17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
58810c16bSdanmcd * Common Development and Distribution License (the "License").
68810c16bSdanmcd * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate *
87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate * and limitations under the License.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate *
197c478bd9Sstevel@tonic-gate * CDDL HEADER END
207c478bd9Sstevel@tonic-gate */
217c478bd9Sstevel@tonic-gate /*
22f02131e0SVladimir Kotal * Copyright (c) 1998, 2010, Oracle and/or its affiliates. All rights reserved.
2348bbca81SDaniel Hoffman * Copyright (c) 2016 by Delphix. All rights reserved.
247c478bd9Sstevel@tonic-gate */
257c478bd9Sstevel@tonic-gate
267c478bd9Sstevel@tonic-gate /*
277c478bd9Sstevel@tonic-gate * NOTE:I'm trying to use "struct sadb_foo" instead of "sadb_foo_t"
287c478bd9Sstevel@tonic-gate * as a maximal PF_KEY portability test.
297c478bd9Sstevel@tonic-gate *
307c478bd9Sstevel@tonic-gate * Also, this is a deliberately single-threaded app, also for portability
317c478bd9Sstevel@tonic-gate * to systems without POSIX threads.
327c478bd9Sstevel@tonic-gate */
337c478bd9Sstevel@tonic-gate
347c478bd9Sstevel@tonic-gate #include <sys/types.h>
357c478bd9Sstevel@tonic-gate #include <sys/stat.h>
367c478bd9Sstevel@tonic-gate #include <sys/socket.h>
377c478bd9Sstevel@tonic-gate #include <sys/sysmacros.h>
387c478bd9Sstevel@tonic-gate #include <sys/fcntl.h>
397c478bd9Sstevel@tonic-gate #include <net/pfkeyv2.h>
407c478bd9Sstevel@tonic-gate #include <arpa/inet.h>
417c478bd9Sstevel@tonic-gate #include <netinet/in.h>
427c478bd9Sstevel@tonic-gate #include <sys/uio.h>
437c478bd9Sstevel@tonic-gate
447c478bd9Sstevel@tonic-gate #include <syslog.h>
457c478bd9Sstevel@tonic-gate #include <signal.h>
467c478bd9Sstevel@tonic-gate #include <unistd.h>
477c478bd9Sstevel@tonic-gate #include <limits.h>
487c478bd9Sstevel@tonic-gate #include <stdlib.h>
497c478bd9Sstevel@tonic-gate #include <stdio.h>
50e3320f40Smarkfen #include <stdarg.h>
517c478bd9Sstevel@tonic-gate #include <netdb.h>
527c478bd9Sstevel@tonic-gate #include <pwd.h>
537c478bd9Sstevel@tonic-gate #include <errno.h>
547c478bd9Sstevel@tonic-gate #include <libintl.h>
557c478bd9Sstevel@tonic-gate #include <locale.h>
567c478bd9Sstevel@tonic-gate #include <fcntl.h>
577c478bd9Sstevel@tonic-gate #include <strings.h>
587c478bd9Sstevel@tonic-gate #include <ctype.h>
599c2c14abSThejaswini Singarajipura #include <sys/cladm.h>
607c478bd9Sstevel@tonic-gate
617c478bd9Sstevel@tonic-gate #include <ipsec_util.h>
627c478bd9Sstevel@tonic-gate
637c478bd9Sstevel@tonic-gate static int keysock;
649c2c14abSThejaswini Singarajipura static int cluster_socket;
657c478bd9Sstevel@tonic-gate static uint32_t seq;
667c478bd9Sstevel@tonic-gate static pid_t mypid;
677c478bd9Sstevel@tonic-gate static boolean_t vflag = B_FALSE; /* Verbose? */
68e3320f40Smarkfen static boolean_t cflag = B_FALSE; /* Check Only */
69e3320f40Smarkfen
70e3320f40Smarkfen char *my_fmri = NULL;
71e3320f40Smarkfen FILE *debugfile = stdout;
729c2c14abSThejaswini Singarajipura static struct sockaddr_in cli_addr;
739c2c14abSThejaswini Singarajipura static boolean_t in_cluster_mode = B_FALSE;
747c478bd9Sstevel@tonic-gate
757c478bd9Sstevel@tonic-gate #define MAX_GET_SIZE 1024
76e3320f40Smarkfen /*
77ec485834Spwernau * WARN() and ERROR() do the same thing really, with ERROR() the function
78e3320f40Smarkfen * that prints the error buffer needs to be called at the end of a code block
79e3320f40Smarkfen * This will print out all accumulated errors before bailing. The WARN()
80e3320f40Smarkfen * macro calls handle_errors() in such a way that it prints the message
81e3320f40Smarkfen * then continues.
82e3320f40Smarkfen * If the FATAL() macro used call handle_errors() immediately.
83e3320f40Smarkfen */
84e3320f40Smarkfen #define ERROR(x, y, z) x = record_error(x, y, z)
85e3320f40Smarkfen #define ERROR1(w, x, y, z) w = record_error(w, x, y, z)
86e3320f40Smarkfen #define ERROR2(v, w, x, y, z) v = record_error(v, w, x, y, z)
87e3320f40Smarkfen #define WARN(x, y, z) ERROR(x, y, z);\
88e3320f40Smarkfen handle_errors(x, NULL, B_FALSE, B_FALSE); x = NULL
89e3320f40Smarkfen #define WARN1(w, x, y, z) ERROR1(w, x, y, z);\
90e3320f40Smarkfen handle_errors(w, NULL, B_FALSE, B_FALSE); w = NULL
91e3320f40Smarkfen #define WARN2(v, w, x, y, z) ERROR2(v, w, x, y, z);\
92e3320f40Smarkfen handle_errors(v, NULL, B_FALSE, B_FALSE); v = NULL
93e3320f40Smarkfen #define FATAL(x, y, z) ERROR(x, y, z);\
94e3320f40Smarkfen handle_errors(x, y, B_TRUE, B_TRUE)
95e3320f40Smarkfen #define FATAL1(w, x, y, z) ERROR1(w, x, y, z);\
96e3320f40Smarkfen handle_errors(w, x, B_TRUE, B_TRUE)
97e3320f40Smarkfen
987c478bd9Sstevel@tonic-gate /* Defined as a uint64_t array for alignment purposes. */
997c478bd9Sstevel@tonic-gate static uint64_t get_buffer[MAX_GET_SIZE];
1007c478bd9Sstevel@tonic-gate
101bfe6f8f5SVladimir Kotal /*
102bfe6f8f5SVladimir Kotal * Disable default TAB completion for now (until some brave soul tackles it).
103bfe6f8f5SVladimir Kotal */
104bfe6f8f5SVladimir Kotal /* ARGSUSED */
105bfe6f8f5SVladimir Kotal static
CPL_MATCH_FN(no_match)106bfe6f8f5SVladimir Kotal CPL_MATCH_FN(no_match)
107bfe6f8f5SVladimir Kotal {
108bfe6f8f5SVladimir Kotal return (0);
109bfe6f8f5SVladimir Kotal }
110bfe6f8f5SVladimir Kotal
1117c478bd9Sstevel@tonic-gate /*
112e3320f40Smarkfen * Create/Grow a buffer large enough to hold error messages. If *ebuf
113e3320f40Smarkfen * is not NULL then it will contain a copy of the command line that
114e3320f40Smarkfen * triggered the error/warning, copy this into a new buffer or
115e3320f40Smarkfen * append new messages to the existing buffer.
116e3320f40Smarkfen */
117e3320f40Smarkfen /*PRINTFLIKE1*/
118e3320f40Smarkfen char *
record_error(char * ep,char * ebuf,char * fmt,...)119e3320f40Smarkfen record_error(char *ep, char *ebuf, char *fmt, ...)
120e3320f40Smarkfen {
121e3320f40Smarkfen char *err_ptr;
122e3320f40Smarkfen char tmp_buff[1024];
123e3320f40Smarkfen va_list ap;
124e3320f40Smarkfen int length = 0;
125e3320f40Smarkfen err_ptr = ep;
126e3320f40Smarkfen
127e3320f40Smarkfen va_start(ap, fmt);
12872c8fd38Smarkfen length = vsnprintf(tmp_buff, sizeof (tmp_buff), fmt, ap);
129e3320f40Smarkfen va_end(ap);
130e3320f40Smarkfen
131e3320f40Smarkfen /* There is a new line character */
132e3320f40Smarkfen length++;
13372c8fd38Smarkfen
13472c8fd38Smarkfen if (ep == NULL) {
13572c8fd38Smarkfen if (ebuf != NULL)
13672c8fd38Smarkfen length += strlen(ebuf);
13772c8fd38Smarkfen } else {
13872c8fd38Smarkfen length += strlen(ep);
13972c8fd38Smarkfen }
14072c8fd38Smarkfen
14172c8fd38Smarkfen if (err_ptr == NULL)
14272c8fd38Smarkfen err_ptr = calloc(length, sizeof (char));
14372c8fd38Smarkfen else
14472c8fd38Smarkfen err_ptr = realloc(err_ptr, length);
14572c8fd38Smarkfen
146e3320f40Smarkfen if (err_ptr == NULL)
147e3320f40Smarkfen Bail("realloc() failure");
14872c8fd38Smarkfen
14972c8fd38Smarkfen /*
15072c8fd38Smarkfen * If (ep == NULL) then this is the first error to record,
15172c8fd38Smarkfen * copy in the command line that triggered this error/warning.
15272c8fd38Smarkfen */
15372c8fd38Smarkfen if (ep == NULL && ebuf != NULL)
15472c8fd38Smarkfen (void) strlcpy(err_ptr, ebuf, length);
15572c8fd38Smarkfen
15672c8fd38Smarkfen /*
15772c8fd38Smarkfen * Now the actual error.
15872c8fd38Smarkfen */
159e3320f40Smarkfen (void) strlcat(err_ptr, tmp_buff, length);
160e3320f40Smarkfen return (err_ptr);
161e3320f40Smarkfen }
162e3320f40Smarkfen
163e3320f40Smarkfen /*
164bfe6f8f5SVladimir Kotal * If not in interactive mode print usage message and exit.
1657c478bd9Sstevel@tonic-gate */
1667c478bd9Sstevel@tonic-gate static void
usage(void)1677c478bd9Sstevel@tonic-gate usage(void)
1687c478bd9Sstevel@tonic-gate {
1697c478bd9Sstevel@tonic-gate if (!interactive) {
1707c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("Usage:\t"
1717c478bd9Sstevel@tonic-gate "ipseckey [ -nvp ] | cmd [sa_type] [extfield value]*\n"));
1727c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
1737c478bd9Sstevel@tonic-gate gettext("\tipseckey [ -nvp ] -f infile\n"));
1747c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
1757c478bd9Sstevel@tonic-gate gettext("\tipseckey [ -nvp ] -s outfile\n"));
176bfe6f8f5SVladimir Kotal EXIT_FATAL(NULL);
177bfe6f8f5SVladimir Kotal } else {
178bfe6f8f5SVladimir Kotal (void) fprintf(stderr,
179bfe6f8f5SVladimir Kotal gettext("Type help or ? for usage info\n"));
180e3320f40Smarkfen }
181e3320f40Smarkfen }
182e3320f40Smarkfen
183e3320f40Smarkfen
184e3320f40Smarkfen /*
185e3320f40Smarkfen * Print out any errors, tidy up as required.
186e3320f40Smarkfen * error pointer ep will be free()'d
187e3320f40Smarkfen */
188e3320f40Smarkfen void
handle_errors(char * ep,char * ebuf,boolean_t fatal,boolean_t done)189e3320f40Smarkfen handle_errors(char *ep, char *ebuf, boolean_t fatal, boolean_t done)
190e3320f40Smarkfen {
191e3320f40Smarkfen if (ep != NULL) {
192e3320f40Smarkfen if (my_fmri == NULL) {
193e3320f40Smarkfen /*
194*bbf21555SRichard Lowe * For now suppress the errors when run from smf(7)
195e3320f40Smarkfen * because potentially sensitive information could
196e3320f40Smarkfen * end up in a publicly readable logfile.
197e3320f40Smarkfen */
198e3320f40Smarkfen (void) fprintf(stdout, "%s\n", ep);
199e3320f40Smarkfen (void) fflush(stdout);
200e3320f40Smarkfen }
201e3320f40Smarkfen free(ep);
202e3320f40Smarkfen if (fatal) {
203e3320f40Smarkfen if (ebuf != NULL) {
204e3320f40Smarkfen free(ebuf);
205e3320f40Smarkfen }
206e3320f40Smarkfen /* reset command buffer */
207e3320f40Smarkfen if (interactive)
208e3320f40Smarkfen longjmp(env, 1);
209e3320f40Smarkfen } else {
210e3320f40Smarkfen return;
211e3320f40Smarkfen }
2127c478bd9Sstevel@tonic-gate } else {
213e3320f40Smarkfen /*
214e3320f40Smarkfen * No errors, if this is the last time that this function
215e3320f40Smarkfen * is called, free(ebuf) and reset command buffer.
216e3320f40Smarkfen */
217e3320f40Smarkfen if (done) {
218e3320f40Smarkfen if (ebuf != NULL) {
219e3320f40Smarkfen free(ebuf);
220e3320f40Smarkfen }
221e3320f40Smarkfen /* reset command buffer */
222e3320f40Smarkfen if (interactive)
223e3320f40Smarkfen longjmp(env, 1);
224e3320f40Smarkfen }
225e3320f40Smarkfen return;
2267c478bd9Sstevel@tonic-gate }
22772c8fd38Smarkfen EXIT_FATAL(NULL);
2287c478bd9Sstevel@tonic-gate }
2297c478bd9Sstevel@tonic-gate
2307c478bd9Sstevel@tonic-gate /*
2317c478bd9Sstevel@tonic-gate * Initialize a PF_KEY base message.
2327c478bd9Sstevel@tonic-gate */
2337c478bd9Sstevel@tonic-gate static void
msg_init(struct sadb_msg * msg,uint8_t type,uint8_t satype)2347c478bd9Sstevel@tonic-gate msg_init(struct sadb_msg *msg, uint8_t type, uint8_t satype)
2357c478bd9Sstevel@tonic-gate {
2367c478bd9Sstevel@tonic-gate msg->sadb_msg_version = PF_KEY_V2;
2377c478bd9Sstevel@tonic-gate msg->sadb_msg_type = type;
2387c478bd9Sstevel@tonic-gate msg->sadb_msg_errno = 0;
2397c478bd9Sstevel@tonic-gate msg->sadb_msg_satype = satype;
2407c478bd9Sstevel@tonic-gate /* For starters... */
2417c478bd9Sstevel@tonic-gate msg->sadb_msg_len = SADB_8TO64(sizeof (*msg));
2427c478bd9Sstevel@tonic-gate msg->sadb_msg_reserved = 0;
2437c478bd9Sstevel@tonic-gate msg->sadb_msg_seq = ++seq;
2447c478bd9Sstevel@tonic-gate msg->sadb_msg_pid = mypid;
2457c478bd9Sstevel@tonic-gate }
2467c478bd9Sstevel@tonic-gate
2477c478bd9Sstevel@tonic-gate /*
2487c478bd9Sstevel@tonic-gate * parseXXX and rparseXXX commands parse input and convert them to PF_KEY
2497c478bd9Sstevel@tonic-gate * field values, or do the reverse for the purposes of saving the SA tables.
2507c478bd9Sstevel@tonic-gate * (See the save_XXX functions.)
2517c478bd9Sstevel@tonic-gate */
2527c478bd9Sstevel@tonic-gate
2537c478bd9Sstevel@tonic-gate #define CMD_NONE 0
2547c478bd9Sstevel@tonic-gate #define CMD_UPDATE 2
25538d95a78Smarkfen #define CMD_UPDATE_PAIR 3
25638d95a78Smarkfen #define CMD_ADD 4
25738d95a78Smarkfen #define CMD_DELETE 5
25838d95a78Smarkfen #define CMD_DELETE_PAIR 6
25938d95a78Smarkfen #define CMD_GET 7
2607c478bd9Sstevel@tonic-gate #define CMD_FLUSH 9
2617c478bd9Sstevel@tonic-gate #define CMD_DUMP 10
2627c478bd9Sstevel@tonic-gate #define CMD_MONITOR 11
2637c478bd9Sstevel@tonic-gate #define CMD_PMONITOR 12
2647c478bd9Sstevel@tonic-gate #define CMD_QUIT 13
2657c478bd9Sstevel@tonic-gate #define CMD_SAVE 14
2667c478bd9Sstevel@tonic-gate #define CMD_HELP 15
2677c478bd9Sstevel@tonic-gate
2687c478bd9Sstevel@tonic-gate /*
2697c478bd9Sstevel@tonic-gate * Parse the command.
2707c478bd9Sstevel@tonic-gate */
2717c478bd9Sstevel@tonic-gate static int
parsecmd(char * cmdstr)2727c478bd9Sstevel@tonic-gate parsecmd(char *cmdstr)
2737c478bd9Sstevel@tonic-gate {
2747c478bd9Sstevel@tonic-gate static struct cmdtable {
2757c478bd9Sstevel@tonic-gate char *cmd;
2767c478bd9Sstevel@tonic-gate int token;
2777c478bd9Sstevel@tonic-gate } table[] = {
2787c478bd9Sstevel@tonic-gate /*
2797c478bd9Sstevel@tonic-gate * Q: Do we want to do GETSPI?
2807c478bd9Sstevel@tonic-gate * A: No, it's for automated key mgmt. only. Either that,
2817c478bd9Sstevel@tonic-gate * or it isn't relevant until we support non IPsec SA types.
2827c478bd9Sstevel@tonic-gate */
2837c478bd9Sstevel@tonic-gate {"update", CMD_UPDATE},
28438d95a78Smarkfen {"update-pair", CMD_UPDATE_PAIR},
2857c478bd9Sstevel@tonic-gate {"add", CMD_ADD},
2867c478bd9Sstevel@tonic-gate {"delete", CMD_DELETE},
28738d95a78Smarkfen {"delete-pair", CMD_DELETE_PAIR},
2887c478bd9Sstevel@tonic-gate {"get", CMD_GET},
2897c478bd9Sstevel@tonic-gate /*
2907c478bd9Sstevel@tonic-gate * Q: And ACQUIRE and REGISTER and EXPIRE?
2917c478bd9Sstevel@tonic-gate * A: not until we support non IPsec SA types.
2927c478bd9Sstevel@tonic-gate */
2937c478bd9Sstevel@tonic-gate {"flush", CMD_FLUSH},
2947c478bd9Sstevel@tonic-gate {"dump", CMD_DUMP},
2957c478bd9Sstevel@tonic-gate {"monitor", CMD_MONITOR},
2967c478bd9Sstevel@tonic-gate {"passive_monitor", CMD_PMONITOR},
2977c478bd9Sstevel@tonic-gate {"pmonitor", CMD_PMONITOR},
2987c478bd9Sstevel@tonic-gate {"quit", CMD_QUIT},
2997c478bd9Sstevel@tonic-gate {"exit", CMD_QUIT},
3007c478bd9Sstevel@tonic-gate {"save", CMD_SAVE},
3017c478bd9Sstevel@tonic-gate {"help", CMD_HELP},
3027c478bd9Sstevel@tonic-gate {"?", CMD_HELP},
3037c478bd9Sstevel@tonic-gate {NULL, CMD_NONE}
3047c478bd9Sstevel@tonic-gate };
3057c478bd9Sstevel@tonic-gate struct cmdtable *ct = table;
3067c478bd9Sstevel@tonic-gate
3077c478bd9Sstevel@tonic-gate while (ct->cmd != NULL && strcmp(ct->cmd, cmdstr) != 0)
3087c478bd9Sstevel@tonic-gate ct++;
3097c478bd9Sstevel@tonic-gate return (ct->token);
3107c478bd9Sstevel@tonic-gate }
3117c478bd9Sstevel@tonic-gate
3127c478bd9Sstevel@tonic-gate /*
3137c478bd9Sstevel@tonic-gate * Convert a number from a command line. I picked "u_longlong_t" for the
3147c478bd9Sstevel@tonic-gate * number because we need the largest number available. Also, the strto<num>
3157c478bd9Sstevel@tonic-gate * calls don't deal in units of uintNN_t.
3167c478bd9Sstevel@tonic-gate */
3177c478bd9Sstevel@tonic-gate static u_longlong_t
parsenum(char * num,boolean_t bail,char * ebuf)318e3320f40Smarkfen parsenum(char *num, boolean_t bail, char *ebuf)
3197c478bd9Sstevel@tonic-gate {
320e3320f40Smarkfen u_longlong_t rc = 0;
3217c478bd9Sstevel@tonic-gate char *end = NULL;
322e3320f40Smarkfen char *ep = NULL;
3237c478bd9Sstevel@tonic-gate
3247c478bd9Sstevel@tonic-gate if (num == NULL) {
325e3320f40Smarkfen FATAL(ep, ebuf, gettext("Unexpected end of command line,"
326e3320f40Smarkfen " was expecting a number.\n"));
327e3320f40Smarkfen /* NOTREACHED */
3287c478bd9Sstevel@tonic-gate }
3297c478bd9Sstevel@tonic-gate
3307c478bd9Sstevel@tonic-gate errno = 0;
3317c478bd9Sstevel@tonic-gate rc = strtoull(num, &end, 0);
3327c478bd9Sstevel@tonic-gate if (errno != 0 || end == num || *end != '\0') {
3337c478bd9Sstevel@tonic-gate if (bail) {
33438d95a78Smarkfen FATAL1(ep, ebuf, gettext(
335e3320f40Smarkfen "Expecting a number, not \"%s\"!\n"), num);
3367c478bd9Sstevel@tonic-gate } else {
3377c478bd9Sstevel@tonic-gate /*
3387c478bd9Sstevel@tonic-gate * -1, while not optimal, is sufficiently out of range
3397c478bd9Sstevel@tonic-gate * for most of this function's applications when
3407c478bd9Sstevel@tonic-gate * we don't just bail.
3417c478bd9Sstevel@tonic-gate */
3427c478bd9Sstevel@tonic-gate return ((u_longlong_t)-1);
3437c478bd9Sstevel@tonic-gate }
3447c478bd9Sstevel@tonic-gate }
345e3320f40Smarkfen handle_errors(ep, NULL, B_FALSE, B_FALSE);
3467c478bd9Sstevel@tonic-gate return (rc);
3477c478bd9Sstevel@tonic-gate }
3487c478bd9Sstevel@tonic-gate
3497c478bd9Sstevel@tonic-gate /*
3507c478bd9Sstevel@tonic-gate * Parse and reverse parse a specific SA type (AH, ESP, etc.).
3517c478bd9Sstevel@tonic-gate */
3527c478bd9Sstevel@tonic-gate static struct typetable {
3537c478bd9Sstevel@tonic-gate char *type;
3547c478bd9Sstevel@tonic-gate int token;
3557c478bd9Sstevel@tonic-gate } type_table[] = {
3567c478bd9Sstevel@tonic-gate {"all", SADB_SATYPE_UNSPEC},
3577c478bd9Sstevel@tonic-gate {"ah", SADB_SATYPE_AH},
3587c478bd9Sstevel@tonic-gate {"esp", SADB_SATYPE_ESP},
3597c478bd9Sstevel@tonic-gate /* PF_KEY NOTE: More to come if net/pfkeyv2.h gets updated. */
3607c478bd9Sstevel@tonic-gate {NULL, 0} /* Token value is irrelevant for this entry. */
3617c478bd9Sstevel@tonic-gate };
3627c478bd9Sstevel@tonic-gate
3637c478bd9Sstevel@tonic-gate
3647c478bd9Sstevel@tonic-gate static int
parsesatype(char * type,char * ebuf)365e3320f40Smarkfen parsesatype(char *type, char *ebuf)
3667c478bd9Sstevel@tonic-gate {
3677c478bd9Sstevel@tonic-gate struct typetable *tt = type_table;
368e3320f40Smarkfen char *ep = NULL;
3697c478bd9Sstevel@tonic-gate
3707c478bd9Sstevel@tonic-gate if (type == NULL)
3717c478bd9Sstevel@tonic-gate return (SADB_SATYPE_UNSPEC);
3727c478bd9Sstevel@tonic-gate
3737c478bd9Sstevel@tonic-gate while (tt->type != NULL && strcasecmp(tt->type, type) != 0)
3747c478bd9Sstevel@tonic-gate tt++;
3757c478bd9Sstevel@tonic-gate
3767c478bd9Sstevel@tonic-gate /*
3777c478bd9Sstevel@tonic-gate * New SA types (including ones keysock maintains for user-land
3787c478bd9Sstevel@tonic-gate * protocols) may be added, so parse a numeric value if possible.
3797c478bd9Sstevel@tonic-gate */
3807c478bd9Sstevel@tonic-gate if (tt->type == NULL) {
381e3320f40Smarkfen tt->token = (int)parsenum(type, B_FALSE, ebuf);
3827c478bd9Sstevel@tonic-gate if (tt->token == -1) {
383e3320f40Smarkfen ERROR1(ep, ebuf, gettext(
384e3320f40Smarkfen "Unknown SA type (%s).\n"), type);
385e3320f40Smarkfen tt->token = SADB_SATYPE_UNSPEC;
3867c478bd9Sstevel@tonic-gate }
3877c478bd9Sstevel@tonic-gate }
388bfe6f8f5SVladimir Kotal handle_errors(ep, NULL, interactive ? B_TRUE : B_FALSE, B_FALSE);
3897c478bd9Sstevel@tonic-gate return (tt->token);
3907c478bd9Sstevel@tonic-gate }
3917c478bd9Sstevel@tonic-gate
3927c478bd9Sstevel@tonic-gate #define NEXTEOF 0
3937c478bd9Sstevel@tonic-gate #define NEXTNONE 1
3947c478bd9Sstevel@tonic-gate #define NEXTNUM 2
3957c478bd9Sstevel@tonic-gate #define NEXTSTR 3
3967c478bd9Sstevel@tonic-gate #define NEXTNUMSTR 4
3977c478bd9Sstevel@tonic-gate #define NEXTADDR 5
3987c478bd9Sstevel@tonic-gate #define NEXTHEX 6
3997c478bd9Sstevel@tonic-gate #define NEXTIDENT 7
4007c478bd9Sstevel@tonic-gate #define NEXTADDR4 8
4017c478bd9Sstevel@tonic-gate #define NEXTADDR6 9
4025d3b8cb7SBill Sommerfeld #define NEXTLABEL 10
4037c478bd9Sstevel@tonic-gate
4047c478bd9Sstevel@tonic-gate #define TOK_EOF 0
4057c478bd9Sstevel@tonic-gate #define TOK_UNKNOWN 1
4067c478bd9Sstevel@tonic-gate #define TOK_SPI 2
4077c478bd9Sstevel@tonic-gate #define TOK_REPLAY 3
4087c478bd9Sstevel@tonic-gate #define TOK_STATE 4
4097c478bd9Sstevel@tonic-gate #define TOK_AUTHALG 5
4107c478bd9Sstevel@tonic-gate #define TOK_ENCRALG 6
4117c478bd9Sstevel@tonic-gate #define TOK_FLAGS 7
4127c478bd9Sstevel@tonic-gate #define TOK_SOFT_ALLOC 8
4137c478bd9Sstevel@tonic-gate #define TOK_SOFT_BYTES 9
4147c478bd9Sstevel@tonic-gate #define TOK_SOFT_ADDTIME 10
4157c478bd9Sstevel@tonic-gate #define TOK_SOFT_USETIME 11
4167c478bd9Sstevel@tonic-gate #define TOK_HARD_ALLOC 12
4177c478bd9Sstevel@tonic-gate #define TOK_HARD_BYTES 13
4187c478bd9Sstevel@tonic-gate #define TOK_HARD_ADDTIME 14
4197c478bd9Sstevel@tonic-gate #define TOK_HARD_USETIME 15
4207c478bd9Sstevel@tonic-gate #define TOK_CURRENT_ALLOC 16
4217c478bd9Sstevel@tonic-gate #define TOK_CURRENT_BYTES 17
4227c478bd9Sstevel@tonic-gate #define TOK_CURRENT_ADDTIME 18
4237c478bd9Sstevel@tonic-gate #define TOK_CURRENT_USETIME 19
4247c478bd9Sstevel@tonic-gate #define TOK_SRCADDR 20
4257c478bd9Sstevel@tonic-gate #define TOK_DSTADDR 21
4267c478bd9Sstevel@tonic-gate #define TOK_PROXYADDR 22
4277c478bd9Sstevel@tonic-gate #define TOK_AUTHKEY 23
4287c478bd9Sstevel@tonic-gate #define TOK_ENCRKEY 24
4297c478bd9Sstevel@tonic-gate #define TOK_SRCIDTYPE 25
4307c478bd9Sstevel@tonic-gate #define TOK_DSTIDTYPE 26
4317c478bd9Sstevel@tonic-gate #define TOK_DPD 27
4327c478bd9Sstevel@tonic-gate #define TOK_SENS_LEVEL 28
4337c478bd9Sstevel@tonic-gate #define TOK_SENS_MAP 29
4347c478bd9Sstevel@tonic-gate #define TOK_INTEG_LEVEL 30
4357c478bd9Sstevel@tonic-gate #define TOK_INTEG_MAP 31
4367c478bd9Sstevel@tonic-gate #define TOK_SRCADDR6 32
4377c478bd9Sstevel@tonic-gate #define TOK_DSTADDR6 33
4387c478bd9Sstevel@tonic-gate #define TOK_PROXYADDR6 34
4397c478bd9Sstevel@tonic-gate #define TOK_SRCPORT 35
4407c478bd9Sstevel@tonic-gate #define TOK_DSTPORT 36
4417c478bd9Sstevel@tonic-gate #define TOK_PROTO 37
4427c478bd9Sstevel@tonic-gate #define TOK_ENCAP 38
4437c478bd9Sstevel@tonic-gate #define TOK_NATLOC 39
4447c478bd9Sstevel@tonic-gate #define TOK_NATREM 40
4457c478bd9Sstevel@tonic-gate #define TOK_NATLPORT 41
4467c478bd9Sstevel@tonic-gate #define TOK_NATRPORT 42
4478810c16bSdanmcd #define TOK_IPROTO 43
4488810c16bSdanmcd #define TOK_IDSTADDR 44
4498810c16bSdanmcd #define TOK_IDSTADDR6 45
4508810c16bSdanmcd #define TOK_ISRCPORT 46
4518810c16bSdanmcd #define TOK_IDSTPORT 47
45238d95a78Smarkfen #define TOK_PAIR_SPI 48
45338d95a78Smarkfen #define TOK_FLAG_INBOUND 49
45438d95a78Smarkfen #define TOK_FLAG_OUTBOUND 50
4559c2c14abSThejaswini Singarajipura #define TOK_REPLAY_VALUE 51
4569c2c14abSThejaswini Singarajipura #define TOK_IDLE_ADDTIME 52
4579c2c14abSThejaswini Singarajipura #define TOK_IDLE_USETIME 53
458628b0c67SMark Fenwick #define TOK_RESERVED 54
4595d3b8cb7SBill Sommerfeld #define TOK_LABEL 55
4605d3b8cb7SBill Sommerfeld #define TOK_OLABEL 56
4615d3b8cb7SBill Sommerfeld #define TOK_IMPLABEL 57
4625d3b8cb7SBill Sommerfeld
4637c478bd9Sstevel@tonic-gate
4647c478bd9Sstevel@tonic-gate static struct toktable {
4657c478bd9Sstevel@tonic-gate char *string;
4667c478bd9Sstevel@tonic-gate int token;
4677c478bd9Sstevel@tonic-gate int next;
4687c478bd9Sstevel@tonic-gate } tokens[] = {
4697c478bd9Sstevel@tonic-gate /* "String", token value, next arg is */
4707c478bd9Sstevel@tonic-gate {"spi", TOK_SPI, NEXTNUM},
47138d95a78Smarkfen {"pair-spi", TOK_PAIR_SPI, NEXTNUM},
4727c478bd9Sstevel@tonic-gate {"replay", TOK_REPLAY, NEXTNUM},
4737c478bd9Sstevel@tonic-gate {"state", TOK_STATE, NEXTNUMSTR},
4747c478bd9Sstevel@tonic-gate {"auth_alg", TOK_AUTHALG, NEXTNUMSTR},
4757c478bd9Sstevel@tonic-gate {"authalg", TOK_AUTHALG, NEXTNUMSTR},
4767c478bd9Sstevel@tonic-gate {"encr_alg", TOK_ENCRALG, NEXTNUMSTR},
4777c478bd9Sstevel@tonic-gate {"encralg", TOK_ENCRALG, NEXTNUMSTR},
4787c478bd9Sstevel@tonic-gate {"flags", TOK_FLAGS, NEXTNUM},
4797c478bd9Sstevel@tonic-gate {"soft_alloc", TOK_SOFT_ALLOC, NEXTNUM},
4807c478bd9Sstevel@tonic-gate {"soft_bytes", TOK_SOFT_BYTES, NEXTNUM},
4817c478bd9Sstevel@tonic-gate {"soft_addtime", TOK_SOFT_ADDTIME, NEXTNUM},
4827c478bd9Sstevel@tonic-gate {"soft_usetime", TOK_SOFT_USETIME, NEXTNUM},
4837c478bd9Sstevel@tonic-gate {"hard_alloc", TOK_HARD_ALLOC, NEXTNUM},
4847c478bd9Sstevel@tonic-gate {"hard_bytes", TOK_HARD_BYTES, NEXTNUM},
4857c478bd9Sstevel@tonic-gate {"hard_addtime", TOK_HARD_ADDTIME, NEXTNUM},
4867c478bd9Sstevel@tonic-gate {"hard_usetime", TOK_HARD_USETIME, NEXTNUM},
4877c478bd9Sstevel@tonic-gate {"current_alloc", TOK_CURRENT_ALLOC, NEXTNUM},
4887c478bd9Sstevel@tonic-gate {"current_bytes", TOK_CURRENT_BYTES, NEXTNUM},
4897c478bd9Sstevel@tonic-gate {"current_addtime", TOK_CURRENT_ADDTIME, NEXTNUM},
4907c478bd9Sstevel@tonic-gate {"current_usetime", TOK_CURRENT_USETIME, NEXTNUM},
4917c478bd9Sstevel@tonic-gate
4927c478bd9Sstevel@tonic-gate {"saddr", TOK_SRCADDR, NEXTADDR},
4937c478bd9Sstevel@tonic-gate {"srcaddr", TOK_SRCADDR, NEXTADDR},
4947c478bd9Sstevel@tonic-gate {"src", TOK_SRCADDR, NEXTADDR},
4957c478bd9Sstevel@tonic-gate {"daddr", TOK_DSTADDR, NEXTADDR},
4967c478bd9Sstevel@tonic-gate {"dstaddr", TOK_DSTADDR, NEXTADDR},
4977c478bd9Sstevel@tonic-gate {"dst", TOK_DSTADDR, NEXTADDR},
4987c478bd9Sstevel@tonic-gate {"proxyaddr", TOK_PROXYADDR, NEXTADDR},
4997c478bd9Sstevel@tonic-gate {"proxy", TOK_PROXYADDR, NEXTADDR},
5008810c16bSdanmcd {"innersrc", TOK_PROXYADDR, NEXTADDR},
5018810c16bSdanmcd {"isrc", TOK_PROXYADDR, NEXTADDR},
5028810c16bSdanmcd {"innerdst", TOK_IDSTADDR, NEXTADDR},
5038810c16bSdanmcd {"idst", TOK_IDSTADDR, NEXTADDR},
5047c478bd9Sstevel@tonic-gate
5057c478bd9Sstevel@tonic-gate {"sport", TOK_SRCPORT, NEXTNUM},
5067c478bd9Sstevel@tonic-gate {"dport", TOK_DSTPORT, NEXTNUM},
5078810c16bSdanmcd {"innersport", TOK_ISRCPORT, NEXTNUM},
5088810c16bSdanmcd {"isport", TOK_ISRCPORT, NEXTNUM},
5098810c16bSdanmcd {"innerdport", TOK_IDSTPORT, NEXTNUM},
5108810c16bSdanmcd {"idport", TOK_IDSTPORT, NEXTNUM},
5117c478bd9Sstevel@tonic-gate {"proto", TOK_PROTO, NEXTNUM},
512eeda67c6Sjojemann {"ulp", TOK_PROTO, NEXTNUM},
5138810c16bSdanmcd {"iproto", TOK_IPROTO, NEXTNUM},
5148810c16bSdanmcd {"iulp", TOK_IPROTO, NEXTNUM},
5157c478bd9Sstevel@tonic-gate
5167c478bd9Sstevel@tonic-gate {"saddr6", TOK_SRCADDR6, NEXTADDR},
5177c478bd9Sstevel@tonic-gate {"srcaddr6", TOK_SRCADDR6, NEXTADDR},
5187c478bd9Sstevel@tonic-gate {"src6", TOK_SRCADDR6, NEXTADDR},
5197c478bd9Sstevel@tonic-gate {"daddr6", TOK_DSTADDR6, NEXTADDR},
5207c478bd9Sstevel@tonic-gate {"dstaddr6", TOK_DSTADDR6, NEXTADDR},
5217c478bd9Sstevel@tonic-gate {"dst6", TOK_DSTADDR6, NEXTADDR},
5227c478bd9Sstevel@tonic-gate {"proxyaddr6", TOK_PROXYADDR6, NEXTADDR},
5237c478bd9Sstevel@tonic-gate {"proxy6", TOK_PROXYADDR6, NEXTADDR},
5248810c16bSdanmcd {"innersrc6", TOK_PROXYADDR6, NEXTADDR},
5258810c16bSdanmcd {"isrc6", TOK_PROXYADDR6, NEXTADDR},
5268810c16bSdanmcd {"innerdst6", TOK_IDSTADDR6, NEXTADDR},
5278810c16bSdanmcd {"idst6", TOK_IDSTADDR6, NEXTADDR},
5287c478bd9Sstevel@tonic-gate
5297c478bd9Sstevel@tonic-gate {"authkey", TOK_AUTHKEY, NEXTHEX},
5307c478bd9Sstevel@tonic-gate {"encrkey", TOK_ENCRKEY, NEXTHEX},
5317c478bd9Sstevel@tonic-gate {"srcidtype", TOK_SRCIDTYPE, NEXTIDENT},
5327c478bd9Sstevel@tonic-gate {"dstidtype", TOK_DSTIDTYPE, NEXTIDENT},
5337c478bd9Sstevel@tonic-gate {"dpd", TOK_DPD, NEXTNUM},
5347c478bd9Sstevel@tonic-gate {"sens_level", TOK_SENS_LEVEL, NEXTNUM},
5357c478bd9Sstevel@tonic-gate {"sens_map", TOK_SENS_MAP, NEXTHEX},
5367c478bd9Sstevel@tonic-gate {"integ_level", TOK_INTEG_LEVEL, NEXTNUM},
5377c478bd9Sstevel@tonic-gate {"integ_map", TOK_INTEG_MAP, NEXTHEX},
5387c478bd9Sstevel@tonic-gate {"nat_loc", TOK_NATLOC, NEXTADDR},
5397c478bd9Sstevel@tonic-gate {"nat_rem", TOK_NATREM, NEXTADDR},
5407c478bd9Sstevel@tonic-gate {"nat_lport", TOK_NATLPORT, NEXTNUM},
5417c478bd9Sstevel@tonic-gate {"nat_rport", TOK_NATRPORT, NEXTNUM},
5427c478bd9Sstevel@tonic-gate {"encap", TOK_ENCAP, NEXTNUMSTR},
54338d95a78Smarkfen
54495c74518SToomas Soome {"outbound", TOK_FLAG_OUTBOUND, 0},
54595c74518SToomas Soome {"inbound", TOK_FLAG_INBOUND, 0},
5469c2c14abSThejaswini Singarajipura
547628b0c67SMark Fenwick {"reserved_bits", TOK_RESERVED, NEXTNUM},
5489c2c14abSThejaswini Singarajipura {"replay_value", TOK_REPLAY_VALUE, NEXTNUM},
5499c2c14abSThejaswini Singarajipura {"idle_addtime", TOK_IDLE_ADDTIME, NEXTNUM},
5509c2c14abSThejaswini Singarajipura {"idle_usetime", TOK_IDLE_USETIME, NEXTNUM},
5515d3b8cb7SBill Sommerfeld
5525d3b8cb7SBill Sommerfeld {"label", TOK_LABEL, NEXTLABEL},
5535d3b8cb7SBill Sommerfeld {"outer-label", TOK_OLABEL, NEXTLABEL},
5545d3b8cb7SBill Sommerfeld {"implicit-label", TOK_IMPLABEL, NEXTLABEL},
5555d3b8cb7SBill Sommerfeld
5567c478bd9Sstevel@tonic-gate {NULL, TOK_UNKNOWN, NEXTEOF}
5577c478bd9Sstevel@tonic-gate };
5587c478bd9Sstevel@tonic-gate
5597c478bd9Sstevel@tonic-gate /*
5607c478bd9Sstevel@tonic-gate * Q: Do I need stuff for proposals, combinations, supported algorithms,
5617c478bd9Sstevel@tonic-gate * or SPI ranges?
