• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*	$NetBSD: isakmp_quick.c,v 1.29 2011/03/14 17:18:13 tteras Exp $	*/
2 
3 /* Id: isakmp_quick.c,v 1.29 2006/08/22 18:17:17 manubsd Exp */
4 
5 /*
6  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. Neither the name of the project nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  */
33 
34 #include "config.h"
35 
36 #include <sys/types.h>
37 #include <sys/param.h>
38 #include <sys/socket.h>
39 
40 #include <netinet/in.h>
41 
42 #include <stdlib.h>
43 #include <stdio.h>
44 #include <string.h>
45 #include <errno.h>
46 #if TIME_WITH_SYS_TIME
47 # include <sys/time.h>
48 # include <time.h>
49 #else
50 # if HAVE_SYS_TIME_H
51 #  include <sys/time.h>
52 # else
53 #  include <time.h>
54 # endif
55 #endif
56 
57 #include PATH_IPSEC_H
58 
59 #include "var.h"
60 #include "vmbuf.h"
61 #include "schedule.h"
62 #include "misc.h"
63 #include "plog.h"
64 #include "debug.h"
65 
66 #include "localconf.h"
67 #include "remoteconf.h"
68 #include "handler.h"
69 #include "policy.h"
70 #include "proposal.h"
71 #include "isakmp_var.h"
72 #include "isakmp.h"
73 #include "isakmp_inf.h"
74 #include "isakmp_quick.h"
75 #include "oakley.h"
76 #include "ipsec_doi.h"
77 #include "crypto_openssl.h"
78 #include "pfkey.h"
79 #include "policy.h"
80 #include "algorithm.h"
81 #include "sockmisc.h"
82 #include "proposal.h"
83 #include "sainfo.h"
84 #include "admin.h"
85 #include "strnames.h"
86 
87 #ifdef ENABLE_HYBRID
88 #include <resolv.h>
89 #include "isakmp_xauth.h"
90 #include "isakmp_cfg.h"
91 #endif
92 
93 #ifdef ENABLE_NATT
94 #include "nattraversal.h"
95 #endif
96 
97 /* quick mode */
98 static vchar_t *quick_ir1mx __P((struct ph2handle *, vchar_t *, vchar_t *));
99 static int get_sainfo_r __P((struct ph2handle *));
100 static int get_proposal_r __P((struct ph2handle *));
101 static int ph2_recv_n __P((struct ph2handle *, struct isakmp_gen *));
102 static void quick_timeover_stub __P((struct sched *));
103 static void quick_timeover __P((struct ph2handle *));
104 
105 /* called from scheduler */
106 static void
quick_timeover_stub(p)107 quick_timeover_stub(p)
108 	struct sched *p;
109 {
110 	quick_timeover(container_of(p, struct ph2handle, sce));
111 }
112 
113 static void
quick_timeover(iph2)114 quick_timeover(iph2)
115 	struct ph2handle *iph2;
116 {
117 	plog(LLV_ERROR, LOCATION, NULL,
118 		"%s give up to get IPsec-SA due to time up to wait.\n",
119 		saddrwop2str(iph2->dst));
120 
121 	/* If initiator side, send error to kernel by SADB_ACQUIRE. */
122 	if (iph2->side == INITIATOR)
123 		pk_sendeacquire(iph2);
124 
125 	remph2(iph2);
126 	delph2(iph2);
127 }
128 
129 /* %%%
130  * Quick Mode
131  */
132 /*
133  * begin Quick Mode as initiator.  send pfkey getspi message to kernel.
134  */
135 int
quick_i1prep(iph2,msg)136 quick_i1prep(iph2, msg)
137 	struct ph2handle *iph2;
138 	vchar_t *msg; /* must be null pointer */
139 {
140 	int error = ISAKMP_INTERNAL_ERROR;
141 
142 	/* validity check */
143 	if (iph2->status != PHASE2ST_STATUS2) {
144 		plog(LLV_ERROR, LOCATION, NULL,
145 			"status mismatched %d.\n", iph2->status);
146 		goto end;
147 	}
148 
149 	iph2->msgid = isakmp_newmsgid2(iph2->ph1);
150 	iph2->ivm = oakley_newiv2(iph2->ph1, iph2->msgid);
151 	if (iph2->ivm == NULL)
152 		return 0;
153 
154 	iph2->status = PHASE2ST_GETSPISENT;
155 
156 	/* don't anything if local test mode. */
157 	if (f_local) {
158 		error = 0;
159 		goto end;
160 	}
161 
162 	/* send getspi message */
163 	if (pk_sendgetspi(iph2) < 0)
164 		goto end;
165 
166 	plog(LLV_DEBUG, LOCATION, NULL, "pfkey getspi sent.\n");
167 
168 	sched_schedule(&iph2->sce, lcconf->wait_ph2complete,
169 		       quick_timeover_stub);
170 
171 	error = 0;
172 
173 end:
174 	return error;
175 }
176 
177 /*
178  * send to responder
179  * 	HDR*, HASH(1), SA, Ni [, KE ] [, IDi2, IDr2 ] [, NAT-OAi, NAT-OAr ]
180  */
181 int
quick_i1send(iph2,msg)182 quick_i1send(iph2, msg)
183 	struct ph2handle *iph2;
184 	vchar_t *msg; /* must be null pointer */
185 {
186 	vchar_t *body = NULL;
187 	vchar_t *hash = NULL;
188 	struct isakmp_gen *gen;
189 	char *p;
190 	int tlen;
191 	int error = ISAKMP_INTERNAL_ERROR;
192 	int natoa = ISAKMP_NPTYPE_NONE;
193 	int pfsgroup, idci, idcr;
194 	int np;
195 	struct ipsecdoi_id_b *id, *id_p;
196 #ifdef ENABLE_NATT
197 	vchar_t *nat_oai = NULL;
198 	vchar_t *nat_oar = NULL;
199 #endif
200 
201 	/* validity check */
202 	if (msg != NULL) {
203 		plog(LLV_ERROR, LOCATION, NULL,
204 			"msg has to be NULL in this function.\n");
205 		goto end;
206 	}
207 	if (iph2->status != PHASE2ST_GETSPIDONE) {
208 		plog(LLV_ERROR, LOCATION, NULL,
209 			"status mismatched %d.\n", iph2->status);
210 		goto end;
211 	}
212 
213 	/* create SA payload for my proposal */
214 	if (ipsecdoi_setph2proposal(iph2) < 0)
215 		goto end;
216 
217 	/* generate NONCE value */
218 	iph2->nonce = eay_set_random(iph2->ph1->rmconf->nonce_size);
219 	if (iph2->nonce == NULL)
220 		goto end;
221 
222 	/*
223 	 * DH value calculation is kicked out into cfparse.y.
224 	 * because pfs group can not be negotiated, it's only to be checked
225 	 * acceptable.
226 	 */
227 	/* generate KE value if need */
228 	pfsgroup = iph2->proposal->pfs_group;
229 	if (pfsgroup) {
230 		/* DH group settting if PFS is required. */
231 		if (oakley_setdhgroup(pfsgroup, &iph2->pfsgrp) < 0) {
232 			plog(LLV_ERROR, LOCATION, NULL,
233 				"failed to set DH value.\n");
234 			goto end;
235 		}
236 		if (oakley_dh_generate(iph2->pfsgrp,
237 				&iph2->dhpub, &iph2->dhpriv) < 0) {
238 			goto end;
239 		}
240 	}
241 
242 	/* generate ID value */
243 	if (ipsecdoi_setid2(iph2) < 0) {
244 		plog(LLV_ERROR, LOCATION, NULL,
245 			"failed to get ID.\n");
246 		goto end;
247 	}
248 	plog(LLV_DEBUG, LOCATION, NULL, "IDci:\n");
249 	plogdump(LLV_DEBUG, iph2->id->v, iph2->id->l);
250 	plog(LLV_DEBUG, LOCATION, NULL, "IDcr:\n");
251 	plogdump(LLV_DEBUG, iph2->id_p->v, iph2->id_p->l);
252 
253 	/*
254 	 * we do not attach IDci nor IDcr, under the following condition:
255 	 * - all proposals are transport mode
256 	 * - no MIP6 or proxy
257 	 * - id payload suggests to encrypt all the traffic (no specific
258 	 *   protocol type)
259 	 * - SA endpoints and IKE addresses for the nego are the same
260 	 *   (iph2->src/dst)
261 	 */
262 	id = (struct ipsecdoi_id_b *)iph2->id->v;
263 	id_p = (struct ipsecdoi_id_b *)iph2->id_p->v;
264 	if (id->proto_id == 0 &&
265 	    id_p->proto_id == 0 &&
266 	    iph2->ph1->rmconf->support_proxy == 0 &&
267 	    iph2->sa_src == NULL && iph2->sa_dst == NULL &&
268 	    ipsecdoi_transportmode(iph2->proposal)) {
269 		idci = idcr = 0;
270 	} else
271 		idci = idcr = 1;
272 
273 #ifdef ENABLE_NATT
274 	/*
275 	 * RFC3947 5.2. if we propose UDP-Encapsulated-Transport
276 	 * we should send NAT-OA
277 	 */
278 	if (ipsecdoi_transportmode(iph2->proposal)
279 	 && (iph2->ph1->natt_flags & NAT_DETECTED)) {
280 		natoa = iph2->ph1->natt_options->payload_nat_oa;
281 
282 		nat_oai = ipsecdoi_sockaddr2id(iph2->src,
283 			IPSECDOI_PREFIX_HOST, IPSEC_ULPROTO_ANY);
284 		nat_oar = ipsecdoi_sockaddr2id(iph2->dst,
285 			IPSECDOI_PREFIX_HOST, IPSEC_ULPROTO_ANY);
286 
287 		if (nat_oai == NULL || nat_oar == NULL) {
288 			plog(LLV_ERROR, LOCATION, NULL,
289 				"failed to generate NAT-OA payload.\n");
290 			goto end;
291 		}
292 
293 		plog(LLV_DEBUG, LOCATION, NULL, "NAT-OAi:\n");
294 		plogdump(LLV_DEBUG, nat_oai->v, nat_oai->l);
295 		plog(LLV_DEBUG, LOCATION, NULL, "NAT-OAr:\n");
296 		plogdump(LLV_DEBUG, nat_oar->v, nat_oar->l);
297 	} else {
298 		natoa = ISAKMP_NPTYPE_NONE;
299 	}
300 #endif
301 
302 	/* create SA;NONCE payload, and KE if need, and IDii, IDir. */
303 	tlen = + sizeof(*gen) + iph2->sa->l
304 		+ sizeof(*gen) + iph2->nonce->l;
305 	if (pfsgroup)
306 		tlen += (sizeof(*gen) + iph2->dhpub->l);
307 	if (idci)
308 		tlen += sizeof(*gen) + iph2->id->l;
309 	if (idcr)
310 		tlen += sizeof(*gen) + iph2->id_p->l;
311 #ifdef ENABLE_NATT
312 	if (natoa != ISAKMP_NPTYPE_NONE)
313 		tlen += 2 * sizeof(*gen) + nat_oai->l + nat_oar->l;
314 #endif
315 
316 	body = vmalloc(tlen);
317 	if (body == NULL) {
318 		plog(LLV_ERROR, LOCATION, NULL,
319 			"failed to get buffer to send.\n");
320 		goto end;
321 	}
322 
323 	p = body->v;
324 
325 	/* add SA payload */
326 	p = set_isakmp_payload(p, iph2->sa, ISAKMP_NPTYPE_NONCE);
327 
328 	/* add NONCE payload */
329 	if (pfsgroup)
330 		np = ISAKMP_NPTYPE_KE;
331 	else if (idci || idcr)
332 		np = ISAKMP_NPTYPE_ID;
333 	else
334 		np = natoa;
335 	p = set_isakmp_payload(p, iph2->nonce, np);
336 
337 	/* add KE payload if need. */
338 	np = (idci || idcr) ? ISAKMP_NPTYPE_ID : natoa;
339 	if (pfsgroup)
340 		p = set_isakmp_payload(p, iph2->dhpub, np);
341 
342 	/* IDci */
343 	np = (idcr) ? ISAKMP_NPTYPE_ID : natoa;
344 	if (idci)
345 		p = set_isakmp_payload(p, iph2->id, np);
346 
347 	/* IDcr */
348 	if (idcr)
349 		p = set_isakmp_payload(p, iph2->id_p, natoa);
350 
351 #ifdef ENABLE_NATT
352 	/* NAT-OA */
353 	if (natoa != ISAKMP_NPTYPE_NONE) {
354 		p = set_isakmp_payload(p, nat_oai, natoa);
355 		p = set_isakmp_payload(p, nat_oar, ISAKMP_NPTYPE_NONE);
356 	}
357 #endif
358 
359 	/* generate HASH(1) */
360 	hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, body);
361 	if (hash == NULL)
362 		goto end;
363 
364 	/* send isakmp payload */
365 	iph2->sendbuf = quick_ir1mx(iph2, body, hash);
366 	if (iph2->sendbuf == NULL)
367 		goto end;
368 
369 	/* send the packet, add to the schedule to resend */
370 	if (isakmp_ph2send(iph2) == -1)
371 		goto end;
372 
373 	/* change status of isakmp status entry */
374 	iph2->status = PHASE2ST_MSG1SENT;
375 
376 	error = 0;
377 
378 end:
379 	if (body != NULL)
380 		vfree(body);
381 	if (hash != NULL)
382 		vfree(hash);
383 #ifdef ENABLE_NATT
384 	if (nat_oai != NULL)
385 		vfree(nat_oai);
386 	if (nat_oar != NULL)
387 		vfree(nat_oar);
388 #endif
389 
390 	return error;
391 }
392 
393 /*
394  * receive from responder
395  * 	HDR*, HASH(2), SA, Nr [, KE ] [, IDi2, IDr2 ] [, NAT-OAi, NAT-OAr ]
396  */
397 int
quick_i2recv(iph2,msg0)398 quick_i2recv(iph2, msg0)
399 	struct ph2handle *iph2;
400 	vchar_t *msg0;
401 {
402 	vchar_t *msg = NULL;
403 	vchar_t *hbuf = NULL;	/* for hash computing. */
404 	vchar_t *pbuf = NULL;	/* for payload parsing */
405 	vchar_t *idci = NULL;
406 	vchar_t *idcr = NULL;
407 	struct isakmp_parse_t *pa;
408 	struct isakmp *isakmp = (struct isakmp *)msg0->v;
409 	struct isakmp_pl_hash *hash = NULL;
410 	char *p;
411 	int tlen;
412 	int error = ISAKMP_INTERNAL_ERROR;
413 
414 	/* validity check */
415 	if (iph2->status != PHASE2ST_MSG1SENT) {
416 		plog(LLV_ERROR, LOCATION, NULL,
417 			"status mismatched %d.\n", iph2->status);
418 		goto end;
419 	}
420 
421 	/* decrypt packet */
422 	if (!ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E)) {
423 		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
424 			"Packet wasn't encrypted.\n");
425 		goto end;
426 	}
427 	msg = oakley_do_decrypt(iph2->ph1, msg0, iph2->ivm->iv, iph2->ivm->ive);
428 	if (msg == NULL)
429 		goto end;
430 
431 	/* create buffer for validating HASH(2) */
432 	/*
433 	 * ordering rule:
434 	 *	1. the first one must be HASH
435 	 *	2. the second one must be SA (added in isakmp-oakley-05!)
