1 | #include <machine/rtems-bsd-user-space.h> |
---|
2 | |
---|
3 | /* $NetBSD: racoonctl.c,v 1.18 2010/11/12 09:08:26 tteras Exp $ */ |
---|
4 | |
---|
5 | /* Id: racoonctl.c,v 1.11 2006/04/06 17:06:25 manubsd Exp */ |
---|
6 | |
---|
7 | /* |
---|
8 | * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. |
---|
9 | * Copyright (C) 2008 Timo Teras. |
---|
10 | * All rights reserved. |
---|
11 | * |
---|
12 | * Redistribution and use in source and binary forms, with or without |
---|
13 | * modification, are permitted provided that the following conditions |
---|
14 | * are met: |
---|
15 | * 1. Redistributions of source code must retain the above copyright |
---|
16 | * notice, this list of conditions and the following disclaimer. |
---|
17 | * 2. Redistributions in binary form must reproduce the above copyright |
---|
18 | * notice, this list of conditions and the following disclaimer in the |
---|
19 | * documentation and/or other materials provided with the distribution. |
---|
20 | * 3. Neither the name of the project nor the names of its contributors |
---|
21 | * may be used to endorse or promote products derived from this software |
---|
22 | * without specific prior written permission. |
---|
23 | * |
---|
24 | * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND |
---|
25 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
---|
26 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
---|
27 | * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE |
---|
28 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
---|
29 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
---|
30 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
---|
31 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
---|
32 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
---|
33 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
---|
34 | * SUCH DAMAGE. |
---|
35 | */ |
---|
36 | |
---|
37 | #include "config.h" |
---|
38 | |
---|
39 | #include <sys/types.h> |
---|
40 | #include <sys/param.h> |
---|
41 | #include <sys/socket.h> |
---|
42 | #include <sys/un.h> |
---|
43 | |
---|
44 | #include <netinet/in.h> |
---|
45 | #include <arpa/inet.h> |
---|
46 | #include <net/pfkeyv2.h> |
---|
47 | |
---|
48 | #include <stdlib.h> |
---|
49 | #include <stdio.h> |
---|
50 | #include <string.h> |
---|
51 | #include <errno.h> |
---|
52 | #if TIME_WITH_SYS_TIME |
---|
53 | # include <sys/time.h> |
---|
54 | # include <time.h> |
---|
55 | #else |
---|
56 | # if HAVE_SYS_TIME_H |
---|
57 | # include <sys/time.h> |
---|
58 | # else |
---|
59 | # include <time.h> |
---|
60 | # endif |
---|
61 | #endif |
---|
62 | #include <netdb.h> |
---|
63 | #ifdef HAVE_UNISTD_H |
---|
64 | #include <unistd.h> |
---|
65 | #endif |
---|
66 | #include <err.h> |
---|
67 | #include <sys/ioctl.h> |
---|
68 | #include <resolv.h> |
---|
69 | |
---|
70 | #include "var.h" |
---|
71 | #include "vmbuf.h" |
---|
72 | #include "misc.h" |
---|
73 | #include "gcmalloc.h" |
---|
74 | |
---|
75 | #include "racoonctl.h" |
---|
76 | #include "admin.h" |
---|
77 | #include "schedule.h" |
---|
78 | #include "handler.h" |
---|
79 | #include "sockmisc.h" |
---|
80 | #include "vmbuf.h" |
---|
81 | #include "plog.h" |
---|
82 | #include "isakmp_var.h" |
---|
83 | #include "isakmp.h" |
---|
84 | #include "isakmp_xauth.h" |
---|
85 | #include "isakmp_cfg.h" |
---|
86 | #include "isakmp_unity.h" |
---|
87 | #include "ipsec_doi.h" |
---|
88 | #include "evt.h" |
---|
89 | |
---|
90 | char *adminsock_path = ADMINSOCK_PATH; |
---|
91 | |
---|
92 | static void usage __P((void)); |
---|
93 | static vchar_t *get_combuf __P((int, char **)); |
---|
94 | static int handle_recv __P((vchar_t *)); |
---|
95 | static vchar_t *f_reload __P((int, char **)); |
---|
96 | static vchar_t *f_getsched __P((int, char **)); |
---|
97 | static vchar_t *f_getsa __P((int, char **)); |
---|
98 | static vchar_t *f_getsacert __P((int, char **)); |
---|
99 | static vchar_t *f_flushsa __P((int, char **)); |
---|
100 | static vchar_t *f_deletesa __P((int, char **)); |
---|
101 | static vchar_t *f_exchangesa __P((int, char **)); |
---|
102 | static vchar_t *f_vpnc __P((int, char **)); |
---|
103 | static vchar_t *f_vpnd __P((int, char **)); |
---|
104 | static vchar_t *f_getevt __P((int, char **)); |
---|
105 | #ifdef ENABLE_HYBRID |
---|
106 | static vchar_t *f_logoutusr __P((int, char **)); |
---|
107 | #endif |
---|
108 | |
---|
109 | struct cmd_tag { |
---|
110 | vchar_t *(*func) __P((int, char **)); |
---|
111 | char *str; |
---|
112 | } cmdtab[] = { |
---|
113 | { f_reload, "reload-config" }, |
---|
114 | { f_reload, "rc" }, |
---|
115 | { f_getsched, "show-schedule" }, |
---|
116 | { f_getsched, "sc" }, |
---|
117 | { f_getsa, "show-sa" }, |
---|
118 | { f_getsa, "ss" }, |
---|
119 | { f_getsacert, "get-cert" }, |
---|
120 | { f_getsacert, "gc" }, |
---|
121 | { f_flushsa, "flush-sa" }, |
---|
122 | { f_flushsa, "fs" }, |
---|
123 | { f_deletesa, "delete-sa" }, |
---|
124 | { f_deletesa, "ds" }, |
---|
125 | { f_exchangesa, "establish-sa" }, |
---|
126 | { f_exchangesa, "es" }, |
---|
127 | { f_vpnc, "vpn-connect" }, |
---|
128 | { f_vpnc, "vc" }, |
---|
129 | { f_vpnd, "vpn-disconnect" }, |
---|
130 | { f_vpnd, "vd" }, |
---|
131 | { f_getevt, "show-event" }, |
---|
132 | { f_getevt, "se" }, |
---|
133 | #ifdef ENABLE_HYBRID |
---|
134 | { f_logoutusr, "logout-user" }, |
---|
135 | { f_logoutusr, "lu" }, |
---|
136 | #endif |
---|
137 | { NULL, NULL }, |
---|
138 | }; |
---|
139 | |
---|
140 | struct evtmsg { |
---|
141 | int type; |
---|
142 | char *msg; |
---|
143 | } evtmsg[] = { |
---|
144 | { EVT_RACOON_QUIT, "Racoon terminated" }, |
---|
145 | |
---|
146 | { EVT_PHASE1_UP, "Phase 1 established" }, |
---|
147 | { EVT_PHASE1_DOWN, "Phase 1 deleted" }, |
---|
148 | { EVT_PHASE1_NO_RESPONSE, "Phase 1 error: peer not responding" }, |
---|
149 | { EVT_PHASE1_NO_PROPOSAL, "Phase 1 error: no proposal chosen" }, |
---|
150 | { EVT_PHASE1_AUTH_FAILED, |
---|
151 | "Phase 1 error: authentication failed (bad certificate?)" }, |
---|