5627c478bd9Sstevel@tonic-gate *
5637c478bd9Sstevel@tonic-gate * A: Probably not, but you never know.
5647c478bd9Sstevel@tonic-gate *
5657c478bd9Sstevel@tonic-gate * Parse out extension header type values.
5667c478bd9Sstevel@tonic-gate */
5677c478bd9Sstevel@tonic-gate static int
parseextval(char * value,int * next)5687c478bd9Sstevel@tonic-gate parseextval(char *value, int *next)
5697c478bd9Sstevel@tonic-gate {
5707c478bd9Sstevel@tonic-gate struct toktable *tp;
5717c478bd9Sstevel@tonic-gate
5727c478bd9Sstevel@tonic-gate if (value == NULL)
5737c478bd9Sstevel@tonic-gate return (TOK_EOF);
5747c478bd9Sstevel@tonic-gate
5757c478bd9Sstevel@tonic-gate for (tp = tokens; tp->string != NULL; tp++)
5767c478bd9Sstevel@tonic-gate if (strcmp(value, tp->string) == 0)
5777c478bd9Sstevel@tonic-gate break;
5787c478bd9Sstevel@tonic-gate
5797c478bd9Sstevel@tonic-gate /*
5807c478bd9Sstevel@tonic-gate * Since the OS controls what extensions are available, we don't have
5817c478bd9Sstevel@tonic-gate * to parse numeric values here.
5827c478bd9Sstevel@tonic-gate */
5837c478bd9Sstevel@tonic-gate
5847c478bd9Sstevel@tonic-gate *next = tp->next;
5857c478bd9Sstevel@tonic-gate return (tp->token);
5867c478bd9Sstevel@tonic-gate }
5877c478bd9Sstevel@tonic-gate
5887c478bd9Sstevel@tonic-gate /*
5897c478bd9Sstevel@tonic-gate * Parse possible state values.
5907c478bd9Sstevel@tonic-gate */
5917c478bd9Sstevel@tonic-gate static uint8_t
parsestate(char * state,char * ebuf)592e3320f40Smarkfen parsestate(char *state, char *ebuf)
5937c478bd9Sstevel@tonic-gate {
5947c478bd9Sstevel@tonic-gate struct states {
5957c478bd9Sstevel@tonic-gate char *state;
5967c478bd9Sstevel@tonic-gate uint8_t retval;
5977c478bd9Sstevel@tonic-gate } states[] = {
5987c478bd9Sstevel@tonic-gate {"larval", SADB_SASTATE_LARVAL},
5997c478bd9Sstevel@tonic-gate {"mature", SADB_SASTATE_MATURE},
6007c478bd9Sstevel@tonic-gate {"dying", SADB_SASTATE_DYING},
6017c478bd9Sstevel@tonic-gate {"dead", SADB_SASTATE_DEAD},
6027c478bd9Sstevel@tonic-gate {NULL, 0}
6037c478bd9Sstevel@tonic-gate };
6047c478bd9Sstevel@tonic-gate struct states *sp;
605e3320f40Smarkfen char *ep = NULL;
6067c478bd9Sstevel@tonic-gate
6077c478bd9Sstevel@tonic-gate if (state == NULL) {
608e3320f40Smarkfen FATAL(ep, ebuf, "Unexpected end of command line "
609e3320f40Smarkfen "was expecting a state.\n");
6107c478bd9Sstevel@tonic-gate }
6117c478bd9Sstevel@tonic-gate
6127c478bd9Sstevel@tonic-gate for (sp = states; sp->state != NULL; sp++) {
6137c478bd9Sstevel@tonic-gate if (strcmp(sp->state, state) == 0)
6147c478bd9Sstevel@tonic-gate return (sp->retval);
6157c478bd9Sstevel@tonic-gate }
616e3320f40Smarkfen ERROR1(ep, ebuf, gettext("Unknown state type \"%s\"\n"), state);
617e3320f40Smarkfen handle_errors(ep, NULL, B_FALSE, B_FALSE);
618eeda67c6Sjojemann return (0);
6197c478bd9Sstevel@tonic-gate }
6207c478bd9Sstevel@tonic-gate
6217c478bd9Sstevel@tonic-gate /*
6227c478bd9Sstevel@tonic-gate * Return the numerical algorithm identifier corresponding to the specified
6237c478bd9Sstevel@tonic-gate * algorithm name.
6247c478bd9Sstevel@tonic-gate */
6257c478bd9Sstevel@tonic-gate static uint8_t
parsealg(char * alg,int proto_num,char * ebuf)626e3320f40Smarkfen parsealg(char *alg, int proto_num, char *ebuf)
6277c478bd9Sstevel@tonic-gate {
6287c478bd9Sstevel@tonic-gate u_longlong_t invalue;
6297c478bd9Sstevel@tonic-gate struct ipsecalgent *algent;
630e3320f40Smarkfen char *ep = NULL;
6317c478bd9Sstevel@tonic-gate
6327c478bd9Sstevel@tonic-gate if (alg == NULL) {
633e3320f40Smarkfen FATAL(ep, ebuf, gettext("Unexpected end of command line, "
634e3320f40Smarkfen "was expecting an algorithm name.\n"));
6357c478bd9Sstevel@tonic-gate }
6367c478bd9Sstevel@tonic-gate
6377c478bd9Sstevel@tonic-gate algent = getipsecalgbyname(alg, proto_num, NULL);
6387c478bd9Sstevel@tonic-gate if (algent != NULL) {
6397c478bd9Sstevel@tonic-gate uint8_t alg_num;
6407c478bd9Sstevel@tonic-gate
6417c478bd9Sstevel@tonic-gate alg_num = algent->a_alg_num;
642628b0c67SMark Fenwick if (ALG_FLAG_COUNTERMODE & algent->a_alg_flags)
643628b0c67SMark Fenwick WARN1(ep, ebuf, gettext(
644628b0c67SMark Fenwick "Using manual keying with a Counter mode algorithm "
645628b0c67SMark Fenwick "such as \"%s\" may be insecure!\n"),
646628b0c67SMark Fenwick algent->a_names[0]);
6477c478bd9Sstevel@tonic-gate freeipsecalgent(algent);
6487c478bd9Sstevel@tonic-gate
6497c478bd9Sstevel@tonic-gate return (alg_num);
6507c478bd9Sstevel@tonic-gate }
6517c478bd9Sstevel@tonic-gate
6527c478bd9Sstevel@tonic-gate /*
6537c478bd9Sstevel@tonic-gate * Since algorithms can be loaded during kernel run-time, check for
6547c478bd9Sstevel@tonic-gate * numeric algorithm values too. PF_KEY can catch bad ones with EINVAL.
6557c478bd9Sstevel@tonic-gate */
656e3320f40Smarkfen invalue = parsenum(alg, B_FALSE, ebuf);
6577c478bd9Sstevel@tonic-gate if (invalue != (u_longlong_t)-1 &&
6587c478bd9Sstevel@tonic-gate (u_longlong_t)(invalue & (u_longlong_t)0xff) == invalue)
6597c478bd9Sstevel@tonic-gate return ((uint8_t)invalue);
6607c478bd9Sstevel@tonic-gate
661e3320f40Smarkfen if (proto_num == IPSEC_PROTO_ESP) {
662e3320f40Smarkfen ERROR1(ep, ebuf, gettext(
663e3320f40Smarkfen "Unknown encryption algorithm type \"%s\"\n"), alg);
664e3320f40Smarkfen } else {
665e3320f40Smarkfen ERROR1(ep, ebuf, gettext(
666e3320f40Smarkfen "Unknown authentication algorithm type \"%s\"\n"), alg);
667e3320f40Smarkfen }
668e3320f40Smarkfen handle_errors(ep, NULL, B_FALSE, B_FALSE);
669eeda67c6Sjojemann return (0);
6707c478bd9Sstevel@tonic-gate }
6717c478bd9Sstevel@tonic-gate
6727c478bd9Sstevel@tonic-gate /*
6737c478bd9Sstevel@tonic-gate * Parse and reverse parse out a source/destination ID type.
6747c478bd9Sstevel@tonic-gate */
6757c478bd9Sstevel@tonic-gate static struct idtypes {
6767c478bd9Sstevel@tonic-gate char *idtype;
6777c478bd9Sstevel@tonic-gate uint8_t retval;
6787c478bd9Sstevel@tonic-gate } idtypes[] = {
6797c478bd9Sstevel@tonic-gate {"prefix", SADB_IDENTTYPE_PREFIX},
6807c478bd9Sstevel@tonic-gate {"fqdn", SADB_IDENTTYPE_FQDN},
6817c478bd9Sstevel@tonic-gate {"domain", SADB_IDENTTYPE_FQDN},
6827c478bd9Sstevel@tonic-gate {"domainname", SADB_IDENTTYPE_FQDN},
6837c478bd9Sstevel@tonic-gate {"user_fqdn", SADB_IDENTTYPE_USER_FQDN},
6847c478bd9Sstevel@tonic-gate {"mailbox", SADB_IDENTTYPE_USER_FQDN},
6857c478bd9Sstevel@tonic-gate {"der_dn", SADB_X_IDENTTYPE_DN},
6867c478bd9Sstevel@tonic-gate {"der_gn", SADB_X_IDENTTYPE_GN},
6877c478bd9Sstevel@tonic-gate {NULL, 0}
6887c478bd9Sstevel@tonic-gate };
6897c478bd9Sstevel@tonic-gate
6907c478bd9Sstevel@tonic-gate static uint16_t
parseidtype(char * type,char * ebuf)691e3320f40Smarkfen parseidtype(char *type, char *ebuf)
6927c478bd9Sstevel@tonic-gate {
6937c478bd9Sstevel@tonic-gate struct idtypes *idp;
6947c478bd9Sstevel@tonic-gate u_longlong_t invalue;
695e3320f40Smarkfen char *ep = NULL;
6967c478bd9Sstevel@tonic-gate
6977c478bd9Sstevel@tonic-gate if (type == NULL) {
6987c478bd9Sstevel@tonic-gate /* Shouldn't reach here, see callers for why. */
699e3320f40Smarkfen FATAL(ep, ebuf, gettext("Unexpected end of command line, "
700e3320f40Smarkfen "was expecting a type.\n"));
7017c478bd9Sstevel@tonic-gate }
7027c478bd9Sstevel@tonic-gate
7037c478bd9Sstevel@tonic-gate for (idp = idtypes; idp->idtype != NULL; idp++) {
7047c478bd9Sstevel@tonic-gate if (strcasecmp(idp->idtype, type) == 0)
7057c478bd9Sstevel@tonic-gate return (idp->retval);
7067c478bd9Sstevel@tonic-gate }
7077c478bd9Sstevel@tonic-gate /*
7087c478bd9Sstevel@tonic-gate * Since identity types are almost arbitrary, check for numeric
7097c478bd9Sstevel@tonic-gate * algorithm values too. PF_KEY can catch bad ones with EINVAL.
7107c478bd9Sstevel@tonic-gate */
711e3320f40Smarkfen invalue = parsenum(type, B_FALSE, ebuf);
7127c478bd9Sstevel@tonic-gate if (invalue != (u_longlong_t)-1 &&
7137c478bd9Sstevel@tonic-gate (u_longlong_t)(invalue & (u_longlong_t)0xffff) == invalue)
7147c478bd9Sstevel@tonic-gate return ((uint16_t)invalue);
7157c478bd9Sstevel@tonic-gate
7167c478bd9Sstevel@tonic-gate
717e3320f40Smarkfen ERROR1(ep, ebuf, gettext("Unknown identity type \"%s\"\n"), type);
718e3320f40Smarkfen
719e3320f40Smarkfen handle_errors(ep, NULL, B_FALSE, B_FALSE);
720eeda67c6Sjojemann return (0);
7217c478bd9Sstevel@tonic-gate }
7227c478bd9Sstevel@tonic-gate
7237c478bd9Sstevel@tonic-gate /*
7247c478bd9Sstevel@tonic-gate * Parse an address off the command line. Return length of sockaddr,
7257c478bd9Sstevel@tonic-gate * and either return a hostent pointer (caller frees). The new
7267c478bd9Sstevel@tonic-gate * getipnodebyname() call does the Right Thing (TM), even with
7277c478bd9Sstevel@tonic-gate * raw addresses (colon-separated IPv6 or dotted decimal IPv4).
7287c478bd9Sstevel@tonic-gate */
7297c478bd9Sstevel@tonic-gate
7307c478bd9Sstevel@tonic-gate static struct {
7317c478bd9Sstevel@tonic-gate struct hostent he;
7327c478bd9Sstevel@tonic-gate char *addtl[2];
7337c478bd9Sstevel@tonic-gate } dummy;
7347c478bd9Sstevel@tonic-gate static union {
7357c478bd9Sstevel@tonic-gate struct in6_addr ipv6;
7367c478bd9Sstevel@tonic-gate struct in_addr ipv4;
7377c478bd9Sstevel@tonic-gate uint64_t aligner;
7387c478bd9Sstevel@tonic-gate } addr1;
7397c478bd9Sstevel@tonic-gate
7407c478bd9Sstevel@tonic-gate static int
parseaddr(char * addr,struct hostent ** hpp,boolean_t v6only,char * ebuf)741e3320f40Smarkfen parseaddr(char *addr, struct hostent **hpp, boolean_t v6only, char *ebuf)
7427c478bd9Sstevel@tonic-gate {
7437c478bd9Sstevel@tonic-gate int hp_errno;
7447c478bd9Sstevel@tonic-gate struct hostent *hp = NULL;
745e3320f40Smarkfen char *ep = NULL;
7467c478bd9Sstevel@tonic-gate
7477c478bd9Sstevel@tonic-gate if (addr == NULL) {
748e3320f40Smarkfen FATAL(ep, ebuf, gettext("Unexpected end of command line, "
749e3320f40Smarkfen "was expecting an address.\n"));
7507c478bd9Sstevel@tonic-gate }
7517c478bd9Sstevel@tonic-gate
7527c478bd9Sstevel@tonic-gate if (!nflag) {
7537c478bd9Sstevel@tonic-gate /*
7547c478bd9Sstevel@tonic-gate * Try name->address first. Assume AF_INET6, and
7557c478bd9Sstevel@tonic-gate * get IPv4's, plus IPv6's if and only if IPv6 is configured.
7567c478bd9Sstevel@tonic-gate * This means to add IPv6 SAs, you must have IPv6
7577c478bd9Sstevel@tonic-gate * up-and-running. (AI_DEFAULT works here.)
7587c478bd9Sstevel@tonic-gate */
7597c478bd9Sstevel@tonic-gate hp = getipnodebyname(addr, AF_INET6,
7607c478bd9Sstevel@tonic-gate (v6only ? AI_ADDRCONFIG : (AI_DEFAULT | AI_ALL)),
7617c478bd9Sstevel@tonic-gate &hp_errno);
7627c478bd9Sstevel@tonic-gate } else {
7637c478bd9Sstevel@tonic-gate /*
7647c478bd9Sstevel@tonic-gate * Try a normal address conversion only. Use "dummy"
7657c478bd9Sstevel@tonic-gate * to construct a fake hostent. Caller will know not
7667c478bd9Sstevel@tonic-gate * to free this one.
7677c478bd9Sstevel@tonic-gate */
7687c478bd9Sstevel@tonic-gate if (inet_pton(AF_INET6, addr, &addr1) == 1) {
7697c478bd9Sstevel@tonic-gate dummy.he.h_addr_list = dummy.addtl;
7707c478bd9Sstevel@tonic-gate dummy.addtl[0] = (char *)&addr1;
7717c478bd9Sstevel@tonic-gate dummy.addtl[1] = NULL;
7727c478bd9Sstevel@tonic-gate hp = &dummy.he;
7737c478bd9Sstevel@tonic-gate dummy.he.h_addrtype = AF_INET6;
7747c478bd9Sstevel@tonic-gate dummy.he.h_length = sizeof (struct in6_addr);
7757c478bd9Sstevel@tonic-gate } else if (inet_pton(AF_INET, addr, &addr1) == 1) {
7767c478bd9Sstevel@tonic-gate /*
7778810c16bSdanmcd * Remap to AF_INET6 anyway.
7787c478bd9Sstevel@tonic-gate */
7797c478bd9Sstevel@tonic-gate dummy.he.h_addr_list = dummy.addtl;
7807c478bd9Sstevel@tonic-gate dummy.addtl[0] = (char *)&addr1;
7817c478bd9Sstevel@tonic-gate dummy.addtl[1] = NULL;
7827c478bd9Sstevel@tonic-gate hp = &dummy.he;
7837c478bd9Sstevel@tonic-gate dummy.he.h_addrtype = AF_INET6;
7847c478bd9Sstevel@tonic-gate dummy.he.h_length = sizeof (struct in6_addr);
7857c478bd9Sstevel@tonic-gate /*
7867c478bd9Sstevel@tonic-gate * NOTE: If macro changes to disallow in-place
7877c478bd9Sstevel@tonic-gate * conversion, rewhack this.
7887c478bd9Sstevel@tonic-gate */
7897c478bd9Sstevel@tonic-gate IN6_INADDR_TO_V4MAPPED(&addr1.ipv4, &addr1.ipv6);
7907c478bd9Sstevel@tonic-gate } else {
7917c478bd9Sstevel@tonic-gate hp = NULL;
7927c478bd9Sstevel@tonic-gate }
7937c478bd9Sstevel@tonic-gate }
7947c478bd9Sstevel@tonic-gate
795e3320f40Smarkfen if (hp == NULL)
796e3320f40Smarkfen WARN1(ep, ebuf, gettext("Unknown address %s."), addr);
7977c478bd9Sstevel@tonic-gate
7987c478bd9Sstevel@tonic-gate *hpp = hp;
7998810c16bSdanmcd /* Always return sockaddr_in6 for now. */
800e3320f40Smarkfen handle_errors(ep, NULL, B_FALSE, B_FALSE);
8018810c16bSdanmcd return (sizeof (struct sockaddr_in6));
8027c478bd9Sstevel@tonic-gate }
8037c478bd9Sstevel@tonic-gate
8047c478bd9Sstevel@tonic-gate /*
8057c478bd9Sstevel@tonic-gate * Parse a hex character for a key. A string will take the form:
8067c478bd9Sstevel@tonic-gate * xxxxxxxxx/nn
8077c478bd9Sstevel@tonic-gate * where
8087c478bd9Sstevel@tonic-gate * xxxxxxxxx == a string of hex characters ([0-9][a-f][A-F])
8097c478bd9Sstevel@tonic-gate * nn == an optional decimal "mask". If it is not present, it
8107c478bd9Sstevel@tonic-gate * is assumed that the hex string will be rounded to the nearest
8117c478bd9Sstevel@tonic-gate * byte, where odd nibbles, like 123 will become 0x0123.
8127c478bd9Sstevel@tonic-gate *
8137c478bd9Sstevel@tonic-gate * NOTE:Unlike the expression of IP addresses, I will not allow an
8147c478bd9Sstevel@tonic-gate * excessive "mask". For example 2112/50 is very illegal.
8157c478bd9Sstevel@tonic-gate * NOTE2: This key should be in canonical order. Consult your man
8167c478bd9Sstevel@tonic-gate * pages per algorithm about said order.
8177c478bd9Sstevel@tonic-gate */
8187c478bd9Sstevel@tonic-gate
8197c478bd9Sstevel@tonic-gate #define hd2num(hd) (((hd) >= '0' && (hd) <= '9') ? ((hd) - '0') : \
8207c478bd9Sstevel@tonic-gate (((hd) >= 'a' && (hd) <= 'f') ? ((hd) - 'a' + 10) : ((hd) - 'A' + 10)))
8217c478bd9Sstevel@tonic-gate
8227c478bd9Sstevel@tonic-gate static struct sadb_key *
parsekey(char * input,char * ebuf,uint_t reserved_bits)823628b0c67SMark Fenwick parsekey(char *input, char *ebuf, uint_t reserved_bits)
8247c478bd9Sstevel@tonic-gate {
8257c478bd9Sstevel@tonic-gate struct sadb_key *retval;
8267c478bd9Sstevel@tonic-gate uint_t i, hexlen = 0, bits, alloclen;
8277c478bd9Sstevel@tonic-gate uint8_t *key;
828e3320f40Smarkfen char *ep = NULL;
8297c478bd9Sstevel@tonic-gate
8307c478bd9Sstevel@tonic-gate if (input == NULL) {
831e3320f40Smarkfen FATAL(ep, ebuf, gettext("Unexpected end of command line, "
832e3320f40Smarkfen "was expecting a key.\n"));
8337c478bd9Sstevel@tonic-gate }
834ec485834Spwernau /* Allow hex values prepended with 0x convention */
835ec485834Spwernau if ((strnlen(input, sizeof (hexlen)) > 2) &&
836ec485834Spwernau (strncasecmp(input, "0x", 2) == 0))
837ec485834Spwernau input += 2;
8387c478bd9Sstevel@tonic-gate
8397c478bd9Sstevel@tonic-gate for (i = 0; input[i] != '\0' && input[i] != '/'; i++)
8407c478bd9Sstevel@tonic-gate hexlen++;
8417c478bd9Sstevel@tonic-gate
8427c478bd9Sstevel@tonic-gate if (input[i] == '\0') {
8437c478bd9Sstevel@tonic-gate bits = 0;
8447c478bd9Sstevel@tonic-gate } else {
8457c478bd9Sstevel@tonic-gate /* Have /nn. */
8467c478bd9Sstevel@tonic-gate input[i] = '\0';
8477c478bd9Sstevel@tonic-gate if (sscanf((input + i + 1), "%u", &bits) != 1) {
848e3320f40Smarkfen FATAL1(ep, ebuf, gettext(
849e3320f40Smarkfen "\"%s\" is not a bit specifier.\n"),
8507c478bd9Sstevel@tonic-gate (input + i + 1));
8517c478bd9Sstevel@tonic-gate }
8527c478bd9Sstevel@tonic-gate /* hexlen in nibbles */
8537c478bd9Sstevel@tonic-gate if (((bits + 3) >> 2) > hexlen) {
854e3320f40Smarkfen ERROR2(ep, ebuf, gettext(
855e3320f40Smarkfen "bit length %d is too big for %s.\n"), bits, input);
8567c478bd9Sstevel@tonic-gate }
8577c478bd9Sstevel@tonic-gate /*
8587c478bd9Sstevel@tonic-gate * Adjust hexlen down if user gave us too small of a bit
8597c478bd9Sstevel@tonic-gate * count.
8607c478bd9Sstevel@tonic-gate */
8617c478bd9Sstevel@tonic-gate if ((hexlen << 2) > bits + 3) {
862e3320f40Smarkfen WARN2(ep, ebuf, gettext(
863e3320f40Smarkfen "WARNING: Lower bits will be truncated "
864e3320f40Smarkfen "for:\n\t%s/%d.\n"), input, bits);
8657c478bd9Sstevel@tonic-gate hexlen = (bits + 3) >> 2;
8667c478bd9Sstevel@tonic-gate input[hexlen] = '\0';
8677c478bd9Sstevel@tonic-gate }
8687c478bd9Sstevel@tonic-gate }
8697c478bd9Sstevel@tonic-gate
8707c478bd9Sstevel@tonic-gate /*
8717c478bd9Sstevel@tonic-gate * Allocate. Remember, hexlen is in nibbles.
8727c478bd9Sstevel@tonic-gate */
8737c478bd9Sstevel@tonic-gate
8747c478bd9Sstevel@tonic-gate alloclen = sizeof (*retval) + roundup((hexlen/2 + (hexlen & 0x1)), 8);
8757c478bd9Sstevel@tonic-gate retval = malloc(alloclen);
8767c478bd9Sstevel@tonic-gate
8777c478bd9Sstevel@tonic-gate if (retval == NULL)
8787c478bd9Sstevel@tonic-gate Bail("malloc(parsekey)");
8797c478bd9Sstevel@tonic-gate retval->sadb_key_len = SADB_8TO64(alloclen);
880628b0c67SMark Fenwick
881628b0c67SMark Fenwick retval->sadb_key_reserved = reserved_bits;
882628b0c67SMark Fenwick
8837c478bd9Sstevel@tonic-gate if (bits == 0)
8847c478bd9Sstevel@tonic-gate retval->sadb_key_bits = (hexlen + (hexlen & 0x1)) << 2;
8857c478bd9Sstevel@tonic-gate else
8867c478bd9Sstevel@tonic-gate retval->sadb_key_bits = bits;
8877c478bd9Sstevel@tonic-gate
8887c478bd9Sstevel@tonic-gate /*
8897c478bd9Sstevel@tonic-gate * Read in nibbles. Read in odd-numbered as shifted high.
8907c478bd9Sstevel@tonic-gate * (e.g. 123 becomes 0x1230).
