![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to proposal.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / ipsec-tools / src / racoon|
Return to proposal.c CVS log | Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / ipsec-tools / src / racoon |
1.1 misho 1: /* $NetBSD: proposal.c,v 1.17 2008/09/19 11:14:49 tteras Exp $ */
2:
3: /* $Id: proposal.c,v 1.17 2008/09/19 11:14:49 tteras Exp $ */
4:
5: /*
6: * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
7: * All rights reserved.
8: *
9: * Redistribution and use in source and binary forms, with or without
10: * modification, are permitted provided that the following conditions
11: * are met:
12: * 1. Redistributions of source code must retain the above copyright
13: * notice, this list of conditions and the following disclaimer.
14: * 2. Redistributions in binary form must reproduce the above copyright
15: * notice, this list of conditions and the following disclaimer in the
16: * documentation and/or other materials provided with the distribution.
17: * 3. Neither the name of the project nor the names of its contributors
18: * may be used to endorse or promote products derived from this software
19: * without specific prior written permission.
20: *
21: * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22: * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23: * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24: * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25: * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26: * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27: * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28: * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29: * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30: * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31: * SUCH DAMAGE.
32: */
33:
34: #include "config.h"
35:
36: #include <sys/param.h>
37: #include <sys/types.h>
38: #include <sys/socket.h>
39: #include <sys/queue.h>
40:
41: #include <netinet/in.h>
42: #include PATH_IPSEC_H
43:
44: #include <stdlib.h>
45: #include <stdio.h>
46: #include <string.h>
47: #include <errno.h>
48:
49: #include "var.h"
50: #include "misc.h"
51: #include "vmbuf.h"
52: #include "plog.h"
53: #include "sockmisc.h"
54: #include "debug.h"
55:
56: #include "policy.h"
57: #include "pfkey.h"
58: #include "isakmp_var.h"
59: #include "isakmp.h"
60: #include "ipsec_doi.h"
61: #include "algorithm.h"
62: #include "proposal.h"
63: #include "sainfo.h"
64: #include "localconf.h"
65: #include "remoteconf.h"
66: #include "oakley.h"
67: #include "handler.h"
68: #include "strnames.h"
69: #include "gcmalloc.h"
70: #ifdef ENABLE_NATT
71: #include "nattraversal.h"
72: #endif
73:
74: static uint g_nextreqid = 1;
75:
76: /* %%%
77: * modules for ipsec sa spec
78: */
79: struct saprop *
80: newsaprop()
81: {
82: struct saprop *new;
83:
84: new = racoon_calloc(1, sizeof(*new));
85: if (new == NULL)
86: return NULL;
87:
88: return new;
89: }
90:
91: struct saproto *
92: newsaproto()
93: {
94: struct saproto *new;
95:
96: new = racoon_calloc(1, sizeof(*new));
97: if (new == NULL)
98: return NULL;
99:
100: return new;
101: }
102:
103: /* set saprop to last part of the prop tree */
104: void
105: inssaprop(head, new)
106: struct saprop **head;
107: struct saprop *new;
108: {
109: struct saprop *p;
110:
111: if (*head == NULL) {
112: *head = new;
113: return;
114: }
115:
116: for (p = *head; p->next; p = p->next)
117: ;
118: p->next = new;
119:
120: return;
121: }
122:
123: /* set saproto to the end of the proto tree in saprop */
124: void
125: inssaproto(pp, new)
126: struct saprop *pp;
127: struct saproto *new;
128: {
129: struct saproto *p;
130:
131: for (p = pp->head; p && p->next; p = p->next)
132: ;
133: if (p == NULL)
134: pp->head = new;
135: else
136: p->next = new;
137:
138: return;
139: }
140:
141: /* set saproto to the top of the proto tree in saprop */
142: void
143: inssaprotorev(pp, new)
144: struct saprop *pp;
145: struct saproto *new;
146: {
147: new->next = pp->head;
148: pp->head = new;
149:
150: return;
151: }
152:
153: struct satrns *
154: newsatrns()
155: {
156: struct satrns *new;
157:
158: new = racoon_calloc(1, sizeof(*new));
159: if (new == NULL)
160: return NULL;
161:
162: return new;
163: }
164:
165: /* set saproto to last part of the proto tree in saprop */
166: void
167: inssatrns(pr, new)
168: struct saproto *pr;
169: struct satrns *new;
170: {
171: struct satrns *tr;
172:
173: for (tr = pr->head; tr && tr->next; tr = tr->next)
174: ;
175: if (tr == NULL)
176: pr->head = new;
177: else
178: tr->next = new;
179:
180: return;
181: }
182:
183: /*
184: * take a single match between saprop. allocate a new proposal and return it
185: * for future use (like picking single proposal from a bundle).
186: * pp1: peer's proposal.
187: * pp2: my proposal.
188: * NOTE: In the case of initiator, must be ensured that there is no
189: * modification of the proposal by calling cmp_aproppair_i() before
190: * this function.
191: * XXX cannot understand the comment!
