1 /* $NetBSD: oakley.c,v 1.9.6.3 2008/03/06 17:00:25 vanhu Exp $ */
2
3 /* Id: oakley.c,v 1.32 2006/05/26 12:19:46 manubsd Exp */
4
5 /*
6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the project nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34 #include "config.h"
35
36 #include <sys/types.h>
37 #include <sys/param.h>
38 #include <sys/socket.h> /* XXX for subjectaltname */
39 #include <netinet/in.h> /* XXX for subjectaltname */
40
41 #include <openssl/pkcs7.h>
42 #include <openssl/x509.h>
43
44 #include <stdlib.h>
45 #include <stdio.h>
46 #include <string.h>
47 #include <errno.h>
48
49 #if TIME_WITH_SYS_TIME
50 # include <sys/time.h>
51 # include <time.h>
52 #else
53 # if HAVE_SYS_TIME_H
54 # include <sys/time.h>
55 # else
56 # include <time.h>
57 # endif
58 #endif
59 #ifdef ENABLE_HYBRID
60 #include <resolv.h>
61 #endif
62
63 #include "var.h"
64 #include "misc.h"
65 #include "vmbuf.h"
66 #include "str2val.h"
67 #include "plog.h"
68 #include "debug.h"
69
70 #include "isakmp_var.h"
71 #include "isakmp.h"
72 #ifdef ENABLE_HYBRID
73 #include "isakmp_xauth.h"
74 #include "isakmp_cfg.h"
75 #endif
76 #include "oakley.h"
77 #include "admin.h"
78 #include "privsep.h"
79 #include "localconf.h"
80 #include "remoteconf.h"
81 #include "policy.h"
82 #include "handler.h"
83 #include "ipsec_doi.h"
84 #include "algorithm.h"
85 #include "dhgroup.h"
86 #include "sainfo.h"
87 #include "proposal.h"
88 #include "crypto_openssl.h"
89 #include "dnssec.h"
90 #include "sockmisc.h"
91 #include "strnames.h"
92 #include "gcmalloc.h"
93 #include "rsalist.h"
94
95 #ifdef HAVE_GSSAPI
96 #include "gssapi.h"
97 #endif
98
99 #define OUTBOUND_SA 0
100 #define INBOUND_SA 1
101
102 #define INITDHVAL(a, s, d, t) \
103 do { \
104 vchar_t buf; \
105 buf.v = str2val((s), 16, &buf.l); \
106 memset(&a, 0, sizeof(struct dhgroup)); \
107 a.type = (t); \
108 a.prime = vdup(&buf); \
109 a.gen1 = 2; \
110 a.gen2 = 0; \
111 racoon_free(buf.v); \
112 } while(0);
113
114 struct dhgroup dh_modp768;
115 struct dhgroup dh_modp1024;
116 struct dhgroup dh_modp1536;
117 struct dhgroup dh_modp2048;
118 struct dhgroup dh_modp3072;
119 struct dhgroup dh_modp4096;
120 struct dhgroup dh_modp6144;
121 struct dhgroup dh_modp8192;
122
123
124 static int oakley_check_dh_pub __P((vchar_t *, vchar_t **));
125 static int oakley_compute_keymat_x __P((struct ph2handle *, int, int));
126 static int get_cert_fromlocal __P((struct ph1handle *, int));
127 static int get_plainrsa_fromlocal __P((struct ph1handle *, int));
128 static int oakley_check_certid __P((struct ph1handle *iph1));
129 static int check_typeofcertname __P((int, int));
130 static cert_t *save_certbuf __P((struct isakmp_gen *));
131 static cert_t *save_certx509 __P((X509 *));
132 static int oakley_padlen __P((int, int));
133
134 int
oakley_get_defaultlifetime()135 oakley_get_defaultlifetime()
136 {
137 return OAKLEY_ATTR_SA_LD_SEC_DEFAULT;
138 }
139
140 int
oakley_dhinit()141 oakley_dhinit()
142 {
143 /* set DH MODP */
144 INITDHVAL(dh_modp768, OAKLEY_PRIME_MODP768,
145 OAKLEY_ATTR_GRP_DESC_MODP768, OAKLEY_ATTR_GRP_TYPE_MODP);
146 INITDHVAL(dh_modp1024, OAKLEY_PRIME_MODP1024,
147 OAKLEY_ATTR_GRP_DESC_MODP1024, OAKLEY_ATTR_GRP_TYPE_MODP);
148 INITDHVAL(dh_modp1536, OAKLEY_PRIME_MODP1536,
149 OAKLEY_ATTR_GRP_DESC_MODP1536, OAKLEY_ATTR_GRP_TYPE_MODP);
150 INITDHVAL(dh_modp2048, OAKLEY_PRIME_MODP2048,
151 OAKLEY_ATTR_GRP_DESC_MODP2048, OAKLEY_ATTR_GRP_TYPE_MODP);
152 INITDHVAL(dh_modp3072, OAKLEY_PRIME_MODP3072,
153 OAKLEY_ATTR_GRP_DESC_MODP3072, OAKLEY_ATTR_GRP_TYPE_MODP);
154 INITDHVAL(dh_modp4096, OAKLEY_PRIME_MODP4096,
155 OAKLEY_ATTR_GRP_DESC_MODP4096, OAKLEY_ATTR_GRP_TYPE_MODP);
156 INITDHVAL(dh_modp6144, OAKLEY_PRIME_MODP6144,
157 OAKLEY_ATTR_GRP_DESC_MODP6144, OAKLEY_ATTR_GRP_TYPE_MODP);
158 INITDHVAL(dh_modp8192, OAKLEY_PRIME_MODP8192,
159 OAKLEY_ATTR_GRP_DESC_MODP8192, OAKLEY_ATTR_GRP_TYPE_MODP);
160
161 return 0;
162 }
163
164 void
oakley_dhgrp_free(dhgrp)165 oakley_dhgrp_free(dhgrp)
166 struct dhgroup *dhgrp;
167 {
168 if (dhgrp->prime)
169 vfree(dhgrp->prime);
170 if (dhgrp->curve_a)
171 vfree(dhgrp->curve_a);
172 if (dhgrp->curve_b)
173 vfree(dhgrp->curve_b);
174 if (dhgrp->order)
175 vfree(dhgrp->order);
176 racoon_free(dhgrp);
177 }
178
179 /*
180 * RFC2409 5
181 * The length of the Diffie-Hellman public value MUST be equal to the
182 * length of the prime modulus over which the exponentiation was
183 * performed, prepending zero bits to the value if necessary.
184 */
185 static int
oakley_check_dh_pub(prime,pub0)186 oakley_check_dh_pub(prime, pub0)
187 vchar_t *prime, **pub0;
188 {
189 vchar_t *tmp;
190 vchar_t *pub = *pub0;
191
192 if (prime->l == pub->l)
193 return 0;
194
195 if (prime->l < pub->l) {
196 /* what should i do ? */
197 plog(LLV_ERROR, LOCATION, NULL,
198 "invalid public information was generated.\n");
199 return -1;
200 }
201
202 /* prime->l > pub->l */
203 tmp = vmalloc(prime->l);
204 if (tmp == NULL) {
205 plog(LLV_ERROR, LOCATION, NULL,
206 "failed to get DH buffer.\n");
207 return -1;
208 }
209 memcpy(tmp->v + prime->l - pub->l, pub->v, pub->l);
210
211 vfree(*pub0);
212 *pub0 = tmp;
213
214 return 0;
215 }
216
217 /*
218 * compute sharing secret of DH
219 * IN: *dh, *pub, *priv, *pub_p
220 * OUT: **gxy
221 */
222 int
oakley_dh_compute(dh,pub,priv,pub_p,gxy)223 oakley_dh_compute(dh, pub, priv, pub_p, gxy)
224 const struct dhgroup *dh;
225 vchar_t *pub, *priv, *pub_p, **gxy;
226 {
227 #ifdef ENABLE_STATS
228 struct timeval start, end;
229 #endif
230 if ((*gxy = vmalloc(dh->prime->l)) == NULL) {
231 plog(LLV_ERROR, LOCATION, NULL,
232 "failed to get DH buffer.\n");
233 return -1;
234 }
235
236 #ifdef ENABLE_STATS
237 gettimeofday(&start, NULL);
238 #endif
239 switch (dh->type) {
240 case OAKLEY_ATTR_GRP_TYPE_MODP:
241 if (eay_dh_compute(dh->prime, dh->gen1, pub, priv, pub_p, gxy) < 0) {
242 plog(LLV_ERROR, LOCATION, NULL,
243 "failed to compute dh value.\n");
244 return -1;
245 }
246 break;
247 case OAKLEY_ATTR_GRP_TYPE_ECP:
248 case OAKLEY_ATTR_GRP_TYPE_EC2N:
249 plog(LLV_ERROR, LOCATION, NULL,
250 "dh type %d isn't supported.\n", dh->type);
251 return -1;
252 default:
253 plog(LLV_ERROR, LOCATION, NULL,
254 "invalid dh type %d.\n", dh->type);
255 return -1;
256 }
257
258 #ifdef ENABLE_STATS
259 gettimeofday(&end, NULL);
260 syslog(LOG_NOTICE, "%s(%s%zu): %8.6f", __func__,
261 s_attr_isakmp_group(dh->type), dh->prime->l << 3,
262 timedelta(&start, &end));
263 #endif
264
265 plog(LLV_DEBUG, LOCATION, NULL, "compute DH's shared.\n");
266 plogdump(LLV_DEBUG, (*gxy)->v, (*gxy)->l);
267
268 return 0;
269 }
270
271 /*
272 * generate values of DH
273 * IN: *dh
274 * OUT: **pub, **priv
275 */
276 int
oakley_dh_generate(dh,pub,priv)277 oakley_dh_generate(dh, pub, priv)
278 const struct dhgroup *dh;
279 vchar_t **pub, **priv;
280 {
281 #ifdef ENABLE_STATS
282 struct timeval start, end;
283 gettimeofday(&start, NULL);
284 #endif
285 switch (dh->type) {
286 case OAKLEY_ATTR_GRP_TYPE_MODP:
287 if (eay_dh_generate(dh->prime, dh->gen1, dh->gen2, pub, priv) < 0) {
288 plog(LLV_ERROR, LOCATION, NULL,
289 "failed to compute dh value.\n");
290 return -1;
291 }
292 break;
293
294 case OAKLEY_ATTR_GRP_TYPE_ECP:
295 case OAKLEY_ATTR_GRP_TYPE_EC2N:
296 plog(LLV_ERROR, LOCATION, NULL,
297 "dh type %d isn't supported.\n", dh->type);
298 return -1;
299 default:
300 plog(LLV_ERROR, LOCATION, NULL,
301 "invalid dh type %d.\n", dh->type);
302 return -1;
303 }
304
305 #ifdef ENABLE_STATS
306 gettimeofday(&end, NULL);
307 syslog(LOG_NOTICE, "%s(%s%zu): %8.6f", __func__,
308 s_attr_isakmp_group(dh->type), dh->prime->l << 3,
309 timedelta(&start, &end));
310 #endif
311
312 if (oakley_check_dh_pub(dh->prime, pub) != 0)
313 return -1;
314
315 plog(LLV_DEBUG, LOCATION, NULL, "compute DH's private.\n");
316 plogdump(LLV_DEBUG, (*priv)->v, (*priv)->l);
317 plog(LLV_DEBUG, LOCATION, NULL, "compute DH's public.\n");
318 plogdump(LLV_DEBUG, (*pub)->v, (*pub)->l);
319
320 return 0;
321 }
322
323 /*
324 * copy pre-defined dhgroup values.
325 */
326 int
oakley_setdhgroup(group,dhgrp)327 oakley_setdhgroup(group, dhgrp)
328 int group;
329 struct dhgroup **dhgrp;
330 {
331 struct dhgroup *g;
332
333 *dhgrp = NULL; /* just make sure, initialize */
334
335 g = alg_oakley_dhdef_group(group);
336 if (g == NULL) {
337 plog(LLV_ERROR, LOCATION, NULL,
338 "invalid DH parameter grp=%d.\n", group);
339 return -1;
340 }
341
342 if (!g->type || !g->prime || !g->gen1) {
343 /* unsuported */
344 plog(LLV_ERROR, LOCATION, NULL,
345 "unsupported DH parameters grp=%d.\n", group);
346 return -1;
347 }
348
349 *dhgrp = racoon_calloc(1, sizeof(struct dhgroup));
350 if (*dhgrp == NULL) {
351 plog(LLV_ERROR, LOCATION, NULL,
352 "failed to get DH buffer.\n");
353 return 0;
354 }
355
356 /* set defined dh vlaues */
357 memcpy(*dhgrp, g, sizeof(*g));
358 (*dhgrp)->prime = vdup(g->prime);
359
360 return 0;
361 }
362
363 /*
364 * PRF
365 *
366 * NOTE: we do not support prf with different input/output bitwidth,
367 * so we do not implement RFC2409 Appendix B (DOORAK-MAC example) in
368 * oakley_compute_keymat(). If you add support for such prf function,
369 * modify oakley_compute_keymat() accordingly.
370 */
371 vchar_t *
oakley_prf(key,buf,iph1)372 oakley_prf(key, buf, iph1)
373 vchar_t *key, *buf;
374 struct ph1handle *iph1;
375 {
376 vchar_t *res = NULL;
377 int type;
378
379 if (iph1->approval == NULL) {
380 /*
381 * it's before negotiating hash algorithm.
382 * We use md5 as default.
383 */
384 type = OAKLEY_ATTR_HASH_ALG_MD5;
385 } else
386 type = iph1->approval->hashtype;
387
388 res = alg_oakley_hmacdef_one(type, key, buf);
389 if (res == NULL) {
390 plog(LLV_ERROR, LOCATION, NULL,
391 "invalid hmac algorithm %d.\n", type);
392 return NULL;
393 }
394
395 return res;
396 }
397
398 /*
399 * hash
400 */
401 vchar_t *
oakley_hash(buf,iph1)402 oakley_hash(buf, iph1)
403 vchar_t *buf;
404 struct ph1handle *iph1;
405 {
406 vchar_t *res = NULL;
407 int type;
408
409 if (iph1->approval == NULL) {
410 /*
411 * it's before negotiating hash algorithm.
412 * We use md5 as default.
413 */
414 type = OAKLEY_ATTR_HASH_ALG_MD5;
415 } else
416 type = iph1->approval->hashtype;
417
418 res = alg_oakley_hashdef_one(type, buf);
419 if (res == NULL) {
420 plog(LLV_ERROR, LOCATION, NULL,
421 "invalid hash algoriym %d.\n", type);
422 return NULL;
423 }
424
425 return res;
426 }
427
428 /*
429 * compute KEYMAT
430 * see seciton 5.5 Phase 2 - Quick Mode in isakmp-oakley-05.