8917c478bd9Sstevel@tonic-gate */
8927c478bd9Sstevel@tonic-gate
8937c478bd9Sstevel@tonic-gate key = (uint8_t *)(retval + 1);
8947c478bd9Sstevel@tonic-gate for (i = 0; input[i] != '\0'; i += 2) {
8957c478bd9Sstevel@tonic-gate boolean_t second = (input[i + 1] != '\0');
8967c478bd9Sstevel@tonic-gate
8977c478bd9Sstevel@tonic-gate if (!isxdigit(input[i]) ||
8987c478bd9Sstevel@tonic-gate (!isxdigit(input[i + 1]) && second)) {
899e3320f40Smarkfen ERROR1(ep, ebuf, gettext(
900e3320f40Smarkfen "string '%s' not a hex value.\n"), input);
901e3320f40Smarkfen free(retval);
902e3320f40Smarkfen retval = NULL;
903e3320f40Smarkfen break;
9047c478bd9Sstevel@tonic-gate }
9057c478bd9Sstevel@tonic-gate *key = (hd2num(input[i]) << 4);
9067c478bd9Sstevel@tonic-gate if (second)
9077c478bd9Sstevel@tonic-gate *key |= hd2num(input[i + 1]);
9087c478bd9Sstevel@tonic-gate else
9097c478bd9Sstevel@tonic-gate break; /* out of for loop. */
9107c478bd9Sstevel@tonic-gate key++;
9117c478bd9Sstevel@tonic-gate }
9127c478bd9Sstevel@tonic-gate
9137c478bd9Sstevel@tonic-gate /* bzero the remaining bits if we're a non-octet amount. */
9147c478bd9Sstevel@tonic-gate if (bits & 0x7)
9157c478bd9Sstevel@tonic-gate *((input[i] == '\0') ? key - 1 : key) &=
9167c478bd9Sstevel@tonic-gate 0xff << (8 - (bits & 0x7));
9177c478bd9Sstevel@tonic-gate
918e3320f40Smarkfen handle_errors(ep, NULL, B_FALSE, B_FALSE);
9197c478bd9Sstevel@tonic-gate return (retval);
9207c478bd9Sstevel@tonic-gate }
9217c478bd9Sstevel@tonic-gate
9225d3b8cb7SBill Sommerfeld #include <tsol/label.h>
9235d3b8cb7SBill Sommerfeld
9245d3b8cb7SBill Sommerfeld #define PARSELABEL_BAD_TOKEN ((struct sadb_sens *)-1)
9255d3b8cb7SBill Sommerfeld
9265d3b8cb7SBill Sommerfeld static struct sadb_sens *
parselabel(int token,char * label)9275d3b8cb7SBill Sommerfeld parselabel(int token, char *label)
9285d3b8cb7SBill Sommerfeld {
9295d3b8cb7SBill Sommerfeld bslabel_t *sl = NULL;
9305d3b8cb7SBill Sommerfeld int err, len;
9315d3b8cb7SBill Sommerfeld sadb_sens_t *sens;
9325d3b8cb7SBill Sommerfeld int doi = 1; /* XXX XXX DEFAULT_DOI XXX XXX */
9335d3b8cb7SBill Sommerfeld
9345d3b8cb7SBill Sommerfeld err = str_to_label(label, &sl, MAC_LABEL, L_DEFAULT, NULL);
9355d3b8cb7SBill Sommerfeld if (err < 0)
9365d3b8cb7SBill Sommerfeld return (NULL);
9375d3b8cb7SBill Sommerfeld
9385d3b8cb7SBill Sommerfeld len = ipsec_convert_sl_to_sens(doi, sl, NULL);
9395d3b8cb7SBill Sommerfeld
9405d3b8cb7SBill Sommerfeld sens = malloc(len);
9415d3b8cb7SBill Sommerfeld if (sens == NULL) {
9425d3b8cb7SBill Sommerfeld Bail("malloc parsed label");
9435d3b8cb7SBill Sommerfeld /* Should exit before reaching here... */
9445d3b8cb7SBill Sommerfeld return (NULL);
9455d3b8cb7SBill Sommerfeld }
9465d3b8cb7SBill Sommerfeld
9475d3b8cb7SBill Sommerfeld (void) ipsec_convert_sl_to_sens(doi, sl, sens);
9485d3b8cb7SBill Sommerfeld
9495d3b8cb7SBill Sommerfeld switch (token) {
9505d3b8cb7SBill Sommerfeld case TOK_LABEL:
9515d3b8cb7SBill Sommerfeld break;
9525d3b8cb7SBill Sommerfeld
9535d3b8cb7SBill Sommerfeld case TOK_OLABEL:
9545d3b8cb7SBill Sommerfeld sens->sadb_sens_exttype = SADB_X_EXT_OUTER_SENS;
9555d3b8cb7SBill Sommerfeld break;
9565d3b8cb7SBill Sommerfeld
9575d3b8cb7SBill Sommerfeld case TOK_IMPLABEL:
9585d3b8cb7SBill Sommerfeld sens->sadb_sens_exttype = SADB_X_EXT_OUTER_SENS;
9595d3b8cb7SBill Sommerfeld sens->sadb_x_sens_flags = SADB_X_SENS_IMPLICIT;
9605d3b8cb7SBill Sommerfeld break;
9615d3b8cb7SBill Sommerfeld
9625d3b8cb7SBill Sommerfeld default:
9635d3b8cb7SBill Sommerfeld free(sens);
9645d3b8cb7SBill Sommerfeld /*
9655d3b8cb7SBill Sommerfeld * Return a different return code for a bad label, but really,
9665d3b8cb7SBill Sommerfeld * this would be a caller error.
9675d3b8cb7SBill Sommerfeld */
9685d3b8cb7SBill Sommerfeld return (PARSELABEL_BAD_TOKEN);
9695d3b8cb7SBill Sommerfeld }
9705d3b8cb7SBill Sommerfeld
9715d3b8cb7SBill Sommerfeld return (sens);
9725d3b8cb7SBill Sommerfeld }
9735d3b8cb7SBill Sommerfeld
9747c478bd9Sstevel@tonic-gate /*
9757c478bd9Sstevel@tonic-gate * Write a message to the PF_KEY socket. If verbose, print the message
9767c478bd9Sstevel@tonic-gate * heading into the kernel.
9777c478bd9Sstevel@tonic-gate */
9787c478bd9Sstevel@tonic-gate static int
key_write(int fd,void * msg,size_t len)9797c478bd9Sstevel@tonic-gate key_write(int fd, void *msg, size_t len)
9807c478bd9Sstevel@tonic-gate {
9817c478bd9Sstevel@tonic-gate if (vflag) {
9827c478bd9Sstevel@tonic-gate (void) printf(
9837c478bd9Sstevel@tonic-gate gettext("VERBOSE ON: Message to kernel looks like:\n"));
9847c478bd9Sstevel@tonic-gate (void) printf("==========================================\n");
985bb3ed8dfSpwernau print_samsg(stdout, msg, B_FALSE, vflag, nflag);
9867c478bd9Sstevel@tonic-gate (void) printf("==========================================\n");
9877c478bd9Sstevel@tonic-gate }
9887c478bd9Sstevel@tonic-gate
9897c478bd9Sstevel@tonic-gate return (write(fd, msg, len));
9907c478bd9Sstevel@tonic-gate }
9917c478bd9Sstevel@tonic-gate
9927c478bd9Sstevel@tonic-gate /*
9937c478bd9Sstevel@tonic-gate * SIGALRM handler for time_critical_enter.
9947c478bd9Sstevel@tonic-gate */
9957c478bd9Sstevel@tonic-gate static void
time_critical_catch(int signal)9967c478bd9Sstevel@tonic-gate time_critical_catch(int signal)
9977c478bd9Sstevel@tonic-gate {
9987c478bd9Sstevel@tonic-gate if (signal == SIGALRM) {
9997c478bd9Sstevel@tonic-gate errx(1, gettext("Reply message from PF_KEY timed out."));
10007c478bd9Sstevel@tonic-gate } else {
10017c478bd9Sstevel@tonic-gate errx(1, gettext("Caught signal %d while trying to receive"
100225e435e0Spwernau "PF_KEY reply message"), signal);
10037c478bd9Sstevel@tonic-gate }
10047c478bd9Sstevel@tonic-gate /* errx() calls exit. */
10057c478bd9Sstevel@tonic-gate }
10067c478bd9Sstevel@tonic-gate
10077c478bd9Sstevel@tonic-gate #define TIME_CRITICAL_TIME 10 /* In seconds */
10087c478bd9Sstevel@tonic-gate
10097c478bd9Sstevel@tonic-gate /*
10107c478bd9Sstevel@tonic-gate * Enter a "time critical" section where key is waiting for a return message.
10117c478bd9Sstevel@tonic-gate */
10127c478bd9Sstevel@tonic-gate static void
time_critical_enter(void)10137c478bd9Sstevel@tonic-gate time_critical_enter(void)
10147c478bd9Sstevel@tonic-gate {
10157c478bd9Sstevel@tonic-gate (void) signal(SIGALRM, time_critical_catch);
10167c478bd9Sstevel@tonic-gate (void) alarm(TIME_CRITICAL_TIME);
10177c478bd9Sstevel@tonic-gate }
10187c478bd9Sstevel@tonic-gate
10197c478bd9Sstevel@tonic-gate /*
10207c478bd9Sstevel@tonic-gate * Exit the "time critical" section after getting an appropriate return
10217c478bd9Sstevel@tonic-gate * message.
10227c478bd9Sstevel@tonic-gate */
10237c478bd9Sstevel@tonic-gate static void
time_critical_exit(void)10247c478bd9Sstevel@tonic-gate time_critical_exit(void)
10257c478bd9Sstevel@tonic-gate {
10267c478bd9Sstevel@tonic-gate (void) alarm(0);
10277c478bd9Sstevel@tonic-gate (void) signal(SIGALRM, SIG_DFL);
10287c478bd9Sstevel@tonic-gate }
10297c478bd9Sstevel@tonic-gate
10307c478bd9Sstevel@tonic-gate /*
10317c478bd9Sstevel@tonic-gate * Construct a PF_KEY FLUSH message for the SA type specified.
10327c478bd9Sstevel@tonic-gate */
10337c478bd9Sstevel@tonic-gate static void
doflush(int satype)10347c478bd9Sstevel@tonic-gate doflush(int satype)
10357c478bd9Sstevel@tonic-gate {
10367c478bd9Sstevel@tonic-gate struct sadb_msg msg;
10377c478bd9Sstevel@tonic-gate int rc;
10387c478bd9Sstevel@tonic-gate
10397c478bd9Sstevel@tonic-gate msg_init(&msg, SADB_FLUSH, (uint8_t)satype);
10407c478bd9Sstevel@tonic-gate rc = key_write(keysock, &msg, sizeof (msg));
10417c478bd9Sstevel@tonic-gate if (rc == -1)
10427c478bd9Sstevel@tonic-gate Bail("write() to PF_KEY socket failed (in doflush)");
10437c478bd9Sstevel@tonic-gate
10447c478bd9Sstevel@tonic-gate time_critical_enter();
10457c478bd9Sstevel@tonic-gate do {
10467c478bd9Sstevel@tonic-gate rc = read(keysock, &msg, sizeof (msg));
10477c478bd9Sstevel@tonic-gate if (rc == -1)
10487c478bd9Sstevel@tonic-gate Bail("read (in doflush)");
10497c478bd9Sstevel@tonic-gate } while (msg.sadb_msg_seq != seq || msg.sadb_msg_pid != mypid);
10507c478bd9Sstevel@tonic-gate time_critical_exit();
10517c478bd9Sstevel@tonic-gate
10527c478bd9Sstevel@tonic-gate /*
10537c478bd9Sstevel@tonic-gate * I should _never_ hit the following unless:
10547c478bd9Sstevel@tonic-gate *
10557c478bd9Sstevel@tonic-gate * 1. There is a kernel bug.
10567c478bd9Sstevel@tonic-gate * 2. There is another process filling in its pid with mine, and
10577c478bd9Sstevel@tonic-gate * issuing a different message that would cause a different result.
10587c478bd9Sstevel@tonic-gate */
10597c478bd9Sstevel@tonic-gate if (msg.sadb_msg_type != SADB_FLUSH ||
10607c478bd9Sstevel@tonic-gate msg.sadb_msg_satype != (uint8_t)satype) {
10617c478bd9Sstevel@tonic-gate syslog((LOG_NOTICE|LOG_AUTH),
10627c478bd9Sstevel@tonic-gate gettext("doflush: Return message not of type SADB_FLUSH!"));
10637c478bd9Sstevel@tonic-gate Bail("doflush: Return message not of type SADB_FLUSH!");
10647c478bd9Sstevel@tonic-gate }
10657c478bd9Sstevel@tonic-gate
10667c478bd9Sstevel@tonic-gate if (msg.sadb_msg_errno != 0) {
10677c478bd9Sstevel@tonic-gate errno = msg.sadb_msg_errno;
10687c478bd9Sstevel@tonic-gate if (errno == EINVAL) {
10697c478bd9Sstevel@tonic-gate print_diagnostic(stderr, msg.sadb_x_msg_diagnostic);
10707c478bd9Sstevel@tonic-gate warnx(gettext("Cannot flush SA type %d."), satype);
10717c478bd9Sstevel@tonic-gate }
10727c478bd9Sstevel@tonic-gate Bail("return message (in doflush)");
10737c478bd9Sstevel@tonic-gate }
10747c478bd9Sstevel@tonic-gate }
10757c478bd9Sstevel@tonic-gate
10767c478bd9Sstevel@tonic-gate /*
10777c478bd9Sstevel@tonic-gate * save_XXX functions are used when "saving" the SA tables to either a
10787c478bd9Sstevel@tonic-gate * file or standard output. They use the dump_XXX functions where needed,
10797c478bd9Sstevel@tonic-gate * but mostly they use the rparseXXX functions.
10807c478bd9Sstevel@tonic-gate */
10817c478bd9Sstevel@tonic-gate
10827c478bd9Sstevel@tonic-gate /*
10837c478bd9Sstevel@tonic-gate * Because "save" and "dump" both use the SADB_DUMP message, fold both
10847c478bd9Sstevel@tonic-gate * into the same function.
10857c478bd9Sstevel@tonic-gate */
10867c478bd9Sstevel@tonic-gate static void
dodump(int satype,FILE * ofile)10877c478bd9Sstevel@tonic-gate dodump(int satype, FILE *ofile)
10887c478bd9Sstevel@tonic-gate {
10897c478bd9Sstevel@tonic-gate struct sadb_msg *msg = (struct sadb_msg *)get_buffer;
10907c478bd9Sstevel@tonic-gate int rc;
10917c478bd9Sstevel@tonic-gate
10927c478bd9Sstevel@tonic-gate if (ofile != NULL) {
10937c478bd9Sstevel@tonic-gate (void) fprintf(ofile,
10947c478bd9Sstevel@tonic-gate gettext("# This key file was generated by the"));
10957c478bd9Sstevel@tonic-gate (void) fprintf(ofile,
1096*bbf21555SRichard Lowe gettext(" ipseckey(8) command's 'save' feature.\n\n"));
10977c478bd9Sstevel@tonic-gate }
10987c478bd9Sstevel@tonic-gate msg_init(msg, SADB_DUMP, (uint8_t)satype);
10997c478bd9Sstevel@tonic-gate rc = key_write(keysock, msg, sizeof (*msg));
11007c478bd9Sstevel@tonic-gate if (rc == -1)
11017c478bd9Sstevel@tonic-gate Bail("write to PF_KEY socket failed (in dodump)");
11027c478bd9Sstevel@tonic-gate
11037c478bd9Sstevel@tonic-gate do {
11047c478bd9Sstevel@tonic-gate /*
11057c478bd9Sstevel@tonic-gate * For DUMP, do only the read as a time critical section.
11067c478bd9Sstevel@tonic-gate */
11077c478bd9Sstevel@tonic-gate time_critical_enter();
11087c478bd9Sstevel@tonic-gate rc = read(keysock, get_buffer, sizeof (get_buffer));
11097c478bd9Sstevel@tonic-gate time_critical_exit();
11107c478bd9Sstevel@tonic-gate if (rc == -1)
11117c478bd9Sstevel@tonic-gate Bail("read (in dodump)");
11127c478bd9Sstevel@tonic-gate if (msg->sadb_msg_pid == mypid &&
11137c478bd9Sstevel@tonic-gate msg->sadb_msg_type == SADB_DUMP &&
11147c478bd9Sstevel@tonic-gate msg->sadb_msg_seq != 0 &&
11157c478bd9Sstevel@tonic-gate msg->sadb_msg_errno == 0) {
11167c478bd9Sstevel@tonic-gate if (ofile == NULL) {
1117bb3ed8dfSpwernau print_samsg(stdout, get_buffer, B_FALSE, vflag,
1118bb3ed8dfSpwernau nflag);
11197c478bd9Sstevel@tonic-gate (void) putchar('\n');
11207c478bd9Sstevel@tonic-gate } else {
11217c478bd9Sstevel@tonic-gate save_assoc(get_buffer, ofile);
11227c478bd9Sstevel@tonic-gate }
11237c478bd9Sstevel@tonic-gate }
11247c478bd9Sstevel@tonic-gate } while (msg->sadb_msg_pid != mypid ||
11257c478bd9Sstevel@tonic-gate (msg->sadb_msg_errno == 0 && msg->sadb_msg_seq != 0));
11267c478bd9Sstevel@tonic-gate
11277c478bd9Sstevel@tonic-gate if (ofile != NULL && ofile != stdout)
11287c478bd9Sstevel@tonic-gate (void) fclose(ofile);
11297c478bd9Sstevel@tonic-gate
11307c478bd9Sstevel@tonic-gate if (msg->sadb_msg_errno == 0) {
11317c478bd9Sstevel@tonic-gate if (ofile == NULL)
11327c478bd9Sstevel@tonic-gate (void) printf(
11337c478bd9Sstevel@tonic-gate gettext("Dump succeeded for SA type %d.\n"),
11347c478bd9Sstevel@tonic-gate satype);
11357c478bd9Sstevel@tonic-gate } else {
11367c478bd9Sstevel@tonic-gate print_diagnostic(stderr, msg->sadb_x_msg_diagnostic);
11377c478bd9Sstevel@tonic-gate errno = msg->sadb_msg_errno;
11387c478bd9Sstevel@tonic-gate Bail("Dump failed");
11397c478bd9Sstevel@tonic-gate }
11407c478bd9Sstevel@tonic-gate }
11417c478bd9Sstevel@tonic-gate
11427c478bd9Sstevel@tonic-gate #define SCOPE_UNSPEC 0
11437c478bd9Sstevel@tonic-gate #define SCOPE_LINKLOCAL 1
11447c478bd9Sstevel@tonic-gate #define SCOPE_SITELOCAL 2
11457c478bd9Sstevel@tonic-gate #define SCOPE_GLOBAL 3
11467c478bd9Sstevel@tonic-gate #define SCOPE_V4COMPAT 4
11477c478bd9Sstevel@tonic-gate #define SCOPE_LOOPBACK 5 /* Pedantic, yes, but necessary. */
11487c478bd9Sstevel@tonic-gate
11497c478bd9Sstevel@tonic-gate static int
ipv6_addr_scope(struct in6_addr * addr)11507c478bd9Sstevel@tonic-gate ipv6_addr_scope(struct in6_addr *addr)
11517c478bd9Sstevel@tonic-gate {
11527c478bd9Sstevel@tonic-gate /* Don't return anything regarding multicast for now... */
11537c478bd9Sstevel@tonic-gate
11547c478bd9Sstevel@tonic-gate if (IN6_IS_ADDR_UNSPECIFIED(addr))
11557c478bd9Sstevel@tonic-gate return (SCOPE_UNSPEC);
11567c478bd9Sstevel@tonic-gate
11577c478bd9Sstevel@tonic-gate if (IN6_IS_ADDR_LINKLOCAL(addr))
11587c478bd9Sstevel@tonic-gate return (SCOPE_LINKLOCAL);
11597c478bd9Sstevel@tonic-gate
11607c478bd9Sstevel@tonic-gate if (IN6_IS_ADDR_SITELOCAL(addr))
11617c478bd9Sstevel@tonic-gate return (SCOPE_SITELOCAL);
11627c478bd9Sstevel@tonic-gate
11637c478bd9Sstevel@tonic-gate if (IN6_IS_ADDR_V4COMPAT(addr))
11647c478bd9Sstevel@tonic-gate return (SCOPE_V4COMPAT);
11657c478bd9Sstevel@tonic-gate
11667c478bd9Sstevel@tonic-gate if (IN6_IS_ADDR_LOOPBACK(addr))
11677c478bd9Sstevel@tonic-gate return (SCOPE_LOOPBACK);
11687c478bd9Sstevel@tonic-gate
11697c478bd9Sstevel@tonic-gate /* For now, return global by default. */
11707c478bd9Sstevel@tonic-gate return (SCOPE_GLOBAL);
11717c478bd9Sstevel@tonic-gate }
11727c478bd9Sstevel@tonic-gate
11737c478bd9Sstevel@tonic-gate /*
11747c478bd9Sstevel@tonic-gate * doaddresses():
11757c478bd9Sstevel@tonic-gate *
11767c478bd9Sstevel@tonic-gate * Used by doaddup() and dodelget() to create new SA's based on the
11777c478bd9Sstevel@tonic-gate * provided source and destination addresses hostent.
11787c478bd9Sstevel@tonic-gate *
11797c478bd9Sstevel@tonic-gate * sadb_msg_type: expected PF_KEY reply message type
11807c478bd9Sstevel@tonic-gate * sadb_msg_satype: expected PF_KEY reply satype
11817c478bd9Sstevel@tonic-gate * cmd: user command
11827c478bd9Sstevel@tonic-gate * srchp: hostent for the source address(es)
11837c478bd9Sstevel@tonic-gate * dsthp: hostent for the destination address(es)
11847c478bd9Sstevel@tonic-gate * src: points to the SADB source address extension
11857c478bd9Sstevel@tonic-gate * dst: points to the SADB destination address extension
11867c478bd9Sstevel@tonic-gate * unspec_src: indicates an unspecified source address.
11877c478bd9Sstevel@tonic-gate * buffer: pointer to the SADB buffer to use with PF_KEY
11887c478bd9Sstevel@tonic-gate * buffer_size: size of buffer
11897c478bd9Sstevel@tonic-gate * spi: spi for this message (set by caller)
11907c478bd9Sstevel@tonic-gate * srcport: source port if specified
11918810c16bSdanmcd * dstport: destination port if specified
11927c478bd9Sstevel@tonic-gate * proto: IP protocol number if specified
11938810c16bSdanmcd * iproto: Inner (tunnel mode) IP protocol number if specified
11947c478bd9Sstevel@tonic-gate * NATT note: we are going to assume a semi-sane world where NAT
11957c478bd9Sstevel@tonic-gate * boxen don't explode to multiple addresses.
11967c478bd9Sstevel@tonic-gate */
11977c478bd9Sstevel@tonic-gate static void
doaddresses(uint8_t sadb_msg_type,uint8_t sadb_msg_satype,int cmd,struct hostent * srchp,struct hostent * dsthp,struct sadb_address * src,struct sadb_address * dst,boolean_t unspec_src,uint64_t * buffer,int buffer_size,uint32_t spi,char * ebuf)11987c478bd9Sstevel@tonic-gate doaddresses(uint8_t sadb_msg_type, uint8_t sadb_msg_satype, int cmd,
11997c478bd9Sstevel@tonic-gate struct hostent *srchp, struct hostent *dsthp,
12007c478bd9Sstevel@tonic-gate struct sadb_address *src, struct sadb_address *dst,
1201e3320f40Smarkfen boolean_t unspec_src, uint64_t *buffer, int buffer_size, uint32_t spi,
1202e3320f40Smarkfen char *ebuf)
12037c478bd9Sstevel@tonic-gate {
1204f02131e0SVladimir Kotal boolean_t last_dst;
12057c478bd9Sstevel@tonic-gate struct sockaddr_in6 *sin6;
12067c478bd9Sstevel@tonic-gate struct sadb_msg *msgp;
12077c478bd9Sstevel@tonic-gate int i, rc;
12087c478bd9Sstevel@tonic-gate char **walker; /* For the SRC and PROXY walking functions. */
12097c478bd9Sstevel@tonic-gate char *first_match;
12108810c16bSdanmcd uint64_t savebuf[MAX_GET_SIZE];
12118810c16bSdanmcd uint16_t srcport = 0, dstport = 0;
1212e3320f40Smarkfen char *ep = NULL;
12137c478bd9Sstevel@tonic-gate
12147c478bd9Sstevel@tonic-gate /*
12157c478bd9Sstevel@tonic-gate * Okay, now we have "src", "dst", and maybe "proxy" reassigned
12167c478bd9Sstevel@tonic-gate * to point into the buffer to be written to PF_KEY, we can do
12177c478bd9Sstevel@tonic-gate * potentially several writes based on destination address.
12187c478bd9Sstevel@tonic-gate *
12198810c16bSdanmcd * First, obtain port numbers from passed-in extensions.
12207c478bd9Sstevel@tonic-gate */
12217c478bd9Sstevel@tonic-gate
12227c478bd9Sstevel@tonic-gate if (src != NULL) {
12237c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(src + 1);
12248810c16bSdanmcd srcport = ntohs(sin6->sin6_port);
12257c478bd9Sstevel@tonic-gate }
12267c478bd9Sstevel@tonic-gate if (dst != NULL) {
12277c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(dst + 1);
12288810c16bSdanmcd dstport = ntohs(sin6->sin6_port);
12297c478bd9Sstevel@tonic-gate }
12307c478bd9Sstevel@tonic-gate
12317c478bd9Sstevel@tonic-gate /*
12327c478bd9Sstevel@tonic-gate * The rules for ADD, GET, and UPDATE: (NOTE: This assumes IPsec.
12337c478bd9Sstevel@tonic-gate * If other consumers of PF_KEY happen, this will have to be
12347c478bd9Sstevel@tonic-gate * rewhacked.):
12357c478bd9Sstevel@tonic-gate *
12367c478bd9Sstevel@tonic-gate * Do a message for every possible DST address.
12377c478bd9Sstevel@tonic-gate *
12387c478bd9Sstevel@tonic-gate * If a source or proxy address explodes, keep unspecified
12397c478bd9Sstevel@tonic-gate * (and mention unspecified).
12407c478bd9Sstevel@tonic-gate *
12417c478bd9Sstevel@tonic-gate * DELETE is different, because you can leave either "src" or "dst"
12427c478bd9Sstevel@tonic-gate * blank! You need to explode if one of them is full, and not assume
12437c478bd9Sstevel@tonic-gate * that the other is set.
12447c478bd9Sstevel@tonic-gate */
12457c478bd9Sstevel@tonic-gate
12467c478bd9Sstevel@tonic-gate if (dsthp == NULL) {
12477c478bd9Sstevel@tonic-gate /*
12487c478bd9Sstevel@tonic-gate * No destination address specified.
12497c478bd9Sstevel@tonic-gate * With extended diagnostics, we don't have to bail the
12507c478bd9Sstevel@tonic-gate * non-DELETE cases here. The EINVAL diagnostics will be
12517c478bd9Sstevel@tonic-gate * enough to inform the user(s) what happened.
12527c478bd9Sstevel@tonic-gate */
12537c478bd9Sstevel@tonic-gate i = 0;
12547c478bd9Sstevel@tonic-gate do {
12557c478bd9Sstevel@tonic-gate if (srchp == &dummy.he) {
12567c478bd9Sstevel@tonic-gate /* Just to be sure... */
12577c478bd9Sstevel@tonic-gate srchp->h_addr_list[1] = NULL;
12587c478bd9Sstevel@tonic-gate } else if (srchp != NULL) {
12597c478bd9Sstevel@tonic-gate /* Degenerate case, h_addr_list[0] == NULL. */
12607c478bd9Sstevel@tonic-gate if (srchp->h_addr_list[i] == NULL)
12617c478bd9Sstevel@tonic-gate Bail("Empty source address list");
12627c478bd9Sstevel@tonic-gate
12637c478bd9Sstevel@tonic-gate /*
12647c478bd9Sstevel@tonic-gate * Fill in the src sockaddr.
12657c478bd9Sstevel@tonic-gate */
12667c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(src + 1);
12677c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6));
12687c478bd9Sstevel@tonic-gate bcopy(srchp->h_addr_list[i], &sin6->sin6_addr,
12697c478bd9Sstevel@tonic-gate sizeof (struct in6_addr));
12707c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6;
12717c478bd9Sstevel@tonic-gate sin6->sin6_port = htons(srcport);
12727c478bd9Sstevel@tonic-gate }
12737c478bd9Sstevel@tonic-gate
12747c478bd9Sstevel@tonic-gate /* Save off a copy for later writing... */
12757c478bd9Sstevel@tonic-gate msgp = (struct sadb_msg *)buffer;
12767c478bd9Sstevel@tonic-gate bcopy(buffer, savebuf, SADB_64TO8(msgp->sadb_msg_len));
12777c478bd9Sstevel@tonic-gate
12787c478bd9Sstevel@tonic-gate rc = key_write(keysock, buffer,
12797c478bd9Sstevel@tonic-gate SADB_64TO8(msgp->sadb_msg_len));
12807c478bd9Sstevel@tonic-gate if (rc == -1)
12817c478bd9Sstevel@tonic-gate Bail("write() to PF_KEY socket "
12827c478bd9Sstevel@tonic-gate "(in doaddresses)");
12839c2c14abSThejaswini Singarajipura /*
12849c2c14abSThejaswini Singarajipura * Sends the message to the Solaris Cluster daemon
12859c2c14abSThejaswini Singarajipura */
12869c2c14abSThejaswini Singarajipura
12879c2c14abSThejaswini Singarajipura if (in_cluster_mode) {
12889c2c14abSThejaswini Singarajipura (void) sendto(cluster_socket, buffer,
12899c2c14abSThejaswini Singarajipura SADB_64TO8(msgp->sadb_msg_len), 0,
12909c2c14abSThejaswini Singarajipura (struct sockaddr *)&cli_addr,
12919c2c14abSThejaswini Singarajipura sizeof (cli_addr));
12929c2c14abSThejaswini Singarajipura }
12937c478bd9Sstevel@tonic-gate
12947c478bd9Sstevel@tonic-gate time_critical_enter();
12957c478bd9Sstevel@tonic-gate do {
12967c478bd9Sstevel@tonic-gate rc = read(keysock, buffer, buffer_size);
12977c478bd9Sstevel@tonic-gate if (rc == -1)
12987c478bd9Sstevel@tonic-gate Bail("read (in doaddresses)");
12997c478bd9Sstevel@tonic-gate } while (msgp->sadb_msg_seq != seq ||
13007c478bd9Sstevel@tonic-gate msgp->sadb_msg_pid != mypid);
13017c478bd9Sstevel@tonic-gate time_critical_exit();
13027c478bd9Sstevel@tonic-gate
13037c478bd9Sstevel@tonic-gate if (msgp->sadb_msg_type != sadb_msg_type ||
13047c478bd9Sstevel@tonic-gate msgp->sadb_msg_satype != sadb_msg_satype) {
13057c478bd9Sstevel@tonic-gate syslog((LOG_NOTICE|LOG_AUTH), gettext(
13067c478bd9Sstevel@tonic-gate "doaddresses: Unexpected returned message "
13077c478bd9Sstevel@tonic-gate "(%d exp %d)\n"), msgp->sadb_msg_type,
13087c478bd9Sstevel@tonic-gate sadb_msg_type);
13097c478bd9Sstevel@tonic-gate Bail("doaddresses: Unexpected returned "
13107c478bd9Sstevel@tonic-gate "message");
13117c478bd9Sstevel@tonic-gate }
13127c478bd9Sstevel@tonic-gate
13137c478bd9Sstevel@tonic-gate errno = msgp->sadb_msg_errno;
13147c478bd9Sstevel@tonic-gate if (errno != 0) {
13157c478bd9Sstevel@tonic-gate if (errno == EINVAL) {
1316e3320f40Smarkfen WARN(ep, ebuf, gettext(
1317e3320f40Smarkfen "One of the entered "
1318e3320f40Smarkfen "values is incorrect."));
13197c478bd9Sstevel@tonic-gate print_diagnostic(stderr,
13207c478bd9Sstevel@tonic-gate msgp->sadb_x_msg_diagnostic);
1321e3320f40Smarkfen } else {
1322e3320f40Smarkfen Bail("return message (in doaddresses)");
13237c478bd9Sstevel@tonic-gate }
13247c478bd9Sstevel@tonic-gate }
13257c478bd9Sstevel@tonic-gate
13267c478bd9Sstevel@tonic-gate /* ...and then restore the saved buffer. */
13277c478bd9Sstevel@tonic-gate msgp = (struct sadb_msg *)savebuf;
13287c478bd9Sstevel@tonic-gate bcopy(savebuf, buffer, SADB_64TO8(msgp->sadb_msg_len));
13297c478bd9Sstevel@tonic-gate } while (srchp != NULL && srchp->h_addr_list[++i] != NULL);
13307c478bd9Sstevel@tonic-gate return;
13317c478bd9Sstevel@tonic-gate }
13327c478bd9Sstevel@tonic-gate
1333f02131e0SVladimir Kotal /*
1334f02131e0SVladimir Kotal * Go through the list of all dst addresses, trying to find matching
1335f02131e0SVladimir Kotal * src address for each. If the first address is == dummy.he we will go
1336f02131e0SVladimir Kotal * through the loop just once. If any other hp is == dummy.he, then we
1337f02131e0SVladimir Kotal * don't have to apply any silly rules.
