• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*	$NetBSD: localconf.c,v 1.7 2008/12/23 14:04:42 tteras Exp $	*/
2 
3 /*	$KAME: localconf.c,v 1.33 2001/08/09 07:32:19 sakane Exp $	*/
4 
5 /*
6  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. Neither the name of the project nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  */
33 
34 #include "config.h"
35 
36 #include <sys/types.h>
37 #include <sys/param.h>
38 
39 #include <stdlib.h>
40 #include <stdio.h>
41 #include <string.h>
42 #include <errno.h>
43 #include <ctype.h>
44 #include <err.h>
45 
46 #include "var.h"
47 #include "misc.h"
48 #include "vmbuf.h"
49 #include "plog.h"
50 #include "debug.h"
51 
52 #include "localconf.h"
53 #include "algorithm.h"
54 #include "admin.h"
55 #include "privsep.h"
56 #include "isakmp_var.h"
57 #include "isakmp.h"
58 #include "ipsec_doi.h"
59 #include "grabmyaddr.h"
60 #include "vendorid.h"
61 #include "str2val.h"
62 #include "safefile.h"
63 #include "admin.h"
64 #include "gcmalloc.h"
65 
66 struct localconf *lcconf;
67 
68 static void setdefault __P((void));
69 
70 void
initlcconf()71 initlcconf()
72 {
73 	lcconf = racoon_calloc(1, sizeof(*lcconf));
74 	if (lcconf == NULL)
75 		errx(1, "failed to allocate local conf.");
76 
77 	setdefault();
78 
79 	lcconf->racoon_conf = LC_DEFAULT_CF;
80 }
81 
82 void
flushlcconf()83 flushlcconf()
84 {
85 	int i;
86 
87 	setdefault();
88 	myaddr_flush();
89 
90 	for (i = 0; i < LC_PATHTYPE_MAX; i++) {
91 		if (lcconf->pathinfo[i]) {
92 			racoon_free(lcconf->pathinfo[i]);
93 			lcconf->pathinfo[i] = NULL;
94 		}
95 	}
96 }
97 
98 static void
setdefault()99 setdefault()
100 {
101 	lcconf->uid = 0;
102 	lcconf->gid = 0;
103 	lcconf->chroot = NULL;
104 	lcconf->port_isakmp = PORT_ISAKMP;
105 	lcconf->port_isakmp_natt = PORT_ISAKMP_NATT;
106 	lcconf->default_af = AF_INET;
107 	lcconf->pad_random = LC_DEFAULT_PAD_RANDOM;
108 	lcconf->pad_randomlen = LC_DEFAULT_PAD_RANDOMLEN;
109 	lcconf->pad_maxsize = LC_DEFAULT_PAD_MAXSIZE;
110 	lcconf->pad_strict = LC_DEFAULT_PAD_STRICT;
111 	lcconf->pad_excltail = LC_DEFAULT_PAD_EXCLTAIL;
112 	lcconf->retry_counter = LC_DEFAULT_RETRY_COUNTER;
113 	lcconf->retry_interval = LC_DEFAULT_RETRY_INTERVAL;
114 	lcconf->count_persend = LC_DEFAULT_COUNT_PERSEND;
115 	lcconf->secret_size = LC_DEFAULT_SECRETSIZE;
116 	lcconf->retry_checkph1 = LC_DEFAULT_RETRY_CHECKPH1;
117 	lcconf->wait_ph2complete = LC_DEFAULT_WAIT_PH2COMPLETE;
118 	lcconf->strict_address = FALSE;
119 	lcconf->complex_bundle = TRUE; /*XXX FALSE;*/
120 	lcconf->gss_id_enc = LC_GSSENC_UTF16LE; /* Windows compatibility */
121 	lcconf->natt_ka_interval = LC_DEFAULT_NATT_KA_INTERVAL;
122 	lcconf->pfkey_buffer_size = LC_DEFAULT_PFKEY_BUFFER_SIZE;
123 }
124 
125 /*
126  * get PSK by string.
127  */
128 vchar_t *
getpskbyname(id0)129 getpskbyname(id0)
130 	vchar_t *id0;
131 {
132 	char *id;
133 	vchar_t *key = NULL;
134 
135 	id = racoon_calloc(1, 1 + id0->l - sizeof(struct ipsecdoi_id_b));
136 	if (id == NULL) {
137 		plog(LLV_ERROR, LOCATION, NULL,
138 			"failed to get psk buffer.\n");
139 		goto end;
140 	}
141 	memcpy(id, id0->v + sizeof(struct ipsecdoi_id_b),
142 		id0->l - sizeof(struct ipsecdoi_id_b));
143 	id[id0->l - sizeof(struct ipsecdoi_id_b)] = '\0';
144 
145 	key = privsep_getpsk(id, id0->l - sizeof(struct ipsecdoi_id_b));
146 
147 end:
148 	if (id)
149 		racoon_free(id);
150 	return key;
151 }
152 
153 /*
154  * get PSK by address.
