ipsec-tools/racoon/sainfo.c

   1 /*      $KAME: sainfo.c,v 1.16 2003/06/27 07:32:39 sakane Exp $ */
   2
   3 /*
   4  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. Neither the name of the project nor the names of its contributors
  16  *    may be used to endorse or promote products derived from this software
  17  *    without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGE.
  30  */
  31
  32 #include "config.h"
  33
  34 #include <sys/param.h>
  35 #include <sys/types.h>
  36 #include <sys/socket.h>
  37 #include <sys/queue.h>
  38
  39 #include <netinet/in.h>
  40 #include <netinet/in.h>
  41 #ifdef HAVE_NETINET6_IPSEC
  42 #  include <netinet6/ipsec.h>
  43 #else
  44 #  include <netinet/ipsec.h>
  45 #endif
  46
  47 #include <stdlib.h>
  48 #include <stdio.h>
  49 #include <string.h>
  50 #include <errno.h>
  51
  52 #include "var.h"
  53 #include "misc.h"
  54 #include "vmbuf.h"
  55 #include "plog.h"
  56 #include "sockmisc.h"
  57 #include "debug.h"
  58
  59 #include "localconf.h"
  60 #include "isakmp_var.h"
  61 #include "isakmp.h"
  62 #include "ipsec_doi.h"
  63 #include "oakley.h"
  64 #include "handler.h"
  65 #include "algorithm.h"
  66 #include "sainfo.h"
  67 #include "gcmalloc.h"
  68
  69 static LIST_HEAD(_sitree, sainfo) sitree;
  70
  71 /* %%%
  72  * modules for ipsec sa info
  73  */
  74 /*
  75  * return matching entry.
  76  * no matching entry found and if there is anonymous entry, return it.
  77  * else return NULL.
  78  * XXX by each data type, should be changed to compare the buffer.
  79  * First pass is for sainfo from a specified peer, second for others.
  80  */
  81 struct sainfo *
  82 getsainfo(src, dst, peer, use_nat_addr)
  83         const vchar_t *src, *dst, *peer;
  84         int use_nat_addr;
  85 {
  86         struct sainfo *s = NULL;
  87         struct sainfo *anonymous = NULL;
  88         int pass = 1;
  89
  90         if (use_nat_addr && lcconf->ext_nat_id == NULL)
  91                 return NULL;
  92
  93         plog(LLV_DEBUG2, LOCATION, NULL, "getsainfo - src id:\n");
  94         if (src != NULL)
  95                 plogdump(LLV_DEBUG2, src->v, src->l);
  96         else
  97                 plog(LLV_DEBUG2, LOCATION, NULL, " anonymous\n");
  98         plog(LLV_DEBUG2, LOCATION, NULL, "getsainfo - dst id:\n");
  99         if (dst != NULL)
 100                 plogdump(LLV_DEBUG2, dst->v, dst->l);
 101         else
 102                 plog(LLV_DEBUG2, LOCATION, NULL, " anonymous\n");
 103         if (peer == NULL)
 104                 pass = 2;
 105     again:
 106         LIST_FOREACH(s, &sitree, chain) {
 107 #ifdef __APPLE__
 108                 if (s->to_delete || s->to_remove) {
 109                         continue;
 110                 }
 111 #endif /* __APPLE__ */
 112                 if (s->idsrc != NULL) {
 113                         plog(LLV_DEBUG2, LOCATION, NULL, "getsainfo - sainfo id - src & dst:\n");
 114                         plogdump(LLV_DEBUG2, s->idsrc->v, s->idsrc->l);
 115                         plogdump(LLV_DEBUG2, s->iddst->v, s->iddst->l);
 116                 } else {
 117                         plog(LLV_DEBUG2, LOCATION, NULL, "getsainfo - sainfo id = anonymous\n");
 118                 }
 119                 if (s->id_i != NULL) {
 120                         if (pass == 2)
 121                                 continue;
 122                         if (memcmp(peer->v, s->id_i->v, s->id_i->l) != 0)
 123                                 continue;
 124                 } else if (pass == 1)
 125                         continue;
 126                 if (s->idsrc == NULL) {
 127                         anonymous = s;
 128                         continue;
 129                 }
 130
 131                 /* anonymous ? */
 132                 if (src == NULL) {
 133                         if (anonymous != NULL)
 134                                 break;
 135                         continue;
 136                 }
 137
 138                 if (memcmp(src->v, s->idsrc->v, s->idsrc->l) == 0) {
 139                         if (use_nat_addr) {
 140                                 if (memcmp(lcconf->ext_nat_id->v, s->iddst->v, s->iddst->l) == 0) {
 141                                         plog(LLV_DEBUG, LOCATION, NULL,
 142                                                 "matched external nat address.\n");
 143                                         plogdump(LLV_DEBUG2, lcconf->ext_nat_id->v, lcconf->ext_nat_id->l);
 144                                         return s;
 145                                 }
 146                         } else if (memcmp(dst->v, s->iddst->v, s->iddst->l) == 0)
 147                                 return s;
 148                 }
 149         }
 150
 151         if (anonymous) {
 152                 plog(LLV_DEBUG, LOCATION, NULL,
 153                         "anonymous sainfo selected.\n");
 154         } else if (pass == 1) {
 155                 pass = 2;
 156                 goto again;
 157         }
 158
 159         return anonymous;
 160 }
 161
 162 #ifdef __APPLE__
 163 int
 164 link_sainfo_to_ph2 (struct sainfo *new)
 165 {
 166         if (!new) {
 167                 return(-1);
 168         }
 169         if (new->to_delete ||
 170                 new->to_remove) {
 171                 return(-1);
 172         }
 173         new->linked_to_ph2++;
 174         return(0);
 175 }
 176
 177 /*
 178  * return matching entry.