1338f02131e0SVladimir Kotal */
13397c478bd9Sstevel@tonic-gate for (i = 0; dsthp->h_addr_list[i] != NULL; i++) {
13407c478bd9Sstevel@tonic-gate if (dsthp == &dummy.he) {
13417c478bd9Sstevel@tonic-gate /* Just to be sure... */
13427c478bd9Sstevel@tonic-gate dsthp->h_addr_list[1] = NULL;
13437c478bd9Sstevel@tonic-gate } else {
13447c478bd9Sstevel@tonic-gate /*
13457c478bd9Sstevel@tonic-gate * Fill in the dst sockaddr.
13467c478bd9Sstevel@tonic-gate */
13477c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(dst + 1);
13487c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6));
13497c478bd9Sstevel@tonic-gate bcopy(dsthp->h_addr_list[i], &sin6->sin6_addr,
13507c478bd9Sstevel@tonic-gate sizeof (struct in6_addr));
13517c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6;
13527c478bd9Sstevel@tonic-gate sin6->sin6_port = htons(dstport);
13537c478bd9Sstevel@tonic-gate }
13547c478bd9Sstevel@tonic-gate
1355f02131e0SVladimir Kotal last_dst = (dsthp->h_addr_list[i + 1] == NULL);
1356f02131e0SVladimir Kotal
13577c478bd9Sstevel@tonic-gate /*
13587c478bd9Sstevel@tonic-gate * Try and assign src, if there's any ambiguity.
13597c478bd9Sstevel@tonic-gate */
13607c478bd9Sstevel@tonic-gate if (!unspec_src && srchp != &dummy.he) {
13617c478bd9Sstevel@tonic-gate if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
13627c478bd9Sstevel@tonic-gate /*
13637c478bd9Sstevel@tonic-gate * IPv4 address. Find an IPv4 address, then
13647c478bd9Sstevel@tonic-gate * keep looking for a second one. If a second
13657c478bd9Sstevel@tonic-gate * exists, print a message, and fill in the
13667c478bd9Sstevel@tonic-gate * unspecified address.
13677c478bd9Sstevel@tonic-gate */
13687c478bd9Sstevel@tonic-gate first_match = NULL;
13697c478bd9Sstevel@tonic-gate
13707c478bd9Sstevel@tonic-gate for (walker = srchp->h_addr_list;
13717c478bd9Sstevel@tonic-gate *walker != NULL; walker++) {
13727c478bd9Sstevel@tonic-gate /* LINTED E_BAD_PTR_CAST_ALIGN */
13737c478bd9Sstevel@tonic-gate if (IN6_IS_ADDR_V4MAPPED(
13747c478bd9Sstevel@tonic-gate (struct in6_addr *)*walker)) {
13757c478bd9Sstevel@tonic-gate if (first_match != NULL)
13767c478bd9Sstevel@tonic-gate break;
13777c478bd9Sstevel@tonic-gate else
13787c478bd9Sstevel@tonic-gate first_match = *walker;
13797c478bd9Sstevel@tonic-gate }
13807c478bd9Sstevel@tonic-gate }
13817c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(src + 1);
13827c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6));
13837c478bd9Sstevel@tonic-gate
13847c478bd9Sstevel@tonic-gate if (first_match == NULL) {
13857c478bd9Sstevel@tonic-gate /*
1386f02131e0SVladimir Kotal * No IPv4 hits. Is this the last
1387f02131e0SVladimir Kotal * destination address in the list ?
13887c478bd9Sstevel@tonic-gate */
1389f02131e0SVladimir Kotal ERROR1(ep, ebuf, gettext(
13907c478bd9Sstevel@tonic-gate "No IPv4 source address "
1391e3320f40Smarkfen "for name %s.\n"), srchp->h_name);
1392f02131e0SVladimir Kotal if (last_dst) {
1393f02131e0SVladimir Kotal FATAL(ep, ebuf, gettext(
1394f02131e0SVladimir Kotal "No match for destination "
1395e3320f40Smarkfen "IP address.\n"));
13967c478bd9Sstevel@tonic-gate } else {
13977c478bd9Sstevel@tonic-gate /* Continue, but do I print? */
13987c478bd9Sstevel@tonic-gate continue; /* for loop */
13997c478bd9Sstevel@tonic-gate }
14007c478bd9Sstevel@tonic-gate
14017c478bd9Sstevel@tonic-gate /* I should never reach here. */
14027c478bd9Sstevel@tonic-gate }
14037c478bd9Sstevel@tonic-gate
14047c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6;
14057c478bd9Sstevel@tonic-gate sin6->sin6_port = htons(srcport);
14067c478bd9Sstevel@tonic-gate if (*walker != NULL) {
14077c478bd9Sstevel@tonic-gate /*
14087c478bd9Sstevel@tonic-gate * Early loop exit. It must've been
14097c478bd9Sstevel@tonic-gate * multiple hits...
14107c478bd9Sstevel@tonic-gate *
14117c478bd9Sstevel@tonic-gate * Issue a null-source warning?
14127c478bd9Sstevel@tonic-gate */
1413e3320f40Smarkfen WARN1(ep, ebuf, gettext(
14147c478bd9Sstevel@tonic-gate "Multiple IPv4 source addresses "
14157c478bd9Sstevel@tonic-gate "for %s, using unspecified source "
14167c478bd9Sstevel@tonic-gate "instead."), srchp->h_name);
14177c478bd9Sstevel@tonic-gate } else {
14187c478bd9Sstevel@tonic-gate /*
14197c478bd9Sstevel@tonic-gate * If I reach here w/o hitting the
14207c478bd9Sstevel@tonic-gate * previous if statements, I have a
14217c478bd9Sstevel@tonic-gate * single source address for this
14227c478bd9Sstevel@tonic-gate * destination.
14237c478bd9Sstevel@tonic-gate */
14247c478bd9Sstevel@tonic-gate bcopy(first_match, &sin6->sin6_addr,
14257c478bd9Sstevel@tonic-gate sizeof (struct in6_addr));
14267c478bd9Sstevel@tonic-gate }
14277c478bd9Sstevel@tonic-gate } else {
14287c478bd9Sstevel@tonic-gate /*
14297c478bd9Sstevel@tonic-gate * IPv6 address. Find an IPv6 address.
14307c478bd9Sstevel@tonic-gate * Unlike IPv4 addresses, things can get a
14317c478bd9Sstevel@tonic-gate * little more sticky with scopes, etc.
14327c478bd9Sstevel@tonic-gate */
14337c478bd9Sstevel@tonic-gate int dst_scope, src_scope;
14347c478bd9Sstevel@tonic-gate
14357c478bd9Sstevel@tonic-gate dst_scope = ipv6_addr_scope(&sin6->sin6_addr);
14367c478bd9Sstevel@tonic-gate
14377c478bd9Sstevel@tonic-gate first_match = NULL;
14387c478bd9Sstevel@tonic-gate for (walker = srchp->h_addr_list;
14397c478bd9Sstevel@tonic-gate *walker != NULL; walker++) {
14407c478bd9Sstevel@tonic-gate /* LINTED E_BAD_PTR_CAST_ALIGN */
14417c478bd9Sstevel@tonic-gate if (!IN6_IS_ADDR_V4MAPPED(
14427c478bd9Sstevel@tonic-gate (struct in6_addr *)*walker)) {
14437c478bd9Sstevel@tonic-gate /*
14447c478bd9Sstevel@tonic-gate * Set first-match, etc.
14457c478bd9Sstevel@tonic-gate * Take into account scopes,
14467c478bd9Sstevel@tonic-gate * and other IPv6 thingies.
14477c478bd9Sstevel@tonic-gate */
14487c478bd9Sstevel@tonic-gate src_scope = ipv6_addr_scope(
14497c478bd9Sstevel@tonic-gate /* LINTED E_BAD_PTR_CAST */
14507c478bd9Sstevel@tonic-gate (struct in6_addr *)*walker);
14517c478bd9Sstevel@tonic-gate if (src_scope == SCOPE_UNSPEC ||
14527c478bd9Sstevel@tonic-gate src_scope == dst_scope) {
14537c478bd9Sstevel@tonic-gate if (first_match !=
14547c478bd9Sstevel@tonic-gate NULL)
14557c478bd9Sstevel@tonic-gate break;
14567c478bd9Sstevel@tonic-gate else
14577c478bd9Sstevel@tonic-gate first_match =
14587c478bd9Sstevel@tonic-gate *walker;
14597c478bd9Sstevel@tonic-gate }
14607c478bd9Sstevel@tonic-gate }
14617c478bd9Sstevel@tonic-gate }
14627c478bd9Sstevel@tonic-gate
14637c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(src + 1);
14647c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6));
14657c478bd9Sstevel@tonic-gate sin6->sin6_port = htons(srcport);
14667c478bd9Sstevel@tonic-gate if (first_match == NULL) {
14677c478bd9Sstevel@tonic-gate /*
1468f02131e0SVladimir Kotal * No IPv6 hits. Is this the last
1469f02131e0SVladimir Kotal * destination address in the list ?
14707c478bd9Sstevel@tonic-gate */
1471f02131e0SVladimir Kotal ERROR1(ep, ebuf, gettext(
14727c478bd9Sstevel@tonic-gate "No IPv6 source address of "
1473e3320f40Smarkfen "matching scope for name %s.\n"),
14747c478bd9Sstevel@tonic-gate srchp->h_name);
1475f02131e0SVladimir Kotal if (last_dst) {
1476f02131e0SVladimir Kotal FATAL(ep, ebuf, gettext(
1477f02131e0SVladimir Kotal "No match for IPV6 "
1478e3320f40Smarkfen "destination "
1479e3320f40Smarkfen "address.\n"));
14807c478bd9Sstevel@tonic-gate } else {
14817c478bd9Sstevel@tonic-gate /* Continue, but do I print? */
14827c478bd9Sstevel@tonic-gate continue; /* for loop */
14837c478bd9Sstevel@tonic-gate }
14847c478bd9Sstevel@tonic-gate
14857c478bd9Sstevel@tonic-gate /* I should never reach here. */
14867c478bd9Sstevel@tonic-gate }
14877c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6;
14887c478bd9Sstevel@tonic-gate if (*walker != NULL) {
14897c478bd9Sstevel@tonic-gate /*
14907c478bd9Sstevel@tonic-gate * Early loop exit. Issue a
14917c478bd9Sstevel@tonic-gate * null-source warning?
14927c478bd9Sstevel@tonic-gate */
1493e3320f40Smarkfen WARN1(ep, ebuf, gettext(
14947c478bd9Sstevel@tonic-gate "Multiple IPv6 source addresses "
14957c478bd9Sstevel@tonic-gate "for %s of the same scope, using "
1496e3320f40Smarkfen "unspecified source instead.\n"),
14977c478bd9Sstevel@tonic-gate srchp->h_name);
14987c478bd9Sstevel@tonic-gate } else {
14997c478bd9Sstevel@tonic-gate /*
15007c478bd9Sstevel@tonic-gate * If I reach here w/o hitting the
15017c478bd9Sstevel@tonic-gate * previous if statements, I have a
15027c478bd9Sstevel@tonic-gate * single source address for this
15037c478bd9Sstevel@tonic-gate * destination.
15047c478bd9Sstevel@tonic-gate */
15057c478bd9Sstevel@tonic-gate bcopy(first_match, &sin6->sin6_addr,
15067c478bd9Sstevel@tonic-gate sizeof (struct in6_addr));
15077c478bd9Sstevel@tonic-gate }
15087c478bd9Sstevel@tonic-gate }
15097c478bd9Sstevel@tonic-gate }
15107c478bd9Sstevel@tonic-gate
1511e3320f40Smarkfen /*
1512e3320f40Smarkfen * If there are errors at this point there is no
1513e3320f40Smarkfen * point sending anything to PF_KEY.
1514e3320f40Smarkfen */
1515e3320f40Smarkfen handle_errors(ep, ebuf, B_TRUE, B_FALSE);
1516e3320f40Smarkfen
15177c478bd9Sstevel@tonic-gate /* Save off a copy for later writing... */
15187c478bd9Sstevel@tonic-gate msgp = (struct sadb_msg *)buffer;
15197c478bd9Sstevel@tonic-gate bcopy(buffer, savebuf, SADB_64TO8(msgp->sadb_msg_len));
15207c478bd9Sstevel@tonic-gate
15217c478bd9Sstevel@tonic-gate rc = key_write(keysock, buffer, SADB_64TO8(msgp->sadb_msg_len));
15227c478bd9Sstevel@tonic-gate if (rc == -1)
15237c478bd9Sstevel@tonic-gate Bail("write() to PF_KEY socket (in doaddresses)");
15247c478bd9Sstevel@tonic-gate
15259c2c14abSThejaswini Singarajipura if (in_cluster_mode) {
15269c2c14abSThejaswini Singarajipura (void) sendto(cluster_socket, buffer,
15279c2c14abSThejaswini Singarajipura SADB_64TO8(msgp->sadb_msg_len), 0,
15289c2c14abSThejaswini Singarajipura (struct sockaddr *)&cli_addr,
15299c2c14abSThejaswini Singarajipura sizeof (cli_addr));
15309c2c14abSThejaswini Singarajipura }
15317c478bd9Sstevel@tonic-gate /* Blank the key for paranoia's sake. */
15327c478bd9Sstevel@tonic-gate bzero(buffer, buffer_size);
15337c478bd9Sstevel@tonic-gate time_critical_enter();
15347c478bd9Sstevel@tonic-gate do {
15357c478bd9Sstevel@tonic-gate rc = read(keysock, buffer, buffer_size);
15367c478bd9Sstevel@tonic-gate if (rc == -1)
15377c478bd9Sstevel@tonic-gate Bail("read (in doaddresses)");
15387c478bd9Sstevel@tonic-gate } while (msgp->sadb_msg_seq != seq ||
15397c478bd9Sstevel@tonic-gate msgp->sadb_msg_pid != mypid);
15407c478bd9Sstevel@tonic-gate time_critical_exit();
15417c478bd9Sstevel@tonic-gate
15427c478bd9Sstevel@tonic-gate /*
15437c478bd9Sstevel@tonic-gate * I should _never_ hit the following unless:
15447c478bd9Sstevel@tonic-gate *
15457c478bd9Sstevel@tonic-gate * 1. There is a kernel bug.
15467c478bd9Sstevel@tonic-gate * 2. Another process is mistakenly using my pid in a PF_KEY
15477c478bd9Sstevel@tonic-gate * message.
15487c478bd9Sstevel@tonic-gate */
15497c478bd9Sstevel@tonic-gate if (msgp->sadb_msg_type != sadb_msg_type ||
15507c478bd9Sstevel@tonic-gate msgp->sadb_msg_satype != sadb_msg_satype) {
15517c478bd9Sstevel@tonic-gate syslog((LOG_NOTICE|LOG_AUTH), gettext(
15527c478bd9Sstevel@tonic-gate "doaddresses: Unexpected returned message "
15537c478bd9Sstevel@tonic-gate "(%d exp %d)\n"), msgp->sadb_msg_type,
15547c478bd9Sstevel@tonic-gate sadb_msg_type);
15557c478bd9Sstevel@tonic-gate Bail("doaddresses: Unexpected returned message");
15567c478bd9Sstevel@tonic-gate }
15577c478bd9Sstevel@tonic-gate
15587c478bd9Sstevel@tonic-gate if (msgp->sadb_msg_errno != 0) {
15597c478bd9Sstevel@tonic-gate char addrprint[INET6_ADDRSTRLEN];
15607c478bd9Sstevel@tonic-gate int on_errno = 0;
15617c478bd9Sstevel@tonic-gate char *on_errno_msg;
15627c478bd9Sstevel@tonic-gate
15637c478bd9Sstevel@tonic-gate /*
15647c478bd9Sstevel@tonic-gate * Print different error messages depending
15657c478bd9Sstevel@tonic-gate * on the SADB message type being processed.
15667c478bd9Sstevel@tonic-gate * If we get a ESRCH error for a GET/DELETE
15677c478bd9Sstevel@tonic-gate * messages, we report that the SA does not
15687c478bd9Sstevel@tonic-gate * exist. If we get a EEXIST error for a
15697c478bd9Sstevel@tonic-gate * ADD/UPDATE message, we report that the
15707c478bd9Sstevel@tonic-gate * SA already exists.
15717c478bd9Sstevel@tonic-gate */
15727c478bd9Sstevel@tonic-gate if (sadb_msg_type == SADB_GET ||
15737c478bd9Sstevel@tonic-gate sadb_msg_type == SADB_DELETE) {
15747c478bd9Sstevel@tonic-gate on_errno = ESRCH;
15757c478bd9Sstevel@tonic-gate on_errno_msg = "does not exist";
15767c478bd9Sstevel@tonic-gate } else if (sadb_msg_type == SADB_ADD ||
15777c478bd9Sstevel@tonic-gate sadb_msg_type == SADB_UPDATE) {
15787c478bd9Sstevel@tonic-gate on_errno = EEXIST;
15797c478bd9Sstevel@tonic-gate on_errno_msg = "already exists";
15807c478bd9Sstevel@tonic-gate }
15817c478bd9Sstevel@tonic-gate
15827c478bd9Sstevel@tonic-gate errno = msgp->sadb_msg_errno;
15837c478bd9Sstevel@tonic-gate if (errno == on_errno) {
1584e3320f40Smarkfen ERROR2(ep, ebuf, gettext(
1585e3320f40Smarkfen "Association (type = %s) "
1586e3320f40Smarkfen "with spi 0x%x and addr\n"),
15877c478bd9Sstevel@tonic-gate rparsesatype(msgp->sadb_msg_satype),
1588e3320f40Smarkfen ntohl(spi));
1589e3320f40Smarkfen ERROR2(ep, ebuf, "%s %s.\n",
15907c478bd9Sstevel@tonic-gate do_inet_ntop(dsthp->h_addr_list[i],
159125e435e0Spwernau addrprint, sizeof (addrprint)),
15927c478bd9Sstevel@tonic-gate on_errno_msg);
15937c478bd9Sstevel@tonic-gate msgp = (struct sadb_msg *)savebuf;
15947c478bd9Sstevel@tonic-gate bcopy(savebuf, buffer,
15957c478bd9Sstevel@tonic-gate SADB_64TO8(msgp->sadb_msg_len));
15967c478bd9Sstevel@tonic-gate continue;
15977c478bd9Sstevel@tonic-gate } else {
159838d95a78Smarkfen if (errno == EINVAL || errno == ESRCH) {
1599e3320f40Smarkfen ERROR2(ep, ebuf, gettext(
1600e3320f40Smarkfen "PF_KEY Diagnostic code %u: %s.\n"),
1601e3320f40Smarkfen msgp->sadb_x_msg_diagnostic,
1602e3320f40Smarkfen keysock_diag(
1603e3320f40Smarkfen msgp->sadb_x_msg_diagnostic));
1604e3320f40Smarkfen } else {
1605e3320f40Smarkfen Bail("return message (in doaddresses)");
16067c478bd9Sstevel@tonic-gate }
16077c478bd9Sstevel@tonic-gate }
16087c478bd9Sstevel@tonic-gate }
1609e3320f40Smarkfen
16107c478bd9Sstevel@tonic-gate if (cmd == CMD_GET) {
16118810c16bSdanmcd if (msgp->sadb_msg_len > MAX_GET_SIZE) {
1612e3320f40Smarkfen WARN1(ep, ebuf, gettext("WARNING: "
1613e3320f40Smarkfen "SA information bigger than %d bytes.\n"),
16148810c16bSdanmcd SADB_64TO8(MAX_GET_SIZE));
16157c478bd9Sstevel@tonic-gate }
1616bb3ed8dfSpwernau print_samsg(stdout, buffer, B_FALSE, vflag, nflag);
16177c478bd9Sstevel@tonic-gate }
16187c478bd9Sstevel@tonic-gate
1619e3320f40Smarkfen handle_errors(ep, ebuf, B_TRUE, B_FALSE);
1620e3320f40Smarkfen
16217c478bd9Sstevel@tonic-gate /* ...and then restore the saved buffer. */
16227c478bd9Sstevel@tonic-gate msgp = (struct sadb_msg *)savebuf;
16237c478bd9Sstevel@tonic-gate bcopy(savebuf, buffer, SADB_64TO8(msgp->sadb_msg_len));
1624e3320f40Smarkfen lines_added++;
16257c478bd9Sstevel@tonic-gate }
16267c478bd9Sstevel@tonic-gate
16277c478bd9Sstevel@tonic-gate /* Degenerate case, h_addr_list[0] == NULL. */
16287c478bd9Sstevel@tonic-gate if (i == 0)
16297c478bd9Sstevel@tonic-gate Bail("Empty destination address list");
1630e3320f40Smarkfen
1631e3320f40Smarkfen /*
1632e3320f40Smarkfen * free(ebuf) even if there are no errors.
1633e3320f40Smarkfen * handle_errors() won't return here.
1634e3320f40Smarkfen */
1635e3320f40Smarkfen handle_errors(ep, ebuf, B_TRUE, B_TRUE);
16367c478bd9Sstevel@tonic-gate }
16377c478bd9Sstevel@tonic-gate
16387c478bd9Sstevel@tonic-gate /*
16397c478bd9Sstevel@tonic-gate * Perform an add or an update. ADD and UPDATE are similar in the extensions
16407c478bd9Sstevel@tonic-gate * they need.
16417c478bd9Sstevel@tonic-gate */
16427c478bd9Sstevel@tonic-gate static void
doaddup(int cmd,int satype,char * argv[],char * ebuf)1643e3320f40Smarkfen doaddup(int cmd, int satype, char *argv[], char *ebuf)
16447c478bd9Sstevel@tonic-gate {
16457c478bd9Sstevel@tonic-gate uint64_t *buffer, *nexthdr;
16467c478bd9Sstevel@tonic-gate struct sadb_msg msg;
16477c478bd9Sstevel@tonic-gate struct sadb_sa *assoc = NULL;
164838d95a78Smarkfen struct sadb_x_pair *sadb_pair = NULL;
16498810c16bSdanmcd struct sadb_address *src = NULL, *dst = NULL;
16508810c16bSdanmcd struct sadb_address *isrc = NULL, *idst = NULL;
16517c478bd9Sstevel@tonic-gate struct sadb_address *natt_local = NULL, *natt_remote = NULL;
16527c478bd9Sstevel@tonic-gate struct sadb_key *encrypt = NULL, *auth = NULL;
16537c478bd9Sstevel@tonic-gate struct sadb_ident *srcid = NULL, *dstid = NULL;
16547c478bd9Sstevel@tonic-gate struct sadb_lifetime *hard = NULL, *soft = NULL; /* Current? */
16559c2c14abSThejaswini Singarajipura struct sadb_lifetime *idle = NULL;
16569c2c14abSThejaswini Singarajipura struct sadb_x_replay_ctr *replay_ctr = NULL;
16575d3b8cb7SBill Sommerfeld struct sadb_sens *label = NULL, *olabel = NULL;
16587c478bd9Sstevel@tonic-gate struct sockaddr_in6 *sin6;
16597c478bd9Sstevel@tonic-gate /* MLS TODO: Need sensitivity eventually. */
16608810c16bSdanmcd int next, token, sa_len, alloclen, totallen = sizeof (msg), prefix;
1661a050d7e9Spwernau uint32_t spi = 0;
1662628b0c67SMark Fenwick uint_t reserved_bits = 0;
166338d95a78Smarkfen uint8_t sadb_msg_type;
16648810c16bSdanmcd char *thiscmd, *pstr;
16658810c16bSdanmcd boolean_t readstate = B_FALSE, unspec_src = B_FALSE;
16668810c16bSdanmcd boolean_t alloc_inner = B_FALSE, use_natt = B_FALSE;
16678810c16bSdanmcd struct hostent *srchp = NULL, *dsthp = NULL, *isrchp = NULL,
16688810c16bSdanmcd *idsthp = NULL;
16697c478bd9Sstevel@tonic-gate struct hostent *natt_lhp = NULL, *natt_rhp = NULL;
16708810c16bSdanmcd uint16_t srcport = 0, dstport = 0, natt_lport = 0, natt_rport = 0,
16718810c16bSdanmcd isrcport = 0, idstport = 0;
16728810c16bSdanmcd uint8_t proto = 0, iproto = 0;
1673e3320f40Smarkfen char *ep = NULL;
16747c478bd9Sstevel@tonic-gate
167538d95a78Smarkfen switch (cmd) {
167638d95a78Smarkfen case CMD_ADD:
167738d95a78Smarkfen thiscmd = "add";
167838d95a78Smarkfen sadb_msg_type = SADB_ADD;
167938d95a78Smarkfen break;
168038d95a78Smarkfen case CMD_UPDATE:
168138d95a78Smarkfen thiscmd = "update";
168238d95a78Smarkfen sadb_msg_type = SADB_UPDATE;
168338d95a78Smarkfen break;
168438d95a78Smarkfen case CMD_UPDATE_PAIR:
168538d95a78Smarkfen thiscmd = "update-pair";
168638d95a78Smarkfen sadb_msg_type = SADB_X_UPDATEPAIR;
168738d95a78Smarkfen break;
168838d95a78Smarkfen }
16897c478bd9Sstevel@tonic-gate
169038d95a78Smarkfen msg_init(&msg, sadb_msg_type, (uint8_t)satype);
16917c478bd9Sstevel@tonic-gate /* Assume last element in argv is set to NULL. */
16927c478bd9Sstevel@tonic-gate do {
16937c478bd9Sstevel@tonic-gate token = parseextval(*argv, &next);
16947c478bd9Sstevel@tonic-gate argv++;
16957c478bd9Sstevel@tonic-gate switch (token) {
16967c478bd9Sstevel@tonic-gate case TOK_EOF:
16977c478bd9Sstevel@tonic-gate /* Do nothing, I'm done. */
16987c478bd9Sstevel@tonic-gate break;
16997c478bd9Sstevel@tonic-gate case TOK_UNKNOWN:
1700e3320f40Smarkfen ERROR1(ep, ebuf, gettext(
1701e3320f40Smarkfen "Unknown extension field \"%s\" \n"), *(argv - 1));
17027c478bd9Sstevel@tonic-gate break;
17037c478bd9Sstevel@tonic-gate case TOK_SPI:
170438d95a78Smarkfen case TOK_PAIR_SPI:
17057c478bd9Sstevel@tonic-gate case TOK_REPLAY:
17067c478bd9Sstevel@tonic-gate case TOK_STATE:
17077c478bd9Sstevel@tonic-gate case TOK_AUTHALG:
17087c478bd9Sstevel@tonic-gate case TOK_ENCRALG:
17097c478bd9Sstevel@tonic-gate case TOK_ENCAP:
17107c478bd9Sstevel@tonic-gate /*
17117c478bd9Sstevel@tonic-gate * May want to place this chunk of code in a function.
17127c478bd9Sstevel@tonic-gate *
17137c478bd9Sstevel@tonic-gate * This code checks for duplicate entries on a command
17147c478bd9Sstevel@tonic-gate * line.
17157c478bd9Sstevel@tonic-gate */
17167c478bd9Sstevel@tonic-gate
17177c478bd9Sstevel@tonic-gate /* Allocate the SADB_EXT_SA extension. */
17187c478bd9Sstevel@tonic-gate if (assoc == NULL) {
17197c478bd9Sstevel@tonic-gate assoc = malloc(sizeof (*assoc));
17207c478bd9Sstevel@tonic-gate if (assoc == NULL)
17217c478bd9Sstevel@tonic-gate Bail("malloc(assoc)");
17227c478bd9Sstevel@tonic-gate bzero(assoc, sizeof (*assoc));
17237c478bd9Sstevel@tonic-gate assoc->sadb_sa_exttype = SADB_EXT_SA;
17247c478bd9Sstevel@tonic-gate assoc->sadb_sa_len =
17257c478bd9Sstevel@tonic-gate SADB_8TO64(sizeof (*assoc));
17267c478bd9Sstevel@tonic-gate totallen += sizeof (*assoc);
17277c478bd9Sstevel@tonic-gate }
17287c478bd9Sstevel@tonic-gate switch (token) {
17297c478bd9Sstevel@tonic-gate case TOK_SPI:
17307c478bd9Sstevel@tonic-gate /*
1731a141dbd6SAlison C * If they type in "spi 0" then they
17327c478bd9Sstevel@tonic-gate * can type in another SPI.
17337c478bd9Sstevel@tonic-gate */
17347c478bd9Sstevel@tonic-gate if (assoc->sadb_sa_spi != 0) {
1735e3320f40Smarkfen ERROR(ep, ebuf, gettext(
1736e3320f40Smarkfen "Can only specify "
1737e3320f40Smarkfen "single SPI value.\n"));
1738e3320f40Smarkfen break;
17397c478bd9Sstevel@tonic-gate }
17407c478bd9Sstevel@tonic-gate /* Must convert SPI to network order! */
17417c478bd9Sstevel@tonic-gate assoc->sadb_sa_spi =
1742e3320f40Smarkfen htonl((uint32_t)parsenum(*argv, B_TRUE,
1743e3320f40Smarkfen ebuf));
1744e3320f40Smarkfen if (assoc->sadb_sa_spi == 0) {
1745e3320f40Smarkfen ERROR(ep, ebuf, gettext(
1746e3320f40Smarkfen "Invalid SPI value \"0\" .\n"));
1747e3320f40Smarkfen }
17487c478bd9Sstevel@tonic-gate break;
174938d95a78Smarkfen case TOK_PAIR_SPI:
175038d95a78Smarkfen if (cmd == CMD_UPDATE_PAIR) {
175138d95a78Smarkfen ERROR(ep, ebuf, gettext(
175238d95a78Smarkfen "pair-spi can not be used with the "
175338d95a78Smarkfen "\"update-pair\" command.\n"));
175438d95a78Smarkfen }
175538d95a78Smarkfen if (sadb_pair == NULL) {
175638d95a78Smarkfen sadb_pair = malloc(sizeof (*sadb_pair));
175738d95a78Smarkfen if (assoc == NULL)
175838d95a78Smarkfen Bail("malloc(assoc)");
175938d95a78Smarkfen bzero(sadb_pair, sizeof (*sadb_pair));
176038d95a78Smarkfen totallen += sizeof (*sadb_pair);
176138d95a78Smarkfen }
176238d95a78Smarkfen if (sadb_pair->sadb_x_pair_spi != 0) {
176338d95a78Smarkfen ERROR(ep, ebuf, gettext(
176438d95a78Smarkfen "Can only specify "
176538d95a78Smarkfen "single pair SPI value.\n"));
176638d95a78Smarkfen break;
176738d95a78Smarkfen }
176838d95a78Smarkfen /* Must convert SPI to network order! */
176938d95a78Smarkfen sadb_pair->sadb_x_pair_len =
177038d95a78Smarkfen SADB_8TO64(sizeof (*sadb_pair));
177138d95a78Smarkfen sadb_pair->sadb_x_pair_exttype =
177238d95a78Smarkfen SADB_X_EXT_PAIR;
177338d95a78Smarkfen sadb_pair->sadb_x_pair_spi =
177438d95a78Smarkfen htonl((uint32_t)parsenum(*argv, B_TRUE,
177538d95a78Smarkfen ebuf));
177638d95a78Smarkfen if (sadb_pair->sadb_x_pair_spi == 0) {
177738d95a78Smarkfen ERROR(ep, ebuf, gettext(
177838d95a78Smarkfen "Invalid SPI value \"0\" .\n"));
177938d95a78Smarkfen }
178038d95a78Smarkfen assoc->sadb_sa_flags |=
178138d95a78Smarkfen SADB_X_SAFLAGS_PAIRED;
178238d95a78Smarkfen break;
17837c478bd9Sstevel@tonic-gate case TOK_REPLAY:
17847c478bd9Sstevel@tonic-gate /*
17857c478bd9Sstevel@tonic-gate * That same cretin can do the same with
17867c478bd9Sstevel@tonic-gate * replay.
17877c478bd9Sstevel@tonic-gate */
17887c478bd9Sstevel@tonic-gate if (assoc->sadb_sa_replay != 0) {
1789e3320f40Smarkfen ERROR(ep, ebuf, gettext(
1790e3320f40Smarkfen "Can only specify "
1791e3320f40Smarkfen "single replay window size.\n"));
1792e3320f40Smarkfen break;
17937c478bd9Sstevel@tonic-gate }
17947c478bd9Sstevel@tonic-gate assoc->sadb_sa_replay =
1795e3320f40Smarkfen (uint8_t)parsenum(*argv, B_TRUE, ebuf);
17967c478bd9Sstevel@tonic-gate if (assoc->sadb_sa_replay != 0) {
1797e3320f40Smarkfen WARN(ep, ebuf, gettext(
17987c478bd9Sstevel@tonic-gate "WARNING: Replay with manual"
1799e3320f40Smarkfen " keying considered harmful.\n"));
18007c478bd9Sstevel@tonic-gate }
18017c478bd9Sstevel@tonic-gate break;
18027c478bd9Sstevel@tonic-gate case TOK_STATE:
18037c478bd9Sstevel@tonic-gate /*
18047c478bd9Sstevel@tonic-gate * 0 is an actual state value, LARVAL. This
18057c478bd9Sstevel@tonic-gate * means that one can type in the larval state
18067c478bd9Sstevel@tonic-gate * and then type in another state on the same
18077c478bd9Sstevel@tonic-gate * command line.
