usr.sbin/setkey/parse.y

   1 /*      $FreeBSD: src/usr.sbin/setkey/parse.y,v 1.1.2.2 2001/07/03 11:02:17 ume Exp $   */
   2 /*      $DragonFly: src/usr.sbin/setkey/parse.y,v 1.4 2004/03/24 18:23:46 cpressey Exp $        */
   3 /*      $KAME: kame/kame/kame/setkey/parse.y,v 1.36 2001/06/07 15:53:12 sakane Exp $    */
   4
   5 /*
   6  * Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project.
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  * 3. Neither the name of the project nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 %{
  35 #include <sys/types.h>
  36 #include <sys/param.h>
  37 #include <sys/socket.h>
  38
  39 #include <net/route.h>
  40 #include <netinet/in.h>
  41 #include <net/pfkeyv2.h>
  42 #include <netkey/key_var.h>
  43 #include <netinet6/ipsec.h>
  44 #include <arpa/inet.h>
  45
  46 #include <string.h>
  47 #include <unistd.h>
  48 #include <stdio.h>
  49 #include <netdb.h>
  50 #include <ctype.h>
  51 #include <errno.h>
  52
  53 #include "libpfkey.h"
  54 #include "vchar.h"
  55
  56 #define ATOX(c) \
  57   (isdigit(c) ? (c - '0') : (isupper(c) ? (c - 'A' + 10) : (c - 'a' + 10) ))
  58
  59 u_int p_type;
  60 u_int32_t p_spi;
  61 int p_no_spi;
  62 struct sockaddr *p_src, *p_dst;
  63 u_int p_prefs, p_prefd, p_upper;
  64 u_int p_satype, p_ext, p_alg_enc, p_alg_auth, p_replay, p_mode;
  65 u_int32_t p_reqid;
  66 u_int p_key_enc_len, p_key_auth_len;
  67 caddr_t p_key_enc, p_key_auth;
  68 time_t p_lt_hard, p_lt_soft;
  69
  70 u_int p_policy_len;
  71 char *p_policy;
  72
  73 /* temporary buffer */
  74 static struct sockaddr *pp_addr;
  75 static u_int pp_prefix;
  76 static u_int pp_port;
  77 static caddr_t pp_key;
  78
  79 extern u_char m_buf[BUFSIZ];
  80 extern int m_len;
  81 extern char cmdarg[8192];
  82 extern int f_debug;
  83
  84 static struct addrinfo *parse_addr(char *, char *, int);
  85 static int setvarbuf(int *, struct sadb_ext *, int, caddr_t, int);
  86 void parse_init(void);
  87 void free_buffer(void);
  88
  89 extern int setkeymsg(void);
  90 extern int sendkeymsg(void);
  91
  92 extern int yylex(void);
  93 extern void yyfatal(const char *);
  94 extern void yyerror(const char *);
  95 %}
  96
  97 %union {
  98         unsigned long num;
  99         vchar_t val;
 100 }
 101
 102 %token EOT
 103 %token ADD GET DELETE FLUSH DUMP
 104 %token ADDRESS PREFIX PORT PORTANY
 105 %token UP_PROTO PR_ESP PR_AH PR_IPCOMP
 106 %token F_PROTOCOL F_AUTH F_ENC F_REPLAY F_COMP F_RAWCPI
 107 %token F_MODE MODE F_REQID
 108 %token F_EXT EXTENSION NOCYCLICSEQ
 109 %token ALG_AUTH ALG_ENC ALG_ENC_DESDERIV ALG_ENC_DES32IV ALG_COMP
 110 %token F_LIFETIME_HARD F_LIFETIME_SOFT
 111 %token DECSTRING QUOTEDSTRING HEXSTRING STRING ANY
 112         /* SPD management */
 113 %token SPDADD SPDDELETE SPDDUMP SPDFLUSH
 114 %token F_POLICY PL_REQUESTS
 115
 116 %type <num> PORT PREFIX EXTENSION MODE
 117 %type <num> UP_PROTO PR_ESP PR_AH PR_IPCOMP
 118 %type <num> ALG_AUTH ALG_ENC ALG_ENC_DESDERIV ALG_ENC_DES32IV ALG_COMP
 119 %type <num> DECSTRING
 120 %type <val> ADDRESS PL_REQUESTS
 121 %type <val> key_string policy_requests
 122 %type <val> QUOTEDSTRING HEXSTRING STRING
 123
 124 %%
 125 commands
 126         :       /*NOTHING*/
 127         |       commands command
 128                 {
 129                         if (f_debug) {
 130                                 printf("cmdarg:\n%s\n", cmdarg);
 131                         } else {
 132                                 setkeymsg();
 133                                 sendkeymsg();
 134                         }
 135                         free_buffer();
 136                         parse_init();
 137                 }
 138         ;
 139
 140 command
 141         :       add_command
 142         |       get_command
 143         |       delete_command
 144         |       deleteall_command
 145         |       flush_command
 146         |       dump_command
 147         |       spdadd_command
 148         |       spddelete_command
 149         |       spddump_command
 150         |       spdflush_command
 151         ;
 152         /* commands concerned with management, there is in tail of this file. */
 153
 154         /* add command */
 155 add_command
