->remote, 491 "delete payload for protocol %s\n", 492 s_ipsecdoi_proto(delete->proto_id)); 493 494 if(!iph1->rmconf->weak_phase1_check && !encrypted) { 495 plog(LLV_WARNING, LOCATION, iph1->remote, 496 "Ignoring unencrypted delete payload " 497 "(check the weak_phase1_check option)\n"); 498 return 0; 499 } 500 501 switch (delete->proto_id) { 502 case IPSECDOI_PROTO_ISAKMP: 503 if (delete->spi_size != sizeof(isakmp_index)) { 504 plog(LLV_ERROR, LOCATION, iph1->remote, 505 "delete payload with strange spi " 506 "size %d(proto_id:%d)\n", 507 delete->spi_size, delete->proto_id); 508 return 0; 509 } 510 511 del_ph1=getph1byindex((isakmp_index *)(delete + 1)); 512 if(del_ph1 != NULL){ 513 514 EVT_PUSH(del_ph1->local, del_ph1->remote, 515 EVTT_PEERPH1_NOPROP, NULL); 516 if (del_ph1->scr) 517 SCHED_KILL(del_ph1->scr); 518 519 /* 520 * Do not delete IPsec SAs when receiving an IKE delete notification. 521 * Just delete the IKE SA. 522 */ 523 isakmp_ph1expire(del_ph1); 524 } 525 break; 526 527 case IPSECDOI_PROTO_IPSEC_AH: 528 case IPSECDOI_PROTO_IPSEC_ESP: 529 if (delete->spi_size != sizeof(u_int32_t)) { 530 plog(LLV_ERROR, LOCATION, iph1->remote, 531 "delete payload with strange spi " 532 "size %d(proto_id:%d)\n", 533 delete->spi_size, delete->proto_id); 534 return 0; 535 } 536 EVT_PUSH(iph1->local, iph1->remote, 537 EVTT_PEER_DELETE, NULL); 538 purge_ipsec_spi(iph1->remote, delete->proto_id, 539 (u_int32_t *)(delete + 1), num_spi); 540 break; 541 542 case IPSECDOI_PROTO_IPCOMP: 543 /* need to handle both 16bit/32bit SPI */ 544 memset(&spi, 0, sizeof(spi)); 545 if (delete->spi_size == sizeof(spi.spi16[1])) { 546 memcpy(&spi.spi16[1], delete + 1, 547 sizeof(spi.spi16[1])); 548 } else if (delete->spi_size == sizeof(spi.spi32)) 549 memcpy(&spi.spi32, delete + 1, sizeof(spi.spi32)); 550 else { 551 plog(LLV_ERROR, LOCATION, iph1->remote, 552 "delete payload with strange spi " 553 "size %d(proto_id:%d)\n", 554 delete->spi_size, delete->proto_id); 555 return 0; 556 } 557 purge_ipsec_spi(iph1->remote, delete->proto_id, 558 &spi.spi32, num_spi); 559 break; 560 561 default: 562 plog(LLV_ERROR, LOCATION, iph1->remote, 563 "deletion message received, " 564 "invalid proto_id: %d\n", 565 delete->proto_id); 566 return 0; 567 } 568 569 plog(LLV_DEBUG, LOCATION, NULL, "purged SAs.\n"); 570 571 return 0; 572 } 573 574 /* 575 * send Delete payload (for ISAKMP SA) in Informational exchange. 576 */ 577 int 578 isakmp_info_send_d1(iph1) 579 struct ph1handle *iph1; 580 { 581 struct isakmp_pl_d *d; 582 vchar_t *payload = NULL; 583 int tlen; 584 int error = 0; 585 586 if (iph1->status != PHASE2ST_ESTABLISHED) 587 return 0; 588 589 /* create delete payload */ 590 591 /* send SPIs of inbound SAs. */ 592 /* XXX should send outbound SAs's ? */ 593 tlen = sizeof(*d) + sizeof(isakmp_index); 594 payload = vmalloc(tlen); 595 if (payload == NULL) { 596 plog(LLV_ERROR, LOCATION, NULL, 597 "failed to get buffer for payload.\n"); 598 return errno; 599 } 600 601 d = (struct isakmp_pl_d *)payload->v; 602 d->h.np = ISAKMP_NPTYPE_NONE; 603 d->h.len = htons(tlen); 604 d->doi = htonl(IPSEC_DOI); 605 d->proto_id = IPSECDOI_PROTO_ISAKMP; 606 d->spi_size = sizeof(isakmp_index); 607 d->num_spi = htons(1); 608 memcpy(d + 1, &iph1->index, sizeof(isakmp_index)); 609 610 error = isakmp_info_send_common(iph1, payload, 611 ISAKMP_NPTYPE_D, 0); 612 vfree(payload); 613 614 return error; 615 } 616 617 /* 618 * send Delete payload (for IPsec SA) in Informational exchange, based on 619 * pfkey msg. It sends always single SPI. 620 */ 621 int 622 isakmp_info_send_d2(iph2) 623 struct ph2handle *iph2; 624 { 625 struct ph1handle *iph1; 626 struct saproto *pr; 627 struct isakmp_pl_d *d; 628 vchar_t *payload = NULL; 629 int tlen; 630 int error = 0; 631 u_int8_t *spi; 632 633 if (iph2->status != PHASE2ST_ESTABLISHED) 634 return 0; 635 636 /* 637 * don't send delete information if there is no phase 1 handler. 638 * It's nonsensical to negotiate phase 1 to send the information. 639 */ 640 iph1 = getph1byaddr(iph2->src, iph2->dst, 0); 641 if (iph1 == NULL){ 642 plog(LLV_DEBUG2, LOCATION, NULL, 643 "No ph1 handler found, could not send DELETE_SA\n"); 644 return 0; 645 } 646 647 /* create delete payload */ 648 for (pr = iph2->approval->head; pr != NULL; pr = pr->next) { 649 650 /* send SPIs of inbound SAs. */ 651 /* 652 * XXX should I send outbound SAs's ? 