17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 58810c16bSdanmcd * Common Development and Distribution License (the "License"). 68810c16bSdanmcd * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 217c478bd9Sstevel@tonic-gate /* 22bfe6f8f5SVladimir Kotal * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 237c478bd9Sstevel@tonic-gate * Use is subject to license terms. 247c478bd9Sstevel@tonic-gate */ 257c478bd9Sstevel@tonic-gate 267c478bd9Sstevel@tonic-gate /* 277c478bd9Sstevel@tonic-gate * NOTE:I'm trying to use "struct sadb_foo" instead of "sadb_foo_t" 287c478bd9Sstevel@tonic-gate * as a maximal PF_KEY portability test. 297c478bd9Sstevel@tonic-gate * 307c478bd9Sstevel@tonic-gate * Also, this is a deliberately single-threaded app, also for portability 317c478bd9Sstevel@tonic-gate * to systems without POSIX threads. 327c478bd9Sstevel@tonic-gate */ 337c478bd9Sstevel@tonic-gate 347c478bd9Sstevel@tonic-gate #include <sys/types.h> 357c478bd9Sstevel@tonic-gate #include <sys/stat.h> 367c478bd9Sstevel@tonic-gate #include <sys/socket.h> 377c478bd9Sstevel@tonic-gate #include <sys/sysmacros.h> 387c478bd9Sstevel@tonic-gate #include <sys/fcntl.h> 397c478bd9Sstevel@tonic-gate #include <net/pfkeyv2.h> 407c478bd9Sstevel@tonic-gate #include <arpa/inet.h> 417c478bd9Sstevel@tonic-gate #include <netinet/in.h> 427c478bd9Sstevel@tonic-gate #include <sys/uio.h> 437c478bd9Sstevel@tonic-gate 447c478bd9Sstevel@tonic-gate #include <syslog.h> 457c478bd9Sstevel@tonic-gate #include <signal.h> 467c478bd9Sstevel@tonic-gate #include <unistd.h> 477c478bd9Sstevel@tonic-gate #include <limits.h> 487c478bd9Sstevel@tonic-gate #include <stdlib.h> 497c478bd9Sstevel@tonic-gate #include <stdio.h> 50e3320f40Smarkfen #include <stdarg.h> 517c478bd9Sstevel@tonic-gate #include <netdb.h> 527c478bd9Sstevel@tonic-gate #include <pwd.h> 537c478bd9Sstevel@tonic-gate #include <errno.h> 547c478bd9Sstevel@tonic-gate #include <libintl.h> 557c478bd9Sstevel@tonic-gate #include <locale.h> 567c478bd9Sstevel@tonic-gate #include <fcntl.h> 577c478bd9Sstevel@tonic-gate #include <strings.h> 587c478bd9Sstevel@tonic-gate #include <ctype.h> 599c2c14abSThejaswini Singarajipura #include <sys/cladm.h> 607c478bd9Sstevel@tonic-gate 617c478bd9Sstevel@tonic-gate #include <ipsec_util.h> 627c478bd9Sstevel@tonic-gate 637c478bd9Sstevel@tonic-gate static int keysock; 649c2c14abSThejaswini Singarajipura static int cluster_socket; 657c478bd9Sstevel@tonic-gate static uint32_t seq; 667c478bd9Sstevel@tonic-gate static pid_t mypid; 677c478bd9Sstevel@tonic-gate static boolean_t vflag = B_FALSE; /* Verbose? */ 68e3320f40Smarkfen static boolean_t cflag = B_FALSE; /* Check Only */ 69e3320f40Smarkfen 70e3320f40Smarkfen char *my_fmri = NULL; 71e3320f40Smarkfen FILE *debugfile = stdout; 729c2c14abSThejaswini Singarajipura static struct sockaddr_in cli_addr; 739c2c14abSThejaswini Singarajipura static boolean_t in_cluster_mode = B_FALSE; 747c478bd9Sstevel@tonic-gate 757c478bd9Sstevel@tonic-gate #define MAX_GET_SIZE 1024 76e3320f40Smarkfen /* 77ec485834Spwernau * WARN() and ERROR() do the same thing really, with ERROR() the function 78e3320f40Smarkfen * that prints the error buffer needs to be called at the end of a code block 79e3320f40Smarkfen * This will print out all accumulated errors before bailing. The WARN() 80e3320f40Smarkfen * macro calls handle_errors() in such a way that it prints the message 81e3320f40Smarkfen * then continues. 82e3320f40Smarkfen * If the FATAL() macro used call handle_errors() immediately. 83e3320f40Smarkfen */ 84e3320f40Smarkfen #define ERROR(x, y, z) x = record_error(x, y, z) 85e3320f40Smarkfen #define ERROR1(w, x, y, z) w = record_error(w, x, y, z) 86e3320f40Smarkfen #define ERROR2(v, w, x, y, z) v = record_error(v, w, x, y, z) 87e3320f40Smarkfen #define WARN(x, y, z) ERROR(x, y, z);\ 88e3320f40Smarkfen handle_errors(x, NULL, B_FALSE, B_FALSE); x = NULL 89e3320f40Smarkfen #define WARN1(w, x, y, z) ERROR1(w, x, y, z);\ 90e3320f40Smarkfen handle_errors(w, NULL, B_FALSE, B_FALSE); w = NULL 91e3320f40Smarkfen #define WARN2(v, w, x, y, z) ERROR2(v, w, x, y, z);\ 92e3320f40Smarkfen handle_errors(v, NULL, B_FALSE, B_FALSE); v = NULL 93e3320f40Smarkfen #define FATAL(x, y, z) ERROR(x, y, z);\ 94e3320f40Smarkfen handle_errors(x, y, B_TRUE, B_TRUE) 95e3320f40Smarkfen #define FATAL1(w, x, y, z) ERROR1(w, x, y, z);\ 96e3320f40Smarkfen handle_errors(w, x, B_TRUE, B_TRUE) 97e3320f40Smarkfen 987c478bd9Sstevel@tonic-gate /* Defined as a uint64_t array for alignment purposes. */ 997c478bd9Sstevel@tonic-gate static uint64_t get_buffer[MAX_GET_SIZE]; 1007c478bd9Sstevel@tonic-gate 101bfe6f8f5SVladimir Kotal /* 102bfe6f8f5SVladimir Kotal * Disable default TAB completion for now (until some brave soul tackles it). 103bfe6f8f5SVladimir Kotal */ 104bfe6f8f5SVladimir Kotal /* ARGSUSED */ 105bfe6f8f5SVladimir Kotal static 106bfe6f8f5SVladimir Kotal CPL_MATCH_FN(no_match) 107bfe6f8f5SVladimir Kotal { 108bfe6f8f5SVladimir Kotal return (0); 109bfe6f8f5SVladimir Kotal } 110bfe6f8f5SVladimir Kotal 1117c478bd9Sstevel@tonic-gate /* 112e3320f40Smarkfen * Create/Grow a buffer large enough to hold error messages. If *ebuf 113e3320f40Smarkfen * is not NULL then it will contain a copy of the command line that 114e3320f40Smarkfen * triggered the error/warning, copy this into a new buffer or 115e3320f40Smarkfen * append new messages to the existing buffer. 116e3320f40Smarkfen */ 117e3320f40Smarkfen /*PRINTFLIKE1*/ 118e3320f40Smarkfen char * 119e3320f40Smarkfen record_error(char *ep, char *ebuf, char *fmt, ...) 120e3320f40Smarkfen { 121e3320f40Smarkfen char *err_ptr; 122e3320f40Smarkfen char tmp_buff[1024]; 123e3320f40Smarkfen va_list ap; 124e3320f40Smarkfen int length = 0; 125e3320f40Smarkfen err_ptr = ep; 126e3320f40Smarkfen 127e3320f40Smarkfen va_start(ap, fmt); 12872c8fd38Smarkfen length = vsnprintf(tmp_buff, sizeof (tmp_buff), fmt, ap); 129e3320f40Smarkfen va_end(ap); 130e3320f40Smarkfen 131e3320f40Smarkfen /* There is a new line character */ 132e3320f40Smarkfen length++; 13372c8fd38Smarkfen 13472c8fd38Smarkfen if (ep == NULL) { 13572c8fd38Smarkfen if (ebuf != NULL) 13672c8fd38Smarkfen length += strlen(ebuf); 13772c8fd38Smarkfen } else { 13872c8fd38Smarkfen length += strlen(ep); 13972c8fd38Smarkfen } 14072c8fd38Smarkfen 14172c8fd38Smarkfen if (err_ptr == NULL) 14272c8fd38Smarkfen err_ptr = calloc(length, sizeof (char)); 14372c8fd38Smarkfen else 14472c8fd38Smarkfen err_ptr = realloc(err_ptr, length); 14572c8fd38Smarkfen 146e3320f40Smarkfen if (err_ptr == NULL) 147e3320f40Smarkfen Bail("realloc() failure"); 14872c8fd38Smarkfen 14972c8fd38Smarkfen /* 15072c8fd38Smarkfen * If (ep == NULL) then this is the first error to record, 15172c8fd38Smarkfen * copy in the command line that triggered this error/warning. 15272c8fd38Smarkfen */ 15372c8fd38Smarkfen if (ep == NULL && ebuf != NULL) 15472c8fd38Smarkfen (void) strlcpy(err_ptr, ebuf, length); 15572c8fd38Smarkfen 15672c8fd38Smarkfen /* 15772c8fd38Smarkfen * Now the actual error. 15872c8fd38Smarkfen */ 159e3320f40Smarkfen (void) strlcat(err_ptr, tmp_buff, length); 160e3320f40Smarkfen return (err_ptr); 161e3320f40Smarkfen } 162e3320f40Smarkfen 163e3320f40Smarkfen /* 164bfe6f8f5SVladimir Kotal * If not in interactive mode print usage message and exit. 1657c478bd9Sstevel@tonic-gate */ 1667c478bd9Sstevel@tonic-gate static void 1677c478bd9Sstevel@tonic-gate usage(void) 1687c478bd9Sstevel@tonic-gate { 1697c478bd9Sstevel@tonic-gate if (!interactive) { 1707c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("Usage:\t" 1717c478bd9Sstevel@tonic-gate "ipseckey [ -nvp ] | cmd [sa_type] [extfield value]*\n")); 1727c478bd9Sstevel@tonic-gate (void) fprintf(stderr, 1737c478bd9Sstevel@tonic-gate gettext("\tipseckey [ -nvp ] -f infile\n")); 1747c478bd9Sstevel@tonic-gate (void) fprintf(stderr, 1757c478bd9Sstevel@tonic-gate gettext("\tipseckey [ -nvp ] -s outfile\n")); 176bfe6f8f5SVladimir Kotal EXIT_FATAL(NULL); 177bfe6f8f5SVladimir Kotal } else { 178bfe6f8f5SVladimir Kotal (void) fprintf(stderr, 179bfe6f8f5SVladimir Kotal gettext("Type help or ? for usage info\n")); 180e3320f40Smarkfen } 181e3320f40Smarkfen } 182e3320f40Smarkfen 183e3320f40Smarkfen 184e3320f40Smarkfen /* 185e3320f40Smarkfen * Print out any errors, tidy up as required. 186e3320f40Smarkfen * error pointer ep will be free()'d 187e3320f40Smarkfen */ 188e3320f40Smarkfen void 189e3320f40Smarkfen handle_errors(char *ep, char *ebuf, boolean_t fatal, boolean_t done) 190e3320f40Smarkfen { 191e3320f40Smarkfen if (ep != NULL) { 192e3320f40Smarkfen if (my_fmri == NULL) { 193e3320f40Smarkfen /* 194e3320f40Smarkfen * For now suppress the errors when run from smf(5) 195e3320f40Smarkfen * because potentially sensitive information could 196e3320f40Smarkfen * end up in a publicly readable logfile. 197e3320f40Smarkfen */ 198e3320f40Smarkfen (void) fprintf(stdout, "%s\n", ep); 199e3320f40Smarkfen (void) fflush(stdout); 200e3320f40Smarkfen } 201e3320f40Smarkfen free(ep); 202e3320f40Smarkfen if (fatal) { 203e3320f40Smarkfen if (ebuf != NULL) { 204e3320f40Smarkfen free(ebuf); 205e3320f40Smarkfen } 206e3320f40Smarkfen /* reset command buffer */ 207e3320f40Smarkfen if (interactive) 208e3320f40Smarkfen longjmp(env, 1); 209e3320f40Smarkfen } else { 210e3320f40Smarkfen return; 211e3320f40Smarkfen } 2127c478bd9Sstevel@tonic-gate } else { 213e3320f40Smarkfen /* 214e3320f40Smarkfen * No errors, if this is the last time that this function 215e3320f40Smarkfen * is called, free(ebuf) and reset command buffer. 216e3320f40Smarkfen */ 217e3320f40Smarkfen if (done) { 218e3320f40Smarkfen if (ebuf != NULL) { 219e3320f40Smarkfen free(ebuf); 220e3320f40Smarkfen } 221e3320f40Smarkfen /* reset command buffer */ 222e3320f40Smarkfen if (interactive) 223e3320f40Smarkfen longjmp(env, 1); 224e3320f40Smarkfen } 225e3320f40Smarkfen return; 2267c478bd9Sstevel@tonic-gate } 22772c8fd38Smarkfen EXIT_FATAL(NULL); 2287c478bd9Sstevel@tonic-gate } 2297c478bd9Sstevel@tonic-gate 2307c478bd9Sstevel@tonic-gate /* 2317c478bd9Sstevel@tonic-gate * Initialize a PF_KEY base message. 2327c478bd9Sstevel@tonic-gate */ 2337c478bd9Sstevel@tonic-gate static void 2347c478bd9Sstevel@tonic-gate msg_init(struct sadb_msg *msg, uint8_t type, uint8_t satype) 2357c478bd9Sstevel@tonic-gate { 2367c478bd9Sstevel@tonic-gate msg->sadb_msg_version = PF_KEY_V2; 2377c478bd9Sstevel@tonic-gate msg->sadb_msg_type = type; 2387c478bd9Sstevel@tonic-gate msg->sadb_msg_errno = 0; 2397c478bd9Sstevel@tonic-gate msg->sadb_msg_satype = satype; 2407c478bd9Sstevel@tonic-gate /* For starters... */ 2417c478bd9Sstevel@tonic-gate msg->sadb_msg_len = SADB_8TO64(sizeof (*msg)); 2427c478bd9Sstevel@tonic-gate msg->sadb_msg_reserved = 0; 2437c478bd9Sstevel@tonic-gate msg->sadb_msg_seq = ++seq; 2447c478bd9Sstevel@tonic-gate msg->sadb_msg_pid = mypid; 2457c478bd9Sstevel@tonic-gate } 2467c478bd9Sstevel@tonic-gate 2477c478bd9Sstevel@tonic-gate /* 2487c478bd9Sstevel@tonic-gate * parseXXX and rparseXXX commands parse input and convert them to PF_KEY 2497c478bd9Sstevel@tonic-gate * field values, or do the reverse for the purposes of saving the SA tables. 2507c478bd9Sstevel@tonic-gate * (See the save_XXX functions.) 2517c478bd9Sstevel@tonic-gate */ 2527c478bd9Sstevel@tonic-gate 2537c478bd9Sstevel@tonic-gate #define CMD_NONE 0 2547c478bd9Sstevel@tonic-gate #define CMD_UPDATE 2 25538d95a78Smarkfen #define CMD_UPDATE_PAIR 3 25638d95a78Smarkfen #define CMD_ADD 4 25738d95a78Smarkfen #define CMD_DELETE 5 25838d95a78Smarkfen #define CMD_DELETE_PAIR 6 25938d95a78Smarkfen #define CMD_GET 7 2607c478bd9Sstevel@tonic-gate #define CMD_FLUSH 9 2617c478bd9Sstevel@tonic-gate #define CMD_DUMP 10 2627c478bd9Sstevel@tonic-gate #define CMD_MONITOR 11 2637c478bd9Sstevel@tonic-gate #define CMD_PMONITOR 12 2647c478bd9Sstevel@tonic-gate #define CMD_QUIT 13 2657c478bd9Sstevel@tonic-gate #define CMD_SAVE 14 2667c478bd9Sstevel@tonic-gate #define CMD_HELP 15 2677c478bd9Sstevel@tonic-gate 2687c478bd9Sstevel@tonic-gate /* 2697c478bd9Sstevel@tonic-gate * Parse the command. 2707c478bd9Sstevel@tonic-gate */ 2717c478bd9Sstevel@tonic-gate static int 2727c478bd9Sstevel@tonic-gate parsecmd(char *cmdstr) 2737c478bd9Sstevel@tonic-gate { 2747c478bd9Sstevel@tonic-gate static struct cmdtable { 2757c478bd9Sstevel@tonic-gate char *cmd; 2767c478bd9Sstevel@tonic-gate int token; 2777c478bd9Sstevel@tonic-gate } table[] = { 2787c478bd9Sstevel@tonic-gate /* 2797c478bd9Sstevel@tonic-gate * Q: Do we want to do GETSPI? 2807c478bd9Sstevel@tonic-gate * A: No, it's for automated key mgmt. only. Either that, 2817c478bd9Sstevel@tonic-gate * or it isn't relevant until we support non IPsec SA types. 2827c478bd9Sstevel@tonic-gate */ 2837c478bd9Sstevel@tonic-gate {"update", CMD_UPDATE}, 28438d95a78Smarkfen {"update-pair", CMD_UPDATE_PAIR}, 2857c478bd9Sstevel@tonic-gate {"add", CMD_ADD}, 2867c478bd9Sstevel@tonic-gate {"delete", CMD_DELETE}, 28738d95a78Smarkfen {"delete-pair", CMD_DELETE_PAIR}, 2887c478bd9Sstevel@tonic-gate {"get", CMD_GET}, 2897c478bd9Sstevel@tonic-gate /* 2907c478bd9Sstevel@tonic-gate * Q: And ACQUIRE and REGISTER and EXPIRE? 2917c478bd9Sstevel@tonic-gate * A: not until we support non IPsec SA types. 2927c478bd9Sstevel@tonic-gate */ 2937c478bd9Sstevel@tonic-gate {"flush", CMD_FLUSH}, 2947c478bd9Sstevel@tonic-gate {"dump", CMD_DUMP}, 2957c478bd9Sstevel@tonic-gate {"monitor", CMD_MONITOR}, 2967c478bd9Sstevel@tonic-gate {"passive_monitor", CMD_PMONITOR}, 2977c478bd9Sstevel@tonic-gate {"pmonitor", CMD_PMONITOR}, 2987c478bd9Sstevel@tonic-gate {"quit", CMD_QUIT}, 2997c478bd9Sstevel@tonic-gate {"exit", CMD_QUIT}, 3007c478bd9Sstevel@tonic-gate {"save", CMD_SAVE}, 3017c478bd9Sstevel@tonic-gate {"help", CMD_HELP}, 3027c478bd9Sstevel@tonic-gate {"?", CMD_HELP}, 3037c478bd9Sstevel@tonic-gate {NULL, CMD_NONE} 3047c478bd9Sstevel@tonic-gate }; 3057c478bd9Sstevel@tonic-gate struct cmdtable *ct = table; 3067c478bd9Sstevel@tonic-gate 3077c478bd9Sstevel@tonic-gate while (ct->cmd != NULL && strcmp(ct->cmd, cmdstr) != 0) 3087c478bd9Sstevel@tonic-gate ct++; 3097c478bd9Sstevel@tonic-gate return (ct->token); 3107c478bd9Sstevel@tonic-gate } 3117c478bd9Sstevel@tonic-gate 3127c478bd9Sstevel@tonic-gate /* 3137c478bd9Sstevel@tonic-gate * Convert a number from a command line. I picked "u_longlong_t" for the 3147c478bd9Sstevel@tonic-gate * number because we need the largest number available. Also, the strto<num> 3157c478bd9Sstevel@tonic-gate * calls don't deal in units of uintNN_t. 3167c478bd9Sstevel@tonic-gate */ 3177c478bd9Sstevel@tonic-gate static u_longlong_t 318e3320f40Smarkfen parsenum(char *num, boolean_t bail, char *ebuf) 3197c478bd9Sstevel@tonic-gate { 320e3320f40Smarkfen u_longlong_t rc = 0; 3217c478bd9Sstevel@tonic-gate char *end = NULL; 322e3320f40Smarkfen char *ep = NULL; 3237c478bd9Sstevel@tonic-gate 3247c478bd9Sstevel@tonic-gate if (num == NULL) { 325e3320f40Smarkfen FATAL(ep, ebuf, gettext("Unexpected end of command line," 326e3320f40Smarkfen " was expecting a number.\n")); 327e3320f40Smarkfen /* NOTREACHED */ 3287c478bd9Sstevel@tonic-gate } 3297c478bd9Sstevel@tonic-gate 3307c478bd9Sstevel@tonic-gate errno = 0; 3317c478bd9Sstevel@tonic-gate rc = strtoull(num, &end, 0); 3327c478bd9Sstevel@tonic-gate if (errno != 0 || end == num || *end != '\0') { 3337c478bd9Sstevel@tonic-gate if (bail) { 33438d95a78Smarkfen FATAL1(ep, ebuf, gettext( 335e3320f40Smarkfen "Expecting a number, not \"%s\"!\n"), num); 3367c478bd9Sstevel@tonic-gate } else { 3377c478bd9Sstevel@tonic-gate /* 3387c478bd9Sstevel@tonic-gate * -1, while not optimal, is sufficiently out of range 3397c478bd9Sstevel@tonic-gate * for most of this function's applications when 3407c478bd9Sstevel@tonic-gate * we don't just bail. 3417c478bd9Sstevel@tonic-gate */ 3427c478bd9Sstevel@tonic-gate return ((u_longlong_t)-1); 3437c478bd9Sstevel@tonic-gate } 3447c478bd9Sstevel@tonic-gate } 345e3320f40Smarkfen handle_errors(ep, NULL, B_FALSE, B_FALSE); 3467c478bd9Sstevel@tonic-gate return (rc); 3477c478bd9Sstevel@tonic-gate } 3487c478bd9Sstevel@tonic-gate 3497c478bd9Sstevel@tonic-gate /* 3507c478bd9Sstevel@tonic-gate * Parse and reverse parse a specific SA type (AH, ESP, etc.). 3517c478bd9Sstevel@tonic-gate */ 3527c478bd9Sstevel@tonic-gate static struct typetable { 3537c478bd9Sstevel@tonic-gate char *type; 3547c478bd9Sstevel@tonic-gate int token; 3557c478bd9Sstevel@tonic-gate } type_table[] = { 3567c478bd9Sstevel@tonic-gate {"all", SADB_SATYPE_UNSPEC}, 3577c478bd9Sstevel@tonic-gate {"ah", SADB_SATYPE_AH}, 3587c478bd9Sstevel@tonic-gate {"esp", SADB_SATYPE_ESP}, 3597c478bd9Sstevel@tonic-gate /* PF_KEY NOTE: More to come if net/pfkeyv2.h gets updated. */ 3607c478bd9Sstevel@tonic-gate {NULL, 0} /* Token value is irrelevant for this entry. */ 3617c478bd9Sstevel@tonic-gate }; 3627c478bd9Sstevel@tonic-gate 3637c478bd9Sstevel@tonic-gate 3647c478bd9Sstevel@tonic-gate static int 365e3320f40Smarkfen parsesatype(char *type, char *ebuf) 3667c478bd9Sstevel@tonic-gate { 3677c478bd9Sstevel@tonic-gate struct typetable *tt = type_table; 368e3320f40Smarkfen char *ep = NULL; 3697c478bd9Sstevel@tonic-gate 3707c478bd9Sstevel@tonic-gate if (type == NULL) 3717c478bd9Sstevel@tonic-gate return (SADB_SATYPE_UNSPEC); 3727c478bd9Sstevel@tonic-gate 3737c478bd9Sstevel@tonic-gate while (tt->type != NULL && strcasecmp(tt->type, type) != 0) 3747c478bd9Sstevel@tonic-gate tt++; 3757c478bd9Sstevel@tonic-gate 3767c478bd9Sstevel@tonic-gate /* 3777c478bd9Sstevel@tonic-gate * New SA types (including ones keysock maintains for user-land 3787c478bd9Sstevel@tonic-gate * protocols) may be added, so parse a numeric value if possible. 3797c478bd9Sstevel@tonic-gate */ 3807c478bd9Sstevel@tonic-gate if (tt->type == NULL) { 381e3320f40Smarkfen tt->token = (int)parsenum(type, B_FALSE, ebuf); 3827c478bd9Sstevel@tonic-gate if (tt->token == -1) { 383e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 384e3320f40Smarkfen "Unknown SA type (%s).