1c22845a5465a8fea2368bf1f4bd7b6b8872731a
[strongswan.git] / src / pluto / modecfg.c
1 /* Mode config related functions
2 * Copyright (C) 2001-2002 Colubris Networks
3 * Copyright (C) 2003 Sean Mathews - Nu Tech Software Solutions, inc.
4 * Copyright (C) 2003-2004 Xelerance Corporation
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 *
16 * RCSID $Id: modecfg.c,v 1.6 2006/04/24 20:44:57 as Exp $
17 *
18 * This code originally written by Colubris Networks, Inc.
19 * Extraction of patch and porting to 1.99 codebases by Xelerance Corporation
20 * Porting to 2.x by Sean Mathews
21 */
22
23 #include <stdio.h>
24 #include <stdlib.h>
25 #include <string.h>
26
27 #include <freeswan.h>
28
29 #include "constants.h"
30 #include "defs.h"
31 #include "state.h"
32 #include "demux.h"
33 #include "timer.h"
34 #include "ipsec_doi.h"
35 #include "log.h"
36 #include "md5.h"
37 #include "sha1.h"
38 #include "crypto.h"
39 #include "modecfg.h"
40 #include "whack.h"
41
42 /*
43 * Addresses assigned (usually via MODE_CONFIG) to the Initiator
44 */
45 struct internal_addr
46 {
47 ip_address ipaddr;
48 ip_address dns[2];
49 ip_address wins[2];
50 };
51
52 /*
53 * Get inside IP address for a connection
54 */
55 static void
56 get_internal_addresses(struct connection *c, struct internal_addr *ia)
57 {
58 zero(ia);
59
60 if (isanyaddr(&c->spd.that.host_srcip))
61 {
62 /* not defined in connection - fetch it from LDAP */
63 }
64 else
65 {
66 ia->ipaddr = c->spd.that.host_srcip;
67 }
68 }
69
70 /*
71 * Compute HASH of Mode Config.
72 */
73 static size_t
74 mode_cfg_hash(u_char *dest, const u_char *start, const u_char *roof
75 , const struct state *st)
76 {
77 struct hmac_ctx ctx;
78
79 hmac_init_chunk(&ctx, st->st_oakley.hasher, st->st_skeyid_a);
80 hmac_update(&ctx, (const u_char *) &st->st_msgid, sizeof(st->st_msgid));
81 hmac_update(&ctx, start, roof-start);
82 hmac_final(dest, &ctx);
83
84 DBG(DBG_CRYPT,
85 DBG_log("MODE CFG: HASH computed:");
86 DBG_dump("", dest, ctx.hmac_digest_size)
87 )
88 return ctx.hmac_digest_size;
89 }
90
91
92 /* Mode Config Reply
93 * Generates a reply stream containing Mode Config information (eg: IP, DNS, WINS)
94 */
95 stf_status modecfg_resp(struct state *st
96 , u_int resp
97 , pb_stream *rbody
98 , u_int16_t replytype
99 , bool hackthat
100 , u_int16_t ap_id)
101 {
102 u_char *r_hash_start,*r_hashval;
103
104 /* START_HASH_PAYLOAD(rbody, ISAKMP_NEXT_ATTR); */
105
106 {
107 pb_stream hash_pbs;
108 int np = ISAKMP_NEXT_ATTR;
109
110 if (!out_generic(np, &isakmp_hash_desc, rbody, &hash_pbs))
111 return STF_INTERNAL_ERROR;
112 r_hashval = hash_pbs.cur; /* remember where to plant value */
113 if (!out_zero(st->st_oakley.hasher->hash_digest_size, &hash_pbs, "HASH"))
114 return STF_INTERNAL_ERROR;
115 close_output_pbs(&hash_pbs);
116 r_hash_start = (rbody)->cur; /* hash from after HASH payload */
117 }
118
119 /* ATTR out */
120 {
121 struct isakmp_mode_attr attrh;
122 struct isakmp_attribute attr;
123 pb_stream strattr,attrval;
124 int attr_type;
125 struct internal_addr ia;
126 int dns_idx, wins_idx;
127 bool dont_advance;
128
129 attrh.isama_np = ISAKMP_NEXT_NONE;
130 attrh.isama_type = replytype;