152 | { EVT_PHASE1_DPD_TIMEOUT, "Phase 1 error: dead peer detected" }, |
---|
153 | { EVT_PHASE1_MODE_CFG, "Phase 1 mode configuration done" }, |
---|
154 | { EVT_PHASE1_XAUTH_SUCCESS, "Phase 1 Xauth succeeded" }, |
---|
155 | { EVT_PHASE1_XAUTH_FAILED, "Phase 1 Xauth failed" }, |
---|
156 | |
---|
157 | { EVT_PHASE2_NO_PHASE1, "Phase 2 error: no suitable phase 1" }, |
---|
158 | { EVT_PHASE2_UP, "Phase 2 established" }, |
---|
159 | { EVT_PHASE2_DOWN, "Phase 2 deleted" }, |
---|
160 | { EVT_PHASE2_NO_RESPONSE, "Phase 2 error: no response" }, |
---|
161 | }; |
---|
162 | |
---|
163 | static vchar_t *get_proto_and_index __P((int, char **, u_int16_t *)); |
---|
164 | static int get_proto __P((char *)); |
---|
165 | static vchar_t *get_index __P((int, char **)); |
---|
166 | static int get_family __P((char *)); |
---|
167 | static vchar_t *get_comindexes __P((int, int, char **)); |
---|
168 | static int get_comindex __P((char *, char **, char **, char **)); |
---|
169 | static int get_ulproto __P((char *)); |
---|
170 | |
---|
171 | struct proto_tag { |
---|
172 | int proto; |
---|
173 | char *str; |
---|
174 | } prototab[] = { |
---|
175 | { ADMIN_PROTO_ISAKMP, "isakmp" }, |
---|
176 | { ADMIN_PROTO_IPSEC, "ipsec" }, |
---|
177 | { ADMIN_PROTO_AH, "ah" }, |
---|
178 | { ADMIN_PROTO_ESP, "esp" }, |
---|
179 | { ADMIN_PROTO_INTERNAL, "internal" }, |
---|
180 | { 0, NULL }, |
---|
181 | }; |
---|
182 | |
---|
183 | struct ulproto_tag { |
---|
184 | int ul_proto; |
---|
185 | char *str; |
---|
186 | } ulprototab[] = { |
---|
187 | { 0, "any" }, |
---|
188 | { IPPROTO_ICMP, "icmp" }, |
---|
189 | { IPPROTO_TCP, "tcp" }, |
---|
190 | { IPPROTO_UDP, "udp" }, |
---|
191 | { IPPROTO_GRE, "gre" }, |
---|
192 | { 0, NULL }, |
---|
193 | }; |
---|
194 | |
---|
195 | int so; |
---|
196 | |
---|
197 | static char _addr1_[NI_MAXHOST], _addr2_[NI_MAXHOST]; |
---|
198 | |
---|
199 | char *pname; |
---|
200 | int long_format = 0; |
---|
201 | int evt_quit_event = 0; |
---|
202 | |
---|
203 | void dump_isakmp_sa __P((char *, int)); |
---|
204 | void dump_internal __P((char *, int)); |
---|
205 | char *pindex_isakmp __P((isakmp_index *)); |
---|
206 | void print_schedule __P((caddr_t, int)); |
---|
207 | void print_evt __P((struct evt_async *)); |
---|
208 | char * fixed_addr __P((char *, char *, int)); |
---|
209 | |
---|
210 | static void |
---|
211 | usage() |
---|
212 | { |
---|
213 | printf( |
---|
214 | "Usage:\n" |
---|
215 | " %s [opts] reload-config\n" |
---|
216 | " %s [opts] show-schedule\n" |
---|
217 | " %s [opts] show-sa [protocol]\n" |
---|
218 | " %s [opts] flush-sa [protocol]\n" |
---|
219 | " %s [opts] delete-sa <saopts>\n" |
---|
220 | " %s [opts] establish-sa [-u identity] [-n remoteconf] [-w] <saopts>\n" |
---|
221 | " %s [opts] vpn-connect [-u identity] vpn_gateway\n" |
---|
222 | " %s [opts] vpn-disconnect vpn_gateway\n" |
---|
223 | " %s [opts] show-event\n" |
---|
224 | " %s [opts] logout-user login\n" |
---|
225 | "\n" |
---|
226 | "General options:\n" |
---|
227 | " -d Debug: hexdump admin messages before sending\n" |
---|
228 | " -l Increase output verbosity (mainly for show-sa)\n" |
---|
229 | " -s <socket> Specify adminport socket to use (default: %s)\n" |
---|
230 | "\n" |
---|
231 | "Parameter specifications:\n" |
---|
232 | " <protocol>: \"isakmp\", \"esp\" or \"ah\".\n" |
---|
233 | " In the case of \"show-sa\" or \"flush-sa\", you can use \"ipsec\".\n" |
---|
234 | "\n" |
---|
235 | " <saopts>: \"isakmp\" <family> <src> <dst>\n" |
---|
236 | " : {\"esp\",\"ah\"} <family> <src/prefixlen/port> <dst/prefixlen/port>\n" |
---|
237 | " <ul_proto>\n" |
---|
238 | " <family>: \"inet\" or \"inet6\"\n" |
---|
239 | " <ul_proto>: \"icmp\", \"tcp\", \"udp\", \"gre\" or \"any\"\n" |
---|
240 | "\n", |
---|
241 | pname, pname, pname, pname, pname, pname, pname, pname, pname, pname, |
---|
242 | ADMINSOCK_PATH); |
---|
243 | } |
---|
244 | |
---|
245 | /* |
---|
246 | * Check for proper racoonctl interface |
---|
247 | */ |
---|
248 | #if ((RACOONCTL_INTERFACE_MAJOR != 1) || (RACOONCTL_INTERFACE < 20041230)) |
---|
249 | #error "Incompatible racoonctl interface" |
---|
250 | #endif |
---|
251 | |
---|
252 | int |
---|
253 | main(ac, av) |
---|
254 | int ac; |
---|
255 | char **av; |
---|
256 | { |
---|
257 | vchar_t *combuf; |
---|
258 | int c; |
---|
259 | |
---|
260 | pname = *av; |
---|
261 | |
---|
262 | /* |
---|
263 | * Check for proper racoonctl interface |
---|
264 | */ |
---|
265 | if ((racoonctl_interface_major != RACOONCTL_INTERFACE_MAJOR) || |
---|
266 | (racoonctl_interface < RACOONCTL_INTERFACE)) |
---|
267 | errx(1, "Incompatible racoonctl interface"); |
---|
268 | |
---|
269 | #ifdef __linux__ |
---|
270 | /* |
---|
271 | * Disable GNU extensions that will prevent racoonct vc -u login |
---|
272 | * from working (GNU getopt(3) does not like options after vc) |
---|
273 | */ |
---|
274 | setenv("POSIXLY_CORRECT", "1", 0); |
---|
275 | #endif |
---|
276 | while ((c = getopt(ac, av, "lds:")) != -1) { |
---|
277 | switch(c) { |
---|
278 | case 'l': |
---|
279 | long_format++; |
---|
280 | break; |
---|
281 | |
---|
282 | case 'd': |
---|
283 | loglevel++; |
---|
284 | break; |
---|
285 | |
---|
286 | case 's': |
---|
287 | adminsock_path = optarg; |
---|
288 | break; |
---|
289 | |
---|
290 | default: |
---|
291 | usage(); |
---|
292 | exit(0); |
---|
293 | } |
---|
294 | } |
---|
295 | |
---|
296 | ac -= optind; |
---|
297 | av += optind; |
---|
298 | |
---|
299 | combuf = get_combuf(ac, av); |
---|
300 | if (!combuf) |
---|
301 | err(1, "kmpstat"); |
---|
302 | |
---|
303 | if (loglevel) |
---|
304 | racoon_hexdump(combuf, ((struct admin_com *)combuf)->ac_len); |
---|
305 | |
---|
306 | com_init(); |
---|
307 | |
---|
308 | if (com_send(combuf) != 0) |
---|
309 | goto bad; |
---|
310 | |
---|
311 | vfree(combuf); |
---|
312 | |
---|
313 | do { |
---|
314 | if (com_recv(&combuf) != 0) |
---|
315 | goto bad; |
---|
316 | if (handle_recv(combuf) != 0) |
---|
317 | goto bad; |
---|
318 | vfree(combuf); |
---|
319 | } while (evt_quit_event != 0); |
