ipsec-93.10.tar.gz

[apple/ipsec.git] / ipsec-tools / racoon / remoteconf.c

diff --git a/ipsec-tools/racoon/remoteconf.c b/ipsec-tools/racoon/remoteconf.c
index 0185db699b7be65f7f9f0a335c88004f20a9f270..c9eb64a4acf0d910d15aafdaf9ec26a5278723c3 100644 (file)
--- a/ipsec-tools/racoon/remoteconf.c
+++ b/ipsec-tools/racoon/remoteconf.c
@@ -1,4 +1,6 @@
-/* $Id: remoteconf.c,v 1.26.2.5 2005/11/06 17:18:26 monas Exp $ */
+/*     $NetBSD: remoteconf.c,v 1.9.4.1 2007/08/01 11:52:22 vanhu Exp $ */
+
+/* Id: remoteconf.c,v 1.38 2006/05/06 15:52:44 manubsd Exp */

 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.


@@ -60,18 +62,23 @@
 #include "debug.h"
 
 #include "isakmp_var.h"
 #include "debug.h"
 
 #include "isakmp_var.h"

+#ifdef ENABLE_HYBRID
+#include "isakmp_xauth.h"
+#endif

 #include "isakmp.h"
 #include "ipsec_doi.h"
 #include "oakley.h"
 #include "remoteconf.h"
 #include "localconf.h"
 #include "grabmyaddr.h"
 #include "isakmp.h"
 #include "ipsec_doi.h"
 #include "oakley.h"
 #include "remoteconf.h"
 #include "localconf.h"
 #include "grabmyaddr.h"

+#include "policy.h"

 #include "proposal.h"
 #include "vendorid.h"
 #include "gcmalloc.h"
 #include "strnames.h"
 #include "algorithm.h"
 #include "nattraversal.h"
 #include "proposal.h"
 #include "vendorid.h"
 #include "gcmalloc.h"
 #include "strnames.h"
 #include "algorithm.h"
 #include "nattraversal.h"

+#include "isakmp_frag.h"

 #include "genlist.h"
 #include "rsalist.h"
 
 #include "genlist.h"
 #include "rsalist.h"
 


@@ -81,7 +88,6 @@ static TAILQ_HEAD(_rmtree, remoteconf) rmtree;
  * Script hook names and script hook paths
  */
 char *script_names[SCRIPT_MAX + 1] = { "phase1_up", "phase1_down" };
  * Script hook names and script hook paths
  */
 char *script_names[SCRIPT_MAX + 1] = { "phase1_up", "phase1_down" };

-vchar_t *script_paths = NULL;

 
 /*%%%*/
 /*
 
 /*%%%*/
 /*


@@ -98,6 +104,7 @@ getrmconf_strict(remote, allow_anon)
        int allow_anon;
 {
        struct remoteconf *p;
        int allow_anon;
 {
        struct remoteconf *p;

+       struct remoteconf *p_withport_besteffort = NULL;

        struct remoteconf *anon = NULL;
        int withport;
        char buf[NI_MAXHOST + NI_MAXSERV + 10];
        struct remoteconf *anon = NULL;
        int withport;
        char buf[NI_MAXHOST + NI_MAXSERV + 10];


@@ -105,12 +112,11 @@ getrmconf_strict(remote, allow_anon)
 
        withport = 0;
 
 
        withport = 0;
 

-#ifndef ENABLE_NATT

        /* 
         * We never have ports set in our remote configurations, but when
         * NAT-T is enabled, the kernel can have policies with ports and
         * send us an acquire message for a destination that has a port set.
        /* 
         * We never have ports set in our remote configurations, but when
         * NAT-T is enabled, the kernel can have policies with ports and
         * send us an acquire message for a destination that has a port set.

-        * If we do this port check here, we don't find the remote config.
+        * If we do this port check here, we have to fallback to a best-effort result (without the port).

         *
         * In an ideal world, we would be able to have remote conf with
         * port, and the port could be a wildcard. That test could be used.
         *
         * In an ideal world, we would be able to have remote conf with
         * port, and the port could be a wildcard. That test could be used.