192: */
193: struct saprop *
194: cmpsaprop_alloc(ph1, pp1, pp2, side)
195: struct ph1handle *ph1;
196: const struct saprop *pp1, *pp2;
197: int side;
198: {
199: struct saprop *newpp = NULL;
200: struct saproto *pr1, *pr2, *newpr = NULL;
201: struct satrns *tr1, *tr2, *newtr;
202: const int ordermatters = 0;
203: int npr1, npr2;
204: int spisizematch;
205:
206: newpp = newsaprop();
207: if (newpp == NULL) {
208: plog(LLV_ERROR, LOCATION, NULL,
209: "failed to allocate saprop.\n");
210: return NULL;
211: }
212: newpp->prop_no = pp1->prop_no;
213:
214: /* see proposal.h about lifetime/key length and PFS selection. */
215:
216: /* check time/bytes lifetime and PFS */
217: switch (ph1->rmconf->pcheck_level) {
218: case PROP_CHECK_OBEY:
219: newpp->lifetime = pp1->lifetime;
220: newpp->lifebyte = pp1->lifebyte;
221: newpp->pfs_group = pp1->pfs_group;
222: break;
223:
224: case PROP_CHECK_STRICT:
225: if (pp1->lifetime > pp2->lifetime) {
226: plog(LLV_ERROR, LOCATION, NULL,
227: "long lifetime proposed: "
228: "my:%d peer:%d\n",
229: (int)pp2->lifetime, (int)pp1->lifetime);
230: goto err;
231: }
232: if (pp1->lifebyte > pp2->lifebyte) {
233: plog(LLV_ERROR, LOCATION, NULL,
234: "long lifebyte proposed: "
235: "my:%d peer:%d\n",
236: pp2->lifebyte, pp1->lifebyte);
237: goto err;
238: }
239: newpp->lifetime = pp1->lifetime;
240: newpp->lifebyte = pp1->lifebyte;
241:
242: prop_pfs_check:
243: if (pp2->pfs_group != 0 && pp1->pfs_group != pp2->pfs_group) {
244: plog(LLV_ERROR, LOCATION, NULL,
245: "pfs group mismatched: "
246: "my:%d peer:%d\n",
247: pp2->pfs_group, pp1->pfs_group);
248: goto err;
249: }
250: newpp->pfs_group = pp1->pfs_group;
251: break;
252:
253: case PROP_CHECK_CLAIM:
254: /* lifetime */
255: if (pp1->lifetime <= pp2->lifetime) {
256: newpp->lifetime = pp1->lifetime;
257: } else {
258: newpp->lifetime = pp2->lifetime;
259: newpp->claim |= IPSECDOI_ATTR_SA_LD_TYPE_SEC;
260: plog(LLV_NOTIFY, LOCATION, NULL,
261: "use own lifetime: "
262: "my:%d peer:%d\n",
263: (int)pp2->lifetime, (int)pp1->lifetime);
264: }
265:
266: /* lifebyte */
267: if (pp1->lifebyte > pp2->lifebyte) {
268: newpp->lifebyte = pp2->lifebyte;
269: newpp->claim |= IPSECDOI_ATTR_SA_LD_TYPE_SEC;
270: plog(LLV_NOTIFY, LOCATION, NULL,
271: "use own lifebyte: "
272: "my:%d peer:%d\n",
273: pp2->lifebyte, pp1->lifebyte);
274: }
275: newpp->lifebyte = pp1->lifebyte;
276:
277: goto prop_pfs_check;
278: break;
279:
280: case PROP_CHECK_EXACT:
281: if (pp1->lifetime != pp2->lifetime) {
282: plog(LLV_ERROR, LOCATION, NULL,
283: "lifetime mismatched: "
284: "my:%d peer:%d\n",
285: (int)pp2->lifetime, (int)pp1->lifetime);
286: goto err;
287: }
288:
289: if (pp1->lifebyte != pp2->lifebyte) {
290: plog(LLV_ERROR, LOCATION, NULL,
291: "lifebyte mismatched: "
292: "my:%d peer:%d\n",
293: pp2->lifebyte, pp1->lifebyte);
294: goto err;
295: }
296: if (pp1->pfs_group != pp2->pfs_group) {
297: plog(LLV_ERROR, LOCATION, NULL,
298: "pfs group mismatched: "
299: "my:%d peer:%d\n",
300: pp2->pfs_group, pp1->pfs_group);
301: goto err;
302: }
303: newpp->lifetime = pp1->lifetime;
304: newpp->lifebyte = pp1->lifebyte;
305: newpp->pfs_group = pp1->pfs_group;
306: break;
307:
308: default:
309: plog(LLV_ERROR, LOCATION, NULL,
310: "invalid pcheck_level why?.\n");
311: goto err;
312: }
313:
314: #ifdef HAVE_SECCTX
315: /* check the security_context properties.
316: * It is possible for one side to have a security context
317: * and the other side doesn't. If so, this is an error.