653 * I send inbound SAs's SPI only at the moment because I can't 654 * decode any more if peer send encoded packet without aware of 655 * deletion of SA. Outbound SAs don't come under the situation. 656 */ 657 tlen = sizeof(*d) + pr->spisize; 658 payload = vmalloc(tlen); 659 if (payload == NULL) { 660 plog(LLV_ERROR, LOCATION, NULL, 661 "failed to get buffer for payload.\n"); 662 return errno; 663 } 664 665 d = (struct isakmp_pl_d *)payload->v; 666 d->h.np = ISAKMP_NPTYPE_NONE; 667 d->h.len = htons(tlen); 668 d->doi = htonl(IPSEC_DOI); 669 d->proto_id = pr->proto_id; 670 d->spi_size = pr->spisize; 671 d->num_spi = htons(1); 672 /* 673 * XXX SPI bits are left-filled, for use with IPComp. 674 * we should be switching to variable-length spi field... 675 */ 676 spi = (u_int8_t *)&pr->spi; 677 spi += sizeof(pr->spi); 678 spi -= pr->spisize; 679 memcpy(d + 1, spi, pr->spisize); 680 681 error = isakmp_info_send_common(iph1, payload, 682 ISAKMP_NPTYPE_D, 0); 683 vfree(payload); 684 } 685 686 return error; 687 } 688 689 /* 690 * send Notification payload (for without ISAKMP SA) in Informational exchange 691 */ 692 int 693 isakmp_info_send_nx(isakmp, remote, local, type, data) 694 struct isakmp *isakmp; 695 struct sockaddr *remote, *local; 696 int type; 697 vchar_t *data; 698 { 699 struct ph1handle *iph1 = NULL; 700 struct remoteconf *rmconf; 701 vchar_t *payload = NULL; 702 int tlen; 703 int error = -1; 704 struct isakmp_pl_n *n; 705 int spisiz = 0; /* see below */ 706 707 /* search appropreate configuration */ 708 rmconf = getrmconf(remote); 709 if (rmconf == NULL) { 710 plog(LLV_ERROR, LOCATION, remote, 711 "no configuration found for peer address.\n"); 712 goto end; 713 } 714 715 /* add new entry to isakmp status table. */ 716 iph1 = newph1(); 717 if (iph1 == NULL) 718 return -1; 719 720 memcpy(&iph1->index.i_ck, &isakmp->i_ck, sizeof(cookie_t)); 721 isakmp_newcookie((char *)&iph1->index.r_ck, remote, local); 722 iph1->status = PHASE1ST_START; 723 iph1->rmconf = rmconf; 724 iph1->side = INITIATOR; 725 iph1->version = isakmp->v; 726 iph1->flags = 0; 727 iph1->msgid = 0; /* XXX */ 728 #ifdef ENABLE_HYBRID 729 if ((iph1->mode_cfg = isakmp_cfg_mkstate()) == NULL) 730 goto end; 731 #endif 732 #ifdef ENABLE_FRAG 733 iph1->frag = 0; 734 iph1->frag_chain = NULL; 735 #endif 736 737 /* copy remote address */ 738 if (copy_ph1addresses(iph1, rmconf, remote, local) < 0) 739 goto end; 740 741 tlen = sizeof(*n) + spisiz; 742 if (data) 743 tlen += data->l; 744 payload = vmalloc(tlen); 745 if (payload == NULL) { 746 plog(LLV_ERROR, LOCATION, NULL, 747 "failed to get buffer to send.\n"); 748 goto end; 749 } 750 751 n = (struct isakmp_pl_n *)payload->v; 752 n->h.np = ISAKMP_NPTYPE_NONE; 753 n->h.len = htons(tlen); 754 n->doi = htonl(IPSEC_DOI); 755 n->proto_id = IPSECDOI_KEY_IKE; 756 n->spi_size = spisiz; 757 n->type = htons(type); 758 if (spisiz) 759 memset(n + 1, 0, spisiz); /* XXX spisiz is always 0 */ 760 if (data) 761 memcpy((caddr_t)(n + 1) + spisiz, data->v, data->l); 762 763 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 0); 764 vfree(payload); 765 766 end: 767 if (iph1 != NULL) 768 delph1(iph1); 769 770 return error; 771 } 772 773 /* 774 * send Notification payload (for ISAKMP SA) in Informational exchange 775 */ 776 int 777 isakmp_info_send_n1(iph1, type, data) 778 struct ph1handle *iph1; 779 int type; 780 vchar_t *data; 781 { 782 vchar_t *payload = NULL; 783 int tlen; 784 int error = 0; 785 struct isakmp_pl_n *n; 786 int spisiz; 787 788 /* 789 * note on SPI size: which description is correct? I have chosen 790 * this to be 0. 791 * 792 * RFC2408 3.1, 2nd paragraph says: ISAKMP SA is identified by 793 * Initiator/Responder cookie and SPI has no meaning, SPI size = 0. 794 * RFC2408 3.1, first paragraph on page 40: ISAKMP SA is identified 795 * by cookie and SPI has no meaning, 0 <= SPI size <= 16. 796 * RFC2407 4.6.3.3, INITIAL-CONTACT is required to set to 16. 