userapps/opensource/ipsec-tools/src/racoon/isakmp_agg.c

   1 /* $Id: isakmp_agg.c,v 1.19.2.3 2005/01/26 19:39:26 vanhu Exp $ */
   2
   3 /*
   4  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. Neither the name of the project nor the names of its contributors
  16  *    may be used to endorse or promote products derived from this software
  17  *    without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGE.
  30  */
  31
  32 /* Aggressive Exchange (Aggressive Mode) */
  33
  34 #include "config.h"
  35
  36 #include <sys/types.h>
  37 #include <sys/param.h>
  38
  39 #include <stdlib.h>
  40 #include <stdio.h>
  41 #include <string.h>
  42 #include <errno.h>
  43 #if TIME_WITH_SYS_TIME
  44 # include <sys/time.h>
  45 # include <time.h>
  46 #else
  47 # if HAVE_SYS_TIME_H
  48 #  include <sys/time.h>
  49 # else
  50 #  include <time.h>
  51 # endif
  52 #endif
  53
  54 #include "var.h"
  55 #include "misc.h"
  56 #include "vmbuf.h"
  57 #include "plog.h"
  58 #include "sockmisc.h"
  59 #include "schedule.h"
  60 #include "debug.h"
  61
  62 #include "localconf.h"
  63 #include "remoteconf.h"
  64 #include "isakmp_var.h"
  65 #include "isakmp.h"
  66 #include "evt.h"
  67 #include "oakley.h"
  68 #include "handler.h"
  69 #include "ipsec_doi.h"
  70 #include "crypto_openssl.h"
  71 #include "pfkey.h"
  72 #include "isakmp_agg.h"
  73 #include "isakmp_inf.h"
  74 #ifdef ENABLE_HYBRID
  75 #include "isakmp_xauth.h"
  76 #include "isakmp_cfg.h"
  77 #endif
  78 #ifdef ENABLE_FRAG
  79 #include "isakmp_frag.h"
  80 #endif
  81 #include "vendorid.h"
  82 #include "strnames.h"
  83
  84 #ifdef ENABLE_NATT
  85 #include "nattraversal.h"
  86 #endif
  87
  88 #ifdef HAVE_GSSAPI
  89 #include "gssapi.h"
  90 #endif
  91
  92 /*
  93  * begin Aggressive Mode as initiator.
  94  */
  95 /*
  96  * send to responder
  97  *      psk: HDR, SA, KE, Ni, IDi1
  98  *      sig: HDR, SA, KE, Ni, IDi1 [, CR ]
  99  *   gssapi: HDR, SA, KE, Ni, IDi1, GSSi
 100  *      rsa: HDR, SA, [ HASH(1),] KE, <IDi1_b>Pubkey_r, <Ni_b>Pubkey_r
 101  *      rev: HDR, SA, [ HASH(1),] <Ni_b>Pubkey_r, <KE_b>Ke_i,
 102  *           <IDii_b>Ke_i [, <Cert-I_b>Ke_i ]
 103  */
 104 int
 105 agg_i1send(iph1, msg)
 106         struct ph1handle *iph1;
 107         vchar_t *msg; /* must be null */
 108 {
 109         struct payload_list *plist = NULL;
 110         int need_cr = 0;
 111         vchar_t *cr = NULL, *gsstoken = NULL;
 112         int error = -1;
 113 #ifdef ENABLE_NATT
 114         vchar_t *vid_natt[MAX_NATT_VID_COUNT];
 115         int i;
 116 #endif
 117 #ifdef ENABLE_HYBRID
 118         vchar_t *vid_xauth = NULL;
 119         vchar_t *vid_unity = NULL;
 120 #endif
 121 #ifdef ENABLE_FRAG
 122         vchar_t *vid_frag = NULL;
 123 #endif
 124 #ifdef HAVE_GSSAPI
 125         int len;
 126 #endif
 127 #ifdef ENABLE_DPD
 128         vchar_t *vid_dpd = NULL;
 129 #endif
 130
 131
 132         /* validity check */
 133         if (msg != NULL) {
 134                 plog(LLV_ERROR, LOCATION, NULL,
 135                         "msg has to be NULL in this function.\n");
 136                 goto end;
 137         }
 138         if (iph1->status != PHASE1ST_START) {
 139                 plog(LLV_ERROR, LOCATION, NULL,
 140                         "status mismatched %d.\n", iph1->status);
 141                 goto end;
 142         }
 143
 144         /* create isakmp index */
 145         memset(&iph1->index, 0, sizeof(iph1->index));
 146         isakmp_newcookie((caddr_t)&iph1->index, iph1->remote, iph1->local);
 147
 148         /* make ID payload into isakmp status */
 149         if (ipsecdoi_setid1(iph1) < 0)
 150                 goto end;
 151
 152         /* create SA payload for my proposal */
 153         iph1->sa = ipsecdoi_setph1proposal(iph1->rmconf->proposal);
 154         if (iph1->sa == NULL)
 155                 goto end;
 156
 157         /* consistency check of proposals */
 158         if (iph1->rmconf->dhgrp == NULL) {
 159                 plog(LLV_ERROR, LOCATION, NULL,
 160                         "configuration failure about DH group.\n");
 161                 goto end;
 162         }
 163
 164         /* generate DH public value */
 165         if (oakley_dh_generate(iph1->rmconf->dhgrp,
 166                                 &iph1->dhpub, &iph1->dhpriv) < 0)
 167                 goto end;
 168
 169         /* generate NONCE value */
 170         iph1->nonce = eay_set_random(iph1->rmconf->nonce_size);
 171         if (iph1->nonce == NULL)
 172                 goto end;
 173
 174 #ifdef ENABLE_HYBRID
 175         /* Do we need Xauth VID? */
 176         switch (iph1->rmconf->proposal->authmethod) {
 177         case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
 178         case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
 179                 if ((vid_xauth = set_vendorid(VENDORID_XAUTH)) == NULL)
 180                         plog(LLV_ERROR, LOCATION, NULL,
 181                              "Xauth vendor ID generation failed\n");
 182                 if ((vid_unity = set_vendorid(VENDORID_UNITY)) == NULL)
 183                         plog(LLV_ERROR, LOCATION, NULL,
 184                              "Unity vendor ID generation failed\n");
 185                 break;
 186         default:
 187                 break;
 188         }
 189 #endif
 190
 191 #ifdef ENABLE_FRAG
 192         if (iph1->rmconf->ike_frag) {
 193                 vid_frag = set_vendorid(VENDORID_FRAG);
 194                 if (vid_frag != NULL)
 195                         vid_frag = isakmp_frag_addcap(vid_frag,
 196                             VENDORID_FRAG_AGG);
 197                 if (vid_frag == NULL)
 198                         plog(LLV_ERROR, LOCATION, NULL,
 199                             "Frag vendorID construction failed\n");
 200         }
 201 #endif
 202
 203         /* create CR if need */
 204         if (iph1->rmconf->send_cr
 205          && oakley_needcr(iph1->rmconf->proposal->authmethod)
 206          && iph1->rmconf->peerscertfile == NULL) {
 207                 need_cr = 1;
 208                 cr = oakley_getcr(iph1);
 209                 if (cr == NULL) {
 210                         plog(LLV_ERROR, LOCATION, NULL,
 211                                 "failed to get cr buffer.\n");
 212                         goto end;
 213                 }
 214         }
 215
 216         plog(LLV_DEBUG, LOCATION, NULL, "authmethod is %s\n",
