xref: /freebsd/sbin/setkey/parse.y (revision d9a42747950146bf03cda7f6e25d219253f8a57a)
1 /*	$FreeBSD$	*/
2 /*	$KAME: parse.y,v 1.83 2004/05/18 08:48:23 sakane Exp $	*/
3 
4 /*-
5  * SPDX-License-Identifier: BSD-3-Clause
6  *
7  * Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project.
8  * All rights reserved.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. Neither the name of the project nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  */
34 
35 %{
36 #include <sys/types.h>
37 #include <sys/param.h>
38 #include <sys/socket.h>
39 
40 #include <net/route.h>
41 #include <netinet/in.h>
42 #include <net/pfkeyv2.h>
43 #include <netipsec/key_var.h>
44 #include <netipsec/ipsec.h>
45 #include <arpa/inet.h>
46 
47 #include <string.h>
48 #include <unistd.h>
49 #include <stdio.h>
50 #include <stdint.h>
51 #include <netdb.h>
52 #include <ctype.h>
53 #include <errno.h>
54 
55 #include "libpfkey.h"
56 #include "vchar.h"
57 
58 #define ATOX(c) \
59   (isdigit(c) ? (c - '0') : (isupper(c) ? (c - 'A' + 10) : (c - 'a' + 10)))
60 
61 u_int32_t p_spi;
62 u_int p_ext, p_alg_enc, p_alg_auth, p_replay, p_mode;
63 u_int32_t p_reqid;
64 u_int p_key_enc_len, p_key_auth_len;
65 caddr_t p_key_enc, p_key_auth;
66 time_t p_lt_hard, p_lt_soft;
67 
68 static int p_aiflags = 0, p_aifamily = PF_UNSPEC;
69 
70 static struct addrinfo *parse_addr(char *, char *);
71 static int fix_portstr(vchar_t *, vchar_t *, vchar_t *);
72 static int setvarbuf(char *, int *, struct sadb_ext *, int, caddr_t, int);
73 void parse_init(void);
74 void free_buffer(void);
75 
76 int setkeymsg0(struct sadb_msg *, unsigned int, unsigned int, size_t);
77 static int setkeymsg_spdaddr(unsigned int, unsigned int, vchar_t *,
78 	struct addrinfo *, int, struct addrinfo *, int);
79 static int setkeymsg_addr(unsigned int, unsigned int,
80 	struct addrinfo *, struct addrinfo *, int);
81 static int setkeymsg_add(unsigned int, unsigned int,
82 	struct addrinfo *, struct addrinfo *);
83 extern int setkeymsg(char *, size_t *);
84 extern int sendkeymsg(char *, size_t);
85 
86 extern int yylex(void);
87 extern void yyfatal(const char *);
88 extern void yyerror(const char *);
89 %}
90 
91 %union {
92 	int num;
93 	unsigned long ulnum;
94 	vchar_t val;
95 	struct addrinfo *res;
96 }
97 
98 %token EOT SLASH BLCL ELCL
99 %token ADD GET DELETE DELETEALL FLUSH DUMP
100 %token PR_ESP PR_AH PR_IPCOMP PR_TCP
101 %token F_PROTOCOL F_AUTH F_ENC F_REPLAY F_COMP F_RAWCPI
102 %token F_MODE MODE F_REQID
103 %token F_EXT EXTENSION NOCYCLICSEQ
104 %token ALG_AUTH ALG_AUTH_NOKEY
105 %token ALG_ENC ALG_ENC_NOKEY ALG_ENC_DESDERIV ALG_ENC_DES32IV ALG_ENC_OLD
106 %token ALG_ENC_SALT
107 %token ALG_COMP
108 %token F_LIFETIME_HARD F_LIFETIME_SOFT
109 %token DECSTRING QUOTEDSTRING HEXSTRING STRING ANY
110 	/* SPD management */
111 %token SPDADD SPDDELETE SPDDUMP SPDFLUSH
112 %token F_POLICY PL_REQUESTS
113 %token F_AIFLAGS
114 %token TAGGED
115 
116 %type <num> prefix protocol_spec upper_spec
117 %type <num> ALG_ENC ALG_ENC_DESDERIV ALG_ENC_DES32IV ALG_ENC_OLD ALG_ENC_NOKEY
118 %type <num> ALG_ENC_SALT
119 %type <num> ALG_AUTH ALG_AUTH_NOKEY
120 %type <num> ALG_COMP
121 %type <num> PR_ESP PR_AH PR_IPCOMP PR_TCP
122 %type <num> EXTENSION MODE
123 %type <ulnum> DECSTRING
124 %type <val> PL_REQUESTS portstr key_string
125 %type <val> policy_requests
126 %type <val> QUOTEDSTRING HEXSTRING STRING
127 %type <val> F_AIFLAGS
128 %type <val> upper_misc_spec policy_spec
129 %type <res> ipaddr
130 
131 %%
132 commands
133 	:	/*NOTHING*/
134 	|	commands command
135 		{
136 			free_buffer();
137 			parse_init();
138 		}
139 	;
140 
141 command
142 	:	add_command
143 	|	get_command
144 	|	delete_command
145 	|	deleteall_command
146 	|	flush_command
147 	|	dump_command
148 	|	spdadd_command
149 	|	spddelete_command
150 	|	spddump_command
151 	|	spdflush_command
152 	;
153 	/* commands concerned with management, there is in tail of this file. */
154 
155 	/* add command */
156 add_command