\n"), type); 385e3320f40Smarkfen tt->token = SADB_SATYPE_UNSPEC; 3867c478bd9Sstevel@tonic-gate } 3877c478bd9Sstevel@tonic-gate } 388bfe6f8f5SVladimir Kotal handle_errors(ep, NULL, interactive ? B_TRUE : B_FALSE, B_FALSE); 3897c478bd9Sstevel@tonic-gate return (tt->token); 3907c478bd9Sstevel@tonic-gate } 3917c478bd9Sstevel@tonic-gate 3927c478bd9Sstevel@tonic-gate #define NEXTEOF 0 3937c478bd9Sstevel@tonic-gate #define NEXTNONE 1 3947c478bd9Sstevel@tonic-gate #define NEXTNUM 2 3957c478bd9Sstevel@tonic-gate #define NEXTSTR 3 3967c478bd9Sstevel@tonic-gate #define NEXTNUMSTR 4 3977c478bd9Sstevel@tonic-gate #define NEXTADDR 5 3987c478bd9Sstevel@tonic-gate #define NEXTHEX 6 3997c478bd9Sstevel@tonic-gate #define NEXTIDENT 7 4007c478bd9Sstevel@tonic-gate #define NEXTADDR4 8 4017c478bd9Sstevel@tonic-gate #define NEXTADDR6 9 402*5d3b8cb7SBill Sommerfeld #define NEXTLABEL 10 4037c478bd9Sstevel@tonic-gate 4047c478bd9Sstevel@tonic-gate #define TOK_EOF 0 4057c478bd9Sstevel@tonic-gate #define TOK_UNKNOWN 1 4067c478bd9Sstevel@tonic-gate #define TOK_SPI 2 4077c478bd9Sstevel@tonic-gate #define TOK_REPLAY 3 4087c478bd9Sstevel@tonic-gate #define TOK_STATE 4 4097c478bd9Sstevel@tonic-gate #define TOK_AUTHALG 5 4107c478bd9Sstevel@tonic-gate #define TOK_ENCRALG 6 4117c478bd9Sstevel@tonic-gate #define TOK_FLAGS 7 4127c478bd9Sstevel@tonic-gate #define TOK_SOFT_ALLOC 8 4137c478bd9Sstevel@tonic-gate #define TOK_SOFT_BYTES 9 4147c478bd9Sstevel@tonic-gate #define TOK_SOFT_ADDTIME 10 4157c478bd9Sstevel@tonic-gate #define TOK_SOFT_USETIME 11 4167c478bd9Sstevel@tonic-gate #define TOK_HARD_ALLOC 12 4177c478bd9Sstevel@tonic-gate #define TOK_HARD_BYTES 13 4187c478bd9Sstevel@tonic-gate #define TOK_HARD_ADDTIME 14 4197c478bd9Sstevel@tonic-gate #define TOK_HARD_USETIME 15 4207c478bd9Sstevel@tonic-gate #define TOK_CURRENT_ALLOC 16 4217c478bd9Sstevel@tonic-gate #define TOK_CURRENT_BYTES 17 4227c478bd9Sstevel@tonic-gate #define TOK_CURRENT_ADDTIME 18 4237c478bd9Sstevel@tonic-gate #define TOK_CURRENT_USETIME 19 4247c478bd9Sstevel@tonic-gate #define TOK_SRCADDR 20 4257c478bd9Sstevel@tonic-gate #define TOK_DSTADDR 21 4267c478bd9Sstevel@tonic-gate #define TOK_PROXYADDR 22 4277c478bd9Sstevel@tonic-gate #define TOK_AUTHKEY 23 4287c478bd9Sstevel@tonic-gate #define TOK_ENCRKEY 24 4297c478bd9Sstevel@tonic-gate #define TOK_SRCIDTYPE 25 4307c478bd9Sstevel@tonic-gate #define TOK_DSTIDTYPE 26 4317c478bd9Sstevel@tonic-gate #define TOK_DPD 27 4327c478bd9Sstevel@tonic-gate #define TOK_SENS_LEVEL 28 4337c478bd9Sstevel@tonic-gate #define TOK_SENS_MAP 29 4347c478bd9Sstevel@tonic-gate #define TOK_INTEG_LEVEL 30 4357c478bd9Sstevel@tonic-gate #define TOK_INTEG_MAP 31 4367c478bd9Sstevel@tonic-gate #define TOK_SRCADDR6 32 4377c478bd9Sstevel@tonic-gate #define TOK_DSTADDR6 33 4387c478bd9Sstevel@tonic-gate #define TOK_PROXYADDR6 34 4397c478bd9Sstevel@tonic-gate #define TOK_SRCPORT 35 4407c478bd9Sstevel@tonic-gate #define TOK_DSTPORT 36 4417c478bd9Sstevel@tonic-gate #define TOK_PROTO 37 4427c478bd9Sstevel@tonic-gate #define TOK_ENCAP 38 4437c478bd9Sstevel@tonic-gate #define TOK_NATLOC 39 4447c478bd9Sstevel@tonic-gate #define TOK_NATREM 40 4457c478bd9Sstevel@tonic-gate #define TOK_NATLPORT 41 4467c478bd9Sstevel@tonic-gate #define TOK_NATRPORT 42 4478810c16bSdanmcd #define TOK_IPROTO 43 4488810c16bSdanmcd #define TOK_IDSTADDR 44 4498810c16bSdanmcd #define TOK_IDSTADDR6 45 4508810c16bSdanmcd #define TOK_ISRCPORT 46 4518810c16bSdanmcd #define TOK_IDSTPORT 47 45238d95a78Smarkfen #define TOK_PAIR_SPI 48 45338d95a78Smarkfen #define TOK_FLAG_INBOUND 49 45438d95a78Smarkfen #define TOK_FLAG_OUTBOUND 50 4559c2c14abSThejaswini Singarajipura #define TOK_REPLAY_VALUE 51 4569c2c14abSThejaswini Singarajipura #define TOK_IDLE_ADDTIME 52 4579c2c14abSThejaswini Singarajipura #define TOK_IDLE_USETIME 53 458628b0c67SMark Fenwick #define TOK_RESERVED 54 459*5d3b8cb7SBill Sommerfeld #define TOK_LABEL 55 460*5d3b8cb7SBill Sommerfeld #define TOK_OLABEL 56 461*5d3b8cb7SBill Sommerfeld #define TOK_IMPLABEL 57 462*5d3b8cb7SBill Sommerfeld 4637c478bd9Sstevel@tonic-gate 4647c478bd9Sstevel@tonic-gate static struct toktable { 4657c478bd9Sstevel@tonic-gate char *string; 4667c478bd9Sstevel@tonic-gate int token; 4677c478bd9Sstevel@tonic-gate int next; 4687c478bd9Sstevel@tonic-gate } tokens[] = { 4697c478bd9Sstevel@tonic-gate /* "String", token value, next arg is */ 4707c478bd9Sstevel@tonic-gate {"spi", TOK_SPI, NEXTNUM}, 47138d95a78Smarkfen {"pair-spi", TOK_PAIR_SPI, NEXTNUM}, 4727c478bd9Sstevel@tonic-gate {"replay", TOK_REPLAY, NEXTNUM}, 4737c478bd9Sstevel@tonic-gate {"state", TOK_STATE, NEXTNUMSTR}, 4747c478bd9Sstevel@tonic-gate {"auth_alg", TOK_AUTHALG, NEXTNUMSTR}, 4757c478bd9Sstevel@tonic-gate {"authalg", TOK_AUTHALG, NEXTNUMSTR}, 4767c478bd9Sstevel@tonic-gate {"encr_alg", TOK_ENCRALG, NEXTNUMSTR}, 4777c478bd9Sstevel@tonic-gate {"encralg", TOK_ENCRALG, NEXTNUMSTR}, 4787c478bd9Sstevel@tonic-gate {"flags", TOK_FLAGS, NEXTNUM}, 4797c478bd9Sstevel@tonic-gate {"soft_alloc", TOK_SOFT_ALLOC, NEXTNUM}, 4807c478bd9Sstevel@tonic-gate {"soft_bytes", TOK_SOFT_BYTES, NEXTNUM}, 4817c478bd9Sstevel@tonic-gate {"soft_addtime", TOK_SOFT_ADDTIME, NEXTNUM}, 4827c478bd9Sstevel@tonic-gate {"soft_usetime", TOK_SOFT_USETIME, NEXTNUM}, 4837c478bd9Sstevel@tonic-gate {"hard_alloc", TOK_HARD_ALLOC, NEXTNUM}, 4847c478bd9Sstevel@tonic-gate {"hard_bytes", TOK_HARD_BYTES, NEXTNUM}, 4857c478bd9Sstevel@tonic-gate {"hard_addtime", TOK_HARD_ADDTIME, NEXTNUM}, 4867c478bd9Sstevel@tonic-gate {"hard_usetime", TOK_HARD_USETIME, NEXTNUM}, 4877c478bd9Sstevel@tonic-gate {"current_alloc", TOK_CURRENT_ALLOC, NEXTNUM}, 4887c478bd9Sstevel@tonic-gate {"current_bytes", TOK_CURRENT_BYTES, NEXTNUM}, 4897c478bd9Sstevel@tonic-gate {"current_addtime", TOK_CURRENT_ADDTIME, NEXTNUM}, 4907c478bd9Sstevel@tonic-gate {"current_usetime", TOK_CURRENT_USETIME, NEXTNUM}, 4917c478bd9Sstevel@tonic-gate 4927c478bd9Sstevel@tonic-gate {"saddr", TOK_SRCADDR, NEXTADDR}, 4937c478bd9Sstevel@tonic-gate {"srcaddr", TOK_SRCADDR, NEXTADDR}, 4947c478bd9Sstevel@tonic-gate {"src", TOK_SRCADDR, NEXTADDR}, 4957c478bd9Sstevel@tonic-gate {"daddr", TOK_DSTADDR, NEXTADDR}, 4967c478bd9Sstevel@tonic-gate {"dstaddr", TOK_DSTADDR, NEXTADDR}, 4977c478bd9Sstevel@tonic-gate {"dst", TOK_DSTADDR, NEXTADDR}, 4987c478bd9Sstevel@tonic-gate {"proxyaddr", TOK_PROXYADDR, NEXTADDR}, 4997c478bd9Sstevel@tonic-gate {"proxy", TOK_PROXYADDR, NEXTADDR}, 5008810c16bSdanmcd {"innersrc", TOK_PROXYADDR, NEXTADDR}, 5018810c16bSdanmcd {"isrc", TOK_PROXYADDR, NEXTADDR}, 5028810c16bSdanmcd {"innerdst", TOK_IDSTADDR, NEXTADDR}, 5038810c16bSdanmcd {"idst", TOK_IDSTADDR, NEXTADDR}, 5047c478bd9Sstevel@tonic-gate 5057c478bd9Sstevel@tonic-gate {"sport", TOK_SRCPORT, NEXTNUM}, 5067c478bd9Sstevel@tonic-gate {"dport", TOK_DSTPORT, NEXTNUM}, 5078810c16bSdanmcd {"innersport", TOK_ISRCPORT, NEXTNUM}, 5088810c16bSdanmcd {"isport", TOK_ISRCPORT, NEXTNUM}, 5098810c16bSdanmcd {"innerdport", TOK_IDSTPORT, NEXTNUM}, 5108810c16bSdanmcd {"idport", TOK_IDSTPORT, NEXTNUM}, 5117c478bd9Sstevel@tonic-gate {"proto", TOK_PROTO, NEXTNUM}, 512eeda67c6Sjojemann {"ulp", TOK_PROTO, NEXTNUM}, 5138810c16bSdanmcd {"iproto", TOK_IPROTO, NEXTNUM}, 5148810c16bSdanmcd {"iulp", TOK_IPROTO, NEXTNUM}, 5157c478bd9Sstevel@tonic-gate 5167c478bd9Sstevel@tonic-gate {"saddr6", TOK_SRCADDR6, NEXTADDR}, 5177c478bd9Sstevel@tonic-gate {"srcaddr6", TOK_SRCADDR6, NEXTADDR}, 5187c478bd9Sstevel@tonic-gate {"src6", TOK_SRCADDR6, NEXTADDR}, 5197c478bd9Sstevel@tonic-gate {"daddr6", TOK_DSTADDR6, NEXTADDR}, 5207c478bd9Sstevel@tonic-gate {"dstaddr6", TOK_DSTADDR6, NEXTADDR}, 5217c478bd9Sstevel@tonic-gate {"dst6", TOK_DSTADDR6, NEXTADDR}, 5227c478bd9Sstevel@tonic-gate {"proxyaddr6", TOK_PROXYADDR6, NEXTADDR}, 5237c478bd9Sstevel@tonic-gate {"proxy6", TOK_PROXYADDR6, NEXTADDR}, 5248810c16bSdanmcd {"innersrc6", TOK_PROXYADDR6, NEXTADDR}, 5258810c16bSdanmcd {"isrc6", TOK_PROXYADDR6, NEXTADDR}, 5268810c16bSdanmcd {"innerdst6", TOK_IDSTADDR6, NEXTADDR}, 5278810c16bSdanmcd {"idst6", TOK_IDSTADDR6, NEXTADDR}, 5287c478bd9Sstevel@tonic-gate 5297c478bd9Sstevel@tonic-gate {"authkey", TOK_AUTHKEY, NEXTHEX}, 5307c478bd9Sstevel@tonic-gate {"encrkey", TOK_ENCRKEY, NEXTHEX}, 5317c478bd9Sstevel@tonic-gate {"srcidtype", TOK_SRCIDTYPE, NEXTIDENT}, 5327c478bd9Sstevel@tonic-gate {"dstidtype", TOK_DSTIDTYPE, NEXTIDENT}, 5337c478bd9Sstevel@tonic-gate {"dpd", TOK_DPD, NEXTNUM}, 5347c478bd9Sstevel@tonic-gate {"sens_level", TOK_SENS_LEVEL, NEXTNUM}, 5357c478bd9Sstevel@tonic-gate {"sens_map", TOK_SENS_MAP, NEXTHEX}, 5367c478bd9Sstevel@tonic-gate {"integ_level", TOK_INTEG_LEVEL, NEXTNUM}, 5377c478bd9Sstevel@tonic-gate {"integ_map", TOK_INTEG_MAP, NEXTHEX}, 5387c478bd9Sstevel@tonic-gate {"nat_loc", TOK_NATLOC, NEXTADDR}, 5397c478bd9Sstevel@tonic-gate {"nat_rem", TOK_NATREM, NEXTADDR}, 5407c478bd9Sstevel@tonic-gate {"nat_lport", TOK_NATLPORT, NEXTNUM}, 5417c478bd9Sstevel@tonic-gate {"nat_rport", TOK_NATRPORT, NEXTNUM}, 5427c478bd9Sstevel@tonic-gate {"encap", TOK_ENCAP, NEXTNUMSTR}, 54338d95a78Smarkfen 54438d95a78Smarkfen {"outbound", TOK_FLAG_OUTBOUND, NULL}, 54538d95a78Smarkfen {"inbound", TOK_FLAG_INBOUND, NULL}, 5469c2c14abSThejaswini Singarajipura 547628b0c67SMark Fenwick {"reserved_bits", TOK_RESERVED, NEXTNUM}, 5489c2c14abSThejaswini Singarajipura {"replay_value", TOK_REPLAY_VALUE, NEXTNUM}, 5499c2c14abSThejaswini Singarajipura {"idle_addtime", TOK_IDLE_ADDTIME, NEXTNUM}, 5509c2c14abSThejaswini Singarajipura {"idle_usetime", TOK_IDLE_USETIME, NEXTNUM}, 551*5d3b8cb7SBill Sommerfeld 552*5d3b8cb7SBill Sommerfeld {"label", TOK_LABEL, NEXTLABEL}, 553*5d3b8cb7SBill Sommerfeld {"outer-label", TOK_OLABEL, NEXTLABEL}, 554*5d3b8cb7SBill Sommerfeld {"implicit-label", TOK_IMPLABEL, NEXTLABEL}, 555*5d3b8cb7SBill Sommerfeld 5567c478bd9Sstevel@tonic-gate {NULL, TOK_UNKNOWN, NEXTEOF} 5577c478bd9Sstevel@tonic-gate }; 5587c478bd9Sstevel@tonic-gate 5597c478bd9Sstevel@tonic-gate /* 5607c478bd9Sstevel@tonic-gate * Q: Do I need stuff for proposals, combinations, supported algorithms, 5617c478bd9Sstevel@tonic-gate * or SPI ranges? 5627c478bd9Sstevel@tonic-gate * 5637c478bd9Sstevel@tonic-gate * A: Probably not, but you never know. 5647c478bd9Sstevel@tonic-gate * 5657c478bd9Sstevel@tonic-gate * Parse out extension header type values. 5667c478bd9Sstevel@tonic-gate */ 5677c478bd9Sstevel@tonic-gate static int 5687c478bd9Sstevel@tonic-gate parseextval(char *value, int *next) 5697c478bd9Sstevel@tonic-gate { 5707c478bd9Sstevel@tonic-gate struct toktable *tp; 5717c478bd9Sstevel@tonic-gate 5727c478bd9Sstevel@tonic-gate if (value == NULL) 5737c478bd9Sstevel@tonic-gate return (TOK_EOF); 5747c478bd9Sstevel@tonic-gate 5757c478bd9Sstevel@tonic-gate for (tp = tokens; tp->string != NULL; tp++) 5767c478bd9Sstevel@tonic-gate if (strcmp(value, tp->string) == 0) 5777c478bd9Sstevel@tonic-gate break; 5787c478bd9Sstevel@tonic-gate 5797c478bd9Sstevel@tonic-gate /* 5807c478bd9Sstevel@tonic-gate * Since the OS controls what extensions are available, we don't have 5817c478bd9Sstevel@tonic-gate * to parse numeric values here. 5827c478bd9Sstevel@tonic-gate */ 5837c478bd9Sstevel@tonic-gate 5847c478bd9Sstevel@tonic-gate *next = tp->next; 5857c478bd9Sstevel@tonic-gate return (tp->token); 5867c478bd9Sstevel@tonic-gate } 5877c478bd9Sstevel@tonic-gate 5887c478bd9Sstevel@tonic-gate /* 5897c478bd9Sstevel@tonic-gate * Parse possible state values. 5907c478bd9Sstevel@tonic-gate */ 5917c478bd9Sstevel@tonic-gate static uint8_t 592e3320f40Smarkfen parsestate(char *state, char *ebuf) 5937c478bd9Sstevel@tonic-gate { 5947c478bd9Sstevel@tonic-gate struct states { 5957c478bd9Sstevel@tonic-gate char *state; 5967c478bd9Sstevel@tonic-gate uint8_t retval; 5977c478bd9Sstevel@tonic-gate } states[] = { 5987c478bd9Sstevel@tonic-gate {"larval", SADB_SASTATE_LARVAL}, 5997c478bd9Sstevel@tonic-gate {"mature", SADB_SASTATE_MATURE}, 6007c478bd9Sstevel@tonic-gate {"dying", SADB_SASTATE_DYING}, 6017c478bd9Sstevel@tonic-gate {"dead", SADB_SASTATE_DEAD}, 6027c478bd9Sstevel@tonic-gate {NULL, 0} 6037c478bd9Sstevel@tonic-gate }; 6047c478bd9Sstevel@tonic-gate struct states *sp; 605e3320f40Smarkfen char *ep = NULL; 6067c478bd9Sstevel@tonic-gate 6077c478bd9Sstevel@tonic-gate if (state == NULL) { 608e3320f40Smarkfen FATAL(ep, ebuf, "Unexpected end of command line " 609e3320f40Smarkfen "was expecting a state.\n"); 6107c478bd9Sstevel@tonic-gate } 6117c478bd9Sstevel@tonic-gate 6127c478bd9Sstevel@tonic-gate for (sp = states; sp->state != NULL; sp++) { 6137c478bd9Sstevel@tonic-gate if (strcmp(sp->state, state) == 0) 6147c478bd9Sstevel@tonic-gate return (sp->retval); 6157c478bd9Sstevel@tonic-gate } 616e3320f40Smarkfen ERROR1(ep, ebuf, gettext("Unknown state type \"%s\"\n"), state); 617e3320f40Smarkfen handle_errors(ep, NULL, B_FALSE, B_FALSE); 618eeda67c6Sjojemann return (0); 6197c478bd9Sstevel@tonic-gate } 6207c478bd9Sstevel@tonic-gate 6217c478bd9Sstevel@tonic-gate /* 6227c478bd9Sstevel@tonic-gate * Return the numerical algorithm identifier corresponding to the specified 6237c478bd9Sstevel@tonic-gate * algorithm name. 6247c478bd9Sstevel@tonic-gate */ 6257c478bd9Sstevel@tonic-gate static uint8_t 626e3320f40Smarkfen parsealg(char *alg, int proto_num, char *ebuf) 6277c478bd9Sstevel@tonic-gate { 6287c478bd9Sstevel@tonic-gate u_longlong_t invalue; 6297c478bd9Sstevel@tonic-gate struct ipsecalgent *algent; 630e3320f40Smarkfen char *ep = NULL; 6317c478bd9Sstevel@tonic-gate 6327c478bd9Sstevel@tonic-gate if (alg == NULL) { 633e3320f40Smarkfen FATAL(ep, ebuf, gettext("Unexpected end of command line, " 634e3320f40Smarkfen "was expecting an algorithm name.\n")); 6357c478bd9Sstevel@tonic-gate } 6367c478bd9Sstevel@tonic-gate 6377c478bd9Sstevel@tonic-gate algent = getipsecalgbyname(alg, proto_num, NULL); 6387c478bd9Sstevel@tonic-gate if (algent != NULL) { 6397c478bd9Sstevel@tonic-gate uint8_t alg_num; 6407c478bd9Sstevel@tonic-gate 6417c478bd9Sstevel@tonic-gate alg_num = algent->a_alg_num; 642628b0c67SMark Fenwick if (ALG_FLAG_COUNTERMODE & algent->a_alg_flags) 643628b0c67SMark Fenwick WARN1(ep, ebuf, gettext( 644628b0c67SMark Fenwick "Using manual keying with a Counter mode algorithm " 645628b0c67SMark Fenwick "such as \"%s\" may be insecure!\n"), 646628b0c67SMark Fenwick algent->a_names[0]); 6477c478bd9Sstevel@tonic-gate freeipsecalgent(algent); 6487c478bd9Sstevel@tonic-gate 6497c478bd9Sstevel@tonic-gate return (alg_num); 6507c478bd9Sstevel@tonic-gate } 6517c478bd9Sstevel@tonic-gate 6527c478bd9Sstevel@tonic-gate /* 6537c478bd9Sstevel@tonic-gate * Since algorithms can be loaded during kernel run-time, check for 6547c478bd9Sstevel@tonic-gate * numeric algorithm values too. PF_KEY can catch bad ones with EINVAL. 6557c478bd9Sstevel@tonic-gate */ 656e3320f40Smarkfen invalue = parsenum(alg, B_FALSE, ebuf); 6577c478bd9Sstevel@tonic-gate if (invalue != (u_longlong_t)-1 && 6587c478bd9Sstevel@tonic-gate (u_longlong_t)(invalue & (u_longlong_t)0xff) == invalue) 6597c478bd9Sstevel@tonic-gate return ((uint8_t)invalue); 6607c478bd9Sstevel@tonic-gate 661e3320f40Smarkfen if (proto_num == IPSEC_PROTO_ESP) { 662e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 663e3320f40Smarkfen "Unknown encryption algorithm type \"%s\"\n"), alg); 664e3320f40Smarkfen } else { 665e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 666e3320f40Smarkfen "Unknown authentication algorithm type \"%s\"\n"), alg); 667e3320f40Smarkfen } 668e3320f40Smarkfen handle_errors(ep, NULL, B_FALSE, B_FALSE); 669eeda67c6Sjojemann return (0); 6707c478bd9Sstevel@tonic-gate } 6717c478bd9Sstevel@tonic-gate 6727c478bd9Sstevel@tonic-gate /* 6737c478bd9Sstevel@tonic-gate * Parse and reverse parse out a source/destination ID type. 6747c478bd9Sstevel@tonic-gate */ 6757c478bd9Sstevel@tonic-gate static struct idtypes { 6767c478bd9Sstevel@tonic-gate char *idtype; 6777c478bd9Sstevel@tonic-gate uint8_t retval; 6787c478bd9Sstevel@tonic-gate } idtypes[] = { 6797c478bd9Sstevel@tonic-gate {"prefix", SADB_IDENTTYPE_PREFIX}, 6807c478bd9Sstevel@tonic-gate {"fqdn", SADB_IDENTTYPE_FQDN}, 6817c478bd9Sstevel@tonic-gate {"domain", SADB_IDENTTYPE_FQDN}, 6827c478bd9Sstevel@tonic-gate {"domainname", SADB_IDENTTYPE_FQDN}, 6837c478bd9Sstevel@tonic-gate {"user_fqdn", SADB_IDENTTYPE_USER_FQDN}, 6847c478bd9Sstevel@tonic-gate {"mailbox", SADB_IDENTTYPE_USER_FQDN}, 6857c478bd9Sstevel@tonic-gate {"der_dn", SADB_X_IDENTTYPE_DN}, 6867c478bd9Sstevel@tonic-gate {"der_gn", SADB_X_IDENTTYPE_GN}, 6877c478bd9Sstevel@tonic-gate {NULL, 0} 6887c478bd9Sstevel@tonic-gate }; 6897c478bd9Sstevel@tonic-gate 6907c478bd9Sstevel@tonic-gate static uint16_t 691e3320f40Smarkfen parseidtype(char *type, char *ebuf) 6927c478bd9Sstevel@tonic-gate { 6937c478bd9Sstevel@tonic-gate struct idtypes *idp; 6947c478bd9Sstevel@tonic-gate u_longlong_t invalue; 695e3320f40Smarkfen char *ep = NULL; 6967c478bd9Sstevel@tonic-gate 6977c478bd9Sstevel@tonic-gate if (type == NULL) { 6987c478bd9Sstevel@tonic-gate /* Shouldn't reach here, see callers for why. */ 699e3320f40Smarkfen FATAL(ep, ebuf, gettext("Unexpected end of command line, " 700e3320f40Smarkfen "was expecting a type.\n")); 7017c478bd9Sstevel@tonic-gate } 7027c478bd9Sstevel@tonic-gate 7037c478bd9Sstevel@tonic-gate for (idp = idtypes; idp->idtype != NULL; idp++) { 7047c478bd9Sstevel@tonic-gate if (strcasecmp(idp->idtype, type) == 0) 7057c478bd9Sstevel@tonic-gate return (idp->retval); 7067c478bd9Sstevel@tonic-gate } 7077c478bd9Sstevel@tonic-gate /* 7087c478bd9Sstevel@tonic-gate * Since identity types are almost arbitrary, check for numeric 7097c478bd9Sstevel@tonic-gate * algorithm values too. PF_KEY can catch bad ones with EINVAL. 7107c478bd9Sstevel@tonic-gate */ 711e3320f40Smarkfen invalue = parsenum(type, B_FALSE, ebuf); 7127c478bd9Sstevel@tonic-gate if (invalue != (u_longlong_t)-1 && 7137c478bd9Sstevel@tonic-gate (u_longlong_t)(invalue & (u_longlong_t)0xffff) == invalue) 7147c478bd9Sstevel@tonic-gate return ((uint16_t)invalue); 7157c478bd9Sstevel@tonic-gate 7167c478bd9Sstevel@tonic-gate 717e3320f40Smarkfen ERROR1(ep, ebuf, gettext("Unknown identity type \"%s\"\n"), type); 718e3320f40Smarkfen 719e3320f40Smarkfen handle_errors(ep, NULL, B_FALSE, B_FALSE); 720eeda67c6Sjojemann return (0); 7217c478bd9Sstevel@tonic-gate } 7227c478bd9Sstevel@tonic-gate 7237c478bd9Sstevel@tonic-gate /* 7247c478bd9Sstevel@tonic-gate * Parse an address off the command line. Return length of sockaddr, 7257c478bd9Sstevel@tonic-gate * and either return a hostent pointer (caller frees). The new 7267c478bd9Sstevel@tonic-gate * getipnodebyname() call does the Right Thing (TM), even with 7277c478bd9Sstevel@tonic-gate * raw addresses (colon-separated IPv6 or dotted decimal IPv4). 