[apple/ipsec.git] / ipsec-tools / racoon / policy.c

/*	$KAME: policy.c,v 1.46 2001/11/16 04:08:10 sakane Exp $	*/

/*
 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
 * All rights reserved.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the project nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 * 
 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#include "config.h"

#include <sys/param.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/queue.h>

#include <netinet/in.h>
#ifdef HAVE_NETINET6_IPSEC
#  include <netinet6/ipsec.h>
#else
#  include <netinet/ipsec.h>
#endif

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>

#include "var.h"
#include "misc.h"
#include "vmbuf.h"
#include "plog.h"
#include "sockmisc.h"
#include "debug.h"

#include "policy.h"
#include "localconf.h"
#include "isakmp_var.h"
#include "isakmp.h"
#include "oakley.h"
#include "handler.h"
#include "strnames.h"
#include "gcmalloc.h"
#include "session.h"

static TAILQ_HEAD(_sptree, secpolicy) sptree;

/* perform exact match against security policy table. */
struct secpolicy *
getsp(spidx)
	struct policyindex *spidx;
{
	struct secpolicy *p;

	for (p = TAILQ_FIRST(&sptree); p; p = TAILQ_NEXT(p, chain)) {
		if (!cmpspidxstrict(spidx, &p->spidx))
			return p;
	}

	return NULL;
}

/*
 * perform non-exact match against security policy table, only if this is
 * transport mode SA negotiation.  for example, 0.0.0.0/0 -> 0.0.0.0/0
 * entry in policy.txt can be returned when we're negotiating transport
 * mode SA.  this is how the kernel works.
 */
#if 1
struct secpolicy *
getsp_r(spidx, iph2)
	struct policyindex *spidx;
	struct ph2handle *iph2;
{
	struct secpolicy *p;
	int mismatched_outer_addr = 0;

	for (p = TAILQ_FIRST(&sptree); p; p = TAILQ_NEXT(p, chain)) {
		if (!cmpspidxwild(spidx, &p->spidx)) {
			if (spidx->dir != IPSEC_DIR_ANY) {
				struct ipsecrequest *isr;
				for (isr = p->req; isr != NULL; isr = isr->next) {
					if (isr->saidx.mode != IPSEC_MODE_TUNNEL) {
						plog(LLV_DEBUG2, LOCATION, NULL, "%s, skipping policy. dir %d, mode %d\n",
							 __FUNCTION__, spidx->dir, isr->saidx.mode);
						continue;
					}

					// for tunnel mode: verify the outer ip addresses match the phase2's addresses
					if (spidx->dir == IPSEC_DIR_INBOUND) {
						// TODO: look out for wildcards
						if (!cmpsaddrwop(iph2->dst, &isr->saidx.src) &&
							!cmpsaddrwop(iph2->src, &isr->saidx.dst)) {
							plog(LLV_DEBUG2, LOCATION, NULL, "%s, inbound policy outer addresses matched phase2's addresses\n",
								 __FUNCTION__);
							return p;
						} else {
							mismatched_outer_addr = 1;
						}
					} else if (spidx->dir == IPSEC_DIR_OUTBOUND) {
						// TODO: look out for wildcards
						if (!cmpsaddrwop(iph2->src, &isr->saidx.src) &&
							!cmpsaddrwop(iph2->dst, &isr->saidx.dst)) {
							plog(LLV_DEBUG2, LOCATION, NULL, "%s, outbound policy outer addresses matched phase2's addresses\n",
								 __FUNCTION__);
							return p;
						} else {
							mismatched_outer_addr = 1;
						}
					} else {
						mismatched_outer_addr = 1;
					}
					if (mismatched_outer_addr) {
						plog(LLV_DEBUG2, LOCATION, NULL, "%s, policy outer addresses matched phase2's addresses: dir %d\n",
							 __FUNCTION__, spidx->dir);
						plog(LLV_DEBUG, LOCATION, NULL, "src1: %s\n",
							 saddr2str((struct sockaddr *)iph2->src));
						plog(LLV_DEBUG, LOCATION, NULL, "src2: %s\n",
							 saddr2str((struct sockaddr *)&isr->saidx.src));
						plog(LLV_DEBUG, LOCATION, NULL, "dst1: %s\n",
							 saddr2str((struct sockaddr *)iph2->dst));
						plog(LLV_DEBUG, LOCATION, NULL, "dst2: %s\n",
							 saddr2str((struct sockaddr *)&isr->saidx.dst));
					}
				}
			}
			if (!mismatched_outer_addr) {
				return p;
			}
		}
	}

