GCC Code Coverage Report
Directory: ./ Exec Total Coverage
File: sbin/iked/parse.c Lines: 0 432 0.0 %
Date: 2017-11-13 Branches: 0 349 0.0 %

Line Branch Exec Source
1
#include <stdlib.h>
2
#include <string.h>
3
#define YYBYACC 1
4
#define YYMAJOR 1
5
#define YYMINOR 9
6
#define YYLEX yylex()
7
#define YYEMPTY -1
8
#define yyclearin (yychar=(YYEMPTY))
9
#define yyerrok (yyerrflag=0)
10
#define YYRECOVERING() (yyerrflag!=0)
11
#define YYPREFIX "yy"
12
#line 25 "parse.y"
13
#include <sys/types.h>
14
#include <sys/ioctl.h>
15
#include <sys/queue.h>
16
#include <sys/socket.h>
17
#include <sys/stat.h>
18
#include <net/if.h>
19
#include <netinet/in.h>
20
#include <arpa/inet.h>
21
22
#include <openssl/pem.h>
23
#include <openssl/evp.h>
24
25
#include <ctype.h>
26
#include <err.h>
27
#include <errno.h>
28
#include <fcntl.h>
29
#include <ifaddrs.h>
30
#include <limits.h>
31
#include <netdb.h>
32
#include <stdarg.h>
33
#include <stdio.h>
34
#include <stdlib.h>
35
#include <string.h>
36
#include <syslog.h>
37
#include <unistd.h>
38
#include <netdb.h>
39
#include <event.h>
40
41
#include "iked.h"
42
#include "ikev2.h"
43
#include "eap.h"
44
45
TAILQ_HEAD(files, file)		 files = TAILQ_HEAD_INITIALIZER(files);
46
static struct file {
47
	TAILQ_ENTRY(file)	 entry;
48
	FILE			*stream;
49
	char			*name;
50
	int			 lineno;
51
	int			 errors;
52
} *file;
53
EVP_PKEY	*wrap_pubkey(FILE *);
54
EVP_PKEY	*find_pubkey(const char *);
55
int		 set_policy(char *, int, struct iked_policy *);
56
int		 set_policy_auth_method(const char *, EVP_PKEY *,
57
		     struct iked_policy *);
58
struct file	*pushfile(const char *, int);
59
int		 popfile(void);
60
int		 check_file_secrecy(int, const char *);
61
int		 yyparse(void);
62
int		 yylex(void);
63
int		 yyerror(const char *, ...)
64
    __attribute__((__format__ (printf, 1, 2)))
65
    __attribute__((__nonnull__ (1)));
66
int		 kw_cmp(const void *, const void *);
67
int		 lookup(char *);
68
int		 lgetc(int);
69
int		 lungetc(int);
70
int		 findeol(void);
71
72
TAILQ_HEAD(symhead, sym)	 symhead = TAILQ_HEAD_INITIALIZER(symhead);
73
struct sym {
74
	TAILQ_ENTRY(sym)	 entry;
75
	int			 used;
76
	int			 persist;
77
	char			*nam;
78
	char			*val;
79
};
80
int		 symset(const char *, const char *, int);
81
char		*symget(const char *);
82
83
#define KEYSIZE_LIMIT	1024
84
85
static struct iked	*env = NULL;
86
static int		 debug = 0;
87
static int		 rules = 0;
88
static int		 passive = 0;
89
static int		 decouple = 0;
90
static char		*ocsp_url = NULL;
91
92
struct ipsec_xf {
93
	const char	*name;
94
	unsigned int	 id;
95
	unsigned int	 length;
96
	unsigned int	 keylength;
97
	unsigned int	 nonce;
98
	unsigned int	 noauth;
99
};
100
101
struct ipsec_transforms {
102
	const struct ipsec_xf *authxf;
103
	const struct ipsec_xf *prfxf;
104
	const struct ipsec_xf *encxf;
105
	const struct ipsec_xf *groupxf;
106
	const struct ipsec_xf *esnxf;
107
};
108
109
struct ipsec_mode {
110
	struct ipsec_transforms	*xfs;
111
	uint8_t			 ike_exch;
112
};
113
114
struct iked_transform ikev2_default_ike_transforms[] = {
115
	{ IKEV2_XFORMTYPE_ENCR, IKEV2_XFORMENCR_AES_CBC, 256 },
116
	{ IKEV2_XFORMTYPE_ENCR, IKEV2_XFORMENCR_AES_CBC, 192 },
117
	{ IKEV2_XFORMTYPE_ENCR, IKEV2_XFORMENCR_AES_CBC, 128 },
118
	{ IKEV2_XFORMTYPE_ENCR, IKEV2_XFORMENCR_3DES },
119
	{ IKEV2_XFORMTYPE_PRF,	IKEV2_XFORMPRF_HMAC_SHA2_256 },
120
	{ IKEV2_XFORMTYPE_PRF,	IKEV2_XFORMPRF_HMAC_SHA1 },
121
	{ IKEV2_XFORMTYPE_INTEGR, IKEV2_XFORMAUTH_HMAC_SHA2_256_128 },
122
	{ IKEV2_XFORMTYPE_INTEGR, IKEV2_XFORMAUTH_HMAC_SHA1_96 },
123
	{ IKEV2_XFORMTYPE_DH,	IKEV2_XFORMDH_MODP_2048 },
124
	{ IKEV2_XFORMTYPE_DH,	IKEV2_XFORMDH_MODP_1536 },
125
	{ IKEV2_XFORMTYPE_DH,	IKEV2_XFORMDH_MODP_1024 },
126
	{ 0 }
127
};
128
size_t ikev2_default_nike_transforms = ((sizeof(ikev2_default_ike_transforms) /
129
    sizeof(ikev2_default_ike_transforms[0])) - 1);
130
131
struct iked_transform ikev2_default_esp_transforms[] = {
132
	{ IKEV2_XFORMTYPE_ENCR, IKEV2_XFORMENCR_AES_CBC, 256 },
133
	{ IKEV2_XFORMTYPE_ENCR, IKEV2_XFORMENCR_AES_CBC, 192 },
134
	{ IKEV2_XFORMTYPE_ENCR, IKEV2_XFORMENCR_AES_CBC, 128 },
135
	{ IKEV2_XFORMTYPE_INTEGR, IKEV2_XFORMAUTH_HMAC_SHA2_256_128 },
136
	{ IKEV2_XFORMTYPE_INTEGR, IKEV2_XFORMAUTH_HMAC_SHA1_96 },
137
	{ IKEV2_XFORMTYPE_ESN,	IKEV2_XFORMESN_ESN },
138
	{ IKEV2_XFORMTYPE_ESN,	IKEV2_XFORMESN_NONE },
139
	{ 0 }
140
};
141
size_t ikev2_default_nesp_transforms = ((sizeof(ikev2_default_esp_transforms) /
142
    sizeof(ikev2_default_esp_transforms[0])) - 1);
143
144
const struct ipsec_xf authxfs[] = {
145
	{ "hmac-md5",		IKEV2_XFORMAUTH_HMAC_MD5_96,		16 },
146
	{ "hmac-sha1",		IKEV2_XFORMAUTH_HMAC_SHA1_96,		20 },
147
	{ "hmac-sha2-256",	IKEV2_XFORMAUTH_HMAC_SHA2_256_128,	32 },
148
	{ "hmac-sha2-384",	IKEV2_XFORMAUTH_HMAC_SHA2_384_192,	48 },
149
	{ "hmac-sha2-512",	IKEV2_XFORMAUTH_HMAC_SHA2_512_256,	64 },
150
	{ NULL }
151
};
152
153
const struct ipsec_xf prfxfs[] = {
154
	{ "hmac-md5",		IKEV2_XFORMPRF_HMAC_MD5,	16 },
155
	{ "hmac-sha1",		IKEV2_XFORMPRF_HMAC_SHA1,	20 },
156
	{ "hmac-sha2-256",	IKEV2_XFORMPRF_HMAC_SHA2_256,	32 },
157
	{ "hmac-sha2-384",	IKEV2_XFORMPRF_HMAC_SHA2_384,	48 },
158
	{ "hmac-sha2-512",	IKEV2_XFORMPRF_HMAC_SHA2_512,	64 },
159
	{ NULL }
160
};
161
162
const struct ipsec_xf *encxfs = NULL;
163
164
const struct ipsec_xf ikeencxfs[] = {
165
	{ "3des",		IKEV2_XFORMENCR_3DES,		24 },
166
	{ "3des-cbc",		IKEV2_XFORMENCR_3DES,		24 },
167
	{ "aes-128",		IKEV2_XFORMENCR_AES_CBC,	16, 16 },
168
	{ "aes-192",		IKEV2_XFORMENCR_AES_CBC,	24, 24 },
169
	{ "aes-256",		IKEV2_XFORMENCR_AES_CBC,	32, 32 },
170
	{ NULL }
171
};
172
173
const struct ipsec_xf ipsecencxfs[] = {
174
	{ "3des",		IKEV2_XFORMENCR_3DES,		24 },
175
	{ "3des-cbc",		IKEV2_XFORMENCR_3DES,		24 },
176
	{ "aes-128",		IKEV2_XFORMENCR_AES_CBC,	16, 16 },
177
	{ "aes-192",		IKEV2_XFORMENCR_AES_CBC,	24, 24 },
178
	{ "aes-256",		IKEV2_XFORMENCR_AES_CBC,	32, 32 },
179
	{ "aes-128-ctr",	IKEV2_XFORMENCR_AES_CTR,	16, 16, 4 },
180
	{ "aes-192-ctr",	IKEV2_XFORMENCR_AES_CTR,	24, 24, 4 },
181
	{ "aes-256-ctr",	IKEV2_XFORMENCR_AES_CTR,	32, 32, 4 },
182
	{ "aes-128-gcm",	IKEV2_XFORMENCR_AES_GCM_16,	16, 16, 4, 1 },
183
	{ "aes-192-gcm",	IKEV2_XFORMENCR_AES_GCM_16,	24, 24, 4, 1 },
184
	{ "aes-256-gcm",	IKEV2_XFORMENCR_AES_GCM_16,	32, 32, 4, 1 },
185
	{ "aes-128-gmac",	IKEV2_XFORMENCR_NULL_AES_GMAC,	16, 16, 4, 1 },
186
	{ "aes-192-gmac",	IKEV2_XFORMENCR_NULL_AES_GMAC,	24, 24, 4, 1 },
187
	{ "aes-256-gmac",	IKEV2_XFORMENCR_NULL_AES_GMAC,	32, 32, 4, 1 },
188
	{ "blowfish",		IKEV2_XFORMENCR_BLOWFISH,	20, 20 },
189
	{ "cast",		IKEV2_XFORMENCR_CAST,		16, 16 },
190
	{ "chacha20-poly1305",	IKEV2_XFORMENCR_CHACHA20_POLY1305,
191
								32, 32, 4, 1 },
192
	{ "null",		IKEV2_XFORMENCR_NULL,		0, 0 },
193
	{ NULL }
194
};
195
196
const struct ipsec_xf groupxfs[] = {
197
	{ "modp768",		IKEV2_XFORMDH_MODP_768 },
198
	{ "grp1",		IKEV2_XFORMDH_MODP_768 },
199
	{ "modp1024",		IKEV2_XFORMDH_MODP_1024 },
200
	{ "grp2",		IKEV2_XFORMDH_MODP_1024 },
201
	{ "ec2n155",		IKEV2_XFORMDH_EC2N_155 },
202
	{ "grp3",		IKEV2_XFORMDH_EC2N_155 },
203
	{ "ec2n185",		IKEV2_XFORMDH_EC2N_185 },
204
	{ "grp4",		IKEV2_XFORMDH_EC2N_185 },
205
	{ "modp1536",		IKEV2_XFORMDH_MODP_1536 },
206
	{ "grp5",		IKEV2_XFORMDH_MODP_1536 },
207
	{ "modp2048",		IKEV2_XFORMDH_MODP_2048 },
208
	{ "grp14",		IKEV2_XFORMDH_MODP_2048 },
209
	{ "modp3072",		IKEV2_XFORMDH_MODP_3072 },
210
	{ "grp15",		IKEV2_XFORMDH_MODP_3072 },
211
	{ "modp4096",		IKEV2_XFORMDH_MODP_4096 },
212
	{ "grp16",		IKEV2_XFORMDH_MODP_4096 },
213
	{ "modp6144",		IKEV2_XFORMDH_MODP_6144 },
214
	{ "grp17",		IKEV2_XFORMDH_MODP_6144 },
215
	{ "modp8192",		IKEV2_XFORMDH_MODP_8192 },
216
	{ "grp18",		IKEV2_XFORMDH_MODP_8192 },
217
	{ "ecp256",		IKEV2_XFORMDH_ECP_256 },
218
	{ "grp19",		IKEV2_XFORMDH_ECP_256 },
219
	{ "ecp384",		IKEV2_XFORMDH_ECP_384 },
220
	{ "grp20",		IKEV2_XFORMDH_ECP_384 },
221
	{ "ecp521",		IKEV2_XFORMDH_ECP_521 },
222
	{ "grp21",		IKEV2_XFORMDH_ECP_521 },
223
	{ "ecp192",		IKEV2_XFORMDH_ECP_192 },
224
	{ "grp25",		IKEV2_XFORMDH_ECP_192 },
225
	{ "ecp224",		IKEV2_XFORMDH_ECP_224 },
226
	{ "grp26",		IKEV2_XFORMDH_ECP_224 },
227
	{ "brainpool224",	IKEV2_XFORMDH_BRAINPOOL_P224R1 },
228
	{ "grp27",		IKEV2_XFORMDH_BRAINPOOL_P224R1 },
229
	{ "brainpool256",	IKEV2_XFORMDH_BRAINPOOL_P256R1 },
230
	{ "grp28",		IKEV2_XFORMDH_BRAINPOOL_P256R1 },
231
	{ "brainpool384",	IKEV2_XFORMDH_BRAINPOOL_P384R1 },
232
	{ "grp29",		IKEV2_XFORMDH_BRAINPOOL_P384R1 },
233
	{ "brainpool512",	IKEV2_XFORMDH_BRAINPOOL_P512R1 },
234
	{ "grp30",		IKEV2_XFORMDH_BRAINPOOL_P512R1 },
235
	{ "curve25519",		IKEV2_XFORMDH_X_CURVE25519 },
236
	{ NULL }
237
};
238
239
const struct ipsec_xf methodxfs[] = {
240
	{ "none",		IKEV2_AUTH_NONE },
241
	{ "rsa",		IKEV2_AUTH_RSA_SIG },
242
	{ "ecdsa256",		IKEV2_AUTH_ECDSA_256 },
243
	{ "ecdsa384",		IKEV2_AUTH_ECDSA_384 },
244
	{ "ecdsa521",		IKEV2_AUTH_ECDSA_521 },
245
	{ "rfc7427",		IKEV2_AUTH_SIG },
246
	{ "signature",		IKEV2_AUTH_SIG_ANY },
247
	{ NULL }
248
};
249
250
const struct ipsec_xf saxfs[] = {
251
	{ "esp",		IKEV2_SAPROTO_ESP },
252
	{ "ah",			IKEV2_SAPROTO_AH },
253
	{ NULL }
254
};
255
256
const struct ipsec_xf cpxfs[] = {
257
	{ "address", IKEV2_CFG_INTERNAL_IP4_ADDRESS,		AF_INET },
258
	{ "netmask", IKEV2_CFG_INTERNAL_IP4_NETMASK,		AF_INET },
259
	{ "name-server", IKEV2_CFG_INTERNAL_IP4_DNS,		AF_INET },
260
	{ "netbios-server", IKEV2_CFG_INTERNAL_IP4_NBNS,	AF_INET },
261
	{ "dhcp-server", IKEV2_CFG_INTERNAL_IP4_DHCP,		AF_INET },
262
	{ "address", IKEV2_CFG_INTERNAL_IP6_ADDRESS,		AF_INET6 },
263
	{ "name-server", IKEV2_CFG_INTERNAL_IP6_DNS,		AF_INET6 },
264
	{ "netbios-server", IKEV2_CFG_INTERNAL_IP6_NBNS,	AF_INET6 },
265
	{ "dhcp-server", IKEV2_CFG_INTERNAL_IP6_DHCP,		AF_INET6 },
266
	{ "protected-subnet", IKEV2_CFG_INTERNAL_IP4_SUBNET,	AF_INET },
267
	{ "protected-subnet", IKEV2_CFG_INTERNAL_IP6_SUBNET,	AF_INET6 },
268
	{ "access-server", IKEV2_CFG_INTERNAL_IP4_SERVER,	AF_INET },
269
	{ "access-server", IKEV2_CFG_INTERNAL_IP6_SERVER,	AF_INET6 },
270
	{ NULL }
271
};
272
273
const struct iked_lifetime deflifetime = {
274
	IKED_LIFETIME_BYTES,
275
	IKED_LIFETIME_SECONDS
276
};
277
278
struct ipsec_addr_wrap {
279
	struct sockaddr_storage	 address;
280
	uint8_t			 mask;
281
	int			 netaddress;
282
	sa_family_t		 af;
283
	unsigned int		 type;
284
	unsigned int		 action;
285
	char			*name;
286
	struct ipsec_addr_wrap	*next;
287
	struct ipsec_addr_wrap	*tail;
288
	struct ipsec_addr_wrap	*srcnat;
289
};
290
291
struct ipsec_hosts {
292
	struct ipsec_addr_wrap	*src;
293
	struct ipsec_addr_wrap	*dst;
294
	uint16_t		 sport;
295
	uint16_t		 dport;
296
};
297
298
struct ipsec_filters {
299
	char			*tag;
300
	unsigned int		 tap;
301
};
302
303
struct ipsec_addr_wrap	*host(const char *);
304
struct ipsec_addr_wrap	*host_v6(const char *, int);
305
struct ipsec_addr_wrap	*host_v4(const char *, int);
306
struct ipsec_addr_wrap	*host_dns(const char *, int);
307
struct ipsec_addr_wrap	*host_if(const char *, int);
308
struct ipsec_addr_wrap	*host_any(void);
309
void			 ifa_load(void);
310
int			 ifa_exists(const char *);
311
struct ipsec_addr_wrap	*ifa_lookup(const char *ifa_name);
312
struct ipsec_addr_wrap	*ifa_grouplookup(const char *);
313
void			 set_ipmask(struct ipsec_addr_wrap *, uint8_t);
314
const struct ipsec_xf	*parse_xf(const char *, unsigned int,
315
			    const struct ipsec_xf *);
316
const char		*print_xf(unsigned int, unsigned int,
317
			    const struct ipsec_xf *);
318
void			 copy_transforms(unsigned int, const struct ipsec_xf *,
319
			    const struct ipsec_xf *,
320
			    struct iked_transform *, size_t,
321
			    unsigned int *, struct iked_transform *, size_t);
322
int			 create_ike(char *, int, uint8_t, struct ipsec_hosts *,
323
			    struct ipsec_hosts *, struct ipsec_mode *,
324
			    struct ipsec_mode *, uint8_t,
325
			    uint8_t, char *, char *,
326
			    uint32_t, struct iked_lifetime *,
327
			    struct iked_auth *, struct ipsec_filters *,
328
			    struct ipsec_addr_wrap *);
329
int			 create_user(const char *, const char *);
330
int			 get_id_type(char *);
331
uint8_t			 x2i(unsigned char *);
332
int			 parsekey(unsigned char *, size_t, struct iked_auth *);
333
int			 parsekeyfile(char *, struct iked_auth *);
334
335
struct ipsec_transforms *ipsec_transforms;
336
struct ipsec_filters *ipsec_filters;
337
338
typedef struct {
339
	union {
340
		int64_t			 number;
341
		uint8_t			 ikemode;
342
		uint8_t			 dir;
343
		uint8_t			 satype;
344
		uint8_t			 proto;
345
		char			*string;
346
		uint16_t		 port;
347
		struct ipsec_hosts	*hosts;
348
		struct ipsec_hosts	 peers;
349
		struct ipsec_addr_wrap	*anyhost;
350
		struct ipsec_addr_wrap	*host;
351
		struct ipsec_addr_wrap	*cfg;
352
		struct {
353
			char		*srcid;
354
			char		*dstid;
355
		} ids;
356
		char			*id;
357
		uint8_t			 type;
358
		struct iked_lifetime	 lifetime;
359
		struct iked_auth	 ikeauth;
360
		struct iked_auth	 ikekey;
361
		struct ipsec_transforms	*transforms;
362
		struct ipsec_filters	*filters;
363
		struct ipsec_mode	*mode;
364
	} v;
365
	int lineno;
366
} YYSTYPE;
367
368
#line 369 "parse.c"
369
#define FROM 257
370
#define ESP 258
371
#define AH 259
372
#define IN 260
373
#define PEER 261
374
#define ON 262
375
#define OUT 263
376
#define TO 264
377
#define SRCID 265
378
#define DSTID 266
379
#define PSK 267
380
#define PORT 268
381
#define FILENAME 269
382
#define AUTHXF 270
383
#define PRFXF 271
384
#define ENCXF 272
385
#define ERROR 273
386
#define IKEV2 274
387
#define IKESA 275
388
#define CHILDSA 276
389
#define PASSIVE 277
390
#define ACTIVE 278
391
#define ANY 279
392
#define TAG 280
393
#define TAP 281
394
#define PROTO 282
395
#define LOCAL 283
396
#define GROUP 284
397
#define NAME 285
398
#define CONFIG 286
399
#define EAP 287
400
#define USER 288
401
#define IKEV1 289
402
#define FLOW 290
403
#define SA 291
404
#define TCPMD5 292
405
#define TUNNEL 293
406
#define TRANSPORT 294
407
#define COUPLE 295
408
#define DECOUPLE 296
409
#define SET 297
410
#define INCLUDE 298
411
#define LIFETIME 299
412
#define BYTES 300
413
#define INET 301
414
#define INET6 302
415
#define QUICK 303
416
#define SKIP 304
417
#define DEFAULT 305
418
#define IPCOMP 306
419
#define OCSP 307
420
#define IKELIFETIME 308
421
#define STRING 309
422
#define NUMBER 310
423
#define YYERRCODE 256
424
const short yylhs[] =
425
	{                                        -1,
426
    0,    0,    0,    0,    0,    0,    0,    0,    0,   41,
427
   41,   34,   35,   35,   35,   35,   35,   36,   37,   32,
428
   32,   33,   33,   31,   30,   30,    2,    2,    2,    9,
429
    9,    9,    3,    3,    3,    3,    4,    4,    6,    6,
430
    5,    5,    7,    7,    8,    8,   10,   10,   10,   10,
431
