xref: /freebsd/sbin/setkey/parse.y (revision 3c6e15bceeab4470243c60c9a4b5b9cafca9abaa) 
1 /*	$FreeBSD$	*/
2 /*	$KAME: parse.y,v 1.83 2004/05/18 08:48:23 sakane Exp $	*/
3 
4 /*
5  * Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 %{
34 #include <sys/types.h>
35 #include <sys/param.h>
36 #include <sys/socket.h>
37 
38 #include <net/route.h>
39 #include <netinet/in.h>
40 #include <net/pfkeyv2.h>
41 #include <netipsec/key_var.h>
42 #include <netipsec/ipsec.h>
43 #include <arpa/inet.h>
44 
45 #include <string.h>
46 #include <unistd.h>
47 #include <stdio.h>
48 #include <netdb.h>
49 #include <ctype.h>
50 #include <errno.h>
51 
52 #include "libpfkey.h"
53 #include "vchar.h"
54 
55 #define ATOX(c) \
56   (isdigit(c) ? (c - '0') : (isupper(c) ? (c - 'A' + 10) : (c - 'a' + 10)))
57 
58 u_int32_t p_spi;
59 u_int p_ext, p_alg_enc, p_alg_auth, p_replay, p_mode;
60 u_int32_t p_reqid;
61 u_int p_key_enc_len, p_key_auth_len;
62 caddr_t p_key_enc, p_key_auth;
63 time_t p_lt_hard, p_lt_soft;
64 
65 static int p_aiflags = 0, p_aifamily = PF_UNSPEC;
66 
67 static struct addrinfo *parse_addr(char *, char *);
68 static int fix_portstr(vchar_t *, vchar_t *, vchar_t *);
69 static int setvarbuf(char *, int *, struct sadb_ext *, int, caddr_t, int);
70 void parse_init(void);
71 void free_buffer(void);
72 
73 int setkeymsg0(struct sadb_msg *, unsigned int, unsigned int, size_t);
74 static int setkeymsg_spdaddr(unsigned int, unsigned int, vchar_t *,
75 	struct addrinfo *, int, struct addrinfo *, int);
76 static int setkeymsg_addr(unsigned int, unsigned int,
77 	struct addrinfo *, struct addrinfo *, int);
78 static int setkeymsg_add(unsigned int, unsigned int,
79 	struct addrinfo *, struct addrinfo *);
80 extern int setkeymsg(char *, size_t *);
81 extern int sendkeymsg(char *, size_t);
82 
83 extern int yylex(void);
84 extern void yyfatal(const char *);
85 extern void yyerror(const char *);
86 %}
87 
88 %union {
89 	int num;
90 	unsigned long ulnum;
91 	vchar_t val;
92 	struct addrinfo *res;
93 }
94 
95 %token EOT SLASH BLCL ELCL
96 %token ADD GET DELETE DELETEALL FLUSH DUMP
97 %token PR_ESP PR_AH PR_IPCOMP PR_TCP
98 %token F_PROTOCOL F_AUTH F_ENC F_REPLAY F_COMP F_RAWCPI
99 %token F_MODE MODE F_REQID
100 %token F_EXT EXTENSION NOCYCLICSEQ
101 %token ALG_AUTH ALG_AUTH_NOKEY
102 %token ALG_ENC ALG_ENC_NOKEY ALG_ENC_DESDERIV ALG_ENC_DES32IV ALG_ENC_OLD
103 %token ALG_COMP
104 %token F_LIFETIME_HARD F_LIFETIME_SOFT
105 %token DECSTRING QUOTEDSTRING HEXSTRING STRING ANY
106 	/* SPD management */
107 %token SPDADD SPDDELETE SPDDUMP SPDFLUSH
108 %token F_POLICY PL_REQUESTS
109 %token F_AIFLAGS
110 %token TAGGED
111 
112 %type <num> prefix protocol_spec upper_spec
113 %type <num> ALG_ENC ALG_ENC_DESDERIV ALG_ENC_DES32IV ALG_ENC_OLD ALG_ENC_NOKEY
114 %type <num> ALG_AUTH ALG_AUTH_NOKEY
115 %type <num> ALG_COMP
116 %type <num> PR_ESP PR_AH PR_IPCOMP PR_TCP
117 %type <num> EXTENSION MODE
118 %type <ulnum> DECSTRING
119 %type <val> PL_REQUESTS portstr key_string
120 %type <val> policy_requests
121 %type <val> QUOTEDSTRING HEXSTRING STRING
122 %type <val> F_AIFLAGS
123 %type <val> upper_misc_spec policy_spec
124 %type <res> ipaddr
125 
126 %%
127 commands
128 	:	/*NOTHING*/
129 	|	commands command
130 		{
131 			free_buffer();
132 			parse_init();
133 		}
134 	;
135 
136 command
137 	:	add_command
138 	|	get_command
139 	|	delete_command
140 	|	deleteall_command
141 	|	flush_command
142 	|	dump_command
143 	|	spdadd_command
144 	|	spddelete_command
145 	|	spddump_command
146 	|	spdflush_command
147 	;
148 	/* commands concerned with management, there is in tail of this file. */
149 
150 	/* add command */
151 add_command
152 	:	ADD ipaddropts ipaddr ipaddr protocol_spec spi extension_spec algorithm_spec EOT
153 		{
154 			int status;
155 
156 			status = setkeymsg_add(SADB_ADD, $5, $3, $4);