436 	 *	3. two IDs must be considered as IDci, then IDcr
437 	 */
438 	pbuf = isakmp_parse(msg);
439 	if (pbuf == NULL)
440 		goto end;
441 	pa = (struct isakmp_parse_t *)pbuf->v;
442 
443 	/* HASH payload is fixed postion */
444 	if (pa->type != ISAKMP_NPTYPE_HASH) {
445 		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
446 			"received invalid next payload type %d, "
447 			"expecting %d.\n",
448 			pa->type, ISAKMP_NPTYPE_HASH);
449 		goto end;
450 	}
451 	hash = (struct isakmp_pl_hash *)pa->ptr;
452 	pa++;
453 
454 	/*
455 	 * this restriction was introduced in isakmp-oakley-05.
456 	 * we do not check this for backward compatibility.
457 	 * TODO: command line/config file option to enable/disable this code
458 	 */
459 	/* HASH payload is fixed postion */
460 	if (pa->type != ISAKMP_NPTYPE_SA) {
461 		plog(LLV_WARNING, LOCATION, iph2->ph1->remote,
462 			"received invalid next payload type %d, "
463 			"expecting %d.\n",
464 			pa->type, ISAKMP_NPTYPE_HASH);
465 	}
466 
467 	/* allocate buffer for computing HASH(2) */
468 	tlen = iph2->nonce->l
469 		+ ntohl(isakmp->len) - sizeof(*isakmp);
470 	hbuf = vmalloc(tlen);
471 	if (hbuf == NULL) {
472 		plog(LLV_ERROR, LOCATION, NULL,
473 			"failed to get hash buffer.\n");
474 		goto end;
475 	}
476 	p = hbuf->v + iph2->nonce->l;	/* retain the space for Ni_b */
477 
478 	/*
479 	 * parse the payloads.
480 	 * copy non-HASH payloads into hbuf, so that we can validate HASH.
481 	 */
482 	iph2->sa_ret = NULL;
483 	tlen = 0;	/* count payload length except of HASH payload. */
484 	for (; pa->type; pa++) {
485 
486 		/* copy to buffer for HASH */
487 		/* Don't modify the payload */
488 		memcpy(p, pa->ptr, pa->len);
489 
490 		switch (pa->type) {
491 		case ISAKMP_NPTYPE_SA:
492 			if (iph2->sa_ret != NULL) {
493 				plog(LLV_ERROR, LOCATION, NULL,
494 					"Ignored, multiple SA "
495 					"isn't supported.\n");
496 				break;
497 			}
498 			if (isakmp_p2ph(&iph2->sa_ret, pa->ptr) < 0) {
499 				plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
500 					"duplicate ISAKMP_NPTYPE_SA.\n");
501 				goto end;
502 			}
503 			break;
504 
505 		case ISAKMP_NPTYPE_NONCE:
506 			if (isakmp_p2ph(&iph2->nonce_p, pa->ptr) < 0) {
507 				plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
508 					"duplicate ISAKMP_NPTYPE_NONCE.\n");
509 				goto end;
510 			}
511 			break;
512 
513 		case ISAKMP_NPTYPE_KE:
514 			if (isakmp_p2ph(&iph2->dhpub_p, pa->ptr) < 0) {
515 				plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
516 					"duplicate ISAKMP_NPTYPE_KE.\n");
517 				goto end;
518 			}
519 			break;
520 
521 		case ISAKMP_NPTYPE_ID:
522 			if (idci == NULL) {
523 				if (isakmp_p2ph(&idci, pa->ptr) < 0)
524 					goto end;
525 			} else if (idcr == NULL) {
526 				if (isakmp_p2ph(&idcr, pa->ptr) < 0)
527 					goto end;
528 			} else {
529 				plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
530 					"too many ISAKMP_NPTYPE_ID payloads.\n");
531 				goto end;
532 			}
533 			break;
534 
535 		case ISAKMP_NPTYPE_N:
536 			ph2_recv_n(iph2, pa->ptr);
537 			break;
538 
539 #ifdef ENABLE_NATT
540 		case ISAKMP_NPTYPE_NATOA_DRAFT:
541 		case ISAKMP_NPTYPE_NATOA_RFC:
542 		    {
543 			struct sockaddr_storage addr;
544 			struct sockaddr *daddr;
545 			u_int8_t prefix;
546 			u_int16_t ul_proto;
547 			vchar_t *vp = NULL;
548 
549 			if (isakmp_p2ph(&vp, pa->ptr) < 0)
550 				goto end;
551 
552 			error = ipsecdoi_id2sockaddr(vp,
553 					(struct sockaddr *) &addr,
554 					&prefix, &ul_proto);
555 
556 			vfree(vp);
557 
558 			if (error)
559 				goto end;
560 
561 			daddr = dupsaddr((struct sockaddr *) &addr);
562 			if (daddr == NULL)
563 				goto end;
564 
565 			if (iph2->natoa_src == NULL)
566 				iph2->natoa_src = daddr;
567 			else if (iph2->natoa_dst == NULL)
568 				iph2->natoa_dst = daddr;
569 			else {
570 				racoon_free(daddr);
571 				plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
572 					"too many ISAKMP_NPTYPE_NATOA payloads.\n");
573 				goto end;
574 			}
575 		    }
576 			break;
577 #endif
578 
579 		default:
580 			/* don't send information, see ident_r1recv() */
581 			plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
582 				"ignore the packet, "
583 				"received unexpecting payload type %d.\n",
584 				pa->type);
585 			goto end;
586 		}
587 
588 		p += pa->len;
589 
590 		/* compute true length of payload. */
591 		tlen += pa->len;
592 	}
593 
594 	/* payload existency check */
595 	if (hash == NULL || iph2->sa_ret == NULL || iph2->nonce_p == NULL) {
596 		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
597 			"few isakmp message received.\n");
598 		goto end;
599 	}
600 
601 #ifndef ANDROID_PATCHED
602 	/* identity check */
603 	if (idci != NULL) {
604 		struct sockaddr_storage proposed_addr, got_addr;
605 		u_int8_t proposed_prefix, got_prefix;
606 		u_int16_t proposed_ulproto, got_ulproto;
607 
608 		error = ipsecdoi_id2sockaddr(iph2->id,
609 					(struct sockaddr *) &proposed_addr,
610 					&proposed_prefix, &proposed_ulproto);
611 		if (error)
612 			goto end;
613 
614 		error = ipsecdoi_id2sockaddr(idci,
615 					(struct sockaddr *) &got_addr,
616 					&got_prefix, &got_ulproto);
617 		if (error)
618 			goto end;
619 
620 		if (proposed_prefix != got_prefix
621 		 || proposed_ulproto != got_ulproto) {
622 			plog(LLV_DEBUG, LOCATION, NULL,
623 				"IDci prefix/ulproto does not match proposal.\n");
624 			error = ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED;
625 			goto end;
626 		}
627 #ifdef ENABLE_NATT
628 		set_port(iph2->natoa_src,
629 			 extract_port((struct sockaddr *) &proposed_addr));
630 #endif
631 
632 		if (cmpsaddr((struct sockaddr *) &proposed_addr,
633 			     (struct sockaddr *) &got_addr) == CMPSADDR_MATCH) {
634 			plog(LLV_DEBUG, LOCATION, NULL,
635 				"IDci matches proposal.\n");
636 #ifdef ENABLE_NATT
637 		} else if (iph2->natoa_src != NULL
638 			&& cmpsaddr(iph2->natoa_src,
639 				    (struct sockaddr *) &got_addr) == 0) {
640 			plog(LLV_DEBUG, LOCATION, NULL,
641 				"IDci matches NAT-OAi.\n");
642 #endif
643 		} else {
644 			plog(LLV_ERROR, LOCATION, NULL,
645 				"mismatched IDci was returned.\n");
646 			error = ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED;
647 			goto end;
648 		}
649 	}
650 	if (idcr != NULL) {
651 		struct sockaddr_storage proposed_addr, got_addr;
652 		u_int8_t proposed_prefix, got_prefix;
653 		u_int16_t proposed_ulproto, got_ulproto;
654 
655 		error = ipsecdoi_id2sockaddr(iph2->id_p,
656 					(struct sockaddr *) &proposed_addr,
657 					&proposed_prefix, &proposed_ulproto);
658 		if (error)
659 			goto end;
660 
661 		error = ipsecdoi_id2sockaddr(idcr,
662 					(struct sockaddr *) &got_addr,
663 					&got_prefix, &got_ulproto);
664 		if (error)
665 			goto end;
666 
667 		if (proposed_prefix != got_prefix
668 		 || proposed_ulproto != got_ulproto) {
669 			plog(LLV_DEBUG, LOCATION, NULL,
670 				"IDcr prefix/ulproto does not match proposal.\n");
671 			error = ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED;
672 			goto end;
673 		}
674 
675 #ifdef ENABLE_NATT
676 		set_port(iph2->natoa_dst,
677 			 extract_port((struct sockaddr *) &proposed_addr));
678 #endif
679 
680 		if (cmpsaddr((struct sockaddr *) &proposed_addr,
681 			     (struct sockaddr *) &got_addr) == CMPSADDR_MATCH) {
682 			plog(LLV_DEBUG, LOCATION, NULL,
683 				"IDcr matches proposal.\n");
684 #ifdef ENABLE_NATT
685 		} else if (iph2->natoa_dst != NULL
686 			&& cmpsaddr(iph2->natoa_dst,
687 				    (struct sockaddr *) &got_addr) == CMPSADDR_MATCH) {
688 			plog(LLV_DEBUG, LOCATION, NULL,
689 				"IDcr matches NAT-OAr.\n");
690 #endif
691 		} else {
692 			plog(LLV_ERROR, LOCATION, NULL,
693 				"mismatched IDcr was returned.\n");
694 			error = ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED;
695 			goto end;
696 		}
697 	}
698 #endif
699 
700 	/* Fixed buffer for calculating HASH */
701 	memcpy(hbuf->v, iph2->nonce->v, iph2->nonce->l);
702 	plog(LLV_DEBUG, LOCATION, NULL,
703 		"HASH allocated:hbuf->l=%zu actual:tlen=%zu\n",
704 		hbuf->l, tlen + iph2->nonce->l);
705 	/* adjust buffer length for HASH */
706 	hbuf->l = iph2->nonce->l + tlen;
707 
708 	/* validate HASH(2) */
709     {
710 	char *r_hash;
711 	vchar_t *my_hash = NULL;
712 	int result;
713 
714 	r_hash = (char *)hash + sizeof(*hash);
715 
716 	plog(LLV_DEBUG, LOCATION, NULL, "HASH(2) received:");
717 	plogdump(LLV_DEBUG, r_hash, ntohs(hash->h.len) - sizeof(*hash));
718 
719 	my_hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, hbuf);
720 	if (my_hash == NULL)
721 		goto end;
722 
723 	result = memcmp(my_hash->v, r_hash, my_hash->l);
724 	vfree(my_hash);
725 
726 	if (result) {
727 		plog(LLV_DEBUG, LOCATION, iph2->ph1->remote,
728 			"HASH(2) mismatch.\n");
729 		error = ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
730 		goto end;
731 	}
732     }
733 
734 	/* validity check SA payload sent from responder */
735 	if (ipsecdoi_checkph2proposal(iph2) < 0) {
736 		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
737 			"proposal check failed.\n");
738 		error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
739 		goto end;
740 	}
741 
742 	/* change status of isakmp status entry */
743 	iph2->status = PHASE2ST_STATUS6;
744 
745 	error = 0;
746 
747 end:
748 	if (hbuf)
749 		vfree(hbuf);
750 	if (pbuf)
751 		vfree(pbuf);
752 	if (msg)
753 		vfree(msg);
754 	if (idci)
755 		vfree(idci);
756 	if (idcr)
757 		vfree(idcr);
758 
759 	if (error) {
760 		VPTRINIT(iph2->sa_ret);