431 */
432 int
oakley_compute_keymat(iph2,side)433 oakley_compute_keymat(iph2, side)
434 struct ph2handle *iph2;
435 int side;
436 {
437 int error = -1;
438
439 /* compute sharing secret of DH when PFS */
440 if (iph2->approval->pfs_group && iph2->dhpub_p) {
441 if (oakley_dh_compute(iph2->pfsgrp, iph2->dhpub,
442 iph2->dhpriv, iph2->dhpub_p, &iph2->dhgxy) < 0)
443 goto end;
444 }
445
446 /* compute keymat */
447 if (oakley_compute_keymat_x(iph2, side, INBOUND_SA) < 0
448 || oakley_compute_keymat_x(iph2, side, OUTBOUND_SA) < 0)
449 goto end;
450
451 plog(LLV_DEBUG, LOCATION, NULL, "KEYMAT computed.\n");
452
453 error = 0;
454
455 end:
456 return error;
457 }
458
459 /*
460 * compute KEYMAT.
461 * KEYMAT = prf(SKEYID_d, protocol | SPI | Ni_b | Nr_b).
462 * If PFS is desired and KE payloads were exchanged,
463 * KEYMAT = prf(SKEYID_d, g(qm)^xy | protocol | SPI | Ni_b | Nr_b)
464 *
465 * NOTE: we do not support prf with different input/output bitwidth,
466 * so we do not implement RFC2409 Appendix B (DOORAK-MAC example).
467 */
468 static int
oakley_compute_keymat_x(iph2,side,sa_dir)469 oakley_compute_keymat_x(iph2, side, sa_dir)
470 struct ph2handle *iph2;
471 int side;
472 int sa_dir;
473 {
474 vchar_t *buf = NULL, *res = NULL, *bp;
475 char *p;
476 int len;
477 int error = -1;
478 int pfs = 0;
479 int dupkeymat; /* generate K[1-dupkeymat] */
480 struct saproto *pr;
481 struct satrns *tr;
482 int encklen, authklen, l;
483
484 pfs = ((iph2->approval->pfs_group && iph2->dhgxy) ? 1 : 0);
485
486 len = pfs ? iph2->dhgxy->l : 0;
487 len += (1
488 + sizeof(u_int32_t) /* XXX SPI size */
489 + iph2->nonce->l
490 + iph2->nonce_p->l);
491 buf = vmalloc(len);
492 if (buf == NULL) {
493 plog(LLV_ERROR, LOCATION, NULL,
494 "failed to get keymat buffer.\n");
495 goto end;
496 }
497
498 for (pr = iph2->approval->head; pr != NULL; pr = pr->next) {
499 p = buf->v;
500
501 /* if PFS */
502 if (pfs) {
503 memcpy(p, iph2->dhgxy->v, iph2->dhgxy->l);
504 p += iph2->dhgxy->l;
505 }
506
507 p[0] = pr->proto_id;
508 p += 1;
509
510 memcpy(p, (sa_dir == INBOUND_SA ? &pr->spi : &pr->spi_p),
511 sizeof(pr->spi));
512 p += sizeof(pr->spi);
513
514 bp = (side == INITIATOR ? iph2->nonce : iph2->nonce_p);
515 memcpy(p, bp->v, bp->l);
516 p += bp->l;
517
518 bp = (side == INITIATOR ? iph2->nonce_p : iph2->nonce);
519 memcpy(p, bp->v, bp->l);
520 p += bp->l;
521
522 /* compute IV */
523 plog(LLV_DEBUG, LOCATION, NULL, "KEYMAT compute with\n");
524 plogdump(LLV_DEBUG, buf->v, buf->l);
525
526 /* res = K1 */
527 res = oakley_prf(iph2->ph1->skeyid_d, buf, iph2->ph1);
528 if (res == NULL)
529 goto end;
530
531 /* compute key length needed */
532 encklen = authklen = 0;
533 switch (pr->proto_id) {
534 case IPSECDOI_PROTO_IPSEC_ESP:
535 for (tr = pr->head; tr; tr = tr->next) {
536 l = alg_ipsec_encdef_keylen(tr->trns_id,
537 tr->encklen);
538 if (l > encklen)
539 encklen = l;
540
541 l = alg_ipsec_hmacdef_hashlen(tr->authtype);
542 if (l > authklen)
543 authklen = l;
544 }
545 break;
546 case IPSECDOI_PROTO_IPSEC_AH:
547 for (tr = pr->head; tr; tr = tr->next) {
548 l = alg_ipsec_hmacdef_hashlen(tr->trns_id);
549 if (l > authklen)
550 authklen = l;
551 }
552 break;
553 default:
554 break;
555 }
556 plog(LLV_DEBUG, LOCATION, NULL, "encklen=%d authklen=%d\n",
557 encklen, authklen);
558
559 dupkeymat = (encklen + authklen) / 8 / res->l;
560 dupkeymat += 2; /* safety mergin */
561 if (dupkeymat < 3)
562 dupkeymat = 3;
563 plog(LLV_DEBUG, LOCATION, NULL,
564 "generating %zu bits of key (dupkeymat=%d)\n",
565 dupkeymat * 8 * res->l, dupkeymat);
566 if (0 < --dupkeymat) {
567 vchar_t *prev = res; /* K(n-1) */
568 vchar_t *seed = NULL; /* seed for Kn */
569 size_t l;
570
571 /*
572 * generating long key (isakmp-oakley-08 5.5)
573 * KEYMAT = K1 | K2 | K3 | ...
574 * where
575 * src = [ g(qm)^xy | ] protocol | SPI | Ni_b | Nr_b
576 * K1 = prf(SKEYID_d, src)
577 * K2 = prf(SKEYID_d, K1 | src)
578 * K3 = prf(SKEYID_d, K2 | src)
579 * Kn = prf(SKEYID_d, K(n-1) | src)
580 */
581 plog(LLV_DEBUG, LOCATION, NULL,
582 "generating K1...K%d for KEYMAT.\n",
583 dupkeymat + 1);
584
585 seed = vmalloc(prev->l + buf->l);
586 if (seed == NULL) {
587 plog(LLV_ERROR, LOCATION, NULL,
588 "failed to get keymat buffer.\n");
589 if (prev && prev != res)
590 vfree(prev);
591 goto end;
592 }
593
594 while (dupkeymat--) {
595 vchar_t *this = NULL; /* Kn */
596 int update_prev;
597
598 memcpy(seed->v, prev->v, prev->l);
599 memcpy(seed->v + prev->l, buf->v, buf->l);
600 this = oakley_prf(iph2->ph1->skeyid_d, seed,
601 iph2->ph1);
602 if (!this) {
603 plog(LLV_ERROR, LOCATION, NULL,
604 "oakley_prf memory overflow\n");
605 if (prev && prev != res)
606 vfree(prev);
607 vfree(this);
608 vfree(seed);
609 goto end;
610 }
611
612 update_prev = (prev && prev == res) ? 1 : 0;
613
614 l = res->l;
615 res = vrealloc(res, l + this->l);
616
617 if (update_prev)
618 prev = res;
619
620 if (res == NULL) {
621 plog(LLV_ERROR, LOCATION, NULL,
622 "failed to get keymat buffer.\n");
623 if (prev && prev != res)
624 vfree(prev);
625 vfree(this);
626 vfree(seed);
627 goto end;
628 }
629 memcpy(res->v + l, this->v, this->l);
630
631 if (prev && prev != res)
632 vfree(prev);
633 prev = this;
634 this = NULL;
635 }
636
637 if (prev && prev != res)
638 vfree(prev);
639 vfree(seed);
640 }
641
642 plogdump(LLV_DEBUG, res->v, res->l);
643
644 if (sa_dir == INBOUND_SA)
645 pr->keymat = res;
646 else
647 pr->keymat_p = res;
648 res = NULL;
649 }
650
651 error = 0;
652
653 end:
654 if (error) {
655 for (pr = iph2->approval->head; pr != NULL; pr = pr->next) {
656 if (pr->keymat) {
657 vfree(pr->keymat);
658 pr->keymat = NULL;
659 }
660 if (pr->keymat_p) {
661 vfree(pr->keymat_p);
662 pr->keymat_p = NULL;
663 }
664 }
665 }
666
667 if (buf != NULL)
668 vfree(buf);
669 if (res)
670 vfree(res);
671
672 return error;
673 }
674
675 #if notyet
676 /*
677 * NOTE: Must terminate by NULL.
678 */
679 vchar_t *
oakley_compute_hashx(struct ph1handle * iph1,...)680 oakley_compute_hashx(struct ph1handle *iph1, ...)
681 {
682 vchar_t *buf, *res;
683 vchar_t *s;
684 caddr_t p;
685 int len;
686
687 va_list ap;
688
689 /* get buffer length */
690 va_start(ap, iph1);
691 len = 0;
692 while ((s = va_arg(ap, vchar_t *)) != NULL) {
693 len += s->l
694 }
695 va_end(ap);
696
697 buf = vmalloc(len);
698 if (buf == NULL) {
699 plog(LLV_ERROR, LOCATION, NULL,
700 "failed to get hash buffer\n");
701 return NULL;
702 }
703
704 /* set buffer */
705 va_start(ap, iph1);
706 p = buf->v;
707 while ((s = va_arg(ap, char *)) != NULL) {
708 memcpy(p, s->v, s->l);
709 p += s->l;
710 }
711 va_end(ap);
712
713 plog(LLV_DEBUG, LOCATION, NULL, "HASH with: \n");
714 plogdump(LLV_DEBUG, buf->v, buf->l);
715
716 /* compute HASH */
717 res = oakley_prf(iph1->skeyid_a, buf, iph1);
718 vfree(buf);
719 if (res == NULL)
720 return NULL;
721
722 plog(LLV_DEBUG, LOCATION, NULL, "HASH computed:\n");
723 plogdump(LLV_DEBUG, res->v, res->l);
724
725 return res;
726 }
727 #endif
728
729 /*
730 * compute HASH(3) prf(SKEYID_a, 0 | M-ID | Ni_b | Nr_b)
731 * see seciton 5.5 Phase 2 - Quick Mode in isakmp-oakley-05.
732 */
733 vchar_t *
oakley_compute_hash3(iph1,msgid,body)734 oakley_compute_hash3(iph1, msgid, body)
735 struct ph1handle *iph1;
736 u_int32_t msgid;
737 vchar_t *body;
738 {
739 vchar_t *buf = 0, *res = 0;
740 int len;
741 int error = -1;
742
743 /* create buffer */
744 len = 1 + sizeof(u_int32_t) + body->l;
745 buf = vmalloc(len);
746 if (buf == NULL) {
747 plog(LLV_DEBUG, LOCATION, NULL,
748 "failed to get hash buffer\n");
749 goto end;
750 }
751
752 buf->v[0] = 0;
753
754 memcpy(buf->v + 1, (char *)&msgid, sizeof(msgid));
755
756 memcpy(buf->v + 1 + sizeof(u_int32_t), body->v, body->l);
757
758 plog(LLV_DEBUG, LOCATION, NULL, "HASH with: \n");
759 plogdump(LLV_DEBUG, buf->v, buf->l);
760
761 /* compute HASH */
762 res = oakley_prf(iph1->skeyid_a, buf, iph1);
763 if (res == NULL)
764 goto end;
765
766 error = 0;
767
768 plog(LLV_DEBUG, LOCATION, NULL, "HASH computed:\n");
769 plogdump(LLV_DEBUG, res->v, res->l);
770
771 end:
772 if (buf != NULL)
773 vfree(buf);
774 return res;
775 }
776
777 /*
778 * compute HASH type of prf(SKEYID_a, M-ID | buffer)
779 * e.g.
780 * for quick mode HASH(1):
781 * prf(SKEYID_a, M-ID | SA | Ni [ | KE ] [ | IDci | IDcr ])
782 * for quick mode HASH(2):
783 * prf(SKEYID_a, M-ID | Ni_b | SA | Nr [ | KE ] [ | IDci | IDcr ])
784 * for Informational exchange:
785 * prf(SKEYID_a, M-ID | N/D)
786 */
787 vchar_t *
oakley_compute_hash1(iph1,msgid,body)788 oakley_compute_hash1(iph1, msgid, body)
789 struct ph1handle *iph1;
790 u_int32_t msgid;
791 vchar_t *body;
792 {
793 vchar_t *buf = NULL, *res = NULL;
794 char *p;
795 int len;
796 int error = -1;
797
798 /* create buffer */
799 len = sizeof(u_int32_t) + body->l;
800 buf = vmalloc(len);
801 if (buf == NULL) {
802 plog(LLV_DEBUG, LOCATION, NULL,
803 "failed to get hash buffer\n");
804 goto end;
805 }
806
807 p = buf->v;
808
809 memcpy(buf->v, (char *)&msgid, sizeof(msgid));
810 p += sizeof(u_int32_t);
811
812 memcpy(p, body->v, body->l);
813
814 plog(LLV_DEBUG, LOCATION, NULL, "HASH with:\n");
815 plogdump(LLV_DEBUG, buf->v, buf->l);
816
817 /* compute HASH */
818 res = oakley_prf(iph1->skeyid_a, buf, iph1);
819 if (res == NULL)
820 goto end;
821
822 error = 0;
823
824 plog(LLV_DEBUG, LOCATION, NULL, "HASH computed:\n");
825 plogdump(LLV_DEBUG, res->v, res->l);
826
827 end:
828 if (buf != NULL)
829 vfree(buf);
830 return res;
831 }
832
833 /*
834 * compute phase1 HASH
835 * main/aggressive
836 * I-digest = prf(SKEYID, g^i | g^r | CKY-I | CKY-R | SAi_b | ID_i1_b)
837 * R-digest = prf(SKEYID, g^r | g^i | CKY-R | CKY-I | SAi_b | ID_r1_b)
838 * for gssapi, also include all GSS tokens, and call gss_wrap on the result
839 */
840 vchar_t *
oakley_ph1hash_common(iph1,sw)841 oakley_ph1hash_common(iph1, sw)
842 struct ph1handle *iph1;
843 int sw;
844 {
845 vchar_t *buf = NULL, *res = NULL, *bp;
846 char *p, *bp2;
847 int len, bl;
848 int error = -1;
849 #ifdef HAVE_GSSAPI
850 vchar_t *gsstokens = NULL;
851 #endif
852
853 /* create buffer */
854 len = iph1->dhpub->l
855 + iph1->dhpub_p->l
856 + sizeof(cookie_t) * 2
857 + iph1->sa->l
858 + (sw == GENERATE ? iph1->id->l : iph1->id_p->l);
859
860 #ifdef HAVE_GSSAPI
861 if (AUTHMETHOD(iph1) == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB) {
862 if (iph1->gi_i != NULL && iph1->gi_r != NULL) {
863 bp = (sw == GENERATE ? iph1->gi_i : iph1->gi_r);
864 len += bp->l;
865 }
866 if (sw == GENERATE)
867 gssapi_get_itokens(iph1, &gsstokens);
868 else
869 gssapi_get_rtokens(iph1, &gsstokens);
870 if (gsstokens == NULL)
871 return NULL;
872 len += gsstokens->l;
873 }
874 #endif
875
876 buf = vmalloc(len);
877 if (buf == NULL) {
878 plog(LLV_ERROR, LOCATION, NULL,
879 "failed to get hash buffer\n");
880 goto end;
881 }
882
883 p = buf->v;
884
885 bp = (sw == GENERATE ? iph1->dhpub : iph1->dhpub_p);
886 memcpy(p, bp->v, bp->l);
887 p += bp->l;
888
889 bp = (sw == GENERATE ? iph1->dhpub_p : iph1->dhpub);
890 memcpy(p, bp->v, bp->l);
891 p += bp->l;
892
893 if (iph1->side == INITIATOR)
894 bp2 = (sw == GENERATE ?