   10,   11,   11,   13,   13,   12,   12,   12,   14,   14,
432
   14,   14,   15,   43,   16,   16,   42,   42,   44,   44,
433
   44,   44,   24,   45,   24,   25,   46,   25,   18,   19,
434
   19,   19,   19,   20,   20,   20,   21,   21,   22,   22,
435
   22,   22,   27,   27,   28,   28,   26,   26,   26,   29,
436
   29,   23,   23,   48,   17,   17,   47,   47,   49,   49,
437
    1,    1,   38,   39,   39,   39,   39,   50,   50,   50,
438
   50,   50,   40,
439
};
440
const short yylen[] =
441
	{                                         2,
442
    0,    3,    2,    3,    3,    3,    3,    4,    3,    1,
443
    0,    2,    2,    2,    2,    2,    3,    3,   16,    0,
444
    1,    1,    2,    3,    0,    1,    0,    1,    1,    0,
445
    1,    1,    0,    2,    2,    2,    1,    1,    1,    3,
446
    6,    6,    0,    2,    1,    1,    0,    4,    4,    2,
447
    2,    1,    1,    1,    3,    1,    4,    1,    0,    4,
448
    2,    2,    1,    0,    2,    0,    2,    1,    2,    2,
449
    2,    2,    0,    0,    3,    0,    0,    3,    3,    0,
450
    1,    1,    1,    0,    1,    1,    0,    1,    0,    2,
451
    2,    1,    1,    1,    1,    1,    0,    2,    4,    0,
452
    2,    1,    2,    0,    2,    0,    2,    1,    2,    2,
453
    2,    1,    3,    1,    1,    1,    1,    1,    1,    1,
454
    1,    1,    0,
455
};
456
const short yydefred[] =
457
	{                                      1,
458
    0,    0,  119,  120,    0,    0,  114,  116,  118,  117,
459
  121,  122,    0,    0,    0,    3,    0,    0,    0,    0,
460
    0,  123,  115,    9,   26,    0,    0,   14,   13,   15,
461
   16,    0,   12,    0,    2,    4,    5,    6,    7,    0,
462
   81,   82,   83,    0,    0,   18,   17,  112,    0,    8,
463
   28,   29,    0,   85,   86,    0,  111,   31,   32,    0,
464
   88,   79,    0,    0,   35,   36,   37,   38,   34,    0,
465
    0,   39,    0,   58,    0,    0,    0,    0,    0,    0,
466
   10,    0,    0,    0,    0,    0,    0,    0,   53,    0,
467
   52,    0,   74,    0,   40,   55,   45,   46,   44,    0,
468
    0,    0,    0,    0,    0,   77,    0,    0,   57,    0,
469
   48,   49,   75,    0,    0,    0,    0,    0,   41,   42,
470
    0,    0,    0,    0,    0,   68,   78,   63,    0,   62,
471
    0,    0,   69,   71,   70,   72,   67,    0,   96,   95,
472
  101,    0,    0,   60,    0,    0,    0,   92,    0,    0,
473
    0,  102,   90,   91,    0,   22,    0,    0,   94,   93,
474
   99,  103,    0,   19,    0,   23,   24,    0,    0,    0,
475
  108,  109,  110,  107,
476
};
477
const short yydgoto[] =
478
	{                                       1,
479
   49,   53,   64,   69,   72,   73,   86,   99,   60,   82,
480
   90,   76,   77,  118,  129,  113,  164,   44,   45,   56,
481
   62,  149,  153,   94,  107,  143,  161,  141,  132,   26,
482
  156,  157,  158,   17,   18,   19,   20,   21,   22,   40,
483
   83,  125,  114,  126,  105,  115,  170,  165,  171,   23,
484
};
485
const short yysindex[] =
486
	{                                      0,
487
  115,    1,    0,    0, -276, -260,    0,    0,    0,    0,
488
    0,    0, -187, -229,    8,    0,   75,   84,   93,   95,
489
   97,    0,    0,    0,    0, -174, -173,    0,    0,    0,
490
    0, -172,    0, -171,    0,    0,    0,    0,    0,  129,
491
    0,    0,    0, -176, -167,    0,    0,    0, -169,    0,
492
    0,    0, -279,    0,    0, -165,    0,    0,    0, -140,
493
    0,    0, -253, -244,    0,    0,    0,    0,    0, -263,
494
 -263,    0,  -43,    0,   96, -124,  105, -124, -250, -250,
495
    0, -129, -244, -163, -212, -116, -160, -107,    0, -132,
496
    0, -109,    0, -123,    0,    0,    0,    0,    0, -263,
497
  113, -263, -250, -250,    0,    0, -142, -124,    0, -124,
498
    0,    0,    0, -156,    0, -153, -153, -151,    0,    0,
499
 -150, -149, -148, -147, -156,    0,    0,    0, -111,    0,
500
 -177, -141,    0,    0,    0,    0,    0, -153,    0,    0,
501
    0, -177, -255,    0, -136, -262, -144,    0, -120, -175,
502
 -139,    0,    0,    0, -138,    0,    0, -120,    0,    0,
503
    0,    0, -160,    0, -154,    0,    0, -137, -135, -154,
504
    0,    0,    0,    0,};
505
const short yyrindex[] =
506
	{                                      0,
507
    0,    0,    0,    0, -240,    0,    0,    0,    0,    0,
508
    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
509
    0,    0,    0,    0,    0, -206,    0,    0,    0,    0,
510
    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
511
    0,    0,    0, -183, -214,    0,    0,    0,  157,    0,
512
    0,    0, -209,    0,    0, -180,    0,    0,    0, -236,
513
    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
514
    0,    0,  153,    0,  -10,  -96,   26,  -88,    0,    0,
515
    0,  253,    0,    0,    0,    0,    0,    0,    0,  204,
516
    0,  229,    0,  309,    0,    0,    0,    0,    0,    0,
517
    0,    0,    0,    0,   83,    0,  317,   57,    0,   57,
518
    0,    0,    0,    0,  179,    0,    0,   30,    0,    0,
519
    0,    0,    0,    0,  278,    0,    0,    0,  342,    0,
520
    0,   -6,    0,    0,    0,    0,    0,    0,    0,    0,
521
    0,    0,   -2,    0,  107,    0,    0,    0,    5,    0,
522
    0,    0,    0,    0,    0,    0,   15,   50,    0,    0,
523
    0,    0,    0,    0,    0,    0,    0,    0,    0,  163,
524
    0,    0,    0,    0,};
525
const short yygindex[] =
526
	{                                      0,
527
    0,    0,    0,    0,   92,    0,  -69,    0,    0,    0,
528
    9,    4,  -77,    0, -103,   61,    0,    0,    0,    0,
529
    0,    0,    0,    0,    0,    0,    0,   35,    0,    0,
530
   20,    0,    0,    0,    0,    0,    0,    0,    0,    0,
531
    0,    0,    0,   54,    0,    0,    0,    0,   10,    0,
532
};
533
#define YYTABLESIZE 651
534
const short yytable[] =
535
	{                                      54,
536
   81,   91,   91,   97,   65,   66,  151,   89,   88,  101,
537
   24,  146,   70,  130,   20,   74,   25,   25,   25,   71,
538
   33,   58,   59,   25,  106,   91,   91,   33,   89,   54,
539
   54,  147,   25,   54,  144,   56,   25,   25,  119,  100,
540
  120,   25,   84,   84,   84,   75,  152,   30,   27,   84,
541
   80,   80,   80,  148,   30,   67,   68,   80,   75,   21,
542
   25,   25,   25,   25,   25,   25,   43,   84,   34,   56,
543
   80,   80,   30,   27,   78,   80,   87,   87,   87,   33,
544
   27,   51,   52,   87,   35,  167,   84,   84,   92,   28,
545
   29,   84,   66,   36,   80,   80,   97,   98,   27,   80,
546
   43,   87,   37,  108,   38,  110,   39,   30,   31,   54,
547
   55,  111,  112,  121,  122,  123,   98,   27,   27,   32,
548
   87,   87,  116,  117,   16,  168,  169,  124,   41,   42,
549
   43,  139,  140,  159,  160,   46,   47,   48,   50,   57,
550
   61,   63,   84,   85,   87,   93,   96,  100,   75,  102,
551
  103,  104,  106,  109,  138,  128,  131,  142,  133,  134,
552
  135,  136,   47,  150,  154,  155,  113,   43,   43,  162,
553
  163,  172,  105,  173,   95,  127,  145,  166,  137,  174,
554
    0,    0,    0,    0,    0,    0,    0,    0,   66,    0,
555
    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
556
    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
557
    0,    0,    0,   50,    0,    0,    0,   79,    0,    0,
558
    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
559
    0,    0,    0,    0,    0,    0,    0,    0,   51,   80,
560
    0,    0,    0,    0,    0,    0,   54,    0,    0,    0,
561
   54,    0,    0,   54,   54,   54,   54,   54,    0,    0,
562
   97,    0,   73,    0,   54,   54,    0,    0,    0,   54,
563
   54,    0,   54,   97,   97,   54,   54,   89,   89,   97,
564
   97,    0,   56,   89,   20,   20,   56,   65,   54,   56,
565
   56,   56,   56,   56,  104,  104,  100,   54,   54,    0,
566
   56,   56,   97,    0,    0,   56,   56,    0,   56,  100,
567
  100,   56,   56,   43,    0,  100,  100,   43,   76,    0,
568
   43,   43,   43,   43,   56,    0,   59,    0,  100,   21,
569
   21,   43,   43,   56,   56,    0,   43,   43,  100,   43,
570
    0,    0,   43,   43,    0,    0,    0,   66,   66,   66,
571
    0,   61,   64,   64,   64,   43,    0,    0,   66,    0,
572
    0,    0,   66,   66,   43,   43,   64,    0,   66,   66,
573
    2,    3,    0,   98,    0,    0,    0,    0,    4,    0,
574
    0,   66,    0,    0,    0,    0,   98,   98,    5,    0,
575
   66,   66,   98,   98,    0,    0,    0,    0,    0,    0,
576
    0,    0,    6,    7,    8,    9,   10,   11,   12,   11,
577
    0,   13,   14,    0,    0,   98,   11,   47,   47,   47,
578
    0,    0,    0,   15,    0,    0,    0,   47,   47,    0,
579
    0,    0,   47,   47,    0,    0,    0,    0,   47,   47,
580
    0,    0,    0,   66,   66,   66,    0,    0,   64,   64,
581
   64,   47,    0,    0,    0,    0,    0,    0,   66,   66,
582
   47,   47,   64,    0,   66,   66,    0,    0,   50,   50,
583
   50,    0,    0,    0,    0,    0,    0,   66,   50,   50,
584
    0,    0,    0,   50,   50,    0,   66,   66,    0,   50,
585
   50,    0,    0,   51,   51,   51,    0,    0,    0,    0,
586
    0,    0,   50,   51,   51,    0,    0,    0,   51,   51,
587
    0,   50,   50,    0,   51,   51,    0,   73,   73,   73,
588
    0,    0,    0,    0,    0,    0,    0,   51,   73,    0,
589
    0,    0,   73,   73,    0,    0,   51,   51,   73,   73,
590
    0,    0,   65,   65,   65,    0,    0,    0,    0,    0,
591
    0,   73,    0,   65,    0,    0,    0,   65,   65,    0,
592
   73,   73,    0,   65,   65,    0,    0,    0,    0,    0,
593
    0,    0,    0,   76,   76,   76,   65,    0,    0,    0,
594
    0,    0,    0,   59,    0,   65,   65,    0,   76,   76,
595
    0,    0,    0,    0,   76,   76,   59,   59,    0,    0,
596
    0,    0,   59,   59,    0,    0,    0,   76,   61,    0,
597
    0,    0,    0,    0,    0,   59,   76,   76,    0,    0,
598
    0,   61,   61,    0,   59,   59,    0,   61,   61,    0,
599
    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
600
   61,    0,    0,    0,    0,    0,    0,    0,    0,   61,
601
   61,
602
};
603
const short yycheck[] =
604
	{                                      10,
605
   44,   79,   80,   10,  258,  259,  269,   10,   78,   87,
606
   10,  267,  257,  117,   10,  279,  257,  258,  259,  264,
607
  257,  301,  302,  264,   10,  103,  104,  264,  279,   40,
608
   41,  287,  309,   44,  138,   10,  277,  278,  108,   10,
609
  110,  282,  257,  258,  259,  309,  309,  257,  309,  264,
610
  257,  258,  259,  309,  264,  309,  310,  264,  309,   10,
611
  301,  302,  303,  304,  305,  306,   10,  282,   61,   44,
612
  277,  278,  282,  257,   71,  282,  257,  258,  259,  309,
613
  264,  258,  259,  264,   10,  163,  301,  302,   80,  277,
614
  278,  306,   10,   10,  301,  302,  309,  310,  282,  306,
615
   44,  282,   10,  100,   10,  102,   10,  295,  296,  277,
616
  278,  103,  104,  270,  271,  272,   10,  301,  302,  307,
617
  301,  302,  265,  266,   10,  280,  281,  284,  303,  304,
618
  305,  309,  310,  309,  310,  309,  309,  309,   10,  309,
619
  306,  282,   47,  268,   40,  275,  310,  264,  309,  257,
620
  283,  261,  276,   41,  266,  309,  308,  299,  309,  309,
621
  309,  309,   10,  300,  309,  286,   10,  264,  257,  309,
622
  309,  309,   10,  309,   83,  115,  142,  158,  125,  170,
623
   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   10,   -1,
624
   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
625
   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
626
   -1,   -1,   -1,   10,   -1,   -1,   -1,  261,   -1,   -1,
627
   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
628
   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   10,  283,
629
   -1,   -1,   -1,   -1,   -1,   -1,  257,   -1,   -1,   -1,
630
  261,   -1,   -1,  264,  265,  266,  267,  268,   -1,   -1,
631
  267,   -1,   10,   -1,  275,  276,   -1,   -1,   -1,  280,
632
  281,   -1,  283,  280,  281,  286,  287,  280,  281,  286,
633
  287,   -1,  257,  286,  280,  281,  261,   10,  299,  264,
634
  265,  266,  267,  268,  280,  281,  267,  308,  309,   -1,
635
  275,  276,  309,   -1,   -1,  280,  281,   -1,  283,  280,
636
  281,  286,  287,  257,   -1,  286,  287,  261,   10,   -1,
637
  264,  265,  266,  267,  299,   -1,   10,   -1,  299,  280,
638
  281,  275,  276,  308,  309,   -1,  280,  281,  309,  283,
639
   -1,   -1,  286,  287,   -1,   -1,   -1,  265,  266,  267,
640
   -1,   10,  270,  271,  272,  299,   -1,   -1,  276,   -1,
641
   -1,   -1,  280,  281,  308,  309,  284,   -1,  286,  287,
642
  256,  257,   -1,  267,   -1,   -1,   -1,   -1,  264,   -1,
643
   -1,  299,   -1,   -1,   -1,   -1,  280,  281,  274,   -1,
644
  308,  309,  286,  287,   -1,   -1,   -1,   -1,   -1,   -1,
645
   -1,   -1,  288,  289,  290,  291,  292,  293,  294,  257,
646
   -1,  297,  298,   -1,   -1,  309,  264,  265,  266,  267,
647
   -1,   -1,   -1,  309,   -1,   -1,   -1,  275,  276,   -1,
648
   -1,   -1,  280,  281,   -1,   -1,   -1,   -1,  286,  287,
649
   -1,   -1,   -1,  265,  266,  267,   -1,   -1,  270,  271,
650
  272,  299,   -1,   -1,   -1,   -1,   -1,   -1,  280,  281,
651
  308,  309,  284,   -1,  286,  287,   -1,   -1,  265,  266,
652
  267,   -1,   -1,   -1,   -1,   -1,   -1,  299,  275,  276,
653
   -1,   -1,   -1,  280,  281,   -1,  308,  309,   -1,  286,
654
  287,   -1,   -1,  265,  266,  267,   -1,   -1,   -1,   -1,
655
   -1,   -1,  299,  275,  276,   -1,   -1,   -1,  280,  281,
656
   -1,  308,  309,   -1,  286,  287,   -1,  265,  266,  267,
657
   -1,   -1,   -1,   -1,   -1,   -1,   -1,  299,  276,   -1,
658
   -1,   -1,  280,  281,   -1,   -1,  308,  309,  286,  287,
659
   -1,   -1,  265,  266,  267,   -1,   -1,   -1,   -1,   -1,
660
   -1,  299,   -1,  276,   -1,   -1,   -1,  280,  281,   -1,
661
  308,  309,   -1,  286,  287,   -1,   -1,   -1,   -1,   -1,
662
   -1,   -1,   -1,  265,  266,  267,  299,   -1,   -1,   -1,
663
   -1,   -1,   -1,  267,   -1,  308,  309,   -1,  280,  281,
664
   -1,   -1,   -1,   -1,  286,  287,  280,  281,   -1,   -1,
665
   -1,   -1,  286,  287,   -1,   -1,   -1,  299,  267,   -1,
666
   -1,   -1,   -1,   -1,   -1,  299,  308,  309,   -1,   -1,
667
   -1,  280,  281,   -1,  308,  309,   -1,  286,  287,   -1,
668
   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
669
  299,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,  308,
670
  309,
671
};
672
#define YYFINAL 1
673
#ifndef YYDEBUG
674
#define YYDEBUG 0
675
#endif
676
#define YYMAXTOKEN 310
677
#if YYDEBUG
678
const char * const yyname[] =
679
	{
680
"end-of-file",0,0,0,0,0,0,0,0,0,"'\\n'",0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
681
