1 /* $KAME: isakmp_newg.c,v 1.10 2002/09/27 05:55:52 itojun Exp $ */
4 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. Neither the name of the project nor the names of its contributors
16 * may be used to endorse or promote products derived from this software
17 * without specific prior written permission.
19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #include <sys/types.h>
35 #include <sys/param.h>
50 #include "cfparse_proto.h"
51 #include "isakmp_var.h"
53 #include "isakmp_newg.h"
55 #include "ipsec_doi.h"
56 #include "crypto_openssl.h"
64 * New group mode as responder
67 isakmp_newgroup_r(iph1, msg)
68 struct ph1handle *iph1;
72 struct isakmp *isakmp = (struct isakmp *)msg->v;
73 struct isakmp_pl_hash *hash = NULL;
74 struct isakmp_pl_sa *sa = NULL;
77 struct oakley_sa *osa;
80 /* validate the type of next payload */
82 * ISAKMP_ETYPE_NEWGRP,
83 * ISAKMP_NPTYPE_HASH, (ISAKMP_NPTYPE_VID), ISAKMP_NPTYPE_SA,
88 struct isakmp_parse_t *pa;
90 if ((pbuf = isakmp_parse(msg)) == NULL)
93 for (pa = (struct isakmp_parse_t *)pbuf->v;
94 pa->type != ISAKMP_NPTYPE_NONE;
98 case ISAKMP_NPTYPE_HASH:
100 isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL);
101 plog(LLV_ERROR, LOCATION, iph1->remote,
102 "received multiple payload type %d.\n",
107 hash = (struct isakmp_pl_hash *)pa->ptr;
109 case ISAKMP_NPTYPE_SA:
111 isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL);
112 plog(LLV_ERROR, LOCATION, iph1->remote,
113 "received multiple payload type %d.\n",
118 sa = (struct isakmp_pl_sa *)pa->ptr;
120 case ISAKMP_NPTYPE_VID:
121 (void)check_vendorid(pa->ptr);
124 isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL);
125 plog(LLV_ERROR, LOCATION, iph1->remote,
126 "ignore the packet, "
127 "received unexpecting payload type %d.\n",
136 isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL);
137 plog(LLV_ERROR, LOCATION, iph1->remote,
138 "no HASH, or no SA payload.\n");
146 vchar_t *my_hash = NULL;
149 plog(LLV_DEBUG, LOCATION, NULL, "validate HASH\n");
151 len = sizeof(isakmp->msgid) + ntohs(sa->h.len);
154 plog(LLV_ERROR, LOCATION, NULL,
155 "failed to get buffer to send.\n");
158 memcpy(buf->v, &isakmp->msgid, sizeof(isakmp->msgid));
159 memcpy(buf->v + sizeof(isakmp->msgid), sa, ntohs(sa->h.len));
161 plog(LLV_DEBUG, LOCATION, NULL, "hash source\n");
162 plogdump(LLV_DEBUG, buf->v, buf->l);
164 my_hash = isakmp_prf(iph1->skeyid_a, buf, iph1);
169 plog(LLV_DEBUG, LOCATION, NULL, "hash result\n");
170 plogdump(LLV_DEBUG, my_hash->v, my_hash->l);
172 r_hash = (char *)hash + sizeof(*hash);
174 plog(LLV_DEBUG, LOCATION, NULL, "original hash\n"));
175 plogdump(LLV_DEBUG, r_hash, ntohs(hash->h.len) - sizeof(*hash)));
177 result = memcmp(my_hash->v, r_hash, my_hash->l);
181 plog(LLV_ERROR, LOCATION, iph1->remote,
183 isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_HASH_INFORMATION, NULL);
188 /* check SA payload and get new one for use */
189 buf = ipsecdoi_get_proposal((struct ipsecdoi_sa *)sa,
190 OAKLEY_NEWGROUP_MODE);
192 isakmp_info_send_n1(iph1, ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED, NULL);
196 /* save sa parameters */
197 osa = ipsecdoi_get_oakley(buf);
199 isakmp_info_send_n1(iph1, ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED, NULL);
204 switch (osa->dhgrp) {
205 case OAKLEY_ATTR_GRP_DESC_MODP768:
206 case OAKLEY_ATTR_GRP_DESC_MODP1024:
207 case OAKLEY_ATTR_GRP_DESC_MODP1536:
210 isakmp_info_send_n1(iph1, ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED, NULL);
211 plog(LLV_ERROR, LOCATION, NULL,
212 "dh group %d isn't supported.\n", osa->dhgrp);
216 plog(LLV_INFO, LOCATION, iph1->remote,
217 "got new dh group %s.\n", isakmp_pindex(&iph1->index, 0));
224 (void)isakmp_free_ph1(iph1);