761 		VPTRINIT(iph2->nonce_p);
762 		VPTRINIT(iph2->dhpub_p);
763 		VPTRINIT(iph2->id);
764 		VPTRINIT(iph2->id_p);
765 #ifdef ENABLE_NATT
766 		if (iph2->natoa_src) {
767 			racoon_free(iph2->natoa_src);
768 			iph2->natoa_src = NULL;
769 		}
770 		if (iph2->natoa_dst) {
771 			racoon_free(iph2->natoa_dst);
772 			iph2->natoa_dst = NULL;
773 		}
774 #endif
775 	}
776 
777 	return error;
778 }
779 
780 /*
781  * send to responder
782  * 	HDR*, HASH(3)
783  */
784 int
quick_i2send(iph2,msg0)785 quick_i2send(iph2, msg0)
786 	struct ph2handle *iph2;
787 	vchar_t *msg0;
788 {
789 	vchar_t *msg = NULL;
790 	vchar_t *buf = NULL;
791 	vchar_t *hash = NULL;
792 	char *p = NULL;
793 	int tlen;
794 	int error = ISAKMP_INTERNAL_ERROR;
795 
796 	/* validity check */
797 	if (iph2->status != PHASE2ST_STATUS6) {
798 		plog(LLV_ERROR, LOCATION, NULL,
799 			"status mismatched %d.\n", iph2->status);
800 		goto end;
801 	}
802 
803 	/* generate HASH(3) */
804     {
805 	vchar_t *tmp = NULL;
806 
807 	plog(LLV_DEBUG, LOCATION, NULL, "HASH(3) generate\n");
808 
809 	tmp = vmalloc(iph2->nonce->l + iph2->nonce_p->l);
810 	if (tmp == NULL) {
811 		plog(LLV_ERROR, LOCATION, NULL,
812 			"failed to get hash buffer.\n");
813 		goto end;
814 	}
815 	memcpy(tmp->v, iph2->nonce->v, iph2->nonce->l);
816 	memcpy(tmp->v + iph2->nonce->l, iph2->nonce_p->v, iph2->nonce_p->l);
817 
818 	hash = oakley_compute_hash3(iph2->ph1, iph2->msgid, tmp);
819 	vfree(tmp);
820 
821 	if (hash == NULL)
822 		goto end;
823     }
824 
825 	/* create buffer for isakmp payload */
826 	tlen = sizeof(struct isakmp)
827 		+ sizeof(struct isakmp_gen) + hash->l;
828 	buf = vmalloc(tlen);
829 	if (buf == NULL) {
830 		plog(LLV_ERROR, LOCATION, NULL,
831 			"failed to get buffer to send.\n");
832 		goto end;
833 	}
834 
835 	/* create isakmp header */
836 	p = set_isakmp_header2(buf, iph2, ISAKMP_NPTYPE_HASH);
837 	if (p == NULL)
838 		goto end;
839 
840 	/* add HASH(3) payload */
841 	p = set_isakmp_payload(p, hash, ISAKMP_NPTYPE_NONE);
842 
843 #ifdef HAVE_PRINT_ISAKMP_C
844 	isakmp_printpacket(buf, iph2->ph1->local, iph2->ph1->remote, 1);
845 #endif
846 
847 	/* encoding */
848 	iph2->sendbuf = oakley_do_encrypt(iph2->ph1, buf, iph2->ivm->ive, iph2->ivm->iv);
849 	if (iph2->sendbuf == NULL)
850 		goto end;
851 
852 	/* if there is commit bit, need resending */
853 	if (ISSET(iph2->flags, ISAKMP_FLAG_C)) {
854 		/* send the packet, add to the schedule to resend */
855 		if (isakmp_ph2send(iph2) == -1)
856 			goto end;
857 	} else {
858 		/* send the packet */
859 		if (isakmp_send(iph2->ph1, iph2->sendbuf) < 0)
860 			goto end;
861 	}
862 
863 	/* the sending message is added to the received-list. */
864 	if (add_recvdpkt(iph2->ph1->remote, iph2->ph1->local,
865 			iph2->sendbuf, msg0) == -1) {
866 		plog(LLV_ERROR , LOCATION, NULL,
867 			"failed to add a response packet to the tree.\n");
868 		goto end;
869 	}
870 
871 	/* compute both of KEYMATs */
872 	if (oakley_compute_keymat(iph2, INITIATOR) < 0)
873 		goto end;
874 
875 	iph2->status = PHASE2ST_ADDSA;
876 
877 	/* don't anything if local test mode. */
878 	if (f_local) {
879 		error = 0;
880 		goto end;
881 	}
882 
883 	/* if there is commit bit don't set up SA now. */
884 	if (ISSET(iph2->flags, ISAKMP_FLAG_C)) {
885 		iph2->status = PHASE2ST_COMMIT;
886 		error = 0;
887 		goto end;
888 	}
889 
890 	/* Do UPDATE for initiator */
891 	plog(LLV_DEBUG, LOCATION, NULL, "call pk_sendupdate\n");
892 	if (pk_sendupdate(iph2) < 0) {
893 		plog(LLV_ERROR, LOCATION, NULL, "pfkey update failed.\n");
894 		goto end;
895 	}
896 	plog(LLV_DEBUG, LOCATION, NULL, "pfkey update sent.\n");
897 
898 	/* Do ADD for responder */
899 	if (pk_sendadd(iph2) < 0) {
900 		plog(LLV_ERROR, LOCATION, NULL, "pfkey add failed.\n");
901 		goto end;
902 	}
903 	plog(LLV_DEBUG, LOCATION, NULL, "pfkey add sent.\n");
904 
905 	error = 0;
906 
907 end:
908 	if (buf != NULL)
909 		vfree(buf);
910 	if (msg != NULL)
911 		vfree(msg);
912 	if (hash != NULL)
913 		vfree(hash);
914 
915 	return error;
916 }
917 
918 /*
919  * receive from responder
920  * 	HDR#*, HASH(4), notify
921  */
922 int
quick_i3recv(iph2,msg0)923 quick_i3recv(iph2, msg0)
924 	struct ph2handle *iph2;
925 	vchar_t *msg0;
926 {
927 	vchar_t *msg = NULL;
928 	vchar_t *pbuf = NULL;	/* for payload parsing */
929 	struct isakmp_parse_t *pa;
930 	struct isakmp_pl_hash *hash = NULL;
931 	vchar_t *notify = NULL;
932 	int error = ISAKMP_INTERNAL_ERROR;
933 
934 	/* validity check */
935 	if (iph2->status != PHASE2ST_COMMIT) {
936 		plog(LLV_ERROR, LOCATION, NULL,
937 			"status mismatched %d.\n", iph2->status);
938 		goto end;
939 	}
940 
941 	/* decrypt packet */
942 	if (!ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E)) {
943 		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
944 			"Packet wasn't encrypted.\n");
945 		goto end;
946 	}
947 	msg = oakley_do_decrypt(iph2->ph1, msg0, iph2->ivm->iv, iph2->ivm->ive);
948 	if (msg == NULL)
949 		goto end;
950 
951 	/* validate the type of next payload */
952 	pbuf = isakmp_parse(msg);
953 	if (pbuf == NULL)
954 		goto end;
955 
956 	for (pa = (struct isakmp_parse_t *)pbuf->v;
957 	     pa->type != ISAKMP_NPTYPE_NONE;
958 	     pa++) {
959 
960 		switch (pa->type) {
961 		case ISAKMP_NPTYPE_HASH:
962 			hash = (struct isakmp_pl_hash *)pa->ptr;
963 			break;
964 		case ISAKMP_NPTYPE_N:
965 			if (notify != NULL) {
966 				plog(LLV_WARNING, LOCATION, NULL,
967 				    "Ignoring multiples notifications\n");
968 				break;
969 			}
970 			ph2_recv_n(iph2, pa->ptr);
971 			notify = vmalloc(pa->len);
972 			if (notify == NULL) {
973 				plog(LLV_ERROR, LOCATION, NULL,
974 					"failed to get notify buffer.\n");
975 				goto end;
976 			}
977 			memcpy(notify->v, pa->ptr, notify->l);
978 			break;
979 		default:
980 			/* don't send information, see ident_r1recv() */
981 			plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
982 				"ignore the packet, "
983 				"received unexpecting payload type %d.\n",
984 				pa->type);
985 			goto end;
986 		}
987 	}
988 
989 	/* payload existency check */
990 	if (hash == NULL) {
991 		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
992 			"few isakmp message received.\n");
993 		goto end;
994 	}
995 
996 	/* validate HASH(4) */
997     {
998 	char *r_hash;
999 	vchar_t *my_hash = NULL;
1000 	vchar_t *tmp = NULL;
1001 	int result;
1002 
1003 	r_hash = (char *)hash + sizeof(*hash);
1004 
1005 	plog(LLV_DEBUG, LOCATION, NULL, "HASH(4) validate:");
1006 	plogdump(LLV_DEBUG, r_hash, ntohs(hash->h.len) - sizeof(*hash));
1007 
1008 	my_hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, notify);
1009 	vfree(tmp);
1010 	if (my_hash == NULL)
1011 		goto end;
1012 
1013 	result = memcmp(my_hash->v, r_hash, my_hash->l);
1014 	vfree(my_hash);
1015 
1016 	if (result) {
1017 		plog(LLV_DEBUG, LOCATION, iph2->ph1->remote,
1018 			"HASH(4) mismatch.\n");
1019 		error = ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
1020 		goto end;
1021 	}
1022     }
1023 
1024 	iph2->status = PHASE2ST_ADDSA;
1025 	iph2->flags ^= ISAKMP_FLAG_C;	/* reset bit */
1026 
1027 	/* don't anything if local test mode. */
1028 	if (f_local) {
1029 		error = 0;
1030 		goto end;
1031 	}
1032 
1033 	/* Do UPDATE for initiator */
1034 	plog(LLV_DEBUG, LOCATION, NULL, "call pk_sendupdate\n");
1035 	if (pk_sendupdate(iph2) < 0) {
1036 		plog(LLV_ERROR, LOCATION, NULL, "pfkey update failed.\n");
1037 		goto end;
1038 	}
1039 	plog(LLV_DEBUG, LOCATION, NULL, "pfkey update sent.\n");
1040 
1041 	/* Do ADD for responder */
1042 	if (pk_sendadd(iph2) < 0) {
1043 		plog(LLV_ERROR, LOCATION, NULL, "pfkey add failed.\n");
1044 		goto end;
1045 	}
1046 	plog(LLV_DEBUG, LOCATION, NULL, "pfkey add sent.\n");
1047 
1048 	error = 0;
1049 
1050 end:
1051 	if (msg != NULL)
1052 		vfree(msg);
1053 	if (pbuf != NULL)
1054 		vfree(pbuf);
1055 	if (notify != NULL)
1056 		vfree(notify);
1057 
1058 	return error;
1059 }
1060 
1061 /*
1062  * receive from initiator
1063  * 	HDR*, HASH(1), SA, Ni [, KE ] [, IDi2, IDr2 ] [, NAT-OAi, NAT-OAr ]
1064  */
1065 int
quick_r1recv(iph2,msg0)1066 quick_r1recv(iph2, msg0)
1067 	struct ph2handle *iph2;
1068 	vchar_t *msg0;
1069 {
1070 	vchar_t *msg = NULL;
1071 	vchar_t *hbuf = NULL;	/* for hash computing. */
1072 	vchar_t *pbuf = NULL;	/* for payload parsing */
1073 	struct isakmp_parse_t *pa;
1074 	struct isakmp *isakmp = (struct isakmp *)msg0->v;
1075 	struct isakmp_pl_hash *hash = NULL;
1076 	char *p;
1077 	int tlen;
1078 	int f_id_order;	/* for ID payload detection */
1079 	int error = ISAKMP_INTERNAL_ERROR;
1080 
1081 	/* validity check */
1082 	if (iph2->status != PHASE2ST_START) {
1083 		plog(LLV_ERROR, LOCATION, NULL,
1084 			"status mismatched %d.\n", iph2->status);
1085 		goto end;
1086 	}
1087 
1088 	/* decrypting */
1089 	if (!ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E)) {
1090 		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1091 			"Packet wasn't encrypted.\n");
1092 		error = ISAKMP_NTYPE_PAYLOAD_MALFORMED;
1093 		goto end;
1094 	}
1095 	/* decrypt packet */
1096 	msg = oakley_do_decrypt(iph2->ph1, msg0, iph2->ivm->iv, iph2->ivm->ive);
1097 	if (msg == NULL) {
1098 		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1099 			"Packet decryption failed.\n");
1100 		goto end;
1101 	}
1102 
1103 	/* create buffer for using to validate HASH(1) */
1104 	/*
1105 	 * ordering rule:
1106 	 *	1. the first one must be HASH
1107 	 *	2. the second one must be SA (added in isakmp-oakley-05!)