157 	:	ADD ipaddropts ipaddr ipaddr protocol_spec spi extension_spec algorithm_spec EOT
158 		{
159 			int status;
160 
161 			status = setkeymsg_add(SADB_ADD, $5, $3, $4);
162 			if (status < 0)
163 				return -1;
164 		}
165 	;
166 
167 	/* delete */
168 delete_command
169 	:	DELETE ipaddropts ipaddr ipaddr protocol_spec spi extension_spec EOT
170 		{
171 			int status;
172 
173 			if ($3->ai_next || $4->ai_next) {
174 				yyerror("multiple address specified");
175 				return -1;
176 			}
177 			if (p_mode != IPSEC_MODE_ANY)
178 				yyerror("WARNING: mode is obsolete");
179 
180 			status = setkeymsg_addr(SADB_DELETE, $5, $3, $4, 0);
181 			if (status < 0)
182 				return -1;
183 		}
184 	;
185 
186 	/* deleteall command */
187 deleteall_command
188 	:	DELETEALL ipaddropts ipaddr ipaddr protocol_spec EOT
189 		{
190 			int status;
191 
192 			status = setkeymsg_addr(SADB_DELETE, $5, $3, $4, 1);
193 			if (status < 0)
194 				return -1;
195 		}
196 	;
197 
198 	/* get command */
199 get_command
200 	:	GET ipaddropts ipaddr ipaddr protocol_spec spi extension_spec EOT
201 		{
202 			int status;
203 
204 			if (p_mode != IPSEC_MODE_ANY)
205 				yyerror("WARNING: mode is obsolete");
206 
207 			status = setkeymsg_addr(SADB_GET, $5, $3, $4, 0);
208 			if (status < 0)
209 				return -1;
210 		}
211 	;
212 
213 	/* flush */
214 flush_command
215 	:	FLUSH protocol_spec EOT
216 		{
217 			struct sadb_msg msg;
218 			setkeymsg0(&msg, SADB_FLUSH, $2, sizeof(msg));
219 			sendkeymsg((char *)&msg, sizeof(msg));
220 		}
221 	;
222 
223 	/* dump */
224 dump_command
225 	:	DUMP protocol_spec EOT
226 		{
227 			struct sadb_msg msg;
228 			setkeymsg0(&msg, SADB_DUMP, $2, sizeof(msg));
229 			sendkeymsg((char *)&msg, sizeof(msg));
230 		}
231 	;
232 
233 protocol_spec
234 	:	/*NOTHING*/
235 		{
236 			$$ = SADB_SATYPE_UNSPEC;
237 		}
238 	|	PR_ESP
239 		{
240 			$$ = SADB_SATYPE_ESP;
241 			if ($1 == 1)
242 				p_ext |= SADB_X_EXT_OLD;
243 			else
244 				p_ext &= ~SADB_X_EXT_OLD;
245 		}
246 	|	PR_AH
247 		{
248 			$$ = SADB_SATYPE_AH;
249 			if ($1 == 1)
250 				p_ext |= SADB_X_EXT_OLD;
251 			else
252 				p_ext &= ~SADB_X_EXT_OLD;
253 		}
254 	|	PR_IPCOMP
255 		{
256 			$$ = SADB_X_SATYPE_IPCOMP;
257 		}
258 	|	PR_TCP
259 		{
260 			$$ = SADB_X_SATYPE_TCPSIGNATURE;
261 		}
262 	;
263 
264 spi
265 	:	DECSTRING { p_spi = $1; }
266 	|	HEXSTRING
267 		{
268 			char *ep;
269 			unsigned long v;
270 
271 			ep = NULL;
272 			v = strtoul($1.buf, &ep, 16);
273 			if (!ep || *ep) {
274 				yyerror("invalid SPI");
275 				return -1;
276 			}
277 			if (v & ~0xffffffff) {
278 				yyerror("SPI too big.");
279 				return -1;
280 			}
281 
282 			p_spi = v;
283 		}
284 	;
285 
286 algorithm_spec
287 	:	esp_spec
288 	|	ah_spec
289 	|	ipcomp_spec
290 	;
291 
292 esp_spec
293 	:	F_ENC enc_alg F_AUTH auth_alg
294 	|	F_ENC enc_alg
295 	;
296 
297 ah_spec
298 	:	F_AUTH auth_alg
299 	;
300 
301 ipcomp_spec
302 	:	F_COMP ALG_COMP
303 		{
304 			if ($2 < 0) {
305 				yyerror("unsupported algorithm");
306 				return -1;
307 			}
308 			p_alg_enc = $2;
309 		}
310 	|	F_COMP ALG_COMP F_RAWCPI
311 		{
312 			if ($2 < 0) {
313 				yyerror("unsupported algorithm");
314 				return -1;
315 			}
316 			p_alg_enc = $2;
317 			p_ext |= SADB_X_EXT_RAWCPI;
318 		}
319 	;
320 
321 enc_alg
322 	:	ALG_ENC_NOKEY {
323 			if ($1 < 0) {
324 				yyerror("unsupported algorithm");
325 				return -1;
326 			}
327 			p_alg_enc = $1;
328 
329 			p_key_enc_len = 0;
330 			p_key_enc = NULL;
331 			if (ipsec_check_keylen(SADB_EXT_SUPPORTED_ENCRYPT,
332 			    p_alg_enc, PFKEY_UNUNIT64(p_key_enc_len)) < 0) {
333 				yyerror(ipsec_strerror());
334 				return -1;
335 			}
336 		}
337 	|	ALG_ENC key_string {
338 			if ($1 < 0) {
339 				yyerror("unsupported algorithm");
340 				return -1;
341 			}
342 			p_alg_enc = $1;
343 
344 			p_key_enc_len = $2.len;
345 			p_key_enc = $2.buf;
346 			if (ipsec_check_keylen(SADB_EXT_SUPPORTED_ENCRYPT,
347 			    p_alg_enc, PFKEY_UNUNIT64(p_key_enc_len)) < 0) {
348 				yyerror(ipsec_strerror());
