1 /* $NetBSD: ipsec_doi.c,v 1.46 2010/12/14 17:57:31 tteras Exp $ */ 2 3 /* Id: ipsec_doi.c,v 1.55 2006/08/17 09:20:41 vanhu Exp */ 4 5 /* 6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. Neither the name of the project nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #include "config.h" 35 36 #include <sys/types.h> 37 #include <sys/param.h> 38 #include <sys/socket.h> 39 40 #include <netinet/in.h> 41 42 #include PATH_IPSEC_H 43 44 #include <stdlib.h> 45 #include <stdio.h> 46 #include <string.h> 47 #include <errno.h> 48 #include <netdb.h> 49 #if TIME_WITH_SYS_TIME 50 # include <sys/time.h> 51 # include <time.h> 52 #else 53 # if HAVE_SYS_TIME_H 54 # include <sys/time.h> 55 # else 56 # include <time.h> 57 # endif 58 #endif 59 60 #include "var.h" 61 #include "vmbuf.h" 62 #include "misc.h" 63 #include "plog.h" 64 #include "debug.h" 65 66 #include "cfparse_proto.h" 67 #include "isakmp_var.h" 68 #include "isakmp.h" 69 #include "ipsec_doi.h" 70 #include "oakley.h" 71 #include "remoteconf.h" 72 #include "localconf.h" 73 #include "sockmisc.h" 74 #include "handler.h" 75 #include "policy.h" 76 #include "algorithm.h" 77 #include "sainfo.h" 78 #include "proposal.h" 79 #include "crypto_openssl.h" 80 #include "strnames.h" 81 #include "gcmalloc.h" 82 83 #ifdef ENABLE_NATT 84 #include "nattraversal.h" 85 #endif 86 87 #ifdef HAVE_GSSAPI 88 #include <iconv.h> 89 #include "gssapi.h" 90 #ifdef HAVE_ICONV_2ND_CONST 91 #define __iconv_const const 92 #else 93 #define __iconv_const 94 #endif 95 #endif 96 97 static vchar_t *get_ph1approval __P((struct ph1handle *, u_int32_t, u_int32_t, 98 struct prop_pair **)); 99 static int get_ph1approvalx __P((struct remoteconf *, void *)); 100 101 static int t2isakmpsa __P((struct isakmp_pl_t *, struct isakmpsa *, u_int32_t)); 102 static int cmp_aproppair_i __P((struct prop_pair *, struct prop_pair *)); 103 static struct prop_pair *get_ph2approval __P((struct ph2handle *, 104 struct prop_pair **)); 105 static struct prop_pair *get_ph2approvalx __P((struct ph2handle *, 106 struct prop_pair *)); 107 static void free_proppair0 __P((struct prop_pair *)); 108 static struct prop_pair ** get_proppair_and_doi_sit __P((vchar_t *, int, 109 u_int32_t *, u_int32_t *)); 110 111 static int get_transform 112 __P((struct isakmp_pl_p *, struct prop_pair **, int *)); 113 static u_int32_t ipsecdoi_set_ld __P((vchar_t *)); 114 115 static int check_doi __P((u_int32_t)); 116 static int check_situation __P((u_int32_t)); 117 118 static int check_prot_main __P((int)); 119 static int check_prot_quick __P((int)); 120 static int (*check_protocol[]) __P((int)) = { 121 check_prot_main, /* IPSECDOI_TYPE_PH1 */ 122 check_prot_quick, /* IPSECDOI_TYPE_PH2 */ 123 }; 124 125 static int check_spi_size __P((int, int)); 126 127 static int check_trns_isakmp __P((int)); 128 static int check_trns_ah __P((int)); 129 static int check_trns_esp __P((int)); 130 static int check_trns_ipcomp __P((int)); 131 static int (*check_transform[]) __P((int)) = { 132 0, 133 check_trns_isakmp, /* IPSECDOI_PROTO_ISAKMP */ 134 check_trns_ah, /* IPSECDOI_PROTO_IPSEC_AH */ 135 check_trns_esp, /* IPSECDOI_PROTO_IPSEC_ESP */ 136 check_trns_ipcomp, /* IPSECDOI_PROTO_IPCOMP */ 137 }; 138 139 static int check_attr_isakmp __P((struct isakmp_pl_t *)); 140 static int check_attr_ah __P((struct isakmp_pl_t *)); 141 static int check_attr_esp __P((struct isakmp_pl_t *)); 142 static int check_attr_ipsec __P((int, struct isakmp_pl_t *)); 143 static int check_attr_ipcomp __P((struct isakmp_pl_t *)); 144 static int (*check_attributes[]) __P((struct isakmp_pl_t *)) = { 145 0, 146 check_attr_isakmp, /* IPSECDOI_PROTO_ISAKMP */ 147 check_attr_ah, /* IPSECDOI_PROTO_IPSEC_AH */ 148 check_attr_esp, /* IPSECDOI_PROTO_IPSEC_ESP */ 149 check_attr_ipcomp, /* IPSECDOI_PROTO_IPCOMP */ 150 }; 151 152 static int setph1prop __P((struct isakmpsa *, caddr_t)); 153 static int setph1trns __P((struct isakmpsa *, caddr_t)); 154 static int setph1attr __P((struct isakmpsa *, caddr_t)); 155 static vchar_t *setph2proposal0 __P((const struct ph2handle *, 156 const struct saprop *, const struct saproto *)); 157 158 struct ph1approvalx_ctx { 159 struct prop_pair *p; 160 struct isakmpsa *sa; 161 }; 162 163 /*%%%*/ 164 /* 165 * check phase 1 SA payload. 166 * make new SA payload to be replyed not including general header. 167 * the pointer to one of isakmpsa in proposal is set into iph1->approval. 168 * OUT: 169 * positive: the pointer to new buffer of SA payload. 170 * network byte order. 171 * NULL : error occurd. 172 */ 173 int 174 ipsecdoi_checkph1proposal(sa, iph1) 175 vchar_t *sa; 176 struct ph1handle *iph1; 177 { 178 vchar_t *newsa; /* new SA payload approved. */ 179 struct prop_pair **pair; 180 u_int32_t doitype, sittype; 181 182 /* get proposal pair */ 183 pair = get_proppair_and_doi_sit(sa, IPSECDOI_TYPE_PH1, 184 &doitype, &sittype); 185 if (pair == NULL) 186 return -1; 187 188 /* check and get one SA for use */ 189 newsa = get_ph1approval(iph1, doitype, sittype, pair); 190 free_proppair(pair); 191 192 if (newsa == NULL) 193 return -1; 194 195 iph1->sa_ret = newsa; 196 return 0; 197 } 198 199 static void 200 print_ph1proposal(pair, s) 201 struct prop_pair *pair; 202 struct isakmpsa *s; 203 { 204 struct isakmp_pl_p *prop = pair->prop; 205 struct isakmp_pl_t *trns = pair->trns; 206 207 plog(LLV_DEBUG, LOCATION, NULL, 208 "prop#=%d, prot-id=%s, spi-size=%d, #trns=%d\n", 209 prop->p_no, s_ipsecdoi_proto(prop->proto_id), 210 prop->spi_size, prop->num_t); 211 plog(LLV_DEBUG, LOCATION, NULL, 212 "trns#=%d, trns-id=%s\n", 213 trns->t_no, s_ipsecdoi_trns(prop->proto_id, trns->t_id)); 214 plog(LLV_DEBUG, LOCATION, NULL, 215 " lifetime = %ld\n", (long) s->lifetime); 216 plog(LLV_DEBUG, LOCATION, NULL, 217 " lifebyte = %zu\n", s->lifebyte); 218 plog(LLV_DEBUG, LOCATION, NULL, 219 " enctype = %s\n", 220 s_oakley_attr_v(OAKLEY_ATTR_ENC_ALG, s->enctype)); 221 plog(LLV_DEBUG, LOCATION, NULL, 222 " encklen = %d\n", s->encklen); 223 plog(LLV_DEBUG, LOCATION, NULL, 224 " hashtype = %s\n", 225 s_oakley_attr_v(OAKLEY_ATTR_HASH_ALG, s->hashtype)); 226 plog(LLV_DEBUG, LOCATION, NULL, 227 " authmethod = %s\n", 228 s_oakley_attr_v(OAKLEY_ATTR_AUTH_METHOD, s->authmethod)); 229 plog(LLV_DEBUG, LOCATION, NULL, 230 " dh_group = %s\n", 231 s_oakley_attr_v(OAKLEY_ATTR_GRP_DESC, s->dh_group)); 232 } 233 234 235 /* 236 * acceptable check for remote configuration. 237 * return a new SA payload to be reply to peer. 238 */ 239 240 static vchar_t * 241 get_ph1approval(iph1, doitype, sittype, pair) 242 struct ph1handle *iph1; 243 u_int32_t doitype, sittype; 244 struct prop_pair **pair; 245 { 246 vchar_t *newsa; 247 struct ph1approvalx_ctx ctx; 248 struct prop_pair *s, *p; 249 struct rmconfselector rmsel; 250 struct isakmpsa *sa; 251 int i; 252 253 memset(&rmsel, 0, sizeof(rmsel)); 254 rmsel.remote = iph1->remote; 255 256 if (iph1->approval) { 257 delisakmpsa(iph1->approval); 258 iph1->approval = NULL; 259 } 260 261 for (i = 0; i < MAXPROPPAIRLEN; i++) { 262 if (pair[i] == NULL) 263 continue; 264 for (s = pair[i]; s; s = s->next) { 265 /* compare proposal and select one */ 266 for (p = s; p; p = p->tnext) { 267 struct isakmp_pl_p *prop = p->prop; 268 269 sa = newisakmpsa(); 270 ctx.p = p; 271 ctx.sa = sa; 272 if (t2isakmpsa(p->trns, sa, 273 iph1->vendorid_mask) < 0) 274 continue; 275 print_ph1proposal(p, sa); 276 if (iph1->rmconf != NULL) { 277 if (get_ph1approvalx(iph1->rmconf, &ctx)) 278 goto found; 279 } else { 280 if (enumrmconf(&rmsel, get_ph1approvalx, &ctx)) 281 goto found; 282 } 283 delisakmpsa(sa); 284 } 285 } 286 } 287 288 plog(LLV_ERROR, LOCATION, NULL, "no suitable proposal found.\n"); 289 290 return NULL; 291 292 found: 293 sa = ctx.sa; 294 plog(LLV_DEBUG, LOCATION, NULL, "an acceptable proposal found.\n"); 295 296 /* check DH group settings */ 297 if (sa->dhgrp) { 298 if (sa->dhgrp->prime && sa->dhgrp->gen1) { 299 /* it's ok */ 300 goto saok; 301 } 302 plog(LLV_WARNING, LOCATION, NULL, 303 "invalid DH parameter found, use default.\n"); 304 oakley_dhgrp_free(sa->dhgrp); 305 sa->dhgrp=NULL; 306 } 307 308 if (oakley_setdhgroup(sa->dh_group, &sa->dhgrp) == -1) { 309 sa->dhgrp = NULL; 310 delisakmpsa(sa); 311 return NULL; 312 } 313 314 saok: 315 #ifdef HAVE_GSSAPI 316 if (sa->gssid != NULL) 317 plog(LLV_DEBUG, LOCATION, NULL, "gss id in new sa '%.*s'\n", 318 (int)sa->gssid->l, sa->gssid->v); 319 if (iph1->side == INITIATOR) { 320 if (iph1->rmconf->proposal->gssid != NULL) 321 iph1->gi_i = vdup(iph1->rmconf->proposal->gssid); 322 if (sa->gssid != NULL) 323 iph1->gi_r = vdup(sa->gssid); 324 } else { 325 if (sa->gssid != NULL) { 326 iph1->gi_r = vdup(sa->gssid); 327 iph1->gi_i = gssapi_get_id(iph1); 328 } 329 } 330 if (iph1->gi_i != NULL) 331 plog(LLV_DEBUG, LOCATION, NULL, "GIi is %.*s\n", 332 (int)iph1->gi_i->l, iph1->gi_i->v); 333 if (iph1->gi_r != NULL) 334 plog(LLV_DEBUG, LOCATION, NULL, "GIr is %.*s\n", 335 (int)iph1->gi_r->l, iph1->gi_r->v); 336 #endif 337 plog(LLV_DEBUG, LOCATION, NULL, "agreed on %s auth.\n", 338 s_oakley_attr_method(sa->authmethod)); 339 340 newsa = get_sabyproppair(doitype, sittype, p); 341 if (newsa == NULL) 342 delisakmpsa(sa); 343 else 344 iph1->approval = sa; 345 346 return newsa; 347 } 348 349 /* 350 * compare peer's single proposal and all of my proposal. 351 * and select one if suiatable. 352 */ 353 static int 354 get_ph1approvalx(rmconf, ctx) 355 struct remoteconf *rmconf; 356 void *ctx; 357 { 358 struct ph1approvalx_ctx *pctx = (struct ph1approvalx_ctx *) ctx; 359 struct isakmpsa *sa; 360 361 /* do the hard work */ 362 sa = checkisakmpsa(rmconf->pcheck_level, pctx->sa, rmconf->proposal); 363 if (sa == NULL) 364 return 0; 365 366 /* duplicate and modify the found SA to match proposal */ 367 sa = dupisakmpsa(sa); 368 369 switch (rmconf->pcheck_level) { 370 case PROP_CHECK_OBEY: 371 sa->lifetime = pctx->sa->lifetime; 372 sa->lifebyte = pctx->sa->lifebyte; 373 sa->encklen = pctx->sa->encklen; 374 break; 375 case PROP_CHECK_CLAIM: 376 case PROP_CHECK_STRICT: 377 if (pctx->sa->lifetime < sa->lifetime) 378 sa->lifetime = pctx->sa->lifetime; 379 if (pctx->sa->lifebyte < sa->lifebyte) 380 sa->lifebyte = pctx->sa->lifebyte; 381 if (pctx->sa->encklen > sa->encklen) 382 sa->encklen = pctx->sa->encklen; 383 break; 384 default: 385 break; 386 } 387 388 /* replace the proposal with our approval sa */ 389 delisakmpsa(pctx->sa); 390 pctx->sa = sa; 391 392 return 1; 393 } 394 395 /* 396 * get ISAKMP data attributes 397 */ 398 static int 399 t2isakmpsa(trns, sa, vendorid_mask) 400 struct isakmp_pl_t *trns; 401 struct isakmpsa *sa; 402 u_int32_t vendorid_mask; 403 { 404 struct isakmp_data *d, *prev; 405 int flag, type; 406 int error = -1; 407 int life_t; 408 int keylen = 0; 409 vchar_t *val = NULL; 410 int len, tlen; 411 u_char *p; 412 413 tlen = ntohs(trns->h.len) - sizeof(*trns); 414 prev = (struct isakmp_data *)NULL; 415 d = (struct isakmp_data *)(trns + 1); 416 417 /* default */ 418 life_t = OAKLEY_ATTR_SA_LD_TYPE_DEFAULT; 419 sa->lifetime = OAKLEY_ATTR_SA_LD_SEC_DEFAULT; 420 sa->lifebyte = 0; 421 sa->dhgrp = racoon_calloc(1, sizeof(struct dhgroup)); 422 if (!sa->dhgrp) 423 goto err; 424 425 while (tlen > 0) { 426 427 type = ntohs(d->type) & ~ISAKMP_GEN_MASK; 428 flag = ntohs(d->type) & ISAKMP_GEN_MASK; 429 430 plog(LLV_DEBUG, LOCATION, NULL, 431 "type=%s, flag=0x%04x, lorv=%s\n", 432 s_oakley_attr(type), flag, 433 s_oakley_attr_v(type, ntohs(d->lorv))); 434 435 /* get variable-sized item */ 436 switch (type) { 437 case OAKLEY_ATTR_GRP_PI: 438 case OAKLEY_ATTR_GRP_GEN_ONE: 439 case OAKLEY_ATTR_GRP_GEN_TWO: 440 case OAKLEY_ATTR_GRP_CURVE_A: 441 case OAKLEY_ATTR_GRP_CURVE_B: 442 case OAKLEY_ATTR_SA_LD: 443 case OAKLEY_ATTR_GRP_ORDER: 444 if (flag) { /*TV*/ 445 len = 2; 446 p = (u_char *)&d->lorv; 447 } else { /*TLV*/ 448 len = ntohs(d->lorv); 449 p = (u_char *)(d + 1); 450 } 451 val = vmalloc(len); 452 if (!val) 453 return -1; 454 memcpy(val->v, p, len); 455 break; 456 457 default: 458 break; 459 } 460 461 switch (type) { 462 case OAKLEY_ATTR_ENC_ALG: 463 sa->enctype = (u_int16_t)ntohs(d->lorv); 464 break; 465 466 case OAKLEY_ATTR_HASH_ALG: 467 sa->hashtype = (u_int16_t)ntohs(d->lorv); 468 break; 469 470 case OAKLEY_ATTR_AUTH_METHOD: 471 sa->authmethod = ntohs(d->lorv); 472 #ifdef HAVE_GSSAPI 473 if (sa->authmethod == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB_REAL && 474 (vendorid_mask & VENDORID_GSSAPI_MASK)) 475 sa->authmethod = OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB; 476 #endif 477 break; 478 479 case OAKLEY_ATTR_GRP_DESC: 480 sa->dh_group = (u_int16_t)ntohs(d->lorv); 481 break; 482 483 case OAKLEY_ATTR_GRP_TYPE: 484 { 485 int type = (int)ntohs(d->lorv); 486 if (type == OAKLEY_ATTR_GRP_TYPE_MODP) 487 sa->dhgrp->type = type; 488 else 489 return -1; 490 break; 491 } 492 case OAKLEY_ATTR_GRP_PI: 493 sa->dhgrp->prime = val; 494 break; 495 496 case OAKLEY_ATTR_GRP_GEN_ONE: 497 vfree(val); 498 if (!flag) 499 sa->dhgrp->gen1 = ntohs(d->lorv); 500 else { 501 int len = ntohs(d->lorv); 502 sa->dhgrp->gen1 = 0; 503 if (len > 4) 504 return -1; 505 memcpy(&sa->dhgrp->gen1, d + 1, len); 506 sa->dhgrp->gen1 = ntohl(sa->dhgrp->gen1); 507 } 508 break; 509 510 case OAKLEY_ATTR_GRP_GEN_TWO: 511 vfree(val); 512 if (!flag) 513 sa->dhgrp->gen2 = ntohs(d->lorv); 514 else { 515 int len = ntohs(d->lorv); 516 sa->dhgrp->gen2 = 0; 517 if (len > 4) 518 return -1; 519 memcpy(&sa->dhgrp->gen2, d + 1, len); 520 sa->dhgrp->gen2 = ntohl(sa->dhgrp->gen2); 521 } 522 break; 523 524 case OAKLEY_ATTR_GRP_CURVE_A: 525 sa->dhgrp->curve_a = val; 526 break; 527 528 case OAKLEY_ATTR_GRP_CURVE_B: 529 sa->dhgrp->curve_b = val; 530 break; 531 532 case OAKLEY_ATTR_SA_LD_TYPE: 533 { 534 int type = (int)ntohs(d->lorv); 535 switch (type) { 536 case OAKLEY_ATTR_SA_LD_TYPE_SEC: 537 case OAKLEY_ATTR_SA_LD_TYPE_KB: 538 life_t = type; 539 break; 540 default: 541 life_t = OAKLEY_ATTR_SA_LD_TYPE_DEFAULT; 542 break; 543 } 544 break; 545 } 546 case OAKLEY_ATTR_SA_LD: 547 if (!prev 548 || (ntohs(prev->type) & ~ISAKMP_GEN_MASK) != 549 OAKLEY_ATTR_SA_LD_TYPE) { 550 plog(LLV_ERROR, LOCATION, NULL, 551 "life duration must follow ltype\n"); 552 break; 553 } 554 555 switch (life_t) { 556 case IPSECDOI_ATTR_SA_LD_TYPE_SEC: 557 sa->lifetime = ipsecdoi_set_ld(val); 558 vfree(val); 559 if (sa->lifetime == 0) { 560 plog(LLV_ERROR, LOCATION, NULL, 561 "invalid life duration.\n"); 562 goto err; 563 } 564 break; 565 case IPSECDOI_ATTR_SA_LD_TYPE_KB: 566 sa->lifebyte = ipsecdoi_set_ld(val); 567 vfree(val); 568 if (sa->lifebyte == 0) { 569 plog(LLV_ERROR, LOCATION, NULL, 570 "invalid life duration.\n"); 571 goto err; 572 } 573 break; 574 default: 575 vfree(val); 576 plog(LLV_ERROR, LOCATION, NULL, 577 "invalid life type: %d\n", life_t); 578 goto err; 579 } 580 break; 581 582 case OAKLEY_ATTR_KEY_LEN: 583 { 584 int len = ntohs(d->lorv); 585 if (len % 8 != 0) { 586 plog(LLV_ERROR, LOCATION, NULL, 587 "keylen %d: not multiple of 8\n", 588 len); 589 goto err; 590 } 591 sa->encklen = (u_int16_t)len; 592 keylen++; 593 break; 594 } 595 case OAKLEY_ATTR_PRF: 596 case OAKLEY_ATTR_FIELD_SIZE: 597 /* unsupported */ 598 break; 599 600 case OAKLEY_ATTR_GRP_ORDER: 601 sa->dhgrp->order = val; 602 break; 603 #ifdef HAVE_GSSAPI 604 case OAKLEY_ATTR_GSS_ID: 605 { 606 int error = -1; 607 iconv_t cd = (iconv_t) -1; 608 size_t srcleft, dstleft, rv; 609 __iconv_const char *src; 610 char *dst; 611 int len = ntohs(d->lorv); 612 613 /* 614 * Older verions of racoon just placed the 615 * ISO-Latin-1 string on the wire directly. 