isakmp_inf.c revision c91307af2622f6625525f3c1f9c954376df950ad
1c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh/* $NetBSD: isakmp_inf.c,v 1.14.4.17 2009/05/18 17:07:46 tteras Exp $ */ 20a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 30a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* Id: isakmp_inf.c,v 1.44 2006/05/06 20:45:52 manubsd Exp */ 40a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 50a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* 60a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 70a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * All rights reserved. 80a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * 90a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * Redistribution and use in source and binary forms, with or without 100a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * modification, are permitted provided that the following conditions 110a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * are met: 120a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * 1. Redistributions of source code must retain the above copyright 130a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * notice, this list of conditions and the following disclaimer. 140a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * 2. Redistributions in binary form must reproduce the above copyright 150a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * notice, this list of conditions and the following disclaimer in the 160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * documentation and/or other materials provided with the distribution. 170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * 3. Neither the name of the project nor the names of its contributors 180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * may be used to endorse or promote products derived from this software 190a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * without specific prior written permission. 200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * 210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 220a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 230a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * SUCH DAMAGE. 320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 330a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "config.h" 350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 360a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include <sys/types.h> 370a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include <sys/param.h> 380a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include <sys/socket.h> 390a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include <net/pfkeyv2.h> 410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include <netinet/in.h> 420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include <sys/queue.h> 430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include PATH_IPSEC_H 440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include <stdlib.h> 460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include <stdio.h> 470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include <string.h> 480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include <errno.h> 490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#if TIME_WITH_SYS_TIME 500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang# include <sys/time.h> 510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang# include <time.h> 520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#else 530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang# if HAVE_SYS_TIME_H 540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang# include <sys/time.h> 550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang# else 560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang# include <time.h> 570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang# endif 580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_HYBRID 600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include <resolv.h> 610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "libpfkey.h" 640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "var.h" 660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "vmbuf.h" 670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "schedule.h" 680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "str2val.h" 690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "misc.h" 700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "plog.h" 710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "debug.h" 720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "localconf.h" 740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "remoteconf.h" 750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "sockmisc.h" 760a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "handler.h" 770a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "policy.h" 780a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "proposal.h" 790a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "isakmp_var.h" 800a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "evt.h" 810a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "isakmp.h" 820a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_HYBRID 830a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "isakmp_xauth.h" 840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "isakmp_unity.h" 850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "isakmp_cfg.h" 860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "isakmp_inf.h" 880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "oakley.h" 890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "ipsec_doi.h" 900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "crypto_openssl.h" 910a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "pfkey.h" 920a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "policy.h" 930a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "algorithm.h" 940a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "proposal.h" 950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "admin.h" 960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "strnames.h" 970a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_NATT 980a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "nattraversal.h" 990a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 1000a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* information exchange */ 1020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangstatic int isakmp_info_recv_n (struct ph1handle *, struct isakmp_pl_n *, u_int32_t, int); 1030a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangstatic int isakmp_info_recv_d (struct ph1handle *, struct isakmp_pl_d *, u_int32_t, int); 1040a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1050a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_DPD 1060a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangstatic int isakmp_info_recv_r_u __P((struct ph1handle *, 1070a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct isakmp_pl_ru *, u_int32_t)); 1080a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangstatic int isakmp_info_recv_r_u_ack __P((struct ph1handle *, 1090a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct isakmp_pl_ru *, u_int32_t)); 110c91307af2622f6625525f3c1f9c954376df950adChia-chi Yehstatic void isakmp_info_send_r_u __P((void *)); 1110a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 1120a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1130a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangstatic void purge_isakmp_spi __P((int, isakmp_index *, size_t)); 114c91307af2622f6625525f3c1f9c954376df950adChia-chi Yehstatic void info_recv_initialcontact __P((struct ph1handle *)); 1150a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* %%% 1170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * Information Exchange 1180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 1190a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* 1200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * receive Information 1210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 1220a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangint 1230a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangisakmp_info_recv(iph1, msg0) 1240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph1handle *iph1; 1250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *msg0; 1260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang{ 1270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *msg = NULL; 1280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *pbuf = NULL; 1290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang u_int32_t msgid = 0; 1300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int error = -1; 1310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct isakmp *isakmp; 1320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct isakmp_gen *gen; 1330a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct isakmp_parse_t *pa, *pap; 1340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang void *p; 1350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *hash, *payload; 1360a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct isakmp_gen *nd; 1370a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang u_int8_t np; 1380a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int encrypted; 1390a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_DEBUG, LOCATION, NULL, "receive Information.\n"); 1410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang encrypted = ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E); 1430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang msgid = ((struct isakmp *)msg0->v)->msgid; 1440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* Use new IV to decrypt Informational message. */ 1460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (encrypted) { 1470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct isakmp_ivm *ivm; 1480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->ivm == NULL) { 1500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, "iph1->ivm == NULL\n"); 1510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return -1; 1520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 1530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* compute IV */ 1550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang ivm = oakley_newiv2(iph1, ((struct isakmp *)msg0->v)->msgid); 1560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (ivm == NULL) 1570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return -1; 1580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang msg = oakley_do_decrypt(iph1, msg0, ivm->iv, ivm->ive); 1600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang oakley_delivm(ivm); 1610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (msg == NULL) 1620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return -1; 1630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } else 1650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang msg = vdup(msg0); 1660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* Safety check */ 1680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (msg->l < sizeof(*isakmp) + sizeof(*gen)) { 1690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 1700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "ignore information because the " 171c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh "message is way too short - %zu byte(s).\n", msg->l); 1720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 1730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 1740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang isakmp = (struct isakmp *)msg->v; 1760a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang gen = (struct isakmp_gen *)((caddr_t)isakmp + sizeof(struct isakmp)); 1770a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang np = gen->np; 1780a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1790a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (encrypted) { 1800a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (isakmp->np != ISAKMP_NPTYPE_HASH) { 1810a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 182c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh "ignore information because the" 1830a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "message has no hash payload.\n"); 1840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 1850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 1860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 187c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if (iph1->status != PHASE1ST_ESTABLISHED) { 1880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 189c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh "ignore information because ISAKMP-SA" 1900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "has not been established yet.\n"); 1910a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 1920a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 1930a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1940a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* Safety check */ 1950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (msg->l < sizeof(*isakmp) + ntohs(gen->len) + sizeof(*nd)) { 1960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 1970a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "ignore information because the " 198c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh "message is too short - %zu byte(s).\n", msg->l); 1990a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 2000a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 2010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 2020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang p = (caddr_t) gen + sizeof(struct isakmp_gen); 2030a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang nd = (struct isakmp_gen *) ((caddr_t) gen + ntohs(gen->len)); 2040a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 2050a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* nd length check */ 2060a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (ntohs(nd->len) > msg->l - (sizeof(struct isakmp) + 2070a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang ntohs(gen->len))) { 2080a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 2090a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "too long payload length (broken message?)\n"); 2100a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 2110a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 2120a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 2130a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (ntohs(nd->len) < sizeof(*nd)) { 2140a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 2150a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "too short payload length (broken message?)\n"); 2160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 2170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 2180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 2190a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang payload = vmalloc(ntohs(nd->len)); 2200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (payload == NULL) { 2210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 2220a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "cannot allocate memory\n"); 2230a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 2240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 2250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 2260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang memcpy(payload->v, (caddr_t) nd, ntohs(nd->len)); 2270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 2280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* compute HASH */ 2290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang hash = oakley_compute_hash1(iph1, isakmp->msgid, payload); 2300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (hash == NULL) { 2310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 2320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "cannot compute hash\n"); 2330a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 2340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(payload); 2350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 2360a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 2370a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 2380a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (ntohs(gen->len) - sizeof(struct isakmp_gen) != hash->l) { 2390a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 2400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "ignore information due to hash length mismatch\n"); 2410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 2420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(hash); 2430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(payload); 2440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 2450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 2460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 2470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (memcmp(p, hash->v, hash->l) != 0) { 2480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 2490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "ignore information due to hash mismatch\n"); 2500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 2510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(hash); 2520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(payload); 2530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 2540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 2550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 2560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_DEBUG, LOCATION, NULL, "hash validated.