1 /* $OpenBSD: ikev2_msg.c,v 1.62 2020/01/22 07:52:37 deraadt Exp $ */ 2 3 /* 4 * Copyright (c) 2019 Tobias Heider <tobias.heider@stusta.de> 5 * Copyright (c) 2010-2013 Reyk Floeter <reyk@openbsd.org> 6 * 7 * Permission to use, copy, modify, and distribute this software for any 8 * purpose with or without fee is hereby granted, provided that the above 9 * copyright notice and this permission notice appear in all copies. 10 * 11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18 */ 19 20 #include <sys/param.h> /* roundup */ 21 #include <sys/queue.h> 22 #include <sys/socket.h> 23 #include <sys/wait.h> 24 #include <sys/uio.h> 25 26 #include <netinet/in.h> 27 #include <arpa/inet.h> 28 29 #include <stdlib.h> 30 #include <stdio.h> 31 #include <unistd.h> 32 #include <string.h> 33 #include <signal.h> 34 #include <errno.h> 35 #include <err.h> 36 #include <pwd.h> 37 #include <event.h> 38 39 #include <openssl/sha.h> 40 #include <openssl/evp.h> 41 42 #include "iked.h" 43 #include "ikev2.h" 44 #include "eap.h" 45 #include "dh.h" 46 47 void ikev1_recv(struct iked *, struct iked_message *); 48 void ikev2_msg_response_timeout(struct iked *, void *); 49 void ikev2_msg_retransmit_timeout(struct iked *, void *); 50 int ikev2_check_frag_oversize(struct iked_sa *sa, struct ibuf *buf); 51 int ikev2_send_encrypted_fragments(struct iked *env, struct iked_sa *sa, 52 struct ibuf *in,uint8_t exchange, uint8_t firstpayload, int response); 53 54 void 55 ikev2_msg_cb(int fd, short event, void *arg) 56 { 57 struct iked_socket *sock = arg; 58 struct iked *env = sock->sock_env; 59 struct iked_message msg; 60 struct ike_header hdr; 61 uint32_t natt = 0x00000000; 62 uint8_t buf[IKED_MSGBUF_MAX]; 63 ssize_t len; 64 off_t off; 65 66 bzero(&msg, sizeof(msg)); 67 bzero(buf, sizeof(buf)); 68 69 msg.msg_peerlen = sizeof(msg.msg_peer); 70 msg.msg_locallen = sizeof(msg.msg_local); 71 msg.msg_parent = &msg; 72 memcpy(&msg.msg_local, &sock->sock_addr, sizeof(sock->sock_addr)); 73 74 if ((len = recvfromto(fd, buf, sizeof(buf), 0, 75 (struct sockaddr *)&msg.msg_peer, &msg.msg_peerlen, 76 (struct sockaddr *)&msg.msg_local, &msg.msg_locallen)) < 77 (ssize_t)sizeof(natt)) 78 return; 79 80 if (socket_getport((struct sockaddr *)&msg.msg_local) == 81 env->sc_nattport) { 82 if (memcmp(&natt, buf, sizeof(natt)) != 0) 83 return; 84 msg.msg_natt = 1; 85 off = sizeof(natt); 86 } else 87 off = 0; 88 89 if ((size_t)(len - off) <= sizeof(hdr)) 90 return; 91 memcpy(&hdr, buf + off, sizeof(hdr)); 92 93 if ((msg.msg_data = ibuf_new(buf + off, len - off)) == NULL) 94 return; 95 96 TAILQ_INIT(&msg.msg_proposals); 97 SLIST_INIT(&msg.msg_certreqs); 98 msg.msg_fd = fd; 99 100 if (hdr.ike_version == IKEV1_VERSION) 101 ikev1_recv(env, &msg); 102 else 103 ikev2_recv(env, &msg); 104 105 ikev2_msg_cleanup(env, &msg); 106 } 107 108 void 109 ikev1_recv(struct iked *env, struct iked_message *msg) 110 { 111 struct ike_header *hdr; 112 113 if (ibuf_size(msg->msg_data) <= sizeof(*hdr)) { 114 log_debug("%s: short message", __func__); 115 return; 116 } 117 118 hdr = (struct ike_header *)ibuf_data(msg->msg_data); 119 120 log_debug("%s: header ispi %s rspi %s" 121 " nextpayload %u version 0x%02x exchange %u flags 0x%02x" 122 " msgid %u length %u", __func__, 123 print_spi(betoh64(hdr->ike_ispi), 8), 124 print_spi(betoh64(hdr->ike_rspi), 8), 125 hdr->ike_nextpayload, 126 hdr->ike_version, 127 hdr->ike_exchange, 128 hdr->ike_flags, 129 betoh32(hdr->ike_msgid), 130 betoh32(hdr->ike_length)); 131 132 log_debug("%s: IKEv1 not supported", __func__); 133 } 134 135 struct ibuf * 136 ikev2_msg_init(struct iked *env, struct iked_message *msg, 137 struct sockaddr_storage *peer, socklen_t peerlen, 138 struct sockaddr_storage *local, socklen_t locallen, int response) 139 { 140 bzero(msg, sizeof(*msg)); 141 memcpy(&msg->msg_peer, peer, peerlen); 142 msg->msg_peerlen = peerlen; 143 memcpy(&msg->msg_local, local, locallen); 144 msg->msg_locallen = locallen; 145 msg->msg_response = response ? 