318: */
319:
320: if (*pp1->sctx.ctx_str && !(*pp2->sctx.ctx_str)) {
321: plog(LLV_ERROR, LOCATION, NULL,
322: "My proposal missing security context\n");
323: goto err;
324: }
325: if (!(*pp1->sctx.ctx_str) && *pp2->sctx.ctx_str) {
326: plog(LLV_ERROR, LOCATION, NULL,
327: "Peer is missing security context\n");
328: goto err;
329: }
330:
331: if (*pp1->sctx.ctx_str && *pp2->sctx.ctx_str) {
332: if (pp1->sctx.ctx_doi == pp2->sctx.ctx_doi)
333: newpp->sctx.ctx_doi = pp1->sctx.ctx_doi;
334: else {
335: plog(LLV_ERROR, LOCATION, NULL,
336: "sec doi mismatched: my:%d peer:%d\n",
337: pp2->sctx.ctx_doi, pp1->sctx.ctx_doi);
338: goto err;
339: }
340:
341: if (pp1->sctx.ctx_alg == pp2->sctx.ctx_alg)
342: newpp->sctx.ctx_alg = pp1->sctx.ctx_alg;
343: else {
344: plog(LLV_ERROR, LOCATION, NULL,
345: "sec alg mismatched: my:%d peer:%d\n",
346: pp2->sctx.ctx_alg, pp1->sctx.ctx_alg);
347: goto err;
348: }
349:
350: if ((pp1->sctx.ctx_strlen != pp2->sctx.ctx_strlen) ||
351: memcmp(pp1->sctx.ctx_str, pp2->sctx.ctx_str,
352: pp1->sctx.ctx_strlen) != 0) {
353: plog(LLV_ERROR, LOCATION, NULL,
354: "sec ctx string mismatched: my:%s peer:%s\n",
355: pp2->sctx.ctx_str, pp1->sctx.ctx_str);
356: goto err;
357: } else {
358: newpp->sctx.ctx_strlen = pp1->sctx.ctx_strlen;
359: memcpy(newpp->sctx.ctx_str, pp1->sctx.ctx_str,
360: pp1->sctx.ctx_strlen);
361: }
362: }
363: #endif /* HAVE_SECCTX */
364:
365: npr1 = npr2 = 0;
366: for (pr1 = pp1->head; pr1; pr1 = pr1->next)
367: npr1++;
368: for (pr2 = pp2->head; pr2; pr2 = pr2->next)
369: npr2++;
370: if (npr1 != npr2)
371: goto err;
372:
373: /* check protocol order */
374: pr1 = pp1->head;
375: pr2 = pp2->head;
376:
377: while (1) {
378: if (!ordermatters) {
379: /*
380: * XXX does not work if we have multiple proposals
381: * with the same proto_id
382: */
383: switch (side) {
384: case RESPONDER:
385: if (!pr2)
386: break;
387: for (pr1 = pp1->head; pr1; pr1 = pr1->next) {
388: if (pr1->proto_id == pr2->proto_id)
389: break;
390: }
391: break;
392: case INITIATOR:
393: if (!pr1)
394: break;
395: for (pr2 = pp2->head; pr2; pr2 = pr2->next) {
396: if (pr2->proto_id == pr1->proto_id)
397: break;
398: }
399: break;
400: }
401: }
402: if (!pr1 || !pr2)
403: break;
404:
405: if (pr1->proto_id != pr2->proto_id) {
406: plog(LLV_ERROR, LOCATION, NULL,
407: "proto_id mismatched: "
408: "my:%s peer:%s\n",
409: s_ipsecdoi_proto(pr2->proto_id),
410: s_ipsecdoi_proto(pr1->proto_id));
411: goto err;
412: }
413: spisizematch = 0;
414: if (pr1->spisize == pr2->spisize)
415: spisizematch = 1;
416: else if (pr1->proto_id == IPSECDOI_PROTO_IPCOMP) {
417: /*
418: * draft-shacham-ippcp-rfc2393bis-05.txt:
419: * need to accept 16bit and 32bit SPI (CPI) for IPComp.
420: */
421: if (pr1->spisize == sizeof(u_int16_t) &&
422: pr2->spisize == sizeof(u_int32_t)) {
423: spisizematch = 1;
424: } else if (pr2->spisize == sizeof(u_int16_t) &&
425: pr1->spisize == sizeof(u_int32_t)) {
426: spisizematch = 1;
427: }
428: if (spisizematch) {
429: plog(LLV_ERROR, LOCATION, NULL,
430: "IPComp SPI size promoted "
431: "from 16bit to 32bit\n");
432: }
433: }
434: if (!spisizematch) {
435: plog(LLV_ERROR, LOCATION, NULL,
436: "spisize mismatched: "
437: "my:%d peer:%d\n",
438: (int)pr2->spisize, (int)pr1->spisize);
439: goto err;
440: }
441:
442: #ifdef ENABLE_NATT
443: if ((ph1->natt_flags & NAT_DETECTED) &&
444: natt_udp_encap (pr2->encmode))
445: {
446: plog(LLV_INFO, LOCATION, NULL, "Adjusting my encmode %s->%s\n",
447: s_ipsecdoi_encmode(pr2->encmode),
448: s_ipsecdoi_encmode(pr2->encmode - ph1->natt_options->mode_udp_diff));
449: pr2->encmode -= ph1->natt_options->mode_udp_diff;
450: pr2->udp_encap = 1;
451: }
452:
453: if ((ph1->natt_flags & NAT_DETECTED) &&
454: natt_udp_encap (pr1->encmode))
455: {
456: plog(LLV_INFO, LOCATION, NULL, "Adjusting peer's encmode %s(%d)->%s(%d)\n",
457: s_ipsecdoi_encmode(pr1->encmode),
458: pr1->encmode,