0,0,0,0,0,0,0,0,0,"'('","')'",0,0,"','",0,0,"'/'",0,0,0,0,0,0,0,0,0,0,0,0,0,
682
"'='",0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
683
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
684
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
685
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
686
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
687
"FROM","ESP","AH","IN","PEER","ON","OUT","TO","SRCID","DSTID","PSK","PORT",
688
"FILENAME","AUTHXF","PRFXF","ENCXF","ERROR","IKEV2","IKESA","CHILDSA","PASSIVE",
689
"ACTIVE","ANY","TAG","TAP","PROTO","LOCAL","GROUP","NAME","CONFIG","EAP","USER",
690
"IKEV1","FLOW","SA","TCPMD5","TUNNEL","TRANSPORT","COUPLE","DECOUPLE","SET",
691
"INCLUDE","LIFETIME","BYTES","INET","INET6","QUICK","SKIP","DEFAULT","IPCOMP",
692
"OCSP","IKELIFETIME","STRING","NUMBER",
693
};
694
const char * const yyrule[] =
695
	{"$accept : grammar",
696
"grammar :",
697
"grammar : grammar include '\\n'",
698
"grammar : grammar '\\n'",
699
"grammar : grammar set '\\n'",
700
"grammar : grammar user '\\n'",
701
"grammar : grammar ikev2rule '\\n'",
702
"grammar : grammar varset '\\n'",
703
"grammar : grammar otherrule skipline '\\n'",
704
"grammar : grammar error '\\n'",
705
"comma : ','",
706
"comma :",
707
"include : INCLUDE STRING",
708
"set : SET ACTIVE",
709
"set : SET PASSIVE",
710
"set : SET COUPLE",
711
"set : SET DECOUPLE",
712
"set : SET OCSP STRING",
713
"user : USER STRING STRING",
714
"ikev2rule : IKEV2 name ikeflags satype af proto hosts_list peers ike_sa child_sa ids ikelifetime lifetime ikeauth ikecfg filters",
715
"ikecfg :",
716
"ikecfg : ikecfgvals",
717
"ikecfgvals : cfg",
718
"ikecfgvals : ikecfgvals cfg",
719
"cfg : CONFIG STRING host_spec",
720
"name :",
721
"name : STRING",
722
"satype :",
723
"satype : ESP",
724
"satype : AH",
725
"af :",
726
"af : INET",
727
"af : INET6",
728
"proto :",
729
"proto : PROTO protoval",
730
"proto : PROTO ESP",
731
"proto : PROTO AH",
732
"protoval : STRING",
733
"protoval : NUMBER",
734
"hosts_list : hosts",
735
"hosts_list : hosts_list comma hosts",
736
"hosts : FROM host port TO host port",
737
"hosts : TO host port FROM host port",
738
"port :",
739
"port : PORT portval",
740
"portval : STRING",
741
"portval : NUMBER",
742
"peers :",
743
"peers : PEER anyhost LOCAL anyhost",
744
"peers : LOCAL anyhost PEER anyhost",
745
"peers : PEER anyhost",
746
"peers : LOCAL anyhost",
747
"anyhost : host_spec",
748
"anyhost : ANY",
749
"host_spec : STRING",
750
"host_spec : STRING '/' NUMBER",
751
"host : host_spec",
752
"host : host_spec '(' host_spec ')'",
753
"host : ANY",
754
"ids :",
755
"ids : SRCID id DSTID id",
756
"ids : SRCID id",
757
"ids : DSTID id",
758
"id : STRING",
759
"$$1 :",
760
"transforms : $$1 transforms_l",
761
"transforms :",
762
"transforms_l : transforms_l transform",
763
"transforms_l : transform",
764
"transform : AUTHXF STRING",
765
"transform : ENCXF STRING",
766
"transform : PRFXF STRING",
767
"transform : GROUP STRING",
768
"ike_sa :",
769
"$$2 :",
770
"ike_sa : IKESA $$2 transforms",
771
"child_sa :",
772
"$$3 :",
773
"child_sa : CHILDSA $$3 transforms",
774
"ikeflags : ikematch ikemode ipcomp",
775
"ikematch :",
776
"ikematch : QUICK",
777
"ikematch : SKIP",
778
"ikematch : DEFAULT",
779
"ikemode :",
780
"ikemode : PASSIVE",
781
"ikemode : ACTIVE",
782
"ipcomp :",
783
"ipcomp : IPCOMP",
784
"ikeauth :",
785
"ikeauth : PSK keyspec",
786
"ikeauth : EAP STRING",
787
"ikeauth : STRING",
788
"byte_spec : NUMBER",
789
"byte_spec : STRING",
790
"time_spec : NUMBER",
791
"time_spec : STRING",
792
"lifetime :",
793
"lifetime : LIFETIME time_spec",
794
"lifetime : LIFETIME time_spec BYTES byte_spec",
795
"ikelifetime :",
796
"ikelifetime : IKELIFETIME time_spec",
797
"keyspec : STRING",
798
"keyspec : FILENAME STRING",
799
"$$4 :",
800
"filters : $$4 filters_l",
801
"filters :",
802
"filters_l : filters_l filter",
803
"filters_l : filter",
804
"filter : TAG STRING",
805
"filter : TAP STRING",
806
"string : string STRING",
807
"string : STRING",
808
"varset : STRING '=' string",
809
"otherrule : IKEV1",
810
"otherrule : sarule",
811
"otherrule : FLOW",
812
"otherrule : TCPMD5",
813
"sarule : SA",
814
"sarule : FROM",
815
"sarule : TO",
816
"sarule : TUNNEL",
817
"sarule : TRANSPORT",
818
"skipline :",
819
};
820
#endif
821
#ifdef YYSTACKSIZE
822
#undef YYMAXDEPTH
823
#define YYMAXDEPTH YYSTACKSIZE
824
#else
825
#ifdef YYMAXDEPTH
826
#define YYSTACKSIZE YYMAXDEPTH
827
#else
828
#define YYSTACKSIZE 10000
829
#define YYMAXDEPTH 10000
830
#endif
831
#endif
832
#define YYINITSTACKSIZE 200
833
/* LINTUSED */
834
int yydebug;
835
int yynerrs;
836
int yyerrflag;
837
int yychar;
838
short *yyssp;
839
YYSTYPE *yyvsp;
840
YYSTYPE yyval;
841
YYSTYPE yylval;
842
short *yyss;
843
short *yysslim;
844
YYSTYPE *yyvs;
845
unsigned int yystacksize;
846
int yyparse(void);
847
#line 1070 "parse.y"
848
849
struct keywords {
850
	const char	*k_name;
851
	int		 k_val;
852
};
853
854
int
855
yyerror(const char *fmt, ...)
856
{
857
	va_list		 ap;
858
859
	file->errors++;
860
	va_start(ap, fmt);
861
	fprintf(stderr, "%s: %d: ", file->name, yylval.lineno);
862
	vfprintf(stderr, fmt, ap);
863
	fprintf(stderr, "\n");
864
	va_end(ap);
865
	return (0);
866
}
867
868
int
869
kw_cmp(const void *k, const void *e)
870
{
871
	return (strcmp(k, ((const struct keywords *)e)->k_name));
872
}
873
874
int
875
lookup(char *s)
876
{
877
	/* this has to be sorted always */
878
	static const struct keywords keywords[] = {
879
		{ "active",		ACTIVE },
880
		{ "ah",			AH },
881
		{ "any",		ANY },
882
		{ "auth",		AUTHXF },
883
		{ "bytes",		BYTES },
884
		{ "childsa",		CHILDSA },
885
		{ "config",		CONFIG },
886
		{ "couple",		COUPLE },
887
		{ "decouple",		DECOUPLE },
888
		{ "default",		DEFAULT },
889
		{ "dstid",		DSTID },
890
		{ "eap",		EAP },
891
		{ "enc",		ENCXF },
892
		{ "esp",		ESP },
893
		{ "file",		FILENAME },
894
		{ "flow",		FLOW },
895
		{ "from",		FROM },
896
		{ "group",		GROUP },
897
		{ "ike",		IKEV1 },
898
		{ "ikelifetime",	IKELIFETIME },
899
		{ "ikesa",		IKESA },
900
		{ "ikev2",		IKEV2 },
901
		{ "include",		INCLUDE },
902
		{ "inet",		INET },
903
		{ "inet6",		INET6 },
904
		{ "ipcomp",		IPCOMP },
905
		{ "lifetime",		LIFETIME },
906
		{ "local",		LOCAL },
907
		{ "name",		NAME },
908
		{ "ocsp",		OCSP },
909
		{ "passive",		PASSIVE },
910
		{ "peer",		PEER },
911
		{ "port",		PORT },
912
		{ "prf",		PRFXF },
913
		{ "proto",		PROTO },
914
		{ "psk",		PSK },
915
		{ "quick",		QUICK },
916
		{ "sa",			SA },
917
		{ "set",		SET },
918
		{ "skip",		SKIP },
919
		{ "srcid",		SRCID },
920
		{ "tag",		TAG },
921
		{ "tap",		TAP },
922
		{ "tcpmd5",		TCPMD5 },
923
		{ "to",			TO },
924
		{ "transport",		TRANSPORT },
925
		{ "tunnel",		TUNNEL },
926
		{ "user",		USER }
927
	};
928
	const struct keywords	*p;
929
930
	p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]),
931
	    sizeof(keywords[0]), kw_cmp);
932
933
	if (p) {
934
		if (debug > 1)
935
			fprintf(stderr, "%s: %d\n", s, p->k_val);
936
		return (p->k_val);
937
	} else {
938
		if (debug > 1)
939
			fprintf(stderr, "string: %s\n", s);
940
		return (STRING);
941
	}
942
}
943
944
#define MAXPUSHBACK	128
945
946
unsigned char	*parsebuf;
947
int		 parseindex;
948
unsigned char	 pushback_buffer[MAXPUSHBACK];
949
int		 pushback_index = 0;
950
951
int
952
lgetc(int quotec)
953
{
954
	int		c, next;
955
956
	if (parsebuf) {
957
		/* Read character from the parsebuffer instead of input. */
958
		if (parseindex >= 0) {
959
			c = parsebuf[parseindex++];
960
			if (c != '\0')
961
				return (c);
962
			parsebuf = NULL;
963
		} else
964
			parseindex++;
965
	}
966
967
	if (pushback_index)
968
		return (pushback_buffer[--pushback_index]);
969
970
	if (quotec) {
971
		if ((c = getc(file->stream)) == EOF) {
972
			yyerror("reached end of file while parsing "
973
			    "quoted string");
974
			if (popfile() == EOF)
975
				return (EOF);
976
			return (quotec);
977
		}
978
		return (c);
979
	}
980
981
	while ((c = getc(file->stream)) == '\\') {
982
		next = getc(file->stream);
983
		if (next != '\n') {
984
			c = next;
985
			break;
986
		}
987
		yylval.lineno = file->lineno;
988
		file->lineno++;
989
	}
990
991
	while (c == EOF) {
992
		if (popfile() == EOF)
993
			return (EOF);
994
		c = getc(file->stream);
995
	}
996
	return (c);
997
}
998
999
int
1000
lungetc(int c)
1001
{
1002
	if (c == EOF)
1003
		return (EOF);
1004
	if (parsebuf) {
1005
		parseindex--;
1006
		if (parseindex >= 0)
1007
			return (c);
1008
	}
1009
	if (pushback_index < MAXPUSHBACK-1)
1010
		return (pushback_buffer[pushback_index++] = c);
1011
	else
1012
		return (EOF);
1013
}
1014
1015
int
1016
findeol(void)
1017
{
1018
	int	c;
1019
1020
	parsebuf = NULL;
1021
1022
	/* skip to either EOF or the first real EOL */
1023
	while (1) {
1024
		if (pushback_index)
1025
			c = pushback_buffer[--pushback_index];
1026
		else
1027
			c = lgetc(0);
1028
		if (c == '\n') {
1029
			file->lineno++;
1030
			break;
1031
		}
1032
		if (c == EOF)
1033
			break;
1034
	}
1035
	return (ERROR);
1036
}
1037
1038
int
1039
yylex(void)
1040
{
1041
	unsigned char	 buf[8096];
1042
	unsigned char	*p, *val;
1043
	int		 quotec, next, c;
1044
	int		 token;
1045
1046
top:
1047
	p = buf;
1048
	while ((c = lgetc(0)) == ' ' || c == '\t')
1049
		; /* nothing */
1050
1051
	yylval.lineno = file->lineno;
1052
	if (c == '#')
1053
		while ((c = lgetc(0)) != '\n' && c != EOF)
1054
			; /* nothing */
1055
	if (c == '$' && parsebuf == NULL) {
1056
		while (1) {
1057
			if ((c = lgetc(0)) == EOF)
1058
				return (0);
1059
1060
			if (p + 1 >= buf + sizeof(buf) - 1) {
1061
				yyerror("string too long");
1062
				return (findeol());
1063
			}
1064
			if (isalnum(c) || c == '_') {
1065
				*p++ = c;
1066
				continue;
1067
			}
1068
			*p = '\0';
1069
			lungetc(c);
1070
			break;
1071
		}
1072
		val = symget(buf);
1073
		if (val == NULL) {
1074
			yyerror("macro '%s' not defined", buf);
1075
			return (findeol());
1076
		}
1077
		parsebuf = val;
1078
		parseindex = 0;
1079
		goto top;
1080
	}
1081
1082
	switch (c) {
1083
	case '\'':
1084
	case '"':
1085
		quotec = c;
1086
		while (1) {
1087
			if ((c = lgetc(quotec)) == EOF)
1088
				return (0);
1089
			if (c == '\n') {
1090
				file->lineno++;
1091
				continue;
1092
			} else if (c == '\\') {
1093
				if ((next = lgetc(quotec)) == EOF)
1094
					return (0);
1095
				if (next == quotec || c == ' ' || c == '\t')
1096
					c = next;
1097
				else if (next == '\n') {
1098
					file->lineno++;
1099
					continue;
1100
				} else
1101
					lungetc(next);
1102
			} else if (c == quotec) {
1103
				*p = '\0';
1104
				break;
1105
			} else if (c == '\0') {
1106
				yyerror("syntax error");
1107
				return (findeol());
1108
			}
1109
			if (p + 1 >= buf + sizeof(buf) - 1) {
1110
				yyerror("string too long");
1111
				return (findeol());
1112
			}
1113
			*p++ = c;
1114
		}
1115
		yylval.v.string = strdup(buf);
1116
		if (yylval.v.string == NULL)
1117
			err(1, "yylex: strdup");
1118
		return (STRING);
1119
	}
1120
1121
#define allowed_to_end_number(x) \
1122
	(isspace(x) || x == ')' || x ==',' || x == '/' || x == '}' || x == '=')
1123
1124
	if (c == '-' || isdigit(c)) {
1125
		do {
1126
			*p++ = c;
1127
			if ((unsigned)(p-buf) >= sizeof(buf)) {
1128
				yyerror("string too long");
1129
				return (findeol());
1130
			}
1131
		} while ((c = lgetc(0)) != EOF && isdigit(c));
1132
		lungetc(c);
1133
		if (p == buf + 1 && buf[0] == '-')
1134
			goto nodigits;
1135
		if (c == EOF || allowed_to_end_number(c)) {
1136
			const char *errstr = NULL;
1137
1138
			*p = '\0';
1139
			yylval.v.number = strtonum(buf, LLONG_MIN,
1140
			    LLONG_MAX, &errstr);
1141
			if (errstr) {
1142
				yyerror("\"%s\" invalid number: %s",
1143
				    buf, errstr);
1144
				return (findeol());
1145
			}
1146
			return (NUMBER);
1147
		} else {
1148
nodigits:
1149
			while (p > buf + 1)
1150
				lungetc(*--p);
1151
			c = *--p;
1152
			if (c == '-')
1153
				return (c);
1154
		}
1155
	}
1156
1157
#define allowed_in_string(x) \
1158
	(isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \
1159
	x != '{' && x != '}' && x != '<' && x != '>' && \
1160
	x != '!' && x != '=' && x != '/' && x != '#' && \
1161
	x != ','))
1162
1163
	if (isalnum(c) || c == ':' || c == '_' || c == '*') {
1164
		do {
1165
			*p++ = c;
1166
			if ((unsigned)(p-buf) >= sizeof(buf)) {
1167
				yyerror("string too long");
1168
				return (findeol());
1169
			}
1170
		} while ((c = lgetc(0)) != EOF && (allowed_in_string(c)));
1171
		lungetc(c);
1172
		*p = '\0';
1173
		if ((token = lookup(buf)) == STRING)
1174
			if ((yylval.v.string = strdup(buf)) == NULL)
1175
				err(1, "yylex: strdup");
1176
		return (token);
1177
	}
1178
	if (c == '\n') {
1179
		yylval.lineno = file->lineno;
1180
		file->lineno++;
1181
	}
1182
	if (c == EOF)
1183
		return (0);
1184
	return (c);
1185
}
1186
1187
int
1188
check_file_secrecy(int fd, const char *fname)
1189
{
1190
	struct stat	st;
1191
1192
	if (fstat(fd, &st)) {
1193
		warn("cannot stat %s", fname);
1194
		return (-1);
1195
	}
1196
	if (st.st_uid != 0 && st.st_uid != getuid()) {
1197
		warnx("%s: owner not root or current user", fname);
1198
		return (-1);
1199
	}
1200
	if (st.st_mode & (S_IWGRP | S_IXGRP | S_IRWXO)) {
1201
		warnx("%s: group writable or world read/writable", fname);
1202
		return (-1);
1203
	}
1204
	return (0);
1205
}
1206
1207
struct file *
1208
pushfile(const char *name, int secret)
1209
{
1210
	struct file	*nfile;
1211
1212
	if ((nfile = calloc(1, sizeof(struct file))) == NULL) {
1213
		warn("malloc");
1214
		return (NULL);
1215
	}
1216
	if ((nfile->name = strdup(name)) == NULL) {
1217
		warn("malloc");
1218
		free(nfile);
1219
		return (NULL);
1220
	}
1221
	if (TAILQ_FIRST(&files) == NULL && strcmp(nfile->name, "-") == 0) {
1222
		nfile->stream = stdin;
1223
		free(nfile->name);
1224
		if ((nfile->name = strdup("stdin")) == NULL) {
1225
			warn("strdup");
1226
			free(nfile);
1227
			return (NULL);
1228
		}
1229
	} else if ((nfile->stream = fopen(nfile->name, "r")) == NULL) {
1230
		warn("%s", nfile->name);
1231
		free(nfile->name);
1232
		free(nfile);
1233
		return (NULL);
1234
	} else if (secret &&
1235
	    check_file_secrecy(fileno(nfile->stream), nfile->name)) {
1236
		fclose(nfile->stream);
1237
		free(nfile->name);
1238
		free(nfile);
1239
		return (NULL);
1240
	}
1241
	nfile->lineno = 1;
1242
	TAILQ_INSERT_TAIL(&files, nfile, entry);
1243
	return (nfile);
1244
}
1245
1246
int
1247
popfile(void)
1248
{
1249
	struct file	*prev;
1250
1251
	if ((prev = TAILQ_PREV(file, files, entry)) != NULL) {
1252
		prev->errors += file->errors;
1253
		TAILQ_REMOVE(&files, file, entry);
1254
		fclose(file->stream);
1255
		free(file->name);
1256
		free(file);
1257
		file = prev;
1258