349 				return -1;
350 			}
351 		}
352 	|	ALG_ENC_OLD {
353 			if ($1 < 0) {
354 				yyerror("unsupported algorithm");
355 				return -1;
356 			}
357 			yyerror("WARNING: obsolete algorithm");
358 			p_alg_enc = $1;
359 
360 			p_key_enc_len = 0;
361 			p_key_enc = NULL;
362 			if (ipsec_check_keylen(SADB_EXT_SUPPORTED_ENCRYPT,
363 			    p_alg_enc, PFKEY_UNUNIT64(p_key_enc_len)) < 0) {
364 				yyerror(ipsec_strerror());
365 				return -1;
366 			}
367 		}
368 	|	ALG_ENC_DESDERIV key_string
369 		{
370 			if ($1 < 0) {
371 				yyerror("unsupported algorithm");
372 				return -1;
373 			}
374 			p_alg_enc = $1;
375 			if (p_ext & SADB_X_EXT_OLD) {
376 				yyerror("algorithm mismatched");
377 				return -1;
378 			}
379 			p_ext |= SADB_X_EXT_DERIV;
380 
381 			p_key_enc_len = $2.len;
382 			p_key_enc = $2.buf;
383 			if (ipsec_check_keylen(SADB_EXT_SUPPORTED_ENCRYPT,
384 			    p_alg_enc, PFKEY_UNUNIT64(p_key_enc_len)) < 0) {
385 				yyerror(ipsec_strerror());
386 				return -1;
387 			}
388 		}
389 	|	ALG_ENC_DES32IV key_string
390 		{
391 			if ($1 < 0) {
392 				yyerror("unsupported algorithm");
393 				return -1;
394 			}
395 			p_alg_enc = $1;
396 			if (!(p_ext & SADB_X_EXT_OLD)) {
397 				yyerror("algorithm mismatched");
398 				return -1;
399 			}
400 			p_ext |= SADB_X_EXT_IV4B;
401 
402 			p_key_enc_len = $2.len;
403 			p_key_enc = $2.buf;
404 			if (ipsec_check_keylen(SADB_EXT_SUPPORTED_ENCRYPT,
405 			    p_alg_enc, PFKEY_UNUNIT64(p_key_enc_len)) < 0) {
406 				yyerror(ipsec_strerror());
407 				return -1;
408 			}
409 		}
410 	|	ALG_ENC_SALT key_string
411 		{
412 			if ($1 < 0) {
413 				yyerror("unsupported algorithm");
414 				return -1;
415 			}
416 			p_alg_enc = $1;
417 
418 			p_key_enc_len = $2.len;
419 
420 			p_key_enc = $2.buf;
421 			/*
422 			 * Salted keys include a 4 byte value that is
423 			 * not part of the key.
424 			 */
425 			if (ipsec_check_keylen(SADB_EXT_SUPPORTED_ENCRYPT,
426 			    p_alg_enc, PFKEY_UNUNIT64(p_key_enc_len - 4)) < 0) {
427 				yyerror(ipsec_strerror());
428 				return -1;
429 			}
430 		}
431 	;
432 
433 auth_alg
434 	:	ALG_AUTH key_string {
435 			if ($1 < 0) {
436 				yyerror("unsupported algorithm");
437 				return -1;
438 			}
439 			p_alg_auth = $1;
440 
441 			p_key_auth_len = $2.len;
442 			p_key_auth = $2.buf;
443 
444 			if (p_alg_auth == SADB_X_AALG_TCP_MD5) {
445 				if ((p_key_auth_len < 1) || (p_key_auth_len >
446 				    80))
447 					return -1;
448 			} else if (ipsec_check_keylen(SADB_EXT_SUPPORTED_AUTH,
449 			    p_alg_auth, PFKEY_UNUNIT64(p_key_auth_len)) < 0) {
450 				yyerror(ipsec_strerror());
451 				return -1;
452 			}
453 		}
454 	|	ALG_AUTH_NOKEY {
455 			if ($1 < 0) {
456 				yyerror("unsupported algorithm");
457 				return -1;
458 			}
459 			p_alg_auth = $1;
460 
461 			p_key_auth_len = 0;
462 			p_key_auth = NULL;
463 		}
464 	;
465 
466 key_string
467 	:	QUOTEDSTRING
468 		{
469 			$$ = $1;
470 		}
471 	|	HEXSTRING
472 		{
473 			caddr_t pp_key;
474 			caddr_t bp;
475 			caddr_t yp = $1.buf;
476 			int l;
477 
478 			l = strlen(yp) % 2 + strlen(yp) / 2;
479 			if ((pp_key = malloc(l)) == 0) {
480 				yyerror("not enough core");
481 				return -1;
482 			}
483 			memset(pp_key, 0, l);
484 
485 			bp = pp_key;
486 			if (strlen(yp) % 2) {
487 				*bp = ATOX(yp[0]);
488 				yp++, bp++;
489 			}
490 			while (*yp) {
491 				*bp = (ATOX(yp[0]) << 4) | ATOX(yp[1]);
492 				yp += 2, bp++;
493 			}
494 
495 			$$.len = l;
496 			$$.buf = pp_key;
497 		}
498 	;
499 
500 extension_spec
501 	:	/*NOTHING*/
502 	|	extension_spec extension
503 	;
504 
505 extension
506 	:	F_EXT EXTENSION { p_ext |= $2; }
507 	|	F_EXT NOCYCLICSEQ { p_ext &= ~SADB_X_EXT_CYCSEQ; }
508 	|	F_MODE MODE { p_mode = $2; }
509 	|	F_MODE ANY { p_mode = IPSEC_MODE_ANY; }
510 	|	F_REQID DECSTRING { p_reqid = $2; }
511 	|	F_REPLAY DECSTRING
512 		{
513 			if ((p_ext & SADB_X_EXT_OLD) != 0) {
514 				yyerror("replay prevention cannot be used with "
515 				    "ah/esp-old");
516 				return -1;
