1 /* $FreeBSD: src/usr.sbin/setkey/parse.y,v 1.1.2.2 2001/07/03 11:02:17 ume Exp $ */
2 /* $DragonFly: src/usr.sbin/setkey/parse.y,v 1.4 2004/03/24 18:23:46 cpressey Exp $ */
3 /* $KAME: kame/kame/kame/setkey/parse.y,v 1.36 2001/06/07 15:53:12 sakane Exp $ */
6 * Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project.
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the project nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 #include <sys/types.h>
36 #include <sys/param.h>
37 #include <sys/socket.h>
39 #include <net/route.h>
40 #include <netinet/in.h>
41 #include <net/pfkeyv2.h>
42 #include <netkey/key_var.h>
43 #include <netinet6/ipsec.h>
44 #include <arpa/inet.h>
57 (isdigit(c) ? (c - '0') : (isupper(c) ? (c - 'A' + 10) : (c - 'a' + 10) ))
62 struct sockaddr *p_src, *p_dst;
63 u_int p_prefs, p_prefd, p_upper;
64 u_int p_satype, p_ext, p_alg_enc, p_alg_auth, p_replay, p_mode;
66 u_int p_key_enc_len, p_key_auth_len;
67 caddr_t p_key_enc, p_key_auth;
68 time_t p_lt_hard, p_lt_soft;
73 /* temporary buffer */
74 static struct sockaddr *pp_addr;
75 static u_int pp_prefix;
77 static caddr_t pp_key;
79 extern u_char m_buf[BUFSIZ];
81 extern char cmdarg[8192];
84 static struct addrinfo *parse_addr(char *, char *, int);
85 static int setvarbuf(int *, struct sadb_ext *, int, caddr_t, int);
86 void parse_init(void);
87 void free_buffer(void);
89 extern int setkeymsg(void);
90 extern int sendkeymsg(void);
92 extern int yylex(void);
93 extern void yyfatal(const char *);
94 extern void yyerror(const char *);
103 %token ADD GET DELETE FLUSH DUMP
104 %token ADDRESS PREFIX PORT PORTANY
105 %token UP_PROTO PR_ESP PR_AH PR_IPCOMP
106 %token F_PROTOCOL F_AUTH F_ENC F_REPLAY F_COMP F_RAWCPI
107 %token F_MODE MODE F_REQID
108 %token F_EXT EXTENSION NOCYCLICSEQ
109 %token ALG_AUTH ALG_ENC ALG_ENC_DESDERIV ALG_ENC_DES32IV ALG_COMP
110 %token F_LIFETIME_HARD F_LIFETIME_SOFT
111 %token DECSTRING QUOTEDSTRING HEXSTRING STRING ANY
113 %token SPDADD SPDDELETE SPDDUMP SPDFLUSH
114 %token F_POLICY PL_REQUESTS
116 %type <num> PORT PREFIX EXTENSION MODE
117 %type <num> UP_PROTO PR_ESP PR_AH PR_IPCOMP
118 %type <num> ALG_AUTH ALG_ENC ALG_ENC_DESDERIV ALG_ENC_DES32IV ALG_COMP
119 %type <num> DECSTRING
120 %type <val> ADDRESS PL_REQUESTS
121 %type <val> key_string policy_requests
122 %type <val> QUOTEDSTRING HEXSTRING STRING
130 printf("cmdarg:\n%s\n", cmdarg);
152 /* commands concerned with management, there is in tail of this file. */
156 : ADD { p_type = SADB_ADD; }
157 sa_selector_spec extension_spec algorithm_spec EOT
162 : DELETE { p_type = SADB_DELETE; }
163 sa_selector_spec extension_spec
165 if (p_mode != IPSEC_MODE_ANY)
166 yyerror("WARNING: mode is obsoleted.");
171 /* deleteall command */
173 : DELETEALL { p_type = SADB_DELETE; }