	return NULL;
}
#else
struct secpolicy *
getsp_r(spidx, iph2)
	struct policyindex *spidx;
	struct ph2handle *iph2;
{
	struct secpolicy *p;
	u_int8_t prefixlen;

	plog(LLV_DEBUG, LOCATION, NULL, "checking for transport mode\n");

	if (spidx->src.ss_family != spidx->dst.ss_family) {
		plog(LLV_ERROR, LOCATION, NULL,
			"address family mismatch, src:%d dst:%d\n",
				spidx->src.ss_family,
				spidx->dst.ss_family);
		return NULL;
	}
	switch (spidx->src.ss_family) {
	case AF_INET:
		prefixlen = sizeof(struct in_addr) << 3;
		break;
#ifdef INET6
	case AF_INET6:
		prefixlen = sizeof(struct in6_addr) << 3;
		break;
#endif
	default:
		plog(LLV_ERROR, LOCATION, NULL,
			"invalid family: %d\n", spidx->src.ss_family);
		return NULL;
	}

	/* is it transport mode SA negotiation? */
	plog(LLV_DEBUG, LOCATION, NULL, "src1: %s\n",
		saddr2str(iph2->src));
	plog(LLV_DEBUG, LOCATION, NULL, "src2: %s\n",
		saddr2str(&spidx->src));
	if (cmpsaddrwop(iph2->src, &spidx->src)
	 || spidx->prefs != prefixlen)
		return NULL;

	plog(LLV_DEBUG, LOCATION, NULL, "dst1: %s\n",
		saddr2str(iph2->dst));
	plog(LLV_DEBUG, LOCATION, NULL, "dst2: %s\n",
		saddr2str(&spidx->dst));
	if (cmpsaddrwop(iph2->dst, &spidx->dst)
	 || spidx->prefd != prefixlen)
		return NULL;

	plog(LLV_DEBUG, LOCATION, NULL, "looks to be transport mode\n");

	for (p = TAILQ_FIRST(&sptree); p; p = TAILQ_NEXT(p, chain)) {
		if (!cmpspidx_wild(spidx, &p->spidx))
			return p;
	}

	return NULL;
}
#endif

struct secpolicy *
getspbyspid(spid)
	u_int32_t spid;
{
	struct secpolicy *p;

	for (p = TAILQ_FIRST(&sptree); p; p = TAILQ_NEXT(p, chain)) {
		if (p->id == spid)
			return p;
	}

	return NULL;
}

/*
 * compare policyindex.
 * a: subject b: db
 * OUT:	0:	equal
 *	1:	not equal
 */
int
cmpspidxstrict(a, b)
	struct policyindex *a, *b;
{
	//plog(LLV_DEBUG, LOCATION, NULL, "sub:%p: %s\n", a, spidx2str(a));
	//plog(LLV_DEBUG, LOCATION, NULL, "db :%p: %s\n", b, spidx2str(b));

	/* XXX don't check direction now, but it's to be checked carefully. */
	if (a->dir != b->dir
	 || a->prefs != b->prefs
	 || a->prefd != b->prefd
	 || a->ul_proto != b->ul_proto)
		return 1;

	if (cmpsaddrstrict(&a->src, &b->src))
		return 1;
	if (cmpsaddrstrict(&a->dst, &b->dst))
		return 1;

	return 0;
}

/*
 * compare policyindex, with wildcard address/protocol match.
 * a: subject b: db, can contain wildcard things.
 * OUT:	0:	equal
 *	1:	not equal
 */
int
cmpspidxwild(a, b)
	struct policyindex *a, *b;
{
	struct sockaddr_storage sa1, sa2;

	//plog(LLV_DEBUG, LOCATION, NULL, "sub:%p: %s\n", a, spidx2str(a));
	//plog(LLV_DEBUG, LOCATION, NULL, "db: %p: %s\n", b, spidx2str(b));

	if (!(b->dir == IPSEC_DIR_ANY || a->dir == b->dir))
		return 1;

	if (!(a->ul_proto == IPSEC_ULPROTO_ANY ||
	      b->ul_proto == IPSEC_ULPROTO_ANY ||
	      a->ul_proto == b->ul_proto))
		return 1;

	if (a->src.ss_family != b->src.ss_family)
		return 1;
	if (a->dst.ss_family != b->dst.ss_family)
		return 1;