1108 	 *	3. two IDs must be considered as IDci, then IDcr
1109 	 */
1110 	pbuf = isakmp_parse(msg);
1111 	if (pbuf == NULL)
1112 		goto end;
1113 	pa = (struct isakmp_parse_t *)pbuf->v;
1114 
1115 	/* HASH payload is fixed postion */
1116 	if (pa->type != ISAKMP_NPTYPE_HASH) {
1117 		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1118 			"received invalid next payload type %d, "
1119 			"expecting %d.\n",
1120 			pa->type, ISAKMP_NPTYPE_HASH);
1121 		error = ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX;
1122 		goto end;
1123 	}
1124 	hash = (struct isakmp_pl_hash *)pa->ptr;
1125 	pa++;
1126 
1127 	/*
1128 	 * this restriction was introduced in isakmp-oakley-05.
1129 	 * we do not check this for backward compatibility.
1130 	 * TODO: command line/config file option to enable/disable this code
1131 	 */
1132 	/* HASH payload is fixed postion */
1133 	if (pa->type != ISAKMP_NPTYPE_SA) {
1134 		plog(LLV_WARNING, LOCATION, iph2->ph1->remote,
1135 			"received invalid next payload type %d, "
1136 			"expecting %d.\n",
1137 			pa->type, ISAKMP_NPTYPE_SA);
1138 		error = ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX;
1139 	}
1140 
1141 	/* allocate buffer for computing HASH(1) */
1142 	tlen = ntohl(isakmp->len) - sizeof(*isakmp);
1143 	hbuf = vmalloc(tlen);
1144 	if (hbuf == NULL) {
1145 		plog(LLV_ERROR, LOCATION, NULL,
1146 			"failed to get hash buffer.\n");
1147 		goto end;
1148 	}
1149 	p = hbuf->v;
1150 
1151 	/*
1152 	 * parse the payloads.
1153 	 * copy non-HASH payloads into hbuf, so that we can validate HASH.
1154 	 */
1155 	iph2->sa = NULL;	/* we don't support multi SAs. */
1156 	iph2->nonce_p = NULL;
1157 	iph2->dhpub_p = NULL;
1158 	iph2->id_p = NULL;
1159 	iph2->id = NULL;
1160 	tlen = 0;	/* count payload length except of HASH payload. */
1161 
1162 	/*
1163 	 * IDi2 MUST be immediatelly followed by IDr2.  We allowed the
1164 	 * illegal case, but logged.  First ID payload is to be IDi2.
1165 	 * And next ID payload is to be IDr2.
1166 	 */
1167 	f_id_order = 0;
1168 
1169 	for (; pa->type; pa++) {
1170 
1171 		/* copy to buffer for HASH */
1172 		/* Don't modify the payload */
1173 		memcpy(p, pa->ptr, pa->len);
1174 
1175 		if (pa->type != ISAKMP_NPTYPE_ID)
1176 			f_id_order = 0;
1177 
1178 		switch (pa->type) {
1179 		case ISAKMP_NPTYPE_SA:
1180 			if (iph2->sa != NULL) {
1181 				plog(LLV_ERROR, LOCATION, NULL,
1182 					"Multi SAs isn't supported.\n");
1183 				goto end;
1184 			}
1185 			if (isakmp_p2ph(&iph2->sa, pa->ptr) < 0) {
1186 				plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1187 					"duplicate ISAKMP_NPTYPE_SA.\n");
1188 				goto end;
1189 			}
1190 			break;
1191 
1192 		case ISAKMP_NPTYPE_NONCE:
1193 			if (isakmp_p2ph(&iph2->nonce_p, pa->ptr) < 0) {
1194 				plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1195 					"duplicate ISAKMP_NPTYPE_NONCE.\n");
1196 				goto end;
1197 			}
1198 			break;
1199 
1200 		case ISAKMP_NPTYPE_KE:
1201 			if (isakmp_p2ph(&iph2->dhpub_p, pa->ptr) < 0) {
1202 				plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1203 					"duplicate ISAKMP_NPTYPE_KE.\n");
1204 				goto end;
1205 			}
1206 			break;
1207 
1208 		case ISAKMP_NPTYPE_ID:
1209 			if (iph2->id_p == NULL) {
1210 				/* for IDci */
1211 				f_id_order++;
1212 
1213 				if (isakmp_p2ph(&iph2->id_p, pa->ptr) < 0)
1214 					goto end;
1215 
1216 			} else if (iph2->id == NULL) {
1217 				/* for IDcr */
1218 				if (f_id_order == 0) {
1219 					plog(LLV_ERROR, LOCATION, NULL,
1220 						"IDr2 payload is not "
1221 						"immediatelly followed "
1222 						"by IDi2. We allowed.\n");
1223 					/* XXX we allowed in this case. */
1224 				}
1225 
1226 				if (isakmp_p2ph(&iph2->id, pa->ptr) < 0)
1227 					goto end;
1228 			} else {
1229 				plog(LLV_ERROR, LOCATION, NULL,
1230 					"received too many ID payloads.\n");
1231 				plogdump(LLV_ERROR, iph2->id->v, iph2->id->l);
1232 				error = ISAKMP_NTYPE_INVALID_ID_INFORMATION;
1233 				goto end;
1234 			}
1235 			break;
1236 
1237 		case ISAKMP_NPTYPE_N:
1238 			ph2_recv_n(iph2, pa->ptr);
1239 			break;
1240 
1241 #ifdef ENABLE_NATT
1242 		case ISAKMP_NPTYPE_NATOA_DRAFT:
1243 		case ISAKMP_NPTYPE_NATOA_RFC:
1244 		    {
1245 			struct sockaddr_storage addr;
1246 			struct sockaddr *daddr;
1247 			u_int8_t prefix;
1248 			u_int16_t ul_proto;
1249 			vchar_t *vp = NULL;
1250 
1251 			if (isakmp_p2ph(&vp, pa->ptr) < 0)
1252 				goto end;
1253 
1254 			error = ipsecdoi_id2sockaddr(vp,
1255 					(struct sockaddr *) &addr,
1256 					&prefix, &ul_proto);
1257 
1258 			vfree(vp);
1259 
1260 			if (error)
1261 				goto end;
1262 
1263 			daddr = dupsaddr((struct sockaddr *) &addr);
1264 			if (daddr == NULL)
1265 				goto end;
1266 
1267 			if (iph2->natoa_dst == NULL)
1268 				iph2->natoa_dst = daddr;
1269 			else if (iph2->natoa_src == NULL)
1270 				iph2->natoa_src = daddr;
1271 			else {
1272 				racoon_free(daddr);
1273 				plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1274 					"received too many NAT-OA payloads.\n");
1275 				error = ISAKMP_NTYPE_PAYLOAD_MALFORMED;
1276 				goto end;
1277 			}
1278 		    }
1279 			break;
1280 #endif
1281 
1282 		default:
1283 			plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1284 				"ignore the packet, "
1285 				"received unexpecting payload type %d.\n",
1286 				pa->type);
1287 			error = ISAKMP_NTYPE_PAYLOAD_MALFORMED;
1288 			goto end;
1289 		}
1290 
1291 		p += pa->len;
1292 
1293 		/* compute true length of payload. */
1294 		tlen += pa->len;
1295 	}
1296 
1297 	/* payload existency check */
1298 	if (hash == NULL || iph2->sa == NULL || iph2->nonce_p == NULL) {
1299 		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1300 			"few isakmp message received.\n");
1301 		error = ISAKMP_NTYPE_PAYLOAD_MALFORMED;
1302 		goto end;
1303 	}
1304 
1305 	if (iph2->id_p) {
1306 		plog(LLV_DEBUG, LOCATION, NULL, "received IDci2:");
1307 		plogdump(LLV_DEBUG, iph2->id_p->v, iph2->id_p->l);
1308 	}
1309 	if (iph2->id) {
1310 		plog(LLV_DEBUG, LOCATION, NULL, "received IDcr2:");
1311 		plogdump(LLV_DEBUG, iph2->id->v, iph2->id->l);
1312 	}
1313 
1314 	/* adjust buffer length for HASH */
1315 	hbuf->l = tlen;
1316 
1317 	/* validate HASH(1) */
1318     {
1319 	char *r_hash;
1320 	vchar_t *my_hash = NULL;
1321 	int result;
1322 
1323 	r_hash = (caddr_t)hash + sizeof(*hash);
1324 
1325 	plog(LLV_DEBUG, LOCATION, NULL, "HASH(1) validate:");
1326 	plogdump(LLV_DEBUG, r_hash, ntohs(hash->h.len) - sizeof(*hash));
1327 
1328 	my_hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, hbuf);
1329 	if (my_hash == NULL)
1330 		goto end;
1331 
1332 	result = memcmp(my_hash->v, r_hash, my_hash->l);
1333 	vfree(my_hash);
1334 
1335 	if (result) {
1336 		plog(LLV_DEBUG, LOCATION, iph2->ph1->remote,
1337 			"HASH(1) mismatch.\n");
1338 		error = ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
1339 		goto end;
1340 	}
1341     }
1342 
1343 	/* get sainfo */
1344 	error = get_sainfo_r(iph2);
1345 	if (error) {
1346 		plog(LLV_ERROR, LOCATION, NULL,
1347 			"failed to get sainfo.\n");
1348 		goto end;
1349 	}
1350 
1351 
1352 	/* check the existence of ID payload and create responder's proposal */
1353 	error = get_proposal_r(iph2);
1354 	switch (error) {
1355 	case -2:
1356 		/* generate a policy template from peer's proposal */
1357 		if (set_proposal_from_proposal(iph2)) {
1358 			plog(LLV_ERROR, LOCATION, NULL,
1359 				"failed to generate a proposal template "
1360 				"from client's proposal.\n");
1361 			error = ISAKMP_INTERNAL_ERROR;
1362 			goto end;
1363 		}
1364 		/*FALLTHROUGH*/
1365 	case 0:
1366 		/* select single proposal or reject it. */
1367 		if (ipsecdoi_selectph2proposal(iph2) < 0) {
1368 			plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1369 				"no proposal chosen.\n");
1370 			error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
1371 			goto end;
1372 		}
1373 		break;
1374 	default:
1375 		plog(LLV_ERROR, LOCATION, NULL,
1376 			"failed to get proposal for responder.\n");
1377 		goto end;
1378 	}
1379 
1380 	/* check KE and attribute of PFS */
1381 	if (iph2->dhpub_p != NULL && iph2->approval->pfs_group == 0) {
1382 		plog(LLV_ERROR, LOCATION, NULL,
1383 			"no PFS is specified, but peer sends KE.\n");
1384 		error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
1385 		goto end;
1386 	}
1387 	if (iph2->dhpub_p == NULL && iph2->approval->pfs_group != 0) {
1388 		plog(LLV_ERROR, LOCATION, NULL,
1389 			"PFS is specified, but peer doesn't sends KE.\n");
1390 		error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
1391 		goto end;
1392 	}
1393 
1394 	/*
1395 	 * save the packet from the initiator in order to resend the
1396 	 * responder's first packet against this packet.