18087c478bd9Sstevel@tonic-gate */
18097c478bd9Sstevel@tonic-gate if (assoc->sadb_sa_state != 0) {
1810e3320f40Smarkfen ERROR(ep, ebuf, gettext(
1811e3320f40Smarkfen "Can only specify "
1812e3320f40Smarkfen "single SA state.\n"));
1813e3320f40Smarkfen break;
18147c478bd9Sstevel@tonic-gate }
1815e3320f40Smarkfen assoc->sadb_sa_state = parsestate(*argv,
1816e3320f40Smarkfen ebuf);
18177c478bd9Sstevel@tonic-gate readstate = B_TRUE;
18187c478bd9Sstevel@tonic-gate break;
18197c478bd9Sstevel@tonic-gate case TOK_AUTHALG:
18207c478bd9Sstevel@tonic-gate if (assoc->sadb_sa_auth != 0) {
1821e3320f40Smarkfen ERROR(ep, ebuf, gettext(
1822e3320f40Smarkfen "Can only specify "
1823e3320f40Smarkfen "single auth algorithm.\n"));
1824e3320f40Smarkfen break;
18257c478bd9Sstevel@tonic-gate }
18267c478bd9Sstevel@tonic-gate assoc->sadb_sa_auth = parsealg(*argv,
1827e3320f40Smarkfen IPSEC_PROTO_AH, ebuf);
18287c478bd9Sstevel@tonic-gate break;
18297c478bd9Sstevel@tonic-gate case TOK_ENCRALG:
18308810c16bSdanmcd if (satype == SADB_SATYPE_AH) {
1831e3320f40Smarkfen ERROR(ep, ebuf, gettext("Cannot specify"
1832e3320f40Smarkfen " encryption with SA type ah.\n"));
1833e3320f40Smarkfen break;
18348810c16bSdanmcd }
18357c478bd9Sstevel@tonic-gate if (assoc->sadb_sa_encrypt != 0) {
1836e3320f40Smarkfen ERROR(ep, ebuf, gettext(
1837e3320f40Smarkfen "Can only specify "
1838e3320f40Smarkfen "single encryption algorithm.\n"));
1839e3320f40Smarkfen break;
18407c478bd9Sstevel@tonic-gate }
18417c478bd9Sstevel@tonic-gate assoc->sadb_sa_encrypt = parsealg(*argv,
1842e3320f40Smarkfen IPSEC_PROTO_ESP, ebuf);
18437c478bd9Sstevel@tonic-gate break;
18447c478bd9Sstevel@tonic-gate case TOK_ENCAP:
18457c478bd9Sstevel@tonic-gate if (use_natt) {
1846e3320f40Smarkfen ERROR(ep, ebuf, gettext(
1847e3320f40Smarkfen "Can only specify single"
1848e3320f40Smarkfen " encapsulation.\n"));
1849e3320f40Smarkfen break;
18507c478bd9Sstevel@tonic-gate }
18517c478bd9Sstevel@tonic-gate if (strncmp(*argv, "udp", 3)) {
1852e3320f40Smarkfen ERROR(ep, ebuf, gettext(
1853e3320f40Smarkfen "Can only specify udp"
1854e3320f40Smarkfen " encapsulation.\n"));
1855e3320f40Smarkfen break;
18567c478bd9Sstevel@tonic-gate }
18577c478bd9Sstevel@tonic-gate use_natt = B_TRUE;
18587c478bd9Sstevel@tonic-gate /* set assoc flags later */
18597c478bd9Sstevel@tonic-gate break;
18607c478bd9Sstevel@tonic-gate }
18617c478bd9Sstevel@tonic-gate argv++;
18627c478bd9Sstevel@tonic-gate break;
18637c478bd9Sstevel@tonic-gate case TOK_SRCPORT:
18647c478bd9Sstevel@tonic-gate if (srcport != 0) {
1865e3320f40Smarkfen ERROR(ep, ebuf, gettext("Can only specify "
1866e3320f40Smarkfen "single source port.\n"));
1867e3320f40Smarkfen break;
18687c478bd9Sstevel@tonic-gate }
1869e3320f40Smarkfen srcport = parsenum(*argv, B_TRUE, ebuf);
18707c478bd9Sstevel@tonic-gate argv++;
18717c478bd9Sstevel@tonic-gate break;
18727c478bd9Sstevel@tonic-gate case TOK_DSTPORT:
18737c478bd9Sstevel@tonic-gate if (dstport != 0) {
1874e3320f40Smarkfen ERROR(ep, ebuf, gettext("Can only specify "
1875e3320f40Smarkfen "single destination port.\n"));
1876e3320f40Smarkfen break;
18777c478bd9Sstevel@tonic-gate }
1878e3320f40Smarkfen dstport = parsenum(*argv, B_TRUE, ebuf);
18797c478bd9Sstevel@tonic-gate argv++;
18807c478bd9Sstevel@tonic-gate break;
18818810c16bSdanmcd case TOK_ISRCPORT:
18828810c16bSdanmcd alloc_inner = B_TRUE;
18838810c16bSdanmcd if (isrcport != 0) {
1884e3320f40Smarkfen ERROR(ep, ebuf, gettext(
1885e3320f40Smarkfen "Can only specify "
1886e3320f40Smarkfen "single inner-source port.\n"));
1887e3320f40Smarkfen break;
18888810c16bSdanmcd }
1889e3320f40Smarkfen isrcport = parsenum(*argv, B_TRUE, ebuf);
18908810c16bSdanmcd argv++;
18918810c16bSdanmcd break;
18928810c16bSdanmcd case TOK_IDSTPORT:
18938810c16bSdanmcd alloc_inner = B_TRUE;
18948810c16bSdanmcd if (idstport != 0) {
1895e3320f40Smarkfen ERROR(ep, ebuf, gettext(
1896e3320f40Smarkfen "Can only specify "
1897e3320f40Smarkfen "single inner-destination port.\n"));
1898e3320f40Smarkfen break;
18998810c16bSdanmcd }
1900e3320f40Smarkfen idstport = parsenum(*argv, B_TRUE, ebuf);
19018810c16bSdanmcd argv++;
19028810c16bSdanmcd break;
19037c478bd9Sstevel@tonic-gate case TOK_NATLPORT:
19047c478bd9Sstevel@tonic-gate if (natt_lport != 0) {
1905e3320f40Smarkfen ERROR(ep, ebuf, gettext(
1906e3320f40Smarkfen "Can only specify "
1907e3320f40Smarkfen "single NAT-T local port.\n"));
1908e3320f40Smarkfen break;
19097c478bd9Sstevel@tonic-gate }
1910e3320f40Smarkfen natt_lport = parsenum(*argv, B_TRUE, ebuf);
19117c478bd9Sstevel@tonic-gate argv++;
19127c478bd9Sstevel@tonic-gate break;
19137c478bd9Sstevel@tonic-gate case TOK_NATRPORT:
19147c478bd9Sstevel@tonic-gate if (natt_rport != 0) {
1915e3320f40Smarkfen ERROR(ep, ebuf, gettext(
1916e3320f40Smarkfen "Can only specify "
1917e3320f40Smarkfen "single NAT-T remote port.\n"));
1918e3320f40Smarkfen break;
19197c478bd9Sstevel@tonic-gate }
1920e3320f40Smarkfen natt_rport = parsenum(*argv, B_TRUE, ebuf);
19217c478bd9Sstevel@tonic-gate argv++;
19227c478bd9Sstevel@tonic-gate break;
19237c478bd9Sstevel@tonic-gate
19247c478bd9Sstevel@tonic-gate case TOK_PROTO:
19257c478bd9Sstevel@tonic-gate if (proto != 0) {
1926e3320f40Smarkfen ERROR(ep, ebuf, gettext(
1927e3320f40Smarkfen "Can only specify "
1928e3320f40Smarkfen "single protocol.\n"));
1929e3320f40Smarkfen break;
19307c478bd9Sstevel@tonic-gate }
1931e3320f40Smarkfen proto = parsenum(*argv, B_TRUE, ebuf);
19327c478bd9Sstevel@tonic-gate argv++;
19337c478bd9Sstevel@tonic-gate break;
19348810c16bSdanmcd case TOK_IPROTO:
19358810c16bSdanmcd alloc_inner = B_TRUE;
19368810c16bSdanmcd if (iproto != 0) {
1937e3320f40Smarkfen ERROR(ep, ebuf, gettext(
1938e3320f40Smarkfen "Can only specify "
1939e3320f40Smarkfen "single inner protocol.\n"));
1940e3320f40Smarkfen break;
19418810c16bSdanmcd }
1942e3320f40Smarkfen iproto = parsenum(*argv, B_TRUE, ebuf);
19438810c16bSdanmcd argv++;
19448810c16bSdanmcd break;
19457c478bd9Sstevel@tonic-gate case TOK_SRCADDR:
19467c478bd9Sstevel@tonic-gate case TOK_SRCADDR6:
19477c478bd9Sstevel@tonic-gate if (src != NULL) {
1948e3320f40Smarkfen ERROR(ep, ebuf, gettext(
1949e3320f40Smarkfen "Can only specify "
1950e3320f40Smarkfen "single source address.\n"));
1951e3320f40Smarkfen break;
19527c478bd9Sstevel@tonic-gate }
19537c478bd9Sstevel@tonic-gate sa_len = parseaddr(*argv, &srchp,
1954e3320f40Smarkfen (token == TOK_SRCADDR6), ebuf);
1955e3320f40Smarkfen if (srchp == NULL) {
1956e3320f40Smarkfen ERROR1(ep, ebuf, gettext(
1957e3320f40Smarkfen "Unknown src address \"%s\"\n"), *argv);
1958e3320f40Smarkfen break;
1959e3320f40Smarkfen }
19607c478bd9Sstevel@tonic-gate argv++;
19617c478bd9Sstevel@tonic-gate /*
19627c478bd9Sstevel@tonic-gate * Round of the sockaddr length to an 8 byte
19637c478bd9Sstevel@tonic-gate * boundary to make PF_KEY happy.
19647c478bd9Sstevel@tonic-gate */
19657c478bd9Sstevel@tonic-gate alloclen = sizeof (*src) + roundup(sa_len, 8);
19667c478bd9Sstevel@tonic-gate src = malloc(alloclen);
19677c478bd9Sstevel@tonic-gate if (src == NULL)
19687c478bd9Sstevel@tonic-gate Bail("malloc(src)");
19697c478bd9Sstevel@tonic-gate totallen += alloclen;
19707c478bd9Sstevel@tonic-gate src->sadb_address_len = SADB_8TO64(alloclen);
19717c478bd9Sstevel@tonic-gate src->sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
19727c478bd9Sstevel@tonic-gate src->sadb_address_reserved = 0;
19737c478bd9Sstevel@tonic-gate src->sadb_address_prefixlen = 0;
19747c478bd9Sstevel@tonic-gate src->sadb_address_proto = 0;
19757c478bd9Sstevel@tonic-gate if (srchp == &dummy.he) {
19767c478bd9Sstevel@tonic-gate /*
19777c478bd9Sstevel@tonic-gate * Single address with -n flag.
19787c478bd9Sstevel@tonic-gate */
19797c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(src + 1);
19807c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6));
19817c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6;
19827c478bd9Sstevel@tonic-gate bcopy(srchp->h_addr_list[0], &sin6->sin6_addr,
19837c478bd9Sstevel@tonic-gate sizeof (struct in6_addr));
19847c478bd9Sstevel@tonic-gate }
19857c478bd9Sstevel@tonic-gate break;
19867c478bd9Sstevel@tonic-gate case TOK_DSTADDR:
19877c478bd9Sstevel@tonic-gate case TOK_DSTADDR6:
19887c478bd9Sstevel@tonic-gate if (dst != NULL) {
1989e3320f40Smarkfen ERROR(ep, ebuf, gettext(
1990e3320f40Smarkfen "Can only specify single "
1991e3320f40Smarkfen "destination address.\n"));
1992e3320f40Smarkfen break;
19937c478bd9Sstevel@tonic-gate }
19947c478bd9Sstevel@tonic-gate sa_len = parseaddr(*argv, &dsthp,
1995e3320f40Smarkfen (token == TOK_DSTADDR6), ebuf);
1996e3320f40Smarkfen if (dsthp == NULL) {
1997e3320f40Smarkfen ERROR1(ep, ebuf, gettext(
1998e3320f40Smarkfen "Unknown dst address \"%s\"\n"), *argv);
1999e3320f40Smarkfen break;
2000e3320f40Smarkfen }
20017c478bd9Sstevel@tonic-gate argv++;
20027c478bd9Sstevel@tonic-gate alloclen = sizeof (*dst) + roundup(sa_len, 8);
20037c478bd9Sstevel@tonic-gate dst = malloc(alloclen);
20047c478bd9Sstevel@tonic-gate if (dst == NULL)
20057c478bd9Sstevel@tonic-gate Bail("malloc(dst)");
20067c478bd9Sstevel@tonic-gate totallen += alloclen;
20077c478bd9Sstevel@tonic-gate dst->sadb_address_len = SADB_8TO64(alloclen);
20087c478bd9Sstevel@tonic-gate dst->sadb_address_exttype = SADB_EXT_ADDRESS_DST;
20097c478bd9Sstevel@tonic-gate dst->sadb_address_reserved = 0;
20107c478bd9Sstevel@tonic-gate dst->sadb_address_prefixlen = 0;
20117c478bd9Sstevel@tonic-gate dst->sadb_address_proto = 0;
20127c478bd9Sstevel@tonic-gate if (dsthp == &dummy.he) {
20137c478bd9Sstevel@tonic-gate /*
20147c478bd9Sstevel@tonic-gate * Single address with -n flag.
20157c478bd9Sstevel@tonic-gate */
20167c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(dst + 1);
20177c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6));
20187c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6;
20197c478bd9Sstevel@tonic-gate bcopy(dsthp->h_addr_list[0], &sin6->sin6_addr,
20207c478bd9Sstevel@tonic-gate sizeof (struct in6_addr));
20217c478bd9Sstevel@tonic-gate }
20227c478bd9Sstevel@tonic-gate break;
20237c478bd9Sstevel@tonic-gate case TOK_PROXYADDR:
20247c478bd9Sstevel@tonic-gate case TOK_PROXYADDR6:
20258810c16bSdanmcd if (isrc != NULL) {
2026e3320f40Smarkfen ERROR(ep, ebuf, gettext(
2027e3320f40Smarkfen "Can only specify single "
2028e3320f40Smarkfen "proxy/inner-source address.\n"));
2029e3320f40Smarkfen break;
20307c478bd9Sstevel@tonic-gate }
20318810c16bSdanmcd if ((pstr = strchr(*argv, '/')) != NULL) {
20328810c16bSdanmcd /* Parse out the prefix. */
20338810c16bSdanmcd errno = 0;
20348810c16bSdanmcd prefix = strtol(pstr + 1, NULL, 10);
20358810c16bSdanmcd if (errno != 0) {
2036e3320f40Smarkfen ERROR1(ep, ebuf, gettext(
2037e3320f40Smarkfen "Invalid prefix %s."), pstr);
2038e3320f40Smarkfen break;
20398810c16bSdanmcd }
20408810c16bSdanmcd /* Recycle pstr */
20418810c16bSdanmcd alloclen = (int)(pstr - *argv);
20428810c16bSdanmcd pstr = malloc(alloclen + 1);
20438810c16bSdanmcd if (pstr == NULL) {
20448810c16bSdanmcd Bail("malloc(pstr)");
20458810c16bSdanmcd }
20468810c16bSdanmcd (void) strlcpy(pstr, *argv, alloclen + 1);
20478810c16bSdanmcd } else {
20488810c16bSdanmcd pstr = *argv;
20498810c16bSdanmcd /*
20508810c16bSdanmcd * Assume mapping to AF_INET6, and we're a host.
20518810c16bSdanmcd * XXX some miscreants may still make classful
20528810c16bSdanmcd * assumptions. If this is a problem, fix it
20538810c16bSdanmcd * here.
20548810c16bSdanmcd */
20558810c16bSdanmcd prefix = 128;
20568810c16bSdanmcd }
20578810c16bSdanmcd sa_len = parseaddr(pstr, &isrchp,
2058e3320f40Smarkfen (token == TOK_PROXYADDR6), ebuf);
2059e3320f40Smarkfen if (isrchp == NULL) {
2060e3320f40Smarkfen ERROR1(ep, ebuf, gettext(
2061e3320f40Smarkfen "Unknown proxy/inner-source address "
2062e3320f40Smarkfen "\"%s\"\n"), *argv);
2063e3320f40Smarkfen break;
2064e3320f40Smarkfen }
20658810c16bSdanmcd if (pstr != *argv)
20668810c16bSdanmcd free(pstr);
20677c478bd9Sstevel@tonic-gate argv++;
20688810c16bSdanmcd alloclen = sizeof (*isrc) + roundup(sa_len, 8);
20698810c16bSdanmcd isrc = malloc(alloclen);
20708810c16bSdanmcd if (isrc == NULL)
20718810c16bSdanmcd Bail("malloc(isrc)");
20727c478bd9Sstevel@tonic-gate totallen += alloclen;
20738810c16bSdanmcd isrc->sadb_address_len = SADB_8TO64(alloclen);
20748810c16bSdanmcd isrc->sadb_address_exttype = SADB_EXT_ADDRESS_PROXY;
20758810c16bSdanmcd isrc->sadb_address_reserved = 0;
20768810c16bSdanmcd isrc->sadb_address_prefixlen = prefix;
20778810c16bSdanmcd isrc->sadb_address_proto = 0;
20788810c16bSdanmcd if (isrchp == &dummy.he ||
20798810c16bSdanmcd isrchp->h_addr_list[1] == NULL) {
20807c478bd9Sstevel@tonic-gate /*
20817c478bd9Sstevel@tonic-gate * Single address with -n flag or single name.
20827c478bd9Sstevel@tonic-gate */
20838810c16bSdanmcd sin6 = (struct sockaddr_in6 *)(isrc + 1);
20847c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6));
20857c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6;
20868810c16bSdanmcd bcopy(isrchp->h_addr_list[0], &sin6->sin6_addr,
20877c478bd9Sstevel@tonic-gate sizeof (struct in6_addr));
20888810c16bSdanmcd /*
20898810c16bSdanmcd * normalize prefixlen for IPv4-mapped
20908810c16bSdanmcd * addresses.
20918810c16bSdanmcd */
20928810c16bSdanmcd if (prefix <= 32 &&
20938810c16bSdanmcd IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr))
20948810c16bSdanmcd isrc->sadb_address_prefixlen += 96;
20958810c16bSdanmcd alloc_inner = B_TRUE;
20967c478bd9Sstevel@tonic-gate } else {
20977c478bd9Sstevel@tonic-gate /*
20988810c16bSdanmcd * If the proxy/isrc address is vague, don't
20998810c16bSdanmcd * bother.
21007c478bd9Sstevel@tonic-gate */
21017c478bd9Sstevel@tonic-gate totallen -= alloclen;
21028810c16bSdanmcd free(isrc);
21038810c16bSdanmcd isrc = NULL;
2104e3320f40Smarkfen WARN1(ep, ebuf, gettext(
2105e3320f40Smarkfen "Proxy/inner-source address %s "
2106e3320f40Smarkfen "is vague, not using.\n"), isrchp->h_name);
21078810c16bSdanmcd freehostent(isrchp);
21088810c16bSdanmcd isrchp = NULL;
2109e3320f40Smarkfen break;
21108810c16bSdanmcd }
21118810c16bSdanmcd break;
21128810c16bSdanmcd case TOK_IDSTADDR:
21138810c16bSdanmcd case TOK_IDSTADDR6:
21148810c16bSdanmcd if (idst != NULL) {
2115e3320f40Smarkfen ERROR(ep, ebuf, gettext(
2116e3320f40Smarkfen "Can only specify single "
2117e3320f40Smarkfen "inner-destination address.\n"));
2118e3320f40Smarkfen break;
21198810c16bSdanmcd }
21208810c16bSdanmcd if ((pstr = strchr(*argv, '/')) != NULL) {
21218810c16bSdanmcd /* Parse out the prefix. */
21228810c16bSdanmcd errno = 0;
21238810c16bSdanmcd prefix = strtol(pstr + 1, NULL, 10);
21248810c16bSdanmcd if (errno != 0) {
2125e3320f40Smarkfen ERROR1(ep, ebuf, gettext(
2126e3320f40Smarkfen "Invalid prefix %s.\n"), pstr);
2127e3320f40Smarkfen break;
21288810c16bSdanmcd }
21298810c16bSdanmcd /* Recycle pstr */
21308810c16bSdanmcd alloclen = (int)(pstr - *argv);
21318810c16bSdanmcd pstr = malloc(alloclen + 1);
21328810c16bSdanmcd if (pstr == NULL) {
21338810c16bSdanmcd Bail("malloc(pstr)");
21348810c16bSdanmcd }
21358810c16bSdanmcd (void) strlcpy(pstr, *argv, alloclen + 1);
21368810c16bSdanmcd } else {
21378810c16bSdanmcd pstr = *argv;
21388810c16bSdanmcd /*
21398810c16bSdanmcd * Assume mapping to AF_INET6, and we're a host.
21408810c16bSdanmcd * XXX some miscreants may still make classful
21418810c16bSdanmcd * assumptions. If this is a problem, fix it
21428810c16bSdanmcd * here.
21438810c16bSdanmcd */
21448810c16bSdanmcd prefix = 128;
21458810c16bSdanmcd }
21468810c16bSdanmcd sa_len = parseaddr(pstr, &idsthp,
2147e3320f40Smarkfen (token == TOK_IDSTADDR6), ebuf);
2148e3320f40Smarkfen if (idsthp == NULL) {
2149e3320f40Smarkfen ERROR1(ep, ebuf, gettext(
2150e3320f40Smarkfen "Unknown Inner Src address "
2151e3320f40Smarkfen " \"%s\"\n"), *argv);
2152e3320f40Smarkfen break;
2153e3320f40Smarkfen }
21548810c16bSdanmcd if (pstr != *argv)
21558810c16bSdanmcd free(pstr);
21568810c16bSdanmcd argv++;
21578810c16bSdanmcd alloclen = sizeof (*idst) + roundup(sa_len, 8);
21588810c16bSdanmcd idst = malloc(alloclen);
21598810c16bSdanmcd if (idst == NULL)
21608810c16bSdanmcd Bail("malloc(idst)");
21618810c16bSdanmcd totallen += alloclen;
21628810c16bSdanmcd idst->sadb_address_len = SADB_8TO64(alloclen);
21638810c16bSdanmcd idst->sadb_address_exttype =
21648810c16bSdanmcd SADB_X_EXT_ADDRESS_INNER_DST;
21658810c16bSdanmcd idst->sadb_address_reserved = 0;
21668810c16bSdanmcd idst->sadb_address_prefixlen = prefix;
21678810c16bSdanmcd idst->sadb_address_proto = 0;
21688810c16bSdanmcd if (idsthp == &dummy.he ||
21698810c16bSdanmcd idsthp->h_addr_list[1] == NULL) {
21708810c16bSdanmcd /*
21718810c16bSdanmcd * Single address with -n flag or single name.
21728810c16bSdanmcd */
21738810c16bSdanmcd sin6 = (struct sockaddr_in6 *)(idst + 1);
21748810c16bSdanmcd bzero(sin6, sizeof (*sin6));
21758810c16bSdanmcd sin6->sin6_family = AF_INET6;
21768810c16bSdanmcd bcopy(idsthp->h_addr_list[0], &sin6->sin6_addr,
21778810c16bSdanmcd sizeof (struct in6_addr));
21788810c16bSdanmcd /*
21798810c16bSdanmcd * normalize prefixlen for IPv4-mapped
21808810c16bSdanmcd * addresses.
21818810c16bSdanmcd */
21828810c16bSdanmcd if (prefix <= 32 &&
21838810c16bSdanmcd IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr))
21848810c16bSdanmcd idst->sadb_address_prefixlen += 96;
21858810c16bSdanmcd alloc_inner = B_TRUE;
21868810c16bSdanmcd } else {
21878810c16bSdanmcd /*
21888810c16bSdanmcd * If the idst address is vague, don't bother.
21898810c16bSdanmcd */
21908810c16bSdanmcd totallen -= alloclen;
21918810c16bSdanmcd free(idst);
21928810c16bSdanmcd idst = NULL;
2193e3320f40Smarkfen WARN1(ep, ebuf, gettext(
2194e3320f40Smarkfen "Inner destination address %s "
2195e3320f40Smarkfen "is vague, not using.\n"), idsthp->h_name);
21968810c16bSdanmcd freehostent(idsthp);
21978810c16bSdanmcd idsthp = NULL;
2198e3320f40Smarkfen break;
21997c478bd9Sstevel@tonic-gate }
22007c478bd9Sstevel@tonic-gate break;
22017c478bd9Sstevel@tonic-gate case TOK_NATLOC:
22027c478bd9Sstevel@tonic-gate if (natt_local != NULL) {
2203e3320f40Smarkfen ERROR(ep, ebuf, gettext(
2204e3320f40Smarkfen "Can only specify "
2205e3320f40Smarkfen "single NAT-T local address.\n"));
2206e3320f40Smarkfen break;
2207e3320f40Smarkfen }
2208e3320f40Smarkfen sa_len = parseaddr(*argv, &natt_lhp, 0, ebuf);
2209e3320f40Smarkfen if (natt_lhp == NULL) {
2210e3320f40Smarkfen ERROR1(ep, ebuf, gettext(
2211e3320f40Smarkfen "Unknown NAT-T local address \"%s\"\n"),
2212e3320f40Smarkfen *argv);
2213e3320f40Smarkfen break;
22147c478bd9Sstevel@tonic-gate }
22157c478bd9Sstevel@tonic-gate argv++;
22167c478bd9Sstevel@tonic-gate /*
22177c478bd9Sstevel@tonic-gate * Round of the sockaddr length to an 8 byte
22187c478bd9Sstevel@tonic-gate * boundary to make PF_KEY happy.
22197c478bd9Sstevel@tonic-gate */
22207c478bd9Sstevel@tonic-gate alloclen = sizeof (*natt_local) + roundup(sa_len, 8);
22217c478bd9Sstevel@tonic-gate natt_local = malloc(alloclen);
22227c478bd9Sstevel@tonic-gate if (natt_local == NULL)
22237c478bd9Sstevel@tonic-gate Bail("malloc(natt_local)");
22247c478bd9Sstevel@tonic-gate totallen += alloclen;
22257c478bd9Sstevel@tonic-gate natt_local->sadb_address_len = SADB_8TO64(alloclen);
22267c478bd9Sstevel@tonic-gate natt_local->sadb_address_exttype =
22277c478bd9Sstevel@tonic-gate SADB_X_EXT_ADDRESS_NATT_LOC;
22287c478bd9Sstevel@tonic-gate natt_local->sadb_address_reserved = 0;
22297c478bd9Sstevel@tonic-gate natt_local->sadb_address_prefixlen = 0;
22307c478bd9Sstevel@tonic-gate natt_local->sadb_address_proto = 0;
22318810c16bSdanmcd if (natt_lhp == &dummy.he ||
22328810c16bSdanmcd natt_lhp->h_addr_list[1] == NULL) {
22337c478bd9Sstevel@tonic-gate /*
22348810c16bSdanmcd * Single address with -n flag or single name.
22357c478bd9Sstevel@tonic-gate */
22367c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(natt_local + 1);
22377c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6));
22387c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6;
22397c478bd9Sstevel@tonic-gate bcopy(natt_lhp->h_addr_list[0],
22407c478bd9Sstevel@tonic-gate &sin6->sin6_addr, sizeof (struct in6_addr));
22418810c16bSdanmcd } else {
22428810c16bSdanmcd /*
22438810c16bSdanmcd * If the nat-local address is vague, don't
22448810c16bSdanmcd * bother.
22458810c16bSdanmcd */
22468810c16bSdanmcd totallen -= alloclen;
22478810c16bSdanmcd free(natt_local);
22488810c16bSdanmcd natt_local = NULL;
2249e3320f40Smarkfen WARN1(ep, ebuf, gettext(
2250e3320f40Smarkfen "NAT-T local address %s "
2251e3320f40Smarkfen "is vague, not using.\n"),
2252e3320f40Smarkfen natt_lhp->h_name);
22538810c16bSdanmcd freehostent(natt_lhp);
22548810c16bSdanmcd natt_lhp = NULL;
2255e3320f40Smarkfen break;
22567c478bd9Sstevel@tonic-gate }
22577c478bd9Sstevel@tonic-gate break;
22587c478bd9Sstevel@tonic-gate case TOK_NATREM:
22597c478bd9Sstevel@tonic-gate if (natt_remote != NULL) {
2260e3320f40Smarkfen ERROR(ep, ebuf, gettext(
2261e3320f40Smarkfen "Can only specify "
2262e3320f40Smarkfen "single NAT-T remote address.\n"));
2263e3320f40Smarkfen break;
2264e3320f40Smarkfen }
2265e3320f40Smarkfen sa_len = parseaddr(*argv, &natt_rhp, 0, ebuf);
2266e3320f40Smarkfen if (natt_rhp == NULL) {
2267e3320f40Smarkfen ERROR1(ep, ebuf, gettext(
2268e3320f40Smarkfen "Unknown NAT-T remote address \"%s\"\n"),
2269e3320f40Smarkfen *argv);
2270e3320f40Smarkfen break;
22717c478bd9Sstevel@tonic-gate }
22727c478bd9Sstevel@tonic-gate argv++;
22737c478bd9Sstevel@tonic-gate /*
22747c478bd9Sstevel@tonic-gate * Round of the sockaddr length to an 8 byte
22757c478bd9Sstevel@tonic-gate * boundary to make PF_KEY happy.
22767c478bd9Sstevel@tonic-gate */
22777c478bd9Sstevel@tonic-gate alloclen = sizeof (*natt_remote) + roundup(sa_len, 8);
22787c478bd9Sstevel@tonic-gate natt_remote = malloc(alloclen);
22797c478bd9Sstevel@tonic-gate if (natt_remote == NULL)
22807c478bd9Sstevel@tonic-gate Bail("malloc(natt_remote)");
22817c478bd9Sstevel@tonic-gate totallen += alloclen;
22827c478bd9Sstevel@tonic-gate natt_remote->sadb_address_len = SADB_8TO64(alloclen);
22837c478bd9Sstevel@tonic-gate natt_remote->sadb_address_exttype =
22847c478bd9Sstevel@tonic-gate SADB_X_EXT_ADDRESS_NATT_REM;
22857c478bd9Sstevel@tonic-gate natt_remote->sadb_address_reserved = 0;
22867c478bd9Sstevel@tonic-gate natt_remote->sadb_address_prefixlen = 0;
22877c478bd9Sstevel@tonic-gate natt_remote->sadb_address_proto = 0;
22888810c16bSdanmcd if (natt_rhp == &dummy.he ||
22898810c16bSdanmcd natt_rhp->h_addr_list[1] == NULL) {
22907c478bd9Sstevel@tonic-gate /*
22918810c16bSdanmcd * Single address with -n flag or single name.
22927c478bd9Sstevel@tonic-gate */
22937c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(natt_remote + 1);
22947c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6));
22957c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6;
22967c478bd9Sstevel@tonic-gate bcopy(natt_rhp->h_addr_list[0],
22977c478bd9Sstevel@tonic-gate &sin6->sin6_addr, sizeof (struct in6_addr));
22988810c16bSdanmcd } else {
22998810c16bSdanmcd /*
2300e3320f40Smarkfen * If the nat-renote address is vague, don't
23018810c16bSdanmcd * bother.
