Merge with EOM 1.132

author: niklas
style

author: angelos
Make sure the LIFE_DURATION length is 2 or 4 bytes (we don't handle
anything else, although we could extend it to handle anything up to 8
bytes).

author: provos
dont crash when isakmp sa keystate = 0; happens when encountering high
packet loss.

author: ho
ipsec_decode_ids is only used with USE_DEBUG

author: provos
style as pointed out by the code style pedant.

author: provos
proper reference counting for isakmp_sa in struct message, remove bogus
calls to sa_reference; fix some more memory leaks in conf.c

1 files changed, 24 insertions, 15 deletions

diff --git a/sbin/isakmpd/ipsec.c b/sbin/isakmpd/ipsec.c
index 7903e6cc919..dc416e73cbc 100644
--- a/sbin/isakmpd/ipsec.c
+++ b/sbin/isakmpd/ipsec.c
@@ -1,5 +1,5 @@
-/*	$OpenBSD: ipsec.c,v 1.27 2000/08/03 07:24:58 niklas Exp $	*/
-/*	$EOM: ipsec.c,v 1.126 2000/07/13 20:05:07 angelos Exp $	*/
+/*	$OpenBSD: ipsec.c,v 1.28 2000/10/07 06:58:47 niklas Exp $	*/
+/*	$EOM: ipsec.c,v 1.132 2000/10/06 23:49:39 niklas Exp $	*/
 
 /*
  * Copyright (c) 1998, 1999, 2000 Niklas Hallqvist.  All rights reserved.
@@ -152,7 +152,9 @@ static struct doi ipsec_doi = {
   ipsec_validate_transform_id,
   ipsec_initiator,
   ipsec_responder,
+#ifdef USE_DEBUG
   ipsec_decode_ids
+#endif
 };
 
 int16_t script_quick_mode[] = {
@@ -481,6 +483,12 @@ ipsec_get_keystate (struct message *msg)
    * the ISAKMP SA concatenated with the message ID, and use that as an
    * IV for further cryptographic operations.
    */
+  if (!msg->isakmp_sa->keystate)
+    {
+      log_print ("ipsec_get_keystate: no keystate in ISAKMP SA %p",
+		 msg->isakmp_sa);
+      return 0;
+    }
   ks = crypto_clone_keystate (msg->isakmp_sa->keystate);
   if (!ks)
     return 0;
@@ -551,7 +559,7 @@ ipsec_validate_id_information (u_int8_t type, u_int8_t *extra, u_int8_t *buf,
   u_int8_t proto = GET_IPSEC_ID_PROTO (extra);
   u_int16_t port = GET_IPSEC_ID_PORT (extra);
 
