1c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh/* $NetBSD: isakmp_base.c,v 1.7 2006/10/02 21:51:33 manu Exp $ */ 20a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 30a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* $KAME: isakmp_base.c,v 1.49 2003/11/13 02:30:20 sakane Exp $ */ 40a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 50a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* 60a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 70a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * All rights reserved. 80a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * 90a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * Redistribution and use in source and binary forms, with or without 100a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * modification, are permitted provided that the following conditions 110a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * are met: 120a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * 1. Redistributions of source code must retain the above copyright 130a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * notice, this list of conditions and the following disclaimer. 140a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * 2. Redistributions in binary form must reproduce the above copyright 150a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * notice, this list of conditions and the following disclaimer in the 160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * documentation and/or other materials provided with the distribution. 170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * 3. Neither the name of the project nor the names of its contributors 180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * may be used to endorse or promote products derived from this software 190a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * without specific prior written permission. 200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * 210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 220a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 230a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * SUCH DAMAGE. 320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 330a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* Base Exchange (Base Mode) */ 350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 360a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "config.h" 370a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 380a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include <sys/types.h> 390a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include <sys/param.h> 400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include <stdlib.h> 420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include <stdio.h> 430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include <string.h> 440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include <errno.h> 450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#if TIME_WITH_SYS_TIME 460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang# include <sys/time.h> 470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang# include <time.h> 480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#else 490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang# if HAVE_SYS_TIME_H 500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang# include <sys/time.h> 510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang# else 520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang# include <time.h> 530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang# endif 540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "var.h" 570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "misc.h" 580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "vmbuf.h" 590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "plog.h" 600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "sockmisc.h" 610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "schedule.h" 620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "debug.h" 630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_HYBRID 650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include <resolv.h> 660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "localconf.h" 690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "remoteconf.h" 700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "isakmp_var.h" 710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "isakmp.h" 720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "evt.h" 730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "oakley.h" 740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "handler.h" 750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "ipsec_doi.h" 760a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "crypto_openssl.h" 770a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "pfkey.h" 780a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "isakmp_base.h" 790a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "isakmp_inf.h" 800a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "vendorid.h" 810a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_NATT 820a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "nattraversal.h" 830a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_FRAG 850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "isakmp_frag.h" 860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_HYBRID 880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "isakmp_xauth.h" 890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "isakmp_cfg.h" 900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 910a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 920a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* %%% 930a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * begin Identity Protection Mode as initiator. 940a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* 960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * send to responder 970a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * psk: HDR, SA, Idii, Ni_b 980a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * sig: HDR, SA, Idii, Ni_b 990a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * rsa: HDR, SA, [HASH(1),] <IDii_b>Pubkey_r, <Ni_b>Pubkey_r 1000a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * rev: HDR, SA, [HASH(1),] <Ni_b>Pubkey_r, <IDii_b>Ke_i 1010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 1020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangint 1030a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangbase_i1send(iph1, msg) 1040a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph1handle *iph1; 1050a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *msg; /* must be null */ 1060a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang{ 1070a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct payload_list *plist = NULL; 1080a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int error = -1; 1090a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_NATT 1100a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *vid_natt[MAX_NATT_VID_COUNT] = { NULL }; 1110a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int i, vid_natt_i = 0; 1120a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 1130a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_FRAG 1140a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *vid_frag = NULL; 1150a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 1160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_HYBRID 1170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *vid_xauth = NULL; 1180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *vid_unity = NULL; 1190a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 1200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_DPD 1210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *vid_dpd = NULL; 1220a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 1230a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* validity check */ 1260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (msg != NULL) { 1270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 1280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "msg has to be NULL in this function.\n"); 1290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 1300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 1310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->status != PHASE1ST_START) { 1320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 1330a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "status mismatched %d.\n", iph1->status); 1340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 1350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 1360a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1370a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* create isakmp index */ 1380a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang memset(&iph1->index, 0, sizeof(iph1->index)); 1390a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang isakmp_newcookie((caddr_t)&iph1->index, iph1->remote, iph1->local); 1400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* make ID payload into isakmp status */ 1420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (ipsecdoi_setid1(iph1) < 0) 1430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 1440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* create SA payload for my proposal */ 146c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh iph1->sa = ipsecdoi_setph1proposal(iph1->rmconf->proposal); 1470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->sa == NULL) 1480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 1490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* generate NONCE value */ 1510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->nonce = eay_set_random(iph1->rmconf->nonce_size); 1520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->nonce == NULL) 1530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 1540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_HYBRID 1560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* Do we need Xauth VID? */ 157c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh switch (RMAUTHMETHOD(iph1)) { 158c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I: 1590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I: 1600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I: 1610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I: 1620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I: 1630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I: 1640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I: 1650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if ((vid_xauth = set_vendorid(VENDORID_XAUTH)) == NULL) 1660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 1670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "Xauth vendor ID generation failed\n"); 1680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if ((vid_unity = set_vendorid(VENDORID_UNITY)) == NULL) 1700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 1710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "Unity vendor ID generation failed\n"); 1720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 1730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang default: 1740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 1750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 1760a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 1770a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_FRAG 1780a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->rmconf->ike_frag) { 1790a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vid_frag = set_vendorid(VENDORID_FRAG); 1800a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (vid_frag != NULL) 1810a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vid_frag = isakmp_frag_addcap(vid_frag, 1820a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang VENDORID_FRAG_BASE); 1830a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (vid_frag == NULL) 1840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 1850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "Frag vendorID construction failed\n"); 1860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 1870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 1880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_NATT 1890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* Is NAT-T support allowed in the config file? */ 1900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->rmconf->nat_traversal) { 1910a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* Advertise NAT-T capability */ 1920a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang memset (vid_natt, 0, sizeof (vid_natt)); 