517 			}
518 			p_replay = $2;
519 			if (p_replay > (UINT32_MAX - 32) >> 3)
520 				yyerror("replay window is too large");
521 		}
522 	|	F_LIFETIME_HARD DECSTRING { p_lt_hard = $2; }
523 	|	F_LIFETIME_SOFT DECSTRING { p_lt_soft = $2; }
524 	;
525 
526 	/* definition about command for SPD management */
527 	/* spdadd */
528 spdadd_command
529 	:	SPDADD ipaddropts STRING prefix portstr STRING prefix portstr upper_spec upper_misc_spec policy_spec EOT
530 		{
531 			int status;
532 			struct addrinfo *src, *dst;
533 
534 			/* fixed port fields if ulp is icmpv6 */
535 			if ($10.buf != NULL) {
536 				if ($9 != IPPROTO_ICMPV6)
537 					return -1;
538 				free($5.buf);
539 				free($8.buf);
540 				if (fix_portstr(&$10, &$5, &$8))
541 					return -1;
542 			}
543 
544 			src = parse_addr($3.buf, $5.buf);
545 			dst = parse_addr($6.buf, $8.buf);
546 			if (!src || !dst) {
547 				/* yyerror is already called */
548 				return -1;
549 			}
550 			if (src->ai_next || dst->ai_next) {
551 				yyerror("multiple address specified");
552 				freeaddrinfo(src);
553 				freeaddrinfo(dst);
554 				return -1;
555 			}
556 
557 			status = setkeymsg_spdaddr(SADB_X_SPDADD, $9, &$11,
558 			    src, $4, dst, $7);
559 			freeaddrinfo(src);
560 			freeaddrinfo(dst);
561 			if (status < 0)
562 				return -1;
563 		}
564 	|	SPDADD TAGGED QUOTEDSTRING policy_spec EOT
565 		{
566 			return -1;
567 		}
568 	;
569 
570 spddelete_command
571 	:	SPDDELETE ipaddropts STRING prefix portstr STRING prefix portstr upper_spec upper_misc_spec policy_spec EOT
572 		{
573 			int status;
574 			struct addrinfo *src, *dst;
575 
576 			/* fixed port fields if ulp is icmpv6 */
577 			if ($10.buf != NULL) {
578 				if ($9 != IPPROTO_ICMPV6)
579 					return -1;
580 				free($5.buf);
581 				free($8.buf);
582 				if (fix_portstr(&$10, &$5, &$8))
583 					return -1;
584 			}
585 
586 			src = parse_addr($3.buf, $5.buf);
587 			dst = parse_addr($6.buf, $8.buf);
588 			if (!src || !dst) {
589 				/* yyerror is already called */
590 				return -1;
591 			}
592 			if (src->ai_next || dst->ai_next) {
593 				yyerror("multiple address specified");
594 				freeaddrinfo(src);
595 				freeaddrinfo(dst);
596 				return -1;
597 			}
598 
599 			status = setkeymsg_spdaddr(SADB_X_SPDDELETE, $9, &$11,
600 			    src, $4, dst, $7);
601 			freeaddrinfo(src);
602 			freeaddrinfo(dst);
603 			if (status < 0)
604 				return -1;
605 		}
606 	;
607 
608 spddump_command:
609 		SPDDUMP EOT
610 		{
611 			struct sadb_msg msg;
612 			setkeymsg0(&msg, SADB_X_SPDDUMP, SADB_SATYPE_UNSPEC,
613 			    sizeof(msg));
614 			sendkeymsg((char *)&msg, sizeof(msg));
615 		}
616 	;
617 
618 spdflush_command:
619 		SPDFLUSH EOT
620 		{
621 			struct sadb_msg msg;
622 			setkeymsg0(&msg, SADB_X_SPDFLUSH, SADB_SATYPE_UNSPEC,
623 			    sizeof(msg));
624 			sendkeymsg((char *)&msg, sizeof(msg));
625 		}
626 	;
627 
628 ipaddropts
629 	:	/* nothing */
630 	|	ipaddropts ipaddropt
631 	;
632 
633 ipaddropt
634 	:	F_AIFLAGS
635 		{
636 			char *p;
637 
638 			for (p = $1.buf + 1; *p; p++)
639 				switch (*p) {
640 				case '4':
641 					p_aifamily = AF_INET;
642 					break;
643 #ifdef INET6
644 				case '6':
645 					p_aifamily = AF_INET6;
646 					break;
647 #endif
648 				case 'n':
649 					p_aiflags = AI_NUMERICHOST;
650 					break;
651 				default:
652 					yyerror("invalid flag");
653 					return -1;
654 				}
655 		}
656 	;
657 
658 ipaddr
659 	:	STRING
660 		{
661 			$$ = parse_addr($1.buf, NULL);
662 			if ($$ == NULL) {
663 				/* yyerror already called by parse_addr */
664 				return -1;
665 			}
666 		}
667 	;
668 
669 prefix
670 	:	/*NOTHING*/ { $$ = -1; }
671 	|	SLASH DECSTRING { $$ = $2; }
672 	;
673 
674 portstr
675 	:	/*NOTHING*/
676 		{
677 			$$.buf = strdup("0");
678 			if (!$$.buf) {
679 				yyerror("insufficient memory");
680 				return -1;
681 			}
682 			$$.len = strlen($$.buf);
683 		}
684 	|	BLCL ANY ELCL
685 		{
686 			$$.buf = strdup("0");
687 			if (!$$.buf) {
688 				yyerror("insufficient memory");