174 ipaddress { p_src = pp_addr; }
175 ipaddress { p_dst = pp_addr; }
183 : GET { p_type = SADB_GET; }
184 sa_selector_spec extension_spec
186 if (p_mode != IPSEC_MODE_ANY)
187 yyerror("WARNING: mode is obsoleted.");
194 : FLUSH { p_type = SADB_FLUSH; }
200 : DUMP { p_type = SADB_DUMP; }
204 /* sa_selector_spec */
206 : ipaddress { p_src = pp_addr; }
207 ipaddress { p_dst = pp_addr; }
212 : /*NOTHING*/ { p_satype = SADB_SATYPE_UNSPEC; }
215 p_satype = SADB_SATYPE_ESP;
217 p_ext |= SADB_X_EXT_OLD;
219 p_ext &= ~SADB_X_EXT_OLD;
223 p_satype = SADB_SATYPE_AH;
225 p_ext |= SADB_X_EXT_OLD;
227 p_ext &= ~SADB_X_EXT_OLD;
231 p_satype = SADB_X_SATYPE_IPCOMP;
236 : DECSTRING { p_spi = $1; }
241 char buf0[4], buf[4];
246 yyerror("SPI too big.");
253 *bp = (ATOX(yp[0]) << 4) | ATOX(yp[1]);
258 for (i = 0; i < 4; i++) buf[i] = 0;
260 for (j = $1.len - 1, i = 3; j >= 0; j--, i--)
264 p_spi = ntohl(*(u_int32_t *)buf);
277 : F_ENC enc_alg enc_key F_AUTH auth_alg auth_key
278 | F_ENC enc_alg enc_key
282 : F_AUTH auth_alg auth_key
286 : F_COMP ALG_COMP { p_alg_enc = $2; }
287 | F_COMP ALG_COMP { p_alg_enc = $2; }
288 F_RAWCPI { p_ext |= SADB_X_EXT_RAWCPI; }
292 : ALG_ENC { p_alg_enc = $1; }
296 if (p_ext & SADB_X_EXT_OLD) {
297 yyerror("algorithm mismatched.");
300 p_ext |= SADB_X_EXT_DERIV;
305 if (!(p_ext & SADB_X_EXT_OLD)) {
306 yyerror("algorithm mismatched.");
309 p_ext |= SADB_X_EXT_IV4B;
316 if (p_alg_enc != SADB_EALG_NULL) {
317 yyerror("no key found.");
323 p_key_enc_len = $1.len;
326 if (ipsec_check_keylen(SADB_EXT_SUPPORTED_ENCRYPT,
328 PFKEY_UNUNIT64(p_key_enc_len)) < 0) {
329 yyerror(ipsec_strerror());
336 : ALG_AUTH { p_alg_auth = $1; }
342 if (p_alg_auth != SADB_X_AALG_NULL) {
343 yyerror("no key found.");
349 p_key_auth_len = $1.len;
352 if (ipsec_check_keylen(SADB_EXT_SUPPORTED_AUTH,
354 PFKEY_UNUNIT64(p_key_auth_len)) < 0) {
355 yyerror(ipsec_strerror());
365 /* free pp_key later */
372 if ((pp_key = malloc($1.len)) == 0) {
374 yyerror("not enough core");
377 memset(pp_key, 0, $1.len);
381 *bp = (ATOX(yp[0]) << 4) | ATOX(yp[1]);
391 | extension_spec extension
395 : F_EXT EXTENSION { p_ext |= $2; }
396 | F_EXT NOCYCLICSEQ { p_ext &= ~SADB_X_EXT_CYCSEQ; }
397 | F_MODE MODE { p_mode = $2; }
398 | F_MODE ANY { p_mode = IPSEC_MODE_ANY; }
399 | F_REQID DECSTRING { p_reqid = $2; }
402 if (p_ext & SADB_X_EXT_OLD) {
403 yyerror("replay prevention "
404 "only use on new spec.");
409 | F_LIFETIME_HARD DECSTRING { p_lt_hard = $2; }
410 | F_LIFETIME_SOFT DECSTRING { p_lt_soft = $2; }
413 /* definition about command for SPD management */
418 p_type = SADB_X_SPDADD;
419 p_satype = SADB_SATYPE_UNSPEC;
421 sp_selector_spec policy_spec EOT
427 p_type = SADB_X_SPDDELETE;
428 p_satype = SADB_SATYPE_UNSPEC;
430 sp_selector_spec policy_spec EOT
