Home | History | Annotate | Download | only in racoon
      1 /*	$NetBSD: isakmp_unity.c,v 1.9 2007/10/19 03:37:19 manu Exp $	*/
      2 
      3 /* Id: isakmp_unity.c,v 1.10 2006/07/31 04:49:23 manubsd Exp */
      4 
      5 /*
      6  * Copyright (C) 2004 Emmanuel Dreyfus
      7  * All rights reserved.
      8  *
      9  * Redistribution and use in source and binary forms, with or without
     10  * modification, are permitted provided that the following conditions
     11  * are met:
     12  * 1. Redistributions of source code must retain the above copyright
     13  *    notice, this list of conditions and the following disclaimer.
     14  * 2. Redistributions in binary form must reproduce the above copyright
     15  *    notice, this list of conditions and the following disclaimer in the
     16  *    documentation and/or other materials provided with the distribution.
     17  * 3. Neither the name of the project nor the names of its contributors
     18  *    may be used to endorse or promote products derived from this software
     19  *    without specific prior written permission.
     20  *
     21  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
     22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
     25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     31  * SUCH DAMAGE.
     32  */
     33 
     34 #include "config.h"
     35 
     36 #include <sys/types.h>
     37 #include <sys/param.h>
     38 #include <sys/socket.h>
     39 #include <sys/queue.h>
     40 
     41 #include <netinet/in.h>
     42 #include <arpa/inet.h>
     43 
     44 #include <stdlib.h>
     45 #include <stdio.h>
     46 #include <fcntl.h>
     47 #include <string.h>
     48 #include <errno.h>
     49 #if TIME_WITH_SYS_TIME
     50 # include <sys/time.h>
     51 # include <time.h>
     52 #else
     53 # if HAVE_SYS_TIME_H
     54 #  include <sys/time.h>
     55 # else
     56 #  include <time.h>
     57 # endif
     58 #endif
     59 #include <netdb.h>
     60 #ifdef HAVE_UNISTD_H
     61 #include <unistd.h>
     62 #endif
     63 #include <ctype.h>
     64 #include <resolv.h>
     65 
     66 #include "var.h"
     67 #include "misc.h"
     68 #include "vmbuf.h"
     69 #include "plog.h"
     70 #include "sockmisc.h"
     71 #include "schedule.h"
     72 #include "debug.h"
     73 
     74 #include "isakmp_var.h"
     75 #include "isakmp.h"
     76 #include "handler.h"
     77 #include "isakmp_xauth.h"
     78 #include "isakmp_unity.h"
     79 #include "isakmp_cfg.h"
     80 #include "strnames.h"
     81 
     82 static vchar_t *isakmp_cfg_split(struct ph1handle *,
     83     struct isakmp_data *, struct unity_netentry*,int);
     84 
     85 vchar_t *
     86 isakmp_unity_req(iph1, attr)
     87 	struct ph1handle *iph1;
     88 	struct isakmp_data *attr;
     89 {
     90 	int type;
     91 	vchar_t *reply_attr = NULL;
     92 
     93 	if ((iph1->mode_cfg->flags & ISAKMP_CFG_VENDORID_UNITY) == 0) {
     94 		plog(LLV_ERROR, LOCATION, NULL,
     95 		    "Unity mode config request but the peer "
     96 		    "did not declare itself as  unity compliant\n");
     97 		return NULL;
     98 	}
     99 
    100 	type = ntohs(attr->type);
    101 
    102 	/* Handle short attributes */
    103 	if ((type & ISAKMP_GEN_MASK) == ISAKMP_GEN_TV) {
    104 		type &= ~ISAKMP_GEN_MASK;
    105 
    106 		plog(LLV_DEBUG, LOCATION, NULL,
    107 		     "Short attribute %s = %d\n",
    108 		     s_isakmp_cfg_type(type), ntohs(attr->lorv));
    109 
    110 		switch (type) {
    111 		default:
    112 			plog(LLV_DEBUG, LOCATION, NULL,
    113 			     "Ignored short attribute %s\n",
    114 			     s_isakmp_cfg_type(type));
    115 			break;
    116 		}
    117 
    118 		return reply_attr;
    119 	}
    120 
    121 	switch(type) {
    122 	case UNITY_BANNER: {
    123 #define MAXMOTD 65536
    124 		char buf[MAXMOTD + 1];
    125 		int fd;
    126 		char *filename = &isakmp_cfg_config.motd[0];
    127 		int len;
    128 
    129 		if ((fd = open(filename, O_RDONLY, 0)) == -1) {
    130 			plog(LLV_ERROR, LOCATION, NULL,
    131 			    "Cannot open \"%s\"\n", filename);
    132 			return NULL;
    133 		}
    134 