 156         :       ADD { p_type = SADB_ADD; }
 157                 sa_selector_spec extension_spec algorithm_spec EOT
 158         ;
 159
 160         /* delete */
 161 delete_command
 162         :       DELETE { p_type = SADB_DELETE; }
 163                 sa_selector_spec extension_spec
 164                 {
 165                         if (p_mode != IPSEC_MODE_ANY)
 166                                 yyerror("WARNING: mode is obsoleted.");
 167                 }
 168                 EOT
 169         ;
 170
 171         /* deleteall command */
 172 deleteall_command
 173         :       DELETEALL { p_type = SADB_DELETE; }
 174                 ipaddress { p_src = pp_addr; }
 175                 ipaddress { p_dst = pp_addr; }
 176                 protocol_spec
 177                 { p_no_spi = 1; }
 178                 EOT
 179         ;
 180
 181         /* get command */
 182 get_command
 183         :       GET { p_type = SADB_GET; }
 184                 sa_selector_spec extension_spec
 185                 {
 186                         if (p_mode != IPSEC_MODE_ANY)
 187                                 yyerror("WARNING: mode is obsoleted.");
 188                 }
 189                 EOT
 190         ;
 191
 192         /* flush */
 193 flush_command
 194         :       FLUSH { p_type = SADB_FLUSH; }
 195                 protocol_spec EOT
 196         ;
 197
 198         /* dump */
 199 dump_command
 200         :       DUMP { p_type = SADB_DUMP; }
 201                 protocol_spec EOT
 202         ;
 203
 204         /* sa_selector_spec */
 205 sa_selector_spec
 206         :       ipaddress { p_src = pp_addr; }
 207                 ipaddress { p_dst = pp_addr; }
 208                 protocol_spec spi
 209         ;
 210
 211 protocol_spec
 212         :       /*NOTHING*/ { p_satype = SADB_SATYPE_UNSPEC; }
 213         |       PR_ESP
 214                 {
 215                         p_satype = SADB_SATYPE_ESP;
 216                         if ($1 == 1)
 217                                 p_ext |= SADB_X_EXT_OLD;
 218                         else
 219                                 p_ext &= ~SADB_X_EXT_OLD;
 220                 }
 221         |       PR_AH
 222                 {
 223                         p_satype = SADB_SATYPE_AH;
 224                         if ($1 == 1)
 225                                 p_ext |= SADB_X_EXT_OLD;
 226                         else
 227                                 p_ext &= ~SADB_X_EXT_OLD;
 228                 }
 229         |       PR_IPCOMP
 230                 {
 231                         p_satype = SADB_X_SATYPE_IPCOMP;
 232                 }
 233         ;
 234
 235 spi
 236         :       DECSTRING { p_spi = $1; }
 237         |       HEXSTRING
 238                 {
 239                         caddr_t bp;
 240                         caddr_t yp = $1.buf;
 241                         char buf0[4], buf[4];
 242                         int i, j;
 243
 244                         /* sanity check */
 245                         if ($1.len > 4) {
 246                                 yyerror("SPI too big.");
 247                                 free($1.buf);
 248                                 return -1;
 249                         }
 250
 251                         bp = buf0;
 252                         while (*yp) {
 253                                 *bp = (ATOX(yp[0]) << 4) | ATOX(yp[1]);
 254                                 yp += 2, bp++;
 255                         }
 256
 257                         /* initialize */
 258                         for (i = 0; i < 4; i++) buf[i] = 0;
 259
 260                         for (j = $1.len - 1, i = 3; j >= 0; j--, i--)
 261                                 buf[i] = buf0[j];
 262
 263                         /* XXX: endian */
 264                         p_spi = ntohl(*(u_int32_t *)buf);
 265
 266                         free($1.buf);
 267                 }
 268         ;
 269
 270 algorithm_spec
 271         :       esp_spec
 272         |       ah_spec
 273         |       ipcomp_spec
 274         ;
 275
 276 esp_spec
 277         :       F_ENC enc_alg enc_key F_AUTH auth_alg auth_key
 278         |       F_ENC enc_alg enc_key
 279         ;
 280
 281 ah_spec
