ipsec-tools/racoon/isakmp_frag.c

   1 /*      $NetBSD: isakmp_frag.c,v 1.4 2006/09/09 16:22:09 manu Exp $     */
   2
   3 /* Id: isakmp_frag.c,v 1.4 2004/11/13 17:31:36 manubsd Exp */
   4
   5 /*
   6  * Copyright (C) 2004 Emmanuel Dreyfus
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  * 3. Neither the name of the project nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "config.h"
  35
  36 #include <sys/types.h>
  37 #include <sys/param.h>
  38 #include <sys/socket.h>
  39 #include <sys/queue.h>
  40
  41 #include <netinet/in.h>
  42 #include <arpa/inet.h>
  43
  44 #ifdef HAVE_OPENSSL
  45 #include <openssl/md5.h>
  46 #endif
  47
  48 #include <stdlib.h>
  49 #include <stdio.h>
  50 #include <fcntl.h>
  51 #include <string.h>
  52 #include <errno.h>
  53 #if TIME_WITH_SYS_TIME
  54 # include <sys/time.h>
  55 # include <time.h>
  56 #else
  57 # if HAVE_SYS_TIME_H
  58 #  include <sys/time.h>
  59 # else
  60 #  include <time.h>
  61 # endif
  62 #endif
  63 #include <netdb.h>
  64 #ifdef HAVE_UNISTD_H
  65 #include <unistd.h>
  66 #endif
  67 #include <ctype.h>
  68
  69 #include "var.h"
  70 #include "misc.h"
  71 #include "vmbuf.h"
  72 #include "plog.h"
  73 #include "sockmisc.h"
  74 #include "schedule.h"
  75 #include "debug.h"
  76
  77 #include "isakmp_var.h"
  78 #include "isakmp.h"
  79 #include "handler.h"
  80 #include "isakmp_frag.h"
  81 #include "strnames.h"
  82 #include "nattraversal.h"
  83 #include "grabmyaddr.h"
  84 #include "localconf.h"
  85
  86 int
  87 isakmp_sendfrags(iph1, buf)
  88         struct ph1handle *iph1;
  89         vchar_t *buf;
  90 {
  91         struct isakmp *hdr;
  92         struct isakmp_frag *fraghdr;
  93         caddr_t data;
  94         caddr_t sdata;
  95         size_t datalen;
  96         size_t max_datalen;
  97         size_t fraglen;
  98         vchar_t *frag;
  99         unsigned int trailer;
 100         unsigned int fragnum = 0;
 101         size_t len;
 102         int etype;
 103 #ifdef ENABLE_NATT
 104         size_t extralen = NON_ESP_MARKER_USE(iph1)? NON_ESP_MARKER_LEN : 0;
 105 #else
 106         size_t extralen = 0;
 107 #endif
 108         int s;
 109         vchar_t *vbuf;
 110
 111
 112         /* select the socket to be sent */
 113         s = getsockmyaddr(iph1->local);
 114         if (s == -1){
 115                 return -1;
 116         }
 117
 118         /*
 119          * Catch the exchange type for later: the fragments and the
 120          * fragmented packet must have the same exchange type.
 121          */
 122         hdr = (struct isakmp *)buf->v;
 123         etype = hdr->etype;
 124
 125         /*
 126          * We want to send a a packet smaller than ISAKMP_FRAG_MAXLEN
 127          * First compute the maximum data length that will fit in it
 128          */
 129         max_datalen = ISAKMP_FRAG_MAXLEN -
 130             (sizeof(*hdr) + sizeof(*fraghdr));
 131
 132         sdata = buf->v;
 133         len = buf->l;
 134
 135         while (len > 0) {
 136                 fragnum++;
 137
 138                 if (len > max_datalen)
 139                         datalen = max_datalen;
 140                 else
 141                         datalen = len;
 142
 143                 fraglen = sizeof(*hdr) + sizeof(*fraghdr) + datalen;
 144
 145                 if ((frag = vmalloc(fraglen)) == NULL) {
 146                         plog(LLV_ERROR, LOCATION, NULL,
 147                             "Cannot allocate memory\n");
 148                         return -1;
 149                 }
 150
 151                 set_isakmp_header1(frag, iph1, ISAKMP_NPTYPE_FRAG);
 152                 hdr = (struct isakmp *)frag->v;
 153                 hdr->etype = etype;
 154
 155                 fraghdr = (struct isakmp_frag *)(hdr + 1);
 156                 fraghdr->unknown0 = 0;
 157                 fraghdr->len = htons(fraglen - sizeof(*hdr));
 158                 fraghdr->unknown1 = htons(1);
 159                 fraghdr->index = fragnum;
 160                 if (len == datalen)
 161                         fraghdr->flags = ISAKMP_FRAG_LAST;
 162                 else
 163                         fraghdr->flags = 0;
 164
 165                 data = (caddr_t)(fraghdr + 1);
 166                 memcpy(data, sdata, datalen);
 167
 168 #ifdef ENABLE_NATT
 169                 /* If NAT-T port floating is in use, 4 zero bytes (non-ESP marker)
 170                  must added just before the packet itself. For this we must
 171                  allocate a new buffer and release it at the end. */
 172                 if (extralen) {
 173                         if ((vbuf = vmalloc(frag->l + extralen)) == NULL) {
 174                                 plog(LLV_ERROR, LOCATION, NULL,
 175                                          "%s: vbuf allocation failed\n", __FUNCTION__);
 176                                 vfree(frag);
 177                                 return -1;
 178                         }