	/* compare src address */
	if (sizeof(sa1) < a->src.ss_len || sizeof(sa2) < b->src.ss_len) {
		plog(LLV_ERROR, LOCATION, NULL,
			"unexpected error: "
			"src.ss_len:%d dst.ss_len:%d\n",
			a->src.ss_len, b->src.ss_len);
		return 1;
	}
	mask_sockaddr(&sa1, &a->src, b->prefs);
	mask_sockaddr(&sa2, &b->src, b->prefs);
	plog(LLV_DEBUG, LOCATION, NULL, "%p masked with /%d: %s\n",
		a, b->prefs, saddr2str((struct sockaddr *)&sa1));
	plog(LLV_DEBUG, LOCATION, NULL, "%p masked with /%d: %s\n",
		b, b->prefs, saddr2str((struct sockaddr *)&sa2));
	if (cmpsaddrwild(&sa1, &sa2))
		return 1;

	/* compare dst address */
	if (sizeof(sa1) < a->dst.ss_len || sizeof(sa2) < b->dst.ss_len) {
		plog(LLV_ERROR, LOCATION, NULL, "unexpected error\n");
		exit(1);
	}
	mask_sockaddr(&sa1, &a->dst, b->prefd);
	mask_sockaddr(&sa2, &b->dst, b->prefd);
	plog(LLV_DEBUG, LOCATION, NULL, "%p masked with /%d: %s\n",
		a, b->prefd, saddr2str((struct sockaddr *)&sa1));
	plog(LLV_DEBUG, LOCATION, NULL, "%p masked with /%d: %s\n",
		b, b->prefd, saddr2str((struct sockaddr *)&sa2));
	if (cmpsaddrwild(&sa1, &sa2))
		return 1;

	return 0;
}

struct secpolicy *
newsp()
{
	struct secpolicy *new;

	new = racoon_calloc(1, sizeof(*new));
	if (new == NULL)
		return NULL;

	return new;
}

void
delsp(sp)
	struct secpolicy *sp;
{
	struct ipsecrequest *req = NULL, *next;

	for (req = sp->req; req; req = next) {
		next = req->next;
		racoon_free(req);
	}
	
	racoon_free(sp);
}

void
delsp_bothdir(spidx0)
	struct policyindex *spidx0;
{
	struct policyindex spidx;
	struct secpolicy *sp;
	struct sockaddr_storage src, dst;
	u_int8_t prefs, prefd;

	memcpy(&spidx, spidx0, sizeof(spidx));
	switch (spidx.dir) {
	case IPSEC_DIR_INBOUND:
#ifdef HAVE_POLICY_FWD
	case IPSEC_DIR_FWD:
#endif
		src   = spidx.src;
		dst   = spidx.dst;
		prefs = spidx.prefs;
		prefd = spidx.prefd;
		break;
	case IPSEC_DIR_OUTBOUND:
		src   = spidx.dst;
		dst   = spidx.src;
		prefs = spidx.prefd;
		prefd = spidx.prefs;
		break;
	default:
		return;
	}

	spidx.src   = src;
	spidx.dst   = dst;
	spidx.prefs = prefs;
	spidx.prefd = prefd;
	spidx.dir   = IPSEC_DIR_INBOUND;

	sp = getsp(&spidx);
	if (sp) {
		remsp(sp);
		delsp(sp);
	}

#ifdef HAVE_POLICY_FWD
	spidx.dir   = IPSEC_DIR_FWD;

	sp = getsp(&spidx);
	if (sp) {
		remsp(sp);
		delsp(sp);
	}
#endif

	spidx.src   = dst;
	spidx.dst   = src;
	spidx.prefs = prefd;
	spidx.prefd = prefs;
	spidx.dir   = IPSEC_DIR_OUTBOUND;

	sp = getsp(&spidx);
	if (sp) {
		remsp(sp);
		delsp(sp);
	}
}

void
inssp(new)
	struct secpolicy *new;
{
#ifdef HAVE_PFKEY_POLICY_PRIORITY
	struct secpolicy *p;