\n"); 2570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 2580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(hash); 2590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(payload); 2600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } else { 2610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* make sure the packet was encrypted after the beginning of phase 1. */ 2620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang switch (iph1->etype) { 2630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_ETYPE_AGG: 2640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_ETYPE_BASE: 2650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_ETYPE_IDENT: 2660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if ((iph1->side == INITIATOR && iph1->status < PHASE1ST_MSG3SENT) 2670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang || (iph1->side == RESPONDER && iph1->status < PHASE1ST_MSG2SENT)) { 2680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 2690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 2700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /*FALLTHRU*/ 2710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang default: 2720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, iph1->remote, 2730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "%s message must be encrypted\n", 2740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang s_isakmp_nptype(np)); 2750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang error = 0; 2760a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 2770a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 2780a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 2790a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 2800a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (!(pbuf = isakmp_parse(msg))) { 2810a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang error = -1; 2820a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 2830a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 2840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 2850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang error = 0; 2860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang for (pa = (struct isakmp_parse_t *)pbuf->v; pa->type; pa++) { 2870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang switch (pa->type) { 2880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NPTYPE_HASH: 2890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* Handled above */ 2900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 2910a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NPTYPE_N: 2920a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang error = isakmp_info_recv_n(iph1, 2930a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang (struct isakmp_pl_n *)pa->ptr, 2940a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang msgid, encrypted); 2950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 2960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NPTYPE_D: 2970a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang error = isakmp_info_recv_d(iph1, 2980a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang (struct isakmp_pl_d *)pa->ptr, 2990a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang msgid, encrypted); 3000a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 3010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NPTYPE_NONCE: 3020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* XXX to be 6.4.2 ike-01.txt */ 3030a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* XXX IV is to be synchronized. */ 3040a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, iph1->remote, 3050a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "ignore Acknowledged Informational\n"); 3060a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 3070a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang default: 3080a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* don't send information, see isakmp_ident_r1() */ 3090a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang error = 0; 3100a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, iph1->remote, 3110a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "reject the packet, " 3120a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "received unexpected payload type %s.\n", 3130a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang s_isakmp_nptype(gen->np)); 3140a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 315051f86dfca525c160855397f7b6a4fb5ef8df2b5Chia-chi Yeh if (error < 0) 3160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 3170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 3180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang end: 3190a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (msg != NULL) 3200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(msg); 3210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (pbuf != NULL) 3220a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(pbuf); 3230a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return error; 3240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang} 3250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 3260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* 3270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * handling of Notification payload 3280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 3290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangstatic int 3300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangisakmp_info_recv_n(iph1, notify, msgid, encrypted) 3310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph1handle *iph1; 3320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct isakmp_pl_n *notify; 3330a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang u_int32_t msgid; 3340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int encrypted; 3350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang{ 3360a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang u_int type; 337c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh vchar_t *pbuf; 338c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh char *nraw, *ndata; 339c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh size_t l; 340c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh char *spi; 3410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 3420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang type = ntohs(notify->type); 343c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh 3440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang switch (type) { 3450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NTYPE_CONNECTED: 3460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NTYPE_RESPONDER_LIFETIME: 3470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NTYPE_REPLAY_STATUS: 3480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_HYBRID 3490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NTYPE_UNITY_HEARTBEAT: 3500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 3510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* do something */ 3520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 3530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NTYPE_INITIAL_CONTACT: 3540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (encrypted) 355c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh info_recv_initialcontact(iph1); 356c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh return 0; 3570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 3580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_DPD 3590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NTYPE_R_U_THERE: 3600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (encrypted) 3610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return isakmp_info_recv_r_u(iph1, 3620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang (struct isakmp_pl_ru *)notify, msgid); 3630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 3640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case ISAKMP_NTYPE_R_U_THERE_ACK: 3650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (encrypted) 3660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return isakmp_info_recv_r_u_ack(iph1, 3670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang (struct isakmp_pl_ru *)notify, msgid); 3680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 3690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 370c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh default: 371c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh { 372c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh /* XXX there is a potential of dos attack. */ 373c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if(type >= ISAKMP_NTYPE_MINERROR && 374c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh type <= ISAKMP_NTYPE_MAXERROR) { 375c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if (msgid == 0) { 376c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh /* don't think this realy deletes ph1 ? */ 377c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh plog(LLV_ERROR, LOCATION, iph1->remote, 378c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh "delete phase1 handle.\n"); 379c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh return -1; 380c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh } else { 381c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if (getph2bymsgid(iph1, msgid) == NULL) { 382c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh plog(LLV_ERROR, LOCATION, iph1->remote, 383c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh "fatal %s notify messsage, " 384c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh "phase1 should be deleted.\n", 385c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh s_isakmp_notify_msg(type)); 386c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh } else { 387c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh plog(LLV_ERROR, LOCATION, iph1->remote, 388c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh "fatal %s notify messsage, " 389c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh "phase2 should be deleted.\n", 390c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh s_isakmp_notify_msg(type)); 391c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh } 392c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh } 393c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh } else { 394c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh plog(LLV_ERROR, LOCATION, iph1->remote, 395c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh "unhandled notify message %s, " 396c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh "no phase2 handle found.\n", 397c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh s_isakmp_notify_msg(type)); 398c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh } 399c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh } 400c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh break; 4010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 4020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 403c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh /* get spi if specified and allocate */ 404c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if(notify->spi_size > 0) { 405c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if (ntohs(notify->h.len) < sizeof(*notify) + notify->spi_size) { 406c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh plog(LLV_ERROR, LOCATION, iph1->remote, 407c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh "invalid spi_size in notification payload.\n"); 408c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh return -1; 409c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh } 410c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh spi = val2str((char *)(notify + 1), notify->spi_size); 411c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh 412c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh plog(LLV_DEBUG, LOCATION, iph1->remote, 413c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh "notification message %d:%s, " 414c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh "doi=%d proto_id=%d spi=%s(size=%d).\n", 415c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh type, s_isakmp_notify_msg(type), 416c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh ntohl(notify->doi), notify->proto_id, spi, notify->spi_size); 417c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh 418c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh racoon_free(spi); 419c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh } 4200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 421c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh /* Send the message data to the logs */ 422c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if(type >= ISAKMP_NTYPE_MINERROR && 423c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh type <= ISAKMP_NTYPE_MAXERROR) { 424c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh l = ntohs(notify->h.len) - sizeof(*notify) - notify->spi_size; 425c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if (l > 0) { 426c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh nraw = (char*)notify; 427c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh nraw += sizeof(*notify) + notify->spi_size; 428c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh ndata = binsanitize(nraw, l); 429c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if (ndata != NULL) { 430c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh plog(LLV_ERROR, LOCATION, iph1->remote, 431c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh "Message: '%s'.\n", 432c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh ndata); 433c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh racoon_free(ndata); 434c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh } else { 435c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh plog(LLV_ERROR, LOCATION, iph1->remote, 436c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh "Cannot allocate memory\n"); 437c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh } 438c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh } 439c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh } 4400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return 0; 4410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang} 4420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 4430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* 4440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * handling of Deletion payload 4450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 4460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangstatic int 4470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangisakmp_info_recv_d(iph1, delete, msgid, encrypted) 4480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph1handle *iph1; 4490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct isakmp_pl_d *delete; 4500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang u_int32_t msgid; 4510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int encrypted; 4520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang{ 4530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int tlen, num_spi; 4540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *pbuf; 4550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int protected = 0; 4560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph1handle *del_ph1; 4570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph2handle *iph2; 4580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang union { 4590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang u_int32_t spi32; 4600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang u_int16_t spi16[2]; 4610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } spi; 4620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 4630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (ntohl(delete->doi) != IPSEC_DOI) { 4640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, iph1->remote, 4650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "delete payload with invalid doi:%d.