616 * Check to see if we are configured to be 617 * compatible with this behavior. 618 */ 619 if (lcconf->gss_id_enc == LC_GSSENC_LATIN1) { 620 if ((sa->gssid = vmalloc(len)) == NULL) { 621 plog(LLV_ERROR, LOCATION, NULL, 622 "failed to allocate memory\n"); 623 goto out; 624 } 625 memcpy(sa->gssid->v, d + 1, len); 626 plog(LLV_DEBUG, LOCATION, NULL, 627 "received old-style gss " 628 "id '%.*s' (len %zu)\n", 629 (int)sa->gssid->l, sa->gssid->v, 630 sa->gssid->l); 631 error = 0; 632 goto out; 633 } 634 635 /* 636 * For Windows 2000 compatibility, we expect 637 * the GSS ID attribute on the wire to be 638 * encoded in UTF-16LE. Internally, we work 639 * in ISO-Latin-1. Therefore, we should need 640 * 1/2 the specified length, which should always 641 * be a multiple of 2 octets. 642 */ 643 cd = iconv_open("latin1", "utf-16le"); 644 if (cd == (iconv_t) -1) { 645 plog(LLV_ERROR, LOCATION, NULL, 646 "unable to initialize utf-16le -> latin1 " 647 "conversion descriptor: %s\n", 648 strerror(errno)); 649 goto out; 650 } 651 652 if ((sa->gssid = vmalloc(len / 2)) == NULL) { 653 plog(LLV_ERROR, LOCATION, NULL, 654 "failed to allocate memory\n"); 655 goto out; 656 } 657 658 src = (__iconv_const char *)(d + 1); 659 srcleft = len; 660 661 dst = sa->gssid->v; 662 dstleft = len / 2; 663 664 rv = iconv(cd, (__iconv_const char **)&src, &srcleft, 665 &dst, &dstleft); 666 if (rv != 0) { 667 if (rv == -1) { 668 plog(LLV_ERROR, LOCATION, NULL, 669 "unable to convert GSS ID from " 670 "utf-16le -> latin1: %s\n", 671 strerror(errno)); 672 } else { 673 plog(LLV_ERROR, LOCATION, NULL, 674 "%zd character%s in GSS ID cannot " 675 "be represented in latin1\n", 676 rv, rv == 1 ? "" : "s"); 677 } 678 goto out; 679 } 680 681 /* XXX dstleft should always be 0; assert it? */ 682 sa->gssid->l = (len / 2) - dstleft; 683 684 plog(LLV_DEBUG, LOCATION, NULL, 685 "received gss id '%.*s' (len %zu)\n", 686 (int)sa->gssid->l, sa->gssid->v, sa->gssid->l); 687 688 error = 0; 689 out: 690 if (cd != (iconv_t)-1) 691 (void)iconv_close(cd); 692 693 if ((error != 0) && (sa->gssid != NULL)) { 694 vfree(sa->gssid); 695 sa->gssid = NULL; 696 } 697 break; 698 } 699 #endif /* HAVE_GSSAPI */ 700 701 default: 702 break; 703 } 704 705 prev = d; 706 if (flag) { 707 tlen -= sizeof(*d); 708 d = (struct isakmp_data *)((char *)d + sizeof(*d)); 709 } else { 710 tlen -= (sizeof(*d) + ntohs(d->lorv)); 711 d = (struct isakmp_data *)((char *)d + sizeof(*d) + ntohs(d->lorv)); 712 } 713 } 714 715 /* key length must not be specified on some algorithms */ 716 if (keylen) { 717 if (sa->enctype == OAKLEY_ATTR_ENC_ALG_DES 718 #ifdef HAVE_OPENSSL_IDEA_H 719 || sa->enctype == OAKLEY_ATTR_ENC_ALG_IDEA 720 #endif 721 || sa->enctype == OAKLEY_ATTR_ENC_ALG_3DES) { 722 plog(LLV_ERROR, LOCATION, NULL, 723 "keylen must not be specified " 724 "for encryption algorithm %d\n", 725 sa->enctype); 726 return -1; 727 } 728 } 729 730 return 0; 731 err: 732 return error; 733 } 734 735 /*%%%*/ 736 /* 737 * check phase 2 SA payload and select single proposal. 738 * make new SA payload to be replyed not including general header. 739 * This function is called by responder only. 740 * OUT: 741 * 0: succeed. 742 * -1: error occured. 743 */ 744 int 745 ipsecdoi_selectph2proposal(iph2) 746 struct ph2handle *iph2; 747 { 748 struct prop_pair **pair; 749 struct prop_pair *ret; 750 u_int32_t doitype, sittype; 751 752 /* get proposal pair */ 753 pair = get_proppair_and_doi_sit(iph2->sa, IPSECDOI_TYPE_PH2, 754 &doitype, &sittype); 755 if (pair == NULL) 756 return -1; 757 758 /* check and select a proposal. */ 759 ret = get_ph2approval(iph2, pair); 760 free_proppair(pair); 761 if (ret == NULL) 762 return -1; 763 764 /* make a SA to be replayed. */ 765 /* SPI must be updated later. */ 766 iph2->sa_ret = get_sabyproppair(doitype, sittype, ret); 767 free_proppair0(ret); 768 if (iph2->sa_ret == NULL) 769 return -1; 770 771 return 0; 772 } 773 774 /* 775 * check phase 2 SA payload returned from responder. 776 * This function is called by initiator only. 777 * OUT: 778 * 0: valid. 779 * -1: invalid. 780 */ 781 int 782 ipsecdoi_checkph2proposal(iph2) 783 struct ph2handle *iph2; 784 { 785 struct prop_pair **rpair = NULL, **spair = NULL; 786 struct prop_pair *p; 787 int i, n, num; 788 int error = -1; 789 vchar_t *sa_ret = NULL; 790 u_int32_t doitype, sittype; 791 792 /* get proposal pair of SA sent. */ 793 spair = get_proppair_and_doi_sit(iph2->sa, IPSECDOI_TYPE_PH2, 794 &doitype, &sittype); 795 if (spair == NULL) { 796 plog(LLV_ERROR, LOCATION, NULL, 797 "failed to get prop pair.\n"); 798 goto end; 799 } 800 801 /* XXX should check the number of transform */ 802 803 /* get proposal pair of SA replayed */ 804 rpair = get_proppair(iph2->sa_ret, IPSECDOI_TYPE_PH2); 805 if (rpair == NULL) { 806 plog(LLV_ERROR, LOCATION, NULL, 807 "failed to get prop pair.\n"); 808 goto end; 809 } 810 811 /* check proposal is only one ? */ 812 n = 0; 813 num = 0; 814 for (i = 0; i < MAXPROPPAIRLEN; i++) { 815 if (rpair[i]) { 816 n = i; 817 num++; 818 } 819 } 820 if (num == 0) { 821 plog(LLV_ERROR, LOCATION, NULL, 822 "no proposal received.\n"); 823 goto end; 824 } 825 if (num != 1) { 826 plog(LLV_ERROR, LOCATION, NULL, 827 "some proposals received.\n"); 828 goto end; 829 } 830 831 if (spair[n] == NULL) { 832 plog(LLV_WARNING, LOCATION, NULL, 833 "invalid proposal number:%d received.\n", i); 834 } 835 836 837 if (rpair[n]->tnext != NULL) { 838 plog(LLV_ERROR, LOCATION, NULL, 839 "multi transforms replyed.\n"); 840 goto end; 841 } 842 843 if (cmp_aproppair_i(rpair[n], spair[n])) { 844 plog(LLV_ERROR, LOCATION, NULL, 845 "proposal mismathed.\n"); 846 goto end; 847 } 848 849 /* 850 * check and select a proposal. 851 * ensure that there is no modification of the proposal by 852 * cmp_aproppair_i() 853 */ 854 p = get_ph2approval(iph2, rpair); 855 if (p == NULL) 856 goto end; 857 858 /* make a SA to be replayed. */ 859 sa_ret = iph2->sa_ret; 860 iph2->sa_ret = get_sabyproppair(doitype, sittype, p); 861 free_proppair0(p); 862 if (iph2->sa_ret == NULL) 863 goto end; 864 865 error = 0; 866 867 end: 868 if (rpair) 869 free_proppair(rpair); 870 if (spair) 871 free_proppair(spair); 872 if (sa_ret) 873 vfree(sa_ret); 874 875 return error; 876 } 877 878 /* 879 * compare two prop_pair which is assumed to have same proposal number. 880 * the case of bundle or single SA, NOT multi transforms. 881 * a: a proposal that is multi protocols and single transform, usually replyed. 882 * b: a proposal that is multi protocols and multi transform, usually sent. 883 * NOTE: this function is for initiator. 884 * OUT 885 * 0: equal 886 * 1: not equal 887 * XXX cannot understand the comment! 888 */ 889 static int 890 cmp_aproppair_i(a, b) 891 struct prop_pair *a, *b; 892 { 893 struct prop_pair *p, *q, *r; 894 int len; 895 896 for (p = a, q = b; p && q; p = p->next, q = q->next) { 897 for (r = q; r; r = r->tnext) { 898 /* compare trns */ 899 if (p->trns->t_no == r->trns->t_no) 900 break; 901 } 902 if (!r) { 903 /* no suitable transform found */ 904 plog(LLV_ERROR, LOCATION, NULL, 905 "no suitable transform found.\n"); 906 return -1; 907 } 908 909 /* compare prop */ 910 if (p->prop->p_no != r->prop->p_no) { 911 plog(LLV_WARNING, LOCATION, NULL, 912 "proposal #%d mismatched, " 913 "expected #%d.\n", 914 r->prop->p_no, p->prop->p_no); 915 /*FALLTHROUGH*/ 916 } 917 918 if (p->prop->proto_id != r->prop->proto_id) { 919 plog(LLV_ERROR, LOCATION, NULL, 920 "proto_id mismathed: my:%d peer:%d\n", 921 r->prop->proto_id, p->prop->proto_id); 922 return -1; 923 } 924 925 if (p->prop->spi_size != r->prop->spi_size) { 926 plog(LLV_ERROR, LOCATION, NULL, 927 "invalid spi size: %d.\n", 928 p->prop->spi_size); 929 return -1; 930 } 931 932 /* check #of transforms */ 933 if (p->prop->num_t != 1) { 934 plog(LLV_WARNING, LOCATION, NULL, 935 "#of transform is %d, " 936 "but expected 1.\n", p->prop->num_t); 937 /*FALLTHROUGH*/ 938 } 939 940 if (p->trns->t_id != r->trns->t_id) { 941 plog(LLV_WARNING, LOCATION, NULL, 942 "transform number has been modified.\n"); 943 /*FALLTHROUGH*/ 944 } 945 if (p->trns->reserved != r->trns->reserved) { 946 plog(LLV_WARNING, LOCATION, NULL, 947 "reserved field should be zero.\n"); 948 /*FALLTHROUGH*/ 949 } 950 951 /* compare attribute */ 952 len = ntohs(r->trns->h.len) - sizeof(*p->trns); 953 if (memcmp(p->trns + 1, r->trns + 1, len) != 0) { 954 plog(LLV_WARNING, LOCATION, NULL, 955 "attribute has been modified.\n"); 956 /*FALLTHROUGH*/ 957 } 958 } 959 if ((p && !q) || (!p && q)) { 960 /* # of protocols mismatched */ 961 plog(LLV_ERROR, LOCATION, NULL, 962 "#of protocols mismatched.\n"); 963 return -1; 964 } 965 966 return 0; 967 } 968 969 /* 970 * acceptable check for policy configuration. 971 * return a new SA payload to be reply to peer. 972 */ 973 static struct prop_pair * 974 get_ph2approval(iph2, pair) 975 struct ph2handle *iph2; 976 struct prop_pair **pair; 977 { 978 struct prop_pair *ret; 979 int i; 980 981 iph2->approval = NULL; 982 983 plog(LLV_DEBUG, LOCATION, NULL, 984 "begin compare proposals.\n"); 985 986 for (i = 0; i < MAXPROPPAIRLEN; i++) { 987 if (pair[i] == NULL) 988 continue; 989 plog(LLV_DEBUG, LOCATION, NULL, 990 "pair[%d]: %p\n", i, pair[i]); 991 print_proppair(LLV_DEBUG, pair[i]);; 992 993 /* compare proposal and select one */ 994 ret = get_ph2approvalx(iph2, pair[i]); 995 if (ret != NULL) { 996 /* found */ 997 return ret; 998 } 999 } 1000 1001 plog(LLV_ERROR, LOCATION, NULL, "no suitable policy found.\n"); 1002 1003 return NULL; 1004 } 1005 1006 /* 1007 * compare my proposal and peers just one proposal. 1008 * set a approval. 1009 */ 1010 static struct prop_pair * 1011 get_ph2approvalx(iph2, pp) 1012 struct ph2handle *iph2; 1013 struct prop_pair *pp; 1014 { 1015 struct prop_pair *ret = NULL; 1016 struct saprop *pr0, *pr = NULL; 1017 struct saprop *q1, *q2; 1018 1019 pr0 = aproppair2saprop(pp); 1020 if (pr0 == NULL) 1021 return NULL; 1022 1023 for (q1 = pr0; q1; q1 = q1->next) { 1024 for (q2 = iph2->proposal; q2; q2 = q2->next) { 1025 plog(LLV_DEBUG, LOCATION, NULL, 1026 "peer's single bundle:\n"); 1027 printsaprop0(LLV_DEBUG, q1); 1028 plog(LLV_DEBUG, LOCATION, NULL, 1029 "my single bundle:\n"); 1030 printsaprop0(LLV_DEBUG, q2); 1031 1032 pr = cmpsaprop_alloc(iph2->ph1, q1, q2, iph2->side); 1033 if (pr != NULL) 1034 goto found; 1035 1036 plog(LLV_ERROR, LOCATION, NULL, 1037 "not matched\n"); 1038 } 1039 } 1040 /* no proposal matching */ 1041 err: 1042 flushsaprop(pr0); 1043 return NULL; 1044 1045 found: 1046 flushsaprop(pr0); 1047 plog(LLV_DEBUG, LOCATION, NULL, "matched\n"); 1048 iph2->approval = pr; 1049 1050 { 1051 struct saproto *sp; 1052 struct prop_pair *p, *x; 1053 struct prop_pair *n = NULL; 1054 1055 ret = NULL; 1056 1057 for (p = pp; p; p = p->next) { 1058 /* 1059 * find a proposal with matching proto_id. 1060 * we have analyzed validity already, in cmpsaprop_alloc(). 1061 */ 1062 for (sp = pr->head; sp; sp = sp->next) { 1063 if (sp->proto_id == p->prop->proto_id) 1064 break; 1065 } 1066 if (!sp) 1067 goto err; 1068 if (sp->head->next) 1069 goto err; /* XXX */ 1070 1071 for (x = p; x; x = x->tnext) 1072 if (sp->head->trns_no == x->trns->t_no) 1073 break; 1074 if (!x) 1075 goto err; /* XXX */ 1076 1077 n = racoon_calloc(1, sizeof(struct prop_pair)); 1078 if (n == NULL) { 1079 plog(LLV_ERROR, LOCATION, NULL, 1080 "failed to get buffer.\n"); 1081 goto err; 1082 } 1083 1084 n->prop = x->prop; 1085 n->trns = x->trns; 1086 1087 /* need to preserve the order */ 1088 for (x = ret; x && x->next; x = x->next) 1089 ; 1090 if (x && x->prop == n->prop) { 1091 for (/*nothing*/; x && x->tnext; x = x->tnext) 1092 ; 1093 x->tnext = n; 1094 } else { 1095 if (x) 1096 x->next = n; 1097 else { 1098 ret = n; 1099 } 1100 } 1101 1102 /* #of transforms should be updated ? */ 1103 } 1104 } 1105 1106 return ret; 1107 } 1108 1109 void 1110 free_proppair(pair) 1111 struct prop_pair **pair; 1112 { 1113 int i; 1114 1115 for (i = 0; i < MAXPROPPAIRLEN; i++) { 1116 free_proppair0(pair[i]); 1117 pair[i] = NULL; 1118 } 1119 racoon_free(pair); 1120 } 1121 1122 static void 1123 free_proppair0(pair) 1124 struct prop_pair *pair; 1125 { 1126 struct prop_pair *p, *q, *r, *s; 1127 1128 p = pair; 1129 while (p) { 1130 q = p->next; 1131 r = p; 1132 while (r) { 1133 s = r->tnext; 1134 racoon_free(r); 1135 r = s; 1136 } 1137 p = q; 1138 } 1139 } 1140 1141 /* 1142 * get proposal pairs from SA payload. 1143 * tiny check for proposal payload. 1144 */ 1145 static struct prop_pair ** 1146 get_proppair_and_doi_sit(sa, mode, doitype, sittype) 1147 vchar_t *sa; 1148 int mode; 1149 u_int32_t *doitype, *sittype; 1150 { 1151 struct prop_pair **pair = NULL; 1152 int num_p = 0; /* number of proposal for use */ 1153 int tlen; 1154 caddr_t bp; 1155 int i; 1156 struct ipsecdoi_sa_b *sab = (struct ipsecdoi_sa_b *)sa->v; 1157 1158 plog(LLV_DEBUG, LOCATION, NULL, "total SA len=%zu\n", sa->l); 1159 plogdump(LLV_DEBUG, sa->v, sa->l); 1160 1161 /* check SA payload size */ 1162 if (sa->l < sizeof(*sab)) { 1163 plog(LLV_ERROR, LOCATION, NULL, 1164 "Invalid SA length = %zu.\n", sa->l); 1165 goto bad; 1166 } 1167 1168 /* check DOI */ 1169 if (check_doi(ntohl(sab->doi)) < 0) 1170 goto bad; 1171 if (doitype != NULL) 1172 *doitype = ntohl(sab->doi); 1173 1174 /* check SITUATION */ 1175 if (check_situation(ntohl(sab->sit)) < 0) 1176 goto bad; 1177 if (sittype != NULL) 1178 *sittype = ntohl(sab->sit); 1179 1180 pair = racoon_calloc(1, MAXPROPPAIRLEN * sizeof(*pair)); 1181 if (pair == NULL) { 1182 plog(LLV_ERROR, LOCATION, NULL, 1183 "failed to get buffer.\n"); 1184 goto bad; 1185 } 1186 memset(pair, 0, sizeof(pair)); 1187 1188 bp = (caddr_t)(sab + 1); 1189 tlen = sa->l - sizeof(*sab); 1190 1191 { 1192 struct isakmp_pl_p *prop; 1193 int proplen; 1194 vchar_t *pbuf = NULL; 1195 struct isakmp_parse_t *pa; 1196 1197 pbuf = isakmp_parsewoh(ISAKMP_NPTYPE_P, (struct isakmp_gen *)bp, tlen); 1198 if (pbuf == NULL) 1199 goto bad; 1200 1201 for (pa = (struct isakmp_parse_t *)pbuf->v; 1202 pa->type != ISAKMP_NPTYPE_NONE; 1203 pa++) { 1204 /* check the value of next payload */ 1205 if (pa->type != ISAKMP_NPTYPE_P) { 1206 plog(LLV_ERROR, LOCATION, NULL, 1207 "Invalid payload type=%u\n", pa->type); 1208 vfree(pbuf); 1209 goto bad; 1210 } 1211 1212 prop = (struct isakmp_pl_p *)pa->ptr; 1213 proplen = pa->len; 1214 1215 plog(LLV_DEBUG, LOCATION, NULL, 1216 "proposal #%u len=%d\n", prop->p_no, proplen); 1217 1218 if (proplen == 0) { 1219 plog(LLV_ERROR, LOCATION, NULL, 1220 "invalid proposal with length %d\n", proplen); 1221 vfree(pbuf); 1222 goto bad; 1223 } 1224 1225 /* check Protocol ID */ 1226 if (!check_protocol[mode]) { 1227 plog(LLV_ERROR, LOCATION, NULL, 1228 "unsupported mode %d\n", mode); 1229 continue; 1230 } 1231 1232 if (check_protocol[mode](prop->proto_id) < 0) 1233 continue; 1234 1235 /* check SPI length when IKE. */ 1236 if (check_spi_size(prop->proto_id, prop->spi_size) < 0) 1237 continue; 1238 1239 /* get transform */ 1240 if (get_transform(prop, pair, &num_p) < 0) { 1241 vfree(pbuf); 1242 goto bad; 1243 } 1244 } 1245 vfree(pbuf); 1246 pbuf = NULL; 1247 } 1248 1249 { 1250 int notrans, nprop; 1251 struct prop_pair *p, *q; 1252 1253 /* check for proposals with no transforms */ 1254 for (i = 0; i < MAXPROPPAIRLEN; i++) { 1255 if (!pair[i]) 1256 continue; 1257 1258 plog(LLV_DEBUG, LOCATION, NULL, "pair %d:\n", i); 1259 print_proppair(LLV_DEBUG, pair[i]); 1260 1261 notrans = nprop = 0; 1262 for (p = pair[i]; p; p = p->next) { 1263 if (p->trns == NULL) { 1264 notrans++; 1265 break; 1266 } 1267 for (q = p; q; q = q->tnext) 1268 nprop++; 1269 } 1270 1271 #if 0 1272 /* 1273 * XXX at this moment, we cannot accept proposal group 1274 * with multiple proposals. this should be fixed. 