157 			if (status < 0)
158 				return -1;
159 		}
160 	;
161 
162 	/* delete */
163 delete_command
164 	:	DELETE ipaddropts ipaddr ipaddr protocol_spec spi extension_spec EOT
165 		{
166 			int status;
167 
168 			if ($3->ai_next || $4->ai_next) {
169 				yyerror("multiple address specified");
170 				return -1;
171 			}
172 			if (p_mode != IPSEC_MODE_ANY)
173 				yyerror("WARNING: mode is obsolete");
174 
175 			status = setkeymsg_addr(SADB_DELETE, $5, $3, $4, 0);
176 			if (status < 0)
177 				return -1;
178 		}
179 	;
180 
181 	/* deleteall command */
182 deleteall_command
183 	:	DELETEALL ipaddropts ipaddr ipaddr protocol_spec EOT
184 		{
185 			int status;
186 
187 			status = setkeymsg_addr(SADB_DELETE, $5, $3, $4, 1);
188 			if (status < 0)
189 				return -1;
190 		}
191 	;
192 
193 	/* get command */
194 get_command
195 	:	GET ipaddropts ipaddr ipaddr protocol_spec spi extension_spec EOT
196 		{
197 			int status;
198 
199 			if (p_mode != IPSEC_MODE_ANY)
200 				yyerror("WARNING: mode is obsolete");
201 
202 			status = setkeymsg_addr(SADB_GET, $5, $3, $4, 0);
203 			if (status < 0)
204 				return -1;
205 		}
206 	;
207 
208 	/* flush */
209 flush_command
210 	:	FLUSH protocol_spec EOT
211 		{
212 			struct sadb_msg msg;
213 			setkeymsg0(&msg, SADB_FLUSH, $2, sizeof(msg));
214 			sendkeymsg((char *)&msg, sizeof(msg));
215 		}
216 	;
217 
218 	/* dump */
219 dump_command
220 	:	DUMP protocol_spec EOT
221 		{
222 			struct sadb_msg msg;
223 			setkeymsg0(&msg, SADB_DUMP, $2, sizeof(msg));
224 			sendkeymsg((char *)&msg, sizeof(msg));
225 		}
226 	;
227 
228 protocol_spec
229 	:	/*NOTHING*/
230 		{
231 			$$ = SADB_SATYPE_UNSPEC;
232 		}
233 	|	PR_ESP
234 		{
235 			$$ = SADB_SATYPE_ESP;
236 			if ($1 == 1)
237 				p_ext |= SADB_X_EXT_OLD;
238 			else
239 				p_ext &= ~SADB_X_EXT_OLD;
240 		}
241 	|	PR_AH
242 		{
243 			$$ = SADB_SATYPE_AH;
244 			if ($1 == 1)
245 				p_ext |= SADB_X_EXT_OLD;
246 			else
247 				p_ext &= ~SADB_X_EXT_OLD;
248 		}
249 	|	PR_IPCOMP
250 		{
251 			$$ = SADB_X_SATYPE_IPCOMP;
252 		}
253 	|	PR_TCP
254 		{
255 			$$ = SADB_X_SATYPE_TCPSIGNATURE;
256 		}
257 	;
258 
259 spi
260 	:	DECSTRING { p_spi = $1; }
261 	|	HEXSTRING
262 		{
263 			char *ep;
264 			unsigned long v;
265 
266 			ep = NULL;
267 			v = strtoul($1.buf, &ep, 16);
268 			if (!ep || *ep) {
269 				yyerror("invalid SPI");
270 				return -1;
271 			}
272 			if (v & ~0xffffffff) {
273 				yyerror("SPI too big.");
274 				return -1;
275 			}
276 
277 			p_spi = v;
278 		}
279 	;
280 
281 algorithm_spec
282 	:	esp_spec
283 	|	ah_spec
284 	|	ipcomp_spec
285 	;
286 
287 esp_spec
288 	:	F_ENC enc_alg F_AUTH auth_alg
289 	|	F_ENC enc_alg
290 	;
291 
292 ah_spec
293 	:	F_AUTH auth_alg
294 	;
295 
296 ipcomp_spec
297 	:	F_COMP ALG_COMP
298 		{
299 			if ($2 < 0) {
300 				yyerror("unsupported algorithm");
301 				return -1;
302 			}
303 			p_alg_enc = $2;
304 		}
305 	|	F_COMP ALG_COMP F_RAWCPI
306 		{
307 			if ($2 < 0) {
308 				yyerror("unsupported algorithm");
309 				return -1;
310 			}
311 			p_alg_enc = $2;
312 			p_ext |= SADB_X_EXT_RAWCPI;
313 		}
314 	;
315 
316 enc_alg
317 	:	ALG_ENC_NOKEY {
318 			if ($1 < 0) {
319 				yyerror("unsupported algorithm");
320 				return -1;
321 			}
322 			p_alg_enc = $1;
323 
324 			p_key_enc_len = 0;
325 			p_key_enc = NULL;
326 			if (ipsec_check_keylen(SADB_EXT_SUPPORTED_ENCRYPT,
327 			    p_alg_enc, PFKEY_UNUNIT64(p_key_enc_len)) < 0) {
328 				yyerror(ipsec_strerror());
329 				return -1;
330 			}
331 		}
332 	|	ALG_ENC key_string {
333 			if ($1 < 0) {
334 				yyerror("unsupported algorithm");
335 				return -1;
336 			}
337 			p_alg_enc = $1;
338 
339 			p_key_enc_len = $2.len;
340 			p_key_enc = $2.buf;
341 			if (ipsec_check_keylen(SADB_EXT_SUPPORTED_ENCRYPT,
342 			    p_alg_enc, PFKEY_UNUNIT64(p_key_enc_len)) < 0) {