23028810c16bSdanmcd */
23038810c16bSdanmcd totallen -= alloclen;
23048810c16bSdanmcd free(natt_remote);
23058810c16bSdanmcd natt_remote = NULL;
2306e3320f40Smarkfen WARN1(ep, ebuf, gettext(
2307e3320f40Smarkfen "NAT-T remote address %s "
2308e3320f40Smarkfen "is vague, not using.\n"),
2309e3320f40Smarkfen natt_rhp->h_name);
23108810c16bSdanmcd freehostent(natt_rhp);
23118810c16bSdanmcd natt_rhp = NULL;
2312e3320f40Smarkfen break;
23137c478bd9Sstevel@tonic-gate }
23147c478bd9Sstevel@tonic-gate break;
23157c478bd9Sstevel@tonic-gate case TOK_ENCRKEY:
23167c478bd9Sstevel@tonic-gate if (encrypt != NULL) {
2317e3320f40Smarkfen ERROR(ep, ebuf, gettext(
2318e3320f40Smarkfen "Can only specify "
2319e3320f40Smarkfen "single encryption key.\n"));
2320e3320f40Smarkfen break;
23217c478bd9Sstevel@tonic-gate }
2322a050d7e9Spwernau if (assoc != NULL &&
2323a050d7e9Spwernau assoc->sadb_sa_encrypt == SADB_EALG_NULL) {
2324ec485834Spwernau FATAL(ep, ebuf, gettext(
2325ec485834Spwernau "Cannot specify a key with NULL "
2326ec485834Spwernau "encryption algorithm.\n"));
2327ec485834Spwernau break;
2328ec485834Spwernau }
2329628b0c67SMark Fenwick encrypt = parsekey(*argv, ebuf, reserved_bits);
23307c478bd9Sstevel@tonic-gate argv++;
2331e3320f40Smarkfen if (encrypt == NULL) {
2332e3320f40Smarkfen ERROR(ep, ebuf, gettext(
2333e3320f40Smarkfen "Invalid encryption key.\n"));
2334e3320f40Smarkfen break;
2335e3320f40Smarkfen }
2336e3320f40Smarkfen totallen += SADB_64TO8(encrypt->sadb_key_len);
23377c478bd9Sstevel@tonic-gate encrypt->sadb_key_exttype = SADB_EXT_KEY_ENCRYPT;
23387c478bd9Sstevel@tonic-gate break;
23397c478bd9Sstevel@tonic-gate case TOK_AUTHKEY:
23407c478bd9Sstevel@tonic-gate if (auth != NULL) {
2341e3320f40Smarkfen ERROR(ep, ebuf, gettext(
2342e3320f40Smarkfen "Can only specify single"
2343e3320f40Smarkfen " authentication key.\n"));
2344e3320f40Smarkfen break;
23457c478bd9Sstevel@tonic-gate }
2346628b0c67SMark Fenwick auth = parsekey(*argv, ebuf, 0);
23477c478bd9Sstevel@tonic-gate argv++;
2348e3320f40Smarkfen if (auth == NULL) {
2349e3320f40Smarkfen ERROR(ep, ebuf, gettext(
2350e3320f40Smarkfen "Invalid authentication key.\n"));
2351e3320f40Smarkfen break;
2352e3320f40Smarkfen }
23537c478bd9Sstevel@tonic-gate totallen += SADB_64TO8(auth->sadb_key_len);
23547c478bd9Sstevel@tonic-gate auth->sadb_key_exttype = SADB_EXT_KEY_AUTH;
23557c478bd9Sstevel@tonic-gate break;
23567c478bd9Sstevel@tonic-gate case TOK_SRCIDTYPE:
23577c478bd9Sstevel@tonic-gate if (*argv == NULL || *(argv + 1) == NULL) {
2358e3320f40Smarkfen FATAL(ep, ebuf, gettext(
2359e3320f40Smarkfen "Unexpected end of command "
2360e3320f40Smarkfen "line - Expecting Src Type.\n"));
2361e3320f40Smarkfen /* NOTREACHED */
2362e3320f40Smarkfen break;
23637c478bd9Sstevel@tonic-gate }
23647c478bd9Sstevel@tonic-gate if (srcid != NULL) {
2365e3320f40Smarkfen ERROR(ep, ebuf, gettext(
2366e3320f40Smarkfen "Can only specify single"
2367e3320f40Smarkfen " source certificate identity.\n"));
2368e3320f40Smarkfen break;
23697c478bd9Sstevel@tonic-gate }
23707c478bd9Sstevel@tonic-gate alloclen = sizeof (*srcid) +
23717c478bd9Sstevel@tonic-gate roundup(strlen(*(argv + 1)) + 1, 8);
23727c478bd9Sstevel@tonic-gate srcid = malloc(alloclen);
23737c478bd9Sstevel@tonic-gate if (srcid == NULL)
23747c478bd9Sstevel@tonic-gate Bail("malloc(srcid)");
23757c478bd9Sstevel@tonic-gate totallen += alloclen;
2376e3320f40Smarkfen srcid->sadb_ident_type = parseidtype(*argv, ebuf);
23777c478bd9Sstevel@tonic-gate argv++;
23787c478bd9Sstevel@tonic-gate srcid->sadb_ident_len = SADB_8TO64(alloclen);
23797c478bd9Sstevel@tonic-gate srcid->sadb_ident_exttype = SADB_EXT_IDENTITY_SRC;
23807c478bd9Sstevel@tonic-gate srcid->sadb_ident_reserved = 0;
23817c478bd9Sstevel@tonic-gate srcid->sadb_ident_id = 0; /* Not useful here. */
2382e3320f40Smarkfen (void) strlcpy((char *)(srcid + 1), *argv, alloclen);
23837c478bd9Sstevel@tonic-gate argv++;
23847c478bd9Sstevel@tonic-gate break;
23857c478bd9Sstevel@tonic-gate case TOK_DSTIDTYPE:
23867c478bd9Sstevel@tonic-gate if (*argv == NULL || *(argv + 1) == NULL) {
2387e3320f40Smarkfen ERROR(ep, ebuf, gettext(
2388e3320f40Smarkfen "Unexpected end of command"
2389e3320f40Smarkfen " line - expecting dst type.\n"));
2390e3320f40Smarkfen break;
23917c478bd9Sstevel@tonic-gate }
23927c478bd9Sstevel@tonic-gate if (dstid != NULL) {
2393e3320f40Smarkfen ERROR(ep, ebuf, gettext(
2394e3320f40Smarkfen "Can only specify single destination "
239525e435e0Spwernau "certificate identity.\n"));
2396e3320f40Smarkfen break;
23977c478bd9Sstevel@tonic-gate }
23987c478bd9Sstevel@tonic-gate alloclen = sizeof (*dstid) +
23997c478bd9Sstevel@tonic-gate roundup(strlen(*(argv + 1)) + 1, 8);
24007c478bd9Sstevel@tonic-gate dstid = malloc(alloclen);
24017c478bd9Sstevel@tonic-gate if (dstid == NULL)
24027c478bd9Sstevel@tonic-gate Bail("malloc(dstid)");
24037c478bd9Sstevel@tonic-gate totallen += alloclen;
2404e3320f40Smarkfen dstid->sadb_ident_type = parseidtype(*argv, ebuf);
24057c478bd9Sstevel@tonic-gate argv++;
24067c478bd9Sstevel@tonic-gate dstid->sadb_ident_len = SADB_8TO64(alloclen);
24077c478bd9Sstevel@tonic-gate dstid->sadb_ident_exttype = SADB_EXT_IDENTITY_DST;
24087c478bd9Sstevel@tonic-gate dstid->sadb_ident_reserved = 0;
24097c478bd9Sstevel@tonic-gate dstid->sadb_ident_id = 0; /* Not useful here. */
2410e3320f40Smarkfen (void) strlcpy((char *)(dstid + 1), *argv, alloclen);
24117c478bd9Sstevel@tonic-gate argv++;
24127c478bd9Sstevel@tonic-gate break;
24137c478bd9Sstevel@tonic-gate case TOK_HARD_ALLOC:
24147c478bd9Sstevel@tonic-gate case TOK_HARD_BYTES:
24157c478bd9Sstevel@tonic-gate case TOK_HARD_ADDTIME:
24167c478bd9Sstevel@tonic-gate case TOK_HARD_USETIME:
24177c478bd9Sstevel@tonic-gate if (hard == NULL) {
24187c478bd9Sstevel@tonic-gate hard = malloc(sizeof (*hard));
24197c478bd9Sstevel@tonic-gate if (hard == NULL)
24207c478bd9Sstevel@tonic-gate Bail("malloc(hard_lifetime)");
24217c478bd9Sstevel@tonic-gate bzero(hard, sizeof (*hard));
24227c478bd9Sstevel@tonic-gate hard->sadb_lifetime_exttype =
24237c478bd9Sstevel@tonic-gate SADB_EXT_LIFETIME_HARD;
24247c478bd9Sstevel@tonic-gate hard->sadb_lifetime_len =
24257c478bd9Sstevel@tonic-gate SADB_8TO64(sizeof (*hard));
24267c478bd9Sstevel@tonic-gate totallen += sizeof (*hard);
24277c478bd9Sstevel@tonic-gate }
24287c478bd9Sstevel@tonic-gate switch (token) {
24297c478bd9Sstevel@tonic-gate case TOK_HARD_ALLOC:
24307c478bd9Sstevel@tonic-gate if (hard->sadb_lifetime_allocations != 0) {
2431e3320f40Smarkfen ERROR(ep, ebuf, gettext(
2432e3320f40Smarkfen "Can only specify single"
2433e3320f40Smarkfen " hard allocation limit.\n"));
2434e3320f40Smarkfen break;
24357c478bd9Sstevel@tonic-gate }
24367c478bd9Sstevel@tonic-gate hard->sadb_lifetime_allocations =
2437e3320f40Smarkfen (uint32_t)parsenum(*argv, B_TRUE, ebuf);
24387c478bd9Sstevel@tonic-gate break;
24397c478bd9Sstevel@tonic-gate case TOK_HARD_BYTES:
24407c478bd9Sstevel@tonic-gate if (hard->sadb_lifetime_bytes != 0) {
2441e3320f40Smarkfen ERROR(ep, ebuf, gettext(
2442e3320f40Smarkfen "Can only specify "
2443e3320f40Smarkfen "single hard byte limit.\n"));
2444e3320f40Smarkfen break;
24457c478bd9Sstevel@tonic-gate }
24467c478bd9Sstevel@tonic-gate hard->sadb_lifetime_bytes = parsenum(*argv,
2447e3320f40Smarkfen B_TRUE, ebuf);
24487c478bd9Sstevel@tonic-gate break;
24497c478bd9Sstevel@tonic-gate case TOK_HARD_ADDTIME:
24507c478bd9Sstevel@tonic-gate if (hard->sadb_lifetime_addtime != 0) {
2451e3320f40Smarkfen ERROR(ep, ebuf, gettext(
2452e3320f40Smarkfen "Can only specify "
2453e3320f40Smarkfen "single past-add lifetime.\n"));
2454e3320f40Smarkfen break;
24557c478bd9Sstevel@tonic-gate }
24567c478bd9Sstevel@tonic-gate hard->sadb_lifetime_addtime = parsenum(*argv,
2457e3320f40Smarkfen B_TRUE, ebuf);
24587c478bd9Sstevel@tonic-gate break;
24597c478bd9Sstevel@tonic-gate case TOK_HARD_USETIME:
24607c478bd9Sstevel@tonic-gate if (hard->sadb_lifetime_usetime != 0) {
2461e3320f40Smarkfen ERROR(ep, ebuf, gettext(
2462e3320f40Smarkfen "Can only specify "
2463e3320f40Smarkfen "single past-use lifetime.\n"));
2464e3320f40Smarkfen break;
24657c478bd9Sstevel@tonic-gate }
24667c478bd9Sstevel@tonic-gate hard->sadb_lifetime_usetime = parsenum(*argv,
2467e3320f40Smarkfen B_TRUE, ebuf);
24687c478bd9Sstevel@tonic-gate break;
24697c478bd9Sstevel@tonic-gate }
24707c478bd9Sstevel@tonic-gate argv++;
24717c478bd9Sstevel@tonic-gate break;
24727c478bd9Sstevel@tonic-gate case TOK_SOFT_ALLOC:
24737c478bd9Sstevel@tonic-gate case TOK_SOFT_BYTES:
24747c478bd9Sstevel@tonic-gate case TOK_SOFT_ADDTIME:
24757c478bd9Sstevel@tonic-gate case TOK_SOFT_USETIME:
24767c478bd9Sstevel@tonic-gate if (soft == NULL) {
24777c478bd9Sstevel@tonic-gate soft = malloc(sizeof (*soft));
24787c478bd9Sstevel@tonic-gate if (soft == NULL)
24797c478bd9Sstevel@tonic-gate Bail("malloc(soft_lifetime)");
24807c478bd9Sstevel@tonic-gate bzero(soft, sizeof (*soft));
24817c478bd9Sstevel@tonic-gate soft->sadb_lifetime_exttype =
24827c478bd9Sstevel@tonic-gate SADB_EXT_LIFETIME_SOFT;
24837c478bd9Sstevel@tonic-gate soft->sadb_lifetime_len =
24847c478bd9Sstevel@tonic-gate SADB_8TO64(sizeof (*soft));
24857c478bd9Sstevel@tonic-gate totallen += sizeof (*soft);
24867c478bd9Sstevel@tonic-gate }
24877c478bd9Sstevel@tonic-gate switch (token) {
24887c478bd9Sstevel@tonic-gate case TOK_SOFT_ALLOC:
24897c478bd9Sstevel@tonic-gate if (soft->sadb_lifetime_allocations != 0) {
2490e3320f40Smarkfen ERROR(ep, ebuf, gettext(
2491e3320f40Smarkfen "Can only specify single"
2492e3320f40Smarkfen " soft allocation limit.\n"));
2493e3320f40Smarkfen break;
24947c478bd9Sstevel@tonic-gate }
24957c478bd9Sstevel@tonic-gate soft->sadb_lifetime_allocations =
2496e3320f40Smarkfen (uint32_t)parsenum(*argv, B_TRUE, ebuf);
24977c478bd9Sstevel@tonic-gate break;
24987c478bd9Sstevel@tonic-gate case TOK_SOFT_BYTES:
24997c478bd9Sstevel@tonic-gate if (soft->sadb_lifetime_bytes != 0) {
2500e3320f40Smarkfen ERROR(ep, ebuf, gettext(
2501e3320f40Smarkfen "Can only specify single"
2502e3320f40Smarkfen " soft byte limit.\n"));
2503e3320f40Smarkfen break;
25047c478bd9Sstevel@tonic-gate }
25057c478bd9Sstevel@tonic-gate soft->sadb_lifetime_bytes = parsenum(*argv,
2506e3320f40Smarkfen B_TRUE, ebuf);
25077c478bd9Sstevel@tonic-gate break;
25087c478bd9Sstevel@tonic-gate case TOK_SOFT_ADDTIME:
25097c478bd9Sstevel@tonic-gate if (soft->sadb_lifetime_addtime != 0) {
2510e3320f40Smarkfen ERROR(ep, ebuf, gettext(
2511e3320f40Smarkfen "Can only specify single"
2512e3320f40Smarkfen " past-add lifetime.\n"));
2513e3320f40Smarkfen break;
25147c478bd9Sstevel@tonic-gate }
25157c478bd9Sstevel@tonic-gate soft->sadb_lifetime_addtime = parsenum(*argv,
2516e3320f40Smarkfen B_TRUE, ebuf);
25177c478bd9Sstevel@tonic-gate break;
25187c478bd9Sstevel@tonic-gate case TOK_SOFT_USETIME:
25197c478bd9Sstevel@tonic-gate if (soft->sadb_lifetime_usetime != 0) {
2520e3320f40Smarkfen ERROR(ep, ebuf, gettext(
2521e3320f40Smarkfen "Can only specify single"
2522e3320f40Smarkfen " past-use lifetime.\n"));
2523e3320f40Smarkfen break;
25247c478bd9Sstevel@tonic-gate }
25257c478bd9Sstevel@tonic-gate soft->sadb_lifetime_usetime = parsenum(*argv,
2526e3320f40Smarkfen B_TRUE, ebuf);
25277c478bd9Sstevel@tonic-gate break;
25287c478bd9Sstevel@tonic-gate }
25297c478bd9Sstevel@tonic-gate argv++;
25307c478bd9Sstevel@tonic-gate break;
253138d95a78Smarkfen case TOK_FLAG_INBOUND:
253238d95a78Smarkfen assoc->sadb_sa_flags |= SADB_X_SAFLAGS_INBOUND;
253338d95a78Smarkfen break;
253438d95a78Smarkfen case TOK_FLAG_OUTBOUND:
253538d95a78Smarkfen assoc->sadb_sa_flags |= SADB_X_SAFLAGS_OUTBOUND;
253638d95a78Smarkfen break;
25379c2c14abSThejaswini Singarajipura case TOK_REPLAY_VALUE:
25389c2c14abSThejaswini Singarajipura if (replay_ctr != NULL) {
25399c2c14abSThejaswini Singarajipura ERROR(ep, ebuf, gettext(
25409c2c14abSThejaswini Singarajipura "Can only specify single "
25419c2c14abSThejaswini Singarajipura "replay value."));
25429c2c14abSThejaswini Singarajipura break;
25439c2c14abSThejaswini Singarajipura }
25449c2c14abSThejaswini Singarajipura replay_ctr = calloc(1, sizeof (*replay_ctr));
25459c2c14abSThejaswini Singarajipura if (replay_ctr == NULL) {
25469c2c14abSThejaswini Singarajipura Bail("malloc(replay value)");
25479c2c14abSThejaswini Singarajipura }
25489c2c14abSThejaswini Singarajipura /*
25499c2c14abSThejaswini Singarajipura * We currently do not support a 64-bit
25509c2c14abSThejaswini Singarajipura * replay value. RFC 4301 will require one,
25519c2c14abSThejaswini Singarajipura * however, and we have a field in place when
25529c2c14abSThejaswini Singarajipura * 4301 is built.
25539c2c14abSThejaswini Singarajipura */
25549c2c14abSThejaswini Singarajipura replay_ctr->sadb_x_rc_exttype = SADB_X_EXT_REPLAY_VALUE;
25559c2c14abSThejaswini Singarajipura replay_ctr->sadb_x_rc_len =
25569c2c14abSThejaswini Singarajipura SADB_8TO64(sizeof (*replay_ctr));
25579c2c14abSThejaswini Singarajipura totallen += sizeof (*replay_ctr);
25589c2c14abSThejaswini Singarajipura replay_ctr->sadb_x_rc_replay32 = (uint32_t)parsenum(
25599c2c14abSThejaswini Singarajipura *argv, B_TRUE, ebuf);
25609c2c14abSThejaswini Singarajipura argv++;
25619c2c14abSThejaswini Singarajipura break;
25629c2c14abSThejaswini Singarajipura case TOK_IDLE_ADDTIME:
25639c2c14abSThejaswini Singarajipura case TOK_IDLE_USETIME:
25649c2c14abSThejaswini Singarajipura if (idle == NULL) {
25659c2c14abSThejaswini Singarajipura idle = calloc(1, sizeof (*idle));
25669c2c14abSThejaswini Singarajipura if (idle == NULL) {
25679c2c14abSThejaswini Singarajipura Bail("malloc idle lifetime");
25689c2c14abSThejaswini Singarajipura }
25699c2c14abSThejaswini Singarajipura idle->sadb_lifetime_exttype =
25709c2c14abSThejaswini Singarajipura SADB_X_EXT_LIFETIME_IDLE;
25719c2c14abSThejaswini Singarajipura idle->sadb_lifetime_len =
25729c2c14abSThejaswini Singarajipura SADB_8TO64(sizeof (*idle));
25739c2c14abSThejaswini Singarajipura totallen += sizeof (*idle);
25749c2c14abSThejaswini Singarajipura }
25759c2c14abSThejaswini Singarajipura switch (token) {
25769c2c14abSThejaswini Singarajipura case TOK_IDLE_ADDTIME:
25779c2c14abSThejaswini Singarajipura idle->sadb_lifetime_addtime =
25789c2c14abSThejaswini Singarajipura (uint32_t)parsenum(*argv,
25799c2c14abSThejaswini Singarajipura B_TRUE, ebuf);
25809c2c14abSThejaswini Singarajipura break;
25819c2c14abSThejaswini Singarajipura case TOK_IDLE_USETIME:
25829c2c14abSThejaswini Singarajipura idle->sadb_lifetime_usetime =
25839c2c14abSThejaswini Singarajipura (uint32_t)parsenum(*argv,
25849c2c14abSThejaswini Singarajipura B_TRUE, ebuf);
25859c2c14abSThejaswini Singarajipura break;
25869c2c14abSThejaswini Singarajipura }
25879c2c14abSThejaswini Singarajipura argv++;
25889c2c14abSThejaswini Singarajipura break;
2589628b0c67SMark Fenwick case TOK_RESERVED:
2590628b0c67SMark Fenwick if (encrypt != NULL)
2591628b0c67SMark Fenwick ERROR(ep, ebuf, gettext(
2592628b0c67SMark Fenwick "Reserved bits need to be "
2593628b0c67SMark Fenwick "specified before key.\n"));
2594628b0c67SMark Fenwick reserved_bits = (uint_t)parsenum(*argv,
2595628b0c67SMark Fenwick B_TRUE, ebuf);
2596628b0c67SMark Fenwick argv++;
2597628b0c67SMark Fenwick break;
25985d3b8cb7SBill Sommerfeld case TOK_LABEL:
25995d3b8cb7SBill Sommerfeld label = parselabel(token, *argv);
26005d3b8cb7SBill Sommerfeld argv++;
26015d3b8cb7SBill Sommerfeld if (label == NULL) {
26025d3b8cb7SBill Sommerfeld ERROR(ep, ebuf,
26035d3b8cb7SBill Sommerfeld gettext("Malformed security label\n"));
26045d3b8cb7SBill Sommerfeld break;
26055d3b8cb7SBill Sommerfeld } else if (label == PARSELABEL_BAD_TOKEN) {
26065d3b8cb7SBill Sommerfeld Bail("Internal token value error");
26075d3b8cb7SBill Sommerfeld }
26085d3b8cb7SBill Sommerfeld totallen += SADB_64TO8(label->sadb_sens_len);
26095d3b8cb7SBill Sommerfeld break;
26105d3b8cb7SBill Sommerfeld
26115d3b8cb7SBill Sommerfeld case TOK_OLABEL:
26125d3b8cb7SBill Sommerfeld case TOK_IMPLABEL:
26135d3b8cb7SBill Sommerfeld olabel = parselabel(token, *argv);
26145d3b8cb7SBill Sommerfeld argv++;
26155d3b8cb7SBill Sommerfeld if (label == NULL) {
26165d3b8cb7SBill Sommerfeld ERROR(ep, ebuf,
26175d3b8cb7SBill Sommerfeld gettext("Malformed security label\n"));
26185d3b8cb7SBill Sommerfeld break;
26195d3b8cb7SBill Sommerfeld } else if (label == PARSELABEL_BAD_TOKEN) {
26205d3b8cb7SBill Sommerfeld Bail("Internal token value error");
26215d3b8cb7SBill Sommerfeld }
26225d3b8cb7SBill Sommerfeld totallen += SADB_64TO8(olabel->sadb_sens_len);
26235d3b8cb7SBill Sommerfeld break;
26247c478bd9Sstevel@tonic-gate default:
2625e3320f40Smarkfen ERROR1(ep, ebuf, gettext(
2626e3320f40Smarkfen "Don't use extension %s for add/update.\n"),
26277c478bd9Sstevel@tonic-gate *(argv - 1));
26287c478bd9Sstevel@tonic-gate break;
26297c478bd9Sstevel@tonic-gate }
26307c478bd9Sstevel@tonic-gate } while (token != TOK_EOF);
26317c478bd9Sstevel@tonic-gate
2632e3320f40Smarkfen handle_errors(ep, ebuf, B_TRUE, B_FALSE);
2633e3320f40Smarkfen
2634437220cdSdanmcd #define PORT_ONLY_ALLOCATE(af, socktype, exttype, extvar, port) { \
2635437220cdSdanmcd alloclen = sizeof (sadb_address_t) + roundup(sizeof (socktype), 8); \
2636437220cdSdanmcd (extvar) = calloc(1, alloclen); \
2637437220cdSdanmcd if ((extvar) == NULL) { \
2638437220cdSdanmcd Bail("malloc(implicit port)"); \
2639437220cdSdanmcd } \
2640437220cdSdanmcd totallen += alloclen; \
2641437220cdSdanmcd (extvar)->sadb_address_len = SADB_8TO64(alloclen); \
2642437220cdSdanmcd (extvar)->sadb_address_exttype = (exttype); \
2643437220cdSdanmcd /* sin/sin6 has equivalent offsets for ports! */ \
2644437220cdSdanmcd sin6 = (struct sockaddr_in6 *)((extvar) + 1); \
2645437220cdSdanmcd sin6->sin6_family = (af); \
2646437220cdSdanmcd sin6->sin6_port = (port); \
2647437220cdSdanmcd }
2648437220cdSdanmcd
26498810c16bSdanmcd /*
2650437220cdSdanmcd * If we specify inner ports or NAT ports w/o addresses, we still need
2651437220cdSdanmcd * to allocate. Also, if we have one inner address, we need the
26528810c16bSdanmcd * other, even if we don't specify anything.
26538810c16bSdanmcd */
2654437220cdSdanmcd if (use_natt) {
2655437220cdSdanmcd if (natt_lport != 0 && natt_local == NULL) {
2656437220cdSdanmcd PORT_ONLY_ALLOCATE(AF_INET, struct sockaddr_in,
2657437220cdSdanmcd SADB_X_EXT_ADDRESS_NATT_LOC, natt_local,
2658437220cdSdanmcd natt_lport);
2659437220cdSdanmcd }
2660437220cdSdanmcd
2661437220cdSdanmcd if (natt_rport != 0 && natt_remote == NULL) {
2662437220cdSdanmcd PORT_ONLY_ALLOCATE(AF_INET, struct sockaddr_in,
2663437220cdSdanmcd SADB_X_EXT_ADDRESS_NATT_REM, natt_remote,
2664437220cdSdanmcd natt_rport);
2665437220cdSdanmcd }
2666437220cdSdanmcd } else {
2667437220cdSdanmcd if (natt_lport != 0 || natt_rport != 0) {
2668437220cdSdanmcd ERROR(ep, ebuf, gettext("Must specify 'encap udp' "
2669437220cdSdanmcd "with any NAT-T port.\n"));
2670437220cdSdanmcd } else if (natt_local != NULL || natt_remote != NULL) {
2671437220cdSdanmcd ERROR(ep, ebuf, gettext("Must specify 'encap udp' "
2672437220cdSdanmcd "with any NAT-T address.\n"));
26738810c16bSdanmcd }
2674437220cdSdanmcd }
2675437220cdSdanmcd
2676437220cdSdanmcd if (alloc_inner && idst == NULL) {
2677437220cdSdanmcd PORT_ONLY_ALLOCATE(AF_INET6, struct sockaddr_in6,
2678437220cdSdanmcd SADB_X_EXT_ADDRESS_INNER_DST, idst, 0);
26798810c16bSdanmcd }
26808810c16bSdanmcd
26818810c16bSdanmcd if (alloc_inner && isrc == NULL) {
2682437220cdSdanmcd PORT_ONLY_ALLOCATE(AF_INET6, struct sockaddr_in6,
2683437220cdSdanmcd SADB_X_EXT_ADDRESS_INNER_SRC, isrc, 0);
26848810c16bSdanmcd }
2685437220cdSdanmcd #undef PORT_ONLY_ALLOCATE
26868810c16bSdanmcd
26877c478bd9Sstevel@tonic-gate /*
26887c478bd9Sstevel@tonic-gate * Okay, so now I have all of the potential extensions!
26897c478bd9Sstevel@tonic-gate * Allocate a single contiguous buffer. Keep in mind that it'll
26907c478bd9Sstevel@tonic-gate * be enough because the key itself will be yanked.
26917c478bd9Sstevel@tonic-gate */
26927c478bd9Sstevel@tonic-gate
26937c478bd9Sstevel@tonic-gate if (src == NULL && dst != NULL) {
26947c478bd9Sstevel@tonic-gate /*
26957c478bd9Sstevel@tonic-gate * Set explicit unspecified source address.
26967c478bd9Sstevel@tonic-gate */
26977c478bd9Sstevel@tonic-gate size_t lenbytes = SADB_64TO8(dst->sadb_address_len);
26987c478bd9Sstevel@tonic-gate
26997c478bd9Sstevel@tonic-gate unspec_src = B_TRUE;
27007c478bd9Sstevel@tonic-gate totallen += lenbytes;
27017c478bd9Sstevel@tonic-gate src = malloc(lenbytes);
27027c478bd9Sstevel@tonic-gate if (src == NULL)
27037c478bd9Sstevel@tonic-gate Bail("malloc(implicit src)");
27047c478bd9Sstevel@tonic-gate /* Confusing, but we're copying from DST to SRC. :) */
27057c478bd9Sstevel@tonic-gate bcopy(dst, src, lenbytes);
27067c478bd9Sstevel@tonic-gate src->sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
27077c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(src + 1);
27087c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6));
27097c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6;
27107c478bd9Sstevel@tonic-gate }
27118810c16bSdanmcd
27127c478bd9Sstevel@tonic-gate msg.sadb_msg_len = SADB_8TO64(totallen);
27137c478bd9Sstevel@tonic-gate
27147c478bd9Sstevel@tonic-gate buffer = malloc(totallen);
27157c478bd9Sstevel@tonic-gate nexthdr = buffer;
27167c478bd9Sstevel@tonic-gate bcopy(&msg, nexthdr, sizeof (msg));
27177c478bd9Sstevel@tonic-gate nexthdr += SADB_8TO64(sizeof (msg));
27187c478bd9Sstevel@tonic-gate if (assoc != NULL) {
27197c478bd9Sstevel@tonic-gate if (assoc->sadb_sa_spi == 0) {
2720e3320f40Smarkfen ERROR1(ep, ebuf, gettext(
2721e3320f40Smarkfen "The SPI value is missing for "
2722e3320f40Smarkfen "the association you wish to %s.\n"), thiscmd);
27237c478bd9Sstevel@tonic-gate }
27247c478bd9Sstevel@tonic-gate if (assoc->sadb_sa_auth == 0 && assoc->sadb_sa_encrypt == 0 &&
272525e435e0Spwernau cmd == CMD_ADD) {
2726e3320f40Smarkfen free(assoc);
2727e3320f40Smarkfen FATAL(ep, ebuf, gettext(
2728e3320f40Smarkfen "Select at least one algorithm "
2729e3320f40Smarkfen "for this add.\n"));
27307c478bd9Sstevel@tonic-gate }
27317c478bd9Sstevel@tonic-gate
27327c478bd9Sstevel@tonic-gate /* Hack to let user specify NULL ESP implicitly. */
27337c478bd9Sstevel@tonic-gate if (msg.sadb_msg_satype == SADB_SATYPE_ESP &&
27347c478bd9Sstevel@tonic-gate assoc->sadb_sa_encrypt == 0)
27357c478bd9Sstevel@tonic-gate assoc->sadb_sa_encrypt = SADB_EALG_NULL;
27367c478bd9Sstevel@tonic-gate
27377c478bd9Sstevel@tonic-gate /* 0 is an actual value. Print a warning if it was entered. */
27387c478bd9Sstevel@tonic-gate if (assoc->sadb_sa_state == 0) {
2739e3320f40Smarkfen if (readstate) {
2740e3320f40Smarkfen ERROR(ep, ebuf, gettext(
2741e3320f40Smarkfen "WARNING: Cannot set LARVAL SA state.\n"));
2742e3320f40Smarkfen }
27437c478bd9Sstevel@tonic-gate assoc->sadb_sa_state = SADB_SASTATE_MATURE;
27447c478bd9Sstevel@tonic-gate }
27457c478bd9Sstevel@tonic-gate
27467c478bd9Sstevel@tonic-gate if (use_natt) {
27477c478bd9Sstevel@tonic-gate if (natt_remote != NULL)
27487c478bd9Sstevel@tonic-gate assoc->sadb_sa_flags |= SADB_X_SAFLAGS_NATT_REM;
27497c478bd9Sstevel@tonic-gate if (natt_local != NULL)
27507c478bd9Sstevel@tonic-gate assoc->sadb_sa_flags |= SADB_X_SAFLAGS_NATT_LOC;
27517c478bd9Sstevel@tonic-gate }
27527c478bd9Sstevel@tonic-gate
27538810c16bSdanmcd if (alloc_inner) {
27548810c16bSdanmcd /*
27558810c16bSdanmcd * For now, assume RFC 3884's dream of transport-mode
27568810c16bSdanmcd * SAs with inner IP address selectors will not
27578810c16bSdanmcd * happen.