1275 */ 1276 if (pair[i]->next) { 1277 plog(LLV_WARNING, LOCATION, NULL, 1278 "proposal #%u ignored " 1279 "(multiple proposal not supported)\n", 1280 pair[i]->prop->p_no); 1281 notrans++; 1282 } 1283 #endif 1284 1285 if (notrans) { 1286 for (p = pair[i]; p; p = q) { 1287 q = p->next; 1288 racoon_free(p); 1289 } 1290 pair[i] = NULL; 1291 num_p--; 1292 } else { 1293 plog(LLV_DEBUG, LOCATION, NULL, 1294 "proposal #%u: %d transform\n", 1295 pair[i]->prop->p_no, nprop); 1296 } 1297 } 1298 } 1299 1300 /* bark if no proposal is found. */ 1301 if (num_p <= 0) { 1302 plog(LLV_ERROR, LOCATION, NULL, 1303 "no Proposal found.\n"); 1304 goto bad; 1305 } 1306 1307 return pair; 1308 bad: 1309 if (pair != NULL) 1310 racoon_free(pair); 1311 return NULL; 1312 } 1313 1314 struct prop_pair ** 1315 get_proppair(sa, mode) 1316 vchar_t *sa; 1317 int mode; 1318 { 1319 return get_proppair_and_doi_sit(sa, mode, NULL, NULL); 1320 } 1321 1322 1323 /* 1324 * check transform payload. 1325 * OUT: 1326 * positive: return the pointer to the payload of valid transform. 1327 * 0 : No valid transform found. 1328 */ 1329 static int 1330 get_transform(prop, pair, num_p) 1331 struct isakmp_pl_p *prop; 1332 struct prop_pair **pair; 1333 int *num_p; 1334 { 1335 int tlen; /* total length of all transform in a proposal */ 1336 caddr_t bp; 1337 struct isakmp_pl_t *trns; 1338 int trnslen; 1339 vchar_t *pbuf = NULL; 1340 struct isakmp_parse_t *pa; 1341 struct prop_pair *p = NULL, *q; 1342 int num_t; 1343 1344 bp = (caddr_t)prop + sizeof(struct isakmp_pl_p) + prop->spi_size; 1345 tlen = ntohs(prop->h.len) 1346 - (sizeof(struct isakmp_pl_p) + prop->spi_size); 1347 pbuf = isakmp_parsewoh(ISAKMP_NPTYPE_T, (struct isakmp_gen *)bp, tlen); 1348 if (pbuf == NULL) 1349 return -1; 1350 1351 /* check and get transform for use */ 1352 num_t = 0; 1353 for (pa = (struct isakmp_parse_t *)pbuf->v; 1354 pa->type != ISAKMP_NPTYPE_NONE; 1355 pa++) { 1356 1357 num_t++; 1358 1359 /* check the value of next payload */ 1360 if (pa->type != ISAKMP_NPTYPE_T) { 1361 plog(LLV_ERROR, LOCATION, NULL, 1362 "Invalid payload type=%u\n", pa->type); 1363 break; 1364 } 1365 1366 trns = (struct isakmp_pl_t *)pa->ptr; 1367 trnslen = pa->len; 1368 1369 plog(LLV_DEBUG, LOCATION, NULL, 1370 "transform #%u len=%u\n", trns->t_no, trnslen); 1371 1372 /* check transform ID */ 1373 if (prop->proto_id >= ARRAYLEN(check_transform)) { 1374 plog(LLV_WARNING, LOCATION, NULL, 1375 "unsupported proto_id %u\n", 1376 prop->proto_id); 1377 continue; 1378 } 1379 if (prop->proto_id >= ARRAYLEN(check_attributes)) { 1380 plog(LLV_WARNING, LOCATION, NULL, 1381 "unsupported proto_id %u\n", 1382 prop->proto_id); 1383 continue; 1384 } 1385 1386 if (!check_transform[prop->proto_id] 1387 || !check_attributes[prop->proto_id]) { 1388 plog(LLV_WARNING, LOCATION, NULL, 1389 "unsupported proto_id %u\n", 1390 prop->proto_id); 1391 continue; 1392 } 1393 if (check_transform[prop->proto_id](trns->t_id) < 0) 1394 continue; 1395 1396 /* check data attributes */ 1397 if (check_attributes[prop->proto_id](trns) != 0) 1398 continue; 1399 1400 p = racoon_calloc(1, sizeof(*p)); 1401 if (p == NULL) { 1402 plog(LLV_ERROR, LOCATION, NULL, 1403 "failed to get buffer.\n"); 1404 vfree(pbuf); 1405 return -1; 1406 } 1407 p->prop = prop; 1408 p->trns = trns; 1409 1410 /* need to preserve the order */ 1411 for (q = pair[prop->p_no]; q && q->next; q = q->next) 1412 ; 1413 if (q && q->prop == p->prop) { 1414 for (/*nothing*/; q && q->tnext; q = q->tnext) 1415 ; 1416 q->tnext = p; 1417 } else { 1418 if (q) 1419 q->next = p; 1420 else { 1421 pair[prop->p_no] = p; 1422 (*num_p)++; 1423 } 1424 } 1425 } 1426 1427 vfree(pbuf); 1428 1429 return 0; 1430 } 1431 1432 /* 1433 * make a new SA payload from prop_pair. 1434 * NOTE: this function make spi value clear. 1435 */ 1436 vchar_t * 1437 get_sabyproppair(doitype, sittype, pair) 1438 u_int32_t doitype, sittype; 1439 struct prop_pair *pair; 1440 { 1441 vchar_t *newsa; 1442 int newtlen; 1443 u_int8_t *np_p = NULL; 1444 struct prop_pair *p; 1445 int prophlen, trnslen; 1446 caddr_t bp; 1447 1448 newtlen = sizeof(struct ipsecdoi_sa_b); 1449 for (p = pair; p; p = p->next) { 1450 newtlen += sizeof(struct isakmp_pl_p); 1451 newtlen += p->prop->spi_size; 1452 newtlen += ntohs(p->trns->h.len); 1453 } 1454 1455 newsa = vmalloc(newtlen); 1456 if (newsa == NULL) { 1457 plog(LLV_ERROR, LOCATION, NULL, "failed to get newsa.\n"); 1458 return NULL; 1459 } 1460 bp = newsa->v; 1461 1462 ((struct isakmp_gen *)bp)->len = htons(newtlen); 1463 1464 /* update some of values in SA header */ 1465 ((struct ipsecdoi_sa_b *)bp)->doi = htonl(doitype); 1466 ((struct ipsecdoi_sa_b *)bp)->sit = htonl(sittype); 1467 bp += sizeof(struct ipsecdoi_sa_b); 1468 1469 /* create proposal payloads */ 1470 for (p = pair; p; p = p->next) { 1471 prophlen = sizeof(struct isakmp_pl_p) 1472 + p->prop->spi_size; 1473 trnslen = ntohs(p->trns->h.len); 1474 1475 if (np_p) 1476 *np_p = ISAKMP_NPTYPE_P; 1477 1478 /* create proposal */ 1479 1480 memcpy(bp, p->prop, prophlen); 1481 ((struct isakmp_pl_p *)bp)->h.np = ISAKMP_NPTYPE_NONE; 1482 ((struct isakmp_pl_p *)bp)->h.len = htons(prophlen + trnslen); 1483 ((struct isakmp_pl_p *)bp)->num_t = 1; 1484 np_p = &((struct isakmp_pl_p *)bp)->h.np; 1485 memset(bp + sizeof(struct isakmp_pl_p), 0, p->prop->spi_size); 1486 bp += prophlen; 1487 1488 /* create transform */ 1489 memcpy(bp, p->trns, trnslen); 1490 ((struct isakmp_pl_t *)bp)->h.np = ISAKMP_NPTYPE_NONE; 1491 ((struct isakmp_pl_t *)bp)->h.len = htons(trnslen); 1492 bp += trnslen; 1493 } 1494 1495 return newsa; 1496 } 1497 1498 /* 1499 * update responder's spi 1500 */ 1501 int 1502 ipsecdoi_updatespi(iph2) 1503 struct ph2handle *iph2; 1504 { 1505 struct prop_pair **pair, *p; 1506 struct saprop *pp; 1507 struct saproto *pr; 1508 int i; 1509 int error = -1; 1510 u_int8_t *spi; 1511 1512 pair = get_proppair(iph2->sa_ret, IPSECDOI_TYPE_PH2); 1513 if (pair == NULL) 1514 return -1; 1515 for (i = 0; i < MAXPROPPAIRLEN; i++) { 1516 if (pair[i]) 1517 break; 1518 } 1519 if (i == MAXPROPPAIRLEN || pair[i]->tnext) { 1520 /* multiple transform must be filtered by selectph2proposal.*/ 1521 goto end; 1522 } 1523 1524 pp = iph2->approval; 1525 1526 /* create proposal payloads */ 1527 for (p = pair[i]; p; p = p->next) { 1528 /* 1529 * find a proposal/transform with matching proto_id/t_id. 1530 * we have analyzed validity already, in cmpsaprop_alloc(). 1531 */ 1532 for (pr = pp->head; pr; pr = pr->next) { 1533 if (p->prop->proto_id == pr->proto_id && 1534 p->trns->t_id == pr->head->trns_id) { 1535 break; 1536 } 1537 } 1538 if (!pr) 1539 goto end; 1540 1541 /* 1542 * XXX SPI bits are left-filled, for use with IPComp. 1543 * we should be switching to variable-length spi field... 1544 */ 1545 spi = (u_int8_t *)&pr->spi; 1546 spi += sizeof(pr->spi); 1547 spi -= pr->spisize; 1548 memcpy((caddr_t)p->prop + sizeof(*p->prop), spi, pr->spisize); 1549 } 1550 1551 error = 0; 1552 end: 1553 free_proppair(pair); 1554 return error; 1555 } 1556 1557 /* 1558 * make a new SA payload from prop_pair. 1559 */ 1560 vchar_t * 1561 get_sabysaprop(pp0, sa0) 1562 struct saprop *pp0; 1563 vchar_t *sa0; 1564 { 1565 struct prop_pair **pair = NULL; 1566 vchar_t *newsa = NULL; 1567 int newtlen; 1568 u_int8_t *np_p = NULL; 1569 struct prop_pair *p = NULL; 1570 struct saprop *pp; 1571 struct saproto *pr; 1572 struct satrns *tr; 1573 int prophlen, trnslen; 1574 caddr_t bp; 1575 int error = -1; 1576 1577 /* get proposal pair */ 1578 pair = get_proppair(sa0, IPSECDOI_TYPE_PH2); 1579 if (pair == NULL) 1580 goto out; 1581 1582 newtlen = sizeof(struct ipsecdoi_sa_b); 1583 for (pp = pp0; pp; pp = pp->next) { 1584 1585 if (pair[pp->prop_no] == NULL) 1586 goto out; 1587 1588 for (pr = pp->head; pr; pr = pr->next) { 1589 newtlen += (sizeof(struct isakmp_pl_p) 1590 + pr->spisize); 1591 1592 for (tr = pr->head; tr; tr = tr->next) { 1593 for (p = pair[pp->prop_no]; p; p = p->tnext) { 1594 if (tr->trns_no == p->trns->t_no) 1595 break; 1596 } 1597 if (p == NULL) 1598 goto out; 1599 1600 newtlen += ntohs(p->trns->h.len); 1601 } 1602 } 1603 } 1604 1605 newsa = vmalloc(newtlen); 1606 if (newsa == NULL) { 1607 plog(LLV_ERROR, LOCATION, NULL, "failed to get newsa.\n"); 1608 goto out; 1609 } 1610 bp = newsa->v; 1611 1612 /* some of values of SA must be updated in the out of this function */ 1613 ((struct isakmp_gen *)bp)->len = htons(newtlen); 1614 bp += sizeof(struct ipsecdoi_sa_b); 1615 1616 /* create proposal payloads */ 1617 for (pp = pp0; pp; pp = pp->next) { 1618 1619 for (pr = pp->head; pr; pr = pr->next) { 1620 prophlen = sizeof(struct isakmp_pl_p) 1621 + p->prop->spi_size; 1622 1623 for (tr = pr->head; tr; tr = tr->next) { 1624 for (p = pair[pp->prop_no]; p; p = p->tnext) { 1625 if (tr->trns_no == p->trns->t_no) 1626 break; 1627 } 1628 if (p == NULL) 1629 goto out; 1630 1631 trnslen = ntohs(p->trns->h.len); 1632 1633 if (np_p) 1634 *np_p = ISAKMP_NPTYPE_P; 1635 1636 /* create proposal */ 1637 1638 memcpy(bp, p->prop, prophlen); 1639 ((struct isakmp_pl_p *)bp)->h.np = ISAKMP_NPTYPE_NONE; 1640 ((struct isakmp_pl_p *)bp)->h.len = htons(prophlen + trnslen); 1641 ((struct isakmp_pl_p *)bp)->num_t = 1; 1642 np_p = &((struct isakmp_pl_p *)bp)->h.np; 1643 bp += prophlen; 1644 1645 /* create transform */ 1646 memcpy(bp, p->trns, trnslen); 1647 ((struct isakmp_pl_t *)bp)->h.np = ISAKMP_NPTYPE_NONE; 1648 ((struct isakmp_pl_t *)bp)->h.len = htons(trnslen); 1649 bp += trnslen; 1650 } 1651 } 1652 } 1653 1654 error = 0; 1655 out: 1656 if (pair != NULL) 1657 racoon_free(pair); 1658 1659 if (error != 0) { 1660 if (newsa != NULL) { 1661 vfree(newsa); 1662 newsa = NULL; 1663 } 1664 } 1665 1666 return newsa; 1667 } 1668 1669 /* 1670 * If some error happens then return 0. Although 0 means that lifetime is zero, 1671 * such a value should not be accepted. 1672 * Also 0 of lifebyte should not be included in a packet although 0 means not 1673 * to care of it. 1674 */ 1675 static u_int32_t 1676 ipsecdoi_set_ld(buf) 1677 vchar_t *buf; 1678 { 1679 u_int32_t ld; 1680 1681 if (buf == 0) 1682 return 0; 1683 1684 switch (buf->l) { 1685 case 2: 1686 ld = ntohs(*(u_int16_t *)buf->v); 1687 break; 1688 case 4: 1689 ld = ntohl(*(u_int32_t *)buf->v); 1690 break; 1691 default: 1692 plog(LLV_ERROR, LOCATION, NULL, 1693 "length %zu of life duration " 1694 "isn't supported.\n", buf->l); 1695 return 0; 1696 } 1697 1698 return ld; 1699 } 1700 1701 /* 1702 * parse responder-lifetime attributes from payload 1703 */ 1704 int 1705 ipsecdoi_parse_responder_lifetime(notify, lifetime_sec, lifetime_kb) 1706 struct isakmp_pl_n *notify; 1707 u_int32_t *lifetime_sec; 1708 u_int32_t *lifetime_kb; 1709 { 1710 struct isakmp_data *d; 1711 int flag, type, tlen, ld_type = -1; 1712 u_int16_t lorv; 1713 u_int32_t value; 1714 1715 tlen = ntohs(notify->h.len) - sizeof(*notify) - notify->spi_size; 1716 d = (struct isakmp_data *)((char *)(notify + 1) + 1717 notify->spi_size); 1718 1719 while (tlen >= sizeof(struct isakmp_data)) { 1720 type = ntohs(d->type) & ~ISAKMP_GEN_MASK; 1721 flag = ntohs(d->type) & ISAKMP_GEN_MASK; 1722 lorv = ntohs(d->lorv); 1723 1724 plog(LLV_DEBUG, LOCATION, NULL, 1725 "type=%s, flag=0x%04x, lorv=%s\n", 1726 s_ipsecdoi_attr(type), flag, 1727 s_ipsecdoi_attr_v(type, lorv)); 1728 1729 switch (type) { 1730 case IPSECDOI_ATTR_SA_LD_TYPE: 1731 if (! flag) { 1732 plog(LLV_ERROR, LOCATION, NULL, 1733 "must be TV when LD_TYPE.\n"); 1734 return -1; 1735 } 1736 ld_type = lorv; 1737 break; 1738 case IPSECDOI_ATTR_SA_LD: 1739 if (flag) 1740 value = lorv; 1741 else if (lorv == 2) 1742 value = ntohs(*(u_int16_t *)(d + 1)); 1743 else if (lorv == 4) 1744 value = ntohl(*(u_int32_t *)(d + 1)); 1745 else { 1746 plog(LLV_ERROR, LOCATION, NULL, 1747 "payload length %d for lifetime " 1748 "data length is unsupported.\n", lorv); 1749 return -1; 1750 } 1751 1752 switch (ld_type) { 1753 case IPSECDOI_ATTR_SA_LD_TYPE_SEC: 1754 if (lifetime_sec != NULL) 1755 *lifetime_sec = value; 1756 plog(LLV_INFO, LOCATION, NULL, 1757 "received RESPONDER-LIFETIME: %d " 1758 "seconds\n", value); 1759 break; 1760 case IPSECDOI_ATTR_SA_LD_TYPE_KB: 1761 if (lifetime_kb != NULL) 1762 *lifetime_kb = value; 1763 plog(LLV_INFO, LOCATION, NULL, 1764 "received RESPONDER-LIFETIME: %d " 1765 "kbytes\n", value); 1766 break; 1767 default: 1768 plog(LLV_ERROR, LOCATION, NULL, 1769 "lifetime data received without " 1770 "lifetime data type.\n"); 1771 return -1; 1772 } 1773 break; 1774 } 1775 1776 if (flag) { 1777 tlen -= sizeof(*d); 1778 d = (struct isakmp_data *)((char *)d 1779 + sizeof(*d)); 1780 } else { 1781 tlen -= (sizeof(*d) + lorv); 1782 d = (struct isakmp_data *)((char *)d 1783 + sizeof(*d) + lorv); 1784 } 1785 } 1786 1787 return 0; 1788 } 1789 1790 1791 /*%%%*/ 1792 /* 1793 * check DOI 1794 */ 1795 static int 1796 check_doi(doi) 1797 u_int32_t doi; 1798 { 1799 switch (doi) { 1800 case IPSEC_DOI: 1801 return 0; 1802 default: 1803 plog(LLV_ERROR, LOCATION, NULL, 1804 "invalid value of DOI 0x%08x.\n", doi); 1805 return -1; 1806 } 1807 /* NOT REACHED */ 1808 } 1809 1810 /* 1811 * check situation 1812 */ 1813 static int 1814 check_situation(sit) 1815 u_int32_t sit; 1816 { 1817 switch (sit) { 1818 case IPSECDOI_SIT_IDENTITY_ONLY: 1819 return 0; 1820 1821 case IPSECDOI_SIT_SECRECY: 1822 case IPSECDOI_SIT_INTEGRITY: 1823 plog(LLV_ERROR, LOCATION, NULL, 1824 "situation 0x%08x unsupported yet.\n", sit); 1825 return -1; 1826 1827 default: 1828 plog(LLV_ERROR, LOCATION, NULL, 1829 "invalid situation 0x%08x.\n", sit); 1830 return -1; 1831 } 1832 /* NOT REACHED */ 1833 } 1834 1835 /* 1836 * check protocol id in main mode 1837 */ 1838 static int 1839 check_prot_main(proto_id) 1840 int proto_id; 1841 { 1842 switch (proto_id) { 1843 case IPSECDOI_PROTO_ISAKMP: 1844 return 0; 1845 1846 default: 1847 plog(LLV_ERROR, LOCATION, NULL, 1848 "Illegal protocol id=%u.\n", proto_id); 1849 return -1; 1850 } 1851 /* NOT REACHED */ 1852 } 1853 1854 /* 1855 * check protocol id in quick mode 1856 */ 1857 static int 1858 check_prot_quick(proto_id) 1859 int proto_id; 1860 { 1861 switch (proto_id) { 1862 case IPSECDOI_PROTO_IPSEC_AH: 1863 case IPSECDOI_PROTO_IPSEC_ESP: 1864 return 0; 1865 1866 case IPSECDOI_PROTO_IPCOMP: 1867 return 0; 1868 1869 default: 1870 plog(LLV_ERROR, LOCATION, NULL, 1871 "invalid protocol id %d.\n", proto_id); 1872 return -1; 1873 } 1874 /* NOT REACHED */ 1875 } 1876 1877 static int 1878 check_spi_size(proto_id, size) 1879 int proto_id, size; 1880 { 1881 switch (proto_id) { 1882 case IPSECDOI_PROTO_ISAKMP: 1883 if (size != 0) { 1884 /* WARNING */ 1885 plog(LLV_WARNING, LOCATION, NULL, 1886 "SPI size isn't zero, but IKE proposal.