343 				yyerror(ipsec_strerror());
344 				return -1;
345 			}
346 		}
347 	|	ALG_ENC_OLD {
348 			if ($1 < 0) {
349 				yyerror("unsupported algorithm");
350 				return -1;
351 			}
352 			yyerror("WARNING: obsolete algorithm");
353 			p_alg_enc = $1;
354 
355 			p_key_enc_len = 0;
356 			p_key_enc = NULL;
357 			if (ipsec_check_keylen(SADB_EXT_SUPPORTED_ENCRYPT,
358 			    p_alg_enc, PFKEY_UNUNIT64(p_key_enc_len)) < 0) {
359 				yyerror(ipsec_strerror());
360 				return -1;
361 			}
362 		}
363 	|	ALG_ENC_DESDERIV key_string
364 		{
365 			if ($1 < 0) {
366 				yyerror("unsupported algorithm");
367 				return -1;
368 			}
369 			p_alg_enc = $1;
370 			if (p_ext & SADB_X_EXT_OLD) {
371 				yyerror("algorithm mismatched");
372 				return -1;
373 			}
374 			p_ext |= SADB_X_EXT_DERIV;
375 
376 			p_key_enc_len = $2.len;
377 			p_key_enc = $2.buf;
378 			if (ipsec_check_keylen(SADB_EXT_SUPPORTED_ENCRYPT,
379 			    p_alg_enc, PFKEY_UNUNIT64(p_key_enc_len)) < 0) {
380 				yyerror(ipsec_strerror());
381 				return -1;
382 			}
383 		}
384 	|	ALG_ENC_DES32IV key_string
385 		{
386 			if ($1 < 0) {
387 				yyerror("unsupported algorithm");
388 				return -1;
389 			}
390 			p_alg_enc = $1;
391 			if (!(p_ext & SADB_X_EXT_OLD)) {
392 				yyerror("algorithm mismatched");
393 				return -1;
394 			}
395 			p_ext |= SADB_X_EXT_IV4B;
396 
397 			p_key_enc_len = $2.len;
398 			p_key_enc = $2.buf;
399 			if (ipsec_check_keylen(SADB_EXT_SUPPORTED_ENCRYPT,
400 			    p_alg_enc, PFKEY_UNUNIT64(p_key_enc_len)) < 0) {
401 				yyerror(ipsec_strerror());
402 				return -1;
403 			}
404 		}
405 	;
406 
407 auth_alg
408 	:	ALG_AUTH key_string {
409 			if ($1 < 0) {
410 				yyerror("unsupported algorithm");
411 				return -1;
412 			}
413 			p_alg_auth = $1;
414 
415 			p_key_auth_len = $2.len;
416 			p_key_auth = $2.buf;
417 
418 			if (p_alg_auth == SADB_X_AALG_TCP_MD5) {
419 				if ((p_key_auth_len < 1) || (p_key_auth_len >
420 				    80))
421 					return -1;
422 			} else if (ipsec_check_keylen(SADB_EXT_SUPPORTED_AUTH,
423 			    p_alg_auth, PFKEY_UNUNIT64(p_key_auth_len)) < 0) {
424 				yyerror(ipsec_strerror());
425 				return -1;
426 			}
427 		}
428 	|	ALG_AUTH_NOKEY {
429 			if ($1 < 0) {
430 				yyerror("unsupported algorithm");
431 				return -1;
432 			}
433 			p_alg_auth = $1;
434 
435 			p_key_auth_len = 0;
436 			p_key_auth = NULL;
437 		}
438 	;
439 
440 key_string
441 	:	QUOTEDSTRING
442 		{
443 			$$ = $1;
444 		}
445 	|	HEXSTRING
446 		{
447 			caddr_t pp_key;
448 			caddr_t bp;
449 			caddr_t yp = $1.buf;
450 			int l;
451 
452 			l = strlen(yp) % 2 + strlen(yp) / 2;
453 			if ((pp_key = malloc(l)) == 0) {
454 				yyerror("not enough core");
455 				return -1;
456 			}
457 			memset(pp_key, 0, l);
458 
459 			bp = pp_key;
460 			if (strlen(yp) % 2) {
461 				*bp = ATOX(yp[0]);
462 				yp++, bp++;
463 			}
464 			while (*yp) {
465 				*bp = (ATOX(yp[0]) << 4) | ATOX(yp[1]);
466 				yp += 2, bp++;
467 			}
468 
469 			$$.len = l;
470 			$$.buf = pp_key;
471 		}
472 	;
473 
474 extension_spec
475 	:	/*NOTHING*/
476 	|	extension_spec extension
477 	;
478 
479 extension
480 	:	F_EXT EXTENSION { p_ext |= $2; }
481 	|	F_EXT NOCYCLICSEQ { p_ext &= ~SADB_X_EXT_CYCSEQ; }
482 	|	F_MODE MODE { p_mode = $2; }
483 	|	F_MODE ANY { p_mode = IPSEC_MODE_ANY; }
484 	|	F_REQID DECSTRING { p_reqid = $2; }
485 	|	F_REPLAY DECSTRING
486 		{
487 			if ((p_ext & SADB_X_EXT_OLD) != 0) {
488 				yyerror("replay prevention cannot be used with "
489 				    "ah/esp-old");
490 				return -1;
491 			}
492 			p_replay = $2;
493 		}
494 	|	F_LIFETIME_HARD DECSTRING { p_lt_hard = $2; }
495 	|	F_LIFETIME_SOFT DECSTRING { p_lt_soft = $2; }
496 	;
497 
498 	/* definition about command for SPD management */
499 	/* spdadd */
500 spdadd_command