@@ -132,9 +138,8 @@ getrmconf_strict(remote, allow_anon)
        default:
                plog(LLV_ERROR2, LOCATION, NULL,
                        "invalid ip address family: %d\n", remote->sa_family);
        default:
                plog(LLV_ERROR2, LOCATION, NULL,
                        "invalid ip address family: %d\n", remote->sa_family);

-               exit(1);
+               return NULL;

        }
        }

-#endif /* ENABLE_NATT */

 
        if (remote->sa_family == AF_UNSPEC)
                snprintf (buf, sizeof(buf), "%s", "anonymous");
 
        if (remote->sa_family == AF_UNSPEC)
                snprintf (buf, sizeof(buf), "%s", "anonymous");


@@ -147,6 +152,11 @@ getrmconf_strict(remote, allow_anon)
        }
 
        TAILQ_FOREACH(p, &rmtree, chain) {
        }
 
        TAILQ_FOREACH(p, &rmtree, chain) {

+#ifdef __APPLE__
+               if (p->to_delete || p->to_remove) {
+                       continue;
+               }
+#endif

                if ((remote->sa_family == AF_UNSPEC
                     && remote->sa_family == p->remote->sa_family)
                 || (!withport && cmpsaddrwop(remote, p->remote) == 0)
                if ((remote->sa_family == AF_UNSPEC
                     && remote->sa_family == p->remote->sa_family)
                 || (!withport && cmpsaddrwop(remote, p->remote) == 0)


@@ -154,6 +164,9 @@ getrmconf_strict(remote, allow_anon)
                        plog(LLV_DEBUG, LOCATION, NULL,
                                "configuration found for %s.\n", buf);
                        return p;
                        plog(LLV_DEBUG, LOCATION, NULL,
                                "configuration found for %s.\n", buf);
                        return p;

+               } else if (withport && cmpsaddrwop(remote, p->remote) == 0) {
+                       // for withport: save the pointer for the best-effort search
+                       p_withport_besteffort = p;

                }
 
                /* save the pointer to the anonymous configuration */
                }
 
                /* save the pointer to the anonymous configuration */


@@ -161,6 +174,12 @@ getrmconf_strict(remote, allow_anon)
                        anon = p;
        }
 
                        anon = p;
        }
 

+       if (p_withport_besteffort) {
+               plog(LLV_DEBUG, LOCATION, NULL,
+                        "configuration found for %s.\n", buf);
+               return p_withport_besteffort;
+       }
+       

        if (allow_anon && anon != NULL) {
                plog(LLV_DEBUG, LOCATION, NULL,
                        "anonymous configuration selected for %s.\n", buf);
        if (allow_anon && anon != NULL) {
                plog(LLV_DEBUG, LOCATION, NULL,
                        "anonymous configuration selected for %s.\n", buf);


@@ -173,6 +192,37 @@ getrmconf_strict(remote, allow_anon)
        return NULL;
 }
 
        return NULL;
 }
 

+int
+no_remote_configs(ignore_anonymous)
+       int ignore_anonymous;
+{
+       
+       struct remoteconf *p;
+#if !TARGET_OS_EMBEDDED
+       static const char default_idv[] = "macuser@localhost";
+       static const int default_idv_len = sizeof(default_idv) - 1;
+#endif
+
+       TAILQ_FOREACH(p, &rmtree, chain) {
+               if (ignore_anonymous) {
+                       if (p->remote->sa_family == AF_UNSPEC)  /* anonymous */
+                               continue;
+               }
+#if !TARGET_OS_EMBEDDED
+               // ignore the default btmm ipv6 config thats always present in racoon.conf
+               if (p->remote->sa_family == AF_INET6 &&
+                       p->idvtype == IDTYPE_USERFQDN &&
+                       p->idv != NULL &&
+                       p->idv->l == default_idv_len &&
+                       strncmp(p->idv->v, default_idv, p->idv->l) == 0) {
+                       continue;
+               }
+#endif
+               return 0;
+       }
+       return 1;
+}
+

 struct remoteconf *
 getrmconf(remote)
        struct sockaddr *remote;
 struct remoteconf *
 getrmconf(remote)
        struct sockaddr *remote;


@@ -180,6 +230,43 @@ getrmconf(remote)
        return getrmconf_strict(remote, 1);
 }
 
        return getrmconf_strict(remote, 1);
 }
 

+#ifdef __APPLE__
+int
+link_rmconf_to_ph1 (struct remoteconf *new)
+{
+       if (!new) {
+               return(-1);
+       }
+       if (new->to_delete ||
+               new->to_remove) {
+               return(-1);
+       }
+       new->linked_to_ph1++;
+       return(0);
+}
+
+int
+unlink_rmconf_from_ph1 (struct remoteconf *old)
+{
+       if (!old) {
+               return(-1);
+       }
+       if (old->linked_to_ph1 <= 0) {
+               return(-1);
+       }
+       old->linked_to_ph1--;
+       if (old->linked_to_ph1 == 0) {
+               if (old->to_remove) {
+                       remrmconf(old);
+               }
+               if (old->to_delete) {
+                       delrmconf(old);
+               }
+       }
+       return(0);
+}
+#endif
+

