Start for support of IKECFG in SET/ACK mode. Server side only so far.

2 files changed, 407 insertions, 58 deletions

diff --git a/sbin/isakmpd/exchange.c b/sbin/isakmpd/exchange.c
index 9ff70e07085..6da0b577059 100644
--- a/sbin/isakmpd/exchange.c
+++ b/sbin/isakmpd/exchange.c
@@ -1,10 +1,10 @@
-/*	$OpenBSD: exchange.c,v 1.65 2002/06/01 07:44:21 deraadt Exp $	*/
+/*	$OpenBSD: exchange.c,v 1.66 2002/06/07 19:53:19 ho Exp $	*/
 /*	$EOM: exchange.c,v 1.143 2000/12/04 00:02:25 angelos Exp $	*/
 
 /*
  * Copyright (c) 1998, 1999, 2000, 2001 Niklas Hallqvist.  All rights reserved.
  * Copyright (c) 1999, 2001 Angelos D. Keromytis.  All rights reserved.
- * Copyright (c) 1999, 2000 Håkan Olsson.  All rights reserved.
+ * Copyright (c) 1999, 2000, 2002 Håkan Olsson.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -715,6 +715,21 @@ exchange_add_finalization (struct exchange *exchange,
   exchange->finalize_arg = node;
 }
 
+static void
+exchange_establish_transaction (struct exchange *exchange, void *arg, int fail)
+{
+  /* Establish a TRANSACTION exchange.  */
+  struct exchange_finalization_node *node
+    = (struct exchange_finalization_node *)arg;
+  struct sa *isakmp_sa = sa_lookup_by_name ((char *)node->second_arg, 1);
+
+  if (isakmp_sa && !fail)
+    exchange_establish_p2 (isakmp_sa, ISAKMP_EXCH_TRANSACTION, 0, 0,
+			   node->first, node->first_arg);
+
+  free (node);
+}
+
 /* Establish a phase 1 exchange.  */
 void
 exchange_establish_p1 (struct transport *t, u_int8_t type, u_int32_t doi,
@@ -724,6 +739,8 @@ exchange_establish_p1 (struct transport *t, u_int8_t type, u_int32_t doi,
 {
   struct exchange *exchange;
   struct message *msg;
+  struct conf_list *flags;
+  struct conf_list_node *flag;
   char *tag = 0;
   char *str;
 
@@ -805,8 +822,39 @@ exchange_establish_p1 (struct transport *t, u_int8_t type, u_int32_t doi,
   if (!exchange->policy && name)
     exchange->policy = conf_get_str ("Phase 1", "Default");
 
-  exchange->finalize = finalize;
-  exchange->finalize_arg = arg;
+  if (name)
+    {
+      flags = conf_get_list (name, "Flags");
+      if (flags)
+	{
+	  for (flag = TAILQ_FIRST (&flags->fields); flag;
+	       flag = TAILQ_NEXT (flag, link))
+	    if (strcasecmp (flag->field, "ikecfg") == 0)
+	      {
+		struct exchange_finalization_node *node;
+
+		node = calloc (1, (unsigned long)sizeof *node);
+		if (!node)
+		  {
+		    log_print ("exchange_establish_p1: calloc (1, %lu) failed",
+			       (unsigned long)sizeof (*node));
+		    exchange_free (exchange);
+		    return;
+		  }
+
+		/* Insert this finalization inbetween the original.  */
+		node->first = finalize;
+		node->first_arg = arg;
+		node->second_arg = name;
+		exchange_add_finalization (exchange,
+					   exchange_establish_transaction,
+					   node);
+		finalize = 0;
+	      }
+	  conf_free_list (flags);
+	}
+    }
+  exchange_add_finalization (exchange, finalize, arg);
   cookie_gen (t, exchange, exchange->cookies, ISAKMP_HDR_ICOOKIE_LEN);
   exchange_enter (exchange);
 #ifdef USE_DEBUG
@@ -816,8 +864,9 @@ exchange_establish_p1 (struct transport *t, u_int8_t type, u_int32_t doi,
   msg = message_alloc (t, 0, ISAKMP_HDR_SZ);
   msg->exchange = exchange;
 