\n", 4660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang ntohl(delete->doi)); 4670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_HYBRID 4680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* 4690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * At deconnexion time, Cisco VPN client does this 4700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * with a zero DOI. Don't give up in that situation. 4710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 4720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (((iph1->mode_cfg->flags & 4730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang ISAKMP_CFG_VENDORID_UNITY) == 0) || (delete->doi != 0)) 4740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return 0; 4750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#else 4760a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return 0; 4770a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 4780a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 4790a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 4800a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang num_spi = ntohs(delete->num_spi); 4810a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang tlen = ntohs(delete->h.len) - sizeof(struct isakmp_pl_d); 4820a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 4830a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (tlen != num_spi * delete->spi_size) { 4840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, iph1->remote, 4850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "deletion payload with invalid length.\n"); 4860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return 0; 4870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 4880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 4890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_DEBUG, LOCATION, iph1->remote, 4900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "delete payload for protocol %s\n", 4910a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang s_ipsecdoi_proto(delete->proto_id)); 4920a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 4930a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if(!iph1->rmconf->weak_phase1_check && !encrypted) { 4940a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_WARNING, LOCATION, iph1->remote, 4950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "Ignoring unencrypted delete payload " 4960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "(check the weak_phase1_check option)\n"); 4970a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return 0; 4980a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 4990a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 5000a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang switch (delete->proto_id) { 5010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case IPSECDOI_PROTO_ISAKMP: 5020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (delete->spi_size != sizeof(isakmp_index)) { 5030a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, iph1->remote, 5040a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "delete payload with strange spi " 5050a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "size %d(proto_id:%d)\n", 5060a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang delete->spi_size, delete->proto_id); 5070a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return 0; 5080a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 5090a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 5100a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang del_ph1=getph1byindex((isakmp_index *)(delete + 1)); 5110a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if(del_ph1 != NULL){ 5120a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 513c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh EVT_PUSH(del_ph1->local, del_ph1->remote, 514c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh EVTT_PEERPH1_NOPROP, NULL); 515c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if (del_ph1->scr) 516c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh SCHED_KILL(del_ph1->scr); 5170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 5180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* 519c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh * Do not delete IPsec SAs when receiving an IKE delete notification. 520c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh * Just delete the IKE SA. 5210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 522c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh isakmp_ph1expire(del_ph1); 5230a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 5240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 5250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 5260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case IPSECDOI_PROTO_IPSEC_AH: 5270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case IPSECDOI_PROTO_IPSEC_ESP: 5280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (delete->spi_size != sizeof(u_int32_t)) { 5290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, iph1->remote, 5300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "delete payload with strange spi " 5310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "size %d(proto_id:%d)\n", 5320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang delete->spi_size, delete->proto_id); 5330a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return 0; 5340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 535c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh EVT_PUSH(iph1->local, iph1->remote, 536c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh EVTT_PEER_DELETE, NULL); 5370a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang purge_ipsec_spi(iph1->remote, delete->proto_id, 5380a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang (u_int32_t *)(delete + 1), num_spi); 5390a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 5400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 5410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang case IPSECDOI_PROTO_IPCOMP: 5420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* need to handle both 16bit/32bit SPI */ 5430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang memset(&spi, 0, sizeof(spi)); 5440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (delete->spi_size == sizeof(spi.spi16[1])) { 5450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang memcpy(&spi.spi16[1], delete + 1, 5460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang sizeof(spi.spi16[1])); 5470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } else if (delete->spi_size == sizeof(spi.spi32)) 5480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang memcpy(&spi.spi32, delete + 1, sizeof(spi.spi32)); 5490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang else { 5500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, iph1->remote, 5510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "delete payload with strange spi " 5520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "size %d(proto_id:%d)\n", 5530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang delete->spi_size, delete->proto_id); 5540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return 0; 5550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 5560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang purge_ipsec_spi(iph1->remote, delete->proto_id, 5570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang &spi.spi32, num_spi); 5580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 5590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 5600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang default: 5610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, iph1->remote, 5620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "deletion message received, " 5630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "invalid proto_id: %d\n", 5640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang delete->proto_id); 5650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return 0; 5660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 5670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 5680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_DEBUG, LOCATION, NULL, "purged SAs.\n"); 5690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 5700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return 0; 5710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang} 5720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 5730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* 5740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * send Delete payload (for ISAKMP SA) in Informational exchange. 5750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 5760a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangint 5770a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangisakmp_info_send_d1(iph1) 5780a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph1handle *iph1; 5790a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang{ 5800a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct isakmp_pl_d *d; 5810a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *payload = NULL; 5820a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int tlen; 5830a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int error = 0; 5840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 5850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->status != PHASE2ST_ESTABLISHED) 5860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return 0; 5870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 5880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* create delete payload */ 5890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 5900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* send SPIs of inbound SAs. */ 5910a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* XXX should send outbound SAs's ? */ 5920a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang tlen = sizeof(*d) + sizeof(isakmp_index); 5930a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang payload = vmalloc(tlen); 5940a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (payload == NULL) { 5950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 5960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "failed to get buffer for payload.\n"); 5970a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return errno; 5980a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 5990a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 6000a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang d = (struct isakmp_pl_d *)payload->v; 6010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang d->h.np = ISAKMP_NPTYPE_NONE; 6020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang d->h.len = htons(tlen); 6030a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang d->doi = htonl(IPSEC_DOI); 6040a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang d->proto_id = IPSECDOI_PROTO_ISAKMP; 6050a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang d->spi_size = sizeof(isakmp_index); 6060a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang d->num_spi = htons(1); 6070a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang memcpy(d + 1, &iph1->index, sizeof(isakmp_index)); 6080a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 6090a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang error = isakmp_info_send_common(iph1, payload, 6100a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang ISAKMP_NPTYPE_D, 0); 6110a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(payload); 6120a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 6130a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return error; 6140a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang} 6150a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 6160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* 6170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * send Delete payload (for IPsec SA) in Informational exchange, based on 6180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * pfkey msg. It sends always single SPI. 6190a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 6200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangint 6210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangisakmp_info_send_d2(iph2) 6220a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph2handle *iph2; 6230a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang{ 6240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph1handle *iph1; 6250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct saproto *pr; 6260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct isakmp_pl_d *d; 6270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *payload = NULL; 6280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int tlen; 6290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int error = 0; 6300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang u_int8_t *spi; 6310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 6320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph2->status != PHASE2ST_ESTABLISHED) 6330a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return 0; 6340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 6350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* 6360a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * don't send delete information if there is no phase 1 handler. 6370a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * It's nonsensical to negotiate phase 1 to send the information. 6380a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 639c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh iph1 = getph1byaddr(iph2->src, iph2->dst, 0); 6400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1 == NULL){ 6410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_DEBUG2, LOCATION, NULL, 6420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "No ph1 handler found, could not send DELETE_SA\n"); 6430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return 0; 6440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 6450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 6460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* create delete payload */ 6470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang for (pr = iph2->approval->head; pr != NULL; pr = pr->next) { 6480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 6490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* send SPIs of inbound SAs. */ 6500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* 6510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * XXX should I send outbound SAs's ? 6520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * I send inbound SAs's SPI only at the moment because I can't 6530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * decode any more if peer send encoded packet without aware of 6540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * deletion of SA. Outbound SAs don't come under the situation. 6550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 6560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang tlen = sizeof(*d) + pr->spisize; 6570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang payload = vmalloc(tlen); 6580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (payload == NULL) { 6590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 6600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "failed to get buffer for payload.