501 	:	SPDADD ipaddropts STRING prefix portstr STRING prefix portstr upper_spec upper_misc_spec policy_spec EOT
502 		{
503 			int status;
504 			struct addrinfo *src, *dst;
505 
506 			/* fixed port fields if ulp is icmpv6 */
507 			if ($10.buf != NULL) {
508 				if ($9 != IPPROTO_ICMPV6)
509 					return -1;
510 				free($5.buf);
511 				free($8.buf);
512 				if (fix_portstr(&$10, &$5, &$8))
513 					return -1;
514 			}
515 
516 			src = parse_addr($3.buf, $5.buf);
517 			dst = parse_addr($6.buf, $8.buf);
518 			if (!src || !dst) {
519 				/* yyerror is already called */
520 				return -1;
521 			}
522 			if (src->ai_next || dst->ai_next) {
523 				yyerror("multiple address specified");
524 				freeaddrinfo(src);
525 				freeaddrinfo(dst);
526 				return -1;
527 			}
528 
529 			status = setkeymsg_spdaddr(SADB_X_SPDADD, $9, &$11,
530 			    src, $4, dst, $7);
531 			freeaddrinfo(src);
532 			freeaddrinfo(dst);
533 			if (status < 0)
534 				return -1;
535 		}
536 	|	SPDADD TAGGED QUOTEDSTRING policy_spec EOT
537 		{
538 			return -1;
539 		}
540 	;
541 
542 spddelete_command
543 	:	SPDDELETE ipaddropts STRING prefix portstr STRING prefix portstr upper_spec upper_misc_spec policy_spec EOT
544 		{
545 			int status;
546 			struct addrinfo *src, *dst;
547 
548 			/* fixed port fields if ulp is icmpv6 */
549 			if ($10.buf != NULL) {
550 				if ($9 != IPPROTO_ICMPV6)
551 					return -1;
552 				free($5.buf);
553 				free($8.buf);
554 				if (fix_portstr(&$10, &$5, &$8))
555 					return -1;
556 			}
557 
558 			src = parse_addr($3.buf, $5.buf);
559 			dst = parse_addr($6.buf, $8.buf);
560 			if (!src || !dst) {
561 				/* yyerror is already called */
562 				return -1;
563 			}
564 			if (src->ai_next || dst->ai_next) {
565 				yyerror("multiple address specified");
566 				freeaddrinfo(src);
567 				freeaddrinfo(dst);
568 				return -1;
569 			}
570 
571 			status = setkeymsg_spdaddr(SADB_X_SPDDELETE, $9, &$11,
572 			    src, $4, dst, $7);
573 			freeaddrinfo(src);
574 			freeaddrinfo(dst);
575 			if (status < 0)
576 				return -1;
577 		}
578 	;
579 
580 spddump_command:
581 		SPDDUMP EOT
582 		{
583 			struct sadb_msg msg;
584 			setkeymsg0(&msg, SADB_X_SPDDUMP, SADB_SATYPE_UNSPEC,
585 			    sizeof(msg));
586 			sendkeymsg((char *)&msg, sizeof(msg));
587 		}
588 	;
589 
590 spdflush_command:
591 		SPDFLUSH EOT
592 		{
593 			struct sadb_msg msg;
594 			setkeymsg0(&msg, SADB_X_SPDFLUSH, SADB_SATYPE_UNSPEC,
595 			    sizeof(msg));
596 			sendkeymsg((char *)&msg, sizeof(msg));
597 		}
598 	;
599 
600 ipaddropts
601 	:	/* nothing */
602 	|	ipaddropts ipaddropt
603 	;
604 
605 ipaddropt
606 	:	F_AIFLAGS
607 		{
608 			char *p;
609 
610 			for (p = $1.buf + 1; *p; p++)
611 				switch (*p) {
612 				case '4':
613 					p_aifamily = AF_INET;
614 					break;
615 #ifdef INET6
616 				case '6':
617 					p_aifamily = AF_INET6;
618 					break;
619 #endif
620 				case 'n':
621 					p_aiflags = AI_NUMERICHOST;
622 					break;
623 				default:
624 					yyerror("invalid flag");
625 					return -1;
626 				}
627 		}
628 	;
629 
630 ipaddr
631 	:	STRING
632 		{
633 			$$ = parse_addr($1.buf, NULL);
634 			if ($$ == NULL) {
635 				/* yyerror already called by parse_addr */
636 				return -1;
637 			}
638 		}
639 	;
640 
641 prefix
642 	:	/*NOTHING*/ { $$ = -1; }
643 	|	SLASH DECSTRING { $$ = $2; }
644 	;
645 
646 portstr
647 	:	/*NOTHING*/
648 		{
649 			$$.buf = strdup("0");
650 			if (!$$.buf) {
651 				yyerror("insufficient memory");
652 				return -1;
653 			}
654 			$$.len = strlen($$.buf);
655 		}
656 	|	BLCL ANY ELCL
657 		{
658 			$$.buf = strdup("0");
659 			if (!$$.buf) {
660 				yyerror("insufficient memory");
661 				return -1;
662 			}
663 			$$.len = strlen($$.buf);
664 		}
665 	|	BLCL DECSTRING ELCL
666 		{
667 			char buf[20];
668 			snprintf(buf, sizeof(buf), "%lu", $2);
669 			$$.buf = strdup(buf);
670 			if (!$$.buf) {