-  /* Do not create SA for an information exchange.  */
-  if (exchange->type != ISAKMP_EXCH_INFO)
+  /* Do not create SA for an information or transaction exchange.  */
+  if (exchange->type != ISAKMP_EXCH_INFO
+      && exchange->type != ISAKMP_EXCH_TRANSACTION)
     {
       /*
        * Don't install a transport into this SA as it will be an INADDR_ANY
@@ -1393,8 +1442,6 @@ exchange_finalize (struct message *msg)
       exchange->keynote_key = 0;
       msg->isakmp_sa->policy_id = exchange->policy_id;
       exchange->policy_id = -1;
-      msg->isakmp_sa->id_i_len = exchange->id_i_len;
-      msg->isakmp_sa->id_r_len = exchange->id_r_len;
       msg->isakmp_sa->initiator = exchange->initiator;
 
       if (exchange->recv_certtype && exchange->recv_cert)
@@ -1426,11 +1473,6 @@ exchange_finalize (struct message *msg)
 							       ->transport)));
     }
 
-  exchange->doi->finalize_exchange (msg);
-  if (exchange->finalize)
-    exchange->finalize (exchange, exchange->finalize_arg, 0);
-  exchange->finalize = 0;
-
   /* Copy the ID from phase 1 to exchange or phase 2 SA.  */
   if (msg->isakmp_sa)
     {
@@ -1450,6 +1492,11 @@ exchange_finalize (struct message *msg)
 	}
     }
 
+  exchange->doi->finalize_exchange (msg);
+  if (exchange->finalize)
+    exchange->finalize (exchange, exchange->finalize_arg, 0);
+  exchange->finalize = 0;
+
   /*
    * There is no reason to keep the SAs connected to us anymore, in fact
    * it can hurt us if we have short lifetimes on the SAs and we try
diff --git a/sbin/isakmpd/isakmp_cfg.c b/sbin/isakmpd/isakmp_cfg.c
index 28a210a8373..dd52874164d 100644
--- a/sbin/isakmpd/isakmp_cfg.c
+++ b/sbin/isakmpd/isakmp_cfg.c
@@ -1,7 +1,8 @@
-/*	$OpenBSD: isakmp_cfg.c,v 1.9 2002/06/06 19:03:10 ho Exp $	*/
+/*	$OpenBSD: isakmp_cfg.c,v 1.10 2002/06/07 19:53:19 ho Exp $	*/
 
 /*
  * Copyright (c) 2001 Niklas Hallqvist.  All rights reserved.
+ * Copyright (c) 2002 Håkan Olsson.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -39,6 +40,7 @@
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <string.h>
+#include <bitstring.h>
 
 #include "sysdep.h"
 
@@ -53,6 +55,7 @@
 #include "message.h"
 #include "prf.h"
 #include "sa.h"
+#include "transport.h"
 #include "util.h"
 
 /*
@@ -66,34 +69,45 @@ int16_t script_transaction[] = {
   EXCHANGE_SCRIPT_END
 };
 
-static int decode_attribute (u_int16_t, u_int8_t *, u_int16_t, void *);
-static int initiator_send_ATTR (struct message *);
-static int initiator_recv_ATTR (struct message *);
-static int responder_recv_ATTR (struct message *);
-static int responder_send_ATTR (struct message *);
+static int cfg_decode_attribute (u_int16_t, u_int8_t *, u_int16_t, void *);
+static int cfg_initiator_send_ATTR (struct message *);
+static int cfg_initiator_recv_ATTR (struct message *);
+static int cfg_responder_recv_ATTR (struct message *);
+static int cfg_responder_send_ATTR (struct message *);
 
+/* Server: SET/ACK    Client; REQ/REPLY */
 int (*isakmp_cfg_initiator[]) (struct message *) = {
-  initiator_send_ATTR,
-  initiator_recv_ATTR
+  cfg_initiator_send_ATTR,
+  cfg_initiator_recv_ATTR
 };
 
+/* Server: REQ/REPLY  Client: SET/ACK */
 int (*isakmp_cfg_responder[]) (struct message *) = {
-  responder_recv_ATTR,
-  responder_send_ATTR
+  cfg_responder_recv_ATTR,
+  cfg_responder_send_ATTR
 };
 