---|
320 | |
---|
321 | close(so); |
---|
322 | exit(0); |
---|
323 | |
---|
324 | bad: |
---|
325 | close(so); |
---|
326 | if (errno == EEXIST) |
---|
327 | exit(0); |
---|
328 | exit(1); |
---|
329 | } |
---|
330 | |
---|
331 | /* %%% */ |
---|
332 | /* |
---|
333 | * return command buffer. |
---|
334 | */ |
---|
335 | static vchar_t * |
---|
336 | get_combuf(ac, av) |
---|
337 | int ac; |
---|
338 | char **av; |
---|
339 | { |
---|
340 | struct cmd_tag *cp; |
---|
341 | |
---|
342 | if (ac == 0) { |
---|
343 | usage(); |
---|
344 | exit(0); |
---|
345 | } |
---|
346 | |
---|
347 | /* checking the string of command. */ |
---|
348 | for (cp = &cmdtab[0]; cp->str; cp++) { |
---|
349 | if (strcmp(*av, cp->str) == 0) { |
---|
350 | break; |
---|
351 | } |
---|
352 | } |
---|
353 | if (!cp->str) { |
---|
354 | printf("Invalid command [%s]\n", *av); |
---|
355 | errno = EINVAL; |
---|
356 | return NULL; |
---|
357 | } |
---|
358 | |
---|
359 | ac--; |
---|
360 | av++; |
---|
361 | return (cp->func)(ac, av); |
---|
362 | } |
---|
363 | |
---|
364 | static vchar_t * |
---|
365 | make_request(u_int16_t cmd, u_int16_t proto, size_t len) |
---|
366 | { |
---|
367 | vchar_t *buf; |
---|
368 | struct admin_com *head; |
---|
369 | |
---|
370 | buf = vmalloc(sizeof(struct admin_com) + len); |
---|
371 | if (buf == NULL) |
---|
372 | errx(1, "not enough core"); |
---|
373 | |
---|
374 | head = (struct admin_com *) buf->v; |
---|
375 | head->ac_len = buf->l; |
---|
376 | head->ac_cmd = ADMIN_FLAG_VERSION | cmd; |
---|
377 | head->ac_version = 1; |
---|
378 | head->ac_proto = proto; |
---|
379 | |
---|
380 | return buf; |
---|
381 | } |
---|
382 | |
---|
383 | static vchar_t * |
---|
384 | f_reload(ac, av) |
---|
385 | int ac; |
---|
386 | char **av; |
---|
387 | { |
---|
388 | return make_request(ADMIN_RELOAD_CONF, 0, 0); |
---|
389 | } |
---|
390 | |
---|
391 | static vchar_t * |
---|
392 | f_getevt(ac, av) |
---|
393 | int ac; |
---|
394 | char **av; |
---|
395 | { |
---|
396 | evt_quit_event = -1; |
---|
397 | if (ac >= 1) |
---|
398 | errx(1, "too many arguments"); |
---|
399 | |
---|
400 | return make_request(ADMIN_SHOW_EVT, 0, 0); |
---|
401 | } |
---|
402 | |
---|
403 | static vchar_t * |
---|
404 | f_getsched(ac, av) |
---|
405 | int ac; |
---|
406 | char **av; |
---|
407 | { |
---|
408 | return make_request(ADMIN_SHOW_SCHED, 0, 0); |
---|
409 | } |
---|
410 | |
---|
411 | static vchar_t * |
---|
412 | f_getsa(ac, av) |
---|
413 | int ac; |
---|
414 | char **av; |
---|
415 | { |
---|
416 | int proto; |
---|
417 | |
---|
418 | /* need protocol */ |
---|
419 | if (ac != 1) |
---|
420 | errx(1, "insufficient arguments"); |
---|
421 | proto = get_proto(*av); |
---|
422 | if (proto == -1) |
---|
423 | errx(1, "unknown protocol %s", *av); |
---|
424 | |
---|
425 | return make_request(ADMIN_SHOW_SA, proto, 0); |
---|
426 | } |
---|
427 | |
---|
428 | static vchar_t * |
---|
429 | f_getsacert(ac, av) |
---|
430 | int ac; |
---|
431 | char **av; |
---|
432 | { |
---|
433 | vchar_t *buf, *index; |
---|
434 | struct admin_com_indexes *com; |
---|
435 | |
---|
436 | index = get_index(ac, av); |
---|
437 | if (index == NULL) |
---|
438 | return NULL; |
---|
439 | |
---|
440 | com = (struct admin_com_indexes *) index->v; |
---|
441 | buf = make_request(ADMIN_GET_SA_CERT, ADMIN_PROTO_ISAKMP, index->l); |
---|
442 | if (buf == NULL) |
---|
443 | errx(1, "Cannot allocate buffer"); |
---|
444 | |
---|
445 | memcpy(buf->v+sizeof(struct admin_com), index->v, index->l); |
---|
446 | |
---|
447 | vfree(index); |
---|
448 | |
---|
449 | return buf; |
---|
450 | } |
---|
451 | |
---|
452 | static vchar_t * |
---|
453 | f_flushsa(ac, av) |
---|
454 | int ac; |
---|
455 | char **av; |
---|
456 | { |
---|
457 | vchar_t *buf; |
---|
458 | struct admin_com *head; |
---|
459 | int proto; |
---|
460 | |
---|
461 | /* need protocol */ |
---|
462 | if (ac != 1) |
---|
463 | errx(1, "insufficient arguments"); |
---|
464 | proto = get_proto(*av); |
---|
465 | if (proto == -1) |
---|
466 | errx(1, "unknown protocol %s", *av); |
---|
467 | |
---|
468 | return make_request(ADMIN_FLUSH_SA, proto, 0); |
---|
469 | } |
---|
470 | |
---|
471 | static vchar_t * |
---|
472 | f_deletesa(ac, av) |
---|
473 | int ac; |
---|
474 | char **av; |
---|
475 | { |
---|
476 | vchar_t *buf, *index; |
---|
477 | int proto; |
---|
478 | |
---|
479 | /* need protocol */ |
---|
480 | if (ac < 1) |
---|
481 | errx(1, "insufficient arguments"); |
---|
482 | proto = get_proto(*av); |
---|
483 | if (proto == -1) |
---|
484 | errx(1, "unknown protocol %s", *av); |
---|
485 | |
---|
486 | /* get index(es) */ |
---|
487 | av++; |
---|
488 | ac--; |
---|
489 | switch (proto) { |
---|
490 | case ADMIN_PROTO_ISAKMP: |
---|
491 | index = get_index(ac, av); |
---|
492 | if (index == NULL) |
---|
493 | return NULL; |
---|
494 | break; |
---|
495 | case ADMIN_PROTO_AH: |
---|
496 | case ADMIN_PROTO_ESP: |
---|
497 | index = get_index(ac, av); |
---|
498 | if (index == NULL) |
---|
499 | return NULL; |
---|
500 | break; |
---|
501 | default: |
---|
502 | errno = EPROTONOSUPPORT; |
---|
503 | return NULL; |
---|
504 | } |
---|
505 | |
---|
506 | buf = make_request(ADMIN_DELETE_SA, proto, index->l); |
---|
507 | if (buf == NULL) |
---|
508 | goto out; |
---|
509 | |
---|
510 | memcpy(buf->v + sizeof(struct admin_com), index->v, index->l); |
---|
511 | |
---|
512 | out: |
---|
513 | if (index != NULL) |
---|
514 | vfree(index); |
---|
515 | |
---|
516 | return buf; |
---|
517 | } |
---|
518 | |
---|
519 | static vchar_t * |
---|
520 | f_deleteallsadst(ac, av) |
---|
521 | int ac; |
---|
522 | char **av; |
---|
523 | { |
---|
524 | vchar_t *buf, *index; |
---|
525 | u_int16_t proto; |
---|
526 | |
---|
527 | index = get_proto_and_index(ac, av, &proto); |
---|
528 | if (index == NULL) |
---|
529 | return NULL; |
---|
530 | |
---|
531 | buf = make_request(ADMIN_DELETE_ALL_SA_DST, proto, index->l); |
---|
532 | if (buf == NULL) |
---|
533 | goto out; |
---|
534 | |
---|
535 | memcpy(buf->v+sizeof(struct admin_com), index->v, index->l); |
