ike-cfg: Fix memory leak when matching against ranges
[strongswan.git] / src / libcharon / config / ike_cfg.c
1 /*
2 * Copyright (C) 2012-2017 Tobias Brunner
3 * Copyright (C) 2005-2007 Martin Willi
4 * Copyright (C) 2005 Jan Hutter
5 * Hochschule fuer Technik Rapperswil
6 *
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by the
9 * Free Software Foundation; either version 2 of the License, or (at your
10 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
11 *
12 * This program is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
14 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15 * for more details.
16 */
17
18 #define _GNU_SOURCE /* for stdndup() */
19 #include <string.h>
20
21 #include "ike_cfg.h"
22
23 #include <daemon.h>
24
25 ENUM(ike_version_names, IKE_ANY, IKEV2,
26 "IKEv1/2",
27 "IKEv1",
28 "IKEv2",
29 );
30
31 typedef struct private_ike_cfg_t private_ike_cfg_t;
32
33 /**
34 * Private data of an ike_cfg_t object
35 */
36 struct private_ike_cfg_t {
37
38 /**
39 * Public part
40 */
41 ike_cfg_t public;
42
43 /**
44 * Number of references hold by others to this ike_cfg
45 */
46 refcount_t refcount;
47
48 /**
49 * IKE version to use
50 */
51 ike_version_t version;
52
53 /**
54 * Address list string for local host
55 */
56 char *me;
57
58 /**
59 * Address list string for remote host
60 */
61 char *other;
62
63 /**
64 * Local single host or DNS names, as allocated char*
65 */
66 linked_list_t *my_hosts;
67
68 /**
69 * Remote single host or DNS names, as allocated char*
70 */
71 linked_list_t *other_hosts;
72
73 /**
74 * Local ranges/subnets this config matches to, as traffic_selector_t*
75 */
76 linked_list_t *my_ranges;
77
78 /**
79 * Remote ranges/subnets this config matches to, as traffic_selector_t*
80 */
81 linked_list_t *other_ranges;
82
83 /**
84 * our source port
85 */
86 uint16_t my_port;
87
88 /**
89 * destination port
90 */
91 uint16_t other_port;
92
93 /**
94 * should we send a certificate request?
95 */
96 bool certreq;
97
98 /**
99 * enforce UDP encapsulation
100 */
101 bool force_encap;
102
103 /**
104 * use IKEv1 fragmentation
105 */
106 fragmentation_t fragmentation;
107
108 /**
109 * DSCP value to use on sent IKE packets
110 */
111 uint8_t dscp;
112
113 /**
114 * List of proposals to use
115 */
116 linked_list_t *proposals;
117 };
118
119 METHOD(ike_cfg_t, get_version, ike_version_t,
120 private_ike_cfg_t *this)
121 {
122 return this->version;
123 }
124
125 METHOD(ike_cfg_t, send_certreq, bool,
126 private_ike_cfg_t *this)
127 {
128 return this->certreq;
129 }
130
131 METHOD(ike_cfg_t, force_encap_, bool,
132 private_ike_cfg_t *this)
133 {
134 return this->force_encap;
135 }
136
137 METHOD(ike_cfg_t, fragmentation, fragmentation_t,
138 private_ike_cfg_t *this)
139 {
140 return this->fragmentation;
141 }
142
143 /**
144 * Common function for resolve_me/other
145 */
146 static host_t* resolve(linked_list_t *hosts, int family, uint16_t port)
147 {
148 enumerator_t *enumerator;
149 host_t *host = NULL;
150 bool tried = FALSE;
151 char *str;
152
153 enumerator = hosts->create_enumerator(hosts);
154 while (enumerator->enumerate(enumerator, &str))
155 {
156 host = host_create_from_dns(str, family, port);
157 if (host)
158 {
159 break;
160 }
161 tried = TRUE;
162 }
163 enumerator->destroy(enumerator);
164
165 if (!host && !tried)
166 {
167 /* we have no single host configured, return %any */
168 host = host_create_any(family ?: AF_INET);
169 host->set_port(host, port);
170 }
171 return host;
172 }
173
174 METHOD(ike_cfg_t, resolve_me, host_t*,
175 private_ike_cfg_t *this, int family)
176 {
177 return resolve(this->my_hosts, family, this->my_port);
178 }
179
180 METHOD(ike_cfg_t, resolve_other, host_t*,
181 private_ike_cfg_t *this, int family)
182 {
183 return resolve(this->other_hosts, family, this->other_port);
184 }
185
186 /**
187 * Common function for match_me/other
188 */