\n"); 1887 } 1888 return 0; 1889 1890 case IPSECDOI_PROTO_IPSEC_AH: 1891 case IPSECDOI_PROTO_IPSEC_ESP: 1892 if (size != 4) { 1893 plog(LLV_ERROR, LOCATION, NULL, 1894 "invalid SPI size=%d for IPSEC proposal.\n", 1895 size); 1896 return -1; 1897 } 1898 return 0; 1899 1900 case IPSECDOI_PROTO_IPCOMP: 1901 if (size != 2 && size != 4) { 1902 plog(LLV_ERROR, LOCATION, NULL, 1903 "invalid SPI size=%d for IPCOMP proposal.\n", 1904 size); 1905 return -1; 1906 } 1907 return 0; 1908 1909 default: 1910 /* ??? */ 1911 return -1; 1912 } 1913 /* NOT REACHED */ 1914 } 1915 1916 /* 1917 * check transform ID in ISAKMP. 1918 */ 1919 static int 1920 check_trns_isakmp(t_id) 1921 int t_id; 1922 { 1923 switch (t_id) { 1924 case IPSECDOI_KEY_IKE: 1925 return 0; 1926 default: 1927 plog(LLV_ERROR, LOCATION, NULL, 1928 "invalid transform-id=%u in proto_id=%u.\n", 1929 t_id, IPSECDOI_KEY_IKE); 1930 return -1; 1931 } 1932 /* NOT REACHED */ 1933 } 1934 1935 /* 1936 * check transform ID in AH. 1937 */ 1938 static int 1939 check_trns_ah(t_id) 1940 int t_id; 1941 { 1942 switch (t_id) { 1943 case IPSECDOI_AH_MD5: 1944 case IPSECDOI_AH_SHA: 1945 case IPSECDOI_AH_SHA256: 1946 case IPSECDOI_AH_SHA384: 1947 case IPSECDOI_AH_SHA512: 1948 return 0; 1949 case IPSECDOI_AH_DES: 1950 plog(LLV_ERROR, LOCATION, NULL, 1951 "not support transform-id=%u in AH.\n", t_id); 1952 return -1; 1953 default: 1954 plog(LLV_ERROR, LOCATION, NULL, 1955 "invalid transform-id=%u in AH.\n", t_id); 1956 return -1; 1957 } 1958 /* NOT REACHED */ 1959 } 1960 1961 /* 1962 * check transform ID in ESP. 1963 */ 1964 static int 1965 check_trns_esp(t_id) 1966 int t_id; 1967 { 1968 switch (t_id) { 1969 case IPSECDOI_ESP_DES: 1970 case IPSECDOI_ESP_3DES: 1971 case IPSECDOI_ESP_NULL: 1972 case IPSECDOI_ESP_RC5: 1973 case IPSECDOI_ESP_CAST: 1974 case IPSECDOI_ESP_BLOWFISH: 1975 case IPSECDOI_ESP_AES: 1976 case IPSECDOI_ESP_TWOFISH: 1977 case IPSECDOI_ESP_CAMELLIA: 1978 return 0; 1979 case IPSECDOI_ESP_DES_IV32: 1980 case IPSECDOI_ESP_DES_IV64: 1981 case IPSECDOI_ESP_IDEA: 1982 case IPSECDOI_ESP_3IDEA: 1983 case IPSECDOI_ESP_RC4: 1984 plog(LLV_ERROR, LOCATION, NULL, 1985 "not support transform-id=%u in ESP.\n", t_id); 1986 return -1; 1987 default: 1988 plog(LLV_ERROR, LOCATION, NULL, 1989 "invalid transform-id=%u in ESP.\n", t_id); 1990 return -1; 1991 } 1992 /* NOT REACHED */ 1993 } 1994 1995 /* 1996 * check transform ID in IPCOMP. 1997 */ 1998 static int 1999 check_trns_ipcomp(t_id) 2000 int t_id; 2001 { 2002 switch (t_id) { 2003 case IPSECDOI_IPCOMP_OUI: 2004 case IPSECDOI_IPCOMP_DEFLATE: 2005 case IPSECDOI_IPCOMP_LZS: 2006 return 0; 2007 default: 2008 plog(LLV_ERROR, LOCATION, NULL, 2009 "invalid transform-id=%u in IPCOMP.\n", t_id); 2010 return -1; 2011 } 2012 /* NOT REACHED */ 2013 } 2014 2015 /* 2016 * check data attributes in IKE. 2017 */ 2018 static int 2019 check_attr_isakmp(trns) 2020 struct isakmp_pl_t *trns; 2021 { 2022 struct isakmp_data *d; 2023 int tlen; 2024 int flag, type; 2025 u_int16_t lorv; 2026 2027 tlen = ntohs(trns->h.len) - sizeof(struct isakmp_pl_t); 2028 d = (struct isakmp_data *)((caddr_t)trns + sizeof(struct isakmp_pl_t)); 2029 2030 while (tlen > 0) { 2031 type = ntohs(d->type) & ~ISAKMP_GEN_MASK; 2032 flag = ntohs(d->type) & ISAKMP_GEN_MASK; 2033 lorv = ntohs(d->lorv); 2034 2035 plog(LLV_DEBUG, LOCATION, NULL, 2036 "type=%s, flag=0x%04x, lorv=%s\n", 2037 s_oakley_attr(type), flag, 2038 s_oakley_attr_v(type, lorv)); 2039 2040 /* 2041 * some of the attributes must be encoded in TV. 2042 * see RFC2409 Appendix A "Attribute Classes". 2043 */ 2044 switch (type) { 2045 case OAKLEY_ATTR_ENC_ALG: 2046 case OAKLEY_ATTR_HASH_ALG: 2047 case OAKLEY_ATTR_AUTH_METHOD: 2048 case OAKLEY_ATTR_GRP_DESC: 2049 case OAKLEY_ATTR_GRP_TYPE: 2050 case OAKLEY_ATTR_SA_LD_TYPE: 2051 case OAKLEY_ATTR_PRF: 2052 case OAKLEY_ATTR_KEY_LEN: 2053 case OAKLEY_ATTR_FIELD_SIZE: 2054 if (!flag) { /* TLV*/ 2055 plog(LLV_ERROR, LOCATION, NULL, 2056 "oakley attribute %d must be TV.\n", 2057 type); 2058 return -1; 2059 } 2060 break; 2061 } 2062 2063 /* sanity check for TLV. length must be specified. */ 2064 if (!flag && lorv == 0) { /*TLV*/ 2065 plog(LLV_ERROR, LOCATION, NULL, 2066 "invalid length %d for TLV attribute %d.\n", 2067 lorv, type); 2068 return -1; 2069 } 2070 2071 switch (type) { 2072 case OAKLEY_ATTR_ENC_ALG: 2073 if (!alg_oakley_encdef_ok(lorv)) { 2074 plog(LLV_ERROR, LOCATION, NULL, 2075 "invalied encryption algorithm=%d.\n", 2076 lorv); 2077 return -1; 2078 } 2079 break; 2080 2081 case OAKLEY_ATTR_HASH_ALG: 2082 if (!alg_oakley_hashdef_ok(lorv)) { 2083 plog(LLV_ERROR, LOCATION, NULL, 2084 "invalied hash algorithm=%d.\n", 2085 lorv); 2086 return -1; 2087 } 2088 break; 2089 2090 case OAKLEY_ATTR_AUTH_METHOD: 2091 switch (lorv) { 2092 case OAKLEY_ATTR_AUTH_METHOD_PSKEY: 2093 case OAKLEY_ATTR_AUTH_METHOD_RSASIG: 2094 #ifdef ENABLE_HYBRID 2095 case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I: 2096 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I: 2097 #endif 2098 #if defined(ENABLE_HYBRID) || defined(HAVE_GSSAPI) 2099 /* These two authentication method IDs overlap. */ 2100 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I: 2101 /*case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB:*/ 2102 #endif 2103 break; 2104 case OAKLEY_ATTR_AUTH_METHOD_DSSSIG: 2105 #ifdef ENABLE_HYBRID 2106 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R: 2107 case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R: 2108 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R: 2109 case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I: 2110 case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R: 2111 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I: 2112 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R: 2113 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I: 2114 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R: 2115 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I: 2116 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R: 2117 #endif 2118 case OAKLEY_ATTR_AUTH_METHOD_RSAENC: 2119 case OAKLEY_ATTR_AUTH_METHOD_RSAREV: 2120 plog(LLV_ERROR, LOCATION, NULL, 2121 "auth method %s isn't supported.\n", 2122 s_oakley_attr_method(lorv)); 2123 return -1; 2124 default: 2125 plog(LLV_ERROR, LOCATION, NULL, 2126 "invalid auth method %d.\n", 2127 lorv); 2128 return -1; 2129 } 2130 break; 2131 2132 case OAKLEY_ATTR_GRP_DESC: 2133 if (!alg_oakley_dhdef_ok(lorv)) { 2134 plog(LLV_ERROR, LOCATION, NULL, 2135 "invalid DH group %d.\n", 2136 lorv); 2137 return -1; 2138 } 2139 break; 2140 2141 case OAKLEY_ATTR_GRP_TYPE: 2142 switch (lorv) { 2143 case OAKLEY_ATTR_GRP_TYPE_MODP: 2144 break; 2145 default: 2146 plog(LLV_ERROR, LOCATION, NULL, 2147 "unsupported DH group type %d.\n", 2148 lorv); 2149 return -1; 2150 } 2151 break; 2152 2153 case OAKLEY_ATTR_GRP_PI: 2154 case OAKLEY_ATTR_GRP_GEN_ONE: 2155 /* sanity checks? */ 2156 break; 2157 2158 case OAKLEY_ATTR_GRP_GEN_TWO: 2159 case OAKLEY_ATTR_GRP_CURVE_A: 2160 case OAKLEY_ATTR_GRP_CURVE_B: 2161 plog(LLV_ERROR, LOCATION, NULL, 2162 "attr type=%u isn't supported.\n", type); 2163 return -1; 2164 2165 case OAKLEY_ATTR_SA_LD_TYPE: 2166 switch (lorv) { 2167 case OAKLEY_ATTR_SA_LD_TYPE_SEC: 2168 case OAKLEY_ATTR_SA_LD_TYPE_KB: 2169 break; 2170 default: 2171 plog(LLV_ERROR, LOCATION, NULL, 2172 "invalid life type %d.\n", lorv); 2173 return -1; 2174 } 2175 break; 2176 2177 case OAKLEY_ATTR_SA_LD: 2178 /* should check the value */ 2179 break; 2180 2181 case OAKLEY_ATTR_PRF: 2182 case OAKLEY_ATTR_KEY_LEN: 2183 break; 2184 2185 case OAKLEY_ATTR_FIELD_SIZE: 2186 plog(LLV_ERROR, LOCATION, NULL, 2187 "attr type=%u isn't supported.\n", type); 2188 return -1; 2189 2190 case OAKLEY_ATTR_GRP_ORDER: 2191 break; 2192 2193 case OAKLEY_ATTR_GSS_ID: 2194 break; 2195 2196 default: 2197 plog(LLV_ERROR, LOCATION, NULL, 2198 "invalid attribute type %d.\n", type); 2199 return -1; 2200 } 2201 2202 if (flag) { 2203 tlen -= sizeof(*d); 2204 d = (struct isakmp_data *)((char *)d 2205 + sizeof(*d)); 2206 } else { 2207 tlen -= (sizeof(*d) + lorv); 2208 d = (struct isakmp_data *)((char *)d 2209 + sizeof(*d) + lorv); 2210 } 2211 } 2212 2213 return 0; 2214 } 2215 2216 /* 2217 * check data attributes in IPSEC AH/ESP. 2218 */ 2219 static int 2220 check_attr_ah(trns) 2221 struct isakmp_pl_t *trns; 2222 { 2223 return check_attr_ipsec(IPSECDOI_PROTO_IPSEC_AH, trns); 2224 } 2225 2226 static int 2227 check_attr_esp(trns) 2228 struct isakmp_pl_t *trns; 2229 { 2230 return check_attr_ipsec(IPSECDOI_PROTO_IPSEC_ESP, trns); 2231 } 2232 2233 static int 2234 check_attr_ipsec(proto_id, trns) 2235 int proto_id; 2236 struct isakmp_pl_t *trns; 2237 { 2238 struct isakmp_data *d; 2239 int tlen; 2240 int flag, type = 0; 2241 u_int16_t lorv; 2242 int attrseen[16]; /* XXX magic number */ 2243 2244 tlen = ntohs(trns->h.len) - sizeof(struct isakmp_pl_t); 2245 d = (struct isakmp_data *)((caddr_t)trns + sizeof(struct isakmp_pl_t)); 2246 memset(attrseen, 0, sizeof(attrseen)); 2247 2248 while (tlen > 0) { 2249 type = ntohs(d->type) & ~ISAKMP_GEN_MASK; 2250 flag = ntohs(d->type) & ISAKMP_GEN_MASK; 2251 lorv = ntohs(d->lorv); 2252 2253 plog(LLV_DEBUG, LOCATION, NULL, 2254 "type=%s, flag=0x%04x, lorv=%s\n", 2255 s_ipsecdoi_attr(type), flag, 2256 s_ipsecdoi_attr_v(type, lorv)); 2257 2258 if (type < sizeof(attrseen)/sizeof(attrseen[0])) 2259 attrseen[type]++; 2260 2261 switch (type) { 2262 case IPSECDOI_ATTR_ENC_MODE: 2263 if (! flag) { 2264 plog(LLV_ERROR, LOCATION, NULL, 2265 "must be TV when ENC_MODE.\n"); 2266 return -1; 2267 } 2268 2269 switch (lorv) { 2270 case IPSECDOI_ATTR_ENC_MODE_TUNNEL: 2271 case IPSECDOI_ATTR_ENC_MODE_TRNS: 2272 break; 2273 #ifdef ENABLE_NATT 2274 case IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC: 2275 case IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC: 2276 case IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT: 2277 case IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT: 2278 plog(LLV_DEBUG, LOCATION, NULL, 2279 "UDP encapsulation requested\n"); 2280 break; 2281 #endif 2282 default: 2283 plog(LLV_ERROR, LOCATION, NULL, 2284 "invalid encryption mode=%u.\n", 2285 lorv); 2286 return -1; 2287 } 2288 break; 2289 2290 case IPSECDOI_ATTR_AUTH: 2291 if (! flag) { 2292 plog(LLV_ERROR, LOCATION, NULL, 2293 "must be TV when AUTH.\n"); 2294 return -1; 2295 } 2296 2297 switch (lorv) { 2298 case IPSECDOI_ATTR_AUTH_HMAC_MD5: 2299 if (proto_id == IPSECDOI_PROTO_IPSEC_AH && 2300 trns->t_id != IPSECDOI_AH_MD5) { 2301 ahmismatch: 2302 plog(LLV_ERROR, LOCATION, NULL, 2303 "auth algorithm %u conflicts " 2304 "with transform %u.\n", 2305 lorv, trns->t_id); 2306 return -1; 2307 } 2308 break; 2309 case IPSECDOI_ATTR_AUTH_HMAC_SHA1: 2310 if (proto_id == IPSECDOI_PROTO_IPSEC_AH) { 2311 if (trns->t_id != IPSECDOI_AH_SHA) 2312 goto ahmismatch; 2313 } 2314 break; 2315 case IPSECDOI_ATTR_AUTH_HMAC_SHA2_256: 2316 if (proto_id == IPSECDOI_PROTO_IPSEC_AH) { 2317 if (trns->t_id != IPSECDOI_AH_SHA256) 2318 goto ahmismatch; 2319 } 2320 break; 2321 case IPSECDOI_ATTR_AUTH_HMAC_SHA2_384: 2322 if (proto_id == IPSECDOI_PROTO_IPSEC_AH) { 2323 if (trns->t_id != IPSECDOI_AH_SHA384) 2324 goto ahmismatch; 2325 } 2326 break; 2327 case IPSECDOI_ATTR_AUTH_HMAC_SHA2_512: 2328 if (proto_id == IPSECDOI_PROTO_IPSEC_AH) { 2329 if (trns->t_id != IPSECDOI_AH_SHA512) 2330 goto ahmismatch; 2331 } 2332 break; 2333 case IPSECDOI_ATTR_AUTH_DES_MAC: 2334 case IPSECDOI_ATTR_AUTH_KPDK: 2335 plog(LLV_ERROR, LOCATION, NULL, 2336 "auth algorithm %u isn't supported.\n", 2337 lorv); 2338 return -1; 2339 default: 2340 plog(LLV_ERROR, LOCATION, NULL, 2341 "invalid auth algorithm=%u.\n", 2342 lorv); 2343 return -1; 2344 } 2345 break; 2346 2347 case IPSECDOI_ATTR_SA_LD_TYPE: 2348 if (! flag) { 2349 plog(LLV_ERROR, LOCATION, NULL, 2350 "must be TV when LD_TYPE.\n"); 2351 return -1; 2352 } 2353 2354 switch (lorv) { 2355 case IPSECDOI_ATTR_SA_LD_TYPE_SEC: 2356 case IPSECDOI_ATTR_SA_LD_TYPE_KB: 2357 break; 2358 default: 2359 plog(LLV_ERROR, LOCATION, NULL, 2360 "invalid life type %d.\n", lorv); 2361 return -1; 2362 } 2363 break; 2364 2365 case IPSECDOI_ATTR_SA_LD: 2366 if (flag) { 2367 /* i.e. ISAKMP_GEN_TV */ 2368 plog(LLV_DEBUG, LOCATION, NULL, 2369 "life duration was in TLV.\n"); 2370 } else { 2371 /* i.e. ISAKMP_GEN_TLV */ 2372 if (lorv == 0) { 2373 plog(LLV_ERROR, LOCATION, NULL, 2374 "invalid length of LD\n"); 2375 return -1; 2376 } 2377 } 2378 break; 2379 2380 case IPSECDOI_ATTR_GRP_DESC: 2381 if (! flag) { 2382 plog(LLV_ERROR, LOCATION, NULL, 2383 "must be TV when GRP_DESC.\n"); 2384 return -1; 2385 } 2386 2387 if (!alg_oakley_dhdef_ok(lorv)) { 2388 plog(LLV_ERROR, LOCATION, NULL, 2389 "invalid group description=%u.\n", 2390 lorv); 2391 return -1; 2392 } 2393 break; 2394 2395 case IPSECDOI_ATTR_KEY_LENGTH: 2396 if (! flag) { 2397 plog(LLV_ERROR, LOCATION, NULL, 2398 "must be TV when KEY_LENGTH.\n"); 2399 return -1; 2400 } 2401 break; 2402 2403 #ifdef HAVE_SECCTX 2404 case IPSECDOI_ATTR_SECCTX: 2405 if (flag) { 2406 plog(LLV_ERROR, LOCATION, NULL, 2407 "SECCTX must be in TLV.\n"); 2408 return -1; 2409 } 2410 break; 2411 #endif 2412 2413 case IPSECDOI_ATTR_KEY_ROUNDS: 2414 case IPSECDOI_ATTR_COMP_DICT_SIZE: 2415 case IPSECDOI_ATTR_COMP_PRIVALG: 2416 plog(LLV_ERROR, LOCATION, NULL, 2417 "attr type=%u isn't supported.\n", type); 2418 return -1; 2419 2420 default: 2421 plog(LLV_ERROR, LOCATION, NULL, 2422 "invalid attribute type %d.\n", type); 2423 return -1; 2424 } 2425 2426 if (flag) { 2427 tlen -= sizeof(*d); 2428 d = (struct isakmp_data *)((char *)d 2429 + sizeof(*d)); 2430 } else { 2431 tlen -= (sizeof(*d) + lorv); 2432 d = (struct isakmp_data *)((caddr_t)d 2433 + sizeof(*d) + lorv); 2434 } 2435 } 2436 2437 if (proto_id == IPSECDOI_PROTO_IPSEC_AH && 2438 !attrseen[IPSECDOI_ATTR_AUTH]) { 2439 plog(LLV_ERROR, LOCATION, NULL, 2440 "attr AUTH must be present for AH.\n"); 2441 return -1; 2442 } 2443 2444 if (proto_id == IPSECDOI_PROTO_IPSEC_ESP && 2445 trns->t_id == IPSECDOI_ESP_NULL && 2446 !attrseen[IPSECDOI_ATTR_AUTH]) { 2447 plog(LLV_ERROR, LOCATION, NULL, 2448 "attr AUTH must be present for ESP NULL encryption.\n"); 2449 return -1; 2450 } 2451 2452 return 0; 2453 } 2454 2455 static int 2456 check_attr_ipcomp(trns) 2457 struct isakmp_pl_t *trns; 2458 { 2459 struct isakmp_data *d; 2460 int tlen; 2461 int flag, type = 0; 2462 u_int16_t lorv; 2463 int attrseen[16]; /* XXX magic number */ 2464 2465 tlen = ntohs(trns->h.len) - sizeof(struct isakmp_pl_t); 2466 d = (struct isakmp_data *)((caddr_t)trns + sizeof(struct isakmp_pl_t)); 2467 memset(attrseen, 0, sizeof(attrseen)); 2468 2469 while (tlen > 0) { 2470 type = ntohs(d->type) & ~ISAKMP_GEN_MASK; 2471 flag = ntohs(d->type) & ISAKMP_GEN_MASK; 2472 lorv = ntohs(d->lorv); 2473 2474 plog(LLV_DEBUG, LOCATION, NULL, 2475 "type=%d, flag=0x%04x, lorv=0x%04x\n", 2476 type, flag, lorv); 2477 2478 if (type < sizeof(attrseen)/sizeof(attrseen[0])) 2479 attrseen[type]++; 2480 2481 switch (type) { 2482 case IPSECDOI_ATTR_ENC_MODE: 2483 if (! flag) { 2484 plog(LLV_ERROR, LOCATION, NULL, 2485 "must be TV when ENC_MODE.