 282         :       F_AUTH auth_alg auth_key
 283         ;
 284
 285 ipcomp_spec
 286         :       F_COMP ALG_COMP { p_alg_enc = $2; }
 287         |       F_COMP ALG_COMP { p_alg_enc = $2; }
 288                 F_RAWCPI { p_ext |= SADB_X_EXT_RAWCPI; }
 289         ;
 290
 291 enc_alg
 292         :       ALG_ENC { p_alg_enc = $1; }
 293         |       ALG_ENC_DESDERIV
 294                 {
 295                         p_alg_enc = $1;
 296                         if (p_ext & SADB_X_EXT_OLD) {
 297                                 yyerror("algorithm mismatched.");
 298                                 return -1;
 299                         }
 300                         p_ext |= SADB_X_EXT_DERIV;
 301                 }
 302         |       ALG_ENC_DES32IV
 303                 {
 304                         p_alg_enc = $1;
 305                         if (!(p_ext & SADB_X_EXT_OLD)) {
 306                                 yyerror("algorithm mismatched.");
 307                                 return -1;
 308                         }
 309                         p_ext |= SADB_X_EXT_IV4B;
 310                 }
 311         ;
 312
 313 enc_key
 314         :       /*NOTHING*/
 315                 {
 316                         if (p_alg_enc != SADB_EALG_NULL) {
 317                                 yyerror("no key found.");
 318                                 return -1;
 319                         }
 320                 }
 321         |       key_string
 322                 {
 323                         p_key_enc_len = $1.len;
 324                         p_key_enc = pp_key;
 325
 326                         if (ipsec_check_keylen(SADB_EXT_SUPPORTED_ENCRYPT,
 327                                         p_alg_enc,
 328                                         PFKEY_UNUNIT64(p_key_enc_len)) < 0) {
 329                                 yyerror(ipsec_strerror());
 330                                 return -1;
 331                         }
 332                 }
 333         ;
 334
 335 auth_alg
 336         :       ALG_AUTH { p_alg_auth = $1; }
 337         ;
 338
 339 auth_key
 340         :       /*NOTHING*/
 341                 {
 342                         if (p_alg_auth != SADB_X_AALG_NULL) {
 343                                 yyerror("no key found.");
 344                                 return -1;
 345                         }
 346                 }
 347         |       key_string
 348                 {
 349                         p_key_auth_len = $1.len;
 350                         p_key_auth = pp_key;
 351
 352                         if (ipsec_check_keylen(SADB_EXT_SUPPORTED_AUTH,
 353                                         p_alg_auth,
 354                                         PFKEY_UNUNIT64(p_key_auth_len)) < 0) {
 355                                 yyerror(ipsec_strerror());
 356                                 return -1;
 357                         }
 358                 }
 359         ;
 360
 361 key_string
 362         :       QUOTEDSTRING
 363                 {
 364                         pp_key = $1.buf;
 365                         /* free pp_key later */
 366                 }
 367         |       HEXSTRING
 368                 {
 369                         caddr_t bp;
 370                         caddr_t yp = $1.buf;
 371
 372                         if ((pp_key = malloc($1.len)) == 0) {
 373                                 free($1.buf);
 374                                 yyerror("not enough core");
 375                                 return -1;
 376                         }
 377                         memset(pp_key, 0, $1.len);
 378
 379                         bp = pp_key;
 380                         while (*yp) {
 381                                 *bp = (ATOX(yp[0]) << 4) | ATOX(yp[1]);
 382                                 yp += 2, bp++;
 383                         }
 384
 385                         free($1.buf);
 386                 }
 387         ;
 388
 389 extension_spec
 390         :       /*NOTHING*/
 391         |       extension_spec extension
 392         ;
 393
 394 extension
 395         :       F_EXT EXTENSION { p_ext |= $2; }
 396         |       F_EXT NOCYCLICSEQ { p_ext &= ~SADB_X_EXT_CYCSEQ; }