155  */
156 vchar_t *
getpskbyaddr(remote)157 getpskbyaddr(remote)
158 	struct sockaddr *remote;
159 {
160 	vchar_t *key = NULL;
161 	char addr[NI_MAXHOST], port[NI_MAXSERV];
162 
163 	GETNAMEINFO(remote, addr, port);
164 
165 	key = privsep_getpsk(addr, strlen(addr));
166 
167 	return key;
168 }
169 
170 vchar_t *
getpsk(str,len)171 getpsk(str, len)
172 	const char *str;
173 	const int len;
174 {
175 	FILE *fp;
176 	char buf[1024];	/* XXX how is variable length ? */
177 	vchar_t *key = NULL;
178 	char *p, *q;
179 	size_t keylen;
180 	char *k = NULL;
181 
182 	if (safefile(lcconf->pathinfo[LC_PATHTYPE_PSK], 1) == 0)
183 		fp = fopen(lcconf->pathinfo[LC_PATHTYPE_PSK], "r");
184 	else
185 		fp = NULL;
186 	if (fp == NULL) {
187 		plog(LLV_ERROR, LOCATION, NULL,
188 			"failed to open pre_share_key file %s\n",
189 			lcconf->pathinfo[LC_PATHTYPE_PSK]);
190 		return NULL;
191 	}
192 
193 	while (fgets(buf, sizeof(buf), fp) != NULL) {
194 		/* comment line */
195 		if (buf[0] == '#')
196 			continue;
197 
198 		/* search the end of 1st string. */
199 		for (p = buf; *p != '\0' && !isspace((int)*p); p++)
200 			;
201 		if (*p == '\0')
202 			continue;	/* no 2nd parameter */
203 		*p = '\0';
204 		/* search the 1st of 2nd string. */
205 		while (isspace((int)*++p))
206 			;
207 		if (*p == '\0')
208 			continue;	/* no 2nd parameter */
209 		p--;
210 		if (strncmp(buf, str, len) == 0 && buf[len] == '\0') {
211 			p++;
212 			keylen = 0;
213 			for (q = p; *q != '\0' && *q != '\n'; q++)
214 				keylen++;
215 			*q = '\0';
216 
217 			/* fix key if hex string */
218 			if (strncmp(p, "0x", 2) == 0) {
219 				k = str2val(p + 2, 16, &keylen);
220 				if (k == NULL) {
221 					plog(LLV_ERROR, LOCATION, NULL,
222 						"failed to get psk buffer.\n");
223 					goto end;
224 				}
225 				p = k;
226 			}
227 
228 			key = vmalloc(keylen);
229 			if (key == NULL) {
230 				plog(LLV_ERROR, LOCATION, NULL,
231 					"failed to allocate key buffer.\n");
232 				goto end;
233 			}
234 			memcpy(key->v, p, key->l);
235 			if (k)
236 				racoon_free(k);
237 			goto end;
238 		}
239 	}
240 
241 end:
242 	fclose(fp);
243 	return key;
244 }
245 
246 /*
247  * get a file name of a type specified.
248  */
249 void
getpathname(path,len,type,name)250 getpathname(path, len, type, name)
251 	char *path;
252 	int len, type;
253 	const char *name;
254 {
255 	snprintf(path, len, "%s%s%s",
256 		name[0] == '/' ? "" : lcconf->pathinfo[type],
257 		name[0] == '/' ? "" : "/",
258 		name);
259 
260 	plog(LLV_DEBUG, LOCATION, NULL, "filename: %s\n", path);
261 }
262 
263 #if 0 /* DELETEIT */
264 static int lc_doi2idtype[] = {
265 	-1,
266 	-1,
267 	LC_IDENTTYPE_FQDN,
268 	LC_IDENTTYPE_USERFQDN,
269 	-1,
270 	-1,
271 	-1,
272 	-1,
273 	-1,
274 	LC_IDENTTYPE_CERTNAME,
275 	-1,
276 	LC_IDENTTYPE_KEYID,
277 };
278 
279 /*
280  * convert DOI value to idtype
281  * OUT	-1   : NG
282  *	other: converted.
283  */
284 int
285 doi2idtype(idtype)
286 	int idtype;
287 {
288 	if (ARRAYLEN(lc_doi2idtype) > idtype)
289 		return lc_doi2idtype[idtype];
290 	return -1;
291 }
292 #endif
293 
294 static int lc_sittype2doi[] = {
295 	IPSECDOI_SIT_IDENTITY_ONLY,
296 	IPSECDOI_SIT_SECRECY,
297 	IPSECDOI_SIT_INTEGRITY,
298 };
299 
300 /*
301  * convert sittype to DOI value.
302  * OUT	-1   : NG
303  *	other: converted.
304  */
305 int
sittype2doi(sittype)306 sittype2doi(sittype)
307 	int sittype;
308 {
309 	if (ARRAYLEN(lc_sittype2doi) > sittype)
310 		return lc_sittype2doi[sittype];
311 	return -1;
312 }
313 
314 static int lc_doitype2doi[] = {
315 	IPSEC_DOI,
316 };
317 
318 /*
319  * convert doitype to DOI value.
320  * OUT	-1   : NG
321  *	other: converted.
322  */
323 int
doitype2doi(doitype)324 doitype2doi(doitype)
325 	int doitype;
326 {
327 	if (ARRAYLEN(lc_doitype2doi) > doitype)
328 		return lc_doitype2doi[doitype];
329 	return -1;
330 }
331 
332 
333 
334 static void
saverestore_params(f)335 saverestore_params(f)
336 	int f;
337 {
338 	static u_int16_t s_port_isakmp;
339 
340 	/* 0: save, 1: restore */
341 	if (f) {
342 		lcconf->port_isakmp = s_port_isakmp;
343 	} else {
344 		s_port_isakmp = lcconf->port_isakmp;
345 	}
346 }
347 
348 void
restore_params()349 restore_params()
350 {
351 	saverestore_params(1);
352 }
353 
354 void
save_params()355 save_params()
356 {
357 	saverestore_params(0);
358 }
359