7287c478bd9Sstevel@tonic-gate */ 7297c478bd9Sstevel@tonic-gate 7307c478bd9Sstevel@tonic-gate static struct { 7317c478bd9Sstevel@tonic-gate struct hostent he; 7327c478bd9Sstevel@tonic-gate char *addtl[2]; 7337c478bd9Sstevel@tonic-gate } dummy; 7347c478bd9Sstevel@tonic-gate static union { 7357c478bd9Sstevel@tonic-gate struct in6_addr ipv6; 7367c478bd9Sstevel@tonic-gate struct in_addr ipv4; 7377c478bd9Sstevel@tonic-gate uint64_t aligner; 7387c478bd9Sstevel@tonic-gate } addr1; 7397c478bd9Sstevel@tonic-gate 7407c478bd9Sstevel@tonic-gate static int 741e3320f40Smarkfen parseaddr(char *addr, struct hostent **hpp, boolean_t v6only, char *ebuf) 7427c478bd9Sstevel@tonic-gate { 7437c478bd9Sstevel@tonic-gate int hp_errno; 7447c478bd9Sstevel@tonic-gate struct hostent *hp = NULL; 745e3320f40Smarkfen char *ep = NULL; 7467c478bd9Sstevel@tonic-gate 7477c478bd9Sstevel@tonic-gate if (addr == NULL) { 748e3320f40Smarkfen FATAL(ep, ebuf, gettext("Unexpected end of command line, " 749e3320f40Smarkfen "was expecting an address.\n")); 7507c478bd9Sstevel@tonic-gate } 7517c478bd9Sstevel@tonic-gate 7527c478bd9Sstevel@tonic-gate if (!nflag) { 7537c478bd9Sstevel@tonic-gate /* 7547c478bd9Sstevel@tonic-gate * Try name->address first. Assume AF_INET6, and 7557c478bd9Sstevel@tonic-gate * get IPv4's, plus IPv6's if and only if IPv6 is configured. 7567c478bd9Sstevel@tonic-gate * This means to add IPv6 SAs, you must have IPv6 7577c478bd9Sstevel@tonic-gate * up-and-running. (AI_DEFAULT works here.) 7587c478bd9Sstevel@tonic-gate */ 7597c478bd9Sstevel@tonic-gate hp = getipnodebyname(addr, AF_INET6, 7607c478bd9Sstevel@tonic-gate (v6only ? AI_ADDRCONFIG : (AI_DEFAULT | AI_ALL)), 7617c478bd9Sstevel@tonic-gate &hp_errno); 7627c478bd9Sstevel@tonic-gate } else { 7637c478bd9Sstevel@tonic-gate /* 7647c478bd9Sstevel@tonic-gate * Try a normal address conversion only. Use "dummy" 7657c478bd9Sstevel@tonic-gate * to construct a fake hostent. Caller will know not 7667c478bd9Sstevel@tonic-gate * to free this one. 7677c478bd9Sstevel@tonic-gate */ 7687c478bd9Sstevel@tonic-gate if (inet_pton(AF_INET6, addr, &addr1) == 1) { 7697c478bd9Sstevel@tonic-gate dummy.he.h_addr_list = dummy.addtl; 7707c478bd9Sstevel@tonic-gate dummy.addtl[0] = (char *)&addr1; 7717c478bd9Sstevel@tonic-gate dummy.addtl[1] = NULL; 7727c478bd9Sstevel@tonic-gate hp = &dummy.he; 7737c478bd9Sstevel@tonic-gate dummy.he.h_addrtype = AF_INET6; 7747c478bd9Sstevel@tonic-gate dummy.he.h_length = sizeof (struct in6_addr); 7757c478bd9Sstevel@tonic-gate } else if (inet_pton(AF_INET, addr, &addr1) == 1) { 7767c478bd9Sstevel@tonic-gate /* 7778810c16bSdanmcd * Remap to AF_INET6 anyway. 7787c478bd9Sstevel@tonic-gate */ 7797c478bd9Sstevel@tonic-gate dummy.he.h_addr_list = dummy.addtl; 7807c478bd9Sstevel@tonic-gate dummy.addtl[0] = (char *)&addr1; 7817c478bd9Sstevel@tonic-gate dummy.addtl[1] = NULL; 7827c478bd9Sstevel@tonic-gate hp = &dummy.he; 7837c478bd9Sstevel@tonic-gate dummy.he.h_addrtype = AF_INET6; 7847c478bd9Sstevel@tonic-gate dummy.he.h_length = sizeof (struct in6_addr); 7857c478bd9Sstevel@tonic-gate /* 7867c478bd9Sstevel@tonic-gate * NOTE: If macro changes to disallow in-place 7877c478bd9Sstevel@tonic-gate * conversion, rewhack this. 7887c478bd9Sstevel@tonic-gate */ 7897c478bd9Sstevel@tonic-gate IN6_INADDR_TO_V4MAPPED(&addr1.ipv4, &addr1.ipv6); 7907c478bd9Sstevel@tonic-gate } else { 7917c478bd9Sstevel@tonic-gate hp = NULL; 7927c478bd9Sstevel@tonic-gate } 7937c478bd9Sstevel@tonic-gate } 7947c478bd9Sstevel@tonic-gate 795e3320f40Smarkfen if (hp == NULL) 796e3320f40Smarkfen WARN1(ep, ebuf, gettext("Unknown address %s."), addr); 7977c478bd9Sstevel@tonic-gate 7987c478bd9Sstevel@tonic-gate *hpp = hp; 7998810c16bSdanmcd /* Always return sockaddr_in6 for now. */ 800e3320f40Smarkfen handle_errors(ep, NULL, B_FALSE, B_FALSE); 8018810c16bSdanmcd return (sizeof (struct sockaddr_in6)); 8027c478bd9Sstevel@tonic-gate } 8037c478bd9Sstevel@tonic-gate 8047c478bd9Sstevel@tonic-gate /* 8057c478bd9Sstevel@tonic-gate * Parse a hex character for a key. A string will take the form: 8067c478bd9Sstevel@tonic-gate * xxxxxxxxx/nn 8077c478bd9Sstevel@tonic-gate * where 8087c478bd9Sstevel@tonic-gate * xxxxxxxxx == a string of hex characters ([0-9][a-f][A-F]) 8097c478bd9Sstevel@tonic-gate * nn == an optional decimal "mask". If it is not present, it 8107c478bd9Sstevel@tonic-gate * is assumed that the hex string will be rounded to the nearest 8117c478bd9Sstevel@tonic-gate * byte, where odd nibbles, like 123 will become 0x0123. 8127c478bd9Sstevel@tonic-gate * 8137c478bd9Sstevel@tonic-gate * NOTE:Unlike the expression of IP addresses, I will not allow an 8147c478bd9Sstevel@tonic-gate * excessive "mask". For example 2112/50 is very illegal. 8157c478bd9Sstevel@tonic-gate * NOTE2: This key should be in canonical order. Consult your man 8167c478bd9Sstevel@tonic-gate * pages per algorithm about said order. 8177c478bd9Sstevel@tonic-gate */ 8187c478bd9Sstevel@tonic-gate 8197c478bd9Sstevel@tonic-gate #define hd2num(hd) (((hd) >= '0' && (hd) <= '9') ? ((hd) - '0') : \ 8207c478bd9Sstevel@tonic-gate (((hd) >= 'a' && (hd) <= 'f') ? ((hd) - 'a' + 10) : ((hd) - 'A' + 10))) 8217c478bd9Sstevel@tonic-gate 8227c478bd9Sstevel@tonic-gate static struct sadb_key * 823628b0c67SMark Fenwick parsekey(char *input, char *ebuf, uint_t reserved_bits) 8247c478bd9Sstevel@tonic-gate { 8257c478bd9Sstevel@tonic-gate struct sadb_key *retval; 8267c478bd9Sstevel@tonic-gate uint_t i, hexlen = 0, bits, alloclen; 8277c478bd9Sstevel@tonic-gate uint8_t *key; 828e3320f40Smarkfen char *ep = NULL; 8297c478bd9Sstevel@tonic-gate 8307c478bd9Sstevel@tonic-gate if (input == NULL) { 831e3320f40Smarkfen FATAL(ep, ebuf, gettext("Unexpected end of command line, " 832e3320f40Smarkfen "was expecting a key.\n")); 8337c478bd9Sstevel@tonic-gate } 834ec485834Spwernau /* Allow hex values prepended with 0x convention */ 835ec485834Spwernau if ((strnlen(input, sizeof (hexlen)) > 2) && 836ec485834Spwernau (strncasecmp(input, "0x", 2) == 0)) 837ec485834Spwernau input += 2; 8387c478bd9Sstevel@tonic-gate 8397c478bd9Sstevel@tonic-gate for (i = 0; input[i] != '\0' && input[i] != '/'; i++) 8407c478bd9Sstevel@tonic-gate hexlen++; 8417c478bd9Sstevel@tonic-gate 8427c478bd9Sstevel@tonic-gate if (input[i] == '\0') { 8437c478bd9Sstevel@tonic-gate bits = 0; 8447c478bd9Sstevel@tonic-gate } else { 8457c478bd9Sstevel@tonic-gate /* Have /nn. */ 8467c478bd9Sstevel@tonic-gate input[i] = '\0'; 8477c478bd9Sstevel@tonic-gate if (sscanf((input + i + 1), "%u", &bits) != 1) { 848e3320f40Smarkfen FATAL1(ep, ebuf, gettext( 849e3320f40Smarkfen "\"%s\" is not a bit specifier.\n"), 8507c478bd9Sstevel@tonic-gate (input + i + 1)); 8517c478bd9Sstevel@tonic-gate } 8527c478bd9Sstevel@tonic-gate /* hexlen in nibbles */ 8537c478bd9Sstevel@tonic-gate if (((bits + 3) >> 2) > hexlen) { 854e3320f40Smarkfen ERROR2(ep, ebuf, gettext( 855e3320f40Smarkfen "bit length %d is too big for %s.\n"), bits, input); 8567c478bd9Sstevel@tonic-gate } 8577c478bd9Sstevel@tonic-gate /* 8587c478bd9Sstevel@tonic-gate * Adjust hexlen down if user gave us too small of a bit 8597c478bd9Sstevel@tonic-gate * count. 8607c478bd9Sstevel@tonic-gate */ 8617c478bd9Sstevel@tonic-gate if ((hexlen << 2) > bits + 3) { 862e3320f40Smarkfen WARN2(ep, ebuf, gettext( 863e3320f40Smarkfen "WARNING: Lower bits will be truncated " 864e3320f40Smarkfen "for:\n\t%s/%d.\n"), input, bits); 8657c478bd9Sstevel@tonic-gate hexlen = (bits + 3) >> 2; 8667c478bd9Sstevel@tonic-gate input[hexlen] = '\0'; 8677c478bd9Sstevel@tonic-gate } 8687c478bd9Sstevel@tonic-gate } 8697c478bd9Sstevel@tonic-gate 8707c478bd9Sstevel@tonic-gate /* 8717c478bd9Sstevel@tonic-gate * Allocate. Remember, hexlen is in nibbles. 8727c478bd9Sstevel@tonic-gate */ 8737c478bd9Sstevel@tonic-gate 8747c478bd9Sstevel@tonic-gate alloclen = sizeof (*retval) + roundup((hexlen/2 + (hexlen & 0x1)), 8); 8757c478bd9Sstevel@tonic-gate retval = malloc(alloclen); 8767c478bd9Sstevel@tonic-gate 8777c478bd9Sstevel@tonic-gate if (retval == NULL) 8787c478bd9Sstevel@tonic-gate Bail("malloc(parsekey)"); 8797c478bd9Sstevel@tonic-gate retval->sadb_key_len = SADB_8TO64(alloclen); 880628b0c67SMark Fenwick 881628b0c67SMark Fenwick retval->sadb_key_reserved = reserved_bits; 882628b0c67SMark Fenwick 8837c478bd9Sstevel@tonic-gate if (bits == 0) 8847c478bd9Sstevel@tonic-gate retval->sadb_key_bits = (hexlen + (hexlen & 0x1)) << 2; 8857c478bd9Sstevel@tonic-gate else 8867c478bd9Sstevel@tonic-gate retval->sadb_key_bits = bits; 8877c478bd9Sstevel@tonic-gate 8887c478bd9Sstevel@tonic-gate /* 8897c478bd9Sstevel@tonic-gate * Read in nibbles. Read in odd-numbered as shifted high. 8907c478bd9Sstevel@tonic-gate * (e.g. 123 becomes 0x1230). 8917c478bd9Sstevel@tonic-gate */ 8927c478bd9Sstevel@tonic-gate 8937c478bd9Sstevel@tonic-gate key = (uint8_t *)(retval + 1); 8947c478bd9Sstevel@tonic-gate for (i = 0; input[i] != '\0'; i += 2) { 8957c478bd9Sstevel@tonic-gate boolean_t second = (input[i + 1] != '\0'); 8967c478bd9Sstevel@tonic-gate 8977c478bd9Sstevel@tonic-gate if (!isxdigit(input[i]) || 8987c478bd9Sstevel@tonic-gate (!isxdigit(input[i + 1]) && second)) { 899e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 900e3320f40Smarkfen "string '%s' not a hex value.\n"), input); 901e3320f40Smarkfen free(retval); 902e3320f40Smarkfen retval = NULL; 903e3320f40Smarkfen break; 9047c478bd9Sstevel@tonic-gate } 9057c478bd9Sstevel@tonic-gate *key = (hd2num(input[i]) << 4); 9067c478bd9Sstevel@tonic-gate if (second) 9077c478bd9Sstevel@tonic-gate *key |= hd2num(input[i + 1]); 9087c478bd9Sstevel@tonic-gate else 9097c478bd9Sstevel@tonic-gate break; /* out of for loop. */ 9107c478bd9Sstevel@tonic-gate key++; 9117c478bd9Sstevel@tonic-gate } 9127c478bd9Sstevel@tonic-gate 9137c478bd9Sstevel@tonic-gate /* bzero the remaining bits if we're a non-octet amount. */ 9147c478bd9Sstevel@tonic-gate if (bits & 0x7) 9157c478bd9Sstevel@tonic-gate *((input[i] == '\0') ? key - 1 : key) &= 9167c478bd9Sstevel@tonic-gate 0xff << (8 - (bits & 0x7)); 9177c478bd9Sstevel@tonic-gate 918e3320f40Smarkfen handle_errors(ep, NULL, B_FALSE, B_FALSE); 9197c478bd9Sstevel@tonic-gate return (retval); 9207c478bd9Sstevel@tonic-gate } 9217c478bd9Sstevel@tonic-gate 922*5d3b8cb7SBill Sommerfeld #include <tsol/label.h> 923*5d3b8cb7SBill Sommerfeld 924*5d3b8cb7SBill Sommerfeld #define PARSELABEL_BAD_TOKEN ((struct sadb_sens *)-1) 925*5d3b8cb7SBill Sommerfeld 926*5d3b8cb7SBill Sommerfeld static struct sadb_sens * 927*5d3b8cb7SBill Sommerfeld parselabel(int token, char *label) 928*5d3b8cb7SBill Sommerfeld { 929*5d3b8cb7SBill Sommerfeld bslabel_t *sl = NULL; 930*5d3b8cb7SBill Sommerfeld int err, len; 931*5d3b8cb7SBill Sommerfeld sadb_sens_t *sens; 932*5d3b8cb7SBill Sommerfeld int doi = 1; /* XXX XXX DEFAULT_DOI XXX XXX */ 933*5d3b8cb7SBill Sommerfeld 934*5d3b8cb7SBill Sommerfeld err = str_to_label(label, &sl, MAC_LABEL, L_DEFAULT, NULL); 935*5d3b8cb7SBill Sommerfeld if (err < 0) 936*5d3b8cb7SBill Sommerfeld return (NULL); 937*5d3b8cb7SBill Sommerfeld 938*5d3b8cb7SBill Sommerfeld len = ipsec_convert_sl_to_sens(doi, sl, NULL); 939*5d3b8cb7SBill Sommerfeld 940*5d3b8cb7SBill Sommerfeld sens = malloc(len); 941*5d3b8cb7SBill Sommerfeld if (sens == NULL) { 942*5d3b8cb7SBill Sommerfeld Bail("malloc parsed label"); 943*5d3b8cb7SBill Sommerfeld /* Should exit before reaching here... */ 944*5d3b8cb7SBill Sommerfeld return (NULL); 945*5d3b8cb7SBill Sommerfeld } 946*5d3b8cb7SBill Sommerfeld 947*5d3b8cb7SBill Sommerfeld (void) ipsec_convert_sl_to_sens(doi, sl, sens); 948*5d3b8cb7SBill Sommerfeld 949*5d3b8cb7SBill Sommerfeld switch (token) { 950*5d3b8cb7SBill Sommerfeld case TOK_LABEL: 951*5d3b8cb7SBill Sommerfeld break; 952*5d3b8cb7SBill Sommerfeld 953*5d3b8cb7SBill Sommerfeld case TOK_OLABEL: 954*5d3b8cb7SBill Sommerfeld sens->sadb_sens_exttype = SADB_X_EXT_OUTER_SENS; 955*5d3b8cb7SBill Sommerfeld break; 956*5d3b8cb7SBill Sommerfeld 957*5d3b8cb7SBill Sommerfeld case TOK_IMPLABEL: 958*5d3b8cb7SBill Sommerfeld sens->sadb_sens_exttype = SADB_X_EXT_OUTER_SENS; 959*5d3b8cb7SBill Sommerfeld sens->sadb_x_sens_flags = SADB_X_SENS_IMPLICIT; 960*5d3b8cb7SBill Sommerfeld break; 961*5d3b8cb7SBill Sommerfeld 962*5d3b8cb7SBill Sommerfeld default: 963*5d3b8cb7SBill Sommerfeld free(sens); 964*5d3b8cb7SBill Sommerfeld /* 965*5d3b8cb7SBill Sommerfeld * Return a different return code for a bad label, but really, 966*5d3b8cb7SBill Sommerfeld * this would be a caller error. 967*5d3b8cb7SBill Sommerfeld */ 968*5d3b8cb7SBill Sommerfeld return (PARSELABEL_BAD_TOKEN); 969*5d3b8cb7SBill Sommerfeld } 970*5d3b8cb7SBill Sommerfeld 971*5d3b8cb7SBill Sommerfeld return (sens); 972*5d3b8cb7SBill Sommerfeld } 973*5d3b8cb7SBill Sommerfeld 9747c478bd9Sstevel@tonic-gate /* 9757c478bd9Sstevel@tonic-gate * Write a message to the PF_KEY socket. If verbose, print the message 9767c478bd9Sstevel@tonic-gate * heading into the kernel. 9777c478bd9Sstevel@tonic-gate */ 9787c478bd9Sstevel@tonic-gate static int 9797c478bd9Sstevel@tonic-gate key_write(int fd, void *msg, size_t len) 9807c478bd9Sstevel@tonic-gate { 9817c478bd9Sstevel@tonic-gate if (vflag) { 9827c478bd9Sstevel@tonic-gate (void) printf( 9837c478bd9Sstevel@tonic-gate gettext("VERBOSE ON: Message to kernel looks like:\n")); 9847c478bd9Sstevel@tonic-gate (void) printf("==========================================\n"); 985bb3ed8dfSpwernau print_samsg(stdout, msg, B_FALSE, vflag, nflag); 9867c478bd9Sstevel@tonic-gate (void) printf("==========================================\n"); 9877c478bd9Sstevel@tonic-gate } 9887c478bd9Sstevel@tonic-gate 9897c478bd9Sstevel@tonic-gate return (write(fd, msg, len)); 9907c478bd9Sstevel@tonic-gate } 9917c478bd9Sstevel@tonic-gate 9927c478bd9Sstevel@tonic-gate /* 9937c478bd9Sstevel@tonic-gate * SIGALRM handler for time_critical_enter. 9947c478bd9Sstevel@tonic-gate */ 9957c478bd9Sstevel@tonic-gate static void 9967c478bd9Sstevel@tonic-gate time_critical_catch(int signal) 9977c478bd9Sstevel@tonic-gate { 9987c478bd9Sstevel@tonic-gate if (signal == SIGALRM) { 9997c478bd9Sstevel@tonic-gate errx(1, gettext("Reply message from PF_KEY timed out.")); 10007c478bd9Sstevel@tonic-gate } else { 10017c478bd9Sstevel@tonic-gate errx(1, gettext("Caught signal %d while trying to receive" 100225e435e0Spwernau "PF_KEY reply message"), signal); 10037c478bd9Sstevel@tonic-gate } 10047c478bd9Sstevel@tonic-gate /* errx() calls exit. */ 10057c478bd9Sstevel@tonic-gate } 10067c478bd9Sstevel@tonic-gate 10077c478bd9Sstevel@tonic-gate #define TIME_CRITICAL_TIME 10 /* In seconds */ 10087c478bd9Sstevel@tonic-gate 10097c478bd9Sstevel@tonic-gate /* 10107c478bd9Sstevel@tonic-gate * Enter a "time critical" section where key is waiting for a return message. 10117c478bd9Sstevel@tonic-gate */ 10127c478bd9Sstevel@tonic-gate static void 10137c478bd9Sstevel@tonic-gate time_critical_enter(void) 10147c478bd9Sstevel@tonic-gate { 10157c478bd9Sstevel@tonic-gate (void) signal(SIGALRM, time_critical_catch); 10167c478bd9Sstevel@tonic-gate (void) alarm(TIME_CRITICAL_TIME); 10177c478bd9Sstevel@tonic-gate } 10187c478bd9Sstevel@tonic-gate 10197c478bd9Sstevel@tonic-gate /* 10207c478bd9Sstevel@tonic-gate * Exit the "time critical" section after getting an appropriate return 10217c478bd9Sstevel@tonic-gate * message. 10227c478bd9Sstevel@tonic-gate */ 10237c478bd9Sstevel@tonic-gate static void 10247c478bd9Sstevel@tonic-gate time_critical_exit(void) 10257c478bd9Sstevel@tonic-gate { 10267c478bd9Sstevel@tonic-gate (void) alarm(0); 10277c478bd9Sstevel@tonic-gate (void) signal(SIGALRM, SIG_DFL); 10287c478bd9Sstevel@tonic-gate } 10297c478bd9Sstevel@tonic-gate 10307c478bd9Sstevel@tonic-gate /* 10317c478bd9Sstevel@tonic-gate * Construct a PF_KEY FLUSH message for the SA type specified. 10327c478bd9Sstevel@tonic-gate */ 10337c478bd9Sstevel@tonic-gate static void 10347c478bd9Sstevel@tonic-gate doflush(int satype) 10357c478bd9Sstevel@tonic-gate { 10367c478bd9Sstevel@tonic-gate struct sadb_msg msg; 10377c478bd9Sstevel@tonic-gate int rc; 10387c478bd9Sstevel@tonic-gate 10397c478bd9Sstevel@tonic-gate msg_init(&msg, SADB_FLUSH, (uint8_t)satype); 10407c478bd9Sstevel@tonic-gate rc = key_write(keysock, &msg, sizeof (msg)); 10417c478bd9Sstevel@tonic-gate if (rc == -1) 10427c478bd9Sstevel@tonic-gate Bail("write() to PF_KEY socket failed (in doflush)"); 10437c478bd9Sstevel@tonic-gate 10447c478bd9Sstevel@tonic-gate time_critical_enter(); 10457c478bd9Sstevel@tonic-gate do { 10467c478bd9Sstevel@tonic-gate rc = read(keysock, &msg, sizeof (msg)); 10477c478bd9Sstevel@tonic-gate if (rc == -1) 10487c478bd9Sstevel@tonic-gate Bail("read (in doflush)"); 10497c478bd9Sstevel@tonic-gate } while (msg.sadb_msg_seq != seq || msg.sadb_msg_pid != mypid); 10507c478bd9Sstevel@tonic-gate time_critical_exit(); 10517c478bd9Sstevel@tonic-gate 10527c478bd9Sstevel@tonic-gate /* 10537c478bd9Sstevel@tonic-gate * I should _never_ hit the following unless: 10547c478bd9Sstevel@tonic-gate * 10557c478bd9Sstevel@tonic-gate * 1. There is a kernel bug. 10567c478bd9Sstevel@tonic-gate * 2. There is another process filling in its pid with mine, and 10577c478bd9Sstevel@tonic-gate * issuing a different message that would cause a different result. 10587c478bd9Sstevel@tonic-gate */ 10597c478bd9Sstevel@tonic-gate if (msg.sadb_msg_type != SADB_FLUSH || 10607c478bd9Sstevel@tonic-gate msg.sadb_msg_satype != (uint8_t)satype) { 10617c478bd9Sstevel@tonic-gate syslog((LOG_NOTICE|LOG_AUTH), 10627c478bd9Sstevel@tonic-gate gettext("doflush: Return message not of type SADB_FLUSH!")); 10637c478bd9Sstevel@tonic-gate Bail("doflush: Return message not of type SADB_FLUSH!"); 10647c478bd9Sstevel@tonic-gate } 10657c478bd9Sstevel@tonic-gate 10667c478bd9Sstevel@tonic-gate if (msg.sadb_msg_errno != 0) { 10677c478bd9Sstevel@tonic-gate errno = msg.sadb_msg_errno; 10687c478bd9Sstevel@tonic-gate if (errno == EINVAL) { 10697c478bd9Sstevel@tonic-gate print_diagnostic(stderr, msg.sadb_x_msg_diagnostic); 10707c478bd9Sstevel@tonic-gate warnx(gettext("Cannot flush SA type %d."), satype); 10717c478bd9Sstevel@tonic-gate } 10727c478bd9Sstevel@tonic-gate Bail("return message (in doflush)"); 10737c478bd9Sstevel@tonic-gate } 10747c478bd9Sstevel@tonic-gate } 10757c478bd9Sstevel@tonic-gate 10767c478bd9Sstevel@tonic-gate /* 10777c478bd9Sstevel@tonic-gate * save_XXX functions are used when "saving" the SA tables to either a 10787c478bd9Sstevel@tonic-gate * file or standard output. They use the dump_XXX functions where needed, 10797c478bd9Sstevel@tonic-gate * but mostly they use the rparseXXX functions. 