 397         |       F_MODE MODE { p_mode = $2; }
 398         |       F_MODE ANY { p_mode = IPSEC_MODE_ANY; }
 399         |       F_REQID DECSTRING { p_reqid = $2; }
 400         |       F_REPLAY DECSTRING
 401                 {
 402                         if (p_ext & SADB_X_EXT_OLD) {
 403                                 yyerror("replay prevention "
 404                                         "only use on new spec.");
 405                                 return -1;
 406                         }
 407                         p_replay = $2;
 408                 }
 409         |       F_LIFETIME_HARD DECSTRING { p_lt_hard = $2; }
 410         |       F_LIFETIME_SOFT DECSTRING { p_lt_soft = $2; }
 411         ;
 412
 413         /* definition about command for SPD management */
 414         /* spdadd */
 415 spdadd_command
 416         :       SPDADD
 417                 {
 418                         p_type = SADB_X_SPDADD;
 419                         p_satype = SADB_SATYPE_UNSPEC;
 420                 }
 421                 sp_selector_spec policy_spec EOT
 422         ;
 423
 424 spddelete_command:
 425                 SPDDELETE
 426                 {
 427                         p_type = SADB_X_SPDDELETE;
 428                         p_satype = SADB_SATYPE_UNSPEC;
 429                 }
 430                 sp_selector_spec policy_spec EOT
 431         ;
 432
 433 spddump_command:
 434                 SPDDUMP
 435                 {
 436                         p_type = SADB_X_SPDDUMP;
 437                         p_satype = SADB_SATYPE_UNSPEC;
 438                 }
 439                 EOT
 440         ;
 441
 442 spdflush_command:
 443                 SPDFLUSH
 444                 {
 445                         p_type = SADB_X_SPDFLUSH;
 446                         p_satype = SADB_SATYPE_UNSPEC;
 447                 }
 448                 EOT
 449         ;
 450
 451         /* sp_selector_spec */
 452 sp_selector_spec
 453         :       ipaddress { p_src = pp_addr; }
 454                 prefix { p_prefs = pp_prefix; }
 455                 port
 456                 {
 457                         switch (p_src->sa_family) {
 458                         case AF_INET:
 459                                 ((struct sockaddr_in *)p_src)->sin_port =
 460                                     htons(pp_port);
 461                                 break;
 462 #ifdef INET6
 463                         case AF_INET6:
 464                                 ((struct sockaddr_in6 *)p_src)->sin6_port =
 465                                     htons(pp_port);
 466                                 break;
 467 #endif
 468                         default:
 469                                 exit(1); /*XXX*/
 470                         }
 471                 }
 472                 ipaddress { p_dst = pp_addr; }
 473                 prefix { p_prefd = pp_prefix; }
 474                 port
 475                 {
 476                         switch (p_dst->sa_family) {
 477                         case AF_INET:
 478                                 ((struct sockaddr_in *)p_dst)->sin_port =
 479                                     htons(pp_port);
 480                                 break;
 481 #ifdef INET6
 482                         case AF_INET6:
 483                                 ((struct sockaddr_in6 *)p_dst)->sin6_port =
 484                                     htons(pp_port);
 485                                 break;
 486 #endif
 487                         default:
 488                                 exit(1); /*XXX*/
 489                         }
 490                 }
 491                 upper_spec
 492                 {
 493                         /* XXX is it something userland should check? */
 494 #if 0
 495                         switch (p_upper) {
 496                         case IPPROTO_ICMP:
 497                         case IPPROTO_ICMPV6:
 498                                 if (_INPORTBYSA(p_src) != IPSEC_PORT_ANY
 499                                  || _INPORTBYSA(p_dst) != IPSEC_PORT_ANY) {
 500                                         yyerror("port number must be \"any\".");
 501                                         return -1;