-/* XXX A lot can be shared with responder_send_ATTR.  */
+/*
+ * As "the server", this starts SET/ACK mode 
+ * As "the client", this starts REQ/REPLY mode
+ * XXX A lot can be shared with responder_send_ATTR.
+ */
 static int
-initiator_send_ATTR (struct message *msg)
+cfg_initiator_send_ATTR (struct message *msg)
 {
   struct exchange *exchange = msg->exchange;
   struct sa *isakmp_sa = msg->isakmp_sa;
   struct ipsec_sa *isa = isakmp_sa->data;
+  struct ipsec_exch *ie = exchange->data;
   struct hash *hash = hash_get (isa->hash);
   struct prf *prf;
   size_t hashsize = hash->hashsize;
-  u_int8_t *hashp = 0, *attrp;
-  size_t attrlen;
+  u_int8_t *hashp = 0, *attrp, *attr;
+  size_t attrlen, off;
+  char *id_string, *cfg_mode, *field;
+  struct sockaddr *sa;
+#define CFG_ATTR_BIT_MAX ISAKMP_CFG_ATTR_FUTURE_MIN	/* XXX */
+  bitstr_t bit_decl (attrbits, CFG_ATTR_BIT_MAX);
 
   if (exchange->phase == 2)
     {
@@ -101,7 +115,7 @@ initiator_send_ATTR (struct message *msg)
       hashp = malloc (ISAKMP_HASH_SZ + hashsize);
       if (!hashp)
 	{
-	  log_error ("responder_send_ATTR: malloc (%lu) failed",
+	  log_error ("cfg_initiator_send_ATTR: malloc (%lu) failed",
 		     ISAKMP_HASH_SZ + (unsigned long)hashsize);
 	  return -1;
 	}
@@ -113,17 +127,198 @@ initiator_send_ATTR (struct message *msg)
 	}
     }
 
-#ifndef to_be_removed
-  attrp = 0;
+  /* XXX This is wrong. */
+  id_string = ipsec_id_string (isakmp_sa->id_i, isakmp_sa->id_i_len);
+  if (!id_string)
+    {
+      log_print ("cfg_initiator_send_ATTR: cannot parse ID");
+      goto fail;
+    }
+
+  /* Check for attribute list to send to the other side */
   attrlen = 0;
+  bit_nclear (attrbits, 0, CFG_ATTR_BIT_MAX - 1);
+
+  cfg_mode = conf_get_str (id_string, "Mode");
+  if (!cfg_mode || strcmp (cfg_mode, "SET") == 0)
+    {
+      /* SET/ACK mode */
+      LOG_DBG ((LOG_NEGOTIATION, 10, "cfg_initiator_send_ATTR: SET/ACK mode"));
+
+#define ATTRFIND(STR,ATTR4,LEN4,ATTR6,LEN6) do				\
+	{								\
+	  if ((sa = conf_get_address (id_string, STR)) != NULL)		\
+	    switch (sa->sa_family)					\
+	      {								\
+	      case AF_INET:						\
+		bit_set (attrbits, ATTR4);				\
+		attrlen += ISAKMP_ATTR_SZ + LEN4;		       	\
+		break;							\
+	      case AF_INET6:						\
+		bit_set (attrbits, ATTR6);				\
+		attrlen += ISAKMP_ATTR_SZ + LEN6;			\
+		break;							\
+	      default:							\
+	      }								\
+          free (sa);							\
+        } while (0)
+
+      /* XXX We don't simultaneously support IPv4 and IPv6 addresses.  */
+      ATTRFIND ("Address", ISAKMP_CFG_ATTR_INTERNAL_IP4_ADDRESS, 4,
+		ISAKMP_CFG_ATTR_INTERNAL_IP6_ADDRESS, 16);
+      ATTRFIND ("Netmask", ISAKMP_CFG_ATTR_INTERNAL_IP4_NETMASK, 4,
+		ISAKMP_CFG_ATTR_INTERNAL_IP6_NETMASK, 16);
+      ATTRFIND ("Nameserver", ISAKMP_CFG_ATTR_INTERNAL_IP4_DNS, 4,
+		ISAKMP_CFG_ATTR_INTERNAL_IP6_DNS, 16);
+      ATTRFIND ("WINS-server", ISAKMP_CFG_ATTR_INTERNAL_IP4_NBNS, 4,
+		ISAKMP_CFG_ATTR_INTERNAL_IP6_NBNS, 16);
+      ATTRFIND ("DHCP-server", ISAKMP_CFG_ATTR_INTERNAL_IP4_DHCP, 4,
+		ISAKMP_CFG_ATTR_INTERNAL_IP6_DHCP, 16);
+#ifdef notyet
+      ATTRFIND ("Network", ISAKMP_CFG_ATTR_INTERNAL_IP4_SUBNET, 8,
+		ISAKMP_CFG_ATTR_INTERNAL_IP6_SUBNET, 17);
 #endif
+#undef ATTRFIND
+
+      if (conf_get_str (id_string, "Lifetime"))
+	{
+	  bit_set (attrbits, ISAKMP_CFG_ATTR_INTERNAL_ADDRESS_EXPIRY);
+	  attrlen += ISAKMP_ATTR_SZ + 4;
+	}
+    }
+  else
+    {
+      /* XXX REQ/REPLY  */
+      LOG_DBG ((LOG_NEGOTIATION, 10, 
+		"cfg_initiator_send_ATTR: REQ/REPLY mode"));
+    }
+  
+  if (attrlen == 0)
+    {
+      /* No data found.  */
+      log_print ("cfg_initiator_send_ATTR: no IKECFG attributes found for %s",
+		 id_string);
+      free (id_string);
+      return 0;
+    }
+
+  attrp = calloc (1, attrlen);
+  if (!attrp)
+    {
+      log_error ("cfg_initiator_send_ATTR: calloc (1, %lu) failed",
+		 (unsigned long)attrlen);
+      goto fail;
+    }
+
+  if (message_add_payload (msg, ISAKMP_PAYLOAD_ATTRIBUTE, attrp, attrlen, 1))
+    {
+      free (attrp);
+      goto fail;
+    }
 