 179  * no matching entry found and if there is anonymous entry, return it.
 180  * else return NULL.
 181  * XXX by each data type, should be changed to compare the buffer.
 182  */
 183 struct sainfo *
 184 getsainfo_by_dst_id(dst, peer)
 185         const vchar_t *dst, *peer;
 186 {
 187         struct sainfo *s = NULL;
 188         struct sainfo *anonymous = NULL;
 189
 190         plog(LLV_DEBUG2, LOCATION, NULL, "getsainfo_by_dst_id - dst id:\n");
 191         if (dst != NULL)
 192                 plogdump(LLV_DEBUG2, dst->v, dst->l);
 193         else
 194                 return NULL;
 195
 196         LIST_FOREACH(s, &sitree, chain) {
 197                 if (s->to_delete || s->to_remove) {
 198                         continue;
 199                 }
 200                 if (s->idsrc != NULL) {
 201                         plog(LLV_DEBUG2, LOCATION, NULL, "getsainfo_by_dst_id - sainfo id - src & dst:\n");
 202                         plogdump(LLV_DEBUG2, s->idsrc->v, s->idsrc->l);
 203                         plogdump(LLV_DEBUG2, s->iddst->v, s->iddst->l);
 204                 } else {
 205                         plog(LLV_DEBUG2, LOCATION, NULL, "getsainfo_by_dst_id - sainfo id = anonymous\n");
 206                 }
 207                 if (s->id_i != NULL) {
 208                         plog(LLV_DEBUG2, LOCATION, NULL, "getsainfo_by_dst_id - sainfo id_i:\n");
 209                         plogdump(LLV_DEBUG2, s->id_i->v, s->id_i->l);
 210                         if (peer == NULL)
 211                                 continue;
 212                         if (memcmp(peer->v, s->id_i->v, s->id_i->l) != 0)
 213                                 continue;
 214                 }
 215                 if (s->idsrc == NULL) {
 216                         anonymous = s;
 217                         continue;
 218                 }
 219
 220                 if (memcmp(dst->v, s->iddst->v, s->iddst->l) == 0)
 221                         return s;
 222         }
 223
 224         if (anonymous) {
 225                 plog(LLV_DEBUG, LOCATION, NULL,
 226                          "anonymous sainfo selected.\n");
 227         }
 228
 229         return anonymous;
 230 }
 231
 232 int
 233 unlink_sainfo_from_ph2 (struct sainfo *old)
 234 {
 235         if (!old) {
 236                 return(-1);
 237         }
 238         if (old->linked_to_ph2 <= 0) {
 239                 return(-1);
 240         }
 241         old->linked_to_ph2--;
 242         if (old->linked_to_ph2 == 0) {
 243                 if (old->to_remove) {
 244                         remsainfo(old);
 245                 }
 246                 if (old->to_delete) {
 247                         delsainfo(old);
 248                 }
 249         }
 250         return(0);
 251 }
 252 #endif
 253
 254 struct sainfo *
 255 newsainfo()
 256 {
 257         struct sainfo *new;
 258
 259         new = racoon_calloc(1, sizeof(*new));
 260         if (new == NULL)
 261                 return NULL;
 262
 263         new->lifetime = IPSECDOI_ATTR_SA_LD_SEC_DEFAULT;
 264         new->lifebyte = IPSECDOI_ATTR_SA_LD_KB_MAX;
 265 #ifdef __APPLE__
 266         new->to_remove = FALSE;
 267         new->to_delete = FALSE;
 268         new->linked_to_ph2 = 0;
 269 #endif
 270
 271         return new;
 272 }
 273
 274 void
 275 delsainfo(si)
 276         struct sainfo *si;
 277 {
 278         int i;
 279
 280 #ifdef __APPLE__
 281         if (si->linked_to_ph2) {
 282                 si->to_delete = TRUE;
 283                 return;
 284         }
 285 #endif
 286
 287         for (i = 0; i < MAXALGCLASS; i++)