10807c478bd9Sstevel@tonic-gate */ 10817c478bd9Sstevel@tonic-gate 10827c478bd9Sstevel@tonic-gate /* 10837c478bd9Sstevel@tonic-gate * Because "save" and "dump" both use the SADB_DUMP message, fold both 10847c478bd9Sstevel@tonic-gate * into the same function. 10857c478bd9Sstevel@tonic-gate */ 10867c478bd9Sstevel@tonic-gate static void 10877c478bd9Sstevel@tonic-gate dodump(int satype, FILE *ofile) 10887c478bd9Sstevel@tonic-gate { 10897c478bd9Sstevel@tonic-gate struct sadb_msg *msg = (struct sadb_msg *)get_buffer; 10907c478bd9Sstevel@tonic-gate int rc; 10917c478bd9Sstevel@tonic-gate 10927c478bd9Sstevel@tonic-gate if (ofile != NULL) { 10937c478bd9Sstevel@tonic-gate (void) fprintf(ofile, 10947c478bd9Sstevel@tonic-gate gettext("# This key file was generated by the")); 10957c478bd9Sstevel@tonic-gate (void) fprintf(ofile, 10967c478bd9Sstevel@tonic-gate gettext(" ipseckey(1m) command's 'save' feature.\n\n")); 10977c478bd9Sstevel@tonic-gate } 10987c478bd9Sstevel@tonic-gate msg_init(msg, SADB_DUMP, (uint8_t)satype); 10997c478bd9Sstevel@tonic-gate rc = key_write(keysock, msg, sizeof (*msg)); 11007c478bd9Sstevel@tonic-gate if (rc == -1) 11017c478bd9Sstevel@tonic-gate Bail("write to PF_KEY socket failed (in dodump)"); 11027c478bd9Sstevel@tonic-gate 11037c478bd9Sstevel@tonic-gate do { 11047c478bd9Sstevel@tonic-gate /* 11057c478bd9Sstevel@tonic-gate * For DUMP, do only the read as a time critical section. 11067c478bd9Sstevel@tonic-gate */ 11077c478bd9Sstevel@tonic-gate time_critical_enter(); 11087c478bd9Sstevel@tonic-gate rc = read(keysock, get_buffer, sizeof (get_buffer)); 11097c478bd9Sstevel@tonic-gate time_critical_exit(); 11107c478bd9Sstevel@tonic-gate if (rc == -1) 11117c478bd9Sstevel@tonic-gate Bail("read (in dodump)"); 11127c478bd9Sstevel@tonic-gate if (msg->sadb_msg_pid == mypid && 11137c478bd9Sstevel@tonic-gate msg->sadb_msg_type == SADB_DUMP && 11147c478bd9Sstevel@tonic-gate msg->sadb_msg_seq != 0 && 11157c478bd9Sstevel@tonic-gate msg->sadb_msg_errno == 0) { 11167c478bd9Sstevel@tonic-gate if (ofile == NULL) { 1117bb3ed8dfSpwernau print_samsg(stdout, get_buffer, B_FALSE, vflag, 1118bb3ed8dfSpwernau nflag); 11197c478bd9Sstevel@tonic-gate (void) putchar('\n'); 11207c478bd9Sstevel@tonic-gate } else { 11217c478bd9Sstevel@tonic-gate save_assoc(get_buffer, ofile); 11227c478bd9Sstevel@tonic-gate } 11237c478bd9Sstevel@tonic-gate } 11247c478bd9Sstevel@tonic-gate } while (msg->sadb_msg_pid != mypid || 11257c478bd9Sstevel@tonic-gate (msg->sadb_msg_errno == 0 && msg->sadb_msg_seq != 0)); 11267c478bd9Sstevel@tonic-gate 11277c478bd9Sstevel@tonic-gate if (ofile != NULL && ofile != stdout) 11287c478bd9Sstevel@tonic-gate (void) fclose(ofile); 11297c478bd9Sstevel@tonic-gate 11307c478bd9Sstevel@tonic-gate if (msg->sadb_msg_errno == 0) { 11317c478bd9Sstevel@tonic-gate if (ofile == NULL) 11327c478bd9Sstevel@tonic-gate (void) printf( 11337c478bd9Sstevel@tonic-gate gettext("Dump succeeded for SA type %d.\n"), 11347c478bd9Sstevel@tonic-gate satype); 11357c478bd9Sstevel@tonic-gate } else { 11367c478bd9Sstevel@tonic-gate print_diagnostic(stderr, msg->sadb_x_msg_diagnostic); 11377c478bd9Sstevel@tonic-gate errno = msg->sadb_msg_errno; 11387c478bd9Sstevel@tonic-gate Bail("Dump failed"); 11397c478bd9Sstevel@tonic-gate } 11407c478bd9Sstevel@tonic-gate } 11417c478bd9Sstevel@tonic-gate 11427c478bd9Sstevel@tonic-gate #define SCOPE_UNSPEC 0 11437c478bd9Sstevel@tonic-gate #define SCOPE_LINKLOCAL 1 11447c478bd9Sstevel@tonic-gate #define SCOPE_SITELOCAL 2 11457c478bd9Sstevel@tonic-gate #define SCOPE_GLOBAL 3 11467c478bd9Sstevel@tonic-gate #define SCOPE_V4COMPAT 4 11477c478bd9Sstevel@tonic-gate #define SCOPE_LOOPBACK 5 /* Pedantic, yes, but necessary. */ 11487c478bd9Sstevel@tonic-gate 11497c478bd9Sstevel@tonic-gate static int 11507c478bd9Sstevel@tonic-gate ipv6_addr_scope(struct in6_addr *addr) 11517c478bd9Sstevel@tonic-gate { 11527c478bd9Sstevel@tonic-gate /* Don't return anything regarding multicast for now... */ 11537c478bd9Sstevel@tonic-gate 11547c478bd9Sstevel@tonic-gate if (IN6_IS_ADDR_UNSPECIFIED(addr)) 11557c478bd9Sstevel@tonic-gate return (SCOPE_UNSPEC); 11567c478bd9Sstevel@tonic-gate 11577c478bd9Sstevel@tonic-gate if (IN6_IS_ADDR_LINKLOCAL(addr)) 11587c478bd9Sstevel@tonic-gate return (SCOPE_LINKLOCAL); 11597c478bd9Sstevel@tonic-gate 11607c478bd9Sstevel@tonic-gate if (IN6_IS_ADDR_SITELOCAL(addr)) 11617c478bd9Sstevel@tonic-gate return (SCOPE_SITELOCAL); 11627c478bd9Sstevel@tonic-gate 11637c478bd9Sstevel@tonic-gate if (IN6_IS_ADDR_V4COMPAT(addr)) 11647c478bd9Sstevel@tonic-gate return (SCOPE_V4COMPAT); 11657c478bd9Sstevel@tonic-gate 11667c478bd9Sstevel@tonic-gate if (IN6_IS_ADDR_LOOPBACK(addr)) 11677c478bd9Sstevel@tonic-gate return (SCOPE_LOOPBACK); 11687c478bd9Sstevel@tonic-gate 11697c478bd9Sstevel@tonic-gate /* For now, return global by default. */ 11707c478bd9Sstevel@tonic-gate return (SCOPE_GLOBAL); 11717c478bd9Sstevel@tonic-gate } 11727c478bd9Sstevel@tonic-gate 11737c478bd9Sstevel@tonic-gate /* 11747c478bd9Sstevel@tonic-gate * doaddresses(): 11757c478bd9Sstevel@tonic-gate * 11767c478bd9Sstevel@tonic-gate * Used by doaddup() and dodelget() to create new SA's based on the 11777c478bd9Sstevel@tonic-gate * provided source and destination addresses hostent. 11787c478bd9Sstevel@tonic-gate * 11797c478bd9Sstevel@tonic-gate * sadb_msg_type: expected PF_KEY reply message type 11807c478bd9Sstevel@tonic-gate * sadb_msg_satype: expected PF_KEY reply satype 11817c478bd9Sstevel@tonic-gate * cmd: user command 11827c478bd9Sstevel@tonic-gate * srchp: hostent for the source address(es) 11837c478bd9Sstevel@tonic-gate * dsthp: hostent for the destination address(es) 11847c478bd9Sstevel@tonic-gate * src: points to the SADB source address extension 11857c478bd9Sstevel@tonic-gate * dst: points to the SADB destination address extension 11867c478bd9Sstevel@tonic-gate * unspec_src: indicates an unspecified source address. 11877c478bd9Sstevel@tonic-gate * buffer: pointer to the SADB buffer to use with PF_KEY 11887c478bd9Sstevel@tonic-gate * buffer_size: size of buffer 11897c478bd9Sstevel@tonic-gate * spi: spi for this message (set by caller) 11907c478bd9Sstevel@tonic-gate * srcport: source port if specified 11918810c16bSdanmcd * dstport: destination port if specified 11927c478bd9Sstevel@tonic-gate * proto: IP protocol number if specified 11938810c16bSdanmcd * iproto: Inner (tunnel mode) IP protocol number if specified 11947c478bd9Sstevel@tonic-gate * NATT note: we are going to assume a semi-sane world where NAT 11957c478bd9Sstevel@tonic-gate * boxen don't explode to multiple addresses. 11967c478bd9Sstevel@tonic-gate */ 11977c478bd9Sstevel@tonic-gate static void 11987c478bd9Sstevel@tonic-gate doaddresses(uint8_t sadb_msg_type, uint8_t sadb_msg_satype, int cmd, 11997c478bd9Sstevel@tonic-gate struct hostent *srchp, struct hostent *dsthp, 12007c478bd9Sstevel@tonic-gate struct sadb_address *src, struct sadb_address *dst, 1201e3320f40Smarkfen boolean_t unspec_src, uint64_t *buffer, int buffer_size, uint32_t spi, 1202e3320f40Smarkfen char *ebuf) 12037c478bd9Sstevel@tonic-gate { 12047c478bd9Sstevel@tonic-gate boolean_t single_dst; 12057c478bd9Sstevel@tonic-gate struct sockaddr_in6 *sin6; 12067c478bd9Sstevel@tonic-gate struct sadb_msg *msgp; 12077c478bd9Sstevel@tonic-gate int i, rc; 12087c478bd9Sstevel@tonic-gate char **walker; /* For the SRC and PROXY walking functions. */ 12097c478bd9Sstevel@tonic-gate char *first_match; 12108810c16bSdanmcd uint64_t savebuf[MAX_GET_SIZE]; 12118810c16bSdanmcd uint16_t srcport = 0, dstport = 0; 1212e3320f40Smarkfen char *ep = NULL; 12137c478bd9Sstevel@tonic-gate 12147c478bd9Sstevel@tonic-gate /* 12157c478bd9Sstevel@tonic-gate * Okay, now we have "src", "dst", and maybe "proxy" reassigned 12167c478bd9Sstevel@tonic-gate * to point into the buffer to be written to PF_KEY, we can do 12177c478bd9Sstevel@tonic-gate * potentially several writes based on destination address. 12187c478bd9Sstevel@tonic-gate * 12198810c16bSdanmcd * First, obtain port numbers from passed-in extensions. 12207c478bd9Sstevel@tonic-gate */ 12217c478bd9Sstevel@tonic-gate 12227c478bd9Sstevel@tonic-gate if (src != NULL) { 12237c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(src + 1); 12248810c16bSdanmcd srcport = ntohs(sin6->sin6_port); 12257c478bd9Sstevel@tonic-gate } 12267c478bd9Sstevel@tonic-gate if (dst != NULL) { 12277c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(dst + 1); 12288810c16bSdanmcd dstport = ntohs(sin6->sin6_port); 12297c478bd9Sstevel@tonic-gate } 12307c478bd9Sstevel@tonic-gate 12317c478bd9Sstevel@tonic-gate /* 12327c478bd9Sstevel@tonic-gate * The rules for ADD, GET, and UPDATE: (NOTE: This assumes IPsec. 12337c478bd9Sstevel@tonic-gate * If other consumers of PF_KEY happen, this will have to be 12347c478bd9Sstevel@tonic-gate * rewhacked.): 12357c478bd9Sstevel@tonic-gate * 12367c478bd9Sstevel@tonic-gate * Do a message for every possible DST address. 12377c478bd9Sstevel@tonic-gate * 12387c478bd9Sstevel@tonic-gate * If a source or proxy address explodes, keep unspecified 12397c478bd9Sstevel@tonic-gate * (and mention unspecified). 12407c478bd9Sstevel@tonic-gate * 12417c478bd9Sstevel@tonic-gate * If dsthp is == dummy.he, then go through the loop once. 12427c478bd9Sstevel@tonic-gate * If any other hp is == dummy.he, then you don't have to apply any 12437c478bd9Sstevel@tonic-gate * silly rules. 12447c478bd9Sstevel@tonic-gate * 12457c478bd9Sstevel@tonic-gate * DELETE is different, because you can leave either "src" or "dst" 12467c478bd9Sstevel@tonic-gate * blank! You need to explode if one of them is full, and not assume 12477c478bd9Sstevel@tonic-gate * that the other is set. 12487c478bd9Sstevel@tonic-gate */ 12497c478bd9Sstevel@tonic-gate 12507c478bd9Sstevel@tonic-gate if (dsthp == NULL) { 12517c478bd9Sstevel@tonic-gate /* 12527c478bd9Sstevel@tonic-gate * No destination address specified. 12537c478bd9Sstevel@tonic-gate * With extended diagnostics, we don't have to bail the 12547c478bd9Sstevel@tonic-gate * non-DELETE cases here. The EINVAL diagnostics will be 12557c478bd9Sstevel@tonic-gate * enough to inform the user(s) what happened. 12567c478bd9Sstevel@tonic-gate */ 12577c478bd9Sstevel@tonic-gate i = 0; 12587c478bd9Sstevel@tonic-gate do { 12597c478bd9Sstevel@tonic-gate if (srchp == &dummy.he) { 12607c478bd9Sstevel@tonic-gate /* Just to be sure... */ 12617c478bd9Sstevel@tonic-gate srchp->h_addr_list[1] = NULL; 12627c478bd9Sstevel@tonic-gate } else if (srchp != NULL) { 12637c478bd9Sstevel@tonic-gate /* Degenerate case, h_addr_list[0] == NULL. */ 12647c478bd9Sstevel@tonic-gate if (srchp->h_addr_list[i] == NULL) 12657c478bd9Sstevel@tonic-gate Bail("Empty source address list"); 12667c478bd9Sstevel@tonic-gate 12677c478bd9Sstevel@tonic-gate /* 12687c478bd9Sstevel@tonic-gate * Fill in the src sockaddr. 12697c478bd9Sstevel@tonic-gate */ 12707c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(src + 1); 12717c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6)); 12727c478bd9Sstevel@tonic-gate bcopy(srchp->h_addr_list[i], &sin6->sin6_addr, 12737c478bd9Sstevel@tonic-gate sizeof (struct in6_addr)); 12747c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6; 12757c478bd9Sstevel@tonic-gate sin6->sin6_port = htons(srcport); 12767c478bd9Sstevel@tonic-gate } 12777c478bd9Sstevel@tonic-gate 12787c478bd9Sstevel@tonic-gate /* Save off a copy for later writing... */ 12797c478bd9Sstevel@tonic-gate msgp = (struct sadb_msg *)buffer; 12807c478bd9Sstevel@tonic-gate bcopy(buffer, savebuf, SADB_64TO8(msgp->sadb_msg_len)); 12817c478bd9Sstevel@tonic-gate 12827c478bd9Sstevel@tonic-gate rc = key_write(keysock, buffer, 12837c478bd9Sstevel@tonic-gate SADB_64TO8(msgp->sadb_msg_len)); 12847c478bd9Sstevel@tonic-gate if (rc == -1) 12857c478bd9Sstevel@tonic-gate Bail("write() to PF_KEY socket " 12867c478bd9Sstevel@tonic-gate "(in doaddresses)"); 12879c2c14abSThejaswini Singarajipura /* 12889c2c14abSThejaswini Singarajipura * Sends the message to the Solaris Cluster daemon 12899c2c14abSThejaswini Singarajipura */ 12909c2c14abSThejaswini Singarajipura 12919c2c14abSThejaswini Singarajipura if (in_cluster_mode) { 12929c2c14abSThejaswini Singarajipura (void) sendto(cluster_socket, buffer, 12939c2c14abSThejaswini Singarajipura SADB_64TO8(msgp->sadb_msg_len), 0, 12949c2c14abSThejaswini Singarajipura (struct sockaddr *)&cli_addr, 12959c2c14abSThejaswini Singarajipura sizeof (cli_addr)); 12969c2c14abSThejaswini Singarajipura } 12977c478bd9Sstevel@tonic-gate 12987c478bd9Sstevel@tonic-gate time_critical_enter(); 12997c478bd9Sstevel@tonic-gate do { 13007c478bd9Sstevel@tonic-gate rc = read(keysock, buffer, buffer_size); 13017c478bd9Sstevel@tonic-gate if (rc == -1) 13027c478bd9Sstevel@tonic-gate Bail("read (in doaddresses)"); 13037c478bd9Sstevel@tonic-gate } while (msgp->sadb_msg_seq != seq || 13047c478bd9Sstevel@tonic-gate msgp->sadb_msg_pid != mypid); 13057c478bd9Sstevel@tonic-gate time_critical_exit(); 13067c478bd9Sstevel@tonic-gate 13077c478bd9Sstevel@tonic-gate if (msgp->sadb_msg_type != sadb_msg_type || 13087c478bd9Sstevel@tonic-gate msgp->sadb_msg_satype != sadb_msg_satype) { 13097c478bd9Sstevel@tonic-gate syslog((LOG_NOTICE|LOG_AUTH), gettext( 13107c478bd9Sstevel@tonic-gate "doaddresses: Unexpected returned message " 13117c478bd9Sstevel@tonic-gate "(%d exp %d)\n"), msgp->sadb_msg_type, 13127c478bd9Sstevel@tonic-gate sadb_msg_type); 13137c478bd9Sstevel@tonic-gate Bail("doaddresses: Unexpected returned " 13147c478bd9Sstevel@tonic-gate "message"); 13157c478bd9Sstevel@tonic-gate } 13167c478bd9Sstevel@tonic-gate 13177c478bd9Sstevel@tonic-gate errno = msgp->sadb_msg_errno; 13187c478bd9Sstevel@tonic-gate if (errno != 0) { 13197c478bd9Sstevel@tonic-gate if (errno == EINVAL) { 1320e3320f40Smarkfen WARN(ep, ebuf, gettext( 1321e3320f40Smarkfen "One of the entered " 1322e3320f40Smarkfen "values is incorrect.")); 13237c478bd9Sstevel@tonic-gate print_diagnostic(stderr, 13247c478bd9Sstevel@tonic-gate msgp->sadb_x_msg_diagnostic); 1325e3320f40Smarkfen } else { 1326e3320f40Smarkfen Bail("return message (in doaddresses)"); 13277c478bd9Sstevel@tonic-gate } 13287c478bd9Sstevel@tonic-gate } 13297c478bd9Sstevel@tonic-gate 13307c478bd9Sstevel@tonic-gate /* ...and then restore the saved buffer. */ 13317c478bd9Sstevel@tonic-gate msgp = (struct sadb_msg *)savebuf; 13327c478bd9Sstevel@tonic-gate bcopy(savebuf, buffer, SADB_64TO8(msgp->sadb_msg_len)); 13337c478bd9Sstevel@tonic-gate } while (srchp != NULL && srchp->h_addr_list[++i] != NULL); 13347c478bd9Sstevel@tonic-gate return; 13357c478bd9Sstevel@tonic-gate } 13367c478bd9Sstevel@tonic-gate 13377c478bd9Sstevel@tonic-gate single_dst = (dsthp == &dummy.he || dsthp->h_addr_list[1] == NULL); 13387c478bd9Sstevel@tonic-gate 13397c478bd9Sstevel@tonic-gate for (i = 0; dsthp->h_addr_list[i] != NULL; i++) { 13407c478bd9Sstevel@tonic-gate if (dsthp == &dummy.he) { 13417c478bd9Sstevel@tonic-gate /* Just to be sure... */ 13427c478bd9Sstevel@tonic-gate dsthp->h_addr_list[1] = NULL; 13437c478bd9Sstevel@tonic-gate } else { 13447c478bd9Sstevel@tonic-gate /* 13457c478bd9Sstevel@tonic-gate * Fill in the dst sockaddr. 13467c478bd9Sstevel@tonic-gate */ 13477c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(dst + 1); 13487c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6)); 13497c478bd9Sstevel@tonic-gate bcopy(dsthp->h_addr_list[i], &sin6->sin6_addr, 13507c478bd9Sstevel@tonic-gate sizeof (struct in6_addr)); 13517c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6; 13527c478bd9Sstevel@tonic-gate sin6->sin6_port = htons(dstport); 13537c478bd9Sstevel@tonic-gate } 13547c478bd9Sstevel@tonic-gate 13557c478bd9Sstevel@tonic-gate /* 13567c478bd9Sstevel@tonic-gate * Try and assign src, if there's any ambiguity. 13577c478bd9Sstevel@tonic-gate */ 13587c478bd9Sstevel@tonic-gate if (!unspec_src && srchp != &dummy.he) { 13597c478bd9Sstevel@tonic-gate if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 13607c478bd9Sstevel@tonic-gate /* 13617c478bd9Sstevel@tonic-gate * IPv4 address. Find an IPv4 address, then 13627c478bd9Sstevel@tonic-gate * keep looking for a second one. If a second 13637c478bd9Sstevel@tonic-gate * exists, print a message, and fill in the 13647c478bd9Sstevel@tonic-gate * unspecified address. 13657c478bd9Sstevel@tonic-gate */ 13667c478bd9Sstevel@tonic-gate first_match = NULL; 13677c478bd9Sstevel@tonic-gate 13687c478bd9Sstevel@tonic-gate for (walker = srchp->h_addr_list; 13697c478bd9Sstevel@tonic-gate *walker != NULL; walker++) { 13707c478bd9Sstevel@tonic-gate /* LINTED E_BAD_PTR_CAST_ALIGN */ 13717c478bd9Sstevel@tonic-gate if (IN6_IS_ADDR_V4MAPPED( 13727c478bd9Sstevel@tonic-gate (struct in6_addr *)*walker)) { 13737c478bd9Sstevel@tonic-gate if (first_match != NULL) 13747c478bd9Sstevel@tonic-gate break; 13757c478bd9Sstevel@tonic-gate else 13767c478bd9Sstevel@tonic-gate first_match = *walker; 13777c478bd9Sstevel@tonic-gate } 13787c478bd9Sstevel@tonic-gate } 13797c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(src + 1); 13807c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6)); 13817c478bd9Sstevel@tonic-gate 13827c478bd9Sstevel@tonic-gate if (first_match == NULL) { 13837c478bd9Sstevel@tonic-gate /* 13847c478bd9Sstevel@tonic-gate * No IPv4 hits. Is this a single 13857c478bd9Sstevel@tonic-gate * dest? 13867c478bd9Sstevel@tonic-gate */ 1387e3320f40Smarkfen WARN1(ep, ebuf, gettext( 13887c478bd9Sstevel@tonic-gate "No IPv4 source address " 1389e3320f40Smarkfen "for name %s.\n"), srchp->h_name); 13907c478bd9Sstevel@tonic-gate if (single_dst) { 1391e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1392e3320f40Smarkfen "Only single destination " 1393e3320f40Smarkfen "IP address.