+  if (!cfg_mode || strcmp (cfg_mode, "SET") == 0)
+    {
+      /*
+       * SET/ACK cont. Use the bitstring built previously to collect
+       * the right parameters for attrp.
+       */
+      u_int16_t bit, length;
+      u_int32_t life;
+
+      SET_ISAKMP_ATTRIBUTE_TYPE (attrp, ISAKMP_CFG_SET);
+      getrandom ((u_int8_t *)&ie->cfg_id, sizeof ie->cfg_id);
+      SET_ISAKMP_ATTRIBUTE_ID (attrp, ie->cfg_id);
+
+      off = ISAKMP_ATTRIBUTE_SZ;
+      for (bit = 0; bit < CFG_ATTR_BIT_MAX; bit++)
+	if (bit_test (attrbits, bit))
+	  {
+	    attr = attrp + off;
+	    SET_ISAKMP_ATTR_TYPE (attr, bit);
+	    
+	    /* All the other are similar, this is the odd one.  */
+	    if (bit == ISAKMP_CFG_ATTR_INTERNAL_ADDRESS_EXPIRY)
+	      {
+		life = conf_get_num (id_string, "Lifetime", 1200);
+		SET_ISAKMP_ATTR_LENGTH_VALUE (attr, 4);
+		encode_32 (attr + ISAKMP_ATTR_VALUE_OFF, life);
+		off += ISAKMP_ATTR_SZ + 4;
+		continue;
+	      }
+
+	    switch (bit)
+	      {
+	      case ISAKMP_CFG_ATTR_INTERNAL_IP4_ADDRESS:
+	      case ISAKMP_CFG_ATTR_INTERNAL_IP4_NETMASK:
+	      case ISAKMP_CFG_ATTR_INTERNAL_IP4_DNS:
+	      case ISAKMP_CFG_ATTR_INTERNAL_IP4_DHCP:
+	      case ISAKMP_CFG_ATTR_INTERNAL_IP4_NBNS:
+		length = 4;
+		break;
+
+	      case ISAKMP_CFG_ATTR_INTERNAL_IP6_ADDRESS:
+	      case ISAKMP_CFG_ATTR_INTERNAL_IP6_NETMASK:
+	      case ISAKMP_CFG_ATTR_INTERNAL_IP6_DNS:
+	      case ISAKMP_CFG_ATTR_INTERNAL_IP6_DHCP:
+	      case ISAKMP_CFG_ATTR_INTERNAL_IP6_NBNS:
+		length = 16;
+		break;
+
+	      default:
+		length = 0; /* Silence gcc.  */
+	      }
+
+	    switch (bit)
+	      {
+	      case ISAKMP_CFG_ATTR_INTERNAL_IP4_ADDRESS:
+	      case ISAKMP_CFG_ATTR_INTERNAL_IP6_ADDRESS:
+		field = "Address";
+		break;
+
+	      case ISAKMP_CFG_ATTR_INTERNAL_IP4_NETMASK:
+	      case ISAKMP_CFG_ATTR_INTERNAL_IP6_NETMASK:
+		field = "Netmask";
+		break;
+
+	      case ISAKMP_CFG_ATTR_INTERNAL_IP4_DNS:
+	      case ISAKMP_CFG_ATTR_INTERNAL_IP6_DNS:
+		field = "Nameserver";
+		break;
+
+	      case ISAKMP_CFG_ATTR_INTERNAL_IP4_DHCP:
+	      case ISAKMP_CFG_ATTR_INTERNAL_IP6_DHCP:
+		field = "DHCP-server";
+		break;
+
+	      case ISAKMP_CFG_ATTR_INTERNAL_IP4_NBNS:
+	      case ISAKMP_CFG_ATTR_INTERNAL_IP6_NBNS:
+		field = "WINS-server";
+		break;
+
+	      default:
+		field = 0; /* Silence gcc.  */
+	      }
+
+	    sa = conf_get_address (id_string, field);
+	    SET_ISAKMP_ATTR_LENGTH_VALUE (attr, length);
+	    memcpy (attr + ISAKMP_ATTR_VALUE_OFF, sockaddr_addrdata (sa),
+		    length);
+
+	    off += length + ISAKMP_ATTR_SZ;
+	  }
+    }
+  else
+    {
+      /* XXX REQ/REPLY cont.  */
+      goto fail; 		   
+    }
+  
   if (exchange->phase == 2)
     {
       prf = prf_alloc (isa->prf_type, isa->hash, isa->skeyid_a,
 		       isa->skeyid_len);
       if (!prf)
-	return -1;
+	goto fail;
       prf->Init (prf->prfctx);
       prf->Update (prf->prfctx, exchange->message_id,
 		   ISAKMP_HDR_MESSAGE_ID_LEN);
@@ -132,16 +327,36 @@ initiator_send_ATTR (struct message *msg)
       prf_free (prf);
     }
   return 0;
+
+ fail:
+  if (id_string)
+    free (id_string);
+  return -1;
 }
 