		return (0);
1259
	}
1260
	return (EOF);
1261
}
1262
1263
int
1264
parse_config(const char *filename, struct iked *x_env)
1265
{
1266
	struct sym	*sym;
1267
	int		 errors = 0;
1268
1269
	env = x_env;
1270
	rules = 0;
1271
1272
	if ((file = pushfile(filename, 1)) == NULL)
1273
		return (-1);
1274
1275
	decouple = passive = 0;
1276
1277
	if (env->sc_opts & IKED_OPT_PASSIVE)
1278
		passive = 1;
1279
1280
	yyparse();
1281
	errors = file->errors;
1282
	popfile();
1283
1284
	env->sc_passive = passive ? 1 : 0;
1285
	env->sc_decoupled = decouple ? 1 : 0;
1286
	env->sc_ocsp_url = ocsp_url;
1287
1288
	if (!rules)
1289
		log_warnx("%s: no valid configuration rules found",
1290
		    filename);
1291
	else
1292
		log_debug("%s: loaded %d configuration rules",
1293
		    filename, rules);
1294
1295
	/* Free macros and check which have not been used. */
1296
	while ((sym = TAILQ_FIRST(&symhead))) {
1297
		if (!sym->used)
1298
			log_debug("warning: macro '%s' not "
1299
			    "used\n", sym->nam);
1300
		free(sym->nam);
1301
		free(sym->val);
1302
		TAILQ_REMOVE(&symhead, sym, entry);
1303
		free(sym);
1304
	}
1305
1306
	return (errors ? -1 : 0);
1307
}
1308
1309
int
1310
symset(const char *nam, const char *val, int persist)
1311
{
1312
	struct sym	*sym;
1313
1314
	TAILQ_FOREACH(sym, &symhead, entry) {
1315
		if (strcmp(nam, sym->nam) == 0)
1316
			break;
1317
	}
1318
1319
	if (sym != NULL) {
1320
		if (sym->persist == 1)
1321
			return (0);
1322
		else {
1323
			free(sym->nam);
1324
			free(sym->val);
1325
			TAILQ_REMOVE(&symhead, sym, entry);
1326
			free(sym);
1327
		}
1328
	}
1329
	if ((sym = calloc(1, sizeof(*sym))) == NULL)
1330
		return (-1);
1331
1332
	sym->nam = strdup(nam);
1333
	if (sym->nam == NULL) {
1334
		free(sym);
1335
		return (-1);
1336
	}
1337
	sym->val = strdup(val);
1338
	if (sym->val == NULL) {
1339
		free(sym->nam);
1340
		free(sym);
1341
		return (-1);
1342
	}
1343
	sym->used = 0;
1344
	sym->persist = persist;
1345
	TAILQ_INSERT_TAIL(&symhead, sym, entry);
1346
	return (0);
1347
}
1348
1349
int
1350
cmdline_symset(char *s)
1351
{
1352
	char	*sym, *val;
1353
	int	ret;
1354
	size_t	len;
1355
1356
	if ((val = strrchr(s, '=')) == NULL)
1357
		return (-1);
1358
1359
	len = strlen(s) - strlen(val) + 1;
1360
	if ((sym = malloc(len)) == NULL)
1361
		err(1, "cmdline_symset: malloc");
1362
1363
	strlcpy(sym, s, len);
1364
1365
	ret = symset(sym, val + 1, 1);
1366
	free(sym);
1367
1368
	return (ret);
1369
}
1370
1371
char *
1372
symget(const char *nam)
1373
{
1374
	struct sym	*sym;
1375
1376
	TAILQ_FOREACH(sym, &symhead, entry) {
1377
		if (strcmp(nam, sym->nam) == 0) {
1378
			sym->used = 1;
1379
			return (sym->val);
1380
		}
1381
	}
1382
	return (NULL);
1383
}
1384
1385
uint8_t
1386
x2i(unsigned char *s)
1387
{
1388
	char	ss[3];
1389
1390
	ss[0] = s[0];
1391
	ss[1] = s[1];
1392
	ss[2] = 0;
1393
1394
	if (!isxdigit(s[0]) || !isxdigit(s[1])) {
1395
		yyerror("keys need to be specified in hex digits");
1396
		return (-1);
1397
	}
1398
	return ((uint8_t)strtoul(ss, NULL, 16));
1399
}
1400
1401
int
1402
parsekey(unsigned char *hexkey, size_t len, struct iked_auth *auth)
1403
{
1404
	unsigned int	  i;
1405
1406
	bzero(auth, sizeof(*auth));
1407
	if ((len / 2) > sizeof(auth->auth_data))
1408
		return (-1);
1409
	auth->auth_length = len / 2;
1410
1411
	for (i = 0; i < auth->auth_length; i++)
1412
		auth->auth_data[i] = x2i(hexkey + 2 * i);
1413
1414
	return (0);
1415
}
1416
1417
int
1418
parsekeyfile(char *filename, struct iked_auth *auth)
1419
{
1420
	struct stat	 sb;
1421
	int		 fd, ret;
1422
	unsigned char	*hex;
1423
1424
	if ((fd = open(filename, O_RDONLY)) < 0)
1425
		err(1, "open %s", filename);
1426
	if (fstat(fd, &sb) < 0)
1427
		err(1, "parsekeyfile: stat %s", filename);
1428
	if ((sb.st_size > KEYSIZE_LIMIT) || (sb.st_size == 0))
1429
		errx(1, "%s: key too %s", filename, sb.st_size ? "large" :
1430
		    "small");
1431
	if ((hex = calloc(sb.st_size, sizeof(unsigned char))) == NULL)
1432
		err(1, "parsekeyfile: calloc");
1433
	if (read(fd, hex, sb.st_size) < sb.st_size)
1434
		err(1, "parsekeyfile: read");
1435
	close(fd);
1436
	ret = parsekey(hex, sb.st_size, auth);
1437
	free(hex);
1438
	return (ret);
1439
}
1440
1441
int
1442
get_id_type(char *string)
1443
{
1444
	struct in6_addr ia;
1445
1446
	if (string == NULL)
1447
		return (IKEV2_ID_NONE);
1448
1449
	if (*string == '/')
1450
		return (IKEV2_ID_ASN1_DN);
1451
	else if (inet_pton(AF_INET, string, &ia) == 1)
1452
		return (IKEV2_ID_IPV4);
1453
	else if (inet_pton(AF_INET6, string, &ia) == 1)
1454
		return (IKEV2_ID_IPV6);
1455
	else if (strchr(string, '@'))
1456
		return (IKEV2_ID_UFQDN);
1457
	else
1458
		return (IKEV2_ID_FQDN);
1459
}
1460
1461
EVP_PKEY *
1462
wrap_pubkey(FILE *fp)
1463
{
1464
	EVP_PKEY	*key = NULL;
1465
	struct rsa_st	*rsa = NULL;
1466
1467
	key = PEM_read_PUBKEY(fp, NULL, NULL, NULL);
1468
	if (key == NULL) {
1469
		/* reading PKCS #8 failed, try PEM */
1470
		rewind(fp);
1471
		rsa = PEM_read_RSAPublicKey(fp, NULL, NULL, NULL);
1472
		fclose(fp);
1473
		if (rsa == NULL)
1474
			return (NULL);
1475
		if ((key = EVP_PKEY_new()) == NULL) {
1476
			RSA_free(rsa);
1477
			return (NULL);
1478
		}
1479
		if (!EVP_PKEY_set1_RSA(key, rsa)) {
1480
			RSA_free(rsa);
1481
			EVP_PKEY_free(key);
1482
			return (NULL);
1483
		}
1484
		/* Always free RSA *rsa */
1485
		RSA_free(rsa);
1486
	} else {
1487
		fclose(fp);
1488
	}
1489
1490
	return (key);
1491
}
1492
1493
EVP_PKEY *
1494
find_pubkey(const char *keyfile)
1495
{
1496
	FILE		*fp = NULL;
1497
	if ((fp = fopen(keyfile, "r")) == NULL)
1498
		return (NULL);
1499
1500
	return (wrap_pubkey(fp));
1501
}
1502
1503
int
1504
set_policy_auth_method(const char *peerid, EVP_PKEY *key,
1505
    struct iked_policy *pol)
1506
{
1507
	struct rsa_st		*rsa;
1508
	EC_KEY			*ec_key;
1509
	u_int8_t		 method;
1510
	u_int8_t		 cert_type;
1511
	struct iked_auth	*ikeauth;
1512
1513
	method = IKEV2_AUTH_NONE;
1514
	cert_type = IKEV2_CERT_NONE;
1515
1516
	if (key != NULL) {
1517
		/* infer policy from key type */
1518
		if ((rsa = EVP_PKEY_get1_RSA(key)) != NULL) {
1519
			method = IKEV2_AUTH_RSA_SIG;
1520
			cert_type = IKEV2_CERT_RSA_KEY;
1521
			RSA_free(rsa);
1522
		} else if ((ec_key = EVP_PKEY_get1_EC_KEY(key)) != NULL) {
1523
			const EC_GROUP *group = EC_KEY_get0_group(ec_key);
1524
			if (group == NULL) {
1525
				EC_KEY_free(ec_key);
1526
				return (-1);
1527
			}
1528
			switch (EC_GROUP_get_degree(group)) {
1529
			case 256:
1530
				method = IKEV2_AUTH_ECDSA_256;
1531
				break;
1532
			case 384:
1533
				method = IKEV2_AUTH_ECDSA_384;
1534
				break;
1535
			case 521:
1536
				method = IKEV2_AUTH_ECDSA_521;
1537
				break;
1538
			default:
1539
				EC_KEY_free(ec_key);
1540
				return (-1);
1541
			}
1542
			cert_type = IKEV2_CERT_ECDSA;
1543
			EC_KEY_free(ec_key);
1544
		}
1545
1546
		if (method == IKEV2_AUTH_NONE || cert_type == IKEV2_CERT_NONE)
1547
			return (-1);
1548
	} else {
1549
		/* default to IKEV2_CERT_X509_CERT otherwise */
1550
		method = IKEV2_AUTH_SIG;
1551
		cert_type = IKEV2_CERT_X509_CERT;
1552
	}
1553
1554
	ikeauth = &pol->pol_auth;
1555
1556
	if (ikeauth->auth_method == IKEV2_AUTH_SHARED_KEY_MIC) {
1557
		if (key != NULL &&
1558
		    method != IKEV2_AUTH_RSA_SIG)
1559
			goto mismatch;
1560
		return (0);
1561
	}
1562
1563
	if (ikeauth->auth_method != IKEV2_AUTH_NONE &&
1564
	    ikeauth->auth_method != IKEV2_AUTH_SIG_ANY &&
1565
	    ikeauth->auth_method != method)
1566
		goto mismatch;
1567
1568
	ikeauth->auth_method = method;
1569
	pol->pol_certreqtype = cert_type;
1570
1571
	log_debug("%s: using %s for peer %s", __func__,
1572
	    print_xf(method, 0, methodxfs), peerid);
1573
1574
	return (0);
1575
1576
 mismatch:
1577
	log_warnx("%s: ikeauth policy mismatch, %s specified, but only %s "
1578
	    "possible", __func__, print_xf(ikeauth->auth_method, 0, methodxfs),
1579
	    print_xf(method, 0, methodxfs));
1580
	return (-1);
1581
}
1582
1583
int
1584
set_policy(char *idstr, int type, struct iked_policy *pol)
1585
{
1586
	char		 keyfile[PATH_MAX];
1587
	const char	*prefix = NULL;
1588
	EVP_PKEY	*key = NULL;
1589
1590
	switch (type) {
1591
	case IKEV2_ID_IPV4:
1592
		prefix = "ipv4";
1593
		break;
1594
	case IKEV2_ID_IPV6:
1595
		prefix = "ipv6";
1596
		break;
1597
	case IKEV2_ID_FQDN:
1598
		prefix = "fqdn";
1599
		break;
1600
	case IKEV2_ID_UFQDN:
1601
		prefix = "ufqdn";
1602
		break;
1603
	case IKEV2_ID_ASN1_DN:
1604
		/* public key authentication is not supported with ASN.1 IDs */
1605
		goto done;
1606
	default:
1607
		/* Unspecified ID or public key not supported for this type */
1608
		log_debug("%s: unknown type = %d", __func__, type);
1609
		return (-1);
1610
	}
1611
1612
	lc_string(idstr);
1613
	if ((size_t)snprintf(keyfile, sizeof(keyfile),
1614
	    IKED_CA IKED_PUBKEY_DIR "%s/%s", prefix,
1615
	    idstr) >= sizeof(keyfile)) {
1616
		log_warnx("%s: public key path is too long", __func__);
1617
		return (-1);
1618
	}
1619
1620
	if ((key = find_pubkey(keyfile)) == NULL) {
1621
		log_warnx("%s: could not find pubkey for %s", __func__,
1622
		    keyfile);
1623
	}
1624
1625
 done:
1626
	if (set_policy_auth_method(keyfile, key, pol) < 0) {
1627
		EVP_PKEY_free(key);
1628
		log_warnx("%s: failed to set policy auth method for %s",
1629
		    __func__, keyfile);
1630
		return (-1);
1631
	}
1632
1633
	if (key != NULL) {
1634
		EVP_PKEY_free(key);
1635
		log_debug("%s: found pubkey for %s", __func__, keyfile);
1636
	}
1637
1638
	return (0);
1639
}
1640
1641
struct ipsec_addr_wrap *
1642
host(const char *s)
1643
{
1644
	struct ipsec_addr_wrap	*ipa = NULL;
1645
	int			 mask, cont = 1;
1646
	char			*p, *q, *ps;
1647
1648
	if ((p = strrchr(s, '/')) != NULL) {
1649
		errno = 0;
1650
		mask = strtol(p + 1, &q, 0);
1651
		if (errno == ERANGE || !q || *q || mask > 128 || q == (p + 1))
1652
			errx(1, "host: invalid netmask '%s'", p);
1653
		if ((ps = malloc(strlen(s) - strlen(p) + 1)) == NULL)
1654
			err(1, "host: calloc");
1655
		strlcpy(ps, s, strlen(s) - strlen(p) + 1);
1656
	} else {
1657
		if ((ps = strdup(s)) == NULL)
1658
			err(1, "host: strdup");
1659
		mask = -1;
1660
	}
1661
1662
	/* Does interface with this name exist? */
1663
	if (cont && (ipa = host_if(ps, mask)) != NULL)
1664
		cont = 0;
1665
1666
	/* IPv4 address? */
1667
	if (cont && (ipa = host_v4(s, mask == -1 ? 32 : mask)) != NULL)
1668
		cont = 0;
1669
1670
	/* IPv6 address? */
1671
	if (cont && (ipa = host_v6(ps, mask == -1 ? 128 : mask)) != NULL)
1672
		cont = 0;
1673
1674
	/* dns lookup */
1675
	if (cont && mask == -1 && (ipa = host_dns(s, mask)) != NULL)
1676
		cont = 0;
1677
	free(ps);
1678
1679
	if (ipa == NULL || cont == 1) {
1680
		fprintf(stderr, "no IP address found for %s\n", s);
1681
		return (NULL);
1682
	}
1683
	return (ipa);
1684
}
1685
1686
struct ipsec_addr_wrap *
1687
host_v6(const char *s, int prefixlen)
1688
{
1689
	struct ipsec_addr_wrap	*ipa = NULL;
1690
	struct addrinfo		 hints, *res;
1691
	char			 hbuf[NI_MAXHOST];
1692
1693
	bzero(&hints, sizeof(struct addrinfo));
1694
	hints.ai_family = AF_INET6;
1695
	hints.ai_socktype = SOCK_STREAM;
1696
	hints.ai_flags = AI_NUMERICHOST;
1697
	if (getaddrinfo(s, NULL, &hints, &res))
1698
		return (NULL);
1699
	if (res->ai_next)
1700
		err(1, "host_v6: numeric hostname expanded to multiple item");
1701
1702
	ipa = calloc(1, sizeof(struct ipsec_addr_wrap));
1703
	if (ipa == NULL)
1704
		err(1, "host_v6: calloc");
1705
	ipa->af = res->ai_family;
1706
	memcpy(&ipa->address, res->ai_addr, sizeof(struct sockaddr_in6));
1707
	if (prefixlen > 128)
1708
		prefixlen = 128;
1709
	ipa->next = NULL;
1710
	ipa->tail = ipa;
1711
1712
	set_ipmask(ipa, prefixlen);
1713
	if (getnameinfo(res->ai_addr, res->ai_addrlen,
1714
	    hbuf, sizeof(hbuf), NULL, 0, NI_NUMERICHOST)) {
1715
		errx(1, "could not get a numeric hostname");
1716
	}
1717
1718
	if (prefixlen != 128) {
1719
		ipa->netaddress = 1;
1720
		if (asprintf(&ipa->name, "%s/%d", hbuf, prefixlen) == -1)
1721
			err(1, "host_v6: asprintf");
1722
	} else {
1723
		if ((ipa->name = strdup(hbuf)) == NULL)
1724
			err(1, "host_v6: strdup");
1725
	}
1726
1727
	freeaddrinfo(res);
1728
1729
	return (ipa);
1730
}
1731
1732
struct ipsec_addr_wrap *
1733
host_v4(const char *s, int mask)
1734
{
1735
	struct ipsec_addr_wrap	*ipa = NULL;
1736
	struct sockaddr_in	 ina;
1737
	int			 bits = 32;
1738
1739
	bzero(&ina, sizeof(ina));
1740
	if (strrchr(s, '/') != NULL) {
1741
		if ((bits = inet_net_pton(AF_INET, s, &ina.sin_addr,
1742
		    sizeof(ina.sin_addr))) == -1)
1743
			return (NULL);
1744
	} else {
1745
		if (inet_pton(AF_INET, s, &ina.sin_addr) != 1)
1746
			return (NULL);
1747
	}
1748
1749
	ipa = calloc(1, sizeof(struct ipsec_addr_wrap));
1750
	if (ipa == NULL)
1751
		err(1, "host_v4: calloc");
1752
1753
	ina.sin_family = AF_INET;
1754
	ina.sin_len = sizeof(ina);
1755
	memcpy(&ipa->address, &ina, sizeof(ina));
1756
1757
	ipa->name = strdup(s);
1758
	if (ipa->name == NULL)
1759
		err(1, "host_v4: strdup");
1760
	ipa->af = AF_INET;
1761
	ipa->next = NULL;
1762
	ipa->tail = ipa;
1763
1764
	set_ipmask(ipa, bits);
1765
	if (strrchr(s, '/') != NULL)
1766
		ipa->netaddress = 1;
1767
1768
	return (ipa);
1769
}
1770
1771
struct ipsec_addr_wrap *
1772
host_dns(const char *s, int mask)
1773
{
1774
	struct ipsec_addr_wrap	*ipa = NULL, *head = NULL;
1775
	struct addrinfo		 hints, *res0, *res;
1776
	int			 error;
1777
	char			 hbuf[NI_MAXHOST];
1778
1779
	bzero(&hints, sizeof(struct addrinfo));
1780
	hints.ai_family = PF_UNSPEC;
1781
	hints.ai_socktype = SOCK_STREAM;
1782
	hints.ai_flags = AI_ADDRCONFIG;
1783
	error = getaddrinfo(s, NULL, &hints, &res0);
1784
	if (error)
1785
		return (NULL);
1786
1787
	for (res = res0; res; res = res->ai_next) {
1788
		if (res->ai_family != AF_INET && res->ai_family != AF_INET6)
1789
			continue;
1790
1791
		ipa = calloc(1, sizeof(struct ipsec_addr_wrap));
1792
		if (ipa == NULL)
1793
			err(1, "host_dns: calloc");
1794
		switch (res->ai_family) {
1795
		case AF_INET:
1796
			memcpy(&ipa->address, res->ai_addr,
1797
			    sizeof(struct sockaddr_in));
1798
			break;
1799
		case AF_INET6:
1800
			memcpy(&ipa->address, res->ai_addr,
1801
			    sizeof(struct sockaddr_in6));
1802
			break;
1803
		}
1804
		error = getnameinfo(res->ai_addr, res->ai_addrlen, hbuf,
1805
		    sizeof(hbuf), NULL, 0, NI_NUMERICHOST);
1806
		if (error)
1807
			err(1, "host_dns: getnameinfo");
1808
		ipa->name = strdup(hbuf);
1809
		if (ipa->name == NULL)
1810
			err(1, "host_dns: strdup");
1811
		ipa->af = res->ai_family;
1812
		ipa->next = NULL;
1813
		ipa->tail = ipa;
1814
		if (head == NULL)
1815
			head = ipa;
1816
		else {
1817
			head->tail->next = ipa;
1818
			head->tail = ipa;
1819
		}
1820
1821
		/*
1822
		 * XXX for now, no netmask support for IPv6.