1 : 0; 146 msg->msg_fd = -1; 147 msg->msg_data = ibuf_static(); 148 msg->msg_e = 0; 149 msg->msg_parent = msg; /* has to be set */ 150 TAILQ_INIT(&msg->msg_proposals); 151 152 return (msg->msg_data); 153 } 154 155 struct iked_message * 156 ikev2_msg_copy(struct iked *env, struct iked_message *msg) 157 { 158 struct iked_message *m = NULL; 159 struct ibuf *buf; 160 size_t len; 161 void *ptr; 162 163 if (ibuf_size(msg->msg_data) < msg->msg_offset) 164 return (NULL); 165 len = ibuf_size(msg->msg_data) - msg->msg_offset; 166 167 if ((ptr = ibuf_seek(msg->msg_data, msg->msg_offset, len)) == NULL || 168 (m = malloc(sizeof(*m))) == NULL || 169 (buf = ikev2_msg_init(env, m, &msg->msg_peer, msg->msg_peerlen, 170 &msg->msg_local, msg->msg_locallen, msg->msg_response)) == NULL || 171 ibuf_add(buf, ptr, len)) 172 return (NULL); 173 174 m->msg_fd = msg->msg_fd; 175 m->msg_msgid = msg->msg_msgid; 176 m->msg_offset = msg->msg_offset; 177 m->msg_sa = msg->msg_sa; 178 179 return (m); 180 } 181 182 void 183 ikev2_msg_cleanup(struct iked *env, struct iked_message *msg) 184 { 185 struct iked_certreq *cr; 186 187 if (msg == msg->msg_parent) { 188 ibuf_release(msg->msg_nonce); 189 ibuf_release(msg->msg_ke); 190 ibuf_release(msg->msg_auth.id_buf); 191 ibuf_release(msg->msg_id.id_buf); 192 ibuf_release(msg->msg_cert.id_buf); 193 ibuf_release(msg->msg_cookie); 194 ibuf_release(msg->msg_cookie2); 195 196 msg->msg_nonce = NULL; 197 msg->msg_ke = NULL; 198 msg->msg_auth.id_buf = NULL; 199 msg->msg_id.id_buf = NULL; 200 msg->msg_cert.id_buf = NULL; 201 msg->msg_cookie = NULL; 202 msg->msg_cookie2 = NULL; 203 204 config_free_proposals(&msg->msg_proposals, 0); 205 while ((cr = SLIST_FIRST(&msg->msg_certreqs))) { 206 ibuf_release(cr->cr_data); 207 SLIST_REMOVE_HEAD(&msg->msg_certreqs, cr_entry); 208 free(cr); 209 } 210 } 211 212 if (msg->msg_data != NULL) { 213 ibuf_release(msg->msg_data); 214 msg->msg_data = NULL; 215 } 216 } 217 218 int 219 ikev2_msg_valid_ike_sa(struct iked *env, struct ike_header *oldhdr, 220 struct iked_message *msg) 221 { 222 #if 0 223 /* XXX Disabled, see comment below */ 224 struct iked_message resp; 225 struct ike_header *hdr; 226 struct ikev2_payload *pld; 227 struct ikev2_notify *n; 228 struct ibuf *buf; 229 struct iked_sa sa; 230 #endif 231 232 if (msg->msg_sa != NULL && msg->msg_policy != NULL) { 233 if (msg->msg_sa->sa_state == IKEV2_STATE_CLOSED) 234 return (-1); 235 /* 236 * Only permit informational requests from initiator 237 * on closing SAs (for DELETE). 238 */ 239 if (msg->msg_sa->sa_state == IKEV2_STATE_CLOSING) { 240 if (((oldhdr->ike_flags & 241 (IKEV2_FLAG_INITIATOR|IKEV2_FLAG_RESPONSE)) == 242 IKEV2_FLAG_INITIATOR) && 243 (oldhdr->ike_exchange == 244 IKEV2_EXCHANGE_INFORMATIONAL)) 245 return (0); 246 return (-1); 247 } 248 return (0); 249 } 250 251 #if 0 252 /* 253 * XXX Sending INVALID_IKE_SPIs notifications is disabled 254 * XXX because it is not mandatory and ignored by most 255 * XXX implementations. We might want to enable it in 256 * XXX combination with a rate-limitation to avoid DoS situations. 257 */ 258 259 /* Fail without error message */ 260 if (msg->msg_response || msg->msg_policy == NULL) 261 return (-1); 262 263 /* Invalid IKE SA, return notification */ 264 if ((buf = ikev2_msg_init(env, &resp, 265 &msg->msg_peer, msg->msg_peerlen, 266 &msg->msg_local, msg->msg_locallen, 1)) == NULL) 267 goto done; 268 269 resp.msg_fd = msg->msg_fd; 270 271 bzero(&sa, sizeof(sa)); 272 if ((oldhdr->ike_flags & IKEV2_FLAG_INITIATOR) == 0) 273 sa.sa_hdr.sh_initiator = 1; 274 sa.sa_hdr.sh_ispi = betoh64(oldhdr->ike_ispi); 275 sa.sa_hdr.sh_rspi = betoh64(oldhdr->ike_rspi); 276 277 resp.msg_msgid = betoh32(oldhdr->ike_msgid); 278 279 /* IKE header */ 280 if ((hdr = ikev2_add_header(buf, &sa, resp.msg_msgid, 281 IKEV2_PAYLOAD_NOTIFY, IKEV2_EXCHANGE_INFORMATIONAL, 282 IKEV2_FLAG_RESPONSE)) == NULL) 283 goto done; 284 285 /* SA payload */ 286 if ((pld = ikev2_add_payload(buf)) == NULL) 287 goto done; 288 if ((n = ibuf_advance(buf, sizeof(*n))) == NULL) 289 goto done; 290 n->n_protoid = IKEV2_SAPROTO_IKE; 291 n->n_spisize = 0; 292 n->n_type = htobe16(IKEV2_N_INVALID_IKE_SPI); 293 294 if (ikev2_next_payload(pld, sizeof(*n), IKEV2_PAYLOAD_NONE) == -1) 295 goto done; 296 297 if (ikev2_set_header(hdr, ibuf_size(buf) - sizeof(*hdr)) == -1) 298 goto done; 299 300 (void)ikev2_pld_parse(env, hdr, &resp, 0); 301 (void)ikev2_msg_send(env, &resp); 302 303 done: 304 ikev2_msg_cleanup(env, &resp); 305 #endif 306 307 /* Always fail */ 308 return (-1); 309 } 310 311 int 312 ikev2_msg_send(struct iked *env, struct