 217                 s_oakley_attr_method(iph1->rmconf->proposal->authmethod));
 218 #ifdef HAVE_GSSAPI
 219         if (iph1->rmconf->proposal->authmethod ==
 220             OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB) {
 221                 gssapi_get_itoken(iph1, &len);
 222         }
 223 #endif
 224
 225         /* set SA payload to propose */
 226         plist = isakmp_plist_append(plist, iph1->sa, ISAKMP_NPTYPE_SA);
 227
 228         /* create isakmp KE payload */
 229         plist = isakmp_plist_append(plist, iph1->dhpub, ISAKMP_NPTYPE_KE);
 230
 231         /* create isakmp NONCE payload */
 232         plist = isakmp_plist_append(plist, iph1->nonce, ISAKMP_NPTYPE_NONCE);
 233
 234         /* create isakmp ID payload */
 235         plist = isakmp_plist_append(plist, iph1->id, ISAKMP_NPTYPE_ID);
 236
 237 #ifdef HAVE_GSSAPI
 238         if (iph1->rmconf->proposal->authmethod ==
 239             OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB) {
 240                 gssapi_get_token_to_send(iph1, &gsstoken);
 241                 plist = isakmp_plist_append(plist, gsstoken, ISAKMP_NPTYPE_GSS);
 242         } else
 243 #endif
 244         /* create isakmp CR payload */
 245         if (need_cr)
 246                 plist = isakmp_plist_append(plist, cr, ISAKMP_NPTYPE_CR);
 247
 248 #ifdef ENABLE_FRAG
 249         if (vid_frag)
 250                 plist = isakmp_plist_append(plist, vid_frag, ISAKMP_NPTYPE_VID);
 251 #endif
 252 #ifdef ENABLE_NATT
 253         /* set VID payload for NAT-T if NAT-T support allowed in the config file */
 254         if (iph1->rmconf->nat_traversal)
 255                 plist = isakmp_plist_append_natt_vids(plist, vid_natt);
 256         else
 257                 vid_natt[0]=NULL;
 258 #endif
 259 #ifdef ENABLE_HYBRID
 260         if (vid_xauth)
 261                 plist = isakmp_plist_append(plist,
 262                     vid_xauth, ISAKMP_NPTYPE_VID);
 263         if (vid_unity)
 264                 plist = isakmp_plist_append(plist,
 265                     vid_unity, ISAKMP_NPTYPE_VID);
 266 #endif
 267 #ifdef ENABLE_DPD
 268         if(iph1->rmconf->dpd){
 269                 vid_dpd = set_vendorid(VENDORID_DPD);
 270                 if (vid_dpd != NULL)
 271                         plist = isakmp_plist_append(plist, vid_dpd, ISAKMP_NPTYPE_VID);
 272         }
 273 #endif
 274
 275         iph1->sendbuf = isakmp_plist_set_all (&plist, iph1);
 276
 277 #ifdef HAVE_PRINT_ISAKMP_C
 278         isakmp_printpacket(iph1->sendbuf, iph1->local, iph1->remote, 0);
 279 #endif
 280
 281         /* send the packet, add to the schedule to resend */
 282         iph1->retry_counter = iph1->rmconf->retry_counter;
 283         if (isakmp_ph1resend(iph1) == -1)
 284                 goto end;
 285
 286         iph1->status = PHASE1ST_MSG1SENT;
 287
 288         error = 0;
 289
 290 end:
 291         if (cr)
 292                 vfree(cr);
 293         if (gsstoken)
 294                 vfree(gsstoken);
 295 #ifdef ENABLE_FRAG
 296         if (vid_frag)
 297                 vfree(vid_frag);
 298 #endif
 299 #ifdef ENABLE_NATT
 300         for (i = 0; i < MAX_NATT_VID_COUNT && vid_natt[i] != NULL; i++)
 301                 vfree(vid_natt[i]);
 302 #endif
 303 #ifdef ENABLE_DPD
 304         if (vid_dpd != NULL)
 305                 vfree(vid_dpd);
 306 #endif
 307
 308         return error;
 309 }
 310
 311 /*
 312  * receive from responder
 313  *      psk: HDR, SA, KE, Nr, IDr1, HASH_R
 314  *      sig: HDR, SA, KE, Nr, IDr1, [ CR, ] [ CERT, ] SIG_R
 315  *   gssapi: HDR, SA, KE, Nr, IDr1, GSSr, HASH_R
 316  *      rsa: HDR, SA, KE, <IDr1_b>PubKey_i, <Nr_b>PubKey_i, HASH_R
 317  *      rev: HDR, SA, <Nr_b>PubKey_i, <KE_b>Ke_r, <IDir_b>Ke_r, HASH_R
 318  */
 319 int
 320 agg_i2recv(iph1, msg)
 321         struct ph1handle *iph1;
 322         vchar_t *msg;
 323 {
 324         vchar_t *pbuf = NULL;
 325         struct isakmp_parse_t *pa;
 326         vchar_t *satmp = NULL;
 327         int error = -1;
 328         int vid_numeric;
 329         int ptype;
 330 #ifdef ENABLE_HYBRID
 331         vchar_t *unity_vid;
 332         vchar_t *xauth_vid;
 333 #endif
 334 #ifdef HAVE_GSSAPI
 335         vchar_t *gsstoken = NULL;
 336 #endif
 337
 338 #ifdef ENABLE_NATT
 339         int natd_seq = 0;
 340         struct natd_payload {
 341                 int seq;
 342                 vchar_t *payload;
 343                 TAILQ_ENTRY(natd_payload) chain;
 344         };
 345         TAILQ_HEAD(_natd_payload, natd_payload) natd_tree;
 346         TAILQ_INIT(&natd_tree);
 347 #endif
 348
 349         /* validity check */
 350         if (iph1->status != PHASE1ST_MSG1SENT) {
 351                 plog(LLV_ERROR, LOCATION, NULL,
 352                         "status mismatched %d.\n", iph1->status);
 353                 goto end;
 354         }
 355
 356         /* validate the type of next payload */
 357         pbuf = isakmp_parse(msg);
 358         if (pbuf == NULL)
 359                 goto end;
 360         pa = (struct isakmp_parse_t *)pbuf->v;
 361
 362         iph1->pl_hash = NULL;
 363
 364         /* SA payload is fixed postion */
 365         if (pa->type != ISAKMP_NPTYPE_SA) {
 366                 plog(LLV_ERROR, LOCATION, iph1->remote,
 367                         "received invalid next payload type %d, "
 368                         "expecting %d.\n",
 369                         pa->type, ISAKMP_NPTYPE_SA);
 370                 goto end;
 371         }
 372
 373         if (isakmp_p2ph(&satmp, pa->ptr) < 0)
 374                 goto end;
 375         pa++;
 376
 377         for (/*nothing*/;
 378              pa->type != ISAKMP_NPTYPE_NONE;
 379              pa++) {
 380
 381                 switch (pa->type) {
 382                 case ISAKMP_NPTYPE_KE:
 383                         if (isakmp_p2ph(&iph1->dhpub_p, pa->ptr) < 0)
 384                                 goto end;
 385                         break;
 386                 case ISAKMP_NPTYPE_NONCE:
 387                         if (isakmp_p2ph(&iph1->nonce_p, pa->ptr) < 0)
 388                                 goto end;
 389                         break;
 390                 case ISAKMP_NPTYPE_ID:
 391                         if (isakmp_p2ph(&iph1->id_p, pa->ptr) < 0)
 392                                 goto end;
 393                         break;
 394                 case ISAKMP_NPTYPE_HASH:
 395                         iph1->pl_hash = (struct isakmp_pl_hash *)pa->ptr;
 396                         break;
 397                 case ISAKMP_NPTYPE_CR:
 398                         if (oakley_savecr(iph1, pa->ptr) < 0)
 399                                 goto end;
 400                         break;
 401                 case ISAKMP_NPTYPE_CERT:
 402                         if (oakley_savecert(iph1, pa->ptr) < 0)
 403                                 goto end;
 404                         break;
 405                 case ISAKMP_NPTYPE_SIG:
 406                         if (isakmp_p2ph(&iph1->sig_p, pa->ptr) < 0)
 407                                 goto end;
 408                         break;
 409                 case ISAKMP_NPTYPE_VID:
 410                         vid_numeric = check_vendorid(pa->ptr);
 411 #ifdef ENABLE_NATT
 412                         if (iph1->rmconf->nat_traversal &&
 413                             natt_vendorid(vid_numeric))
 414                                 natt_handle_vendorid(iph1, vid_numeric);
 415 #endif
 416 #ifdef ENABLE_HYBRID
 417                         switch (vid_numeric) {
 418                         case VENDORID_XAUTH:
 419                                 iph1->mode_cfg->flags |=
 420                                     ISAKMP_CFG_VENDORID_XAUTH;
 421                                 break;
 422
 423                         case VENDORID_UNITY:
 424                                 iph1->mode_cfg->flags |=
 425                                     ISAKMP_CFG_VENDORID_UNITY;
 426                                 break;
 427                         default:
 428                                 break;
 429                         }
 430 #endif
 431 #ifdef ENABLE_DPD
 432                         if (vid_numeric == VENDORID_DPD && iph1->rmconf->dpd) {
 433                                 iph1->dpd_support=1;
 434                                 plog(LLV_DEBUG, LOCATION, NULL,
 435                                          "remote supports DPD\n");
 436                         }
 437 #endif
 438                         break;
 439                 case ISAKMP_NPTYPE_N:
 440                         isakmp_check_notify(pa->ptr, iph1);
 441                         break;
 442 #ifdef HAVE_GSSAPI
 443                 case ISAKMP_NPTYPE_GSS:
 444                         if (isakmp_p2ph(&gsstoken, pa->ptr) < 0)
 445                                 goto end;
 446                         gssapi_save_received_token(iph1, gsstoken);
 447                         break;
 448 #endif
 449
 450 #ifdef ENABLE_NATT
 451                 case ISAKMP_NPTYPE_NATD_DRAFT:
 452                 case ISAKMP_NPTYPE_NATD_RFC:
 453                         if (NATT_AVAILABLE(iph1) && iph1->natt_options &&
 454                             pa->type == iph1->natt_options->payload_nat_d) {
 455                                 struct natd_payload *natd;
 456                                 natd = (struct natd_payload *)racoon_malloc(sizeof(*natd));
 457                                 if (!natd)
 458                                         goto end;
 459
 460                                 natd->payload = NULL;
 461
 462                                 if (isakmp_p2ph (&natd->payload, pa->ptr) < 0)
 463                                         goto end;
 464
 465                                 natd->seq = natd_seq++;
 466
 467                                 TAILQ_INSERT_TAIL(&natd_tree, natd, chain);
 468                                 break;
 469                         }
 470                         /* passthrough to default... */
 471 #endif
 472
 473                 default:
 474                         /* don't send information, see isakmp_ident_r1() */
 475                         plog(LLV_ERROR, LOCATION, iph1->remote,
 476                                 "ignore the packet, "
 477                                 "received unexpecting payload type %d.\n",
 478                                 pa->type);
 479                         goto end;
 480                 }
 481         }
 482
 483         /* payload existency check */
 484         /* XXX to be checked each authentication method. */
 485
 486         /* verify identifier */
 487         if (ipsecdoi_checkid1(iph1) != 0) {
 488                 plog(LLV_ERROR, LOCATION, iph1->remote,
 489                         "invalid ID payload.\n");
 490                 goto end;
 491         }
 492
 493         /* check SA payload and set approval SA for use */
 494         if (ipsecdoi_checkph1proposal(satmp, iph1) < 0) {
 495                 plog(LLV_ERROR, LOCATION, iph1->remote,
 496                         "failed to get valid proposal.\n");
 497                 /* XXX send information */
 498                 goto end;
 499         }
 500         VPTRINIT(iph1->sa_ret);
 501
 502         /* fix isakmp index */
 503         memcpy(&iph1->index.r_ck, &((struct isakmp *)msg->v)->r_ck,
 504                 sizeof(cookie_t));
 505
 506 #ifdef ENABLE_NATT
 507         if (NATT_AVAILABLE(iph1)) {
 508                 struct natd_payload *natd = NULL;
 509                 int natd_verified;
 510
 511                 plog(LLV_INFO, LOCATION, iph1->remote,
 512                      "Selected NAT-T version: %s\n",
 513                      vid_string_by_id(iph1->natt_options->version));
 514
 515                 /* set both bits first so that we can clear them
 516                    upon verifying hashes */
 517                 iph1->natt_flags |= NAT_DETECTED;
 518
 519                 while ((natd = TAILQ_FIRST(&natd_tree)) != NULL) {
 520                         /* this function will clear appropriate bits bits
 521                            from iph1->natt_flags */
 522                         natd_verified = natt_compare_addr_hash (iph1,
 523                                 natd->payload, natd->seq);
 524
 525                         plog (LLV_INFO, LOCATION, NULL, "NAT-D payload #%d %s\n",
 526                                 natd->seq - 1,
 527                                 natd_verified ? "verified" : "doesn't match");
 528
 529                         vfree (natd->payload);
 530
 531                         TAILQ_REMOVE(&natd_tree, natd, chain);
 532                         racoon_free (natd);
 533                 }
 534
 535                 plog (LLV_INFO, LOCATION, NULL, "NAT %s %s%s\n",
 536                       iph1->natt_flags & NAT_DETECTED ?
