/*      $NetBSD: sainfo.c,v 1.17 2025/03/07 15:55:29 christos Exp $     */

/*      $KAME: sainfo.c,v 1.16 2003/06/27 07:32:39 sakane Exp $ */

/*
 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
 * All rights reserved.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the project nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 * 
 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#include "config.h"

#include <sys/param.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/queue.h>

#include <netinet/in.h>
#include <netinet/in.h> 
#include PATH_IPSEC_H

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>

#include "var.h"
#include "misc.h"
#include "vmbuf.h"
#include "plog.h"
#include "sockmisc.h"
#include "debug.h"

#include "localconf.h"
#include "isakmp_var.h"
#include "isakmp.h"
#include "ipsec_doi.h"
#include "oakley.h"
#include "handler.h"
#include "algorithm.h"
#include "sainfo.h"
#include "gcmalloc.h"

typedef LIST_HEAD(_sitree, sainfo) sainfo_tailq_head_t;
static sainfo_tailq_head_t sitree, sitree_save;

/* %%%
 * modules for ipsec sa info
 */
/*
 * return matching entry.
 * no matching entry found and if there is anonymous entry, return it.
 * else return NULL.
 * First pass is for sainfo from a specified peer, second for others.
 */
struct sainfo *
getsainfo(const vchar_t *loc, const vchar_t *rmt, const vchar_t *peer,
    const vchar_t *client, uint32_t remoteid)
{
        struct sainfo *s = NULL;

        /* debug level output */
        if(loglevel >= LLV_DEBUG) {
                char *dloc, *drmt, *dpeer, *dclient;

                if (loc == NULL)
                        dloc = strdup("ANONYMOUS");
                else
                        dloc = ipsecdoi_id2str(loc);

                if (rmt == SAINFO_ANONYMOUS)
                        drmt = strdup("ANONYMOUS");
                else if (rmt == SAINFO_CLIENTADDR)
                        drmt = strdup("CLIENTADDR");
                else
                        drmt = ipsecdoi_id2str(rmt);

                if (peer == NULL)
                        dpeer = strdup("NULL");
                else
                        dpeer = ipsecdoi_id2str(peer);

                if (client == NULL)
                        dclient = strdup("NULL");
                else
                        dclient = ipsecdoi_id2str(client);

                plog(LLV_DEBUG, LOCATION, NULL,
                        "getsainfo params: loc=\'%s\' rmt=\'%s\' peer=\'%s\' client=\'%s\' id=%u\n",
                        dloc, drmt, dpeer, dclient, remoteid );
 
                racoon_free(dloc);
                racoon_free(drmt);
                racoon_free(dpeer);
                racoon_free(dclient);
        }

        LIST_FOREACH(s, &sitree, chain) {
                const char *sainfostr = sainfo2str(s);
                plog(LLV_DEBUG, LOCATION, NULL,
                        "evaluating sainfo: %s\n", sainfostr);

                if(s->remoteid != remoteid) {
                        plog(LLV_DEBUG, LOCATION, NULL,
                                "remoteid mismatch: %u != %u\n",
                                s->remoteid, remoteid);
                                continue;
                }

                /* compare 'from' id value */
                if (s->id_i != NULL)
                        if (ipsecdoi_chkcmpids(peer, s->id_i, 0))
                                continue;

                /* compare ids - client */
                if( s->iddst == SAINFO_CLIENTADDR ) {
                        /*
                         * This sainfo section enforces client address
                         * checking. Prevent match if the client value
                         * ( modecfg or tunnel address ) is NULL.
                         */

                        if (client == NULL)
                                continue;

                        if( rmt == SAINFO_CLIENTADDR ) {
                                /*
                                 * In the case where a supplied rmt value is
                                 * also SAINFO_CLIENTADDR, we are comparing
                                 * with another sainfo to check for duplicate.
                                 * Only compare the local values to determine
                                 * a match.
                                 */

                                 if (!ipsecdoi_chkcmpids(loc, s->idsrc, 0))
                                        return s;
                        }
                        else {
                                /*
                                 * In the case where a supplied rmt value is
                                 * not SAINFO_CLIENTADDR, do a standard match
                                 * for local values and enforce that the rmt
                                 * id matches the client address value.
                                 */

                                if (!ipsecdoi_chkcmpids(loc, s->idsrc, 0) &&
                                    !ipsecdoi_chkcmpids(rmt, client, 0))
                                        return s;
                        }