---|
536 | |
---|
537 | out: |
---|
538 | if (index != NULL) |
---|
539 | vfree(index); |
---|
540 | |
---|
541 | return buf; |
---|
542 | } |
---|
543 | |
---|
544 | static vchar_t * |
---|
545 | f_exchangesa(ac, av) |
---|
546 | int ac; |
---|
547 | char **av; |
---|
548 | { |
---|
549 | vchar_t *buf, *index; |
---|
550 | u_int16_t proto; |
---|
551 | int cmd = ADMIN_ESTABLISH_SA; |
---|
552 | size_t com_len = 0; |
---|
553 | char *id = NULL; |
---|
554 | char *key = NULL; |
---|
555 | char *remoteconf = NULL; |
---|
556 | struct admin_com_psk *acp; |
---|
557 | int wait = 0; |
---|
558 | |
---|
559 | if (ac < 1) |
---|
560 | errx(1, "insufficient arguments"); |
---|
561 | |
---|
562 | /* Optional -u identity */ |
---|
563 | if (strcmp(av[0], "-u") == 0) { |
---|
564 | if (ac < 2) |
---|
565 | errx(1, "-u require an argument"); |
---|
566 | |
---|
567 | id = av[1]; |
---|
568 | if ((key = getpass("Password: ")) == NULL) |
---|
569 | errx(1, "getpass() failed: %s", strerror(errno)); |
---|
570 | |
---|
571 | com_len += sizeof(*acp) + strlen(id) + 1 + strlen(key) + 1; |
---|
572 | cmd = ADMIN_ESTABLISH_SA_PSK; |
---|
573 | |
---|
574 | av += 2; |
---|
575 | ac -= 2; |
---|
576 | } |
---|
577 | |
---|
578 | if (ac >= 2 && strcmp(av[0], "-n") == 0) { |
---|
579 | /* Remoteconf name */ |
---|
580 | remoteconf = av[1]; |
---|
581 | av += 2; |
---|
582 | ac -= 2; |
---|
583 | } |
---|
584 | |
---|
585 | if (ac >= 1 && strcmp(av[0], "-w") == 0) { |
---|
586 | wait = 1; |
---|
587 | av++; |
---|
588 | ac--; |
---|
589 | } |
---|
590 | |
---|
591 | index = get_proto_and_index(ac, av, &proto); |
---|
592 | if (index == NULL) |
---|
593 | return NULL; |
---|
594 | |
---|
595 | if (proto == ADMIN_PROTO_ISAKMP && cmd == ADMIN_ESTABLISH_SA && |
---|
596 | remoteconf != NULL) |
---|
597 | com_len += strlen(remoteconf) + 1; |
---|
598 | |
---|
599 | if (wait) { |
---|
600 | switch (proto) { |
---|
601 | case ADMIN_PROTO_ISAKMP: |
---|
602 | evt_quit_event = EVT_PHASE1_MODE_CFG; |
---|
603 | break; |
---|
604 | case ADMIN_PROTO_AH: |
---|
605 | case ADMIN_PROTO_ESP: |
---|
606 | evt_quit_event = EVT_PHASE2_UP; |
---|
607 | break; |
---|
608 | default: |
---|
609 | errno = EPROTONOSUPPORT; |
---|
610 | return NULL; |
---|
611 | } |
---|
612 | } |
---|
613 | |
---|
614 | com_len += index->l; |
---|
615 | buf = make_request(cmd, proto, com_len); |
---|
616 | if (buf == NULL) |
---|
617 | errx(1, "Cannot allocate buffer"); |
---|
618 | |
---|
619 | memcpy(buf->v+sizeof(struct admin_com), index->v, index->l); |
---|
620 | |
---|
621 | if (proto == ADMIN_PROTO_ISAKMP && cmd == ADMIN_ESTABLISH_SA && |
---|
622 | remoteconf != NULL) { |
---|
623 | strcpy(buf->v + sizeof(struct admin_com) + index->l, |
---|
624 | remoteconf); |
---|
625 | } else if (id && key) { |
---|
626 | char *data; |
---|
627 | acp = (struct admin_com_psk *) |
---|
628 | (buf->v + sizeof(struct admin_com) + index->l); |
---|
629 | |
---|
630 | acp->id_type = IDTYPE_USERFQDN; |
---|
631 | acp->id_len = strlen(id) + 1; |
---|
632 | acp->key_len = strlen(key) + 1; |
---|
633 | |
---|
634 | data = (char *)(acp + 1); |
---|
635 | strcpy(data, id); |
---|
636 | |
---|
637 | data = (char *)(data + acp->id_len); |
---|
638 | strcpy(data, key); |
---|
639 | } |
---|
640 | |
---|
641 | vfree(index); |
---|
642 | |
---|
643 | return buf; |
---|
644 | } |
---|
645 | |
---|
646 | static vchar_t * |
---|
647 | f_vpnc(ac, av) |
---|
648 | int ac; |
---|
649 | char **av; |
---|
650 | { |
---|
651 | char *nav[] = {NULL, NULL, NULL, NULL, NULL, NULL}; |
---|
652 | int nac = 0; |
---|
653 | char *isakmp = "isakmp"; |
---|
654 | char *inet = "inet"; |
---|
655 | char *srcaddr; |
---|
656 | struct addrinfo hints, *res; |
---|
657 | struct sockaddr *src; |
---|
658 | char *idx; |
---|
659 | |
---|
660 | if (ac < 1) |
---|
661 | errx(1, "insufficient arguments"); |
---|
662 | |
---|
663 | evt_quit_event = EVT_PHASE1_MODE_CFG; |
---|
664 | |
---|
665 | /* Optional -u identity */ |
---|
666 | if (strcmp(av[0], "-u") == 0) { |
---|
667 | if (ac < 2) |
---|
668 | errx(1, "-u require an argument"); |
---|
669 | |
---|
670 | nav[nac++] = av[0]; |
---|
671 | nav[nac++] = av[1]; |
---|
672 | |
---|
673 | ac -= 2; |
---|
674 | av += 2; |
---|
675 | } |
---|
676 | |
---|
677 | if (ac < 1) |
---|
678 | errx(1, "VPN gateway required"); |
---|
679 | if (ac > 1) |
---|
680 | warnx("Extra arguments"); |
---|
681 | |
---|
682 | /* |
---|
683 | * Find the source address |
---|
684 | */ |
---|
685 | memset(&hints, 0, sizeof(hints)); |
---|
686 | hints.ai_family = PF_UNSPEC; |
---|
687 | hints.ai_socktype = SOCK_DGRAM; |
---|
688 | if (getaddrinfo(av[0], "4500", &hints, &res) != 0) |
---|
689 | errx(1, "Cannot resolve destination address"); |
---|
690 | |
---|
691 | if ((src = getlocaladdr(res->ai_addr)) == NULL) |
---|
692 | errx(1, "cannot find source address"); |
---|
693 | |
---|
694 | if ((srcaddr = saddr2str(src)) == NULL) |
---|
695 | errx(1, "cannot read source address"); |
---|
696 | |
---|
697 | /* We get "ip[port]" strip the port */ |
---|
698 | if ((idx = index(srcaddr, '[')) == NULL) |
---|
699 | errx(1, "unexpected source address format"); |
---|
700 | *idx = '\0'; |
---|
701 | |
---|
702 | nav[nac++] = isakmp; |
---|
703 | nav[nac++] = inet; |
---|
704 | nav[nac++] = srcaddr; |
---|
705 | nav[nac++] = av[0]; |
---|
706 | |
---|
707 | return f_exchangesa(nac, nav); |
---|
708 | } |
---|
709 | |
---|
710 | static vchar_t * |
---|
711 | f_vpnd(ac, av) |
---|
712 | int ac; |
---|
713 | char **av; |
---|
714 | { |
---|
715 | char *nav[] = {NULL, NULL, NULL, NULL}; |
---|
716 | int nac = 0; |
---|
717 | char *isakmp = "isakmp"; |
---|
718 | char *inet = "inet"; |
---|
719 | char *anyaddr = "0.0.0.0"; |
---|
720 | char *idx; |
---|
721 | |
---|
722 | if (ac < 1) |
---|
723 | errx(1, "VPN gateway required"); |
---|
724 | if (ac > 1) |
---|
725 | warnx("Extra arguments"); |
---|
726 | |
---|
727 | evt_quit_event = EVT_PHASE1_DOWN; |
---|
728 | |
---|
729 | nav[nac++] = isakmp; |
---|
730 | nav[nac++] = inet; |