689 				return -1;
690 			}
691 			$$.len = strlen($$.buf);
692 		}
693 	|	BLCL DECSTRING ELCL
694 		{
695 			char buf[20];
696 			snprintf(buf, sizeof(buf), "%lu", $2);
697 			$$.buf = strdup(buf);
698 			if (!$$.buf) {
699 				yyerror("insufficient memory");
700 				return -1;
701 			}
702 			$$.len = strlen($$.buf);
703 		}
704 	|	BLCL STRING ELCL
705 		{
706 			$$ = $2;
707 		}
708 	;
709 
710 upper_spec
711 	:	DECSTRING { $$ = $1; }
712 	|	ANY { $$ = IPSEC_ULPROTO_ANY; }
713 	|	PR_TCP { $$ = IPPROTO_TCP; }
714 	|	PR_ESP { $$ = IPPROTO_ESP; }
715 	|	STRING
716 		{
717 			struct protoent *ent;
718 
719 			ent = getprotobyname($1.buf);
720 			if (ent)
721 				$$ = ent->p_proto;
722 			else {
723 				if (strcmp("icmp6", $1.buf) == 0) {
724 					$$ = IPPROTO_ICMPV6;
725 				} else if(strcmp("ip4", $1.buf) == 0) {
726 					$$ = IPPROTO_IPV4;
727 				} else {
728 					yyerror("invalid upper layer protocol");
729 					return -1;
730 				}
731 			}
732 			endprotoent();
733 		}
734 	;
735 
736 upper_misc_spec
737 	:	/*NOTHING*/
738 		{
739 			$$.buf = NULL;
740 			$$.len = 0;
741 		}
742 	|	STRING
743 		{
744 			$$.buf = strdup($1.buf);
745 			if (!$$.buf) {
746 				yyerror("insufficient memory");
747 				return -1;
748 			}
749 			$$.len = strlen($$.buf);
750 		}
751 	;
752 
753 policy_spec
754 	:	F_POLICY policy_requests
755 		{
756 			char *policy;
757 
758 			policy = ipsec_set_policy($2.buf, $2.len);
759 			if (policy == NULL) {
760 				yyerror(ipsec_strerror());
761 				return -1;
762 			}
763 
764 			$$.buf = policy;
765 			$$.len = ipsec_get_policylen(policy);
766 		}
767 	;
768 
769 policy_requests
770 	:	PL_REQUESTS { $$ = $1; }
771 	;
772 
773 %%
774 
775 int
776 setkeymsg0(struct sadb_msg *msg, unsigned type, unsigned satype, size_t l)
777 {
778 
779 	msg->sadb_msg_version = PF_KEY_V2;
780 	msg->sadb_msg_type = type;
781 	msg->sadb_msg_errno = 0;
782 	msg->sadb_msg_satype = satype;
783 	msg->sadb_msg_reserved = 0;
784 	msg->sadb_msg_seq = 0;
785 	msg->sadb_msg_pid = getpid();
786 	msg->sadb_msg_len = PFKEY_UNIT64(l);
787 	return 0;
788 }
789 
790 /* XXX NO BUFFER OVERRUN CHECK! BAD BAD! */
791 static int
792 setkeymsg_spdaddr(unsigned type, unsigned upper, vchar_t *policy,
793     struct addrinfo *srcs, int splen, struct addrinfo *dsts, int dplen)
794 {
795 	struct sadb_msg *msg;
796 	char buf[BUFSIZ];
797 	int l, l0;
798 	struct sadb_address m_addr;
799 	struct addrinfo *s, *d;
800 	int n;
801 	int plen;
802 	struct sockaddr *sa;
803 	int salen;
804 
805 	msg = (struct sadb_msg *)buf;
806 
807 	if (!srcs || !dsts)
808 		return -1;
809 
810 	/* fix up length afterwards */
811 	setkeymsg0(msg, type, SADB_SATYPE_UNSPEC, 0);
812 	l = sizeof(struct sadb_msg);
813 
814 	memcpy(buf + l, policy->buf, policy->len);
815 	l += policy->len;
816 
817 	l0 = l;
818 	n = 0;
819 
820 	/* do it for all src/dst pairs */
821 	for (s = srcs; s; s = s->ai_next) {
822 		for (d = dsts; d; d = d->ai_next) {
823 			/* rewind pointer */
824 			l = l0;
825 
826 			if (s->ai_addr->sa_family != d->ai_addr->sa_family)
827 				continue;
828 			switch (s->ai_addr->sa_family) {
829 			case AF_INET:
830 				plen = sizeof(struct in_addr) << 3;
831 				break;
832 #ifdef INET6
833 			case AF_INET6:
834 				plen = sizeof(struct in6_addr) << 3;
835 				break;
836 #endif
837 			default:
838 				continue;
839 			}
840 
841 			/* set src */
842 			sa = s->ai_addr;
843 			salen = s->ai_addr->sa_len;
844 			m_addr.sadb_address_len = PFKEY_UNIT64(sizeof(m_addr) +
845 			    PFKEY_ALIGN8(salen));
846 			m_addr.sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
847 			m_addr.sadb_address_proto = upper;
848 			m_addr.sadb_address_prefixlen =
849 			    (splen >= 0 ? splen : plen);
850 			m_addr.sadb_address_reserved = 0;
851 
852 			setvarbuf(buf, &l, (struct sadb_ext *)&m_addr,
853 			    sizeof(m_addr), (caddr_t)sa, salen);
854 
855 			/* set dst */
856 			sa = d->ai_addr;
857 			salen = d->ai_addr->sa_len;
858 			m_addr.sadb_address_len = PFKEY_UNIT64(sizeof(m_addr) +