\n"); 6610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return errno; 6620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 6630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 6640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang d = (struct isakmp_pl_d *)payload->v; 6650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang d->h.np = ISAKMP_NPTYPE_NONE; 6660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang d->h.len = htons(tlen); 6670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang d->doi = htonl(IPSEC_DOI); 6680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang d->proto_id = pr->proto_id; 6690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang d->spi_size = pr->spisize; 6700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang d->num_spi = htons(1); 6710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* 6720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * XXX SPI bits are left-filled, for use with IPComp. 6730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * we should be switching to variable-length spi field... 6740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 6750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang spi = (u_int8_t *)&pr->spi; 6760a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang spi += sizeof(pr->spi); 6770a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang spi -= pr->spisize; 6780a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang memcpy(d + 1, spi, pr->spisize); 6790a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 6800a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang error = isakmp_info_send_common(iph1, payload, 6810a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang ISAKMP_NPTYPE_D, 0); 6820a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(payload); 6830a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 6840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 6850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return error; 6860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang} 6870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 6880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* 6890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * send Notification payload (for without ISAKMP SA) in Informational exchange 6900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 6910a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangint 6920a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangisakmp_info_send_nx(isakmp, remote, local, type, data) 6930a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct isakmp *isakmp; 6940a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct sockaddr *remote, *local; 6950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int type; 6960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *data; 6970a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang{ 6980a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph1handle *iph1 = NULL; 699c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh struct remoteconf *rmconf; 7000a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *payload = NULL; 7010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int tlen; 7020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int error = -1; 7030a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct isakmp_pl_n *n; 7040a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int spisiz = 0; /* see below */ 7050a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 706c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh /* search appropreate configuration */ 707c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh rmconf = getrmconf(remote); 708c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if (rmconf == NULL) { 709c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh plog(LLV_ERROR, LOCATION, remote, 710c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh "no configuration found for peer address.\n"); 711c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh goto end; 712c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh } 713c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh 7140a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* add new entry to isakmp status table. */ 7150a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1 = newph1(); 7160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1 == NULL) 7170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return -1; 7180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 7190a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang memcpy(&iph1->index.i_ck, &isakmp->i_ck, sizeof(cookie_t)); 7200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang isakmp_newcookie((char *)&iph1->index.r_ck, remote, local); 7210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->status = PHASE1ST_START; 722c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh iph1->rmconf = rmconf; 7230a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->side = INITIATOR; 7240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->version = isakmp->v; 7250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->flags = 0; 7260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->msgid = 0; /* XXX */ 7270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_HYBRID 7280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if ((iph1->mode_cfg = isakmp_cfg_mkstate()) == NULL) 7290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 7300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 7310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_FRAG 7320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->frag = 0; 7330a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->frag_chain = NULL; 7340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 7350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 7360a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* copy remote address */ 737c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if (copy_ph1addresses(iph1, rmconf, remote, local) < 0) 7380a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 7390a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 7400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang tlen = sizeof(*n) + spisiz; 7410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (data) 7420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang tlen += data->l; 7430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang payload = vmalloc(tlen); 7440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (payload == NULL) { 7450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 7460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "failed to get buffer to send.\n"); 7470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 7480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 7490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 7500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang n = (struct isakmp_pl_n *)payload->v; 7510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang n->h.np = ISAKMP_NPTYPE_NONE; 7520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang n->h.len = htons(tlen); 7530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang n->doi = htonl(IPSEC_DOI); 7540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang n->proto_id = IPSECDOI_KEY_IKE; 7550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang n->spi_size = spisiz; 7560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang n->type = htons(type); 7570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (spisiz) 7580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang memset(n + 1, 0, spisiz); /* XXX spisiz is always 0 */ 7590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (data) 7600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang memcpy((caddr_t)(n + 1) + spisiz, data->v, data->l); 7610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 7620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 0); 7630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(payload); 7640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 7650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang end: 7660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1 != NULL) 7670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang delph1(iph1); 7680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 7690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return error; 7700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang} 7710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 7720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* 7730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * send Notification payload (for ISAKMP SA) in Informational exchange 7740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 7750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangint 7760a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangisakmp_info_send_n1(iph1, type, data) 7770a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph1handle *iph1; 7780a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int type; 7790a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *data; 7800a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang{ 7810a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *payload = NULL; 7820a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int tlen; 7830a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int error = 0; 7840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct isakmp_pl_n *n; 7850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int spisiz; 7860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 7870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* 7880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * note on SPI size: which description is correct? I have chosen 7890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * this to be 0. 7900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * 7910a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * RFC2408 3.1, 2nd paragraph says: ISAKMP SA is identified by 7920a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * Initiator/Responder cookie and SPI has no meaning, SPI size = 0. 7930a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * RFC2408 3.1, first paragraph on page 40: ISAKMP SA is identified 7940a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * by cookie and SPI has no meaning, 0 <= SPI size <= 16. 7950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * RFC2407 4.6.3.3, INITIAL-CONTACT is required to set to 16. 7960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 7970a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (type == ISAKMP_NTYPE_INITIAL_CONTACT) 7980a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang spisiz = sizeof(isakmp_index); 7990a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang else 8000a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang spisiz = 0; 8010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 8020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang tlen = sizeof(*n) + spisiz; 8030a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (data) 8040a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang tlen += data->l; 8050a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang payload = vmalloc(tlen); 8060a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (payload == NULL) { 8070a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 8080a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "failed to get buffer to send.\n"); 8090a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return errno; 8100a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 8110a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 8120a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang n = (struct isakmp_pl_n *)payload->v; 8130a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang n->h.np = ISAKMP_NPTYPE_NONE; 8140a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang n->h.len = htons(tlen); 8150a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang n->doi = htonl(iph1->rmconf->doitype); 8160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang n->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX to be configurable ? */ 8170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang n->spi_size = spisiz; 8180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang n->type = htons(type); 8190a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (spisiz) 8200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang memcpy(n + 1, &iph1->index, sizeof(isakmp_index)); 8210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (data) 8220a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang memcpy((caddr_t)(n + 1) + spisiz, data->v, data->l); 8230a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 8240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, iph1->flags); 8250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(payload); 8260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 8270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return error; 8280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang} 8290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 8300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* 8310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * send Notification payload (for IPsec SA) in Informational exchange 8320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 8330a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangint 8340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangisakmp_info_send_n2(iph2, type, data) 8350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph2handle *iph2; 8360a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int type; 8370a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *data; 8380a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang{ 8390a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph1handle *iph1 = iph2->ph1; 8400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *payload = NULL; 8410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int tlen; 8420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int error = 0; 8430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct isakmp_pl_n *n; 8440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct saproto *pr; 8450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 8460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (!iph2->approval) 8470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return EINVAL; 8480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 8490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pr = iph2->approval->head; 8500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 8510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* XXX must be get proper spi */ 8520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang tlen = sizeof(*n) + pr->spisize; 8530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (data) 8540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang tlen += data->l; 8550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang payload = vmalloc(tlen); 8560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (payload == NULL) { 8570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 8580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "failed to get buffer to send.\n"); 8590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return errno; 8600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 8610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 8620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang n = (struct isakmp_pl_n *)payload->v; 8630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang n->h.np = ISAKMP_NPTYPE_NONE; 8640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang n->h.len = htons(tlen); 8650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang n->doi = htonl(IPSEC_DOI); /* IPSEC DOI (1) */ 8660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang n->proto_id = pr->proto_id; /* IPSEC AH/ESP/whatever*/ 8670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang n->spi_size = pr->spisize; 8680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang n->type = htons(type); 8690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang *(u_int32_t *)(n + 1) = pr->spi; 8700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (data) 8710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang memcpy((caddr_t)(n + 1) + pr->spisize, data->v, data->l); 8720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 8730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph2->flags |= ISAKMP_FLAG_E; /* XXX Should we do FLAG_A ? */ 8740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, iph2->flags); 8750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(payload); 8760a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 8770a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return error; 8780a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang} 8790a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 8800a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* 8810a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * send Information 8820a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * When ph1->skeyid_a == NULL, send message without encoding. 