 537                                 "detected:" : "not detected",
 538                       iph1->natt_flags & NAT_DETECTED_ME ? "ME " : "",
 539                       iph1->natt_flags & NAT_DETECTED_PEER ? "PEER" : "");
 540
 541                 if (iph1->natt_flags & NAT_DETECTED)
 542                         natt_float_ports (iph1);
 543         }
 544 #endif
 545
 546         /* compute sharing secret of DH */
 547         if (oakley_dh_compute(iph1->rmconf->dhgrp, iph1->dhpub,
 548                                 iph1->dhpriv, iph1->dhpub_p, &iph1->dhgxy) < 0)
 549                 goto end;
 550
 551         /* generate SKEYIDs & IV & final cipher key */
 552         if (oakley_skeyid(iph1) < 0)
 553                 goto end;
 554         if (oakley_skeyid_dae(iph1) < 0)
 555                 goto end;
 556         if (oakley_compute_enckey(iph1) < 0)
 557                 goto end;
 558         if (oakley_newiv(iph1) < 0)
 559                 goto end;
 560
 561         /* validate authentication value */
 562         ptype = oakley_validate_auth(iph1);
 563         if (ptype != 0) {
 564                 if (ptype == -1) {
 565                         /* message printed inner oakley_validate_auth() */
 566                         goto end;
 567                 }
 568                 EVT_PUSH(iph1->local, iph1->remote,
 569                     EVTT_PEERPH1AUTH_FAILED, NULL);
 570                 isakmp_info_send_n1(iph1, ptype, NULL);
 571                 goto end;
 572         }
 573
 574         if (oakley_checkcr(iph1) < 0) {
 575                 /* Ignore this error in order to be interoperability. */
 576                 ;
 577         }
 578
 579         /* change status of isakmp status entry */
 580         iph1->status = PHASE1ST_MSG2RECEIVED;
 581
 582         error = 0;
 583
 584 end:
 585         if (pbuf)
 586                 vfree(pbuf);
 587         if (satmp)
 588                 vfree(satmp);
 589         if (error) {
 590                 VPTRINIT(iph1->dhpub_p);
 591                 VPTRINIT(iph1->nonce_p);
 592                 VPTRINIT(iph1->id_p);
 593                 oakley_delcert(iph1->cert_p);
 594                 iph1->cert_p = NULL;
 595                 oakley_delcert(iph1->crl_p);
 596                 iph1->crl_p = NULL;
 597                 VPTRINIT(iph1->sig_p);
 598                 oakley_delcert(iph1->cr_p);
 599                 iph1->cr_p = NULL;
 600         }
 601
 602         return error;
 603 }
 604
 605 /*
 606  * send to responder
 607  *      psk: HDR, HASH_I
 608  *   gssapi: HDR, HASH_I
 609  *      sig: HDR, [ CERT, ] SIG_I
 610  *      rsa: HDR, HASH_I
 611  *      rev: HDR, HASH_I
 612  */
 613 int
 614 agg_i2send(iph1, msg)
 615         struct ph1handle *iph1;
 616         vchar_t *msg;
 617 {
 618         struct payload_list *plist = NULL;
 619         int need_cert = 0;
 620         int error = -1;
 621         vchar_t *gsshash = NULL;
 622
 623         /* validity check */
 624         if (iph1->status != PHASE1ST_MSG2RECEIVED) {
 625                 plog(LLV_ERROR, LOCATION, NULL,
 626                         "status mismatched %d.\n", iph1->status);
 627                 goto end;
 628         }
 629
 630         /* generate HASH to send */
 631         plog(LLV_DEBUG, LOCATION, NULL, "generate HASH_I\n");
 632         iph1->hash = oakley_ph1hash_common(iph1, GENERATE);
 633         if (iph1->hash == NULL) {
 634 #ifdef HAVE_GSSAPI
 635                 if (gssapi_more_tokens(iph1))
 636                         isakmp_info_send_n1(iph1,
 637                             ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE, NULL);
 638 #endif
 639                 goto end;
 640         }
 641
 642         switch (iph1->approval->authmethod) {
 643         case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
 644                 /* set HASH payload */
 645                 plist = isakmp_plist_append(plist, iph1->hash, ISAKMP_NPTYPE_HASH);
 646                 break;
 647         case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
 648         case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
 649 #ifdef ENABLE_HYBRID
 650         case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
 651         case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
 652 #endif
 653                 /* XXX if there is CR or not ? */
 654
 655                 if (oakley_getmycert(iph1) < 0)
 656                         goto end;
 657
 658                 if (oakley_getsign(iph1) < 0)
 659                         goto end;
 660
 661                 if (iph1->cert != NULL && iph1->rmconf->send_cert)
 662                         need_cert = 1;
 663
 664                 /* add CERT payload if there */
 665                 if (need_cert)
 666                         plist = isakmp_plist_append(plist, iph1->cert->pl, ISAKMP_NPTYPE_CERT);
 667
 668                 /* add SIG payload */
 669                 plist = isakmp_plist_append(plist, iph1->sig, ISAKMP_NPTYPE_SIG);
 670                 break;
 671
 672         case OAKLEY_ATTR_AUTH_METHOD_RSAENC:
 673         case OAKLEY_ATTR_AUTH_METHOD_RSAREV:
 674                 break;
 675 #ifdef HAVE_GSSAPI
 676         case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB:
 677                 gsshash = gssapi_wraphash(iph1);
 678                 if (gsshash == NULL) {
 679                         plog(LLV_ERROR, LOCATION, NULL,
 680                                 "failed to wrap hash\n");
 681                         isakmp_info_send_n1(iph1,
 682                                 ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE, NULL);
 683                         goto end;
 684                 }
 685
 686                 plist = isakmp_plist_append(plist, gsshash, ISAKMP_NPTYPE_HASH);
 687                 break;
 688 #endif
 689         }
 690
 691 #ifdef ENABLE_NATT
 692         /* generate NAT-D payloads */
 693         if (NATT_AVAILABLE(iph1))
 694         {
 695                 vchar_t *natd[2] = { NULL, NULL };
 696
 697                 plog (LLV_INFO, LOCATION, NULL, "Adding remote and local NAT-D payloads.\n");
 698                 if ((natd[0] = natt_hash_addr (iph1, iph1->remote)) == NULL) {
 699                         plog(LLV_ERROR, LOCATION, NULL,
 700                                 "NAT-D hashing failed for %s\n", saddr2str(iph1->remote));
 701                         goto end;
 702                 }
 703
 704                 if ((natd[1] = natt_hash_addr (iph1, iph1->local)) == NULL) {
 705                         plog(LLV_ERROR, LOCATION, NULL,
 706                                 "NAT-D hashing failed for %s\n", saddr2str(iph1->local));
 707                         goto end;
 708                 }
 709
 710                 plist = isakmp_plist_append(plist, natd[0], iph1->natt_options->payload_nat_d);
 711                 plist = isakmp_plist_append(plist, natd[1], iph1->natt_options->payload_nat_d);
 712         }
 713 #endif
 714
 715         iph1->sendbuf = isakmp_plist_set_all (&plist, iph1);
 716
 717 #ifdef HAVE_PRINT_ISAKMP_C