 179                         *(u_int32_t *)vbuf->v = 0; // non-esp marker
 180                         memcpy(vbuf->v + extralen, frag->v, frag->l);
 181                         vfree(frag);
 182                         frag = vbuf;
 183                 }
 184 #endif
 185
 186                 if (sendfromto(s, frag->v, frag->l,
 187                                            iph1->local, iph1->remote, lcconf->count_persend) == -1) {
 188                         plog(LLV_ERROR, LOCATION, NULL, "%s: sendfromto failed\n", __FUNCTION__);
 189                         vfree(frag);
 190                         return -1;
 191                 }
 192
 193                 vfree(frag);
 194
 195                 len -= datalen;
 196                 sdata += datalen;
 197         }
 198
 199         plog(LLV_DEBUG2, LOCATION, NULL,
 200                  "%s: processed %d fragments\n", __FUNCTION__, fragnum);
 201
 202         return fragnum;
 203 }
 204
 205 unsigned int
 206 vendorid_frag_cap(gen)
 207         struct isakmp_gen *gen;
 208 {
 209         int *hp;
 210         int hashlen_bytes = eay_md5_hashlen() >> 3;
 211
 212         hp = (int *)(gen + 1);
 213
 214         return ntohl(hp[hashlen_bytes / sizeof(*hp)]);
 215 }
 216
 217 int
 218 isakmp_frag_extract(iph1, msg)
 219         struct ph1handle *iph1;
 220         vchar_t *msg;
 221 {
 222         struct isakmp *isakmp;
 223         struct isakmp_frag *frag;
 224         struct isakmp_frag_item *item;
 225         vchar_t *buf;
 226         size_t len;
 227         int last_frag = 0;
 228         char *data;
 229         int i;
 230
 231         if (msg->l < sizeof(*isakmp) + sizeof(*frag)) {
 232                 plog(LLV_ERROR, LOCATION, NULL, "Message too short\n");
 233                 return -1;
 234         }
 235
 236         isakmp = (struct isakmp *)msg->v;
 237         frag = (struct isakmp_frag *)(isakmp + 1);
 238
 239         /*
 240          * frag->len is the frag payload data plus the frag payload header,
 241          * whose size is sizeof(*frag)
 242          */
 243         if (msg->l < sizeof(*isakmp) + ntohs(frag->len) ||
 244                 ntohs(frag->len) < sizeof(*frag) + 1) {
 245                 plog(LLV_ERROR, LOCATION, NULL, "Fragment too short\n");
 246                 return -1;
 247         }
 248
 249         if (ntohs(frag->len) < sizeof(*frag)) {
 250                 plog(LLV_ERROR, LOCATION, NULL,
 251                          "invalid Frag, frag-len %d\n",
 252                          ntohs(frag->len));
 253                 return -1;
 254         }
 255
 256         if ((buf = vmalloc(ntohs(frag->len) - sizeof(*frag))) == NULL) {
 257                 plog(LLV_ERROR, LOCATION, NULL, "Cannot allocate memory\n");
 258                 return -1;
 259         }
 260
 261         if ((item = racoon_malloc(sizeof(*item))) == NULL) {
 262                 plog(LLV_ERROR, LOCATION, NULL, "Cannot allocate memory\n");
 263                 vfree(buf);
 264                 return -1;
 265         }
 266         bzero(item, sizeof(*item));
 267
 268         data = (char *)(frag + 1);
 269         memcpy(buf->v, data, buf->l);
 270
 271         item->frag_num = frag->index;
 272         item->frag_last = (frag->flags & ISAKMP_FRAG_LAST);
 273         item->frag_next = NULL;
 274         item->frag_packet = buf;
 275         item->frag_id = ntohs(frag->unknown1);
 276
 277         /* Look for the last frag while inserting the new item in the chain */
 278         if (item->frag_last)
 279                 last_frag = item->frag_num;
 280
 281         if (iph1->frag_chain == NULL) {
 282                 iph1->frag_chain = item;
 283         } else {
 284                 struct isakmp_frag_item *current;
 285                 int dup = 0;
 286
 287                 current = iph1->frag_chain;
 288                 if (!current->frag_next && current->frag_last) {
 289                         last_frag = current->frag_num;
 290                 }
 291                 while (current->frag_next) {
 292                         if (current->frag_last)
 293                                 last_frag = current->frag_num;
 294                         if (current->frag_num == item->frag_num) {
 295                                 dup = 1;
 296                         }
 297                         current = current->frag_next;
 298                 }
 299                 // avoid duplicates
 300                 if (!dup) {
 301                         current->frag_next = item;
 302                 } else {
 303                         racoon_free(item);
 304                         vfree(buf);
 305                         item = NULL;
 306                         buf = NULL;
 307                 }
 308         }
 309
 310         /* If we saw the last frag, check if the chain is complete */
 311         if (last_frag != 0) {
 312                 for (i = 1; i <= last_frag; i++) {
 313                         item = iph1->frag_chain;