 struct remoteconf *
 newrmconf()
 {
 struct remoteconf *
 newrmconf()
 {


@@ -209,18 +296,23 @@ newrmconf()
        new->getcert_method = ISAKMP_GETCERT_PAYLOAD;
        new->getcacert_method = ISAKMP_GETCERT_LOCALFILE;
        new->cacerttype = ISAKMP_CERT_X509SIGN;
        new->getcert_method = ISAKMP_GETCERT_PAYLOAD;
        new->getcacert_method = ISAKMP_GETCERT_LOCALFILE;
        new->cacerttype = ISAKMP_CERT_X509SIGN;

+       new->certtype = ISAKMP_CERT_NONE;

        new->cacertfile = NULL;
        new->send_cert = TRUE;
        new->send_cr = TRUE;
        new->support_proxy = FALSE;
        for (i = 0; i <= SCRIPT_MAX; i++)
        new->cacertfile = NULL;
        new->send_cert = TRUE;
        new->send_cr = TRUE;
        new->support_proxy = FALSE;
        for (i = 0; i <= SCRIPT_MAX; i++)

-               new->script[i] = -1;
+               new->script[i] = NULL;

        new->gen_policy = FALSE;
        new->retry_counter = lcconf->retry_counter;
        new->retry_interval = lcconf->retry_interval;
 #ifdef __APPLE__
        new->nat_traversal = NATT_ON;
        new->natt_multiple_user = FALSE;
        new->gen_policy = FALSE;
        new->retry_counter = lcconf->retry_counter;
        new->retry_interval = lcconf->retry_interval;
 #ifdef __APPLE__
        new->nat_traversal = NATT_ON;
        new->natt_multiple_user = FALSE;

+       new->natt_keepalive = TRUE;
+       new->to_remove = FALSE;
+       new->to_delete = FALSE;
+       new->linked_to_ph1 = 0;

 #else
        new->nat_traversal = NATT_OFF;
 #endif
 #else
        new->nat_traversal = NATT_OFF;
 #endif


@@ -233,7 +325,15 @@ newrmconf()
        new->dpd_interval = 0; /* Disable DPD checks by default */
        new->dpd_retry = 5;
        new->dpd_maxfails = 5;
        new->dpd_interval = 0; /* Disable DPD checks by default */
        new->dpd_retry = 5;
        new->dpd_maxfails = 5;

+    new->dpd_algo = DPD_ALGO_INBOUND_DETECT;
+    new->idle_timeout = 0;

 
 

+       new->weak_phase1_check = 0;
+
+#ifdef ENABLE_HYBRID
+       new->xauth = NULL;
+#endif
+       new->initiate_ph1rekey = TRUE;

        return new;
 }
 
        return new;
 }
 


@@ -266,8 +366,10 @@ dupidvl(entry, arg)
        id = newidspec();
        if (!id) return (void *) -1;
 
        id = newidspec();
        if (!id) return (void *) -1;
 

-       if (set_identifier(&id->id, old->idtype, old->id) != 0) 
+       if (set_identifier(&id->id, old->idtype, old->id) != 0) {
+               racoon_free(id);

                return (void *) -1;
                return (void *) -1;

+       }

 
        id->idtype = old->idtype;
 
 
        id->idtype = old->idtype;
 


@@ -338,10 +440,22 @@ void
 delrmconf(rmconf)
        struct remoteconf *rmconf;
 {
 delrmconf(rmconf)
        struct remoteconf *rmconf;
 {

+#ifdef __APPLE__
+       if (rmconf->linked_to_ph1) {
+               rmconf->to_delete = TRUE;
+               return;
+       }
+#endif

        if (rmconf->remote)
                racoon_free(rmconf->remote);
        if (rmconf->remote)
                racoon_free(rmconf->remote);

-       if (rmconf->etypes)
+#ifdef ENABLE_HYBRID
+       if (rmconf->xauth)
+               xauth_rmconf_delete(&rmconf->xauth);
+#endif
+       if (rmconf->etypes) {

                deletypes(rmconf->etypes);
                deletypes(rmconf->etypes);

+               rmconf->etypes=NULL;
+       }

        if (rmconf->idv)
                vfree(rmconf->idv);
        if (rmconf->idvl_p)
        if (rmconf->idv)
                vfree(rmconf->idv);
        if (rmconf->idvl_p)


@@ -436,6 +550,12 @@ void
 remrmconf(rmconf)
        struct remoteconf *rmconf;
 {
 remrmconf(rmconf)
        struct remoteconf *rmconf;
 {