 718         isakmp_printpacket(iph1->sendbuf, iph1->local, iph1->remote, 0);
 719 #endif
 720
 721         /* send to responder */
 722         if (isakmp_send(iph1, iph1->sendbuf) < 0)
 723                 goto end;
 724
 725         /* the sending message is added to the received-list. */
 726         if (add_recvdpkt(iph1->remote, iph1->local, iph1->sendbuf, msg) == -1) {
 727                 plog(LLV_ERROR , LOCATION, NULL,
 728                         "failed to add a response packet to the tree.\n");
 729                 goto end;
 730         }
 731
 732         /* set encryption flag */
 733         iph1->flags |= ISAKMP_FLAG_E;
 734
 735         iph1->status = PHASE1ST_ESTABLISHED;
 736         savestatus();
 737
 738         error = 0;
 739
 740 end:
 741         if (gsshash)
 742                 vfree(gsshash);
 743         return error;
 744 }
 745
 746 /*
 747  * receive from initiator
 748  *      psk: HDR, SA, KE, Ni, IDi1
 749  *      sig: HDR, SA, KE, Ni, IDi1 [, CR ]
 750  *   gssapi: HDR, SA, KE, Ni, IDi1 , GSSi
 751  *      rsa: HDR, SA, [ HASH(1),] KE, <IDi1_b>Pubkey_r, <Ni_b>Pubkey_r
 752  *      rev: HDR, SA, [ HASH(1),] <Ni_b>Pubkey_r, <KE_b>Ke_i,
 753  *           <IDii_b>Ke_i [, <Cert-I_b>Ke_i ]
 754  */
 755 int
 756 agg_r1recv(iph1, msg)
 757         struct ph1handle *iph1;
 758         vchar_t *msg;
 759 {
 760         int error = -1;
 761         vchar_t *pbuf = NULL;
 762         struct isakmp_parse_t *pa;
 763         int vid_numeric;
 764 #ifdef HAVE_GSSAPI
 765         vchar_t *gsstoken = NULL;
 766 #endif
 767
 768         /* validity check */
 769         if (iph1->status != PHASE1ST_START) {
 770                 plog(LLV_ERROR, LOCATION, NULL,
 771                         "status mismatched %d.\n", iph1->status);
 772                 goto end;
 773         }
 774
 775         /* validate the type of next payload */
 776         pbuf = isakmp_parse(msg);
 777         if (pbuf == NULL)
 778                 goto end;
 779         pa = (struct isakmp_parse_t *)pbuf->v;
 780
 781         /* SA payload is fixed postion */
 782         if (pa->type != ISAKMP_NPTYPE_SA) {
 783                 plog(LLV_ERROR, LOCATION, iph1->remote,
 784                         "received invalid next payload type %d, "
 785                         "expecting %d.\n",
 786                         pa->type, ISAKMP_NPTYPE_SA);
 787                 goto end;
 788         }
 789         if (isakmp_p2ph(&iph1->sa, pa->ptr) < 0)
 790                 goto end;
 791         pa++;
 792
 793         for (/*nothing*/;
 794              pa->type != ISAKMP_NPTYPE_NONE;
 795              pa++) {
 796
 797                 plog(LLV_DEBUG, LOCATION, NULL,
 798                         "received payload of type %s\n",
 799                         s_isakmp_nptype(pa->type));
 800
 801                 switch (pa->type) {
 802                 case ISAKMP_NPTYPE_KE:
 803                         if (isakmp_p2ph(&iph1->dhpub_p, pa->ptr) < 0)
 804                                 goto end;
 805                         break;
 806                 case ISAKMP_NPTYPE_NONCE:
 807                         if (isakmp_p2ph(&iph1->nonce_p, pa->ptr) < 0)
 808                                 goto end;
 809                         break;
 810                 case ISAKMP_NPTYPE_ID:
 811                         if (isakmp_p2ph(&iph1->id_p, pa->ptr) < 0)
 812                                 goto end;
 813                         break;
 814                 case ISAKMP_NPTYPE_VID:
 815                         vid_numeric = check_vendorid(pa->ptr);
 816
 817 #ifdef ENABLE_NATT
 818                         if (iph1->rmconf->nat_traversal &&
 819                             natt_vendorid(vid_numeric)) {
 820                                 natt_handle_vendorid(iph1, vid_numeric);
 821                                 break;
 822                         }
 823 #endif
 824 #ifdef ENABLE_HYBRID
 825                         switch (vid_numeric) {
 826                         case VENDORID_XAUTH:
 827                                 iph1->mode_cfg->flags |=
 828                                     ISAKMP_CFG_VENDORID_XAUTH;
 829                                 break;
 830
 831                         case VENDORID_UNITY:
 832                                 iph1->mode_cfg->flags |=
 833                                     ISAKMP_CFG_VENDORID_UNITY;
 834                                 break;
 835                         default:
 836                                 break;
 837                         }
 838 #endif
 839 #ifdef ENABLE_DPD
 840                         if (vid_numeric == VENDORID_DPD && iph1->rmconf->dpd) {
 841                                 iph1->dpd_support=1;
 842                                 plog(LLV_DEBUG, LOCATION, NULL,
 843                                          "remote supports DPD\n");
 844                         }
 845 #endif
 846 #ifdef ENABLE_FRAG
 847                         if ((vid_numeric == VENDORID_FRAG) &&
 848                             (vendorid_frag_cap(pa->ptr) & VENDORID_FRAG_AGG))
 849                                 iph1->frag = 1;
 850 #endif
 851                         break;
 852
 853                 case ISAKMP_NPTYPE_CR:
 854                         if (oakley_savecr(iph1, pa->ptr) < 0)
 855                                 goto end;
 856                         break;
 857
 858 #ifdef HAVE_GSSAPI
 859                 case ISAKMP_NPTYPE_GSS:
 860                         if (isakmp_p2ph(&gsstoken, pa->ptr) < 0)
 861                                 goto end;
 862                         gssapi_save_received_token(iph1, gsstoken);
 863                         break;
 864 #endif
 865                 default:
 866                         /* don't send information, see isakmp_ident_r1() */
 867                         plog(LLV_ERROR, LOCATION, iph1->remote,
 868                                 "ignore the packet, "
 869                                 "received unexpecting payload type %d.\n",
 870                                 pa->type);
 871                         goto end;
 872                 }
 873         }
 874
 875         /* payload existency check */
 876         /* XXX to be checked each authentication method. */
 877
 878         /* verify identifier */
 879         if (ipsecdoi_checkid1(iph1) != 0) {
 880                 plog(LLV_ERROR, LOCATION, iph1->remote,
 881                         "invalid ID payload.\n");
 882                 goto end;
 883         }
 884
 885 #ifdef ENABLE_NATT
 886         if (NATT_AVAILABLE(iph1))
 887                 plog(LLV_INFO, LOCATION, iph1->remote,
 888                      "Selected NAT-T version: %s\n",
 889                      vid_string_by_id(iph1->natt_options->version));
 890 #endif
 891
 892         /* check SA payload and set approval SA for use */
 893         if (ipsecdoi_checkph1proposal(iph1->sa, iph1) < 0) {
 894                 plog(LLV_ERROR, LOCATION, iph1->remote,
 895                         "failed to get valid proposal.\n");
 896                 /* XXX send information */
 897                 goto end;
 898         }
 899