459: s_ipsecdoi_encmode(pr1->encmode - ph1->natt_options->mode_udp_diff),
460: pr1->encmode - ph1->natt_options->mode_udp_diff);
461: pr1->encmode -= ph1->natt_options->mode_udp_diff;
462: pr1->udp_encap = 1;
463: }
464: #endif
465:
466: if (pr1->encmode != pr2->encmode) {
467: plog(LLV_ERROR, LOCATION, NULL,
468: "encmode mismatched: "
469: "my:%s peer:%s\n",
470: s_ipsecdoi_encmode(pr2->encmode),
471: s_ipsecdoi_encmode(pr1->encmode));
472: goto err;
473: }
474:
475: for (tr1 = pr1->head; tr1; tr1 = tr1->next) {
476: for (tr2 = pr2->head; tr2; tr2 = tr2->next) {
477: if (cmpsatrns(pr1->proto_id, tr1, tr2, ph1->rmconf->pcheck_level) == 0)
478: goto found;
479: }
480: }
481:
482: goto err;
483:
484: found:
485: newpr = newsaproto();
486: if (newpr == NULL) {
487: plog(LLV_ERROR, LOCATION, NULL,
488: "failed to allocate saproto.\n");
489: goto err;
490: }
491: newpr->proto_id = pr1->proto_id;
492: newpr->spisize = pr1->spisize;
493: newpr->encmode = pr1->encmode;
494: newpr->spi = pr2->spi; /* copy my SPI */
495: newpr->spi_p = pr1->spi; /* copy peer's SPI */
496: newpr->reqid_in = pr2->reqid_in;
497: newpr->reqid_out = pr2->reqid_out;
498: #ifdef ENABLE_NATT
499: newpr->udp_encap = pr1->udp_encap | pr2->udp_encap;
500: #endif
501:
502: newtr = newsatrns();
503: if (newtr == NULL) {
504: plog(LLV_ERROR, LOCATION, NULL,
505: "failed to allocate satrns.\n");
506: racoon_free(newpr);
507: goto err;
508: }
509: newtr->trns_no = tr1->trns_no;
510: newtr->trns_id = tr1->trns_id;
511: newtr->encklen = tr1->encklen;
512: newtr->authtype = tr1->authtype;
513:
514: inssatrns(newpr, newtr);
515: inssaproto(newpp, newpr);
516:
517: pr1 = pr1->next;
518: pr2 = pr2->next;
519: }
520:
521: /* XXX should check if we have visited all items or not */
522: if (!ordermatters) {
523: switch (side) {
524: case RESPONDER:
525: if (!pr2)
526: pr1 = NULL;
527: break;
528: case INITIATOR:
529: if (!pr1)
530: pr2 = NULL;
531: break;
532: }
533: }
534:
535: /* should be matched all protocols in a proposal */
536: if (pr1 != NULL || pr2 != NULL)
537: goto err;
538:
539: return newpp;
540:
541: err:
542: flushsaprop(newpp);
543: return NULL;
544: }
545:
546: /* take a single match between saprop. returns 0 if pp1 equals to pp2. */
547: int
548: cmpsaprop(pp1, pp2)
549: const struct saprop *pp1, *pp2;
550: {
551: if (pp1->pfs_group != pp2->pfs_group) {
552: plog(LLV_WARNING, LOCATION, NULL,
553: "pfs_group mismatch. mine:%d peer:%d\n",
554: pp1->pfs_group, pp2->pfs_group);
555: /* FALLTHRU */
556: }
557:
558: if (pp1->lifetime > pp2->lifetime) {
559: plog(LLV_WARNING, LOCATION, NULL,
560: "less lifetime proposed. mine:%d peer:%d\n",
561: (int)pp1->lifetime, (int)pp2->lifetime);
562: /* FALLTHRU */
563: }
564: if (pp1->lifebyte > pp2->lifebyte) {
565: plog(LLV_WARNING, LOCATION, NULL,
566: "less lifebyte proposed. mine:%d peer:%d\n",
567: pp1->lifebyte, pp2->lifebyte);
568: /* FALLTHRU */
569: }
570:
571: return 0;
572: }
573:
574: /*
575: * take a single match between satrns. returns 0 if tr1 equals to tr2.
576: * tr1: peer's satrns
577: * tr2: my satrns
578: */
579: int
580: cmpsatrns(proto_id, tr1, tr2, check_level)
581: int proto_id;
582: const struct satrns *tr1, *tr2;
583: int check_level;
584: {
585: if (tr1->trns_id != tr2->trns_id) {
586: plog(LLV_WARNING, LOCATION, NULL,
587: "trns_id mismatched: "
588: "my:%s peer:%s\n",
589: s_ipsecdoi_trns(proto_id, tr2->trns_id),
590: s_ipsecdoi_trns(proto_id, tr1->trns_id));
591: return 1;
592: }
593:
594: if (tr1->authtype != tr2->authtype) {
595: plog(LLV_WARNING, LOCATION, NULL,
596: "authtype mismatched: "
597: "my:%s peer:%s\n",
598: s_ipsecdoi_attr_v(IPSECDOI_ATTR_AUTH, tr2->authtype),
599: s_ipsecdoi_attr_v(IPSECDOI_ATTR_AUTH, tr1->authtype));
600: return 1;
601: }
602:
603: /* Check key length regarding checkmode
604: * XXX Shall we send some kind of notify message when key length rejected ?