895 (char *)&iph1->index.i_ck : (char *)&iph1->index.r_ck);
896 else
897 bp2 = (sw == GENERATE ?
898 (char *)&iph1->index.r_ck : (char *)&iph1->index.i_ck);
899 bl = sizeof(cookie_t);
900 memcpy(p, bp2, bl);
901 p += bl;
902
903 if (iph1->side == INITIATOR)
904 bp2 = (sw == GENERATE ?
905 (char *)&iph1->index.r_ck : (char *)&iph1->index.i_ck);
906 else
907 bp2 = (sw == GENERATE ?
908 (char *)&iph1->index.i_ck : (char *)&iph1->index.r_ck);
909 bl = sizeof(cookie_t);
910 memcpy(p, bp2, bl);
911 p += bl;
912
913 bp = iph1->sa;
914 memcpy(p, bp->v, bp->l);
915 p += bp->l;
916
917 bp = (sw == GENERATE ? iph1->id : iph1->id_p);
918 memcpy(p, bp->v, bp->l);
919 p += bp->l;
920
921 #ifdef HAVE_GSSAPI
922 if (AUTHMETHOD(iph1) == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB) {
923 if (iph1->gi_i != NULL && iph1->gi_r != NULL) {
924 bp = (sw == GENERATE ? iph1->gi_i : iph1->gi_r);
925 memcpy(p, bp->v, bp->l);
926 p += bp->l;
927 }
928 memcpy(p, gsstokens->v, gsstokens->l);
929 p += gsstokens->l;
930 }
931 #endif
932
933 plog(LLV_DEBUG, LOCATION, NULL, "HASH with:\n");
934 plogdump(LLV_DEBUG, buf->v, buf->l);
935
936 /* compute HASH */
937 res = oakley_prf(iph1->skeyid, buf, iph1);
938 if (res == NULL)
939 goto end;
940
941 error = 0;
942
943 plog(LLV_DEBUG, LOCATION, NULL, "HASH (%s) computed:\n",
944 iph1->side == INITIATOR ? "init" : "resp");
945 plogdump(LLV_DEBUG, res->v, res->l);
946
947 end:
948 if (buf != NULL)
949 vfree(buf);
950 #ifdef HAVE_GSSAPI
951 if (gsstokens != NULL)
952 vfree(gsstokens);
953 #endif
954 return res;
955 }
956
957 /*
958 * compute HASH_I on base mode.
959 * base:psk,rsa
960 * HASH_I = prf(SKEYID, g^xi | CKY-I | CKY-R | SAi_b | IDii_b)
961 * base:sig
962 * HASH_I = prf(hash(Ni_b | Nr_b), g^xi | CKY-I | CKY-R | SAi_b | IDii_b)
963 */
964 vchar_t *
oakley_ph1hash_base_i(iph1,sw)965 oakley_ph1hash_base_i(iph1, sw)
966 struct ph1handle *iph1;
967 int sw;
968 {
969 vchar_t *buf = NULL, *res = NULL, *bp;
970 vchar_t *hashkey = NULL;
971 vchar_t *hash = NULL; /* for signature mode */
972 char *p;
973 int len;
974 int error = -1;
975
976 /* sanity check */
977 if (iph1->etype != ISAKMP_ETYPE_BASE) {
978 plog(LLV_ERROR, LOCATION, NULL,
979 "invalid etype for this hash function\n");
980 return NULL;
981 }
982
983 switch (AUTHMETHOD(iph1)) {
984 case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
985 case OAKLEY_ATTR_AUTH_METHOD_RSAENC:
986 case OAKLEY_ATTR_AUTH_METHOD_RSAREV:
987 #ifdef ENABLE_HYBRID
988 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I:
989 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R:
990 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I:
991 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R:
992 case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
993 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
994 #endif
995 if (iph1->skeyid == NULL) {
996 plog(LLV_ERROR, LOCATION, NULL, "no SKEYID found.\n");
997 return NULL;
998 }
999 hashkey = iph1->skeyid;
1000 break;
1001
1002 case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
1003 case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
1004 #ifdef HAVE_GSSAPI
1005 case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB:
1006 #endif
1007 #ifdef ENABLE_HYBRID
1008 case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
1009 case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
1010 case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
1011 case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
1012 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
1013 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
1014 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I:
1015 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:
1016 #endif
1017 /* make hash for seed */
1018 len = iph1->nonce->l + iph1->nonce_p->l;
1019 buf = vmalloc(len);
1020 if (buf == NULL) {
1021 plog(LLV_ERROR, LOCATION, NULL,
1022 "failed to get hash buffer\n");
1023 goto end;
1024 }
1025 p = buf->v;
1026
1027 bp = (sw == GENERATE ? iph1->nonce_p : iph1->nonce);
1028 memcpy(p, bp->v, bp->l);
1029 p += bp->l;
1030
1031 bp = (sw == GENERATE ? iph1->nonce : iph1->nonce_p);
1032 memcpy(p, bp->v, bp->l);
1033 p += bp->l;
1034
1035 hash = oakley_hash(buf, iph1);
1036 if (hash == NULL)
1037 goto end;
1038 vfree(buf);
1039 buf = NULL;
1040
1041 hashkey = hash;
1042 break;
1043
1044 default:
1045 plog(LLV_ERROR, LOCATION, NULL,
1046 "not supported authentication method %d\n",
1047 iph1->approval->authmethod);
1048 return NULL;
1049
1050 }
1051
1052 len = (sw == GENERATE ? iph1->dhpub->l : iph1->dhpub_p->l)
1053 + sizeof(cookie_t) * 2
1054 + iph1->sa->l
1055 + (sw == GENERATE ? iph1->id->l : iph1->id_p->l);
1056 buf = vmalloc(len);
1057 if (buf == NULL) {
1058 plog(LLV_ERROR, LOCATION, NULL,
1059 "failed to get hash buffer\n");
1060 goto end;
1061 }
1062 p = buf->v;
1063
1064 bp = (sw == GENERATE ? iph1->dhpub : iph1->dhpub_p);
1065 memcpy(p, bp->v, bp->l);
1066 p += bp->l;
1067
1068 memcpy(p, &iph1->index.i_ck, sizeof(cookie_t));
1069 p += sizeof(cookie_t);
1070 memcpy(p, &iph1->index.r_ck, sizeof(cookie_t));
1071 p += sizeof(cookie_t);
1072
1073 memcpy(p, iph1->sa->v, iph1->sa->l);
1074 p += iph1->sa->l;
1075
1076 bp = (sw == GENERATE ? iph1->id : iph1->id_p);
1077 memcpy(p, bp->v, bp->l);
1078 p += bp->l;
1079
1080 plog(LLV_DEBUG, LOCATION, NULL, "HASH_I with:\n");
1081 plogdump(LLV_DEBUG, buf->v, buf->l);
1082
1083 /* compute HASH */
1084 res = oakley_prf(hashkey, buf, iph1);
1085 if (res == NULL)
1086 goto end;
1087
1088 error = 0;
1089
1090 plog(LLV_DEBUG, LOCATION, NULL, "HASH_I computed:\n");
1091 plogdump(LLV_DEBUG, res->v, res->l);
1092
1093 end:
1094 if (hash != NULL)
1095 vfree(hash);
1096 if (buf != NULL)
1097 vfree(buf);
1098 return res;
1099 }
1100
1101 /*
1102 * compute HASH_R on base mode for signature method.
1103 * base:
1104 * HASH_R = prf(hash(Ni_b | Nr_b), g^xi | g^xr | CKY-I | CKY-R | SAi_b | IDii_b)
1105 */
1106 vchar_t *
oakley_ph1hash_base_r(iph1,sw)1107 oakley_ph1hash_base_r(iph1, sw)
1108 struct ph1handle *iph1;
1109 int sw;
1110 {
1111 vchar_t *buf = NULL, *res = NULL, *bp;
1112 vchar_t *hash = NULL;
1113 char *p;
1114 int len;
1115 int error = -1;
1116
1117 /* sanity check */
1118 if (iph1->etype != ISAKMP_ETYPE_BASE) {
1119 plog(LLV_ERROR, LOCATION, NULL,
1120 "invalid etype for this hash function\n");
1121 return NULL;
1122 }
1123
1124 switch(AUTHMETHOD(iph1)) {
1125 case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
1126 case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
1127 #ifdef ENABLE_HYBRID
1128 case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
1129 case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
1130 case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
1131 case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
1132 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
1133 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
1134 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I:
1135 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:
1136 case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
1137 #endif
1138 break;
1139 default:
1140 plog(LLV_ERROR, LOCATION, NULL,
1141 "not supported authentication method %d\n",
1142 iph1->approval->authmethod);
1143 return NULL;
1144 break;
1145 }
1146
1147 /* make hash for seed */
1148 len = iph1->nonce->l + iph1->nonce_p->l;
1149 buf = vmalloc(len);
1150 if (buf == NULL) {
1151 plog(LLV_ERROR, LOCATION, NULL,
1152 "failed to get hash buffer\n");
1153 goto end;
1154 }
1155 p = buf->v;
1156
1157 bp = (sw == GENERATE ? iph1->nonce_p : iph1->nonce);
1158 memcpy(p, bp->v, bp->l);
1159 p += bp->l;
1160
1161 bp = (sw == GENERATE ? iph1->nonce : iph1->nonce_p);
1162 memcpy(p, bp->v, bp->l);
1163 p += bp->l;
1164
1165 hash = oakley_hash(buf, iph1);
1166 if (hash == NULL)
1167 goto end;
1168 vfree(buf);
1169 buf = NULL;
1170
1171 /* make really hash */
1172 len = (sw == GENERATE ? iph1->dhpub_p->l : iph1->dhpub->l)
1173 + (sw == GENERATE ? iph1->dhpub->l : iph1->dhpub_p->l)
1174 + sizeof(cookie_t) * 2
1175 + iph1->sa->l
1176 + (sw == GENERATE ? iph1->id_p->l : iph1->id->l);
1177 buf = vmalloc(len);
1178 if (buf == NULL) {
1179 plog(LLV_ERROR, LOCATION, NULL,
1180 "failed to get hash buffer\n");
1181 goto end;
1182 }
1183 p = buf->v;
1184
1185
1186 bp = (sw == GENERATE ? iph1->dhpub_p : iph1->dhpub);
1187 memcpy(p, bp->v, bp->l);
1188 p += bp->l;
1189
1190 bp = (sw == GENERATE ? iph1->dhpub : iph1->dhpub_p);
1191 memcpy(p, bp->v, bp->l);
1192 p += bp->l;
1193
1194 memcpy(p, &iph1->index.i_ck, sizeof(cookie_t));
1195 p += sizeof(cookie_t);
1196 memcpy(p, &iph1->index.r_ck, sizeof(cookie_t));
1197 p += sizeof(cookie_t);
1198
1199 memcpy(p, iph1->sa->v, iph1->sa->l);
1200 p += iph1->sa->l;
1201
1202 bp = (sw == GENERATE ? iph1->id_p : iph1->id);
1203 memcpy(p, bp->v, bp->l);
1204 p += bp->l;
1205
1206 plog(LLV_DEBUG, LOCATION, NULL, "HASH_R with:\n");
1207 plogdump(LLV_DEBUG, buf->v, buf->l);
1208
1209 /* compute HASH */
1210 res = oakley_prf(hash, buf, iph1);
1211 if (res == NULL)
1212 goto end;
1213
1214 error = 0;
1215
1216 plog(LLV_DEBUG, LOCATION, NULL, "HASH_R computed:\n");
1217 plogdump(LLV_DEBUG, res->v, res->l);
1218
1219 end:
1220 if (buf != NULL)
1221 vfree(buf);
1222 if (hash)
1223 vfree(hash);
1224 return res;
1225 }
1226
1227 /*
1228 * compute each authentication method in phase 1.
1229 * OUT:
1230 * 0: OK
1231 * -1: error
1232 * other: error to be reply with notification.
1233 * the value is notification type.