---|
731 | nav[nac++] = anyaddr; |
---|
732 | nav[nac++] = av[0]; |
---|
733 | |
---|
734 | return f_deleteallsadst(nac, nav); |
---|
735 | } |
---|
736 | |
---|
737 | #ifdef ENABLE_HYBRID |
---|
738 | static vchar_t * |
---|
739 | f_logoutusr(ac, av) |
---|
740 | int ac; |
---|
741 | char **av; |
---|
742 | { |
---|
743 | vchar_t *buf; |
---|
744 | char *user; |
---|
745 | size_t userlen; |
---|
746 | |
---|
747 | /* need username */ |
---|
748 | if (ac < 1) |
---|
749 | errx(1, "insufficient arguments"); |
---|
750 | user = av[0]; |
---|
751 | userlen = strlen(user); |
---|
752 | if ((user == NULL) || (userlen > LOGINLEN)) |
---|
753 | errx(1, "bad login (too long?)"); |
---|
754 | |
---|
755 | buf = make_request(ADMIN_LOGOUT_USER, 0, userlen); |
---|
756 | if (buf == NULL) |
---|
757 | return NULL; |
---|
758 | |
---|
759 | strncpy(buf->v + sizeof(struct admin_com), user, userlen); |
---|
760 | |
---|
761 | return buf; |
---|
762 | } |
---|
763 | #endif /* ENABLE_HYBRID */ |
---|
764 | |
---|
765 | static vchar_t * |
---|
766 | get_proto_and_index(ac, av, proto) |
---|
767 | int ac; |
---|
768 | char **av; |
---|
769 | u_int16_t *proto; |
---|
770 | { |
---|
771 | vchar_t *index = NULL; |
---|
772 | |
---|
773 | /* need protocol */ |
---|
774 | if (ac < 1) |
---|
775 | errx(1, "insufficient arguments"); |
---|
776 | *proto = get_proto(*av); |
---|
777 | if (*proto == (u_int16_t) -1) |
---|
778 | errx(1, "unknown protocol %s", *av); |
---|
779 | |
---|
780 | /* get index(es) */ |
---|
781 | av++; |
---|
782 | ac--; |
---|
783 | switch (*proto) { |
---|
784 | case ADMIN_PROTO_ISAKMP: |
---|
785 | case ADMIN_PROTO_AH: |
---|
786 | case ADMIN_PROTO_ESP: |
---|
787 | index = get_index(ac, av); |
---|
788 | break; |
---|
789 | default: |
---|
790 | errno = EPROTONOSUPPORT; |
---|
791 | break; |
---|
792 | } |
---|
793 | return index; |
---|
794 | } |
---|
795 | |
---|
796 | static int |
---|
797 | get_proto(str) |
---|
798 | char *str; |
---|
799 | { |
---|
800 | struct proto_tag *cp; |
---|
801 | |
---|
802 | if (str == NULL) { |
---|
803 | errno = EINVAL; |
---|
804 | return -1; |
---|
805 | } |
---|
806 | |
---|
807 | /* checking the string of command. */ |
---|
808 | for (cp = &prototab[0]; cp->str; cp++) { |
---|
809 | if (strcmp(str, cp->str) == 0) |
---|
810 | return cp->proto; |
---|
811 | } |
---|
812 | |
---|
813 | errno = EINVAL; |
---|
814 | return -1; |
---|
815 | } |
---|
816 | |
---|
817 | static vchar_t * |
---|
818 | get_index(ac, av) |
---|
819 | int ac; |
---|
820 | char **av; |
---|
821 | { |
---|
822 | int family; |
---|
823 | |
---|
824 | if (ac != 3 && ac != 4) { |
---|
825 | errno = EINVAL; |
---|
826 | return NULL; |
---|
827 | } |
---|
828 | |
---|
829 | /* checking the string of family */ |
---|
830 | family = get_family(*av); |
---|
831 | if (family == -1) |
---|
832 | return NULL; |
---|
833 | av++; |
---|
834 | ac--; |
---|
835 | |
---|
836 | return get_comindexes(family, ac, av); |
---|
837 | } |
---|
838 | |
---|
839 | static int |
---|
840 | get_family(str) |
---|
841 | char *str; |
---|
842 | { |
---|
843 | if (strcmp("inet", str) == 0) |
---|
844 | return AF_INET; |
---|
845 | #ifdef INET6 |
---|
846 | else if (strcmp("inet6", str) == 0) |
---|
847 | return AF_INET6; |
---|
848 | #endif |
---|
849 | errno = EAFNOSUPPORT; |
---|
850 | return -1; |
---|
851 | } |
---|
852 | |
---|
853 | static vchar_t * |
---|
854 | get_comindexes(family, ac, av) |
---|
855 | int family; |
---|
856 | int ac; |
---|
857 | char **av; |
---|
858 | { |
---|
859 | vchar_t *buf; |
---|
860 | struct admin_com_indexes *ci; |
---|
861 | char *p_name = NULL, *p_port = NULL; |
---|
862 | char *p_prefs = NULL, *p_prefd = NULL; |
---|
863 | struct sockaddr *src = NULL, *dst = NULL; |
---|
864 | int ulproto; |
---|
865 | |
---|
866 | if (ac != 2 && ac != 3) { |
---|
867 | errno = EINVAL; |
---|
868 | return NULL; |
---|
869 | } |
---|
870 | |
---|
871 | if (get_comindex(*av, &p_name, &p_port, &p_prefs) == -1) |
---|
872 | goto bad; |
---|
873 | src = get_sockaddr(family, p_name, p_port); |
---|
874 | if (p_name) { |
---|
875 | racoon_free(p_name); |
---|
876 | p_name = NULL; |
---|
877 | } |
---|
878 | if (p_port) { |
---|
879 | racoon_free(p_port); |
---|
880 | p_port = NULL; |
---|
881 | } |
---|
882 | if (src == NULL) |
---|
883 | goto bad; |
---|
884 | av++; |
---|
885 | ac--; |
---|
886 | if (get_comindex(*av, &p_name, &p_port, &p_prefd) == -1) |
---|
887 | goto bad; |
---|
888 | dst = get_sockaddr(family, p_name, p_port); |
---|
889 | if (p_name) { |
---|
890 | racoon_free(p_name); |
---|
891 | p_name = NULL; |
---|
892 | } |
---|
893 | if (p_port) { |
---|
894 | racoon_free(p_port); |
---|
895 | p_port = NULL; |
---|
896 | } |
---|
897 | if (dst == NULL) |
---|
898 | goto bad; |
---|
899 | |
---|
900 | buf = vmalloc(sizeof(*ci)); |
---|
901 | if (buf == NULL) |
---|
902 | goto bad; |
---|
903 | |
---|
904 | av++; |
---|
905 | ac--; |
---|
906 | if(ac){ |
---|
907 | ulproto = get_ulproto(*av); |
---|
908 | if (ulproto == -1) |
---|
909 | goto bad; |
---|
910 | }else |
---|
911 | ulproto=0; |
---|
912 | |
---|
913 | ci = (struct admin_com_indexes *)buf->v; |
---|
914 | if(p_prefs) |
---|
915 | ci->prefs = (u_int8_t)atoi(p_prefs); /* XXX should be handled error. */ |
---|
916 | else |
---|
917 | ci->prefs = 32; |
---|
918 | if(p_prefd) |
---|
919 | ci->prefd = (u_int8_t)atoi(p_prefd); /* XXX should be handled error. */ |
---|
920 | else |
---|
921 | ci->prefd = 32; |
---|
922 | ci->ul_proto = ulproto; |
---|
923 | memcpy(&ci->src, src, sysdep_sa_len(src)); |
---|
924 | memcpy(&ci->dst, dst, sysdep_sa_len(dst)); |
---|
925 | |
---|
926 | if (p_name) |
---|
927 | racoon_free(p_name); |
---|
928 | |
---|
929 | return buf; |
---|
930 | |
---|
931 | bad: |
---|
932 | if (p_name) |
---|
933 | racoon_free(p_name); |
---|
934 | if (p_port) |
---|
935 | racoon_free(p_port); |
---|
936 | if (p_prefs) |
---|
937 | racoon_free(p_prefs); |
---|
938 | if (p_prefd) |
---|
939 | racoon_free(p_prefd); |
---|
940 | return NULL; |
---|
941 | } |
---|
942 | |