8830a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 8840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangint 8850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangisakmp_info_send_common(iph1, payload, np, flags) 8860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph1handle *iph1; 8870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *payload; 8880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang u_int32_t np; 8890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int flags; 8900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang{ 8910a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph2handle *iph2 = NULL; 8920a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *hash = NULL; 8930a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct isakmp *isakmp; 8940a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct isakmp_gen *gen; 8950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang char *p; 8960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int tlen; 8970a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int error = -1; 8980a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 8990a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* add new entry to isakmp status table */ 9000a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph2 = newph2(); 9010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph2 == NULL) 9020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 9030a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 9040a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph2->dst = dupsaddr(iph1->remote); 9050a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph2->dst == NULL) { 9060a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang delph2(iph2); 9070a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 9080a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 9090a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph2->src = dupsaddr(iph1->local); 9100a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph2->src == NULL) { 9110a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang delph2(iph2); 9120a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 9130a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 914c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh#if (!defined(ENABLE_NATT)) || (defined(BROKEN_NATT)) 915c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if (set_port(iph2->dst, 0) == NULL || 916c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh set_port(iph2->src, 0) == NULL) { 917c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh plog(LLV_ERROR, LOCATION, NULL, 918c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh "invalid family: %d\n", iph1->remote->sa_family); 919c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh delph2(iph2); 920c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh goto end; 921c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh } 922c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh#endif 923c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh iph2->ph1 = iph1; 9240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph2->side = INITIATOR; 9250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph2->status = PHASE2ST_START; 9260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph2->msgid = isakmp_newmsgid2(iph1); 9270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 9280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* get IV and HASH(1) if skeyid_a was generated. */ 9290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->skeyid_a != NULL) { 9300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph2->ivm = oakley_newiv2(iph1, iph2->msgid); 9310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph2->ivm == NULL) { 9320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang delph2(iph2); 9330a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 9340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 9350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 9360a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* generate HASH(1) */ 937c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, payload); 9380a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (hash == NULL) { 9390a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang delph2(iph2); 9400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 9410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 9420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 9430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* initialized total buffer length */ 9440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang tlen = hash->l; 9450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang tlen += sizeof(*gen); 9460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } else { 9470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* IKE-SA is not established */ 9480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang hash = NULL; 9490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 9500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* initialized total buffer length */ 9510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang tlen = 0; 9520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 9530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if ((flags & ISAKMP_FLAG_A) == 0) 9540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph2->flags = (hash == NULL ? 0 : ISAKMP_FLAG_E); 9550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang else 9560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph2->flags = (hash == NULL ? 0 : ISAKMP_FLAG_A); 9570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 9580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang insph2(iph2); 9590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang bindph12(iph1, iph2); 9600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 9610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang tlen += sizeof(*isakmp) + payload->l; 9620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 9630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* create buffer for isakmp payload */ 9640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph2->sendbuf = vmalloc(tlen); 9650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph2->sendbuf == NULL) { 9660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 9670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "failed to get buffer to send.\n"); 9680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto err; 9690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 9700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 9710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* create isakmp header */ 9720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang isakmp = (struct isakmp *)iph2->sendbuf->v; 9730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang memcpy(&isakmp->i_ck, &iph1->index.i_ck, sizeof(cookie_t)); 9740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang memcpy(&isakmp->r_ck, &iph1->index.r_ck, sizeof(cookie_t)); 9750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang isakmp->np = hash == NULL ? (np & 0xff) : ISAKMP_NPTYPE_HASH; 9760a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang isakmp->v = iph1->version; 9770a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang isakmp->etype = ISAKMP_ETYPE_INFO; 9780a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang isakmp->flags = iph2->flags; 9790a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang memcpy(&isakmp->msgid, &iph2->msgid, sizeof(isakmp->msgid)); 9800a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang isakmp->len = htonl(tlen); 9810a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang p = (char *)(isakmp + 1); 9820a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 9830a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* create HASH payload */ 9840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (hash != NULL) { 9850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang gen = (struct isakmp_gen *)p; 9860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang gen->np = np & 0xff; 9870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang gen->len = htons(sizeof(*gen) + hash->l); 9880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang p += sizeof(*gen); 9890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang memcpy(p, hash->v, hash->l); 9900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang p += hash->l; 9910a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 9920a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 9930a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* add payload */ 9940a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang memcpy(p, payload->v, payload->l); 9950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang p += payload->l; 9960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 9970a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef HAVE_PRINT_ISAKMP_C 9980a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang isakmp_printpacket(iph2->sendbuf, iph1->local, iph1->remote, 1); 9990a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 10000a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* encoding */ 10020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (ISSET(isakmp->flags, ISAKMP_FLAG_E)) { 10030a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *tmp; 10040a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10050a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang tmp = oakley_do_encrypt(iph2->ph1, iph2->sendbuf, iph2->ivm->ive, 10060a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph2->ivm->iv); 10070a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang VPTRINIT(iph2->sendbuf); 10080a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (tmp == NULL) 10090a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto err; 10100a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph2->sendbuf = tmp; 10110a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 10120a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10130a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* HDR*, HASH(1), N */ 10140a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (isakmp_send(iph2->ph1, iph2->sendbuf) < 0) { 10150a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang VPTRINIT(iph2->sendbuf); 10160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto err; 10170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 10180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10190a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_DEBUG, LOCATION, NULL, 10200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "sendto Information %s.\n", s_isakmp_nptype(np)); 10210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10220a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* 10230a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * don't resend notify message because peer can use Acknowledged 10240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * Informational if peer requires the reply of the notify message. 10250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 10260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* XXX If Acknowledged Informational required, don't delete ph2handle */ 10280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang error = 0; 10290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang VPTRINIT(iph2->sendbuf); 10300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto err; /* XXX */ 10310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangend: 10330a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (hash) 10340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(hash); 10350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return error; 10360a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10370a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangerr: 1038c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh unbindph12(iph2); 10390a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang remph2(iph2); 10400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang delph2(iph2); 10410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto end; 10420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang} 10430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* 10450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * add a notify payload to buffer by reallocating buffer. 10460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * If buf == NULL, the function only create a notify payload. 10470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * 10480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * XXX Which is SPI to be included, inbound or outbound ? 10490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 10500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangvchar_t * 10510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangisakmp_add_pl_n(buf0, np_p, type, pr, data) 10520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *buf0; 10530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang u_int8_t **np_p; 10540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int type; 10550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct saproto *pr; 10560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *data; 10570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang{ 10580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *buf = NULL; 10590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct isakmp_pl_n *n; 10600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int tlen; 10610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int oldlen = 0; 10620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (*np_p) 10640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang **np_p = ISAKMP_NPTYPE_N; 10650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang tlen = sizeof(*n) + pr->spisize; 10670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (data) 10690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang tlen += data->l; 10700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (buf0) { 10710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang oldlen = buf0->l; 10720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang buf = vrealloc(buf0, buf0->l + tlen); 10730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } else 10740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang buf = vmalloc(tlen); 10750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (!buf) { 10760a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 10770a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "failed to get a payload buffer.