iked_message *msg) 313 { 314 struct iked_sa *sa = msg->msg_sa; 315 struct ibuf *buf = msg->msg_data; 316 uint32_t natt = 0x00000000; 317 int isnatt = 0; 318 uint8_t exchange, flags; 319 struct ike_header *hdr; 320 struct iked_message *m; 321 322 if (buf == NULL || (hdr = ibuf_seek(msg->msg_data, 323 msg->msg_offset, sizeof(*hdr))) == NULL) 324 return (-1); 325 326 isnatt = (msg->msg_natt || (sa && sa->sa_natt)); 327 328 exchange = hdr->ike_exchange; 329 flags = hdr->ike_flags; 330 log_info("%ssend %s %s %u peer %s local %s, %ld bytes%s", 331 SPI_IH(hdr), 332 print_map(exchange, ikev2_exchange_map), 333 (flags & IKEV2_FLAG_RESPONSE) ? "res" : "req", 334 betoh32(hdr->ike_msgid), 335 print_host((struct sockaddr *)&msg->msg_peer, NULL, 0), 336 print_host((struct sockaddr *)&msg->msg_local, NULL, 0), 337 ibuf_length(buf), isnatt ? ", NAT-T" : ""); 338 339 if (isnatt) { 340 if (ibuf_prepend(buf, &natt, sizeof(natt)) == -1) { 341 log_debug("%s: failed to set NAT-T", __func__); 342 return (-1); 343 } 344 } 345 346 if (sendtofrom(msg->msg_fd, ibuf_data(buf), ibuf_size(buf), 0, 347 (struct sockaddr *)&msg->msg_peer, msg->msg_peerlen, 348 (struct sockaddr *)&msg->msg_local, msg->msg_locallen) == -1) { 349 log_warn("%s: sendtofrom", __func__); 350 if (sa != NULL && errno == EADDRNOTAVAIL) { 351 sa_state(env, sa, IKEV2_STATE_CLOSING); 352 timer_del(env, &sa->sa_timer); 353 timer_set(env, &sa->sa_timer, 354 ikev2_ike_sa_timeout, sa); 355 timer_add(env, &sa->sa_timer, 356 IKED_IKE_SA_DELETE_TIMEOUT); 357 } 358 if (sa != NULL) 359 return (-1); 360 } 361 362 if (sa == NULL) 363 return (0); 364 365 if ((m = ikev2_msg_copy(env, msg)) == NULL) { 366 log_debug("%s: failed to copy a message", __func__); 367 return (-1); 368 } 369 m->msg_exchange = exchange; 370 371 if (flags & IKEV2_FLAG_RESPONSE) { 372 TAILQ_INSERT_TAIL(&sa->sa_responses, m, msg_entry); 373 timer_set(env, &m->msg_timer, ikev2_msg_response_timeout, m); 374 timer_add(env, &m->msg_timer, IKED_RESPONSE_TIMEOUT); 375 } else { 376 TAILQ_INSERT_TAIL(&sa->sa_requests, m, msg_entry); 377 timer_set(env, &m->msg_timer, ikev2_msg_retransmit_timeout, m); 378 timer_add(env, &m->msg_timer, IKED_RETRANSMIT_TIMEOUT); 379 } 380 381 return (0); 382 } 383 384 uint32_t 385 ikev2_msg_id(struct iked *env, struct iked_sa *sa) 386 { 387 uint32_t id = sa->sa_reqid; 388 389 if (++sa->sa_reqid == UINT32_MAX) { 390 /* XXX we should close and renegotiate the connection now */ 391 log_debug("%s: IKEv2 message sequence overflow", __func__); 392 } 393 return (id); 394 } 395 396 struct ibuf * 397 ikev2_msg_encrypt(struct iked *env, struct iked_sa *sa, struct ibuf *src) 398 { 399 size_t len, ivlen, encrlen, integrlen, blocklen, 400 outlen; 401 uint8_t *buf, pad = 0, *ptr; 402 struct ibuf *encr, *dst = NULL, *out = NULL; 403 404 buf = ibuf_data(src); 405 len = ibuf_size(src); 406 407 log_debug("%s: decrypted length %zu", __func__, len); 408 print_hex(buf, 0, len); 409 410 if (sa == NULL || 411 sa->sa_encr == NULL || 412 sa->sa_integr == NULL) { 413 log_debug("%s: invalid SA", __func__); 414 goto done; 415 } 416 417 if (sa->sa_hdr.sh_initiator) 418 encr = sa->sa_key_iencr; 419 else 420 encr = sa->sa_key_rencr; 421 422 blocklen = cipher_length(sa->sa_encr); 423 ivlen = cipher_ivlength(sa->sa_encr); 424 integrlen = hash_length(sa->sa_integr); 425 encrlen = roundup(len + sizeof(pad), blocklen); 426 pad = encrlen - (len + sizeof(pad)); 427 428 /* 429 * Pad the payload and encrypt it 430 */ 431 if (pad) { 432 if ((ptr = ibuf_advance(src, pad)) == NULL) 433 goto done; 434 arc4random_buf(ptr, pad); 435 } 436 if (ibuf_add(src, &pad, sizeof(pad)) != 0) 437 goto done; 438 439 log_debug("%s: padded length %zu", __func__, ibuf_size(src)); 440 print_hex(ibuf_data(src), 0, ibuf_size(src)); 441 442 cipher_setkey(sa->sa_encr, encr->buf, ibuf_length(encr)); 443 cipher_setiv(sa->sa_encr, NULL, 0); /* XXX ivlen */ 444 cipher_init_encrypt(sa->sa_encr); 445 446 if ((dst = ibuf_dup(sa->sa_encr->encr_iv)) == NULL) 447 goto done; 448 449 if ((out = ibuf_new(NULL, 450 cipher_outlength(sa->sa_encr, encrlen))) == NULL) 451 goto done; 452 453 outlen = ibuf_size(out); 454 cipher_update(sa->sa_encr, 455 ibuf_data(src), encrlen, ibuf_data(out), &outlen); 456 457 if (outlen && ibuf_add(dst, ibuf_data(out), outlen) != 