---|
943 | static int |
---|
944 | get_comindex(str, name, port, pref) |
---|
945 | char *str, **name, **port, **pref; |
---|
946 | { |
---|
947 | char *p; |
---|
948 | |
---|
949 | *name = *port = *pref = NULL; |
---|
950 | |
---|
951 | *name = racoon_strdup(str); |
---|
952 | STRDUP_FATAL(*name); |
---|
953 | p = strpbrk(*name, "/["); |
---|
954 | if (p != NULL) { |
---|
955 | if (*(p + 1) == '\0') |
---|
956 | goto bad; |
---|
957 | if (*p == '/') { |
---|
958 | *p = '\0'; |
---|
959 | *pref = racoon_strdup(p + 1); |
---|
960 | STRDUP_FATAL(*pref); |
---|
961 | p = strchr(*pref, '['); |
---|
962 | if (p != NULL) { |
---|
963 | if (*(p + 1) == '\0') |
---|
964 | goto bad; |
---|
965 | *p = '\0'; |
---|
966 | *port = racoon_strdup(p + 1); |
---|
967 | STRDUP_FATAL(*port); |
---|
968 | p = strchr(*pref, ']'); |
---|
969 | if (p == NULL) |
---|
970 | goto bad; |
---|
971 | *p = '\0'; |
---|
972 | } |
---|
973 | } else if (*p == '[') { |
---|
974 | if (*pref == NULL) |
---|
975 | goto bad; |
---|
976 | *p = '\0'; |
---|
977 | *port = racoon_strdup(p + 1); |
---|
978 | STRDUP_FATAL(*port); |
---|
979 | p = strchr(*pref, ']'); |
---|
980 | if (p == NULL) |
---|
981 | goto bad; |
---|
982 | *p = '\0'; |
---|
983 | } else { |
---|
984 | /* XXX */ |
---|
985 | } |
---|
986 | } |
---|
987 | |
---|
988 | return 0; |
---|
989 | |
---|
990 | bad: |
---|
991 | |
---|
992 | if (*name) |
---|
993 | racoon_free(*name); |
---|
994 | if (*port) |
---|
995 | racoon_free(*port); |
---|
996 | if (*pref) |
---|
997 | racoon_free(*pref); |
---|
998 | *name = *port = *pref = NULL; |
---|
999 | return -1; |
---|
1000 | } |
---|
1001 | |
---|
1002 | static int |
---|
1003 | get_ulproto(str) |
---|
1004 | char *str; |
---|
1005 | { |
---|
1006 | struct ulproto_tag *cp; |
---|
1007 | |
---|
1008 | if(str == NULL){ |
---|
1009 | errno = EINVAL; |
---|
1010 | return -1; |
---|
1011 | } |
---|
1012 | |
---|
1013 | /* checking the string of upper layer protocol. */ |
---|
1014 | for (cp = &ulprototab[0]; cp->str; cp++) { |
---|
1015 | if (strcmp(str, cp->str) == 0) |
---|
1016 | return cp->ul_proto; |
---|
1017 | } |
---|
1018 | |
---|
1019 | errno = EINVAL; |
---|
1020 | return -1; |
---|
1021 | } |
---|
1022 | |
---|
1023 | /* %%% */ |
---|
1024 | void |
---|
1025 | dump_isakmp_sa(buf, len) |
---|
1026 | char *buf; |
---|
1027 | int len; |
---|
1028 | { |
---|
1029 | struct ph1dump *pd; |
---|
1030 | struct tm *tm; |
---|
1031 | char tbuf[56]; |
---|
1032 | caddr_t p = NULL; |
---|
1033 | |
---|
1034 | /* isakmp status header */ |
---|
1035 | /* short header; |
---|
1036 | 1234567890123456789012 0000000000000000:0000000000000000 000000000000 |
---|
1037 | */ |
---|
1038 | char *header1 = |
---|
1039 | "Destination Cookies Created"; |
---|
1040 | |
---|
1041 | /* semi long header; |
---|
1042 | 1234567890123456789012 0000000000000000:0000000000000000 00 X 00 X 0000-00-00 00:00:00 000000 |
---|
1043 | */ |
---|
1044 | char *header2 = |
---|
1045 | "Destination Cookies ST S V E Created Phase2"; |
---|
1046 | |
---|
1047 | /* long header; |
---|
1048 | 0000:0000:0000:0000:0000:0000:0000:0000.00000 0000:0000:0000:0000:0000:0000:0000:0000.00000 0000000000000000:0000000000000000 00 X 00 X 0000-00-00 00:00:00 000000 |
---|
1049 | */ |
---|
1050 | char *header3 = |
---|
1051 | "Source Destination Cookies ST S V E Created Phase2"; |
---|
1052 | |
---|
1053 | /* phase status header */ |
---|
1054 | /* short format; |
---|
1055 | side stats source address destination address |
---|
1056 | xxx xxxxx 1234567890123456789012 1234567890123456789012 |
---|
1057 | */ |
---|
1058 | |
---|
1059 | static char *estr[] = { "", "B", "M", "U", "A", "I", }; |
---|
1060 | |
---|
1061 | switch (long_format) { |
---|
1062 | case 0: |
---|
1063 | printf("%s\n", header1); |
---|
1064 | break; |
---|
1065 | case 1: |
---|
1066 | printf("%s\n", header2); |
---|
1067 | break; |
---|
1068 | case 2: |
---|
1069 | default: |
---|
1070 | printf("%s\n", header3); |
---|
1071 | break; |
---|
1072 | } |
---|
1073 | |
---|
1074 | if (len % sizeof(*pd)) |
---|
1075 | printf("invalid length %d\n", len); |
---|
1076 | len /= sizeof(*pd); |
---|
1077 | |
---|
1078 | pd = (struct ph1dump *)buf; |
---|
1079 | |
---|
1080 | while (len-- > 0) { |
---|
1081 | /* source address */ |
---|
1082 | if (long_format >= 2) { |
---|
1083 | GETNAMEINFO((struct sockaddr *)&pd->local, _addr1_, _addr2_); |
---|
1084 | switch (long_format) { |
---|
1085 | case 0: |
---|
1086 | break; |
---|
1087 | case 1: |
---|
1088 | p = fixed_addr(_addr1_, _addr2_, 22); |
---|
1089 | break; |
---|
1090 | case 2: |
---|
1091 | default: |
---|
1092 | p = fixed_addr(_addr1_, _addr2_, 45); |
---|
1093 | break; |
---|
1094 | } |
---|
1095 | printf("%s ", p); |
---|
1096 | } |
---|
1097 | |
---|
1098 | /* destination address */ |
---|
1099 | GETNAMEINFO((struct sockaddr *)&pd->remote, _addr1_, _addr2_); |
---|
1100 | switch (long_format) { |
---|
1101 | case 0: |
---|
1102 | case 1: |
---|
1103 | p = fixed_addr(_addr1_, _addr2_, 22); |
---|
1104 | break; |
---|
1105 | case 2: |
---|
1106 | default: |
---|
1107 | p = fixed_addr(_addr1_, _addr2_, 45); |
---|
1108 | break; |
---|
1109 | } |
---|
1110 | printf("%s ", p); |
---|
1111 | |
---|
1112 | printf("%s ", pindex_isakmp(&pd->index)); |
---|
1113 | |
---|
1114 | /* statuc, side and version */ |
---|
1115 | if (long_format >= 1) { |
---|
1116 | printf("%2d %c %2x ", |
---|
1117 | pd->status, |
---|
1118 | pd->side == INITIATOR ? 'I' : 'R', |
---|
1119 | pd->version); |
---|
1120 | if (ARRAYLEN(estr) > pd->etype) |
---|
1121 | printf("%s ", estr[pd->etype]); |
---|
1122 | } |
---|
1123 | |
---|
1124 | /* created date */ |
---|
1125 | if (pd->created) { |
---|
1126 | tm = localtime(&pd->created); |
---|
1127 | strftime(tbuf, sizeof(tbuf), "%Y-%m-%d %T", tm); |
---|
1128 | } else |
---|
1129 | snprintf(tbuf, sizeof(tbuf), " "); |
---|
1130 | printf("%s ", tbuf); |
---|
1131 | |
---|
1132 | /* counter of phase 2 */ |
---|
1133 | if (long_format >= 1) |
---|
1134 | printf("%6d ", pd->ph2cnt); |
---|
1135 | |