436 p_type = SADB_X_SPDDUMP;
437 p_satype = SADB_SATYPE_UNSPEC;
445 p_type = SADB_X_SPDFLUSH;
446 p_satype = SADB_SATYPE_UNSPEC;
451 /* sp_selector_spec */
453 : ipaddress { p_src = pp_addr; }
454 prefix { p_prefs = pp_prefix; }
457 switch (p_src->sa_family) {
459 ((struct sockaddr_in *)p_src)->sin_port =
464 ((struct sockaddr_in6 *)p_src)->sin6_port =
472 ipaddress { p_dst = pp_addr; }
473 prefix { p_prefd = pp_prefix; }
476 switch (p_dst->sa_family) {
478 ((struct sockaddr_in *)p_dst)->sin_port =
483 ((struct sockaddr_in6 *)p_dst)->sin6_port =
493 /* XXX is it something userland should check? */
498 if (_INPORTBYSA(p_src) != IPSEC_PORT_ANY
499 || _INPORTBYSA(p_dst) != IPSEC_PORT_ANY) {
500 yyerror("port number must be \"any\".");
503 if ((pp_addr->sa_family == AF_INET6
504 && p_upper == IPPROTO_ICMP)
505 || (pp_addr->sa_family == AF_INET
506 && p_upper == IPPROTO_ICMPV6)) {
507 yyerror("upper layer protocol "
522 struct addrinfo *res;
524 res = parse_addr($1.buf, NULL, AI_NUMERICHOST);
529 pp_addr = (struct sockaddr *)malloc(res->ai_addrlen);
531 yyerror("not enough core");
535 memcpy(pp_addr, res->ai_addr, res->ai_addrlen);
543 : /*NOTHING*/ { pp_prefix = ~0; }
544 | PREFIX { pp_prefix = $1; }
548 : /*NOTHING*/ { pp_port = IPSEC_PORT_ANY; }
549 | PORT { pp_port = $1; }
550 | PORTANY { pp_port = IPSEC_PORT_ANY; }
554 : DECSTRING { p_upper = $1; }
555 | UP_PROTO { p_upper = $1; }
556 | ANY { p_upper = IPSEC_ULPROTO_ANY; }
559 struct protoent *ent;
561 ent = getprotobyname($1.buf);
563 p_upper = ent->p_proto;
565 if (strcmp("icmp6", $1.buf) == 0) {
566 p_upper = IPPROTO_ICMPV6;
567 } else if(strcmp("ip4", $1.buf) == 0) {
568 p_upper = IPPROTO_IPV4;
570 yyerror("invalid upper layer protocol");
580 : F_POLICY policy_requests
582 p_policy = ipsec_set_policy($2.buf, $2.len);
583 if (p_policy == NULL) {
586 yyerror(ipsec_strerror());
590 p_policy_len = ipsec_get_policylen(p_policy);
597 : PL_REQUESTS { $$ = $1; }
605 struct sadb_msg m_msg;
607 m_msg.sadb_msg_version = PF_KEY_V2;
608 m_msg.sadb_msg_type = p_type;
609 m_msg.sadb_msg_errno = 0;
610 m_msg.sadb_msg_satype = p_satype;
611 m_msg.sadb_msg_reserved = 0;
612 m_msg.sadb_msg_seq = 0;
613 m_msg.sadb_msg_pid = getpid();
615 m_len = sizeof(struct sadb_msg);
616 memcpy(m_buf, &m_msg, m_len);
624 /* set encryption algorithm, if present. */
625 if (p_satype != SADB_X_SATYPE_IPCOMP && p_alg_enc != SADB_EALG_NONE) {
626 struct sadb_key m_key;
629 PFKEY_UNIT64(sizeof(m_key)
630 + PFKEY_ALIGN8(p_key_enc_len));
631 m_key.sadb_key_exttype = SADB_EXT_KEY_ENCRYPT;
632 m_key.sadb_key_bits = p_key_enc_len * 8;
633 m_key.sadb_key_reserved = 0;
636 (struct sadb_ext *)&m_key, sizeof(m_key),
637 (caddr_t)p_key_enc, p_key_enc_len);
640 /* set authentication algorithm, if present. */