671 				yyerror("insufficient memory");
672 				return -1;
673 			}
674 			$$.len = strlen($$.buf);
675 		}
676 	|	BLCL STRING ELCL
677 		{
678 			$$ = $2;
679 		}
680 	;
681 
682 upper_spec
683 	:	DECSTRING { $$ = $1; }
684 	|	ANY { $$ = IPSEC_ULPROTO_ANY; }
685 	|	PR_TCP { $$ = IPPROTO_TCP; }
686 	|	PR_ESP { $$ = IPPROTO_ESP; }
687 	|	STRING
688 		{
689 			struct protoent *ent;
690 
691 			ent = getprotobyname($1.buf);
692 			if (ent)
693 				$$ = ent->p_proto;
694 			else {
695 				if (strcmp("icmp6", $1.buf) == 0) {
696 					$$ = IPPROTO_ICMPV6;
697 				} else if(strcmp("ip4", $1.buf) == 0) {
698 					$$ = IPPROTO_IPV4;
699 				} else {
700 					yyerror("invalid upper layer protocol");
701 					return -1;
702 				}
703 			}
704 			endprotoent();
705 		}
706 	;
707 
708 upper_misc_spec
709 	:	/*NOTHING*/
710 		{
711 			$$.buf = NULL;
712 			$$.len = 0;
713 		}
714 	|	STRING
715 		{
716 			$$.buf = strdup($1.buf);
717 			if (!$$.buf) {
718 				yyerror("insufficient memory");
719 				return -1;
720 			}
721 			$$.len = strlen($$.buf);
722 		}
723 	;
724 
725 policy_spec
726 	:	F_POLICY policy_requests
727 		{
728 			char *policy;
729 
730 			policy = ipsec_set_policy($2.buf, $2.len);
731 			if (policy == NULL) {
732 				yyerror(ipsec_strerror());
733 				return -1;
734 			}
735 
736 			$$.buf = policy;
737 			$$.len = ipsec_get_policylen(policy);
738 		}
739 	;
740 
741 policy_requests
742 	:	PL_REQUESTS { $$ = $1; }
743 	;
744 
745 %%
746 
747 int
748 setkeymsg0(msg, type, satype, l)
749 	struct sadb_msg *msg;
750 	unsigned int type;
751 	unsigned int satype;
752 	size_t l;
753 {
754 
755 	msg->sadb_msg_version = PF_KEY_V2;
756 	msg->sadb_msg_type = type;
757 	msg->sadb_msg_errno = 0;
758 	msg->sadb_msg_satype = satype;
759 	msg->sadb_msg_reserved = 0;
760 	msg->sadb_msg_seq = 0;
761 	msg->sadb_msg_pid = getpid();
762 	msg->sadb_msg_len = PFKEY_UNIT64(l);
763 	return 0;
764 }
765 
766 /* XXX NO BUFFER OVERRUN CHECK! BAD BAD! */
767 static int
768 setkeymsg_spdaddr(type, upper, policy, srcs, splen, dsts, dplen)
769 	unsigned int type;
770 	unsigned int upper;
771 	vchar_t *policy;
772 	struct addrinfo *srcs;
773 	int splen;
774 	struct addrinfo *dsts;
775 	int dplen;
776 {
777 	struct sadb_msg *msg;
778 	char buf[BUFSIZ];
779 	int l, l0;
780 	struct sadb_address m_addr;
781 	struct addrinfo *s, *d;
782 	int n;
783 	int plen;
784 	struct sockaddr *sa;
785 	int salen;
786 
787 	msg = (struct sadb_msg *)buf;
788 
789 	if (!srcs || !dsts)
790 		return -1;
791 
792 	/* fix up length afterwards */
793 	setkeymsg0(msg, type, SADB_SATYPE_UNSPEC, 0);
794 	l = sizeof(struct sadb_msg);
795 
796 	memcpy(buf + l, policy->buf, policy->len);
797 	l += policy->len;
798 
799 	l0 = l;
800 	n = 0;
801 
802 	/* do it for all src/dst pairs */
803 	for (s = srcs; s; s = s->ai_next) {
804 		for (d = dsts; d; d = d->ai_next) {
805 			/* rewind pointer */
806 			l = l0;
807 
808 			if (s->ai_addr->sa_family != d->ai_addr->sa_family)
809 				continue;
810 			switch (s->ai_addr->sa_family) {
811 			case AF_INET:
812 				plen = sizeof(struct in_addr) << 3;
813 				break;
814 #ifdef INET6
815 			case AF_INET6:
816 				plen = sizeof(struct in6_addr) << 3;
817 				break;
818 #endif
819 			default:
820 				continue;
821 			}
822 
823 			/* set src */
824 			sa = s->ai_addr;
825 			salen = s->ai_addr->sa_len;
826 			m_addr.sadb_address_len = PFKEY_UNIT64(sizeof(m_addr) +
827 			    PFKEY_ALIGN8(salen));
828 			m_addr.sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
829 			m_addr.sadb_address_proto = upper;
830 			m_addr.sadb_address_prefixlen =
831 			    (splen >= 0 ? splen : plen);
832 			m_addr.sadb_address_reserved = 0;
833 
834 			setvarbuf(buf, &l, (struct sadb_ext *)&m_addr,
835 			    sizeof(m_addr), (caddr_t)sa, salen);
836 
837 			/* set dst */
838 			sa = d->ai_addr;