1930a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef VENDORID_NATT_00 1940a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_00)) != NULL) 1950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vid_natt_i++; 1960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 1970a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef VENDORID_NATT_02 1980a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_02)) != NULL) 1990a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vid_natt_i++; 2000a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 2010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef VENDORID_NATT_02_N 2020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_02_N)) != NULL) 2030a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vid_natt_i++; 2040a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 2050a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef VENDORID_NATT_RFC 2060a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_RFC)) != NULL) 2070a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vid_natt_i++; 2080a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 2090a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 2100a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 2110a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 2120a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* set SA payload to propose */ 2130a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plist = isakmp_plist_append(plist, iph1->sa, ISAKMP_NPTYPE_SA); 2140a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 2150a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* create isakmp ID payload */ 2160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plist = isakmp_plist_append(plist, iph1->id, ISAKMP_NPTYPE_ID); 2170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 2180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* create isakmp NONCE payload */ 2190a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plist = isakmp_plist_append(plist, iph1->nonce, ISAKMP_NPTYPE_NONCE); 2200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 2210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_FRAG 2220a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (vid_frag) 2230a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plist = isakmp_plist_append(plist, vid_frag, ISAKMP_NPTYPE_VID); 2240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 2250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_HYBRID 2260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (vid_xauth) 2270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plist = isakmp_plist_append(plist, 2280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vid_xauth, ISAKMP_NPTYPE_VID); 2290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (vid_unity) 2300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plist = isakmp_plist_append(plist, 2310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vid_unity, ISAKMP_NPTYPE_VID); 2320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 2330a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_DPD 2340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->rmconf->dpd) { 2350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vid_dpd = set_vendorid(VENDORID_DPD); 2360a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (vid_dpd != NULL) 2370a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plist = isakmp_plist_append(plist, vid_dpd, ISAKMP_NPTYPE_VID); 2380a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 2390a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 2400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_NATT 2410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* set VID payload for NAT-T */ 2420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang for (i = 0; i < vid_natt_i; i++) 2430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plist = isakmp_plist_append(plist, vid_natt[i], ISAKMP_NPTYPE_VID); 2440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 2450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->sendbuf = isakmp_plist_set_all (&plist, iph1); 2460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 2470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 2480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef HAVE_PRINT_ISAKMP_C 2490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang isakmp_printpacket(iph1->sendbuf, iph1->local, iph1->remote, 0); 2500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 2510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 2520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* send the packet, add to the schedule to resend */ 253c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh iph1->retry_counter = iph1->rmconf->retry_counter; 254c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if (isakmp_ph1resend(iph1) == -1) 2550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 2560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 2570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->status = PHASE1ST_MSG1SENT; 2580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 2590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang error = 0; 2600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 2610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangend: 2620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_FRAG 2630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (vid_frag) 2640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(vid_frag); 2650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 2660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_NATT 2670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang for (i = 0; i < vid_natt_i; i++) 2680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(vid_natt[i]); 2690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 2700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_HYBRID 2710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (vid_xauth != NULL) 2720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(vid_xauth); 2730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (vid_unity != NULL) 2740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(vid_unity); 2750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 2760a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_DPD 2770a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (vid_dpd != NULL) 2780a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(vid_dpd); 2790a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 2800a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 2810a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return error; 2820a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang} 2830a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 2840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* 2850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * receive from responder 2860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * psk: HDR, SA, Idir, Nr_b 2870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * sig: HDR, SA, Idir, Nr_b, [ CR ] 2880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * rsa: HDR, SA, <IDir_b>PubKey_i, <Nr_b>PubKey_i 2890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * rev: HDR, SA, <Nr_b>PubKey_i, <IDir_b>Ke_r 2900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 2910a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangint 2920a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangbase_i2recv(iph1, msg) 2930a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph1handle *iph1; 2940a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *msg; 2950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang{ 2960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *pbuf = NULL; 2970a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct isakmp_parse_t *pa; 2980a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *satmp = NULL; 2990a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int error = -1; 300c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh int vid_numeric; 3010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_HYBRID 3020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *unity_vid; 3030a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *xauth_vid; 3040a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 3050a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 3060a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* validity check */ 3070a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->status != PHASE1ST_MSG1SENT) { 3080a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 3090a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "status mismatched %d.\n", iph1->status); 3100a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 3110a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 3120a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 3130a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* validate the type of next payload */ 3140a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pbuf = isakmp_parse(msg); 3150a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (pbuf == NULL) 3160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 3170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pa = (struct isakmp_parse_t *)pbuf->v; 3180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 3190a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* SA payload is fixed postion */ 3200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (pa->type != ISAKMP_NPTYPE_SA) { 3210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, iph1->remote, 3220a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "received invalid next payload type %d, " 3230a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "expecting %d.\n", 3240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pa->type, ISAKMP_NPTYPE_SA); 3250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 3260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 3270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (isakmp_p2ph(&satmp, pa->ptr) < 0) 3280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 3290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pa++; 3300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 3310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang for (/*nothing*/; 3320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pa->type != ISAKMP_NPTYPE_NONE; 3330a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pa++) { 3340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 3350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang switch (pa->type) { 3360a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NPTYPE_NONCE: 3370a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (isakmp_p2ph(&iph1->nonce_p, pa->ptr) < 0) 3380a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 3390a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 3400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NPTYPE_ID: 3410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (isakmp_p2ph(&iph1->id_p, pa->ptr) < 0) 3420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 3430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 3440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NPTYPE_VID: 345adfbc90a9f63d1e0c87b4b17689c07cd3c781a0eChia-chi Yeh handle_vendorid(iph1, pa->ptr); 3460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 3470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang default: 3480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* don't send information, see ident_r1recv() */ 3490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, iph1->remote, 3500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "ignore the packet, " 3510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "received unexpecting payload type %d.\n", 3520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pa->type); 3530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 3540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 3550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 3560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 3570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->nonce_p == NULL || iph1->id_p == NULL) { 3580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, iph1->remote, 3590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "few isakmp message received.\n"); 3600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 3610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 3620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 3630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* verify identifier */ 3640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (ipsecdoi_checkid1(iph1) != 0) { 3650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, iph1->remote, 3660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "invalid ID payload.