605: */
606: switch(check_level){
607: case PROP_CHECK_OBEY:
608: return 0;
609: break;
610:
611: case PROP_CHECK_STRICT:
612: /* FALLTHROUGH */
613: case PROP_CHECK_CLAIM:
614: if (tr1->encklen < tr2->encklen) {
615: plog(LLV_WARNING, LOCATION, NULL,
616: "low key length proposed, "
617: "mine:%d peer:%d.\n",
618: tr2->encklen, tr1->encklen);
619: return 1;
620: }
621: break;
622: case PROP_CHECK_EXACT:
623: if (tr1->encklen != tr2->encklen) {
624: plog(LLV_WARNING, LOCATION, NULL,
625: "key length mismatched, "
626: "mine:%d peer:%d.\n",
627: tr2->encklen, tr1->encklen);
628: return 1;
629: }
630: break;
631: }
632:
633: return 0;
634: }
635:
636: int
637: set_satrnsbysainfo(pr, sainfo)
638: struct saproto *pr;
639: struct sainfo *sainfo;
640: {
641: struct sainfoalg *a, *b;
642: struct satrns *newtr;
643: int t;
644:
645: switch (pr->proto_id) {
646: case IPSECDOI_PROTO_IPSEC_AH:
647: if (sainfo->algs[algclass_ipsec_auth] == NULL) {
648: plog(LLV_ERROR, LOCATION, NULL,
649: "no auth algorithm found\n");
650: goto err;
651: }
652: t = 1;
653: for (a = sainfo->algs[algclass_ipsec_auth]; a; a = a->next) {
654:
655: if (a->alg == IPSECDOI_ATTR_AUTH_NONE)
656: continue;
657:
658: /* allocate satrns */
659: newtr = newsatrns();
660: if (newtr == NULL) {
661: plog(LLV_ERROR, LOCATION, NULL,
662: "failed to allocate satrns.\n");
663: goto err;
664: }
665:
666: newtr->trns_no = t++;
667: newtr->trns_id = ipsecdoi_authalg2trnsid(a->alg);
668: newtr->authtype = a->alg;
669:
670: inssatrns(pr, newtr);
671: }
672: break;
673: case IPSECDOI_PROTO_IPSEC_ESP:
674: if (sainfo->algs[algclass_ipsec_enc] == NULL) {
675: plog(LLV_ERROR, LOCATION, NULL,
676: "no encryption algorithm found\n");
677: goto err;
678: }
679: t = 1;
680: for (a = sainfo->algs[algclass_ipsec_enc]; a; a = a->next) {
681: for (b = sainfo->algs[algclass_ipsec_auth]; b; b = b->next) {
682: /* allocate satrns */
683: newtr = newsatrns();
684: if (newtr == NULL) {
685: plog(LLV_ERROR, LOCATION, NULL,
686: "failed to allocate satrns.\n");
687: goto err;
688: }
689:
690: newtr->trns_no = t++;
691: newtr->trns_id = a->alg;
692: newtr->encklen = a->encklen;
693: newtr->authtype = b->alg;
694:
695: inssatrns(pr, newtr);
696: }
697: }
698: break;
699: case IPSECDOI_PROTO_IPCOMP:
700: if (sainfo->algs[algclass_ipsec_comp] == NULL) {
701: plog(LLV_ERROR, LOCATION, NULL,
702: "no ipcomp algorithm found\n");
703: goto err;
704: }
705: t = 1;
706: for (a = sainfo->algs[algclass_ipsec_comp]; a; a = a->next) {
707:
708: /* allocate satrns */
709: newtr = newsatrns();
710: if (newtr == NULL) {
711: plog(LLV_ERROR, LOCATION, NULL,
712: "failed to allocate satrns.\n");
713: goto err;
714: }
715:
716: newtr->trns_no = t++;
717: newtr->trns_id = a->alg;
718: newtr->authtype = IPSECDOI_ATTR_AUTH_NONE; /*no auth*/
719:
720: inssatrns(pr, newtr);
721: }
722: break;
723: default:
724: plog(LLV_ERROR, LOCATION, NULL,
725: "unknown proto_id (%d).\n", pr->proto_id);
726: goto err;
727: }
728:
729: /* no proposal found */
730: if (pr->head == NULL) {
731: plog(LLV_ERROR, LOCATION, NULL, "no algorithms found.\n");
732: return -1;
733: }
734:
735: return 0;
736:
737: err:
738: flushsatrns(pr->head);
739: return -1;
740: }
741:
742: struct saprop *
743: aproppair2saprop(p0)
744: struct prop_pair *p0;
745: {
746: struct prop_pair *p, *t;
747: struct saprop *newpp;
748: struct saproto *newpr;
749: struct satrns *newtr;
750: u_int8_t *spi;
751:
752: if (p0 == NULL)
753: return NULL;
754:
755: /* allocate ipsec a sa proposal */
756: newpp = newsaprop();
757: if (newpp == NULL) {
758: plog(LLV_ERROR, LOCATION, NULL,
759: "failed to allocate saprop.\n");
760: return NULL;
761: }
762: newpp->prop_no = p0->prop->p_no;
763: /* lifetime & lifebyte must be updated later */
764:
765: for (p = p0; p; p = p->next) {
766:
767: /* allocate ipsec sa protocol */
768: newpr = newsaproto();
769: if (newpr == NULL) {
770: plog(LLV_ERROR, LOCATION, NULL,
771: "failed to allocate saproto.\n");
772: goto err;
773: }
774:
775: /* check spi size */
776: /* XXX should be handled isakmp cookie */
777: if (sizeof(newpr->spi) < p->prop->spi_size) {
778: plog(LLV_ERROR, LOCATION, NULL,
779: "invalid spi size %d.\n", p->prop->spi_size);
780: racoon_free(newpr);
781: goto err;
782: }
783:
784: /*
785: * XXX SPI bits are left-filled, for use with IPComp.
786: * we should be switching to variable-length spi field...