131
132 attrh.isama_identifier = ap_id;
133 if (!out_struct(&attrh, &isakmp_attr_desc, rbody, &strattr))
134 return STF_INTERNAL_ERROR;
135
136 get_internal_addresses(st->st_connection, &ia);
137
138 if (!isanyaddr(&ia.dns[0])) /* We got DNS addresses, answer with those */
139 resp |= LELEM(INTERNAL_IP4_DNS);
140 else
141 resp &= ~LELEM(INTERNAL_IP4_DNS);
142
143 if (!isanyaddr(&ia.wins[0])) /* We got WINS addresses, answer with those */
144 resp |= LELEM(INTERNAL_IP4_NBNS);
145 else
146 resp &= ~LELEM(INTERNAL_IP4_NBNS);
147
148 if (hackthat)
149 {
150 if (memcmp(&st->st_connection->spd.that.client.addr
151 ,&ia.ipaddr
152 ,sizeof(ia.ipaddr)) != 0)
153 {
154 /* Make the Internal IP address and Netmask
155 * as that client address
156 */
157 st->st_connection->spd.that.client.addr = ia.ipaddr;
158 st->st_connection->spd.that.client.maskbits = 32;
159 st->st_connection->spd.that.has_client = TRUE;
160 }
161 }
162
163 attr_type = 0;
164 dns_idx = 0;
165 wins_idx = 0;
166
167 while (resp != 0)
168 {
169 dont_advance = FALSE;
170 if (resp & 1)
171 {
172 const u_char *byte_ptr;
173 u_int len;
174
175 /* ISAKMP attr out */
176 attr.isaat_af_type = attr_type | ISAKMP_ATTR_AF_TLV;
177 out_struct(&attr, &isakmp_modecfg_attribute_desc, &strattr, &attrval);
178
179 switch (attr_type)
180 {
181 case INTERNAL_IP4_ADDRESS:
182 {
183 char srcip[ADDRTOT_BUF];
184
185 addrtot(&ia.ipaddr, 0, srcip, sizeof(srcip));
186 plog("assigning virtual IP source address %s", srcip);
187 len = addrbytesptr(&ia.ipaddr, &byte_ptr);
188 out_raw(byte_ptr,len,&attrval,"IP4_addr");
189 }
190 break;
191 case INTERNAL_IP4_NETMASK:
192 {
193 u_int mask;
194 #if 0
195 char mask[4],bits[8]={0x00,0x80,0xc0,0xe0,0xf0,0xf8,0xfc,0xfe};
196 int t,m=st->st_connection->that.host_addr.maskbit;
197 for (t=0; t<4; t++)
198 {
199 if (m < 8)
200 mask[t] = bits[m];
201 else
202 mask[t] = 0xff;
203 m -= 8;
204 }
205 #endif
206 if (st->st_connection->spd.this.client.maskbits == 0)
207 mask = 0;
208 else
209 mask = 0xffffffff * 1;
210 out_raw(&mask,4,&attrval,"IP4_mask");
211 }
212 break;
213 case INTERNAL_IP4_SUBNET:
214 {
215 char mask[4];
216 char bits[8] = {0x00,0x80,0xc0,0xe0,0xf0,0xf8,0xfc,0xfe};
217 int t;
218 int m = st->st_connection->spd.this.client.maskbits;
219
220 for (t = 0; t < 4; t++)
221 {
222 if (m < 8)
223 mask[t] = bits[m];
224 else
225 mask[t] = 0xff;
226 m -= 8;
227 if (m < 0)
228 m = 0;
229 }
230 len = addrbytesptr(&st->st_connection->spd.this.client.addr, &byte_ptr);
231 out_raw(byte_ptr,len,&attrval,"IP4_subnet");
232 out_raw(mask,sizeof(mask),&attrval,"IP4_submsk");
233 }
234 break;
235 case INTERNAL_IP4_DNS:
236 len = addrbytesptr(&ia.dns[dns_idx++], &byte_ptr);
237 out_raw(byte_ptr,len,&attrval,"IP4_dns");
238 if (dns_idx < 2 && !isanyaddr(&ia.dns[dns_idx]))
239 {
240 dont_advance = TRUE;
241 }
242 break;
243 case INTERNAL_IP4_NBNS:
244 len = addrbytesptr(&ia.wins[wins_idx++], &byte_ptr);
245 out_raw(byte_ptr,len,&attrval,"IP4_wins");
246 if (wins_idx < 2 && !isanyaddr(&ia.wins[wins_idx]))
247 {
248 dont_advance = TRUE;
249 }
250 break;
251 default:
252 plog("attempt to send unsupported mode cfg attribute %s."
