xref: /external/ipsec-tools/src/racoon/sainfo.c

/*	$NetBSD: sainfo.c,v 1.7.6.1 2007/08/01 11:52:22 vanhu Exp $	*/

/*	$KAME: sainfo.c,v 1.16 2003/06/27 07:32:39 sakane Exp $	*/

/*
 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the project nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#include "config.h"

#include <sys/param.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/queue.h>

#include <netinet/in.h>
#include <netinet/in.h>
#include PATH_IPSEC_H

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>

#include "var.h"
#include "misc.h"
#include "vmbuf.h"
#include "plog.h"
#include "sockmisc.h"
#include "debug.h"

#include "localconf.h"
#include "isakmp_var.h"
#include "isakmp.h"
#include "ipsec_doi.h"
#include "oakley.h"
#include "handler.h"
#include "algorithm.h"
#include "sainfo.h"
#include "gcmalloc.h"

static LIST_HEAD(_sitree, sainfo) sitree, sitree_save, sitree_tmp;

/* %%%
 * modules for ipsec sa info
 */
/*
 * return matching entry.
 * no matching entry found and if there is anonymous entry, return it.
 * else return NULL.
 * First pass is for sainfo from a specified peer, second for others.
 */
struct sainfo *
getsainfo(loc, rmt, peer, remoteid)
	const vchar_t *loc, *rmt, *peer;
	int remoteid;
{
	struct sainfo *s = NULL;
	struct sainfo *anonymous = NULL;
	int pass = 1;

	if (peer == NULL)
		pass = 2;

	/* debug level output */
	if(loglevel >= LLV_DEBUG) {
		char *dloc, *drmt, *dpeer, *dclient;

		if (loc == NULL)
			dloc = strdup("ANONYMOUS");
		else
			dloc = ipsecdoi_id2str(loc);

		if (rmt == NULL)
			drmt = strdup("ANONYMOUS");
		else
			drmt = ipsecdoi_id2str(rmt);

		if (peer == NULL)
			dpeer = strdup("NULL");
		else
			dpeer = ipsecdoi_id2str(peer);

		plog(LLV_DEBUG, LOCATION, NULL,
			"getsainfo params: loc=\'%s\', rmt=\'%s\', peer=\'%s\', id=%i\n",
			dloc, drmt, dpeer, remoteid );

                racoon_free(dloc);
                racoon_free(drmt);
                racoon_free(dpeer);
	}

    again:
	plog(LLV_DEBUG, LOCATION, NULL,
		"getsainfo pass #%i\n", pass);

	LIST_FOREACH(s, &sitree, chain) {
		const char *sainfostr = sainfo2str(s);
		plog(LLV_DEBUG, LOCATION, NULL,
			"evaluating sainfo: %s\n", sainfostr);

		if(s->remoteid != remoteid)
			continue;

		if (s->id_i != NULL) {
			if (pass == 2)
				continue;
			if (ipsecdoi_chkcmpids(peer, s->id_i, 0))
				continue;
		} else if (pass == 1)
			continue;
		if (s->idsrc == NULL && s->iddst == NULL) {
			anonymous = s;
			continue;
		}

		/* anonymous ? */
		if (loc == NULL) {
			if (anonymous != NULL)
				break;
			continue;
		}

		/* compare the ids */
		if (!ipsecdoi_chkcmpids(loc, s->idsrc, 0) &&
		    !ipsecdoi_chkcmpids(rmt, s->iddst, 0))
			return s;
	}

	if ((anonymous == NULL) && (pass == 1)) {
		pass++;
		goto again;
	}

	return anonymous;
}

struct sainfo *
newsainfo()
{
	struct sainfo *new;

	new = racoon_calloc(1, sizeof(*new));
	if (new == NULL)
		return NULL;

	new->lifetime = IPSECDOI_ATTR_SA_LD_SEC_DEFAULT;
	new->lifebyte = IPSECDOI_ATTR_SA_LD_KB_MAX;

	return new;
}

void
delsainfo(si)
	struct sainfo *si;
{
	int i;

	for (i = 0; i < MAXALGCLASS; i++)
		delsainfoalg(si->algs[i]);

	if (si->idsrc)
		vfree(si->idsrc);
	if (si->iddst)
		vfree(si->iddst);

#ifdef ENABLE_HYBRID
	if (si->group)
		vfree(si->group);
#endif

	racoon_free(si);
}

void
inssainfo(new)
	struct sainfo *new;
{
	LIST_INSERT_HEAD(&sitree, new, chain);
}

void
remsainfo(si)
	struct sainfo *si;
{
	LIST_REMOVE(si, chain);
}

void
flushsainfo()
{
	struct sainfo *s, *next;

	for (s = LIST_FIRST(&sitree); s; s = next) {
		next = LIST_NEXT(s, chain);
		remsainfo(s);
		delsainfo(s);
	}
}

void
initsainfo()
{
	LIST_INIT(&sitree);
}

struct sainfoalg *
newsainfoalg()
{
	struct sainfoalg *new;

	new = racoon_calloc(1, sizeof(*new));
	if (new == NULL)
		return NULL;

	return new;
}

void
delsainfoalg(alg)
	struct sainfoalg *alg;
{
	struct sainfoalg *a, *next;

	for (a = alg; a; a = next) {
		next = a->next;
		racoon_free(a);
	}
}

void
inssainfoalg(head, new)
	struct sainfoalg **head;
	struct sainfoalg *new;
{
	struct sainfoalg *a;

	for (a = *head; a && a->next; a = a->next)
		;
	if (a)
		a->next = new;
	else
		*head = new;
}

const char *
sainfo2str(si)
	const struct sainfo *si;
{
        static char buf[256];

        char *idloc = NULL, *idrmt = NULL, *id_i;

        if (si->idsrc == NULL)
                idloc = strdup("ANONYMOUS");
        else
                idloc = ipsecdoi_id2str(si->idsrc);

        if (si->iddst == NULL)
                idrmt = strdup("ANONYMOUS");
        else
                idrmt = ipsecdoi_id2str(si->iddst);

        if (si->id_i == NULL)
                id_i = strdup("ANY");
        else
                id_i = ipsecdoi_id2str(si->id_i);

        snprintf(buf, 255, "loc=\'%s\', rmt=\'%s\', peer=\'%s\', id=%i",
		idloc, idrmt, id_i, si->remoteid);

        racoon_free(idloc);
        racoon_free(idrmt);
        racoon_free(id_i);

        return buf;
}

void save_sainfotree(void){
	sitree_save=sitree;
	initsainfo();
}

void save_sainfotree_flush(void){
	sitree_tmp=sitree;
	sitree=sitree_save;
	flushsainfo();
	sitree=sitree_tmp;
}

void save_sainfotree_restore(void){
	flushsainfo();
	sitree=sitree_save;
}