859 			    PFKEY_ALIGN8(salen));
860 			m_addr.sadb_address_exttype = SADB_EXT_ADDRESS_DST;
861 			m_addr.sadb_address_proto = upper;
862 			m_addr.sadb_address_prefixlen =
863 			    (dplen >= 0 ? dplen : plen);
864 			m_addr.sadb_address_reserved = 0;
865 
866 			setvarbuf(buf, &l, (struct sadb_ext *)&m_addr,
867 			    sizeof(m_addr), (caddr_t)sa, salen);
868 
869 			msg->sadb_msg_len = PFKEY_UNIT64(l);
870 
871 			sendkeymsg(buf, l);
872 
873 			n++;
874 		}
875 	}
876 
877 	if (n == 0)
878 		return -1;
879 	else
880 		return 0;
881 }
882 
883 /* XXX NO BUFFER OVERRUN CHECK! BAD BAD! */
884 static int
885 setkeymsg_addr(unsigned type, unsigned satype, struct addrinfo *srcs,
886     struct addrinfo *dsts, int no_spi)
887 {
888 	struct sadb_msg *msg;
889 	char buf[BUFSIZ];
890 	int l, l0, len;
891 	struct sadb_sa m_sa;
892 	struct sadb_x_sa2 m_sa2;
893 	struct sadb_x_sa_replay m_replay;
894 	struct sadb_address m_addr;
895 	struct addrinfo *s, *d;
896 	int n;
897 	int plen;
898 	struct sockaddr *sa;
899 	int salen;
900 
901 	msg = (struct sadb_msg *)buf;
902 
903 	if (!srcs || !dsts)
904 		return -1;
905 
906 	/* fix up length afterwards */
907 	setkeymsg0(msg, type, satype, 0);
908 	l = sizeof(struct sadb_msg);
909 
910 	if (!no_spi) {
911 		len = sizeof(struct sadb_sa);
912 		m_sa.sadb_sa_len = PFKEY_UNIT64(len);
913 		m_sa.sadb_sa_exttype = SADB_EXT_SA;
914 		m_sa.sadb_sa_spi = htonl(p_spi);
915 		m_sa.sadb_sa_replay = p_replay > UINT8_MAX ? UINT8_MAX:
916 		    p_replay;
917 		m_sa.sadb_sa_state = 0;
918 		m_sa.sadb_sa_auth = p_alg_auth;
919 		m_sa.sadb_sa_encrypt = p_alg_enc;
920 		m_sa.sadb_sa_flags = p_ext;
921 
922 		memcpy(buf + l, &m_sa, len);
923 		l += len;
924 
925 		len = sizeof(struct sadb_x_sa2);
926 		m_sa2.sadb_x_sa2_len = PFKEY_UNIT64(len);
927 		m_sa2.sadb_x_sa2_exttype = SADB_X_EXT_SA2;
928 		m_sa2.sadb_x_sa2_mode = p_mode;
929 		m_sa2.sadb_x_sa2_reqid = p_reqid;
930 
931 		memcpy(buf + l, &m_sa2, len);
932 		l += len;
933 
934 		if (p_replay > UINT8_MAX) {
935 			len = sizeof(struct sadb_x_sa_replay);
936 			m_replay.sadb_x_sa_replay_len = PFKEY_UNIT64(len);
937 			m_replay.sadb_x_sa_replay_exttype =
938 			    SADB_X_EXT_SA_REPLAY;
939 			m_replay.sadb_x_sa_replay_replay = p_replay << 3;
940 
941 			memcpy(buf + l, &m_replay, len);
942 			l += len;
943 		}
944 	}
945 
946 	l0 = l;
947 	n = 0;
948 
949 	/* do it for all src/dst pairs */
950 	for (s = srcs; s; s = s->ai_next) {
951 		for (d = dsts; d; d = d->ai_next) {
952 			/* rewind pointer */
953 			l = l0;
954 
955 			if (s->ai_addr->sa_family != d->ai_addr->sa_family)
956 				continue;
957 			switch (s->ai_addr->sa_family) {
958 			case AF_INET:
959 				plen = sizeof(struct in_addr) << 3;
960 				break;
961 #ifdef INET6
962 			case AF_INET6:
963 				plen = sizeof(struct in6_addr) << 3;
964 				break;
965 #endif
966 			default:
967 				continue;
968 			}
969 
970 			/* set src */
971 			sa = s->ai_addr;
972 			salen = s->ai_addr->sa_len;
973 			m_addr.sadb_address_len = PFKEY_UNIT64(sizeof(m_addr) +
974 			    PFKEY_ALIGN8(salen));
975 			m_addr.sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
976 			m_addr.sadb_address_proto = IPSEC_ULPROTO_ANY;
977 			m_addr.sadb_address_prefixlen = plen;
978 			m_addr.sadb_address_reserved = 0;
979 
980 			setvarbuf(buf, &l, (struct sadb_ext *)&m_addr,
981 			    sizeof(m_addr), (caddr_t)sa, salen);
982 
983 			/* set dst */
984 			sa = d->ai_addr;
985 			salen = d->ai_addr->sa_len;
986 			m_addr.sadb_address_len = PFKEY_UNIT64(sizeof(m_addr) +
987 			    PFKEY_ALIGN8(salen));
988 			m_addr.sadb_address_exttype = SADB_EXT_ADDRESS_DST;
989 			m_addr.sadb_address_proto = IPSEC_ULPROTO_ANY;
990 			m_addr.sadb_address_prefixlen = plen;
991 			m_addr.sadb_address_reserved = 0;
992 
993 			setvarbuf(buf, &l, (struct sadb_ext *)&m_addr,
994 			    sizeof(m_addr), (caddr_t)sa, salen);
995 
996 			msg->sadb_msg_len = PFKEY_UNIT64(l);
997 
998 			sendkeymsg(buf, l);
999 
1000 			n++;
1001 		}
1002 	}
1003 