253 , enum_show(&modecfg_attr_names, attr_type));
254 break;
255 }
256 close_output_pbs(&attrval);
257
258 }
259 if (!dont_advance)
260 {
261 attr_type++;
262 resp >>= 1;
263 }
264 }
265 close_message(&strattr);
266 }
267
268 mode_cfg_hash(r_hashval,r_hash_start,rbody->cur,st);
269 close_message(rbody);
270 encrypt_message(rbody, st);
271 return STF_OK;
272 }
273
274 /* Set MODE_CONFIG data to client.
275 * Pack IP Addresses, DNS, etc... and ship
276 */
277 stf_status modecfg_send_set(struct state *st)
278 {
279 pb_stream reply,rbody;
280 char buf[256];
281
282 /* set up reply */
283 init_pbs(&reply, buf, sizeof(buf), "ModecfgR1");
284
285 st->st_state = STATE_MODE_CFG_R1;
286 /* HDR out */
287 {
288 struct isakmp_hdr hdr;
289
290 zero(&hdr); /* default to 0 */
291 hdr.isa_version = ISAKMP_MAJOR_VERSION << ISA_MAJ_SHIFT | ISAKMP_MINOR_VERSION;
292 hdr.isa_np = ISAKMP_NEXT_HASH;
293 hdr.isa_xchg = ISAKMP_XCHG_MODE_CFG;
294 hdr.isa_flags = ISAKMP_FLAG_ENCRYPTION;
295 memcpy(hdr.isa_icookie, st->st_icookie, COOKIE_SIZE);
296 memcpy(hdr.isa_rcookie, st->st_rcookie, COOKIE_SIZE);
297 hdr.isa_msgid = st->st_msgid;
298
299 if (!out_struct(&hdr, &isakmp_hdr_desc, &reply, &rbody))
300 {
301 return STF_INTERNAL_ERROR;
302 }
303 }
304
305 #define MODECFG_SET_ITEM ( LELEM(INTERNAL_IP4_ADDRESS) | LELEM(INTERNAL_IP4_SUBNET) | LELEM(INTERNAL_IP4_NBNS) | LELEM(INTERNAL_IP4_DNS) )
306
307 modecfg_resp(st, MODECFG_SET_ITEM
308 , &rbody
309 , ISAKMP_CFG_SET
310 , TRUE
311 , 0/* XXX ID */);
312 #undef MODECFG_SET_ITEM
313
314 clonetochunk(st->st_tpacket, reply.start
315 , pbs_offset(&reply), "ModeCfg set");
316
317 /* Transmit */
318 send_packet(st, "ModeCfg set");
319
320 /* RETRANSMIT if Main, SA_REPLACE if Aggressive */
321 if (st->st_event->ev_type != EVENT_RETRANSMIT
322 && st->st_event->ev_type != EVENT_NULL)
323 {
324 delete_event(st);
325 event_schedule(EVENT_RETRANSMIT, EVENT_RETRANSMIT_DELAY_0, st);
326 }
327
328 return STF_OK;
329 }
330
331 /* Set MODE_CONFIG data to client.