-  LOG_DBG ((LOG_MESSAGE, 0, 
+  LOG_DBG ((LOG_MESSAGE, 0,
 	    "ipsec_validate_id_information: proto %d port %d type %d",
 	    proto, port, type));
   if (type < IPSEC_ID_IPV4_ADDR || type > IPSEC_ID_KEY_ID)
@@ -686,7 +694,7 @@ ipsec_initiator (struct message *msg)
 		 exchange->type, exchange->phase);
       return -1;
     }
-    
+
   switch (exchange->type)
     {
     case ISAKMP_EXCH_ID_PROT:
@@ -732,7 +740,7 @@ ipsec_responder (struct message *msg)
       message_drop (msg, ISAKMP_NOTIFY_UNSUPPORTED_EXCHANGE_TYPE, 0, 1, 0);
       return -1;
     }
-    
+
   LOG_DBG ((LOG_MISC, 30,
 	    "ipsec_responder: phase %d exchange %d step %d", exchange->phase,
 	    exchange->type, exchange->step));
@@ -848,7 +856,7 @@ ipsec_is_attribute_incompatible (u_int16_t type, u_int8_t *value,
 	  return decode_16 (value) < IKE_DURATION_SECONDS
 	    || decode_16 (value) > IKE_DURATION_KILOBYTES;
 	case IKE_ATTR_LIFE_DURATION:
-	  return 0;
+	  return len != 2 && len != 4;
 	case IKE_ATTR_PRF:
 	  return 1;
 	case IKE_ATTR_KEY_LENGTH:
@@ -856,7 +864,7 @@ ipsec_is_attribute_incompatible (u_int16_t type, u_int8_t *value,
 	   * Our crypto routines only allows key-lengths which are multiples
 	   * of an octet.
 	   */
-	  return decode_16 (value) % 8 != 0; 
+	  return decode_16 (value) % 8 != 0;
 	case IKE_ATTR_FIELD_SIZE:
 	  return 1;
 	case IKE_ATTR_GROUP_ORDER:
@@ -871,7 +879,7 @@ ipsec_is_attribute_incompatible (u_int16_t type, u_int8_t *value,
 	  return decode_16 (value) < IPSEC_DURATION_SECONDS
 	    || decode_16 (value) > IPSEC_DURATION_KILOBYTES;
 	case IPSEC_ATTR_SA_LIFE_DURATION:
-	  return 0;
+	  return len != 2 && len != 4;
 	case IPSEC_ATTR_GROUP_DESCRIPTION:
 	  return decode_16 (value) < IKE_GROUP_DESC_MODP_768
 	    || decode_16 (value) > IKE_GROUP_DESC_MODP_1536;
@@ -1278,7 +1286,7 @@ ipsec_handle_leftover_payload (struct message *msg, u_int8_t type,
 	       * over it, so it's obviously still active. We temporarily need
                * to remove the SA from the list to avoid an endless loop.
 	       */
-		   
+
 	      if (sa == msg->isakmp_sa)
 	        {
                   LIST_REMOVE (sa, link);
@@ -1502,7 +1510,7 @@ ipsec_ipv4toa (char *buf, size_t size, u_int8_t *addr)
 		  buf, size, NULL, 0, NI_NUMERICHOST) != 0)
     {
       log_error("ipsec_ipv4toa: getnameinfo() failed");
-      strcpy(buf, "<error>");
+      strcpy (buf, "<error>");
     }
 }
 
@@ -1533,7 +1541,7 @@ ipsec_decode_id (u_int8_t *buf, int size, u_int8_t *id, size_t id_len,
 	case IPSEC_ID_IPV4_ADDR_SUBNET:
 	  ipsec_ipv4toa (ntop, sizeof(ntop), id + ISAKMP_ID_DATA_OFF);
 	  ipsec_ipv4toa (ntop2, sizeof(ntop2), id + ISAKMP_ID_DATA_OFF + 4);
-	  snprintf (buf, size, "%08x/%08x: %s/%s", 
+	  snprintf (buf, size, "%08x/%08x: %s/%s",
 		    decode_32 (id + ISAKMP_ID_DATA_OFF),
 		    decode_32 (id + ISAKMP_ID_DATA_OFF + 4),
 		    ntop, ntop2);
@@ -1553,7 +1561,7 @@ ipsec_decode_id (u_int8_t *buf, int size, u_int8_t *id, size_t id_len,
 	}
     }
   else
-    strlcpy(buf, "<noid>", size);
+    strlcpy (buf, "<noid>", size);
 }
 
 char *
@@ -1606,7 +1614,7 @@ ipsec_build_id (char *section, size_t *sz)
 
   SET_ISAKMP_ID_TYPE (p, id);
   SET_ISAKMP_ID_DOI_DATA (p, "\000\000\000");
-  
+
   switch (id)
     {
     case IPSEC_ID_IPV4_ADDR:
@@ -1639,15 +1647,16 @@ ipsec_clone_id (u_int8_t **did, size_t *did_len, u_int8_t *id, size_t id_len)
     }
 
   *did = malloc (id_len);
-  if (*did == NULL) 
+  if (*did == NULL)
     {
+      *did_len = 0;
       log_error ("ipsec_clone_id: malloc(%d) failed", id_len);
       return -1;
     }
 
   *did_len = id_len;
   memcpy (*did, id, id_len);
-    
+
   return 0;
 }