 900         if (oakley_checkcr(iph1) < 0) {
 901                 /* Ignore this error in order to be interoperability. */
 902                 ;
 903         }
 904
 905         iph1->status = PHASE1ST_MSG1RECEIVED;
 906
 907         error = 0;
 908
 909 end:
 910         if (pbuf)
 911                 vfree(pbuf);
 912         if (error) {
 913                 VPTRINIT(iph1->sa);
 914                 VPTRINIT(iph1->dhpub_p);
 915                 VPTRINIT(iph1->nonce_p);
 916                 VPTRINIT(iph1->id_p);
 917                 oakley_delcert(iph1->cr_p);
 918                 iph1->cr_p = NULL;
 919         }
 920
 921         return error;
 922 }
 923
 924 /*
 925  * send to initiator
 926  *      psk: HDR, SA, KE, Nr, IDr1, HASH_R
 927  *      sig: HDR, SA, KE, Nr, IDr1, [ CR, ] [ CERT, ] SIG_R
 928  *   gssapi: HDR, SA, KE, Nr, IDr1, GSSr, HASH_R
 929  *      rsa: HDR, SA, KE, <IDr1_b>PubKey_i, <Nr_b>PubKey_i, HASH_R
 930  *      rev: HDR, SA, <Nr_b>PubKey_i, <KE_b>Ke_r, <IDir_b>Ke_r, HASH_R
 931  */
 932 int
 933 agg_r1send(iph1, msg)
 934         struct ph1handle *iph1;
 935         vchar_t *msg;
 936 {
 937         struct payload_list *plist = NULL;
 938         int need_cr = 0;
 939         int need_cert = 0;
 940         vchar_t *cr = NULL;
 941         vchar_t *vid = NULL;
 942         int error = -1;
 943 #ifdef ENABLE_HYBRID
 944         vchar_t *xauth_vid = NULL;
 945         vchar_t *unity_vid = NULL;
 946 #endif
 947 #ifdef ENABLE_NATT
 948         vchar_t *vid_natt = NULL;
 949         vchar_t *natd[2] = { NULL, NULL };
 950 #endif
 951 #ifdef ENABLE_DPD
 952         vchar_t *vid_dpd = NULL;
 953 #endif
 954
 955 #ifdef HAVE_GSSAPI
 956         int gsslen;
 957         vchar_t *gsstoken = NULL, *gsshash = NULL;
 958         vchar_t *gss_sa = NULL;
 959 #endif
 960
 961         /* validity check */
 962         if (iph1->status != PHASE1ST_MSG1RECEIVED) {
 963                 plog(LLV_ERROR, LOCATION, NULL,
 964                         "status mismatched %d.\n", iph1->status);
 965                 goto end;
 966         }
 967
 968         /* set responder's cookie */
 969         isakmp_newcookie((caddr_t)&iph1->index.r_ck, iph1->remote, iph1->local);
 970
 971         /* make ID payload into isakmp status */
 972         if (ipsecdoi_setid1(iph1) < 0)
 973                 goto end;
 974
 975         /* generate DH public value */
 976         if (oakley_dh_generate(iph1->rmconf->dhgrp,
 977                                 &iph1->dhpub, &iph1->dhpriv) < 0)
 978                 goto end;
 979
 980         /* generate NONCE value */
 981         iph1->nonce = eay_set_random(iph1->rmconf->nonce_size);
 982         if (iph1->nonce == NULL)
 983                 goto end;
 984
 985         /* compute sharing secret of DH */
 986         if (oakley_dh_compute(iph1->approval->dhgrp, iph1->dhpub,
 987                                 iph1->dhpriv, iph1->dhpub_p, &iph1->dhgxy) < 0)
 988                 goto end;
 989
 990         /* generate SKEYIDs & IV & final cipher key */
 991         if (oakley_skeyid(iph1) < 0)
 992                 goto end;
 993         if (oakley_skeyid_dae(iph1) < 0)
 994                 goto end;
 995         if (oakley_compute_enckey(iph1) < 0)
 996                 goto end;
 997         if (oakley_newiv(iph1) < 0)
 998                 goto end;
 999
1000 #ifdef HAVE_GSSAPI
1001         if (iph1->rmconf->proposal->authmethod ==
1002             OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB)
1003                 gssapi_get_rtoken(iph1, &gsslen);
1004 #endif
1005
1006         /* generate HASH to send */
1007         plog(LLV_DEBUG, LOCATION, NULL, "generate HASH_R\n");
1008         iph1->hash = oakley_ph1hash_common(iph1, GENERATE);
1009         if (iph1->hash == NULL) {
1010 #ifdef HAVE_GSSAPI
1011                 if (gssapi_more_tokens(iph1))
1012                         isakmp_info_send_n1(iph1,
1013                             ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE, NULL);
1014 #endif
1015                 goto end;
1016         }
1017
1018         /* create CR if need */
1019         if (iph1->rmconf->send_cr
1020          && oakley_needcr(iph1->approval->authmethod)
1021          && iph1->rmconf->peerscertfile == NULL) {
1022                 need_cr = 1;
1023                 cr = oakley_getcr(iph1);
1024                 if (cr == NULL) {
1025                         plog(LLV_ERROR, LOCATION, NULL,
1026                                 "failed to get cr buffer.\n");
1027                         goto end;
1028                 }
1029         }
1030
1031 #ifdef ENABLE_NATT
1032         /* Has the peer announced NAT-T? */
1033         if (NATT_AVAILABLE(iph1)) {
1034                 /* set chosen VID */
1035                 vid_natt = set_vendorid(iph1->natt_options->version);
1036
1037                 /* generate NAT-D payloads */
1038                 plog (LLV_INFO, LOCATION, NULL, "Adding remote and local NAT-D payloads.\n");
1039                 if ((natd[0] = natt_hash_addr (iph1, iph1->remote)) == NULL) {
1040                         plog(LLV_ERROR, LOCATION, NULL,
1041                                 "NAT-D hashing failed for %s\n", saddr2str(iph1->remote));
1042                         goto end;
1043                 }
1044
1045                 if ((natd[1] = natt_hash_addr (iph1, iph1->local)) == NULL) {
1046                         plog(LLV_ERROR, LOCATION, NULL,
1047                                 "NAT-D hashing failed for %s\n", saddr2str(iph1->local));
1048                         goto end;
1049                 }
1050         }
1051 #endif
1052 #ifdef ENABLE_DPD
1053         /* Only send DPD support if remote announced DPD and if DPD support is active */
1054         if (iph1->dpd_support && iph1->rmconf->dpd)
1055                 vid_dpd = set_vendorid(VENDORID_DPD);
1056 #endif
1057
1058         switch (iph1->approval->authmethod) {
1059         case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
1060                 /* set SA payload to reply */
1061                 plist = isakmp_plist_append(plist, iph1->sa_ret, ISAKMP_NPTYPE_SA);
1062
1063                 /* create isakmp KE payload */
1064                 plist = isakmp_plist_append(plist, iph1->dhpub, ISAKMP_NPTYPE_KE);
1065
1066                 /* create isakmp NONCE payload */
1067                 plist = isakmp_plist_append(plist, iph1->nonce, ISAKMP_NPTYPE_NONCE);
1068
1069                 /* create isakmp ID payload */
1070                 plist = isakmp_plist_append(plist, iph1->id, ISAKMP_NPTYPE_ID);
1071
1072                 /* create isakmp HASH payload */
1073                 plist = isakmp_plist_append(plist, iph1->hash, ISAKMP_NPTYPE_HASH);
1074
1075                 /* append vendor id, if needed */
1076                 if (vid)
1077                         plist = isakmp_plist_append(plist, vid, ISAKMP_NPTYPE_VID);
1078
1079                 /* create isakmp CR payload if needed */
1080                 if (need_cr)
1081                         plist = isakmp_plist_append(plist, cr, ISAKMP_NPTYPE_CR);
1082                 break;