1397 	 */
1398 	iph2->msg1 = vdup(msg0);
1399 
1400 	/* change status of isakmp status entry */
1401 	iph2->status = PHASE2ST_STATUS2;
1402 
1403 	error = 0;
1404 
1405 end:
1406 	if (hbuf)
1407 		vfree(hbuf);
1408 	if (msg)
1409 		vfree(msg);
1410 	if (pbuf)
1411 		vfree(pbuf);
1412 
1413 	if (error) {
1414 		VPTRINIT(iph2->sa);
1415 		VPTRINIT(iph2->nonce_p);
1416 		VPTRINIT(iph2->dhpub_p);
1417 		VPTRINIT(iph2->id);
1418 		VPTRINIT(iph2->id_p);
1419 #ifdef ENABLE_NATT
1420 		if (iph2->natoa_src) {
1421 			racoon_free(iph2->natoa_src);
1422 			iph2->natoa_src = NULL;
1423 		}
1424 		if (iph2->natoa_dst) {
1425 			racoon_free(iph2->natoa_dst);
1426 			iph2->natoa_dst = NULL;
1427 		}
1428 #endif
1429 	}
1430 
1431 	return error;
1432 }
1433 
1434 /*
1435  * call pfkey_getspi.
1436  */
1437 int
quick_r1prep(iph2,msg)1438 quick_r1prep(iph2, msg)
1439 	struct ph2handle *iph2;
1440 	vchar_t *msg;
1441 {
1442 	int error = ISAKMP_INTERNAL_ERROR;
1443 
1444 	/* validity check */
1445 	if (iph2->status != PHASE2ST_STATUS2) {
1446 		plog(LLV_ERROR, LOCATION, NULL,
1447 			"status mismatched %d.\n", iph2->status);
1448 		goto end;
1449 	}
1450 
1451 	iph2->status = PHASE2ST_GETSPISENT;
1452 
1453 	/* send getspi message */
1454 	if (pk_sendgetspi(iph2) < 0)
1455 		goto end;
1456 
1457 	plog(LLV_DEBUG, LOCATION, NULL, "pfkey getspi sent.\n");
1458 
1459 	sched_schedule(&iph2->sce, lcconf->wait_ph2complete,
1460 		       quick_timeover_stub);
1461 
1462 	error = 0;
1463 
1464 end:
1465 	return error;
1466 }
1467 
1468 /*
1469  * send to initiator
1470  * 	HDR*, HASH(2), SA, Nr [, KE ] [, IDi2, IDr2 ] [, NAT-OAi, NAT-OAr ]
1471  */
1472 int
quick_r2send(iph2,msg)1473 quick_r2send(iph2, msg)
1474 	struct ph2handle *iph2;
1475 	vchar_t *msg;
1476 {
1477 	vchar_t *body = NULL;
1478 	vchar_t *hash = NULL;
1479 	struct isakmp_gen *gen;
1480 	char *p;
1481 	int tlen;
1482 	int error = ISAKMP_INTERNAL_ERROR;
1483 	int natoa = ISAKMP_NPTYPE_NONE;
1484 	int pfsgroup;
1485 	u_int8_t *np_p = NULL;
1486 #ifdef ENABLE_NATT
1487 	vchar_t *nat_oai = NULL;
1488 	vchar_t *nat_oar = NULL;
1489 #endif
1490 
1491 	/* validity check */
1492 	if (msg != NULL) {
1493 		plog(LLV_ERROR, LOCATION, NULL,
1494 			"msg has to be NULL in this function.\n");
1495 		goto end;
1496 	}
1497 	if (iph2->status != PHASE2ST_GETSPIDONE) {
1498 		plog(LLV_ERROR, LOCATION, NULL,
1499 			"status mismatched %d.\n", iph2->status);
1500 		goto end;
1501 	}
1502 
1503 	/* update responders SPI */
1504 	if (ipsecdoi_updatespi(iph2) < 0) {
1505 		plog(LLV_ERROR, LOCATION, NULL, "failed to update spi.\n");
1506 		goto end;
1507 	}
1508 
1509 	/* generate NONCE value */
1510 	iph2->nonce = eay_set_random(iph2->ph1->rmconf->nonce_size);
1511 	if (iph2->nonce == NULL)
1512 		goto end;
1513 
1514 	/* generate KE value if need */
1515 	pfsgroup = iph2->approval->pfs_group;
1516 	if (iph2->dhpub_p != NULL && pfsgroup != 0) {
1517 		/* DH group settting if PFS is required. */
1518 		if (oakley_setdhgroup(pfsgroup, &iph2->pfsgrp) < 0) {
1519 			plog(LLV_ERROR, LOCATION, NULL,
1520 				"failed to set DH value.\n");
1521 			goto end;
1522 		}
1523 		/* generate DH public value */
1524 		if (oakley_dh_generate(iph2->pfsgrp,
1525 				&iph2->dhpub, &iph2->dhpriv) < 0) {
1526 			goto end;
1527 		}
1528 	}
1529 
1530 #ifdef ENABLE_NATT
1531 	/*
1532 	 * RFC3947 5.2. if we chose UDP-Encapsulated-Transport
1533 	 * we should send NAT-OA
1534 	 */
1535 	if (ipsecdoi_transportmode(iph2->proposal)
1536 	 && (iph2->ph1->natt_flags & NAT_DETECTED)) {
1537 		natoa = iph2->ph1->natt_options->payload_nat_oa;
1538 
1539 		nat_oai = ipsecdoi_sockaddr2id(iph2->dst,
1540 			IPSECDOI_PREFIX_HOST, IPSEC_ULPROTO_ANY);
1541 		nat_oar = ipsecdoi_sockaddr2id(iph2->src,
1542 			IPSECDOI_PREFIX_HOST, IPSEC_ULPROTO_ANY);
1543 
1544 		if (nat_oai == NULL || nat_oar == NULL) {
1545 			plog(LLV_ERROR, LOCATION, NULL,
1546 				"failed to generate NAT-OA payload.\n");
1547 			goto end;
1548 		}
1549 
1550 		plog(LLV_DEBUG, LOCATION, NULL, "NAT-OAi:\n");
1551 		plogdump(LLV_DEBUG, nat_oai->v, nat_oai->l);
1552 		plog(LLV_DEBUG, LOCATION, NULL, "NAT-OAr:\n");
1553 		plogdump(LLV_DEBUG, nat_oar->v, nat_oar->l);
1554 	}
1555 #endif
1556 
1557 	/* create SA;NONCE payload, and KE and ID if need */
1558 	tlen = sizeof(*gen) + iph2->sa_ret->l
1559 		+ sizeof(*gen) + iph2->nonce->l;
1560 	if (iph2->dhpub_p != NULL && pfsgroup != 0)
1561 		tlen += (sizeof(*gen) + iph2->dhpub->l);
1562 	if (iph2->id_p != NULL)
1563 		tlen += (sizeof(*gen) + iph2->id_p->l
1564 			+ sizeof(*gen) + iph2->id->l);
1565 #ifdef ENABLE_NATT
1566 	if (natoa != ISAKMP_NPTYPE_NONE)
1567 		tlen += 2 * sizeof(*gen) + nat_oai->l + nat_oar->l;
1568 #endif
1569 
1570 	body = vmalloc(tlen);
1571 	if (body == NULL) {
1572 		plog(LLV_ERROR, LOCATION, NULL,
1573 			"failed to get buffer to send.\n");
1574 		goto end;
1575 	}
1576 	p = body->v;
1577 
1578 	/* make SA payload */
1579 	p = set_isakmp_payload(body->v, iph2->sa_ret, ISAKMP_NPTYPE_NONCE);
1580 
1581 	/* add NONCE payload */
1582 	np_p = &((struct isakmp_gen *)p)->np;	/* XXX */
1583 	p = set_isakmp_payload(p, iph2->nonce,
1584 		(iph2->dhpub_p != NULL && pfsgroup != 0)
1585 				? ISAKMP_NPTYPE_KE
1586 				: (iph2->id_p != NULL
1587 					? ISAKMP_NPTYPE_ID
1588 					: natoa));
1589 
1590 	/* add KE payload if need. */
1591 	if (iph2->dhpub_p != NULL && pfsgroup != 0) {
1592 		np_p = &((struct isakmp_gen *)p)->np;	/* XXX */
1593 		p = set_isakmp_payload(p, iph2->dhpub,
1594 			(iph2->id_p == NULL)
1595 				? natoa
1596 				: ISAKMP_NPTYPE_ID);
1597 	}
1598 
1599 	/* add ID payloads received. */
1600 	if (iph2->id_p != NULL) {
1601 		/* IDci */
1602 		p = set_isakmp_payload(p, iph2->id_p, ISAKMP_NPTYPE_ID);
1603 		/* IDcr */
1604 		np_p = &((struct isakmp_gen *)p)->np;	/* XXX */
1605 		p = set_isakmp_payload(p, iph2->id, natoa);
1606 	}
1607 
1608 #ifdef ENABLE_NATT
1609 	/* NAT-OA */
1610 	if (natoa != ISAKMP_NPTYPE_NONE) {
1611 		p = set_isakmp_payload(p, nat_oai, natoa);
1612 		p = set_isakmp_payload(p, nat_oar, ISAKMP_NPTYPE_NONE);
1613 	}
1614 #endif
1615 
1616 	/* add a RESPONDER-LIFETIME notify payload if needed */
1617     {
1618 	vchar_t *data = NULL;
1619 	struct saprop *pp = iph2->approval;
1620 	struct saproto *pr;
1621 
1622 	if (pp->claim & IPSECDOI_ATTR_SA_LD_TYPE_SEC) {
1623 		u_int32_t v = htonl((u_int32_t)pp->lifetime);
1624 		data = isakmp_add_attr_l(data, IPSECDOI_ATTR_SA_LD_TYPE,
1625 					IPSECDOI_ATTR_SA_LD_TYPE_SEC);
1626 		if (!data)
1627 			goto end;
1628 		data = isakmp_add_attr_v(data, IPSECDOI_ATTR_SA_LD,
1629 					(caddr_t)&v, sizeof(v));
1630 		if (!data)
1631 			goto end;
1632 	}
1633 	if (pp->claim & IPSECDOI_ATTR_SA_LD_TYPE_KB) {
1634 		u_int32_t v = htonl((u_int32_t)pp->lifebyte);
1635 		data = isakmp_add_attr_l(data, IPSECDOI_ATTR_SA_LD_TYPE,
1636 					IPSECDOI_ATTR_SA_LD_TYPE_KB);
1637 		if (!data)
1638 			goto end;
1639 		data = isakmp_add_attr_v(data, IPSECDOI_ATTR_SA_LD,
1640 					(caddr_t)&v, sizeof(v));
1641 		if (!data)
1642 			goto end;
1643 	}
1644 
1645 	/*
1646 	 * XXX Is there only single RESPONDER-LIFETIME payload in a IKE message
1647 	 * in the case of SA bundle ?
