[apple/ipsec.git] / ipsec-tools / racoon / vendorid.c

/* $Id: vendorid.c,v 1.7 2005/01/29 16:34:25 vanhu Exp $ */

/*
 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
 * All rights reserved.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the project nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 * 
 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#include "config.h"

#include <sys/types.h>
#include <sys/param.h>

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <ctype.h>

#include "var.h"
#include "misc.h"
#include "vmbuf.h"
#include "plog.h"
#include "debug.h"

#include "localconf.h"
#include "isakmp_var.h"
#include "isakmp.h"
#include "vendorid.h"
#include "crypto_openssl.h"

static struct vendor_id all_vendor_ids[] = {
{ VENDORID_KAME       , "KAME/racoon" },
{ VENDORID_GSSAPI_LONG, "A GSS-API Authentication Method for IKE" },
{ VENDORID_GSSAPI     , "GSSAPI" },
{ VENDORID_MS_NT5     , "MS NT5 ISAKMPOAKLEY" },
{ VENDORID_NATT_00    , "draft-ietf-ipsec-nat-t-ike-00" },
{ VENDORID_NATT_01    , "draft-ietf-ipsec-nat-t-ike-01" },
{ VENDORID_NATT_02    , "draft-ietf-ipsec-nat-t-ike-02" },
{ VENDORID_NATT_02_N  , "draft-ietf-ipsec-nat-t-ike-02\n" },
{ VENDORID_NATT_03    , "draft-ietf-ipsec-nat-t-ike-03" },
{ VENDORID_NATT_04    , "draft-ietf-ipsec-nat-t-ike-04" },
{ VENDORID_NATT_05    , "draft-ietf-ipsec-nat-t-ike-05" },
{ VENDORID_NATT_06    , "draft-ietf-ipsec-nat-t-ike-06" },
{ VENDORID_NATT_07    , "draft-ietf-ipsec-nat-t-ike-07" },
{ VENDORID_NATT_08    , "draft-ietf-ipsec-nat-t-ike-08" },
{ VENDORID_NATT_APPLE , "draft-ietf-ipsec-nat-t-ike" },
{ VENDORID_NATT_RFC   , "RFC 3947" },
{ VENDORID_XAUTH      , "draft-ietf-ipsra-isakmp-xauth-06.txt" },
{ VENDORID_UNITY      , "CISCO-UNITY" },
{ VENDORID_FRAG       , "FRAGMENTATION" },
/* Just a readable string for DPD ... */
{ VENDORID_DPD        , "DPD" },
};

#define NUMVENDORIDS	(sizeof(all_vendor_ids)/sizeof(all_vendor_ids[0]))

#define DPD_MAJOR_VERSION	0x01
#define DPD_MINOR_VERSION	0x00

const char vendorid_dpd_hash[] = {
	0xAF, 0xCA, 0xD7, 0x13,
	0x68, 0xA1, 0xF1, 0xC9,
	0x6B, 0x86, 0x96, 0xFC,
	0x77, 0x57, DPD_MAJOR_VERSION, DPD_MINOR_VERSION
};


static vchar_t *vendorid_fixup(int, vchar_t *t);

static struct vendor_id *
lookup_vendor_id_by_id (int id)
{
	int i;

	for (i = 0; i < NUMVENDORIDS; i++)
		if (all_vendor_ids[i].id == id)
			return &all_vendor_ids[i];

	return NULL;
}

const char *
vid_string_by_id (int id)
{
	struct vendor_id *current;

	if (id == VENDORID_DPD)
		return vendorid_dpd_hash;

	current = lookup_vendor_id_by_id(id);

	return current ? current->string : NULL;
}

static struct vendor_id *
lookup_vendor_id_by_hash (const char *hash)
{
	int i;

	for (i = 0; i < NUMVENDORIDS; i++)
		if (strncmp(all_vendor_ids[i].hash->v, hash,
			    all_vendor_ids[i].hash->l) == 0)
			return &all_vendor_ids[i];

	return NULL;
}

void
compute_vendorids (void)
{
	int i;
	vchar_t vid;

	for (i = 0; i < NUMVENDORIDS; i++) {
		/* VENDORID_DPD is not a MD5 sum... */
		if(i == VENDORID_DPD){
			all_vendor_ids[i].hash = vmalloc(sizeof(vendorid_dpd_hash));
			if (all_vendor_ids[i].hash == NULL) {
				plog(ASL_LEVEL_ERR, 
					"unable to get memory for VID hash\n");
				exit(1); /* this really shouldn't happen */
			}
			memcpy(all_vendor_ids[i].hash->v, vendorid_dpd_hash,
				   sizeof(vendorid_dpd_hash));
			continue;
		}

		vid.v = (char *) all_vendor_ids[i].string;
		vid.l = strlen(vid.v);

		all_vendor_ids[i].hash = eay_md5_one(&vid);
		if (all_vendor_ids[i].hash == NULL)
			plog(ASL_LEVEL_ERR, 
			    "unable to hash vendor ID string\n");

