Return to sainfo.c CVS log

Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / ipsec-tools / src / racoon

ipsec-tools

/*	$NetBSD: sainfo.c,v 1.14 2011/02/02 15:21:34 vanhu Exp $	*/

/*	$KAME: sainfo.c,v 1.16 2003/06/27 07:32:39 sakane Exp $	*/

/*
 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
 * All rights reserved.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the project nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 * 
 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#include "config.h"

#include <sys/param.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/queue.h>

#include <netinet/in.h>
#include <netinet/in.h> 
#include PATH_IPSEC_H

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>

#include "var.h"
#include "misc.h"
#include "vmbuf.h"
#include "plog.h"
#include "sockmisc.h"
#include "debug.h"

#include "localconf.h"
#include "isakmp_var.h"
#include "isakmp.h"
#include "ipsec_doi.h"
#include "oakley.h"
#include "handler.h"
#include "algorithm.h"
#include "sainfo.h"
#include "gcmalloc.h"

typedef LIST_HEAD(_sitree, sainfo) sainfo_tailq_head_t;
static sainfo_tailq_head_t sitree, sitree_save;

/* %%%
 * modules for ipsec sa info
 */
/*
 * return matching entry.
 * no matching entry found and if there is anonymous entry, return it.
 * else return NULL.
 * First pass is for sainfo from a specified peer, second for others.
 */
struct sainfo *
getsainfo(loc, rmt, peer, client, remoteid)
	const vchar_t *loc, *rmt, *peer, *client;
	uint32_t remoteid;
{
	struct sainfo *s = NULL;

	/* debug level output */
	if(loglevel >= LLV_DEBUG) {
		char *dloc, *drmt, *dpeer, *dclient;

		if (loc == NULL)
			dloc = strdup("ANONYMOUS");
		else
			dloc = ipsecdoi_id2str(loc);

		if (rmt == SAINFO_ANONYMOUS)
			drmt = strdup("ANONYMOUS");
		else if (rmt == SAINFO_CLIENTADDR)
			drmt = strdup("CLIENTADDR");
		else
			drmt = ipsecdoi_id2str(rmt);

		if (peer == NULL)
			dpeer = strdup("NULL");
		else
			dpeer = ipsecdoi_id2str(peer);

		if (client == NULL)
			dclient = strdup("NULL");
		else
			dclient = ipsecdoi_id2str(client);

		plog(LLV_DEBUG, LOCATION, NULL,
			"getsainfo params: loc=\'%s\' rmt=\'%s\' peer=\'%s\' client=\'%s\' id=%u\n",
			dloc, drmt, dpeer, dclient, remoteid );
 
                racoon_free(dloc);
                racoon_free(drmt);
                racoon_free(dpeer);
                racoon_free(dclient);
	}

	LIST_FOREACH(s, &sitree, chain) {
		const char *sainfostr = sainfo2str(s);
		plog(LLV_DEBUG, LOCATION, NULL,
			"evaluating sainfo: %s\n", sainfostr);

		if(s->remoteid != remoteid) {
			plog(LLV_DEBUG, LOCATION, NULL,
				"remoteid mismatch: %u != %u\n",
				s->remoteid, remoteid);
				continue;
		}

		/* compare 'from' id value */
		if (s->id_i != NULL)
			if (ipsecdoi_chkcmpids(peer, s->id_i, 0))
				continue;

		/* compare ids - client */
		if( s->iddst == SAINFO_CLIENTADDR ) {
			/*
			 * This sainfo section enforces client address
			 * checking. Prevent match if the client value
			 * ( modecfg or tunnel address ) is NULL.
			 */

			if (client == NULL)
				continue;

			if( rmt == SAINFO_CLIENTADDR ) {
				/*
				 * In the case where a supplied rmt value is
				 * also SAINFO_CLIENTADDR, we are comparing
				 * with another sainfo to check for duplicate.
				 * Only compare the local values to determine
				 * a match.
				 */

				 if (!ipsecdoi_chkcmpids(loc, s->idsrc, 0))
					return s;
			}
			else {
				/*
				 * In the case where a supplied rmt value is
				 * not SAINFO_CLIENTADDR, do a standard match
				 * for local values and enforce that the rmt
				 * id matches the client address value.
				 */

				if (!ipsecdoi_chkcmpids(loc, s->idsrc, 0) &&
				    !ipsecdoi_chkcmpids(rmt, client, 0))
					return s;
			}

			continue;
		}


		/* compare ids - standard */
		if (!ipsecdoi_chkcmpids(loc, s->idsrc, 0) &&
		    !ipsecdoi_chkcmpids(rmt, s->iddst, 0))
			return s;
	}

