1 /*	$KAME: ipsec_dump_policy.c,v 1.13 2002/06/27 14:35:11 itojun Exp $	*/
2 
3 /*-
4  * SPDX-License-Identifier: BSD-3-Clause
5  *
6  * Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project.
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. Neither the name of the project nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  */
33 
34 #include <sys/cdefs.h>
35 #include <sys/types.h>
36 #include <sys/param.h>
37 #include <sys/socket.h>
38 
39 #include <netipsec/key_var.h>
40 #include <netinet/in.h>
41 #include <netipsec/ipsec.h>
42 
43 #include <arpa/inet.h>
44 
45 #include <stdio.h>
46 #include <stdlib.h>
47 #include <string.h>
48 #include <netdb.h>
49 
50 #include "ipsec_strerror.h"
51 
52 static const char *ipsp_dir_strs[] = {
53 	"any", "in", "out",
54 };
55 
56 static const char *ipsp_policy_strs[] = {
57 	"discard", "none", "ipsec", "entrust", "bypass",
58 };
59 
60 static char *ipsec_dump_ipsecrequest(char *, size_t,
61 	struct sadb_x_ipsecrequest *, size_t);
62 static int set_addresses(char *, size_t, struct sockaddr *, struct sockaddr *);
63 static char *set_address(char *, size_t, struct sockaddr *);
64 
65 /*
66  * policy is sadb_x_policy buffer.
67  * Must call free() later.
68  * When delimiter == NULL, alternatively ' '(space) is applied.
69  */
70 char *
ipsec_dump_policy(caddr_t policy,char * delimiter)71 ipsec_dump_policy(caddr_t policy, char *delimiter)
72 {
73 	struct sadb_x_policy *xpl = (struct sadb_x_policy *)policy;
74 	struct sadb_x_ipsecrequest *xisr;
75 	size_t off, buflen;
76 	char *buf;
77 	char isrbuf[1024];
78 	char *newbuf;
79 
80 	/* sanity check */
81 	if (policy == NULL)
82 		return NULL;
83 	if (xpl->sadb_x_policy_exttype != SADB_X_EXT_POLICY) {
84 		__ipsec_errcode = EIPSEC_INVAL_EXTTYPE;
85 		return NULL;
86 	}
87 
88 	/* set delimiter */
89 	if (delimiter == NULL)
90 		delimiter = " ";
91 
92 	switch (xpl->sadb_x_policy_dir) {
93 	case IPSEC_DIR_ANY:
94 	case IPSEC_DIR_INBOUND:
95 	case IPSEC_DIR_OUTBOUND:
96 		break;
97 	default:
98 		__ipsec_errcode = EIPSEC_INVAL_DIR;
99 		return NULL;
100 	}
101 
102 	switch (xpl->sadb_x_policy_type) {
103 	case IPSEC_POLICY_DISCARD:
104 	case IPSEC_POLICY_NONE:
105 	case IPSEC_POLICY_IPSEC:
106 	case IPSEC_POLICY_BYPASS:
107 	case IPSEC_POLICY_ENTRUST:
108 		break;
109 	default:
110 		__ipsec_errcode = EIPSEC_INVAL_POLICY;
111 		return NULL;
112 	}
113 
114 	buflen = strlen(ipsp_dir_strs[xpl->sadb_x_policy_dir])
115 		+ 1	/* space */
116 		+ strlen(ipsp_policy_strs[xpl->sadb_x_policy_type])
117 		+ 1;	/* NUL */
118 
119 	if ((buf = malloc(buflen)) == NULL) {
120 		__ipsec_errcode = EIPSEC_NO_BUFS;
121 		return NULL;
122 	}
123 	snprintf(buf, buflen, "%s %s", ipsp_dir_strs[xpl->sadb_x_policy_dir],
124 	    ipsp_policy_strs[xpl->sadb_x_policy_type]);
125 
126 	if (xpl->sadb_x_policy_type != IPSEC_POLICY_IPSEC) {
127 		__ipsec_errcode = EIPSEC_NO_ERROR;
128 		return buf;
129 	}
130 
131 	/* count length of buffer for use */
132 	off = sizeof(*xpl);
133 	while (off < PFKEY_EXTLEN(xpl)) {
134 		xisr = (struct sadb_x_ipsecrequest *)((caddr_t)xpl + off);
135 		off += xisr->sadb_x_ipsecrequest_len;
136 	}
137 
138 	/* validity check */
139 	if (off != PFKEY_EXTLEN(xpl)) {
140 		__ipsec_errcode = EIPSEC_INVAL_SADBMSG;
141 		free(buf);
142 		return NULL;
143 	}
144 
145 	off = sizeof(*xpl);
146 	while (off < PFKEY_EXTLEN(xpl)) {
147 		xisr = (struct sadb_x_ipsecrequest *)((caddr_t)xpl + off);
148 
149 		if (ipsec_dump_ipsecrequest(isrbuf, sizeof(isrbuf), xisr,
150 		    PFKEY_EXTLEN(xpl) - off) == NULL) {
151 			free(buf);
152 			return NULL;
153 		}
154 
155 		buflen = strlen(buf) + strlen(delimiter) + strlen(isrbuf) + 1;
156 		newbuf = (char *)realloc(buf, buflen);