\n"); 3670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 3680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 3690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 3700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_NATT 3710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (NATT_AVAILABLE(iph1)) 3720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_INFO, LOCATION, iph1->remote, 3730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "Selected NAT-T version: %s\n", 3740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vid_string_by_id(iph1->natt_options->version)); 3750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 3760a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 3770a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* check SA payload and set approval SA for use */ 3780a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (ipsecdoi_checkph1proposal(satmp, iph1) < 0) { 3790a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, iph1->remote, 3800a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "failed to get valid proposal.\n"); 3810a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* XXX send information */ 3820a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 3830a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 3840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang VPTRINIT(iph1->sa_ret); 3850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 3860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->status = PHASE1ST_MSG2RECEIVED; 3870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 3880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang error = 0; 3890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 3900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangend: 3910a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (pbuf) 3920a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(pbuf); 3930a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (satmp) 3940a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(satmp); 3950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 3960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (error) { 3970a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang VPTRINIT(iph1->nonce_p); 3980a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang VPTRINIT(iph1->id_p); 3990a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 4000a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 4010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return error; 4020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang} 4030a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 4040a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* 4050a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * send to responder 4060a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * psk: HDR, KE, HASH_I 4070a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * sig: HDR, KE, [ CR, ] [CERT,] SIG_I 4080a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * rsa: HDR, KE, HASH_I 4090a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * rev: HDR, <KE>Ke_i, HASH_I 4100a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 4110a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangint 4120a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangbase_i2send(iph1, msg) 4130a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph1handle *iph1; 4140a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *msg; 4150a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang{ 4160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct payload_list *plist = NULL; 4170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *vid = NULL; 4180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int need_cert = 0; 4190a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int error = -1; 4200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 4210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* validity check */ 4220a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->status != PHASE1ST_MSG2RECEIVED) { 4230a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 4240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "status mismatched %d.\n", iph1->status); 4250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 4260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 4270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 4280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* fix isakmp index */ 4290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang memcpy(&iph1->index.r_ck, &((struct isakmp *)msg->v)->r_ck, 4300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang sizeof(cookie_t)); 4310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 4320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* generate DH public value */ 4330a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (oakley_dh_generate(iph1->approval->dhgrp, 4340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang &iph1->dhpub, &iph1->dhpriv) < 0) 4350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 4360a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 4370a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* generate SKEYID to compute hash if not signature mode */ 438c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh switch (AUTHMETHOD(iph1)) { 4390a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_RSASIG: 4400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_DSSSIG: 4410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_HYBRID 4420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I: 4430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I: 4440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I: 4450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I: 4460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I: 4470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 4480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 4490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang default: 4500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (oakley_skeyid(iph1) < 0) 4510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 4520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 4530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 4540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 4550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* generate HASH to send */ 4560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_DEBUG, LOCATION, NULL, "generate HASH_I\n"); 4570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->hash = oakley_ph1hash_base_i(iph1, GENERATE); 4580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->hash == NULL) 4590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 460c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh switch (AUTHMETHOD(iph1)) { 4610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_PSKEY: 4620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_HYBRID 463c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I: 4640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I: 4650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I: 4660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 4670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vid = set_vendorid(iph1->approval->vendorid); 4680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 4690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* create isakmp KE payload */ 4700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plist = isakmp_plist_append(plist, iph1->dhpub, ISAKMP_NPTYPE_KE); 4710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 4720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* create isakmp HASH payload */ 4730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plist = isakmp_plist_append(plist, iph1->hash, ISAKMP_NPTYPE_HASH); 4740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 4750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* append vendor id, if needed */ 4760a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (vid) 4770a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plist = isakmp_plist_append(plist, vid, ISAKMP_NPTYPE_VID); 4780a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 4790a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_DSSSIG: 4800a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_RSASIG: 4810a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_HYBRID 4820a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I: 4830a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I: 4840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 4850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* XXX if there is CR or not ? */ 4860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 4870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (oakley_getmycert(iph1) < 0) 4880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 4890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 4900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (oakley_getsign(iph1) < 0) 4910a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 4920a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 4930a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->cert && iph1->rmconf->send_cert) 4940a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang need_cert = 1; 4950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 4960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* create isakmp KE payload */ 497c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh plist = isakmp_plist_append(plist, 498c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh iph1->dhpub, ISAKMP_NPTYPE_KE); 4990a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 5000a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* add CERT payload if there */ 5010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (need_cert) 502c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh plist = isakmp_plist_append(plist, 503c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh iph1->cert->pl, ISAKMP_NPTYPE_CERT); 5040a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 5050a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* add SIG payload */ 506c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh plist = isakmp_plist_append(plist, 5070a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->sig, ISAKMP_NPTYPE_SIG); 5080a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 5090a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 5100a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef HAVE_GSSAPI 5110a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB: 5120a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* ... */ 5130a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 5140a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 5150a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_RSAENC: 5160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_RSAREV: 5170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_HYBRID 5180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I: 5190a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I: 5200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 5210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 5220a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 5230a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 5240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_NATT 5250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* generate NAT-D payloads */ 5260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (NATT_AVAILABLE(iph1)) 5270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang { 5280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *natd[2] = { NULL, NULL }; 5290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 5300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog (LLV_INFO, LOCATION, NULL, "Adding remote and local NAT-D payloads.