← Back to branch summary

~ubuntu-branches/ubuntu/hardy/openswan/hardy-updates

« back to all changes in this revision

Viewing changes to programs/pluto/vendor.c

  • Committer: Bazaar Package Importer
  • Author(s): Rene Mayrhofer
  • Date: 2005-01-27 16:10:11 UTC
  • mfrom: (1.1.1 upstream)
  • Revision ID: james.westby@ubuntu.com-20050127161011-idgybmyz3vwhpfiq
Tags: 2.3.0-2
http://bugs.debian.org/292458
http://bugs.debian.org/291143
Urgency HIGH due to security issue and problems with build-deps in sarge.
* Fix the security issue. Please see
  http://www.idefense.com/application/poi/display?id=190&
      type=vulnerabilities&flashstatus=false
  for more details. Thanks to Martin Schulze for informing me about
  this issue.
  Closes: #292458: Openswan XAUTH/PAM Buffer Overflow Vulnerability
* Added a Build-Dependency to lynx.
  Closes: #291143: openswan: FTBFS: Missing build dependency.

Show diffs side-by-side

added added

removed removed

Lines of Context:
programs/pluto/vendor.c
1
 
/* FreeS/WAN ISAKMP VendorID
 
1
/* Openswan ISAKMP VendorID Handling
2
2
 * Copyright (C) 2002-2003 Mathieu Lafon - Arkoon Network Security
 
3
 * Copyright (C) 2004 Xelerance Corporation
3
4
 *
4
5
 * This program is free software; you can redistribute it and/or modify it
5
6
 * under the terms of the GNU General Public License as published by the
11
12
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
12
13
 * for more details.
13
14
 *
14
 
 * RCSID $Id: vendor.c,v 1.5.2.3 2004/06/01 14:42:36 ken Exp $
 
15
 * RCSID $Id: vendor.c,v 1.34 2004/11/30 02:29:07 mcr Exp $
15
16
 */
16
17
 
17
18
#include <stdlib.h>
39
40
#include "vendor.h"
40
41
#include "quirks.h"
41
42
#include "kernel.h"
 
43
#include "state.h"
42
44
 
43
45
#ifdef NAT_TRAVERSAL
44
46
#include "nat_traversal.h"
45
47
#endif
46
48
 
47
49
/**
48
 
 * Unknown/Special VID:
 
50
 * Listing of interesting but details unknown Vendor IDs:
49
51
 *
50
52
 * SafeNet SoftRemote 8.0.0:
51
53
 *  47bbe7c993f1fc13b4e6d0db565c68e5010201010201010310382e302e3020284275696c6420313029000000
62
64
 *  cf49908791073fb46439790fdeb6aeed981101ab0000000500000300
63
65
 *
64
66
 * Cisco:
 
67
 *  1f07f70eaa6514d3b0fa96542a500300 (VPN 3000 version 3.0.0)
 
68
 *  1f07f70eaa6514d3b0fa96542a500301 (VPN 3000 version 3.0.1)
 
69
 *  1f07f70eaa6514d3b0fa96542a500305 (VPN 3000 version 3.0.5)
 
70
 *  1f07f70eaa6514d3b0fa96542a500407 (VPN 3000 version 4.0.7)
 
71
 *  (Can you see the pattern?)
 
72
 *  afcad71368a1f1c96b8696fc77570100 (Non-RFC Dead Peer Detection ?)
65
73
 *  c32364b3b4f447eb17c488ab2a480a57
66
 
 *  1f07f70eaa6514d3b0fa96542a500305
67
 
 *  1f07f70eaa6514d3b0fa96542a500300
68
 
 *  1f07f70eaa6514d3b0fa96542a500301 (VPN 3000 version 3.1 ??)
69
 
 *  afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection ?)
70
74
 *  6d761ddc26aceca1b0ed11fabbb860c4
 
75
 *  5946c258f99a1a57b03eb9d1759e0f24 (From a Cisco VPN 3k)
 
76
 *  ebbc5b00141d0c895e11bd395902d690 (From a Cisco VPN 3k)
71
77
 *
72
78
 * Microsoft L2TP (???):
73
79
 *  47bbe7c993f1fc13b4e6d0db565c68e5010201010201010310382e312e3020284275696c6420313029000000
75
81
 *  3025dbd21062b9e53dc441c6aab5293600000000
76
82
 *  da8e937880010000
77
83
 *
78
 
 * If someone know what they mean, mail me.
 