157 		if (newbuf == NULL) {
158 			__ipsec_errcode = EIPSEC_NO_BUFS;
159 			free(buf);
160 			return NULL;
161 		}
162 		buf = newbuf;
163 		snprintf(buf + strlen(buf), buflen - strlen(buf),
164 		    "%s%s", delimiter, isrbuf);
165 
166 		off += xisr->sadb_x_ipsecrequest_len;
167 	}
168 
169 	__ipsec_errcode = EIPSEC_NO_ERROR;
170 	return buf;
171 }
172 
173 static char *
ipsec_dump_ipsecrequest(char * buf,size_t len,struct sadb_x_ipsecrequest * xisr,size_t bound)174 ipsec_dump_ipsecrequest(char *buf, size_t len, struct sadb_x_ipsecrequest *xisr,
175     size_t bound)
176 {
177 	const char *proto, *mode, *level;
178 	char abuf[NI_MAXHOST * 2 + 2];
179 
180 	if (xisr->sadb_x_ipsecrequest_len > bound) {
181 		__ipsec_errcode = EIPSEC_INVAL_PROTO;
182 		return NULL;
183 	}
184 
185 	switch (xisr->sadb_x_ipsecrequest_proto) {
186 	case IPPROTO_ESP:
187 		proto = "esp";
188 		break;
189 	case IPPROTO_AH:
190 		proto = "ah";
191 		break;
192 	case IPPROTO_IPCOMP:
193 		proto = "ipcomp";
194 		break;
195 	case IPPROTO_TCP:
196 		proto = "tcp";
197 		break;
198 	default:
199 		__ipsec_errcode = EIPSEC_INVAL_PROTO;
200 		return NULL;
201 	}
202 
203 	switch (xisr->sadb_x_ipsecrequest_mode) {
204 	case IPSEC_MODE_ANY:
205 		mode = "any";
206 		break;
207 	case IPSEC_MODE_TRANSPORT:
208 		mode = "transport";
209 		break;
210 	case IPSEC_MODE_TUNNEL:
211 		mode = "tunnel";
212 		break;
213 	default:
214 		__ipsec_errcode = EIPSEC_INVAL_MODE;
215 		return NULL;
216 	}
217 
218 	abuf[0] = '\0';
219 	if (xisr->sadb_x_ipsecrequest_len > sizeof(*xisr)) {
220 		struct sockaddr *sa1, *sa2;
221 		caddr_t p;
222 
223 		p = (caddr_t)(xisr + 1);
224 		sa1 = (struct sockaddr *)p;
225 		sa2 = (struct sockaddr *)(p + sa1->sa_len);
226 		if (sizeof(*xisr) + sa1->sa_len + sa2->sa_len !=
227 		    xisr->sadb_x_ipsecrequest_len) {
228 			__ipsec_errcode = EIPSEC_INVAL_ADDRESS;
229 			return NULL;
230 		}
231 		if (set_addresses(abuf, sizeof(abuf), sa1, sa2) != 0) {
232 			__ipsec_errcode = EIPSEC_INVAL_ADDRESS;
233 			return NULL;
234 		}
235 	}
236 
237 	switch (xisr->sadb_x_ipsecrequest_level) {
238 	case IPSEC_LEVEL_DEFAULT:
239 		level = "default";
240 		break;
241 	case IPSEC_LEVEL_USE:
242 		level = "use";
243 		break;
244 	case IPSEC_LEVEL_REQUIRE:
245 		level = "require";
246 		break;
247 	case IPSEC_LEVEL_UNIQUE:
248 		level = "unique";
249 		break;
250 	default:
251 		__ipsec_errcode = EIPSEC_INVAL_LEVEL;
252 		return NULL;
253 	}
254 
255 	if (xisr->sadb_x_ipsecrequest_reqid == 0)
256 		snprintf(buf, len, "%s/%s/%s/%s", proto, mode, abuf, level);
257 	else {
258 		int ch;
259 
260 		if (xisr->sadb_x_ipsecrequest_reqid > IPSEC_MANUAL_REQID_MAX)
261 			ch = '#';
262 		else
263 			ch = ':';
264 		snprintf(buf, len, "%s/%s/%s/%s%c%u", proto, mode, abuf, level,
265 		    ch, xisr->sadb_x_ipsecrequest_reqid);
266 	}
267 
268 	return buf;
269 }
270 
271 static int
set_addresses(char * buf,size_t len,struct sockaddr * sa1,struct sockaddr * sa2)272 set_addresses(char *buf, size_t len, struct sockaddr *sa1, struct sockaddr *sa2)
273 {
274 	char tmp1[NI_MAXHOST], tmp2[NI_MAXHOST];
275 
276 	if (set_address(tmp1, sizeof(tmp1), sa1) == NULL ||
277 	    set_address(tmp2, sizeof(tmp2), sa2) == NULL)
278 		return -1;
279 	if (strlen(tmp1) + 1 + strlen(tmp2) + 1 > len)
280 		return -1;
281 	snprintf(buf, len, "%s-%s", tmp1, tmp2);
282 	return 0;
283 }
284 
285 static char *
set_address(char * buf,size_t len,struct sockaddr * sa)286 set_address(char *buf, size_t len, struct sockaddr *sa)
287 {
288 	const int niflags = NI_NUMERICHOST;
289 
290 	if (len < 1)
291 		return NULL;
292 	buf[0] = '\0';
293 	if (getnameinfo(sa, sa->sa_len, buf, len, NULL, 0, niflags) != 0)
294 		return NULL;
295 	return buf;
296 }
297