1004 	if (n == 0)
1005 		return -1;
1006 	else
1007 		return 0;
1008 }
1009 
1010 /* XXX NO BUFFER OVERRUN CHECK! BAD BAD! */
1011 static int
1012 setkeymsg_add(unsigned type, unsigned satype, struct addrinfo *srcs,
1013     struct addrinfo *dsts)
1014 {
1015 	struct sadb_msg *msg;
1016 	char buf[BUFSIZ];
1017 	int l, l0, len;
1018 	struct sadb_sa m_sa;
1019 	struct sadb_x_sa2 m_sa2;
1020 	struct sadb_address m_addr;
1021 	struct sadb_x_sa_replay m_replay;
1022 	struct addrinfo *s, *d;
1023 	int n;
1024 	int plen;
1025 	struct sockaddr *sa;
1026 	int salen;
1027 
1028 	msg = (struct sadb_msg *)buf;
1029 
1030 	if (!srcs || !dsts)
1031 		return -1;
1032 
1033 	/* fix up length afterwards */
1034 	setkeymsg0(msg, type, satype, 0);
1035 	l = sizeof(struct sadb_msg);
1036 
1037 	/* set encryption algorithm, if present. */
1038 	if (satype != SADB_X_SATYPE_IPCOMP && p_key_enc) {
1039 		struct sadb_key m_key;
1040 
1041 		m_key.sadb_key_len =
1042 			PFKEY_UNIT64(sizeof(m_key)
1043 				   + PFKEY_ALIGN8(p_key_enc_len));
1044 		m_key.sadb_key_exttype = SADB_EXT_KEY_ENCRYPT;
1045 		m_key.sadb_key_bits = p_key_enc_len * 8;
1046 		m_key.sadb_key_reserved = 0;
1047 
1048 		setvarbuf(buf, &l,
1049 			(struct sadb_ext *)&m_key, sizeof(m_key),
1050 			(caddr_t)p_key_enc, p_key_enc_len);
1051 	}
1052 
1053 	/* set authentication algorithm, if present. */
1054 	if (p_key_auth) {
1055 		struct sadb_key m_key;
1056 
1057 		m_key.sadb_key_len =
1058 			PFKEY_UNIT64(sizeof(m_key)
1059 				   + PFKEY_ALIGN8(p_key_auth_len));
1060 		m_key.sadb_key_exttype = SADB_EXT_KEY_AUTH;
1061 		m_key.sadb_key_bits = p_key_auth_len * 8;
1062 		m_key.sadb_key_reserved = 0;
1063 
1064 		setvarbuf(buf, &l,
1065 			(struct sadb_ext *)&m_key, sizeof(m_key),
1066 			(caddr_t)p_key_auth, p_key_auth_len);
1067 	}
1068 
1069 	/* set lifetime for HARD */
1070 	if (p_lt_hard != 0) {
1071 		struct sadb_lifetime m_lt;
1072 		u_int slen = sizeof(struct sadb_lifetime);
1073 
1074 		m_lt.sadb_lifetime_len = PFKEY_UNIT64(slen);
1075 		m_lt.sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD;
1076 		m_lt.sadb_lifetime_allocations = 0;
1077 		m_lt.sadb_lifetime_bytes = 0;
1078 		m_lt.sadb_lifetime_addtime = p_lt_hard;
1079 		m_lt.sadb_lifetime_usetime = 0;
1080 
1081 		memcpy(buf + l, &m_lt, slen);
1082 		l += slen;
1083 	}
1084 
1085 	/* set lifetime for SOFT */
1086 	if (p_lt_soft != 0) {
1087 		struct sadb_lifetime m_lt;
1088 		u_int slen = sizeof(struct sadb_lifetime);
1089 
1090 		m_lt.sadb_lifetime_len = PFKEY_UNIT64(slen);
1091 		m_lt.sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT;
1092 		m_lt.sadb_lifetime_allocations = 0;
1093 		m_lt.sadb_lifetime_bytes = 0;
1094 		m_lt.sadb_lifetime_addtime = p_lt_soft;
1095 		m_lt.sadb_lifetime_usetime = 0;
1096 
1097 		memcpy(buf + l, &m_lt, slen);
1098 		l += slen;
1099 	}
1100 
1101 	len = sizeof(struct sadb_sa);
1102 	m_sa.sadb_sa_len = PFKEY_UNIT64(len);
1103 	m_sa.sadb_sa_exttype = SADB_EXT_SA;
1104 	m_sa.sadb_sa_spi = htonl(p_spi);
1105 	m_sa.sadb_sa_replay = p_replay > UINT8_MAX ? UINT8_MAX: p_replay;
1106 	m_sa.sadb_sa_state = 0;
1107 	m_sa.sadb_sa_auth = p_alg_auth;
1108 	m_sa.sadb_sa_encrypt = p_alg_enc;
1109 	m_sa.sadb_sa_flags = p_ext;
1110 
1111 	memcpy(buf + l, &m_sa, len);
1112 	l += len;
1113 
1114 	len = sizeof(struct sadb_x_sa2);
1115 	m_sa2.sadb_x_sa2_len = PFKEY_UNIT64(len);
1116 	m_sa2.sadb_x_sa2_exttype = SADB_X_EXT_SA2;
1117 	m_sa2.sadb_x_sa2_mode = p_mode;
1118 	m_sa2.sadb_x_sa2_reqid = p_reqid;
1119 
1120 	memcpy(buf + l, &m_sa2, len);
1121 	l += len;
1122 
1123 	if (p_replay > UINT8_MAX) {
1124 		len = sizeof(struct sadb_x_sa_replay);
1125 		m_replay.sadb_x_sa_replay_len = PFKEY_UNIT64(len);
1126 		m_replay.sadb_x_sa_replay_exttype = SADB_X_EXT_SA_REPLAY;
1127 		m_replay.sadb_x_sa_replay_replay = p_replay << 3;
1128 
1129 		memcpy(buf + l, &m_replay, len);
1130 		l += len;
1131 	}
1132 	l0 = l;
1133 	n = 0;
1134 
1135 	/* do it for all src/dst pairs */
1136 	for (s = srcs; s; s = s->ai_next) {