\n"); 5310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if ((natd[0] = natt_hash_addr (iph1, iph1->remote)) == NULL) { 5320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 5330a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "NAT-D hashing failed for %s\n", saddr2str(iph1->remote)); 5340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 5350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 5360a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 5370a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if ((natd[1] = natt_hash_addr (iph1, iph1->local)) == NULL) { 5380a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 5390a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "NAT-D hashing failed for %s\n", saddr2str(iph1->local)); 5400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 5410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 5420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 5430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plist = isakmp_plist_append(plist, natd[0], iph1->natt_options->payload_nat_d); 5440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plist = isakmp_plist_append(plist, natd[1], iph1->natt_options->payload_nat_d); 5450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 5460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 5470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 5480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->sendbuf = isakmp_plist_set_all (&plist, iph1); 5490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 5500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef HAVE_PRINT_ISAKMP_C 5510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang isakmp_printpacket(iph1->sendbuf, iph1->local, iph1->remote, 0); 5520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 5530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 5540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* send the packet, add to the schedule to resend */ 555c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh iph1->retry_counter = iph1->rmconf->retry_counter; 556c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if (isakmp_ph1resend(iph1) == -1) 5570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 5580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 5590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* the sending message is added to the received-list. */ 5600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (add_recvdpkt(iph1->remote, iph1->local, iph1->sendbuf, msg) == -1) { 5610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR , LOCATION, NULL, 5620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "failed to add a response packet to the tree.\n"); 5630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 5640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 5650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 5660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->status = PHASE1ST_MSG2SENT; 5670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 5680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang error = 0; 5690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 5700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangend: 5710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (vid) 5720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(vid); 5730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return error; 5740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang} 5750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 5760a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* 5770a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * receive from responder 5780a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * psk: HDR, KE, HASH_R 5790a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * sig: HDR, KE, [CERT,] SIG_R 5800a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * rsa: HDR, KE, HASH_R 5810a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * rev: HDR, <KE>_Ke_r, HASH_R 5820a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 5830a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangint 5840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangbase_i3recv(iph1, msg) 5850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph1handle *iph1; 5860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *msg; 5870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang{ 5880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *pbuf = NULL; 5890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct isakmp_parse_t *pa; 590c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh int error = -1; 591c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh int ptype; 5920a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_NATT 5930a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *natd_received; 5940a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int natd_seq = 0, natd_verified; 5950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 5960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 5970a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* validity check */ 5980a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->status != PHASE1ST_MSG2SENT) { 5990a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 6000a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "status mismatched %d.\n", iph1->status); 6010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 6020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 6030a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 6040a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* validate the type of next payload */ 6050a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pbuf = isakmp_parse(msg); 6060a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (pbuf == NULL) 6070a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 6080a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 6090a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang for (pa = (struct isakmp_parse_t *)pbuf->v; 6100a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pa->type != ISAKMP_NPTYPE_NONE; 6110a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pa++) { 6120a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 6130a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang switch (pa->type) { 6140a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NPTYPE_KE: 6150a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (isakmp_p2ph(&iph1->dhpub_p, pa->ptr) < 0) 6160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 6170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 6180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NPTYPE_HASH: 6190a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->pl_hash = (struct isakmp_pl_hash *)pa->ptr; 6200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 6210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NPTYPE_CERT: 6220a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (oakley_savecert(iph1, pa->ptr) < 0) 6230a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 6240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 6250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NPTYPE_SIG: 6260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (isakmp_p2ph(&iph1->sig_p, pa->ptr) < 0) 6270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 6280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 6290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NPTYPE_VID: 630adfbc90a9f63d1e0c87b4b17689c07cd3c781a0eChia-chi Yeh handle_vendorid(iph1, pa->ptr); 6310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 6320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 6330a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_NATT 6340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NPTYPE_NATD_DRAFT: 6350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NPTYPE_NATD_RFC: 6360a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (NATT_AVAILABLE(iph1) && iph1->natt_options && 6370a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pa->type == iph1->natt_options->payload_nat_d) { 6380a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang natd_received = NULL; 6390a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (isakmp_p2ph (&natd_received, pa->ptr) < 0) 6400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 6410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 6420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* set both bits first so that we can clear them 6430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang upon verifying hashes */ 6440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (natd_seq == 0) 6450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->natt_flags |= NAT_DETECTED; 6460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 6470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* this function will clear appropriate bits bits 6480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang from iph1->natt_flags */ 6490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang natd_verified = natt_compare_addr_hash (iph1, 6500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang natd_received, natd_seq++); 6510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 6520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog (LLV_INFO, LOCATION, NULL, "NAT-D payload #%d %s\n", 6530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang natd_seq - 1, 6540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang natd_verified ? "verified" : "doesn't match"); 6550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 6560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree (natd_received); 6570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 6580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 6590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* passthrough to default... */ 6600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 6610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 6620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang default: 6630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* don't send information, see ident_r1recv() */ 6640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, iph1->remote, 6650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "ignore the packet, " 6660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "received unexpecting payload type %d.\n", 6670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pa->type); 6680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 6690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 6700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 6710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 6720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_NATT 6730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (NATT_AVAILABLE(iph1)) { 6740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog (LLV_INFO, LOCATION, NULL, "NAT %s %s%s\n", 6750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->natt_flags & NAT_DETECTED ? 6760a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "detected:" : "not detected", 6770a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->natt_flags & NAT_DETECTED_ME ? "ME " : "", 6780a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->natt_flags & NAT_DETECTED_PEER ? "PEER" : ""); 6790a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->natt_flags & NAT_DETECTED) 6800a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang natt_float_ports (iph1); 6810a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 6820a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 6830a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 6840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* payload existency check */ 6850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* validate authentication value */ 6860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang ptype = oakley_validate_auth(iph1); 6870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (ptype != 0) { 6880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (ptype == -1) { 6890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* message printed inner oakley_validate_auth() */ 6900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 6910a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 692c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh EVT_PUSH(iph1->local, iph1->remote, 693c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh EVTT_PEERPH1AUTH_FAILED, NULL); 6940a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang isakmp_info_send_n1(iph1, ptype, NULL); 6950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 6960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 6970a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 6980a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* compute sharing secret of DH */ 6990a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (oakley_dh_compute(iph1->approval->dhgrp, iph1->dhpub, 7000a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->dhpriv, iph1->dhpub_p, &iph1->dhgxy) < 0) 7010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 7020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 7030a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* generate SKEYID to compute hash if signature mode */ 704c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh switch (AUTHMETHOD(iph1)) { 7050a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_RSASIG: 