 502                                 }
 503                                 if ((pp_addr->sa_family == AF_INET6
 504                                   && p_upper == IPPROTO_ICMP)
 505                                  || (pp_addr->sa_family == AF_INET
 506                                   && p_upper == IPPROTO_ICMPV6)) {
 507                                         yyerror("upper layer protocol "
 508                                                 "mismatched.\n");
 509                                         return -1;
 510                                 }
 511                                 break;
 512                         default:
 513                                 break;
 514                         }
 515 #endif
 516                 }
 517         ;
 518
 519 ipaddress
 520         :       ADDRESS
 521                 {
 522                         struct addrinfo *res;
 523
 524                         res = parse_addr($1.buf, NULL, AI_NUMERICHOST);
 525                         if (res == NULL) {
 526                                 free($1.buf);
 527                                 return -1;
 528                         }
 529                         pp_addr = (struct sockaddr *)malloc(res->ai_addrlen);
 530                         if (!pp_addr) {
 531                                 yyerror("not enough core");
 532                                 goto end;
 533                         }
 534
 535                         memcpy(pp_addr, res->ai_addr, res->ai_addrlen);
 536                     end:
 537                         freeaddrinfo(res);
 538                         free($1.buf);
 539                 }
 540         ;
 541
 542 prefix
 543         :       /*NOTHING*/ { pp_prefix = ~0; }
 544         |       PREFIX { pp_prefix = $1; }
 545         ;
 546
 547 port
 548         :       /*NOTHING*/ { pp_port = IPSEC_PORT_ANY; }
 549         |       PORT { pp_port = $1; }
 550         |       PORTANY { pp_port = IPSEC_PORT_ANY; }
 551         ;
 552
 553 upper_spec
 554         :       DECSTRING { p_upper = $1; }
 555         |       UP_PROTO { p_upper = $1; }
 556         |       ANY { p_upper = IPSEC_ULPROTO_ANY; }
 557         |       STRING
 558                 {
 559                         struct protoent *ent;
 560
 561                         ent = getprotobyname($1.buf);
 562                         if (ent)
 563                                 p_upper = ent->p_proto;
 564                         else {
 565                                 if (strcmp("icmp6", $1.buf) == 0) {
 566                                         p_upper = IPPROTO_ICMPV6;
 567                                 } else if(strcmp("ip4", $1.buf) == 0) {
 568                                         p_upper = IPPROTO_IPV4;
 569                                 } else {
 570                                         yyerror("invalid upper layer protocol");
 571                                         free($1.buf);
 572                                         return -1;
 573                                 }
 574                         }
 575                         free($1.buf);
 576                 }
 577         ;
 578
 579 policy_spec
 580         :       F_POLICY policy_requests
 581                 {
 582                         p_policy = ipsec_set_policy($2.buf, $2.len);
 583                         if (p_policy == NULL) {
 584                                 free($2.buf);
 585                                 p_policy = NULL;
 586                                 yyerror(ipsec_strerror());
 587                                 return -1;
 588                         }
 589
 590                         p_policy_len = ipsec_get_policylen(p_policy);
 591
 592                         free($2.buf);
 593                 }
 594         ;
 595
 596 policy_requests
 597         :       PL_REQUESTS { $$ = $1; }
 598         ;
 599
 600 %%
 601
 602 int
 603 setkeymsg(void)
 604 {
 605         struct sadb_msg m_msg;
 606
 607         m_msg.sadb_msg_version = PF_KEY_V2;
 608         m_msg.sadb_msg_type = p_type;
 609         m_msg.sadb_msg_errno = 0;
 610         m_msg.sadb_msg_satype = p_satype;
 611         m_msg.sadb_msg_reserved = 0;
 612         m_msg.sadb_msg_seq = 0;