\n")); 13947c478bd9Sstevel@tonic-gate } else { 13957c478bd9Sstevel@tonic-gate /* Continue, but do I print? */ 13967c478bd9Sstevel@tonic-gate continue; /* for loop */ 13977c478bd9Sstevel@tonic-gate } 13987c478bd9Sstevel@tonic-gate 13997c478bd9Sstevel@tonic-gate /* I should never reach here. */ 14007c478bd9Sstevel@tonic-gate } 14017c478bd9Sstevel@tonic-gate 14027c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6; 14037c478bd9Sstevel@tonic-gate sin6->sin6_port = htons(srcport); 14047c478bd9Sstevel@tonic-gate if (*walker != NULL) { 14057c478bd9Sstevel@tonic-gate /* 14067c478bd9Sstevel@tonic-gate * Early loop exit. It must've been 14077c478bd9Sstevel@tonic-gate * multiple hits... 14087c478bd9Sstevel@tonic-gate * 14097c478bd9Sstevel@tonic-gate * Issue a null-source warning? 14107c478bd9Sstevel@tonic-gate */ 1411e3320f40Smarkfen WARN1(ep, ebuf, gettext( 14127c478bd9Sstevel@tonic-gate "Multiple IPv4 source addresses " 14137c478bd9Sstevel@tonic-gate "for %s, using unspecified source " 14147c478bd9Sstevel@tonic-gate "instead."), srchp->h_name); 14157c478bd9Sstevel@tonic-gate } else { 14167c478bd9Sstevel@tonic-gate /* 14177c478bd9Sstevel@tonic-gate * If I reach here w/o hitting the 14187c478bd9Sstevel@tonic-gate * previous if statements, I have a 14197c478bd9Sstevel@tonic-gate * single source address for this 14207c478bd9Sstevel@tonic-gate * destination. 14217c478bd9Sstevel@tonic-gate */ 14227c478bd9Sstevel@tonic-gate bcopy(first_match, &sin6->sin6_addr, 14237c478bd9Sstevel@tonic-gate sizeof (struct in6_addr)); 14247c478bd9Sstevel@tonic-gate } 14257c478bd9Sstevel@tonic-gate } else { 14267c478bd9Sstevel@tonic-gate /* 14277c478bd9Sstevel@tonic-gate * IPv6 address. Find an IPv6 address. 14287c478bd9Sstevel@tonic-gate * Unlike IPv4 addresses, things can get a 14297c478bd9Sstevel@tonic-gate * little more sticky with scopes, etc. 14307c478bd9Sstevel@tonic-gate */ 14317c478bd9Sstevel@tonic-gate int dst_scope, src_scope; 14327c478bd9Sstevel@tonic-gate 14337c478bd9Sstevel@tonic-gate dst_scope = ipv6_addr_scope(&sin6->sin6_addr); 14347c478bd9Sstevel@tonic-gate 14357c478bd9Sstevel@tonic-gate first_match = NULL; 14367c478bd9Sstevel@tonic-gate for (walker = srchp->h_addr_list; 14377c478bd9Sstevel@tonic-gate *walker != NULL; walker++) { 14387c478bd9Sstevel@tonic-gate /* LINTED E_BAD_PTR_CAST_ALIGN */ 14397c478bd9Sstevel@tonic-gate if (!IN6_IS_ADDR_V4MAPPED( 14407c478bd9Sstevel@tonic-gate (struct in6_addr *)*walker)) { 14417c478bd9Sstevel@tonic-gate /* 14427c478bd9Sstevel@tonic-gate * Set first-match, etc. 14437c478bd9Sstevel@tonic-gate * Take into account scopes, 14447c478bd9Sstevel@tonic-gate * and other IPv6 thingies. 14457c478bd9Sstevel@tonic-gate */ 14467c478bd9Sstevel@tonic-gate src_scope = ipv6_addr_scope( 14477c478bd9Sstevel@tonic-gate /* LINTED E_BAD_PTR_CAST */ 14487c478bd9Sstevel@tonic-gate (struct in6_addr *)*walker); 14497c478bd9Sstevel@tonic-gate if (src_scope == SCOPE_UNSPEC || 14507c478bd9Sstevel@tonic-gate src_scope == dst_scope) { 14517c478bd9Sstevel@tonic-gate if (first_match != 14527c478bd9Sstevel@tonic-gate NULL) 14537c478bd9Sstevel@tonic-gate break; 14547c478bd9Sstevel@tonic-gate else 14557c478bd9Sstevel@tonic-gate first_match = 14567c478bd9Sstevel@tonic-gate *walker; 14577c478bd9Sstevel@tonic-gate } 14587c478bd9Sstevel@tonic-gate } 14597c478bd9Sstevel@tonic-gate } 14607c478bd9Sstevel@tonic-gate 14617c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(src + 1); 14627c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6)); 14637c478bd9Sstevel@tonic-gate sin6->sin6_port = htons(srcport); 14647c478bd9Sstevel@tonic-gate if (first_match == NULL) { 14657c478bd9Sstevel@tonic-gate /* 14667c478bd9Sstevel@tonic-gate * No IPv6 hits. Is this a single 14677c478bd9Sstevel@tonic-gate * dest? 14687c478bd9Sstevel@tonic-gate */ 1469e3320f40Smarkfen WARN1(ep, ebuf, gettext( 14707c478bd9Sstevel@tonic-gate "No IPv6 source address of " 1471e3320f40Smarkfen "matching scope for name %s.\n"), 14727c478bd9Sstevel@tonic-gate srchp->h_name); 14737c478bd9Sstevel@tonic-gate if (single_dst) { 1474e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1475e3320f40Smarkfen "Only a single IPV6 " 1476e3320f40Smarkfen "destination " 1477e3320f40Smarkfen "address.\n")); 14787c478bd9Sstevel@tonic-gate } else { 14797c478bd9Sstevel@tonic-gate /* Continue, but do I print? */ 14807c478bd9Sstevel@tonic-gate continue; /* for loop */ 14817c478bd9Sstevel@tonic-gate } 14827c478bd9Sstevel@tonic-gate 14837c478bd9Sstevel@tonic-gate /* I should never reach here. */ 14847c478bd9Sstevel@tonic-gate } 14857c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6; 14867c478bd9Sstevel@tonic-gate if (*walker != NULL) { 14877c478bd9Sstevel@tonic-gate /* 14887c478bd9Sstevel@tonic-gate * Early loop exit. Issue a 14897c478bd9Sstevel@tonic-gate * null-source warning? 14907c478bd9Sstevel@tonic-gate */ 1491e3320f40Smarkfen WARN1(ep, ebuf, gettext( 14927c478bd9Sstevel@tonic-gate "Multiple IPv6 source addresses " 14937c478bd9Sstevel@tonic-gate "for %s of the same scope, using " 1494e3320f40Smarkfen "unspecified source instead.\n"), 14957c478bd9Sstevel@tonic-gate srchp->h_name); 14967c478bd9Sstevel@tonic-gate } else { 14977c478bd9Sstevel@tonic-gate /* 14987c478bd9Sstevel@tonic-gate * If I reach here w/o hitting the 14997c478bd9Sstevel@tonic-gate * previous if statements, I have a 15007c478bd9Sstevel@tonic-gate * single source address for this 15017c478bd9Sstevel@tonic-gate * destination. 15027c478bd9Sstevel@tonic-gate */ 15037c478bd9Sstevel@tonic-gate bcopy(first_match, &sin6->sin6_addr, 15047c478bd9Sstevel@tonic-gate sizeof (struct in6_addr)); 15057c478bd9Sstevel@tonic-gate } 15067c478bd9Sstevel@tonic-gate } 15077c478bd9Sstevel@tonic-gate } 15087c478bd9Sstevel@tonic-gate 1509e3320f40Smarkfen /* 1510e3320f40Smarkfen * If there are errors at this point there is no 1511e3320f40Smarkfen * point sending anything to PF_KEY. 1512e3320f40Smarkfen */ 1513e3320f40Smarkfen handle_errors(ep, ebuf, B_TRUE, B_FALSE); 1514e3320f40Smarkfen 15157c478bd9Sstevel@tonic-gate /* Save off a copy for later writing... */ 15167c478bd9Sstevel@tonic-gate msgp = (struct sadb_msg *)buffer; 15177c478bd9Sstevel@tonic-gate bcopy(buffer, savebuf, SADB_64TO8(msgp->sadb_msg_len)); 15187c478bd9Sstevel@tonic-gate 15197c478bd9Sstevel@tonic-gate rc = key_write(keysock, buffer, SADB_64TO8(msgp->sadb_msg_len)); 15207c478bd9Sstevel@tonic-gate if (rc == -1) 15217c478bd9Sstevel@tonic-gate Bail("write() to PF_KEY socket (in doaddresses)"); 15227c478bd9Sstevel@tonic-gate 15239c2c14abSThejaswini Singarajipura if (in_cluster_mode) { 15249c2c14abSThejaswini Singarajipura (void) sendto(cluster_socket, buffer, 15259c2c14abSThejaswini Singarajipura SADB_64TO8(msgp->sadb_msg_len), 0, 15269c2c14abSThejaswini Singarajipura (struct sockaddr *)&cli_addr, 15279c2c14abSThejaswini Singarajipura sizeof (cli_addr)); 15289c2c14abSThejaswini Singarajipura } 15297c478bd9Sstevel@tonic-gate /* Blank the key for paranoia's sake. */ 15307c478bd9Sstevel@tonic-gate bzero(buffer, buffer_size); 15317c478bd9Sstevel@tonic-gate time_critical_enter(); 15327c478bd9Sstevel@tonic-gate do { 15337c478bd9Sstevel@tonic-gate rc = read(keysock, buffer, buffer_size); 15347c478bd9Sstevel@tonic-gate if (rc == -1) 15357c478bd9Sstevel@tonic-gate Bail("read (in doaddresses)"); 15367c478bd9Sstevel@tonic-gate } while (msgp->sadb_msg_seq != seq || 15377c478bd9Sstevel@tonic-gate msgp->sadb_msg_pid != mypid); 15387c478bd9Sstevel@tonic-gate time_critical_exit(); 15397c478bd9Sstevel@tonic-gate 15407c478bd9Sstevel@tonic-gate /* 15417c478bd9Sstevel@tonic-gate * I should _never_ hit the following unless: 15427c478bd9Sstevel@tonic-gate * 15437c478bd9Sstevel@tonic-gate * 1. There is a kernel bug. 15447c478bd9Sstevel@tonic-gate * 2. Another process is mistakenly using my pid in a PF_KEY 15457c478bd9Sstevel@tonic-gate * message. 15467c478bd9Sstevel@tonic-gate */ 15477c478bd9Sstevel@tonic-gate if (msgp->sadb_msg_type != sadb_msg_type || 15487c478bd9Sstevel@tonic-gate msgp->sadb_msg_satype != sadb_msg_satype) { 15497c478bd9Sstevel@tonic-gate syslog((LOG_NOTICE|LOG_AUTH), gettext( 15507c478bd9Sstevel@tonic-gate "doaddresses: Unexpected returned message " 15517c478bd9Sstevel@tonic-gate "(%d exp %d)\n"), msgp->sadb_msg_type, 15527c478bd9Sstevel@tonic-gate sadb_msg_type); 15537c478bd9Sstevel@tonic-gate Bail("doaddresses: Unexpected returned message"); 15547c478bd9Sstevel@tonic-gate } 15557c478bd9Sstevel@tonic-gate 15567c478bd9Sstevel@tonic-gate if (msgp->sadb_msg_errno != 0) { 15577c478bd9Sstevel@tonic-gate char addrprint[INET6_ADDRSTRLEN]; 15587c478bd9Sstevel@tonic-gate int on_errno = 0; 15597c478bd9Sstevel@tonic-gate char *on_errno_msg; 15607c478bd9Sstevel@tonic-gate 15617c478bd9Sstevel@tonic-gate /* 15627c478bd9Sstevel@tonic-gate * Print different error messages depending 15637c478bd9Sstevel@tonic-gate * on the SADB message type being processed. 15647c478bd9Sstevel@tonic-gate * If we get a ESRCH error for a GET/DELETE 15657c478bd9Sstevel@tonic-gate * messages, we report that the SA does not 15667c478bd9Sstevel@tonic-gate * exist. If we get a EEXIST error for a 15677c478bd9Sstevel@tonic-gate * ADD/UPDATE message, we report that the 15687c478bd9Sstevel@tonic-gate * SA already exists. 15697c478bd9Sstevel@tonic-gate */ 15707c478bd9Sstevel@tonic-gate if (sadb_msg_type == SADB_GET || 15717c478bd9Sstevel@tonic-gate sadb_msg_type == SADB_DELETE) { 15727c478bd9Sstevel@tonic-gate on_errno = ESRCH; 15737c478bd9Sstevel@tonic-gate on_errno_msg = "does not exist"; 15747c478bd9Sstevel@tonic-gate } else if (sadb_msg_type == SADB_ADD || 15757c478bd9Sstevel@tonic-gate sadb_msg_type == SADB_UPDATE) { 15767c478bd9Sstevel@tonic-gate on_errno = EEXIST; 15777c478bd9Sstevel@tonic-gate on_errno_msg = "already exists"; 15787c478bd9Sstevel@tonic-gate } 15797c478bd9Sstevel@tonic-gate 15807c478bd9Sstevel@tonic-gate errno = msgp->sadb_msg_errno; 15817c478bd9Sstevel@tonic-gate if (errno == on_errno) { 1582e3320f40Smarkfen ERROR2(ep, ebuf, gettext( 1583e3320f40Smarkfen "Association (type = %s) " 1584e3320f40Smarkfen "with spi 0x%x and addr\n"), 15857c478bd9Sstevel@tonic-gate rparsesatype(msgp->sadb_msg_satype), 1586e3320f40Smarkfen ntohl(spi)); 1587e3320f40Smarkfen ERROR2(ep, ebuf, "%s %s.\n", 15887c478bd9Sstevel@tonic-gate do_inet_ntop(dsthp->h_addr_list[i], 158925e435e0Spwernau addrprint, sizeof (addrprint)), 15907c478bd9Sstevel@tonic-gate on_errno_msg); 15917c478bd9Sstevel@tonic-gate msgp = (struct sadb_msg *)savebuf; 15927c478bd9Sstevel@tonic-gate bcopy(savebuf, buffer, 15937c478bd9Sstevel@tonic-gate SADB_64TO8(msgp->sadb_msg_len)); 15947c478bd9Sstevel@tonic-gate continue; 15957c478bd9Sstevel@tonic-gate } else { 159638d95a78Smarkfen if (errno == EINVAL || errno == ESRCH) { 1597e3320f40Smarkfen ERROR2(ep, ebuf, gettext( 1598e3320f40Smarkfen "PF_KEY Diagnostic code %u: %s.\n"), 1599e3320f40Smarkfen msgp->sadb_x_msg_diagnostic, 1600e3320f40Smarkfen keysock_diag( 1601e3320f40Smarkfen msgp->sadb_x_msg_diagnostic)); 1602e3320f40Smarkfen } else { 1603e3320f40Smarkfen Bail("return message (in doaddresses)"); 16047c478bd9Sstevel@tonic-gate } 16057c478bd9Sstevel@tonic-gate } 16067c478bd9Sstevel@tonic-gate } 1607e3320f40Smarkfen 16087c478bd9Sstevel@tonic-gate if (cmd == CMD_GET) { 16098810c16bSdanmcd if (msgp->sadb_msg_len > MAX_GET_SIZE) { 1610e3320f40Smarkfen WARN1(ep, ebuf, gettext("WARNING: " 1611e3320f40Smarkfen "SA information bigger than %d bytes.\n"), 16128810c16bSdanmcd SADB_64TO8(MAX_GET_SIZE)); 16137c478bd9Sstevel@tonic-gate } 1614bb3ed8dfSpwernau print_samsg(stdout, buffer, B_FALSE, vflag, nflag); 16157c478bd9Sstevel@tonic-gate } 16167c478bd9Sstevel@tonic-gate 1617e3320f40Smarkfen handle_errors(ep, ebuf, B_TRUE, B_FALSE); 1618e3320f40Smarkfen 16197c478bd9Sstevel@tonic-gate /* ...and then restore the saved buffer. */ 16207c478bd9Sstevel@tonic-gate msgp = (struct sadb_msg *)savebuf; 16217c478bd9Sstevel@tonic-gate bcopy(savebuf, buffer, SADB_64TO8(msgp->sadb_msg_len)); 1622e3320f40Smarkfen lines_added++; 16237c478bd9Sstevel@tonic-gate } 16247c478bd9Sstevel@tonic-gate 16257c478bd9Sstevel@tonic-gate /* Degenerate case, h_addr_list[0] == NULL. */ 16267c478bd9Sstevel@tonic-gate if (i == 0) 16277c478bd9Sstevel@tonic-gate Bail("Empty destination address list"); 1628e3320f40Smarkfen 1629e3320f40Smarkfen /* 1630e3320f40Smarkfen * free(ebuf) even if there are no errors. 1631e3320f40Smarkfen * handle_errors() won't return here. 1632e3320f40Smarkfen */ 1633e3320f40Smarkfen handle_errors(ep, ebuf, B_TRUE, B_TRUE); 16347c478bd9Sstevel@tonic-gate } 16357c478bd9Sstevel@tonic-gate 16367c478bd9Sstevel@tonic-gate /* 16377c478bd9Sstevel@tonic-gate * Perform an add or an update. ADD and UPDATE are similar in the extensions 16387c478bd9Sstevel@tonic-gate * they need. 16397c478bd9Sstevel@tonic-gate */ 16407c478bd9Sstevel@tonic-gate static void 1641e3320f40Smarkfen doaddup(int cmd, int satype, char *argv[], char *ebuf) 16427c478bd9Sstevel@tonic-gate { 16437c478bd9Sstevel@tonic-gate uint64_t *buffer, *nexthdr; 16447c478bd9Sstevel@tonic-gate struct sadb_msg msg; 16457c478bd9Sstevel@tonic-gate struct sadb_sa *assoc = NULL; 164638d95a78Smarkfen struct sadb_x_pair *sadb_pair = NULL; 16478810c16bSdanmcd struct sadb_address *src = NULL, *dst = NULL; 16488810c16bSdanmcd struct sadb_address *isrc = NULL, *idst = NULL; 16497c478bd9Sstevel@tonic-gate struct sadb_address *natt_local = NULL, *natt_remote = NULL; 16507c478bd9Sstevel@tonic-gate struct sadb_key *encrypt = NULL, *auth = NULL; 16517c478bd9Sstevel@tonic-gate struct sadb_ident *srcid = NULL, *dstid = NULL; 16527c478bd9Sstevel@tonic-gate struct sadb_lifetime *hard = NULL, *soft = NULL; /* Current? */ 16539c2c14abSThejaswini Singarajipura struct sadb_lifetime *idle = NULL; 16549c2c14abSThejaswini Singarajipura struct sadb_x_replay_ctr *replay_ctr = NULL; 1655*5d3b8cb7SBill Sommerfeld struct sadb_sens *label = NULL, *olabel = NULL; 16567c478bd9Sstevel@tonic-gate struct sockaddr_in6 *sin6; 16577c478bd9Sstevel@tonic-gate /* MLS TODO: Need sensitivity eventually. */ 16588810c16bSdanmcd int next, token, sa_len, alloclen, totallen = sizeof (msg), prefix; 1659a050d7e9Spwernau uint32_t spi = 0; 1660628b0c67SMark Fenwick uint_t reserved_bits = 0; 166138d95a78Smarkfen uint8_t sadb_msg_type; 16628810c16bSdanmcd char *thiscmd, *pstr; 16638810c16bSdanmcd boolean_t readstate = B_FALSE, unspec_src = B_FALSE; 16648810c16bSdanmcd boolean_t alloc_inner = B_FALSE, use_natt = B_FALSE; 16658810c16bSdanmcd struct hostent *srchp = NULL, *dsthp = NULL, *isrchp = NULL, 16668810c16bSdanmcd *idsthp = NULL; 16677c478bd9Sstevel@tonic-gate struct hostent *natt_lhp = NULL, *natt_rhp = NULL; 16688810c16bSdanmcd uint16_t srcport = 0, dstport = 0, natt_lport = 0, natt_rport = 0, 16698810c16bSdanmcd isrcport = 0, idstport = 0; 16708810c16bSdanmcd uint8_t proto = 0, iproto = 0; 1671e3320f40Smarkfen char *ep = NULL; 16727c478bd9Sstevel@tonic-gate 167338d95a78Smarkfen switch (cmd) { 167438d95a78Smarkfen case CMD_ADD: 167538d95a78Smarkfen thiscmd = "add"; 167638d95a78Smarkfen sadb_msg_type = SADB_ADD; 167738d95a78Smarkfen break; 167838d95a78Smarkfen case CMD_UPDATE: 167938d95a78Smarkfen thiscmd = "update"; 168038d95a78Smarkfen sadb_msg_type = SADB_UPDATE; 168138d95a78Smarkfen break; 168238d95a78Smarkfen case CMD_UPDATE_PAIR: 168338d95a78Smarkfen thiscmd = "update-pair"; 168438d95a78Smarkfen sadb_msg_type = SADB_X_UPDATEPAIR; 168538d95a78Smarkfen break; 168638d95a78Smarkfen } 16877c478bd9Sstevel@tonic-gate 168838d95a78Smarkfen msg_init(&msg, sadb_msg_type, (uint8_t)satype); 16897c478bd9Sstevel@tonic-gate /* Assume last element in argv is set to NULL. */ 16907c478bd9Sstevel@tonic-gate do { 16917c478bd9Sstevel@tonic-gate token = parseextval(*argv, &next); 16927c478bd9Sstevel@tonic-gate argv++; 16937c478bd9Sstevel@tonic-gate switch (token) { 16947c478bd9Sstevel@tonic-gate case TOK_EOF: 16957c478bd9Sstevel@tonic-gate /* Do nothing, I'm done. */ 16967c478bd9Sstevel@tonic-gate break; 16977c478bd9Sstevel@tonic-gate case TOK_UNKNOWN: 1698e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 1699e3320f40Smarkfen "Unknown extension field \"%s\" \n"), *(argv - 1)); 17007c478bd9Sstevel@tonic-gate break; 17017c478bd9Sstevel@tonic-gate case TOK_SPI: 170238d95a78Smarkfen case TOK_PAIR_SPI: 17037c478bd9Sstevel@tonic-gate case TOK_REPLAY: 17047c478bd9Sstevel@tonic-gate case TOK_STATE: 17057c478bd9Sstevel@tonic-gate case TOK_AUTHALG: 17067c478bd9Sstevel@tonic-gate case TOK_ENCRALG: 17077c478bd9Sstevel@tonic-gate case TOK_ENCAP: 17087c478bd9Sstevel@tonic-gate /* 17097c478bd9Sstevel@tonic-gate * May want to place this chunk of code in a function. 17107c478bd9Sstevel@tonic-gate * 17117c478bd9Sstevel@tonic-gate * This code checks for duplicate entries on a command 17127c478bd9Sstevel@tonic-gate * line. 17137c478bd9Sstevel@tonic-gate */ 17147c478bd9Sstevel@tonic-gate 17157c478bd9Sstevel@tonic-gate /* Allocate the SADB_EXT_SA extension. */ 17167c478bd9Sstevel@tonic-gate if (assoc == NULL) { 17177c478bd9Sstevel@tonic-gate assoc = malloc(sizeof (*assoc)); 17187c478bd9Sstevel@tonic-gate if (assoc == NULL) 17197c478bd9Sstevel@tonic-gate Bail("malloc(assoc)"); 17207c478bd9Sstevel@tonic-gate bzero(assoc, sizeof (*assoc)); 17217c478bd9Sstevel@tonic-gate assoc->sadb_sa_exttype = SADB_EXT_SA; 17227c478bd9Sstevel@tonic-gate assoc->sadb_sa_len = 17237c478bd9Sstevel@tonic-gate SADB_8TO64(sizeof (*assoc)); 17247c478bd9Sstevel@tonic-gate totallen += sizeof (*assoc); 17257c478bd9Sstevel@tonic-gate } 17267c478bd9Sstevel@tonic-gate switch (token) { 17277c478bd9Sstevel@tonic-gate case TOK_SPI: 17287c478bd9Sstevel@tonic-gate /* 17297c478bd9Sstevel@tonic-gate * If some cretin types in "spi 0" then he/she 17307c478bd9Sstevel@tonic-gate * can type in another SPI. 17317c478bd9Sstevel@tonic-gate */ 17327c478bd9Sstevel@tonic-gate if (assoc->sadb_sa_spi != 0) { 1733e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1734e3320f40Smarkfen "Can only specify " 1735e3320f40Smarkfen "single SPI value.\n")); 1736e3320f40Smarkfen break; 17377c478bd9Sstevel@tonic-gate } 17387c478bd9Sstevel@tonic-gate /* Must convert SPI to network order! */ 17397c478bd9Sstevel@tonic-gate assoc->sadb_sa_spi = 1740e3320f40Smarkfen htonl((uint32_t)parsenum(*argv, B_TRUE, 1741e3320f40Smarkfen ebuf)); 1742e3320f40Smarkfen if (assoc->sadb_sa_spi == 0) { 1743e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1744e3320f40Smarkfen "Invalid SPI value \"0\" .