7060a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_DSSSIG: 7070a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_HYBRID 7080a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I: 7090a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I: 7100a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I: 7110a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I: 7120a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I: 7130a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 7140a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (oakley_skeyid(iph1) < 0) 7150a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 7160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 7170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang default: 7180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 7190a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 7200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 7210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* generate SKEYIDs & IV & final cipher key */ 7220a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (oakley_skeyid_dae(iph1) < 0) 7230a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 7240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (oakley_compute_enckey(iph1) < 0) 7250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 7260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (oakley_newiv(iph1) < 0) 7270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 7280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 7290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* see handler.h about IV synchronization. */ 7300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang memcpy(iph1->ivm->iv->v, iph1->ivm->ive->v, iph1->ivm->iv->l); 7310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 7320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* set encryption flag */ 7330a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->flags |= ISAKMP_FLAG_E; 7340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 7350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->status = PHASE1ST_MSG3RECEIVED; 7360a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 7370a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang error = 0; 7380a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 7390a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangend: 7400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (pbuf) 7410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(pbuf); 7420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 7430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (error) { 7440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang VPTRINIT(iph1->dhpub_p); 745c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh oakley_delcert(iph1->cert_p); 746c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh iph1->cert_p = NULL; 747c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh oakley_delcert(iph1->crl_p); 748c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh iph1->crl_p = NULL; 7490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang VPTRINIT(iph1->sig_p); 7500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 7510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 7520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return error; 7530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang} 7540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 7550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* 7560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * status update and establish isakmp sa. 7570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 7580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangint 7590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangbase_i3send(iph1, msg) 7600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph1handle *iph1; 7610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *msg; 7620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang{ 7630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int error = -1; 7640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 7650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* validity check */ 7660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->status != PHASE1ST_MSG3RECEIVED) { 7670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 7680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "status mismatched %d.\n", iph1->status); 7690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 7700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 7710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 7720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->status = PHASE1ST_ESTABLISHED; 7730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 7740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang error = 0; 7750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 7760a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangend: 7770a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return error; 7780a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang} 7790a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 7800a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* 7810a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * receive from initiator 7820a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * psk: HDR, SA, Idii, Ni_b 7830a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * sig: HDR, SA, Idii, Ni_b 7840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * rsa: HDR, SA, [HASH(1),] <IDii_b>Pubkey_r, <Ni_b>Pubkey_r 7850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * rev: HDR, SA, [HASH(1),] <Ni_b>Pubkey_r, <IDii_b>Ke_i 7860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 7870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangint 7880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangbase_r1recv(iph1, msg) 7890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph1handle *iph1; 7900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *msg; 7910a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang{ 7920a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *pbuf = NULL; 7930a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct isakmp_parse_t *pa; 7940a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int error = -1; 7950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int vid_numeric; 7960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 7970a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* validity check */ 7980a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->status != PHASE1ST_START) { 7990a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 8000a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "status mismatched %d.\n", iph1->status); 8010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 8020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 8030a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 8040a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* validate the type of next payload */ 805c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh /* 806c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh * NOTE: XXX even if multiple VID, we'll silently ignore those. 807c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh */ 8080a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pbuf = isakmp_parse(msg); 8090a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (pbuf == NULL) 8100a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 8110a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pa = (struct isakmp_parse_t *)pbuf->v; 8120a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 8130a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* check the position of SA payload */ 8140a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (pa->type != ISAKMP_NPTYPE_SA) { 8150a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, iph1->remote, 8160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "received invalid next payload type %d, " 8170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "expecting %d.\n", 8180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pa->type, ISAKMP_NPTYPE_SA); 8190a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 8200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 8210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (isakmp_p2ph(&iph1->sa, pa->ptr) < 0) 8220a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 8230a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pa++; 8240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 8250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang for (/*nothing*/; 8260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pa->type != ISAKMP_NPTYPE_NONE; 8270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pa++) { 8280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 8290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang switch (pa->type) { 8300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NPTYPE_NONCE: 8310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (isakmp_p2ph(&iph1->nonce_p, pa->ptr) < 0) 8320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 8330a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 8340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NPTYPE_ID: 8350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (isakmp_p2ph(&iph1->id_p, pa->ptr) < 0) 8360a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 8370a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 8380a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NPTYPE_VID: 839adfbc90a9f63d1e0c87b4b17689c07cd3c781a0eChia-chi Yeh vid_numeric = handle_vendorid(iph1, pa->ptr); 8400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_FRAG 8410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if ((vid_numeric == VENDORID_FRAG) && 8420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang (vendorid_frag_cap(pa->ptr) & VENDORID_FRAG_BASE)) 8430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->frag = 1; 8440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 8450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 8460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang default: 8470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* don't send information, see ident_r1recv() */ 8480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, iph1->remote, 8490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "ignore the packet, " 8500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "received unexpecting payload type %d.\n", 8510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pa->type); 8520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 8530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 8540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 8550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 8560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->nonce_p == NULL || iph1->id_p == NULL) { 8570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, iph1->remote, 8580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "few isakmp message received.\n"); 8590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 8600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 8610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 8620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* verify identifier */ 8630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (ipsecdoi_checkid1(iph1) != 0) { 8640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, iph1->remote, 8650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "invalid ID payload.\n"); 8660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 8670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 8680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 8690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_NATT 8700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (NATT_AVAILABLE(iph1)) 8710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_INFO, LOCATION, iph1->remote, 8720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "Selected NAT-T version: %s\n", 8730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vid_string_by_id(iph1->natt_options->version)); 8740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 8750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 8760a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* check SA payload and set approval SA for use */ 8770a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (ipsecdoi_checkph1proposal(iph1->sa, iph1) < 0) { 8780a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, iph1->remote, 8790a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "failed to get valid proposal.