839 			salen = d->ai_addr->sa_len;
840 			m_addr.sadb_address_len = PFKEY_UNIT64(sizeof(m_addr) +
841 			    PFKEY_ALIGN8(salen));
842 			m_addr.sadb_address_exttype = SADB_EXT_ADDRESS_DST;
843 			m_addr.sadb_address_proto = upper;
844 			m_addr.sadb_address_prefixlen =
845 			    (dplen >= 0 ? dplen : plen);
846 			m_addr.sadb_address_reserved = 0;
847 
848 			setvarbuf(buf, &l, (struct sadb_ext *)&m_addr,
849 			    sizeof(m_addr), (caddr_t)sa, salen);
850 
851 			msg->sadb_msg_len = PFKEY_UNIT64(l);
852 
853 			sendkeymsg(buf, l);
854 
855 			n++;
856 		}
857 	}
858 
859 	if (n == 0)
860 		return -1;
861 	else
862 		return 0;
863 }
864 
865 /* XXX NO BUFFER OVERRUN CHECK! BAD BAD! */
866 static int
867 setkeymsg_addr(type, satype, srcs, dsts, no_spi)
868 	unsigned int type;
869 	unsigned int satype;
870 	struct addrinfo *srcs;
871 	struct addrinfo *dsts;
872 	int no_spi;
873 {
874 	struct sadb_msg *msg;
875 	char buf[BUFSIZ];
876 	int l, l0, len;
877 	struct sadb_sa m_sa;
878 	struct sadb_x_sa2 m_sa2;
879 	struct sadb_address m_addr;
880 	struct addrinfo *s, *d;
881 	int n;
882 	int plen;
883 	struct sockaddr *sa;
884 	int salen;
885 
886 	msg = (struct sadb_msg *)buf;
887 
888 	if (!srcs || !dsts)
889 		return -1;
890 
891 	/* fix up length afterwards */
892 	setkeymsg0(msg, type, satype, 0);
893 	l = sizeof(struct sadb_msg);
894 
895 	if (!no_spi) {
896 		len = sizeof(struct sadb_sa);
897 		m_sa.sadb_sa_len = PFKEY_UNIT64(len);
898 		m_sa.sadb_sa_exttype = SADB_EXT_SA;
899 		m_sa.sadb_sa_spi = htonl(p_spi);
900 		m_sa.sadb_sa_replay = p_replay;
901 		m_sa.sadb_sa_state = 0;
902 		m_sa.sadb_sa_auth = p_alg_auth;
903 		m_sa.sadb_sa_encrypt = p_alg_enc;
904 		m_sa.sadb_sa_flags = p_ext;
905 
906 		memcpy(buf + l, &m_sa, len);
907 		l += len;
908 
909 		len = sizeof(struct sadb_x_sa2);
910 		m_sa2.sadb_x_sa2_len = PFKEY_UNIT64(len);
911 		m_sa2.sadb_x_sa2_exttype = SADB_X_EXT_SA2;
912 		m_sa2.sadb_x_sa2_mode = p_mode;
913 		m_sa2.sadb_x_sa2_reqid = p_reqid;
914 
915 		memcpy(buf + l, &m_sa2, len);
916 		l += len;
917 	}
918 
919 	l0 = l;
920 	n = 0;
921 
922 	/* do it for all src/dst pairs */
923 	for (s = srcs; s; s = s->ai_next) {
924 		for (d = dsts; d; d = d->ai_next) {
925 			/* rewind pointer */
926 			l = l0;
927 
928 			if (s->ai_addr->sa_family != d->ai_addr->sa_family)
929 				continue;
930 			switch (s->ai_addr->sa_family) {
931 			case AF_INET:
932 				plen = sizeof(struct in_addr) << 3;
933 				break;
934 #ifdef INET6
935 			case AF_INET6:
936 				plen = sizeof(struct in6_addr) << 3;
937 				break;
938 #endif
939 			default:
940 				continue;
941 			}
942 
943 			/* set src */
944 			sa = s->ai_addr;
945 			salen = s->ai_addr->sa_len;
946 			m_addr.sadb_address_len = PFKEY_UNIT64(sizeof(m_addr) +
947 			    PFKEY_ALIGN8(salen));
948 			m_addr.sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
949 			m_addr.sadb_address_proto = IPSEC_ULPROTO_ANY;
950 			m_addr.sadb_address_prefixlen = plen;
951 			m_addr.sadb_address_reserved = 0;
952 
953 			setvarbuf(buf, &l, (struct sadb_ext *)&m_addr,
954 			    sizeof(m_addr), (caddr_t)sa, salen);
955 
956 			/* set dst */
957 			sa = d->ai_addr;
958 			salen = d->ai_addr->sa_len;
959 			m_addr.sadb_address_len = PFKEY_UNIT64(sizeof(m_addr) +
960 			    PFKEY_ALIGN8(salen));
961 			m_addr.sadb_address_exttype = SADB_EXT_ADDRESS_DST;
962 			m_addr.sadb_address_proto = IPSEC_ULPROTO_ANY;
963 			m_addr.sadb_address_prefixlen = plen;
964 			m_addr.sadb_address_reserved = 0;
965 
966 			setvarbuf(buf, &l, (struct sadb_ext *)&m_addr,
967 			    sizeof(m_addr), (caddr_t)sa, salen);
968 
969 			msg->sadb_msg_len = PFKEY_UNIT64(l);
970 
971 			sendkeymsg(buf, l);
972 
973 			n++;
974 		}
975 	}
976 
977 	if (n == 0)
978 		return -1;
979 	else
980 		return 0;
981 }
982 
983 /* XXX NO BUFFER OVERRUN CHECK! BAD BAD! */