787: */
788: newpr->proto_id = p->prop->proto_id;
789: newpr->spisize = p->prop->spi_size;
790: memset(&newpr->spi, 0, sizeof(newpr->spi));
791: spi = (u_int8_t *)&newpr->spi;
792: spi += sizeof(newpr->spi);
793: spi -= p->prop->spi_size;
794: memcpy(spi, p->prop + 1, p->prop->spi_size);
795: newpr->reqid_in = 0;
796: newpr->reqid_out = 0;
797:
798: for (t = p; t; t = t->tnext) {
799:
800: plog(LLV_DEBUG, LOCATION, NULL,
801: "prop#=%d prot-id=%s spi-size=%d "
802: "#trns=%d trns#=%d trns-id=%s\n",
803: t->prop->p_no,
804: s_ipsecdoi_proto(t->prop->proto_id),
805: t->prop->spi_size, t->prop->num_t,
806: t->trns->t_no,
807: s_ipsecdoi_trns(t->prop->proto_id,
808: t->trns->t_id));
809:
810: /* allocate ipsec sa transform */
811: newtr = newsatrns();
812: if (newtr == NULL) {
813: plog(LLV_ERROR, LOCATION, NULL,
814: "failed to allocate satrns.\n");
815: racoon_free(newpr);
816: goto err;
817: }
818:
819: if (ipsecdoi_t2satrns(t->trns,
820: newpp, newpr, newtr) < 0) {
821: flushsaprop(newpp);
822: racoon_free(newtr);
823: racoon_free(newpr);
824: return NULL;
825: }
826:
827: inssatrns(newpr, newtr);
828: }
829:
830: /*
831: * If the peer does not specify encryption mode, use
832: * transport mode by default. This is to conform to
833: * draft-shacham-ippcp-rfc2393bis-08.txt (explicitly specifies
834: * that unspecified == transport), as well as RFC2407
835: * (unspecified == implementation dependent default).
836: */
837: if (newpr->encmode == 0)
838: newpr->encmode = IPSECDOI_ATTR_ENC_MODE_TRNS;
839:
840: inssaproto(newpp, newpr);
841: }
842:
843: return newpp;
844:
845: err:
846: flushsaprop(newpp);
847: return NULL;
848: }
849:
850: void
851: flushsaprop(head)
852: struct saprop *head;
853: {
854: struct saprop *p, *save;
855:
856: for (p = head; p != NULL; p = save) {
857: save = p->next;
858: flushsaproto(p->head);
859: racoon_free(p);
860: }
861:
862: return;
863: }
864:
865: void
866: flushsaproto(head)
867: struct saproto *head;
868: {
869: struct saproto *p, *save;
870:
871: for (p = head; p != NULL; p = save) {
872: save = p->next;
873: flushsatrns(p->head);
874: vfree(p->keymat);
875: vfree(p->keymat_p);
876: racoon_free(p);
877: }
878:
879: return;
880: }
881:
882: void
883: flushsatrns(head)
884: struct satrns *head;
885: {
886: struct satrns *p, *save;
887:
888: for (p = head; p != NULL; p = save) {
889: save = p->next;
890: racoon_free(p);
891: }
892:
893: return;
894: }
895:
896: /*
897: * print multiple proposals
898: */
899: void
900: printsaprop(pri, pp)
901: const int pri;
902: const struct saprop *pp;
903: {
904: const struct saprop *p;
905:
906: if (pp == NULL) {
907: plog(pri, LOCATION, NULL, "(null)");
908: return;
909: }
910:
911: for (p = pp; p; p = p->next) {
912: printsaprop0(pri, p);
913: }
914:
915: return;
916: }
917:
918: /*
919: * print one proposal.
920: */
921: void
922: printsaprop0(pri, pp)
923: int pri;
924: const struct saprop *pp;
925: {
926: const struct saproto *p;
927:
928: if (pp == NULL)
929: return;
930:
931: for (p = pp->head; p; p = p->next) {
932: printsaproto(pri, p);
933: }
934:
935: return;
936: }
937:
938: void
939: printsaproto(pri, pr)
940: const int pri;
941: const struct saproto *pr;
942: {
943: struct satrns *tr;
944:
945: if (pr == NULL)
946: return;
947:
948: plog(pri, LOCATION, NULL,
949: " (proto_id=%s spisize=%d spi=%08lx spi_p=%08lx "
950: "encmode=%s reqid=%d:%d)\n",
951: s_ipsecdoi_proto(pr->proto_id),
952: (int)pr->spisize,
953: (unsigned long)ntohl(pr->spi),
954: (unsigned long)ntohl(pr->spi_p),
955: s_ipsecdoi_attr_v(IPSECDOI_ATTR_ENC_MODE, pr->encmode),
956: (int)pr->reqid_in, (int)pr->reqid_out);
957:
958: for (tr = pr->head; tr; tr = tr->next) {
959: printsatrns(pri, pr->proto_id, tr);
960: }
961:
962: return;
963: }
964:
965: void
966: printsatrns(pri, proto_id, tr)
967: const int pri;
968: const int proto_id;
969: const struct satrns *tr;
970: {
971: if (tr == NULL)
972: return;
973:
974: switch (proto_id) {
975: case IPSECDOI_PROTO_IPSEC_AH:
976: plog(pri, LOCATION, NULL,
977: " (trns_id=%s authtype=%s)\n",
978: s_ipsecdoi_trns(proto_id, tr->trns_id),
979: s_ipsecdoi_attr_v(IPSECDOI_ATTR_AUTH, tr->authtype));
980: break;
981: case IPSECDOI_PROTO_IPSEC_ESP:
982: plog(pri, LOCATION, NULL,
983: " (trns_id=%s encklen=%d authtype=%s)\n",
984: s_ipsecdoi_trns(proto_id, tr->trns_id),
985: tr->encklen,
986: s_ipsecdoi_attr_v(IPSECDOI_ATTR_AUTH, tr->authtype));
987: break;
988: case IPSECDOI_PROTO_IPCOMP:
989: plog(pri, LOCATION, NULL,
990: " (trns_id=%s)\n",
991: s_ipsecdoi_trns(proto_id, tr->trns_id));
992: break;