1823
		 * but since there's no way to specify address family, once you
1824
		 * have IPv6 address on a host, you cannot use dns/netmask
1825
		 * syntax.
1826
		 */
1827
		if (ipa->af == AF_INET)
1828
			set_ipmask(ipa, mask == -1 ? 32 : mask);
1829
		else
1830
			if (mask != -1)
1831
				err(1, "host_dns: cannot apply netmask "
1832
				    "on non-IPv4 address");
1833
	}
1834
	freeaddrinfo(res0);
1835
1836
	return (head);
1837
}
1838
1839
struct ipsec_addr_wrap *
1840
host_if(const char *s, int mask)
1841
{
1842
	struct ipsec_addr_wrap *ipa = NULL;
1843
1844
	if (ifa_exists(s))
1845
		ipa = ifa_lookup(s);
1846
1847
	return (ipa);
1848
}
1849
1850
struct ipsec_addr_wrap *
1851
host_any(void)
1852
{
1853
	struct ipsec_addr_wrap	*ipa;
1854
1855
	ipa = calloc(1, sizeof(struct ipsec_addr_wrap));
1856
	if (ipa == NULL)
1857
		err(1, "host_any: calloc");
1858
	ipa->af = AF_UNSPEC;
1859
	ipa->netaddress = 1;
1860
	ipa->tail = ipa;
1861
	return (ipa);
1862
}
1863
1864
/* interface lookup routintes */
1865
1866
struct ipsec_addr_wrap	*iftab;
1867
1868
void
1869
ifa_load(void)
1870
{
1871
	struct ifaddrs		*ifap, *ifa;
1872
	struct ipsec_addr_wrap	*n = NULL, *h = NULL;
1873
	struct sockaddr_in	*sa_in;
1874
	struct sockaddr_in6	*sa_in6;
1875
1876
	if (getifaddrs(&ifap) < 0)
1877
		err(1, "ifa_load: getifaddrs");
1878
1879
	for (ifa = ifap; ifa; ifa = ifa->ifa_next) {
1880
		if (!(ifa->ifa_addr->sa_family == AF_INET ||
1881
		    ifa->ifa_addr->sa_family == AF_INET6 ||
1882
		    ifa->ifa_addr->sa_family == AF_LINK))
1883
			continue;
1884
		n = calloc(1, sizeof(struct ipsec_addr_wrap));
1885
		if (n == NULL)
1886
			err(1, "ifa_load: calloc");
1887
		n->af = ifa->ifa_addr->sa_family;
1888
		if ((n->name = strdup(ifa->ifa_name)) == NULL)
1889
			err(1, "ifa_load: strdup");
1890
		if (n->af == AF_INET) {
1891
			sa_in = (struct sockaddr_in *)ifa->ifa_addr;
1892
			memcpy(&n->address, sa_in, sizeof(*sa_in));
1893
			sa_in = (struct sockaddr_in *)ifa->ifa_netmask;
1894
			n->mask = mask2prefixlen((struct sockaddr *)sa_in);
1895
		} else if (n->af == AF_INET6) {
1896
			sa_in6 = (struct sockaddr_in6 *)ifa->ifa_addr;
1897
			memcpy(&n->address, sa_in6, sizeof(*sa_in6));
1898
			sa_in6 = (struct sockaddr_in6 *)ifa->ifa_netmask;
1899
			n->mask = mask2prefixlen6((struct sockaddr *)sa_in6);
1900
		}
1901
		n->next = NULL;
1902
		n->tail = n;
1903
		if (h == NULL)
1904
			h = n;
1905
		else {
1906
			h->tail->next = n;
1907
			h->tail = n;
1908
		}
1909
	}
1910
1911
	iftab = h;
1912
	freeifaddrs(ifap);
1913
}
1914
1915
int
1916
ifa_exists(const char *ifa_name)
1917
{
1918
	struct ipsec_addr_wrap	*n;
1919
	struct ifgroupreq	 ifgr;
1920
	int			 s;
1921
1922
	if (iftab == NULL)
1923
		ifa_load();
1924
1925
	/* check wether this is a group */
1926
	if ((s = socket(AF_INET, SOCK_DGRAM, 0)) == -1)
1927
		err(1, "ifa_exists: socket");
1928
	bzero(&ifgr, sizeof(ifgr));
1929
	strlcpy(ifgr.ifgr_name, ifa_name, sizeof(ifgr.ifgr_name));
1930
	if (ioctl(s, SIOCGIFGMEMB, (caddr_t)&ifgr) == 0) {
1931
		close(s);
1932
		return (1);
1933
	}
1934
	close(s);
1935
1936
	for (n = iftab; n; n = n->next) {
1937
		if (n->af == AF_LINK && !strncmp(n->name, ifa_name,
1938
		    IFNAMSIZ))
1939
			return (1);
1940
	}
1941
1942
	return (0);
1943
}
1944
1945
struct ipsec_addr_wrap *
1946
ifa_grouplookup(const char *ifa_name)
1947
{
1948
	struct ifg_req		*ifg;
1949
	struct ifgroupreq	 ifgr;
1950
	int			 s;
1951
	size_t			 len;
1952
	struct ipsec_addr_wrap	*n, *h = NULL, *hn;
1953
1954
	if ((s = socket(AF_INET, SOCK_DGRAM, 0)) == -1)
1955
		err(1, "socket");
1956
	bzero(&ifgr, sizeof(ifgr));
1957
	strlcpy(ifgr.ifgr_name, ifa_name, sizeof(ifgr.ifgr_name));
1958
	if (ioctl(s, SIOCGIFGMEMB, (caddr_t)&ifgr) == -1) {
1959
		close(s);
1960
		return (NULL);
1961
	}
1962
1963
	len = ifgr.ifgr_len;
1964
	if ((ifgr.ifgr_groups = calloc(1, len)) == NULL)
1965
		err(1, "calloc");
1966
	if (ioctl(s, SIOCGIFGMEMB, (caddr_t)&ifgr) == -1)
1967
		err(1, "ioctl");
1968
1969
	for (ifg = ifgr.ifgr_groups; ifg && len >= sizeof(struct ifg_req);
1970
	    ifg++) {
1971
		len -= sizeof(struct ifg_req);
1972
		if ((n = ifa_lookup(ifg->ifgrq_member)) == NULL)
1973
			continue;
1974
		if (h == NULL)
1975
			h = n;
1976
		else {
1977
			for (hn = h; hn->next != NULL; hn = hn->next)
1978
				;	/* nothing */
1979
			hn->next = n;
1980
			n->tail = hn;
1981
		}
1982
	}
1983
	free(ifgr.ifgr_groups);
1984
	close(s);
1985
1986
	return (h);
1987
}
1988
1989
struct ipsec_addr_wrap *
1990
ifa_lookup(const char *ifa_name)
1991
{
1992
	struct ipsec_addr_wrap	*p = NULL, *h = NULL, *n = NULL;
1993
	struct sockaddr_in6	*in6;
1994
	uint8_t			*s6;
1995
1996
	if (iftab == NULL)
1997
		ifa_load();
1998
1999
	if ((n = ifa_grouplookup(ifa_name)) != NULL)
2000
		return (n);
2001
2002
	for (p = iftab; p; p = p->next) {
2003
		if (p->af != AF_INET && p->af != AF_INET6)
2004
			continue;
2005
		if (strncmp(p->name, ifa_name, IFNAMSIZ))
2006
			continue;
2007
		n = calloc(1, sizeof(struct ipsec_addr_wrap));
2008
		if (n == NULL)
2009
			err(1, "ifa_lookup: calloc");
2010
		memcpy(n, p, sizeof(struct ipsec_addr_wrap));
2011
		if ((n->name = strdup(p->name)) == NULL)
2012
			err(1, "ifa_lookup: strdup");
2013
		switch (n->af) {
2014
		case AF_INET:
2015
			set_ipmask(n, 32);
2016
			break;
2017
		case AF_INET6:
2018
			in6 = (struct sockaddr_in6 *)&n->address;
2019
			s6 = (uint8_t *)&in6->sin6_addr.s6_addr;
2020
2021
			/* route/show.c and bgpd/util.c give KAME credit */
2022
			if (IN6_IS_ADDR_LINKLOCAL(&in6->sin6_addr)) {
2023
				uint16_t	 tmp16;
2024
2025
				/* for now we can not handle link local,
2026
				 * therefore bail for now
2027
				 */
2028
				free(n);
2029
				continue;
2030
2031
				memcpy(&tmp16, &s6[2], sizeof(tmp16));
2032
				/* use this when we support link-local
2033
				 * n->??.scopeid = ntohs(tmp16);
2034
				 */
2035
				s6[2] = 0;
2036
				s6[3] = 0;
2037
			}
2038
			set_ipmask(n, 128);
2039
			break;
2040
		}
2041
2042
		n->next = NULL;
2043
		n->tail = n;
2044
		if (h == NULL)
2045
			h = n;
2046
		else {
2047
			h->tail->next = n;
2048
			h->tail = n;
2049
		}
2050
	}
2051
2052
	return (h);
2053
}
2054
2055
void
2056
set_ipmask(struct ipsec_addr_wrap *address, uint8_t b)
2057
{
2058
	address->mask = b;
2059
}
2060
2061
const struct ipsec_xf *
2062
parse_xf(const char *name, unsigned int length, const struct ipsec_xf xfs[])
2063
{
2064
	int		i;
2065
2066
	for (i = 0; xfs[i].name != NULL; i++) {
2067
		if (strncmp(name, xfs[i].name, strlen(name)))
2068
			continue;
2069
		if (length == 0 || length == xfs[i].length)
2070
			return &xfs[i];
2071
	}
2072
	return (NULL);
2073
}
2074
2075
const char *
2076
print_xf(unsigned int id, unsigned int length, const struct ipsec_xf xfs[])
2077
{
2078
	int		i;
2079
2080
	for (i = 0; xfs[i].name != NULL; i++) {
2081
		if (xfs[i].id == id) {
2082
			if (length == 0 || length == xfs[i].length)
2083
				return (xfs[i].name);
2084
		}
2085
	}
2086
	return ("unknown");
2087
}
2088
2089
size_t
2090
keylength_xf(unsigned int saproto, unsigned int type, unsigned int id)
2091
{
2092
	int			 i;
2093
	const struct ipsec_xf	*xfs;
2094
2095
	switch (type) {
2096
	case IKEV2_XFORMTYPE_ENCR:
2097
		if (saproto == IKEV2_SAPROTO_IKE)
2098
			xfs = ikeencxfs;
2099
		else
2100
			xfs = ipsecencxfs;
2101
		break;
2102
	case IKEV2_XFORMTYPE_INTEGR:
2103
		xfs = authxfs;
2104
		break;
2105
	default:
2106
		return (0);
2107
	}
2108
2109
	for (i = 0; xfs[i].name != NULL; i++) {
2110
		if (xfs[i].id == id)
2111
			return (xfs[i].length * 8);
2112
	}
2113
	return (0);
2114
}
2115
2116
size_t
2117
noncelength_xf(unsigned int type, unsigned int id)
2118
{
2119
	const struct ipsec_xf	*xfs = ipsecencxfs;
2120
	int			 i;
2121
2122
	if (type != IKEV2_XFORMTYPE_ENCR)
2123
		return (0);
2124
2125
	for (i = 0; xfs[i].name != NULL; i++)
2126
		if (xfs[i].id == id)
2127
			return (xfs[i].nonce * 8);
2128
	return (0);
2129
}
2130
2131
void
2132
print_user(struct iked_user *usr)
2133
{
2134
	print_verbose("user \"%s\" \"%s\"\n", usr->usr_name, usr->usr_pass);
2135
}
2136
2137
void
2138
print_policy(struct iked_policy *pol)
2139
{
2140
	struct iked_proposal	*pp;
2141
	struct iked_transform	*xform;
2142
	struct iked_flow	*flow;
2143
	struct iked_cfg		*cfg;
2144
	unsigned int		 i, j;
2145
	const struct ipsec_xf	*xfs = NULL;
2146
2147
	print_verbose("ikev2");
2148
2149
	if (pol->pol_name[0] != '\0')
2150
		print_verbose(" \"%s\"", pol->pol_name);
2151
2152
	if (pol->pol_flags & IKED_POLICY_DEFAULT)
2153
		print_verbose(" default");
2154
	else if (pol->pol_flags & IKED_POLICY_QUICK)
2155
		print_verbose(" quick");
2156
	else if (pol->pol_flags & IKED_POLICY_SKIP)
2157
		print_verbose(" skip");
2158
2159
	if (pol->pol_flags & IKED_POLICY_ACTIVE)
2160
		print_verbose(" active");
2161
	else
2162
		print_verbose(" passive");
2163
2164
	print_verbose(" %s", print_xf(pol->pol_saproto, 0, saxfs));
2165
2166
	if (pol->pol_ipproto)
2167
		print_verbose(" proto %s", print_proto(pol->pol_ipproto));
2168
2169
	if (pol->pol_af) {
2170
		if (pol->pol_af == AF_INET)
2171
			print_verbose(" inet");
2172
		else
2173
			print_verbose(" inet6");
2174
	}
2175
2176
	RB_FOREACH(flow, iked_flows, &pol->pol_flows) {
2177
		print_verbose(" from %s",
2178
		    print_host((struct sockaddr *)&flow->flow_src.addr, NULL,
2179
		    0));
2180
		if (flow->flow_src.addr_af != AF_UNSPEC &&
2181
		    flow->flow_src.addr_net)
2182
			print_verbose("/%d", flow->flow_src.addr_mask);
2183
		if (flow->flow_src.addr_port)
2184
			print_verbose(" port %d",
2185
			    ntohs(flow->flow_src.addr_port));
2186
2187
		print_verbose(" to %s",
2188
		    print_host((struct sockaddr *)&flow->flow_dst.addr, NULL,
2189
		    0));
2190
		if (flow->flow_dst.addr_af != AF_UNSPEC &&
2191
		    flow->flow_dst.addr_net)
2192
			print_verbose("/%d", flow->flow_dst.addr_mask);
2193
		if (flow->flow_dst.addr_port)
2194
			print_verbose(" port %d",
2195
			    ntohs(flow->flow_dst.addr_port));
2196
	}
2197
2198
	if ((pol->pol_flags & IKED_POLICY_DEFAULT) == 0) {
2199
		print_verbose(" local %s",
2200
		    print_host((struct sockaddr *)&pol->pol_local.addr, NULL,
2201
		    0));
2202
		if (pol->pol_local.addr.ss_family != AF_UNSPEC &&
2203
		    pol->pol_local.addr_net)
2204
			print_verbose("/%d", pol->pol_local.addr_mask);
2205
2206
		print_verbose(" peer %s",
2207
		    print_host((struct sockaddr *)&pol->pol_peer.addr, NULL,
2208
		    0));
2209
		if (pol->pol_peer.addr.ss_family != AF_UNSPEC &&
2210
		    pol->pol_peer.addr_net)
2211
			print_verbose("/%d", pol->pol_peer.addr_mask);
2212
	}
2213
2214
	TAILQ_FOREACH(pp, &pol->pol_proposals, prop_entry) {
2215
		if (!pp->prop_nxforms)
2216
			continue;
2217
		if (pp->prop_protoid == IKEV2_SAPROTO_IKE)
2218
			print_verbose(" ikesa");
2219
		else
2220
			print_verbose(" childsa");
2221
2222
		for (j = 0; ikev2_xformtype_map[j].cm_type != 0; j++) {
2223
			xfs = NULL;
2224
2225
			for (i = 0; i < pp->prop_nxforms; i++) {
2226
				xform = pp->prop_xforms + i;
2227
2228
				if (xform->xform_type !=
2229
				    ikev2_xformtype_map[j].cm_type)
2230
					continue;
2231
2232
				if (xfs != NULL) {
2233
					print_verbose(",");
2234
				} else {
2235
					switch (xform->xform_type) {
2236
					case IKEV2_XFORMTYPE_INTEGR:
2237
						print_verbose(" auth ");
2238
						xfs = authxfs;
2239
						break;
2240
					case IKEV2_XFORMTYPE_ENCR:
2241
						print_verbose(" enc ");
2242
						if (pp->prop_protoid ==
2243
						    IKEV2_SAPROTO_IKE)
2244
							xfs = ikeencxfs;
2245
						else
2246
							xfs = ipsecencxfs;
2247
						break;
2248
					case IKEV2_XFORMTYPE_PRF:
2249
						print_verbose(" prf ");
2250
						xfs = prfxfs;
2251
						break;
2252
					case IKEV2_XFORMTYPE_DH:
2253
						print_verbose(" group ");
2254
						xfs = groupxfs;
2255
						break;
2256
					default:
2257
						continue;
2258
					}
2259
				}
2260
2261
				print_verbose("%s", print_xf(xform->xform_id,
2262
				    xform->xform_length / 8, xfs));
2263
			}
2264
		}
2265
	}
2266
2267
	if (pol->pol_localid.id_length != 0)
2268
		print_verbose(" srcid %s", pol->pol_localid.id_data);
2269
	if (pol->pol_peerid.id_length != 0)
2270
		print_verbose(" dstid %s", pol->pol_peerid.id_data);
2271
2272
	if (pol->pol_rekey)
2273
		print_verbose(" ikelifetime %u", pol->pol_rekey);
2274
2275
	print_verbose(" lifetime %llu bytes %llu",
2276
	    pol->pol_lifetime.lt_seconds, pol->pol_lifetime.lt_bytes);
2277
2278
	switch (pol->pol_auth.auth_method) {
2279
	case IKEV2_AUTH_NONE:
2280
		print_verbose (" none");
2281
		break;
2282
	case IKEV2_AUTH_SHARED_KEY_MIC:
2283
		print_verbose(" psk 0x");
2284
		for (i = 0; i < pol->pol_auth.auth_length; i++)
2285
			print_verbose("%02x", pol->pol_auth.auth_data[i]);
2286
		break;
2287
	default:
2288
		if (pol->pol_auth.auth_eap)
2289
			print_verbose(" eap \"%s\"",
2290
			    print_map(pol->pol_auth.auth_eap, eap_type_map));
2291
		else
2292
			print_verbose(" %s",
2293
			    print_xf(pol->pol_auth.auth_method, 0, methodxfs));
2294
	}
2295
2296
	for (i = 0; i < pol->pol_ncfg; i++) {
2297
		cfg = &pol->pol_cfg[i];
2298
		print_verbose(" config %s %s", print_xf(cfg->cfg_type,
2299
		    cfg->cfg.address.addr_af, cpxfs),
2300
		    print_host((struct sockaddr *)&cfg->cfg.address.addr, NULL,
2301
		    0));
2302
	}
2303
2304
	if (pol->pol_tag[0] != '\0')
2305
		print_verbose(" tag \"%s\"", pol->pol_tag);
2306
2307
	if (pol->pol_tap != 0)
2308
		print_verbose(" tap \"enc%u\"", pol->pol_tap);
2309
2310
	print_verbose("\n");
2311
}
2312
2313
void
2314
copy_transforms(unsigned int type, const struct ipsec_xf *xf,