1234 */
1235 int
oakley_validate_auth(iph1)1236 oakley_validate_auth(iph1)
1237 struct ph1handle *iph1;
1238 {
1239 vchar_t *my_hash = NULL;
1240 int result;
1241 #ifdef HAVE_GSSAPI
1242 vchar_t *gsshash = NULL;
1243 #endif
1244 #ifdef ENABLE_STATS
1245 struct timeval start, end;
1246 #endif
1247
1248 #ifdef ENABLE_STATS
1249 gettimeofday(&start, NULL);
1250 #endif
1251
1252 switch (AUTHMETHOD(iph1)) {
1253 case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
1254 #ifdef ENABLE_HYBRID
1255 case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
1256 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
1257 #endif
1258 /* validate HASH */
1259 {
1260 char *r_hash;
1261
1262 if (iph1->id_p == NULL || iph1->pl_hash == NULL) {
1263 plog(LLV_ERROR, LOCATION, iph1->remote,
1264 "few isakmp message received.\n");
1265 return ISAKMP_NTYPE_PAYLOAD_MALFORMED;
1266 }
1267 #ifdef ENABLE_HYBRID
1268 if (AUTHMETHOD(iph1) == FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I &&
1269 ((iph1->mode_cfg->flags & ISAKMP_CFG_VENDORID_XAUTH) == 0))
1270 {
1271 plog(LLV_ERROR, LOCATION, NULL, "No SIG was passed, "
1272 "hybrid auth is enabled, "
1273 "but peer is no Xauth compliant\n");
1274 return ISAKMP_NTYPE_SITUATION_NOT_SUPPORTED;
1275 break;
1276 }
1277 #endif
1278 r_hash = (caddr_t)(iph1->pl_hash + 1);
1279
1280 plog(LLV_DEBUG, LOCATION, NULL, "HASH received:\n");
1281 plogdump(LLV_DEBUG, r_hash,
1282 ntohs(iph1->pl_hash->h.len) - sizeof(*iph1->pl_hash));
1283
1284 switch (iph1->etype) {
1285 case ISAKMP_ETYPE_IDENT:
1286 case ISAKMP_ETYPE_AGG:
1287 my_hash = oakley_ph1hash_common(iph1, VALIDATE);
1288 break;
1289 case ISAKMP_ETYPE_BASE:
1290 if (iph1->side == INITIATOR)
1291 my_hash = oakley_ph1hash_common(iph1, VALIDATE);
1292 else
1293 my_hash = oakley_ph1hash_base_i(iph1, VALIDATE);
1294 break;
1295 default:
1296 plog(LLV_ERROR, LOCATION, NULL,
1297 "invalid etype %d\n", iph1->etype);
1298 return ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE;
1299 }
1300 if (my_hash == NULL)
1301 return ISAKMP_INTERNAL_ERROR;
1302
1303 result = memcmp(my_hash->v, r_hash, my_hash->l);
1304 vfree(my_hash);
1305
1306 if (result) {
1307 plog(LLV_ERROR, LOCATION, NULL, "HASH mismatched\n");
1308 return ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
1309 }
1310
1311 plog(LLV_DEBUG, LOCATION, NULL, "HASH for PSK validated.\n");
1312 }
1313 break;
1314 case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
1315 case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
1316 #ifdef ENABLE_HYBRID
1317 case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
1318 case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
1319 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
1320 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
1321 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I:
1322 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:
1323 #endif
1324 {
1325 int error = 0;
1326 int certtype = 0;
1327
1328 /* validation */
1329 if (iph1->id_p == NULL) {
1330 plog(LLV_ERROR, LOCATION, iph1->remote,
1331 "no ID payload was passed.\n");
1332 return ISAKMP_NTYPE_PAYLOAD_MALFORMED;
1333 }
1334 if (iph1->sig_p == NULL) {
1335 plog(LLV_ERROR, LOCATION, iph1->remote,
1336 "no SIG payload was passed.\n");
1337 return ISAKMP_NTYPE_PAYLOAD_MALFORMED;
1338 }
1339
1340 plog(LLV_DEBUG, LOCATION, NULL, "SIGN passed:\n");
1341 plogdump(LLV_DEBUG, iph1->sig_p->v, iph1->sig_p->l);
1342
1343 /* get peer's cert */
1344 switch (iph1->rmconf->getcert_method) {
1345 case ISAKMP_GETCERT_PAYLOAD:
1346 if (iph1->cert_p == NULL) {
1347 plog(LLV_ERROR, LOCATION, NULL,
1348 "no peer's CERT payload found.\n");
1349 return ISAKMP_INTERNAL_ERROR;
1350 }
1351 break;
1352 case ISAKMP_GETCERT_LOCALFILE:
1353 switch (iph1->rmconf->certtype) {
1354 case ISAKMP_CERT_X509SIGN:
1355 if (iph1->rmconf->peerscertfile == NULL) {
1356 plog(LLV_ERROR, LOCATION, NULL,
1357 "no peer's CERT file found.\n");
1358 return ISAKMP_INTERNAL_ERROR;
1359 }
1360
1361 /* don't use cached cert */
1362 if (iph1->cert_p != NULL) {
1363 oakley_delcert(iph1->cert_p);
1364 iph1->cert_p = NULL;
1365 }
1366
1367 error = get_cert_fromlocal(iph1, 0);
1368 #ifdef ANDROID_PATCHED
1369 if (!error)
1370 break;
1371 default:
1372 return ISAKMP_INTERNAL_ERROR;
1373 #else
1374 break;
1375 case ISAKMP_CERT_PLAINRSA:
1376 error = get_plainrsa_fromlocal(iph1, 0);
1377 break;
1378 }
1379 if (error)
1380 return ISAKMP_INTERNAL_ERROR;
1381 break;
1382 case ISAKMP_GETCERT_DNS:
1383 if (iph1->rmconf->peerscertfile != NULL) {
1384 plog(LLV_ERROR, LOCATION, NULL,
1385 "why peer's CERT file is defined "
1386 "though getcert method is dns ?\n");
1387 return ISAKMP_INTERNAL_ERROR;
1388 }
1389
1390 /* don't use cached cert */
1391 if (iph1->cert_p != NULL) {
1392 oakley_delcert(iph1->cert_p);
1393 iph1->cert_p = NULL;
1394 }
1395
1396 iph1->cert_p = dnssec_getcert(iph1->id_p);
1397 if (iph1->cert_p == NULL) {
1398 plog(LLV_ERROR, LOCATION, NULL,
1399 "no CERT RR found.\n");
1400 return ISAKMP_INTERNAL_ERROR;
1401 #endif
1402 }
1403 break;
1404 default:
1405 plog(LLV_ERROR, LOCATION, NULL,
1406 "invalid getcert_mothod: %d\n",
1407 iph1->rmconf->getcert_method);
1408 return ISAKMP_INTERNAL_ERROR;
1409 }
1410
1411 /* compare ID payload and certificate name */
1412 if (iph1->rmconf->verify_cert &&
1413 (error = oakley_check_certid(iph1)) != 0)
1414 return error;
1415
1416 /* verify certificate */
1417 if (iph1->rmconf->verify_cert
1418 && iph1->rmconf->getcert_method == ISAKMP_GETCERT_PAYLOAD) {
1419 certtype = iph1->rmconf->certtype;
1420 #ifdef ENABLE_HYBRID
1421 switch (AUTHMETHOD(iph1)) {
1422 case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
1423 case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
1424 certtype = iph1->cert_p->type;
1425 break;
1426 default:
1427 break;
1428 }
1429 #endif
1430 switch (certtype) {
1431 case ISAKMP_CERT_X509SIGN: {
1432 char path[MAXPATHLEN];
1433 char *ca;
1434
1435 if (iph1->rmconf->cacertfile != NULL) {
1436 getpathname(path, sizeof(path),
1437 LC_PATHTYPE_CERT,
1438 iph1->rmconf->cacertfile);
1439 ca = path;
1440 } else {
1441 ca = NULL;
1442 }
1443
1444 error = eay_check_x509cert(&iph1->cert_p->cert,
1445 lcconf->pathinfo[LC_PATHTYPE_CERT],
1446 ca, 0);
1447 break;
1448 }
1449
1450 default:
1451 plog(LLV_ERROR, LOCATION, NULL,
1452 "no supported certtype %d\n", certtype);
1453 return ISAKMP_INTERNAL_ERROR;
1454 }
1455 if (error != 0) {
1456 plog(LLV_ERROR, LOCATION, NULL,
1457 "the peer's certificate is not verified.\n");
1458 return ISAKMP_NTYPE_INVALID_CERT_AUTHORITY;
1459 }
1460 }
1461
1462 /* Generate a warning if verify_cert == 0
1463 */
1464 if (iph1->rmconf->verify_cert){
1465 plog(LLV_DEBUG, LOCATION, NULL, "CERT validated\n");
1466 }else{
1467 plog(LLV_WARNING, LOCATION, NULL,
1468 "CERT validation disabled by configuration\n");
1469 }
1470
1471 /* compute hash */
1472 switch (iph1->etype) {
1473 case ISAKMP_ETYPE_IDENT:
1474 case ISAKMP_ETYPE_AGG:
1475 my_hash = oakley_ph1hash_common(iph1, VALIDATE);
1476 break;
1477 case ISAKMP_ETYPE_BASE:
1478 if (iph1->side == INITIATOR)
1479 my_hash = oakley_ph1hash_base_r(iph1, VALIDATE);
1480 else
1481 my_hash = oakley_ph1hash_base_i(iph1, VALIDATE);
1482 break;
1483 default:
1484 plog(LLV_ERROR, LOCATION, NULL,
1485 "invalid etype %d\n", iph1->etype);
1486 return ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE;
1487 }
1488 if (my_hash == NULL)
1489 return ISAKMP_INTERNAL_ERROR;
1490
1491
1492 certtype = iph1->rmconf->certtype;
1493 #ifdef ENABLE_HYBRID
1494 switch (AUTHMETHOD(iph1)) {
1495 case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
1496 case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
1497 certtype = iph1->cert_p->type;
1498 break;
1499 default:
1500 break;
1501 }
1502 #endif
1503 /* check signature */
1504 switch (certtype) {
1505 case ISAKMP_CERT_X509SIGN:
1506 case ISAKMP_CERT_DNS:
1507 error = eay_check_x509sign(my_hash,
1508 iph1->sig_p,
1509 &iph1->cert_p->cert);
1510 break;
1511 #ifndef ANDROID_PATCHED
1512 case ISAKMP_CERT_PLAINRSA:
1513 iph1->rsa_p = rsa_try_check_rsasign(my_hash,
1514 iph1->sig_p, iph1->rsa_candidates);
1515 error = iph1->rsa_p ? 0 : -1;
1516
1517 break;
1518 #endif
1519 default:
1520 plog(LLV_ERROR, LOCATION, NULL,
1521 "no supported certtype %d\n",
1522 certtype);
1523 vfree(my_hash);
1524 return ISAKMP_INTERNAL_ERROR;
1525 }
1526
1527 vfree(my_hash);
1528 if (error != 0) {
1529 plog(LLV_ERROR, LOCATION, NULL,
1530 "Invalid SIG.\n");
1531 return ISAKMP_NTYPE_INVALID_SIGNATURE;
1532 }
1533 plog(LLV_DEBUG, LOCATION, NULL, "SIG authenticated\n");
1534 }
1535 break;
1536 #ifdef ENABLE_HYBRID
1537 case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
1538 case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
1539 {
1540 if ((iph1->mode_cfg->flags & ISAKMP_CFG_VENDORID_XAUTH) == 0) {
1541 plog(LLV_ERROR, LOCATION, NULL, "No SIG was passed, "
1542 "hybrid auth is enabled, "
1543 "but peer is no Xauth compliant\n");
1544 return ISAKMP_NTYPE_SITUATION_NOT_SUPPORTED;
1545 break;
1546 }
1547 plog(LLV_INFO, LOCATION, NULL, "No SIG was passed, "
1548 "but hybrid auth is enabled\n");
1549
1550 return 0;
1551 break;
1552 }
1553 #endif
1554 #ifdef HAVE_GSSAPI
1555 case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB:
1556 /* check if we're not into XAUTH_PSKEY_I instead */
1557 #ifdef ENABLE_HYBRID
1558 if (iph1->rmconf->xauth)
1559 break;
1560 #endif
1561 switch (iph1->etype) {
1562 case ISAKMP_ETYPE_IDENT:
1563 case ISAKMP_ETYPE_AGG:
1564 my_hash = oakley_ph1hash_common(iph1, VALIDATE);
1565 break;
1566 default:
1567 plog(LLV_ERROR, LOCATION, NULL,
1568 "invalid etype %d\n", iph1->etype);
1569 return ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE;
1570 }
1571
1572 if (my_hash == NULL) {
1573 if (gssapi_more_tokens(iph1))
1574 return ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE;
1575 else
1576 return ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
1577 }
1578
1579 gsshash = gssapi_unwraphash(iph1);
1580 if (gsshash == NULL) {
1581 vfree(my_hash);
1582 return ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
1583 }
1584
1585 result = memcmp(my_hash->v, gsshash->v, my_hash->l);
1586 vfree(my_hash);
1587 vfree(gsshash);
1588
1589 if (result) {
1590 plog(LLV_ERROR, LOCATION, NULL, "HASH mismatched\n");
1591 return ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
1592 }
1593 plog(LLV_DEBUG, LOCATION, NULL, "hash compared OK\n");
1594 break;
1595 #endif
1596 case OAKLEY_ATTR_AUTH_METHOD_RSAENC:
1597 case OAKLEY_ATTR_AUTH_METHOD_RSAREV:
1598 #ifdef ENABLE_HYBRID
1599 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I:
1600 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R:
1601 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I:
1602 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R:
1603 #endif
1604 if (iph1->id_p == NULL || iph1->pl_hash == NULL) {
1605 plog(LLV_ERROR, LOCATION, iph1->remote,
1606 "few isakmp message received.\n");
1607 return ISAKMP_NTYPE_PAYLOAD_MALFORMED;
1608 }
1609 plog(LLV_ERROR, LOCATION, iph1->remote,
1610 "not supported authmethod type %s\n",
1611 s_oakley_attr_method(iph1->approval->authmethod));
1612 return ISAKMP_INTERNAL_ERROR;
1613 default:
1614 plog(LLV_ERROR, LOCATION, iph1->remote,
1615 "invalid authmethod %d why ?\n",
1616 iph1->approval->authmethod);
1617 return ISAKMP_INTERNAL_ERROR;
1618 }
1619 #ifdef ENABLE_STATS
1620 gettimeofday(&end, NULL);
1621 syslog(LOG_NOTICE, "%s(%s): %8.6f", __func__,
1622 s_oakley_attr_method(iph1->approval->authmethod),
1623 timedelta(&start, &end));
1624 #endif
1625
1626 return 0;
1627 }
1628
1629 /* get my certificate
1630 * NOTE: include certificate type.
1631 */
1632 int
oakley_getmycert(iph1)1633 oakley_getmycert(iph1)
1634 struct ph1handle *iph1;
1635 {
1636 switch (iph1->rmconf->certtype) {
1637 case ISAKMP_CERT_X509SIGN:
1638 if (iph1->cert)
1639 return 0;
1640 return get_cert_fromlocal(iph1, 1);
1641 #ifndef ANDROID_PATCHED
1642 case ISAKMP_CERT_PLAINRSA:
1643 if (iph1->rsa)
1644 return 0;
1645 return get_plainrsa_fromlocal(iph1, 1);
1646 #endif
1647 default:
1648 plog(LLV_ERROR, LOCATION, NULL,
1649 "Unknown certtype #%d\n",
1650 iph1->rmconf->certtype);
1651 return -1;
1652 }
1653
1654 }
1655
1656 /*
1657 * get a CERT from local file.
1658 * IN:
1659 * my != 0 my cert.
1660 * my == 0 peer's cert.