797 */ 798 if (type == ISAKMP_NTYPE_INITIAL_CONTACT) 799 spisiz = sizeof(isakmp_index); 800 else 801 spisiz = 0; 802 803 tlen = sizeof(*n) + spisiz; 804 if (data) 805 tlen += data->l; 806 payload = vmalloc(tlen); 807 if (payload == NULL) { 808 plog(LLV_ERROR, LOCATION, NULL, 809 "failed to get buffer to send.\n"); 810 return errno; 811 } 812 813 n = (struct isakmp_pl_n *)payload->v; 814 n->h.np = ISAKMP_NPTYPE_NONE; 815 n->h.len = htons(tlen); 816 n->doi = htonl(iph1->rmconf->doitype); 817 n->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX to be configurable ? */ 818 n->spi_size = spisiz; 819 n->type = htons(type); 820 if (spisiz) 821 memcpy(n + 1, &iph1->index, sizeof(isakmp_index)); 822 if (data) 823 memcpy((caddr_t)(n + 1) + spisiz, data->v, data->l); 824 825 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, iph1->flags); 826 vfree(payload); 827 828 return error; 829 } 830 831 /* 832 * send Notification payload (for IPsec SA) in Informational exchange 833 */ 834 int 835 isakmp_info_send_n2(iph2, type, data) 836 struct ph2handle *iph2; 837 int type; 838 vchar_t *data; 839 { 840 struct ph1handle *iph1 = iph2->ph1; 841 vchar_t *payload = NULL; 842 int tlen; 843 int error = 0; 844 struct isakmp_pl_n *n; 845 struct saproto *pr; 846 847 if (!iph2->approval) 848 return EINVAL; 849 850 pr = iph2->approval->head; 851 852 /* XXX must be get proper spi */ 853 tlen = sizeof(*n) + pr->spisize; 854 if (data) 855 tlen += data->l; 856 payload = vmalloc(tlen); 857 if (payload == NULL) { 858 plog(LLV_ERROR, LOCATION, NULL, 859 "failed to get buffer to send.\n"); 860 return errno; 861 } 862 863 n = (struct isakmp_pl_n *)payload->v; 864 n->h.np = ISAKMP_NPTYPE_NONE; 865 n->h.len = htons(tlen); 866 n->doi = htonl(IPSEC_DOI); /* IPSEC DOI (1) */ 867 n->proto_id = pr->proto_id; /* IPSEC AH/ESP/whatever*/ 868 n->spi_size = pr->spisize; 869 n->type = htons(type); 870 *(u_int32_t *)(n + 1) = pr->spi; 871 if (data) 872 memcpy((caddr_t)(n + 1) + pr->spisize, data->v, data->l); 873 874 iph2->flags |= ISAKMP_FLAG_E; /* XXX Should we do FLAG_A ? */ 875 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, iph2->flags); 876 vfree(payload); 877 878 return error; 879 } 880 881 /* 882 * send Information 883 * When ph1->skeyid_a == NULL, send message without encoding. 884 */ 885 int 886 isakmp_info_send_common(iph1, payload, np, flags) 887 struct ph1handle *iph1; 888 vchar_t *payload; 889 u_int32_t np; 890 int flags; 891 { 892 struct ph2handle *iph2 = NULL; 893 vchar_t *hash = NULL; 894 struct isakmp *isakmp; 895 struct isakmp_gen *gen; 896 char *p; 897 int tlen; 898 int error = -1; 899 900 /* add new entry to isakmp status table */ 901 iph2 = newph2(); 902 if (iph2 == NULL) 903 goto end; 904 905 iph2->dst = dupsaddr(iph1->remote); 906 if (iph2->dst == NULL) { 907 delph2(iph2); 908 goto end; 909 } 910 iph2->src = dupsaddr(iph1->local); 911 if (iph2->src == NULL) { 912 delph2(iph2); 913 goto end; 914 } 915 #if (!defined(ENABLE_NATT)) || (defined(BROKEN_NATT)) 916 if (set_port(iph2->dst, 0) == NULL || 917 set_port(iph2->src, 0) == NULL) { 918 plog(LLV_ERROR, LOCATION, NULL, 919 "invalid family: %d\n", iph1->remote->sa_family); 920 delph2(iph2); 921 goto end; 922 } 923 #endif 924 iph2->ph1 = iph1; 925 iph2->side = INITIATOR; 926 iph2->status = PHASE2ST_START; 927 iph2->msgid = isakmp_newmsgid2(iph1); 928 929 /* get IV and HASH(1) if skeyid_a was generated. */ 930 if (iph1->skeyid_a != NULL) { 931 iph2->ivm = oakley_newiv2(iph1, iph2->msgid); 932 if (iph2->ivm == NULL) { 933 delph2(iph2); 934 goto end; 935 } 936 937 /* generate HASH(1) */ 938 hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, payload); 939 if (hash == NULL) { 940 delph2(iph2); 941 goto end; 942 } 943 944 /* initialized total buffer length */ 945 tlen = hash->l; 946 tlen += sizeof(*gen); 947 } else { 948 /* IKE-SA is not established */ 949 hash = NULL; 950 951 /* initialized total buffer length */ 952 tlen = 0; 953 } 954 if ((flags & ISAKMP_FLAG_A) == 0) 955 iph2->flags = (hash == NULL ? 0 : ISAKMP_FLAG_E); 956 else 957 iph2->flags = (hash == NULL ? 0 : ISAKMP_FLAG_A); 958 959 insph2(iph2); 960 bindph12(iph1, iph2); 961 962 tlen += sizeof(*isakmp) + payload->l; 963 964 /* create buffer for isakmp payload */ 965 iph2->sendbuf = vmalloc(tlen); 966 if (iph2->sendbuf == NULL) { 967 plog(LLV_ERROR, LOCATION, NULL, 968 "failed to get buffer to send.