 288                 delsainfoalg(si->algs[i]);
 289
 290         if (si->idsrc)
 291                 vfree(si->idsrc);
 292         if (si->iddst)
 293                 vfree(si->iddst);
 294
 295 #ifdef ENABLE_HYBRID
 296         if (si->group)
 297                 vfree(si->group);
 298 #endif
 299
 300         racoon_free(si);
 301 }
 302
 303 void
 304 inssainfo(new)
 305         struct sainfo *new;
 306 {
 307         LIST_INSERT_HEAD(&sitree, new, chain);
 308 }
 309
 310 void
 311 remsainfo(si)
 312         struct sainfo *si;
 313 {
 314 #ifdef __APPLE__
 315         if (si->linked_to_ph2) {
 316                 si->to_remove = TRUE;
 317                 return;
 318         }
 319 #endif
 320         LIST_REMOVE(si, chain);
 321 }
 322
 323 void
 324 flushsainfo()
 325 {
 326         struct sainfo *s, *next;
 327
 328         for (s = LIST_FIRST(&sitree); s; s = next) {
 329                 next = LIST_NEXT(s, chain);
 330                 if (s->dynamic == 0) {
 331                         remsainfo(s);
 332                         delsainfo(s);
 333                 }
 334         }
 335 }
 336
 337 void
 338 flushsainfo_dynamic(u_int32_t addr)
 339 {
 340         struct sainfo *s, *next;
 341
 342         for (s = LIST_FIRST(&sitree); s; s = next) {
 343                 next = LIST_NEXT(s, chain);
 344                 if (s->dynamic == addr) {
 345                         remsainfo(s);
 346                         delsainfo(s);
 347                 }
 348         }
 349 }
 350
 351 void
 352 initsainfo()
 353 {
 354         LIST_INIT(&sitree);
 355 }
 356
 357 struct sainfoalg *
 358 newsainfoalg()
 359 {
 360         struct sainfoalg *new;
 361
 362         new = racoon_calloc(1, sizeof(*new));
 363         if (new == NULL)
 364                 return NULL;
 365
 366         return new;
 367 }
 368
 369 void
 370 delsainfoalg(alg)
 371         struct sainfoalg *alg;
 372 {
 373         struct sainfoalg *a, *next;
 374
 375         for (a = alg; a; a = next) {
 376                 next = a->next;
 377                 racoon_free(a);
 378         }
 379 }
 380
 381 void
 382 inssainfoalg(head, new)
 383         struct sainfoalg **head;
 384         struct sainfoalg *new;
 385 {
 386         struct sainfoalg *a;
 387
 388         for (a = *head; a && a->next; a = a->next)
 389                 ;
 390         if (a)
 391                 a->next = new;
 392         else
 393                 *head = new;
 394 }
 395
 396 const char *
 397 sainfo2str(si)
 398         const struct sainfo *si;
 399 {
 400     char *idsrc_str;
 401     char *iddst_str;
 402     char *idi_str;
 403         static char buf[256];
 404
 405         if (si->idsrc == NULL)
 406                 snprintf(buf, sizeof(buf), "anonymous");
 407         else {
 408         idsrc_str = ipsecdoi_id2str(si->idsrc);
 409         if (idsrc_str) {
 410             snprintf(buf, sizeof(buf), "%s", idsrc_str);
 411             racoon_free(idsrc_str);
 412         }
 413         iddst_str = ipsecdoi_id2str(si->iddst);
 414         if (iddst_str) {
 415             snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf),
 416                      " %s", iddst_str);
 417             racoon_free(iddst_str);
 418         }
 419         }
 420
 421         if (si->id_i != NULL) {
 422         idi_str = ipsecdoi_id2str(si->id_i);
 423         if (idi_str) {
 424             snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf),
 425                      " from %s", idi_str);
 426             racoon_free(idi_str);
 427         }
 428     }
 429
 430         return buf;
 431 }