27588810c16bSdanmcd */
27598810c16bSdanmcd assoc->sadb_sa_flags |= SADB_X_SAFLAGS_TUNNEL;
27608810c16bSdanmcd if (proto != 0 && proto != IPPROTO_ENCAP &&
27618810c16bSdanmcd proto != IPPROTO_IPV6) {
2762e3320f40Smarkfen ERROR1(ep, ebuf, gettext(
2763e3320f40Smarkfen "WARNING: Protocol type %d not "
2764e3320f40Smarkfen "for use with Tunnel-Mode SA.\n"), proto);
27658810c16bSdanmcd /* Continue and let PF_KEY scream... */
27668810c16bSdanmcd }
27678810c16bSdanmcd }
27688810c16bSdanmcd
27697c478bd9Sstevel@tonic-gate bcopy(assoc, nexthdr, SADB_64TO8(assoc->sadb_sa_len));
27707c478bd9Sstevel@tonic-gate nexthdr += assoc->sadb_sa_len;
27717c478bd9Sstevel@tonic-gate /* Save the SPI for the case of an error. */
27727c478bd9Sstevel@tonic-gate spi = assoc->sadb_sa_spi;
27737c478bd9Sstevel@tonic-gate free(assoc);
27747c478bd9Sstevel@tonic-gate } else {
2775a050d7e9Spwernau if (spi == 0)
2776a050d7e9Spwernau ERROR1(ep, ebuf, gettext(
2777a050d7e9Spwernau "Need to define SPI for %s.\n"), thiscmd);
2778e3320f40Smarkfen ERROR1(ep, ebuf, gettext(
2779e3320f40Smarkfen "Need SA parameters for %s.\n"), thiscmd);
27807c478bd9Sstevel@tonic-gate }
27817c478bd9Sstevel@tonic-gate
278238d95a78Smarkfen if (sadb_pair != NULL) {
278338d95a78Smarkfen if (sadb_pair->sadb_x_pair_spi == 0) {
278438d95a78Smarkfen ERROR1(ep, ebuf, gettext(
278538d95a78Smarkfen "The SPI value is missing for the "
278638d95a78Smarkfen "association you wish to %s.\n"), thiscmd);
278738d95a78Smarkfen }
278838d95a78Smarkfen bcopy(sadb_pair, nexthdr,
278938d95a78Smarkfen SADB_64TO8(sadb_pair->sadb_x_pair_len));
279038d95a78Smarkfen nexthdr += sadb_pair->sadb_x_pair_len;
279138d95a78Smarkfen free(sadb_pair);
279238d95a78Smarkfen }
279338d95a78Smarkfen
27947c478bd9Sstevel@tonic-gate if (hard != NULL) {
27957c478bd9Sstevel@tonic-gate bcopy(hard, nexthdr, SADB_64TO8(hard->sadb_lifetime_len));
27967c478bd9Sstevel@tonic-gate nexthdr += hard->sadb_lifetime_len;
27977c478bd9Sstevel@tonic-gate free(hard);
27987c478bd9Sstevel@tonic-gate }
27997c478bd9Sstevel@tonic-gate
28007c478bd9Sstevel@tonic-gate if (soft != NULL) {
28017c478bd9Sstevel@tonic-gate bcopy(soft, nexthdr, SADB_64TO8(soft->sadb_lifetime_len));
28027c478bd9Sstevel@tonic-gate nexthdr += soft->sadb_lifetime_len;
28037c478bd9Sstevel@tonic-gate free(soft);
28047c478bd9Sstevel@tonic-gate }
28057c478bd9Sstevel@tonic-gate
28069c2c14abSThejaswini Singarajipura if (idle != NULL) {
28079c2c14abSThejaswini Singarajipura bcopy(idle, nexthdr, SADB_64TO8(idle->sadb_lifetime_len));
28089c2c14abSThejaswini Singarajipura nexthdr += idle->sadb_lifetime_len;
28099c2c14abSThejaswini Singarajipura free(idle);
28109c2c14abSThejaswini Singarajipura }
28119c2c14abSThejaswini Singarajipura
28127c478bd9Sstevel@tonic-gate if (encrypt == NULL && auth == NULL && cmd == CMD_ADD) {
2813e3320f40Smarkfen ERROR(ep, ebuf, gettext(
2814e3320f40Smarkfen "Must have at least one key for an add.\n"));
28157c478bd9Sstevel@tonic-gate }
28167c478bd9Sstevel@tonic-gate
28177c478bd9Sstevel@tonic-gate if (encrypt != NULL) {
28187c478bd9Sstevel@tonic-gate bcopy(encrypt, nexthdr, SADB_64TO8(encrypt->sadb_key_len));
28197c478bd9Sstevel@tonic-gate nexthdr += encrypt->sadb_key_len;
28207c478bd9Sstevel@tonic-gate bzero(encrypt, SADB_64TO8(encrypt->sadb_key_len));
28217c478bd9Sstevel@tonic-gate free(encrypt);
28227c478bd9Sstevel@tonic-gate }
28237c478bd9Sstevel@tonic-gate
28247c478bd9Sstevel@tonic-gate if (auth != NULL) {
28257c478bd9Sstevel@tonic-gate bcopy(auth, nexthdr, SADB_64TO8(auth->sadb_key_len));
28267c478bd9Sstevel@tonic-gate nexthdr += auth->sadb_key_len;
28277c478bd9Sstevel@tonic-gate bzero(auth, SADB_64TO8(auth->sadb_key_len));
28287c478bd9Sstevel@tonic-gate free(auth);
28297c478bd9Sstevel@tonic-gate }
28307c478bd9Sstevel@tonic-gate
28317c478bd9Sstevel@tonic-gate if (srcid != NULL) {
28327c478bd9Sstevel@tonic-gate bcopy(srcid, nexthdr, SADB_64TO8(srcid->sadb_ident_len));
28337c478bd9Sstevel@tonic-gate nexthdr += srcid->sadb_ident_len;
28347c478bd9Sstevel@tonic-gate free(srcid);
28357c478bd9Sstevel@tonic-gate }
28367c478bd9Sstevel@tonic-gate
28377c478bd9Sstevel@tonic-gate if (dstid != NULL) {
28387c478bd9Sstevel@tonic-gate bcopy(dstid, nexthdr, SADB_64TO8(dstid->sadb_ident_len));
28397c478bd9Sstevel@tonic-gate nexthdr += dstid->sadb_ident_len;
28407c478bd9Sstevel@tonic-gate free(dstid);
28417c478bd9Sstevel@tonic-gate }
28427c478bd9Sstevel@tonic-gate
28437c478bd9Sstevel@tonic-gate if (dst != NULL) {
28447c478bd9Sstevel@tonic-gate bcopy(dst, nexthdr, SADB_64TO8(dst->sadb_address_len));
28457c478bd9Sstevel@tonic-gate free(dst);
28467c478bd9Sstevel@tonic-gate dst = (struct sadb_address *)nexthdr;
28478810c16bSdanmcd dst->sadb_address_proto = proto;
28488810c16bSdanmcd ((struct sockaddr_in6 *)(dst + 1))->sin6_port = htons(dstport);
28497c478bd9Sstevel@tonic-gate nexthdr += dst->sadb_address_len;
28507c478bd9Sstevel@tonic-gate } else {
2851e3320f40Smarkfen FATAL1(ep, ebuf, gettext(
2852e3320f40Smarkfen "Need destination address for %s.\n"), thiscmd);
28537c478bd9Sstevel@tonic-gate }
28547c478bd9Sstevel@tonic-gate
28557c478bd9Sstevel@tonic-gate if (use_natt) {
28567c478bd9Sstevel@tonic-gate if (natt_remote == NULL && natt_local == NULL) {
2857e3320f40Smarkfen ERROR(ep, ebuf, gettext(
2858e3320f40Smarkfen "Must specify NAT-T remote or local address "
2859e3320f40Smarkfen "for UDP encapsulation.\n"));
28607c478bd9Sstevel@tonic-gate }
28617c478bd9Sstevel@tonic-gate
28627c478bd9Sstevel@tonic-gate if (natt_remote != NULL) {
28638810c16bSdanmcd bcopy(natt_remote, nexthdr,
28648810c16bSdanmcd SADB_64TO8(natt_remote->sadb_address_len));
28657c478bd9Sstevel@tonic-gate free(natt_remote);
28667c478bd9Sstevel@tonic-gate natt_remote = (struct sadb_address *)nexthdr;
28677c478bd9Sstevel@tonic-gate nexthdr += natt_remote->sadb_address_len;
28688810c16bSdanmcd ((struct sockaddr_in6 *)(natt_remote + 1))->sin6_port =
28698810c16bSdanmcd htons(natt_rport);
28707c478bd9Sstevel@tonic-gate }
28718810c16bSdanmcd
28727c478bd9Sstevel@tonic-gate if (natt_local != NULL) {
28737c478bd9Sstevel@tonic-gate bcopy(natt_local, nexthdr,
28747c478bd9Sstevel@tonic-gate SADB_64TO8(natt_local->sadb_address_len));
28757c478bd9Sstevel@tonic-gate free(natt_local);
28767c478bd9Sstevel@tonic-gate natt_local = (struct sadb_address *)nexthdr;
28777c478bd9Sstevel@tonic-gate nexthdr += natt_local->sadb_address_len;
28788810c16bSdanmcd ((struct sockaddr_in6 *)(natt_local + 1))->sin6_port =
28798810c16bSdanmcd htons(natt_lport);
28807c478bd9Sstevel@tonic-gate }
28817c478bd9Sstevel@tonic-gate }
2882e3320f40Smarkfen
2883e3320f40Smarkfen handle_errors(ep, ebuf, B_TRUE, B_FALSE);
2884e3320f40Smarkfen
28857c478bd9Sstevel@tonic-gate /*
28867c478bd9Sstevel@tonic-gate * PF_KEY requires a source address extension, even if the source
28877c478bd9Sstevel@tonic-gate * address itself is unspecified. (See "Set explicit unspecified..."
28887c478bd9Sstevel@tonic-gate * code fragment above. Destination reality check was above.)
28897c478bd9Sstevel@tonic-gate */
28907c478bd9Sstevel@tonic-gate bcopy(src, nexthdr, SADB_64TO8(src->sadb_address_len));
28917c478bd9Sstevel@tonic-gate free(src);
28927c478bd9Sstevel@tonic-gate src = (struct sadb_address *)nexthdr;
28938810c16bSdanmcd src->sadb_address_proto = proto;
28948810c16bSdanmcd ((struct sockaddr_in6 *)(src + 1))->sin6_port = htons(srcport);
28957c478bd9Sstevel@tonic-gate nexthdr += src->sadb_address_len;
28967c478bd9Sstevel@tonic-gate
28978810c16bSdanmcd if (isrc != NULL) {
28988810c16bSdanmcd bcopy(isrc, nexthdr, SADB_64TO8(isrc->sadb_address_len));
28998810c16bSdanmcd free(isrc);
29008810c16bSdanmcd isrc = (struct sadb_address *)nexthdr;
29018810c16bSdanmcd isrc->sadb_address_proto = iproto;
29028810c16bSdanmcd ((struct sockaddr_in6 *)(isrc + 1))->sin6_port =
29038810c16bSdanmcd htons(isrcport);
29048810c16bSdanmcd nexthdr += isrc->sadb_address_len;
29057c478bd9Sstevel@tonic-gate }
29067c478bd9Sstevel@tonic-gate
29078810c16bSdanmcd if (idst != NULL) {
29088810c16bSdanmcd bcopy(idst, nexthdr, SADB_64TO8(idst->sadb_address_len));
29098810c16bSdanmcd free(idst);
29108810c16bSdanmcd idst = (struct sadb_address *)nexthdr;
29118810c16bSdanmcd idst->sadb_address_proto = iproto;
29128810c16bSdanmcd ((struct sockaddr_in6 *)(idst + 1))->sin6_port =
29138810c16bSdanmcd htons(idstport);
29148810c16bSdanmcd nexthdr += idst->sadb_address_len;
29158810c16bSdanmcd }
29167c478bd9Sstevel@tonic-gate
29179c2c14abSThejaswini Singarajipura if (replay_ctr != NULL) {
29189c2c14abSThejaswini Singarajipura bcopy(replay_ctr, nexthdr,
29199c2c14abSThejaswini Singarajipura SADB_64TO8(replay_ctr->sadb_x_rc_len));
29209c2c14abSThejaswini Singarajipura nexthdr += replay_ctr->sadb_x_rc_len;
29219c2c14abSThejaswini Singarajipura free(replay_ctr);
29229c2c14abSThejaswini Singarajipura }
29239c2c14abSThejaswini Singarajipura
29245d3b8cb7SBill Sommerfeld if (label != NULL) {
29255d3b8cb7SBill Sommerfeld bcopy(label, nexthdr, SADB_64TO8(label->sadb_sens_len));
29265d3b8cb7SBill Sommerfeld nexthdr += label->sadb_sens_len;
29275d3b8cb7SBill Sommerfeld free(label);
29285d3b8cb7SBill Sommerfeld label = NULL;
29295d3b8cb7SBill Sommerfeld }
29305d3b8cb7SBill Sommerfeld
29315d3b8cb7SBill Sommerfeld if (olabel != NULL) {
29325d3b8cb7SBill Sommerfeld bcopy(olabel, nexthdr, SADB_64TO8(olabel->sadb_sens_len));
29335d3b8cb7SBill Sommerfeld nexthdr += olabel->sadb_sens_len;
29345d3b8cb7SBill Sommerfeld free(olabel);
29355d3b8cb7SBill Sommerfeld olabel = NULL;
29365d3b8cb7SBill Sommerfeld }
29375d3b8cb7SBill Sommerfeld
293825e435e0Spwernau if (cflag) {
293925e435e0Spwernau /*
294025e435e0Spwernau * Assume the checked cmd would have worked if it was actually
294125e435e0Spwernau * used. doaddresses() will increment lines_added if it
294225e435e0Spwernau * succeeds.
294325e435e0Spwernau */
294425e435e0Spwernau lines_added++;
294525e435e0Spwernau } else {
294638d95a78Smarkfen doaddresses(sadb_msg_type, satype,
2947e3320f40Smarkfen cmd, srchp, dsthp, src, dst, unspec_src, buffer, totallen,
2948e3320f40Smarkfen spi, ebuf);
2949e3320f40Smarkfen }
29507c478bd9Sstevel@tonic-gate
29518810c16bSdanmcd if (isrchp != NULL && isrchp != &dummy.he)
295225e435e0Spwernau freehostent(isrchp);
29538810c16bSdanmcd if (idsthp != NULL && idsthp != &dummy.he)
295425e435e0Spwernau freehostent(idsthp);
29557c478bd9Sstevel@tonic-gate if (srchp != NULL && srchp != &dummy.he)
295625e435e0Spwernau freehostent(srchp);
29577c478bd9Sstevel@tonic-gate if (dsthp != NULL && dsthp != &dummy.he)
295825e435e0Spwernau freehostent(dsthp);
29597c478bd9Sstevel@tonic-gate if (natt_lhp != NULL && natt_lhp != &dummy.he)
296025e435e0Spwernau freehostent(natt_lhp);
29617c478bd9Sstevel@tonic-gate if (natt_rhp != NULL && natt_rhp != &dummy.he)
296225e435e0Spwernau freehostent(natt_rhp);
2963e3320f40Smarkfen free(ebuf);
2964e3320f40Smarkfen free(buffer);
29657c478bd9Sstevel@tonic-gate }
29667c478bd9Sstevel@tonic-gate
29677c478bd9Sstevel@tonic-gate /*
29687c478bd9Sstevel@tonic-gate * DELETE and GET are similar, in that they only need the extensions
29697c478bd9Sstevel@tonic-gate * required to _find_ an SA, and then either delete it or obtain its
29707c478bd9Sstevel@tonic-gate * information.
29717c478bd9Sstevel@tonic-gate */
29727c478bd9Sstevel@tonic-gate static void
dodelget(int cmd,int satype,char * argv[],char * ebuf)2973e3320f40Smarkfen dodelget(int cmd, int satype, char *argv[], char *ebuf)
29747c478bd9Sstevel@tonic-gate {
29757c478bd9Sstevel@tonic-gate struct sadb_msg *msg = (struct sadb_msg *)get_buffer;
29767c478bd9Sstevel@tonic-gate uint64_t *nextext;
29777c478bd9Sstevel@tonic-gate struct sadb_sa *assoc = NULL;
29787c478bd9Sstevel@tonic-gate struct sadb_address *src = NULL, *dst = NULL;
29797c478bd9Sstevel@tonic-gate int next, token, sa_len;
29807c478bd9Sstevel@tonic-gate char *thiscmd;
29817c478bd9Sstevel@tonic-gate uint32_t spi;
298238d95a78Smarkfen uint8_t sadb_msg_type;
29837c478bd9Sstevel@tonic-gate struct hostent *srchp = NULL, *dsthp = NULL;
29847c478bd9Sstevel@tonic-gate struct sockaddr_in6 *sin6;
29857c478bd9Sstevel@tonic-gate boolean_t unspec_src = B_TRUE;
29867c478bd9Sstevel@tonic-gate uint16_t srcport = 0, dstport = 0;
29877c478bd9Sstevel@tonic-gate uint8_t proto = 0;
2988e3320f40Smarkfen char *ep = NULL;
2989df8eb1c6SVladimir Kotal uint32_t sa_flags = 0;
29907c478bd9Sstevel@tonic-gate
29917c478bd9Sstevel@tonic-gate /* Set the first extension header to right past the base message. */
29927c478bd9Sstevel@tonic-gate nextext = (uint64_t *)(msg + 1);
29937c478bd9Sstevel@tonic-gate bzero(nextext, sizeof (get_buffer) - sizeof (*msg));
29947c478bd9Sstevel@tonic-gate
299538d95a78Smarkfen switch (cmd) {
299638d95a78Smarkfen case CMD_GET:
299738d95a78Smarkfen thiscmd = "get";
299838d95a78Smarkfen sadb_msg_type = SADB_GET;
299938d95a78Smarkfen break;
300038d95a78Smarkfen case CMD_DELETE:
300138d95a78Smarkfen thiscmd = "delete";
300238d95a78Smarkfen sadb_msg_type = SADB_DELETE;
300338d95a78Smarkfen break;
300438d95a78Smarkfen case CMD_DELETE_PAIR:
300538d95a78Smarkfen thiscmd = "delete-pair";
300638d95a78Smarkfen sadb_msg_type = SADB_X_DELPAIR;
300738d95a78Smarkfen break;
300838d95a78Smarkfen }
300938d95a78Smarkfen
301038d95a78Smarkfen msg_init(msg, sadb_msg_type, (uint8_t)satype);
30117c478bd9Sstevel@tonic-gate
301207b56925Ssommerfe #define ALLOC_ADDR_EXT(ext, exttype) \
301307b56925Ssommerfe (ext) = (struct sadb_address *)nextext; \
301407b56925Ssommerfe nextext = (uint64_t *)((ext) + 1); \
301507b56925Ssommerfe nextext += SADB_8TO64(roundup(sa_len, 8)); \
301607b56925Ssommerfe (ext)->sadb_address_exttype = exttype; \
301707b56925Ssommerfe (ext)->sadb_address_len = nextext - ((uint64_t *)ext);
301807b56925Ssommerfe
30197c478bd9Sstevel@tonic-gate /* Assume last element in argv is set to NULL. */
30207c478bd9Sstevel@tonic-gate do {
30217c478bd9Sstevel@tonic-gate token = parseextval(*argv, &next);
30227c478bd9Sstevel@tonic-gate argv++;
30237c478bd9Sstevel@tonic-gate switch (token) {
30247c478bd9Sstevel@tonic-gate case TOK_EOF:
30257c478bd9Sstevel@tonic-gate /* Do nothing, I'm done. */
30267c478bd9Sstevel@tonic-gate break;
30277c478bd9Sstevel@tonic-gate case TOK_UNKNOWN:
3028e3320f40Smarkfen ERROR1(ep, ebuf, gettext(
3029e3320f40Smarkfen "Unknown extension field \"%s\"\n"), *(argv - 1));
30307c478bd9Sstevel@tonic-gate break;
30317c478bd9Sstevel@tonic-gate case TOK_SPI:
30327c478bd9Sstevel@tonic-gate if (assoc != NULL) {
3033e3320f40Smarkfen ERROR(ep, ebuf, gettext(
3034e3320f40Smarkfen "Can only specify single SPI value.\n"));
3035e3320f40Smarkfen break;
30367c478bd9Sstevel@tonic-gate }
30377c478bd9Sstevel@tonic-gate assoc = (struct sadb_sa *)nextext;
30387c478bd9Sstevel@tonic-gate nextext = (uint64_t *)(assoc + 1);
30397c478bd9Sstevel@tonic-gate assoc->sadb_sa_len = SADB_8TO64(sizeof (*assoc));
30407c478bd9Sstevel@tonic-gate assoc->sadb_sa_exttype = SADB_EXT_SA;
30417c478bd9Sstevel@tonic-gate assoc->sadb_sa_spi = htonl((uint32_t)parsenum(*argv,
3042e3320f40Smarkfen B_TRUE, ebuf));
30437c478bd9Sstevel@tonic-gate spi = assoc->sadb_sa_spi;
30447c478bd9Sstevel@tonic-gate argv++;
30457c478bd9Sstevel@tonic-gate break;
30467c478bd9Sstevel@tonic-gate case TOK_SRCPORT:
30477c478bd9Sstevel@tonic-gate if (srcport != 0) {
3048e3320f40Smarkfen ERROR(ep, ebuf, gettext(
3049e3320f40Smarkfen "Can only specify single source port.\n"));
3050e3320f40Smarkfen break;
30517c478bd9Sstevel@tonic-gate }
3052e3320f40Smarkfen srcport = parsenum(*argv, B_TRUE, ebuf);
30537c478bd9Sstevel@tonic-gate argv++;
30547c478bd9Sstevel@tonic-gate break;
30557c478bd9Sstevel@tonic-gate case TOK_DSTPORT:
30567c478bd9Sstevel@tonic-gate if (dstport != 0) {
3057e3320f40Smarkfen ERROR(ep, ebuf, gettext(
3058e3320f40Smarkfen "Can only "
3059e3320f40Smarkfen "specify single destination port.\n"));
3060e3320f40Smarkfen break;
30617c478bd9Sstevel@tonic-gate }
3062e3320f40Smarkfen dstport = parsenum(*argv, B_TRUE, ebuf);
30637c478bd9Sstevel@tonic-gate argv++;
30647c478bd9Sstevel@tonic-gate break;
30657c478bd9Sstevel@tonic-gate case TOK_PROTO:
30667c478bd9Sstevel@tonic-gate if (proto != 0) {
3067e3320f40Smarkfen ERROR(ep, ebuf, gettext(
3068e3320f40Smarkfen "Can only specify single protocol.\n"));
3069e3320f40Smarkfen break;
30707c478bd9Sstevel@tonic-gate }
3071e3320f40Smarkfen proto = parsenum(*argv, B_TRUE, ebuf);
30727c478bd9Sstevel@tonic-gate argv++;
30737c478bd9Sstevel@tonic-gate break;
30747c478bd9Sstevel@tonic-gate case TOK_SRCADDR:
30757c478bd9Sstevel@tonic-gate case TOK_SRCADDR6:
30767c478bd9Sstevel@tonic-gate if (src != NULL) {
3077e3320f40Smarkfen ERROR(ep, ebuf, gettext(
3078e3320f40Smarkfen "Can only specify single source addr.\n"));
3079e3320f40Smarkfen break;
30807c478bd9Sstevel@tonic-gate }
30817c478bd9Sstevel@tonic-gate sa_len = parseaddr(*argv, &srchp,
3082e3320f40Smarkfen (token == TOK_SRCADDR6), ebuf);
3083e3320f40Smarkfen if (srchp == NULL) {
3084e3320f40Smarkfen ERROR1(ep, ebuf, gettext(
3085e3320f40Smarkfen "Unknown source address \"%s\"\n"), *argv);
3086e3320f40Smarkfen break;
3087e3320f40Smarkfen }
30887c478bd9Sstevel@tonic-gate argv++;
30897c478bd9Sstevel@tonic-gate
30907c478bd9Sstevel@tonic-gate unspec_src = B_FALSE;
309107b56925Ssommerfe
309207b56925Ssommerfe ALLOC_ADDR_EXT(src, SADB_EXT_ADDRESS_SRC);
309307b56925Ssommerfe
30947c478bd9Sstevel@tonic-gate if (srchp == &dummy.he) {
30957c478bd9Sstevel@tonic-gate /*
30967c478bd9Sstevel@tonic-gate * Single address with -n flag.
30977c478bd9Sstevel@tonic-gate */
30987c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(src + 1);
30997c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6));
31007c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6;
31017c478bd9Sstevel@tonic-gate bcopy(srchp->h_addr_list[0], &sin6->sin6_addr,
31027c478bd9Sstevel@tonic-gate sizeof (struct in6_addr));
31037c478bd9Sstevel@tonic-gate }
31047c478bd9Sstevel@tonic-gate /* The rest is pre-bzeroed for us. */
31057c478bd9Sstevel@tonic-gate break;
31067c478bd9Sstevel@tonic-gate case TOK_DSTADDR:
31077c478bd9Sstevel@tonic-gate case TOK_DSTADDR6:
31087c478bd9Sstevel@tonic-gate if (dst != NULL) {
3109e3320f40Smarkfen ERROR(ep, ebuf, gettext(
3110e3320f40Smarkfen "Can only specify single destination "
3111e3320f40Smarkfen "address.\n"));
3112e3320f40Smarkfen break;
31137c478bd9Sstevel@tonic-gate }
31147c478bd9Sstevel@tonic-gate sa_len = parseaddr(*argv, &dsthp,
3115e3320f40Smarkfen (token == TOK_SRCADDR6), ebuf);
3116e3320f40Smarkfen if (dsthp == NULL) {
3117e3320f40Smarkfen ERROR1(ep, ebuf, gettext(
3118e3320f40Smarkfen "Unknown destination address \"%s\"\n"),
3119e3320f40Smarkfen *argv);
3120e3320f40Smarkfen break;
3121e3320f40Smarkfen }
31227c478bd9Sstevel@tonic-gate argv++;
31237c478bd9Sstevel@tonic-gate
312407b56925Ssommerfe ALLOC_ADDR_EXT(dst, SADB_EXT_ADDRESS_DST);
312507b56925Ssommerfe
31267c478bd9Sstevel@tonic-gate if (dsthp == &dummy.he) {
31277c478bd9Sstevel@tonic-gate /*
31287c478bd9Sstevel@tonic-gate * Single address with -n flag.
31297c478bd9Sstevel@tonic-gate */
31307c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(dst + 1);
31317c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6));
31327c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6;
31337c478bd9Sstevel@tonic-gate bcopy(dsthp->h_addr_list[0], &sin6->sin6_addr,
31347c478bd9Sstevel@tonic-gate sizeof (struct in6_addr));
31357c478bd9Sstevel@tonic-gate }
31367c478bd9Sstevel@tonic-gate /* The rest is pre-bzeroed for us. */
31377c478bd9Sstevel@tonic-gate break;
313838d95a78Smarkfen case TOK_FLAG_INBOUND:
3139df8eb1c6SVladimir Kotal sa_flags |= SADB_X_SAFLAGS_INBOUND;
314038d95a78Smarkfen break;
314138d95a78Smarkfen case TOK_FLAG_OUTBOUND:
3142df8eb1c6SVladimir Kotal sa_flags |= SADB_X_SAFLAGS_OUTBOUND;
314338d95a78Smarkfen break;
31447c478bd9Sstevel@tonic-gate default:
3145e3320f40Smarkfen ERROR2(ep, ebuf, gettext(
3146e3320f40Smarkfen "Don't use extension %s for '%s' command.\n"),
3147e3320f40Smarkfen *(argv - 1), thiscmd);
31487c478bd9Sstevel@tonic-gate break;
31497c478bd9Sstevel@tonic-gate }
31507c478bd9Sstevel@tonic-gate } while (token != TOK_EOF);
31517c478bd9Sstevel@tonic-gate
3152e3320f40Smarkfen handle_errors(ep, ebuf, B_TRUE, B_FALSE);
3153e3320f40Smarkfen
3154df8eb1c6SVladimir Kotal if (assoc == NULL) {
3155df8eb1c6SVladimir Kotal FATAL1(ep, ebuf, gettext(
3156df8eb1c6SVladimir Kotal "Need SA parameters for %s.\n"), thiscmd);
3157df8eb1c6SVladimir Kotal }
3158df8eb1c6SVladimir Kotal
3159df8eb1c6SVladimir Kotal /* We can set the flags now with valid assoc in hand. */
3160df8eb1c6SVladimir Kotal assoc->sadb_sa_flags |= sa_flags;
3161df8eb1c6SVladimir Kotal
316207b56925Ssommerfe if ((srcport != 0) && (src == NULL)) {
316307b56925Ssommerfe ALLOC_ADDR_EXT(src, SADB_EXT_ADDRESS_SRC);
316407b56925Ssommerfe sin6 = (struct sockaddr_in6 *)(src + 1);
31658810c16bSdanmcd src->sadb_address_proto = proto;
316607b56925Ssommerfe bzero(sin6, sizeof (*sin6));
316707b56925Ssommerfe sin6->sin6_family = AF_INET6;
31688810c16bSdanmcd sin6->sin6_port = htons(srcport);
316907b56925Ssommerfe }
317007b56925Ssommerfe
317107b56925Ssommerfe if ((dstport != 0) && (dst == NULL)) {
317207b56925Ssommerfe ALLOC_ADDR_EXT(dst, SADB_EXT_ADDRESS_DST);
317307b56925Ssommerfe sin6 = (struct sockaddr_in6 *)(dst + 1);
31748810c16bSdanmcd src->sadb_address_proto = proto;
317507b56925Ssommerfe bzero(sin6, sizeof (*sin6));
317607b56925Ssommerfe sin6->sin6_family = AF_INET6;
31778810c16bSdanmcd sin6->sin6_port = htons(dstport);
317807b56925Ssommerfe }
317907b56925Ssommerfe
31807c478bd9Sstevel@tonic-gate /* So I have enough of the message to send it down! */
31817c478bd9Sstevel@tonic-gate msg->sadb_msg_len = nextext - get_buffer;
31827c478bd9Sstevel@tonic-gate
318325e435e0Spwernau if (cflag) {
318425e435e0Spwernau /*
318525e435e0Spwernau * Assume the checked cmd would have worked if it was actually
318625e435e0Spwernau * used. doaddresses() will increment lines_added if it
318725e435e0Spwernau * succeeds.
318825e435e0Spwernau */
318925e435e0Spwernau lines_added++;
319025e435e0Spwernau } else {
319138d95a78Smarkfen doaddresses(sadb_msg_type, satype,
3192e3320f40Smarkfen cmd, srchp, dsthp, src, dst, unspec_src, get_buffer,
3193e3320f40Smarkfen sizeof (get_buffer), spi, NULL);
3194e3320f40Smarkfen }
31957c478bd9Sstevel@tonic-gate
31967c478bd9Sstevel@tonic-gate if (srchp != NULL && srchp != &dummy.he)
31977c478bd9Sstevel@tonic-gate freehostent(srchp);
31987c478bd9Sstevel@tonic-gate if (dsthp != NULL && dsthp != &dummy.he)
31997c478bd9Sstevel@tonic-gate freehostent(dsthp);
32007c478bd9Sstevel@tonic-gate }
32017c478bd9Sstevel@tonic-gate
32027c478bd9Sstevel@tonic-gate /*
3203bfe6f8f5SVladimir Kotal * "ipseckey monitor" should exit very gracefully if ^C is tapped provided
3204bfe6f8f5SVladimir Kotal * it is not running in interactive mode.
32057c478bd9Sstevel@tonic-gate */
32067c478bd9Sstevel@tonic-gate static void
monitor_catch(int signal)32077c478bd9Sstevel@tonic-gate monitor_catch(int signal)
32087c478bd9Sstevel@tonic-gate {
3209bfe6f8f5SVladimir Kotal if (!interactive)
3210bfe6f8f5SVladimir Kotal errx(signal, gettext("Bailing on signal %d."), signal);
32117c478bd9Sstevel@tonic-gate }
32127c478bd9Sstevel@tonic-gate
32137c478bd9Sstevel@tonic-gate /*
32147c478bd9Sstevel@tonic-gate * Loop forever, listening on PF_KEY messages.
32157c478bd9Sstevel@tonic-gate */
32167c478bd9Sstevel@tonic-gate static void
domonitor(boolean_t passive)32177c478bd9Sstevel@tonic-gate domonitor(boolean_t passive)
32187c478bd9Sstevel@tonic-gate {
32197c478bd9Sstevel@tonic-gate struct sadb_msg *samsg;
3220bfe6f8f5SVladimir Kotal struct sigaction newsig, oldsig;
32217c478bd9Sstevel@tonic-gate int rc;
32227c478bd9Sstevel@tonic-gate
32237c478bd9Sstevel@tonic-gate /* Catch ^C. */
3224bfe6f8f5SVladimir Kotal newsig.sa_handler = monitor_catch;
3225bfe6f8f5SVladimir Kotal newsig.sa_flags = 0;
3226bfe6f8f5SVladimir Kotal (void) sigemptyset(&newsig.sa_mask);
3227bfe6f8f5SVladimir Kotal (void) sigaddset(&newsig.sa_mask, SIGINT);
3228bfe6f8f5SVladimir Kotal (void) sigaction(SIGINT, &newsig, &oldsig);
32297c478bd9Sstevel@tonic-gate
32307c478bd9Sstevel@tonic-gate samsg = (struct sadb_msg *)get_buffer;
32317c478bd9Sstevel@tonic-gate if (!passive) {
32327c478bd9Sstevel@tonic-gate (void) printf(gettext("Actively"));
32337c478bd9Sstevel@tonic-gate msg_init(samsg, SADB_X_PROMISC, 1); /* Turn ON promisc. */
32347c478bd9Sstevel@tonic-gate rc = key_write(keysock, samsg, sizeof (*samsg));
32357c478bd9Sstevel@tonic-gate if (rc == -1)
32367c478bd9Sstevel@tonic-gate Bail("write (SADB_X_PROMISC)");
32377c478bd9Sstevel@tonic-gate } else {
32387c478bd9Sstevel@tonic-gate (void) printf(gettext("Passively"));
32397c478bd9Sstevel@tonic-gate }
32407c478bd9Sstevel@tonic-gate (void) printf(gettext(" monitoring the PF_KEY socket.\n"));
32417c478bd9Sstevel@tonic-gate
32427c478bd9Sstevel@tonic-gate for (; ; ) {
32437c478bd9Sstevel@tonic-gate /*
32447c478bd9Sstevel@tonic-gate * I assume that read() is non-blocking, and will never
32457c478bd9Sstevel@tonic-gate * return 0.
32467c478bd9Sstevel@tonic-gate */
32477c478bd9Sstevel@tonic-gate rc = read(keysock, samsg, sizeof (get_buffer));
3248bfe6f8f5SVladimir Kotal if (rc == -1) {
3249bfe6f8f5SVladimir Kotal if (errno == EINTR && interactive)
3250bfe6f8f5SVladimir Kotal goto out;
3251bfe6f8f5SVladimir Kotal else
3252bfe6f8f5SVladimir Kotal Bail("read (in domonitor)");
3253bfe6f8f5SVladimir Kotal }
32547c478bd9Sstevel@tonic-gate (void) printf(gettext("Read %d bytes.\n"), rc);
32557c478bd9Sstevel@tonic-gate /*
32567c478bd9Sstevel@tonic-gate * Q: Should I use the same method of printing as GET does?