\n"); 969 goto err; 970 } 971 972 /* create isakmp header */ 973 isakmp = (struct isakmp *)iph2->sendbuf->v; 974 memcpy(&isakmp->i_ck, &iph1->index.i_ck, sizeof(cookie_t)); 975 memcpy(&isakmp->r_ck, &iph1->index.r_ck, sizeof(cookie_t)); 976 isakmp->np = hash == NULL ? (np & 0xff) : ISAKMP_NPTYPE_HASH; 977 isakmp->v = iph1->version; 978 isakmp->etype = ISAKMP_ETYPE_INFO; 979 isakmp->flags = iph2->flags; 980 memcpy(&isakmp->msgid, &iph2->msgid, sizeof(isakmp->msgid)); 981 isakmp->len = htonl(tlen); 982 p = (char *)(isakmp + 1); 983 984 /* create HASH payload */ 985 if (hash != NULL) { 986 gen = (struct isakmp_gen *)p; 987 gen->np = np & 0xff; 988 gen->len = htons(sizeof(*gen) + hash->l); 989 p += sizeof(*gen); 990 memcpy(p, hash->v, hash->l); 991 p += hash->l; 992 } 993 994 /* add payload */ 995 memcpy(p, payload->v, payload->l); 996 p += payload->l; 997 998 #ifdef HAVE_PRINT_ISAKMP_C 999 isakmp_printpacket(iph2->sendbuf, iph1->local, iph1->remote, 1); 1000 #endif 1001 1002 /* encoding */ 1003 if (ISSET(isakmp->flags, ISAKMP_FLAG_E)) { 1004 vchar_t *tmp; 1005 1006 tmp = oakley_do_encrypt(iph2->ph1, iph2->sendbuf, iph2->ivm->ive, 1007 iph2->ivm->iv); 1008 VPTRINIT(iph2->sendbuf); 1009 if (tmp == NULL) 1010 goto err; 1011 iph2->sendbuf = tmp; 1012 } 1013 1014 /* HDR*, HASH(1), N */ 1015 if (isakmp_send(iph2->ph1, iph2->sendbuf) < 0) { 1016 VPTRINIT(iph2->sendbuf); 1017 goto err; 1018 } 1019 1020 plog(LLV_DEBUG, LOCATION, NULL, 1021 "sendto Information %s.\n", s_isakmp_nptype(np)); 1022 1023 /* 1024 * don't resend notify message because peer can use Acknowledged 1025 * Informational if peer requires the reply of the notify message. 1026 */ 1027 1028 /* XXX If Acknowledged Informational required, don't delete ph2handle */ 1029 error = 0; 1030 VPTRINIT(iph2->sendbuf); 1031 goto err; /* XXX */ 1032 1033 end: 1034 if (hash) 1035 vfree(hash); 1036 return error; 1037 1038 err: 1039 unbindph12(iph2); 1040 remph2(iph2); 1041 delph2(iph2); 1042 goto end; 1043 } 1044 1045 /* 1046 * add a notify payload to buffer by reallocating buffer. 1047 * If buf == NULL, the function only create a notify payload. 1048 * 1049 * XXX Which is SPI to be included, inbound or outbound ? 1050 */ 1051 vchar_t * 1052 isakmp_add_pl_n(buf0, np_p, type, pr, data) 1053 vchar_t *buf0; 1054 u_int8_t **np_p; 1055 int type; 1056 struct saproto *pr; 1057 vchar_t *data; 1058 { 1059 vchar_t *buf = NULL; 1060 struct isakmp_pl_n *n; 1061 int tlen; 1062 int oldlen = 0; 1063 1064 if (*np_p) 1065 **np_p = ISAKMP_NPTYPE_N; 1066 1067 tlen = sizeof(*n) + pr->spisize; 1068 1069 if (data) 1070 tlen += data->l; 1071 if (buf0) { 1072 oldlen = buf0->l; 1073 buf = vrealloc(buf0, buf0->l + tlen); 1074 } else 1075 buf = vmalloc(tlen); 1076 if (!buf) { 1077 plog(LLV_ERROR, LOCATION, NULL, 1078 "failed to get a payload buffer.\n"); 1079 return NULL; 1080 } 1081 1082 n = (struct isakmp_pl_n *)(buf->v + oldlen); 1083 n->h.np = ISAKMP_NPTYPE_NONE; 1084 n->h.len = htons(tlen); 1085 n->doi = htonl(IPSEC_DOI); /* IPSEC DOI (1) */ 1086 n->proto_id = pr->proto_id; /* IPSEC AH/ESP/whatever*/ 1087 n->spi_size = pr->spisize; 1088 n->type = htons(type); 1089 *(u_int32_t *)(n + 1) = pr->spi; /* XXX */ 1090 if (data) 1091 memcpy((caddr_t)(n + 1) + pr->spisize, data->v, data->l); 1092 1093 /* save the pointer of next payload type */ 1094 *np_p = &n->h.np; 1095 1096 return buf; 1097 } 1098 1099 static void 1100 purge_isakmp_spi(proto, spi, n) 1101 int proto; 1102 isakmp_index *spi; /*network byteorder*/ 1103 size_t n; 1104 { 1105 struct ph1handle *iph1; 1106 size_t i; 1107 1108 for (i = 0; i < n; i++) { 1109 iph1 = getph1byindex(&spi[i]); 1110 if (!iph1) 1111 continue; 1112 1113 plog(LLV_INFO, LOCATION, NULL, 1114 "purged ISAKMP-SA proto_id=%s spi=%s.