\n")); 1745e3320f40Smarkfen } 17467c478bd9Sstevel@tonic-gate break; 174738d95a78Smarkfen case TOK_PAIR_SPI: 174838d95a78Smarkfen if (cmd == CMD_UPDATE_PAIR) { 174938d95a78Smarkfen ERROR(ep, ebuf, gettext( 175038d95a78Smarkfen "pair-spi can not be used with the " 175138d95a78Smarkfen "\"update-pair\" command.\n")); 175238d95a78Smarkfen } 175338d95a78Smarkfen if (sadb_pair == NULL) { 175438d95a78Smarkfen sadb_pair = malloc(sizeof (*sadb_pair)); 175538d95a78Smarkfen if (assoc == NULL) 175638d95a78Smarkfen Bail("malloc(assoc)"); 175738d95a78Smarkfen bzero(sadb_pair, sizeof (*sadb_pair)); 175838d95a78Smarkfen totallen += sizeof (*sadb_pair); 175938d95a78Smarkfen } 176038d95a78Smarkfen if (sadb_pair->sadb_x_pair_spi != 0) { 176138d95a78Smarkfen ERROR(ep, ebuf, gettext( 176238d95a78Smarkfen "Can only specify " 176338d95a78Smarkfen "single pair SPI value.\n")); 176438d95a78Smarkfen break; 176538d95a78Smarkfen } 176638d95a78Smarkfen /* Must convert SPI to network order! */ 176738d95a78Smarkfen sadb_pair->sadb_x_pair_len = 176838d95a78Smarkfen SADB_8TO64(sizeof (*sadb_pair)); 176938d95a78Smarkfen sadb_pair->sadb_x_pair_exttype = 177038d95a78Smarkfen SADB_X_EXT_PAIR; 177138d95a78Smarkfen sadb_pair->sadb_x_pair_spi = 177238d95a78Smarkfen htonl((uint32_t)parsenum(*argv, B_TRUE, 177338d95a78Smarkfen ebuf)); 177438d95a78Smarkfen if (sadb_pair->sadb_x_pair_spi == 0) { 177538d95a78Smarkfen ERROR(ep, ebuf, gettext( 177638d95a78Smarkfen "Invalid SPI value \"0\" .\n")); 177738d95a78Smarkfen } 177838d95a78Smarkfen assoc->sadb_sa_flags |= 177938d95a78Smarkfen SADB_X_SAFLAGS_PAIRED; 178038d95a78Smarkfen break; 17817c478bd9Sstevel@tonic-gate case TOK_REPLAY: 17827c478bd9Sstevel@tonic-gate /* 17837c478bd9Sstevel@tonic-gate * That same cretin can do the same with 17847c478bd9Sstevel@tonic-gate * replay. 17857c478bd9Sstevel@tonic-gate */ 17867c478bd9Sstevel@tonic-gate if (assoc->sadb_sa_replay != 0) { 1787e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1788e3320f40Smarkfen "Can only specify " 1789e3320f40Smarkfen "single replay window size.\n")); 1790e3320f40Smarkfen break; 17917c478bd9Sstevel@tonic-gate } 17927c478bd9Sstevel@tonic-gate assoc->sadb_sa_replay = 1793e3320f40Smarkfen (uint8_t)parsenum(*argv, B_TRUE, ebuf); 17947c478bd9Sstevel@tonic-gate if (assoc->sadb_sa_replay != 0) { 1795e3320f40Smarkfen WARN(ep, ebuf, gettext( 17967c478bd9Sstevel@tonic-gate "WARNING: Replay with manual" 1797e3320f40Smarkfen " keying considered harmful.\n")); 17987c478bd9Sstevel@tonic-gate } 17997c478bd9Sstevel@tonic-gate break; 18007c478bd9Sstevel@tonic-gate case TOK_STATE: 18017c478bd9Sstevel@tonic-gate /* 18027c478bd9Sstevel@tonic-gate * 0 is an actual state value, LARVAL. This 18037c478bd9Sstevel@tonic-gate * means that one can type in the larval state 18047c478bd9Sstevel@tonic-gate * and then type in another state on the same 18057c478bd9Sstevel@tonic-gate * command line. 18067c478bd9Sstevel@tonic-gate */ 18077c478bd9Sstevel@tonic-gate if (assoc->sadb_sa_state != 0) { 1808e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1809e3320f40Smarkfen "Can only specify " 1810e3320f40Smarkfen "single SA state.\n")); 1811e3320f40Smarkfen break; 18127c478bd9Sstevel@tonic-gate } 1813e3320f40Smarkfen assoc->sadb_sa_state = parsestate(*argv, 1814e3320f40Smarkfen ebuf); 18157c478bd9Sstevel@tonic-gate readstate = B_TRUE; 18167c478bd9Sstevel@tonic-gate break; 18177c478bd9Sstevel@tonic-gate case TOK_AUTHALG: 18187c478bd9Sstevel@tonic-gate if (assoc->sadb_sa_auth != 0) { 1819e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1820e3320f40Smarkfen "Can only specify " 1821e3320f40Smarkfen "single auth algorithm.\n")); 1822e3320f40Smarkfen break; 18237c478bd9Sstevel@tonic-gate } 18247c478bd9Sstevel@tonic-gate assoc->sadb_sa_auth = parsealg(*argv, 1825e3320f40Smarkfen IPSEC_PROTO_AH, ebuf); 18267c478bd9Sstevel@tonic-gate break; 18277c478bd9Sstevel@tonic-gate case TOK_ENCRALG: 18288810c16bSdanmcd if (satype == SADB_SATYPE_AH) { 1829e3320f40Smarkfen ERROR(ep, ebuf, gettext("Cannot specify" 1830e3320f40Smarkfen " encryption with SA type ah.\n")); 1831e3320f40Smarkfen break; 18328810c16bSdanmcd } 18337c478bd9Sstevel@tonic-gate if (assoc->sadb_sa_encrypt != 0) { 1834e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1835e3320f40Smarkfen "Can only specify " 1836e3320f40Smarkfen "single encryption algorithm.\n")); 1837e3320f40Smarkfen break; 18387c478bd9Sstevel@tonic-gate } 18397c478bd9Sstevel@tonic-gate assoc->sadb_sa_encrypt = parsealg(*argv, 1840e3320f40Smarkfen IPSEC_PROTO_ESP, ebuf); 18417c478bd9Sstevel@tonic-gate break; 18427c478bd9Sstevel@tonic-gate case TOK_ENCAP: 18437c478bd9Sstevel@tonic-gate if (use_natt) { 1844e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1845e3320f40Smarkfen "Can only specify single" 1846e3320f40Smarkfen " encapsulation.\n")); 1847e3320f40Smarkfen break; 18487c478bd9Sstevel@tonic-gate } 18497c478bd9Sstevel@tonic-gate if (strncmp(*argv, "udp", 3)) { 1850e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1851e3320f40Smarkfen "Can only specify udp" 1852e3320f40Smarkfen " encapsulation.\n")); 1853e3320f40Smarkfen break; 18547c478bd9Sstevel@tonic-gate } 18557c478bd9Sstevel@tonic-gate use_natt = B_TRUE; 18567c478bd9Sstevel@tonic-gate /* set assoc flags later */ 18577c478bd9Sstevel@tonic-gate break; 18587c478bd9Sstevel@tonic-gate } 18597c478bd9Sstevel@tonic-gate argv++; 18607c478bd9Sstevel@tonic-gate break; 18617c478bd9Sstevel@tonic-gate case TOK_SRCPORT: 18627c478bd9Sstevel@tonic-gate if (srcport != 0) { 1863e3320f40Smarkfen ERROR(ep, ebuf, gettext("Can only specify " 1864e3320f40Smarkfen "single source port.\n")); 1865e3320f40Smarkfen break; 18667c478bd9Sstevel@tonic-gate } 1867e3320f40Smarkfen srcport = parsenum(*argv, B_TRUE, ebuf); 18687c478bd9Sstevel@tonic-gate argv++; 18697c478bd9Sstevel@tonic-gate break; 18707c478bd9Sstevel@tonic-gate case TOK_DSTPORT: 18717c478bd9Sstevel@tonic-gate if (dstport != 0) { 1872e3320f40Smarkfen ERROR(ep, ebuf, gettext("Can only specify " 1873e3320f40Smarkfen "single destination port.\n")); 1874e3320f40Smarkfen break; 18757c478bd9Sstevel@tonic-gate } 1876e3320f40Smarkfen dstport = parsenum(*argv, B_TRUE, ebuf); 18777c478bd9Sstevel@tonic-gate argv++; 18787c478bd9Sstevel@tonic-gate break; 18798810c16bSdanmcd case TOK_ISRCPORT: 18808810c16bSdanmcd alloc_inner = B_TRUE; 18818810c16bSdanmcd if (isrcport != 0) { 1882e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1883e3320f40Smarkfen "Can only specify " 1884e3320f40Smarkfen "single inner-source port.\n")); 1885e3320f40Smarkfen break; 18868810c16bSdanmcd } 1887e3320f40Smarkfen isrcport = parsenum(*argv, B_TRUE, ebuf); 18888810c16bSdanmcd argv++; 18898810c16bSdanmcd break; 18908810c16bSdanmcd case TOK_IDSTPORT: 18918810c16bSdanmcd alloc_inner = B_TRUE; 18928810c16bSdanmcd if (idstport != 0) { 1893e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1894e3320f40Smarkfen "Can only specify " 1895e3320f40Smarkfen "single inner-destination port.\n")); 1896e3320f40Smarkfen break; 18978810c16bSdanmcd } 1898e3320f40Smarkfen idstport = parsenum(*argv, B_TRUE, ebuf); 18998810c16bSdanmcd argv++; 19008810c16bSdanmcd break; 19017c478bd9Sstevel@tonic-gate case TOK_NATLPORT: 19027c478bd9Sstevel@tonic-gate if (natt_lport != 0) { 1903e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1904e3320f40Smarkfen "Can only specify " 1905e3320f40Smarkfen "single NAT-T local port.\n")); 1906e3320f40Smarkfen break; 19077c478bd9Sstevel@tonic-gate } 1908e3320f40Smarkfen natt_lport = parsenum(*argv, B_TRUE, ebuf); 19097c478bd9Sstevel@tonic-gate argv++; 19107c478bd9Sstevel@tonic-gate break; 19117c478bd9Sstevel@tonic-gate case TOK_NATRPORT: 19127c478bd9Sstevel@tonic-gate if (natt_rport != 0) { 1913e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1914e3320f40Smarkfen "Can only specify " 1915e3320f40Smarkfen "single NAT-T remote port.\n")); 1916e3320f40Smarkfen break; 19177c478bd9Sstevel@tonic-gate } 1918e3320f40Smarkfen natt_rport = parsenum(*argv, B_TRUE, ebuf); 19197c478bd9Sstevel@tonic-gate argv++; 19207c478bd9Sstevel@tonic-gate break; 19217c478bd9Sstevel@tonic-gate 19227c478bd9Sstevel@tonic-gate case TOK_PROTO: 19237c478bd9Sstevel@tonic-gate if (proto != 0) { 1924e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1925e3320f40Smarkfen "Can only specify " 1926e3320f40Smarkfen "single protocol.\n")); 1927e3320f40Smarkfen break; 19287c478bd9Sstevel@tonic-gate } 1929e3320f40Smarkfen proto = parsenum(*argv, B_TRUE, ebuf); 19307c478bd9Sstevel@tonic-gate argv++; 19317c478bd9Sstevel@tonic-gate break; 19328810c16bSdanmcd case TOK_IPROTO: 19338810c16bSdanmcd alloc_inner = B_TRUE; 19348810c16bSdanmcd if (iproto != 0) { 1935e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1936e3320f40Smarkfen "Can only specify " 1937e3320f40Smarkfen "single inner protocol.\n")); 1938e3320f40Smarkfen break; 19398810c16bSdanmcd } 1940e3320f40Smarkfen iproto = parsenum(*argv, B_TRUE, ebuf); 19418810c16bSdanmcd argv++; 19428810c16bSdanmcd break; 19437c478bd9Sstevel@tonic-gate case TOK_SRCADDR: 19447c478bd9Sstevel@tonic-gate case TOK_SRCADDR6: 19457c478bd9Sstevel@tonic-gate if (src != NULL) { 1946e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1947e3320f40Smarkfen "Can only specify " 1948e3320f40Smarkfen "single source address.\n")); 1949e3320f40Smarkfen break; 19507c478bd9Sstevel@tonic-gate } 19517c478bd9Sstevel@tonic-gate sa_len = parseaddr(*argv, &srchp, 1952e3320f40Smarkfen (token == TOK_SRCADDR6), ebuf); 1953e3320f40Smarkfen if (srchp == NULL) { 1954e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 1955e3320f40Smarkfen "Unknown src address \"%s\"\n"), *argv); 1956e3320f40Smarkfen break; 1957e3320f40Smarkfen } 19587c478bd9Sstevel@tonic-gate argv++; 19597c478bd9Sstevel@tonic-gate /* 19607c478bd9Sstevel@tonic-gate * Round of the sockaddr length to an 8 byte 19617c478bd9Sstevel@tonic-gate * boundary to make PF_KEY happy. 19627c478bd9Sstevel@tonic-gate */ 19637c478bd9Sstevel@tonic-gate alloclen = sizeof (*src) + roundup(sa_len, 8); 19647c478bd9Sstevel@tonic-gate src = malloc(alloclen); 19657c478bd9Sstevel@tonic-gate if (src == NULL) 19667c478bd9Sstevel@tonic-gate Bail("malloc(src)"); 19677c478bd9Sstevel@tonic-gate totallen += alloclen; 19687c478bd9Sstevel@tonic-gate src->sadb_address_len = SADB_8TO64(alloclen); 19697c478bd9Sstevel@tonic-gate src->sadb_address_exttype = SADB_EXT_ADDRESS_SRC; 19707c478bd9Sstevel@tonic-gate src->sadb_address_reserved = 0; 19717c478bd9Sstevel@tonic-gate src->sadb_address_prefixlen = 0; 19727c478bd9Sstevel@tonic-gate src->sadb_address_proto = 0; 19737c478bd9Sstevel@tonic-gate if (srchp == &dummy.he) { 19747c478bd9Sstevel@tonic-gate /* 19757c478bd9Sstevel@tonic-gate * Single address with -n flag. 19767c478bd9Sstevel@tonic-gate */ 19777c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(src + 1); 19787c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6)); 19797c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6; 19807c478bd9Sstevel@tonic-gate bcopy(srchp->h_addr_list[0], &sin6->sin6_addr, 19817c478bd9Sstevel@tonic-gate sizeof (struct in6_addr)); 19827c478bd9Sstevel@tonic-gate } 19837c478bd9Sstevel@tonic-gate break; 19847c478bd9Sstevel@tonic-gate case TOK_DSTADDR: 19857c478bd9Sstevel@tonic-gate case TOK_DSTADDR6: 19867c478bd9Sstevel@tonic-gate if (dst != NULL) { 1987e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1988e3320f40Smarkfen "Can only specify single " 1989e3320f40Smarkfen "destination address.\n")); 1990e3320f40Smarkfen break; 19917c478bd9Sstevel@tonic-gate } 19927c478bd9Sstevel@tonic-gate sa_len = parseaddr(*argv, &dsthp, 1993e3320f40Smarkfen (token == TOK_DSTADDR6), ebuf); 1994e3320f40Smarkfen if (dsthp == NULL) { 1995e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 1996e3320f40Smarkfen "Unknown dst address \"%s\"\n"), *argv); 1997e3320f40Smarkfen break; 1998e3320f40Smarkfen } 19997c478bd9Sstevel@tonic-gate argv++; 20007c478bd9Sstevel@tonic-gate alloclen = sizeof (*dst) + roundup(sa_len, 8); 20017c478bd9Sstevel@tonic-gate dst = malloc(alloclen); 20027c478bd9Sstevel@tonic-gate if (dst == NULL) 20037c478bd9Sstevel@tonic-gate Bail("malloc(dst)"); 20047c478bd9Sstevel@tonic-gate totallen += alloclen; 20057c478bd9Sstevel@tonic-gate dst->sadb_address_len = SADB_8TO64(alloclen); 20067c478bd9Sstevel@tonic-gate dst->sadb_address_exttype = SADB_EXT_ADDRESS_DST; 20077c478bd9Sstevel@tonic-gate dst->sadb_address_reserved = 0; 20087c478bd9Sstevel@tonic-gate dst->sadb_address_prefixlen = 0; 20097c478bd9Sstevel@tonic-gate dst->sadb_address_proto = 0; 20107c478bd9Sstevel@tonic-gate if (dsthp == &dummy.he) { 20117c478bd9Sstevel@tonic-gate /* 20127c478bd9Sstevel@tonic-gate * Single address with -n flag. 20137c478bd9Sstevel@tonic-gate */ 20147c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(dst + 1); 20157c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6)); 20167c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6; 20177c478bd9Sstevel@tonic-gate bcopy(dsthp->h_addr_list[0], &sin6->sin6_addr, 20187c478bd9Sstevel@tonic-gate sizeof (struct in6_addr)); 20197c478bd9Sstevel@tonic-gate } 20207c478bd9Sstevel@tonic-gate break; 20217c478bd9Sstevel@tonic-gate case TOK_PROXYADDR: 20227c478bd9Sstevel@tonic-gate case TOK_PROXYADDR6: 20238810c16bSdanmcd if (isrc != NULL) { 2024e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2025e3320f40Smarkfen "Can only specify single " 2026e3320f40Smarkfen "proxy/inner-source address.\n")); 2027e3320f40Smarkfen break; 20287c478bd9Sstevel@tonic-gate } 20298810c16bSdanmcd if ((pstr = strchr(*argv, '/')) != NULL) { 20308810c16bSdanmcd /* Parse out the prefix. */ 20318810c16bSdanmcd errno = 0; 20328810c16bSdanmcd prefix = strtol(pstr + 1, NULL, 10); 20338810c16bSdanmcd if (errno != 0) { 2034e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 2035e3320f40Smarkfen "Invalid prefix %s."), pstr); 2036e3320f40Smarkfen break; 20378810c16bSdanmcd } 20388810c16bSdanmcd /* Recycle pstr */ 20398810c16bSdanmcd alloclen = (int)(pstr - *argv); 20408810c16bSdanmcd pstr = malloc(alloclen + 1); 20418810c16bSdanmcd if (pstr == NULL) { 20428810c16bSdanmcd Bail("malloc(pstr)"); 20438810c16bSdanmcd } 20448810c16bSdanmcd (void) strlcpy(pstr, *argv, alloclen + 1); 20458810c16bSdanmcd } else { 20468810c16bSdanmcd pstr = *argv; 20478810c16bSdanmcd /* 20488810c16bSdanmcd * Assume mapping to AF_INET6, and we're a host. 20498810c16bSdanmcd * XXX some miscreants may still make classful 20508810c16bSdanmcd * assumptions. If this is a problem, fix it 20518810c16bSdanmcd * here. 20528810c16bSdanmcd */ 20538810c16bSdanmcd prefix = 128; 20548810c16bSdanmcd } 20558810c16bSdanmcd sa_len = parseaddr(pstr, &isrchp, 2056e3320f40Smarkfen (token == TOK_PROXYADDR6), ebuf); 2057e3320f40Smarkfen if (isrchp == NULL) { 2058e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 2059e3320f40Smarkfen "Unknown proxy/inner-source address " 2060e3320f40Smarkfen "\"%s\"\n"), *argv); 2061e3320f40Smarkfen break; 2062e3320f40Smarkfen } 20638810c16bSdanmcd if (pstr != *argv) 20648810c16bSdanmcd free(pstr); 20657c478bd9Sstevel@tonic-gate argv++; 20668810c16bSdanmcd alloclen = sizeof (*isrc) + roundup(sa_len, 8); 20678810c16bSdanmcd isrc = malloc(alloclen); 20688810c16bSdanmcd if (isrc == NULL) 20698810c16bSdanmcd Bail("malloc(isrc)"); 20707c478bd9Sstevel@tonic-gate totallen += alloclen; 20718810c16bSdanmcd isrc->sadb_address_len = SADB_8TO64(alloclen); 20728810c16bSdanmcd isrc->sadb_address_exttype = SADB_EXT_ADDRESS_PROXY; 20738810c16bSdanmcd isrc->sadb_address_reserved = 0; 20748810c16bSdanmcd isrc->sadb_address_prefixlen = prefix; 20758810c16bSdanmcd isrc->sadb_address_proto = 0; 20768810c16bSdanmcd if (isrchp == &dummy.he || 20778810c16bSdanmcd isrchp->h_addr_list[1] == NULL) { 20787c478bd9Sstevel@tonic-gate /* 20797c478bd9Sstevel@tonic-gate * Single address with -n flag or single name. 20807c478bd9Sstevel@tonic-gate */ 20818810c16bSdanmcd sin6 = (struct sockaddr_in6 *)(isrc + 1); 20827c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6)); 20837c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6; 20848810c16bSdanmcd bcopy(isrchp->h_addr_list[0], &sin6->sin6_addr, 20857c478bd9Sstevel@tonic-gate sizeof (struct in6_addr)); 20868810c16bSdanmcd /* 20878810c16bSdanmcd * normalize prefixlen for IPv4-mapped 20888810c16bSdanmcd * addresses. 20898810c16bSdanmcd */ 20908810c16bSdanmcd if (prefix <= 32 && 20918810c16bSdanmcd IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) 20928810c16bSdanmcd isrc->sadb_address_prefixlen += 96; 20938810c16bSdanmcd alloc_inner = B_TRUE; 20947c478bd9Sstevel@tonic-gate } else { 20957c478bd9Sstevel@tonic-gate /* 20968810c16bSdanmcd * If the proxy/isrc address is vague, don't 20978810c16bSdanmcd * bother. 20987c478bd9Sstevel@tonic-gate */ 20997c478bd9Sstevel@tonic-gate totallen -= alloclen; 21008810c16bSdanmcd free(isrc); 21018810c16bSdanmcd isrc = NULL; 2102e3320f40Smarkfen WARN1(ep, ebuf, gettext( 2103e3320f40Smarkfen "Proxy/inner-source address %s " 2104e3320f40Smarkfen "is vague, not using.\n"), isrchp->h_name); 21058810c16bSdanmcd freehostent(isrchp); 21068810c16bSdanmcd isrchp = NULL; 2107e3320f40Smarkfen break; 21088810c16bSdanmcd } 21098810c16bSdanmcd break; 21108810c16bSdanmcd case TOK_IDSTADDR: 21118810c16bSdanmcd case TOK_IDSTADDR6: 21128810c16bSdanmcd if (idst != NULL) { 2113e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2114e3320f40Smarkfen "Can only specify single " 2115e3320f40Smarkfen "inner-destination address.\n")); 2116e3320f40Smarkfen break; 21178810c16bSdanmcd } 21188810c16bSdanmcd if ((pstr = strchr(*argv, '/')) != NULL) { 21198810c16bSdanmcd /* Parse out the prefix. */ 21208810c16bSdanmcd errno = 0; 21218810c16bSdanmcd prefix = strtol(pstr + 1, NULL, 10); 21228810c16bSdanmcd if (errno != 0) { 2123e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 2124e3320f40Smarkfen "Invalid prefix %s.