993: default:
994: plog(pri, LOCATION, NULL,
995: "(unknown proto_id %d)\n", proto_id);
996: }
997:
998: return;
999: }
1000:
1001: void
1002: print_proppair0(pri, p, level)
1003: int pri;
1004: struct prop_pair *p;
1005: int level;
1006: {
1007: char spc[21];
1008:
1009: memset(spc, ' ', sizeof(spc));
1010: spc[sizeof(spc) - 1] = '\0';
1011: if (level < 20) {
1012: spc[level] = '\0';
1013: }
1014:
1015: plog(pri, LOCATION, NULL,
1016: "%s%p: next=%p tnext=%p\n", spc, p, p->next, p->tnext);
1017: if (p->next)
1018: print_proppair0(pri, p->next, level + 1);
1019: if (p->tnext)
1020: print_proppair0(pri, p->tnext, level + 1);
1021: }
1022:
1023: void
1024: print_proppair(pri, p)
1025: int pri;
1026: struct prop_pair *p;
1027: {
1028: print_proppair0(pri, p, 1);
1029: }
1030:
1031: int
1032: set_proposal_from_policy(iph2, sp_main, sp_sub)
1033: struct ph2handle *iph2;
1034: struct secpolicy *sp_main, *sp_sub;
1035: {
1036: struct saprop *newpp;
1037: struct ipsecrequest *req;
1038: int encmodesv = IPSECDOI_ATTR_ENC_MODE_TRNS; /* use only when complex_bundle */
1039:
1040: newpp = newsaprop();
1041: if (newpp == NULL) {
1042: plog(LLV_ERROR, LOCATION, NULL,
1043: "failed to allocate saprop.\n");
1044: goto err;
1045: }
1046: newpp->prop_no = 1;
1047: newpp->lifetime = iph2->sainfo->lifetime;
1048: newpp->lifebyte = iph2->sainfo->lifebyte;
1049: newpp->pfs_group = iph2->sainfo->pfs_group;
1050:
1051: if (lcconf->complex_bundle)
1052: goto skip1;
1053:
1054: /*
1055: * decide the encryption mode of this SA bundle.
1056: * the mode becomes tunnel mode when there is even one policy
1057: * of tunnel mode in the SPD. otherwise the mode becomes
1058: * transport mode.
1059: */
1060: for (req = sp_main->req; req; req = req->next) {
1061: if (req->saidx.mode == IPSEC_MODE_TUNNEL) {
1062: encmodesv = pfkey2ipsecdoi_mode(req->saidx.mode);
1063: #ifdef ENABLE_NATT
1064: if (iph2->ph1 && (iph2->ph1->natt_flags & NAT_DETECTED))
1065: encmodesv += iph2->ph1->natt_options->mode_udp_diff;
1066: #endif
1067: break;
1068: }
1069: }
1070:
1071: skip1:
1072: for (req = sp_main->req; req; req = req->next) {
1073: struct saproto *newpr;
1074: caddr_t paddr = NULL;
1075:
1076: /*
1077: * check if SA bundle ?
1078: * nested SAs negotiation is NOT supported.
1079: * me +--- SA1 ---+ peer1
1080: * me +--- SA2 --------------+ peer2
1081: */
1082: #ifdef __linux__
1083: if (req->saidx.src.ss_family && req->saidx.dst.ss_family) {
1084: #else
1085: if (req->saidx.src.ss_len && req->saidx.dst.ss_len) {
1086: #endif
1087: /* check the end of ip addresses of SA */
1088: if (iph2->side == INITIATOR)
1089: paddr = (caddr_t)&req->saidx.dst;
1090: else
1091: paddr = (caddr_t)&req->saidx.src;
1092: }
1093:
1094: /* allocate ipsec sa protocol */
1095: newpr = newsaproto();
1096: if (newpr == NULL) {
1097: plog(LLV_ERROR, LOCATION, NULL,
1098: "failed to allocate saproto.\n");
1099: goto err;
1100: }
1101:
1102: newpr->proto_id = ipproto2doi(req->saidx.proto);
1103: if (newpr->proto_id == IPSECDOI_PROTO_IPCOMP)
1104: newpr->spisize = 2;
1105: else
1106: newpr->spisize = 4;
1107: if (lcconf->complex_bundle) {
1108: newpr->encmode = pfkey2ipsecdoi_mode(req->saidx.mode);
1109: #ifdef ENABLE_NATT
1110: if (iph2->ph1 && (iph2->ph1->natt_flags & NAT_DETECTED))
1111: newpr->encmode +=
1112: iph2->ph1->natt_options->mode_udp_diff;
1113: #endif
1114: }
1115: else
1116: newpr->encmode = encmodesv;
1117:
1118: if (iph2->side == INITIATOR)
1119: newpr->reqid_out = req->saidx.reqid;
1120: else
1121: newpr->reqid_in = req->saidx.reqid;
1122:
1123: if (set_satrnsbysainfo(newpr, iph2->sainfo) < 0) {
1124: plog(LLV_ERROR, LOCATION, NULL,
1125: "failed to get algorithms.\n");
1126: racoon_free(newpr);
1127: goto err;
1128: }
1129:
1130: /* set new saproto */
1131: inssaprotorev(newpp, newpr);
1132: }
1133:
1134: /* get reqid_in from inbound policy */
1135: if (sp_sub) {
1136: struct saproto *pr;
1137:
1138: req = sp_sub->req;
1139: pr = newpp->head;
1140: while (req && pr) {
1141: if (iph2->side == INITIATOR)
1142: pr->reqid_in = req->saidx.reqid;
1143: else
1144: pr->reqid_out = req->saidx.reqid;
1145: pr = pr->next;
1146: req = req->next;
1147: }
1148: if (pr || req) {
1149: plog(LLV_NOTIFY, LOCATION, NULL,
1150: "There is a difference "
1151: "between the in/out bound policies in SPD.\n");
1152: }
1153: }
1154:
1155: iph2->proposal = newpp;
1156:
1157: printsaprop0(LLV_DEBUG, newpp);
1158:
1159: return 0;
1160: err:
1161: flushsaprop(newpp);
1162: return -1;
1163: }
1164:
1165: /*
1166: * generate a policy from peer's proposal.