1661 */
1662 static int
get_cert_fromlocal(iph1,my)1663 get_cert_fromlocal(iph1, my)
1664 struct ph1handle *iph1;
1665 int my;
1666 {
1667 char path[MAXPATHLEN];
1668 vchar_t *cert = NULL;
1669 cert_t **certpl;
1670 char *certfile;
1671 int error = -1;
1672
1673 if (my) {
1674 certfile = iph1->rmconf->mycertfile;
1675 certpl = &iph1->cert;
1676 } else {
1677 certfile = iph1->rmconf->peerscertfile;
1678 certpl = &iph1->cert_p;
1679 }
1680 if (!certfile) {
1681 plog(LLV_ERROR, LOCATION, NULL, "no CERT defined.\n");
1682 return 0;
1683 }
1684
1685 switch (iph1->rmconf->certtype) {
1686 case ISAKMP_CERT_X509SIGN:
1687 case ISAKMP_CERT_DNS:
1688 /* make public file name */
1689 getpathname(path, sizeof(path), LC_PATHTYPE_CERT, certfile);
1690 cert = eay_get_x509cert(path);
1691 if (cert) {
1692 char *p = NULL;
1693 p = eay_get_x509text(cert);
1694 plog(LLV_DEBUG, LOCATION, NULL, "%s", p ? p : "\n");
1695 racoon_free(p);
1696 };
1697 break;
1698
1699 default:
1700 plog(LLV_ERROR, LOCATION, NULL,
1701 "not supported certtype %d\n",
1702 iph1->rmconf->certtype);
1703 goto end;
1704 }
1705
1706 if (!cert) {
1707 plog(LLV_ERROR, LOCATION, NULL,
1708 "failed to get %s CERT.\n",
1709 my ? "my" : "peers");
1710 goto end;
1711 }
1712
1713 *certpl = oakley_newcert();
1714 if (!*certpl) {
1715 plog(LLV_ERROR, LOCATION, NULL,
1716 "failed to get cert buffer.\n");
1717 goto end;
1718 }
1719 (*certpl)->pl = vmalloc(cert->l + 1);
1720 if ((*certpl)->pl == NULL) {
1721 plog(LLV_ERROR, LOCATION, NULL,
1722 "failed to get cert buffer\n");
1723 oakley_delcert(*certpl);
1724 *certpl = NULL;
1725 goto end;
1726 }
1727 memcpy((*certpl)->pl->v + 1, cert->v, cert->l);
1728 (*certpl)->pl->v[0] = iph1->rmconf->certtype;
1729 (*certpl)->type = iph1->rmconf->certtype;
1730 (*certpl)->cert.v = (*certpl)->pl->v + 1;
1731 (*certpl)->cert.l = (*certpl)->pl->l - 1;
1732
1733 plog(LLV_DEBUG, LOCATION, NULL, "created CERT payload:\n");
1734 plogdump(LLV_DEBUG, (*certpl)->pl->v, (*certpl)->pl->l);
1735
1736 error = 0;
1737
1738 end:
1739 if (cert != NULL)
1740 vfree(cert);
1741
1742 return error;
1743 }
1744
1745 #ifndef ANDROID_PATCHED
1746 static int
get_plainrsa_fromlocal(iph1,my)1747 get_plainrsa_fromlocal(iph1, my)
1748 struct ph1handle *iph1;
1749 int my;
1750 {
1751 char path[MAXPATHLEN];
1752 vchar_t *cert = NULL;
1753 char *certfile;
1754 int error = -1;
1755
1756 iph1->rsa_candidates = rsa_lookup_keys(iph1, my);
1757 if (!iph1->rsa_candidates ||
1758 rsa_list_count(iph1->rsa_candidates) == 0) {
1759 plog(LLV_ERROR, LOCATION, NULL,
1760 "%s RSA key not found for %s\n",
1761 my ? "Private" : "Public",
1762 saddr2str_fromto("%s <-> %s",
1763 iph1->local, iph1->remote));
1764 goto end;
1765 }
1766
1767 if (my && rsa_list_count(iph1->rsa_candidates) > 1) {
1768 plog(LLV_WARNING, LOCATION, NULL,
1769 "More than one (=%lu) private "
1770 "PlainRSA key found for %s\n",
1771 rsa_list_count(iph1->rsa_candidates),
1772 saddr2str_fromto("%s <-> %s",
1773 iph1->local, iph1->remote));
1774 plog(LLV_WARNING, LOCATION, NULL,
1775 "This may have unpredictable results, "
1776 "i.e. wrong key could be used!\n");
1777 plog(LLV_WARNING, LOCATION, NULL,
1778 "Consider using only one single private "
1779 "key for all peers...\n");
1780 }
1781 if (my) {
1782 iph1->rsa = ((struct rsa_key *)
1783 genlist_next(iph1->rsa_candidates, NULL))->rsa;
1784
1785 genlist_free(iph1->rsa_candidates, NULL);
1786 iph1->rsa_candidates = NULL;
1787
1788 if (iph1->rsa == NULL)
1789 goto end;
1790 }
1791
1792 error = 0;
1793
1794 end:
1795 return error;
1796 }
1797 #endif
1798
1799 /* get signature */
1800 int
oakley_getsign(iph1)1801 oakley_getsign(iph1)
1802 struct ph1handle *iph1;
1803 {
1804 char path[MAXPATHLEN];
1805 vchar_t *privkey = NULL;
1806 int error = -1;
1807
1808 switch (iph1->rmconf->certtype) {
1809 case ISAKMP_CERT_X509SIGN:
1810 case ISAKMP_CERT_DNS:
1811 if (iph1->rmconf->myprivfile == NULL) {
1812 plog(LLV_ERROR, LOCATION, NULL, "no cert defined.\n");
1813 goto end;
1814 }
1815
1816 /* make private file name */
1817 getpathname(path, sizeof(path),
1818 LC_PATHTYPE_CERT,
1819 iph1->rmconf->myprivfile);
1820 privkey = privsep_eay_get_pkcs1privkey(path);
1821 if (privkey == NULL) {
1822 plog(LLV_ERROR, LOCATION, NULL,
1823 "failed to get private key.\n");
1824 goto end;
1825 }
1826 plog(LLV_DEBUG2, LOCATION, NULL, "private key:\n");
1827 plogdump(LLV_DEBUG2, privkey->v, privkey->l);
1828
1829 iph1->sig = eay_get_x509sign(iph1->hash, privkey);
1830 break;
1831 #ifndef ANDROID_PATCHED
1832 case ISAKMP_CERT_PLAINRSA:
1833 iph1->sig = eay_get_rsasign(iph1->hash, iph1->rsa);
1834 break;
1835 #endif
1836 default:
1837 plog(LLV_ERROR, LOCATION, NULL,
1838 "Unknown certtype #%d\n",
1839 iph1->rmconf->certtype);
1840 goto end;
1841 }
1842
1843 if (iph1->sig == NULL) {
1844 plog(LLV_ERROR, LOCATION, NULL, "failed to sign.\n");
1845 goto end;
1846 }
1847
1848 plog(LLV_DEBUG, LOCATION, NULL, "SIGN computed:\n");
1849 plogdump(LLV_DEBUG, iph1->sig->v, iph1->sig->l);
1850
1851 error = 0;
1852
1853 end:
1854 if (privkey != NULL)
1855 vfree(privkey);
1856
1857 return error;
1858 }
1859
1860 /*
1861 * compare certificate name and ID value.
1862 */
1863 static int
oakley_check_certid(iph1)1864 oakley_check_certid(iph1)
1865 struct ph1handle *iph1;
1866 {
1867 struct ipsecdoi_id_b *id_b;
1868 vchar_t *name = NULL;
1869 char *altname = NULL;
1870 int idlen, type;
1871 int error;
1872
1873 if (iph1->id_p == NULL || iph1->cert_p == NULL) {
1874 plog(LLV_ERROR, LOCATION, NULL, "no ID nor CERT found.\n");
1875 return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
1876 }
1877
1878 id_b = (struct ipsecdoi_id_b *)iph1->id_p->v;
1879 idlen = iph1->id_p->l - sizeof(*id_b);
1880
1881 switch (id_b->type) {
1882 case IPSECDOI_ID_DER_ASN1_DN:
1883 name = eay_get_x509asn1subjectname(&iph1->cert_p->cert);
1884 if (!name) {
1885 plog(LLV_ERROR, LOCATION, NULL,
1886 "failed to get subjectName\n");
1887 return ISAKMP_NTYPE_INVALID_CERTIFICATE;
1888 }
1889 if (idlen != name->l) {
1890 plog(LLV_ERROR, LOCATION, NULL,
1891 "Invalid ID length in phase 1.\n");
1892 vfree(name);
1893 return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
1894 }
1895 error = memcmp(id_b + 1, name->v, idlen);
1896 vfree(name);
1897 if (error != 0) {
1898 plog(LLV_ERROR, LOCATION, NULL,
1899 "ID mismatched with ASN1 SubjectName.\n");
1900 plogdump(LLV_DEBUG, id_b + 1, idlen);
1901 plogdump(LLV_DEBUG, name->v, idlen);
1902 return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
1903 }
1904 return 0;
1905 case IPSECDOI_ID_IPV4_ADDR:
1906 case IPSECDOI_ID_IPV6_ADDR:
1907 {
1908 /*
1909 * converting to binary from string because openssl return
1910 * a string even if object is a binary.
1911 * XXX fix it ! access by ASN.1 directly without.
1912 */
1913 struct addrinfo hints, *res;
1914 caddr_t a = NULL;
1915 int pos;
1916
1917 for (pos = 1; ; pos++) {
1918 if (eay_get_x509subjectaltname(&iph1->cert_p->cert,
1919 &altname, &type, pos) !=0) {
1920 plog(LLV_ERROR, LOCATION, NULL,
1921 "failed to get subjectAltName\n");
1922 return ISAKMP_NTYPE_INVALID_CERTIFICATE;
1923 }
1924
1925 /* it's the end condition of the loop. */
1926 if (!altname) {
1927 plog(LLV_ERROR, LOCATION, NULL,
1928 "no proper subjectAltName.\n");
1929 return ISAKMP_NTYPE_INVALID_CERTIFICATE;
1930 }
1931
1932 if (check_typeofcertname(id_b->type, type) == 0)
1933 break;
1934
1935 /* next name */
1936 racoon_free(altname);
1937 altname = NULL;
1938 }
1939 memset(&hints, 0, sizeof(hints));
1940 hints.ai_family = PF_UNSPEC;
1941 hints.ai_socktype = SOCK_RAW;
1942 hints.ai_flags = AI_NUMERICHOST;
1943 error = getaddrinfo(altname, NULL, &hints, &res);
1944 if (error != 0) {
1945 plog(LLV_ERROR, LOCATION, NULL,
1946 "no proper subjectAltName.\n");
1947 racoon_free(altname);
1948 return ISAKMP_NTYPE_INVALID_CERTIFICATE;
1949 }
1950 switch (res->ai_family) {
1951 case AF_INET:
1952 a = (caddr_t)&((struct sockaddr_in *)res->ai_addr)->sin_addr.s_addr;
1953 break;
1954 #ifdef INET6
1955 case AF_INET6:
1956 a = (caddr_t)&((struct sockaddr_in6 *)res->ai_addr)->sin6_addr.s6_addr;
1957 break;
1958 #endif
1959 default:
1960 plog(LLV_ERROR, LOCATION, NULL,
1961 "family not supported: %d.\n", res->ai_family);
1962 racoon_free(altname);
1963 freeaddrinfo(res);
1964 return ISAKMP_NTYPE_INVALID_CERTIFICATE;
1965 }
1966 error = memcmp(id_b + 1, a, idlen);
1967 freeaddrinfo(res);
1968 vfree(name);
1969 if (error != 0) {
1970 plog(LLV_ERROR, LOCATION, NULL,
1971 "ID mismatched with subjectAltName.\n");
1972 plogdump(LLV_DEBUG, id_b + 1, idlen);
1973 plogdump(LLV_DEBUG, a, idlen);
1974 return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
1975 }
1976 return 0;
1977 }
1978 case IPSECDOI_ID_FQDN:
1979 case IPSECDOI_ID_USER_FQDN:
1980 {
1981 int pos;
1982
1983 for (pos = 1; ; pos++) {
1984 if (eay_get_x509subjectaltname(&iph1->cert_p->cert,
1985 &altname, &type, pos) != 0){
1986 plog(LLV_ERROR, LOCATION, NULL,
1987 "failed to get subjectAltName\n");
1988 return ISAKMP_NTYPE_INVALID_CERTIFICATE;
1989 }
1990
1991 /* it's the end condition of the loop. */
1992 if (!altname) {
1993 plog(LLV_ERROR, LOCATION, NULL,
1994 "no proper subjectAltName.\n");
1995 return ISAKMP_NTYPE_INVALID_CERTIFICATE;
1996 }
1997
1998 if (check_typeofcertname(id_b->type, type) == 0)
1999 break;
2000
2001 /* next name */
2002 racoon_free(altname);
2003 altname = NULL;
2004 }
2005 if (idlen != strlen(altname)) {
2006 plog(LLV_ERROR, LOCATION, NULL,
2007 "Invalid ID length in phase 1.\n");
2008 racoon_free(altname);
2009 return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
2010 }
2011 if (check_typeofcertname(id_b->type, type) != 0) {
2012 plog(LLV_ERROR, LOCATION, NULL,
2013 "ID type mismatched. ID: %s CERT: %s.\n",
2014 s_ipsecdoi_ident(id_b->type),
2015 s_ipsecdoi_ident(type));
2016 racoon_free(altname);
2017 return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
2018 }
2019 error = memcmp(id_b + 1, altname, idlen);
2020 if (error) {
2021 plog(LLV_ERROR, LOCATION, NULL, "ID mismatched.\n");
2022 plogdump(LLV_DEBUG, id_b + 1, idlen);
2023 plogdump(LLV_DEBUG, altname, idlen);
2024 racoon_free(altname);
2025 return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
2026 }
2027 racoon_free(altname);
2028 return 0;
2029 }
2030 default:
2031 plog(LLV_ERROR, LOCATION, NULL,
2032 "Inpropper ID type passed: %s.\n",
2033 s_ipsecdoi_ident(id_b->type));
2034 return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
2035 }
2036 /*NOTREACHED*/
2037 }
2038
2039 static int
check_typeofcertname(doi,genid)2040 check_typeofcertname(doi, genid)
2041 int doi, genid;
2042 {
2043 switch (doi) {
2044 case IPSECDOI_ID_IPV4_ADDR:
2045 case IPSECDOI_ID_IPV4_ADDR_SUBNET:
2046 case IPSECDOI_ID_IPV6_ADDR:
2047 case IPSECDOI_ID_IPV6_ADDR_SUBNET:
2048 case IPSECDOI_ID_IPV4_ADDR_RANGE:
2049 case IPSECDOI_ID_IPV6_ADDR_RANGE:
2050 if (genid != GENT_IPADD)
2051 return -1;
2052 return 0;
2053 case IPSECDOI_ID_FQDN:
2054 if (genid != GENT_DNS)
2055 return -1;
2056 return 0;
2057 case IPSECDOI_ID_USER_FQDN:
2058 if (genid != GENT_EMAIL)
2059 return -1;
2060 return 0;
2061 case IPSECDOI_ID_DER_ASN1_DN: /* should not be passed to this function*/
2062 case IPSECDOI_ID_DER_ASN1_GN:
2063 case IPSECDOI_ID_KEY_ID:
2064 default:
2065 return -1;
2066 }
2067 /*NOTREACHED*/
2068 }
2069
2070 /*
2071 * save certificate including certificate type.
2072 */
2073 int
oakley_savecert(iph1,gen)2074 oakley_savecert(iph1, gen)
2075 struct ph1handle *iph1;
2076 struct isakmp_gen *gen;
2077 {
2078 cert_t **c;
2079 u_int8_t type;
2080 STACK_OF(X509) *certs=NULL;
2081 PKCS7 *p7;
2082
2083 type = *(u_int8_t *)(gen + 1) & 0xff;
2084
2085 switch (type) {
2086 case ISAKMP_CERT_DNS:
2087 plog(LLV_WARNING, LOCATION, NULL,
2088 "CERT payload is unnecessary in DNSSEC. "
2089 "ignore this CERT payload.\n");
2090 return 0;
2091 case ISAKMP_CERT_PKCS7:
2092 case ISAKMP_CERT_PGP:
2093 case ISAKMP_CERT_X509SIGN:
2094 case ISAKMP_CERT_KERBEROS:
2095 case ISAKMP_CERT_SPKI:
2096 c = &iph1->cert_p;
2097 break;
2098 case ISAKMP_CERT_CRL:
2099 c = &iph1->crl_p;
2100 break;
2101 case ISAKMP_CERT_X509KE:
2102 case ISAKMP_CERT_X509ATTR:
2103 case ISAKMP_CERT_ARL:
2104 plog(LLV_ERROR, LOCATION, NULL,
2105 "No supported such CERT type %d\n", type);
2106 return -1;
2107 default:
2108 plog(LLV_ERROR, LOCATION, NULL,
2109 "Invalid CERT type %d\n", type);
2110 return -1;
2111 }
2112
2113 /* XXX choice the 1th cert, ignore after the cert. */
2114 /* XXX should be processed. */
2115 if (*c) {
2116 plog(LLV_WARNING, LOCATION, NULL,
2117 "ignore 2nd CERT payload.\n");
2118 return 0;
2119 }
2120
2121 if (type == ISAKMP_CERT_PKCS7) {
2122 u_char *bp;
2123 int i;
2124
2125 /* Skip the header */
2126 bp = (u_char *)(gen + 1);
2127 /* And the first byte is the certificate type,
2128 * we know that already
2129 */
2130 bp++;
2131 p7 = d2i_PKCS7(NULL, (void *)&bp,
2132 ntohs(gen->len) - sizeof(*gen) - 1);
2133
2134 if (!p7) {
2135 plog(LLV_ERROR, LOCATION, NULL,
2136 "Failed to parse PKCS#7 CERT.\n");
2137 return -1;
2138 }
2139
2140 /* Copied this from the openssl pkcs7 application;
2141 * there"s little by way of documentation for any of
2142 * it. I can only presume it"s correct.