+/*
+ * As "the server", this ends SET/ACK.
+ * As "the client", this ends REQ/REPLY.
+ */
 static int
-initiator_recv_ATTR (struct message *msg)
+cfg_initiator_recv_ATTR (struct message *msg)
 {
-  struct exchange *exchange = msg->exchange;
-#if 0
+  struct payload *attrp
+    = TAILQ_FIRST (&msg->payload[ISAKMP_PAYLOAD_ATTRIBUTE]);
+#ifdef notyet
   struct payload *p = TAILQ_FIRST (&msg->payload[ISAKMP_PAYLOAD_ATTRIBUTE]);
 #endif
   struct payload *hashp = TAILQ_FIRST (&msg->payload[ISAKMP_PAYLOAD_HASH]);
+  struct exchange *exchange = msg->exchange;
+  struct ipsec_exch *ie = exchange->data;
+  struct sa *isakmp_sa = msg->isakmp_sa;
+  struct ipsec_sa *isa = isakmp_sa->data;
+  struct isakmp_cfg_attr *attr;
+  struct prf *prf;
+  u_int8_t *hash, *comp_hash;
+  size_t hash_len;
+  struct sockaddr *sa;
+  char *addr;
 
   if (exchange->phase == 2)
     {
@@ -149,21 +364,102 @@ initiator_recv_ATTR (struct message *msg)
 	{
 	  /* XXX Should another NOTIFY type be used?  */
 	  message_drop (msg, ISAKMP_NOTIFY_INVALID_HASH_INFORMATION, 0, 1, 0);
-	  log_print ("initiator_recv_ATTR: phase 2 message missing HASH");
+	  log_print ("cfg_initiator_recv_ATTR: phase 2 message missing HASH");
 	  return -1;
 	}
 