2315
    const struct ipsec_xf *xfs,
2316
    struct iked_transform *dst, size_t ndst,
2317
    unsigned int *n, struct iked_transform *src, size_t nsrc)
2318
{
2319
	unsigned int		 i;
2320
	struct iked_transform	*a, *b;
2321
2322
	if (xf != NULL) {
2323
		if (*n >= ndst)
2324
			return;
2325
		b = dst + (*n)++;
2326
2327
		b->xform_type = type;
2328
		b->xform_id = xf->id;
2329
		b->xform_keylength = xf->length * 8;
2330
		b->xform_length = xf->keylength * 8;
2331
		return;
2332
	}
2333
2334
	for (i = 0; i < nsrc; i++) {
2335
		a = src + i;
2336
		if (a->xform_type != type)
2337
			continue;
2338
		if (*n >= ndst)
2339
			return;
2340
		b = dst + (*n)++;
2341
		memcpy(b, a, sizeof(*b));
2342
	}
2343
}
2344
2345
int
2346
create_ike(char *name, int af, uint8_t ipproto, struct ipsec_hosts *hosts,
2347
    struct ipsec_hosts *peers, struct ipsec_mode *ike_sa,
2348
    struct ipsec_mode *ipsec_sa, uint8_t saproto,
2349
    uint8_t flags, char *srcid, char *dstid,
2350
    uint32_t ikelifetime, struct iked_lifetime *lt,
2351
    struct iked_auth *authtype, struct ipsec_filters *filter,
2352
    struct ipsec_addr_wrap *ikecfg)
2353
{
2354
	char			 idstr[IKED_ID_SIZE];
2355
	unsigned int		 idtype = IKEV2_ID_NONE;
2356
	struct ipsec_addr_wrap	*ipa, *ipb, *ippn;
2357
	struct iked_policy	 pol;
2358
	struct iked_proposal	 prop[2];
2359
	unsigned int		 j;
2360
	struct iked_transform	 ikexforms[64], ipsecxforms[64];
2361
	struct iked_flow	 flows[64];
2362
	static unsigned int	 policy_id = 0;
2363
	struct iked_cfg		*cfg;
2364
2365
	bzero(&pol, sizeof(pol));
2366
	bzero(&prop, sizeof(prop));
2367
	bzero(&ikexforms, sizeof(ikexforms));
2368
	bzero(&ipsecxforms, sizeof(ipsecxforms));
2369
	bzero(&flows, sizeof(flows));
2370
	bzero(idstr, sizeof(idstr));
2371
2372
	pol.pol_id = ++policy_id;
2373
	pol.pol_certreqtype = env->sc_certreqtype;
2374
	pol.pol_af = af;
2375
	pol.pol_saproto = saproto;
2376
	pol.pol_ipproto = ipproto;
2377
	pol.pol_flags = flags;
2378
	memcpy(&pol.pol_auth, authtype, sizeof(struct iked_auth));
2379
2380
	if (name != NULL) {
2381
		if (strlcpy(pol.pol_name, name,
2382
		    sizeof(pol.pol_name)) >= sizeof(pol.pol_name)) {
2383
			yyerror("name too long");
2384
			return (-1);
2385
		}
2386
	} else {
2387
		snprintf(pol.pol_name, sizeof(pol.pol_name),
2388
		    "policy%d", policy_id);
2389
	}
2390
2391
	if (srcid) {
2392
		pol.pol_localid.id_type = get_id_type(srcid);
2393
		pol.pol_localid.id_length = strlen(srcid);
2394
		if (strlcpy((char *)pol.pol_localid.id_data,
2395
		    srcid, IKED_ID_SIZE) >= IKED_ID_SIZE) {
2396
			yyerror("srcid too long");
2397
			return (-1);
2398
		}
2399
	}
2400
	if (dstid) {
2401
		pol.pol_peerid.id_type = get_id_type(dstid);
2402
		pol.pol_peerid.id_length = strlen(dstid);
2403
		if (strlcpy((char *)pol.pol_peerid.id_data,
2404
		    dstid, IKED_ID_SIZE) >= IKED_ID_SIZE) {
2405
			yyerror("dstid too long");
2406
			return (-1);
2407
		}
2408
	}
2409
2410
	if (filter != NULL) {
2411
		if (filter->tag)
2412
			strlcpy(pol.pol_tag, filter->tag, sizeof(pol.pol_tag));
2413
		pol.pol_tap = filter->tap;
2414
	}
2415
2416
	if (peers == NULL) {
2417
		if (pol.pol_flags & IKED_POLICY_ACTIVE) {
2418
			yyerror("active mode requires peer specification");
2419
			return (-1);
2420
		}
2421
		pol.pol_flags |= IKED_POLICY_DEFAULT|IKED_POLICY_SKIP;
2422
	}
2423
2424
	if (peers && peers->src && peers->dst &&
2425
	    (peers->src->af != AF_UNSPEC) && (peers->dst->af != AF_UNSPEC) &&
2426
	    (peers->src->af != peers->dst->af))
2427
		fatalx("create_ike: peer address family mismatch");
2428
2429
	if (peers && (pol.pol_af != AF_UNSPEC) &&
2430
	    ((peers->src && (peers->src->af != AF_UNSPEC) &&
2431
	    (peers->src->af != pol.pol_af)) ||
2432
	    (peers->dst && (peers->dst->af != AF_UNSPEC) &&
2433
	    (peers->dst->af != pol.pol_af))))
2434
		fatalx("create_ike: policy address family mismatch");
2435
2436
	ipa = ipb = NULL;
2437
	if (peers) {
2438
		if (peers->src)
2439
			ipa = peers->src;
2440
		if (peers->dst)
2441
			ipb = peers->dst;
2442
		if (ipa == NULL && ipb == NULL) {
2443
			if (hosts->src && hosts->src->next == NULL)
2444
				ipa = hosts->src;
2445
			if (hosts->dst && hosts->dst->next == NULL)
2446
				ipb = hosts->dst;
2447
		}
2448
	}
2449
	if (ipa == NULL && ipb == NULL) {
2450
		yyerror("could not get local/peer specification");
2451
		return (-1);
2452
	}
2453
	if (pol.pol_flags & IKED_POLICY_ACTIVE) {
2454
		if (ipb == NULL || ipb->netaddress ||
2455
		    (ipa != NULL && ipa->netaddress)) {
2456
			yyerror("active mode requires local/peer address");
2457
			return (-1);
2458
		}
2459
	}
2460
	if (ipa) {
2461
		memcpy(&pol.pol_local.addr, &ipa->address,
2462
		    sizeof(ipa->address));
2463
		pol.pol_local.addr_af = ipa->af;
2464
		pol.pol_local.addr_mask = ipa->mask;
2465
		pol.pol_local.addr_net = ipa->netaddress;
2466
		if (pol.pol_af == AF_UNSPEC)
2467
			pol.pol_af = ipa->af;
2468
	}
2469
	if (ipb) {
2470
		memcpy(&pol.pol_peer.addr, &ipb->address,
2471
		    sizeof(ipb->address));
2472
		pol.pol_peer.addr_af = ipb->af;
2473
		pol.pol_peer.addr_mask = ipb->mask;
2474
		pol.pol_peer.addr_net = ipb->netaddress;
2475
		if (pol.pol_af == AF_UNSPEC)
2476
			pol.pol_af = ipb->af;
2477
	}
2478
2479
	if (ikelifetime)
2480
		pol.pol_rekey = ikelifetime;
2481
2482
	if (lt)
2483
		pol.pol_lifetime = *lt;
2484
	else
2485
		pol.pol_lifetime = deflifetime;
2486
2487
	TAILQ_INIT(&pol.pol_proposals);
2488
	RB_INIT(&pol.pol_flows);
2489
2490
	prop[0].prop_id = ++pol.pol_nproposals;
2491
	prop[0].prop_protoid = IKEV2_SAPROTO_IKE;
2492
	if (ike_sa == NULL || ike_sa->xfs == NULL) {
2493
		prop[0].prop_nxforms = ikev2_default_nike_transforms;
2494
		prop[0].prop_xforms = ikev2_default_ike_transforms;
2495
	} else {
2496
		j = 0;
2497
		copy_transforms(IKEV2_XFORMTYPE_INTEGR,
2498
		    ike_sa->xfs->authxf, authxfs,
2499
		    ikexforms, nitems(ikexforms), &j,
2500
		    ikev2_default_ike_transforms,
2501
		    ikev2_default_nike_transforms);
2502
		copy_transforms(IKEV2_XFORMTYPE_ENCR,
2503
		    ike_sa->xfs->encxf, ikeencxfs,
2504
		    ikexforms, nitems(ikexforms), &j,
2505
		    ikev2_default_ike_transforms,
2506
		    ikev2_default_nike_transforms);
2507
		copy_transforms(IKEV2_XFORMTYPE_DH,
2508
		    ike_sa->xfs->groupxf, groupxfs,
2509
		    ikexforms, nitems(ikexforms), &j,
2510
		    ikev2_default_ike_transforms,
2511
		    ikev2_default_nike_transforms);
2512
		copy_transforms(IKEV2_XFORMTYPE_PRF,
2513
		    ike_sa->xfs->prfxf, prfxfs,
2514
		    ikexforms, nitems(ikexforms), &j,
2515
		    ikev2_default_ike_transforms,
2516
		    ikev2_default_nike_transforms);
2517
		prop[0].prop_nxforms = j;
2518
		prop[0].prop_xforms = ikexforms;
2519
	}
2520
	TAILQ_INSERT_TAIL(&pol.pol_proposals, &prop[0], prop_entry);
2521
2522
	prop[1].prop_id = ++pol.pol_nproposals;
2523
	prop[1].prop_protoid = saproto;
2524
	if (ipsec_sa == NULL || ipsec_sa->xfs == NULL) {
2525
		prop[1].prop_nxforms = ikev2_default_nesp_transforms;
2526
		prop[1].prop_xforms = ikev2_default_esp_transforms;
2527
	} else {
2528
		j = 0;
2529
		if (ipsec_sa->xfs->encxf && ipsec_sa->xfs->encxf->noauth &&
2530
		    ipsec_sa->xfs->authxf) {
2531
			yyerror("authentication is implicit for %s",
2532
			    ipsec_sa->xfs->encxf->name);
2533
			return (-1);
2534
		}
2535
		if (ipsec_sa->xfs->encxf == NULL ||
2536
		    (ipsec_sa->xfs->encxf && !ipsec_sa->xfs->encxf->noauth))
2537
			copy_transforms(IKEV2_XFORMTYPE_INTEGR,
2538
			    ipsec_sa->xfs->authxf, authxfs,
2539
			    ipsecxforms, nitems(ipsecxforms), &j,
2540
			    ikev2_default_esp_transforms,
2541
			    ikev2_default_nesp_transforms);
2542
		copy_transforms(IKEV2_XFORMTYPE_ENCR,
2543
		    ipsec_sa->xfs->encxf, ipsecencxfs,
2544
		    ipsecxforms, nitems(ipsecxforms), &j,
2545
		    ikev2_default_esp_transforms,
2546
		    ikev2_default_nesp_transforms);
2547
		copy_transforms(IKEV2_XFORMTYPE_DH,
2548
		    ipsec_sa->xfs->groupxf, groupxfs,
2549
		    ipsecxforms, nitems(ipsecxforms), &j,
2550
		    ikev2_default_esp_transforms,
2551
		    ikev2_default_nesp_transforms);
2552
		copy_transforms(IKEV2_XFORMTYPE_ESN,
2553
		    NULL, NULL,
2554
		    ipsecxforms, nitems(ipsecxforms), &j,
2555
		    ikev2_default_esp_transforms,
2556
		    ikev2_default_nesp_transforms);
2557
		prop[1].prop_nxforms = j;
2558
		prop[1].prop_xforms = ipsecxforms;
2559
	}
2560
	TAILQ_INSERT_TAIL(&pol.pol_proposals, &prop[1], prop_entry);
2561
2562
	if (hosts == NULL || hosts->src == NULL || hosts->dst == NULL)
2563
		fatalx("create_ike: no traffic selectors/flows");
2564
2565
	for (j = 0, ipa = hosts->src, ipb = hosts->dst; ipa && ipb;
2566
	    ipa = ipa->next, ipb = ipb->next, j++) {
2567
		if (j >= nitems(flows))
2568
			fatalx("create_ike: too many flows");
2569
		memcpy(&flows[j].flow_src.addr, &ipa->address,
2570
		    sizeof(ipa->address));
2571
		flows[j].flow_src.addr_af = ipa->af;
2572
		flows[j].flow_src.addr_mask = ipa->mask;
2573
		flows[j].flow_src.addr_net = ipa->netaddress;
2574
		flows[j].flow_src.addr_port = hosts->sport;
2575
2576
		memcpy(&flows[j].flow_dst.addr, &ipb->address,
2577
		    sizeof(ipb->address));
2578
		flows[j].flow_dst.addr_af = ipb->af;
2579
		flows[j].flow_dst.addr_mask = ipb->mask;
2580
		flows[j].flow_dst.addr_net = ipb->netaddress;
2581
		flows[j].flow_dst.addr_port = hosts->dport;
2582
2583
		ippn = ipa->srcnat;
2584
		if (ippn) {
2585
			memcpy(&flows[j].flow_prenat.addr, &ippn->address,
2586
			    sizeof(ippn->address));
2587
			flows[j].flow_prenat.addr_af = ippn->af;
2588
			flows[j].flow_prenat.addr_mask = ippn->mask;
2589
			flows[j].flow_prenat.addr_net = ippn->netaddress;
2590
		} else {
2591
			flows[j].flow_prenat.addr_af = 0;
2592
		}
2593
2594
		flows[j].flow_ipproto = ipproto;
2595
2596
		if (RB_INSERT(iked_flows, &pol.pol_flows, &flows[j]) == NULL)
2597
			pol.pol_nflows++;
2598
		else
2599
			warnx("create_ike: duplicate flow");
2600
	}
2601
2602
	for (j = 0, ipa = ikecfg; ipa; ipa = ipa->next, j++) {
2603
		if (j >= IKED_CFG_MAX)
2604
			break;
2605
		cfg = &pol.pol_cfg[j];
2606
		pol.pol_ncfg++;
2607
2608
		cfg->cfg_action = ipa->action;
2609
		cfg->cfg_type = ipa->type;
2610
		memcpy(&cfg->cfg.address.addr, &ipa->address,
2611
		    sizeof(ipa->address));
2612
		cfg->cfg.address.addr_mask = ipa->mask;
2613
		cfg->cfg.address.addr_net = ipa->netaddress;
2614
		cfg->cfg.address.addr_af = ipa->af;
2615
	}
2616
2617
	if (dstid) {
2618
		strlcpy(idstr, dstid, sizeof(idstr));
2619
		idtype = pol.pol_peerid.id_type;
2620
	} else if (!pol.pol_peer.addr_net) {
2621
		print_host((struct sockaddr *)&pol.pol_peer.addr, idstr,
2622
		    sizeof(idstr));
2623
		switch (pol.pol_peer.addr.ss_family) {
2624
		case AF_INET:
2625
			idtype = IKEV2_ID_IPV4;
2626
			break;
2627
		case AF_INET6:
2628
			idtype = IKEV2_ID_IPV6;
2629
			break;
2630
		default:
2631
			log_warnx("%s: unknown address family", __func__);
2632
			break;
2633
		}
2634
	}
2635
2636
	/* Make sure that we know how to authenticate this peer */
2637
	if (idtype && set_policy(idstr, idtype, &pol) < 0) {
2638
		log_debug("%s: set_policy failed", __func__);
2639
		return (-1);
2640
	}
2641
2642
	config_setpolicy(env, &pol, PROC_IKEV2);
2643
	config_setflow(env, &pol, PROC_IKEV2);
2644
2645
	rules++;
2646
	return (0);
2647
}
2648
2649
int
2650
create_user(const char *user, const char *pass)
2651
{
2652
	struct iked_user	 usr;
2653
2654
	bzero(&usr, sizeof(usr));
2655
2656
	if (*user == '\0' || (strlcpy(usr.usr_name, user,
2657
	    sizeof(usr.usr_name)) >= sizeof(usr.usr_name))) {
2658
		yyerror("invalid user name");
2659
		return (-1);
2660
	}
2661
	if (*pass == '\0' || (strlcpy(usr.usr_pass, pass,
2662
	    sizeof(usr.usr_pass)) >= sizeof(usr.usr_pass))) {
2663
		yyerror("invalid password");
2664
		return (-1);
2665
	}
2666
2667
	config_setuser(env, &usr, PROC_IKEV2);
2668
2669
	rules++;
2670
	return (0);
2671
}
2672
#line 2665 "parse.c"
2673
/* allocate initial stack or double stack size, up to YYMAXDEPTH */
2674
static int yygrowstack(void)
2675
{
2676
    unsigned int newsize;
2677
    long sslen;
2678
    short *newss;
2679
    YYSTYPE *newvs;
2680
2681
    if ((newsize = yystacksize) == 0)
2682
        newsize = YYINITSTACKSIZE;
2683
    else if (newsize >= YYMAXDEPTH)
2684
        return -1;
2685
    else if ((newsize *= 2) > YYMAXDEPTH)
2686
        newsize = YYMAXDEPTH;
2687
    sslen = yyssp - yyss;
2688
#ifdef SIZE_MAX
2689
#define YY_SIZE_MAX SIZE_MAX
2690
#else
2691
#define YY_SIZE_MAX 0xffffffffU
2692
#endif
2693
    if (newsize && YY_SIZE_MAX / newsize < sizeof *newss)
2694
        goto bail;
2695
    newss = yyss ? (short *)realloc(yyss, newsize * sizeof *newss) :
2696
      (short *)malloc(newsize * sizeof *newss); /* overflow check above */
2697
    if (newss == NULL)
2698
        goto bail;
2699
    yyss = newss;
2700
    yyssp = newss + sslen;
2701
    if (newsize && YY_SIZE_MAX / newsize < sizeof *newvs)
2702
        goto bail;
2703
    newvs = yyvs ? (YYSTYPE *)realloc(yyvs, newsize * sizeof *newvs) :
2704
      (YYSTYPE *)malloc(newsize * sizeof *newvs); /* overflow check above */
2705
    if (newvs == NULL)
2706
        goto bail;
2707
    yyvs = newvs;
2708
    yyvsp = newvs + sslen;
2709
    yystacksize = newsize;
2710
    yysslim = yyss + newsize - 1;
2711
    return 0;
2712
bail:
2713
    if (yyss)
2714
            free(yyss);
2715
    if (yyvs)
2716
            free(yyvs);
2717
    yyss = yyssp = NULL;
2718
    yyvs = yyvsp = NULL;
2719
    yystacksize = 0;
2720
    return -1;
2721
}
2722
2723
#define YYABORT goto yyabort
2724
#define YYREJECT goto yyabort