641 if (p_alg_auth != SADB_AALG_NONE) {
642 struct sadb_key m_key;
645 PFKEY_UNIT64(sizeof(m_key)
646 + PFKEY_ALIGN8(p_key_auth_len));
647 m_key.sadb_key_exttype = SADB_EXT_KEY_AUTH;
648 m_key.sadb_key_bits = p_key_auth_len * 8;
649 m_key.sadb_key_reserved = 0;
652 (struct sadb_ext *)&m_key, sizeof(m_key),
653 (caddr_t)p_key_auth, p_key_auth_len);
656 /* set lifetime for HARD */
657 if (p_lt_hard != 0) {
658 struct sadb_lifetime m_lt;
659 u_int len = sizeof(struct sadb_lifetime);
661 m_lt.sadb_lifetime_len = PFKEY_UNIT64(len);
662 m_lt.sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD;
663 m_lt.sadb_lifetime_allocations = 0;
664 m_lt.sadb_lifetime_bytes = 0;
665 m_lt.sadb_lifetime_addtime = p_lt_hard;
666 m_lt.sadb_lifetime_usetime = 0;
668 memcpy(m_buf + m_len, &m_lt, len);
672 /* set lifetime for SOFT */
673 if (p_lt_soft != 0) {
674 struct sadb_lifetime m_lt;
675 u_int len = sizeof(struct sadb_lifetime);
677 m_lt.sadb_lifetime_len = PFKEY_UNIT64(len);
678 m_lt.sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT;
679 m_lt.sadb_lifetime_allocations = 0;
680 m_lt.sadb_lifetime_bytes = 0;
681 m_lt.sadb_lifetime_addtime = p_lt_soft;
682 m_lt.sadb_lifetime_usetime = 0;
684 memcpy(m_buf + m_len, &m_lt, len);
693 struct sadb_x_sa2 m_sa2;
694 struct sadb_address m_addr;
698 len = sizeof(struct sadb_sa);
699 m_sa.sadb_sa_len = PFKEY_UNIT64(len);
700 m_sa.sadb_sa_exttype = SADB_EXT_SA;
701 m_sa.sadb_sa_spi = htonl(p_spi);
702 m_sa.sadb_sa_replay = p_replay;
703 m_sa.sadb_sa_state = 0;
704 m_sa.sadb_sa_auth = p_alg_auth;
705 m_sa.sadb_sa_encrypt = p_alg_enc;
706 m_sa.sadb_sa_flags = p_ext;
708 memcpy(m_buf + m_len, &m_sa, len);
711 len = sizeof(struct sadb_x_sa2);
712 m_sa2.sadb_x_sa2_len = PFKEY_UNIT64(len);
713 m_sa2.sadb_x_sa2_exttype = SADB_X_EXT_SA2;
714 m_sa2.sadb_x_sa2_mode = p_mode;
715 m_sa2.sadb_x_sa2_reqid = p_reqid;
717 memcpy(m_buf + m_len, &m_sa2, len);
722 m_addr.sadb_address_len =
723 PFKEY_UNIT64(sizeof(m_addr)
724 + PFKEY_ALIGN8(p_src->sa_len));
725 m_addr.sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
726 m_addr.sadb_address_proto = IPSEC_ULPROTO_ANY;
727 switch (p_src->sa_family) {
729 m_addr.sadb_address_prefixlen =
730 sizeof(struct in_addr) << 3;
734 m_addr.sadb_address_prefixlen =
735 sizeof(struct in6_addr) << 3;
739 yyerror("unsupported address family");
742 m_addr.sadb_address_reserved = 0;
745 (struct sadb_ext *)&m_addr, sizeof(m_addr),
746 (caddr_t)p_src, p_src->sa_len);
749 m_addr.sadb_address_len =
750 PFKEY_UNIT64(sizeof(m_addr)
751 + PFKEY_ALIGN8(p_dst->sa_len));
752 m_addr.sadb_address_exttype = SADB_EXT_ADDRESS_DST;
753 m_addr.sadb_address_proto = IPSEC_ULPROTO_ANY;
754 switch (p_dst->sa_family) {
756 m_addr.sadb_address_prefixlen =
757 sizeof(struct in_addr) << 3;