	TAILQ_FOREACH(p, &sptree, chain) {
		if (new->spidx.priority < p->spidx.priority) {
			TAILQ_INSERT_BEFORE(p, new, chain);
			return;
		}
	}
	if (p == NULL)
#endif
	        TAILQ_INSERT_HEAD(&sptree, new, chain);

	check_auto_exit();
	return;
}

void
remsp(sp)
	struct secpolicy *sp;
{
	TAILQ_REMOVE(&sptree, sp, chain);
	check_auto_exit();
}

void
flushsp()
{
	struct secpolicy *p, *next;

	for (p = TAILQ_FIRST(&sptree); p; p = next) {
		next = TAILQ_NEXT(p, chain);
		remsp(p);
		delsp(p);
	}
}

int
policies_installed(void)
{
	if (TAILQ_EMPTY(&sptree))
		return 0;
	else
		return 1;
}

void
initsp()
{
	TAILQ_INIT(&sptree);
}

struct ipsecrequest *
newipsecreq()
{
	struct ipsecrequest *new;

	new = racoon_calloc(1, sizeof(*new));
	if (new == NULL)
		return NULL;

	return new;
}

const char *
spidx2str(spidx)
	const struct policyindex *spidx;
{
	/* addr/pref[port] addr/pref[port] ul dir act */
	static char buf[256];
	char *p, *a, *b;
	int blen, i;

	blen = sizeof(buf) - 1;
	p = buf;

	a = saddr2str((const struct sockaddr *)&spidx->src);
	for (b = a; *b != '\0'; b++)
		if (*b == '[') {
			*b = '\0';
			b++;
			break;
		}
	i = snprintf(p, blen, "%s/%d[%s ", a, spidx->prefs, b);
	if (i < 0 || i >= blen)
		return NULL;
	p += i;
	blen -= i;

	a = saddr2str((const struct sockaddr *)&spidx->dst);
	for (b = a; *b != '\0'; b++)
		if (*b == '[') {
			*b = '\0';
			b++;
			break;
		}
	i = snprintf(p, blen, "%s/%d[%s ", a, spidx->prefd, b);
	if (i < 0 || i >= blen)
		return NULL;
	p += i;
	blen -= i;

	snprintf(p, blen, "proto=%s dir=%s",
		s_proto(spidx->ul_proto), s_direction(spidx->dir));