    135 		if ((len = read(fd, buf, MAXMOTD)) == -1) {
    136 			plog(LLV_ERROR, LOCATION, NULL,
    137 			    "Cannot read \"%s\"\n", filename);
    138 			close(fd);
    139 			return NULL;
    140 		}
    141 		close(fd);
    142 
    143 		buf[len] = '\0';
    144 		reply_attr = isakmp_cfg_string(iph1, attr, buf);
    145 
    146 		break;
    147 	}
    148 
    149 	case UNITY_PFS:
    150 		reply_attr = isakmp_cfg_short(iph1, attr,
    151 		    isakmp_cfg_config.pfs_group);
    152 		break;
    153 
    154 	case UNITY_SAVE_PASSWD:
    155 		reply_attr = isakmp_cfg_short(iph1, attr,
    156 		    isakmp_cfg_config.save_passwd);
    157 		break;
    158 
    159 	case UNITY_DDNS_HOSTNAME:
    160 		reply_attr = isakmp_cfg_copy(iph1, attr);
    161 		break;
    162 
    163 	case UNITY_DEF_DOMAIN:
    164 		reply_attr = isakmp_cfg_string(iph1,
    165 		    attr, isakmp_cfg_config.default_domain);
    166 		break;
    167 
    168 	case UNITY_SPLIT_INCLUDE:
    169 		if(isakmp_cfg_config.splitnet_type == UNITY_SPLIT_INCLUDE)
    170 			reply_attr = isakmp_cfg_split(iph1, attr,
    171 			isakmp_cfg_config.splitnet_list,
    172 			isakmp_cfg_config.splitnet_count);
    173 		else
    174 			return NULL;
    175 		break;
    176 	case UNITY_LOCAL_LAN:
    177 		if(isakmp_cfg_config.splitnet_type == UNITY_LOCAL_LAN)
    178 			reply_attr = isakmp_cfg_split(iph1, attr,
    179 			isakmp_cfg_config.splitnet_list,
    180 			isakmp_cfg_config.splitnet_count);
    181 		else
    182 			return NULL;
    183 		break;
    184 	case UNITY_SPLITDNS_NAME:
    185 		reply_attr = isakmp_cfg_varlen(iph1, attr,
    186 				isakmp_cfg_config.splitdns_list,
    187 				isakmp_cfg_config.splitdns_len);
    188 		break;
    189 	case UNITY_FW_TYPE:
    190 	case UNITY_NATT_PORT:
    191 	case UNITY_BACKUP_SERVERS:
    192 	default:
    193 		plog(LLV_DEBUG, LOCATION, NULL,
    194 		     "Ignored attribute %s\n", s_isakmp_cfg_type(type));
    195 		return NULL;
    196 		break;
    197 	}
    198 
    199 	return reply_attr;
    200 }
    201 
    202 void
    203 isakmp_unity_reply(iph1, attr)
    204 	struct ph1handle *iph1;
    205 	struct isakmp_data *attr;
    206 {
    207 	int type = ntohs(attr->type);
    208 	int alen = ntohs(attr->lorv);
    209 
    210 	struct unity_network *network = (struct unity_network *)(attr + 1);
    211 	int index = 0;
    212 	int count = 0;
    213 
    214 	switch(type) {
    215 	case UNITY_SPLIT_INCLUDE:
    216 	{
    217 		if (alen)
    218 			count = alen / sizeof(struct unity_network);
    219 
    220 		for(;index < count; index++)
    221 			splitnet_list_add(
    222 				&iph1->mode_cfg->split_include,
    223 				&network[index],
    224 				&iph1->mode_cfg->include_count);
    225 
    226 		iph1->mode_cfg->flags |= ISAKMP_CFG_GOT_SPLIT_INCLUDE;
    227 		break;
    228 	}
    229 	case UNITY_LOCAL_LAN:
    230 	{
    231 		if (alen)
    232 			count = alen / sizeof(struct unity_network);
    233 
    234 		for(;index < count; index++)
    235 			splitnet_list_add(
    236 				&iph1->mode_cfg->split_local,
    237 				&network[index],
    238 				&iph1->mode_cfg->local_count);
    239 
    240 		iph1->mode_cfg->flags |= ISAKMP_CFG_GOT_SPLIT_LOCAL;
    241 		break;
    242 	}
    243 	case UNITY_SPLITDNS_NAME:
    244 	case UNITY_BANNER:
    245 	case UNITY_SAVE_PASSWD:
    246 	case UNITY_NATT_PORT:
    247 	case UNITY_PFS:
    248 	case UNITY_FW_TYPE:
    249 	case UNITY_BACKUP_SERVERS:
    250 	case UNITY_DDNS_HOSTNAME:
    251 	default:
    252 		plog(LLV_WARNING, LOCATION, NULL,
    253 		     "Ignored attribute %s\n",
    254 		     s_isakmp_cfg_type(type));
    255 		break;
    256 	}
    257 	return;
    258 }
    259 
    260 static vchar_t *
    261 isakmp_cfg_split(iph1, attr, netentry, count)
    262 	struct ph1handle *iph1;
    263 	struct isakmp_data *attr;
    264 	struct unity_netentry *netentry;
    265 	int count;
    266 {
    267 	vchar_t *buffer;
    268 	struct isakmp_data *new;
    269 	struct unity_network * network;
    270 	size_t len;
    271 	int index = 0;
    272 
    273 	char tmp1[40];
    274 	char tmp2[40];
    275 
    276 	len = sizeof(struct unity_network) * count;