189 static u_int match(linked_list_t *hosts, linked_list_t *ranges, host_t *cand)
190 {
191 enumerator_t *enumerator;
192 traffic_selector_t *ts;
193 char *str;
194 host_t *host;
195 uint8_t mask;
196 u_int quality = 0;
197
198 /* try single hosts first */
199 enumerator = hosts->create_enumerator(hosts);
200 while (enumerator->enumerate(enumerator, &str))
201 {
202 host = host_create_from_dns(str, cand->get_family(cand), 0);
203 if (host)
204 {
205 if (host->ip_equals(host, cand))
206 {
207 quality = max(quality, 128 + 1);
208 }
209 if (host->is_anyaddr(host))
210 {
211 quality = max(quality, 1);
212 }
213 host->destroy(host);
214 }
215 }
216 enumerator->destroy(enumerator);
217
218 /* then ranges/subnets */
219 enumerator = ranges->create_enumerator(ranges);
220 while (enumerator->enumerate(enumerator, &ts))
221 {
222 if (ts->includes(ts, cand))
223 {
224 if (ts->to_subnet(ts, &host, &mask))
225 {
226 quality = max(quality, mask + 1);
227 }
228 else
229 {
230 quality = max(quality, 1);
231 }
232 host->destroy(host);
233 }
234 }
235 enumerator->destroy(enumerator);
236
237 return quality;
238 }
239
240 METHOD(ike_cfg_t, match_me, u_int,
241 private_ike_cfg_t *this, host_t *host)
242 {
243 return match(this->my_hosts, this->my_ranges, host);
244 }
245
246 METHOD(ike_cfg_t, match_other, u_int,
247 private_ike_cfg_t *this, host_t *host)
248 {
249 return match(this->other_hosts, this->other_ranges, host);
250 }
251
252 METHOD(ike_cfg_t, get_my_addr, char*,
253 private_ike_cfg_t *this)
254 {
255 return this->me;
256 }
257
258 METHOD(ike_cfg_t, get_other_addr, char*,
259 private_ike_cfg_t *this)
260 {
261 return this->other;
262 }
263
264 METHOD(ike_cfg_t, get_my_port, uint16_t,
265 private_ike_cfg_t *this)
266 {
267 return this->my_port;
268 }
269
270 METHOD(ike_cfg_t, get_other_port, uint16_t,
271 private_ike_cfg_t *this)
272 {
273 return this->other_port;
274 }
275
276 METHOD(ike_cfg_t, get_dscp, uint8_t,
277 private_ike_cfg_t *this)
278 {
279 return this->dscp;
280 }
281
282 METHOD(ike_cfg_t, add_proposal, void,
283 private_ike_cfg_t *this, proposal_t *proposal)
284 {
285 if (proposal)
286 {
287 this->proposals->insert_last(this->proposals, proposal);
288 }
289 }
290
291 METHOD(ike_cfg_t, get_proposals, linked_list_t*,
292 private_ike_cfg_t *this)
293 {
294 enumerator_t *enumerator;
295 proposal_t *current;
296 linked_list_t *proposals;
297
298 proposals = linked_list_create();
299 enumerator = this->proposals->create_enumerator(this->proposals);
300 while (enumerator->enumerate(enumerator, &current))
301 {
302 current = current->clone(current);
303 proposals->insert_last(proposals, current);
304 }
305 enumerator->destroy(enumerator);
306
307 DBG2(DBG_CFG, "configured proposals: %#P", proposals);
308
309 return proposals;
310 }
311
312 METHOD(ike_cfg_t, select_proposal, proposal_t*,
313 private_ike_cfg_t *this, linked_list_t *proposals, bool private,
314 bool prefer_self)
315 {
316 enumerator_t *prefer_enum, *match_enum;
317 proposal_t *proposal, *match, *selected = NULL;
318
319 if (prefer_self)
320 {
321 prefer_enum = this->proposals->create_enumerator(this->proposals);
322 match_enum = proposals->create_enumerator(proposals);
323 }
324 else
325 {
326 prefer_enum = proposals->create_enumerator(proposals);
327 match_enum = this->proposals->create_enumerator(this->proposals);
328 }
329
330 while (prefer_enum->enumerate(prefer_enum, (void**)&proposal))
331 {
332 if (prefer_self)
333 {
334 proposals->reset_enumerator(proposals, match_enum);
335 }
336 else
337 {
338 this->proposals->reset_enumerator(this->proposals, match_enum);
339 }
340 while (match_enum->enumerate(match_enum, (void**)&match))
341 {
342 selected = proposal->select(proposal, match, prefer_self, private);
343 if (selected)
344 {
345 DBG2(DBG_CFG, "received proposals: %#P", proposals);
346 DBG2(DBG_CFG, "configured proposals: %#P", this->proposals);
347 DBG2(DBG_CFG, "selected proposal: %P", selected);
348 break;
349 }