	return buf;
}
Commit	Line	Data
52b7d2ce A	1	/* $KAME: policy.c,v 1.46 2001/11/16 04:08:10 sakane Exp $ */
	2
	3	/*
	4	* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
	5	* All rights reserved.
	6	*
	7	* Redistribution and use in source and binary forms, with or without
	8	* modification, are permitted provided that the following conditions
	9	* are met:
	10	* 1. Redistributions of source code must retain the above copyright
	11	* notice, this list of conditions and the following disclaimer.
	12	* 2. Redistributions in binary form must reproduce the above copyright
	13	* notice, this list of conditions and the following disclaimer in the
	14	* documentation and/or other materials provided with the distribution.
	15	* 3. Neither the name of the project nor the names of its contributors
	16	* may be used to endorse or promote products derived from this software
	17	* without specific prior written permission.
	18	*
	19	* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
	20	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	21	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	22	* ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
	23	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	24	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	25	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	26	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	27	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	28	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	29	* SUCH DAMAGE.
	30	*/
	31
	32	#include "config.h"
	33
	34	#include <sys/param.h>
	35	#include <sys/types.h>
	36	#include <sys/socket.h>
	37	#include <sys/queue.h>
	38
	39	#include <netinet/in.h>
	40	#ifdef HAVE_NETINET6_IPSEC
	41	# include <netinet6/ipsec.h>
	42	#else
	43	# include <netinet/ipsec.h>
	44	#endif
	45
	46	#include <stdlib.h>
	47	#include <stdio.h>
	48	#include <string.h>
	49	#include <errno.h>
	50
	51	#include "var.h"
	52	#include "misc.h"
	53	#include "vmbuf.h"
	54	#include "plog.h"
	55	#include "sockmisc.h"
	56	#include "debug.h"
	57
	58	#include "policy.h"
	59	#include "localconf.h"
	60	#include "isakmp_var.h"
	61	#include "isakmp.h"
	62	#include "oakley.h"
	63	#include "handler.h"
	64	#include "strnames.h"
65	#include "gcmalloc.h"
66	#include "session.h"
67
68	static TAILQ_HEAD(_sptree, secpolicy) sptree;
69
70	/* perform exact match against security policy table. */
71	struct secpolicy *
72	getsp(spidx)
73	struct policyindex *spidx;
74	{
75	struct secpolicy *p;
76
77	for (p = TAILQ_FIRST(&sptree); p; p = TAILQ_NEXT(p, chain)) {
78	if (!cmpspidxstrict(spidx, &p->spidx))
79	return p;
80	}
81
82	return NULL;
83	}
84
85	/*
86	* perform non-exact match against security policy table, only if this is
87	* transport mode SA negotiation. for example, 0.0.0.0/0 -> 0.0.0.0/0
88	* entry in policy.txt can be returned when we're negotiating transport
89	* mode SA. this is how the kernel works.
90	*/
91	#if 1
92	struct secpolicy *
e97d2cf9	93	getsp_r(spidx, iph2)
52b7d2ce	94	struct policyindex *spidx;
e97d2cf9	95	struct ph2handle *iph2;
52b7d2ce A	96	{
52b7d2ce A	97	struct secpolicy *p;
e97d2cf9	98	int mismatched_outer_addr = 0;
52b7d2ce A	99
52b7d2ce A	100	for (p = TAILQ_FIRST(&sptree); p; p = TAILQ_NEXT(p, chain)) {
e97d2cf9 A	101	if (!cmpspidxwild(spidx, &p->spidx)) {
	102	if (spidx->dir != IPSEC_DIR_ANY) {
	103	struct ipsecrequest *isr;
	104	for (isr = p->req; isr != NULL; isr = isr->next) {
	105	if (isr->saidx.mode != IPSEC_MODE_TUNNEL) {