---|
1136 | printf("\n"); |
---|
1137 | |
---|
1138 | pd++; |
---|
1139 | } |
---|
1140 | |
---|
1141 | return; |
---|
1142 | } |
---|
1143 | |
---|
1144 | /* %%% */ |
---|
1145 | void |
---|
1146 | dump_internal(buf, tlen) |
---|
1147 | char *buf; |
---|
1148 | int tlen; |
---|
1149 | { |
---|
1150 | struct ph2handle *iph2; |
---|
1151 | struct sockaddr *addr; |
---|
1152 | |
---|
1153 | /* |
---|
1154 | short header; |
---|
1155 | source address destination address |
---|
1156 | 1234567890123456789012 1234567890123456789012 |
---|
1157 | */ |
---|
1158 | char *short_h1 = |
---|
1159 | "Source Destination "; |
---|
1160 | |
---|
1161 | /* |
---|
1162 | long header; |
---|
1163 | source address destination address |
---|
1164 | 123456789012345678901234567890123456789012345 123456789012345678901234567890123456789012345 |
---|
1165 | 0000:0000:0000:0000:0000:0000:0000:0000.00000 0000:0000:0000:0000:0000:0000:0000:0000.00000 0000:0000:0000:0000:0000:0000:0000:0000.00000 |
---|
1166 | */ |
---|
1167 | char *long_h1 = |
---|
1168 | "Source Destination "; |
---|
1169 | |
---|
1170 | printf("%s\n", long_format ? long_h1 : short_h1); |
---|
1171 | |
---|
1172 | while (tlen > 0) { |
---|
1173 | iph2 = (struct ph2handle *)buf; |
---|
1174 | addr = (struct sockaddr *)(++iph2); |
---|
1175 | |
---|
1176 | GETNAMEINFO(addr, _addr1_, _addr2_); |
---|
1177 | printf("%s ", long_format ? |
---|
1178 | fixed_addr(_addr1_, _addr2_, 45) |
---|
1179 | : fixed_addr(_addr1_, _addr2_, 22)); |
---|
1180 | addr++; |
---|
1181 | tlen -= sysdep_sa_len(addr); |
---|
1182 | |
---|
1183 | GETNAMEINFO(addr, _addr1_, _addr2_); |
---|
1184 | printf("%s ", long_format ? |
---|
1185 | fixed_addr(_addr1_, _addr2_, 45) |
---|
1186 | : fixed_addr(_addr1_, _addr2_, 22)); |
---|
1187 | addr++; |
---|
1188 | tlen -= sysdep_sa_len(addr); |
---|
1189 | |
---|
1190 | printf("\n"); |
---|
1191 | } |
---|
1192 | |
---|
1193 | return; |
---|
1194 | } |
---|
1195 | |
---|
1196 | /* %%% */ |
---|
1197 | char * |
---|
1198 | pindex_isakmp(index) |
---|
1199 | isakmp_index *index; |
---|
1200 | { |
---|
1201 | static char buf[64]; |
---|
1202 | u_char *p; |
---|
1203 | int i, j; |
---|
1204 | |
---|
1205 | memset(buf, 0, sizeof(buf)); |
---|
1206 | |
---|
1207 | /* copy index */ |
---|
1208 | p = (u_char *)index; |
---|
1209 | for (j = 0, i = 0; i < sizeof(isakmp_index); i++) { |
---|
1210 | snprintf((char *)&buf[j], sizeof(buf) - j, "%02x", p[i]); |
---|
1211 | j += 2; |
---|
1212 | switch (i) { |
---|
1213 | case 7: |
---|
1214 | #if 0 |
---|
1215 | case 15: |
---|
1216 | #endif |
---|
1217 | buf[j++] = ':'; |
---|
1218 | } |
---|
1219 | } |
---|
1220 | |
---|
1221 | return buf; |
---|
1222 | } |
---|
1223 | |
---|
1224 | /* print schedule */ |
---|
1225 | char *str_sched_stat[] = { |
---|
1226 | "off", |
---|
1227 | "on", |
---|
1228 | "dead", |
---|
1229 | }; |
---|
1230 | |
---|
1231 | char *str_sched_id[] = { |
---|
1232 | "PH1resend", |
---|
1233 | "PH1lifetime", |
---|
1234 | "PH2resend", |
---|
1235 | "PSTacquire", |
---|
1236 | "PSTlifetime", |
---|
1237 | }; |
---|
1238 | |
---|
1239 | void |
---|
1240 | print_schedule(buf, len) |
---|
1241 | caddr_t buf; |
---|
1242 | int len; |
---|
1243 | { |
---|
1244 | struct scheddump *sc = (struct scheddump *)buf; |
---|
1245 | struct tm *tm; |
---|
1246 | char tbuf[56]; |
---|
1247 | |
---|
1248 | if (len % sizeof(*sc)) |
---|
1249 | printf("invalid length %d\n", len); |
---|
1250 | len /= sizeof(*sc); |
---|
1251 | |
---|
1252 | /* 00000000 00000000 00000000 xxx........*/ |
---|
1253 | printf("index tick xtime created\n"); |
---|
1254 | |
---|
1255 | while (len-- > 0) { |
---|
1256 | tm = localtime(&sc->created); |
---|
1257 | strftime(tbuf, sizeof(tbuf), "%Y-%m-%d %T", tm); |
---|
1258 | |
---|
1259 | printf("%-8ld %-8ld %-8ld %s\n", |
---|
1260 | sc->id, |
---|
1261 | (long)sc->tick, |
---|
1262 | (long)sc->xtime, |
---|
1263 | tbuf); |
---|
1264 | sc++; |
---|
1265 | } |
---|
1266 | |
---|
1267 | return; |
---|
1268 | } |
---|
1269 | |
---|
1270 | |
---|
1271 | void |
---|
1272 | print_evt(evtdump) |
---|
1273 | struct evt_async *evtdump; |
---|
1274 | { |
---|
1275 | int i; |
---|
1276 | char *srcstr; |
---|
1277 | char *dststr; |
---|
1278 | |
---|
1279 | for (i = 0; i < sizeof(evtmsg) / sizeof(evtmsg[0]); i++) |
---|
1280 | if (evtmsg[i].type == evtdump->ec_type) |
---|
1281 | break; |
---|
1282 | |
---|
1283 | if (evtmsg[i].msg == NULL) |
---|
1284 | printf("Event %d: ", evtdump->ec_type); |
---|
1285 | else |
---|
1286 | printf("%s : ", evtmsg[i].msg); |
---|
1287 | |
---|
1288 | if ((srcstr = saddr2str((struct sockaddr *)&evtdump->ec_ph1src)) == NULL) |
---|
1289 | printf("unknown"); |
---|
1290 | else |
---|
1291 | printf("%s", srcstr); |
---|
1292 | printf(" -> "); |
---|
1293 | if ((dststr = saddr2str((struct sockaddr *)&evtdump->ec_ph1dst)) == NULL) |
---|
1294 | printf("unknown"); |
---|
1295 | else |
---|
1296 | printf("%s", dststr); |
---|
1297 | printf("\n"); |
---|
1298 | } |
---|
1299 | |
---|
1300 | /* |
---|
1301 | * Print ISAKMP mode config info (IP and banner) |
---|
1302 | */ |
---|
1303 | void |
---|
1304 | print_cfg(buf, len) |
---|
1305 | caddr_t buf; |
---|
1306 | int len; |
---|
1307 | { |
---|
1308 | struct evt_async *evtdump = (struct evt_async *)buf; |
---|
1309 | struct isakmp_data *attr; |
---|
1310 | char *banner = NULL; |
---|
1311 | struct in_addr addr4; |
---|
1312 | |
---|
1313 | memset(&addr4, 0, sizeof(addr4)); |
---|
1314 | |
---|
1315 | if (evtdump->ec_type != EVT_PHASE1_MODE_CFG) |
---|
1316 | return; |
---|
1317 | |
---|
1318 | len -= sizeof(*evtdump); |
---|
1319 | attr = (struct isakmp_data *)(evtdump + 1); |
---|
1320 | |
---|
1321 | while (len > 0) { |
---|
1322 | if (len < sizeof(*attr)) { |
---|
1323 | printf("short attribute too short\n"); |
---|
1324 | break; |
---|
1325 | } |
---|
1326 | |
---|
1327 | if ((ntohs(attr->type) & ISAKMP_GEN_MASK) == ISAKMP_GEN_TV) { |
---|
1328 | /* Short attribute, skip */ |
---|
1329 | len -= sizeof(*attr); |
---|
1330 | attr++; |
---|
1331 | } else { /* Long attribute */ |