350 }
351 if (selected)
352 {
353 break;
354 }
355 }
356 prefer_enum->destroy(prefer_enum);
357 match_enum->destroy(match_enum);
358 if (!selected)
359 {
360 DBG1(DBG_CFG, "received proposals: %#P", proposals);
361 DBG1(DBG_CFG, "configured proposals: %#P", this->proposals);
362 }
363 return selected;
364 }
365
366 METHOD(ike_cfg_t, get_dh_group, diffie_hellman_group_t,
367 private_ike_cfg_t *this)
368 {
369 enumerator_t *enumerator;
370 proposal_t *proposal;
371 uint16_t dh_group = MODP_NONE;
372
373 enumerator = this->proposals->create_enumerator(this->proposals);
374 while (enumerator->enumerate(enumerator, &proposal))
375 {
376 if (proposal->get_algorithm(proposal, DIFFIE_HELLMAN_GROUP, &dh_group, NULL))
377 {
378 break;
379 }
380 }
381 enumerator->destroy(enumerator);
382 return dh_group;
383 }
384
385 METHOD(ike_cfg_t, equals, bool,
386 private_ike_cfg_t *this, ike_cfg_t *other_public)
387 {
388 private_ike_cfg_t *other = (private_ike_cfg_t*)other_public;
389
390 if (this == other)
391 {
392 return TRUE;
393 }
394 if (this->public.equals != other->public.equals)
395 {
396 return FALSE;
397 }
398 if (!this->proposals->equals_offset(this->proposals, other->proposals,
399 offsetof(proposal_t, equals)))
400 {
401 return FALSE;
402 }
403 return
404 this->version == other->version &&
405 this->certreq == other->certreq &&
406 this->force_encap == other->force_encap &&
407 this->fragmentation == other->fragmentation &&
408 streq(this->me, other->me) &&
409 streq(this->other, other->other) &&
410 this->my_port == other->my_port &&
411 this->other_port == other->other_port;
412 }
413
414 METHOD(ike_cfg_t, get_ref, ike_cfg_t*,
415 private_ike_cfg_t *this)
416 {
417 ref_get(&this->refcount);
418 return &this->public;
419 }
420
421 METHOD(ike_cfg_t, destroy, void,
422 private_ike_cfg_t *this)
423 {
424 if (ref_put(&this->refcount))
425 {
426 this->proposals->destroy_offset(this->proposals,
427 offsetof(proposal_t, destroy));
428 free(this->me);
429 free(this->other);
430 this->my_hosts->destroy_function(this->my_hosts, free);
431 this->other_hosts->destroy_function(this->other_hosts, free);
432 this->my_ranges->destroy_offset(this->my_ranges,
433 offsetof(traffic_selector_t, destroy));
434 this->other_ranges->destroy_offset(this->other_ranges,
435 offsetof(traffic_selector_t, destroy));
436 free(this);
437 }
438 }
439
440 /**
441 * Try to parse a string as subnet
442 */
443 static traffic_selector_t* make_subnet(char *str)
444 {
445 char *pos;
446
447 pos = strchr(str, '/');
448 if (!pos)
449 {
450 return NULL;
451 }
452 return traffic_selector_create_from_cidr(str, 0, 0, 0);
453 }
454
455 /**
456 * Try to parse a string as an IP range
457 */
458 static traffic_selector_t* make_range(char *str)
459 {
460 traffic_selector_t *ts;
461 ts_type_t type;
462 host_t *from, *to;
463
464 if (!host_create_from_range(str, &from, &to))
465 {
466 return NULL;
467 }
468 if (to->get_family(to) == AF_INET)
469 {
470 type = TS_IPV4_ADDR_RANGE;
471 }
472 else
473 {
474 type = TS_IPV6_ADDR_RANGE;
475 }
476 ts = traffic_selector_create_from_bytes(0, type,
477 from->get_address(from), 0,
478 to->get_address(to), 0);
479 from->destroy(from);
480 to->destroy(to);
481 return ts;
482 }
483
484 /**
485 * Parse address string into lists of single hosts and ranges/subnets
486 */
487 static void parse_addresses(char *str, linked_list_t *hosts,
488 linked_list_t *ranges)
489 {
490 enumerator_t *enumerator;
491 traffic_selector_t *ts;
492
493 enumerator = enumerator_create_token(str, ",", " ");
494 while (enumerator->enumerate(enumerator, &str))
495 {
496 ts = make_subnet(str);
497 if (ts)
498 {
499 ranges->insert_last(ranges, ts);
500 continue;
501 }
502 ts = make_range(str);
503 if (ts)
504 {
505 ranges->insert_last(ranges, ts);
506 continue;
507 }
508 hosts->insert_last(hosts, strdup(str));
509 }
510 enumerator->destroy(enumerator);
511 }
512
513 /**
514 * Described in header.