761 m_addr.sadb_address_prefixlen =
762 sizeof(struct in6_addr) << 3;
766 yyerror("unsupported address family");
769 m_addr.sadb_address_reserved = 0;
772 (struct sadb_ext *)&m_addr, sizeof(m_addr),
773 (caddr_t)p_dst, p_dst->sa_len);
777 /* for SPD management */
778 case SADB_X_SPDFLUSH:
783 case SADB_X_SPDDELETE:
785 struct sadb_address m_addr;
788 memcpy(m_buf + m_len, p_policy, p_policy_len);
789 m_len += p_policy_len;
794 m_addr.sadb_address_len =
795 PFKEY_UNIT64(sizeof(m_addr)
796 + PFKEY_ALIGN8(p_src->sa_len));
797 m_addr.sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
798 m_addr.sadb_address_proto = p_upper;
799 switch (p_src->sa_family) {
801 plen = sizeof(struct in_addr) << 3;
805 plen = sizeof(struct in6_addr) << 3;
809 yyerror("unsupported address family");
812 m_addr.sadb_address_prefixlen =
813 (p_prefs != ~0 ? p_prefs : plen);
814 m_addr.sadb_address_reserved = 0;
817 (struct sadb_ext *)&m_addr, sizeof(m_addr),
818 (caddr_t)p_src, p_src->sa_len);
821 m_addr.sadb_address_len =
822 PFKEY_UNIT64(sizeof(m_addr)
823 + PFKEY_ALIGN8(p_dst->sa_len));
824 m_addr.sadb_address_exttype = SADB_EXT_ADDRESS_DST;
825 m_addr.sadb_address_proto = p_upper;
826 switch (p_dst->sa_family) {
828 plen = sizeof(struct in_addr) << 3;
832 plen = sizeof(struct in6_addr) << 3;
836 yyerror("unsupported address family");
839 m_addr.sadb_address_prefixlen =
840 (p_prefd != ~0 ? p_prefd : plen);
841 m_addr.sadb_address_reserved = 0;
844 (struct sadb_ext *)&m_addr, sizeof(m_addr),
845 (caddr_t)p_dst, p_dst->sa_len);
850 ((struct sadb_msg *)m_buf)->sadb_msg_len = PFKEY_UNIT64(m_len);
855 static struct addrinfo *
856 parse_addr(char *host, char *port, int flag)
858 struct addrinfo hints, *res = NULL;
861 memset(&hints, 0, sizeof(hints));
862 hints.ai_family = PF_UNSPEC;
863 hints.ai_socktype = SOCK_DGRAM;
864 hints.ai_flags = flag;
865 error = getaddrinfo(host, port, &hints, &res);
867 yyerror(gai_strerror(error));
870 if (res->ai_next != NULL) {
871 yyerror(gai_strerror(error));
877 setvarbuf(int *off, struct sadb_ext *ebuf, int elen, caddr_t vbuf, int vlen)
879 memset(m_buf + *off, 0, PFKEY_UNUNIT64(ebuf->sadb_ext_len));
880 memcpy(m_buf + *off, (caddr_t)ebuf, elen);
881 memcpy(m_buf + *off + elen, vbuf, vlen);
882 (*off) += PFKEY_ALIGN8(elen + vlen);
894 p_src = 0, p_dst = 0;
895 pp_prefix = p_prefs = p_prefd = ~0;
896 pp_port = IPSEC_PORT_ANY;
900 p_ext = SADB_X_EXT_CYCSEQ;
901 p_alg_enc = SADB_EALG_NONE;
902 p_alg_auth = SADB_AALG_NONE;
903 p_mode = IPSEC_MODE_ANY;
906 p_key_enc_len = p_key_auth_len = 0;
907 p_key_enc = p_key_auth = 0;
908 p_lt_hard = p_lt_soft = 0;
913 memset(cmdarg, 0, sizeof(cmdarg));
921 if (p_src) free(p_src);
922 if (p_dst) free(p_dst);
923 if (p_key_enc) free(p_key_enc);
924 if (p_key_auth) free(p_key_auth);