	106	plog(LLV_DEBUG2, LOCATION, NULL, "%s, skipping policy. dir %d, mode %d\n",
	107	__FUNCTION__, spidx->dir, isr->saidx.mode);
	108	continue;
	109	}
	110
	111	// for tunnel mode: verify the outer ip addresses match the phase2's addresses
	112	if (spidx->dir == IPSEC_DIR_INBOUND) {
	113	// TODO: look out for wildcards
85f41bec A	114	if (!cmpsaddrwop(iph2->dst, &isr->saidx.src) &&
85f41bec A	115	!cmpsaddrwop(iph2->src, &isr->saidx.dst)) {
e97d2cf9 A	116	plog(LLV_DEBUG2, LOCATION, NULL, "%s, inbound policy outer addresses matched phase2's addresses\n",
	117	__FUNCTION__);
	118	return p;
	119	} else {
	120	mismatched_outer_addr = 1;
	121	}
	122	} else if (spidx->dir == IPSEC_DIR_OUTBOUND) {
	123	// TODO: look out for wildcards
85f41bec A	124	if (!cmpsaddrwop(iph2->src, &isr->saidx.src) &&
85f41bec A	125	!cmpsaddrwop(iph2->dst, &isr->saidx.dst)) {
e97d2cf9 A	126	plog(LLV_DEBUG2, LOCATION, NULL, "%s, outbound policy outer addresses matched phase2's addresses\n",
	127	__FUNCTION__);
	128	return p;
	129	} else {
	130	mismatched_outer_addr = 1;
	131	}
	132	} else {
	133	mismatched_outer_addr = 1;
	134	}
	135	if (mismatched_outer_addr) {
	136	plog(LLV_DEBUG2, LOCATION, NULL, "%s, policy outer addresses matched phase2's addresses: dir %d\n",
	137	__FUNCTION__, spidx->dir);
	138	plog(LLV_DEBUG, LOCATION, NULL, "src1: %s\n",
85f41bec	139	saddr2str((struct sockaddr *)iph2->src));
e97d2cf9 A	140	plog(LLV_DEBUG, LOCATION, NULL, "src2: %s\n",
	141	saddr2str((struct sockaddr *)&isr->saidx.src));
	142	plog(LLV_DEBUG, LOCATION, NULL, "dst1: %s\n",
85f41bec	143	saddr2str((struct sockaddr *)iph2->dst));
e97d2cf9 A	144	plog(LLV_DEBUG, LOCATION, NULL, "dst2: %s\n",
	145	saddr2str((struct sockaddr *)&isr->saidx.dst));
	146	}
	147	}
	148	}
	149	if (!mismatched_outer_addr) {
	150	return p;
	151	}
	152	}
52b7d2ce A	153	}
	154
	155	return NULL;
	156	}
	157	#else
	158	struct secpolicy *
	159	getsp_r(spidx, iph2)
	160	struct policyindex *spidx;
	161	struct ph2handle *iph2;
	162	{
	163	struct secpolicy *p;
	164	u_int8_t prefixlen;
	165
	166	plog(LLV_DEBUG, LOCATION, NULL, "checking for transport mode\n");
	167
	168	if (spidx->src.ss_family != spidx->dst.ss_family) {
	169	plog(LLV_ERROR, LOCATION, NULL,
	170	"address family mismatch, src:%d dst:%d\n",
	171	spidx->src.ss_family,
	172	spidx->dst.ss_family);
	173	return NULL;
	174	}
	175	switch (spidx->src.ss_family) {
	176	case AF_INET:
	177	prefixlen = sizeof(struct in_addr) << 3;
	178	break;
	179	#ifdef INET6
	180	case AF_INET6:
	181	prefixlen = sizeof(struct in6_addr) << 3;
	182	break;
	183	#endif
	184	default:
	185	plog(LLV_ERROR, LOCATION, NULL,
	186	"invalid family: %d\n", spidx->src.ss_family);
	187	return NULL;
	188	}
	189
	190	/* is it transport mode SA negotiation? */
	191	plog(LLV_DEBUG, LOCATION, NULL, "src1: %s\n",
	192	saddr2str(iph2->src));
	193	plog(LLV_DEBUG, LOCATION, NULL, "src2: %s\n",
85f41bec A	194	saddr2str(&spidx->src));
85f41bec A	195	if (cmpsaddrwop(iph2->src, &spidx->src)
52b7d2ce A	196	\|\| spidx->prefs != prefixlen)
	197	return NULL;
	198
	199	plog(LLV_DEBUG, LOCATION, NULL, "dst1: %s\n",
	200	saddr2str(iph2->dst));
	201	plog(LLV_DEBUG, LOCATION, NULL, "dst2: %s\n",
85f41bec A	202	saddr2str(&spidx->dst));
85f41bec A	203	if (cmpsaddrwop(iph2->dst, &spidx->dst)
52b7d2ce A	204	\|\| spidx->prefd != prefixlen)
	205	return NULL;
	206
	207	plog(LLV_DEBUG, LOCATION, NULL, "looks to be transport mode\n");
	208
	209	for (p = TAILQ_FIRST(&sptree); p; p = TAILQ_NEXT(p, chain)) {
	210	if (!cmpspidx_wild(spidx, &p->spidx))
	211	return p;
	212	}
	213