\n"); 10780a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return NULL; 10790a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 10800a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10810a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang n = (struct isakmp_pl_n *)(buf->v + oldlen); 10820a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang n->h.np = ISAKMP_NPTYPE_NONE; 10830a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang n->h.len = htons(tlen); 10840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang n->doi = htonl(IPSEC_DOI); /* IPSEC DOI (1) */ 10850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang n->proto_id = pr->proto_id; /* IPSEC AH/ESP/whatever*/ 10860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang n->spi_size = pr->spisize; 10870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang n->type = htons(type); 10880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang *(u_int32_t *)(n + 1) = pr->spi; /* XXX */ 10890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (data) 10900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang memcpy((caddr_t)(n + 1) + pr->spisize, data->v, data->l); 10910a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10920a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* save the pointer of next payload type */ 10930a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang *np_p = &n->h.np; 10940a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return buf; 10960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang} 10970a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 10980a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangstatic void 10990a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangpurge_isakmp_spi(proto, spi, n) 11000a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int proto; 11010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang isakmp_index *spi; /*network byteorder*/ 11020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang size_t n; 11030a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang{ 11040a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph1handle *iph1; 11050a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang size_t i; 11060a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 11070a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang for (i = 0; i < n; i++) { 11080a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1 = getph1byindex(&spi[i]); 11090a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (!iph1) 11100a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang continue; 11110a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 11120a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_INFO, LOCATION, NULL, 11130a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "purged ISAKMP-SA proto_id=%s spi=%s.\n", 11140a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang s_ipsecdoi_proto(proto), 11150a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang isakmp_pindex(&spi[i], 0)); 11160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1117c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh SCHED_KILL(iph1->sce); 11180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->status = PHASE1ST_EXPIRED; 1119c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh iph1->sce = sched_new(1, isakmp_ph1delete_stub, iph1); 11200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 11210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang} 11220a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 11230a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 11240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 11250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangvoid 11260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangpurge_ipsec_spi(dst0, proto, spi, n) 11270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct sockaddr *dst0; 11280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int proto; 11290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang u_int32_t *spi; /*network byteorder*/ 11300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang size_t n; 11310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang{ 11320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *buf = NULL; 11330a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct sadb_msg *msg, *next, *end; 11340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct sadb_sa *sa; 11350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct sadb_lifetime *lt; 11360a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct sockaddr *src, *dst; 11370a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph2handle *iph2; 11380a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang u_int64_t created; 11390a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang size_t i; 11400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang caddr_t mhp[SADB_EXT_MAX + 1]; 1141c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh#ifdef ENABLE_NATT 1142c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh struct sadb_x_nat_t_type *natt_type; 1143c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh struct sadb_x_nat_t_port *natt_port; 1144c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh#endif 11450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 11460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_DEBUG2, LOCATION, NULL, 11470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "purge_ipsec_spi:\n"); 11480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_DEBUG2, LOCATION, NULL, "dst0: %s\n", saddr2str(dst0)); 11490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_DEBUG2, LOCATION, NULL, "SPI: %08X\n", ntohl(spi[0])); 11500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 11510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang buf = pfkey_dump_sadb(ipsecdoi2pfkey_proto(proto)); 11520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (buf == NULL) { 11530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_DEBUG, LOCATION, NULL, 11540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "pfkey_dump_sadb returned nothing.\n"); 11550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return; 11560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 11570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 11580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang msg = (struct sadb_msg *)buf->v; 11590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang end = (struct sadb_msg *)(buf->v + buf->l); 11600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 11610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang while (msg < end) { 11620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if ((msg->sadb_msg_len << 3) < sizeof(*msg)) 11630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 11640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang next = (struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3)); 11650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (msg->sadb_msg_type != SADB_DUMP) { 11660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang msg = next; 11670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang continue; 11680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 11690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 11700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (pfkey_align(msg, mhp) || pfkey_check(mhp)) { 11710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 11720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "pfkey_check (%s)\n", ipsec_strerror()); 11730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang msg = next; 11740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang continue; 11750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 11760a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 11770a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang sa = (struct sadb_sa *)(mhp[SADB_EXT_SA]); 11780a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (!sa 11790a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang || !mhp[SADB_EXT_ADDRESS_SRC] 11800a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang || !mhp[SADB_EXT_ADDRESS_DST]) { 11810a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang msg = next; 11820a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang continue; 11830a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 11840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]); 11850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]); 11860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang lt = (struct sadb_lifetime*)mhp[SADB_EXT_LIFETIME_HARD]; 11870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if(lt != NULL) 11880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang created = lt->sadb_lifetime_addtime; 11890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang else 11900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang created = 0; 11910a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 11920a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (sa->sadb_sa_state != SADB_SASTATE_MATURE 11930a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang && sa->sadb_sa_state != SADB_SASTATE_DYING) { 11940a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang msg = next; 11950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang continue; 11960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 1197c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh#ifdef ENABLE_NATT 1198c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh natt_type = (void *)mhp[SADB_X_EXT_NAT_T_TYPE]; 1199c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if (natt_type && natt_type->sadb_x_nat_t_type_type) { 1200c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh /* NAT-T is enabled for this SADB entry; copy 1201c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh * the ports from NAT-T extensions */ 1202c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh natt_port = (void *)mhp[SADB_X_EXT_NAT_T_SPORT]; 1203c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if (extract_port(src) == 0 && natt_port != NULL) 1204c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh set_port(src, ntohs(natt_port->sadb_x_nat_t_port_port)); 1205c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh 1206c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh natt_port = (void *)mhp[SADB_X_EXT_NAT_T_DPORT]; 1207c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if (extract_port(dst) == 0 && natt_port != NULL) 1208c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh set_port(dst, ntohs(natt_port->sadb_x_nat_t_port_port)); 1209c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh }else{ 1210c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh /* Force default UDP ports, so CMPSADDR will match SAs with NO encapsulation 1211c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh */ 1212c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh set_port(src, PORT_ISAKMP); 1213c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh set_port(dst, PORT_ISAKMP); 1214c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh } 1215c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh#endif 12160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_DEBUG2, LOCATION, NULL, "src: %s\n", saddr2str(src)); 12170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_DEBUG2, LOCATION, NULL, "dst: %s\n", saddr2str(dst)); 12180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 12190a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* XXX n^2 algorithm, inefficient */ 12200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 12210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* don't delete inbound SAs at the moment */ 12220a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* XXX should we remove SAs with opposite direction as well? */ 1223c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if (CMPSADDR(dst0, dst)) { 12240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang msg = next; 12250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang continue; 12260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 12270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1228c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh#ifdef ENABLE_NATT 1229c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if (natt_type == NULL || 1230c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh ! natt_type->sadb_x_nat_t_type_type) { 1231c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh /* Set back port to 0 if it was forced to default UDP port 1232c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh */ 1233c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh set_port(src, 0); 1234c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh set_port(dst, 0); 1235c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh } 1236c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh#endif 12370a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang for (i = 0; i < n; i++) { 12380a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_DEBUG, LOCATION, NULL, 12390a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "check spi(packet)=%u spi(db)=%u.\n", 12400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang ntohl(spi[i]), ntohl(sa->sadb_sa_spi)); 12410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (spi[i] != sa->sadb_sa_spi) 12420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang continue; 12430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 12440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pfkey_send_delete(lcconf->sock_pfkey, 12450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang msg->sadb_msg_satype, 12460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang IPSEC_MODE_ANY, 12470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang src, dst, sa->sadb_sa_spi); 12480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 12490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* 12500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * delete a relative phase 2 handler. 12510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * continue to process if no relative phase 2 handler 12520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * exists. 12530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 12540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph2 = getph2bysaidx(src, dst, proto, spi[i]); 12550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if(iph2 != NULL){ 12560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang delete_spd(iph2, created); 1257c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh unbindph12(iph2); 12580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang remph2(iph2); 12590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang delph2(iph2); 12600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 12610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 12620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_INFO, LOCATION, NULL, 12630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "purged IPsec-SA proto_id=%s spi=%u.\n", 12640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang s_ipsecdoi_proto(proto), 12650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang ntohl(spi[i])); 12660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 12670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 12680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang msg = next; 12690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 12700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 12710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (buf) 12720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(buf); 12730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang} 12740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 12750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* 1276c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh * delete all phase2 sa relatived to the destination address. 12770a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * Don't delete Phase 1 handlers on INITIAL-CONTACT, and don't ignore 12780a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * an INITIAL-CONTACT if we have contacted the peer. This matches the 12790a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * Sun IKE behavior, and makes rekeying work much better when the peer 12800a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * restarts. 