		/* Special cases */
		all_vendor_ids[i].hash =
			vendorid_fixup(all_vendor_ids[i].id,
				       all_vendor_ids[i].hash);
	}
}

/*
 * set hashed vendor id.
 * hash function is always MD5.
 */
vchar_t *
set_vendorid(int vendorid)
{
	struct vendor_id *current;

	if (vendorid == VENDORID_UNKNOWN) {
		/*
		 * The default unknown ID gets translated to
		 * KAME/racoon.
		 */
		vendorid = VENDORID_KAME;
	}

	current = lookup_vendor_id_by_id(vendorid);
	if (current == NULL) {
		plog(ASL_LEVEL_ERR, 
		    "invalid vendor ID index: %d\n", vendorid);
		return (NULL);
	}

	/* The rest of racoon expects a private copy 
	 * of the VID that could be free'd after use.
	 * That's why we don't return the original pointer. */
	return vdup(current->hash);
}

/*
 * Check the vendor ID payload -- return the vendor ID index
 * if we find a recognized one, or UNKNOWN if we don't.
 *
 * gen ... points to Vendor ID payload.
 */
int
check_vendorid(struct isakmp_gen *gen)
{
	int vidlen;
	struct vendor_id *current;

	if (gen == NULL)
		return (VENDORID_UNKNOWN);

	vidlen = ntohs(gen->len) - sizeof(*gen);

	current = lookup_vendor_id_by_hash((char *)(gen + 1));
	if (!current)
		goto unknown;
	
	if (current->hash->l < vidlen)
		plog(ASL_LEVEL_INFO, 
		     "received broken Microsoft ID: %s\n",
		     current->string);
	else
		plog(ASL_LEVEL_INFO, 
		     "received Vendor ID: %s\n",
		     current->string);

	return current->id;

unknown:
	plogdump(ASL_LEVEL_DEBUG, (char *)(gen + 1), vidlen, "received unknown Vendor ID:\n");
	return (VENDORID_UNKNOWN);
}

static vchar_t * 
vendorid_fixup(vendorid, vidhash)
	int vendorid;		 
	vchar_t *vidhash;
{			   
	switch(vendorid) {
	case VENDORID_XAUTH: {	/* The vendor Id is truncated */
		vchar_t *tmp;					    
				  
		if ((tmp = vmalloc(8)) == NULL) {
			plog(ASL_LEVEL_ERR, 
			    "unable to hash vendor ID string\n");
			return NULL;				    
		}			
		  
		memcpy(tmp->v, vidhash->v, 8);
		vfree(vidhash);		  
		vidhash = tmp;
				   
		break;
	} 
	case VENDORID_UNITY:	/* Two bytes tweak */
		vidhash->v[14] = 0x01;		  
		vidhash->v[15] = 0x00;
		break;		   

