#include #ifdef __rtems__ #include #include "rtems-bsd-racoon-namespace.h" #endif /* __rtems__ */ /* $NetBSD: sainfo.c,v 1.14 2011/02/02 15:21:34 vanhu Exp $ */ /* $KAME: sainfo.c,v 1.16 2003/06/27 07:32:39 sakane Exp $ */ /* * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. Neither the name of the project nor the names of its contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. */ #include "config.h" #include #include #include #include #include #include #include PATH_IPSEC_H #include #include #include #include #include "var.h" #include "misc.h" #include "vmbuf.h" #include "plog.h" #include "sockmisc.h" #include "debug.h" #include "localconf.h" #include "isakmp_var.h" #include "isakmp.h" #include "ipsec_doi.h" #include "oakley.h" #include "handler.h" #include "algorithm.h" #include "sainfo.h" #include "gcmalloc.h" typedef LIST_HEAD(_sitree, sainfo) sainfo_tailq_head_t; static sainfo_tailq_head_t sitree, sitree_save; /* %%% * modules for ipsec sa info */ /* * return matching entry. * no matching entry found and if there is anonymous entry, return it. * else return NULL. * First pass is for sainfo from a specified peer, second for others. */ struct sainfo * getsainfo(loc, rmt, peer, client, remoteid) const vchar_t *loc, *rmt, *peer, *client; uint32_t remoteid; { struct sainfo *s = NULL; /* debug level output */ if(loglevel >= LLV_DEBUG) { char *dloc, *drmt, *dpeer, *dclient; if (loc == NULL) dloc = strdup("ANONYMOUS"); else dloc = ipsecdoi_id2str(loc); if (rmt == SAINFO_ANONYMOUS) drmt = strdup("ANONYMOUS"); else if (rmt == SAINFO_CLIENTADDR) drmt = strdup("CLIENTADDR"); else drmt = ipsecdoi_id2str(rmt); if (peer == NULL) dpeer = strdup("NULL"); else dpeer = ipsecdoi_id2str(peer); if (client == NULL) dclient = strdup("NULL"); else dclient = ipsecdoi_id2str(client); plog(LLV_DEBUG, LOCATION, NULL, "getsainfo params: loc=\'%s\' rmt=\'%s\' peer=\'%s\' client=\'%s\' id=%u\n", dloc, drmt, dpeer, dclient, remoteid ); racoon_free(dloc); racoon_free(drmt); racoon_free(dpeer); racoon_free(dclient); } LIST_FOREACH(s, &sitree, chain) { const char *sainfostr = sainfo2str(s); plog(LLV_DEBUG, LOCATION, NULL, "evaluating sainfo: %s\n", sainfostr); if(s->remoteid != remoteid) { plog(LLV_DEBUG, LOCATION, NULL, "remoteid mismatch: %u != %u\n", s->remoteid, remoteid); continue; } /* compare 'from' id value */ if (s->id_i != NULL) if (ipsecdoi_chkcmpids(peer, s->id_i, 0)) continue; /* compare ids - client */ if( s->iddst == SAINFO_CLIENTADDR ) { /* * This sainfo section enforces client address * checking. Prevent match if the client value * ( modecfg or tunnel address ) is NULL. */ if (client == NULL) continue; if( rmt == SAINFO_CLIENTADDR ) { /* * In the case where a supplied rmt value is * also SAINFO_CLIENTADDR, we are comparing * with another sainfo to check for duplicate. * Only compare the local values to determine * a match. */ if (!ipsecdoi_chkcmpids(loc, s->idsrc, 0)) return s; } else { /* * In the case where a supplied rmt value is * not SAINFO_CLIENTADDR, do a standard match * for local values and enforce that the rmt * id matches the client address value. */ if (!ipsecdoi_chkcmpids(loc, s->idsrc, 0) && !ipsecdoi_chkcmpids(rmt, client, 0)) return