\n"); 2486 return -1; 2487 } 2488 2489 switch (lorv) { 2490 case IPSECDOI_ATTR_ENC_MODE_TUNNEL: 2491 case IPSECDOI_ATTR_ENC_MODE_TRNS: 2492 break; 2493 #ifdef ENABLE_NATT 2494 case IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC: 2495 case IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC: 2496 case IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT: 2497 case IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT: 2498 plog(LLV_DEBUG, LOCATION, NULL, 2499 "UDP encapsulation requested\n"); 2500 break; 2501 #endif 2502 default: 2503 plog(LLV_ERROR, LOCATION, NULL, 2504 "invalid encryption mode=%u.\n", 2505 lorv); 2506 return -1; 2507 } 2508 break; 2509 2510 case IPSECDOI_ATTR_SA_LD_TYPE: 2511 if (! flag) { 2512 plog(LLV_ERROR, LOCATION, NULL, 2513 "must be TV when LD_TYPE.\n"); 2514 return -1; 2515 } 2516 2517 switch (lorv) { 2518 case IPSECDOI_ATTR_SA_LD_TYPE_SEC: 2519 case IPSECDOI_ATTR_SA_LD_TYPE_KB: 2520 break; 2521 default: 2522 plog(LLV_ERROR, LOCATION, NULL, 2523 "invalid life type %d.\n", lorv); 2524 return -1; 2525 } 2526 break; 2527 2528 case IPSECDOI_ATTR_SA_LD: 2529 if (flag) { 2530 /* i.e. ISAKMP_GEN_TV */ 2531 plog(LLV_DEBUG, LOCATION, NULL, 2532 "life duration was in TLV.\n"); 2533 } else { 2534 /* i.e. ISAKMP_GEN_TLV */ 2535 if (lorv == 0) { 2536 plog(LLV_ERROR, LOCATION, NULL, 2537 "invalid length of LD\n"); 2538 return -1; 2539 } 2540 } 2541 break; 2542 2543 case IPSECDOI_ATTR_GRP_DESC: 2544 if (! flag) { 2545 plog(LLV_ERROR, LOCATION, NULL, 2546 "must be TV when GRP_DESC.\n"); 2547 return -1; 2548 } 2549 2550 if (!alg_oakley_dhdef_ok(lorv)) { 2551 plog(LLV_ERROR, LOCATION, NULL, 2552 "invalid group description=%u.\n", 2553 lorv); 2554 return -1; 2555 } 2556 break; 2557 2558 case IPSECDOI_ATTR_AUTH: 2559 plog(LLV_ERROR, LOCATION, NULL, 2560 "invalid attr type=%u.\n", type); 2561 return -1; 2562 2563 case IPSECDOI_ATTR_KEY_LENGTH: 2564 case IPSECDOI_ATTR_KEY_ROUNDS: 2565 case IPSECDOI_ATTR_COMP_DICT_SIZE: 2566 case IPSECDOI_ATTR_COMP_PRIVALG: 2567 plog(LLV_ERROR, LOCATION, NULL, 2568 "attr type=%u isn't supported.\n", type); 2569 return -1; 2570 2571 default: 2572 plog(LLV_ERROR, LOCATION, NULL, 2573 "invalid attribute type %d.\n", type); 2574 return -1; 2575 } 2576 2577 if (flag) { 2578 tlen -= sizeof(*d); 2579 d = (struct isakmp_data *)((char *)d 2580 + sizeof(*d)); 2581 } else { 2582 tlen -= (sizeof(*d) + lorv); 2583 d = (struct isakmp_data *)((caddr_t)d 2584 + sizeof(*d) + lorv); 2585 } 2586 } 2587 2588 #if 0 2589 if (proto_id == IPSECDOI_PROTO_IPCOMP && 2590 !attrseen[IPSECDOI_ATTR_AUTH]) { 2591 plog(LLV_ERROR, LOCATION, NULL, 2592 "attr AUTH must be present for AH.\n", type); 2593 return -1; 2594 } 2595 #endif 2596 2597 return 0; 2598 } 2599 2600 /* %%% */ 2601 /* 2602 * create phase1 proposal from remote configuration. 2603 * NOT INCLUDING isakmp general header of SA payload 2604 */ 2605 vchar_t * 2606 ipsecdoi_setph1proposal(rmconf, props) 2607 struct remoteconf *rmconf; 2608 struct isakmpsa *props; 2609 { 2610 vchar_t *mysa; 2611 int sablen; 2612 2613 /* count total size of SA minus isakmp general header */ 2614 /* not including isakmp general header of SA payload */ 2615 sablen = sizeof(struct ipsecdoi_sa_b); 2616 sablen += setph1prop(props, NULL); 2617 2618 mysa = vmalloc(sablen); 2619 if (mysa == NULL) { 2620 plog(LLV_ERROR, LOCATION, NULL, 2621 "failed to allocate my sa buffer\n"); 2622 return NULL; 2623 } 2624 2625 /* create SA payload */ 2626 /* not including isakmp general header */ 2627 ((struct ipsecdoi_sa_b *)mysa->v)->doi = htonl(rmconf->doitype); 2628 ((struct ipsecdoi_sa_b *)mysa->v)->sit = htonl(rmconf->sittype); 2629 2630 (void)setph1prop(props, mysa->v + sizeof(struct ipsecdoi_sa_b)); 2631 2632 return mysa; 2633 } 2634 2635 static int 2636 setph1prop(props, buf) 2637 struct isakmpsa *props; 2638 caddr_t buf; 2639 { 2640 struct isakmp_pl_p *prop = NULL; 2641 struct isakmpsa *s = NULL; 2642 int proplen, trnslen; 2643 u_int8_t *np_t; /* pointer next trns type in previous header */ 2644 int trns_num; 2645 caddr_t p = buf; 2646 2647 proplen = sizeof(*prop); 2648 if (buf) { 2649 /* create proposal */ 2650 prop = (struct isakmp_pl_p *)p; 2651 prop->h.np = ISAKMP_NPTYPE_NONE; 2652 prop->p_no = props->prop_no; 2653 prop->proto_id = IPSECDOI_PROTO_ISAKMP; 2654 prop->spi_size = 0; 2655 p += sizeof(*prop); 2656 } 2657 2658 np_t = NULL; 2659 trns_num = 0; 2660 2661 for (s = props; s != NULL; s = s->next) { 2662 if (np_t) 2663 *np_t = ISAKMP_NPTYPE_T; 2664 2665 trnslen = setph1trns(s, p); 2666 proplen += trnslen; 2667 if (buf) { 2668 /* save buffer to pre-next payload */ 2669 np_t = &((struct isakmp_pl_t *)p)->h.np; 2670 p += trnslen; 2671 2672 /* count up transform length */ 2673 trns_num++; 2674 } 2675 } 2676 2677 /* update proposal length */ 2678 if (buf) { 2679 prop->h.len = htons(proplen); 2680 prop->num_t = trns_num; 2681 } 2682 2683 return proplen; 2684 } 2685 2686 static int 2687 setph1trns(sa, buf) 2688 struct isakmpsa *sa; 2689 caddr_t buf; 2690 { 2691 struct isakmp_pl_t *trns = NULL; 2692 int trnslen, attrlen; 2693 caddr_t p = buf; 2694 2695 trnslen = sizeof(*trns); 2696 if (buf) { 2697 /* create transform */ 2698 trns = (struct isakmp_pl_t *)p; 2699 trns->h.np = ISAKMP_NPTYPE_NONE; 2700 trns->t_no = sa->trns_no; 2701 trns->t_id = IPSECDOI_KEY_IKE; 2702 p += sizeof(*trns); 2703 } 2704 2705 attrlen = setph1attr(sa, p); 2706 trnslen += attrlen; 2707 if (buf) 2708 p += attrlen; 2709 2710 if (buf) 2711 trns->h.len = htons(trnslen); 2712 2713 return trnslen; 2714 } 2715 2716 static int 2717 setph1attr(sa, buf) 2718 struct isakmpsa *sa; 2719 caddr_t buf; 2720 { 2721 caddr_t p = buf; 2722 int attrlen = 0; 2723 2724 if (sa->lifetime) { 2725 u_int32_t lifetime = htonl((u_int32_t)sa->lifetime); 2726 2727 attrlen += sizeof(struct isakmp_data) 2728 + sizeof(struct isakmp_data); 2729 if (sa->lifetime > 0xffff) 2730 attrlen += sizeof(lifetime); 2731 if (buf) { 2732 p = isakmp_set_attr_l(p, OAKLEY_ATTR_SA_LD_TYPE, 2733 OAKLEY_ATTR_SA_LD_TYPE_SEC); 2734 if (sa->lifetime > 0xffff) { 2735 p = isakmp_set_attr_v(p, OAKLEY_ATTR_SA_LD, 2736 (caddr_t)&lifetime, 2737 sizeof(lifetime)); 2738 } else { 2739 p = isakmp_set_attr_l(p, OAKLEY_ATTR_SA_LD, 2740 sa->lifetime); 2741 } 2742 } 2743 } 2744 2745 if (sa->lifebyte) { 2746 u_int32_t lifebyte = htonl((u_int32_t)sa->lifebyte); 2747 2748 attrlen += sizeof(struct isakmp_data) 2749 + sizeof(struct isakmp_data); 2750 if (sa->lifebyte > 0xffff) 2751 attrlen += sizeof(lifebyte); 2752 if (buf) { 2753 p = isakmp_set_attr_l(p, OAKLEY_ATTR_SA_LD_TYPE, 2754 OAKLEY_ATTR_SA_LD_TYPE_KB); 2755 if (sa->lifebyte > 0xffff) { 2756 p = isakmp_set_attr_v(p, OAKLEY_ATTR_SA_LD, 2757 (caddr_t)&lifebyte, 2758 sizeof(lifebyte)); 2759 } else { 2760 p = isakmp_set_attr_l(p, OAKLEY_ATTR_SA_LD, 2761 sa->lifebyte); 2762 } 2763 } 2764 } 2765 2766 if (sa->enctype) { 2767 attrlen += sizeof(struct isakmp_data); 2768 if (buf) 2769 p = isakmp_set_attr_l(p, OAKLEY_ATTR_ENC_ALG, sa->enctype); 2770 } 2771 if (sa->encklen) { 2772 attrlen += sizeof(struct isakmp_data); 2773 if (buf) 2774 p = isakmp_set_attr_l(p, OAKLEY_ATTR_KEY_LEN, sa->encklen); 2775 } 2776 if (sa->authmethod) { 2777 int authmethod; 2778 2779 authmethod = isakmpsa_switch_authmethod(sa->authmethod); 2780 authmethod &= 0xffff; 2781 attrlen += sizeof(struct isakmp_data); 2782 if (buf) 2783 p = isakmp_set_attr_l(p, OAKLEY_ATTR_AUTH_METHOD, authmethod); 2784 } 2785 if (sa->hashtype) { 2786 attrlen += sizeof(struct isakmp_data); 2787 if (buf) 2788 p = isakmp_set_attr_l(p, OAKLEY_ATTR_HASH_ALG, sa->hashtype); 2789 } 2790 switch (sa->dh_group) { 2791 case OAKLEY_ATTR_GRP_DESC_MODP768: 2792 case OAKLEY_ATTR_GRP_DESC_MODP1024: 2793 case OAKLEY_ATTR_GRP_DESC_MODP1536: 2794 case OAKLEY_ATTR_GRP_DESC_MODP2048: 2795 case OAKLEY_ATTR_GRP_DESC_MODP3072: 2796 case OAKLEY_ATTR_GRP_DESC_MODP4096: 2797 case OAKLEY_ATTR_GRP_DESC_MODP6144: 2798 case OAKLEY_ATTR_GRP_DESC_MODP8192: 2799 /* don't attach group type for known groups */ 2800 attrlen += sizeof(struct isakmp_data); 2801 if (buf) { 2802 p = isakmp_set_attr_l(p, OAKLEY_ATTR_GRP_DESC, 2803 sa->dh_group); 2804 } 2805 break; 2806 case OAKLEY_ATTR_GRP_DESC_EC2N155: 2807 case OAKLEY_ATTR_GRP_DESC_EC2N185: 2808 /* don't attach group type for known groups */ 2809 attrlen += sizeof(struct isakmp_data); 2810 if (buf) { 2811 p = isakmp_set_attr_l(p, OAKLEY_ATTR_GRP_TYPE, 2812 OAKLEY_ATTR_GRP_TYPE_EC2N); 2813 } 2814 break; 2815 case 0: 2816 default: 2817 break; 2818 } 2819 2820 #ifdef HAVE_GSSAPI 2821 if (sa->authmethod == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB && 2822 sa->gssid != NULL) { 2823 attrlen += sizeof(struct isakmp_data); 2824 /* 2825 * Older versions of racoon just placed the ISO-Latin-1 2826 * string on the wire directly. Check to see if we are 2827 * configured to be compatible with this behavior. Otherwise, 2828 * we encode the GSS ID as UTF-16LE for Windows 2000 2829 * compatibility, which requires twice the number of octets. 2830 */ 2831 if (lcconf->gss_id_enc == LC_GSSENC_LATIN1) 2832 attrlen += sa->gssid->l; 2833 else 2834 attrlen += sa->gssid->l * 2; 2835 if (buf) { 2836 plog(LLV_DEBUG, LOCATION, NULL, "gss id attr: len %zu, " 2837 "val '%.*s'\n", sa->gssid->l, (int)sa->gssid->l, 2838 sa->gssid->v); 2839 if (lcconf->gss_id_enc == LC_GSSENC_LATIN1) { 2840 p = isakmp_set_attr_v(p, OAKLEY_ATTR_GSS_ID, 2841 (caddr_t)sa->gssid->v, 2842 sa->gssid->l); 2843 } else { 2844 size_t dstleft = sa->gssid->l * 2; 2845 size_t srcleft = sa->gssid->l; 2846 const char *src = (const char *)sa->gssid->v; 2847 char *odst, *dst = racoon_malloc(dstleft); 2848 iconv_t cd; 2849 size_t rv; 2850 2851 cd = iconv_open("utf-16le", "latin1"); 2852 if (cd == (iconv_t) -1) { 2853 plog(LLV_ERROR, LOCATION, NULL, 2854 "unable to initialize " 2855 "latin1 -> utf-16le " 2856 "converstion descriptor: %s\n", 2857 strerror(errno)); 2858 attrlen -= sa->gssid->l * 2; 2859 goto gssid_done; 2860 } 2861 odst = dst; 2862 rv = iconv(cd, (__iconv_const char **)&src, 2863 &srcleft, &dst, &dstleft); 2864 if (rv != 0) { 2865 if (rv == -1) { 2866 plog(LLV_ERROR, LOCATION, NULL, 2867 "unable to convert GSS ID " 2868 "from latin1 -> utf-16le: " 2869 "%s\n", strerror(errno)); 2870 } else { 2871 /* should never happen */ 2872 plog(LLV_ERROR, LOCATION, NULL, 2873 "%zd character%s in GSS ID " 2874 "cannot be represented " 2875 "in utf-16le\n", 2876 rv, rv == 1 ? "" : "s"); 2877 } 2878 (void) iconv_close(cd); 2879 attrlen -= sa->gssid->l * 2; 2880 goto gssid_done; 2881 } 2882 (void) iconv_close(cd); 2883 2884 /* XXX Check srcleft and dstleft? */ 2885 2886 p = isakmp_set_attr_v(p, OAKLEY_ATTR_GSS_ID, 2887 odst, sa->gssid->l * 2); 2888 2889 racoon_free(odst); 2890 } 2891 } 2892 } 2893 gssid_done: 2894 #endif /* HAVE_GSSAPI */ 2895 2896 return attrlen; 2897 } 2898 2899 static vchar_t * 2900 setph2proposal0(iph2, pp, pr) 2901 const struct ph2handle *iph2; 2902 const struct saprop *pp; 2903 const struct saproto *pr; 2904 { 2905 vchar_t *p; 2906 struct isakmp_pl_p *prop; 2907 struct isakmp_pl_t *trns; 2908 struct satrns *tr; 2909 int attrlen; 2910 size_t trnsoff; 2911 caddr_t x0, x; 2912 u_int8_t *np_t; /* pointer next trns type in previous header */ 2913 const u_int8_t *spi; 2914 #ifdef HAVE_SECCTX 2915 int truectxlen = 0; 2916 #endif 2917 2918 p = vmalloc(sizeof(*prop) + sizeof(pr->spi)); 2919 if (p == NULL) 2920 return NULL; 2921 2922 /* create proposal */ 2923 prop = (struct isakmp_pl_p *)p->v; 2924 prop->h.np = ISAKMP_NPTYPE_NONE; 2925 prop->p_no = pp->prop_no; 2926 prop->proto_id = pr->proto_id; 2927 prop->num_t = 1; 2928 2929 spi = (const u_int8_t *)&pr->spi; 2930 switch (pr->proto_id) { 2931 case IPSECDOI_PROTO_IPCOMP: 2932 /* 2933 * draft-shacham-ippcp-rfc2393bis-05.txt: 2934 * construct 16bit SPI (CPI). 2935 * XXX we may need to provide a configuration option to 2936 * generate 32bit SPI. otherwise we cannot interoeprate 2937 * with nodes that uses 32bit SPI, in case we are initiator. 2938 */ 2939 prop->spi_size = sizeof(u_int16_t); 2940 spi += sizeof(pr->spi) - sizeof(u_int16_t); 2941 p->l -= sizeof(pr->spi); 2942 p->l += sizeof(u_int16_t); 2943 break; 2944 default: 2945 prop->spi_size = sizeof(pr->spi); 2946 break; 2947 } 2948 memcpy(prop + 1, spi, prop->spi_size); 2949 2950 /* create transform */ 2951 trnsoff = sizeof(*prop) + prop->spi_size; 2952 np_t = NULL; 2953 2954 for (tr = pr->head; tr; tr = tr->next) { 2955 2956 switch (pr->proto_id) { 2957 case IPSECDOI_PROTO_IPSEC_ESP: 2958 /* 2959 * don't build a null encryption 2960 * with no authentication transform. 2961 */ 2962 if (tr->trns_id == IPSECDOI_ESP_NULL && 2963 tr->authtype == IPSECDOI_ATTR_AUTH_NONE) 2964 continue; 2965 break; 2966 } 2967 2968 if (np_t) { 2969 *np_t = ISAKMP_NPTYPE_T; 2970 prop->num_t++; 2971 } 2972 2973 /* get attribute length */ 2974 attrlen = 0; 2975 if (pp->lifetime) { 2976 attrlen += sizeof(struct isakmp_data) 2977 + sizeof(struct isakmp_data); 2978 if (pp->lifetime > 0xffff) 2979 attrlen += sizeof(u_int32_t); 2980 } 2981 if (pp->lifebyte && pp->lifebyte != IPSECDOI_ATTR_SA_LD_KB_MAX) { 2982 attrlen += sizeof(struct isakmp_data) 2983 + sizeof(struct isakmp_data); 2984 if (pp->lifebyte > 0xffff) 2985 attrlen += sizeof(u_int32_t); 2986 } 2987 attrlen += sizeof(struct isakmp_data); /* enc mode */ 2988 if (tr->encklen) 2989 attrlen += sizeof(struct isakmp_data); 2990 2991 switch (pr->proto_id) { 2992 case IPSECDOI_PROTO_IPSEC_ESP: 2993 /* non authentication mode ? */ 2994 if (tr->authtype != IPSECDOI_ATTR_AUTH_NONE) 2995 attrlen += sizeof(struct isakmp_data); 2996 break; 2997 case IPSECDOI_PROTO_IPSEC_AH: 2998 if (tr->authtype == IPSECDOI_ATTR_AUTH_NONE) { 2999 plog(LLV_ERROR, LOCATION, NULL, 3000 "no authentication algorithm found " 3001 "but protocol is AH.\n"); 3002 vfree(p); 3003 return NULL; 3004 } 3005 attrlen += sizeof(struct isakmp_data); 3006 break; 3007 case IPSECDOI_PROTO_IPCOMP: 3008 break; 3009 default: 3010 plog(LLV_ERROR, LOCATION, NULL, 3011 "invalid protocol: %d\n", pr->proto_id); 3012 vfree(p); 3013 return NULL; 3014 } 3015 3016 if (alg_oakley_dhdef_ok(iph2->sainfo->pfs_group)) 3017 attrlen += sizeof(struct isakmp_data); 3018 3019 #ifdef HAVE_SECCTX 3020 /* ctx_str is defined as char ctx_str[MAX_CTXSTR_SIZ]. 