0) 458 goto done; 459 460 if ((ptr = ibuf_advance(dst, integrlen)) == NULL) 461 goto done; 462 explicit_bzero(ptr, integrlen); 463 464 log_debug("%s: length %zu, padding %d, output length %zu", 465 __func__, len + sizeof(pad), pad, ibuf_size(dst)); 466 print_hex(ibuf_data(dst), 0, ibuf_size(dst)); 467 468 ibuf_release(src); 469 ibuf_release(out); 470 return (dst); 471 done: 472 ibuf_release(src); 473 ibuf_release(out); 474 ibuf_release(dst); 475 return (NULL); 476 } 477 478 int 479 ikev2_msg_integr(struct iked *env, struct iked_sa *sa, struct ibuf *src) 480 { 481 int ret = -1; 482 size_t integrlen, tmplen; 483 struct ibuf *integr, *tmp = NULL; 484 uint8_t *ptr; 485 486 log_debug("%s: message length %zu", __func__, ibuf_size(src)); 487 print_hex(ibuf_data(src), 0, ibuf_size(src)); 488 489 if (sa == NULL || 490 sa->sa_integr == NULL) { 491 log_debug("%s: invalid SA", __func__); 492 return (-1); 493 } 494 495 if (sa->sa_hdr.sh_initiator) 496 integr = sa->sa_key_iauth; 497 else 498 integr = sa->sa_key_rauth; 499 500 integrlen = hash_length(sa->sa_integr); 501 502 log_debug("%s: integrity checksum length %zu", __func__, 503 integrlen); 504 505 /* 506 * Validate packet checksum 507 */ 508 if ((tmp = ibuf_new(NULL, hash_keylength(sa->sa_integr))) == NULL) 509 goto done; 510 511 hash_setkey(sa->sa_integr, ibuf_data(integr), ibuf_size(integr)); 512 hash_init(sa->sa_integr); 513 hash_update(sa->sa_integr, ibuf_data(src), 514 ibuf_size(src) - integrlen); 515 hash_final(sa->sa_integr, ibuf_data(tmp), &tmplen); 516 517 if (tmplen != integrlen) { 518 log_debug("%s: hash failure", __func__); 519 goto done; 520 } 521 522 if ((ptr = ibuf_seek(src, 523 ibuf_size(src) - integrlen, integrlen)) == NULL) 524 goto done; 525 memcpy(ptr, ibuf_data(tmp), tmplen); 526 527 print_hex(ibuf_data(tmp), 0, ibuf_size(tmp)); 528 529 ret = 0; 530 done: 531 ibuf_release(tmp); 532 533 return (ret); 534 } 535 536 struct ibuf * 537 ikev2_msg_decrypt(struct iked *env, struct iked_sa *sa, 538 struct ibuf *msg, struct ibuf *src) 539 { 540 ssize_t ivlen, encrlen, integrlen, blocklen, 541 outlen, tmplen; 542 uint8_t pad = 0, *ptr; 543 struct ibuf *integr, *encr, *tmp = NULL, *out = NULL; 544 off_t ivoff, encroff, integroff; 545 546 if (sa == NULL || 547 sa->sa_encr == NULL || 548 sa->sa_integr == NULL) { 549 log_debug("%s: invalid SA", __func__); 550 print_hex(ibuf_data(src), 0, ibuf_size(src)); 551 goto done; 552 } 553 554 if (!sa->sa_hdr.sh_initiator) { 555 encr = sa->sa_key_iencr; 556 integr = sa->sa_key_iauth; 557 } else { 558 encr = sa->sa_key_rencr; 559 integr = sa->sa_key_rauth; 560 } 561 562 blocklen = cipher_length(sa->sa_encr); 563 ivlen = cipher_ivlength(sa->sa_encr); 564 ivoff = 0; 565 integrlen = hash_length(sa->sa_integr); 566 integroff = ibuf_size(src) - integrlen; 567 encroff = ivlen; 568 encrlen = ibuf_size(src) - integrlen - ivlen; 569 570 if (encrlen < 0 || integroff < 0) { 571 log_debug("%s: invalid integrity value", __func__); 572 goto done; 573 } 574 575 log_debug("%s: IV length %zd", __func__, ivlen); 576 print_hex(ibuf_data(src), 0, ivlen); 577 log_debug("%s: encrypted payload length %zd", __func__, encrlen); 578 print_hex(ibuf_data(src), encroff, encrlen); 579 log_debug("%s: integrity checksum length %zd", __func__, integrlen); 580 print_hex(ibuf_data(src), integroff, integrlen); 581 582 /* 583 * Validate packet checksum 584 */ 585 if ((tmp = ibuf_new(NULL, ibuf_length(integr))) == NULL) 586 goto done; 587 588 hash_setkey(sa->sa_integr, integr->buf, ibuf_length(integr)); 589 hash_init(sa->sa_integr); 590 hash_update(sa->sa_integr, ibuf_data(msg), 591 ibuf_size(msg) - integrlen); 592 hash_final(sa->sa_integr, tmp->buf, &tmplen); 593 594 if (memcmp(tmp->buf, ibuf_data(src) + integroff, integrlen) != 0) { 595 log_debug("%s: integrity check failed", __func__); 596 goto done; 597 } 598 599 log_debug("%s: integrity check succeeded", __func__); 600 print_hex(tmp->buf, 0, tmplen); 601 602 ibuf_release(tmp); 603 tmp = NULL; 604 605 /* 606 * Decrypt the payload and strip any padding 607 */ 608 if ((encrlen % blocklen) != 0) { 609 log_debug("%s: unaligned encrypted payload", __func__); 610 goto done; 611 } 612 613 cipher_setkey(sa->sa_encr, encr->buf, ibuf_length(encr)); 614 cipher_setiv(sa->sa_encr, ibuf_data(src) + ivoff, ivlen); 