\n", 1115 s_ipsecdoi_proto(proto), 1116 isakmp_pindex(&spi[i], 0)); 1117 1118 SCHED_KILL(iph1->sce); 1119 iph1->status = PHASE1ST_EXPIRED; 1120 iph1->sce = sched_new(1, isakmp_ph1delete_stub, iph1); 1121 } 1122 } 1123 1124 1125 1126 void 1127 purge_ipsec_spi(dst0, proto, spi, n) 1128 struct sockaddr *dst0; 1129 int proto; 1130 u_int32_t *spi; /*network byteorder*/ 1131 size_t n; 1132 { 1133 vchar_t *buf = NULL; 1134 struct sadb_msg *msg, *next, *end; 1135 struct sadb_sa *sa; 1136 struct sadb_lifetime *lt; 1137 struct sockaddr *src, *dst; 1138 struct ph2handle *iph2; 1139 u_int64_t created; 1140 size_t i; 1141 caddr_t mhp[SADB_EXT_MAX + 1]; 1142 #ifdef ENABLE_NATT 1143 struct sadb_x_nat_t_type *natt_type; 1144 struct sadb_x_nat_t_port *natt_port; 1145 #endif 1146 1147 plog(LLV_DEBUG2, LOCATION, NULL, 1148 "purge_ipsec_spi:\n"); 1149 plog(LLV_DEBUG2, LOCATION, NULL, "dst0: %s\n", saddr2str(dst0)); 1150 plog(LLV_DEBUG2, LOCATION, NULL, "SPI: %08X\n", ntohl(spi[0])); 1151 1152 buf = pfkey_dump_sadb(ipsecdoi2pfkey_proto(proto)); 1153 if (buf == NULL) { 1154 plog(LLV_DEBUG, LOCATION, NULL, 1155 "pfkey_dump_sadb returned nothing.\n"); 1156 return; 1157 } 1158 1159 msg = (struct sadb_msg *)buf->v; 1160 end = (struct sadb_msg *)(buf->v + buf->l); 1161 1162 while (msg < end) { 1163 if ((msg->sadb_msg_len << 3) < sizeof(*msg)) 1164 break; 1165 next = (struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3)); 1166 if (msg->sadb_msg_type != SADB_DUMP) { 1167 msg = next; 1168 continue; 1169 } 1170 1171 if (pfkey_align(msg, mhp) || pfkey_check(mhp)) { 1172 plog(LLV_ERROR, LOCATION, NULL, 1173 "pfkey_check (%s)\n", ipsec_strerror()); 1174 msg = next; 1175 continue; 1176 } 1177 1178 sa = (struct sadb_sa *)(mhp[SADB_EXT_SA]); 1179 if (!sa 1180 || !mhp[SADB_EXT_ADDRESS_SRC] 1181 || !mhp[SADB_EXT_ADDRESS_DST]) { 1182 msg = next; 1183 continue; 1184 } 1185 src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]); 1186 dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]); 1187 lt = (struct sadb_lifetime*)mhp[SADB_EXT_LIFETIME_HARD]; 1188 if(lt != NULL) 1189 created = lt->sadb_lifetime_addtime; 1190 else 1191 created = 0; 1192 1193 if (sa->sadb_sa_state != SADB_SASTATE_MATURE 1194 && sa->sadb_sa_state != SADB_SASTATE_DYING) { 1195 msg = next; 1196 continue; 1197 } 1198 #ifdef ENABLE_NATT 1199 natt_type = (void *)mhp[SADB_X_EXT_NAT_T_TYPE]; 1200 if (natt_type && natt_type->sadb_x_nat_t_type_type) { 1201 /* NAT-T is enabled for this SADB entry; copy 1202 * the ports from NAT-T extensions */ 1203 natt_port = (void *)mhp[SADB_X_EXT_NAT_T_SPORT]; 1204 if (extract_port(src) == 0 && natt_port != NULL) 1205 set_port(src, ntohs(natt_port->sadb_x_nat_t_port_port)); 1206 1207 natt_port = (void *)mhp[SADB_X_EXT_NAT_T_DPORT]; 1208 if (extract_port(dst) == 0 && natt_port != NULL) 1209 set_port(dst, ntohs(natt_port->sadb_x_nat_t_port_port)); 1210 }else{ 1211 /* Force default UDP ports, so CMPSADDR will match SAs with NO encapsulation 1212 */ 1213 set_port(src, PORT_ISAKMP); 1214 set_port(dst, PORT_ISAKMP); 1215 } 1216 #endif 1217 plog(LLV_DEBUG2, LOCATION, NULL, "src: %s\n", saddr2str(src)); 1218 plog(LLV_DEBUG2, LOCATION, NULL, "dst: %s\n", saddr2str(dst)); 1219 1220 /* XXX n^2 algorithm, inefficient */ 1221 1222 /* don't delete inbound SAs at the moment */ 1223 /* XXX should we remove SAs with opposite direction as well? */ 1224 if (CMPSADDR(dst0, dst)) { 1225 msg = next; 1226 continue; 1227 } 1228 1229 #ifdef ENABLE_NATT 1230 if (natt_type == NULL || 1231 ! natt_type->sadb_x_nat_t_type_type) { 1232 /* Set back port to 0 if it was forced to default UDP port 1233 */ 1234 set_port(src, 0); 1235 set_port(dst, 0); 1236 } 1237 #endif 1238 for (i = 0; i < n; i++) { 1239 plog(LLV_DEBUG, LOCATION, NULL, 1240 "check spi(packet)=%u spi(db)=%u.\n", 1241 ntohl(spi[i]), ntohl(sa->sadb_sa_spi)); 1242 if (spi[i] != sa->sadb_sa_spi) 1243 continue; 1244 1245 pfkey_send_delete(lcconf->sock_pfkey, 1246 msg->sadb_msg_satype, 1247 IPSEC_MODE_ANY, 1248 src, dst, sa->sadb_sa_spi); 1249 1250 /* 1251 * delete a relative phase 2 handler. 1252 * continue to process if no relative phase 2 handler 1253 * exists. 1254 */ 1255 iph2 = getph2bysaidx(src, dst, proto, spi[i]); 1256 if(iph2 != NULL){ 1257 delete_spd(iph2, created); 1258 unbindph12(iph2); 1259 remph2(iph2); 1260 delph2(iph2); 1261 } 1262 1263 plog(LLV_INFO, LOCATION, NULL, 1264 "purged IPsec-SA proto_id=%s spi=%u.