32577c478bd9Sstevel@tonic-gate * A: For now, yes.
32587c478bd9Sstevel@tonic-gate */
3259bb3ed8dfSpwernau print_samsg(stdout, get_buffer, B_TRUE, vflag, nflag);
32607c478bd9Sstevel@tonic-gate (void) putchar('\n');
32617c478bd9Sstevel@tonic-gate }
3262bfe6f8f5SVladimir Kotal
3263bfe6f8f5SVladimir Kotal out:
3264bfe6f8f5SVladimir Kotal if (interactive)
3265bfe6f8f5SVladimir Kotal /* restore SIGINT behavior */
3266bfe6f8f5SVladimir Kotal (void) sigaction(SIGINT, &oldsig, NULL);
32677c478bd9Sstevel@tonic-gate }
32687c478bd9Sstevel@tonic-gate
32697c478bd9Sstevel@tonic-gate /*
32707c478bd9Sstevel@tonic-gate * Either mask or unmask all relevant signals.
32717c478bd9Sstevel@tonic-gate */
32727c478bd9Sstevel@tonic-gate static void
mask_signals(boolean_t unmask)32737c478bd9Sstevel@tonic-gate mask_signals(boolean_t unmask)
32747c478bd9Sstevel@tonic-gate {
32757c478bd9Sstevel@tonic-gate sigset_t set;
32767c478bd9Sstevel@tonic-gate static sigset_t oset;
32777c478bd9Sstevel@tonic-gate
32787c478bd9Sstevel@tonic-gate if (unmask) {
32797c478bd9Sstevel@tonic-gate (void) sigprocmask(SIG_SETMASK, &oset, NULL);
32807c478bd9Sstevel@tonic-gate } else {
32817c478bd9Sstevel@tonic-gate (void) sigfillset(&set);
32827c478bd9Sstevel@tonic-gate (void) sigprocmask(SIG_SETMASK, &set, &oset);
32837c478bd9Sstevel@tonic-gate }
32847c478bd9Sstevel@tonic-gate }
32857c478bd9Sstevel@tonic-gate
32867c478bd9Sstevel@tonic-gate /*
32877c478bd9Sstevel@tonic-gate * Assorted functions to print help text.
32887c478bd9Sstevel@tonic-gate */
32897c478bd9Sstevel@tonic-gate #define puts_tr(s) (void) puts(gettext(s))
32907c478bd9Sstevel@tonic-gate
32917c478bd9Sstevel@tonic-gate static void
doattrhelp()32927c478bd9Sstevel@tonic-gate doattrhelp()
32937c478bd9Sstevel@tonic-gate {
32947c478bd9Sstevel@tonic-gate int i;
32957c478bd9Sstevel@tonic-gate
32967c478bd9Sstevel@tonic-gate puts_tr("\nSA attributes:");
32977c478bd9Sstevel@tonic-gate
32987c478bd9Sstevel@tonic-gate for (i = 0; tokens[i].string != NULL; i++) {
32997c478bd9Sstevel@tonic-gate if (i%3 == 0)
33007c478bd9Sstevel@tonic-gate (void) printf("\n");
33017c478bd9Sstevel@tonic-gate (void) printf(" %-15.15s", tokens[i].string);
33027c478bd9Sstevel@tonic-gate }
33037c478bd9Sstevel@tonic-gate (void) printf("\n");
33047c478bd9Sstevel@tonic-gate }
33057c478bd9Sstevel@tonic-gate
33067c478bd9Sstevel@tonic-gate static void
dohelpcmd(char * cmds)33077c478bd9Sstevel@tonic-gate dohelpcmd(char *cmds)
33087c478bd9Sstevel@tonic-gate {
33097c478bd9Sstevel@tonic-gate int cmd;
33107c478bd9Sstevel@tonic-gate
33117c478bd9Sstevel@tonic-gate if (strcmp(cmds, "attr") == 0) {
33127c478bd9Sstevel@tonic-gate doattrhelp();
33137c478bd9Sstevel@tonic-gate return;
33147c478bd9Sstevel@tonic-gate }
33157c478bd9Sstevel@tonic-gate
33167c478bd9Sstevel@tonic-gate cmd = parsecmd(cmds);
33177c478bd9Sstevel@tonic-gate switch (cmd) {
33187c478bd9Sstevel@tonic-gate case CMD_UPDATE:
33197c478bd9Sstevel@tonic-gate puts_tr("update - Update an existing SA");
33207c478bd9Sstevel@tonic-gate break;
332138d95a78Smarkfen case CMD_UPDATE_PAIR:
332238d95a78Smarkfen puts_tr("update-pair - Update an existing pair of SA's");
332338d95a78Smarkfen break;
33247c478bd9Sstevel@tonic-gate case CMD_ADD:
33257c478bd9Sstevel@tonic-gate puts_tr("add - Add a new security association (SA)");
33267c478bd9Sstevel@tonic-gate break;
33277c478bd9Sstevel@tonic-gate case CMD_DELETE:
33287c478bd9Sstevel@tonic-gate puts_tr("delete - Delete an SA");
33297c478bd9Sstevel@tonic-gate break;
333038d95a78Smarkfen case CMD_DELETE_PAIR:
333138d95a78Smarkfen puts_tr("delete-pair - Delete a pair of SA's");
333238d95a78Smarkfen break;
33337c478bd9Sstevel@tonic-gate case CMD_GET:
33347c478bd9Sstevel@tonic-gate puts_tr("get - Display an SA");
33357c478bd9Sstevel@tonic-gate break;
33367c478bd9Sstevel@tonic-gate case CMD_FLUSH:
33377c478bd9Sstevel@tonic-gate puts_tr("flush - Delete all SAs");
3338bfe6f8f5SVladimir Kotal puts_tr("");
3339bfe6f8f5SVladimir Kotal puts_tr("Optional arguments:");
3340bfe6f8f5SVladimir Kotal puts_tr("all delete all SAs");
3341bfe6f8f5SVladimir Kotal puts_tr("esp delete just ESP SAs");
3342bfe6f8f5SVladimir Kotal puts_tr("ah delete just AH SAs");
3343bfe6f8f5SVladimir Kotal puts_tr("<number> delete just SAs with type given by number");
3344bfe6f8f5SVladimir Kotal puts_tr("");
33457c478bd9Sstevel@tonic-gate break;
33467c478bd9Sstevel@tonic-gate case CMD_DUMP:
33477c478bd9Sstevel@tonic-gate puts_tr("dump - Display all SAs");
3348bfe6f8f5SVladimir Kotal puts_tr("");
3349bfe6f8f5SVladimir Kotal puts_tr("Optional arguments:");
3350bfe6f8f5SVladimir Kotal puts_tr("all display all SAs");
3351bfe6f8f5SVladimir Kotal puts_tr("esp display just ESP SAs");
3352bfe6f8f5SVladimir Kotal puts_tr("ah display just AH SAs");
3353bfe6f8f5SVladimir Kotal puts_tr("<number> display just SAs with type "
3354bfe6f8f5SVladimir Kotal "given by number");
3355bfe6f8f5SVladimir Kotal puts_tr("");
33567c478bd9Sstevel@tonic-gate break;
33577c478bd9Sstevel@tonic-gate case CMD_MONITOR:
33587c478bd9Sstevel@tonic-gate puts_tr("monitor - Monitor all PF_KEY reply messages.");
33597c478bd9Sstevel@tonic-gate break;
33607c478bd9Sstevel@tonic-gate case CMD_PMONITOR:
33617c478bd9Sstevel@tonic-gate puts_tr(
33627c478bd9Sstevel@tonic-gate "pmonitor, passive_monitor - Monitor PF_KEY messages that");
33637c478bd9Sstevel@tonic-gate puts_tr(
33647c478bd9Sstevel@tonic-gate " reply to all PF_KEY sockets.");
33657c478bd9Sstevel@tonic-gate break;
33667c478bd9Sstevel@tonic-gate
33677c478bd9Sstevel@tonic-gate case CMD_QUIT:
33687c478bd9Sstevel@tonic-gate puts_tr("quit, exit - Exit the program");
33697c478bd9Sstevel@tonic-gate break;
33707c478bd9Sstevel@tonic-gate case CMD_SAVE:
33717c478bd9Sstevel@tonic-gate puts_tr("save - Saves all SAs to a file");
33727c478bd9Sstevel@tonic-gate break;
33737c478bd9Sstevel@tonic-gate case CMD_HELP:
33747c478bd9Sstevel@tonic-gate puts_tr("help - Display list of commands");
33757c478bd9Sstevel@tonic-gate puts_tr("help <cmd> - Display help for command");
33767c478bd9Sstevel@tonic-gate puts_tr("help attr - Display possible SA attributes");
33777c478bd9Sstevel@tonic-gate break;
33787c478bd9Sstevel@tonic-gate default:
33797c478bd9Sstevel@tonic-gate (void) printf(gettext("%s: Unknown command\n"), cmds);
33807c478bd9Sstevel@tonic-gate break;
33817c478bd9Sstevel@tonic-gate }
33827c478bd9Sstevel@tonic-gate }
33837c478bd9Sstevel@tonic-gate
33847c478bd9Sstevel@tonic-gate
33857c478bd9Sstevel@tonic-gate static void
dohelp(char * cmds)33867c478bd9Sstevel@tonic-gate dohelp(char *cmds)
33877c478bd9Sstevel@tonic-gate {
33887c478bd9Sstevel@tonic-gate if (cmds != NULL) {
33897c478bd9Sstevel@tonic-gate dohelpcmd(cmds);
33907c478bd9Sstevel@tonic-gate return;
33917c478bd9Sstevel@tonic-gate }
33927c478bd9Sstevel@tonic-gate puts_tr("Commands");
33937c478bd9Sstevel@tonic-gate puts_tr("--------");
33947c478bd9Sstevel@tonic-gate puts_tr("?, help - Display this list");
33957c478bd9Sstevel@tonic-gate puts_tr("help <cmd> - Display help for command");
33967c478bd9Sstevel@tonic-gate puts_tr("help attr - Display possible SA attributes");
33977c478bd9Sstevel@tonic-gate puts_tr("quit, exit - Exit the program");
33987c478bd9Sstevel@tonic-gate puts_tr("monitor - Monitor all PF_KEY reply messages.");
33997c478bd9Sstevel@tonic-gate puts_tr("pmonitor, passive_monitor - Monitor PF_KEY messages that");
34007c478bd9Sstevel@tonic-gate puts_tr(" reply to all PF_KEY sockets.");
34017c478bd9Sstevel@tonic-gate puts_tr("");
34027c478bd9Sstevel@tonic-gate puts_tr("The following commands are of the form:");
34037c478bd9Sstevel@tonic-gate puts_tr(" <command> {SA type} {attribute value}*");
34047c478bd9Sstevel@tonic-gate puts_tr("");
34057c478bd9Sstevel@tonic-gate puts_tr("add (interactive only) - Add a new security association (SA)");
34067c478bd9Sstevel@tonic-gate puts_tr("update (interactive only) - Update an existing SA");
340738d95a78Smarkfen puts_tr("update-pair (interactive only) - Update an existing SA pair");
34087c478bd9Sstevel@tonic-gate puts_tr("delete - Delete an SA");
340938d95a78Smarkfen puts_tr("delete-pair - Delete an SA pair");
34107c478bd9Sstevel@tonic-gate puts_tr("get - Display an SA");
34117c478bd9Sstevel@tonic-gate puts_tr("flush - Delete all SAs");
34127c478bd9Sstevel@tonic-gate puts_tr("dump - Display all SAs");
34137c478bd9Sstevel@tonic-gate puts_tr("save - Saves all SAs to a file");
34147c478bd9Sstevel@tonic-gate }
34157c478bd9Sstevel@tonic-gate
34167c478bd9Sstevel@tonic-gate /*
34177c478bd9Sstevel@tonic-gate * "Parse" a command line from argv.
34187c478bd9Sstevel@tonic-gate */
34197c478bd9Sstevel@tonic-gate static void
parseit(int argc,char * argv[],char * ebuf,boolean_t read_cmdfile)342025e435e0Spwernau parseit(int argc, char *argv[], char *ebuf, boolean_t read_cmdfile)
34217c478bd9Sstevel@tonic-gate {
34227c478bd9Sstevel@tonic-gate int cmd, satype;
3423e3320f40Smarkfen char *ep = NULL;
34247c478bd9Sstevel@tonic-gate
34257c478bd9Sstevel@tonic-gate if (argc == 0)
34267c478bd9Sstevel@tonic-gate return;
34277c478bd9Sstevel@tonic-gate cmd = parsecmd(*argv++);
34287c478bd9Sstevel@tonic-gate
342925e435e0Spwernau /*
343025e435e0Spwernau * Some commands loop forever and should only be run from the command
343125e435e0Spwernau * line, they should never be run from a command file as this may
343225e435e0Spwernau * be used at boot time.
343325e435e0Spwernau */
34347c478bd9Sstevel@tonic-gate switch (cmd) {
34357c478bd9Sstevel@tonic-gate case CMD_HELP:
343625e435e0Spwernau if (read_cmdfile)
343725e435e0Spwernau ERROR(ep, ebuf, gettext("Help not appropriate in "
343825e435e0Spwernau "config file."));
343925e435e0Spwernau else
344025e435e0Spwernau dohelp(*argv);
34417c478bd9Sstevel@tonic-gate return;
34427c478bd9Sstevel@tonic-gate case CMD_MONITOR:
344325e435e0Spwernau if (read_cmdfile)
344425e435e0Spwernau ERROR(ep, ebuf, gettext("Monitor not appropriate in "
344525e435e0Spwernau "config file."));
3446bfe6f8f5SVladimir Kotal else {
344725e435e0Spwernau domonitor(B_FALSE);
3448bfe6f8f5SVladimir Kotal /*
3449bfe6f8f5SVladimir Kotal * Return from the function in interactive mode to
3450bfe6f8f5SVladimir Kotal * avoid error message in the next switch statement.
3451bfe6f8f5SVladimir Kotal * Also print newline to prevent prompt clobbering.
3452bfe6f8f5SVladimir Kotal * The same is done for CMD_PMONITOR.
3453bfe6f8f5SVladimir Kotal */
3454bfe6f8f5SVladimir Kotal if (interactive) {
3455bfe6f8f5SVladimir Kotal (void) printf("\n");
3456bfe6f8f5SVladimir Kotal return;
3457bfe6f8f5SVladimir Kotal }
3458bfe6f8f5SVladimir Kotal }
34597c478bd9Sstevel@tonic-gate break;
34607c478bd9Sstevel@tonic-gate case CMD_PMONITOR:
346125e435e0Spwernau if (read_cmdfile)
346225e435e0Spwernau ERROR(ep, ebuf, gettext("Monitor not appropriate in "
346325e435e0Spwernau "config file."));
3464bfe6f8f5SVladimir Kotal else {
346525e435e0Spwernau domonitor(B_TRUE);
3466bfe6f8f5SVladimir Kotal if (interactive) {
3467bfe6f8f5SVladimir Kotal (void) printf("\n");
3468bfe6f8f5SVladimir Kotal return;
3469bfe6f8f5SVladimir Kotal }
3470bfe6f8f5SVladimir Kotal }
34717c478bd9Sstevel@tonic-gate break;
34727c478bd9Sstevel@tonic-gate case CMD_QUIT:
3473e3320f40Smarkfen EXIT_OK(NULL);
34747c478bd9Sstevel@tonic-gate }
34757c478bd9Sstevel@tonic-gate
347625e435e0Spwernau handle_errors(ep, ebuf, B_FALSE, B_FALSE);
347725e435e0Spwernau
3478e3320f40Smarkfen satype = parsesatype(*argv, ebuf);
34797c478bd9Sstevel@tonic-gate
34807c478bd9Sstevel@tonic-gate if (satype != SADB_SATYPE_UNSPEC) {
34817c478bd9Sstevel@tonic-gate argv++;
34827c478bd9Sstevel@tonic-gate } else {
34837c478bd9Sstevel@tonic-gate /*
34847c478bd9Sstevel@tonic-gate * You must specify either "all" or a specific SA type
34857c478bd9Sstevel@tonic-gate * for the "save" command.
34867c478bd9Sstevel@tonic-gate */
34877c478bd9Sstevel@tonic-gate if (cmd == CMD_SAVE)
34887c478bd9Sstevel@tonic-gate if (*argv == NULL) {
3489e3320f40Smarkfen FATAL(ep, ebuf, gettext(
3490e3320f40Smarkfen "Must specify a specific "
3491e3320f40Smarkfen "SA type for save.\n"));
34927c478bd9Sstevel@tonic-gate } else {
34937c478bd9Sstevel@tonic-gate argv++;
34947c478bd9Sstevel@tonic-gate }
34957c478bd9Sstevel@tonic-gate }
34967c478bd9Sstevel@tonic-gate
34977c478bd9Sstevel@tonic-gate switch (cmd) {
34987c478bd9Sstevel@tonic-gate case CMD_FLUSH:
3499bfe6f8f5SVladimir Kotal if (argc > 2) {
3500bfe6f8f5SVladimir Kotal ERROR(ep, ebuf, gettext("Too many arguments for "
3501bfe6f8f5SVladimir Kotal "flush command"));
3502bfe6f8f5SVladimir Kotal handle_errors(ep, ebuf,
3503bfe6f8f5SVladimir Kotal interactive ? B_TRUE : B_FALSE, B_FALSE);
3504bfe6f8f5SVladimir Kotal }
350525e435e0Spwernau if (!cflag)
350625e435e0Spwernau doflush(satype);
350725e435e0Spwernau /*
350825e435e0Spwernau * If this was called because of an entry in a cmd file
350925e435e0Spwernau * then this action needs to be counted to prevent
351025e435e0Spwernau * do_interactive() treating this as an error.
351125e435e0Spwernau */
351225e435e0Spwernau lines_added++;
35137c478bd9Sstevel@tonic-gate break;
35147c478bd9Sstevel@tonic-gate case CMD_ADD:
35157c478bd9Sstevel@tonic-gate case CMD_UPDATE:
351638d95a78Smarkfen case CMD_UPDATE_PAIR:
35177c478bd9Sstevel@tonic-gate /*
35187c478bd9Sstevel@tonic-gate * NOTE: Shouldn't allow ADDs or UPDATEs with keying material
35197c478bd9Sstevel@tonic-gate * from the command line.
35207c478bd9Sstevel@tonic-gate */
35217c478bd9Sstevel@tonic-gate if (!interactive) {
35227c478bd9Sstevel@tonic-gate errx(1, gettext(
3523e3320f40Smarkfen "can't do ADD or UPDATE from the command line.\n"));
35247c478bd9Sstevel@tonic-gate }
35257c478bd9Sstevel@tonic-gate if (satype == SADB_SATYPE_UNSPEC) {
3526e3320f40Smarkfen FATAL(ep, ebuf, gettext(
3527e3320f40Smarkfen "Must specify a specific SA type."));
35287c478bd9Sstevel@tonic-gate /* NOTREACHED */
35297c478bd9Sstevel@tonic-gate }
35307c478bd9Sstevel@tonic-gate /* Parse for extensions, including keying material. */
3531e3320f40Smarkfen doaddup(cmd, satype, argv, ebuf);
35327c478bd9Sstevel@tonic-gate break;
35337c478bd9Sstevel@tonic-gate case CMD_DELETE:
353438d95a78Smarkfen case CMD_DELETE_PAIR:
35357c478bd9Sstevel@tonic-gate case CMD_GET:
35367c478bd9Sstevel@tonic-gate if (satype == SADB_SATYPE_UNSPEC) {
3537e3320f40Smarkfen FATAL(ep, ebuf, gettext(
3538e3320f40Smarkfen "Must specify a single SA type."));
35397c478bd9Sstevel@tonic-gate /* NOTREACHED */
35407c478bd9Sstevel@tonic-gate }
35417c478bd9Sstevel@tonic-gate /* Parse for bare minimum to locate an SA. */
3542e3320f40Smarkfen dodelget(cmd, satype, argv, ebuf);
35437c478bd9Sstevel@tonic-gate break;
35447c478bd9Sstevel@tonic-gate case CMD_DUMP:
354525e435e0Spwernau if (read_cmdfile)
354625e435e0Spwernau ERROR(ep, ebuf, gettext("Dump not appropriate in "
354725e435e0Spwernau "config file."));
3548bfe6f8f5SVladimir Kotal else {
3549bfe6f8f5SVladimir Kotal if (argc > 2) {
3550bfe6f8f5SVladimir Kotal ERROR(ep, ebuf, gettext("Too many arguments "
3551bfe6f8f5SVladimir Kotal "for dump command"));
3552bfe6f8f5SVladimir Kotal handle_errors(ep, ebuf,
3553bfe6f8f5SVladimir Kotal interactive ? B_TRUE : B_FALSE, B_FALSE);
3554bfe6f8f5SVladimir Kotal }
355525e435e0Spwernau dodump(satype, NULL);
3556bfe6f8f5SVladimir Kotal }
35577c478bd9Sstevel@tonic-gate break;
35587c478bd9Sstevel@tonic-gate case CMD_SAVE:
355925e435e0Spwernau if (read_cmdfile) {
356025e435e0Spwernau ERROR(ep, ebuf, gettext("Save not appropriate in "
356125e435e0Spwernau "config file."));
356225e435e0Spwernau } else {
356325e435e0Spwernau mask_signals(B_FALSE); /* Mask signals */
356425e435e0Spwernau dodump(satype, opensavefile(argv[0]));
356525e435e0Spwernau mask_signals(B_TRUE); /* Unmask signals */
356625e435e0Spwernau }
35677c478bd9Sstevel@tonic-gate break;
35687c478bd9Sstevel@tonic-gate default:
3569e3320f40Smarkfen warnx(gettext("Unknown command (%s).\n"),
35707c478bd9Sstevel@tonic-gate *(argv - ((satype == SADB_SATYPE_UNSPEC) ? 1 : 2)));
35717c478bd9Sstevel@tonic-gate usage();
35727c478bd9Sstevel@tonic-gate }
357325e435e0Spwernau handle_errors(ep, ebuf, B_FALSE, B_FALSE);
35747c478bd9Sstevel@tonic-gate }
35757c478bd9Sstevel@tonic-gate
35767c478bd9Sstevel@tonic-gate int
main(int argc,char * argv[])35777c478bd9Sstevel@tonic-gate main(int argc, char *argv[])
35787c478bd9Sstevel@tonic-gate {
35797c478bd9Sstevel@tonic-gate int ch;
35807c478bd9Sstevel@tonic-gate FILE *infile = stdin, *savefile;
35817c478bd9Sstevel@tonic-gate boolean_t dosave = B_FALSE, readfile = B_FALSE;
3582e3320f40Smarkfen char *configfile = NULL;
358323c73eccSpwernau struct stat sbuf;
35849c2c14abSThejaswini Singarajipura int bootflags;
35857c478bd9Sstevel@tonic-gate
35867c478bd9Sstevel@tonic-gate (void) setlocale(LC_ALL, "");
35877c478bd9Sstevel@tonic-gate #if !defined(TEXT_DOMAIN)
35887c478bd9Sstevel@tonic-gate #define TEXT_DOMAIN "SYS_TEST"
35897c478bd9Sstevel@tonic-gate #endif
35907c478bd9Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN);
35917c478bd9Sstevel@tonic-gate
3592e3320f40Smarkfen /*
3593*bbf21555SRichard Lowe * Check to see if the command is being run from smf(7).
3594e3320f40Smarkfen */
3595e3320f40Smarkfen my_fmri = getenv("SMF_FMRI");
3596e3320f40Smarkfen
35977c478bd9Sstevel@tonic-gate openlog("ipseckey", LOG_CONS, LOG_AUTH);
35987c478bd9Sstevel@tonic-gate if (getuid() != 0) {
3599e3320f40Smarkfen errx(1, "Insufficient privileges to run ipseckey.");
36007c478bd9Sstevel@tonic-gate }
36017c478bd9Sstevel@tonic-gate
36027c478bd9Sstevel@tonic-gate /* umask me to paranoid, I only want to create files read-only */
36037c478bd9Sstevel@tonic-gate (void) umask((mode_t)00377);
36047c478bd9Sstevel@tonic-gate
3605e3320f40Smarkfen while ((ch = getopt(argc, argv, "pnvf:s:c:")) != EOF)
36067c478bd9Sstevel@tonic-gate switch (ch) {
36077c478bd9Sstevel@tonic-gate case 'p':
36087c478bd9Sstevel@tonic-gate pflag = B_TRUE;
36097c478bd9Sstevel@tonic-gate break;
36107c478bd9Sstevel@tonic-gate case 'n':
36117c478bd9Sstevel@tonic-gate nflag = B_TRUE;
36127c478bd9Sstevel@tonic-gate break;
36137c478bd9Sstevel@tonic-gate case 'v':
36147c478bd9Sstevel@tonic-gate vflag = B_TRUE;
36157c478bd9Sstevel@tonic-gate break;
3616e3320f40Smarkfen case 'c':
3617e3320f40Smarkfen cflag = B_TRUE;
3618e3320f40Smarkfen /* FALLTHRU */
36197c478bd9Sstevel@tonic-gate case 'f':
36207c478bd9Sstevel@tonic-gate if (dosave)
36217c478bd9Sstevel@tonic-gate usage();
3622d0115d88SMark Fenwick
3623d0115d88SMark Fenwick /*
3624d0115d88SMark Fenwick * Use stat() to check and see if the user inadvertently
3625d0115d88SMark Fenwick * passed in a bad pathname, or the name of a directory.
3626d0115d88SMark Fenwick * We should also check to see if the filename is a
3627d0115d88SMark Fenwick * pipe. We use stat() here because fopen() will block
3628d0115d88SMark Fenwick * unless the other end of the pipe is open. This would
3629d0115d88SMark Fenwick * be undesirable, especially if this is called at boot
3630d0115d88SMark Fenwick * time. If we ever need to support reading from a pipe
3631d0115d88SMark Fenwick * or special file, this should be revisited.
3632d0115d88SMark Fenwick */
3633d0115d88SMark Fenwick if (stat(optarg, &sbuf) == -1) {
3634d0115d88SMark Fenwick EXIT_BADCONFIG2("Invalid pathname: %s\n",
3635d0115d88SMark Fenwick optarg);
3636d0115d88SMark Fenwick }
3637d0115d88SMark Fenwick if (!(sbuf.st_mode & S_IFREG)) {
3638d0115d88SMark Fenwick EXIT_BADCONFIG2("%s - Not a regular file\n",
3639d0115d88SMark Fenwick optarg);
3640d0115d88SMark Fenwick }
36417c478bd9Sstevel@tonic-gate infile = fopen(optarg, "r");
3642e3320f40Smarkfen if (infile == NULL) {
3643e3320f40Smarkfen EXIT_BADCONFIG2("Unable to open configuration "
3644e3320f40Smarkfen "file: %s\n", optarg);
3645e3320f40Smarkfen }
364623c73eccSpwernau /*
3647d0115d88SMark Fenwick * The input file contains keying information, because
3648d0115d88SMark Fenwick * this is sensative, we should only accept data from
3649d0115d88SMark Fenwick * this file if the file is root owned and only readable
3650d0115d88SMark Fenwick * by privileged users. If the command is being run by
3651d0115d88SMark Fenwick * the administrator, issue a warning, if this is run by
3652*bbf21555SRichard Lowe * smf(7) (IE: boot time) and the permissions are too
3653d0115d88SMark Fenwick * open, we will fail, the SMF service will end up in
3654d0115d88SMark Fenwick * maintenace mode. The check is made with fstat() to
3655d0115d88SMark Fenwick * eliminate any possible TOT to TOU window.
365623c73eccSpwernau */
365723c73eccSpwernau if (fstat(fileno(infile), &sbuf) == -1) {
365823c73eccSpwernau (void) fclose(infile);
365923c73eccSpwernau EXIT_BADCONFIG2("Unable to stat configuration "
366023c73eccSpwernau "file: %s\n", optarg);
366123c73eccSpwernau }
366223c73eccSpwernau if (INSECURE_PERMS(sbuf)) {
366323c73eccSpwernau if (my_fmri != NULL) {
366423c73eccSpwernau (void) fclose(infile);
366523c73eccSpwernau EXIT_BADCONFIG2("Config file "
366623c73eccSpwernau "%s has insecure permissions.",
366723c73eccSpwernau optarg);
366823c73eccSpwernau } else {
3669d0115d88SMark Fenwick (void) fprintf(stderr, gettext(
3670d0115d88SMark Fenwick "Config file %s has insecure "
3671d0115d88SMark Fenwick "permissions, will be rejected in "
3672d0115d88SMark Fenwick "permanent config.\n"), optarg);
367323c73eccSpwernau }
367423c73eccSpwernau }
3675e3320f40Smarkfen configfile = strdup(optarg);
36767c478bd9Sstevel@tonic-gate readfile = B_TRUE;
36777c478bd9Sstevel@tonic-gate break;
36787c478bd9Sstevel@tonic-gate case 's':
36797c478bd9Sstevel@tonic-gate if (readfile)
36807c478bd9Sstevel@tonic-gate usage();
36817c478bd9Sstevel@tonic-gate dosave = B_TRUE;
36827c478bd9Sstevel@tonic-gate savefile = opensavefile(optarg);
36837c478bd9Sstevel@tonic-gate break;
36847c478bd9Sstevel@tonic-gate default:
36857c478bd9Sstevel@tonic-gate usage();
36867c478bd9Sstevel@tonic-gate }
36877c478bd9Sstevel@tonic-gate
36887c478bd9Sstevel@tonic-gate argc -= optind;
36897c478bd9Sstevel@tonic-gate argv += optind;
36907c478bd9Sstevel@tonic-gate
36917c478bd9Sstevel@tonic-gate mypid = getpid();
36927c478bd9Sstevel@tonic-gate
36937c478bd9Sstevel@tonic-gate keysock = socket(PF_KEY, SOCK_RAW, PF_KEY_V2);
36947c478bd9Sstevel@tonic-gate
3695e3320f40Smarkfen if (keysock == -1) {
3696e3320f40Smarkfen if (errno == EPERM) {
3697e3320f40Smarkfen EXIT_BADPERM("Insufficient privileges to open "
3698e3320f40Smarkfen "PF_KEY socket.\n");
3699e3320f40Smarkfen } else {
3700e3320f40Smarkfen /* some other reason */
3701e3320f40Smarkfen EXIT_FATAL("Opening PF_KEY socket");
3702e3320f40Smarkfen }
3703e3320f40Smarkfen }
37047c478bd9Sstevel@tonic-gate
37059c2c14abSThejaswini Singarajipura if ((_cladm(CL_INITIALIZE, CL_GET_BOOTFLAG, &bootflags) != 0) ||
37069c2c14abSThejaswini Singarajipura (bootflags & CLUSTER_BOOTED)) {
37079c2c14abSThejaswini Singarajipura in_cluster_mode = B_TRUE;
37089c2c14abSThejaswini Singarajipura cluster_socket = socket(AF_INET, SOCK_DGRAM, 0);
37099c2c14abSThejaswini Singarajipura cli_addr.sin_family = AF_INET;
3710510c3f91SVladimir Kotal cli_addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
37119c2c14abSThejaswini Singarajipura cli_addr.sin_port = htons(CLUSTER_UDP_PORT);
37129c2c14abSThejaswini Singarajipura }
37139c2c14abSThejaswini Singarajipura
37147c478bd9Sstevel@tonic-gate if (dosave) {
37157c478bd9Sstevel@tonic-gate mask_signals(B_FALSE); /* Mask signals */
37167c478bd9Sstevel@tonic-gate dodump(SADB_SATYPE_UNSPEC, savefile);
37177c478bd9Sstevel@tonic-gate mask_signals(B_TRUE); /* Unmask signals */
3718e3320f40Smarkfen EXIT_OK(NULL);
37197c478bd9Sstevel@tonic-gate }
37207c478bd9Sstevel@tonic-gate
3721e3320f40Smarkfen /*
3722*bbf21555SRichard Lowe * When run from smf(7) flush any existing SA's first
3723e3320f40Smarkfen * otherwise you will end up in maintenance mode.
3724e3320f40Smarkfen */
3725e3320f40Smarkfen if ((my_fmri != NULL) && readfile) {
3726e3320f40Smarkfen (void) fprintf(stdout, gettext(
3727e3320f40Smarkfen "Flushing existing SA's before adding new SA's\n"));
3728e3320f40Smarkfen (void) fflush(stdout);
3729e3320f40Smarkfen doflush(SADB_SATYPE_UNSPEC);
3730e3320f40Smarkfen }
3731bfe6f8f5SVladimir Kotal if (infile != stdin || argc == 0) {
37327c478bd9Sstevel@tonic-gate /* Go into interactive mode here. */
3733e3320f40Smarkfen do_interactive(infile, configfile, "ipseckey> ", my_fmri,
3734bfe6f8f5SVladimir Kotal parseit, no_match);
37357c478bd9Sstevel@tonic-gate }
373625e435e0Spwernau parseit(argc, argv, NULL, B_FALSE);
37377c478bd9Sstevel@tonic-gate
37387c478bd9Sstevel@tonic-gate return (0);
37397c478bd9Sstevel@tonic-gate }
3740