984 static int
985 setkeymsg_add(type, satype, srcs, dsts)
986 	unsigned int type;
987 	unsigned int satype;
988 	struct addrinfo *srcs;
989 	struct addrinfo *dsts;
990 {
991 	struct sadb_msg *msg;
992 	char buf[BUFSIZ];
993 	int l, l0, len;
994 	struct sadb_sa m_sa;
995 	struct sadb_x_sa2 m_sa2;
996 	struct sadb_address m_addr;
997 	struct addrinfo *s, *d;
998 	int n;
999 	int plen;
1000 	struct sockaddr *sa;
1001 	int salen;
1002 
1003 	msg = (struct sadb_msg *)buf;
1004 
1005 	if (!srcs || !dsts)
1006 		return -1;
1007 
1008 	/* fix up length afterwards */
1009 	setkeymsg0(msg, type, satype, 0);
1010 	l = sizeof(struct sadb_msg);
1011 
1012 	/* set encryption algorithm, if present. */
1013 	if (satype != SADB_X_SATYPE_IPCOMP && p_key_enc) {
1014 		struct sadb_key m_key;
1015 
1016 		m_key.sadb_key_len =
1017 			PFKEY_UNIT64(sizeof(m_key)
1018 				   + PFKEY_ALIGN8(p_key_enc_len));
1019 		m_key.sadb_key_exttype = SADB_EXT_KEY_ENCRYPT;
1020 		m_key.sadb_key_bits = p_key_enc_len * 8;
1021 		m_key.sadb_key_reserved = 0;
1022 
1023 		setvarbuf(buf, &l,
1024 			(struct sadb_ext *)&m_key, sizeof(m_key),
1025 			(caddr_t)p_key_enc, p_key_enc_len);
1026 	}
1027 
1028 	/* set authentication algorithm, if present. */
1029 	if (p_key_auth) {
1030 		struct sadb_key m_key;
1031 
1032 		m_key.sadb_key_len =
1033 			PFKEY_UNIT64(sizeof(m_key)
1034 				   + PFKEY_ALIGN8(p_key_auth_len));
1035 		m_key.sadb_key_exttype = SADB_EXT_KEY_AUTH;
1036 		m_key.sadb_key_bits = p_key_auth_len * 8;
1037 		m_key.sadb_key_reserved = 0;
1038 
1039 		setvarbuf(buf, &l,
1040 			(struct sadb_ext *)&m_key, sizeof(m_key),
1041 			(caddr_t)p_key_auth, p_key_auth_len);
1042 	}
1043 
1044 	/* set lifetime for HARD */
1045 	if (p_lt_hard != 0) {
1046 		struct sadb_lifetime m_lt;
1047 		u_int slen = sizeof(struct sadb_lifetime);
1048 
1049 		m_lt.sadb_lifetime_len = PFKEY_UNIT64(slen);
1050 		m_lt.sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD;
1051 		m_lt.sadb_lifetime_allocations = 0;
1052 		m_lt.sadb_lifetime_bytes = 0;
1053 		m_lt.sadb_lifetime_addtime = p_lt_hard;
1054 		m_lt.sadb_lifetime_usetime = 0;
1055 
1056 		memcpy(buf + l, &m_lt, slen);
1057 		l += slen;
1058 	}
1059 
1060 	/* set lifetime for SOFT */
1061 	if (p_lt_soft != 0) {
1062 		struct sadb_lifetime m_lt;
1063 		u_int slen = sizeof(struct sadb_lifetime);
1064 
1065 		m_lt.sadb_lifetime_len = PFKEY_UNIT64(slen);
1066 		m_lt.sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT;
1067 		m_lt.sadb_lifetime_allocations = 0;
1068 		m_lt.sadb_lifetime_bytes = 0;
1069 		m_lt.sadb_lifetime_addtime = p_lt_soft;
1070 		m_lt.sadb_lifetime_usetime = 0;
1071 
1072 		memcpy(buf + l, &m_lt, slen);
1073 		l += slen;
1074 	}
1075 
1076 	len = sizeof(struct sadb_sa);
1077 	m_sa.sadb_sa_len = PFKEY_UNIT64(len);
1078 	m_sa.sadb_sa_exttype = SADB_EXT_SA;
1079 	m_sa.sadb_sa_spi = htonl(p_spi);
1080 	m_sa.sadb_sa_replay = p_replay;
1081 	m_sa.sadb_sa_state = 0;
1082 	m_sa.sadb_sa_auth = p_alg_auth;
1083 	m_sa.sadb_sa_encrypt = p_alg_enc;
1084 	m_sa.sadb_sa_flags = p_ext;
1085 
1086 	memcpy(buf + l, &m_sa, len);
1087 	l += len;
1088 
1089 	len = sizeof(struct sadb_x_sa2);
1090 	m_sa2.sadb_x_sa2_len = PFKEY_UNIT64(len);
1091 	m_sa2.sadb_x_sa2_exttype = SADB_X_EXT_SA2;
1092 	m_sa2.sadb_x_sa2_mode = p_mode;
1093 	m_sa2.sadb_x_sa2_reqid = p_reqid;
1094 
1095 	memcpy(buf + l, &m_sa2, len);
1096 	l += len;
1097 
1098 	l0 = l;
1099 	n = 0;
1100 
1101 	/* do it for all src/dst pairs */
1102 	for (s = srcs; s; s = s->ai_next) {
1103 		for (d = dsts; d; d = d->ai_next) {
1104 			/* rewind pointer */
1105 			l = l0;
1106 
1107 			if (s->ai_addr->sa_family != d->ai_addr->sa_family)
1108 				continue;
1109 			switch (s->ai_addr->sa_family) {
1110 			case AF_INET:
1111 				plen = sizeof(struct in_addr) << 3;
1112 				break;
1113 #ifdef INET6