-      /* XXX Verify hash!  */
+      hash = hashp->p;
+      hash_len = GET_ISAKMP_GEN_LENGTH (hash);
+      comp_hash = malloc (hash_len - ISAKMP_GEN_SZ);
+      if (!comp_hash)
+	{
+	  log_error ("cfg_initiator_recv_ATTR: malloc (%lu) failed",
+		     (unsigned long)hash_len - ISAKMP_GEN_SZ);
+	  return -1;
+	}
+
+      /* Verify hash!  */
+      prf = prf_alloc (isa->prf_type, isa->hash, isa->skeyid_a,
+		       isa->skeyid_len);
+      if (!prf)
+	{
+	  free (comp_hash);
+	  return -1;
+	}
+
+      prf->Init (prf->prfctx);
+      prf->Update (prf->prfctx, exchange->message_id,
+                   ISAKMP_HDR_MESSAGE_ID_LEN);
+      prf->Update (prf->prfctx, hash + hash_len,
+                   msg->iov[0].iov_len - ISAKMP_HDR_SZ - hash_len);
+      prf->Final (comp_hash, prf->prfctx);
+      prf_free (prf);
+      if (memcmp (hash + ISAKMP_GEN_SZ, comp_hash, hash_len - ISAKMP_GEN_SZ)
+          != 0)
+        {
+          message_drop (msg, ISAKMP_NOTIFY_INVALID_HASH_INFORMATION, 0, 1, 0);
+          free (comp_hash);
+          return -1;
+        }
+      free (comp_hash);
 
       /* Mark the HASH as handled.  */
       hashp->flags |= PL_MARK;
     }
 
+  ie->cfg_id = GET_ISAKMP_ATTRIBUTE_ID (attrp->p);
+
+  switch (attrp->p[ISAKMP_ATTRIBUTE_TYPE_OFF])
+    {
+    case ISAKMP_CFG_ACK:
+    case ISAKMP_CFG_REPLY:
+      break;
+
+    default:
+      message_drop (msg, ISAKMP_NOTIFY_PAYLOAD_MALFORMED, 0, 1, 0);
+      log_print ("cfg_responder_recv_ATTR: "
+		 "unexpected configuration message type %d",
+		 attrp->p[ISAKMP_ATTRIBUTE_TYPE_OFF]);
+      return -1;
+    }
+
+  attribute_map (attrp->p + ISAKMP_ATTRIBUTE_ATTRS_OFF,
+		 GET_ISAKMP_GEN_LENGTH (attrp->p)
+		 - ISAKMP_TRANSFORM_SA_ATTRS_OFF, cfg_decode_attribute, ie);
+  
+  if (attrp->p[ISAKMP_ATTRIBUTE_TYPE_OFF] == ISAKMP_CFG_ACK)
+    {
+      /* SET / ACKNOWLEDGE */
+      const char *uk_addr = "<unknown>";
+
+      msg->transport->vtbl->get_src (isakmp_sa->transport, &sa);
+      if (sockaddr2text (sa, &addr, 0) < 0)
+	addr = (char *)uk_addr;
+      
+      for (attr = LIST_FIRST (&ie->attrs); attr; attr = LIST_NEXT (attr, link))
+	LOG_DBG ((LOG_NEGOTIATION, 50, "cfg_responder_recv_ATTR: "
+		  "client %s ACKs attribute %s", addr,
+		  constant_name (isakmp_cfg_attr_cst, attr->type)));
+
+      if (addr != uk_addr)
+	free (addr);
+    }
+  else /* ISAKMP_CFG_REPLY */
+    {
+      /*
+       * XXX REQ/REPLY: effect attributes we've gotten responses on.
+       */
+    }
+
   return 0;
 }
 
+/*
+ * As "the server", this starts REQ/REPLY (initiated by the client).
+ * As "the client", this starts SET/ACK (initiated by the server).
+ */
 static int
-responder_recv_ATTR (struct message *msg)
+cfg_responder_recv_ATTR (struct message *msg)
 {
   struct exchange *exchange = msg->exchange;
   struct payload *attrp
@@ -182,7 +478,7 @@ responder_recv_ATTR (struct message *msg)
 	{
 	  /* XXX Should another NOTIFY type be used?  */
 	  message_drop (msg, ISAKMP_NOTIFY_INVALID_HASH_INFORMATION, 0, 1, 0);
-	  log_print ("responder_recv_ATTR: phase 2 message missing HASH");
+	  log_print ("cfg_responder_recv_ATTR: phase 2 message missing HASH");
 	  return -1;
 	}
 