615 cipher_init_decrypt(sa->sa_encr); 616 617 if ((out = ibuf_new(NULL, cipher_outlength(sa->sa_encr, 618 encrlen))) == NULL) 619 goto done; 620 621 if ((outlen = ibuf_length(out)) != 0) { 622 cipher_update(sa->sa_encr, ibuf_data(src) + encroff, encrlen, 623 ibuf_data(out), &outlen); 624 625 ptr = ibuf_seek(out, outlen - 1, 1); 626 pad = *ptr; 627 } 628 629 log_debug("%s: decrypted payload length %zd/%zd padding %d", 630 __func__, outlen, encrlen, pad); 631 print_hex(ibuf_data(out), 0, ibuf_size(out)); 632 633 /* Strip padding and padding length */ 634 if (ibuf_setsize(out, outlen - pad - 1) != 0) 635 goto done; 636 637 ibuf_release(src); 638 return (out); 639 done: 640 ibuf_release(tmp); 641 ibuf_release(out); 642 ibuf_release(src); 643 return (NULL); 644 } 645 646 int 647 ikev2_check_frag_oversize(struct iked_sa *sa, struct ibuf *buf) { 648 size_t len = ibuf_length(buf); 649 sa_family_t sa_fam; 650 size_t max; 651 size_t ivlen, integrlen, blocklen; 652 653 sa_fam = ((struct sockaddr *)&sa->sa_local.addr)->sa_family; 654 655 max = sa_fam == AF_INET ? IKEV2_MAXLEN_IPV4_FRAG 656 : IKEV2_MAXLEN_IPV6_FRAG; 657 658 blocklen = cipher_length(sa->sa_encr); 659 ivlen = cipher_ivlength(sa->sa_encr); 660 integrlen = hash_length(sa->sa_integr); 661 662 /* Estimated maximum packet size (with 0 < padding < blocklen) */ 663 return ((len + ivlen + blocklen + integrlen) >= max) && sa->sa_frag; 664 } 665 666 int 667 ikev2_msg_send_encrypt(struct iked *env, struct iked_sa *sa, struct ibuf **ep, 668 uint8_t exchange, uint8_t firstpayload, int response) 669 { 670 struct iked_message resp; 671 struct ike_header *hdr; 672 struct ikev2_payload *pld; 673 struct ibuf *buf, *e = *ep; 674 int ret = -1; 675 676 /* Check if msg needs to be fragmented */ 677 if (ikev2_check_frag_oversize(sa, e)) { 678 return ikev2_send_encrypted_fragments(env, sa, e, exchange, 679 firstpayload, response); 680 } 681 682 if ((buf = ikev2_msg_init(env, &resp, &sa->sa_peer.addr, 683 sa->sa_peer.addr.ss_len, &sa->sa_local.addr, 684 sa->sa_local.addr.ss_len, response)) == NULL) 685 goto done; 686 687 resp.msg_msgid = response ? sa->sa_msgid_current : ikev2_msg_id(env, sa); 688 689 /* IKE header */ 690 if ((hdr = ikev2_add_header(buf, sa, resp.msg_msgid, IKEV2_PAYLOAD_SK, 691 exchange, response ? IKEV2_FLAG_RESPONSE : 0)) == NULL) 692 goto done; 693 694 if ((pld = ikev2_add_payload(buf)) == NULL) 695 goto done; 696 697 /* Encrypt message and add as an E payload */ 698 if ((e = ikev2_msg_encrypt(env, sa, e)) == NULL) { 699 log_debug("%s: encryption failed", __func__); 700 goto done; 701 } 702 if (ibuf_cat(buf, e) != 0) 703 goto done; 704 if (ikev2_next_payload(pld, ibuf_size(e), firstpayload) == -1) 705 goto done; 706 707 if (ikev2_set_header(hdr, ibuf_size(buf) - sizeof(*hdr)) == -1) 708 goto done; 709 710 /* Add integrity checksum (HMAC) */ 711 if (ikev2_msg_integr(env, sa, buf) != 0) { 712 log_debug("%s: integrity checksum failed", __func__); 713 goto done; 714 } 715 716 resp.msg_data = buf; 717 resp.msg_sa = sa; 718 resp.msg_fd = sa->sa_fd; 719 TAILQ_INIT(&resp.msg_proposals); 720 721 (void)ikev2_pld_parse(env, hdr, &resp, 0); 722 723 ret = ikev2_msg_send(env, &resp); 724 725 done: 726 /* e is cleaned up by the calling function */ 727 *ep = e; 728 ikev2_msg_cleanup(env, &resp); 729 730 return (ret); 731 } 732 733 int 734 ikev2_send_encrypted_fragments(struct iked *env, struct iked_sa *sa, 735 struct ibuf *in, uint8_t exchange, uint8_t firstpayload, int response) { 736 struct iked_message resp; 737 struct ibuf *buf, *e; 738 struct ike_header *hdr; 739 struct ikev2_payload *pld; 740 struct ikev2_frag_payload *frag; 741 sa_family_t sa_fam; 742 size_t ivlen, integrlen, blocklen; 743 size_t max_len, left, offset=0; 744 size_t frag_num = 1, frag_total; 745 uint8_t *data; 746 uint32_t msgid; 747 int ret = -1; 748 749 sa_fam = ((struct sockaddr *)&sa->sa_local.addr)->sa_family; 750 751 left = ibuf_length(in); 752 753 /* Calculate max allowed size of a fragments payload */ 754 blocklen = cipher_length(sa->sa_encr); 755 ivlen = cipher_ivlength(sa->sa_encr); 756 integrlen = hash_length(sa->sa_integr); 757 max_len = (sa_fam == AF_INET ? IKEV2_MAXLEN_IPV4_FRAG 758 : IKEV2_MAXLEN_IPV6_FRAG) 759 - ivlen - blocklen - integrlen; 760 761 /* Total number of