\n", 1265 s_ipsecdoi_proto(proto), 1266 ntohl(spi[i])); 1267 } 1268 1269 msg = next; 1270 } 1271 1272 if (buf) 1273 vfree(buf); 1274 } 1275 1276 /* 1277 * delete all phase2 sa relatived to the destination address. 1278 * Don't delete Phase 1 handlers on INITIAL-CONTACT, and don't ignore 1279 * an INITIAL-CONTACT if we have contacted the peer. This matches the 1280 * Sun IKE behavior, and makes rekeying work much better when the peer 1281 * restarts. 1282 */ 1283 static void 1284 info_recv_initialcontact(iph1) 1285 struct ph1handle *iph1; 1286 { 1287 vchar_t *buf = NULL; 1288 struct sadb_msg *msg, *next, *end; 1289 struct sadb_sa *sa; 1290 struct sockaddr *src, *dst; 1291 caddr_t mhp[SADB_EXT_MAX + 1]; 1292 int proto_id, i; 1293 struct ph2handle *iph2; 1294 #if 0 1295 char *loc, *rem; 1296 #endif 1297 1298 if (f_local) 1299 return; 1300 1301 #if 0 1302 loc = racoon_strdup(saddrwop2str(iph1->local)); 1303 rem = racoon_strdup(saddrwop2str(iph1->remote)); 1304 STRDUP_FATAL(loc); 1305 STRDUP_FATAL(rem); 1306 1307 /* 1308 * Purge all IPSEC-SAs for the peer. We can do this 1309 * the easy way (using a PF_KEY SADB_DELETE extension) 1310 * or we can do it the hard way. 1311 */ 1312 for (i = 0; i < pfkey_nsatypes; i++) { 1313 proto_id = pfkey2ipsecdoi_proto(pfkey_satypes[i].ps_satype); 1314 1315 plog(LLV_INFO, LOCATION, NULL, 1316 "purging %s SAs for %s -> %s\n", 1317 pfkey_satypes[i].ps_name, loc, rem); 1318 if (pfkey_send_delete_all(lcconf->sock_pfkey, 1319 pfkey_satypes[i].ps_satype, IPSEC_MODE_ANY, 1320 iph1->local, iph1->remote) == -1) { 1321 plog(LLV_ERROR, LOCATION, NULL, 1322 "delete_all %s -> %s failed for %s (%s)\n", 1323 loc, rem, 1324 pfkey_satypes[i].ps_name, ipsec_strerror()); 1325 goto the_hard_way; 1326 } 1327 1328 deleteallph2(iph1->local, iph1->remote, proto_id); 1329 1330 plog(LLV_INFO, LOCATION, NULL, 1331 "purging %s SAs for %s -> %s\n", 1332 pfkey_satypes[i].ps_name, rem, loc); 1333 if (pfkey_send_delete_all(lcconf->sock_pfkey, 1334 pfkey_satypes[i].ps_satype, IPSEC_MODE_ANY, 1335 iph1->remote, iph1->local) == -1) { 1336 plog(LLV_ERROR, LOCATION, NULL, 1337 "delete_all %s -> %s failed for %s (%s)\n", 1338 rem, loc, 1339 pfkey_satypes[i].ps_name, ipsec_strerror()); 1340 goto the_hard_way; 1341 } 1342 1343 deleteallph2(iph1->remote, iph1->local, proto_id); 1344 } 1345 1346 racoon_free(loc); 1347 racoon_free(rem); 1348 return; 1349 1350 the_hard_way: 1351 racoon_free(loc); 1352 racoon_free(rem); 1353 #endif 1354 1355 buf = pfkey_dump_sadb(SADB_SATYPE_UNSPEC); 1356 if (buf == NULL) { 1357 plog(LLV_DEBUG, LOCATION, NULL, 1358 "pfkey_dump_sadb returned nothing.\n"); 1359 return; 1360 } 1361 1362 msg = (struct sadb_msg *)buf->v; 1363 end = (struct sadb_msg *)(buf->v + buf->l); 1364 1365 while (msg < end) { 1366 if ((msg->sadb_msg_len << 3) < sizeof(*msg)) 1367 break; 1368 next = (struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3)); 1369 if (msg->sadb_msg_type != SADB_DUMP) { 1370 msg = next; 1371 continue; 1372 } 1373 1374 if (pfkey_align(msg, mhp) || pfkey_check(mhp)) { 1375 plog(LLV_ERROR, LOCATION, NULL, 1376 "pfkey_check (%s)\n", ipsec_strerror()); 1377 msg = next; 1378 continue; 1379 } 1380 1381 if (mhp[SADB_EXT_SA] == NULL 1382 || mhp[SADB_EXT_ADDRESS_SRC] == NULL 1383 || mhp[SADB_EXT_ADDRESS_DST] == NULL) { 1384 msg = next; 1385 continue; 1386 } 1387 sa = (struct sadb_sa *)mhp[SADB_EXT_SA]; 1388 src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]); 1389 dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]); 1390 1391 if (sa->sadb_sa_state != SADB_SASTATE_MATURE 1392 && sa->sadb_sa_state != SADB_SASTATE_DYING) { 1393 msg = next; 1394 continue; 1395 } 1396 1397 /* 1398 * RFC2407 4.6.3.3 INITIAL-CONTACT is the message that 1399 * announces the sender of the message was rebooted. 1400 * it is interpreted to delete all SAs which source address 1401 * is the sender of the message. 1402 * racoon only deletes SA which is matched both the 1403 * source address and the destination accress. 1404 */ 1405 #ifdef ENABLE_NATT 1406 /* 1407 * XXX RFC 3947 says that whe MUST NOT use IP+port to find old SAs 1408 * from this peer ! 