1083         case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
1084         case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
1085 #ifdef ENABLE_HYBRID
1086         case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
1087         case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
1088 #endif
1089                 /* XXX if there is CR or not ? */
1090
1091                 if (oakley_getmycert(iph1) < 0)
1092                         goto end;
1093
1094                 if (oakley_getsign(iph1) < 0)
1095                         goto end;
1096
1097                 if (iph1->cert != NULL && iph1->rmconf->send_cert)
1098                         need_cert = 1;
1099
1100                 /* set SA payload to reply */
1101                 plist = isakmp_plist_append(plist, iph1->sa_ret, ISAKMP_NPTYPE_SA);
1102
1103                 /* create isakmp KE payload */
1104                 plist = isakmp_plist_append(plist, iph1->dhpub, ISAKMP_NPTYPE_KE);
1105
1106                 /* create isakmp NONCE payload */
1107                 plist = isakmp_plist_append(plist, iph1->nonce, ISAKMP_NPTYPE_NONCE);
1108
1109                 /* add ID payload */
1110                 plist = isakmp_plist_append(plist, iph1->id, ISAKMP_NPTYPE_ID);
1111
1112                 /* add CERT payload if there */
1113                 if (need_cert)
1114                         plist = isakmp_plist_append(plist, iph1->cert->pl, ISAKMP_NPTYPE_CERT);
1115
1116                 /* add SIG payload */
1117                 plist = isakmp_plist_append(plist, iph1->sig, ISAKMP_NPTYPE_SIG);
1118
1119                 /* append vendor id, if needed */
1120                 if (vid)
1121                         plist = isakmp_plist_append(plist, vid, ISAKMP_NPTYPE_VID);
1122
1123 #ifdef ENABLE_HYBRID
1124         if (iph1->mode_cfg->flags & ISAKMP_CFG_VENDORID_XAUTH) {
1125                 if ((xauth_vid = set_vendorid(VENDORID_XAUTH)) == NULL) {
1126                         plog(LLV_ERROR, LOCATION, NULL,
1127                             "Cannot create Xauth vendor ID\n");
1128                         goto end;
1129                 }
1130                 plist = isakmp_plist_append(plist,
1131                     xauth_vid, ISAKMP_NPTYPE_VID);
1132         }
1133
1134         if (iph1->mode_cfg->flags & ISAKMP_CFG_VENDORID_UNITY) {
1135                 if ((unity_vid = set_vendorid(VENDORID_UNITY)) == NULL) {
1136                         plog(LLV_ERROR, LOCATION, NULL,
1137                             "Cannot create Unity vendor ID\n");
1138                         goto end;
1139                 }
1140                 plist = isakmp_plist_append(plist,
1141                     unity_vid, ISAKMP_NPTYPE_VID);
1142         }
1143 #endif
1144
1145                 /* create isakmp CR payload if needed */
1146                 if (need_cr)
1147                         plist = isakmp_plist_append(plist, cr, ISAKMP_NPTYPE_CR);
1148                 break;
1149
1150         case OAKLEY_ATTR_AUTH_METHOD_RSAENC:
1151         case OAKLEY_ATTR_AUTH_METHOD_RSAREV:
1152                 break;
1153 #ifdef HAVE_GSSAPI
1154         case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB:
1155                 /* create buffer to send isakmp payload */
1156                 gsshash = gssapi_wraphash(iph1);
1157                 if (gsshash == NULL) {
1158                         plog(LLV_ERROR, LOCATION, NULL,
1159                                 "failed to wrap hash\n");
1160                         /*
1161                          * This is probably due to the GSS roundtrips not
1162                          * being finished yet. Return this error in
1163                          * the hope that a fallback to main mode will
1164                          * be done.
1165                          */
1166                         isakmp_info_send_n1(iph1,
1167                             ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE, NULL);
1168                         goto end;
1169                 }
1170                 if (iph1->approval->gssid != NULL)
1171                         gss_sa = ipsecdoi_setph1proposal(iph1->approval);
1172                 else
1173                         gss_sa = iph1->sa_ret;
1174
1175                 /* set SA payload to reply */
1176                 plist = isakmp_plist_append(plist, gss_sa, ISAKMP_NPTYPE_SA);
1177
1178                 /* create isakmp KE payload */
1179                 plist = isakmp_plist_append(plist, iph1->dhpub, ISAKMP_NPTYPE_KE);
1180
1181                 /* create isakmp NONCE payload */
1182                 plist = isakmp_plist_append(plist, iph1->nonce, ISAKMP_NPTYPE_NONCE);
1183
1184                 /* create isakmp ID payload */
1185                 plist = isakmp_plist_append(plist, iph1->id, ISAKMP_NPTYPE_ID);
1186
1187                 /* create GSS payload */
1188                 gssapi_get_token_to_send(iph1, &gsstoken);
1189                 plist = isakmp_plist_append(plist, gsstoken, ISAKMP_NPTYPE_GSS);
1190
1191                 /* create isakmp HASH payload */
1192                 plist = isakmp_plist_append(plist, gsshash, ISAKMP_NPTYPE_HASH);
1193
1194                 /* append vendor id, if needed */
1195                 if (vid)
1196                         plist = isakmp_plist_append(plist, vid, ISAKMP_NPTYPE_VID);
1197
1198                 break;
1199 #endif
1200         }
1201
1202 #ifdef ENABLE_NATT
1203         /* append NAT-T payloads */
1204         if (vid_natt) {
1205                 /* chosen VID */
1206                 plist = isakmp_plist_append(plist, vid_natt, ISAKMP_NPTYPE_VID);
1207                 /* NAT-D */
1208                 plist = isakmp_plist_append(plist, natd[0], iph1->natt_options->payload_nat_d);
1209                 plist = isakmp_plist_append(plist, natd[1], iph1->natt_options->payload_nat_d);
1210         }
1211 #endif
1212 #ifdef ENABLE_DPD
1213         if (vid_dpd)
1214                 plist = isakmp_plist_append(plist, vid_dpd, ISAKMP_NPTYPE_VID);
1215 #endif
1216
1217         iph1->sendbuf = isakmp_plist_set_all (&plist, iph1);
1218
1219 #ifdef HAVE_PRINT_ISAKMP_C
1220         isakmp_printpacket(iph1->sendbuf, iph1->local, iph1->remote, 1);
1221 #endif
1222
1223         /* send the packet, add to the schedule to resend */
1224         iph1->retry_counter = iph1->rmconf->retry_counter;
1225         if (isakmp_ph1resend(iph1) == -1)
1226                 goto end;
1227
1228         /* the sending message is added to the received-list. */
1229         if (add_recvdpkt(iph1->remote, iph1->local, iph1->sendbuf, msg) == -1) {
1230                 plog(LLV_ERROR , LOCATION, NULL,
1231                         "failed to add a response packet to the tree.\n");
1232                 goto end;
1233         }
1234
1235         iph1->status = PHASE1ST_MSG1SENT;
1236
1237         error = 0;
1238
1239 end:
1240         if (cr)
1241                 vfree(cr);
1242         if (vid)
1243                 vfree(vid);
1244 #ifdef ENABLE_HYBRID
1245         if (xauth_vid)
1246                 vfree(xauth_vid);
1247         if (unity_vid)