\n"); 8800a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* XXX send information */ 8810a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 8820a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 8830a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 8840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->status = PHASE1ST_MSG1RECEIVED; 8850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 8860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang error = 0; 8870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 8880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangend: 8890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (pbuf) 8900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(pbuf); 8910a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 8920a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (error) { 8930a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang VPTRINIT(iph1->sa); 8940a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang VPTRINIT(iph1->nonce_p); 8950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang VPTRINIT(iph1->id_p); 8960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 8970a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 8980a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return error; 8990a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang} 9000a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 9010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* 9020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * send to initiator 9030a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * psk: HDR, SA, Idir, Nr_b 9040a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * sig: HDR, SA, Idir, Nr_b, [ CR ] 9050a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * rsa: HDR, SA, <IDir_b>PubKey_i, <Nr_b>PubKey_i 9060a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * rev: HDR, SA, <Nr_b>PubKey_i, <IDir_b>Ke_r 9070a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 9080a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangint 9090a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangbase_r1send(iph1, msg) 9100a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph1handle *iph1; 9110a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *msg; 9120a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang{ 9130a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct payload_list *plist = NULL; 9140a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int error = -1; 9150a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_NATT 9160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *vid_natt = NULL; 9170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 9180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_HYBRID 9190a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *vid_xauth = NULL; 9200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *vid_unity = NULL; 9210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 9220a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_FRAG 9230a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *vid_frag = NULL; 9240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 9250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_DPD 9260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *vid_dpd = NULL; 9270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 9280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 9290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* validity check */ 9300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->status != PHASE1ST_MSG1RECEIVED) { 9310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 9320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "status mismatched %d.\n", iph1->status); 9330a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 9340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 9350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 9360a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* set responder's cookie */ 9370a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang isakmp_newcookie((caddr_t)&iph1->index.r_ck, iph1->remote, iph1->local); 9380a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 9390a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* make ID payload into isakmp status */ 9400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (ipsecdoi_setid1(iph1) < 0) 9410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 9420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 9430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* generate NONCE value */ 9440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->nonce = eay_set_random(iph1->rmconf->nonce_size); 9450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->nonce == NULL) 9460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 9470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 9480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* set SA payload to reply */ 9490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plist = isakmp_plist_append(plist, iph1->sa_ret, ISAKMP_NPTYPE_SA); 9500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 9510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* create isakmp ID payload */ 9520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plist = isakmp_plist_append(plist, iph1->id, ISAKMP_NPTYPE_ID); 9530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 9540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* create isakmp NONCE payload */ 9550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plist = isakmp_plist_append(plist, iph1->nonce, ISAKMP_NPTYPE_NONCE); 9560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 9570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_NATT 9580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* has the peer announced nat-t? */ 9590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (NATT_AVAILABLE(iph1)) 9600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vid_natt = set_vendorid(iph1->natt_options->version); 9610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (vid_natt) 9620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plist = isakmp_plist_append(plist, vid_natt, ISAKMP_NPTYPE_VID); 9630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 9640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_HYBRID 9650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->mode_cfg->flags & ISAKMP_CFG_VENDORID_XAUTH) { 9660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog (LLV_INFO, LOCATION, NULL, "Adding xauth VID payload.\n"); 9670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if ((vid_xauth = set_vendorid(VENDORID_XAUTH)) == NULL) { 9680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 9690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "Cannot create Xauth vendor ID\n"); 9700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 9710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 9720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plist = isakmp_plist_append(plist, 9730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vid_xauth, ISAKMP_NPTYPE_VID); 9740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 9750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 9760a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->mode_cfg->flags & ISAKMP_CFG_VENDORID_UNITY) { 9770a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if ((vid_unity = set_vendorid(VENDORID_UNITY)) == NULL) { 9780a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 9790a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "Cannot create Unity vendor ID\n"); 9800a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 9810a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 9820a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plist = isakmp_plist_append(plist, 9830a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vid_unity, ISAKMP_NPTYPE_VID); 9840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 9850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 9860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_DPD 9870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* 9880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * Only send DPD support if remote announced DPD 9890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * and if DPD support is active 9900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 9910a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->dpd_support && iph1->rmconf->dpd) { 9920a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if ((vid_dpd = set_vendorid(VENDORID_DPD)) == NULL) { 9930a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 9940a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "DPD vendorID construction failed\n"); 9950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } else { 9960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plist = isakmp_plist_append(plist, vid_dpd, 9970a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang ISAKMP_NPTYPE_VID); 9980a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 9990a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 10000a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 10010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_FRAG 10020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->rmconf->ike_frag) { 10030a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if ((vid_frag = set_vendorid(VENDORID_FRAG)) == NULL) { 10040a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 10050a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "Frag vendorID construction failed\n"); 10060a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } else { 10070a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vid_frag = isakmp_frag_addcap(vid_frag, 10080a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang VENDORID_FRAG_BASE); 10090a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plist = isakmp_plist_append(plist, 10100a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vid_frag, ISAKMP_NPTYPE_VID); 10110a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 10120a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 10130a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 10140a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10150a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->sendbuf = isakmp_plist_set_all (&plist, iph1); 10160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef HAVE_PRINT_ISAKMP_C 10180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang isakmp_printpacket(iph1->sendbuf, iph1->local, iph1->remote, 0); 10190a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 10200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* send the packet, add to the schedule to resend */ 1022c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh iph1->retry_counter = iph1->rmconf->retry_counter; 1023c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if (isakmp_ph1resend(iph1) == -1) { 10240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1 = NULL; 10250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 10260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 10270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* the sending message is added to the received-list. */ 10290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (add_recvdpkt(iph1->remote, iph1->local, iph1->sendbuf, msg) == -1) { 10300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR , LOCATION, NULL, 10310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "failed to add a response packet to the tree.