+#ifdef __APPLE__
+       if (rmconf->linked_to_ph1) {
+               rmconf->to_remove = TRUE;
+               return;
+       }
+#endif

        TAILQ_REMOVE(&rmtree, rmconf, chain);
 }
 
        TAILQ_REMOVE(&rmtree, rmconf, chain);
 }
 


@@ -622,7 +742,8 @@ dump_rmconf_single (struct remoteconf *p, void *data)
        plog(LLV_INFO, LOCATION, NULL, "\tpassive %s;\n",
                s_switch (p->passive));
        plog(LLV_INFO, LOCATION, NULL, "\tike_frag %s;\n",
        plog(LLV_INFO, LOCATION, NULL, "\tpassive %s;\n",
                s_switch (p->passive));
        plog(LLV_INFO, LOCATION, NULL, "\tike_frag %s;\n",

-               s_switch (p->ike_frag));
+               p->ike_frag == ISAKMP_FRAG_FORCE ?
+                       "force" : s_switch (p->ike_frag));

        plog(LLV_INFO, LOCATION, NULL, "\tesp_frag %d;\n", p->esp_frag);
        plog(LLV_INFO, LOCATION, NULL, "\tinitial_contact %s;\n",
                s_switch (p->ini_contact));
        plog(LLV_INFO, LOCATION, NULL, "\tesp_frag %d;\n", p->esp_frag);
        plog(LLV_INFO, LOCATION, NULL, "\tinitial_contact %s;\n",
                s_switch (p->ini_contact));


@@ -678,13 +799,13 @@ newidspec()
        return new;
 }
 
        return new;
 }
 

-int
+vchar_t *

 script_path_add(path)
        vchar_t *path;
 {
        char *script_dir;
 script_path_add(path)
        vchar_t *path;
 {
        char *script_dir;

-       vchar_t *new_storage;

        vchar_t *new_path;
        vchar_t *new_path;

+       vchar_t *new_storage;

        vchar_t **sp;
        size_t len;
        size_t size;
        vchar_t **sp;
        size_t len;
        size_t size;


@@ -698,44 +819,24 @@ script_path_add(path)
                if ((new_path = vmalloc(len)) == NULL) {
                        plog(LLV_ERROR, LOCATION, NULL,
                            "Cannot allocate memory: %s\n", strerror(errno));
                if ((new_path = vmalloc(len)) == NULL) {
                        plog(LLV_ERROR, LOCATION, NULL,
                            "Cannot allocate memory: %s\n", strerror(errno));

-                       return -1;
+                       return NULL;

                }
 
                new_path->v[0] = '\0';
                }
 
                new_path->v[0] = '\0';

-               (void)strlcat(new_path->v, script_dir, len);
-               (void)strlcat(new_path->v, "/", len);
-               (void)strlcat(new_path->v, path->v, len);
+               (void)strlcat(new_path->v, script_dir, new_path->l);
+               (void)strlcat(new_path->v, "/", new_path->l);
+               (void)strlcat(new_path->v, path->v, new_path->l);

 
                vfree(path);
                path = new_path;
        }
 
 
                vfree(path);
                path = new_path;
        }
 

-       /* First time, initialize */
-       if (script_paths == NULL)
-               len = sizeof(vchar_t *);
-       else
-               len = script_paths->l;
-
-       /* Add a slot for a new path */
-       len += sizeof(vchar_t *);
-       if ((new_storage = vrealloc(script_paths, len)) == NULL) {
-               plog(LLV_ERROR, LOCATION, NULL,
-                   "Cannot allocate memory: %s\n", strerror(errno));
-               return -1;
-       }
-       script_paths = new_storage;
-
-       size = len / sizeof(vchar_t *);
-       sp = (vchar_t **)script_paths->v;       
-       sp[size - 1] = NULL;
-       sp[size - 2] = path;
-
-       return (size - 2);
+       return path;

 }
 
 }
 

+

 struct isakmpsa *
 struct isakmpsa *

-dupisakmpsa(sa)
-       struct isakmpsa *sa;
+dupisakmpsa(struct isakmpsa *sa)

 {
        struct isakmpsa *res = NULL;
 
 {
        struct isakmpsa *res = NULL;
 


@@ -748,9 +849,7 @@ dupisakmpsa(sa)
 
        *res = *sa;
 #ifdef HAVE_GSSAPI
 
        *res = *sa;
 #ifdef HAVE_GSSAPI

-       /* 
-        * XXX gssid
-        */
+       res->gssid=vdup(sa->gssid);

 #endif
        res->next=NULL;
 
 #endif
        res->next=NULL;