	default:     
		break;
	}		
	
	return vidhash;
}
Commit	Line	Data
52b7d2ce A	1	/* $Id: vendorid.c,v 1.7 2005/01/29 16:34:25 vanhu Exp $ */
	2
	3	/*
	4	* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
	5	* All rights reserved.
	6	*
	7	* Redistribution and use in source and binary forms, with or without
	8	* modification, are permitted provided that the following conditions
	9	* are met:
	10	* 1. Redistributions of source code must retain the above copyright
	11	* notice, this list of conditions and the following disclaimer.
	12	* 2. Redistributions in binary form must reproduce the above copyright
	13	* notice, this list of conditions and the following disclaimer in the
	14	* documentation and/or other materials provided with the distribution.
	15	* 3. Neither the name of the project nor the names of its contributors
	16	* may be used to endorse or promote products derived from this software
	17	* without specific prior written permission.
	18	*
	19	* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
	20	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	21	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	22	* ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
	23	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	24	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	25	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	26	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	27	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	28	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	29	* SUCH DAMAGE.
	30	*/
	31
	32	#include "config.h"
	33
	34	#include <sys/types.h>
	35	#include <sys/param.h>
	36
	37	#include <stdlib.h>
	38	#include <stdio.h>
	39	#include <string.h>
	40	#include <errno.h>
	41	#include <ctype.h>
	42
	43	#include "var.h"
	44	#include "misc.h"
	45	#include "vmbuf.h"
	46	#include "plog.h"
	47	#include "debug.h"
	48
	49	#include "localconf.h"
	50	#include "isakmp_var.h"
	51	#include "isakmp.h"
	52	#include "vendorid.h"
	53	#include "crypto_openssl.h"
	54
	55	static struct vendor_id all_vendor_ids[] = {
	56	{ VENDORID_KAME , "KAME/racoon" },
	57	{ VENDORID_GSSAPI_LONG, "A GSS-API Authentication Method for IKE" },
	58	{ VENDORID_GSSAPI , "GSSAPI" },
	59	{ VENDORID_MS_NT5 , "MS NT5 ISAKMPOAKLEY" },
	60	{ VENDORID_NATT_00 , "draft-ietf-ipsec-nat-t-ike-00" },
	61	{ VENDORID_NATT_01 , "draft-ietf-ipsec-nat-t-ike-01" },
	62	{ VENDORID_NATT_02 , "draft-ietf-ipsec-nat-t-ike-02" },
	63	{ VENDORID_NATT_02_N , "draft-ietf-ipsec-nat-t-ike-02\n" },
	64	{ VENDORID_NATT_03 , "draft-ietf-ipsec-nat-t-ike-03" },
65	{ VENDORID_NATT_04 , "draft-ietf-ipsec-nat-t-ike-04" },
66	{ VENDORID_NATT_05 , "draft-ietf-ipsec-nat-t-ike-05" },
67	{ VENDORID_NATT_06 , "draft-ietf-ipsec-nat-t-ike-06" },
68	{ VENDORID_NATT_07 , "draft-ietf-ipsec-nat-t-ike-07" },
69	{ VENDORID_NATT_08 , "draft-ietf-ipsec-nat-t-ike-08" },
52b7d2ce	70	{ VENDORID_NATT_APPLE , "draft-ietf-ipsec-nat-t-ike" },
52b7d2ce A	71	{ VENDORID_NATT_RFC , "RFC 3947" },
	72	{ VENDORID_XAUTH , "draft-ietf-ipsra-isakmp-xauth-06.txt" },
	73	{ VENDORID_UNITY , "CISCO-UNITY" },
	74	{ VENDORID_FRAG , "FRAGMENTATION" },
	75	/* Just a readable string for DPD ... */
	76	{ VENDORID_DPD , "DPD" },
	77	};
	78
	79	#define NUMVENDORIDS (sizeof(all_vendor_ids)/sizeof(all_vendor_ids[0]))
	80
	81	#define DPD_MAJOR_VERSION 0x01
	82	#define DPD_MINOR_VERSION 0x00
	83
	84	const char vendorid_dpd_hash[] = {
	85	0xAF, 0xCA, 0xD7, 0x13,
	86	0x68, 0xA1, 0xF1, 0xC9,
	87	0x6B, 0x86, 0x96, 0xFC,
	88	0x77, 0x57, DPD_MAJOR_VERSION, DPD_MINOR_VERSION
	89	};
	90
	91
	92	static vchar_t vendorid_fixup(int, vchar_t t);
	93
	94	static struct vendor_id *
	95	lookup_vendor_id_by_id (int id)
	96	{
	97	int i;
	98
	99	for (i = 0; i < NUMVENDORIDS; i++)
	100	if (all_vendor_ids[i].id == id)
	101	return &all_vendor_ids[i];
	102
	103	return NULL;
	104	}
	105
	106	const char *
	107	vid_string_by_id (int id)