2143 */
2144
2145 i = OBJ_obj2nid(p7->type);
2146 switch (i) {
2147 case NID_pkcs7_signed:
2148 certs=p7->d.sign->cert;
2149 break;
2150 case NID_pkcs7_signedAndEnveloped:
2151 certs=p7->d.signed_and_enveloped->cert;
2152 break;
2153 default:
2154 break;
2155 }
2156
2157 if (!certs) {
2158 plog(LLV_ERROR, LOCATION, NULL,
2159 "CERT PKCS#7 bundle contains no certs.\n");
2160 PKCS7_free(p7);
2161 return -1;
2162 }
2163
2164 for (i = 0; i < sk_X509_num(certs); i++) {
2165 int len;
2166 u_char *bp;
2167 X509 *cert = sk_X509_value(certs,i);
2168
2169 plog(LLV_DEBUG, LOCATION, NULL,
2170 "Trying PKCS#7 cert %d.\n", i);
2171
2172 /* We'll just try each cert in turn */
2173 *c = save_certx509(cert);
2174
2175 if (!*c) {
2176 plog(LLV_ERROR, LOCATION, NULL,
2177 "Failed to get CERT buffer.\n");
2178 continue;
2179 }
2180
2181 /* Ignore cert if it doesn't match identity
2182 * XXX If verify cert is disabled, we still just take
2183 * the first certificate....
2184 */
2185 if(iph1->rmconf->verify_cert &&
2186 oakley_check_certid(iph1)) {
2187 plog(LLV_DEBUG, LOCATION, NULL,
2188 "Discarding CERT: does not match ID.\n");
2189 oakley_delcert((*c));
2190 *c = NULL;
2191 continue;
2192 }
2193
2194 {
2195 char *p = eay_get_x509text(&(*c)->cert);
2196 plog(LLV_DEBUG, LOCATION, NULL, "CERT saved:\n");
2197 plogdump(LLV_DEBUG, (*c)->cert.v, (*c)->cert.l);
2198 plog(LLV_DEBUG, LOCATION, NULL, "%s",
2199 p ? p : "\n");
2200 racoon_free(p);
2201 }
2202 break;
2203 }
2204 PKCS7_free(p7);
2205
2206 } else {
2207 *c = save_certbuf(gen);
2208 if (!*c) {
2209 plog(LLV_ERROR, LOCATION, NULL,
2210 "Failed to get CERT buffer.\n");
2211 return -1;
2212 }
2213
2214 switch ((*c)->type) {
2215 case ISAKMP_CERT_DNS:
2216 plog(LLV_WARNING, LOCATION, NULL,
2217 "CERT payload is unnecessary in DNSSEC. "
2218 "ignore it.\n");
2219 return 0;
2220 case ISAKMP_CERT_PGP:
2221 case ISAKMP_CERT_X509SIGN:
2222 case ISAKMP_CERT_KERBEROS:
2223 case ISAKMP_CERT_SPKI:
2224 /* Ignore cert if it doesn't match identity
2225 * XXX If verify cert is disabled, we still just take
2226 * the first certificate....
2227 */
2228 if(iph1->rmconf->verify_cert &&
2229 oakley_check_certid(iph1)){
2230 plog(LLV_DEBUG, LOCATION, NULL,
2231 "Discarding CERT: does not match ID.\n");
2232 oakley_delcert((*c));
2233 *c = NULL;
2234 return 0;
2235 }
2236
2237 {
2238 char *p = eay_get_x509text(&(*c)->cert);
2239 plog(LLV_DEBUG, LOCATION, NULL, "CERT saved:\n");
2240 plogdump(LLV_DEBUG, (*c)->cert.v, (*c)->cert.l);
2241 plog(LLV_DEBUG, LOCATION, NULL, "%s", p ? p : "\n");
2242 racoon_free(p);
2243 }
2244 break;
2245 case ISAKMP_CERT_CRL:
2246 plog(LLV_DEBUG, LOCATION, NULL, "CRL saved:\n");
2247 plogdump(LLV_DEBUG, (*c)->cert.v, (*c)->cert.l);
2248 break;
2249 case ISAKMP_CERT_X509KE:
2250 case ISAKMP_CERT_X509ATTR:
2251 case ISAKMP_CERT_ARL:
2252 default:
2253 /* XXX */
2254 oakley_delcert((*c));
2255 *c = NULL;
2256 return 0;
2257 }
2258 }
2259
2260 return 0;
2261 }
2262
2263 /*
2264 * save certificate including certificate type.
2265 */
2266 int
oakley_savecr(iph1,gen)2267 oakley_savecr(iph1, gen)
2268 struct ph1handle *iph1;
2269 struct isakmp_gen *gen;
2270 {
2271 cert_t **c;
2272 u_int8_t type;
2273
2274 type = *(u_int8_t *)(gen + 1) & 0xff;
2275
2276 switch (type) {
2277 case ISAKMP_CERT_DNS:
2278 plog(LLV_WARNING, LOCATION, NULL,
2279 "CERT payload is unnecessary in DNSSEC\n");
2280 /*FALLTHRU*/
2281 case ISAKMP_CERT_PKCS7:
2282 case ISAKMP_CERT_PGP:
2283 case ISAKMP_CERT_X509SIGN:
2284 case ISAKMP_CERT_KERBEROS:
2285 case ISAKMP_CERT_SPKI:
2286 c = &iph1->cr_p;
2287 break;
2288 case ISAKMP_CERT_X509KE:
2289 case ISAKMP_CERT_X509ATTR:
2290 case ISAKMP_CERT_ARL:
2291 plog(LLV_ERROR, LOCATION, NULL,
2292 "No supported such CR type %d\n", type);
2293 return -1;
2294 case ISAKMP_CERT_CRL:
2295 default:
2296 plog(LLV_ERROR, LOCATION, NULL,
2297 "Invalid CR type %d\n", type);
2298 return -1;
2299 }
2300
2301 *c = save_certbuf(gen);
2302 if (!*c) {
2303 plog(LLV_ERROR, LOCATION, NULL,
2304 "Failed to get CR buffer.\n");
2305 return -1;
2306 }
2307
2308 plog(LLV_DEBUG, LOCATION, NULL, "CR saved:\n");
2309 plogdump(LLV_DEBUG, (*c)->cert.v, (*c)->cert.l);
2310
2311 return 0;
2312 }
2313
2314 static cert_t *
save_certbuf(gen)2315 save_certbuf(gen)
2316 struct isakmp_gen *gen;
2317 {
2318 cert_t *new;
2319
2320 if(ntohs(gen->len) <= sizeof(*gen)){
2321 plog(LLV_ERROR, LOCATION, NULL,
2322 "Len is too small !!.\n");
2323 return NULL;
2324 }
2325
2326 new = oakley_newcert();
2327 if (!new) {
2328 plog(LLV_ERROR, LOCATION, NULL,
2329 "Failed to get CERT buffer.\n");
2330 return NULL;
2331 }
2332
2333 new->pl = vmalloc(ntohs(gen->len) - sizeof(*gen));
2334 if (new->pl == NULL) {
2335 plog(LLV_ERROR, LOCATION, NULL,
2336 "Failed to copy CERT from packet.\n");
2337 oakley_delcert(new);
2338 new = NULL;
2339 return NULL;
2340 }
2341 memcpy(new->pl->v, gen + 1, new->pl->l);
2342 new->type = new->pl->v[0] & 0xff;
2343 new->cert.v = new->pl->v + 1;
2344 new->cert.l = new->pl->l - 1;
2345
2346 return new;
2347 }
2348
2349 static cert_t *
save_certx509(cert)2350 save_certx509(cert)
2351 X509 *cert;
2352 {
2353 cert_t *new;
2354 int len;
2355 u_char *bp;
2356
2357 new = oakley_newcert();
2358 if (!new) {
2359 plog(LLV_ERROR, LOCATION, NULL,
2360 "Failed to get CERT buffer.\n");
2361 return NULL;
2362 }
2363
2364 len = i2d_X509(cert, NULL);
2365 new->pl = vmalloc(len);
2366 if (new->pl == NULL) {
2367 plog(LLV_ERROR, LOCATION, NULL,
2368 "Failed to copy CERT from packet.\n");
2369 oakley_delcert(new);
2370 new = NULL;
2371 return NULL;
2372 }
2373 bp = (u_char *) new->pl->v;
2374 len = i2d_X509(cert, &bp);
2375 new->type = ISAKMP_CERT_X509SIGN;
2376 new->cert.v = new->pl->v;
2377 new->cert.l = new->pl->l;
2378
2379 return new;
2380 }
2381
2382 /*
2383 * get my CR.
2384 * NOTE: No Certificate Authority field is included to CR payload at the
2385 * moment. Becuase any certificate authority are accepted without any check.
2386 * The section 3.10 in RFC2408 says that this field SHOULD not be included,
2387 * if there is no specific certificate authority requested.
2388 */
2389 vchar_t *
oakley_getcr(iph1)2390 oakley_getcr(iph1)
2391 struct ph1handle *iph1;
2392 {
2393 vchar_t *buf;
2394
2395 buf = vmalloc(1);
2396 if (buf == NULL) {
2397 plog(LLV_ERROR, LOCATION, NULL,
2398 "failed to get cr buffer\n");
2399 return NULL;
2400 }
2401 if(iph1->rmconf->certtype == ISAKMP_CERT_NONE) {
2402 buf->v[0] = iph1->rmconf->cacerttype;
2403 plog(LLV_DEBUG, LOCATION, NULL, "create my CR: NONE, using %s instead\n",
2404 s_isakmp_certtype(iph1->rmconf->cacerttype));
2405 } else {
2406 buf->v[0] = iph1->rmconf->certtype;
2407 plog(LLV_DEBUG, LOCATION, NULL, "create my CR: %s\n",
2408 s_isakmp_certtype(iph1->rmconf->certtype));
2409 }
2410 if (buf->l > 1)
2411 plogdump(LLV_DEBUG, buf->v, buf->l);
2412
2413 return buf;
2414 }
2415
2416 /*
2417 * check peer's CR.
2418 */
2419 int
oakley_checkcr(iph1)2420 oakley_checkcr(iph1)
2421 struct ph1handle *iph1;
2422 {
2423 if (iph1->cr_p == NULL)
2424 return 0;
2425
2426 plog(LLV_DEBUG, LOCATION, iph1->remote,
2427 "peer transmitted CR: %s\n",
2428 s_isakmp_certtype(iph1->cr_p->type));
2429
2430 if (iph1->cr_p->type != iph1->rmconf->certtype) {
2431 plog(LLV_ERROR, LOCATION, iph1->remote,
2432 "such a cert type isn't supported: %d\n",
2433 (char)iph1->cr_p->type);
2434 return -1;
2435 }
2436
2437 return 0;
2438 }
2439
2440 /*
2441 * check to need CR payload.
2442 */
2443 int
oakley_needcr(type)2444 oakley_needcr(type)
2445 int type;
2446 {
2447 switch (type) {
2448 case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
2449 case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
2450 #ifdef ENABLE_HYBRID
2451 case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
2452 case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
2453 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
2454 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
2455 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I:
2456 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:
2457 #endif
2458 return 1;
2459 default:
2460 return 0;
2461 }
2462 /*NOTREACHED*/
2463 }
2464
2465 /*
2466 * compute SKEYID
2467 * see seciton 5. Exchanges in RFC 2409
2468 * psk: SKEYID = prf(pre-shared-key, Ni_b | Nr_b)
2469 * sig: SKEYID = prf(Ni_b | Nr_b, g^ir)
2470 * enc: SKEYID = prf(H(Ni_b | Nr_b), CKY-I | CKY-R)
2471 */
2472 int
oakley_skeyid(iph1)2473 oakley_skeyid(iph1)
2474 struct ph1handle *iph1;
2475 {
2476 vchar_t *buf = NULL, *bp;
2477 char *p;
2478 int len;
2479 int error = -1;
2480
2481 /* SKEYID */
2482 switch (AUTHMETHOD(iph1)) {
2483 case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
2484 #ifdef ENABLE_HYBRID
2485 case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
2486 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
2487 #endif
2488 if (iph1->etype != ISAKMP_ETYPE_IDENT) {
2489 iph1->authstr = getpskbyname(iph1->id_p);
2490 if (iph1->authstr == NULL) {
2491 if (iph1->rmconf->verify_identifier) {
2492 plog(LLV_ERROR, LOCATION, iph1->remote,
2493 "couldn't find the pskey.\n");
2494 goto end;
2495 }
2496 plog(LLV_NOTIFY, LOCATION, iph1->remote,
2497 "couldn't find the proper pskey, "
2498 "try to get one by the peer's address.\n");
2499 }
2500 }
2501 if (iph1->authstr == NULL) {
2502 /*
2503 * If the exchange type is the main mode or if it's
2504 * failed to get the psk by ID, racoon try to get
2505 * the psk by remote IP address.
2506 * It may be nonsense.