12810a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 1282c91307af2622f6625525f3c1f9c954376df950adChia-chi Yehstatic void 1283c91307af2622f6625525f3c1f9c954376df950adChia-chi Yehinfo_recv_initialcontact(iph1) 12840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph1handle *iph1; 12850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang{ 12860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *buf = NULL; 12870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct sadb_msg *msg, *next, *end; 12880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct sadb_sa *sa; 12890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct sockaddr *src, *dst; 12900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang caddr_t mhp[SADB_EXT_MAX + 1]; 12910a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int proto_id, i; 12920a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph2handle *iph2; 12930a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#if 0 12940a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang char *loc, *rem; 12950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 12960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 12970a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (f_local) 1298c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh return; 12990a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13000a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#if 0 13010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang loc = racoon_strdup(saddrwop2str(iph1->local)); 13020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang rem = racoon_strdup(saddrwop2str(iph1->remote)); 13030a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang STRDUP_FATAL(loc); 13040a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang STRDUP_FATAL(rem); 13050a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13060a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* 13070a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * Purge all IPSEC-SAs for the peer. We can do this 13080a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * the easy way (using a PF_KEY SADB_DELETE extension) 13090a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * or we can do it the hard way. 13100a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 13110a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang for (i = 0; i < pfkey_nsatypes; i++) { 13120a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang proto_id = pfkey2ipsecdoi_proto(pfkey_satypes[i].ps_satype); 13130a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13140a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_INFO, LOCATION, NULL, 13150a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "purging %s SAs for %s -> %s\n", 13160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pfkey_satypes[i].ps_name, loc, rem); 13170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (pfkey_send_delete_all(lcconf->sock_pfkey, 13180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pfkey_satypes[i].ps_satype, IPSEC_MODE_ANY, 13190a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->local, iph1->remote) == -1) { 13200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 13210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "delete_all %s -> %s failed for %s (%s)\n", 13220a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang loc, rem, 13230a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pfkey_satypes[i].ps_name, ipsec_strerror()); 13240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto the_hard_way; 13250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 13260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang deleteallph2(iph1->local, iph1->remote, proto_id); 13280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_INFO, LOCATION, NULL, 13300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "purging %s SAs for %s -> %s\n", 13310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pfkey_satypes[i].ps_name, rem, loc); 13320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (pfkey_send_delete_all(lcconf->sock_pfkey, 13330a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pfkey_satypes[i].ps_satype, IPSEC_MODE_ANY, 13340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->remote, iph1->local) == -1) { 13350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 13360a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "delete_all %s -> %s failed for %s (%s)\n", 13370a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang rem, loc, 13380a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pfkey_satypes[i].ps_name, ipsec_strerror()); 13390a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang goto the_hard_way; 13400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 13410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang deleteallph2(iph1->remote, iph1->local, proto_id); 13430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 13440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang racoon_free(loc); 13460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang racoon_free(rem); 1347c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh return; 13480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang the_hard_way: 13500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang racoon_free(loc); 13510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang racoon_free(rem); 13520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 13530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang buf = pfkey_dump_sadb(SADB_SATYPE_UNSPEC); 13550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (buf == NULL) { 13560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_DEBUG, LOCATION, NULL, 13570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "pfkey_dump_sadb returned nothing.\n"); 1358c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh return; 13590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 13600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang msg = (struct sadb_msg *)buf->v; 13620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang end = (struct sadb_msg *)(buf->v + buf->l); 13630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1364c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh while (msg < end) { 13650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if ((msg->sadb_msg_len << 3) < sizeof(*msg)) 13660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 13670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang next = (struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3)); 1368c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if (msg->sadb_msg_type != SADB_DUMP) { 1369c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh msg = next; 13700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang continue; 1371c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh } 13720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (pfkey_align(msg, mhp) || pfkey_check(mhp)) { 13740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 13750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "pfkey_check (%s)\n", ipsec_strerror()); 1376c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh msg = next; 13770a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang continue; 13780a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 13790a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13800a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (mhp[SADB_EXT_SA] == NULL 13810a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang || mhp[SADB_EXT_ADDRESS_SRC] == NULL 1382c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh || mhp[SADB_EXT_ADDRESS_DST] == NULL) { 1383c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh msg = next; 13840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang continue; 1385c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh } 13860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang sa = (struct sadb_sa *)mhp[SADB_EXT_SA]; 13870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]); 13880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]); 13890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (sa->sadb_sa_state != SADB_SASTATE_MATURE 1391c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh && sa->sadb_sa_state != SADB_SASTATE_DYING) { 1392c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh msg = next; 13930a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang continue; 1394c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh } 13950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 13960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* 13970a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * RFC2407 4.6.3.3 INITIAL-CONTACT is the message that 13980a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * announces the sender of the message was rebooted. 13990a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * it is interpreted to delete all SAs which source address 14000a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * is the sender of the message. 14010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * racoon only deletes SA which is matched both the 14020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * source address and the destination accress. 14030a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 1404c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh#ifdef ENABLE_NATT 1405c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh /* 1406c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh * XXX RFC 3947 says that whe MUST NOT use IP+port to find old SAs 1407c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh * from this peer ! 1408c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh */ 1409c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if(iph1->natt_flags & NAT_DETECTED){ 1410c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if (CMPSADDR(iph1->local, src) == 0 && 1411c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh CMPSADDR(iph1->remote, dst) == 0) 1412c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh ; 1413c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh else if (CMPSADDR(iph1->remote, src) == 0 && 1414c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh CMPSADDR(iph1->local, dst) == 0) 1415c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh ; 1416c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh else { 1417c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh msg = next; 1418c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh continue; 1419c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh } 1420c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh } else 1421c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh#endif 1422c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh /* If there is no NAT-T, we don't have to check addr + port... 1423c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh * XXX what about a configuration with a remote peers which is not 1424c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh * NATed, but which NATs some other peers ? 1425c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh * Here, the INITIAl-CONTACT would also flush all those NATed peers !! 1426c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh */ 1427c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if (cmpsaddrwop(iph1->local, src) == 0 && 1428c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh cmpsaddrwop(iph1->remote, dst) == 0) 1429c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh ; 1430c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh else if (cmpsaddrwop(iph1->remote, src) == 0 && 1431c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh cmpsaddrwop(iph1->local, dst) == 0) 1432c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh ; 1433c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh else { 1434c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh msg = next; 14350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang continue; 1436c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh } 14370a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 14380a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* 14390a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * Make sure this is an SATYPE that we manage. 14400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * This is gross; too bad we couldn't do it the 14410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * easy way. 14420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 14430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang for (i = 0; i < pfkey_nsatypes; i++) { 14440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (pfkey_satypes[i].ps_satype == 14450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang msg->sadb_msg_satype) 14460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang break; 14470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 1448c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if (i == pfkey_nsatypes) { 1449c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh msg = next; 14500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang continue; 1451c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh } 14520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 14530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_INFO, LOCATION, NULL, 14540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "purging spi=%u.\n", ntohl(sa->sadb_sa_spi)); 14550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang pfkey_send_delete(lcconf->sock_pfkey, 14560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang msg->sadb_msg_satype, 14570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang IPSEC_MODE_ANY, src, dst, sa->sadb_sa_spi); 14580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 14590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* 14600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * delete a relative phase 2 handler. 14610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * continue to process if no relative phase 2 handler 14620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * exists. 14630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 14640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang proto_id = pfkey2ipsecdoi_proto(msg->sadb_msg_satype); 14650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph2 = getph2bysaidx(src, dst, proto_id, sa->sadb_sa_spi); 1466c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if (iph2) { 14670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang delete_spd(iph2, 0); 1468c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh unbindph12(iph2); 14690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang remph2(iph2); 14700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang delph2(iph2); 14710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 1472c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh 1473c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh msg = next; 14740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 14750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 14760a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(buf); 1477c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh} 1478c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh 1479c91307af2622f6625525f3c1f9c954376df950adChia-chi Yehvoid 1480c91307af2622f6625525f3c1f9c954376df950adChia-chi Yehisakmp_check_notify(gen, iph1) 1481c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh struct isakmp_gen *gen; /* points to Notify payload */ 1482c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh struct ph1handle *iph1; 1483c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh{ 1484c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh struct isakmp_pl_n *notify = (struct isakmp_pl_n *)gen; 1485c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh 1486c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh plog(LLV_DEBUG, LOCATION, iph1->remote, 1487c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh "Notify Message received\n"); 1488c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh 1489c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh switch (ntohs(notify->type)) { 1490c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh case ISAKMP_NTYPE_CONNECTED: 1491c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh case ISAKMP_NTYPE_RESPONDER_LIFETIME: 1492c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh case ISAKMP_NTYPE_REPLAY_STATUS: 1493c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh case ISAKMP_NTYPE_HEARTBEAT: 1494c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh#ifdef ENABLE_HYBRID 1495c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh case ISAKMP_NTYPE_UNITY_HEARTBEAT: 1496c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh#endif 1497c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh plog(LLV_WARNING, LOCATION, iph1->remote, 1498c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh "ignore %s notification.\n", 1499c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh s_isakmp_notify_msg(ntohs(notify->type))); 1500c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh break; 1501c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh case ISAKMP_NTYPE_INITIAL_CONTACT: 1502c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh plog(LLV_WARNING, LOCATION, iph1->remote, 1503c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh "ignore INITIAL-CONTACT notification, " 1504c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh "because it is only accepted after phase1.\n"); 1505c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh break; 1506c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh default: 1507c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL); 1508c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh plog(LLV_ERROR, LOCATION, iph1->remote, 1509c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh "received unknown notification type %s.