\n"); 10320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 10330a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 10340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->status = PHASE1ST_MSG1SENT; 10360a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10370a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang error = 0; 10380a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10390a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangend: 10400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_NATT 10410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (vid_natt) 10420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(vid_natt); 10430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 10440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_HYBRID 10450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (vid_xauth != NULL) 10460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(vid_xauth); 10470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (vid_unity != NULL) 10480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(vid_unity); 10490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 10500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_FRAG 10510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (vid_frag) 10520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(vid_frag); 10530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 10540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_DPD 10550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (vid_dpd) 10560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(vid_dpd); 10570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 10580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1 != NULL) 10600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang VPTRINIT(iph1->sa_ret); 10610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return error; 10630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang} 10640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* 10660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * receive from initiator 10670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * psk: HDR, KE, HASH_I 10680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * sig: HDR, KE, [ CR, ] [CERT,] SIG_I 10690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * rsa: HDR, KE, HASH_I 10700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * rev: HDR, <KE>Ke_i, HASH_I 10710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 10720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangint 10730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangbase_r2recv(iph1, msg) 10740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph1handle *iph1; 10750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *msg; 10760a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang{ 10770a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *pbuf = NULL; 10780a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct isakmp_parse_t *pa; 1079c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh int error = -1; 1080c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh int ptype; 10810a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_NATT 10820a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int natd_seq = 0; 10830a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 10840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* validity check */ 10860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->status != PHASE1ST_MSG1SENT) { 10870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 10880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "status mismatched %d.\n", iph1->status); 10890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 10900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 10910a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10920a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* validate the type of next payload */ 10930a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pbuf = isakmp_parse(msg); 10940a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (pbuf == NULL) 10950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 10960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10970a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->pl_hash = NULL; 10980a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10990a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang for (pa = (struct isakmp_parse_t *)pbuf->v; 11000a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pa->type != ISAKMP_NPTYPE_NONE; 11010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pa++) { 11020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 11030a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang switch (pa->type) { 11040a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NPTYPE_KE: 11050a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (isakmp_p2ph(&iph1->dhpub_p, pa->ptr) < 0) 11060a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 11070a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 11080a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NPTYPE_HASH: 11090a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->pl_hash = (struct isakmp_pl_hash *)pa->ptr; 11100a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 11110a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NPTYPE_CERT: 11120a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (oakley_savecert(iph1, pa->ptr) < 0) 11130a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 11140a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 11150a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NPTYPE_SIG: 11160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (isakmp_p2ph(&iph1->sig_p, pa->ptr) < 0) 11170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 11180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 11190a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NPTYPE_VID: 1120adfbc90a9f63d1e0c87b4b17689c07cd3c781a0eChia-chi Yeh handle_vendorid(iph1, pa->ptr); 11210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 11220a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 11230a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_NATT 11240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NPTYPE_NATD_DRAFT: 11250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NPTYPE_NATD_RFC: 11260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (pa->type == iph1->natt_options->payload_nat_d) 11270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang { 11280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *natd_received = NULL; 11290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int natd_verified; 11300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 11310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (isakmp_p2ph (&natd_received, pa->ptr) < 0) 11320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 11330a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 11340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (natd_seq == 0) 11350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->natt_flags |= NAT_DETECTED; 11360a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 11370a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang natd_verified = natt_compare_addr_hash (iph1, 11380a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang natd_received, natd_seq++); 11390a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 11400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog (LLV_INFO, LOCATION, NULL, "NAT-D payload #%d %s\n", 11410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang natd_seq - 1, 11420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang natd_verified ? "verified" : "doesn't match"); 11430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 11440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree (natd_received); 11450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 11460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 11470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* passthrough to default... */ 11480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 11490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 11500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang default: 11510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* don't send information, see ident_r1recv() */ 11520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, iph1->remote, 11530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "ignore the packet, " 11540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "received unexpecting payload type %d.\n", 11550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pa->type); 11560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 11570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 11580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 11590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 11600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* generate DH public value */ 11610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (oakley_dh_generate(iph1->approval->dhgrp, 11620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang &iph1->dhpub, &iph1->dhpriv) < 0) 11630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 11640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 11650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* compute sharing secret of DH */ 11660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (oakley_dh_compute(iph1->approval->dhgrp, iph1->dhpub, 11670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->dhpriv, iph1->dhpub_p, &iph1->dhgxy) < 0) 11680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 11690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 11700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* generate SKEYID */ 11710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (oakley_skeyid(iph1) < 0) 11720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 11730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 11740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_NATT 11750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (NATT_AVAILABLE(iph1)) 11760a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog (LLV_INFO, LOCATION, NULL, "NAT %s %s%s\n", 11770a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->natt_flags & NAT_DETECTED ? 11780a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "detected:" : "not detected", 11790a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->natt_flags & NAT_DETECTED_ME ? "ME " : "", 11800a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->natt_flags & NAT_DETECTED_PEER ? "PEER" : ""); 11810a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 11820a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 11830a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* payload existency check */ 11840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* validate authentication value */ 11850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang ptype = oakley_validate_auth(iph1); 11860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (ptype != 0) { 11870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (ptype == -1) { 11880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* message printed inner oakley_validate_auth() */ 11890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 11900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 1191c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh EVT_PUSH(iph1->local, iph1->remote, 1192c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh EVTT_PEERPH1AUTH_FAILED, NULL); 11930a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang isakmp_info_send_n1(iph1, ptype, NULL); 11940a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 11950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 11960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 11970a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->status = PHASE1ST_MSG2RECEIVED; 11980a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 11990a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang error = 0; 12000a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 12010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangend: 12020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (pbuf) 12030a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(pbuf); 12040a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 12050a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (error) { 12060a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang VPTRINIT(iph1->dhpub_p); 1207c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh oakley_delcert(iph1->cert_p); 1208c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh iph1->cert_p = NULL; 1209c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh oakley_delcert(iph1->crl_p); 1210c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh iph1->crl_p = NULL; 12110a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang VPTRINIT(iph1->sig_p); 12120a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 12130a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 12140a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return error; 12150a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang} 12160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 12170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* 12180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * send to initiator 12190a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * psk: HDR, KE, HASH_R 12200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * sig: HDR, KE, [CERT,] SIG_R 12210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * rsa: HDR, KE, HASH_R 12220a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * rev: HDR, <KE>_Ke_r, HASH_R 12230a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 12240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangint 12250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangbase_r2send(iph1, msg) 12260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph1handle *iph1; 12270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *msg; 12280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang{ 12290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct payload_list *plist = NULL; 12300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *vid = NULL; 12310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int need_cert = 0; 12320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int error = -1; 12330a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 12340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* validity check */ 12350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->status != PHASE1ST_MSG2RECEIVED) { 12360a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 12370a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "status mismatched %d.