2507 */
2508 iph1->authstr = getpskbyaddr(iph1->remote);
2509 if (iph1->authstr == NULL) {
2510 plog(LLV_ERROR, LOCATION, iph1->remote,
2511 "couldn't find the pskey for %s.\n",
2512 saddrwop2str(iph1->remote));
2513 goto end;
2514 }
2515 }
2516 plog(LLV_DEBUG, LOCATION, NULL, "the psk found.\n");
2517 /* should be secret PSK */
2518 plog(LLV_DEBUG2, LOCATION, NULL, "psk: ");
2519 plogdump(LLV_DEBUG2, iph1->authstr->v, iph1->authstr->l);
2520
2521 len = iph1->nonce->l + iph1->nonce_p->l;
2522 buf = vmalloc(len);
2523 if (buf == NULL) {
2524 plog(LLV_ERROR, LOCATION, NULL,
2525 "failed to get skeyid buffer\n");
2526 goto end;
2527 }
2528 p = buf->v;
2529
2530 bp = (iph1->side == INITIATOR ? iph1->nonce : iph1->nonce_p);
2531 plog(LLV_DEBUG, LOCATION, NULL, "nonce 1: ");
2532 plogdump(LLV_DEBUG, bp->v, bp->l);
2533 memcpy(p, bp->v, bp->l);
2534 p += bp->l;
2535
2536 bp = (iph1->side == INITIATOR ? iph1->nonce_p : iph1->nonce);
2537 plog(LLV_DEBUG, LOCATION, NULL, "nonce 2: ");
2538 plogdump(LLV_DEBUG, bp->v, bp->l);
2539 memcpy(p, bp->v, bp->l);
2540 p += bp->l;
2541
2542 iph1->skeyid = oakley_prf(iph1->authstr, buf, iph1);
2543 if (iph1->skeyid == NULL)
2544 goto end;
2545 break;
2546
2547 case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
2548 case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
2549 #ifdef ENABLE_HYBRID
2550 case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
2551 case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
2552 case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
2553 case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
2554 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
2555 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
2556 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I:
2557 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:
2558 #endif
2559 #ifdef HAVE_GSSAPI
2560 case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB:
2561 #endif
2562 len = iph1->nonce->l + iph1->nonce_p->l;
2563 buf = vmalloc(len);
2564 if (buf == NULL) {
2565 plog(LLV_ERROR, LOCATION, NULL,
2566 "failed to get nonce buffer\n");
2567 goto end;
2568 }
2569 p = buf->v;
2570
2571 bp = (iph1->side == INITIATOR ? iph1->nonce : iph1->nonce_p);
2572 plog(LLV_DEBUG, LOCATION, NULL, "nonce1: ");
2573 plogdump(LLV_DEBUG, bp->v, bp->l);
2574 memcpy(p, bp->v, bp->l);
2575 p += bp->l;
2576
2577 bp = (iph1->side == INITIATOR ? iph1->nonce_p : iph1->nonce);
2578 plog(LLV_DEBUG, LOCATION, NULL, "nonce2: ");
2579 plogdump(LLV_DEBUG, bp->v, bp->l);
2580 memcpy(p, bp->v, bp->l);
2581 p += bp->l;
2582
2583 iph1->skeyid = oakley_prf(buf, iph1->dhgxy, iph1);
2584 if (iph1->skeyid == NULL)
2585 goto end;
2586 break;
2587 case OAKLEY_ATTR_AUTH_METHOD_RSAENC:
2588 case OAKLEY_ATTR_AUTH_METHOD_RSAREV:
2589 #ifdef ENABLE_HYBRID
2590 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I:
2591 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R:
2592 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I:
2593 case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R:
2594 #endif
2595 plog(LLV_WARNING, LOCATION, NULL,
2596 "not supported authentication method %s\n",
2597 s_oakley_attr_method(iph1->approval->authmethod));
2598 goto end;
2599 default:
2600 plog(LLV_ERROR, LOCATION, NULL,
2601 "invalid authentication method %d\n",
2602 iph1->approval->authmethod);
2603 goto end;
2604 }
2605
2606 plog(LLV_DEBUG, LOCATION, NULL, "SKEYID computed:\n");
2607 plogdump(LLV_DEBUG, iph1->skeyid->v, iph1->skeyid->l);
2608
2609 error = 0;
2610
2611 end:
2612 if (buf != NULL)
2613 vfree(buf);
2614 return error;
2615 }
2616
2617 /*
2618 * compute SKEYID_[dae]
2619 * see seciton 5. Exchanges in RFC 2409
2620 * SKEYID_d = prf(SKEYID, g^ir | CKY-I | CKY-R | 0)
2621 * SKEYID_a = prf(SKEYID, SKEYID_d | g^ir | CKY-I | CKY-R | 1)
2622 * SKEYID_e = prf(SKEYID, SKEYID_a | g^ir | CKY-I | CKY-R | 2)
2623 */
2624 int
oakley_skeyid_dae(iph1)2625 oakley_skeyid_dae(iph1)
2626 struct ph1handle *iph1;
2627 {
2628 vchar_t *buf = NULL;
2629 char *p;
2630 int len;
2631 int error = -1;
2632
2633 if (iph1->skeyid == NULL) {
2634 plog(LLV_ERROR, LOCATION, NULL, "no SKEYID found.\n");
2635 goto end;
2636 }
2637
2638 /* SKEYID D */
2639 /* SKEYID_d = prf(SKEYID, g^xy | CKY-I | CKY-R | 0) */
2640 len = iph1->dhgxy->l + sizeof(cookie_t) * 2 + 1;
2641 buf = vmalloc(len);
2642 if (buf == NULL) {
2643 plog(LLV_ERROR, LOCATION, NULL,
2644 "failed to get skeyid buffer\n");
2645 goto end;
2646 }
2647 p = buf->v;
2648
2649 memcpy(p, iph1->dhgxy->v, iph1->dhgxy->l);
2650 p += iph1->dhgxy->l;
2651 memcpy(p, (caddr_t)&iph1->index.i_ck, sizeof(cookie_t));
2652 p += sizeof(cookie_t);
2653 memcpy(p, (caddr_t)&iph1->index.r_ck, sizeof(cookie_t));
2654 p += sizeof(cookie_t);
2655 *p = 0;
2656 iph1->skeyid_d = oakley_prf(iph1->skeyid, buf, iph1);
2657 if (iph1->skeyid_d == NULL)
2658 goto end;
2659
2660 vfree(buf);
2661 buf = NULL;
2662
2663 plog(LLV_DEBUG, LOCATION, NULL, "SKEYID_d computed:\n");
2664 plogdump(LLV_DEBUG, iph1->skeyid_d->v, iph1->skeyid_d->l);
2665
2666 /* SKEYID A */
2667 /* SKEYID_a = prf(SKEYID, SKEYID_d | g^xy | CKY-I | CKY-R | 1) */
2668 len = iph1->skeyid_d->l + iph1->dhgxy->l + sizeof(cookie_t) * 2 + 1;
2669 buf = vmalloc(len);
2670 if (buf == NULL) {
2671 plog(LLV_ERROR, LOCATION, NULL,
2672 "failed to get skeyid buffer\n");
2673 goto end;
2674 }
2675 p = buf->v;
2676 memcpy(p, iph1->skeyid_d->v, iph1->skeyid_d->l);
2677 p += iph1->skeyid_d->l;
2678 memcpy(p, iph1->dhgxy->v, iph1->dhgxy->l);
2679 p += iph1->dhgxy->l;
2680 memcpy(p, (caddr_t)&iph1->index.i_ck, sizeof(cookie_t));
2681 p += sizeof(cookie_t);
2682 memcpy(p, (caddr_t)&iph1->index.r_ck, sizeof(cookie_t));
2683 p += sizeof(cookie_t);
2684 *p = 1;
2685 iph1->skeyid_a = oakley_prf(iph1->skeyid, buf, iph1);
2686 if (iph1->skeyid_a == NULL)
2687 goto end;
2688
2689 vfree(buf);
2690 buf = NULL;
2691
2692 plog(LLV_DEBUG, LOCATION, NULL, "SKEYID_a computed:\n");
2693 plogdump(LLV_DEBUG, iph1->skeyid_a->v, iph1->skeyid_a->l);
2694
2695 /* SKEYID E */
2696 /* SKEYID_e = prf(SKEYID, SKEYID_a | g^xy | CKY-I | CKY-R | 2) */
2697 len = iph1->skeyid_a->l + iph1->dhgxy->l + sizeof(cookie_t) * 2 + 1;
2698 buf = vmalloc(len);
2699 if (buf == NULL) {
2700 plog(LLV_ERROR, LOCATION, NULL,
2701 "failed to get skeyid buffer\n");
2702 goto end;
2703 }
2704 p = buf->v;
2705 memcpy(p, iph1->skeyid_a->v, iph1->skeyid_a->l);
2706 p += iph1->skeyid_a->l;
2707 memcpy(p, iph1->dhgxy->v, iph1->dhgxy->l);
2708 p += iph1->dhgxy->l;
2709 memcpy(p, (caddr_t)&iph1->index.i_ck, sizeof(cookie_t));
2710 p += sizeof(cookie_t);
2711 memcpy(p, (caddr_t)&iph1->index.r_ck, sizeof(cookie_t));
2712 p += sizeof(cookie_t);
2713 *p = 2;
2714 iph1->skeyid_e = oakley_prf(iph1->skeyid, buf, iph1);
2715 if (iph1->skeyid_e == NULL)
2716 goto end;
2717
2718 vfree(buf);
2719 buf = NULL;
2720
2721 plog(LLV_DEBUG, LOCATION, NULL, "SKEYID_e computed:\n");
2722 plogdump(LLV_DEBUG, iph1->skeyid_e->v, iph1->skeyid_e->l);
2723
2724 error = 0;
2725
2726 end:
2727 if (buf != NULL)
2728 vfree(buf);
2729 return error;
2730 }
2731
2732 /*
2733 * compute final encryption key.
2734 * see Appendix B.
2735 */
2736 int
oakley_compute_enckey(iph1)2737 oakley_compute_enckey(iph1)
2738 struct ph1handle *iph1;
2739 {
2740 u_int keylen, prflen;
2741 int error = -1;
2742
2743 /* RFC2409 p39 */
2744 keylen = alg_oakley_encdef_keylen(iph1->approval->enctype,
2745 iph1->approval->encklen);
2746 if (keylen == -1) {
2747 plog(LLV_ERROR, LOCATION, NULL,
2748 "invalid encryption algoritym %d, "
2749 "or invalid key length %d.\n",
2750 iph1->approval->enctype,
2751 iph1->approval->encklen);
2752 goto end;
2753 }
2754 iph1->key = vmalloc(keylen >> 3);
2755 if (iph1->key == NULL) {
2756 plog(LLV_ERROR, LOCATION, NULL,
2757 "failed to get key buffer\n");
2758 goto end;
2759 }
2760
2761 /* set prf length */
2762 prflen = alg_oakley_hashdef_hashlen(iph1->approval->hashtype);
2763 if (prflen == -1) {
2764 plog(LLV_ERROR, LOCATION, NULL,
2765 "invalid hash type %d.\n", iph1->approval->hashtype);
2766 goto end;
2767 }
2768
2769 /* see isakmp-oakley-08 5.3. */
2770 if (iph1->key->l <= iph1->skeyid_e->l) {
2771 /*
2772 * if length(Ka) <= length(SKEYID_e)
2773 * Ka = first length(K) bit of SKEYID_e
2774 */
2775 memcpy(iph1->key->v, iph1->skeyid_e->v, iph1->key->l);
2776 } else {
2777 vchar_t *buf = NULL, *res = NULL;
2778 u_char *p, *ep;
2779 int cplen;
2780 int subkey;
2781
2782 /*
2783 * otherwise,
2784 * Ka = K1 | K2 | K3
2785 * where
2786 * K1 = prf(SKEYID_e, 0)
2787 * K2 = prf(SKEYID_e, K1)
2788 * K3 = prf(SKEYID_e, K2)
2789 */
2790 plog(LLV_DEBUG, LOCATION, NULL,
2791 "len(SKEYID_e) < len(Ka) (%zu < %zu), "
2792 "generating long key (Ka = K1 | K2 | ...)\n",
2793 iph1->skeyid_e->l, iph1->key->l);
2794
2795 if ((buf = vmalloc(prflen >> 3)) == 0) {
2796 plog(LLV_ERROR, LOCATION, NULL,
2797 "failed to get key buffer\n");
2798 goto end;
2799 }
2800 p = (u_char *)iph1->key->v;
2801 ep = p + iph1->key->l;
2802
2803 subkey = 1;
2804 while (p < ep) {
2805 if (p == (u_char *)iph1->key->v) {
2806 /* just for computing K1 */
2807 buf->v[0] = 0;
2808 buf->l = 1;
2809 }
2810 res = oakley_prf(iph1->skeyid_e, buf, iph1);
2811 if (res == NULL) {
2812 vfree(buf);
2813 goto end;
2814 }
2815 plog(LLV_DEBUG, LOCATION, NULL,
2816 "compute intermediate encryption key K%d\n",
2817 subkey);
2818 plogdump(LLV_DEBUG, buf->v, buf->l);
2819 plogdump(LLV_DEBUG, res->v, res->l);
2820
2821 cplen = (res->l < ep - p) ? res->l : ep - p;
2822 memcpy(p, res->v, cplen);
2823 p += cplen;
2824
2825 buf->l = prflen >> 3; /* to cancel K1 speciality */
2826 if (res->l != buf->l) {
2827 plog(LLV_ERROR, LOCATION, NULL,
2828 "internal error: res->l=%zu buf->l=%zu\n",
2829 res->l, buf->l);
2830 vfree(res);
2831 vfree(buf);
2832 goto end;
2833 }
2834 memcpy(buf->v, res->v, res->l);
2835 vfree(res);
2836 subkey++;
2837 }
2838
2839 vfree(buf);
2840 }
2841
2842 /*
2843 * don't check any weak key or not.
2844 * draft-ietf-ipsec-ike-01.txt Appendix B.
2845 * draft-ietf-ipsec-ciph-aes-cbc-00.txt Section 2.3.
2846 */
2847 #if 0
2848 /* weakkey check */
2849 if (iph1->approval->enctype > ARRAYLEN(oakley_encdef)
2850 || oakley_encdef[iph1->approval->enctype].weakkey == NULL) {
2851 plog(LLV_ERROR, LOCATION, NULL,
2852 "encryption algoritym %d isn't supported.\n",
2853 iph1->approval->enctype);
2854 goto end;
2855 }
2856 if ((oakley_encdef[iph1->approval->enctype].weakkey)(iph1->key)) {
2857 plog(LLV_ERROR, LOCATION, NULL,
2858 "weakkey was generated.\n");
2859 goto end;
2860 }
2861 #endif
2862
2863 plog(LLV_DEBUG, LOCATION, NULL, "final encryption key computed:\n");
2864 plogdump(LLV_DEBUG, iph1->key->v, iph1->key->l);
2865
2866 error = 0;
2867
2868 end:
2869 return error;
2870 }
2871
2872 /* allocated new buffer for CERT */
2873 cert_t *
oakley_newcert()2874 oakley_newcert()
2875 {
2876 cert_t *new;
2877
2878 new = racoon_calloc(1, sizeof(*new));
2879 if (new == NULL) {
2880 plog(LLV_ERROR, LOCATION, NULL,
2881 "failed to get cert's buffer\n");
2882 return NULL;
2883 }
2884
2885 new->pl = NULL;
2886
2887 return new;
2888 }
2889
2890 /* delete buffer for CERT */
2891 void
oakley_delcert(cert)2892 oakley_delcert(cert)
2893 cert_t *cert;
2894 {
2895 if (!cert)
2896 return;
2897 if (cert->pl)
2898 VPTRINIT(cert->pl);
2899 racoon_free(cert);
2900 }
2901
2902 /*
2903 * compute IV and set to ph1handle
2904 * IV = hash(g^xi | g^xr)
2905 * see 4.1 Phase 1 state in draft-ietf-ipsec-ike.