\n", 1510c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh s_isakmp_notify_msg(ntohs(notify->type))); 1511c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh } 1512c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh 1513c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh return; 15140a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang} 15150a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 15160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 15170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_DPD 15180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangstatic int 15190a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangisakmp_info_recv_r_u (iph1, ru, msgid) 15200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph1handle *iph1; 15210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct isakmp_pl_ru *ru; 15220a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang u_int32_t msgid; 15230a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang{ 15240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct isakmp_pl_ru *ru_ack; 15250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *payload = NULL; 15260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int tlen; 15270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int error = 0; 15280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 15290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_DEBUG, LOCATION, iph1->remote, 15300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "DPD R-U-There received\n"); 15310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 15320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* XXX should compare cookies with iph1->index? 15330a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang Or is this already done by calling function? */ 15340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang tlen = sizeof(*ru_ack); 15350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang payload = vmalloc(tlen); 15360a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (payload == NULL) { 15370a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 15380a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "failed to get buffer to send.\n"); 15390a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return errno; 15400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 15410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 15420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang ru_ack = (struct isakmp_pl_ru *)payload->v; 15430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang ru_ack->h.np = ISAKMP_NPTYPE_NONE; 15440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang ru_ack->h.len = htons(tlen); 15450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang ru_ack->doi = htonl(IPSEC_DOI); 15460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang ru_ack->type = htons(ISAKMP_NTYPE_R_U_THERE_ACK); 15470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang ru_ack->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX ? */ 15480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang ru_ack->spi_size = sizeof(isakmp_index); 15490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang memcpy(ru_ack->i_ck, ru->i_ck, sizeof(cookie_t)); 15500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang memcpy(ru_ack->r_ck, ru->r_ck, sizeof(cookie_t)); 15510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang ru_ack->data = ru->data; 15520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 15530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* XXX Should we do FLAG_A ? */ 15540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 15550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang ISAKMP_FLAG_E); 15560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(payload); 15570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 15580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_DEBUG, LOCATION, NULL, "received a valid R-U-THERE, ACK sent\n"); 15590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 15600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* Should we mark tunnel as active ? */ 15610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return error; 15620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang} 15630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 15640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangstatic int 15650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangisakmp_info_recv_r_u_ack (iph1, ru, msgid) 15660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph1handle *iph1; 15670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct isakmp_pl_ru *ru; 15680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang u_int32_t msgid; 15690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang{ 15700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 15710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_DEBUG, LOCATION, iph1->remote, 15720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "DPD R-U-There-Ack received\n"); 15730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1574c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh /* XXX Maintain window of acceptable sequence numbers ? 1575c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh * => ru->data <= iph2->dpd_seq && 1576c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh * ru->data >= iph2->dpd_seq - iph2->dpd_fails ? */ 1577c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if (ntohl(ru->data) != iph1->dpd_seq-1) { 15780a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, iph1->remote, 1579c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh "Wrong DPD sequence number (%d, %d expected).\n", 1580c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh ntohl(ru->data), iph1->dpd_seq-1); 15810a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return 0; 15820a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 15830a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 15840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (memcmp(ru->i_ck, iph1->index.i_ck, sizeof(cookie_t)) || 15850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang memcmp(ru->r_ck, iph1->index.r_ck, sizeof(cookie_t))) { 15860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, iph1->remote, 15870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "Cookie mismatch in DPD ACK!.\n"); 15880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return 0; 15890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 15900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 15910a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->dpd_fails = 0; 1592c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh 1593c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh /* Useless ??? */ 1594c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh iph1->dpd_lastack = time(NULL); 1595c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh 1596c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh SCHED_KILL(iph1->dpd_r_u); 1597c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh 15980a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang isakmp_sched_r_u(iph1, 0); 15990a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 16000a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_DEBUG, LOCATION, NULL, "received an R-U-THERE-ACK\n"); 16010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 16020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return 0; 16030a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang} 16040a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 16050a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 16060a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 16070a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 16080a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* 16090a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * send DPD R-U-THERE payload in Informational exchange. 16100a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 16110a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangstatic void 1612c91307af2622f6625525f3c1f9c954376df950adChia-chi Yehisakmp_info_send_r_u(arg) 1613c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh void *arg; 16140a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang{ 1615c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh struct ph1handle *iph1 = arg; 16160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 16170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* create R-U-THERE payload */ 16180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct isakmp_pl_ru *ru; 16190a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *payload = NULL; 16200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int tlen; 16210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int error = 0; 16220a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 16230a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_DEBUG, LOCATION, iph1->remote, "DPD monitoring....\n"); 16240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1625c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh iph1->dpd_r_u=NULL; 16260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 16270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (iph1->dpd_fails >= iph1->rmconf->dpd_maxfails) { 16280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 16290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_INFO, LOCATION, iph1->remote, 16300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "DPD: remote (ISAKMP-SA spi=%s) seems to be dead.\n", 16310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang isakmp_pindex(&iph1->index, 0)); 16320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1633c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh EVT_PUSH(iph1->local, iph1->remote, EVTT_DPD_TIMEOUT, NULL); 16340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang purge_remote(iph1); 16350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 16360a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* Do not reschedule here: phase1 is deleted, 16370a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * DPD will be reactivated when a new ph1 will be negociated 16380a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 16390a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return; 16400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 16410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 16420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* TODO: check recent activity to avoid useless sends... */ 16430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 16440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang tlen = sizeof(*ru); 16450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang payload = vmalloc(tlen); 16460a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if (payload == NULL) { 16470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_ERROR, LOCATION, NULL, 16480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "failed to get buffer for payload.\n"); 16490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return; 16500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 16510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang ru = (struct isakmp_pl_ru *)payload->v; 16520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang ru->h.np = ISAKMP_NPTYPE_NONE; 16530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang ru->h.len = htons(tlen); 16540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang ru->doi = htonl(IPSEC_DOI); 16550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang ru->type = htons(ISAKMP_NTYPE_R_U_THERE); 16560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang ru->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX ?*/ 16570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang ru->spi_size = sizeof(isakmp_index); 16580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 16590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang memcpy(ru->i_ck, iph1->index.i_ck, sizeof(cookie_t)); 16600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang memcpy(ru->r_ck, iph1->index.r_ck, sizeof(cookie_t)); 16610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1662c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh if (iph1->dpd_seq == 0){ 16630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* generate a random seq which is not too big */ 1664c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh srand(time(NULL)); 1665c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh iph1->dpd_seq = rand() & 0x0fff; 16660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang } 16670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 16680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang ru->data = htonl(iph1->dpd_seq); 16690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 16700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 0); 16710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vfree(payload); 16720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 16730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_DEBUG, LOCATION, iph1->remote, 16740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "DPD R-U-There sent (%d)\n", error); 16750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1676c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh /* will be decreased if ACK received... */ 1677c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh iph1->dpd_fails++; 1678c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh 1679c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh /* XXX should be increased only when ACKed ? */ 1680c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh iph1->dpd_seq++; 1681c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh 16820a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* Reschedule the r_u_there with a short delay, 16830a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * will be deleted/rescheduled if ACK received before */ 16840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang isakmp_sched_r_u(iph1, 1); 16850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 16860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang plog(LLV_DEBUG, LOCATION, iph1->remote, 16870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang "rescheduling send_r_u (%d).\n", iph1->rmconf->dpd_retry); 16880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang} 16890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 16900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* Schedule a new R-U-THERE */ 16910a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangint 16920a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangisakmp_sched_r_u(iph1, retry) 16930a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct ph1handle *iph1; 16940a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int retry; 16950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang{ 16960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if(iph1 == NULL || 16970a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->rmconf == NULL) 16980a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return 1; 16990a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 17000a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 17010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if(iph1->dpd_support == 0 || 17020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang iph1->rmconf->dpd_interval == 0) 17030a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return 0; 17040a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 17050a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang if(retry) 1706c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh iph1->dpd_r_u = sched_new(iph1->rmconf->dpd_retry, 1707c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh isakmp_info_send_r_u, iph1); 17080a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang else 1709c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh iph1->dpd_r_u = sched_new(iph1->rmconf->dpd_interval, 1710c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh isakmp_info_send_r_u, iph1); 17110a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 17120a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang return 0; 17130a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang} 17140a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 1715