1409 */ 1410 if(iph1->natt_flags & NAT_DETECTED){ 1411 if (CMPSADDR(iph1->local, src) == 0 && 1412 CMPSADDR(iph1->remote, dst) == 0) 1413 ; 1414 else if (CMPSADDR(iph1->remote, src) == 0 && 1415 CMPSADDR(iph1->local, dst) == 0) 1416 ; 1417 else { 1418 msg = next; 1419 continue; 1420 } 1421 } else 1422 #endif 1423 /* If there is no NAT-T, we don't have to check addr + port... 1424 * XXX what about a configuration with a remote peers which is not 1425 * NATed, but which NATs some other peers ? 1426 * Here, the INITIAl-CONTACT would also flush all those NATed peers !! 1427 */ 1428 if (cmpsaddrwop(iph1->local, src) == 0 && 1429 cmpsaddrwop(iph1->remote, dst) == 0) 1430 ; 1431 else if (cmpsaddrwop(iph1->remote, src) == 0 && 1432 cmpsaddrwop(iph1->local, dst) == 0) 1433 ; 1434 else { 1435 msg = next; 1436 continue; 1437 } 1438 1439 /* 1440 * Make sure this is an SATYPE that we manage. 1441 * This is gross; too bad we couldn't do it the 1442 * easy way. 1443 */ 1444 for (i = 0; i < pfkey_nsatypes; i++) { 1445 if (pfkey_satypes[i].ps_satype == 1446 msg->sadb_msg_satype) 1447 break; 1448 } 1449 if (i == pfkey_nsatypes) { 1450 msg = next; 1451 continue; 1452 } 1453 1454 plog(LLV_INFO, LOCATION, NULL, 1455 "purging spi=%u.\n", ntohl(sa->sadb_sa_spi)); 1456 pfkey_send_delete(lcconf->sock_pfkey, 1457 msg->sadb_msg_satype, 1458 IPSEC_MODE_ANY, src, dst, sa->sadb_sa_spi); 1459 1460 /* 1461 * delete a relative phase 2 handler. 1462 * continue to process if no relative phase 2 handler 1463 * exists. 1464 */ 1465 proto_id = pfkey2ipsecdoi_proto(msg->sadb_msg_satype); 1466 iph2 = getph2bysaidx(src, dst, proto_id, sa->sadb_sa_spi); 1467 if (iph2) { 1468 delete_spd(iph2, 0); 1469 unbindph12(iph2); 1470 remph2(iph2); 1471 delph2(iph2); 1472 } 1473 1474 msg = next; 1475 } 1476 1477 vfree(buf); 1478 } 1479 1480 void 1481 isakmp_check_notify(gen, iph1) 1482 struct isakmp_gen *gen; /* points to Notify payload */ 1483 struct ph1handle *iph1; 1484 { 1485 struct isakmp_pl_n *notify = (struct isakmp_pl_n *)gen; 1486 1487 plog(LLV_DEBUG, LOCATION, iph1->remote, 1488 "Notify Message received\n"); 1489 1490 switch (ntohs(notify->type)) { 1491 case ISAKMP_NTYPE_CONNECTED: 1492 case ISAKMP_NTYPE_RESPONDER_LIFETIME: 1493 case ISAKMP_NTYPE_REPLAY_STATUS: 1494 case ISAKMP_NTYPE_HEARTBEAT: 1495 #ifdef ENABLE_HYBRID 1496 case ISAKMP_NTYPE_UNITY_HEARTBEAT: 1497 #endif 1498 plog(LLV_WARNING, LOCATION, iph1->remote, 1499 "ignore %s notification.\n", 1500 s_isakmp_notify_msg(ntohs(notify->type))); 1501 break; 1502 case ISAKMP_NTYPE_INITIAL_CONTACT: 1503 plog(LLV_WARNING, LOCATION, iph1->remote, 1504 "ignore INITIAL-CONTACT notification, " 1505 "because it is only accepted after phase1.\n"); 1506 break; 1507 default: 1508 isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL); 1509 plog(LLV_ERROR, LOCATION, iph1->remote, 1510 "received unknown notification type %s.\n", 1511 s_isakmp_notify_msg(ntohs(notify->type))); 1512 } 1513 1514 return; 1515 } 1516 1517 1518 #ifdef ENABLE_DPD 1519 static int 1520 isakmp_info_recv_r_u (iph1, ru, msgid) 1521 struct ph1handle *iph1; 1522 struct isakmp_pl_ru *ru; 1523 u_int32_t msgid; 1524 { 1525 struct isakmp_pl_ru *ru_ack; 1526 vchar_t *payload = NULL; 1527 int tlen; 1528 int error = 0; 1529 1530 plog(LLV_DEBUG, LOCATION, iph1->remote, 1531 "DPD R-U-There received\n"); 1532 1533 /* XXX should compare cookies with iph1->index? 1534 Or is this already done by calling function? */ 1535 tlen = sizeof(*ru_ack); 1536 payload = vmalloc(tlen); 1537 if (payload == NULL) { 1538 plog(LLV_ERROR, LOCATION, NULL, 1539 "failed to get buffer to send.\n"); 1540 return errno; 1541 } 1542 1543 ru_ack = (struct isakmp_pl_ru *)payload->v; 1544 ru_ack->h.np = ISAKMP_NPTYPE_NONE; 1545 ru_ack->h.len = htons(tlen); 1546 ru_ack->doi = htonl(IPSEC_DOI); 1547 ru_ack->type = htons(ISAKMP_NTYPE_R_U_THERE_ACK); 1548 ru_ack->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX ? */ 1549 ru_ack->spi_size = sizeof(isakmp_index); 1550 memcpy(ru_ack->i_ck, ru->i_ck, sizeof(cookie_t)); 1551 memcpy(ru_ack->r_ck, ru->r_ck, sizeof(cookie_t)); 1552 ru_ack->data = ru->data; 1553 1554 /* XXX Should we do FLAG_A ? */ 1555 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 1556 ISAKMP_FLAG_E); 1557 vfree(payload); 1558 1559 plog(LLV_DEBUG, LOCATION, NULL, "received a valid R-U-THERE, ACK sent\n"); 1560 1561 /* Should we mark tunnel as active ? */ 1562 return error; 1563 } 1564 1565 static int 1566 isakmp_info_recv_r_u_ack (iph1, ru, msgid) 1567 struct ph1handle *iph1; 1568 struct isakmp_pl_ru *ru; 1569 u_int32_t msgid; 1570 { 1571 1572 plog(LLV_DEBUG, LOCATION, iph1->remote, 1573 "DPD R-U-There-Ack received\n"); 1574 1575 /* XXX Maintain window of acceptable sequence numbers ? 