                        continue;
                }


                /* compare ids - standard */
                if (!ipsecdoi_chkcmpids(loc, s->idsrc, 0) &&
                    !ipsecdoi_chkcmpids(rmt, s->iddst, 0))
                        return s;
        }

        return NULL;
}

struct sainfo *
newsainfo()
{
        struct sainfo *new;

        new = racoon_calloc(1, sizeof(*new));
        if (new == NULL)
                return NULL;

        new->lifetime = IPSECDOI_ATTR_SA_LD_SEC_DEFAULT;
        new->lifebyte = IPSECDOI_ATTR_SA_LD_KB_MAX;

        return new;
}

void
delsainfo(struct sainfo *si)
{
        int i;

        if (si == NULL)
                return;

        for (i = 0; i < MAXALGCLASS; i++)
                delsainfoalg(si->algs[i]);

        if (si->idsrc)
                vfree(si->idsrc);
        if (si->iddst != NULL &&
                si->iddst != SAINFO_CLIENTADDR)
                vfree(si->iddst);

#ifdef ENABLE_HYBRID
        if (si->group)
                vfree(si->group);
#endif

        racoon_free(si);
}

static int
prisainfo(struct sainfo *s)
{
        /*
         * determine the matching priority
         * of an sainfo section
         */

        int pri = 0;

        if(s->remoteid)
                pri += 3;

        if(s->id_i)
                pri += 3;

        if(s->idsrc)
                pri++;

        if(s->iddst)
                pri++;

        return pri;
}

void
inssainfo(struct sainfo *new)
{
        if(LIST_EMPTY(&sitree)) {

                /* first in list */
                LIST_INSERT_HEAD(&sitree, new, chain);
        }
        else {
                int npri, spri;
                struct sainfo *s, *n;

                /*
                 * insert our new sainfo section
                 * into our list which is sorted
                 * based on the match priority
                 */

                npri = prisainfo(new);

                s = LIST_FIRST(&sitree);
                for (;;) {

                        spri = prisainfo(s);
                        n = LIST_NEXT(s, chain);

                        if(npri > spri)
                        {
                                /* higher priority */
                                LIST_INSERT_BEFORE(s, new, chain);
                                return;
                        }

                        if(n == NULL)
                        {
                                /* last in list */
                                LIST_INSERT_AFTER(s, new, chain);
                                return;
                        }

                        s = n;
                }
        }
}

void
remsainfo(struct sainfo *si)
{
        LIST_REMOVE(si, chain);
}

void
flushsainfo()
{
        struct sainfo *s, *next;

        for (s = LIST_FIRST(&sitree); s; s = next) {
                next = LIST_NEXT(s, chain);
                remsainfo(s);
                delsainfo(s);
        }
}

void
initsainfo()
{
        LIST_INIT(&sitree);
}

struct sainfoalg *
newsainfoalg()
{
        struct sainfoalg *new;

        new = racoon_calloc(1, sizeof(*new));
        if (new == NULL)
                return NULL;

        return new;
}

void
delsainfoalg(struct sainfoalg *alg)
{
        struct sainfoalg *a, *next;

        for (a = alg; a; a = next) {
                next = a->next;
                racoon_free(a);
        }
}

void
inssainfoalg(struct sainfoalg **head, struct sainfoalg *new)
{
        struct sainfoalg *a;

        for (a = *head; a && a->next; a = a->next)
                ;
        if (a)
                a->next = new;
        else
                *head = new;
}

const char *
sainfo2str(const struct sainfo *si)
{
        static char buf[256];

        char *idloc = NULL, *idrmt = NULL, *id_i;
 
        if (si->idsrc == SAINFO_ANONYMOUS)
                idloc = strdup("ANONYMOUS");
        else
                idloc = ipsecdoi_id2str(si->idsrc);
 
        if (si->iddst == SAINFO_ANONYMOUS)
                idrmt = strdup("ANONYMOUS");
        else if (si->iddst == SAINFO_CLIENTADDR)
                idrmt = strdup("CLIENTADDR");
        else
                idrmt = ipsecdoi_id2str(si->iddst);
 
        if (si->id_i == NULL)
                id_i = strdup("ANY");
        else
                id_i = ipsecdoi_id2str(si->id_i);
 
        snprintf(buf, 255, "loc=\'%s\', rmt=\'%s\', peer=\'%s\', id=%u",
                idloc, idrmt, id_i, si->remoteid);
 
        racoon_free(idloc);
        racoon_free(idrmt);
        racoon_free(id_i);
 
        return buf;
}

void sainfo_start_reload(void){
        sitree_save=sitree;
        initsainfo();
}

void sainfo_finish_reload(void){
        sainfo_tailq_head_t sitree_tmp;

        sitree_tmp=sitree;
        sitree=sitree_save;
        flushsainfo();
        sitree=sitree_tmp;
}

void save_sainfotree_restore(void){
        flushsainfo();
        sitree=sitree_save;
}