 613         m_msg.sadb_msg_pid = getpid();
 614
 615         m_len = sizeof(struct sadb_msg);
 616         memcpy(m_buf, &m_msg, m_len);
 617
 618         switch (p_type) {
 619         case SADB_FLUSH:
 620         case SADB_DUMP:
 621                 break;
 622
 623         case SADB_ADD:
 624                 /* set encryption algorithm, if present. */
 625                 if (p_satype != SADB_X_SATYPE_IPCOMP && p_alg_enc != SADB_EALG_NONE) {
 626                         struct sadb_key m_key;
 627
 628                         m_key.sadb_key_len =
 629                                 PFKEY_UNIT64(sizeof(m_key)
 630                                            + PFKEY_ALIGN8(p_key_enc_len));
 631                         m_key.sadb_key_exttype = SADB_EXT_KEY_ENCRYPT;
 632                         m_key.sadb_key_bits = p_key_enc_len * 8;
 633                         m_key.sadb_key_reserved = 0;
 634
 635                         setvarbuf(&m_len,
 636                                 (struct sadb_ext *)&m_key, sizeof(m_key),
 637                                 (caddr_t)p_key_enc, p_key_enc_len);
 638                 }
 639
 640                 /* set authentication algorithm, if present. */
 641                 if (p_alg_auth != SADB_AALG_NONE) {
 642                         struct sadb_key m_key;
 643
 644                         m_key.sadb_key_len =
 645                                 PFKEY_UNIT64(sizeof(m_key)
 646                                            + PFKEY_ALIGN8(p_key_auth_len));
 647                         m_key.sadb_key_exttype = SADB_EXT_KEY_AUTH;
 648                         m_key.sadb_key_bits = p_key_auth_len * 8;
 649                         m_key.sadb_key_reserved = 0;
 650
 651                         setvarbuf(&m_len,
 652                                 (struct sadb_ext *)&m_key, sizeof(m_key),
 653                                 (caddr_t)p_key_auth, p_key_auth_len);
 654                 }
 655
 656                 /* set lifetime for HARD */
 657                 if (p_lt_hard != 0) {
 658                         struct sadb_lifetime m_lt;
 659                         u_int len = sizeof(struct sadb_lifetime);
 660
 661                         m_lt.sadb_lifetime_len = PFKEY_UNIT64(len);
 662                         m_lt.sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD;
 663                         m_lt.sadb_lifetime_allocations = 0;
 664                         m_lt.sadb_lifetime_bytes = 0;
 665                         m_lt.sadb_lifetime_addtime = p_lt_hard;
 666                         m_lt.sadb_lifetime_usetime = 0;
 667
 668                         memcpy(m_buf + m_len, &m_lt, len);
 669                         m_len += len;
 670                 }
 671
 672                 /* set lifetime for SOFT */
 673                 if (p_lt_soft != 0) {
 674                         struct sadb_lifetime m_lt;
 675                         u_int len = sizeof(struct sadb_lifetime);
 676
 677                         m_lt.sadb_lifetime_len = PFKEY_UNIT64(len);
 678                         m_lt.sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT;
 679                         m_lt.sadb_lifetime_allocations = 0;
 680                         m_lt.sadb_lifetime_bytes = 0;
 681                         m_lt.sadb_lifetime_addtime = p_lt_soft;
 682                         m_lt.sadb_lifetime_usetime = 0;
 683
 684                         memcpy(m_buf + m_len, &m_lt, len);
 685                         m_len += len;
 686                 }
 687                 /* FALLTHROUGH */
 688
 689         case SADB_DELETE:
 690         case SADB_GET:
 691             {
 692                 struct sadb_sa m_sa;
 693                 struct sadb_x_sa2 m_sa2;
 694                 struct sadb_address m_addr;
 695                 u_int len;
 696
 697                 if (p_no_spi == 0) {
 698                         len = sizeof(struct sadb_sa);
 699                         m_sa.sadb_sa_len = PFKEY_UNIT64(len);
 700                         m_sa.sadb_sa_exttype = SADB_EXT_SA;
 701                         m_sa.sadb_sa_spi = htonl(p_spi);
 702                         m_sa.sadb_sa_replay = p_replay;
 703                         m_sa.sadb_sa_state = 0;
 704                         m_sa.sadb_sa_auth = p_alg_auth;