fragments to send */ 762 frag_total = (left / max_len) + 1; 763 764 msgid = response ? sa->sa_msgid_current : ikev2_msg_id(env, sa); 765 766 while (frag_num <= frag_total) { 767 if ((buf = ikev2_msg_init(env, &resp, &sa->sa_peer.addr, 768 sa->sa_peer.addr.ss_len, &sa->sa_local.addr, 769 sa->sa_local.addr.ss_len, response)) == NULL) 770 goto done; 771 772 resp.msg_msgid = msgid; 773 774 /* IKE header */ 775 if ((hdr = ikev2_add_header(buf, sa, resp.msg_msgid, 776 IKEV2_PAYLOAD_SKF, exchange, response ? IKEV2_FLAG_RESPONSE 777 : 0)) == NULL) 778 goto done; 779 780 /* Payload header */ 781 if ((pld = ikev2_add_payload(buf)) == NULL) 782 goto done; 783 784 /* Fragment header */ 785 if ((frag = ibuf_advance(buf, sizeof(*frag))) == NULL) { 786 log_debug("%s: failed to add SKF fragment header", 787 __func__); 788 goto done; 789 } 790 frag->frag_num = htobe16(frag_num); 791 frag->frag_total = htobe16(frag_total); 792 793 /* Encrypt message and add as an E payload */ 794 data = ibuf_seek(in, offset, 0); 795 if((e=ibuf_new(data, MIN(left, max_len))) == NULL) { 796 goto done; 797 } 798 if ((e = ikev2_msg_encrypt(env, sa, e)) == NULL) { 799 log_debug("%s: encryption failed", __func__); 800 goto done; 801 } 802 if (ibuf_cat(buf, e) != 0) 803 goto done; 804 805 if (ikev2_next_payload(pld, ibuf_size(e) + sizeof(*frag), 806 firstpayload) == -1) 807 goto done; 808 809 if (ikev2_set_header(hdr, ibuf_size(buf) - sizeof(*hdr)) == -1) 810 goto done; 811 812 /* Add integrity checksum (HMAC) */ 813 if (ikev2_msg_integr(env, sa, buf) != 0) { 814 log_debug("%s: integrity checksum failed", __func__); 815 goto done; 816 } 817 818 log_debug("%s: Fragment %zu of %zu has size of %zu bytes.", 819 __func__, frag_num, frag_total, 820 ibuf_size(buf) - sizeof(*hdr)); 821 print_hex(ibuf_data(buf), 0, ibuf_size(buf)); 822 823 resp.msg_data = buf; 824 resp.msg_sa = sa; 825 resp.msg_fd = sa->sa_fd; 826 TAILQ_INIT(&resp.msg_proposals); 827 828 if (ikev2_msg_send(env, &resp) == -1) 829 goto done; 830 831 offset += MIN(left, max_len); 832 left -= MIN(left, max_len); 833 frag_num++; 834 835 /* MUST be zero after first fragment */ 836 firstpayload = 0; 837 838 ikev2_msg_cleanup(env, &resp); 839 ibuf_release(e); 840 e = NULL; 841 } 842 843 return 0; 844 done: 845 ikev2_msg_cleanup(env, &resp); 846 ibuf_release(e); 847 return ret; 848 } 849 850 struct ibuf * 851 ikev2_msg_auth(struct iked *env, struct iked_sa *sa, int response) 852 { 853 struct ibuf *authmsg = NULL, *nonce, *prfkey, *buf; 854 uint8_t *ptr; 855 struct iked_id *id; 856 size_t tmplen; 857 858 /* 859 * Create the payload to be signed/MAC'ed for AUTH 860 */ 861 862 if (!response) { 863 if ((nonce = sa->sa_rnonce) == NULL || 864 (sa->sa_iid.id_type == 0) || 865 (prfkey = sa->sa_key_iprf) == NULL || 866 (buf = sa->sa_1stmsg) == NULL) 867 return (NULL); 868 id = &sa->sa_iid; 869 } else { 870 if ((nonce = sa->sa_inonce) == NULL || 871 (sa->sa_rid.id_type == 0) || 872 (prfkey = sa->sa_key_rprf) == NULL || 873 (buf = sa->sa_2ndmsg) == NULL) 874 return (NULL); 875 id = &sa->sa_rid; 876 } 877 878 if ((authmsg = ibuf_dup(buf)) == NULL) 879 return (NULL); 880 if (ibuf_cat(authmsg, nonce) != 0) 881 goto fail; 882 883 if ((hash_setkey(sa->sa_prf, ibuf_data(prfkey), 884 ibuf_size(prfkey))) == NULL) 885 goto fail; 886 887 if ((ptr = ibuf_advance(authmsg, 888 hash_length(sa->sa_prf))) == NULL) 889 goto fail; 890 891 hash_init(sa->sa_prf); 892 hash_update(sa->sa_prf, ibuf_data(id->id_buf), ibuf_size(id->id_buf)); 893 hash_final(sa->sa_prf, ptr, &tmplen); 894 895 if (tmplen != hash_length(sa->sa_prf)) 896 goto fail; 897 898 log_debug("%s: %s auth data length %zu", 899 __func__, response ? "responder" : "initiator", 900 ibuf_size(authmsg)); 901 print_hex(ibuf_data(authmsg), 0, ibuf_size(authmsg)); 902 903 return (authmsg); 904 905 fail: 906 ibuf_release(authmsg); 907 return (NULL); 908 } 909 910 int 911 ikev2_msg_authverify(struct iked *env, struct iked_sa *sa, 912 struct iked_auth *auth, uint8_t *buf, size_t len, struct ibuf *authmsg) 913 { 914 uint8_t *key, *psk = NULL; 915 ssize_t keylen; 916 struct iked_id *id; 917 struct iked_dsa *dsa = NULL; 918 int ret = -1; 919 uint8_t keytype; 920 921 if (sa->sa_hdr.sh_initiator) 922 id = &sa->sa_rcert; 923 else 924 id = &sa->sa_icert; 925 926 if ((dsa = dsa_verify_new(auth->auth_method, sa->sa_prf)) == NULL) { 927 log_debug("%s: invalid auth method", __func__); 928 return (-1); 929 } 930 931 switch (auth->auth_method) { 932 case IKEV2_AUTH_SHARED_KEY_MIC: 933 if (!auth->auth_length) { 934 log_debug("%s: no pre-shared key found", __func__); 935 goto done; 936 } 937 if ((keylen = ikev2_psk(sa, auth->auth_data, 938 auth->auth_length, &psk)) == -1) { 939 log_debug("%s: failed to get PSK", __func__); 940 goto done; 941 } 942 key = psk; 943 keytype = 0; 944 break; 945 default: 946 if (!id->id_type || !ibuf_length(id->id_buf)) { 947 log_debug("%s: no cert found", __func__); 948 goto done; 949 } 950 key = ibuf_data(id->id_buf); 951 keylen = ibuf_size(id->id_buf); 952 keytype = id->id_type; 953 break; 954 } 955 956 log_debug("%s: method %s keylen %zd type %s", __func__, 957 print_map(auth->auth_method, ikev2_auth_map), keylen, 958 print_map(id->id_type, ikev2_cert_map)); 959 960 if (dsa_setkey(dsa, key, keylen, keytype) == NULL || 961 dsa_init(dsa, buf, len) != 0 || 962 dsa_update(dsa, ibuf_data(authmsg), ibuf_size(authmsg))) { 963 log_debug("%s: failed to compute digital signature", __func__); 964 goto done; 965 } 966 967 if ((ret = dsa_verify_final(dsa, buf, len)) == 0) { 968 log_debug("%s: authentication successful", __func__); 969 sa_state(env, sa, IKEV2_STATE_AUTH_SUCCESS); 970 sa_stateflags(sa, IKED_REQ_AUTHVALID); 971 } else { 972 log_debug("%s: authentication failed", __func__); 973 sa_state(env, sa, IKEV2_STATE_AUTH_REQUEST); 974 } 975 976 done: 977 free(psk); 978 dsa_free(dsa); 979 980 return (ret); 981 } 982 983 int 984 ikev2_msg_authsign(struct iked *env, struct iked_sa *sa, 985 struct iked_auth *auth, struct ibuf *authmsg) 986 { 987 uint8_t *key, *psk = NULL; 988 ssize_t keylen, siglen; 989 struct iked_hash *prf = sa->sa_prf; 990 struct iked_id *id; 991 struct iked_dsa *dsa = NULL; 992 struct ibuf *buf; 993 int ret = -1; 994 uint8_t keytype; 995 996 if (sa->sa_hdr.sh_initiator) 997 id = &sa->sa_icert; 998 else 999 id = &sa->sa_rcert; 1000 1001 if ((dsa = dsa_sign_new(auth->auth_method, prf)) == NULL) { 1002 log_debug("%s: invalid auth method", __func__); 1003 return (-1); 1004 } 1005 1006 switch (auth->auth_method) { 1007 case IKEV2_AUTH_SHARED_KEY_MIC: 1008 if (!auth->auth_length) { 1009 log_debug("%s: no pre-shared key found", __func__); 1010 goto done; 1011 } 1012 if ((keylen = ikev2_psk(sa, auth->auth_data, 1013 auth->auth_length, &psk)) == -1) { 1014 log_debug("%s: failed to get PSK", __func__); 1015 goto done; 1016 } 1017 key = psk; 1018 keytype = 0; 1019 break; 1020 default: 1021 if (id == NULL) { 1022 log_debug("%s: no cert found", __func__); 1023 goto done; 1024 } 1025 key = ibuf_data(id->id_buf); 1026 keylen = ibuf_size(id->id_buf); 1027 keytype = id->id_type; 1028 break; 1029 } 1030 1031 if (dsa_setkey(dsa, key, keylen, keytype) == NULL || 1032 dsa_init(dsa, NULL, 0) != 0 || 1033 dsa_update(dsa, ibuf_data(authmsg), ibuf_size(authmsg))) { 1034 log_debug("%s: failed to compute digital signature", __func__); 1035 goto done; 1036 } 1037 1038 ibuf_release(sa->sa_localauth.id_buf); 1039 sa->sa_localauth.id_buf = NULL; 1040 1041 if ((buf = ibuf_new(NULL, dsa_length(dsa))) == NULL) { 1042 log_debug("%s: failed to get auth buffer", __func__); 1043 goto done; 1044 } 1045 1046 if ((siglen = dsa_sign_final(dsa, 1047 ibuf_data(buf), ibuf_size(buf))) < 0) { 1048 log_debug("%s: failed to create auth signature", __func__); 1049 ibuf_release(buf); 1050 goto done; 1051 } 1052 1053 if (ibuf_setsize(buf, siglen) < 0) { 1054 log_debug("%s: failed to set auth signature size to %zd", 1055 __func__, siglen); 1056 ibuf_release(buf); 1057 goto done; 1058 } 1059 1060 sa->sa_localauth.id_type = auth->auth_method; 1061 sa->sa_localauth.id_buf = buf; 1062 1063 ret = 0; 1064 done: 1065 free(psk); 1066 dsa_free(dsa); 1067 1068 return (ret); 1069 } 1070 1071 int 1072 ikev2_msg_frompeer(struct iked_message *msg) 1073 { 1074 struct iked_sa *sa = msg->msg_sa; 1075 struct ike_header *hdr; 1076 1077 msg = msg->msg_parent; 1078 1079 if (sa == NULL || 1080 (hdr = ibuf_seek(msg->msg_data, 0, sizeof(*hdr))) == NULL) 1081 return (0); 1082 1083 if (!sa->sa_hdr.sh_initiator && 1084 (hdr->ike_flags & IKEV2_FLAG_INITIATOR)) 1085 return (1); 1086 else if (sa->sa_hdr.sh_initiator && 1087 (hdr->ike_flags & IKEV2_FLAG_INITIATOR) == 0) 1088 return (1); 1089 1090 return (0); 1091 } 1092 1093 struct iked_socket * 1094 ikev2_msg_getsocket(struct iked *env, int af, int natt) 1095 { 1096 switch (af) { 1097 case AF_INET: 1098 return (env->sc_sock4[natt ? 