@@ -191,7 +487,7 @@ responder_recv_ATTR (struct message *msg)
       comp_hash = malloc (hash_len - ISAKMP_GEN_SZ);
       if (!comp_hash)
 	{
-	  log_error ("responder_recv_ATTR: malloc (%lu) failed",
+	  log_error ("cfg_responder_recv_ATTR: malloc (%lu) failed",
 		     (unsigned long)hash_len - ISAKMP_GEN_SZ);
 	  return -1;
 	}
@@ -231,7 +527,8 @@ responder_recv_ATTR (struct message *msg)
     case ISAKMP_CFG_REQUEST:
       attribute_map (attrp->p + ISAKMP_ATTRIBUTE_ATTRS_OFF,
 		     GET_ISAKMP_GEN_LENGTH (attrp->p)
-		     - ISAKMP_TRANSFORM_SA_ATTRS_OFF, decode_attribute, ie);
+		     - ISAKMP_TRANSFORM_SA_ATTRS_OFF, cfg_decode_attribute,
+		     ie);
       break;
 
 #ifdef notyet
@@ -241,7 +538,7 @@ responder_recv_ATTR (struct message *msg)
 
     default:
       message_drop (msg, ISAKMP_NOTIFY_PAYLOAD_MALFORMED, 0, 1, 0);
-      log_print ("responder_recv_ATTR: "
+      log_print ("cfg_responder_recv_ATTR: "
 		 "unexpected configuration message type %d",
 		 attrp->p[ISAKMP_ATTRIBUTE_TYPE_OFF]);
       return -1;
@@ -250,9 +547,13 @@ responder_recv_ATTR (struct message *msg)
   return 0;
 }
 
-/* XXX A lot can be shared with initiator_send_ATTR.  */
+/*
+ * As "the server", this ends REQ/REPLY mode.
+ * As "the client", this ends SET/ACK mode.
+ * XXX A lot can be shared with initiator_send_ATTR.
+ */
 static int
-responder_send_ATTR (struct message *msg)
+cfg_responder_send_ATTR (struct message *msg)
 {
   struct exchange *exchange = msg->exchange;
   struct ipsec_exch *ie = exchange->data;
@@ -276,7 +577,7 @@ responder_send_ATTR (struct message *msg)
   id_string = ipsec_id_string (isakmp_sa->id_i, isakmp_sa->id_i_len);
   if (!id_string)
     {
-      log_print ("responder_send_ATTR: cannot parse client's ID");
+      log_print ("cfg_responder_send_ATTR: cannot parse client's ID");
       goto fail;
     }
 
@@ -286,7 +587,7 @@ responder_send_ATTR (struct message *msg)
       hashp = malloc (ISAKMP_HASH_SZ + hashsize);
       if (!hashp)
 	{
-	  log_error ("responder_send_ATTR: malloc (%lu) failed",
+	  log_error ("cfg_responder_send_ATTR: malloc (%lu) failed",
 		     ISAKMP_HASH_SZ + (unsigned long)hashsize);
 	  goto fail;
 	}
@@ -348,7 +649,7 @@ responder_send_ATTR (struct message *msg)
   attrp = calloc (1, attrlen);
   if (!attrp)
     {
-      log_error ("responder_send_ATTR: calloc (1, %lu) failed",
+      log_error ("cfg_responder_send_ATTR: calloc (1, %lu) failed",
 		 (unsigned long)attrlen);
       goto fail;
     }
@@ -401,7 +702,7 @@ responder_send_ATTR (struct message *msg)
 
 	case ISAKMP_CFG_ATTR_INTERNAL_IP4_SUBNET:
 	case ISAKMP_CFG_ATTR_INTERNAL_IP6_SUBNET:
-	  field = "Address"; /* XXX or "Network" */
+	  field = "Network"; /* XXX or just "Address" */
 	  break;
 	  