 705                         m_sa.sadb_sa_encrypt = p_alg_enc;
 706                         m_sa.sadb_sa_flags = p_ext;
 707
 708                         memcpy(m_buf + m_len, &m_sa, len);
 709                         m_len += len;
 710
 711                         len = sizeof(struct sadb_x_sa2);
 712                         m_sa2.sadb_x_sa2_len = PFKEY_UNIT64(len);
 713                         m_sa2.sadb_x_sa2_exttype = SADB_X_EXT_SA2;
 714                         m_sa2.sadb_x_sa2_mode = p_mode;
 715                         m_sa2.sadb_x_sa2_reqid = p_reqid;
 716
 717                         memcpy(m_buf + m_len, &m_sa2, len);
 718                         m_len += len;
 719                 }
 720
 721                 /* set src */
 722                 m_addr.sadb_address_len =
 723                         PFKEY_UNIT64(sizeof(m_addr)
 724                                    + PFKEY_ALIGN8(p_src->sa_len));
 725                 m_addr.sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
 726                 m_addr.sadb_address_proto = IPSEC_ULPROTO_ANY;
 727                 switch (p_src->sa_family) {
 728                 case AF_INET:
 729                         m_addr.sadb_address_prefixlen =
 730                             sizeof(struct in_addr) << 3;
 731                         break;
 732 #ifdef INET6
 733                 case AF_INET6:
 734                         m_addr.sadb_address_prefixlen =
 735                             sizeof(struct in6_addr) << 3;
 736                         break;
 737 #endif
 738                 default:
 739                         yyerror("unsupported address family");
 740                         exit(1);        /*XXX*/
 741                 }
 742                 m_addr.sadb_address_reserved = 0;
 743
 744                 setvarbuf(&m_len,
 745                         (struct sadb_ext *)&m_addr, sizeof(m_addr),
 746                         (caddr_t)p_src, p_src->sa_len);
 747
 748                 /* set dst */
 749                 m_addr.sadb_address_len =
 750                         PFKEY_UNIT64(sizeof(m_addr)
 751                                    + PFKEY_ALIGN8(p_dst->sa_len));
 752                 m_addr.sadb_address_exttype = SADB_EXT_ADDRESS_DST;
 753                 m_addr.sadb_address_proto = IPSEC_ULPROTO_ANY;
 754                 switch (p_dst->sa_family) {
 755                 case AF_INET:
 756                         m_addr.sadb_address_prefixlen =
 757                             sizeof(struct in_addr) << 3;
 758                         break;
 759 #ifdef INET6
 760                 case AF_INET6:
 761                         m_addr.sadb_address_prefixlen =
 762                             sizeof(struct in6_addr) << 3;
 763                         break;
 764 #endif
 765                 default:
 766                         yyerror("unsupported address family");
 767                         exit(1);        /*XXX*/
 768                 }
 769                 m_addr.sadb_address_reserved = 0;
 770
 771                 setvarbuf(&m_len,
 772                         (struct sadb_ext *)&m_addr, sizeof(m_addr),
 773                         (caddr_t)p_dst, p_dst->sa_len);
 774             }
 775                 break;
 776
 777         /* for SPD management */
 778         case SADB_X_SPDFLUSH:
 779         case SADB_X_SPDDUMP:
 780                 break;
 781
 782         case SADB_X_SPDADD:
 783         case SADB_X_SPDDELETE:
 784             {
 785                 struct sadb_address m_addr;
 786                 u_int8_t plen;
 787
 788                 memcpy(m_buf + m_len, p_policy, p_policy_len);
 789                 m_len += p_policy_len;
 790                 free(p_policy);
 791                 p_policy = NULL;
 792
 793                 /* set src */
 794                 m_addr.sadb_address_len =
 795                         PFKEY_UNIT64(sizeof(m_addr)
 796                                    + PFKEY_ALIGN8(p_src->sa_len));
 797                 m_addr.sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
 798                 m_addr.sadb_address_proto = p_upper;
 799                 switch (p_src->sa_family) {
 800                 case AF_INET:
 801                         plen = sizeof(struct in_addr) << 3;