2725
#define YYACCEPT goto yyaccept
2726
#define YYERROR goto yyerrlab
2727
int
2728
yyparse(void)
2729
{
2730
    int yym, yyn, yystate;
2731
#if YYDEBUG
2732
    const char *yys;
2733
2734
    if ((yys = getenv("YYDEBUG")))
2735
    {
2736
        yyn = *yys;
2737
        if (yyn >= '0' && yyn <= '9')
2738
            yydebug = yyn - '0';
2739
    }
2740
#endif /* YYDEBUG */
2741
2742
    yynerrs = 0;
2743
    yyerrflag = 0;
2744
    yychar = (-1);
2745
2746
    if (yyss == NULL && yygrowstack()) goto yyoverflow;
2747
    yyssp = yyss;
2748
    yyvsp = yyvs;
2749
    *yyssp = yystate = 0;
2750
2751
yyloop:
2752
    if ((yyn = yydefred[yystate]) != 0) goto yyreduce;
2753
    if (yychar < 0)
2754
    {
2755
        if ((yychar = yylex()) < 0) yychar = 0;
2756
#if YYDEBUG
2757
        if (yydebug)
2758
        {
2759
            yys = 0;
2760
            if (yychar <= YYMAXTOKEN) yys = yyname[yychar];
2761
            if (!yys) yys = "illegal-symbol";
2762
            printf("%sdebug: state %d, reading %d (%s)\n",
2763
                    YYPREFIX, yystate, yychar, yys);
2764
        }
2765
#endif
2766
    }
2767
    if ((yyn = yysindex[yystate]) && (yyn += yychar) >= 0 &&
2768
            yyn <= YYTABLESIZE && yycheck[yyn] == yychar)
2769
    {
2770
#if YYDEBUG
2771
        if (yydebug)
2772
            printf("%sdebug: state %d, shifting to state %d\n",
2773
                    YYPREFIX, yystate, yytable[yyn]);
2774
#endif
2775
        if (yyssp >= yysslim && yygrowstack())
2776
        {
2777
            goto yyoverflow;
2778
        }
2779
        *++yyssp = yystate = yytable[yyn];
2780
        *++yyvsp = yylval;
2781
        yychar = (-1);
2782
        if (yyerrflag > 0)  --yyerrflag;
2783
        goto yyloop;
2784
    }
2785
    if ((yyn = yyrindex[yystate]) && (yyn += yychar) >= 0 &&
2786
            yyn <= YYTABLESIZE && yycheck[yyn] == yychar)
2787
    {
2788
        yyn = yytable[yyn];
2789
        goto yyreduce;
2790
    }
2791
    if (yyerrflag) goto yyinrecovery;
2792
#if defined(__GNUC__)
2793
    goto yynewerror;
2794
#endif
2795
yynewerror:
2796
    yyerror("syntax error");
2797
#if defined(__GNUC__)
2798
    goto yyerrlab;
2799
#endif
2800
yyerrlab:
2801
    ++yynerrs;
2802
yyinrecovery:
2803
    if (yyerrflag < 3)
2804
    {
2805
        yyerrflag = 3;
2806
        for (;;)
2807
        {
2808
            if ((yyn = yysindex[*yyssp]) && (yyn += YYERRCODE) >= 0 &&
2809
                    yyn <= YYTABLESIZE && yycheck[yyn] == YYERRCODE)
2810
            {
2811
#if YYDEBUG
2812
                if (yydebug)
2813
                    printf("%sdebug: state %d, error recovery shifting\
2814
 to state %d\n", YYPREFIX, *yyssp, yytable[yyn]);
2815
#endif
2816
                if (yyssp >= yysslim && yygrowstack())
2817
                {
2818
                    goto yyoverflow;
2819
                }
2820
                *++yyssp = yystate = yytable[yyn];
2821
                *++yyvsp = yylval;
2822
                goto yyloop;
2823
            }
2824
            else
2825
            {
2826
#if YYDEBUG
2827
                if (yydebug)
2828
                    printf("%sdebug: error recovery discarding state %d\n",
2829
                            YYPREFIX, *yyssp);
2830
#endif
2831
                if (yyssp <= yyss) goto yyabort;
2832
                --yyssp;
2833
                --yyvsp;
2834
            }
2835
        }
2836
    }
2837
    else
2838
    {
2839
        if (yychar == 0) goto yyabort;
2840
#if YYDEBUG
2841
        if (yydebug)
2842
        {
2843
            yys = 0;
2844
            if (yychar <= YYMAXTOKEN) yys = yyname[yychar];
2845
            if (!yys) yys = "illegal-symbol";
2846
            printf("%sdebug: state %d, error recovery discards token %d (%s)\n",
2847
                    YYPREFIX, yystate, yychar, yys);
2848
        }
2849
#endif
2850
        yychar = (-1);
2851
        goto yyloop;
2852
    }
2853
yyreduce:
2854
#if YYDEBUG
2855
    if (yydebug)
2856
        printf("%sdebug: state %d, reducing by rule %d (%s)\n",
2857
                YYPREFIX, yystate, yyn, yyrule[yyn]);
2858
#endif
2859
    yym = yylen[yyn];
2860
    if (yym)
2861
        yyval = yyvsp[1-yym];
2862
    else
2863
        memset(&yyval, 0, sizeof yyval);
2864
    switch (yyn)
2865
    {
2866
case 9:
2867
#line 422 "parse.y"
2868
{ file->errors++; }
2869
break;
2870
case 12:
2871
#line 429 "parse.y"
2872
{
2873
			struct file	*nfile;
2874
2875
			if ((nfile = pushfile(yyvsp[0].v.string, 0)) == NULL) {
2876
				yyerror("failed to include file %s", yyvsp[0].v.string);
2877
				free(yyvsp[0].v.string);
2878
				YYERROR;
2879
			}
2880
			free(yyvsp[0].v.string);
2881
2882
			file = nfile;
2883
			lungetc('\n');
2884
		}
2885
break;
2886
case 13:
2887
#line 444 "parse.y"
2888
{ passive = 0; }
2889
break;
2890
case 14:
2891
#line 445 "parse.y"
2892
{ passive = 1; }
2893
break;
2894
case 15:
2895
#line 446 "parse.y"
2896
{ decouple = 0; }
2897
break;
2898
case 16:
2899
#line 447 "parse.y"
2900
{ decouple = 1; }
2901
break;
2902
case 17:
2903
#line 448 "parse.y"
2904
{
2905
			if ((ocsp_url = strdup(yyvsp[0].v.string)) == NULL) {
2906
				yyerror("cannot set ocsp_url");
2907
				YYERROR;
2908
			}
2909
		}
2910
break;
2911
case 18:
2912
#line 456 "parse.y"
2913
{
2914
			if (create_user(yyvsp[-1].v.string, yyvsp[0].v.string) == -1)
2915
				YYERROR;
2916
		}
2917
break;
2918
case 19:
2919
#line 464 "parse.y"
2920
{
2921
			if (create_ike(yyvsp[-14].v.string, yyvsp[-11].v.number, yyvsp[-10].v.proto, yyvsp[-9].v.hosts, &yyvsp[-8].v.peers, yyvsp[-7].v.mode, yyvsp[-6].v.mode, yyvsp[-12].v.satype, yyvsp[-13].v.ikemode,
2922
			    yyvsp[-5].v.ids.srcid, yyvsp[-5].v.ids.dstid, yyvsp[-4].v.number, &yyvsp[-3].v.lifetime, &yyvsp[-2].v.ikeauth,
2923
			    yyvsp[0].v.filters, yyvsp[-1].v.cfg) == -1) {
2924
				yyerror("create_ike failed");
2925
				YYERROR;
2926
			}
2927
		}
2928
break;
2929
case 20:
2930
#line 474 "parse.y"
2931
{ yyval.v.cfg = NULL; }
2932
break;
2933
case 21:
2934
#line 475 "parse.y"
2935
{ yyval.v.cfg = yyvsp[0].v.cfg; }
2936
break;
2937
case 22:
2938
#line 478 "parse.y"
2939
{ yyval.v.cfg = yyvsp[0].v.cfg; }
2940
break;
2941
case 23:
2942
#line 479 "parse.y"
2943
{
2944
			if (yyvsp[0].v.cfg == NULL)
2945
				yyval.v.cfg = yyvsp[-1].v.cfg;
2946
			else if (yyvsp[-1].v.cfg == NULL)
2947
				yyval.v.cfg = yyvsp[0].v.cfg;
2948
			else {
2949
				yyvsp[-1].v.cfg->tail->next = yyvsp[0].v.cfg;
2950
				yyvsp[-1].v.cfg->tail = yyvsp[0].v.cfg->tail;
2951
				yyval.v.cfg = yyvsp[-1].v.cfg;
2952
			}
2953
		}
2954
break;
2955
case 24:
2956
#line 492 "parse.y"
2957
{
2958
			const struct ipsec_xf	*xf;
2959
2960
			if ((xf = parse_xf(yyvsp[-1].v.string, yyvsp[0].v.host->af, cpxfs)) == NULL) {
2961
				yyerror("not a valid ikecfg option");
2962
				free(yyvsp[-1].v.string);
2963
				free(yyvsp[0].v.host);
2964
				YYERROR;
2965
			}
2966
			yyval.v.cfg = yyvsp[0].v.host;
2967
			yyval.v.cfg->type = xf->id;
2968
			yyval.v.cfg->action = IKEV2_CP_REPLY;	/* XXX */
2969
		}
2970
break;
2971
case 25:
2972
#line 507 "parse.y"
2973
{ yyval.v.string = NULL; }
2974
break;
2975
case 26:
2976
#line 508 "parse.y"
2977
{
2978
			yyval.v.string = yyvsp[0].v.string;
2979
		}
2980
break;
2981
case 27:
2982
#line 512 "parse.y"
2983
{ yyval.v.satype = IKEV2_SAPROTO_ESP; }
2984
break;
2985
case 28:
2986
#line 513 "parse.y"
2987
{ yyval.v.satype = IKEV2_SAPROTO_ESP; }
2988
break;
2989
case 29:
2990
#line 514 "parse.y"
2991
{ yyval.v.satype = IKEV2_SAPROTO_AH; }
2992
break;
2993
case 30:
2994
#line 517 "parse.y"
2995
{ yyval.v.number = AF_UNSPEC; }
2996
break;
2997
case 31:
2998
#line 518 "parse.y"
2999
{ yyval.v.number = AF_INET; }
3000
break;
3001
case 32:
3002
#line 519 "parse.y"
3003
{ yyval.v.number = AF_INET6; }
3004
break;
3005
case 33:
3006
#line 522 "parse.y"
3007
{ yyval.v.proto = 0; }
3008
break;
3009
case 34:
3010
#line 523 "parse.y"
3011
{ yyval.v.proto = yyvsp[0].v.number; }
3012
break;
3013
case 35:
3014
#line 524 "parse.y"
3015
{ yyval.v.proto = IPPROTO_ESP; }
3016
break;
3017
case 36:
3018
#line 525 "parse.y"
3019
{ yyval.v.proto = IPPROTO_AH; }
3020
break;
3021
case 37:
3022
#line 528 "parse.y"
3023
{
3024
			struct protoent *p;
3025
3026
			p = getprotobyname(yyvsp[0].v.string);
3027
			if (p == NULL) {
3028
				yyerror("unknown protocol: %s", yyvsp[0].v.string);
3029
				YYERROR;
3030
			}
3031
			yyval.v.number = p->p_proto;
3032
			free(yyvsp[0].v.string);
3033
		}
3034
break;
3035
case 38:
3036
#line 539 "parse.y"
3037
{
3038
			if (yyvsp[0].v.number > 255 || yyvsp[0].v.number < 0) {
3039
				yyerror("protocol outside range");
3040
				YYERROR;
3041
			}
3042
		}
3043
break;
3044
case 39:
3045
#line 547 "parse.y"
3046
{ yyval.v.hosts = yyvsp[0].v.hosts; }
3047
break;
3048
case 40:
3049
#line 548 "parse.y"
3050
{
3051
			if (yyvsp[0].v.hosts == NULL)
3052
				yyval.v.hosts = yyvsp[-2].v.hosts;
3053
			else if (yyvsp[-2].v.hosts == NULL)
3054
				yyval.v.hosts = yyvsp[0].v.hosts;
3055
			else {
3056
				yyvsp[-2].v.hosts->src->tail->next = yyvsp[0].v.hosts->src;
3057
				yyvsp[-2].v.hosts->src->tail = yyvsp[0].v.hosts->src->tail;
3058
				yyvsp[-2].v.hosts->dst->tail->next = yyvsp[0].v.hosts->dst;
3059
				yyvsp[-2].v.hosts->dst->tail = yyvsp[0].v.hosts->dst->tail;
3060
				yyval.v.hosts = yyvsp[-2].v.hosts;
3061
			}
3062
		}
3063
break;
3064
case 41:
3065
#line 563 "parse.y"
3066
{
3067
			struct ipsec_addr_wrap *ipa;
3068
			for (ipa = yyvsp[-1].v.host; ipa; ipa = ipa->next) {
3069
				if (ipa->srcnat) {
3070
					yyerror("no flow NAT support for"
3071
					    " destination network: %s",
3072
					    ipa->name);
3073
					YYERROR;
3074
				}
3075
			}
3076
3077
			if ((yyval.v.hosts = calloc(1, sizeof(*yyval.v.hosts))) == NULL)
3078
				err(1, "hosts: calloc");
3079
3080
			yyval.v.hosts->src = yyvsp[-4].v.host;
3081
			yyval.v.hosts->sport = yyvsp[-3].v.port;
3082
			yyval.v.hosts->dst = yyvsp[-1].v.host;
3083
			yyval.v.hosts->dport = yyvsp[0].v.port;
3084
		}
3085
break;
3086
case 42:
3087
#line 582 "parse.y"
3088
{
3089
			struct ipsec_addr_wrap *ipa;
3090
			for (ipa = yyvsp[-4].v.host; ipa; ipa = ipa->next) {
3091
				if (ipa->srcnat) {
3092
					yyerror("no flow NAT support for"
3093
					    " destination network: %s",
3094
					    ipa->name);
3095
					YYERROR;
3096
				}
3097
			}
3098
			if ((yyval.v.hosts = calloc(1, sizeof(*yyval.v.hosts))) == NULL)
3099
				err(1, "hosts: calloc");
3100
3101
			yyval.v.hosts->src = yyvsp[-1].v.host;
3102
			yyval.v.hosts->sport = yyvsp[0].v.port;
3103
			yyval.v.hosts->dst = yyvsp[-4].v.host;
3104
			yyval.v.hosts->dport = yyvsp[-3].v.port;
3105
		}
3106
break;
3107
case 43:
3108
#line 602 "parse.y"
3109
{ yyval.v.port = 0; }
3110
break;
3111
case 44:
3112
#line 603 "parse.y"
3113
{ yyval.v.port = yyvsp[0].v.number; }
3114
break;
3115
case 45:
3116
#line 606 "parse.y"
3117
{
3118
			struct servent *s;
3119
3120
			if ((s = getservbyname(yyvsp[0].v.string, "tcp")) != NULL ||
3121
			    (s = getservbyname(yyvsp[0].v.string, "udp")) != NULL) {
3122
				yyval.v.number = s->s_port;
3123
			} else {
3124
				yyerror("unknown port: %s", yyvsp[0].v.string);
3125
				YYERROR;
3126
			}
3127
		}
3128
break;
3129
case 46:
3130
#line 617 "parse.y"
3131
{
3132
			if (yyvsp[0].v.number > USHRT_MAX || yyvsp[0].v.number < 0) {
3133
				yyerror("port outside range");
3134
				YYERROR;
3135
			}
3136
			yyval.v.number = htons(yyvsp[0].v.number);
3137
		}
3138
break;
3139
case 47:
3140
#line 626 "parse.y"
3141
{
3142
			yyval.v.peers.dst = NULL;
3143
			yyval.v.peers.src = NULL;
3144
		}
3145
break;
3146
case 48:
3147
#line 630 "parse.y"
3148
{
3149
			yyval.v.peers.dst = yyvsp[-2].v.anyhost;
3150
			yyval.v.peers.src = yyvsp[0].v.anyhost;
3151
		}
3152
break;
3153
case 49:
3154
#line 634 "parse.y"
3155
{
3156
			yyval.v.peers.dst = yyvsp[0].v.anyhost;
3157
			yyval.v.peers.src = yyvsp[-2].v.anyhost;
3158
		}
3159
break;
3160
case 50:
3161
#line 638 "parse.y"
3162
{
3163
			yyval.v.peers.dst = yyvsp[0].v.anyhost;
3164
			yyval.v.peers.src = NULL;
3165
		}
3166
break;
3167
case 51:
3168
#line 642 "parse.y"
3169
{
3170
			yyval.v.peers.dst = NULL;
3171
			yyval.v.peers.src = yyvsp[0].v.anyhost;
3172
		}
3173
break;
3174
case 52:
3175
#line 648 "parse.y"
3176
{ yyval.v.anyhost = yyvsp[0].v.host; }
3177
break;
3178
case 53:
3179
#line 649 "parse.y"
3180
{
3181
			yyval.v.anyhost = host_any();
3182
		}
3183
break;
3184
case 54:
3185
#line 653 "parse.y"
3186
{
3187
			if ((yyval.v.host = host(yyvsp[0].v.string)) == NULL) {
3188
				free(yyvsp[0].v.string);
3189
				yyerror("could not parse host specification");
3190
				YYERROR;
3191
			}
3192
			free(yyvsp[0].v.string);
3193
		}
3194
break;
3195
case 55:
3196
#line 661 "parse.y"
3197
{
3198
			char	*buf;
3199
3200
			if (asprintf(&buf, "%s/%lld", yyvsp[-2].v.string, yyvsp[0].v.number) == -1)
3201
				err(1, "host: asprintf");
3202
			free(yyvsp[-2].v.string);
3203
			if ((yyval.v.host = host(buf)) == NULL)	{
3204
				free(buf);
3205
				yyerror("could not parse host specification");
3206
				YYERROR;
3207
			}
3208
			free(buf);
3209
		}
3210
break;
3211
case 56:
3212
#line 676 "parse.y"
3213
{ yyval.v.host = yyvsp[0].v.host; }
3214
break;
3215
case 57:
3216
#line 677 "parse.y"
3217
{
3218
			if ((yyvsp[-3].v.host->af != AF_UNSPEC) && (yyvsp[-1].v.host->af != AF_UNSPEC) &&
3219
			    (yyvsp[-1].v.host->af != yyvsp[-3].v.host->af)) {
3220
				yyerror("Flow NAT address family mismatch");
3221
				YYERROR;
3222
			}
3223
			yyval.v.host = yyvsp[-3].v.host;
3224
			yyval.v.host->srcnat = yyvsp[-1].v.host;
3225
		}
3226