\n"), pstr); 2125e3320f40Smarkfen break; 21268810c16bSdanmcd } 21278810c16bSdanmcd /* Recycle pstr */ 21288810c16bSdanmcd alloclen = (int)(pstr - *argv); 21298810c16bSdanmcd pstr = malloc(alloclen + 1); 21308810c16bSdanmcd if (pstr == NULL) { 21318810c16bSdanmcd Bail("malloc(pstr)"); 21328810c16bSdanmcd } 21338810c16bSdanmcd (void) strlcpy(pstr, *argv, alloclen + 1); 21348810c16bSdanmcd } else { 21358810c16bSdanmcd pstr = *argv; 21368810c16bSdanmcd /* 21378810c16bSdanmcd * Assume mapping to AF_INET6, and we're a host. 21388810c16bSdanmcd * XXX some miscreants may still make classful 21398810c16bSdanmcd * assumptions. If this is a problem, fix it 21408810c16bSdanmcd * here. 21418810c16bSdanmcd */ 21428810c16bSdanmcd prefix = 128; 21438810c16bSdanmcd } 21448810c16bSdanmcd sa_len = parseaddr(pstr, &idsthp, 2145e3320f40Smarkfen (token == TOK_IDSTADDR6), ebuf); 2146e3320f40Smarkfen if (idsthp == NULL) { 2147e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 2148e3320f40Smarkfen "Unknown Inner Src address " 2149e3320f40Smarkfen " \"%s\"\n"), *argv); 2150e3320f40Smarkfen break; 2151e3320f40Smarkfen } 21528810c16bSdanmcd if (pstr != *argv) 21538810c16bSdanmcd free(pstr); 21548810c16bSdanmcd argv++; 21558810c16bSdanmcd alloclen = sizeof (*idst) + roundup(sa_len, 8); 21568810c16bSdanmcd idst = malloc(alloclen); 21578810c16bSdanmcd if (idst == NULL) 21588810c16bSdanmcd Bail("malloc(idst)"); 21598810c16bSdanmcd totallen += alloclen; 21608810c16bSdanmcd idst->sadb_address_len = SADB_8TO64(alloclen); 21618810c16bSdanmcd idst->sadb_address_exttype = 21628810c16bSdanmcd SADB_X_EXT_ADDRESS_INNER_DST; 21638810c16bSdanmcd idst->sadb_address_reserved = 0; 21648810c16bSdanmcd idst->sadb_address_prefixlen = prefix; 21658810c16bSdanmcd idst->sadb_address_proto = 0; 21668810c16bSdanmcd if (idsthp == &dummy.he || 21678810c16bSdanmcd idsthp->h_addr_list[1] == NULL) { 21688810c16bSdanmcd /* 21698810c16bSdanmcd * Single address with -n flag or single name. 21708810c16bSdanmcd */ 21718810c16bSdanmcd sin6 = (struct sockaddr_in6 *)(idst + 1); 21728810c16bSdanmcd bzero(sin6, sizeof (*sin6)); 21738810c16bSdanmcd sin6->sin6_family = AF_INET6; 21748810c16bSdanmcd bcopy(idsthp->h_addr_list[0], &sin6->sin6_addr, 21758810c16bSdanmcd sizeof (struct in6_addr)); 21768810c16bSdanmcd /* 21778810c16bSdanmcd * normalize prefixlen for IPv4-mapped 21788810c16bSdanmcd * addresses. 21798810c16bSdanmcd */ 21808810c16bSdanmcd if (prefix <= 32 && 21818810c16bSdanmcd IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) 21828810c16bSdanmcd idst->sadb_address_prefixlen += 96; 21838810c16bSdanmcd alloc_inner = B_TRUE; 21848810c16bSdanmcd } else { 21858810c16bSdanmcd /* 21868810c16bSdanmcd * If the idst address is vague, don't bother. 21878810c16bSdanmcd */ 21888810c16bSdanmcd totallen -= alloclen; 21898810c16bSdanmcd free(idst); 21908810c16bSdanmcd idst = NULL; 2191e3320f40Smarkfen WARN1(ep, ebuf, gettext( 2192e3320f40Smarkfen "Inner destination address %s " 2193e3320f40Smarkfen "is vague, not using.\n"), idsthp->h_name); 21948810c16bSdanmcd freehostent(idsthp); 21958810c16bSdanmcd idsthp = NULL; 2196e3320f40Smarkfen break; 21977c478bd9Sstevel@tonic-gate } 21987c478bd9Sstevel@tonic-gate break; 21997c478bd9Sstevel@tonic-gate case TOK_NATLOC: 22007c478bd9Sstevel@tonic-gate if (natt_local != NULL) { 2201e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2202e3320f40Smarkfen "Can only specify " 2203e3320f40Smarkfen "single NAT-T local address.\n")); 2204e3320f40Smarkfen break; 2205e3320f40Smarkfen } 2206e3320f40Smarkfen sa_len = parseaddr(*argv, &natt_lhp, 0, ebuf); 2207e3320f40Smarkfen if (natt_lhp == NULL) { 2208e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 2209e3320f40Smarkfen "Unknown NAT-T local address \"%s\"\n"), 2210e3320f40Smarkfen *argv); 2211e3320f40Smarkfen break; 22127c478bd9Sstevel@tonic-gate } 22137c478bd9Sstevel@tonic-gate argv++; 22147c478bd9Sstevel@tonic-gate /* 22157c478bd9Sstevel@tonic-gate * Round of the sockaddr length to an 8 byte 22167c478bd9Sstevel@tonic-gate * boundary to make PF_KEY happy. 22177c478bd9Sstevel@tonic-gate */ 22187c478bd9Sstevel@tonic-gate alloclen = sizeof (*natt_local) + roundup(sa_len, 8); 22197c478bd9Sstevel@tonic-gate natt_local = malloc(alloclen); 22207c478bd9Sstevel@tonic-gate if (natt_local == NULL) 22217c478bd9Sstevel@tonic-gate Bail("malloc(natt_local)"); 22227c478bd9Sstevel@tonic-gate totallen += alloclen; 22237c478bd9Sstevel@tonic-gate natt_local->sadb_address_len = SADB_8TO64(alloclen); 22247c478bd9Sstevel@tonic-gate natt_local->sadb_address_exttype = 22257c478bd9Sstevel@tonic-gate SADB_X_EXT_ADDRESS_NATT_LOC; 22267c478bd9Sstevel@tonic-gate natt_local->sadb_address_reserved = 0; 22277c478bd9Sstevel@tonic-gate natt_local->sadb_address_prefixlen = 0; 22287c478bd9Sstevel@tonic-gate natt_local->sadb_address_proto = 0; 22298810c16bSdanmcd if (natt_lhp == &dummy.he || 22308810c16bSdanmcd natt_lhp->h_addr_list[1] == NULL) { 22317c478bd9Sstevel@tonic-gate /* 22328810c16bSdanmcd * Single address with -n flag or single name. 22337c478bd9Sstevel@tonic-gate */ 22347c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(natt_local + 1); 22357c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6)); 22367c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6; 22377c478bd9Sstevel@tonic-gate bcopy(natt_lhp->h_addr_list[0], 22387c478bd9Sstevel@tonic-gate &sin6->sin6_addr, sizeof (struct in6_addr)); 22398810c16bSdanmcd } else { 22408810c16bSdanmcd /* 22418810c16bSdanmcd * If the nat-local address is vague, don't 22428810c16bSdanmcd * bother. 22438810c16bSdanmcd */ 22448810c16bSdanmcd totallen -= alloclen; 22458810c16bSdanmcd free(natt_local); 22468810c16bSdanmcd natt_local = NULL; 2247e3320f40Smarkfen WARN1(ep, ebuf, gettext( 2248e3320f40Smarkfen "NAT-T local address %s " 2249e3320f40Smarkfen "is vague, not using.\n"), 2250e3320f40Smarkfen natt_lhp->h_name); 22518810c16bSdanmcd freehostent(natt_lhp); 22528810c16bSdanmcd natt_lhp = NULL; 2253e3320f40Smarkfen break; 22547c478bd9Sstevel@tonic-gate } 22557c478bd9Sstevel@tonic-gate break; 22567c478bd9Sstevel@tonic-gate case TOK_NATREM: 22577c478bd9Sstevel@tonic-gate if (natt_remote != NULL) { 2258e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2259e3320f40Smarkfen "Can only specify " 2260e3320f40Smarkfen "single NAT-T remote address.\n")); 2261e3320f40Smarkfen break; 2262e3320f40Smarkfen } 2263e3320f40Smarkfen sa_len = parseaddr(*argv, &natt_rhp, 0, ebuf); 2264e3320f40Smarkfen if (natt_rhp == NULL) { 2265e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 2266e3320f40Smarkfen "Unknown NAT-T remote address \"%s\"\n"), 2267e3320f40Smarkfen *argv); 2268e3320f40Smarkfen break; 22697c478bd9Sstevel@tonic-gate } 22707c478bd9Sstevel@tonic-gate argv++; 22717c478bd9Sstevel@tonic-gate /* 22727c478bd9Sstevel@tonic-gate * Round of the sockaddr length to an 8 byte 22737c478bd9Sstevel@tonic-gate * boundary to make PF_KEY happy. 22747c478bd9Sstevel@tonic-gate */ 22757c478bd9Sstevel@tonic-gate alloclen = sizeof (*natt_remote) + roundup(sa_len, 8); 22767c478bd9Sstevel@tonic-gate natt_remote = malloc(alloclen); 22777c478bd9Sstevel@tonic-gate if (natt_remote == NULL) 22787c478bd9Sstevel@tonic-gate Bail("malloc(natt_remote)"); 22797c478bd9Sstevel@tonic-gate totallen += alloclen; 22807c478bd9Sstevel@tonic-gate natt_remote->sadb_address_len = SADB_8TO64(alloclen); 22817c478bd9Sstevel@tonic-gate natt_remote->sadb_address_exttype = 22827c478bd9Sstevel@tonic-gate SADB_X_EXT_ADDRESS_NATT_REM; 22837c478bd9Sstevel@tonic-gate natt_remote->sadb_address_reserved = 0; 22847c478bd9Sstevel@tonic-gate natt_remote->sadb_address_prefixlen = 0; 22857c478bd9Sstevel@tonic-gate natt_remote->sadb_address_proto = 0; 22868810c16bSdanmcd if (natt_rhp == &dummy.he || 22878810c16bSdanmcd natt_rhp->h_addr_list[1] == NULL) { 22887c478bd9Sstevel@tonic-gate /* 22898810c16bSdanmcd * Single address with -n flag or single name. 22907c478bd9Sstevel@tonic-gate */ 22917c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(natt_remote + 1); 22927c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6)); 22937c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6; 22947c478bd9Sstevel@tonic-gate bcopy(natt_rhp->h_addr_list[0], 22957c478bd9Sstevel@tonic-gate &sin6->sin6_addr, sizeof (struct in6_addr)); 22968810c16bSdanmcd } else { 22978810c16bSdanmcd /* 2298e3320f40Smarkfen * If the nat-renote address is vague, don't 22998810c16bSdanmcd * bother. 23008810c16bSdanmcd */ 23018810c16bSdanmcd totallen -= alloclen; 23028810c16bSdanmcd free(natt_remote); 23038810c16bSdanmcd natt_remote = NULL; 2304e3320f40Smarkfen WARN1(ep, ebuf, gettext( 2305e3320f40Smarkfen "NAT-T remote address %s " 2306e3320f40Smarkfen "is vague, not using.\n"), 2307e3320f40Smarkfen natt_rhp->h_name); 23088810c16bSdanmcd freehostent(natt_rhp); 23098810c16bSdanmcd natt_rhp = NULL; 2310e3320f40Smarkfen break; 23117c478bd9Sstevel@tonic-gate } 23127c478bd9Sstevel@tonic-gate break; 23137c478bd9Sstevel@tonic-gate case TOK_ENCRKEY: 23147c478bd9Sstevel@tonic-gate if (encrypt != NULL) { 2315e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2316e3320f40Smarkfen "Can only specify " 2317e3320f40Smarkfen "single encryption key.\n")); 2318e3320f40Smarkfen break; 23197c478bd9Sstevel@tonic-gate } 2320a050d7e9Spwernau if (assoc != NULL && 2321a050d7e9Spwernau assoc->sadb_sa_encrypt == SADB_EALG_NULL) { 2322ec485834Spwernau FATAL(ep, ebuf, gettext( 2323ec485834Spwernau "Cannot specify a key with NULL " 2324ec485834Spwernau "encryption algorithm.\n")); 2325ec485834Spwernau break; 2326ec485834Spwernau } 2327628b0c67SMark Fenwick encrypt = parsekey(*argv, ebuf, reserved_bits); 23287c478bd9Sstevel@tonic-gate argv++; 2329e3320f40Smarkfen if (encrypt == NULL) { 2330e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2331e3320f40Smarkfen "Invalid encryption key.\n")); 2332e3320f40Smarkfen break; 2333e3320f40Smarkfen } 2334e3320f40Smarkfen totallen += SADB_64TO8(encrypt->sadb_key_len); 23357c478bd9Sstevel@tonic-gate encrypt->sadb_key_exttype = SADB_EXT_KEY_ENCRYPT; 23367c478bd9Sstevel@tonic-gate break; 23377c478bd9Sstevel@tonic-gate case TOK_AUTHKEY: 23387c478bd9Sstevel@tonic-gate if (auth != NULL) { 2339e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2340e3320f40Smarkfen "Can only specify single" 2341e3320f40Smarkfen " authentication key.\n")); 2342e3320f40Smarkfen break; 23437c478bd9Sstevel@tonic-gate } 2344628b0c67SMark Fenwick auth = parsekey(*argv, ebuf, 0); 23457c478bd9Sstevel@tonic-gate argv++; 2346e3320f40Smarkfen if (auth == NULL) { 2347e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2348e3320f40Smarkfen "Invalid authentication key.\n")); 2349e3320f40Smarkfen break; 2350e3320f40Smarkfen } 23517c478bd9Sstevel@tonic-gate totallen += SADB_64TO8(auth->sadb_key_len); 23527c478bd9Sstevel@tonic-gate auth->sadb_key_exttype = SADB_EXT_KEY_AUTH; 23537c478bd9Sstevel@tonic-gate break; 23547c478bd9Sstevel@tonic-gate case TOK_SRCIDTYPE: 23557c478bd9Sstevel@tonic-gate if (*argv == NULL || *(argv + 1) == NULL) { 2356e3320f40Smarkfen FATAL(ep, ebuf, gettext( 2357e3320f40Smarkfen "Unexpected end of command " 2358e3320f40Smarkfen "line - Expecting Src Type.\n")); 2359e3320f40Smarkfen /* NOTREACHED */ 2360e3320f40Smarkfen break; 23617c478bd9Sstevel@tonic-gate } 23627c478bd9Sstevel@tonic-gate if (srcid != NULL) { 2363e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2364e3320f40Smarkfen "Can only specify single" 2365e3320f40Smarkfen " source certificate identity.\n")); 2366e3320f40Smarkfen break; 23677c478bd9Sstevel@tonic-gate } 23687c478bd9Sstevel@tonic-gate alloclen = sizeof (*srcid) + 23697c478bd9Sstevel@tonic-gate roundup(strlen(*(argv + 1)) + 1, 8); 23707c478bd9Sstevel@tonic-gate srcid = malloc(alloclen); 23717c478bd9Sstevel@tonic-gate if (srcid == NULL) 23727c478bd9Sstevel@tonic-gate Bail("malloc(srcid)"); 23737c478bd9Sstevel@tonic-gate totallen += alloclen; 2374e3320f40Smarkfen srcid->sadb_ident_type = parseidtype(*argv, ebuf); 23757c478bd9Sstevel@tonic-gate argv++; 23767c478bd9Sstevel@tonic-gate srcid->sadb_ident_len = SADB_8TO64(alloclen); 23777c478bd9Sstevel@tonic-gate srcid->sadb_ident_exttype = SADB_EXT_IDENTITY_SRC; 23787c478bd9Sstevel@tonic-gate srcid->sadb_ident_reserved = 0; 23797c478bd9Sstevel@tonic-gate srcid->sadb_ident_id = 0; /* Not useful here. */ 2380e3320f40Smarkfen (void) strlcpy((char *)(srcid + 1), *argv, alloclen); 23817c478bd9Sstevel@tonic-gate argv++; 23827c478bd9Sstevel@tonic-gate break; 23837c478bd9Sstevel@tonic-gate case TOK_DSTIDTYPE: 23847c478bd9Sstevel@tonic-gate if (*argv == NULL || *(argv + 1) == NULL) { 2385e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2386e3320f40Smarkfen "Unexpected end of command" 2387e3320f40Smarkfen " line - expecting dst type.\n")); 2388e3320f40Smarkfen break; 23897c478bd9Sstevel@tonic-gate } 23907c478bd9Sstevel@tonic-gate if (dstid != NULL) { 2391e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2392e3320f40Smarkfen "Can only specify single destination " 239325e435e0Spwernau "certificate identity.\n")); 2394e3320f40Smarkfen break; 23957c478bd9Sstevel@tonic-gate } 23967c478bd9Sstevel@tonic-gate alloclen = sizeof (*dstid) + 23977c478bd9Sstevel@tonic-gate roundup(strlen(*(argv + 1)) + 1, 8); 23987c478bd9Sstevel@tonic-gate dstid = malloc(alloclen); 23997c478bd9Sstevel@tonic-gate if (dstid == NULL) 24007c478bd9Sstevel@tonic-gate Bail("malloc(dstid)"); 24017c478bd9Sstevel@tonic-gate totallen += alloclen; 2402e3320f40Smarkfen dstid->sadb_ident_type = parseidtype(*argv, ebuf); 24037c478bd9Sstevel@tonic-gate argv++; 24047c478bd9Sstevel@tonic-gate dstid->sadb_ident_len = SADB_8TO64(alloclen); 24057c478bd9Sstevel@tonic-gate dstid->sadb_ident_exttype = SADB_EXT_IDENTITY_DST; 24067c478bd9Sstevel@tonic-gate dstid->sadb_ident_reserved = 0; 24077c478bd9Sstevel@tonic-gate dstid->sadb_ident_id = 0; /* Not useful here. */ 2408e3320f40Smarkfen (void) strlcpy((char *)(dstid + 1), *argv, alloclen); 24097c478bd9Sstevel@tonic-gate argv++; 24107c478bd9Sstevel@tonic-gate break; 24117c478bd9Sstevel@tonic-gate case TOK_HARD_ALLOC: 24127c478bd9Sstevel@tonic-gate case TOK_HARD_BYTES: 24137c478bd9Sstevel@tonic-gate case TOK_HARD_ADDTIME: 24147c478bd9Sstevel@tonic-gate case TOK_HARD_USETIME: 24157c478bd9Sstevel@tonic-gate if (hard == NULL) { 24167c478bd9Sstevel@tonic-gate hard = malloc(sizeof (*hard)); 24177c478bd9Sstevel@tonic-gate if (hard == NULL) 24187c478bd9Sstevel@tonic-gate Bail("malloc(hard_lifetime)"); 24197c478bd9Sstevel@tonic-gate bzero(hard, sizeof (*hard)); 24207c478bd9Sstevel@tonic-gate hard->sadb_lifetime_exttype = 24217c478bd9Sstevel@tonic-gate SADB_EXT_LIFETIME_HARD; 24227c478bd9Sstevel@tonic-gate hard->sadb_lifetime_len = 24237c478bd9Sstevel@tonic-gate SADB_8TO64(sizeof (*hard)); 24247c478bd9Sstevel@tonic-gate totallen += sizeof (*hard); 24257c478bd9Sstevel@tonic-gate } 24267c478bd9Sstevel@tonic-gate switch (token) { 24277c478bd9Sstevel@tonic-gate case TOK_HARD_ALLOC: 24287c478bd9Sstevel@tonic-gate if (hard->sadb_lifetime_allocations != 0) { 2429e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2430e3320f40Smarkfen "Can only specify single" 2431e3320f40Smarkfen " hard allocation limit.\n")); 2432e3320f40Smarkfen break; 24337c478bd9Sstevel@tonic-gate } 24347c478bd9Sstevel@tonic-gate hard->sadb_lifetime_allocations = 2435e3320f40Smarkfen (uint32_t)parsenum(*argv, B_TRUE, ebuf); 24367c478bd9Sstevel@tonic-gate break; 24377c478bd9Sstevel@tonic-gate case TOK_HARD_BYTES: 24387c478bd9Sstevel@tonic-gate if (hard->sadb_lifetime_bytes != 0) { 2439e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2440e3320f40Smarkfen "Can only specify " 2441e3320f40Smarkfen "single hard byte limit.\n")); 2442e3320f40Smarkfen break; 24437c478bd9Sstevel@tonic-gate } 24447c478bd9Sstevel@tonic-gate hard->sadb_lifetime_bytes = parsenum(*argv, 2445e3320f40Smarkfen B_TRUE, ebuf); 24467c478bd9Sstevel@tonic-gate break; 24477c478bd9Sstevel@tonic-gate case TOK_HARD_ADDTIME: 24487c478bd9Sstevel@tonic-gate if (hard->sadb_lifetime_addtime != 0) { 2449e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2450e3320f40Smarkfen "Can only specify " 2451e3320f40Smarkfen "single past-add lifetime.\n")); 2452e3320f40Smarkfen break; 24537c478bd9Sstevel@tonic-gate } 24547c478bd9Sstevel@tonic-gate hard->sadb_lifetime_addtime = parsenum(*argv, 2455e3320f40Smarkfen B_TRUE, ebuf); 24567c478bd9Sstevel@tonic-gate break; 24577c478bd9Sstevel@tonic-gate case TOK_HARD_USETIME: 24587c478bd9Sstevel@tonic-gate if (hard->sadb_lifetime_usetime != 0) { 2459e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2460e3320f40Smarkfen "Can only specify " 2461e3320f40Smarkfen "single past-use lifetime.\n")); 2462e3320f40Smarkfen break; 24637c478bd9Sstevel@tonic-gate } 24647c478bd9Sstevel@tonic-gate hard->sadb_lifetime_usetime = parsenum(*argv, 2465e3320f40Smarkfen B_TRUE, ebuf); 24667c478bd9Sstevel@tonic-gate break; 24677c478bd9Sstevel@tonic-gate } 24687c478bd9Sstevel@tonic-gate argv++; 24697c478bd9Sstevel@tonic-gate break; 24707c478bd9Sstevel@tonic-gate case TOK_SOFT_ALLOC: 24717c478bd9Sstevel@tonic-gate case TOK_SOFT_BYTES: 24727c478bd9Sstevel@tonic-gate case TOK_SOFT_ADDTIME: 24737c478bd9Sstevel@tonic-gate case TOK_SOFT_USETIME: 24747c478bd9Sstevel@tonic-gate if (soft == NULL) { 24757c478bd9Sstevel@tonic-gate soft = malloc(sizeof (*soft)); 24767c478bd9Sstevel@tonic-gate if (soft == NULL) 24777c478bd9Sstevel@tonic-gate Bail("malloc(soft_lifetime)"); 24787c478bd9Sstevel@tonic-gate bzero(soft, sizeof (*soft)); 24797c478bd9Sstevel@tonic-gate soft->sadb_lifetime_exttype = 24807c478bd9Sstevel@tonic-gate SADB_EXT_LIFETIME_SOFT; 24817c478bd9Sstevel@tonic-gate soft->sadb_lifetime_len = 24827c478bd9Sstevel@tonic-gate SADB_8TO64(sizeof (*soft)); 24837c478bd9Sstevel@tonic-gate totallen += sizeof (*soft); 24847c478bd9Sstevel@tonic-gate } 24857c478bd9Sstevel@tonic-gate switch (token) { 24867c478bd9Sstevel@tonic-gate case TOK_SOFT_ALLOC: 24877c478bd9Sstevel@tonic-gate if (soft->sadb_lifetime_allocations != 0) { 2488e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2489e3320f40Smarkfen "Can only specify single" 2490e3320f40Smarkfen " soft allocation limit.