3021 * The string may be smaller than MAX_CTXSTR_SIZ. 3022 */ 3023 if (*pp->sctx.ctx_str) { 3024 truectxlen = sizeof(struct security_ctx) - 3025 (MAX_CTXSTR_SIZE - pp->sctx.ctx_strlen); 3026 attrlen += sizeof(struct isakmp_data) + truectxlen; 3027 } 3028 #endif /* HAVE_SECCTX */ 3029 3030 p = vrealloc(p, p->l + sizeof(*trns) + attrlen); 3031 if (p == NULL) 3032 return NULL; 3033 prop = (struct isakmp_pl_p *)p->v; 3034 3035 /* set transform's values */ 3036 trns = (struct isakmp_pl_t *)(p->v + trnsoff); 3037 trns->h.np = ISAKMP_NPTYPE_NONE; 3038 trns->t_no = tr->trns_no; 3039 trns->t_id = tr->trns_id; 3040 3041 /* set attributes */ 3042 x = x0 = p->v + trnsoff + sizeof(*trns); 3043 3044 if (pp->lifetime) { 3045 x = isakmp_set_attr_l(x, IPSECDOI_ATTR_SA_LD_TYPE, 3046 IPSECDOI_ATTR_SA_LD_TYPE_SEC); 3047 if (pp->lifetime > 0xffff) { 3048 u_int32_t v = htonl((u_int32_t)pp->lifetime); 3049 x = isakmp_set_attr_v(x, IPSECDOI_ATTR_SA_LD, 3050 (caddr_t)&v, sizeof(v)); 3051 } else { 3052 x = isakmp_set_attr_l(x, IPSECDOI_ATTR_SA_LD, 3053 pp->lifetime); 3054 } 3055 } 3056 3057 if (pp->lifebyte && pp->lifebyte != IPSECDOI_ATTR_SA_LD_KB_MAX) { 3058 x = isakmp_set_attr_l(x, IPSECDOI_ATTR_SA_LD_TYPE, 3059 IPSECDOI_ATTR_SA_LD_TYPE_KB); 3060 if (pp->lifebyte > 0xffff) { 3061 u_int32_t v = htonl((u_int32_t)pp->lifebyte); 3062 x = isakmp_set_attr_v(x, IPSECDOI_ATTR_SA_LD, 3063 (caddr_t)&v, sizeof(v)); 3064 } else { 3065 x = isakmp_set_attr_l(x, IPSECDOI_ATTR_SA_LD, 3066 pp->lifebyte); 3067 } 3068 } 3069 3070 x = isakmp_set_attr_l(x, IPSECDOI_ATTR_ENC_MODE, pr->encmode); 3071 3072 if (tr->encklen) 3073 x = isakmp_set_attr_l(x, IPSECDOI_ATTR_KEY_LENGTH, tr->encklen); 3074 3075 /* mandatory check has done above. */ 3076 if ((pr->proto_id == IPSECDOI_PROTO_IPSEC_ESP && tr->authtype != IPSECDOI_ATTR_AUTH_NONE) 3077 || pr->proto_id == IPSECDOI_PROTO_IPSEC_AH) 3078 x = isakmp_set_attr_l(x, IPSECDOI_ATTR_AUTH, tr->authtype); 3079 3080 if (alg_oakley_dhdef_ok(iph2->sainfo->pfs_group)) 3081 x = isakmp_set_attr_l(x, IPSECDOI_ATTR_GRP_DESC, 3082 iph2->sainfo->pfs_group); 3083 3084 #ifdef HAVE_SECCTX 3085 if (*pp->sctx.ctx_str) { 3086 struct security_ctx secctx; 3087 secctx = pp->sctx; 3088 secctx.ctx_strlen = htons(pp->sctx.ctx_strlen); 3089 x = isakmp_set_attr_v(x, IPSECDOI_ATTR_SECCTX, 3090 (caddr_t)&secctx, truectxlen); 3091 } 3092 #endif 3093 /* update length of this transform. */ 3094 trns = (struct isakmp_pl_t *)(p->v + trnsoff); 3095 trns->h.len = htons(sizeof(*trns) + attrlen); 3096 3097 /* save buffer to pre-next payload */ 3098 np_t = &trns->h.np; 3099 3100 trnsoff += (sizeof(*trns) + attrlen); 3101 } 3102 3103 if (np_t == NULL) { 3104 plog(LLV_ERROR, LOCATION, NULL, 3105 "no suitable proposal was created.\n"); 3106 return NULL; 3107 } 3108 3109 /* update length of this protocol. */ 3110 prop->h.len = htons(p->l); 3111 3112 return p; 3113 } 3114 3115 /* 3116 * create phase2 proposal from policy configuration. 3117 * NOT INCLUDING isakmp general header of SA payload. 3118 * This function is called by initiator only. 3119 */ 3120 int 3121 ipsecdoi_setph2proposal(iph2) 3122 struct ph2handle *iph2; 3123 { 3124 struct saprop *proposal, *a; 3125 struct saproto *b = NULL; 3126 vchar_t *q; 3127 struct ipsecdoi_sa_b *sab; 3128 struct isakmp_pl_p *prop; 3129 size_t propoff; /* for previous field of type of next payload. */ 3130 3131 proposal = iph2->proposal; 3132 3133 iph2->sa = vmalloc(sizeof(*sab)); 3134 if (iph2->sa == NULL) { 3135 plog(LLV_ERROR, LOCATION, NULL, 3136 "failed to allocate my sa buffer\n"); 3137 return -1; 3138 } 3139 3140 /* create SA payload */ 3141 sab = (struct ipsecdoi_sa_b *)iph2->sa->v; 3142 sab->doi = htonl(IPSEC_DOI); 3143 sab->sit = htonl(IPSECDOI_SIT_IDENTITY_ONLY); /* XXX configurable ? */ 3144 3145 prop = NULL; 3146 propoff = 0; 3147 for (a = proposal; a; a = a->next) { 3148 for (b = a->head; b; b = b->next) { 3149 #ifdef ENABLE_NATT 3150 if (iph2->ph1->natt_flags & NAT_DETECTED) { 3151 int udp_diff = iph2->ph1->natt_options->mode_udp_diff; 3152 plog (LLV_INFO, LOCATION, NULL, 3153 "NAT detected -> UDP encapsulation " 3154 "(ENC_MODE %d->%d).\n", 3155 b->encmode, 3156 b->encmode+udp_diff); 3157 /* Tunnel -> UDP-Tunnel, Transport -> UDP_Transport */ 3158 b->encmode += udp_diff; 3159 b->udp_encap = 1; 3160 } 3161 #endif 3162 3163 q = setph2proposal0(iph2, a, b); 3164 if (q == NULL) { 3165 VPTRINIT(iph2->sa); 3166 return -1; 3167 } 3168 3169 iph2->sa = vrealloc(iph2->sa, iph2->sa->l + q->l); 3170 if (iph2->sa == NULL) { 3171 plog(LLV_ERROR, LOCATION, NULL, 3172 "failed to allocate my sa buffer\n"); 3173 if (q) 3174 vfree(q); 3175 return -1; 3176 } 3177 memcpy(iph2->sa->v + iph2->sa->l - q->l, q->v, q->l); 3178 if (propoff != 0) { 3179 prop = (struct isakmp_pl_p *)(iph2->sa->v + 3180 propoff); 3181 prop->h.np = ISAKMP_NPTYPE_P; 3182 } 3183 propoff = iph2->sa->l - q->l; 3184 3185 vfree(q); 3186 } 3187 } 3188 3189 return 0; 3190 } 3191 3192 /* 3193 * return 1 if all of the given protocols are transport mode. 3194 */ 3195 int 3196 ipsecdoi_transportmode(pp) 3197 struct saprop *pp; 3198 { 3199 struct saproto *pr = NULL; 3200 3201 for (; pp; pp = pp->next) { 3202 for (pr = pp->head; pr; pr = pr->next) { 3203 if (pr->encmode != IPSECDOI_ATTR_ENC_MODE_TRNS && 3204 pr->encmode != IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC && 3205 pr->encmode != IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT) 3206 return 0; 3207 } 3208 } 3209 3210 return 1; 3211 } 3212 3213 int 3214 ipsecdoi_get_defaultlifetime() 3215 { 3216 return IPSECDOI_ATTR_SA_LD_SEC_DEFAULT; 3217 } 3218 3219 int 3220 ipsecdoi_checkalgtypes(proto_id, enc, auth, comp) 3221 int proto_id, enc, auth, comp; 3222 { 3223 #define TMPALGTYPE2STR(n) s_algtype(algclass_ipsec_##n, n) 3224 switch (proto_id) { 3225 case IPSECDOI_PROTO_IPSEC_ESP: 3226 if (enc == 0 || comp != 0) { 3227 plog(LLV_ERROR, LOCATION, NULL, 3228 "illegal algorithm defined " 3229 "ESP enc=%s auth=%s comp=%s.\n", 3230 TMPALGTYPE2STR(enc), 3231 TMPALGTYPE2STR(auth), 3232 TMPALGTYPE2STR(comp)); 3233 return -1; 3234 } 3235 break; 3236 case IPSECDOI_PROTO_IPSEC_AH: 3237 if (enc != 0 || auth == 0 || comp != 0) { 3238 plog(LLV_ERROR, LOCATION, NULL, 3239 "illegal algorithm defined " 3240 "AH enc=%s auth=%s comp=%s.\n", 3241 TMPALGTYPE2STR(enc), 3242 TMPALGTYPE2STR(auth), 3243 TMPALGTYPE2STR(comp)); 3244 return -1; 3245 } 3246 break; 3247 case IPSECDOI_PROTO_IPCOMP: 3248 if (enc != 0 || auth != 0 || comp == 0) { 3249 plog(LLV_ERROR, LOCATION, NULL, 3250 "illegal algorithm defined " 3251 "IPcomp enc=%s auth=%s comp=%s.\n", 3252 TMPALGTYPE2STR(enc), 3253 TMPALGTYPE2STR(auth), 3254 TMPALGTYPE2STR(comp)); 3255 return -1; 3256 } 3257 break; 3258 default: 3259 plog(LLV_ERROR, LOCATION, NULL, 3260 "invalid ipsec protocol %d\n", proto_id); 3261 return -1; 3262 } 3263 #undef TMPALGTYPE2STR 3264 return 0; 3265 } 3266 3267 int 3268 ipproto2doi(proto) 3269 int proto; 3270 { 3271 switch (proto) { 3272 case IPPROTO_AH: 3273 return IPSECDOI_PROTO_IPSEC_AH; 3274 case IPPROTO_ESP: 3275 return IPSECDOI_PROTO_IPSEC_ESP; 3276 case IPPROTO_IPCOMP: 3277 return IPSECDOI_PROTO_IPCOMP; 3278 } 3279 return -1; /* XXX */ 3280 } 3281 3282 int 3283 doi2ipproto(proto) 3284 int proto; 3285 { 3286 switch (proto) { 3287 case IPSECDOI_PROTO_IPSEC_AH: 3288 return IPPROTO_AH; 3289 case IPSECDOI_PROTO_IPSEC_ESP: 3290 return IPPROTO_ESP; 3291 case IPSECDOI_PROTO_IPCOMP: 3292 return IPPROTO_IPCOMP; 3293 } 3294 return -1; /* XXX */ 3295 } 3296 3297 /* 3298 * Check if a subnet id is valid for comparison 3299 * with an address id ( address length mask ) 3300 * and compare them 3301 * Return value 3302 * = 0 for match 3303 * = 1 for mismatch 3304 */ 3305 3306 int 3307 ipsecdoi_subnetisaddr_v4( subnet, address ) 3308 const vchar_t *subnet; 3309 const vchar_t *address; 3310 { 3311 struct in_addr *mask; 3312 3313 if (address->l != sizeof(struct in_addr)) 3314 return 1; 3315 3316 if (subnet->l != (sizeof(struct in_addr)*2)) 3317 return 1; 3318 3319 mask = (struct in_addr*)(subnet->v + sizeof(struct in_addr)); 3320 3321 if (mask->s_addr!=0xffffffff) 3322 return 1; 3323 3324 return memcmp(subnet->v,address->v,address->l); 3325 } 3326 3327 #ifdef INET6 3328 3329 int 3330 ipsecdoi_subnetisaddr_v6( subnet, address ) 3331 const vchar_t *subnet; 3332 const vchar_t *address; 3333 { 3334 struct in6_addr *mask; 3335 int i; 3336 3337 if (address->l != sizeof(struct in6_addr)) 3338 return 1; 3339 3340 if (subnet->l != (sizeof(struct in6_addr)*2)) 3341 return 1; 3342 3343 mask = (struct in6_addr*)(subnet->v + sizeof(struct in6_addr)); 3344 3345 for (i=0; i<16; i++) 3346 if(mask->s6_addr[i]!=0xff) 3347 return 1; 3348 3349 return memcmp(subnet->v,address->v,address->l); 3350 } 3351 3352 #endif 3353 3354 /* 3355 * Check and Compare two IDs 3356 * - specify 0 for exact if wildcards are allowed 3357 * Return value 3358 * = 0 for match 3359 * = 1 for misatch 3360 * = -1 for integrity error 3361 */ 3362 3363 int 3364 ipsecdoi_chkcmpids( idt, ids, exact ) 3365 const vchar_t *idt; /* id cmp target */ 3366 const vchar_t *ids; /* id cmp source */ 3367 int exact; 3368 { 3369 struct ipsecdoi_id_b *id_bt; 3370 struct ipsecdoi_id_b *id_bs; 3371 vchar_t ident_t; 3372 vchar_t ident_s; 3373 int result; 3374 3375 /* handle wildcard IDs */ 3376 3377 if (idt == NULL || ids == NULL) 3378 { 3379 if( !exact ) 3380 { 3381 plog(LLV_DEBUG, LOCATION, NULL, 3382 "check and compare ids : values matched (ANONYMOUS)\n" ); 3383 return 0; 3384 } 3385 else 3386 { 3387 plog(LLV_DEBUG, LOCATION, NULL, 3388 "check and compare ids : value mismatch (ANONYMOUS)\n" ); 3389 return -1; 3390 } 3391 } 3392 3393 /* make sure the ids are of the same type */ 3394 3395 id_bt = (struct ipsecdoi_id_b *) idt->v; 3396 id_bs = (struct ipsecdoi_id_b *) ids->v; 3397 3398 ident_t.v = idt->v + sizeof(*id_bt); 3399 ident_t.l = idt->l - sizeof(*id_bt); 3400 ident_s.v = ids->v + sizeof(*id_bs); 3401 ident_s.l = ids->l - sizeof(*id_bs); 3402 3403 if (id_bs->type != id_bt->type) 3404 { 3405 /* 3406 * special exception for comparing 3407 * address to subnet id types when 3408 * the netmask is address length 3409 */ 3410 3411 if ((id_bs->type == IPSECDOI_ID_IPV4_ADDR)&& 3412 (id_bt->type == IPSECDOI_ID_IPV4_ADDR_SUBNET)) { 3413 result = ipsecdoi_subnetisaddr_v4(&ident_t,&ident_s); 3414 goto cmpid_result; 3415 } 3416 3417 if ((id_bs->type == IPSECDOI_ID_IPV4_ADDR_SUBNET)&& 3418 (id_bt->type == IPSECDOI_ID_IPV4_ADDR)) { 3419 result = ipsecdoi_subnetisaddr_v4(&ident_s,&ident_t); 3420 goto cmpid_result; 3421 } 3422 3423 #ifdef INET6 3424 if ((id_bs->type == IPSECDOI_ID_IPV6_ADDR)&& 3425 (id_bt->type == IPSECDOI_ID_IPV6_ADDR_SUBNET)) { 3426 result = ipsecdoi_subnetisaddr_v6(&ident_t,&ident_s); 3427 goto cmpid_result; 3428 } 3429 3430 if ((id_bs->type == IPSECDOI_ID_IPV6_ADDR_SUBNET)&& 3431 (id_bt->type == IPSECDOI_ID_IPV6_ADDR)) { 3432 result = ipsecdoi_subnetisaddr_v6(&ident_s,&ident_t); 3433 goto cmpid_result; 3434 } 3435 #endif 3436 plog(LLV_DEBUG, LOCATION, NULL, 3437 "check and compare ids : id type mismatch %s != %s\n", 3438 s_ipsecdoi_ident(id_bs->type), 3439 s_ipsecdoi_ident(id_bt->type)); 3440 3441 return 1; 3442 } 3443 3444 if(id_bs->proto_id != id_bt->proto_id){ 3445 plog(LLV_DEBUG, LOCATION, NULL, 3446 "check and compare ids : proto_id mismatch %d != %d\n", 3447 id_bs->proto_id, id_bt->proto_id); 3448 3449 return 1; 3450 } 3451 3452 /* compare the ID data. */ 3453 3454 switch (id_bt->type) { 3455 case IPSECDOI_ID_DER_ASN1_DN: 3456 case IPSECDOI_ID_DER_ASN1_GN: 3457 /* compare asn1 ids */ 3458 result = eay_cmp_asn1dn(&ident_t, &ident_s); 3459 goto cmpid_result; 3460 3461 case IPSECDOI_ID_IPV4_ADDR: 3462 /* validate lengths */ 3463 if ((ident_t.l != sizeof(struct in_addr))|| 3464 (ident_s.l != sizeof(struct in_addr))) 3465 goto cmpid_invalid; 3466 break; 3467 3468 case IPSECDOI_ID_IPV4_ADDR_SUBNET: 3469 case IPSECDOI_ID_IPV4_ADDR_RANGE: 3470 /* validate lengths */ 3471 if ((ident_t.l != (sizeof(struct in_addr)*2))|| 3472 (ident_s.l != (sizeof(struct in_addr)*2))) 3473 goto cmpid_invalid; 3474 break; 3475 3476 #ifdef INET6 3477 case IPSECDOI_ID_IPV6_ADDR: 3478 /* validate lengths */ 3479 if ((ident_t.l != sizeof(struct in6_addr))|| 3480 (ident_s.l != sizeof(struct in6_addr))) 3481 goto cmpid_invalid; 3482 break; 3483 3484 case IPSECDOI_ID_IPV6_ADDR_SUBNET: 3485 case IPSECDOI_ID_IPV6_ADDR_RANGE: 3486 /* validate lengths */ 3487 if ((ident_t.l != (sizeof(struct in6_addr)*2))|| 3488 (ident_s.l != (sizeof(struct in6_addr)*2))) 3489 goto cmpid_invalid; 3490 break; 3491 #endif 3492 case IPSECDOI_ID_FQDN: 3493 case IPSECDOI_ID_USER_FQDN: 3494 case IPSECDOI_ID_KEY_ID: 3495 break; 3496 3497 default: 3498 plog(LLV_ERROR, LOCATION, NULL, 3499 "Unhandled id type %i specified for comparison\n", 3500 id_bt->type); 3501 return -1; 3502 } 3503 3504 /* validate matching data and length */ 3505 if (ident_t.l == ident_s.l) 3506 result = memcmp(ident_t.v,ident_s.v,ident_t.l); 3507 else 3508 result = 1; 3509 3510 cmpid_result: 3511 3512 /* debug level output */ 3513 if(loglevel >= LLV_DEBUG) { 3514 char *idstrt = ipsecdoi_id2str(idt); 3515 char *idstrs = ipsecdoi_id2str(ids); 3516 3517 if (!result) 3518 plog(LLV_DEBUG, LOCATION, NULL, 3519 "check and compare ids : values matched (%s)\n", 3520 s_ipsecdoi_ident(id_bs->type) ); 3521 else 3522 plog(LLV_DEBUG, LOCATION, NULL, 3523 "check and compare ids : value mismatch (%s)\n", 3524 s_ipsecdoi_ident(id_bs->type)); 3525 3526 plog(LLV_DEBUG, LOCATION, NULL, "cmpid target: \'%s\'\n", idstrt ); 3527 plog(LLV_DEBUG, LOCATION, NULL, "cmpid source: \'%s\'\n", idstrs ); 3528 3529 racoon_free(idstrs); 3530 racoon_free(idstrt); 3531 } 3532 3533 /* return result */ 3534 if( !result ) 3535 return 0; 3536 else 3537 return 1; 3538 3539 cmpid_invalid: 3540 3541 /* id integrity error */ 3542 plog(LLV_DEBUG, LOCATION, NULL, "check and compare ids : %s integrity error\n", 3543 s_ipsecdoi_ident(id_bs->type)); 3544 plog(LLV_DEBUG, LOCATION, NULL, "cmpid target: length = \'%zu\'\n", ident_t.l ); 3545 plog(LLV_DEBUG, LOCATION, NULL, "cmpid source: length = \'%zu\'\n", ident_s.l ); 3546 3547 return -1; 3548 } 3549 3550 /* 3551 * check the following: 3552 * - In main mode with pre-shared key, only address type can be used. 3553 * - if proper type for phase 1 ? 3554 * - if phase 1 ID payload conformed RFC2407 4.6.2. 3555 * (proto, port) must be (0, 0), (udp, 500) or (udp, [specified]). 3556 * - if ID payload sent from peer is equal to the ID expected by me. 3557 * 3558 * both of "id" and "id_p" should be ID payload without general header, 3559 */ 3560 int 3561 ipsecdoi_checkid1(iph1) 3562 struct ph1handle *iph1; 3563 { 3564 struct ipsecdoi_id_b *id_b; 3565 3566 if (iph1->id_p == NULL) { 3567 plog(LLV_ERROR, LOCATION, NULL, 3568 "invalid iph1 passed id_p == NULL\n"); 3569 return ISAKMP_INTERNAL_ERROR; 3570 } 3571 if (iph1->id_p->l < sizeof(*id_b)) { 3572 plog(LLV_ERROR, LOCATION, NULL, 3573 "invalid value passed as \"ident\" (len=%lu)\n", 3574 (u_long)iph1->id_p->l); 3575 return ISAKMP_NTYPE_INVALID_ID_INFORMATION; 3576 } 3577 3578 id_b = (struct ipsecdoi_id_b *)iph1->id_p->v; 3579 3580 /* In main mode with pre-shared key, only address type can be used. */ 3581 if (iph1->etype == ISAKMP_ETYPE_IDENT && 3582 iph1->approval->authmethod == OAKLEY_ATTR_AUTH_METHOD_PSKEY) { 3583 if (id_b->type != IPSECDOI_ID_IPV4_ADDR 3584 && id_b->type != IPSECDOI_ID_IPV6_ADDR) { 3585 plog(LLV_ERROR, LOCATION, NULL, 3586 "Expecting IP address type in main mode, " 3587 "but %s.\n", s_ipsecdoi_ident(id_b->type)); 3588 return ISAKMP_NTYPE_INVALID_ID_INFORMATION; 3589 } 3590 } 3591 3592 /* if proper type for phase 1 ? */ 3593 switch (id_b->type) { 3594 case IPSECDOI_ID_IPV4_ADDR_SUBNET: 3595 case IPSECDOI_ID_IPV6_ADDR_SUBNET: 3596 case IPSECDOI_ID_IPV4_ADDR_RANGE: 3597 case IPSECDOI_ID_IPV6_ADDR_RANGE: 3598 plog(LLV_WARNING, LOCATION, NULL, 3599 "such ID type %s is not proper.