1648 	 */
1649 	if (data) {
1650 		for (pr = pp->head; pr; pr = pr->next) {
1651 			body = isakmp_add_pl_n(body, &np_p,
1652 					ISAKMP_NTYPE_RESPONDER_LIFETIME, pr, data);
1653 			if (!body) {
1654 				vfree(data);
1655 				return error;	/* XXX */
1656 			}
1657 		}
1658 		vfree(data);
1659 	}
1660     }
1661 
1662 	/* generate HASH(2) */
1663     {
1664 	vchar_t *tmp;
1665 
1666 	tmp = vmalloc(iph2->nonce_p->l + body->l);
1667 	if (tmp == NULL) {
1668 		plog(LLV_ERROR, LOCATION, NULL,
1669 			"failed to get hash buffer.\n");
1670 		goto end;
1671 	}
1672 	memcpy(tmp->v, iph2->nonce_p->v, iph2->nonce_p->l);
1673 	memcpy(tmp->v + iph2->nonce_p->l, body->v, body->l);
1674 
1675 	hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, tmp);
1676 	vfree(tmp);
1677 
1678 	if (hash == NULL)
1679 		goto end;
1680     }
1681 
1682 	/* send isakmp payload */
1683 	iph2->sendbuf = quick_ir1mx(iph2, body, hash);
1684 	if (iph2->sendbuf == NULL)
1685 		goto end;
1686 
1687 	/* send the packet, add to the schedule to resend */
1688 	if (isakmp_ph2send(iph2) == -1)
1689 		goto end;
1690 
1691 	/* the sending message is added to the received-list. */
1692 	if (add_recvdpkt(iph2->ph1->remote, iph2->ph1->local, iph2->sendbuf, iph2->msg1) == -1) {
1693 		plog(LLV_ERROR , LOCATION, NULL,
1694 			"failed to add a response packet to the tree.\n");
1695 		goto end;
1696 	}
1697 
1698 	/* change status of isakmp status entry */
1699 	iph2->status = PHASE2ST_MSG1SENT;
1700 
1701 	error = 0;
1702 
1703 end:
1704 	if (body != NULL)
1705 		vfree(body);
1706 	if (hash != NULL)
1707 		vfree(hash);
1708 #ifdef ENABLE_NATT
1709 	if (nat_oai != NULL)
1710 		vfree(nat_oai);
1711 	if (nat_oar != NULL)
1712 		vfree(nat_oar);
1713 #endif
1714 
1715 	return error;
1716 }
1717 
1718 /*
1719  * receive from initiator
1720  * 	HDR*, HASH(3)
1721 
1722  */
1723 int
quick_r3recv(iph2,msg0)1724 quick_r3recv(iph2, msg0)
1725 	struct ph2handle *iph2;
1726 	vchar_t *msg0;
1727 {
1728 	vchar_t *msg = NULL;
1729 	vchar_t *pbuf = NULL;	/* for payload parsing */
1730 	struct isakmp_parse_t *pa;
1731 	struct isakmp_pl_hash *hash = NULL;
1732 	int error = ISAKMP_INTERNAL_ERROR;
1733 
1734 	/* validity check */
1735 	if (iph2->status != PHASE2ST_MSG1SENT) {
1736 		plog(LLV_ERROR, LOCATION, NULL,
1737 			"status mismatched %d.\n", iph2->status);
1738 		goto end;
1739 	}
1740 
1741 	/* decrypt packet */
1742 	if (!ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E)) {
1743 		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1744 			"Packet wasn't encrypted.\n");
1745 		goto end;
1746 	}
1747 	msg = oakley_do_decrypt(iph2->ph1, msg0, iph2->ivm->iv, iph2->ivm->ive);
1748 	if (msg == NULL)
1749 		goto end;
1750 
1751 	/* validate the type of next payload */
1752 	pbuf = isakmp_parse(msg);
1753 	if (pbuf == NULL)
1754 		goto end;
1755 
1756 	for (pa = (struct isakmp_parse_t *)pbuf->v;
1757 	     pa->type != ISAKMP_NPTYPE_NONE;
1758 	     pa++) {
1759 
1760 		switch (pa->type) {
1761 		case ISAKMP_NPTYPE_HASH:
1762 			hash = (struct isakmp_pl_hash *)pa->ptr;
1763 			break;
1764 		case ISAKMP_NPTYPE_N:
1765 			ph2_recv_n(iph2, pa->ptr);
1766 			break;
1767 		default:
1768 			/* don't send information, see ident_r1recv() */
1769 			plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1770 				"ignore the packet, "
1771 				"received unexpecting payload type %d.\n",
1772 				pa->type);
1773 			goto end;
1774 		}
1775 	}
1776 
1777 	/* payload existency check */
1778 	if (hash == NULL) {
1779 		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1780 			"few isakmp message received.\n");
1781 		goto end;
1782 	}
1783 
1784 	/* validate HASH(3) */
1785 	/* HASH(3) = prf(SKEYID_a, 0 | M-ID | Ni_b | Nr_b) */
1786     {
1787 	char *r_hash;
1788 	vchar_t *my_hash = NULL;
1789 	vchar_t *tmp = NULL;
1790 	int result;
1791 
1792 	r_hash = (char *)hash + sizeof(*hash);
1793 
1794 	plog(LLV_DEBUG, LOCATION, NULL, "HASH(3) validate:");
1795 	plogdump(LLV_DEBUG, r_hash, ntohs(hash->h.len) - sizeof(*hash));
1796 
1797 	tmp = vmalloc(iph2->nonce_p->l + iph2->nonce->l);
1798 	if (tmp == NULL) {
1799 		plog(LLV_ERROR, LOCATION, NULL,
1800 			"failed to get hash buffer.\n");
1801 		goto end;
1802 	}
1803 	memcpy(tmp->v, iph2->nonce_p->v, iph2->nonce_p->l);
1804 	memcpy(tmp->v + iph2->nonce_p->l, iph2->nonce->v, iph2->nonce->l);
1805 
1806 	my_hash = oakley_compute_hash3(iph2->ph1, iph2->msgid, tmp);
1807 	vfree(tmp);
1808 	if (my_hash == NULL)
1809 		goto end;
1810 
1811 	result = memcmp(my_hash->v, r_hash, my_hash->l);
1812 	vfree(my_hash);
1813 
1814 	if (result) {
1815 		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
1816 			"HASH(3) mismatch.\n");
1817 		error = ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
1818 		goto end;
1819 	}
1820     }
1821 
1822 	/* if there is commit bit, don't set up SA now. */
1823 	if (ISSET(iph2->flags, ISAKMP_FLAG_C)) {
1824 		iph2->status = PHASE2ST_COMMIT;
1825 	} else
1826 		iph2->status = PHASE2ST_STATUS6;
1827 
1828 	error = 0;
1829 
1830 end:
1831 	if (pbuf != NULL)
1832 		vfree(pbuf);
1833 	if (msg != NULL)
1834 		vfree(msg);
1835 
1836 	return error;
1837 }
1838 
1839 /*
1840  * send to initiator
1841  * 	HDR#*, HASH(4), notify
1842  */
1843 int
quick_r3send(iph2,msg0)1844 quick_r3send(iph2, msg0)
1845 	struct ph2handle *iph2;
1846 	vchar_t *msg0;
1847 {
1848 	vchar_t *buf = NULL;
1849 	vchar_t *myhash = NULL;
1850 	struct isakmp_pl_n *n;
1851 	vchar_t *notify = NULL;
1852 	char *p;
1853 	int tlen;
1854 	int error = ISAKMP_INTERNAL_ERROR;
1855 
1856 	/* validity check */
1857 	if (iph2->status != PHASE2ST_COMMIT) {
1858 		plog(LLV_ERROR, LOCATION, NULL,
1859 			"status mismatched %d.\n", iph2->status);
1860 		goto end;
1861 	}
1862 
1863 	/* generate HASH(4) */
1864 	/* XXX What can I do in the case of multiple different SA */
1865 	plog(LLV_DEBUG, LOCATION, NULL, "HASH(4) generate\n");
1866 
1867 	/* XXX What should I do if there are multiple SAs ? */
1868 	tlen = sizeof(struct isakmp_pl_n) + iph2->approval->head->spisize;
1869 	notify = vmalloc(tlen);
1870 	if (notify == NULL) {
1871 		plog(LLV_ERROR, LOCATION, NULL,
1872 			"failed to get notify buffer.\n");
1873 		goto end;
1874 	}
1875 	n = (struct isakmp_pl_n *)notify->v;
1876 	n->h.np = ISAKMP_NPTYPE_NONE;
1877 	n->h.len = htons(tlen);
1878 	n->doi = htonl(IPSEC_DOI);
1879 	n->proto_id = iph2->approval->head->proto_id;
1880 	n->spi_size = sizeof(iph2->approval->head->spisize);
1881 	n->type = htons(ISAKMP_NTYPE_CONNECTED);
1882 	memcpy(n + 1, &iph2->approval->head->spi, iph2->approval->head->spisize);
1883 
1884 	myhash = oakley_compute_hash1(iph2->ph1, iph2->msgid, notify);
1885 	if (myhash == NULL)
1886 		goto end;
1887 
1888 	/* create buffer for isakmp payload */
1889 	tlen = sizeof(struct isakmp)
1890 		+ sizeof(struct isakmp_gen) + myhash->l
1891 		+ notify->l;
1892 	buf = vmalloc(tlen);
1893 	if (buf == NULL) {
1894 		plog(LLV_ERROR, LOCATION, NULL,
1895 			"failed to get buffer to send.\n");
1896 		goto end;
1897 	}
1898 
1899 	/* create isakmp header */
1900 	p = set_isakmp_header2(buf, iph2, ISAKMP_NPTYPE_HASH);
1901 	if (p == NULL)
1902 		goto end;
1903 
1904 	/* add HASH(4) payload */
1905 	p = set_isakmp_payload(p, myhash, ISAKMP_NPTYPE_N);
1906 
1907 	/* add notify payload */
1908 	memcpy(p, notify->v, notify->l);
1909 
1910 #ifdef HAVE_PRINT_ISAKMP_C
1911 	isakmp_printpacket(buf, iph2->ph1->local, iph2->ph1->remote, 1);
1912 #endif
1913 
1914 	/* encoding */
1915 	iph2->sendbuf = oakley_do_encrypt(iph2->ph1, buf, iph2->ivm->ive, iph2->ivm->iv);
1916 	if (iph2->sendbuf == NULL)
1917 		goto end;
1918 
1919 	/* send the packet */
1920 	if (isakmp_send(iph2->ph1, iph2->sendbuf) < 0)
1921 		goto end;
1922 
1923 	/* the sending message is added to the received-list. */
1924 	if (add_recvdpkt(iph2->ph1->remote, iph2->ph1->local, iph2->sendbuf, msg0) == -1) {
1925 		plog(LLV_ERROR , LOCATION, NULL,
1926 			"failed to add a response packet to the tree.\n");
1927 		goto end;
1928 	}
1929 
1930 	iph2->status = PHASE2ST_COMMIT;
1931 
1932 	error = 0;
1933 
1934 end:
1935 	if (buf != NULL)
1936 		vfree(buf);
1937 	if (myhash != NULL)
1938 		vfree(myhash);
1939 	if (notify != NULL)
1940 		vfree(notify);
1941 
1942 	return error;
1943 }
1944 
1945 int
tunnel_mode_prop(p)1946 tunnel_mode_prop(p)
1947 	struct saprop *p;
1948 {
1949 	struct saproto *pr;
1950 
1951 	for (pr = p->head; pr; pr = pr->next)
1952 		if (pr->encmode == IPSECDOI_ATTR_ENC_MODE_TUNNEL)
1953 			return 1;
1954 	return 0;
1955 }
1956 
1957 /*
1958  * set SA to kernel.
1959  */
1960 int
quick_r3prep(iph2,msg0)1961 quick_r3prep(iph2, msg0)
1962 	struct ph2handle *iph2;
1963 	vchar_t *msg0;
1964 {
1965 	int error = ISAKMP_INTERNAL_ERROR;
1966 
1967 	/* validity check */
1968 	if (iph2->status != PHASE2ST_STATUS6) {
1969 		plog(LLV_ERROR, LOCATION, NULL,
1970 			"status mismatched %d.\n", iph2->status);
1971 		goto end;
1972 	}
1973 
1974 	/* compute both of KEYMATs */
1975 	if (oakley_compute_keymat(iph2, RESPONDER) < 0)
1976 		goto end;
1977 
1978 	iph2->status = PHASE2ST_ADDSA;
1979 	iph2->flags ^= ISAKMP_FLAG_C;	/* reset bit */
1980 
1981 	/* don't anything if local test mode. */
1982 	if (f_local) {
1983 		error = 0;
1984 		goto end;
1985 	}
1986 
1987 	/* Do UPDATE as responder */
1988 	plog(LLV_DEBUG, LOCATION, NULL, "call pk_sendupdate\n");
1989 	if (pk_sendupdate(iph2) < 0) {
1990 		plog(LLV_ERROR, LOCATION, NULL, "pfkey update failed.\n");
1991 		goto end;
1992 	}
1993 	plog(LLV_DEBUG, LOCATION, NULL, "pfkey update sent.\n");
1994 
1995 	/* Do ADD for responder */
1996 	if (pk_sendadd(iph2) < 0) {
1997 		plog(LLV_ERROR, LOCATION, NULL, "pfkey add failed.\n");
1998 		goto end;
1999 	}
2000 	plog(LLV_DEBUG, LOCATION, NULL, "pfkey add sent.\n");
2001 
2002 	/*
2003 	 * set policies into SPD if the policy is generated
2004 	 * from peer's policy.