332 * Pack IP Addresses, DNS, etc... and ship
333 */
334 stf_status
335 modecfg_start_set(struct state *st)
336 {
337 if (st->st_msgid == 0)
338 {
339 /* pick a new message id */
340 st->st_msgid = generate_msgid(st);
341 }
342 st->st_modecfg.vars_set = TRUE;
343
344 return modecfg_send_set(st);
345 }
346
347 /*
348 * Send modecfg IP address request (IP4 address)
349 */
350 stf_status
351 modecfg_send_request(struct state *st)
352 {
353 pb_stream reply;
354 pb_stream rbody;
355 char buf[256];
356 u_char *r_hash_start,*r_hashval;
357
358 /* set up reply */
359 init_pbs(&reply, buf, sizeof(buf), "modecfg_buf");
360
361 plog("sending ModeCfg request");
362
363 /* this is the beginning of a new exchange */
364 st->st_msgid = generate_msgid(st);
365 st->st_state = STATE_MODE_CFG_I1;
366
367 /* HDR out */
368 {
369 struct isakmp_hdr hdr;
370
371 zero(&hdr); /* default to 0 */
372 hdr.isa_version = ISAKMP_MAJOR_VERSION << ISA_MAJ_SHIFT | ISAKMP_MINOR_VERSION;
373 hdr.isa_np = ISAKMP_NEXT_HASH;
374 hdr.isa_xchg = ISAKMP_XCHG_MODE_CFG;
375 hdr.isa_flags = ISAKMP_FLAG_ENCRYPTION;
376 memcpy(hdr.isa_icookie, st->st_icookie, COOKIE_SIZE);
377 memcpy(hdr.isa_rcookie, st->st_rcookie, COOKIE_SIZE);
378 hdr.isa_msgid = st->st_msgid;
379
380 if (!out_struct(&hdr, &isakmp_hdr_desc, &reply, &rbody))
381 {
382 return STF_INTERNAL_ERROR;
383 }
384 }
385
386 START_HASH_PAYLOAD(rbody, ISAKMP_NEXT_ATTR);
387
388 /* ATTR out */
389 {
390 struct isakmp_mode_attr attrh;
391 struct isakmp_attribute attr;
392 pb_stream strattr;
393
394 attrh.isama_np = ISAKMP_NEXT_NONE;
395 attrh.isama_type = ISAKMP_CFG_REQUEST;
396 attrh.isama_identifier = 0;
397 if (!out_struct(&attrh, &isakmp_attr_desc, &rbody, &strattr))
398 return STF_INTERNAL_ERROR;
399 /* ISAKMP attr out (ipv4) */
400 attr.isaat_af_type = INTERNAL_IP4_ADDRESS;
401 attr.isaat_lv = 0;
402 out_struct(&attr, &isakmp_modecfg_attribute_desc, &strattr, NULL);
403
404 /* ISAKMP attr out (netmask) */
405 attr.isaat_af_type = INTERNAL_IP4_NETMASK;
406 attr.isaat_lv = 0;
407 out_struct(&attr, &isakmp_modecfg_attribute_desc, &strattr, NULL);
408
409 close_message(&strattr);
410 }
411
412 mode_cfg_hash(r_hashval,r_hash_start,rbody.cur,st);
413
414 close_message(&rbody);
415 close_output_pbs(&reply);
416
417 init_phase2_iv(st, &st->st_msgid);
418 encrypt_message(&rbody, st);
419
420 clonetochunk(st->st_tpacket, reply.start, pbs_offset(&reply)
421 , "modecfg: req");
422
423 /* Transmit */
424 send_packet(st, "modecfg: req");
425
426 /* RETRANSMIT if Main, SA_REPLACE if Aggressive */
427 if (st->st_event->ev_type != EVENT_RETRANSMIT)
428 {
429 delete_event(st);
430 event_schedule(EVENT_RETRANSMIT, EVENT_RETRANSMIT_DELAY_0 * 3, st);
431 }
432 st->st_modecfg.started = TRUE;
433
434 return STF_OK;
435 }
436
437 /*
438 * parse a modecfg attribute payload
439 */
440 static stf_status
441 modecfg_parse_attributes(pb_stream *attrs, u_int *set)
442 {
443 struct isakmp_attribute attr;
444 pb_stream strattr;
445
446 while (pbs_left(attrs) > sizeof(struct isakmp_attribute))
447 {
448 if (!in_struct(&attr, &isakmp_modecfg_attribute_desc, attrs, &strattr))
449 {
450 int len = (attr.isaat_af_type & 0x8000)? 4 : attr.isaat_lv;
451
452 if (len < 4)
453 {
454 plog("Attribute was too short: %d", len);
455 return STF_FAIL;
456 }
457
458 attrs->cur += len;
459 }
460
461 switch (attr.isaat_af_type & ISAKMP_ATTR_RTYPE_MASK )
462 {
463 case INTERNAL_IP4_ADDRESS:
464 case INTERNAL_IP4_NETMASK:
465 case INTERNAL_IP4_DNS:
466 case INTERNAL_IP4_SUBNET:
467 case INTERNAL_IP4_NBNS:
468 *set |= LELEM(attr.isaat_af_type);
469 break;
470 default:
471 plog("unsupported mode cfg attribute %s received."