break;
3227
case 58:
3228
#line 686 "parse.y"
3229
{
3230
			yyval.v.host = host_any();
3231
		}
3232
break;
3233
case 59:
3234
#line 691 "parse.y"
3235
{
3236
			yyval.v.ids.srcid = NULL;
3237
			yyval.v.ids.dstid = NULL;
3238
		}
3239
break;
3240
case 60:
3241
#line 695 "parse.y"
3242
{
3243
			yyval.v.ids.srcid = yyvsp[-2].v.id;
3244
			yyval.v.ids.dstid = yyvsp[0].v.id;
3245
		}
3246
break;
3247
case 61:
3248
#line 699 "parse.y"
3249
{
3250
			yyval.v.ids.srcid = yyvsp[0].v.id;
3251
			yyval.v.ids.dstid = NULL;
3252
		}
3253
break;
3254
case 62:
3255
#line 703 "parse.y"
3256
{
3257
			yyval.v.ids.srcid = NULL;
3258
			yyval.v.ids.dstid = yyvsp[0].v.id;
3259
		}
3260
break;
3261
case 63:
3262
#line 709 "parse.y"
3263
{ yyval.v.id = yyvsp[0].v.string; }
3264
break;
3265
case 64:
3266
#line 712 "parse.y"
3267
{
3268
			if ((ipsec_transforms = calloc(1,
3269
			    sizeof(struct ipsec_transforms))) == NULL)
3270
				err(1, "transforms: calloc");
3271
		}
3272
break;
3273
case 65:
3274
#line 717 "parse.y"
3275
{
3276
			yyval.v.transforms = ipsec_transforms;
3277
		}
3278
break;
3279
case 66:
3280
#line 720 "parse.y"
3281
{
3282
			yyval.v.transforms = NULL;
3283
		}
3284
break;
3285
case 69:
3286
#line 729 "parse.y"
3287
{
3288
			if (ipsec_transforms->authxf)
3289
				yyerror("auth already set");
3290
			else {
3291
				ipsec_transforms->authxf = parse_xf(yyvsp[0].v.string, 0,
3292
				    authxfs);
3293
				if (!ipsec_transforms->authxf)
3294
					yyerror("%s not a valid transform", yyvsp[0].v.string);
3295
			}
3296
		}
3297
break;
3298
case 70:
3299
#line 739 "parse.y"
3300
{
3301
			if (ipsec_transforms->encxf)
3302
				yyerror("enc already set");
3303
			else {
3304
				ipsec_transforms->encxf = parse_xf(yyvsp[0].v.string, 0,
3305
				    encxfs);
3306
				if (!ipsec_transforms->encxf)
3307
					yyerror("%s not a valid transform",
3308
					    yyvsp[0].v.string);
3309
			}
3310
		}
3311
break;
3312
case 71:
3313
#line 750 "parse.y"
3314
{
3315
			if (ipsec_transforms->prfxf)
3316
				yyerror("prf already set");
3317
			else {
3318
				ipsec_transforms->prfxf = parse_xf(yyvsp[0].v.string, 0,
3319
				    prfxfs);
3320
				if (!ipsec_transforms->prfxf)
3321
					yyerror("%s not a valid transform",
3322
					    yyvsp[0].v.string);
3323
			}
3324
		}
3325
break;
3326
case 72:
3327
#line 761 "parse.y"
3328
{
3329
			if (ipsec_transforms->groupxf)
3330
				yyerror("group already set");
3331
			else {
3332
				ipsec_transforms->groupxf = parse_xf(yyvsp[0].v.string, 0,
3333
				    groupxfs);
3334
				if (!ipsec_transforms->groupxf)
3335
					yyerror("%s not a valid transform",
3336
					    yyvsp[0].v.string);
3337
			}
3338
		}
3339
break;
3340
case 73:
3341
#line 774 "parse.y"
3342
{
3343
			yyval.v.mode = NULL;
3344
		}
3345
break;
3346
case 74:
3347
#line 777 "parse.y"
3348
{
3349
			encxfs = ikeencxfs;
3350
		}
3351
break;
3352
case 75:
3353
#line 779 "parse.y"
3354
{
3355
			if ((yyval.v.mode = calloc(1, sizeof(*yyval.v.mode))) == NULL)
3356
				err(1, "ike_sa: calloc");
3357
			yyval.v.mode->xfs = yyvsp[0].v.transforms;
3358
		}
3359
break;
3360
case 76:
3361
#line 786 "parse.y"
3362
{
3363
			yyval.v.mode = NULL;
3364
		}
3365
break;
3366
case 77:
3367
#line 789 "parse.y"
3368
{
3369
			encxfs = ipsecencxfs;
3370
		}
3371
break;
3372
case 78:
3373
#line 791 "parse.y"
3374
{
3375
			if ((yyval.v.mode = calloc(1, sizeof(*yyval.v.mode))) == NULL)
3376
				err(1, "child_sa: calloc");
3377
			yyval.v.mode->xfs = yyvsp[0].v.transforms;
3378
		}
3379
break;
3380
case 79:
3381
#line 798 "parse.y"
3382
{ yyval.v.ikemode = yyvsp[-2].v.ikemode | yyvsp[-1].v.ikemode | yyvsp[0].v.ikemode; }
3383
break;
3384
case 80:
3385
#line 801 "parse.y"
3386
{ yyval.v.ikemode = 0; }
3387
break;
3388
case 81:
3389
#line 802 "parse.y"
3390
{ yyval.v.ikemode = IKED_POLICY_QUICK; }
3391
break;
3392
case 82:
3393
#line 803 "parse.y"
3394
{ yyval.v.ikemode = IKED_POLICY_SKIP; }
3395
break;
3396
case 83:
3397
#line 804 "parse.y"
3398
{ yyval.v.ikemode = IKED_POLICY_DEFAULT; }
3399
break;
3400
case 84:
3401
#line 807 "parse.y"
3402
{ yyval.v.ikemode = IKED_POLICY_PASSIVE; }
3403
break;
3404
case 85:
3405
#line 808 "parse.y"
3406
{ yyval.v.ikemode = IKED_POLICY_PASSIVE; }
3407
break;
3408
case 86:
3409
#line 809 "parse.y"
3410
{ yyval.v.ikemode = IKED_POLICY_ACTIVE; }
3411
break;
3412
case 87:
3413
#line 812 "parse.y"
3414
{ yyval.v.ikemode = 0; }
3415
break;
3416
case 88:
3417
#line 813 "parse.y"
3418
{ yyval.v.ikemode = IKED_POLICY_IPCOMP; }
3419
break;
3420
case 89:
3421
#line 816 "parse.y"
3422
{
3423
			yyval.v.ikeauth.auth_method = IKEV2_AUTH_SIG_ANY;	/* default */
3424
			yyval.v.ikeauth.auth_eap = 0;
3425
			yyval.v.ikeauth.auth_length = 0;
3426
		}
3427
break;
3428
case 90:
3429
#line 821 "parse.y"
3430
{
3431
			memcpy(&yyval.v.ikeauth, &yyvsp[0].v.ikekey, sizeof(yyval.v.ikeauth));
3432
			yyval.v.ikeauth.auth_method = IKEV2_AUTH_SHARED_KEY_MIC;
3433
			yyval.v.ikeauth.auth_eap = 0;
3434
		}
3435
break;
3436
case 91:
3437
#line 826 "parse.y"
3438
{
3439
			unsigned int i;
3440
3441
			for (i = 0; i < strlen(yyvsp[0].v.string); i++)
3442
				if (yyvsp[0].v.string[i] == '-')
3443
					yyvsp[0].v.string[i] = '_';
3444
3445
			if (strcasecmp("mschap_v2", yyvsp[0].v.string) != 0) {
3446
				yyerror("unsupported EAP method: %s", yyvsp[0].v.string);
3447
				free(yyvsp[0].v.string);
3448
				YYERROR;
3449
			}
3450
			free(yyvsp[0].v.string);
3451
3452
			yyval.v.ikeauth.auth_method = IKEV2_AUTH_RSA_SIG;
3453
			yyval.v.ikeauth.auth_eap = EAP_TYPE_MSCHAP_V2;
3454
			yyval.v.ikeauth.auth_length = 0;
3455
		}
3456
break;
3457
case 92:
3458
#line 844 "parse.y"
3459
{
3460
			const struct ipsec_xf *xf;
3461
3462
			if ((xf = parse_xf(yyvsp[0].v.string, 0, methodxfs)) == NULL ||
3463
			    xf->id == IKEV2_AUTH_NONE) {
3464
				yyerror("not a valid authentication mode");
3465
				free(yyvsp[0].v.string);
3466
				YYERROR;
3467
			}
3468
			free(yyvsp[0].v.string);
3469
3470
			yyval.v.ikeauth.auth_method = xf->id;
3471
			yyval.v.ikeauth.auth_eap = 0;
3472
			yyval.v.ikeauth.auth_length = 0;
3473
		}
3474
break;
3475
case 93:
3476
#line 861 "parse.y"
3477
{
3478
			yyval.v.number = yyvsp[0].v.number;
3479
		}
3480
break;
3481
case 94:
3482
#line 864 "parse.y"
3483
{
3484
			uint64_t	 bytes = 0;
3485
			char		 unit = 0;
3486
3487
			if (sscanf(yyvsp[0].v.string, "%llu%c", &bytes, &unit) != 2) {
3488
				yyerror("invalid byte specification: %s", yyvsp[0].v.string);
3489
				YYERROR;
3490
			}
3491
			switch (toupper((unsigned char)unit)) {
3492
			case 'K':
3493
				bytes *= 1024;
3494
				break;
3495
			case 'M':
3496
				bytes *= 1024 * 1024;
3497
				break;
3498
			case 'G':
3499
				bytes *= 1024 * 1024 * 1024;
3500
				break;
3501
			default:
3502
				yyerror("invalid byte unit");
3503
				YYERROR;
3504
			}
3505
			yyval.v.number = bytes;
3506
		}
3507
break;
3508
case 95:
3509
#line 890 "parse.y"
3510
{
3511
			yyval.v.number = yyvsp[0].v.number;
3512
		}
3513
break;
3514
case 96:
3515
#line 893 "parse.y"
3516
{
3517
			uint64_t	 seconds = 0;
3518
			char		 unit = 0;
3519
3520
			if (sscanf(yyvsp[0].v.string, "%llu%c", &seconds, &unit) != 2) {
3521
				yyerror("invalid time specification: %s", yyvsp[0].v.string);
3522
				YYERROR;
3523
			}
3524
			switch (tolower((unsigned char)unit)) {
3525
			case 'm':
3526
				seconds *= 60;
3527
				break;
3528
			case 'h':
3529
				seconds *= 60 * 60;
3530
				break;
3531
			default:
3532
				yyerror("invalid time unit");
3533
				YYERROR;
3534
			}
3535
			yyval.v.number = seconds;
3536
		}
3537
break;
3538
case 97:
3539
#line 916 "parse.y"
3540
{
3541
			yyval.v.lifetime = deflifetime;
3542
		}
3543
break;
3544
case 98:
3545
#line 919 "parse.y"
3546
{
3547
			yyval.v.lifetime.lt_seconds = yyvsp[0].v.number;
3548
			yyval.v.lifetime.lt_bytes = deflifetime.lt_bytes;
3549
		}
3550
break;
3551
case 99:
3552
#line 923 "parse.y"
3553
{
3554
			yyval.v.lifetime.lt_seconds = yyvsp[-2].v.number;
3555
			yyval.v.lifetime.lt_bytes = yyvsp[0].v.number;
3556
		}
3557
break;
3558
case 100:
3559
#line 929 "parse.y"
3560
{
3561
			yyval.v.number = 0;
3562
		}
3563
break;
3564
case 101:
3565
#line 932 "parse.y"
3566
{
3567
			yyval.v.number = yyvsp[0].v.number;
3568
		}
3569
break;
3570
case 102:
3571
#line 936 "parse.y"
3572
{
3573
			uint8_t		*hex;
3574
3575
			bzero(&yyval.v.ikekey, sizeof(yyval.v.ikekey));
3576
3577
			hex = yyvsp[0].v.string;
3578
			if (strncmp(hex, "0x", 2) == 0) {
3579
				hex += 2;
3580
				if (parsekey(hex, strlen(hex), &yyval.v.ikekey) != 0) {
3581
					free(yyvsp[0].v.string);
3582
					YYERROR;
3583
				}
3584
			} else {
3585
				if (strlen(yyvsp[0].v.string) > sizeof(yyval.v.ikekey.auth_data)) {
3586
					yyerror("psk too long");
3587
					free(yyvsp[0].v.string);
3588
					YYERROR;
3589
				}
3590
				strlcpy(yyval.v.ikekey.auth_data, yyvsp[0].v.string,
3591
				    sizeof(yyval.v.ikekey.auth_data));
3592
				yyval.v.ikekey.auth_length = strlen(yyvsp[0].v.string);
3593
			}
3594
			free(yyvsp[0].v.string);
3595
		}
3596
break;
3597
case 103:
3598
#line 960 "parse.y"
3599
{
3600
			if (parsekeyfile(yyvsp[0].v.string, &yyval.v.ikekey) != 0) {
3601
				free(yyvsp[0].v.string);
3602
				YYERROR;
3603
			}
3604
			free(yyvsp[0].v.string);
3605
		}
3606
break;
3607
case 104:
3608
#line 969 "parse.y"
3609
{
3610
			if ((ipsec_filters = calloc(1,
3611
			    sizeof(struct ipsec_filters))) == NULL)
3612
				err(1, "filters: calloc");
3613
		}
3614
break;
3615
case 105:
3616
#line 974 "parse.y"
3617
{
3618
			yyval.v.filters = ipsec_filters;
3619
		}
3620
break;
3621
case 106:
3622
#line 977 "parse.y"
3623
{
3624
			yyval.v.filters = NULL;
3625
		}
3626
break;
3627
case 109:
3628
#line 987 "parse.y"
3629
{
3630
			ipsec_filters->tag = yyvsp[0].v.string;
3631
		}
3632
break;
3633
case 110:
3634
#line 991 "parse.y"
3635
{
3636
			const char	*errstr = NULL;
3637
			size_t		 len;
3638
3639
			len = strcspn(yyvsp[0].v.string, "0123456789");
3640
			if (strlen("enc") != len ||
3641
			    strncmp("enc", yyvsp[0].v.string, len) != 0) {
3642
				yyerror("invalid tap interface name: %s", yyvsp[0].v.string);
3643
				free(yyvsp[0].v.string);
3644
				YYERROR;
3645
			}
3646
			ipsec_filters->tap =
3647
			    strtonum(yyvsp[0].v.string + len, 0, UINT_MAX, &errstr);
3648
			free(yyvsp[0].v.string);
3649
			if (errstr != NULL) {
3650
				yyerror("invalid tap interface unit: %s",
3651
				    errstr);
3652
				YYERROR;
3653
			}
3654
		}
3655
break;
3656
case 111:
3657
#line 1014 "parse.y"
3658
{
3659
			if (asprintf(&yyval.v.string, "%s %s", yyvsp[-1].v.string, yyvsp[0].v.string) == -1)
3660
				err(1, "string: asprintf");
3661
			free(yyvsp[-1].v.string);
3662
			free(yyvsp[0].v.string);
3663
		}
3664
break;
3665
case 113:
3666
#line 1024 "parse.y"
3667
{
3668
			char *s = yyvsp[-2].v.string;
3669
			log_debug("%s = \"%s\"\n", yyvsp[-2].v.string, yyvsp[0].v.string);
3670
			while (*s++) {
3671
				if (isspace((unsigned char)*s)) {
3672
					yyerror("macro name cannot contain "
3673
					    "whitespace");
3674
					YYERROR;
3675
				}
3676
			}
3677
			if (symset(yyvsp[-2].v.string, yyvsp[0].v.string, 0) == -1)
3678
				err(1, "cannot store variable");
3679
			free(yyvsp[-2].v.string);
3680
			free(yyvsp[0].v.string);
3681
		}
3682
break;
3683
case 123:
3684
#line 1060 "parse.y"
3685
{
3686
			int	 c;
3687
3688
			while ((c = lgetc(0)) != '\n' && c != EOF)
3689
				; /* nothing */
3690
			if (c == '\n')
3691
				lungetc(c);
3692
		}
3693
break;
3694
#line 3687 "parse.c"
3695
    }
3696
    yyssp -= yym;
3697
    yystate = *yyssp;
3698
    yyvsp -= yym;
3699
    yym = yylhs[yyn];
3700
    if (yystate == 0 && yym == 0)
3701
    {
3702
#if YYDEBUG
3703
        if (yydebug)
3704
            printf("%sdebug: after reduction, shifting from state 0 to\
3705
 state %d\n", YYPREFIX, YYFINAL);
3706
#endif
3707
        yystate = YYFINAL;
3708
        *++yyssp = YYFINAL;
3709
        *++yyvsp = yyval;
3710
        if (yychar < 0)
3711
        {
3712
            if ((yychar = yylex()) < 0) yychar = 0;
3713
#if YYDEBUG
3714
            if (yydebug)
3715
            {
3716
                yys = 0;
3717
                if (yychar <= YYMAXTOKEN) yys = yyname[yychar];
3718
                if (!yys) yys = "illegal-symbol";
3719
                printf("%sdebug: state %d, reading %d (%s)\n",
3720
                        YYPREFIX, YYFINAL, yychar, yys);
3721
            }
3722
#endif
3723
        }
3724
        if (yychar == 0) goto yyaccept;
3725
        goto yyloop;
3726
    }
3727
    if ((yyn = yygindex[yym]) && (yyn += yystate) >= 0 &&
3728
            yyn <= YYTABLESIZE && yycheck[yyn] == yystate)
3729
        yystate = yytable[yyn];
3730
    else
3731
        yystate = yydgoto[yym];
3732
#if YYDEBUG
3733
    if (yydebug)
3734
        printf("%sdebug: after reduction, shifting from state %d \
3735
to state %d\n", YYPREFIX, *yyssp, yystate);
3736
#endif
3737
    if (yyssp >= yysslim && yygrowstack())
3738
    {
3739
        goto yyoverflow;
3740
    }
3741
    *++yyssp = yystate;
3742
    *++yyvsp = yyval;
3743
    goto yyloop;
3744
yyoverflow:
3745
    yyerror("yacc stack overflow");
3746
yyabort:
3747
    if (yyss)
3748
            free(yyss);
3749
    if (yyvs)
3750
            free(yyvs);
3751
    yyss = yyssp = NULL;
3752
    yyvs = yyvsp = NULL;
3753
    yystacksize = 0;
3754
    return (1);
3755
yyaccept:
3756
    if (yyss)
3757
            free(yyss);
3758
    if (yyvs)
3759
            free(yyvs);
3760
    yyss = yyssp = NULL;
3761
    yyvs = yyvsp = NULL;
3762
    yystacksize = 0;
3763
    return (0);
3764
}