    277 	if ((buffer = vmalloc(sizeof(*attr) + len)) == NULL) {
    278 		plog(LLV_ERROR, LOCATION, NULL, "Cannot allocate memory\n");
    279 		return NULL;
    280 	}
    281 
    282 	new = (struct isakmp_data *)buffer->v;
    283 	new->type = attr->type;
    284 	new->lorv = htons(len);
    285 
    286 	network = (struct unity_network *)(new + 1);
    287 	for (; index < count; index++) {
    288 
    289 		memcpy(&network[index],
    290 			&netentry->network,
    291 			sizeof(struct unity_network));
    292 
    293 		inet_ntop(AF_INET, &netentry->network.addr4, tmp1, 40);
    294 		inet_ntop(AF_INET, &netentry->network.mask4, tmp2, 40);
    295 		plog(LLV_DEBUG, LOCATION, NULL, "splitnet: %s/%s\n", tmp1, tmp2);
    296 
    297 		netentry = netentry->next;
    298 	}
    299 
    300 	return buffer;
    301 }
    302 
    303 int  splitnet_list_add(list, network, count)
    304 	struct unity_netentry ** list;
    305 	struct unity_network * network;
    306 	int *count;
    307 {
    308 	struct unity_netentry * nentry;
    309 
    310 	/*
    311 	 * search for network in current list
    312 	 * to avoid adding duplicates
    313 	 */
    314 	for (nentry = *list; nentry != NULL; nentry = nentry->next)
    315 		if (memcmp(&nentry->network, network,
    316 			   sizeof(struct unity_network)) == 0)
    317 			return 0;	/* it's a dupe */
    318 
    319 	/*
    320 	 * allocate new netentry and copy
    321 	 * new splitnet network data
    322 	 */
    323 	nentry = (struct unity_netentry *)
    324 		racoon_malloc(sizeof(struct unity_netentry));
    325 	if (nentry == NULL)
    326 		return -1;
    327 
    328 	memcpy(&nentry->network,network,
    329 		sizeof(struct unity_network));
    330 	nentry->next = NULL;
    331 
    332 	/*
    333 	 * locate the last netentry in our
    334 	 * splitnet list and add our entry
    335 	 */
    336 	if (*list == NULL)
    337 		*list = nentry;
    338 	else {
    339 		struct unity_netentry * tmpentry = *list;
    340 		while (tmpentry->next != NULL)
    341 			tmpentry = tmpentry->next;
    342 		tmpentry->next = nentry;
    343 	}
    344 
    345 	(*count)++;
    346 
    347 	return 0;
    348 }
    349 
    350 void splitnet_list_free(list, count)
    351 	struct unity_netentry * list;
    352 	int *count;
    353 {
    354 	struct unity_netentry * netentry = list;
    355 	struct unity_netentry * delentry;
    356 
    357 	*count = 0;
    358 
    359 	while (netentry != NULL) {
    360 		delentry = netentry;
    361 		netentry = netentry->next;
    362 		racoon_free(delentry);
    363 	}
    364 }
    365 
    366 char * splitnet_list_2str(list, splitnet_ipaddr)
    367 	struct unity_netentry * list;
    368 	enum splinet_ipaddr splitnet_ipaddr;
    369 {
    370 	struct unity_netentry * netentry;
    371 	char tmp1[40];
    372 	char tmp2[40];
    373 	char * str;
    374 	int len;
    375 
    376 	/* determine string length */
    377 	len = 0;
    378 	netentry = list;
    379 	while (netentry != NULL) {
    380 
    381 		inet_ntop(AF_INET, &netentry->network.addr4, tmp1, 40);
    382 		inet_ntop(AF_INET, &netentry->network.mask4, tmp2, 40);
    383 		len += strlen(tmp1);
    384 		len += strlen(tmp2);
    385 		len += 2;
    386 
    387 		netentry = netentry->next;
    388 	}
    389 
    390 	/* allocate network list string */
    391 	str = racoon_malloc(len);
    392 	if (str == NULL)
    393 		return NULL;
    394 
    395 	/* create network list string */
    396 	len = 0;
    397 	netentry = list;
    398 	while (netentry != NULL) {
    399 
    400 		inet_ntop(AF_INET, &netentry->network.addr4, tmp1, 40);
    401 		inet_ntop(AF_INET, &netentry->network.mask4, tmp2, 40);
    402 		if (splitnet_ipaddr == CIDR) {
    403 			uint32_t tmp3;
    404 			int cidrmask;
    405 
    406 			tmp3 = ntohl(netentry->network.mask4.s_addr);
    407 			for (cidrmask = 0; tmp3 != 0; cidrmask++)
    408 				tmp3 <<= 1;
    409 			len += sprintf(str+len, "%s/%d ", tmp1, cidrmask);
    410 		} else {
    411 			len += sprintf(str+len, "%s/%s ", tmp1, tmp2);
    412 		}
    413 
    414 		netentry = netentry->next;
    415 	}
    416 
    417 	str[len-1]=0;
    418 
    419 	return str;
    420 }
    421