472 , enum_show(&modecfg_attr_names
473 , attr.isaat_af_type & ISAKMP_ATTR_RTYPE_MASK ));
474 break;
475 }
476 }
477 return STF_OK;
478 }
479
480 /* STATE_MODE_CFG_R0:
481 * HDR*, HASH, ATTR(REQ=IP) --> HDR*, HASH, ATTR(REPLY=IP)
482 *
483 * This state occurs both in the responder and in the initiator.
484 *
485 * In the responding server, it occurs when the client *asks* for an IP
486 * address or other information.
487 *
488 * Otherwise, it occurs in the initiator when the server sends a challenge
489 * a set, or has a reply to our request.
490 */
491 stf_status
492 modecfg_inR0(struct msg_digest *md)
493 {
494 struct state *const st = md->st;
495 struct payload_digest *p;
496 stf_status stat;
497
498 plog("received ModeCfg request");
499
500 st->st_msgid = md->hdr.isa_msgid;
501 CHECK_QUICK_HASH(md, mode_cfg_hash(hash_val
502 ,hash_pbs->roof
503 , md->message_pbs.roof, st)
504 , "MODECFG-HASH", "MODE R0");
505
506 /* process the MODECFG payloads therein */
507 for (p = md->chain[ISAKMP_NEXT_ATTR]; p != NULL; p = p->next)
508 {
509 u_int set_modecfg_attrs = LEMPTY;
510
511 switch (p->payload.attribute.isama_type)
512 {
513 default:
514 plog("Expecting ISAKMP_CFG_REQUEST, got %s instead (ignored)."
515 , enum_name(&attr_msg_type_names
516 , p->payload.attribute.isama_type));
517
518 stat = modecfg_parse_attributes(&p->pbs, &set_modecfg_attrs);
519 if (stat != STF_OK)
520 return stat;
521 break;
522
523 case ISAKMP_CFG_REQUEST:
524 stat = modecfg_parse_attributes(&p->pbs, &set_modecfg_attrs);
525 if (stat != STF_OK)
526 return stat;
527
528 stat = modecfg_resp(st, set_modecfg_attrs
529 ,&md->rbody
530 ,ISAKMP_CFG_REPLY
531 ,TRUE
532 ,p->payload.attribute.isama_identifier);
533
534 if (stat != STF_OK)
535 {
536 /* notification payload - not exactly the right choice, but okay */
537 md->note = CERTIFICATE_UNAVAILABLE;
538 return stat;
539 }
540
541 /* they asked us, we responded, msgid is done */
542 st->st_msgid = 0;
543 }
544 }
545 return STF_OK;
546 }
547
548 /* STATE_MODE_CFG_R2:
549 * HDR*, HASH, ATTR(SET=IP) --> HDR*, HASH, ATTR(ACK,OK)
550 *
551 * used in server push mode, on the client (initiator).