	214	return NULL;
	215	}
	216	#endif
	217
	218	struct secpolicy *
	219	getspbyspid(spid)
	220	u_int32_t spid;
	221	{
	222	struct secpolicy *p;
	223
	224	for (p = TAILQ_FIRST(&sptree); p; p = TAILQ_NEXT(p, chain)) {
	225	if (p->id == spid)
	226	return p;
	227	}
	228
	229	return NULL;
	230	}
	231
	232	/*
	233	* compare policyindex.
	234	* a: subject b: db
	235	* OUT: 0: equal
	236	* 1: not equal
	237	*/
	238	int
	239	cmpspidxstrict(a, b)
	240	struct policyindex a, b;
	241	{
85f41bec A	242	//plog(LLV_DEBUG, LOCATION, NULL, "sub:%p: %s\n", a, spidx2str(a));
85f41bec A	243	//plog(LLV_DEBUG, LOCATION, NULL, "db :%p: %s\n", b, spidx2str(b));
52b7d2ce A	244
	245	/* XXX don't check direction now, but it's to be checked carefully. */
	246	if (a->dir != b->dir
	247	\|\| a->prefs != b->prefs
	248	\|\| a->prefd != b->prefd
	249	\|\| a->ul_proto != b->ul_proto)
	250	return 1;
	251
85f41bec	252	if (cmpsaddrstrict(&a->src, &b->src))
52b7d2ce	253	return 1;
85f41bec	254	if (cmpsaddrstrict(&a->dst, &b->dst))
52b7d2ce A	255	return 1;
	256
	257	return 0;
	258	}
	259
	260	/*
	261	* compare policyindex, with wildcard address/protocol match.
	262	* a: subject b: db, can contain wildcard things.
	263	* OUT: 0: equal
	264	* 1: not equal
	265	*/
	266	int
	267	cmpspidxwild(a, b)
	268	struct policyindex a, b;
	269	{
	270	struct sockaddr_storage sa1, sa2;
	271
85f41bec A	272	//plog(LLV_DEBUG, LOCATION, NULL, "sub:%p: %s\n", a, spidx2str(a));
85f41bec A	273	//plog(LLV_DEBUG, LOCATION, NULL, "db: %p: %s\n", b, spidx2str(b));
52b7d2ce A	274
	275	if (!(b->dir == IPSEC_DIR_ANY \|\| a->dir == b->dir))
	276	return 1;
	277
	278	if (!(a->ul_proto == IPSEC_ULPROTO_ANY \|\|
	279	b->ul_proto == IPSEC_ULPROTO_ANY \|\|
	280	a->ul_proto == b->ul_proto))
	281	return 1;
	282
	283	if (a->src.ss_family != b->src.ss_family)
	284	return 1;
	285	if (a->dst.ss_family != b->dst.ss_family)
	286	return 1;
	287
52b7d2ce A	288	/* compare src address */
	289	if (sizeof(sa1) < a->src.ss_len \|\| sizeof(sa2) < b->src.ss_len) {
	290	plog(LLV_ERROR, LOCATION, NULL,
	291	"unexpected error: "
	292	"src.ss_len:%d dst.ss_len:%d\n",
	293	a->src.ss_len, b->src.ss_len);
	294	return 1;
	295	}
85f41bec A	296	mask_sockaddr(&sa1, &a->src, b->prefs);
85f41bec A	297	mask_sockaddr(&sa2, &b->src, b->prefs);
52b7d2ce A	298	plog(LLV_DEBUG, LOCATION, NULL, "%p masked with /%d: %s\n",
	299	a, b->prefs, saddr2str((struct sockaddr *)&sa1));
	300	plog(LLV_DEBUG, LOCATION, NULL, "%p masked with /%d: %s\n",
	301	b, b->prefs, saddr2str((struct sockaddr *)&sa2));
85f41bec	302	if (cmpsaddrwild(&sa1, &sa2))
52b7d2ce A	303	return 1;
52b7d2ce A	304
52b7d2ce A	305	/* compare dst address */
	306	if (sizeof(sa1) < a->dst.ss_len \|\| sizeof(sa2) < b->dst.ss_len) {
	307	plog(LLV_ERROR, LOCATION, NULL, "unexpected error\n");
	308	exit(1);
	309	}
85f41bec A	310	mask_sockaddr(&sa1, &a->dst, b->prefd);
85f41bec A	311	mask_sockaddr(&sa2, &b->dst, b->prefd);
52b7d2ce A	312	plog(LLV_DEBUG, LOCATION, NULL, "%p masked with /%d: %s\n",
	313	a, b->prefd, saddr2str((struct sockaddr *)&sa1));
	314	plog(LLV_DEBUG, LOCATION, NULL, "%p masked with /%d: %s\n",
	315	b, b->prefd, saddr2str((struct sockaddr *)&sa2));
85f41bec	316	if (cmpsaddrwild(&sa1, &sa2))
52b7d2ce A	317	return 1;
	318
	319	return 0;
	320	}
	321
	322	struct secpolicy *
	323	newsp()
	324	{
	325	struct secpolicy *new;
	326
	327	new = racoon_calloc(1, sizeof(*new));
	328	if (new == NULL)
	329	return NULL;
	330
	331	return new;
	332	}
	333
	334	void
	335	delsp(sp)
	336	struct secpolicy *sp;
	337	{
