1 /* $OpenBSD: ike_main_mode.c,v 1.11 1999/04/27 21:11:53 niklas Exp $ */ 2 /* $EOM: ike_main_mode.c,v 1.77 1999/04/25 22:12:34 niklas Exp $ */ 3 4 /* 5 * Copyright (c) 1998, 1999 Niklas Hallqvist. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. All advertising materials mentioning features or use of this software 16 * must display the following acknowledgement: 17 * This product includes software developed by Ericsson Radio Systems. 18 * 4. The name of the author may not be used to endorse or promote products 19 * derived from this software without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 26 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 /* 34 * This code was written under funding by Ericsson Radio Systems. 35 */ 36 37 #include <sys/types.h> 38 #include <netinet/in.h> 39 #include <stdlib.h> 40 #include <string.h> 41 42 #include "sysdep.h" 43 44 #include "attribute.h" 45 #include "conf.h" 46 #include "constants.h" 47 #include "crypto.h" 48 #include "dh.h" 49 #include "doi.h" 50 #include "exchange.h" 51 #include "hash.h" 52 #include "ike_auth.h" 53 #include "ike_main_mode.h" 54 #include "ike_phase_1.h" 55 #include "ipsec.h" 56 #include "ipsec_doi.h" 57 #include "isakmp.h" 58 #include "log.h" 59 #include "math_group.h" 60 #include "message.h" 61 #include "prf.h" 62 #include "sa.h" 63 #include "transport.h" 64 #include "util.h" 65 66 static int initiator_send_ID_AUTH (struct message *); 67 static int responder_send_ID_AUTH (struct message *); 68 static int responder_send_KE_NONCE (struct message *); 69 70 int (*ike_main_mode_initiator[]) (struct message *) = { 71 ike_phase_1_initiator_send_SA, 72 ike_phase_1_initiator_recv_SA, 73 ike_phase_1_initiator_send_KE_NONCE, 74 ike_phase_1_initiator_recv_KE_NONCE, 75 initiator_send_ID_AUTH, 76 ike_phase_1_recv_ID_AUTH 77 }; 78 79 int (*ike_main_mode_responder[]) (struct message *) = { 80 ike_phase_1_responder_recv_SA, 81 ike_phase_1_responder_send_SA, 82 ike_phase_1_recv_KE_NONCE, 83 responder_send_KE_NONCE, 84 ike_phase_1_recv_ID_AUTH, 85 responder_send_ID_AUTH 86 }; 87 88 static int 89 initiator_send_ID_AUTH (struct message *msg) 90 { 91 msg->exchange->flags |= EXCHANGE_FLAG_ENCRYPT; 92 93 if (ike_phase_1_send_ID (msg)) 94 return -1; 95 96 if (ike_phase_1_send_AUTH (msg)) 97 return -1; 98 99 return ipsec_initial_contact (msg); 100 } 101 102 /* Send our public DH value and a nonce to the initiator. */ 103 int 104 responder_send_KE_NONCE (struct message *msg) 105 { 106 /* XXX Should we really just use the initiator's nonce size? */ 107 if (ike_phase_1_send_KE_NONCE (msg, msg->exchange->nonce_i_len)) 108 return -1; 109 110 /* 111 * Calculate DH values & key material in parallel with the message going 112 * on a roundtrip over the wire. 113 */ 114 message_register_post_send (msg, 115 (void (*) (struct message *)) 116 ike_phase_1_post_exchange_KE_NONCE); 117 118 return 0; 119 } 120 121 static int 122 responder_send_ID_AUTH (struct message *msg) 123 { 124 msg->exchange->flags |= EXCHANGE_FLAG_ENCRYPT; 125 126 if (ike_phase_1_responder_send_ID_AUTH (msg)) 127 return -1; 128 129 return ipsec_initial_contact (msg); 130 } 131