84
 * 3COM-superstack
 
85
 *    da8e937880010000
 
86
 *    404bf439522ca3f6
 
87
 *
79
88
 */
80
89
 
81
 
#define MAX_LOG_VID_LEN    8
 
90
#define MAX_LOG_VID_LEN            32
82
91
 
83
92
#define VID_KEEP                   0x0000
84
93
#define VID_MD5HASH                0x0001
87
96
 
88
97
#define VID_SUBSTRING_DUMPHEXA     0x0100
89
98
#define VID_SUBSTRING_DUMPASCII    0x0200
90
 
#define VID_SUBSTRING  (VID_SUBSTRING_DUMPHEXA | VID_SUBSTRING_DUMPASCII)
 
99
#define VID_SUBSTRING_MATCH        0x0400
 
100
#define VID_SUBSTRING  (VID_SUBSTRING_DUMPHEXA | VID_SUBSTRING_DUMPASCII | VID_SUBSTRING_MATCH)
91
101
 
92
102
struct vid_struct {
93
103
        enum known_vendorid id;
155
165
        DEC_MD5_VID(SSH_IPSEC_4_2_0,
156
166
                "SSH Communications Security IPSEC Express version 4.2.0")
157
167
 
 
168
 
158
169
        /* note: md5('CISCO-UNITY') = 12f5f28c457168a9702d9fe274cc02d4 */
159
170
        { VID_CISCO_UNITY, VID_KEEP, NULL, "Cisco-Unity",
160
171
                "\x12\xf5\xf2\x8c\x45\x71\x68\xa9\x70\x2d\x9f\xe2\x74\xcc\x01\x00",
161
172
                16 },
162
173
 
 
174
        { VID_CISCO3K, VID_KEEP | VID_SUBSTRING_MATCH, 
 
175
          NULL, "Cisco VPN 3000 Series" , "\x1f\x07\xf7\x0e\xaa\x65\x14\xd3\xb0\xfa\x96\x54\x2a\x50", 14},
 
176
 
163
177
        /**
164
178
         * Timestep VID seen:
165
179
         *   - 54494d455354455020312053475720313532302033313520322e303145303133
177
191
        DEC_FSWAN_VID(FSWAN_2_00_X509_1_3_1_LDAP_VID,
178
192
                "Linux FreeS/WAN 2.00 X.509-1.3.1 LDAP PLUTO_SENDS_VENDORID",
179
193
                "FreeS/WAN 2.00 (X.509-1.3.1 + LDAP)")
 
194
        DEC_FSWAN_VID(OPENSWAN2,
 
195
                "Openswan 2.2.0",
 
196
                "Openswan 2.2.0")
180
197
 
181
198
        /* NAT-Traversal */
182
199
 
191
208
        DEC_MD5_VID(NATT_IETF_03, "draft-ietf-ipsec-nat-t-ike-03")
192
209
        DEC_MD5_VID(NATT_RFC, "Testing NAT-T RFC")
193
210
 
 
211
        DEC_MD5_VID(NATT_DRAFT_IETF_IPSEC_NAT_T_IKE,"draft-ietf-ipsec-nat-t-ike")
 
212
 
194
213
        /* misc */
 
214
 
195
215
        
196
216
        { VID_MISC_XAUTH, VID_KEEP, NULL, "XAUTH",
197
217
                "\x09\x00\x26\x89\xdf\xd6\xb7\x12", 8 },
207
227
        { VID_MISC_HEARTBEAT_NOTIFY, VID_STRING | VID_SUBSTRING_DUMPHEXA,
208
228
                "HeartBeat_Notify", "HeartBeat Notify", NULL, 0 },
209
229
 
 
230
        /**
 
231
         * MacOS X
 
232
         */
 
233
        { VID_MACOSX, VID_STRING|VID_SUBSTRING_DUMPHEXA, "Mac OSX 10.x",
 
234
          "\x4d\xf3\x79\x28\xe9\xfc\x4f\xd1\xb3\x26\x21\x70\xd5\x15\xc6\x62", NULL, 0},
 
235
 
210
236
        DEC_MD5_VID(MISC_FRAGMENTATION, "FRAGMENTATION")
 
237
        DEC_MD5_VID(INITIAL_CONTACT, "Vid-Initial-Contact")
211
238
 
212
239
        /* -- */
213
240
        { 0, 0, NULL, NULL, NULL, 0 }
218
245
 
219
246
static int _vid_struct_init = 0;
220
247
 
 
248
/** 
 
249
 * Setup VendorID structs, and populate them
 
250
 *
 
251
 */
221
252
void init_vendorid(void)
222
253
{
223
254
        struct vid_struct *vid;
236
267
                        vid->vid = vidm;
237
268
                        if (vidm) {
238
269
                                unsigned const char *d = vid->data;
239
 