2005 	 */
2006 	if (iph2->spidx_gen) {
2007 
2008 		struct policyindex *spidx;
2009 		struct sockaddr_storage addr;
2010 		u_int8_t pref;
2011 		struct sockaddr *src = iph2->src;
2012 		struct sockaddr *dst = iph2->dst;
2013 
2014 		/* make inbound policy */
2015 		iph2->src = dst;
2016 		iph2->dst = src;
2017 		if (pk_sendspdupdate2(iph2) < 0) {
2018 			plog(LLV_ERROR, LOCATION, NULL,
2019 				"pfkey spdupdate2(inbound) failed.\n");
2020 			goto end;
2021 		}
2022 		plog(LLV_DEBUG, LOCATION, NULL,
2023 			"pfkey spdupdate2(inbound) sent.\n");
2024 
2025 		spidx = (struct policyindex *)iph2->spidx_gen;
2026 #ifdef HAVE_POLICY_FWD
2027 		/* make forward policy if required */
2028 		if (tunnel_mode_prop(iph2->approval)) {
2029 			spidx->dir = IPSEC_DIR_FWD;
2030 			if (pk_sendspdupdate2(iph2) < 0) {
2031 				plog(LLV_ERROR, LOCATION, NULL,
2032 					"pfkey spdupdate2(forward) failed.\n");
2033 				goto end;
2034 			}
2035 			plog(LLV_DEBUG, LOCATION, NULL,
2036 				"pfkey spdupdate2(forward) sent.\n");
2037 		}
2038 #endif
2039 
2040 		/* make outbound policy */
2041 		iph2->src = src;
2042 		iph2->dst = dst;
2043 		spidx->dir = IPSEC_DIR_OUTBOUND;
2044 		addr = spidx->src;
2045 		spidx->src = spidx->dst;
2046 		spidx->dst = addr;
2047 		pref = spidx->prefs;
2048 		spidx->prefs = spidx->prefd;
2049 		spidx->prefd = pref;
2050 
2051 		if (pk_sendspdupdate2(iph2) < 0) {
2052 			plog(LLV_ERROR, LOCATION, NULL,
2053 				"pfkey spdupdate2(outbound) failed.\n");
2054 			goto end;
2055 		}
2056 		plog(LLV_DEBUG, LOCATION, NULL,
2057 			"pfkey spdupdate2(outbound) sent.\n");
2058 
2059 		/* spidx_gen is unnecessary any more */
2060 		delsp_bothdir((struct policyindex *)iph2->spidx_gen);
2061 		racoon_free(iph2->spidx_gen);
2062 		iph2->spidx_gen = NULL;
2063 		iph2->generated_spidx=1;
2064 	}
2065 
2066 	error = 0;
2067 
2068 end:
2069 	return error;
2070 }
2071 
2072 /*
2073  * create HASH, body (SA, NONCE) payload with isakmp header.
2074  */
2075 static vchar_t *
quick_ir1mx(iph2,body,hash)2076 quick_ir1mx(iph2, body, hash)
2077 	struct ph2handle *iph2;
2078 	vchar_t *body, *hash;
2079 {
2080 	struct isakmp *isakmp;
2081 	vchar_t *buf = NULL, *new = NULL;
2082 	char *p;
2083 	int tlen;
2084 	struct isakmp_gen *gen;
2085 	int error = ISAKMP_INTERNAL_ERROR;
2086 
2087 	/* create buffer for isakmp payload */
2088 	tlen = sizeof(*isakmp)
2089 		+ sizeof(*gen) + hash->l
2090 		+ body->l;
2091 	buf = vmalloc(tlen);
2092 	if (buf == NULL) {
2093 		plog(LLV_ERROR, LOCATION, NULL,
2094 			"failed to get buffer to send.\n");
2095 		goto end;
2096 	}
2097 
2098 	/* re-set encryption flag, for serurity. */
2099 	iph2->flags |= ISAKMP_FLAG_E;
2100 
2101 	/* set isakmp header */
2102 	p = set_isakmp_header2(buf, iph2, ISAKMP_NPTYPE_HASH);
2103 	if (p == NULL)
2104 		goto end;
2105 
2106 	/* add HASH payload */
2107 	/* XXX is next type always SA ? */
2108 	p = set_isakmp_payload(p, hash, ISAKMP_NPTYPE_SA);
2109 
2110 	/* add body payload */
2111 	memcpy(p, body->v, body->l);
2112 
2113 #ifdef HAVE_PRINT_ISAKMP_C
2114 	isakmp_printpacket(buf, iph2->ph1->local, iph2->ph1->remote, 1);
2115 #endif
2116 
2117 	/* encoding */
2118 	new = oakley_do_encrypt(iph2->ph1, buf, iph2->ivm->ive, iph2->ivm->iv);
2119 
2120 	if (new == NULL)
2121 		goto end;
2122 
2123 	vfree(buf);
2124 
2125 	buf = new;
2126 
2127 	error = 0;
2128 
2129 end:
2130 	if (error && buf != NULL) {
2131 		vfree(buf);
2132 		buf = NULL;
2133 	}
2134 
2135 	return buf;
2136 }
2137 
2138 /*
2139  * get remote's sainfo.
2140  * NOTE: this function is for responder.
2141  */
2142 static int
get_sainfo_r(iph2)2143 get_sainfo_r(iph2)
2144 	struct ph2handle *iph2;
2145 {
2146 	vchar_t *idsrc = NULL, *iddst = NULL, *client = NULL;
2147 	int error = ISAKMP_INTERNAL_ERROR;
2148 
2149 	if (iph2->id == NULL) {
2150 		idsrc = ipsecdoi_sockaddr2id(iph2->src, IPSECDOI_PREFIX_HOST,
2151 					IPSEC_ULPROTO_ANY);
2152 	} else {
2153 		idsrc = vdup(iph2->id);
2154 	}
2155 	if (idsrc == NULL) {
2156 		plog(LLV_ERROR, LOCATION, NULL,
2157 			"failed to set ID for source.\n");
2158 		goto end;
2159 	}
2160 
2161 	if (iph2->id_p == NULL) {
2162 		iddst = ipsecdoi_sockaddr2id(iph2->dst, IPSECDOI_PREFIX_HOST,
2163 					IPSEC_ULPROTO_ANY);
2164 	} else {
2165 		iddst = vdup(iph2->id_p);
2166 	}
2167 	if (iddst == NULL) {
2168 		plog(LLV_ERROR, LOCATION, NULL,
2169 			"failed to set ID for destination.\n");
2170 		goto end;
2171 	}
2172 
2173 #ifdef ENABLE_HYBRID
2174 
2175 	/* clientaddr check : obtain modecfg address */
2176 	if (iph2->ph1->mode_cfg != NULL) {
2177 		if ((iph2->ph1->mode_cfg->flags & ISAKMP_CFG_ADDR4_EXTERN) ||
2178 		    (iph2->ph1->mode_cfg->flags & ISAKMP_CFG_ADDR4_LOCAL)){
2179 			struct sockaddr saddr;
2180 			saddr.sa_family = AF_INET;
2181 #ifndef __linux__
2182 			saddr.sa_len = sizeof(struct sockaddr_in);
2183 #endif
2184 			((struct sockaddr_in *)&saddr)->sin_port = IPSEC_PORT_ANY;
2185 			memcpy(&((struct sockaddr_in *)&saddr)->sin_addr,
2186 				&iph2->ph1->mode_cfg->addr4, sizeof(struct in_addr));
2187 			client = ipsecdoi_sockaddr2id(&saddr, 32, IPSEC_ULPROTO_ANY);
2188 		}
2189 	}
2190 
2191 	/* clientaddr check, fallback to peer address */
2192 	if (client == NULL)
2193 	{
2194 		client = ipsecdoi_sockaddr2id(iph2->dst, IPSECDOI_PREFIX_HOST,
2195 					IPSEC_ULPROTO_ANY);
2196 	}
2197 #endif
2198 
2199 	/* obtain a matching sainfo section */
2200 	iph2->sainfo = getsainfo(idsrc, iddst, iph2->ph1->id_p, client, iph2->ph1->rmconf->ph1id);
2201 	if (iph2->sainfo == NULL) {
2202 		plog(LLV_ERROR, LOCATION, NULL,
2203 			"failed to get sainfo.\n");
2204 		goto end;
2205 	}
2206 
2207 #ifdef ENABLE_HYBRID
2208 	/* xauth group inclusion check */
2209 	if (iph2->sainfo->group != NULL)
2210 		if(group_check(iph2->ph1,&iph2->sainfo->group->v,1))
2211 			goto end;
2212 #endif
2213 
2214 	plog(LLV_DEBUG, LOCATION, NULL,
2215 		"selected sainfo: %s\n", sainfo2str(iph2->sainfo));
2216 
2217 	error = 0;
2218 end:
2219 	if (idsrc)
2220 		vfree(idsrc);
2221 	if (iddst)
2222 		vfree(iddst);
2223 	if (client)
2224 		vfree(client);
2225 
2226 	return error;
2227 }
2228 
2229 /*
2230  * Copy both IP addresses in ID payloads into [src,dst]_id if both ID types
2231  * are IP address and same address family.
2232  * Then get remote's policy from SPD copied from kernel.
2233  * If the type of ID payload is address or subnet type, then the index is
2234  * made from the payload.  If there is no ID payload, or the type of ID
2235  * payload is NOT address type, then the index is made from the address
2236  * pair of phase 1.
2237  * NOTE: This function is only for responder.
2238  */
2239 static int
get_proposal_r(iph2)2240 get_proposal_r(iph2)
2241 	struct ph2handle *iph2;
2242 {
2243 	struct policyindex spidx;
2244 	struct secpolicy *sp_in, *sp_out;
2245 	int idi2type = 0;	/* switch whether copy IDs into id[src,dst]. */
2246 	int error = ISAKMP_INTERNAL_ERROR;
2247 
2248 	/* check the existence of ID payload */
2249 	if ((iph2->id_p != NULL && iph2->id == NULL)
2250 	 || (iph2->id_p == NULL && iph2->id != NULL)) {
2251 		plog(LLV_ERROR, LOCATION, NULL,
2252 			"Both IDs wasn't found in payload.\n");
2253 		return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
2254 	}
2255 
2256 	/* make sure if sa_[src, dst] are null. */
2257 	if (iph2->sa_src || iph2->sa_dst) {
2258 		plog(LLV_ERROR, LOCATION, NULL,
2259 			"Why do ID[src,dst] exist already.\n");
2260 		return ISAKMP_INTERNAL_ERROR;
2261 	}
2262 
2263 	memset(&spidx, 0, sizeof(spidx));
2264 
2265 #define _XIDT(d) ((struct ipsecdoi_id_b *)(d)->v)->type
2266 
2267 	/* make a spidx; a key to search SPD */
2268 	spidx.dir = IPSEC_DIR_INBOUND;
2269 	spidx.ul_proto = 0;
2270 
2271 	/*
2272 	 * make destination address in spidx from either ID payload
2273 	 * or phase 1 address into a address in spidx.
2274 	 */
2275 	if (iph2->id != NULL
2276 	 && (_XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR
2277 	  || _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR
2278 	  || _XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR_SUBNET
2279 	  || _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR_SUBNET)) {
2280 		/* get a destination address of a policy */
2281 		error = ipsecdoi_id2sockaddr(iph2->id,
2282 				(struct sockaddr *)&spidx.dst,
2283 				&spidx.prefd, &spidx.ul_proto);
2284 		if (error)
2285 			return error;
2286 
2287 #ifdef INET6
2288 		/*
2289 		 * get scopeid from the SA address.
2290 		 * note that the phase 1 source address is used as
2291 		 * a destination address to search for a inbound policy entry
2292 		 * because rcoon is responder.
2293 		 */
2294 		if (_XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR) {
2295 			error = setscopeid((struct sockaddr *)&spidx.dst,
2296 			                    iph2->src);
2297 			if (error)
2298 				return error;
2299 		}
2300 #endif
2301 
2302 		if (_XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR
2303 		 || _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR)
2304 			idi2type = _XIDT(iph2->id);
2305 
2306 	} else {
2307 
2308 		plog(LLV_DEBUG, LOCATION, NULL,
2309 			"get a destination address of SP index "
2310 			"from phase1 address "
2311 			"due to no ID payloads found "
2312 			"OR because ID type is not address.\n");
2313 
2314 		/*
2315 		 * copy the SOURCE address of IKE into the DESTINATION address
2316 		 * of the key to search the SPD because the direction of policy
2317 		 * is inbound.