	return NULL;
}

struct sainfo *
newsainfo()
{
	struct sainfo *new;

	new = racoon_calloc(1, sizeof(*new));
	if (new == NULL)
		return NULL;

	new->lifetime = IPSECDOI_ATTR_SA_LD_SEC_DEFAULT;
	new->lifebyte = IPSECDOI_ATTR_SA_LD_KB_MAX;

	return new;
}

void
delsainfo(si)
	struct sainfo *si;
{
	int i;

	for (i = 0; i < MAXALGCLASS; i++)
		delsainfoalg(si->algs[i]);

	if (si->idsrc)
		vfree(si->idsrc);
	if (si->iddst != NULL &&
		si->iddst != SAINFO_CLIENTADDR)
		vfree(si->iddst);

#ifdef ENABLE_HYBRID
	if (si->group)
		vfree(si->group);
#endif

	racoon_free(si);
}

int prisainfo(s)
	struct sainfo *s;
{
	/*
	 * determine the matching priority
	 * of an sainfo section
	 */

	int pri = 0;

	if(s->remoteid)
		pri += 3;

	if(s->id_i)
		pri += 3;

	if(s->idsrc)
		pri++;

	if(s->iddst)
		pri++;

	return pri;
}

void
inssainfo(new)
	struct sainfo *new;
{
	if(LIST_EMPTY(&sitree)) {

		/* first in list */
		LIST_INSERT_HEAD(&sitree, new, chain);
	}
	else {
		int npri, spri;
		struct sainfo *s, *n;

		/*
		 * insert our new sainfo section
		 * into our list which is sorted
		 * based on the match priority
		 */

		npri = prisainfo(new);

		s = LIST_FIRST(&sitree);
		while (1) {

			spri = prisainfo(s);
			n = LIST_NEXT(s, chain);

			if(npri > spri)
			{
				/* higher priority */
				LIST_INSERT_BEFORE(s, new, chain);
				return;
			}

			if(n == NULL)
			{
				/* last in list */
				LIST_INSERT_AFTER(s, new, chain);
				return;
			}

			s = n;
		}
	}
}

void
remsainfo(si)
	struct sainfo *si;
{
	LIST_REMOVE(si, chain);
}

void
flushsainfo()
{
	struct sainfo *s, *next;

	for (s = LIST_FIRST(&sitree); s; s = next) {
		next = LIST_NEXT(s, chain);
		remsainfo(s);
		delsainfo(s);
	}
}

void
initsainfo()
{
	LIST_INIT(&sitree);
}

struct sainfoalg *
newsainfoalg()
{
	struct sainfoalg *new;

	new = racoon_calloc(1, sizeof(*new));
	if (new == NULL)
		return NULL;

	return new;
}

void
delsainfoalg(alg)
	struct sainfoalg *alg;
{
	struct sainfoalg *a, *next;

	for (a = alg; a; a = next) {
		next = a->next;
		racoon_free(a);
	}
}

void
inssainfoalg(head, new)
	struct sainfoalg **head;
	struct sainfoalg *new;
{
	struct sainfoalg *a;

	for (a = *head; a && a->next; a = a->next)
		;
	if (a)
		a->next = new;
	else
		*head = new;
}

const char *
sainfo2str(si)
	const struct sainfo *si;
{
        static char buf[256];

        char *idloc = NULL, *idrmt = NULL, *id_i;
 
        if (si->idsrc == SAINFO_ANONYMOUS)
                idloc = strdup("ANONYMOUS");
        else
                idloc = ipsecdoi_id2str(si->idsrc);
 
        if (si->iddst == SAINFO_ANONYMOUS)
                idrmt = strdup("ANONYMOUS");
	else if (si->iddst == SAINFO_CLIENTADDR)
                idrmt = strdup("CLIENTADDR");
        else
                idrmt = ipsecdoi_id2str(si->iddst);
 
        if (si->id_i == NULL)
                id_i = strdup("ANY");
        else
                id_i = ipsecdoi_id2str(si->id_i);
 
        snprintf(buf, 255, "loc=\'%s\', rmt=\'%s\', peer=\'%s\', id=%u",
		idloc, idrmt, id_i, si->remoteid);
 
        racoon_free(idloc);
        racoon_free(idrmt);
        racoon_free(id_i);
 
        return buf;
}

void sainfo_start_reload(void){
	sitree_save=sitree;
	initsainfo();
}

void sainfo_finish_reload(void){
	sainfo_tailq_head_t sitree_tmp;

	sitree_tmp=sitree;
	sitree=sitree_save;
	flushsainfo();
	sitree=sitree_tmp;
}

void save_sainfotree_restore(void){
	flushsainfo();
	sitree=sitree_save;
}