 802                         break;
 803 #ifdef INET6
 804                 case AF_INET6:
 805                         plen = sizeof(struct in6_addr) << 3;
 806                         break;
 807 #endif
 808                 default:
 809                         yyerror("unsupported address family");
 810                         exit(1);        /*XXX*/
 811                 }
 812                 m_addr.sadb_address_prefixlen =
 813                     (p_prefs != ~0 ? p_prefs : plen);
 814                 m_addr.sadb_address_reserved = 0;
 815
 816                 setvarbuf(&m_len,
 817                         (struct sadb_ext *)&m_addr, sizeof(m_addr),
 818                         (caddr_t)p_src, p_src->sa_len);
 819
 820                 /* set dst */
 821                 m_addr.sadb_address_len =
 822                         PFKEY_UNIT64(sizeof(m_addr)
 823                                    + PFKEY_ALIGN8(p_dst->sa_len));
 824                 m_addr.sadb_address_exttype = SADB_EXT_ADDRESS_DST;
 825                 m_addr.sadb_address_proto = p_upper;
 826                 switch (p_dst->sa_family) {
 827                 case AF_INET:
 828                         plen = sizeof(struct in_addr) << 3;
 829                         break;
 830 #ifdef INET6
 831                 case AF_INET6:
 832                         plen = sizeof(struct in6_addr) << 3;
 833                         break;
 834 #endif
 835                 default:
 836                         yyerror("unsupported address family");
 837                         exit(1);        /*XXX*/
 838                 }
 839                 m_addr.sadb_address_prefixlen =
 840                     (p_prefd != ~0 ? p_prefd : plen);
 841                 m_addr.sadb_address_reserved = 0;
 842
 843                 setvarbuf(&m_len,
 844                         (struct sadb_ext *)&m_addr, sizeof(m_addr),
 845                         (caddr_t)p_dst, p_dst->sa_len);
 846             }
 847                 break;
 848         }
 849
 850         ((struct sadb_msg *)m_buf)->sadb_msg_len = PFKEY_UNIT64(m_len);
 851
 852         return 0;
 853 }
 854
 855 static struct addrinfo *
 856 parse_addr(char *host, char *port, int flag)
 857 {
 858         struct addrinfo hints, *res = NULL;
 859         int error;
 860
 861         memset(&hints, 0, sizeof(hints));
 862         hints.ai_family = PF_UNSPEC;
 863         hints.ai_socktype = SOCK_DGRAM;
 864         hints.ai_flags = flag;
 865         error = getaddrinfo(host, port, &hints, &res);
 866         if (error != 0) {
 867                 yyerror(gai_strerror(error));
 868                 return NULL;
 869         }
 870         if (res->ai_next != NULL) {
 871                 yyerror(gai_strerror(error));
 872         }
 873         return res;
 874 }
 875
 876 static int
 877 setvarbuf(int *off, struct sadb_ext *ebuf, int elen, caddr_t vbuf, int vlen)
 878 {
 879         memset(m_buf + *off, 0, PFKEY_UNUNIT64(ebuf->sadb_ext_len));
 880         memcpy(m_buf + *off, (caddr_t)ebuf, elen);
 881         memcpy(m_buf + *off + elen, vbuf, vlen);
 882         (*off) += PFKEY_ALIGN8(elen + vlen);
 883
 884         return 0;
 885 }
 886
 887 void
 888 parse_init(void)
 889 {
 890         p_type = 0;
 891         p_spi = 0;
 892         p_no_spi = 0;
 893
 894         p_src = 0, p_dst = 0;
 895         pp_prefix = p_prefs = p_prefd = ~0;
 896         pp_port = IPSEC_PORT_ANY;
 897         p_upper = 0;
 898
 899         p_satype = 0;
 900         p_ext = SADB_X_EXT_CYCSEQ;
 901         p_alg_enc = SADB_EALG_NONE;
 902         p_alg_auth = SADB_AALG_NONE;
 903         p_mode = IPSEC_MODE_ANY;
 904         p_reqid = 0;
 905         p_replay = 0;
 906         p_key_enc_len = p_key_auth_len = 0;
 907         p_key_enc = p_key_auth = 0;
 908         p_lt_hard = p_lt_soft = 0;
 909
 910         p_policy_len = 0;
 911         p_policy = NULL;
 912
 913         memset(cmdarg, 0, sizeof(cmdarg));
 914
 915         return;
 916 }
 917
 918 void
 919 free_buffer(void)
 920 {
 921         if (p_src) free(p_src);
 922         if (p_dst) free(p_dst);
 923         if (p_key_enc) free(p_key_enc);
 924         if (p_key_auth) free(p_key_auth);
 925
 926         return;
 927 }
 928