\n", 3600 s_ipsecdoi_ident(id_b->type)); 3601 /*FALLTHROUGH*/ 3602 } 3603 3604 /* if phase 1 ID payload conformed RFC2407 4.6.2. */ 3605 if (id_b->type == IPSECDOI_ID_IPV4_ADDR || 3606 id_b->type == IPSECDOI_ID_IPV6_ADDR) { 3607 3608 if (id_b->proto_id == 0 && ntohs(id_b->port) != 0) { 3609 plog(LLV_WARNING, LOCATION, NULL, 3610 "protocol ID and Port mismatched. " 3611 "proto_id:%d port:%d\n", 3612 id_b->proto_id, ntohs(id_b->port)); 3613 /*FALLTHROUGH*/ 3614 3615 } else if (id_b->proto_id == IPPROTO_UDP) { 3616 /* 3617 * copmaring with expecting port. 3618 * always permit if port is equal to PORT_ISAKMP 3619 */ 3620 if (ntohs(id_b->port) != PORT_ISAKMP) { 3621 u_int16_t port; 3622 3623 port = extract_port(iph1->remote); 3624 if (ntohs(id_b->port) != port) { 3625 plog(LLV_WARNING, LOCATION, NULL, 3626 "port %d expected, but %d\n", 3627 port, ntohs(id_b->port)); 3628 /*FALLTHROUGH*/ 3629 } 3630 } 3631 } 3632 } 3633 3634 /* resolve remote configuration if not done yet */ 3635 if (resolveph1rmconf(iph1) < 0) 3636 return ISAKMP_NTYPE_INVALID_ID_INFORMATION; 3637 3638 if (iph1->rmconf == NULL) 3639 return ISAKMP_NTYPE_INVALID_ID_INFORMATION; 3640 3641 return 0; 3642 } 3643 3644 /* 3645 * create ID payload for phase 1 and set into iph1->id. 3646 * NOT INCLUDING isakmp general header. 3647 * see, RFC2407 4.6.2.1 3648 */ 3649 int 3650 ipsecdoi_setid1(iph1) 3651 struct ph1handle *iph1; 3652 { 3653 vchar_t *ret = NULL; 3654 struct ipsecdoi_id_b id_b; 3655 vchar_t *ident = NULL; 3656 struct sockaddr *ipid = NULL; 3657 3658 /* init */ 3659 id_b.proto_id = 0; 3660 id_b.port = 0; 3661 ident = NULL; 3662 3663 switch (iph1->rmconf->idvtype) { 3664 case IDTYPE_FQDN: 3665 id_b.type = IPSECDOI_ID_FQDN; 3666 ident = vdup(iph1->rmconf->idv); 3667 break; 3668 case IDTYPE_USERFQDN: 3669 id_b.type = IPSECDOI_ID_USER_FQDN; 3670 ident = vdup(iph1->rmconf->idv); 3671 break; 3672 case IDTYPE_KEYID: 3673 id_b.type = IPSECDOI_ID_KEY_ID; 3674 ident = vdup(iph1->rmconf->idv); 3675 break; 3676 case IDTYPE_ASN1DN: 3677 id_b.type = IPSECDOI_ID_DER_ASN1_DN; 3678 if (iph1->rmconf->idv) { 3679 /* XXX it must be encoded to asn1dn. */ 3680 ident = vdup(iph1->rmconf->idv); 3681 } else { 3682 if (oakley_getmycert(iph1) < 0) { 3683 plog(LLV_ERROR, LOCATION, NULL, 3684 "failed to get own CERT.\n"); 3685 goto err; 3686 } 3687 ident = eay_get_x509asn1subjectname(iph1->cert); 3688 } 3689 break; 3690 case IDTYPE_ADDRESS: 3691 /* 3692 * if the value of the id type was set by the configuration 3693 * file, then use it. otherwise the value is get from local 3694 * ip address by using ike negotiation. 3695 */ 3696 if (iph1->rmconf->idv) 3697 ipid = (struct sockaddr *)iph1->rmconf->idv->v; 3698 /*FALLTHROUGH*/ 3699 default: 3700 { 3701 int l; 3702 caddr_t p; 3703 3704 if (ipid == NULL) 3705 ipid = iph1->local; 3706 3707 /* use IP address */ 3708 switch (ipid->sa_family) { 3709 case AF_INET: 3710 id_b.type = IPSECDOI_ID_IPV4_ADDR; 3711 l = sizeof(struct in_addr); 3712 p = (caddr_t)&((struct sockaddr_in *)ipid)->sin_addr; 3713 break; 3714 #ifdef INET6 3715 case AF_INET6: 3716 id_b.type = IPSECDOI_ID_IPV6_ADDR; 3717 l = sizeof(struct in6_addr); 3718 p = (caddr_t)&((struct sockaddr_in6 *)ipid)->sin6_addr; 3719 break; 3720 #endif 3721 default: 3722 plog(LLV_ERROR, LOCATION, NULL, 3723 "invalid address family.\n"); 3724 goto err; 3725 } 3726 id_b.proto_id = IPPROTO_UDP; 3727 id_b.port = htons(PORT_ISAKMP); 3728 ident = vmalloc(l); 3729 if (!ident) { 3730 plog(LLV_ERROR, LOCATION, NULL, 3731 "failed to get ID buffer.\n"); 3732 return -1; 3733 } 3734 memcpy(ident->v, p, ident->l); 3735 } 3736 } 3737 if (!ident) { 3738 plog(LLV_ERROR, LOCATION, NULL, 3739 "failed to get ID buffer.\n"); 3740 return -1; 3741 } 3742 3743 ret = vmalloc(sizeof(id_b) + ident->l); 3744 if (ret == NULL) { 3745 plog(LLV_ERROR, LOCATION, NULL, 3746 "failed to get ID buffer.\n"); 3747 goto err; 3748 } 3749 3750 memcpy(ret->v, &id_b, sizeof(id_b)); 3751 memcpy(ret->v + sizeof(id_b), ident->v, ident->l); 3752 3753 iph1->id = ret; 3754 3755 plog(LLV_DEBUG, LOCATION, NULL, 3756 "use ID type of %s\n", s_ipsecdoi_ident(id_b.type)); 3757 if (ident) 3758 vfree(ident); 3759 return 0; 3760 3761 err: 3762 if (ident) 3763 vfree(ident); 3764 plog(LLV_ERROR, LOCATION, NULL, "failed get my ID\n"); 3765 return -1; 3766 } 3767 3768 /* it's only called by cfparse.y. */ 3769 int 3770 set_identifier(vpp, type, value) 3771 vchar_t **vpp, *value; 3772 int type; 3773 { 3774 return set_identifier_qual(vpp, type, value, IDQUAL_UNSPEC); 3775 } 3776 3777 int 3778 set_identifier_qual(vpp, type, value, qual) 3779 vchar_t **vpp, *value; 3780 int type; 3781 int qual; 3782 { 3783 vchar_t *new = NULL; 3784 3785 /* simply return if value is null. */ 3786 if (!value){ 3787 if( type == IDTYPE_FQDN || type == IDTYPE_USERFQDN){ 3788 plog(LLV_ERROR, LOCATION, NULL, 3789 "No %s\n", type == IDTYPE_FQDN ? "fqdn":"user fqdn"); 3790 return -1; 3791 } 3792 return 0; 3793 } 3794 3795 switch (type) { 3796 case IDTYPE_FQDN: 3797 case IDTYPE_USERFQDN: 3798 if(value->l <= 1){ 3799 plog(LLV_ERROR, LOCATION, NULL, 3800 "Empty %s\n", type == IDTYPE_FQDN ? "fqdn":"user fqdn"); 3801 return -1; 3802 } 3803 /* length is adjusted since QUOTEDSTRING teminates NULL. */ 3804 new = vmalloc(value->l - 1); 3805 if (new == NULL) 3806 return -1; 3807 memcpy(new->v, value->v, new->l); 3808 break; 3809 case IDTYPE_KEYID: 3810 /* 3811 * If no qualifier is specified: IDQUAL_UNSPEC. It means 3812 * to use a file for backward compatibility sake. 3813 */ 3814 switch(qual) { 3815 case IDQUAL_FILE: 3816 case IDQUAL_UNSPEC: { 3817 FILE *fp; 3818 char b[512]; 3819 int tlen, len; 3820 3821 fp = fopen(value->v, "r"); 3822 if (fp == NULL) { 3823 plog(LLV_ERROR, LOCATION, NULL, 3824 "can not open %s\n", value->v); 3825 return -1; 3826 } 3827 tlen = 0; 3828 while ((len = fread(b, 1, sizeof(b), fp)) != 0) { 3829 new = vrealloc(new, tlen + len); 3830 if (!new) { 3831 fclose(fp); 3832 return -1; 3833 } 3834 memcpy(new->v + tlen, b, len); 3835 tlen += len; 3836 } 3837 fclose(fp); 3838 break; 3839 } 3840 3841 case IDQUAL_TAG: 3842 new = vmalloc(value->l - 1); 3843 if (new == NULL) { 3844 plog(LLV_ERROR, LOCATION, NULL, 3845 "can not allocate memory"); 3846 return -1; 3847 } 3848 memcpy(new->v, value->v, new->l); 3849 break; 3850 3851 default: 3852 plog(LLV_ERROR, LOCATION, NULL, 3853 "unknown qualifier"); 3854 return -1; 3855 } 3856 break; 3857 3858 case IDTYPE_ADDRESS: { 3859 struct sockaddr *sa; 3860 3861 /* length is adjusted since QUOTEDSTRING teminates NULL. */ 3862 if (value->l == 0) 3863 break; 3864 3865 sa = str2saddr(value->v, NULL); 3866 if (sa == NULL) { 3867 plog(LLV_ERROR, LOCATION, NULL, 3868 "invalid ip address %s\n", value->v); 3869 return -1; 3870 } 3871 3872 new = vmalloc(sysdep_sa_len(sa)); 3873 if (new == NULL) { 3874 racoon_free(sa); 3875 return -1; 3876 } 3877 memcpy(new->v, sa, new->l); 3878 racoon_free(sa); 3879 break; 3880 } 3881 case IDTYPE_ASN1DN: 3882 if (value->v[0] == '~') 3883 /* Hex-encoded ASN1 strings */ 3884 new = eay_hex2asn1dn(value->v + 1, - 1); 3885 else 3886 /* DN encoded strings */ 3887 new = eay_str2asn1dn(value->v, value->l - 1); 3888 3889 if (new == NULL) 3890 return -1; 3891 3892 if (loglevel >= LLV_DEBUG) { 3893 X509_NAME *xn; 3894 BIO *bio; 3895 unsigned char *ptr = (unsigned char *) new->v, *buf; 3896 size_t len; 3897 char save; 3898 3899 xn = d2i_X509_NAME(NULL, (void *)&ptr, new->l); 3900 bio = BIO_new(BIO_s_mem()); 3901 3902 X509_NAME_print_ex(bio, xn, 0, 0); 3903 len = BIO_get_mem_data(bio, &ptr); 3904 save = ptr[len]; 3905 ptr[len] = 0; 3906 plog(LLV_DEBUG, LOCATION, NULL, "Parsed DN: %s\n", ptr); 3907 ptr[len] = save; 3908 X509_NAME_free(xn); 3909 BIO_free(bio); 3910 } 3911 3912 break; 3913 } 3914 3915 *vpp = new; 3916 3917 return 0; 3918 } 3919 3920 /* 3921 * create ID payload for phase 2, and set into iph2->id and id_p. There are 3922 * NOT INCLUDING isakmp general header. 3923 * this function is for initiator. responder will get to copy from payload. 3924 * responder ID type is always address type. 3925 * see, RFC2407 4.6.2.1 3926 */ 3927 int 3928 ipsecdoi_setid2(iph2) 3929 struct ph2handle *iph2; 3930 { 3931 struct secpolicy *sp; 3932 3933 /* check there is phase 2 handler ? */ 3934 sp = getspbyspid(iph2->spid); 3935 if (sp == NULL) { 3936 plog(LLV_ERROR, LOCATION, NULL, 3937 "no policy found for spid:%u.\n", iph2->spid); 3938 return -1; 3939 } 3940 3941 if (!ipsecdoi_transportmode(iph2->proposal)) 3942 iph2->id = ipsecdoi_sockaddr2id((struct sockaddr *)&sp->spidx.src, 3943 sp->spidx.prefs, sp->spidx.ul_proto); 3944 else if (iph2->sa_src != NULL) { 3945 /* He have a specific hint indicating that the transport 3946 * mode SA will be negotiated using addresses that differ 3947 * with the one from the SA. We need to indicate that to 3948 * our peer by setting the SA address as ID. 3949 * This is typically the case for the bootstrapping of the 3950 * transport mode SA protecting BU/BA for MIPv6 traffic 3951 * 3952 * --arno*/ 3953 iph2->id = ipsecdoi_sockaddr2id(iph2->sa_src, 3954 IPSECDOI_PREFIX_HOST, 3955 sp->spidx.ul_proto); 3956 } else 3957 iph2->id = ipsecdoi_sockaddr2id(iph2->src, IPSECDOI_PREFIX_HOST, 3958 sp->spidx.ul_proto); 3959 3960 if (iph2->id == NULL) { 3961 plog(LLV_ERROR, LOCATION, NULL, 3962 "failed to get ID for %s\n", 3963 spidx2str(&sp->spidx)); 3964 return -1; 3965 } 3966 plog(LLV_DEBUG, LOCATION, NULL, "use local ID type %s\n", 3967 s_ipsecdoi_ident(((struct ipsecdoi_id_b *)iph2->id->v)->type)); 3968 3969 /* remote side */ 3970 if (!ipsecdoi_transportmode(iph2->proposal)) 3971 iph2->id_p = ipsecdoi_sockaddr2id((struct sockaddr *)&sp->spidx.dst, 3972 sp->spidx.prefd, sp->spidx.ul_proto); 3973 else if (iph2->sa_dst != NULL) { 3974 /* See comment above for local side. */ 3975 iph2->id_p = ipsecdoi_sockaddr2id(iph2->sa_dst, 3976 IPSECDOI_PREFIX_HOST, 3977 sp->spidx.ul_proto); 3978 } else 3979 iph2->id_p = ipsecdoi_sockaddr2id(iph2->dst, IPSECDOI_PREFIX_HOST, 3980 sp->spidx.ul_proto); 3981 3982 if (iph2->id_p == NULL) { 3983 plog(LLV_ERROR, LOCATION, NULL, 3984 "failed to get ID for %s\n", 3985 spidx2str(&sp->spidx)); 3986 VPTRINIT(iph2->id); 3987 return -1; 3988 } 3989 plog(LLV_DEBUG, LOCATION, NULL, 3990 "use remote ID type %s\n", 3991 s_ipsecdoi_ident(((struct ipsecdoi_id_b *)iph2->id_p->v)->type)); 3992 3993 return 0; 3994 } 3995 3996 /* 3997 * set address type of ID. 3998 * NOT INCLUDING general header. 3999 */ 4000 vchar_t * 4001 ipsecdoi_sockaddr2id(saddr, prefixlen, ul_proto) 4002 struct sockaddr *saddr; 4003 u_int prefixlen; 4004 u_int ul_proto; 4005 { 4006 vchar_t *new; 4007 int type, len1, len2; 4008 caddr_t sa; 4009 u_short port; 4010 4011 /* 4012 * Q. When type is SUBNET, is it allowed to be ::1/128. 4013 * A. Yes. (consensus at bake-off) 4014 */ 4015 switch (saddr->sa_family) { 4016 case AF_INET: 4017 len1 = sizeof(struct in_addr); 4018 if (prefixlen >= (sizeof(struct in_addr) << 3)) { 4019 type = IPSECDOI_ID_IPV4_ADDR; 4020 len2 = 0; 4021 } else { 4022 type = IPSECDOI_ID_IPV4_ADDR_SUBNET; 4023 len2 = sizeof(struct in_addr); 4024 } 4025 sa = (caddr_t)&((struct sockaddr_in *)(saddr))->sin_addr; 4026 port = ((struct sockaddr_in *)(saddr))->sin_port; 4027 break; 4028 #ifdef INET6 4029 case AF_INET6: 4030 len1 = sizeof(struct in6_addr); 4031 if (prefixlen >= (sizeof(struct in6_addr) << 3)) { 4032 type = IPSECDOI_ID_IPV6_ADDR; 4033 len2 = 0; 4034 } else { 4035 type = IPSECDOI_ID_IPV6_ADDR_SUBNET; 4036 len2 = sizeof(struct in6_addr); 4037 } 4038 sa = (caddr_t)&((struct sockaddr_in6 *)(saddr))->sin6_addr; 4039 port = ((struct sockaddr_in6 *)(saddr))->sin6_port; 4040 break; 4041 #endif 4042 default: 4043 plog(LLV_ERROR, LOCATION, NULL, 4044 "invalid family: %d.\n", saddr->sa_family); 4045 return NULL; 4046 } 4047 4048 /* get ID buffer */ 4049 new = vmalloc(sizeof(struct ipsecdoi_id_b) + len1 + len2); 4050 if (new == NULL) { 4051 plog(LLV_ERROR, LOCATION, NULL, 4052 "failed to get ID buffer.\n"); 4053 return NULL; 4054 } 4055 4056 memset(new->v, 0, new->l); 4057 4058 /* set the part of header. */ 4059 ((struct ipsecdoi_id_b *)new->v)->type = type; 4060 4061 /* set ul_proto and port */ 4062 /* 4063 * NOTE: we use both IPSEC_ULPROTO_ANY and IPSEC_PORT_ANY as wild card 4064 * because 0 means port number of 0. Instead of 0, we use IPSEC_*_ANY. 4065 */ 4066 ((struct ipsecdoi_id_b *)new->v)->proto_id = 4067 ul_proto == IPSEC_ULPROTO_ANY ? 0 : ul_proto; 4068 ((struct ipsecdoi_id_b *)new->v)->port = 4069 port == IPSEC_PORT_ANY ? 0 : port; 4070 memcpy(new->v + sizeof(struct ipsecdoi_id_b), sa, len1); 4071 4072 /* set address */ 4073 4074 /* set prefix */ 4075 if (len2) { 4076 u_char *p = (unsigned char *) new->v + 4077 sizeof(struct ipsecdoi_id_b) + len1; 4078 u_int bits = prefixlen; 4079 4080 while (bits >= 8) { 4081 *p++ = 0xff; 4082 bits -= 8; 4083 } 4084 4085 if (bits > 0) 4086 *p = ~((1 << (8 - bits)) - 1); 4087 } 4088 4089 return new; 4090 } 4091 4092 vchar_t * 4093 ipsecdoi_sockrange2id(laddr, haddr, ul_proto) 4094 struct sockaddr *laddr, *haddr; 4095 u_int ul_proto; 4096 { 4097 vchar_t *new; 4098 int type, len1, len2; 4099 u_short port; 4100 4101 if (laddr->sa_family != haddr->sa_family) { 4102 plog(LLV_ERROR, LOCATION, NULL, "Address family mismatch\n"); 4103 return NULL; 4104 } 4105 4106 switch (laddr->sa_family) { 4107 case AF_INET: 4108 type = IPSECDOI_ID_IPV4_ADDR_RANGE; 4109 len1 = sizeof(struct in_addr); 4110 len2 = sizeof(struct in_addr); 4111 break; 4112 #ifdef INET6 4113 case AF_INET6: 4114 type = IPSECDOI_ID_IPV6_ADDR_RANGE; 4115 len1 = sizeof(struct in6_addr); 4116 len2 = sizeof(struct in6_addr); 4117 break; 4118 #endif 4119 default: 4120 plog(LLV_ERROR, LOCATION, NULL, 4121 "invalid family: %d.\n", laddr->sa_family); 4122 return NULL; 4123 } 4124 4125 /* get ID buffer */ 4126 new = vmalloc(sizeof(struct ipsecdoi_id_b) + len1 + len2); 4127 if (new == NULL) { 4128 plog(LLV_ERROR, LOCATION, NULL, 4129 "failed to get ID buffer.\n"); 4130 return NULL; 4131 } 4132 4133 memset(new->v, 0, new->l); 4134 /* set the part of header. */ 4135 ((struct ipsecdoi_id_b *)new->v)->type = type; 4136 4137 /* set ul_proto and port */ 4138 /* 4139 * NOTE: we use both IPSEC_ULPROTO_ANY and IPSEC_PORT_ANY as wild card 4140 * because 0 means port number of 0. Instead of 0, we use IPSEC_*_ANY. 4141 */ 4142 ((struct ipsecdoi_id_b *)new->v)->proto_id = 4143 ul_proto == IPSEC_ULPROTO_ANY ? 0 : ul_proto; 4144 port = ((struct sockaddr_in *)(laddr))->sin_port; 4145 ((struct ipsecdoi_id_b *)new->v)->port = 4146 port == IPSEC_PORT_ANY ? 0 : port; 4147 memcpy(new->v + sizeof(struct ipsecdoi_id_b), 4148 (caddr_t)&((struct sockaddr_in *)(laddr))->sin_addr, 4149 len1); 4150 memcpy(new->v + sizeof(struct ipsecdoi_id_b) + len1, 4151 (caddr_t)&((struct sockaddr_in *)haddr)->sin_addr, 4152 len2); 4153 return new; 4154 } 4155 4156 4157 /* 4158 * create sockaddr structure from ID payload (buf). 4159 * buffers (saddr, prefixlen, ul_proto) must be allocated. 4160 * see, RFC2407 4.6.2.1 4161 */ 4162 int 4163 ipsecdoi_id2sockaddr(buf, saddr, prefixlen, ul_proto) 4164 vchar_t *buf; 4165 struct sockaddr *saddr; 4166 u_int8_t *prefixlen; 4167 u_int16_t *ul_proto; 4168 { 4169 struct ipsecdoi_id_b *id_b = NULL; 4170 u_int plen = 0; 4171 4172 if (buf == NULL) 4173 return ISAKMP_INTERNAL_ERROR; 4174 4175 id_b = (struct ipsecdoi_id_b *)buf->v; 4176 4177 /* 4178 * When a ID payload of subnet type with a IP address of full bit 4179 * masked, it has to be processed as host address. 