2318 		 */
2319 		memcpy(&spidx.dst, iph2->src, sysdep_sa_len(iph2->src));
2320 		switch (spidx.dst.ss_family) {
2321 		case AF_INET:
2322 			spidx.prefd = sizeof(struct in_addr) << 3;
2323 			break;
2324 #ifdef INET6
2325 		case AF_INET6:
2326 			spidx.prefd = sizeof(struct in6_addr) << 3;
2327 			break;
2328 #endif
2329 		default:
2330 			spidx.prefd = 0;
2331 			break;
2332 		}
2333 	}
2334 
2335 	/* make source address in spidx */
2336 	if (iph2->id_p != NULL
2337 	 && (_XIDT(iph2->id_p) == IPSECDOI_ID_IPV4_ADDR
2338 	  || _XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR
2339 	  || _XIDT(iph2->id_p) == IPSECDOI_ID_IPV4_ADDR_SUBNET
2340 	  || _XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR_SUBNET)) {
2341 		/* get a source address of inbound SA */
2342 		error = ipsecdoi_id2sockaddr(iph2->id_p,
2343 				(struct sockaddr *)&spidx.src,
2344 				&spidx.prefs, &spidx.ul_proto);
2345 		if (error)
2346 			return error;
2347 
2348 #ifdef INET6
2349 		/*
2350 		 * get scopeid from the SA address.
2351 		 * for more detail, see above of this function.
2352 		 */
2353 		if (_XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR) {
2354 			error = setscopeid((struct sockaddr *)&spidx.src,
2355 			                    iph2->dst);
2356 			if (error)
2357 				return error;
2358 		}
2359 #endif
2360 
2361 		/* Before setting iph2->[sa_src, sa_dst] with the addresses
2362 		 * provided in ID payloads, we check:
2363 		 * - they are both addresses of same family
2364 		 * - sainfo has not been selected only based on ID payload
2365 		 *   information but also based on specific Phase 1
2366 		 *   credentials (iph2->sainfo->id_i is defined), i.e.
2367 		 *   local configuration _explicitly_ expect that user
2368 		 *   (e.g. from asn1dn "C=FR, ...") with those IDs) */
2369 		if (_XIDT(iph2->id_p) == idi2type &&
2370 		    spidx.dst.ss_family == spidx.src.ss_family &&
2371 		    iph2->sainfo && iph2->sainfo->id_i) {
2372 
2373 			iph2->sa_src = dupsaddr((struct sockaddr *)&spidx.dst);
2374 			if (iph2->sa_src  == NULL) {
2375 				plog(LLV_ERROR, LOCATION, NULL,
2376 				    "buffer allocation failed.\n");
2377 				return ISAKMP_INTERNAL_ERROR;
2378 			}
2379 
2380 			iph2->sa_dst = dupsaddr((struct sockaddr *)&spidx.src);
2381 			if (iph2->sa_dst  == NULL) {
2382 				plog(LLV_ERROR, LOCATION, NULL,
2383 				    "buffer allocation failed.\n");
2384 				return ISAKMP_INTERNAL_ERROR;
2385 			}
2386 		} else {
2387 			plog(LLV_DEBUG, LOCATION, NULL,
2388 			     "Either family (%d - %d), types (%d - %d) of ID "
2389 			     "from initiator differ or matching sainfo "
2390 			     "has no id_i defined for the peer. Not filling "
2391 			     "iph2->sa_src and iph2->sa_dst.\n",
2392 			     spidx.src.ss_family, spidx.dst.ss_family,
2393 			     _XIDT(iph2->id_p),idi2type);
2394 		}
2395 	} else {
2396 		plog(LLV_DEBUG, LOCATION, NULL,
2397 		     "get a source address of SP index from Phase 1"
2398 		     "addresses due to no ID payloads found"
2399 		     "OR because ID type is not address.\n");
2400 
2401 		/* see above comment. */
2402 		memcpy(&spidx.src, iph2->dst, sysdep_sa_len(iph2->dst));
2403 		switch (spidx.src.ss_family) {
2404 		case AF_INET:
2405 			spidx.prefs = sizeof(struct in_addr) << 3;
2406 			break;
2407 #ifdef INET6
2408 		case AF_INET6:
2409 			spidx.prefs = sizeof(struct in6_addr) << 3;
2410 			break;
2411 #endif
2412 		default:
2413 			spidx.prefs = 0;
2414 			break;
2415 		}
2416 	}
2417 
2418 #undef _XIDT
2419 
2420 	plog(LLV_DEBUG, LOCATION, NULL,
2421 		"get src address from ID payload "
2422 		"%s prefixlen=%u ul_proto=%u\n",
2423 		saddr2str((struct sockaddr *)&spidx.src),
2424 		spidx.prefs, spidx.ul_proto);
2425 	plog(LLV_DEBUG, LOCATION, NULL,
2426 		"get dst address from ID payload "
2427 		"%s prefixlen=%u ul_proto=%u\n",
2428 		saddr2str((struct sockaddr *)&spidx.dst),
2429 		spidx.prefd, spidx.ul_proto);
2430 
2431 	/*
2432 	 * convert the ul_proto if it is 0
2433 	 * because 0 in ID payload means a wild card.
2434 	 */
2435 	if (spidx.ul_proto == 0)
2436 		spidx.ul_proto = IPSEC_ULPROTO_ANY;
2437 
2438 #ifdef HAVE_SECCTX
2439 	/*
2440 	 * Need to use security context in spidx to ensure the correct
2441 	 * policy is selected. The only way to get the security context
2442 	 * is to look into the proposal sent by peer ahead of time.
2443 	 */
2444 	if (get_security_context(iph2->sa, &spidx)) {
2445 		plog(LLV_ERROR, LOCATION, NULL,
2446 		     "error occurred trying to get security context.\n");
2447 		return ISAKMP_INTERNAL_ERROR;
2448 	}
2449 #endif /* HAVE_SECCTX */
2450 
2451 	/* get inbound policy */
2452 	sp_in = getsp_r(&spidx);
2453 	if (sp_in == NULL) {
2454 		if (iph2->ph1->rmconf->gen_policy) {
2455 			plog(LLV_INFO, LOCATION, NULL,
2456 				"no policy found, "
2457 				"try to generate the policy : %s\n",
2458 				spidx2str(&spidx));
2459 			iph2->spidx_gen = racoon_malloc(sizeof(spidx));
2460 			if (!iph2->spidx_gen) {
2461 				plog(LLV_ERROR, LOCATION, NULL,
2462 					"buffer allocation failed.\n");
2463 				return ISAKMP_INTERNAL_ERROR;
2464 			}
2465 			memcpy(iph2->spidx_gen, &spidx, sizeof(spidx));
2466 			return -2;	/* special value */
2467 		}
2468 		plog(LLV_ERROR, LOCATION, NULL,
2469 			"no policy found: %s\n", spidx2str(&spidx));
2470 		return ISAKMP_INTERNAL_ERROR;
2471 	}
2472 	/* Refresh existing generated policies
2473 	 */
2474 	if (iph2->ph1->rmconf->gen_policy) {
2475 		plog(LLV_INFO, LOCATION, NULL,
2476 			 "Update the generated policy : %s\n",
2477 			 spidx2str(&spidx));
2478 		iph2->spidx_gen = racoon_malloc(sizeof(spidx));
2479 		if (!iph2->spidx_gen) {
2480 			plog(LLV_ERROR, LOCATION, NULL,
2481 				 "buffer allocation failed.\n");
2482 			return ISAKMP_INTERNAL_ERROR;
2483 		}
2484 		memcpy(iph2->spidx_gen, &spidx, sizeof(spidx));
2485 	}
2486 
2487 	/* get outbound policy */
2488     {
2489 	struct sockaddr_storage addr;
2490 	u_int8_t pref;
2491 
2492 	spidx.dir = IPSEC_DIR_OUTBOUND;
2493 	addr = spidx.src;
2494 	spidx.src = spidx.dst;
2495 	spidx.dst = addr;
2496 	pref = spidx.prefs;
2497 	spidx.prefs = spidx.prefd;
2498 	spidx.prefd = pref;
2499 
2500 	sp_out = getsp_r(&spidx);
2501 	if (!sp_out) {
2502 		plog(LLV_WARNING, LOCATION, NULL,
2503 			"no outbound policy found: %s\n",
2504 			spidx2str(&spidx));
2505 	}
2506     }
2507 
2508 	plog(LLV_DEBUG, LOCATION, NULL,
2509 		"suitable SP found:%s\n", spidx2str(&spidx));
2510 
2511 	/*
2512 	 * In the responder side, the inbound policy should be using IPsec.
2513 	 * outbound policy is not checked currently.
2514 	 */
2515 	if (sp_in->policy != IPSEC_POLICY_IPSEC) {
2516 		plog(LLV_ERROR, LOCATION, NULL,
2517 			"policy found, but no IPsec required: %s\n",
2518 			spidx2str(&spidx));
2519 		return ISAKMP_INTERNAL_ERROR;
2520 	}
2521 
2522 	/* set new proposal derived from a policy into the iph2->proposal. */
2523 	if (set_proposal_from_policy(iph2, sp_in, sp_out) < 0) {
2524 		plog(LLV_ERROR, LOCATION, NULL,
2525 			"failed to create saprop.\n");
2526 		return ISAKMP_INTERNAL_ERROR;
2527 	}
2528 
2529 #ifdef HAVE_SECCTX
2530 	if (spidx.sec_ctx.ctx_str) {
2531 		set_secctx_in_proposal(iph2, spidx);
2532 	}
2533 #endif /* HAVE_SECCTX */
2534 
2535 	iph2->spid = sp_in->id;
2536 
2537 	return 0;
2538 }
2539 
2540 /*
2541  * handle a notification payload inside phase2 exchange.
2542  * phase2 is always encrypted, so it does not need to be checked
2543  * for explicitely.
2544  */
2545 static int
ph2_recv_n(iph2,gen)2546 ph2_recv_n(iph2, gen)
2547 	struct ph2handle *iph2;
2548 	struct isakmp_gen *gen;
2549 {
2550 	struct ph1handle *iph1 = iph2->ph1;
2551 	struct isakmp_pl_n *notify = (struct isakmp_pl_n *) gen;
2552 	u_int type;
2553 	int check_level;
2554 
2555 	type = ntohs(notify->type);
2556 	switch (type) {
2557 	case ISAKMP_NTYPE_CONNECTED:
2558 		break;
2559 	case ISAKMP_NTYPE_INITIAL_CONTACT:
2560 		return isakmp_info_recv_initialcontact(iph1, iph2);
2561 	case ISAKMP_NTYPE_RESPONDER_LIFETIME:
2562 		ipsecdoi_parse_responder_lifetime(notify,
2563 			&iph2->lifetime_secs, &iph2->lifetime_kb);
2564 
2565 		if (iph1 != NULL && iph1->rmconf != NULL) {
2566 			check_level = iph1->rmconf->pcheck_level;
2567 		} else {
2568 			if (iph1 != NULL)
2569 				plog(LLV_DEBUG, LOCATION, NULL,
2570 					"No phase1 rmconf found !\n");
2571 			else
2572 				plog(LLV_DEBUG, LOCATION, NULL,
2573 					"No phase1 found !\n");
2574 			check_level = PROP_CHECK_EXACT;
2575 		}
2576 
2577 		switch (check_level) {
2578 		case PROP_CHECK_OBEY:
2579 			break;
2580 		case PROP_CHECK_STRICT:
2581 		case PROP_CHECK_CLAIM:
2582 			if (iph2->sainfo == NULL
2583 			 || iph2->sainfo->lifetime <= iph2->lifetime_secs) {
2584 				plog(LLV_WARNING, LOCATION, NULL,
2585 					"RESPONDER-LIFETIME: lifetime mismatch\n");
2586 				iph2->lifetime_secs = 0;
2587 			}
2588 			break;
2589 		case PROP_CHECK_EXACT:
2590 			if (iph2->sainfo == NULL
2591 			 || iph2->sainfo->lifetime != iph2->lifetime_secs) {
2592 				plog(LLV_WARNING, LOCATION, NULL,
2593 					"RESPONDER-LIFETIME: lifetime mismatch\n");
2594 				iph2->lifetime_secs = 0;
2595 			}
2596 			break;
2597 		}
2598 		break;
2599 	default:
2600 		isakmp_log_notify(iph2->ph1, notify, "phase2 exchange");
2601 		isakmp_info_send_n2(iph2, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE,
2602 			NULL);
2603 		break;
2604 	}
2605 	return 0;
2606 }
2607 
2608