1576 * => ru->data <= iph2->dpd_seq && 1577 * ru->data >= iph2->dpd_seq - iph2->dpd_fails ? */ 1578 if (ntohl(ru->data) != iph1->dpd_seq-1) { 1579 plog(LLV_ERROR, LOCATION, iph1->remote, 1580 "Wrong DPD sequence number (%d, %d expected).\n", 1581 ntohl(ru->data), iph1->dpd_seq-1); 1582 return 0; 1583 } 1584 1585 if (memcmp(ru->i_ck, iph1->index.i_ck, sizeof(cookie_t)) || 1586 memcmp(ru->r_ck, iph1->index.r_ck, sizeof(cookie_t))) { 1587 plog(LLV_ERROR, LOCATION, iph1->remote, 1588 "Cookie mismatch in DPD ACK!.\n"); 1589 return 0; 1590 } 1591 1592 iph1->dpd_fails = 0; 1593 1594 /* Useless ??? */ 1595 iph1->dpd_lastack = time(NULL); 1596 1597 SCHED_KILL(iph1->dpd_r_u); 1598 1599 isakmp_sched_r_u(iph1, 0); 1600 1601 plog(LLV_DEBUG, LOCATION, NULL, "received an R-U-THERE-ACK\n"); 1602 1603 return 0; 1604 } 1605 1606 1607 1608 1609 /* 1610 * send DPD R-U-THERE payload in Informational exchange. 1611 */ 1612 static void 1613 isakmp_info_send_r_u(arg) 1614 void *arg; 1615 { 1616 struct ph1handle *iph1 = arg; 1617 1618 /* create R-U-THERE payload */ 1619 struct isakmp_pl_ru *ru; 1620 vchar_t *payload = NULL; 1621 int tlen; 1622 int error = 0; 1623 1624 plog(LLV_DEBUG, LOCATION, iph1->remote, "DPD monitoring....\n"); 1625 1626 iph1->dpd_r_u=NULL; 1627 1628 if (iph1->dpd_fails >= iph1->rmconf->dpd_maxfails) { 1629 1630 plog(LLV_INFO, LOCATION, iph1->remote, 1631 "DPD: remote (ISAKMP-SA spi=%s) seems to be dead.\n", 1632 isakmp_pindex(&iph1->index, 0)); 1633 1634 EVT_PUSH(iph1->local, iph1->remote, EVTT_DPD_TIMEOUT, NULL); 1635 purge_remote(iph1); 1636 1637 /* Do not reschedule here: phase1 is deleted, 1638 * DPD will be reactivated when a new ph1 will be negociated 1639 */ 1640 return; 1641 } 1642 1643 /* TODO: check recent activity to avoid useless sends... */ 1644 1645 tlen = sizeof(*ru); 1646 payload = vmalloc(tlen); 1647 if (payload == NULL) { 1648 plog(LLV_ERROR, LOCATION, NULL, 1649 "failed to get buffer for payload.\n"); 1650 return; 1651 } 1652 ru = (struct isakmp_pl_ru *)payload->v; 1653 ru->h.np = ISAKMP_NPTYPE_NONE; 1654 ru->h.len = htons(tlen); 1655 ru->doi = htonl(IPSEC_DOI); 1656 ru->type = htons(ISAKMP_NTYPE_R_U_THERE); 1657 ru->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX ?*/ 1658 ru->spi_size = sizeof(isakmp_index); 1659 1660 memcpy(ru->i_ck, iph1->index.i_ck, sizeof(cookie_t)); 1661 memcpy(ru->r_ck, iph1->index.r_ck, sizeof(cookie_t)); 1662 1663 if (iph1->dpd_seq == 0){ 1664 /* generate a random seq which is not too big */ 1665 srand(time(NULL)); 1666 iph1->dpd_seq = rand() & 0x0fff; 1667 } 1668 1669 ru->data = htonl(iph1->dpd_seq); 1670 1671 error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 0); 1672 vfree(payload); 1673 1674 plog(LLV_DEBUG, LOCATION, iph1->remote, 1675 "DPD R-U-There sent (%d)\n", error); 1676 1677 /* will be decreased if ACK received... */ 1678 iph1->dpd_fails++; 1679 1680 /* XXX should be increased only when ACKed ? */ 1681 iph1->dpd_seq++; 1682 1683 /* Reschedule the r_u_there with a short delay, 1684 * will be deleted/rescheduled if ACK received before */ 1685 isakmp_sched_r_u(iph1, 1); 1686 1687 plog(LLV_DEBUG, LOCATION, iph1->remote, 1688 "rescheduling send_r_u (%d).\n", iph1->rmconf->dpd_retry); 1689 } 1690 1691 /* Schedule a new R-U-THERE */ 1692 int 1693 isakmp_sched_r_u(iph1, retry) 1694 struct ph1handle *iph1; 1695 int retry; 1696 { 1697 if(iph1 == NULL || 1698 iph1->rmconf == NULL) 1699 return 1; 1700 1701 1702 if(iph1->dpd_support == 0 || 1703 iph1->rmconf->dpd_interval == 0) 1704 return 0; 1705 1706 if(retry) 1707 iph1->dpd_r_u = sched_new(iph1->rmconf->dpd_retry, 1708 isakmp_info_send_r_u, iph1); 1709 else 1710 iph1->dpd_r_u = sched_new(iph1->rmconf->dpd_interval, 1711 isakmp_info_send_r_u, iph1); 1712 1713 return 0; 1714 } 1715 #endif 1716