2906 */
2907 int
oakley_newiv(iph1)2908 oakley_newiv(iph1)
2909 struct ph1handle *iph1;
2910 {
2911 struct isakmp_ivm *newivm = NULL;
2912 vchar_t *buf = NULL, *bp;
2913 char *p;
2914 int len;
2915
2916 /* create buffer */
2917 len = iph1->dhpub->l + iph1->dhpub_p->l;
2918 buf = vmalloc(len);
2919 if (buf == NULL) {
2920 plog(LLV_ERROR, LOCATION, NULL,
2921 "failed to get iv buffer\n");
2922 return -1;
2923 }
2924
2925 p = buf->v;
2926
2927 bp = (iph1->side == INITIATOR ? iph1->dhpub : iph1->dhpub_p);
2928 memcpy(p, bp->v, bp->l);
2929 p += bp->l;
2930
2931 bp = (iph1->side == INITIATOR ? iph1->dhpub_p : iph1->dhpub);
2932 memcpy(p, bp->v, bp->l);
2933 p += bp->l;
2934
2935 /* allocate IVm */
2936 newivm = racoon_calloc(1, sizeof(struct isakmp_ivm));
2937 if (newivm == NULL) {
2938 plog(LLV_ERROR, LOCATION, NULL,
2939 "failed to get iv buffer\n");
2940 vfree(buf);
2941 return -1;
2942 }
2943
2944 /* compute IV */
2945 newivm->iv = oakley_hash(buf, iph1);
2946 if (newivm->iv == NULL) {
2947 vfree(buf);
2948 oakley_delivm(newivm);
2949 return -1;
2950 }
2951
2952 /* adjust length of iv */
2953 newivm->iv->l = alg_oakley_encdef_blocklen(iph1->approval->enctype);
2954 if (newivm->iv->l == -1) {
2955 plog(LLV_ERROR, LOCATION, NULL,
2956 "invalid encryption algoriym %d.\n",
2957 iph1->approval->enctype);
2958 vfree(buf);
2959 oakley_delivm(newivm);
2960 return -1;
2961 }
2962
2963 /* create buffer to save iv */
2964 if ((newivm->ive = vdup(newivm->iv)) == NULL) {
2965 plog(LLV_ERROR, LOCATION, NULL,
2966 "vdup (%s)\n", strerror(errno));
2967 vfree(buf);
2968 oakley_delivm(newivm);
2969 return -1;
2970 }
2971
2972 vfree(buf);
2973
2974 plog(LLV_DEBUG, LOCATION, NULL, "IV computed:\n");
2975 plogdump(LLV_DEBUG, newivm->iv->v, newivm->iv->l);
2976
2977 iph1->ivm = newivm;
2978
2979 return 0;
2980 }
2981
2982 /*
2983 * compute IV for the payload after phase 1.
2984 * It's not limited for phase 2.
2985 * if pahse 1 was encrypted.
2986 * IV = hash(last CBC block of Phase 1 | M-ID)
2987 * if phase 1 was not encrypted.
2988 * IV = hash(phase 1 IV | M-ID)
2989 * see 4.2 Phase 2 state in draft-ietf-ipsec-ike.
2990 */
2991 struct isakmp_ivm *
oakley_newiv2(iph1,msgid)2992 oakley_newiv2(iph1, msgid)
2993 struct ph1handle *iph1;
2994 u_int32_t msgid;
2995 {
2996 struct isakmp_ivm *newivm = NULL;
2997 vchar_t *buf = NULL;
2998 char *p;
2999 int len;
3000 int error = -1;
3001
3002 /* create buffer */
3003 len = iph1->ivm->iv->l + sizeof(msgid_t);
3004 buf = vmalloc(len);
3005 if (buf == NULL) {
3006 plog(LLV_ERROR, LOCATION, NULL,
3007 "failed to get iv buffer\n");
3008 goto end;
3009 }
3010
3011 p = buf->v;
3012
3013 memcpy(p, iph1->ivm->iv->v, iph1->ivm->iv->l);
3014 p += iph1->ivm->iv->l;
3015
3016 memcpy(p, &msgid, sizeof(msgid));
3017
3018 plog(LLV_DEBUG, LOCATION, NULL, "compute IV for phase2\n");
3019 plog(LLV_DEBUG, LOCATION, NULL, "phase1 last IV:\n");
3020 plogdump(LLV_DEBUG, buf->v, buf->l);
3021
3022 /* allocate IVm */
3023 newivm = racoon_calloc(1, sizeof(struct isakmp_ivm));
3024 if (newivm == NULL) {
3025 plog(LLV_ERROR, LOCATION, NULL,
3026 "failed to get iv buffer\n");
3027 goto end;
3028 }
3029
3030 /* compute IV */
3031 if ((newivm->iv = oakley_hash(buf, iph1)) == NULL)
3032 goto end;
3033
3034 /* adjust length of iv */
3035 newivm->iv->l = alg_oakley_encdef_blocklen(iph1->approval->enctype);
3036 if (newivm->iv->l == -1) {
3037 plog(LLV_ERROR, LOCATION, NULL,
3038 "invalid encryption algoriym %d.\n",
3039 iph1->approval->enctype);
3040 goto end;
3041 }
3042
3043 /* create buffer to save new iv */
3044 if ((newivm->ive = vdup(newivm->iv)) == NULL) {
3045 plog(LLV_ERROR, LOCATION, NULL, "vdup (%s)\n", strerror(errno));
3046 goto end;
3047 }
3048
3049 error = 0;
3050
3051 plog(LLV_DEBUG, LOCATION, NULL, "phase2 IV computed:\n");
3052 plogdump(LLV_DEBUG, newivm->iv->v, newivm->iv->l);
3053
3054 end:
3055 if (error && newivm != NULL){
3056 oakley_delivm(newivm);
3057 newivm=NULL;
3058 }
3059 if (buf != NULL)
3060 vfree(buf);
3061 return newivm;
3062 }
3063
3064 void
oakley_delivm(ivm)3065 oakley_delivm(ivm)
3066 struct isakmp_ivm *ivm;
3067 {
3068 if (ivm == NULL)
3069 return;
3070
3071 if (ivm->iv != NULL)
3072 vfree(ivm->iv);
3073 if (ivm->ive != NULL)
3074 vfree(ivm->ive);
3075 racoon_free(ivm);
3076 plog(LLV_DEBUG, LOCATION, NULL, "IV freed\n");
3077
3078 return;
3079 }
3080
3081 /*
3082 * decrypt packet.
3083 * save new iv and old iv.
3084 */
3085 vchar_t *
oakley_do_decrypt(iph1,msg,ivdp,ivep)3086 oakley_do_decrypt(iph1, msg, ivdp, ivep)
3087 struct ph1handle *iph1;
3088 vchar_t *msg, *ivdp, *ivep;
3089 {
3090 vchar_t *buf = NULL, *new = NULL;
3091 char *pl;
3092 int len;
3093 u_int8_t padlen;
3094 int blen;
3095 int error = -1;
3096
3097 plog(LLV_DEBUG, LOCATION, NULL, "begin decryption.\n");
3098
3099 blen = alg_oakley_encdef_blocklen(iph1->approval->enctype);
3100 if (blen == -1) {
3101 plog(LLV_ERROR, LOCATION, NULL,
3102 "invalid encryption algoriym %d.\n",
3103 iph1->approval->enctype);
3104 goto end;
3105 }
3106
3107 /* save IV for next, but not sync. */
3108 memset(ivep->v, 0, ivep->l);
3109 memcpy(ivep->v, (caddr_t)&msg->v[msg->l - blen], blen);
3110
3111 plog(LLV_DEBUG, LOCATION, NULL,
3112 "IV was saved for next processing:\n");
3113 plogdump(LLV_DEBUG, ivep->v, ivep->l);
3114
3115 pl = msg->v + sizeof(struct isakmp);
3116
3117 len = msg->l - sizeof(struct isakmp);
3118
3119 /* create buffer */
3120 buf = vmalloc(len);
3121 if (buf == NULL) {
3122 plog(LLV_ERROR, LOCATION, NULL,
3123 "failed to get buffer to decrypt.\n");
3124 goto end;
3125 }
3126 memcpy(buf->v, pl, len);
3127
3128 /* do decrypt */
3129 new = alg_oakley_encdef_decrypt(iph1->approval->enctype,
3130 buf, iph1->key, ivdp);
3131 if (new == NULL) {
3132 plog(LLV_ERROR, LOCATION, NULL,
3133 "decryption %d failed.\n", iph1->approval->enctype);
3134 goto end;
3135 }
3136 plog(LLV_DEBUG, LOCATION, NULL, "with key:\n");
3137 plogdump(LLV_DEBUG, iph1->key->v, iph1->key->l);
3138
3139 vfree(buf);
3140 buf = NULL;
3141
3142 plog(LLV_DEBUG, LOCATION, NULL, "decrypted payload by IV:\n");
3143 plogdump(LLV_DEBUG, ivdp->v, ivdp->l);
3144
3145 plog(LLV_DEBUG, LOCATION, NULL,
3146 "decrypted payload, but not trimed.\n");
3147 plogdump(LLV_DEBUG, new->v, new->l);
3148
3149 /* get padding length */
3150 if (lcconf->pad_excltail)
3151 padlen = new->v[new->l - 1] + 1;
3152 else
3153 padlen = new->v[new->l - 1];
3154 plog(LLV_DEBUG, LOCATION, NULL, "padding len=%u\n", padlen);
3155
3156 /* trim padding */
3157 if (lcconf->pad_strict) {
3158 if (padlen > new->l) {
3159 plog(LLV_ERROR, LOCATION, NULL,
3160 "invalied padding len=%u, buflen=%zu.\n",
3161 padlen, new->l);
3162 plogdump(LLV_ERROR, new->v, new->l);
3163 goto end;
3164 }
3165 new->l -= padlen;
3166 plog(LLV_DEBUG, LOCATION, NULL, "trimmed padding\n");
3167 } else {
3168 plog(LLV_DEBUG, LOCATION, NULL, "skip to trim padding.\n");
3169 }
3170
3171 /* create new buffer */
3172 len = sizeof(struct isakmp) + new->l;
3173 buf = vmalloc(len);
3174 if (buf == NULL) {
3175 plog(LLV_ERROR, LOCATION, NULL,
3176 "failed to get buffer to decrypt.\n");
3177 goto end;
3178 }
3179 memcpy(buf->v, msg->v, sizeof(struct isakmp));
3180 memcpy(buf->v + sizeof(struct isakmp), new->v, new->l);
3181 ((struct isakmp *)buf->v)->len = htonl(buf->l);
3182
3183 plog(LLV_DEBUG, LOCATION, NULL, "decrypted.\n");
3184 plogdump(LLV_DEBUG, buf->v, buf->l);
3185
3186 #ifdef HAVE_PRINT_ISAKMP_C
3187 isakmp_printpacket(buf, iph1->remote, iph1->local, 1);
3188 #endif
3189
3190 error = 0;
3191
3192 end:
3193 if (error && buf != NULL) {
3194 vfree(buf);
3195 buf = NULL;
3196 }
3197 if (new != NULL)
3198 vfree(new);
3199
3200 return buf;
3201 }
3202
3203 /*
3204 * encrypt packet.
3205 */
3206 vchar_t *
oakley_do_encrypt(iph1,msg,ivep,ivp)3207 oakley_do_encrypt(iph1, msg, ivep, ivp)
3208 struct ph1handle *iph1;
3209 vchar_t *msg, *ivep, *ivp;
3210 {
3211 vchar_t *buf = 0, *new = 0;
3212 char *pl;
3213 int len;
3214 u_int padlen;
3215 int blen;
3216 int error = -1;
3217
3218 plog(LLV_DEBUG, LOCATION, NULL, "begin encryption.\n");
3219
3220 /* set cbc block length */
3221 blen = alg_oakley_encdef_blocklen(iph1->approval->enctype);
3222 if (blen == -1) {
3223 plog(LLV_ERROR, LOCATION, NULL,
3224 "invalid encryption algoriym %d.\n",
3225 iph1->approval->enctype);
3226 goto end;
3227 }
3228
3229 pl = msg->v + sizeof(struct isakmp);
3230 len = msg->l - sizeof(struct isakmp);
3231
3232 /* add padding */
3233 padlen = oakley_padlen(len, blen);
3234 plog(LLV_DEBUG, LOCATION, NULL, "pad length = %u\n", padlen);
3235
3236 /* create buffer */
3237 buf = vmalloc(len + padlen);
3238 if (buf == NULL) {
3239 plog(LLV_ERROR, LOCATION, NULL,
3240 "failed to get buffer to encrypt.\n");
3241 goto end;
3242 }
3243 if (padlen) {
3244 int i;
3245 char *p = &buf->v[len];
3246 if (lcconf->pad_random) {
3247 for (i = 0; i < padlen; i++)
3248 *p++ = eay_random() & 0xff;
3249 }
3250 }
3251 memcpy(buf->v, pl, len);
3252
3253 /* make pad into tail */
3254 if (lcconf->pad_excltail)
3255 buf->v[len + padlen - 1] = padlen - 1;
3256 else
3257 buf->v[len + padlen - 1] = padlen;
3258
3259 plogdump(LLV_DEBUG, buf->v, buf->l);
3260
3261 /* do encrypt */
3262 new = alg_oakley_encdef_encrypt(iph1->approval->enctype,
3263 buf, iph1->key, ivep);
3264 if (new == NULL) {
3265 plog(LLV_ERROR, LOCATION, NULL,
3266 "encryption %d failed.\n", iph1->approval->enctype);
3267 goto end;
3268 }
3269 plog(LLV_DEBUG, LOCATION, NULL, "with key:\n");
3270 plogdump(LLV_DEBUG, iph1->key->v, iph1->key->l);
3271
3272 vfree(buf);
3273 buf = NULL;
3274
3275 plog(LLV_DEBUG, LOCATION, NULL, "encrypted payload by IV:\n");
3276 plogdump(LLV_DEBUG, ivep->v, ivep->l);
3277
3278 /* save IV for next */
3279 memset(ivp->v, 0, ivp->l);
3280 memcpy(ivp->v, (caddr_t)&new->v[new->l - blen], blen);
3281
3282 plog(LLV_DEBUG, LOCATION, NULL, "save IV for next:\n");
3283 plogdump(LLV_DEBUG, ivp->v, ivp->l);
3284
3285 /* create new buffer */
3286 len = sizeof(struct isakmp) + new->l;
3287 buf = vmalloc(len);
3288 if (buf == NULL) {
3289 plog(LLV_ERROR, LOCATION, NULL,
3290 "failed to get buffer to encrypt.\n");
3291 goto end;
3292 }
3293 memcpy(buf->v, msg->v, sizeof(struct isakmp));
3294 memcpy(buf->v + sizeof(struct isakmp), new->v, new->l);
3295 ((struct isakmp *)buf->v)->len = htonl(buf->l);
3296
3297 error = 0;
3298
3299 plog(LLV_DEBUG, LOCATION, NULL, "encrypted.\n");
3300
3301 end:
3302 if (error && buf != NULL) {
3303 vfree(buf);
3304 buf = NULL;
3305 }
3306 if (new != NULL)
3307 vfree(new);
3308
3309 return buf;
3310 }
3311
3312 /* culculate padding length */
3313 static int
oakley_padlen(len,base)3314 oakley_padlen(len, base)
3315 int len, base;
3316 {
3317 int padlen;
3318
3319 padlen = base - len % base;
3320
3321 if (lcconf->pad_randomlen)
3322 padlen += ((eay_random() % (lcconf->pad_maxsize + 1) + 1) *
3323 base);
3324
3325 return padlen;
3326 }
3327
3328