1167: * this function unconditionally choices first proposal in SA payload
1168: * passed by peer.
1169: */
1170: int
1171: set_proposal_from_proposal(iph2)
1172: struct ph2handle *iph2;
1173: {
1174: struct saprop *newpp = NULL, *pp0, *pp_peer = NULL;
1175: struct saproto *newpr = NULL, *pr;
1176: struct prop_pair **pair;
1177: int error = -1;
1178: int i;
1179:
1180: /* get proposal pair */
1181: pair = get_proppair(iph2->sa, IPSECDOI_TYPE_PH2);
1182: if (pair == NULL)
1183: goto end;
1184:
1185: /*
1186: * make my proposal according as the client proposal.
1187: * XXX assumed there is only one proposal even if it's the SA bundle.
1188: */
1189: for (i = 0; i < MAXPROPPAIRLEN; i++) {
1190: if (pair[i] == NULL)
1191: continue;
1192:
1193: if (pp_peer != NULL)
1194: flushsaprop(pp_peer);
1195:
1196: pp_peer = aproppair2saprop(pair[i]);
1197: if (pp_peer == NULL)
1198: goto end;
1199:
1200: pp0 = newsaprop();
1201: if (pp0 == NULL) {
1202: plog(LLV_ERROR, LOCATION, NULL,
1203: "failed to allocate saprop.\n");
1204: goto end;
1205: }
1206: pp0->prop_no = 1;
1207: pp0->lifetime = iph2->sainfo->lifetime;
1208: pp0->lifebyte = iph2->sainfo->lifebyte;
1209: pp0->pfs_group = iph2->sainfo->pfs_group;
1210:
1211: #ifdef HAVE_SECCTX
1212: if (*pp_peer->sctx.ctx_str) {
1213: pp0->sctx.ctx_doi = pp_peer->sctx.ctx_doi;
1214: pp0->sctx.ctx_alg = pp_peer->sctx.ctx_alg;
1215: pp0->sctx.ctx_strlen = pp_peer->sctx.ctx_strlen;
1216: memcpy(pp0->sctx.ctx_str, pp_peer->sctx.ctx_str,
1217: pp_peer->sctx.ctx_strlen);
1218: }
1219: #endif /* HAVE_SECCTX */
1220:
1221: if (pp_peer->next != NULL) {
1222: plog(LLV_ERROR, LOCATION, NULL,
1223: "pp_peer is inconsistency, ignore it.\n");
1224: /*FALLTHROUGH*/
1225: }
1226:
1227: for (pr = pp_peer->head; pr; pr = pr->next)
1228: {
1229: newpr = newsaproto();
1230: if (newpr == NULL)
1231: {
1232: plog(LLV_ERROR, LOCATION, NULL,
1233: "failed to allocate saproto.\n");
1234: racoon_free(pp0);
1235: goto end;
1236: }
1237: newpr->proto_id = pr->proto_id;
1238: newpr->spisize = pr->spisize;
1239: newpr->encmode = pr->encmode;
1240: newpr->spi = 0;
1241: newpr->spi_p = pr->spi; /* copy peer's SPI */
1242: newpr->reqid_in = 0;
1243: newpr->reqid_out = 0;
1244:
1245: if (iph2->ph1->rmconf->gen_policy == GENERATE_POLICY_UNIQUE){
1246: newpr->reqid_in = g_nextreqid ;
1247: newpr->reqid_out = g_nextreqid ++;
1248: /*
1249: * XXX there is a (very limited)
1250: * risk of reusing the same reqid
1251: * as another SP entry for the same peer
1252: */
1253: if(g_nextreqid >= IPSEC_MANUAL_REQID_MAX)
1254: g_nextreqid = 1;
1255: }else{
1256: newpr->reqid_in = 0;
1257: newpr->reqid_out = 0;
1258: }
1259:
1260: if (set_satrnsbysainfo(newpr, iph2->sainfo) < 0)
1261: {
1262: plog(LLV_ERROR, LOCATION, NULL,
1263: "failed to get algorithms.\n");
1264: racoon_free(newpr);
1265: racoon_free(pp0);
1266: goto end;
1267: }
1268: inssaproto(pp0, newpr);
1269: }
1270:
1271: inssaprop(&newpp, pp0);
1272: }
1273:
1274: plog(LLV_DEBUG, LOCATION, NULL, "make a proposal from peer's:\n");
1275: printsaprop0(LLV_DEBUG, newpp);
1276:
1277: iph2->proposal = newpp;
1278:
1279: error = 0;
1280:
1281: end:
1282: if (error && newpp)
1283: flushsaprop(newpp);
1284:
1285: if (pp_peer)
1286: flushsaprop(pp_peer);
1287: if (pair)
1288: free_proppair(pair);
1289: return error;
1290: }