s; } continue; } /* compare ids - standard */ if (!ipsecdoi_chkcmpids(loc, s->idsrc, 0) && !ipsecdoi_chkcmpids(rmt, s->iddst, 0)) return s; } return NULL; } struct sainfo * newsainfo() { struct sainfo *new; new = racoon_calloc(1, sizeof(*new)); if (new == NULL) return NULL; new->lifetime = IPSECDOI_ATTR_SA_LD_SEC_DEFAULT; new->lifebyte = IPSECDOI_ATTR_SA_LD_KB_MAX; return new; } void delsainfo(si) struct sainfo *si; { int i; for (i = 0; i < MAXALGCLASS; i++) delsainfoalg(si->algs[i]); if (si->idsrc) vfree(si->idsrc); if (si->iddst != NULL && si->iddst != SAINFO_CLIENTADDR) vfree(si->iddst); #ifdef ENABLE_HYBRID if (si->group) vfree(si->group); #endif racoon_free(si); } int prisainfo(s) struct sainfo *s; { /* * determine the matching priority * of an sainfo section */ int pri = 0; if(s->remoteid) pri += 3; if(s->id_i) pri += 3; if(s->idsrc) pri++; if(s->iddst) pri++; return pri; } void inssainfo(new) struct sainfo *new; { if(LIST_EMPTY(&sitree)) { /* first in list */ LIST_INSERT_HEAD(&sitree, new, chain); } else { int npri, spri; struct sainfo *s, *n; /* * insert our new sainfo section * into our list which is sorted * based on the match priority */ npri = prisainfo(new); s = LIST_FIRST(&sitree); while (1) { spri = prisainfo(s); n = LIST_NEXT(s, chain); if(npri > spri) { /* higher priority */ LIST_INSERT_BEFORE(s, new, chain); return; } if(n == NULL) { /* last in list */ LIST_INSERT_AFTER(s, new, chain); return; } s = n; } } } void remsainfo(si) struct sainfo *si; { LIST_REMOVE(si, chain); } void flushsainfo() { struct sainfo *s, *next; for (s = LIST_FIRST(&sitree); s; s = next) { next = LIST_NEXT(s, chain); remsainfo(s); delsainfo(s); } } void initsainfo() { LIST_INIT(&sitree); } struct sainfoalg * newsainfoalg() { struct sainfoalg *new; new = racoon_calloc(1, sizeof(*new)); if (new == NULL) return NULL; return new; } void delsainfoalg(alg) struct sainfoalg *alg; { struct sainfoalg *a, *next; for (a = alg; a; a = next) { next = a->next; racoon_free(a); } } void inssainfoalg(head, new) struct sainfoalg **head; struct sainfoalg *new; { struct sainfoalg *a; for (a = *head; a && a->next; a = a->next) ; if (a) a->next = new; else *head = new; } const char * sainfo2str(si) const struct sainfo *si; { static char buf[256]; char *idloc = NULL, *idrmt = NULL, *id_i; if (si->idsrc == SAINFO_ANONYMOUS) idloc = strdup("ANONYMOUS"); else idloc = ipsecdoi_id2str(si->idsrc); if (si->iddst == SAINFO_ANONYMOUS) idrmt = strdup("ANONYMOUS"); else if (si->iddst == SAINFO_CLIENTADDR) idrmt = strdup("CLIENTADDR"); else idrmt = ipsecdoi_id2str(si->iddst); if (si->id_i == NULL) id_i = strdup("ANY"); else id_i = ipsecdoi_id2str(si->id_i); snprintf(buf, 255, "loc=\'%s\', rmt=\'%s\', peer=\'%s\', id=%u", idloc, idrmt, id_i, si->remoteid); racoon_free(idloc); racoon_free(idrmt); racoon_free(id_i); return buf; } void sainfo_start_reload(void){ sitree_save=sitree; initsainfo(); } void sainfo_finish_reload(void){ sainfo_tailq_head_t sitree_tmp; sitree_tmp=sitree; sitree=sitree_save; flushsainfo(); sitree=sitree_tmp; } void save_sainfotree_restore(void){ flushsainfo(); sitree=sitree_save; } #ifdef __rtems__ #include "rtems-bsd-racoon-sainfo-data.h" #endif /* __rtems__ */