                                MD5Init(&ctx);
240
 
                                MD5Update(&ctx, d, strlen(vid->data));
241
 
                                MD5Final(vidm, &ctx);
 
270
                                osMD5Init(&ctx);
 
271
                                osMD5Update(&ctx, d, strlen(vid->data));
 
272
                                osMD5Final(vidm, &ctx);
242
273
                                vid->vid_len = MD5_DIGEST_SIZE;
243
274
                        }
244
275
                }
249
280
                        char *vidm =  malloc(FSWAN_VID_SIZE);
250
281
                        vid->vid = vidm;
251
282
                        if (vidm) {
252
 
                                MD5Init(&ctx);
253
 
                                MD5Update(&ctx, vid->data, strlen(vid->data));
254
 
                                MD5Final(hash, &ctx);
 
283
                                osMD5Init(&ctx);
 
284
                                osMD5Update(&ctx, vid->data, strlen(vid->data));
 
285
                                osMD5Final(hash, &ctx);
255
286
                                vidm[0] = 'O';
256
287
                                vidm[1] = 'E';
257
288
#if FSWAN_VID_SIZE - 2 <= MD5_DIGEST_SIZE
284
315
        _vid_struct_init = 1;
285
316
}
286
317
 
287
 
static void handle_known_vendorid (struct msg_digest *md UNUSED,
288
 
        const char *vidstr, size_t len, struct vid_struct *vid)
 
318
 
 
319
/**
 
320
 * Handle Known VendorID's.  This function parses what the remote peer 
 
321
 * sends us, and enables/disables features based on it.  As we go along, 
 
322
 * we set vid_usefull =1 if we did something based on this VendorID.  This
 
323
 * supresses the 'Ignored VendorID ...' log message.
 
324
 *
 
325
 * @param md UNUSED - Deprecated
 
326
 * @param vidstr VendorID String
 
327
 * @param len Length of vidstr
 
328
 * @param vid VendorID Struct (see vendor.h)
 
329
 * @param st State Structure (Hopefully initialized)
 
330
 * @return void
 
331
 */
 
332
static void handle_known_vendorid (struct msg_digest *md UNUSED
 
333
                                   , const char *vidstr
 
334
                                   , size_t len
 
335
                                   , struct vid_struct *vid
 
336
                                   , struct state *st UNUSED)
289
337
{
290
338
        char vid_dump[128];
291
339
        int vid_usefull = 0;
293
341
 
294
342
        switch (vid->id) {
295
343
#ifdef NAT_TRAVERSAL
296
 
                /*
297
 
                 * Use most recent supported NAT-Traversal method and ignore the
298
 
                 * other ones (implementations will send all supported methods but
299
 
                 * only one will be used)
 
344
                /**
 
345
                 * Use most recent supported NAT-Traversal method and ignore
 
346
                 * the other ones (implementations will send all supported
 
347
                 * methods but only one will be used)
300
348
                 *
301
349
                 * Note: most recent == higher id in vendor.h
302
350
                 */
313
361
                case VID_NATT_IETF_03:
314
362
                case VID_NATT_RFC:
315
363
                        vid_usefull = 1;
316
 
                        if ((nat_traversal_support_port_floating) &&
317
 
                                (md->quirks.nat_traversal_vid < vid->id)) {
318
 
                                md->quirks.nat_traversal_vid = vid->id;
319
 
                        } else {
 
364
                        if(!nat_traversal_support_port_floating) {
320
365
                          loglog(RC_LOG_SERIOUS
321
 
                                 , "received Vendor ID payload [%s] meth=%d, but already using method %d"
322
 
                                 , vid->descr, vid->id, md->quirks.nat_traversal_vid);
 
366
                                 , "received Vendor ID payload [%s] meth=%d, "
 
367
                                 "but port floating is off"
 
368
                                 , vid->descr, vid->id);
323
369
                          return;
 
370
                        } else {
 
371
                          if (md->quirks.nat_traversal_vid < vid->id) {
 
372
                            loglog(RC_LOG_SERIOUS
 
373
                                   , "received Vendor ID payload [%s] method set to=%d "
 
374
                                   , vid->descr, vid->id);
 
375
                            md->quirks.nat_traversal_vid = vid->id;
 
376
                            return;
 
