ipsec-146.3.tar.gz

[apple/ipsec.git] / ipsec-tools / racoon / isakmp_cfg.c

diff --git a/ipsec-tools/racoon/isakmp_cfg.c b/ipsec-tools/racoon/isakmp_cfg.c
index c72600ac82abd29453a0c91a41fb3e06a5454c37..f71c012c150d134e8ddf6aefbeb74fb362d51f68 100644 (file)
--- a/ipsec-tools/racoon/isakmp_cfg.c
+++ b/ipsec-tools/racoon/isakmp_cfg.c
@@ -39,9 +39,8 @@
 #include <sys/queue.h>
 
 #include <utmpx.h>
-#if defined(__APPLE__) && defined(__MACH__)
 #include <util.h>
-#endif
+
 
 #ifdef __FreeBSD__
 # include <libutil.h>
@@ -236,7 +235,15 @@ isakmp_cfg_r(iph1, msg)
                        plen = ntohs(ph->len);
                        nph = (struct isakmp_gen *)((char *)ph + plen);
                        plen = ntohs(nph->len);
-
+            /* Check that the hash payload fits in the packet */
+                       if (tlen < (plen + ntohs(ph->len))) {
+                               plog(LLV_WARNING, LOCATION, NULL,
+                                        "Invalid Hash payload. len %d, overall-len %d\n",
+                                        ntohs(nph->len),
+                                        plen);
+                               goto out;
+                       }
+            
                        if ((payload = vmalloc(plen)) == NULL) {
                                plog(LLV_ERROR, LOCATION, NULL, 
                                    "Cannot allocate memory\n");
@@ -503,6 +510,12 @@ isakmp_cfg_reply(iph1, attrpl)
                /* connection was started by API - save attr list for passing to VPN controller */
                if (iph1->mode_cfg->attr_list != NULL)  /* shouldn't happen */
                        vfree(iph1->mode_cfg->attr_list);
+               if (ntohs(attrpl->h.len) < sizeof(*attrpl)) {
+                       plog(LLV_ERROR, LOCATION, NULL,
+                                "invalid cfg-attr-list, attr-len %d\n",
+                                ntohs(attrpl->h.len));
+                       return -1;
+               }
                alen = ntohs(attrpl->h.len) - sizeof(*attrpl);
                if ((iph1->mode_cfg->attr_list = vmalloc(alen)) == NULL) {
                        plog(LLV_ERROR, LOCATION, NULL,
@@ -545,6 +558,12 @@ isakmp_cfg_reply(iph1, attrpl)
        {
                vchar_t *buf;
 
+               if (ntohs(attrpl->h.len) < sizeof(*attrpl)) {
+                       plog(LLV_ERROR, LOCATION, NULL,
+                                "invalid cfg-attr-list, attr-len %d\n",
+                                ntohs(attrpl->h.len));
+                       return -1;
+               }
                alen = ntohs(attrpl->h.len) - sizeof(*attrpl);
                if ((buf = vmalloc(alen)) == NULL) {
                        plog(LLV_WARNING, LOCATION, NULL, 
@@ -601,6 +620,9 @@ isakmp_cfg_request(iph1, attrpl, msg)
                iph1->xauth_awaiting_userinput = 1;
                iph1->xauth_awaiting_userinput_msg = vdup(msg); // dup the message for later
                ike_session_start_xauth_timer(iph1);
+
+               IPSECLOGASLMSG("IPSec Extended Authentication requested.\n");
+
                return 0;
        }
 
@@ -839,8 +861,7 @@ isakmp_cfg_set(iph1, attrpl, msg)
        if (iph1->mode_cfg->flags & ISAKMP_CFG_DELETE_PH1) {
                if (iph1->status == PHASE1ST_ESTABLISHED)
                        isakmp_info_send_d1(iph1);
-               remph1(iph1);
-               delph1(iph1);
+               isakmp_ph1expire(iph1);
                iph1 = NULL;
        }
        vfree(payload);
@@ -1418,7 +1439,7 @@ isakmp_cfg_send(iph1, payload, np, flags, new_exchange, retry_count, msg)
        if (msg) {
                /* the sending message is added to the received-list. */
                if (add_recvdpkt(iph1->remote, iph1->local, iph2->sendbuf, msg,
-                                PH2_NON_ESP_EXTRA_LEN(iph2)) == -1) {
+                                PH2_NON_ESP_EXTRA_LEN(iph2), PH1_FRAG_FLAGS(iph1)) == -1) {
                        plog(LLV_ERROR , LOCATION, NULL,
                             "failed to add a response packet to the tree.\n");
                }
@@ -1605,9 +1626,11 @@ isakmp_cfg_accounting(iph1, inout)
        if (isakmp_cfg_config.accounting == ISAKMP_CFG_ACCT_RADIUS)
                return isakmp_cfg_accounting_radius(iph1, inout);
 #endif
+#ifdef HAVE_OPENSSL
        if (isakmp_cfg_config.accounting == ISAKMP_CFG_ACCT_SYSTEM)
                return privsep_accounting_system(iph1->mode_cfg->port,
                        iph1->remote, iph1->mode_cfg->login, inout);
+#endif
        return 0;
 }
 
@@ -1965,6 +1988,8 @@ isakmp_cfg_getconfig(iph1)
 
        vfree(buffer);
 
+       IPSECLOGASLMSG("IPSec Network Configuration requested.\n");
+
        return error;
 }
 
@@ -2265,7 +2290,7 @@ isakmp_cfg_resize_pool(size)
        /* If a pool already exists, check if we can shrink it */
        if ((isakmp_cfg_config.port_pool != NULL) &&
            (size < isakmp_cfg_config.pool_size)) {
-               for (i = isakmp_cfg_config.pool_size; i >= size; --i) {
+               for (i = isakmp_cfg_config.pool_size-1; i >= size; --i) {
                        if (isakmp_cfg_config.port_pool[i].used) {
                                plog(LLV_ERROR, LOCATION, NULL, 
                                    "resize pool from %zu to %d impossible "
@@ -2361,10 +2386,12 @@ isakmp_cfg_init(cold)
        isakmp_cfg_config.splitdns_list = NULL;
        isakmp_cfg_config.splitdns_len = 0;
 
+#if 0
        if (cold == ISAKMP_CFG_INIT_COLD) {
                if ((error = isakmp_cfg_resize_pool(ISAKMP_CFG_MAX_CNX)) != 0)
                        return error;
        }
+#endif
 
        return 0;
 }