552 */
553 static stf_status
554 modecfg_inI2(struct msg_digest *md)
555 {
556 struct state *const st = md->st;
557 pb_stream *attrs = &md->chain[ISAKMP_NEXT_ATTR]->pbs;
558 int resp = LEMPTY;
559 stf_status stat;
560 struct payload_digest *p;
561 u_int16_t isama_id = 0;
562
563 st->st_msgid = md->hdr.isa_msgid;
564 CHECK_QUICK_HASH(md
565 , mode_cfg_hash(hash_val
566 ,hash_pbs->roof
567 , md->message_pbs.roof
568 , st)
569 , "MODECFG-HASH", "MODE R1");
570
571 for (p = md->chain[ISAKMP_NEXT_ATTR]; p != NULL; p = p->next)
572 {
573 struct isakmp_attribute attr;
574 pb_stream strattr;
575
576 isama_id = p->payload.attribute.isama_identifier;
577
578 if (p->payload.attribute.isama_type != ISAKMP_CFG_SET)
579 {
580 plog("Expecting MODE_CFG_SET, got %x instead."
581 ,md->chain[ISAKMP_NEXT_ATTR]->payload.attribute.isama_type);
582 return STF_IGNORE;
583 }
584
585 /* CHECK that SET has been received. */
586
587 while (pbs_left(attrs) > sizeof(struct isakmp_attribute))
588 {
589 if (!in_struct(&attr, &isakmp_modecfg_attribute_desc
590 , attrs, &strattr))
591 {
592 int len;
593
594 /* Skip unknown */
595 if (attr.isaat_af_type & 0x8000)
596 len = 4;
597 else
598 len = attr.isaat_lv;
599
600 if (len < 4)
601 {
602 plog("Attribute was too short: %d", len);
603 return STF_FAIL;
604 }
605
606 attrs->cur += len;
607 }
608
609 switch (attr.isaat_af_type & ISAKMP_ATTR_RTYPE_MASK )
610 {
611 case INTERNAL_IP4_ADDRESS:
612 {
613 struct connection *c = st->st_connection;
614 ip_address a;
615 u_int32_t *ap = (u_int32_t *)(strattr.cur);
616 a.u.v4.sin_family = AF_INET;
617
618 memcpy(&a.u.v4.sin_addr.s_addr, ap
619 , sizeof(a.u.v4.sin_addr.s_addr));
620
621 if (addrbytesptr(&c->spd.this.host_srcip, NULL) == 0
622 || isanyaddr(&c->spd.this.host_srcip))
623 {
624 char srcip[ADDRTOT_BUF];
625
626 c->spd.this.host_srcip = a;
627 addrtot(&a, 0, srcip, sizeof(srcip));
628 plog("setting virtual IP source address to %s", srcip);
629 }
630
631 /* setting client subnet as srcip/32 */
632 addrtosubnet(&a, &c->spd.this.client);
633 c->spd.this.has_client = TRUE;
634 }
635 resp |= LELEM(attr.isaat_af_type);
636 break;
637 case INTERNAL_IP4_NETMASK:
638 case INTERNAL_IP4_DNS:
639 case INTERNAL_IP4_SUBNET:
640 case INTERNAL_IP4_NBNS:
641 resp |= LELEM(attr.isaat_af_type);
642 break;
643 default:
644 plog("unsupported mode cfg attribute %s received."
645 , enum_show(&modecfg_attr_names, (attr.isaat_af_type & ISAKMP_ATTR_RTYPE_MASK )));
646 break;
647 }
648 }
649 }
650
651 /* ack things */
652 stat = modecfg_resp(st, resp
653 ,&md->rbody
654 ,ISAKMP_CFG_ACK
655 ,FALSE
656 ,isama_id);
657
658 if (stat != STF_OK)
659 {
660 /* notification payload - not exactly the right choice, but okay */
661 md->note = CERTIFICATE_UNAVAILABLE;
662 return stat;
663 }
664
665 /*
666 * we are done with this exchange, clear things so
667 * that we can start phase 2 properly
668 */
669 st->st_msgid = 0;
670
671 if (resp)
672 {
673 st->st_modecfg.vars_set = TRUE;
674 }
675 return STF_OK;
676 }
677
678 /* STATE_MODE_CFG_R1:
679 * HDR*, HASH, ATTR(SET=IP) --> HDR*, HASH, ATTR(ACK,OK)
680 */
681 stf_status
682 modecfg_inR1(struct msg_digest *md)
683 {
684 struct state *const st = md->st;
685 pb_stream *attrs = &md->chain[ISAKMP_NEXT_ATTR]->pbs;
686 int set_modecfg_attrs = LEMPTY;
687 stf_status stat;
688 struct payload_digest *p;
689
690 plog("parsing ModeCfg reply");
691
692 st->st_msgid = md->hdr.isa_msgid;
693 CHECK_QUICK_HASH(md, mode_cfg_hash(hash_val,hash_pbs->roof, md->message_pbs.roof, st)
694 , "MODECFG-HASH", "MODE R1");
695
696
697 /* process the MODECFG payloads therein */
698 for (p = md->chain[ISAKMP_NEXT_ATTR]; p != NULL; p = p->next)
699 {
700 struct isakmp_attribute attr;
701 pb_stream strattr;
702
703 attrs = &p->pbs;
704
705 switch (p->payload.attribute.isama_type)
706 {
707 default:
708 {
709 plog("Expecting MODE_CFG_ACK, got %x instead."