	108	{
	109	struct vendor_id *current;
	110
	111	if (id == VENDORID_DPD)
	112	return vendorid_dpd_hash;
	113
	114	current = lookup_vendor_id_by_id(id);
	115
	116	return current ? current->string : NULL;
	117	}
	118
	119	static struct vendor_id *
	120	lookup_vendor_id_by_hash (const char *hash)
	121	{
	122	int i;
52b7d2ce A	123
	124	for (i = 0; i < NUMVENDORIDS; i++)
	125	if (strncmp(all_vendor_ids[i].hash->v, hash,
	126	all_vendor_ids[i].hash->l) == 0)
	127	return &all_vendor_ids[i];
	128
	129	return NULL;
	130	}
	131
	132	void
	133	compute_vendorids (void)
	134	{
	135	int i;
	136	vchar_t vid;
	137
	138	for (i = 0; i < NUMVENDORIDS; i++) {
	139	/* VENDORID_DPD is not a MD5 sum... */
	140	if(i == VENDORID_DPD){
	141	all_vendor_ids[i].hash = vmalloc(sizeof(vendorid_dpd_hash));
	142	if (all_vendor_ids[i].hash == NULL) {
65c25746	143	plog(ASL_LEVEL_ERR,
52b7d2ce A	144	"unable to get memory for VID hash\n");
	145	exit(1); /* this really shouldn't happen */
	146	}
	147	memcpy(all_vendor_ids[i].hash->v, vendorid_dpd_hash,
	148	sizeof(vendorid_dpd_hash));
	149	continue;
	150	}
	151
	152	vid.v = (char *) all_vendor_ids[i].string;
	153	vid.l = strlen(vid.v);
	154
	155	all_vendor_ids[i].hash = eay_md5_one(&vid);
	156	if (all_vendor_ids[i].hash == NULL)
65c25746	157	plog(ASL_LEVEL_ERR,
52b7d2ce A	158	"unable to hash vendor ID string\n");
	159
	160	/* Special cases */
	161	all_vendor_ids[i].hash =
	162	vendorid_fixup(all_vendor_ids[i].id,
	163	all_vendor_ids[i].hash);
	164	}
	165	}
	166
	167	/*
	168	* set hashed vendor id.
	169	* hash function is always MD5.
	170	*/
	171	vchar_t *
	172	set_vendorid(int vendorid)
	173	{
	174	struct vendor_id *current;
52b7d2ce A	175
	176	if (vendorid == VENDORID_UNKNOWN) {
	177	/*
	178	* The default unknown ID gets translated to
	179	* KAME/racoon.
	180	*/
	181	vendorid = VENDORID_KAME;
	182	}
	183
	184	current = lookup_vendor_id_by_id(vendorid);
	185	if (current == NULL) {
65c25746	186	plog(ASL_LEVEL_ERR,
52b7d2ce A	187	"invalid vendor ID index: %d\n", vendorid);
	188	return (NULL);
	189	}
	190
	191	/* The rest of racoon expects a private copy
	192	* of the VID that could be free'd after use.
	193	* That's why we don't return the original pointer. */
	194	return vdup(current->hash);
	195	}
	196
	197	/*
	198	* Check the vendor ID payload -- return the vendor ID index
	199	* if we find a recognized one, or UNKNOWN if we don't.
	200	*
	201	* gen ... points to Vendor ID payload.
	202	*/
	203	int
	204	check_vendorid(struct isakmp_gen *gen)
	205	{
85f41bec	206	int vidlen;
52b7d2ce A	207	struct vendor_id *current;
	208
	209	if (gen == NULL)
	210	return (VENDORID_UNKNOWN);
	211
	212	vidlen = ntohs(gen->len) - sizeof(*gen);
	213
	214	current = lookup_vendor_id_by_hash((char *)(gen + 1));
	215	if (!current)
	216	goto unknown;
	217
	218	if (current->hash->l < vidlen)
65c25746	219	plog(ASL_LEVEL_INFO,
52b7d2ce A	220	"received broken Microsoft ID: %s\n",
	221	current->string);
	222	else
65c25746	223	plog(ASL_LEVEL_INFO,
52b7d2ce A	224	"received Vendor ID: %s\n",
	225	current->string);
	226
	227	return current->id;
	228
	229	unknown:
65c25746	230	plogdump(ASL_LEVEL_DEBUG, (char *)(gen + 1), vidlen, "received unknown Vendor ID:\n");
52b7d2ce A	231	return (VENDORID_UNKNOWN);
	232	}
	233
	234	static vchar_t *
	235	vendorid_fixup(vendorid, vidhash)
	236	int vendorid;
	237	vchar_t *vidhash;
	238	{
	239	switch(vendorid) {
	240	case VENDORID_XAUTH: { /* The vendor Id is truncated */
	241	vchar_t *tmp;
	242
	243	if ((tmp = vmalloc(8)) == NULL) {
65c25746	244	plog(ASL_LEVEL_ERR,
52b7d2ce A	245	"unable to hash vendor ID string\n");
	246	return NULL;
	247	}
	248
	249	memcpy(tmp->v, vidhash->v, 8);
	250	vfree(vidhash);
	251	vidhash = tmp;
	252
	253	break;
	254	}
	255	case VENDORID_UNITY: /* Two bytes tweak */
	256	vidhash->v[14] = 0x01;
	257	vidhash->v[15] = 0x00;
	258	break;
	259
	260	default:
	261	break;
	262	}
	263
	264	return vidhash;
	265	}