1137 		for (d = dsts; d; d = d->ai_next) {
1138 			/* rewind pointer */
1139 			l = l0;
1140 
1141 			if (s->ai_addr->sa_family != d->ai_addr->sa_family)
1142 				continue;
1143 			switch (s->ai_addr->sa_family) {
1144 			case AF_INET:
1145 				plen = sizeof(struct in_addr) << 3;
1146 				break;
1147 #ifdef INET6
1148 			case AF_INET6:
1149 				plen = sizeof(struct in6_addr) << 3;
1150 				break;
1151 #endif
1152 			default:
1153 				continue;
1154 			}
1155 
1156 			/* set src */
1157 			sa = s->ai_addr;
1158 			salen = s->ai_addr->sa_len;
1159 			m_addr.sadb_address_len = PFKEY_UNIT64(sizeof(m_addr) +
1160 			    PFKEY_ALIGN8(salen));
1161 			m_addr.sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
1162 			m_addr.sadb_address_proto = IPSEC_ULPROTO_ANY;
1163 			m_addr.sadb_address_prefixlen = plen;
1164 			m_addr.sadb_address_reserved = 0;
1165 
1166 			setvarbuf(buf, &l, (struct sadb_ext *)&m_addr,
1167 			    sizeof(m_addr), (caddr_t)sa, salen);
1168 
1169 			/* set dst */
1170 			sa = d->ai_addr;
1171 			salen = d->ai_addr->sa_len;
1172 			m_addr.sadb_address_len = PFKEY_UNIT64(sizeof(m_addr) +
1173 			    PFKEY_ALIGN8(salen));
1174 			m_addr.sadb_address_exttype = SADB_EXT_ADDRESS_DST;
1175 			m_addr.sadb_address_proto = IPSEC_ULPROTO_ANY;
1176 			m_addr.sadb_address_prefixlen = plen;
1177 			m_addr.sadb_address_reserved = 0;
1178 
1179 			setvarbuf(buf, &l, (struct sadb_ext *)&m_addr,
1180 			    sizeof(m_addr), (caddr_t)sa, salen);
1181 
1182 			msg->sadb_msg_len = PFKEY_UNIT64(l);
1183 
1184 			sendkeymsg(buf, l);
1185 
1186 			n++;
1187 		}
1188 	}
1189 
1190 	if (n == 0)
1191 		return -1;
1192 	else
1193 		return 0;
1194 }
1195 
1196 static struct addrinfo *
1197 parse_addr(char *host, char *port)
1198 {
1199 	struct addrinfo hints, *res = NULL;
1200 	int error;
1201 
1202 	memset(&hints, 0, sizeof(hints));
1203 	hints.ai_family = p_aifamily;
1204 	hints.ai_socktype = SOCK_DGRAM;		/*dummy*/
1205 	hints.ai_protocol = IPPROTO_UDP;	/*dummy*/
1206 	hints.ai_flags = p_aiflags;
1207 	error = getaddrinfo(host, port, &hints, &res);
1208 	if (error != 0) {
1209 		yyerror(gai_strerror(error));
1210 		return NULL;
1211 	}
1212 	return res;
1213 }
1214 
1215 static int
1216 fix_portstr(vchar_t *spec, vchar_t *sport, vchar_t *dport)
1217 {
1218 	char *p, *p2;
1219 	u_int l;
1220 
1221 	l = 0;
1222 	for (p = spec->buf; *p != ',' && *p != '\0' && l < spec->len; p++, l++)
1223 		;
1224 	if (*p == '\0') {
1225 		p2 = "0";
1226 	} else {
1227 		if (*p == ',') {
1228 			*p = '\0';
1229 			p2 = ++p;
1230 		}
1231 		for (p = p2; *p != '\0' && l < spec->len; p++, l++)
1232 			;
1233 		if (*p != '\0' || *p2 == '\0') {
1234 			yyerror("invalid an upper layer protocol spec");
1235 			return -1;
1236 		}
1237 	}
1238 
1239 	sport->buf = strdup(spec->buf);
1240 	if (!sport->buf) {
1241 		yyerror("insufficient memory");
1242 		return -1;
1243 	}
1244 	sport->len = strlen(sport->buf);
1245 	dport->buf = strdup(p2);
1246 	if (!dport->buf) {
1247 		yyerror("insufficient memory");
1248 		return -1;
1249 	}
1250 	dport->len = strlen(dport->buf);
1251 
1252 	return 0;
1253 }
1254 
1255 static int
1256 setvarbuf(char *buf, int *off, struct sadb_ext *ebuf, int elen, caddr_t vbuf,
1257     int vlen)
1258 {
1259 	memset(buf + *off, 0, PFKEY_UNUNIT64(ebuf->sadb_ext_len));
1260 	memcpy(buf + *off, (caddr_t)ebuf, elen);
1261 	memcpy(buf + *off + elen, vbuf, vlen);
1262 	(*off) += PFKEY_ALIGN8(elen + vlen);
1263 
1264 	return 0;
1265 }
1266 
1267 void
1268 parse_init(void)
1269 {
1270 	p_spi = 0;
1271 
1272 	p_ext = SADB_X_EXT_CYCSEQ;
1273 	p_alg_enc = SADB_EALG_NONE;
1274 	p_alg_auth = SADB_AALG_NONE;
1275 	p_mode = IPSEC_MODE_ANY;
1276 	p_reqid = 0;
1277 	p_replay = 0;
1278 	p_key_enc_len = p_key_auth_len = 0;
1279 	p_key_enc = p_key_auth = 0;
1280 	p_lt_hard = p_lt_soft = 0;
1281 
1282 	p_aiflags = 0;
1283 	p_aifamily = PF_UNSPEC;
1284 }
1285 
1286 void
1287 free_buffer(void)
1288 {
1289 	/* we got tons of memory leaks in the parser anyways, leave them */
1290 }
1291