1114 			case AF_INET6:
1115 				plen = sizeof(struct in6_addr) << 3;
1116 				break;
1117 #endif
1118 			default:
1119 				continue;
1120 			}
1121 
1122 			/* set src */
1123 			sa = s->ai_addr;
1124 			salen = s->ai_addr->sa_len;
1125 			m_addr.sadb_address_len = PFKEY_UNIT64(sizeof(m_addr) +
1126 			    PFKEY_ALIGN8(salen));
1127 			m_addr.sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
1128 			m_addr.sadb_address_proto = IPSEC_ULPROTO_ANY;
1129 			m_addr.sadb_address_prefixlen = plen;
1130 			m_addr.sadb_address_reserved = 0;
1131 
1132 			setvarbuf(buf, &l, (struct sadb_ext *)&m_addr,
1133 			    sizeof(m_addr), (caddr_t)sa, salen);
1134 
1135 			/* set dst */
1136 			sa = d->ai_addr;
1137 			salen = d->ai_addr->sa_len;
1138 			m_addr.sadb_address_len = PFKEY_UNIT64(sizeof(m_addr) +
1139 			    PFKEY_ALIGN8(salen));
1140 			m_addr.sadb_address_exttype = SADB_EXT_ADDRESS_DST;
1141 			m_addr.sadb_address_proto = IPSEC_ULPROTO_ANY;
1142 			m_addr.sadb_address_prefixlen = plen;
1143 			m_addr.sadb_address_reserved = 0;
1144 
1145 			setvarbuf(buf, &l, (struct sadb_ext *)&m_addr,
1146 			    sizeof(m_addr), (caddr_t)sa, salen);
1147 
1148 			msg->sadb_msg_len = PFKEY_UNIT64(l);
1149 
1150 			sendkeymsg(buf, l);
1151 
1152 			n++;
1153 		}
1154 	}
1155 
1156 	if (n == 0)
1157 		return -1;
1158 	else
1159 		return 0;
1160 }
1161 
1162 static struct addrinfo *
1163 parse_addr(host, port)
1164 	char *host;
1165 	char *port;
1166 {
1167 	struct addrinfo hints, *res = NULL;
1168 	int error;
1169 
1170 	memset(&hints, 0, sizeof(hints));
1171 	hints.ai_family = p_aifamily;
1172 	hints.ai_socktype = SOCK_DGRAM;		/*dummy*/
1173 	hints.ai_protocol = IPPROTO_UDP;	/*dummy*/
1174 	hints.ai_flags = p_aiflags;
1175 	error = getaddrinfo(host, port, &hints, &res);
1176 	if (error != 0) {
1177 		yyerror(gai_strerror(error));
1178 		return NULL;
1179 	}
1180 	return res;
1181 }
1182 
1183 static int
1184 fix_portstr(spec, sport, dport)
1185 	vchar_t *spec, *sport, *dport;
1186 {
1187 	char *p, *p2;
1188 	u_int l;
1189 
1190 	l = 0;
1191 	for (p = spec->buf; *p != ',' && *p != '\0' && l < spec->len; p++, l++)
1192 		;
1193 	if (*p == '\0') {
1194 		p2 = "0";
1195 	} else {
1196 		if (*p == ',') {
1197 			*p = '\0';
1198 			p2 = ++p;
1199 		}
1200 		for (p = p2; *p != '\0' && l < spec->len; p++, l++)
1201 			;
1202 		if (*p != '\0' || *p2 == '\0') {
1203 			yyerror("invalid an upper layer protocol spec");
1204 			return -1;
1205 		}
1206 	}
1207 
1208 	sport->buf = strdup(spec->buf);
1209 	if (!sport->buf) {
1210 		yyerror("insufficient memory");
1211 		return -1;
1212 	}
1213 	sport->len = strlen(sport->buf);
1214 	dport->buf = strdup(p2);
1215 	if (!dport->buf) {
1216 		yyerror("insufficient memory");
1217 		return -1;
1218 	}
1219 	dport->len = strlen(dport->buf);
1220 
1221 	return 0;
1222 }
1223 
1224 static int
1225 setvarbuf(buf, off, ebuf, elen, vbuf, vlen)
1226 	char *buf;
1227 	int *off;
1228 	struct sadb_ext *ebuf;
1229 	int elen;
1230 	caddr_t vbuf;
1231 	int vlen;
1232 {
1233 	memset(buf + *off, 0, PFKEY_UNUNIT64(ebuf->sadb_ext_len));
1234 	memcpy(buf + *off, (caddr_t)ebuf, elen);
1235 	memcpy(buf + *off + elen, vbuf, vlen);
1236 	(*off) += PFKEY_ALIGN8(elen + vlen);
1237 
1238 	return 0;
1239 }
1240 
1241 void
1242 parse_init()
1243 {
1244 	p_spi = 0;
1245 
1246 	p_ext = SADB_X_EXT_CYCSEQ;
1247 	p_alg_enc = SADB_EALG_NONE;
1248 	p_alg_auth = SADB_AALG_NONE;
1249 	p_mode = IPSEC_MODE_ANY;
1250 	p_reqid = 0;
1251 	p_replay = 0;
1252 	p_key_enc_len = p_key_auth_len = 0;
1253 	p_key_enc = p_key_auth = 0;
1254 	p_lt_hard = p_lt_soft = 0;
1255 
1256 	p_aiflags = 0;
1257 	p_aifamily = PF_UNSPEC;
1258 
1259 	return;
1260 }
1261 
1262 void
1263 free_buffer()
1264 {
1265 	/* we got tons of memory leaks in the parser anyways, leave them */
1266 
1267 	return;
1268 }
1269