---|
1332 | char *n; |
---|
1333 | |
---|
1334 | if (len < (sizeof(*attr) + ntohs(attr->lorv))) { |
---|
1335 | printf("long attribute too long\n"); |
---|
1336 | break; |
---|
1337 | } |
---|
1338 | |
---|
1339 | switch (ntohs(attr->type) & ~ISAKMP_GEN_MASK) { |
---|
1340 | case INTERNAL_IP4_ADDRESS: |
---|
1341 | if (ntohs(attr->lorv) < sizeof(addr4)) { |
---|
1342 | printf("addr4 attribute too short\n"); |
---|
1343 | break; |
---|
1344 | } |
---|
1345 | memcpy(&addr4, attr + 1, sizeof(addr4)); |
---|
1346 | break; |
---|
1347 | |
---|
1348 | case UNITY_BANNER: |
---|
1349 | banner = racoon_malloc(ntohs(attr->lorv) + 1); |
---|
1350 | if (banner == NULL) { |
---|
1351 | printf("malloc failed\n"); |
---|
1352 | break; |
---|
1353 | } |
---|
1354 | memcpy(banner, attr + 1, ntohs(attr->lorv)); |
---|
1355 | banner[ntohs(attr->lorv)] = '\0'; |
---|
1356 | break; |
---|
1357 | |
---|
1358 | default: |
---|
1359 | break; |
---|
1360 | } |
---|
1361 | |
---|
1362 | len -= (sizeof(*attr) + ntohs(attr->lorv)); |
---|
1363 | n = (char *)attr; |
---|
1364 | attr = (struct isakmp_data *) |
---|
1365 | (n + sizeof(*attr) + ntohs(attr->lorv)); |
---|
1366 | } |
---|
1367 | } |
---|
1368 | |
---|
1369 | if (len > 0) |
---|
1370 | printf("Bound to address %s\n", inet_ntoa(addr4)); |
---|
1371 | else |
---|
1372 | printf("VPN connexion established\n"); |
---|
1373 | |
---|
1374 | if (banner) { |
---|
1375 | struct winsize win; |
---|
1376 | int col = 0; |
---|
1377 | int i; |
---|
1378 | |
---|
1379 | if (ioctl(1, TIOCGWINSZ, &win) != 1) |
---|
1380 | col = win.ws_col; |
---|
1381 | |
---|
1382 | for (i = 0; i < col; i++) |
---|
1383 | printf("%c", '='); |
---|
1384 | printf("\n%s\n", banner); |
---|
1385 | for (i = 0; i < col; i++) |
---|
1386 | printf("%c", '='); |
---|
1387 | printf("\n"); |
---|
1388 | racoon_free(banner); |
---|
1389 | } |
---|
1390 | } |
---|
1391 | |
---|
1392 | |
---|
1393 | char * |
---|
1394 | fixed_addr(addr, port, len) |
---|
1395 | char *addr, *port; |
---|
1396 | int len; |
---|
1397 | { |
---|
1398 | static char _addr_buf_[BUFSIZ]; |
---|
1399 | char *p; |
---|
1400 | int plen, i; |
---|
1401 | |
---|
1402 | /* initialize */ |
---|
1403 | memset(_addr_buf_, ' ', sizeof(_addr_buf_)); |
---|
1404 | |
---|
1405 | plen = strlen(port); |
---|
1406 | if (len < plen + 1) |
---|
1407 | return NULL; |
---|
1408 | |
---|
1409 | p = _addr_buf_; |
---|
1410 | for (i = 0; i < len - plen - 1 && addr[i] != '\0'; /*noting*/) |
---|
1411 | *p++ = addr[i++]; |
---|
1412 | *p++ = '.'; |
---|
1413 | |
---|
1414 | for (i = 0; i < plen && port[i] != '\0'; /*noting*/) |
---|
1415 | *p++ = port[i++]; |
---|
1416 | |
---|
1417 | _addr_buf_[len] = '\0'; |
---|
1418 | |
---|
1419 | return _addr_buf_; |
---|
1420 | } |
---|
1421 | |
---|
1422 | static int |
---|
1423 | handle_recv(combuf) |
---|
1424 | vchar_t *combuf; |
---|
1425 | { |
---|
1426 | struct admin_com *com; |
---|
1427 | caddr_t buf; |
---|
1428 | int len; |
---|
1429 | |
---|
1430 | com = (struct admin_com *)combuf->v; |
---|
1431 | if (com->ac_cmd & ADMIN_FLAG_LONG_REPLY) |
---|
1432 | len = ((u_int32_t)com->ac_len) + (((u_int32_t)com->ac_len_high) << 16); |
---|
1433 | else |
---|
1434 | len = com->ac_len; |
---|
1435 | len -= sizeof(*com); |
---|
1436 | buf = combuf->v + sizeof(*com); |
---|
1437 | |
---|
1438 | switch (com->ac_cmd & ~ADMIN_FLAG_LONG_REPLY) { |
---|
1439 | case ADMIN_SHOW_SCHED: |
---|
1440 | print_schedule(buf, len); |
---|
1441 | break; |
---|
1442 | |
---|
1443 | case ADMIN_SHOW_EVT: { |
---|
1444 | struct evt_async *ec; |
---|
1445 | |
---|
1446 | /* We got no event? */ |
---|
1447 | if (len == 0) |
---|
1448 | break; |
---|
1449 | |
---|
1450 | if (len < sizeof(struct evt_async)) |
---|
1451 | errx(1, "Short buffer\n"); |
---|
1452 | |
---|
1453 | ec = (struct evt_async *) buf; |
---|
1454 | if (evt_quit_event <= 0) |
---|
1455 | print_evt(ec); |
---|
1456 | else if (evt_quit_event == ec->ec_type) { |
---|
1457 | switch (ec->ec_type) { |
---|
1458 | case EVT_PHASE1_MODE_CFG: |
---|
1459 | print_cfg(ec, len); |
---|
1460 | break; |
---|
1461 | default: |
---|
1462 | print_evt(ec); |
---|
1463 | break; |
---|
1464 | } |
---|
1465 | evt_quit_event = 0; |
---|
1466 | } |
---|
1467 | break; |
---|
1468 | } |
---|
1469 | |
---|
1470 | case ADMIN_GET_SA_CERT: |
---|
1471 | fwrite(buf, len, 1, stdout); |
---|
1472 | break; |
---|
1473 | |
---|
1474 | case ADMIN_SHOW_SA: |
---|
1475 | { |
---|
1476 | switch (com->ac_proto) { |
---|
1477 | case ADMIN_PROTO_ISAKMP: |
---|
1478 | dump_isakmp_sa(buf, len); |
---|
1479 | break; |
---|
1480 | case ADMIN_PROTO_IPSEC: |
---|
1481 | case ADMIN_PROTO_AH: |
---|
1482 | case ADMIN_PROTO_ESP: |
---|
1483 | { |
---|
1484 | struct sadb_msg *msg = (struct sadb_msg *)buf; |
---|
1485 | |
---|
1486 | switch (msg->sadb_msg_errno) { |
---|
1487 | case ENOENT: |
---|
1488 | switch (msg->sadb_msg_type) { |
---|
1489 | case SADB_DELETE: |
---|
1490 | case SADB_GET: |
---|
1491 | printf("No entry.\n"); |
---|
1492 | break; |
---|
1493 | case SADB_DUMP: |
---|
1494 | printf("No SAD entries.\n"); |
---|
1495 | break; |
---|
1496 | } |
---|
1497 | break; |
---|
1498 | case 0: |
---|
1499 | while (1) { |
---|
1500 | pfkey_sadump(msg); |
---|
1501 | if (msg->sadb_msg_seq == 0) |
---|
1502 | break; |
---|
1503 | msg = (struct sadb_msg *)((caddr_t)msg + |
---|
1504 | PFKEY_UNUNIT64(msg->sadb_msg_len)); |
---|
1505 | } |
---|
1506 | break; |
---|
1507 | default: |
---|
1508 | printf("%s.\n", strerror(msg->sadb_msg_errno)); |
---|
1509 | } |
---|
1510 | } |
---|
1511 | break; |
---|
1512 | case ADMIN_PROTO_INTERNAL: |
---|
1513 | dump_internal(buf, len); |
---|
1514 | break; |
---|
1515 | default: |
---|
1516 | printf("Invalid proto [%d]\n", com->ac_proto); |
---|
1517 | } |
---|
1518 | |
---|
1519 | } |
---|
1520 | break; |
---|
1521 | |
---|
1522 | default: |
---|
1523 | /* IGNORE */ |
---|
1524 | break; |
---|
1525 | } |
---|
1526 | |
---|
1527 | return 0; |
---|
1528 | |
---|
1529 | bad: |
---|
1530 | return -1; |
---|
1531 | } |
---|