710 ,md->chain[ISAKMP_NEXT_ATTR]->payload.attribute.isama_type);
711 return STF_IGNORE;
712 }
713 break;
714
715 case ISAKMP_CFG_ACK:
716 /* CHECK that ACK has been received. */
717 stat = modecfg_parse_attributes(attrs, &set_modecfg_attrs);
718 if (stat != STF_OK)
719 return stat;
720 break;
721
722 case ISAKMP_CFG_REPLY:
723 while (pbs_left(attrs) > sizeof(struct isakmp_attribute))
724 {
725 if (!in_struct(&attr, &isakmp_modecfg_attribute_desc
726 , attrs, &strattr))
727 {
728 /* Skip unknown */
729 int len;
730 if (attr.isaat_af_type & 0x8000)
731 len = 4;
732 else
733 len = attr.isaat_lv;
734
735 if (len < 4)
736 {
737 plog("Attribute was too short: %d", len);
738 return STF_FAIL;
739 }
740
741 attrs->cur += len;
742 }
743
744 switch (attr.isaat_af_type & ISAKMP_ATTR_RTYPE_MASK )
745 {
746 case INTERNAL_IP4_ADDRESS:
747 {
748 struct connection *c = st->st_connection;
749 ip_address a;
750 u_int32_t *ap = (u_int32_t *)(strattr.cur);
751 a.u.v4.sin_family = AF_INET;
752
753 memcpy(&a.u.v4.sin_addr.s_addr, ap
754 , sizeof(a.u.v4.sin_addr.s_addr));
755
756 if (addrbytesptr(&c->spd.this.host_srcip, NULL) == 0
757 || isanyaddr(&c->spd.this.host_srcip))
758 {
759 char srcip[ADDRTOT_BUF];
760
761 c->spd.this.host_srcip = a;
762 addrtot(&a, 0, srcip, sizeof(srcip));
763 plog("setting virtual IP source address to %s", srcip);
764 }
765
766 /* setting client subnet as srcip/32 */
767 addrtosubnet(&a, &c->spd.this.client);
768 setportof(0, &c->spd.this.client.addr);
769 c->spd.this.has_client = TRUE;
770 }
771 /* fall through to set attribute flage */
772
773 case INTERNAL_IP4_NETMASK:
774 case INTERNAL_IP4_DNS:
775 case INTERNAL_IP4_SUBNET:
776 case INTERNAL_IP4_NBNS:
777 set_modecfg_attrs |= LELEM(attr.isaat_af_type);
778 break;
779 default:
780 plog("unsupported mode cfg attribute %s received."
781 , enum_show(&modecfg_attr_names
782 , (attr.isaat_af_type & ISAKMP_ATTR_RTYPE_MASK )));
783 break;
784 }
785 }
786 break;
787 }
788 }
789
790 /* we are done with this exchange, clear things so that we can start phase 2 properly */
791 st->st_msgid = 0;
792
793 if (set_modecfg_attrs)
794 {
795 st->st_modecfg.vars_set = TRUE;
796 }
797 return STF_OK;
798 }