 	case ISAKMP_CFG_ATTR_INTERNAL_IP4_NETMASK:
@@ -443,7 +744,7 @@ responder_send_ATTR (struct message *msg)
 	  sa = conf_get_address (id_string, field);
 	  if (!sa)
 	    {
-	      LOG_DBG ((LOG_NEGOTIATION, 10, "responder_send_ATTR: "
+	      LOG_DBG ((LOG_NEGOTIATION, 10, "cfg_responder_send_ATTR: "
 			"attribute not found: %s", field));
 	      attr->length = 0;
 	      break;
@@ -451,7 +752,7 @@ responder_send_ATTR (struct message *msg)
 
 	  if (sa->sa_family != family)
 	    {
-	      log_print ("responder_send_ATTR: attribute %s - expected %s "
+	      log_print ("cfg_responder_send_ATTR: attribute %s - expected %s "
 			 "got %s data", field, 
 			 (family == AF_INET ? "IPv4" : "IPv6"),
 			 (sa->sa_family == AF_INET ? "IPv4" : "IPv6"));
@@ -476,14 +777,14 @@ responder_send_ATTR (struct message *msg)
 	      sa = conf_get_address (id_string, "Netmask");
 	      if (!sa)
 		{
-		  LOG_DBG ((LOG_NEGOTIATION, 10, "responder_send_ATTR: "
+		  LOG_DBG ((LOG_NEGOTIATION, 10, "cfg_responder_send_ATTR: "
 			    "attribute not found: Netmask"));
 		  attr->length = 0;
 		  break;
 		}
 	      if (sa->sa_family != AF_INET)
 		{
-		  log_print ("responder_send_ATTR: attribute Netmask - "
+		  log_print ("cfg_responder_send_ATTR: attribute Netmask - "
 			     "expected IPv4 got IPv6 data");
 		  free (sa);
 		  attr->length = 0;
@@ -500,14 +801,14 @@ responder_send_ATTR (struct message *msg)
 
 	      if (prefix == -1)
 		{
-		  log_print ("responder_send_ATTR: "
+		  log_print ("cfg_responder_send_ATTR: "
 			     "attribute not found: Prefix");
 		  attr->length = 0;
 		  break;
 		}
 	      else if (prefix < -1 || prefix > 128)
 		{
-		  log_print ("responder_send_ATTR: attribute Prefix - "
+		  log_print ("cfg_responder_send_ATTR: attribute Prefix - "
 			     "invalid value %d", prefix);
 		  attr->length = 0;
 		  break;
@@ -566,7 +867,8 @@ responder_send_ATTR (struct message *msg)
  * attributes indexed by type for easy retrieval.
  */
 static int
-decode_attribute (u_int16_t type, u_int8_t *value, u_int16_t len, void *vie)
+cfg_decode_attribute (u_int16_t type, u_int8_t *value, u_int16_t len,
+		      void *vie)
 {
   struct ipsec_exch *ie = vie;
   struct isakmp_cfg_attr *attr;
@@ -576,15 +878,15 @@ decode_attribute (u_int16_t type, u_int8_t *value, u_int16_t len, void *vie)
     return 0;
   if (type == 0 || type >= ISAKMP_CFG_ATTR_FUTURE_MIN)
     {
-      LOG_DBG ((LOG_NEGOTIATION, 30, "decode_attribute: invalid attr type %u",
-		type));
+      LOG_DBG ((LOG_NEGOTIATION, 30,
+		"cfg_decode_attribute: invalid attr type %u", type));
       return -1;
     }
 
   attr = calloc (1, sizeof *attr);
   if (!attr)
     {
-      log_error ("decode_attribute: calloc (1, %lu) failed",
+      log_error ("cfg_decode_attribute: calloc (1, %lu) failed",
 		 (unsigned long)sizeof *attr);
       return -1;
     }
@@ -595,7 +897,7 @@ decode_attribute (u_int16_t type, u_int8_t *value, u_int16_t len, void *vie)
       attr->value = malloc (len);
       if (!attr->value)
 	{
-	  log_error ("decode_attribute: malloc (%d) failed", len);
+	  log_error ("cfg_decode_attribute: malloc (%d) failed", len);
 	  free (attr);
 	  /* Should we also deallocate all other values?  */
 	  return -1;