1248                 vfree(unity_vid);
1249 #endif
1250 #ifdef HAVE_GSSAPI
1251         if (gsstoken)
1252                 vfree(gsstoken);
1253         if (gsshash)
1254                 vfree(gsshash);
1255         if (gss_sa != iph1->sa_ret)
1256                 vfree(gss_sa);
1257 #endif
1258 #ifdef ENABLE_DPD
1259         if (vid_dpd)
1260                 vfree(vid_dpd);
1261 #endif
1262
1263         return error;
1264 }
1265
1266 /*
1267  * receive from initiator
1268  *      psk: HDR, HASH_I
1269  *   gssapi: HDR, HASH_I
1270  *      sig: HDR, [ CERT, ] SIG_I
1271  *      rsa: HDR, HASH_I
1272  *      rev: HDR, HASH_I
1273  */
1274 int
1275 agg_r2recv(iph1, msg0)
1276         struct ph1handle *iph1;
1277         vchar_t *msg0;
1278 {
1279         vchar_t *msg = NULL;
1280         vchar_t *pbuf = NULL;
1281         struct isakmp_parse_t *pa;
1282         int error = -1;
1283         int ptype;
1284
1285 #ifdef ENABLE_NATT
1286         int natd_seq = 0;
1287 #endif
1288
1289         /* validity check */
1290         if (iph1->status != PHASE1ST_MSG1SENT) {
1291                 plog(LLV_ERROR, LOCATION, NULL,
1292                         "status mismatched %d.\n", iph1->status);
1293                 goto end;
1294         }
1295
1296         /* decrypting if need. */
1297         /* XXX configurable ? */
1298         if (ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E)) {
1299                 msg = oakley_do_decrypt(iph1, msg0,
1300                                         iph1->ivm->iv, iph1->ivm->ive);
1301                 if (msg == NULL)
1302                         goto end;
1303         } else
1304                 msg = vdup(msg0);
1305
1306         /* validate the type of next payload */
1307         pbuf = isakmp_parse(msg);
1308         if (pbuf == NULL)
1309                 goto end;
1310
1311         iph1->pl_hash = NULL;
1312
1313         for (pa = (struct isakmp_parse_t *)pbuf->v;
1314              pa->type != ISAKMP_NPTYPE_NONE;
1315              pa++) {
1316
1317                 switch (pa->type) {
1318                 case ISAKMP_NPTYPE_HASH:
1319                         iph1->pl_hash = (struct isakmp_pl_hash *)pa->ptr;
1320                         break;
1321                 case ISAKMP_NPTYPE_VID:
1322                         (void)check_vendorid(pa->ptr);
1323                         break;
1324                 case ISAKMP_NPTYPE_CERT:
1325                         if (oakley_savecert(iph1, pa->ptr) < 0)
1326                                 goto end;
1327                         break;
1328                 case ISAKMP_NPTYPE_SIG:
1329                         if (isakmp_p2ph(&iph1->sig_p, pa->ptr) < 0)
1330                                 goto end;
1331                         break;
1332                 case ISAKMP_NPTYPE_N:
1333                         isakmp_check_notify(pa->ptr, iph1);
1334                         break;
1335
1336 #ifdef ENABLE_NATT
1337                 case ISAKMP_NPTYPE_NATD_DRAFT:
1338                 case ISAKMP_NPTYPE_NATD_RFC:
1339                         if (pa->type == iph1->natt_options->payload_nat_d)
1340                         {
1341                                 vchar_t *natd_received = NULL;
1342                                 int natd_verified;
1343
1344                                 if (isakmp_p2ph (&natd_received, pa->ptr) < 0)
1345                                         goto end;
1346
1347                                 if (natd_seq == 0)
1348                                         iph1->natt_flags |= NAT_DETECTED;
1349
1350                                 natd_verified = natt_compare_addr_hash (iph1,
1351                                         natd_received, natd_seq++);
1352
1353                                 plog (LLV_INFO, LOCATION, NULL, "NAT-D payload #%d %s\n",
1354                                         natd_seq - 1,
1355                                         natd_verified ? "verified" : "doesn't match");
1356
1357                                 vfree (natd_received);
1358                                 break;
1359                         }
1360                         /* passthrough to default... */
1361 #endif
1362
1363                 default:
1364                         /* don't send information, see isakmp_ident_r1() */
1365                         plog(LLV_ERROR, LOCATION, iph1->remote,
1366                                 "ignore the packet, "
1367                                 "received unexpecting payload type %d.\n",
1368                                 pa->type);
1369                         goto end;
1370                 }
1371         }
1372
1373 #ifdef ENABLE_NATT
1374         if (NATT_AVAILABLE(iph1))
1375                 plog (LLV_INFO, LOCATION, NULL, "NAT %s %s%s\n",
1376                       iph1->natt_flags & NAT_DETECTED ?
1377                                 "detected:" : "not detected",
1378                       iph1->natt_flags & NAT_DETECTED_ME ? "ME " : "",
1379                       iph1->natt_flags & NAT_DETECTED_PEER ? "PEER" : "");
1380 #endif
1381
1382         /* validate authentication value */
1383         ptype = oakley_validate_auth(iph1);
1384         if (ptype != 0) {
1385                 if (ptype == -1) {
1386                         /* message printed inner oakley_validate_auth() */
1387                         goto end;
1388                 }
1389                 EVT_PUSH(iph1->local, iph1->remote,
1390                     EVTT_PEERPH1AUTH_FAILED, NULL);
1391                 isakmp_info_send_n1(iph1, ptype, NULL);
1392                 goto end;
1393         }
1394
1395         iph1->status = PHASE1ST_MSG2RECEIVED;
1396
1397         error = 0;
1398
1399 end:
1400         if (pbuf)
1401                 vfree(pbuf);
1402         if (msg)
1403                 vfree(msg);
1404         if (error) {
1405                 oakley_delcert(iph1->cert_p);
1406                 iph1->cert_p = NULL;
1407                 oakley_delcert(iph1->crl_p);
1408                 iph1->crl_p = NULL;
1409                 VPTRINIT(iph1->sig_p);
1410         }
1411
1412         return error;
1413 }
1414
1415 /*
1416  * status update and establish isakmp sa.
1417  */
1418 int
1419 agg_r2send(iph1, msg)
1420         struct ph1handle *iph1;
1421         vchar_t *msg;
1422 {
1423         int error = -1;
1424
1425         /* validity check */
1426         if (iph1->status != PHASE1ST_MSG2RECEIVED) {
1427                 plog(LLV_ERROR, LOCATION, NULL,
1428                         "status mismatched %d.\n", iph1->status);
1429                 goto end;
1430         }
1431
1432         /* IV synchronized when packet encrypted. */
1433         /* see handler.h about IV synchronization. */
1434         if (ISSET(((struct isakmp *)msg->v)->flags, ISAKMP_FLAG_E))
1435                 memcpy(iph1->ivm->iv->v, iph1->ivm->ive->v, iph1->ivm->iv->l);
1436
1437         /* set encryption flag */
1438         iph1->flags |= ISAKMP_FLAG_E;
1439
1440         iph1->status = PHASE1ST_ESTABLISHED;
1441         savestatus();
1442
1443         error = 0;
1444
1445 end:
1446         return error;
1447 }