4180 * e.g. below 2 type are same. 4181 * type = ipv6 subnet, data = 2001::1/128 4182 * type = ipv6 address, data = 2001::1 4183 */ 4184 switch (id_b->type) { 4185 case IPSECDOI_ID_IPV4_ADDR: 4186 case IPSECDOI_ID_IPV4_ADDR_SUBNET: 4187 #ifndef __linux__ 4188 saddr->sa_len = sizeof(struct sockaddr_in); 4189 #endif 4190 saddr->sa_family = AF_INET; 4191 ((struct sockaddr_in *)saddr)->sin_port = 4192 (id_b->port == 0 4193 ? IPSEC_PORT_ANY 4194 : id_b->port); /* see sockaddr2id() */ 4195 memcpy(&((struct sockaddr_in *)saddr)->sin_addr, 4196 buf->v + sizeof(*id_b), sizeof(struct in_addr)); 4197 break; 4198 #ifdef INET6 4199 case IPSECDOI_ID_IPV6_ADDR: 4200 case IPSECDOI_ID_IPV6_ADDR_SUBNET: 4201 #ifndef __linux__ 4202 saddr->sa_len = sizeof(struct sockaddr_in6); 4203 #endif 4204 saddr->sa_family = AF_INET6; 4205 ((struct sockaddr_in6 *)saddr)->sin6_port = 4206 (id_b->port == 0 4207 ? IPSEC_PORT_ANY 4208 : id_b->port); /* see sockaddr2id() */ 4209 memcpy(&((struct sockaddr_in6 *)saddr)->sin6_addr, 4210 buf->v + sizeof(*id_b), sizeof(struct in6_addr)); 4211 ((struct sockaddr_in6 *)saddr)->sin6_scope_id = 4212 (IN6_IS_ADDR_LINKLOCAL(&((struct sockaddr_in6 *)saddr)->sin6_addr) 4213 ? ((struct sockaddr_in6 *)id_b)->sin6_scope_id 4214 : 0); 4215 4216 break; 4217 #endif 4218 default: 4219 plog(LLV_ERROR, LOCATION, NULL, 4220 "unsupported ID type %d\n", id_b->type); 4221 return ISAKMP_NTYPE_INVALID_ID_INFORMATION; 4222 } 4223 4224 /* get prefix length */ 4225 switch (id_b->type) { 4226 case IPSECDOI_ID_IPV4_ADDR: 4227 plen = sizeof(struct in_addr) << 3; 4228 break; 4229 #ifdef INET6 4230 case IPSECDOI_ID_IPV6_ADDR: 4231 plen = sizeof(struct in6_addr) << 3; 4232 break; 4233 #endif 4234 case IPSECDOI_ID_IPV4_ADDR_SUBNET: 4235 #ifdef INET6 4236 case IPSECDOI_ID_IPV6_ADDR_SUBNET: 4237 #endif 4238 { 4239 u_char *p; 4240 u_int max; 4241 int alen = sizeof(struct in_addr); 4242 4243 switch (id_b->type) { 4244 case IPSECDOI_ID_IPV4_ADDR_SUBNET: 4245 alen = sizeof(struct in_addr); 4246 break; 4247 #ifdef INET6 4248 case IPSECDOI_ID_IPV6_ADDR_SUBNET: 4249 alen = sizeof(struct in6_addr); 4250 break; 4251 #endif 4252 } 4253 4254 /* sanity check */ 4255 if (buf->l < alen) 4256 return ISAKMP_INTERNAL_ERROR; 4257 4258 /* get subnet mask length */ 4259 plen = 0; 4260 max = alen <<3; 4261 4262 p = (unsigned char *) buf->v 4263 + sizeof(struct ipsecdoi_id_b) 4264 + alen; 4265 4266 for (; *p == 0xff; p++) { 4267 plen += 8; 4268 if (plen >= max) 4269 break; 4270 } 4271 4272 if (plen < max) { 4273 u_int l = 0; 4274 u_char b = ~(*p); 4275 4276 while (b) { 4277 b >>= 1; 4278 l++; 4279 } 4280 4281 l = 8 - l; 4282 plen += l; 4283 } 4284 } 4285 break; 4286 } 4287 4288 *prefixlen = plen; 4289 *ul_proto = id_b->proto_id == 0 4290 ? IPSEC_ULPROTO_ANY 4291 : id_b->proto_id; /* see sockaddr2id() */ 4292 4293 return 0; 4294 } 4295 4296 /* 4297 * make printable string from ID payload except of general header. 4298 */ 4299 char * 4300 ipsecdoi_id2str(id) 4301 const vchar_t *id; 4302 { 4303 #define BUFLEN 512 4304 char * ret = NULL; 4305 int len = 0; 4306 char *dat; 4307 static char buf[BUFLEN]; 4308 struct ipsecdoi_id_b *id_b = (struct ipsecdoi_id_b *)id->v; 4309 union sockaddr_any saddr; 4310 u_int plen = 0; 4311 4312 switch (id_b->type) { 4313 case IPSECDOI_ID_IPV4_ADDR: 4314 case IPSECDOI_ID_IPV4_ADDR_SUBNET: 4315 case IPSECDOI_ID_IPV4_ADDR_RANGE: 4316 4317 #ifndef __linux__ 4318 saddr.sa.sa_len = sizeof(struct sockaddr_in); 4319 #endif 4320 saddr.sa.sa_family = AF_INET; 4321 saddr.sin.sin_port = IPSEC_PORT_ANY; 4322 memcpy(&saddr.sin.sin_addr, 4323 id->v + sizeof(*id_b), sizeof(struct in_addr)); 4324 break; 4325 #ifdef INET6 4326 case IPSECDOI_ID_IPV6_ADDR: 4327 case IPSECDOI_ID_IPV6_ADDR_SUBNET: 4328 case IPSECDOI_ID_IPV6_ADDR_RANGE: 4329 4330 #ifndef __linux__ 4331 saddr.sa.sa_len = sizeof(struct sockaddr_in6); 4332 #endif 4333 saddr.sa.sa_family = AF_INET6; 4334 saddr.sin6.sin6_port = IPSEC_PORT_ANY; 4335 memcpy(&saddr.sin6.sin6_addr, 4336 id->v + sizeof(*id_b), sizeof(struct in6_addr)); 4337 saddr.sin6.sin6_scope_id = 4338 (IN6_IS_ADDR_LINKLOCAL(&saddr.sin6.sin6_addr) 4339 ? ((struct sockaddr_in6 *)id_b)->sin6_scope_id 4340 : 0); 4341 break; 4342 #endif 4343 } 4344 4345 switch (id_b->type) { 4346 case IPSECDOI_ID_IPV4_ADDR: 4347 #ifdef INET6 4348 case IPSECDOI_ID_IPV6_ADDR: 4349 #endif 4350 len = snprintf( buf, BUFLEN, "%s", saddrwop2str(&saddr.sa)); 4351 break; 4352 4353 case IPSECDOI_ID_IPV4_ADDR_SUBNET: 4354 #ifdef INET6 4355 case IPSECDOI_ID_IPV6_ADDR_SUBNET: 4356 #endif 4357 { 4358 u_char *p; 4359 u_int max; 4360 int alen = sizeof(struct in_addr); 4361 4362 switch (id_b->type) { 4363 case IPSECDOI_ID_IPV4_ADDR_SUBNET: 4364 alen = sizeof(struct in_addr); 4365 break; 4366 #ifdef INET6 4367 case IPSECDOI_ID_IPV6_ADDR_SUBNET: 4368 alen = sizeof(struct in6_addr); 4369 break; 4370 #endif 4371 } 4372 4373 /* sanity check */ 4374 if (id->l < alen) { 4375 len = 0; 4376 break; 4377 } 4378 4379 /* get subnet mask length */ 4380 plen = 0; 4381 max = alen <<3; 4382 4383 p = (unsigned char *) id->v 4384 + sizeof(struct ipsecdoi_id_b) 4385 + alen; 4386 4387 for (; *p == 0xff; p++) { 4388 plen += 8; 4389 if (plen >= max) 4390 break; 4391 } 4392 4393 if (plen < max) { 4394 u_int l = 0; 4395 u_char b = ~(*p); 4396 4397 while (b) { 4398 b >>= 1; 4399 l++; 4400 } 4401 4402 l = 8 - l; 4403 plen += l; 4404 } 4405 4406 len = snprintf( buf, BUFLEN, "%s/%i", saddrwop2str(&saddr.sa), plen); 4407 } 4408 break; 4409 4410 case IPSECDOI_ID_IPV4_ADDR_RANGE: 4411 4412 len = snprintf( buf, BUFLEN, "%s-", saddrwop2str(&saddr.sa)); 4413 4414 #ifndef __linux__ 4415 saddr.sa.sa_len = sizeof(struct sockaddr_in); 4416 #endif 4417 saddr.sa.sa_family = AF_INET; 4418 saddr.sin.sin_port = IPSEC_PORT_ANY; 4419 memcpy(&saddr.sin.sin_addr, 4420 id->v + sizeof(*id_b) + sizeof(struct in_addr), 4421 sizeof(struct in_addr)); 4422 4423 len += snprintf(buf + len, BUFLEN - len, "%s", saddrwop2str(&saddr.sa)); 4424 break; 4425 4426 #ifdef INET6 4427 case IPSECDOI_ID_IPV6_ADDR_RANGE: 4428 len = snprintf( buf, BUFLEN, "%s-", saddrwop2str(&saddr.sa)); 4429 4430 #ifndef __linux__ 4431 saddr.sa.sa_len = sizeof(struct sockaddr_in6); 4432 #endif 4433 saddr.sa.sa_family = AF_INET6; 4434 saddr.sin6.sin6_port = IPSEC_PORT_ANY; 4435 memcpy(&saddr.sin6.sin6_addr, 4436 id->v + sizeof(*id_b) + sizeof(struct in6_addr), 4437 sizeof(struct in6_addr)); 4438 saddr.sin6.sin6_scope_id = 4439 (IN6_IS_ADDR_LINKLOCAL(&saddr.sin6.sin6_addr) 4440 ? ((struct sockaddr_in6 *)id_b)->sin6_scope_id 4441 : 0); 4442 4443 len += snprintf(buf + len, BUFLEN - len, "%s", saddrwop2str(&saddr.sa)); 4444 break; 4445 #endif 4446 4447 case IPSECDOI_ID_FQDN: 4448 case IPSECDOI_ID_USER_FQDN: 4449 len = id->l - sizeof(*id_b); 4450 if (len > BUFLEN) 4451 len = BUFLEN; 4452 memcpy(buf, id->v + sizeof(*id_b), len); 4453 break; 4454 4455 case IPSECDOI_ID_DER_ASN1_DN: 4456 case IPSECDOI_ID_DER_ASN1_GN: 4457 { 4458 X509_NAME *xn = NULL; 4459 4460 dat = id->v + sizeof(*id_b); 4461 len = id->l - sizeof(*id_b); 4462 4463 if (d2i_X509_NAME(&xn, (void*) &dat, len) != NULL) { 4464 BIO *bio = BIO_new(BIO_s_mem()); 4465 X509_NAME_print_ex(bio, xn, 0, 0); 4466 len = BIO_get_mem_data(bio, &dat); 4467 if (len > BUFLEN) 4468 len = BUFLEN; 4469 memcpy(buf,dat,len); 4470 BIO_free(bio); 4471 X509_NAME_free(xn); 4472 } else { 4473 plog(LLV_ERROR, LOCATION, NULL, 4474 "unable to extract asn1dn from id\n"); 4475 4476 len = sprintf(buf, "<ASN1-DN>"); 4477 } 4478 4479 break; 4480 } 4481 4482 /* currently unhandled id types */ 4483 case IPSECDOI_ID_KEY_ID: 4484 len = sprintf( buf, "<KEY-ID>"); 4485 break; 4486 4487 default: 4488 plog(LLV_ERROR, LOCATION, NULL, 4489 "unknown ID type %d\n", id_b->type); 4490 } 4491 4492 if (!len) 4493 len = sprintf( buf, "<?>"); 4494 4495 ret = racoon_malloc(len+1); 4496 if (ret != NULL) { 4497 memcpy(ret,buf,len); 4498 ret[len]=0; 4499 } 4500 4501 return ret; 4502 } 4503 4504 /* 4505 * set IPsec data attributes into a proposal. 4506 * NOTE: MUST called per a transform. 4507 */ 4508 int 4509 ipsecdoi_t2satrns(t, pp, pr, tr) 4510 struct isakmp_pl_t *t; 4511 struct saprop *pp; 4512 struct saproto *pr; 4513 struct satrns *tr; 4514 { 4515 struct isakmp_data *d, *prev; 4516 int flag, type; 4517 int error = -1; 4518 int life_t; 4519 int tlen; 4520 4521 tr->trns_no = t->t_no; 4522 tr->trns_id = t->t_id; 4523 4524 tlen = ntohs(t->h.len) - sizeof(*t); 4525 prev = (struct isakmp_data *)NULL; 4526 d = (struct isakmp_data *)(t + 1); 4527 4528 /* default */ 4529 life_t = IPSECDOI_ATTR_SA_LD_TYPE_DEFAULT; 4530 pp->lifetime = IPSECDOI_ATTR_SA_LD_SEC_DEFAULT; 4531 pp->lifebyte = 0; 4532 tr->authtype = IPSECDOI_ATTR_AUTH_NONE; 4533 4534 while (tlen > 0) { 4535 4536 type = ntohs(d->type) & ~ISAKMP_GEN_MASK; 4537 flag = ntohs(d->type) & ISAKMP_GEN_MASK; 4538 4539 plog(LLV_DEBUG, LOCATION, NULL, 4540 "type=%s, flag=0x%04x, lorv=%s\n", 4541 s_ipsecdoi_attr(type), flag, 4542 s_ipsecdoi_attr_v(type, ntohs(d->lorv))); 4543 4544 switch (type) { 4545 case IPSECDOI_ATTR_SA_LD_TYPE: 4546 { 4547 int type = ntohs(d->lorv); 4548 switch (type) { 4549 case IPSECDOI_ATTR_SA_LD_TYPE_SEC: 4550 case IPSECDOI_ATTR_SA_LD_TYPE_KB: 4551 life_t = type; 4552 break; 4553 default: 4554 plog(LLV_WARNING, LOCATION, NULL, 4555 "invalid life duration type. " 4556 "use default\n"); 4557 life_t = IPSECDOI_ATTR_SA_LD_TYPE_DEFAULT; 4558 break; 4559 } 4560 break; 4561 } 4562 case IPSECDOI_ATTR_SA_LD: 4563 if (prev == NULL 4564 || (ntohs(prev->type) & ~ISAKMP_GEN_MASK) != 4565 IPSECDOI_ATTR_SA_LD_TYPE) { 4566 plog(LLV_ERROR, LOCATION, NULL, 4567 "life duration must follow ltype\n"); 4568 break; 4569 } 4570 4571 { 4572 u_int32_t t; 4573 vchar_t *ld_buf = NULL; 4574 4575 if (flag) { 4576 /* i.e. ISAKMP_GEN_TV */ 4577 ld_buf = vmalloc(sizeof(d->lorv)); 4578 if (ld_buf == NULL) { 4579 plog(LLV_ERROR, LOCATION, NULL, 4580 "failed to get LD buffer.\n"); 4581 goto end; 4582 } 4583 memcpy(ld_buf->v, &d->lorv, sizeof(d->lorv)); 4584 } else { 4585 int len = ntohs(d->lorv); 4586 /* i.e. ISAKMP_GEN_TLV */ 4587 ld_buf = vmalloc(len); 4588 if (ld_buf == NULL) { 4589 plog(LLV_ERROR, LOCATION, NULL, 4590 "failed to get LD buffer.\n"); 4591 goto end; 4592 } 4593 memcpy(ld_buf->v, d + 1, len); 4594 } 4595 switch (life_t) { 4596 case IPSECDOI_ATTR_SA_LD_TYPE_SEC: 4597 t = ipsecdoi_set_ld(ld_buf); 4598 vfree(ld_buf); 4599 if (t == 0) { 4600 plog(LLV_ERROR, LOCATION, NULL, 4601 "invalid life duration.\n"); 4602 goto end; 4603 } 4604 /* lifetime must be equal in a proposal. */ 4605 if (pp->lifetime == IPSECDOI_ATTR_SA_LD_SEC_DEFAULT) 4606 pp->lifetime = t; 4607 else if (pp->lifetime != t) { 4608 plog(LLV_ERROR, LOCATION, NULL, 4609 "lifetime mismatched " 4610 "in a proposal, " 4611 "prev:%ld curr:%u.\n", 4612 (long)pp->lifetime, t); 4613 goto end; 4614 } 4615 break; 4616 case IPSECDOI_ATTR_SA_LD_TYPE_KB: 4617 t = ipsecdoi_set_ld(ld_buf); 4618 vfree(ld_buf); 4619 if (t == 0) { 4620 plog(LLV_ERROR, LOCATION, NULL, 4621 "invalid life duration.\n"); 4622 goto end; 4623 } 4624 /* lifebyte must be equal in a proposal. */ 4625 if (pp->lifebyte == 0) 4626 pp->lifebyte = t; 4627 else if (pp->lifebyte != t) { 4628 plog(LLV_ERROR, LOCATION, NULL, 4629 "lifebyte mismatched " 4630 "in a proposal, " 4631 "prev:%d curr:%u.\n", 4632 pp->lifebyte, t); 4633 goto end; 4634 } 4635 break; 4636 default: 4637 vfree(ld_buf); 4638 plog(LLV_ERROR, LOCATION, NULL, 4639 "invalid life type: %d\n", life_t); 4640 goto end; 4641 } 4642 } 4643 break; 4644 4645 case IPSECDOI_ATTR_GRP_DESC: 4646 /* 4647 * RFC2407: 4.5 IPSEC Security Association Attributes 4648 * Specifies the Oakley Group to be used in a PFS QM 4649 * negotiation. For a list of supported values, see 4650 * Appendix A of [IKE]. 4651 */ 4652 if (pp->pfs_group == 0) 4653 pp->pfs_group = (u_int16_t)ntohs(d->lorv); 4654 else if (pp->pfs_group != (u_int16_t)ntohs(d->lorv)) { 4655 plog(LLV_ERROR, LOCATION, NULL, 4656 "pfs_group mismatched " 4657 "in a proposal.\n"); 4658 goto end; 4659 } 4660 break; 4661 4662 case IPSECDOI_ATTR_ENC_MODE: 4663 if (pr->encmode && 4664 pr->encmode != (u_int16_t)ntohs(d->lorv)) { 4665 plog(LLV_ERROR, LOCATION, NULL, 4666 "multiple encmode exist " 4667 "in a transform.\n"); 4668 goto end; 4669 } 4670 pr->encmode = (u_int16_t)ntohs(d->lorv); 4671 break; 4672 4673 case IPSECDOI_ATTR_AUTH: 4674 if (tr->authtype != IPSECDOI_ATTR_AUTH_NONE) { 4675 plog(LLV_ERROR, LOCATION, NULL, 4676 "multiple authtype exist " 4677 "in a transform.\n"); 4678 goto end; 4679 } 4680 tr->authtype = (u_int16_t)ntohs(d->lorv); 4681 break; 4682 4683 case IPSECDOI_ATTR_KEY_LENGTH: 4684 if (pr->proto_id != IPSECDOI_PROTO_IPSEC_ESP) { 4685 plog(LLV_ERROR, LOCATION, NULL, 4686 "key length defined but not ESP"); 4687 goto end; 4688 } 4689 tr->encklen = ntohs(d->lorv); 4690 break; 4691 #ifdef HAVE_SECCTX 4692 case IPSECDOI_ATTR_SECCTX: 4693 { 4694 int len = ntohs(d->lorv); 4695 memcpy(&pp->sctx, d + 1, len); 4696 pp->sctx.ctx_strlen = ntohs(pp->sctx.ctx_strlen); 4697 break; 4698 } 4699 #endif /* HAVE_SECCTX */ 4700 case IPSECDOI_ATTR_KEY_ROUNDS: 4701 case IPSECDOI_ATTR_COMP_DICT_SIZE: 4702 case IPSECDOI_ATTR_COMP_PRIVALG: 4703 default: 4704 break; 4705 } 4706 4707 prev = d; 4708 if (flag) { 4709 tlen -= sizeof(*d); 4710 d = (struct isakmp_data *)((char *)d + sizeof(*d)); 4711 } else { 4712 tlen -= (sizeof(*d) + ntohs(d->lorv)); 4713 d = (struct isakmp_data *)((caddr_t)d + sizeof(*d) + ntohs(d->lorv)); 4714 } 4715 } 4716 4717 error = 0; 4718 end: 4719 return error; 4720 } 4721 4722 int 4723 ipsecdoi_authalg2trnsid(alg) 4724 int alg; 4725 { 4726 switch (alg) { 4727 case IPSECDOI_ATTR_AUTH_HMAC_MD5: 4728 return IPSECDOI_AH_MD5; 4729 case IPSECDOI_ATTR_AUTH_HMAC_SHA1: 4730 return IPSECDOI_AH_SHA; 4731 case IPSECDOI_ATTR_AUTH_HMAC_SHA2_256: 4732 return IPSECDOI_AH_SHA256; 4733 case IPSECDOI_ATTR_AUTH_HMAC_SHA2_384: 4734 return IPSECDOI_AH_SHA384; 4735 case IPSECDOI_ATTR_AUTH_HMAC_SHA2_512: 4736 return IPSECDOI_AH_SHA512; 4737 case IPSECDOI_ATTR_AUTH_DES_MAC: 4738 return IPSECDOI_AH_DES; 4739 case IPSECDOI_ATTR_AUTH_KPDK: 4740 return IPSECDOI_AH_MD5; /* XXX */ 4741 default: 4742 plog(LLV_ERROR, LOCATION, NULL, 4743 "invalid authentication algorithm:%d\n", alg); 4744 } 4745 return -1; 4746 } 4747 4748 static int rm_idtype2doi[] = { 4749 255, /* IDTYPE_UNDEFINED, 0 */ 4750 IPSECDOI_ID_FQDN, /* IDTYPE_FQDN, 1 */ 4751 IPSECDOI_ID_USER_FQDN, /* IDTYPE_USERFQDN, 2 */ 4752 IPSECDOI_ID_KEY_ID, /* IDTYPE_KEYID, 3 */ 4753 255, /* IDTYPE_ADDRESS, 4 4754 * it expands into 4 types by another function. */ 4755 IPSECDOI_ID_DER_ASN1_DN, /* IDTYPE_ASN1DN, 5 */ 4756 }; 4757 4758 /* 4759 * convert idtype to DOI value. 4760 * OUT 255 : NG 4761 * other: converted. 4762 */ 4763 int 4764 idtype2doi(idtype) 4765 int idtype; 4766 { 4767 if (ARRAYLEN(rm_idtype2doi) > idtype) 4768 return rm_idtype2doi[idtype]; 4769 return 255; 4770 } 4771 4772 int 4773 doi2idtype(doi) 4774 int doi; 4775 { 4776 switch(doi) { 4777 case IPSECDOI_ID_FQDN: 4778 return(IDTYPE_FQDN); 4779 case IPSECDOI_ID_USER_FQDN: 4780 return(IDTYPE_USERFQDN); 4781 case IPSECDOI_ID_KEY_ID: 4782 return(IDTYPE_KEYID); 4783 case IPSECDOI_ID_DER_ASN1_DN: 4784 return(IDTYPE_ASN1DN); 4785 case IPSECDOI_ID_IPV4_ADDR: 4786 case IPSECDOI_ID_IPV4_ADDR_SUBNET: 4787 case IPSECDOI_ID_IPV6_ADDR: 4788 case IPSECDOI_ID_IPV6_ADDR_SUBNET: 4789 return(IDTYPE_ADDRESS); 4790 default: 4791 plog(LLV_WARNING, LOCATION, NULL, 4792 "Inproper idtype:%s in this function.\n", 4793 s_ipsecdoi_ident(doi)); 4794 return(IDTYPE_ADDRESS); /* XXX */ 4795 } 4796 /*NOTREACHED*/ 4797 } 4798