	338	struct ipsecrequest req = NULL, next;
	339
	340	for (req = sp->req; req; req = next) {
	341	next = req->next;
	342	racoon_free(req);
	343	}
	344
	345	racoon_free(sp);
	346	}
	347
	348	void
	349	delsp_bothdir(spidx0)
	350	struct policyindex *spidx0;
	351	{
	352	struct policyindex spidx;
	353	struct secpolicy *sp;
	354	struct sockaddr_storage src, dst;
	355	u_int8_t prefs, prefd;
	356
	357	memcpy(&spidx, spidx0, sizeof(spidx));
	358	switch (spidx.dir) {
	359	case IPSEC_DIR_INBOUND:
	360	#ifdef HAVE_POLICY_FWD
	361	case IPSEC_DIR_FWD:
	362	#endif
	363	src = spidx.src;
	364	dst = spidx.dst;
	365	prefs = spidx.prefs;
	366	prefd = spidx.prefd;
	367	break;
	368	case IPSEC_DIR_OUTBOUND:
	369	src = spidx.dst;
	370	dst = spidx.src;
	371	prefs = spidx.prefd;
	372	prefd = spidx.prefs;
	373	break;
	374	default:
	375	return;
	376	}
	377
	378	spidx.src = src;
	379	spidx.dst = dst;
	380	spidx.prefs = prefs;
381	spidx.prefd = prefd;
382	spidx.dir = IPSEC_DIR_INBOUND;
383
384	sp = getsp(&spidx);
385	if (sp) {
386	remsp(sp);
387	delsp(sp);
388	}
389
390	#ifdef HAVE_POLICY_FWD
391	spidx.dir = IPSEC_DIR_FWD;
392
393	sp = getsp(&spidx);
394	if (sp) {
395	remsp(sp);
396	delsp(sp);
397	}
398	#endif
399
400	spidx.src = dst;
401	spidx.dst = src;
402	spidx.prefs = prefd;
403	spidx.prefd = prefs;
404	spidx.dir = IPSEC_DIR_OUTBOUND;
405
406	sp = getsp(&spidx);
407	if (sp) {
408	remsp(sp);
409	delsp(sp);
410	}
411	}
412
413	void
414	inssp(new)
415	struct secpolicy *new;
416	{
417	#ifdef HAVE_PFKEY_POLICY_PRIORITY
418	struct secpolicy *p;
419
420	TAILQ_FOREACH(p, &sptree, chain) {
421	if (new->spidx.priority < p->spidx.priority) {
422	TAILQ_INSERT_BEFORE(p, new, chain);
423	return;
424	}
425	}
426	if (p == NULL)
427	#endif
d1e348cf	428	TAILQ_INSERT_HEAD(&sptree, new, chain);
52b7d2ce A	429
	430	check_auto_exit();
	431	return;
	432	}
	433
	434	void
	435	remsp(sp)
	436	struct secpolicy *sp;
	437	{
	438	TAILQ_REMOVE(&sptree, sp, chain);
	439	check_auto_exit();
	440	}
	441
	442	void
	443	flushsp()
	444	{
	445	struct secpolicy p, next;
	446
	447	for (p = TAILQ_FIRST(&sptree); p; p = next) {
	448	next = TAILQ_NEXT(p, chain);
	449	remsp(p);
	450	delsp(p);
	451	}
	452	}
	453
	454	int
	455	policies_installed(void)
	456	{
	457	if (TAILQ_EMPTY(&sptree))
	458	return 0;
	459	else
	460	return 1;
	461	}
	462
	463	void
	464	initsp()
	465	{
	466	TAILQ_INIT(&sptree);
	467	}
	468
	469	struct ipsecrequest *
	470	newipsecreq()
	471	{
	472	struct ipsecrequest *new;
	473
	474	new = racoon_calloc(1, sizeof(*new));
	475	if (new == NULL)
	476	return NULL;
	477
	478	return new;
	479	}
	480
	481	const char *
	482	spidx2str(spidx)
	483	const struct policyindex *spidx;
	484	{
	485	/* addr/pref[port] addr/pref[port] ul dir act */
	486	static char buf[256];
	487	char p, a, *b;
	488	int blen, i;
	489
	490	blen = sizeof(buf) - 1;
	491	p = buf;
	492
493	a = saddr2str((const struct sockaddr *)&spidx->src);
494	for (b = a; *b != '\0'; b++)
495	if (*b == '[') {
496	*b = '\0';
497	b++;
498	break;
499	}
500	i = snprintf(p, blen, "%s/%d[%s ", a, spidx->prefs, b);
501	if (i < 0 \|\| i >= blen)
502	return NULL;
503	p += i;
504	blen -= i;
505
506	a = saddr2str((const struct sockaddr *)&spidx->dst);
507	for (b = a; *b != '\0'; b++)
508	if (*b == '[') {
509	*b = '\0';
510	b++;
511	break;
512	}
513	i = snprintf(p, blen, "%s/%d[%s ", a, spidx->prefd, b);
514	if (i < 0 \|\| i >= blen)
515	return NULL;
516	p += i;
517	blen -= i;
518
519	snprintf(p, blen, "proto=%s dir=%s",
520	s_proto(spidx->ul_proto), s_direction(spidx->dir));
521
522	return buf;
523	}