377
                          } else {
 
378
                            loglog(RC_LOG_SERIOUS
 
379
                                   , "received Vendor ID payload [%s] meth=%d, "
 
380
                                   "but already using method %d"
 
381
                                   , vid->descr, vid->id
 
382
                                   , md->quirks.nat_traversal_vid);
 
383
                            return;
 
384
                          }
324
385
                        }
325
386
                        break;
326
387
#endif
 
388
 
 
389
        case VID_MISC_DPD:
 
390
            /* Remote side would like to do DPD with us on this connection */
 
391
            md->dpd = 1;
 
392
            vid_usefull = 1;
 
393
            break;
 
394
 
 
395
/* We only need these when dealing with XAUTH */
 
396
#ifdef XAUTH
327
397
        case VID_SSH_SENTINEL_1_4_1:
328
 
          loglog(RC_LOG_SERIOUS, "SSH Sentinel 1.4.1 found, setting XAUTH_ACK quirk");
 
398
          loglog(RC_LOG_SERIOUS
 
399
                 , "SSH Sentinel 1.4.1 found, setting XAUTH_ACK quirk");
329
400
          md->quirks.xauth_ack_msgid = TRUE;
330
401
          vid_usefull = 1;
331
402
          break;
332
403
 
 
404
        case VID_CISCO_UNITY:
 
405
          md->quirks.modecfg_pull_mode= TRUE;
 
406
          vid_usefull = 1;
 
407
          break;
 
408
 
333
409
        case VID_MISC_XAUTH:
334
410
            vid_usefull=1;
335
411
            break;
 
412
#endif
336
413
            
337
414
        default:
338
415
            break;
367
444
                vid_usefull ? "received" : "ignoring", vid_dump);
368
445
}
369
446
 
370
 
void handle_vendorid (struct msg_digest *md, const char *vid, size_t len)
 
447
 
 
448
/**
 
449
 * Handle VendorID's.  This function parses what the remote peer 
 
450
 * sends us, calls handle_known_vendorid on each VID we received
 
451
 *
 
452
 * Known VendorID's are defined in vendor.h
 
453
 *
 
454
 * @param md Message Digest from remote peer
 
455
 * @param vid String of VendorIDs
 
456
 * @param len Length of vid
 
457
 * @param vid VendorID Struct (see vendor.h)
 
458
 * @param st State Structure (Hopefully initialized)
 
459
 * @return void
 
460
 */
 
461
void handle_vendorid (struct msg_digest *md, const char *vid, size_t len, struct state *st)
371
462
{
372
463
        struct vid_struct *pvid;
373
464
 
382
473
                if (pvid->vid && vid && pvid->vid_len && len) {
383
474
                        if (pvid->vid_len == len) {
384
475
                                if (memcmp(pvid->vid, vid, len)==0) {
385
 
                                        handle_known_vendorid(md, vid, len, pvid);
 
476
                                        handle_known_vendorid(md, vid
 
477
                                                              , len, pvid, st);
386
478
                                        return;
387
479
                                }
388
480
                        }
389
 
                        else if ((pvid->vid_len < len) && (pvid->flags & VID_SUBSTRING)) {
 
481
                        else if ((pvid->vid_len < len)
 
482
                                 && (pvid->flags & VID_SUBSTRING)) {
390
483
                                if (memcmp(pvid->vid, vid, pvid->vid_len)==0) {
391
 
                                        handle_known_vendorid(md, vid, len, pvid);
 
484
                                        handle_known_vendorid(md, vid, len
 
485
                                                              , pvid, st);
392
486
                                        return;
393
487
                                }
394
488
                        }
406
500
                        log_vid[2*i] = _hexdig[(vid[i] >> 4) & 0xF];
407
501
                        log_vid[2*i+1] = _hexdig[vid[i] & 0xF];
408
502
                }
409
 
                loglog(RC_LOG_SERIOUS, "ignoring Vendor ID payload [%s%s]",
 
503
                loglog(RC_LOG_SERIOUS, "ignoring unknown Vendor ID payload [%s%s]",
410
504
                        log_vid, (len>MAX_LOG_VID_LEN) ? "..." : "");
411
505
        }
412
506
}
413
507
 
414
508
/**
415
509
 * Add a vendor id payload to the msg
 
510
 *
 
511
 * @param np
 
512
 * @param outs PB stream
 
513
 * @param vid Int of VendorID to be sent (see vendor.h for the list)
 
514
 * @return bool True if successful
416
515
 */
417
516
bool out_vendorid (u_int8_t np, pb_stream *outs, unsigned int vid)
418
517
{