515 */
516 int ike_cfg_get_family(ike_cfg_t *cfg, bool local)
517 {
518 private_ike_cfg_t *this = (private_ike_cfg_t*)cfg;
519 enumerator_t *enumerator;
520 host_t *host;
521 char *str;
522 int family = AF_UNSPEC;
523
524 if (local)
525 {
526 enumerator = this->my_hosts->create_enumerator(this->my_hosts);
527 }
528 else
529 {
530 enumerator = this->other_hosts->create_enumerator(this->other_hosts);
531 }
532 while (enumerator->enumerate(enumerator, &str))
533 {
534 if (streq(str, "%any"))
535 { /* ignore %any as its family is undetermined */
536 continue;
537 }
538 host = host_create_from_string(str, 0);
539 if (host)
540 {
541 if (family == AF_UNSPEC)
542 {
543 family = host->get_family(host);
544 }
545 else if (family != host->get_family(host))
546 {
547 /* more than one address family defined */
548 family = AF_UNSPEC;
549 host->destroy(host);
550 break;
551 }
552 }
553 DESTROY_IF(host);
554 }
555 enumerator->destroy(enumerator);
556 return family;
557 }
558
559 /**
560 * Described in header.
561 */
562 bool ike_cfg_has_address(ike_cfg_t *cfg, host_t *addr, bool local)
563 {
564 private_ike_cfg_t *this = (private_ike_cfg_t*)cfg;
565 enumerator_t *enumerator;
566 host_t *host;
567 char *str;
568 bool found = FALSE;
569
570 if (local)
571 {
572 enumerator = this->my_hosts->create_enumerator(this->my_hosts);
573 }
574 else
575 {
576 enumerator = this->other_hosts->create_enumerator(this->other_hosts);
577 }
578 while (enumerator->enumerate(enumerator, &str))
579 {
580 host = host_create_from_string(str, 0);
581 if (host && addr->ip_equals(addr, host))
582 {
583 found = TRUE;
584 break;
585 }
586 DESTROY_IF(host);
587 }
588 enumerator->destroy(enumerator);
589 return found;
590 }
591
592 /**
593 * Described in header.
594 */
595 ike_cfg_t *ike_cfg_create(ike_version_t version, bool certreq, bool force_encap,
596 char *me, uint16_t my_port,
597 char *other, uint16_t other_port,
598 fragmentation_t fragmentation, uint8_t dscp)
599 {
600 private_ike_cfg_t *this;
601
602 INIT(this,
603 .public = {
604 .get_version = _get_version,
605 .send_certreq = _send_certreq,
606 .force_encap = _force_encap_,
607 .fragmentation = _fragmentation,
608 .resolve_me = _resolve_me,
609 .resolve_other = _resolve_other,
610 .match_me = _match_me,
611 .match_other = _match_other,
612 .get_my_addr = _get_my_addr,
613 .get_other_addr = _get_other_addr,
614 .get_my_port = _get_my_port,
615 .get_other_port = _get_other_port,
616 .get_dscp = _get_dscp,
617 .add_proposal = _add_proposal,
618 .get_proposals = _get_proposals,
619 .select_proposal = _select_proposal,
620 .get_dh_group = _get_dh_group,
621 .equals = _equals,
622 .get_ref = _get_ref,
623 .destroy = _destroy,
624 },
625 .refcount = 1,
626 .version = version,
627 .certreq = certreq,
628 .force_encap = force_encap,
629 .fragmentation = fragmentation,
630 .me = strdup(me),
631 .my_ranges = linked_list_create(),
632 .my_hosts = linked_list_create(),
633 .other = strdup(other),
634 .other_ranges = linked_list_create(),
635 .other_hosts = linked_list_create(),
636 .my_port = my_port,
637 .other_port = other_port,
638 .dscp = dscp,
639 .proposals = linked_list_create(),
640 );
641
642 parse_addresses(me, this->my_hosts, this->my_ranges);
643 parse_addresses(other, this->other_hosts, this->other_ranges);
644
645 return &this->public;
646 }