 314                         do {
 315                                 if (item->frag_num == i)
 316                                         break;
 317                                 item = item->frag_next;
 318                         } while (item != NULL);
 319
 320                         if (item == NULL) /* Not found */
 321                                 break;
 322                 }
 323
 324                 if (item != NULL) /* It is complete */
 325                         return 1;
 326         }
 327
 328         plog(LLV_DEBUG2, LOCATION, NULL,
 329                  "%s: processed %d fragments\n", __FUNCTION__, last_frag);
 330
 331         return 0;
 332 }
 333
 334 vchar_t *
 335 isakmp_frag_reassembly(iph1)
 336         struct ph1handle *iph1;
 337 {
 338         struct isakmp_frag_item *item;
 339         size_t len = 0;
 340         vchar_t *buf = NULL;
 341         int frag_count = 0, frag_max = 0;
 342         int i;
 343         char *data;
 344
 345         if ((item = iph1->frag_chain) == NULL) {
 346                 plog(LLV_ERROR, LOCATION, NULL, "No fragment to reassemble\n");
 347                 goto out;
 348         }
 349
 350         do {
 351                 frag_count++;
 352                 if (item->frag_num > frag_max && item->frag_last) {
 353                         frag_max = item->frag_num;
 354                 }
 355                 len += item->frag_packet->l;
 356                 item = item->frag_next;
 357         } while (item != NULL);
 358
 359         if ((buf = vmalloc(len)) == NULL) {
 360                 plog(LLV_ERROR, LOCATION, NULL, "Cannot allocate memory\n");
 361                 goto out;
 362         }
 363         data = buf->v;
 364
 365         for (i = 1; i <= frag_max; i++) {
 366                 item = iph1->frag_chain;
 367                 do {
 368                         if (item->frag_num == i)
 369                                 break;
 370                         item = item->frag_next;
 371                 } while (item != NULL);
 372
 373                 if (item == NULL) {
 374                         plog(LLV_ERROR, LOCATION, NULL,
 375                             "Missing fragment #%d\n", i);
 376                         vfree(buf);
 377                         buf = NULL;
 378                         return buf;
 379                 }
 380                 memcpy(data, item->frag_packet->v, item->frag_packet->l);
 381                 data += item->frag_packet->l;
 382         }
 383
 384         plog(LLV_DEBUG2, LOCATION, NULL,
 385                  "%s: processed %d fragments\n", __FUNCTION__, frag_count);
 386
 387 out:
 388         item = iph1->frag_chain;
 389
 390         while (item != NULL) {
 391                 struct isakmp_frag_item *next_item;
 392
 393                 next_item = item->frag_next;
 394
 395                 vfree(item->frag_packet);
 396                 racoon_free(item);
 397
 398                 item = next_item;
 399         }
 400
 401         iph1->frag_chain = NULL;
 402
 403         return buf;
 404 }
 405
 406 vchar_t *
 407 isakmp_frag_addcap(buf, cap)
 408         vchar_t *buf;
 409         int cap;
 410 {
 411         int *capp;
 412         size_t len;
 413         int hashlen_bytes = eay_md5_hashlen() >> 3;
 414
 415         /* If the capability has not been added, add room now */
 416         len = buf->l;
 417         if (len == hashlen_bytes) {
 418                 if ((buf = vrealloc(buf, len + sizeof(cap))) == NULL) {
 419                         plog(LLV_ERROR, LOCATION, NULL,
 420                             "Cannot allocate memory\n");
 421                         return NULL;
 422                 }
 423                 capp = (int *)(buf->v + len);
 424                 *capp = htonl(0);
 425         }
 426
 427         capp = (int *)(buf->v + hashlen_bytes);
 428         *capp |= htonl(cap);
 429
 430         return buf;
 431 }
 432
 433 int
 434 sendfragsfromto(s, buf, local, remote, count_persend, frag_flags)
 435         int              s;
 436         vchar_t         *buf;
 437         struct sockaddr *local;
 438         struct sockaddr *remote;
 439         int              count_persend;
 440         u_int32_t        frag_flags;
 441 {
 442         struct isakmp *main_hdr;
 443         struct isakmp *hdr;
 444         struct isakmp_frag *fraghdr;
 445         caddr_t data;
 446         caddr_t sdata;
 447         size_t datalen;
 448         size_t max_datalen;
 449         size_t fraglen;
 450         vchar_t *frag;
 451         unsigned int trailer;
 452         unsigned int fragnum = 0;
 453         size_t len;
 454 #ifdef ENABLE_NATT
 455         size_t extralen = (frag_flags & FRAG_PUT_NON_ESP_MARKER)? NON_ESP_MARKER_LEN : 0;
 456 #else
 457         size_t extralen = 0;
 458 #endif
 459
 460         /*
 461          * fragmented packet must have the same exchange type (amongst other fields in the header).