\n", iph1->status); 12380a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 12390a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 12400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 12410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* generate HASH to send */ 12420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_DEBUG, LOCATION, NULL, "generate HASH_I\n"); 1243c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh switch (AUTHMETHOD(iph1)) { 12440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_PSKEY: 12450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_HYBRID 12460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R: 12470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 12480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_RSAENC: 12490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_RSAREV: 12500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_HYBRID 12510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R: 12520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R: 12530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 12540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->hash = oakley_ph1hash_common(iph1, GENERATE); 12550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 12560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_DSSSIG: 12570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_RSASIG: 12580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_HYBRID 12590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R: 12600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R: 12610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R: 12620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R: 12630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 12640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef HAVE_GSSAPI 12650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB: 12660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 12670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->hash = oakley_ph1hash_base_r(iph1, GENERATE); 12680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 12690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang default: 12700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 12710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "invalid authentication method %d\n", 12720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->approval->authmethod); 12730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 12740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 12750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->hash == NULL) 12760a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 12770a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1278c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh switch (AUTHMETHOD(iph1)) { 12790a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_PSKEY: 12800a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_HYBRID 12810a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R: 12820a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 12830a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vid = set_vendorid(iph1->approval->vendorid); 12840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 12850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* create isakmp KE payload */ 12860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plist = isakmp_plist_append(plist, 12870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->dhpub, ISAKMP_NPTYPE_KE); 12880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 12890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* create isakmp HASH payload */ 12900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plist = isakmp_plist_append(plist, 12910a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->hash, ISAKMP_NPTYPE_HASH); 12920a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 12930a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* append vendor id, if needed */ 12940a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (vid) 12950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plist = isakmp_plist_append(plist, 12960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vid, ISAKMP_NPTYPE_VID); 12970a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 12980a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_DSSSIG: 12990a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_RSASIG: 13000a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_HYBRID 13010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R: 13020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R: 13030a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R: 13040a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R: 13050a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 13060a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* XXX if there is CR or not ? */ 13070a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13080a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (oakley_getmycert(iph1) < 0) 13090a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 13100a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13110a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (oakley_getsign(iph1) < 0) 13120a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 13130a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13140a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->cert && iph1->rmconf->send_cert) 13150a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang need_cert = 1; 13160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* create isakmp KE payload */ 1318c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh plist = isakmp_plist_append(plist, 1319c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh iph1->dhpub, ISAKMP_NPTYPE_KE); 13200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* add CERT payload if there */ 13220a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (need_cert) 1323c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh plist = isakmp_plist_append(plist, 1324c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh iph1->cert->pl, ISAKMP_NPTYPE_CERT); 13250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* add SIG payload */ 1326c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh plist = isakmp_plist_append(plist, 1327c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh iph1->sig, ISAKMP_NPTYPE_SIG); 13280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 13290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef HAVE_GSSAPI 13300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB: 13310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* ... */ 13320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 13330a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 13340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_RSAENC: 13350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_RSAREV: 13360a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_HYBRID 13370a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R: 13380a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R: 13390a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 13400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 13410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 13420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_NATT 13440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* generate NAT-D payloads */ 13450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (NATT_AVAILABLE(iph1)) { 13460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *natd[2] = { NULL, NULL }; 13470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_INFO, LOCATION, 13490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang NULL, "Adding remote and local NAT-D payloads.\n"); 13500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if ((natd[0] = natt_hash_addr(iph1, iph1->remote)) == NULL) { 13510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 13520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "NAT-D hashing failed for %s\n", 13530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang saddr2str(iph1->remote)); 13540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 13550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 13560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if ((natd[1] = natt_hash_addr(iph1, iph1->local)) == NULL) { 13580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 13590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "NAT-D hashing failed for %s\n", 13600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang saddr2str(iph1->local)); 13610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 13620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 13630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plist = isakmp_plist_append(plist, 13650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang natd[0], iph1->natt_options->payload_nat_d); 13660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plist = isakmp_plist_append(plist, 13670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang natd[1], iph1->natt_options->payload_nat_d); 13680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 13690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 13700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->sendbuf = isakmp_plist_set_all(&plist, iph1); 13720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef HAVE_PRINT_ISAKMP_C 13740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang isakmp_printpacket(iph1->sendbuf, iph1->local, iph1->remote, 0); 13750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 13760a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13770a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* send HDR;KE;NONCE to responder */ 13780a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (isakmp_send(iph1, iph1->sendbuf) < 0) 13790a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 13800a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13810a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* the sending message is added to the received-list. */ 13820a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (add_recvdpkt(iph1->remote, iph1->local, iph1->sendbuf, msg) == -1) { 13830a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR , LOCATION, NULL, 13840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "failed to add a response packet to the tree.\n"); 13850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 13860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 13870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* generate SKEYIDs & IV & final cipher key */ 13890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (oakley_skeyid_dae(iph1) < 0) 13900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 13910a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (oakley_compute_enckey(iph1) < 0) 13920a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 13930a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (oakley_newiv(iph1) < 0) 13940a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 13950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* set encryption flag */ 13970a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->flags |= ISAKMP_FLAG_E; 13980a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13990a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->status = PHASE1ST_ESTABLISHED; 14000a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 14010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang error = 0; 14020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 14030a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangend: 14040a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (vid) 14050a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(vid); 14060a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return error; 14070a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang} 1408