1 : 0]); 1099 case AF_INET6: 1100 return (env->sc_sock6[natt ? 1 : 0]); 1101 } 1102 1103 log_debug("%s: af socket %d not available", __func__, af); 1104 return (NULL); 1105 } 1106 1107 void 1108 ikev2_msg_prevail(struct iked *env, struct iked_msgqueue *queue, 1109 struct iked_message *msg) 1110 { 1111 struct iked_message *m, *mtmp; 1112 1113 TAILQ_FOREACH_SAFE(m, queue, msg_entry, mtmp) { 1114 if (m->msg_msgid < msg->msg_msgid) 1115 ikev2_msg_dispose(env, queue, m); 1116 } 1117 } 1118 1119 void 1120 ikev2_msg_dispose(struct iked *env, struct iked_msgqueue *queue, 1121 struct iked_message *msg) 1122 { 1123 TAILQ_REMOVE(queue, msg, msg_entry); 1124 timer_del(env, &msg->msg_timer); 1125 ikev2_msg_cleanup(env, msg); 1126 free(msg); 1127 } 1128 1129 void 1130 ikev2_msg_flushqueue(struct iked *env, struct iked_msgqueue *queue) 1131 { 1132 struct iked_message *m = NULL; 1133 1134 while ((m = TAILQ_FIRST(queue)) != NULL) 1135 ikev2_msg_dispose(env, queue, m); 1136 } 1137 1138 struct iked_message * 1139 ikev2_msg_lookup(struct iked *env, struct iked_msgqueue *queue, 1140 struct iked_message *msg, struct ike_header *hdr) 1141 { 1142 struct iked_message *m = NULL; 1143 1144 TAILQ_FOREACH(m, queue, msg_entry) { 1145 if (m->msg_msgid == msg->msg_msgid && 1146 m->msg_exchange == hdr->ike_exchange) 1147 break; 1148 } 1149 1150 return (m); 1151 } 1152 1153 void 1154 ikev2_msg_lookup_dispose_all(struct iked *env, struct iked_msgqueue *queue, 1155 struct iked_message *msg, struct ike_header *hdr) 1156 { 1157 struct iked_message *m = NULL, *tmp = NULL; 1158 1159 TAILQ_FOREACH_SAFE(m, queue, msg_entry, tmp) { 1160 if (m->msg_msgid == msg->msg_msgid && 1161 m->msg_exchange == hdr->ike_exchange) { 1162 TAILQ_REMOVE(queue, m, msg_entry); 1163 timer_del(env, &m->msg_timer); 1164 ikev2_msg_cleanup(env, m); 1165 free(m); 1166 } 1167 } 1168 } 1169 1170 int 1171 ikev2_msg_lookup_retransmit_all(struct iked *env, struct iked_msgqueue *queue, 1172 struct iked_message *msg, struct ike_header *hdr, struct iked_sa *sa) 1173 { 1174 struct iked_message *m = NULL, *tmp = NULL; 1175 int count = 0; 1176 1177 TAILQ_FOREACH_SAFE(m, queue, msg_entry, tmp) { 1178 if (m->msg_msgid == msg->msg_msgid && 1179 m->msg_exchange == hdr->ike_exchange) { 1180 if (ikev2_msg_retransmit_response(env, sa, m)) 1181 return -1; 1182 count++; 1183 } 1184 } 1185 return count; 1186 } 1187 1188 int 1189 ikev2_msg_retransmit_response(struct iked *env, struct iked_sa *sa, 1190 struct iked_message *msg) 1191 { 1192 if (sendtofrom(msg->msg_fd, ibuf_data(msg->msg_data), 1193 ibuf_size(msg->msg_data), 0, 1194 (struct sockaddr *)&msg->msg_peer, msg->msg_peerlen, 1195 (struct sockaddr *)&msg->msg_local, msg->msg_locallen) == -1) { 1196 log_warn("%s: sendtofrom", __func__); 1197 return (-1); 1198 } 1199 1200 timer_add(env, &msg->msg_timer, IKED_RESPONSE_TIMEOUT); 1201 return (0); 1202 } 1203 1204 void 1205 ikev2_msg_response_timeout(struct iked *env, void *arg) 1206 { 1207 struct iked_message *msg = arg; 1208 struct iked_sa *sa = msg->msg_sa; 1209 1210 ikev2_msg_dispose(env, &sa->sa_responses, msg); 1211 } 1212 1213 void 1214 ikev2_msg_retransmit_timeout(struct iked *env, void *arg) 1215 { 1216 struct iked_message *msg = arg; 1217 struct iked_sa *sa = msg->msg_sa; 1218 1219 if (msg->msg_tries < IKED_RETRANSMIT_TRIES) { 1220 if (sendtofrom(msg->msg_fd, ibuf_data(msg->msg_data), 1221 ibuf_size(msg->msg_data), 0, 1222 (struct sockaddr *)&msg->msg_peer, msg->msg_peerlen, 1223 (struct sockaddr *)&msg->msg_local, 1224 msg->msg_locallen) == -1) { 1225 log_warn("%s: sendtofrom", __func__); 1226 ikev2_ike_sa_setreason(sa, "retransmit failed"); 1227 sa_free(env, sa); 1228 return; 1229 } 1230 /* Exponential timeout */ 1231 timer_add(env, &msg->msg_timer, 1232 IKED_RETRANSMIT_TIMEOUT * (2 << (msg->msg_tries++))); 1233 } else { 1234 log_debug("%s: retransmit limit reached for msgid %u", 1235 __func__, msg->msg_msgid); 1236 ikev2_ike_sa_setreason(sa, "retransmit limit reached"); 1237 sa_free(env, sa); 1238 } 1239 } 1240