 462          */
 463         main_hdr = (struct isakmp *)buf->v;
 464
 465         /*
 466          * We want to send a a packet smaller than ISAKMP_FRAG_MAXLEN
 467          * First compute the maximum data length that will fit in it
 468          */
 469         max_datalen = ISAKMP_FRAG_MAXLEN -
 470         (sizeof(*main_hdr) + sizeof(*fraghdr));
 471
 472         sdata = buf->v;
 473         len = buf->l;
 474
 475         while (len > 0) {
 476                 fragnum++;
 477
 478                 if (len > max_datalen)
 479                         datalen = max_datalen;
 480                 else
 481                         datalen = len;
 482
 483                 fraglen = sizeof(*hdr) + sizeof(*fraghdr) + datalen;
 484
 485                 if ((frag = vmalloc(fraglen)) == NULL) {
 486                         plog(LLV_ERROR, LOCATION, NULL,
 487                                  "Cannot allocate memory\n");
 488                         return -1;
 489                 }
 490
 491                 hdr = (struct isakmp *)frag->v;
 492                 bcopy(main_hdr, hdr, sizeof(*hdr));
 493                 hdr->len = htonl(frag->l);
 494                 hdr->np = ISAKMP_NPTYPE_FRAG;
 495
 496                 fraghdr = (struct isakmp_frag *)(hdr + 1);
 497                 fraghdr->unknown0 = 0;
 498                 fraghdr->len = htons(fraglen - sizeof(*hdr));
 499                 fraghdr->unknown1 = htons(1);
 500                 fraghdr->index = fragnum;
 501                 if (len == datalen)
 502                         fraghdr->flags = ISAKMP_FRAG_LAST;
 503                 else
 504                         fraghdr->flags = 0;
 505
 506                 data = (caddr_t)(fraghdr + 1);
 507                 memcpy(data, sdata, datalen);
 508
 509 #ifdef ENABLE_NATT
 510                 /* If NAT-T port floating is in use, 4 zero bytes (non-ESP marker)
 511                  must added just before the packet itself. For this we must
 512                  allocate a new buffer and release it at the end. */
 513                 if (extralen) {
 514                         vchar_t *vbuf;
 515
 516                         if ((vbuf = vmalloc(frag->l + extralen)) == NULL) {
 517                                 plog(LLV_ERROR, LOCATION, NULL,
 518                                          "%s: vbuf allocation failed\n", __FUNCTION__);
 519                                 vfree(frag);
 520                                 return -1;
 521                         }
 522                         *(u_int32_t *)vbuf->v = 0; // non-esp marker
 523                         memcpy(vbuf->v + extralen, frag->v, frag->l);
 524                         vfree(frag);
 525                         frag = vbuf;
 526                 }
 527 #endif
 528
 529                 if (sendfromto(s, frag->v, frag->l, local, remote, count_persend) == -1) {
 530                         plog(LLV_ERROR, LOCATION, NULL, "sendfromto failed\n");
 531                         vfree(frag);
 532                         return -1;
 533                 }
 534
 535                 vfree(frag);
 536
 537                 len -= datalen;
 538                 sdata += datalen;
 539         }
 540
 541         plog(LLV_DEBUG2, LOCATION, NULL,
 542                  "%s: processed %d fragments\n", __FUNCTION__, fragnum);
 543
 544         return fragnum;
 545 }