\n")); 2491e3320f40Smarkfen break; 24927c478bd9Sstevel@tonic-gate } 24937c478bd9Sstevel@tonic-gate soft->sadb_lifetime_allocations = 2494e3320f40Smarkfen (uint32_t)parsenum(*argv, B_TRUE, ebuf); 24957c478bd9Sstevel@tonic-gate break; 24967c478bd9Sstevel@tonic-gate case TOK_SOFT_BYTES: 24977c478bd9Sstevel@tonic-gate if (soft->sadb_lifetime_bytes != 0) { 2498e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2499e3320f40Smarkfen "Can only specify single" 2500e3320f40Smarkfen " soft byte limit.\n")); 2501e3320f40Smarkfen break; 25027c478bd9Sstevel@tonic-gate } 25037c478bd9Sstevel@tonic-gate soft->sadb_lifetime_bytes = parsenum(*argv, 2504e3320f40Smarkfen B_TRUE, ebuf); 25057c478bd9Sstevel@tonic-gate break; 25067c478bd9Sstevel@tonic-gate case TOK_SOFT_ADDTIME: 25077c478bd9Sstevel@tonic-gate if (soft->sadb_lifetime_addtime != 0) { 2508e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2509e3320f40Smarkfen "Can only specify single" 2510e3320f40Smarkfen " past-add lifetime.\n")); 2511e3320f40Smarkfen break; 25127c478bd9Sstevel@tonic-gate } 25137c478bd9Sstevel@tonic-gate soft->sadb_lifetime_addtime = parsenum(*argv, 2514e3320f40Smarkfen B_TRUE, ebuf); 25157c478bd9Sstevel@tonic-gate break; 25167c478bd9Sstevel@tonic-gate case TOK_SOFT_USETIME: 25177c478bd9Sstevel@tonic-gate if (soft->sadb_lifetime_usetime != 0) { 2518e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2519e3320f40Smarkfen "Can only specify single" 2520e3320f40Smarkfen " past-use lifetime.\n")); 2521e3320f40Smarkfen break; 25227c478bd9Sstevel@tonic-gate } 25237c478bd9Sstevel@tonic-gate soft->sadb_lifetime_usetime = parsenum(*argv, 2524e3320f40Smarkfen B_TRUE, ebuf); 25257c478bd9Sstevel@tonic-gate break; 25267c478bd9Sstevel@tonic-gate } 25277c478bd9Sstevel@tonic-gate argv++; 25287c478bd9Sstevel@tonic-gate break; 252938d95a78Smarkfen case TOK_FLAG_INBOUND: 253038d95a78Smarkfen assoc->sadb_sa_flags |= SADB_X_SAFLAGS_INBOUND; 253138d95a78Smarkfen break; 253238d95a78Smarkfen case TOK_FLAG_OUTBOUND: 253338d95a78Smarkfen assoc->sadb_sa_flags |= SADB_X_SAFLAGS_OUTBOUND; 253438d95a78Smarkfen break; 25359c2c14abSThejaswini Singarajipura case TOK_REPLAY_VALUE: 25369c2c14abSThejaswini Singarajipura if (replay_ctr != NULL) { 25379c2c14abSThejaswini Singarajipura ERROR(ep, ebuf, gettext( 25389c2c14abSThejaswini Singarajipura "Can only specify single " 25399c2c14abSThejaswini Singarajipura "replay value.")); 25409c2c14abSThejaswini Singarajipura break; 25419c2c14abSThejaswini Singarajipura } 25429c2c14abSThejaswini Singarajipura replay_ctr = calloc(1, sizeof (*replay_ctr)); 25439c2c14abSThejaswini Singarajipura if (replay_ctr == NULL) { 25449c2c14abSThejaswini Singarajipura Bail("malloc(replay value)"); 25459c2c14abSThejaswini Singarajipura } 25469c2c14abSThejaswini Singarajipura /* 25479c2c14abSThejaswini Singarajipura * We currently do not support a 64-bit 25489c2c14abSThejaswini Singarajipura * replay value. RFC 4301 will require one, 25499c2c14abSThejaswini Singarajipura * however, and we have a field in place when 25509c2c14abSThejaswini Singarajipura * 4301 is built. 25519c2c14abSThejaswini Singarajipura */ 25529c2c14abSThejaswini Singarajipura replay_ctr->sadb_x_rc_exttype = SADB_X_EXT_REPLAY_VALUE; 25539c2c14abSThejaswini Singarajipura replay_ctr->sadb_x_rc_len = 25549c2c14abSThejaswini Singarajipura SADB_8TO64(sizeof (*replay_ctr)); 25559c2c14abSThejaswini Singarajipura totallen += sizeof (*replay_ctr); 25569c2c14abSThejaswini Singarajipura replay_ctr->sadb_x_rc_replay32 = (uint32_t)parsenum( 25579c2c14abSThejaswini Singarajipura *argv, B_TRUE, ebuf); 25589c2c14abSThejaswini Singarajipura argv++; 25599c2c14abSThejaswini Singarajipura break; 25609c2c14abSThejaswini Singarajipura case TOK_IDLE_ADDTIME: 25619c2c14abSThejaswini Singarajipura case TOK_IDLE_USETIME: 25629c2c14abSThejaswini Singarajipura if (idle == NULL) { 25639c2c14abSThejaswini Singarajipura idle = calloc(1, sizeof (*idle)); 25649c2c14abSThejaswini Singarajipura if (idle == NULL) { 25659c2c14abSThejaswini Singarajipura Bail("malloc idle lifetime"); 25669c2c14abSThejaswini Singarajipura } 25679c2c14abSThejaswini Singarajipura idle->sadb_lifetime_exttype = 25689c2c14abSThejaswini Singarajipura SADB_X_EXT_LIFETIME_IDLE; 25699c2c14abSThejaswini Singarajipura idle->sadb_lifetime_len = 25709c2c14abSThejaswini Singarajipura SADB_8TO64(sizeof (*idle)); 25719c2c14abSThejaswini Singarajipura totallen += sizeof (*idle); 25729c2c14abSThejaswini Singarajipura } 25739c2c14abSThejaswini Singarajipura switch (token) { 25749c2c14abSThejaswini Singarajipura case TOK_IDLE_ADDTIME: 25759c2c14abSThejaswini Singarajipura idle->sadb_lifetime_addtime = 25769c2c14abSThejaswini Singarajipura (uint32_t)parsenum(*argv, 25779c2c14abSThejaswini Singarajipura B_TRUE, ebuf); 25789c2c14abSThejaswini Singarajipura break; 25799c2c14abSThejaswini Singarajipura case TOK_IDLE_USETIME: 25809c2c14abSThejaswini Singarajipura idle->sadb_lifetime_usetime = 25819c2c14abSThejaswini Singarajipura (uint32_t)parsenum(*argv, 25829c2c14abSThejaswini Singarajipura B_TRUE, ebuf); 25839c2c14abSThejaswini Singarajipura break; 25849c2c14abSThejaswini Singarajipura } 25859c2c14abSThejaswini Singarajipura argv++; 25869c2c14abSThejaswini Singarajipura break; 2587628b0c67SMark Fenwick case TOK_RESERVED: 2588628b0c67SMark Fenwick if (encrypt != NULL) 2589628b0c67SMark Fenwick ERROR(ep, ebuf, gettext( 2590628b0c67SMark Fenwick "Reserved bits need to be " 2591628b0c67SMark Fenwick "specified before key.\n")); 2592628b0c67SMark Fenwick reserved_bits = (uint_t)parsenum(*argv, 2593628b0c67SMark Fenwick B_TRUE, ebuf); 2594628b0c67SMark Fenwick argv++; 2595628b0c67SMark Fenwick break; 2596*5d3b8cb7SBill Sommerfeld case TOK_LABEL: 2597*5d3b8cb7SBill Sommerfeld label = parselabel(token, *argv); 2598*5d3b8cb7SBill Sommerfeld argv++; 2599*5d3b8cb7SBill Sommerfeld if (label == NULL) { 2600*5d3b8cb7SBill Sommerfeld ERROR(ep, ebuf, 2601*5d3b8cb7SBill Sommerfeld gettext("Malformed security label\n")); 2602*5d3b8cb7SBill Sommerfeld break; 2603*5d3b8cb7SBill Sommerfeld } else if (label == PARSELABEL_BAD_TOKEN) { 2604*5d3b8cb7SBill Sommerfeld Bail("Internal token value error"); 2605*5d3b8cb7SBill Sommerfeld } 2606*5d3b8cb7SBill Sommerfeld totallen += SADB_64TO8(label->sadb_sens_len); 2607*5d3b8cb7SBill Sommerfeld break; 2608*5d3b8cb7SBill Sommerfeld 2609*5d3b8cb7SBill Sommerfeld case TOK_OLABEL: 2610*5d3b8cb7SBill Sommerfeld case TOK_IMPLABEL: 2611*5d3b8cb7SBill Sommerfeld olabel = parselabel(token, *argv); 2612*5d3b8cb7SBill Sommerfeld argv++; 2613*5d3b8cb7SBill Sommerfeld if (label == NULL) { 2614*5d3b8cb7SBill Sommerfeld ERROR(ep, ebuf, 2615*5d3b8cb7SBill Sommerfeld gettext("Malformed security label\n")); 2616*5d3b8cb7SBill Sommerfeld break; 2617*5d3b8cb7SBill Sommerfeld } else if (label == PARSELABEL_BAD_TOKEN) { 2618*5d3b8cb7SBill Sommerfeld Bail("Internal token value error"); 2619*5d3b8cb7SBill Sommerfeld } 2620*5d3b8cb7SBill Sommerfeld totallen += SADB_64TO8(olabel->sadb_sens_len); 2621*5d3b8cb7SBill Sommerfeld break; 26227c478bd9Sstevel@tonic-gate default: 2623e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 2624e3320f40Smarkfen "Don't use extension %s for add/update.\n"), 26257c478bd9Sstevel@tonic-gate *(argv - 1)); 26267c478bd9Sstevel@tonic-gate break; 26277c478bd9Sstevel@tonic-gate } 26287c478bd9Sstevel@tonic-gate } while (token != TOK_EOF); 26297c478bd9Sstevel@tonic-gate 2630e3320f40Smarkfen handle_errors(ep, ebuf, B_TRUE, B_FALSE); 2631e3320f40Smarkfen 2632437220cdSdanmcd #define PORT_ONLY_ALLOCATE(af, socktype, exttype, extvar, port) { \ 2633437220cdSdanmcd alloclen = sizeof (sadb_address_t) + roundup(sizeof (socktype), 8); \ 2634437220cdSdanmcd (extvar) = calloc(1, alloclen); \ 2635437220cdSdanmcd if ((extvar) == NULL) { \ 2636437220cdSdanmcd Bail("malloc(implicit port)"); \ 2637437220cdSdanmcd } \ 2638437220cdSdanmcd totallen += alloclen; \ 2639437220cdSdanmcd (extvar)->sadb_address_len = SADB_8TO64(alloclen); \ 2640437220cdSdanmcd (extvar)->sadb_address_exttype = (exttype); \ 2641437220cdSdanmcd /* sin/sin6 has equivalent offsets for ports! */ \ 2642437220cdSdanmcd sin6 = (struct sockaddr_in6 *)((extvar) + 1); \ 2643437220cdSdanmcd sin6->sin6_family = (af); \ 2644437220cdSdanmcd sin6->sin6_port = (port); \ 2645437220cdSdanmcd } 2646437220cdSdanmcd 26478810c16bSdanmcd /* 2648437220cdSdanmcd * If we specify inner ports or NAT ports w/o addresses, we still need 2649437220cdSdanmcd * to allocate. Also, if we have one inner address, we need the 26508810c16bSdanmcd * other, even if we don't specify anything. 26518810c16bSdanmcd */ 2652437220cdSdanmcd if (use_natt) { 2653437220cdSdanmcd if (natt_lport != 0 && natt_local == NULL) { 2654437220cdSdanmcd PORT_ONLY_ALLOCATE(AF_INET, struct sockaddr_in, 2655437220cdSdanmcd SADB_X_EXT_ADDRESS_NATT_LOC, natt_local, 2656437220cdSdanmcd natt_lport); 2657437220cdSdanmcd } 2658437220cdSdanmcd 2659437220cdSdanmcd if (natt_rport != 0 && natt_remote == NULL) { 2660437220cdSdanmcd PORT_ONLY_ALLOCATE(AF_INET, struct sockaddr_in, 2661437220cdSdanmcd SADB_X_EXT_ADDRESS_NATT_REM, natt_remote, 2662437220cdSdanmcd natt_rport); 2663437220cdSdanmcd } 2664437220cdSdanmcd } else { 2665437220cdSdanmcd if (natt_lport != 0 || natt_rport != 0) { 2666437220cdSdanmcd ERROR(ep, ebuf, gettext("Must specify 'encap udp' " 2667437220cdSdanmcd "with any NAT-T port.\n")); 2668437220cdSdanmcd } else if (natt_local != NULL || natt_remote != NULL) { 2669437220cdSdanmcd ERROR(ep, ebuf, gettext("Must specify 'encap udp' " 2670437220cdSdanmcd "with any NAT-T address.\n")); 26718810c16bSdanmcd } 2672437220cdSdanmcd } 2673437220cdSdanmcd 2674437220cdSdanmcd if (alloc_inner && idst == NULL) { 2675437220cdSdanmcd PORT_ONLY_ALLOCATE(AF_INET6, struct sockaddr_in6, 2676437220cdSdanmcd SADB_X_EXT_ADDRESS_INNER_DST, idst, 0); 26778810c16bSdanmcd } 26788810c16bSdanmcd 26798810c16bSdanmcd if (alloc_inner && isrc == NULL) { 2680437220cdSdanmcd PORT_ONLY_ALLOCATE(AF_INET6, struct sockaddr_in6, 2681437220cdSdanmcd SADB_X_EXT_ADDRESS_INNER_SRC, isrc, 0); 26828810c16bSdanmcd } 2683437220cdSdanmcd #undef PORT_ONLY_ALLOCATE 26848810c16bSdanmcd 26857c478bd9Sstevel@tonic-gate /* 26867c478bd9Sstevel@tonic-gate * Okay, so now I have all of the potential extensions! 26877c478bd9Sstevel@tonic-gate * Allocate a single contiguous buffer. Keep in mind that it'll 26887c478bd9Sstevel@tonic-gate * be enough because the key itself will be yanked. 26897c478bd9Sstevel@tonic-gate */ 26907c478bd9Sstevel@tonic-gate 26917c478bd9Sstevel@tonic-gate if (src == NULL && dst != NULL) { 26927c478bd9Sstevel@tonic-gate /* 26937c478bd9Sstevel@tonic-gate * Set explicit unspecified source address. 26947c478bd9Sstevel@tonic-gate */ 26957c478bd9Sstevel@tonic-gate size_t lenbytes = SADB_64TO8(dst->sadb_address_len); 26967c478bd9Sstevel@tonic-gate 26977c478bd9Sstevel@tonic-gate unspec_src = B_TRUE; 26987c478bd9Sstevel@tonic-gate totallen += lenbytes; 26997c478bd9Sstevel@tonic-gate src = malloc(lenbytes); 27007c478bd9Sstevel@tonic-gate if (src == NULL) 27017c478bd9Sstevel@tonic-gate Bail("malloc(implicit src)"); 27027c478bd9Sstevel@tonic-gate /* Confusing, but we're copying from DST to SRC. :) */ 27037c478bd9Sstevel@tonic-gate bcopy(dst, src, lenbytes); 27047c478bd9Sstevel@tonic-gate src->sadb_address_exttype = SADB_EXT_ADDRESS_SRC; 27057c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(src + 1); 27067c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6)); 27077c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6; 27087c478bd9Sstevel@tonic-gate } 27098810c16bSdanmcd 27107c478bd9Sstevel@tonic-gate msg.sadb_msg_len = SADB_8TO64(totallen); 27117c478bd9Sstevel@tonic-gate 27127c478bd9Sstevel@tonic-gate buffer = malloc(totallen); 27137c478bd9Sstevel@tonic-gate nexthdr = buffer; 27147c478bd9Sstevel@tonic-gate bcopy(&msg, nexthdr, sizeof (msg)); 27157c478bd9Sstevel@tonic-gate nexthdr += SADB_8TO64(sizeof (msg)); 27167c478bd9Sstevel@tonic-gate if (assoc != NULL) { 27177c478bd9Sstevel@tonic-gate if (assoc->sadb_sa_spi == 0) { 2718e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 2719e3320f40Smarkfen "The SPI value is missing for " 2720e3320f40Smarkfen "the association you wish to %s.\n"), thiscmd); 27217c478bd9Sstevel@tonic-gate } 27227c478bd9Sstevel@tonic-gate if (assoc->sadb_sa_auth == 0 && assoc->sadb_sa_encrypt == 0 && 272325e435e0Spwernau cmd == CMD_ADD) { 2724e3320f40Smarkfen free(assoc); 2725e3320f40Smarkfen FATAL(ep, ebuf, gettext( 2726e3320f40Smarkfen "Select at least one algorithm " 2727e3320f40Smarkfen "for this add.\n")); 27287c478bd9Sstevel@tonic-gate } 27297c478bd9Sstevel@tonic-gate 27307c478bd9Sstevel@tonic-gate /* Hack to let user specify NULL ESP implicitly. */ 27317c478bd9Sstevel@tonic-gate if (msg.sadb_msg_satype == SADB_SATYPE_ESP && 27327c478bd9Sstevel@tonic-gate assoc->sadb_sa_encrypt == 0) 27337c478bd9Sstevel@tonic-gate assoc->sadb_sa_encrypt = SADB_EALG_NULL; 27347c478bd9Sstevel@tonic-gate 27357c478bd9Sstevel@tonic-gate /* 0 is an actual value. Print a warning if it was entered. */ 27367c478bd9Sstevel@tonic-gate if (assoc->sadb_sa_state == 0) { 2737e3320f40Smarkfen if (readstate) { 2738e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2739e3320f40Smarkfen "WARNING: Cannot set LARVAL SA state.\n")); 2740e3320f40Smarkfen } 27417c478bd9Sstevel@tonic-gate assoc->sadb_sa_state = SADB_SASTATE_MATURE; 27427c478bd9Sstevel@tonic-gate } 27437c478bd9Sstevel@tonic-gate 27447c478bd9Sstevel@tonic-gate if (use_natt) { 27457c478bd9Sstevel@tonic-gate if (natt_remote != NULL) 27467c478bd9Sstevel@tonic-gate assoc->sadb_sa_flags |= SADB_X_SAFLAGS_NATT_REM; 27477c478bd9Sstevel@tonic-gate if (natt_local != NULL) 27487c478bd9Sstevel@tonic-gate assoc->sadb_sa_flags |= SADB_X_SAFLAGS_NATT_LOC; 27497c478bd9Sstevel@tonic-gate } 27507c478bd9Sstevel@tonic-gate 27518810c16bSdanmcd if (alloc_inner) { 27528810c16bSdanmcd /* 27538810c16bSdanmcd * For now, assume RFC 3884's dream of transport-mode 27548810c16bSdanmcd * SAs with inner IP address selectors will not 27558810c16bSdanmcd * happen. 27568810c16bSdanmcd */ 27578810c16bSdanmcd assoc->sadb_sa_flags |= SADB_X_SAFLAGS_TUNNEL; 27588810c16bSdanmcd if (proto != 0 && proto != IPPROTO_ENCAP && 27598810c16bSdanmcd proto != IPPROTO_IPV6) { 2760e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 2761e3320f40Smarkfen "WARNING: Protocol type %d not " 2762e3320f40Smarkfen "for use with Tunnel-Mode SA.\n"), proto); 27638810c16bSdanmcd /* Continue and let PF_KEY scream... */ 27648810c16bSdanmcd } 27658810c16bSdanmcd } 27668810c16bSdanmcd 27677c478bd9Sstevel@tonic-gate bcopy(assoc, nexthdr, SADB_64TO8(assoc->sadb_sa_len)); 27687c478bd9Sstevel@tonic-gate nexthdr += assoc->sadb_sa_len; 27697c478bd9Sstevel@tonic-gate /* Save the SPI for the case of an error. */ 27707c478bd9Sstevel@tonic-gate spi = assoc->sadb_sa_spi; 27717c478bd9Sstevel@tonic-gate free(assoc); 27727c478bd9Sstevel@tonic-gate } else { 2773a050d7e9Spwernau if (spi == 0) 2774a050d7e9Spwernau ERROR1(ep, ebuf, gettext( 2775a050d7e9Spwernau "Need to define SPI for %s.\n"), thiscmd); 2776e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 2777e3320f40Smarkfen "Need SA parameters for %s.\n"), thiscmd); 27787c478bd9Sstevel@tonic-gate } 27797c478bd9Sstevel@tonic-gate 278038d95a78Smarkfen if (sadb_pair != NULL) { 278138d95a78Smarkfen if (sadb_pair->sadb_x_pair_spi == 0) { 278238d95a78Smarkfen ERROR1(ep, ebuf, gettext( 278338d95a78Smarkfen "The SPI value is missing for the " 278438d95a78Smarkfen "association you wish to %s.\n"), thiscmd); 278538d95a78Smarkfen } 278638d95a78Smarkfen bcopy(sadb_pair, nexthdr, 278738d95a78Smarkfen SADB_64TO8(sadb_pair->sadb_x_pair_len)); 278838d95a78Smarkfen nexthdr += sadb_pair->sadb_x_pair_len; 278938d95a78Smarkfen free(sadb_pair); 279038d95a78Smarkfen } 279138d95a78Smarkfen 27927c478bd9Sstevel@tonic-gate if (hard != NULL) { 27937c478bd9Sstevel@tonic-gate bcopy(hard, nexthdr, SADB_64TO8(hard->sadb_lifetime_len)); 27947c478bd9Sstevel@tonic-gate nexthdr += hard->sadb_lifetime_len; 27957c478bd9Sstevel@tonic-gate free(hard); 27967c478bd9Sstevel@tonic-gate } 27977c478bd9Sstevel@tonic-gate 27987c478bd9Sstevel@tonic-gate if (soft != NULL) { 27997c478bd9Sstevel@tonic-gate bcopy(soft, nexthdr, SADB_64TO8(soft->sadb_lifetime_len)); 28007c478bd9Sstevel@tonic-gate nexthdr += soft->sadb_lifetime_len; 28017c478bd9Sstevel@tonic-gate free(soft); 28027c478bd9Sstevel@tonic-gate } 28037c478bd9Sstevel@tonic-gate 28049c2c14abSThejaswini Singarajipura if (idle != NULL) { 28059c2c14abSThejaswini Singarajipura bcopy(idle, nexthdr, SADB_64TO8(idle->sadb_lifetime_len)); 28069c2c14abSThejaswini Singarajipura nexthdr += idle->sadb_lifetime_len; 28079c2c14abSThejaswini Singarajipura free(idle); 28089c2c14abSThejaswini Singarajipura } 28099c2c14abSThejaswini Singarajipura 28107c478bd9Sstevel@tonic-gate if (encrypt == NULL && auth == NULL && cmd == CMD_ADD) { 2811e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2812e3320f40Smarkfen "Must have at least one key for an add.\n")); 28137c478bd9Sstevel@tonic-gate } 28147c478bd9Sstevel@tonic-gate 28157c478bd9Sstevel@tonic-gate if (encrypt != NULL) { 28167c478bd9Sstevel@tonic-gate bcopy(encrypt, nexthdr, SADB_64TO8(encrypt->sadb_key_len)); 28177c478bd9Sstevel@tonic-gate nexthdr += encrypt->sadb_key_len; 28187c478bd9Sstevel@tonic-gate bzero(encrypt, SADB_64TO8(encrypt->sadb_key_len)); 28197c478bd9Sstevel@tonic-gate free(encrypt); 28207c478bd9Sstevel@tonic-gate } 28217c478bd9Sstevel@tonic-gate 28227c478bd9Sstevel@tonic-gate if (auth != NULL) { 28237c478bd9Sstevel@tonic-gate bcopy(auth, nexthdr, SADB_64TO8(auth->sadb_key_len)); 28247c478bd9Sstevel@tonic-gate nexthdr += auth->sadb_key_len; 28257c478bd9Sstevel@tonic-gate bzero(auth, SADB_64TO8(auth->sadb_key_len)); 28267c478bd9Sstevel@tonic-gate free(auth); 28277c478bd9Sstevel@tonic-gate } 28287c478bd9Sstevel@tonic-gate 28297c478bd9Sstevel@tonic-gate if (srcid != NULL) { 28307c478bd9Sstevel@tonic-gate bcopy(srcid, nexthdr, SADB_64TO8(srcid->sadb_ident_len)); 28317c478bd9Sstevel@tonic-gate nexthdr += srcid->sadb_ident_len; 28327c478bd9Sstevel@tonic-gate free(srcid); 28337c478bd9Sstevel@tonic-gate } 28347c478bd9Sstevel@tonic-gate 28357c478bd9Sstevel@tonic-gate if (dstid != NULL) { 28367c478bd9Sstevel@tonic-gate bcopy(dstid, nexthdr, SADB_64TO8(dstid->sadb_ident_len)); 28377c478bd9Sstevel@tonic-gate nexthdr += dstid->sadb_ident_len; 28387c478bd9Sstevel@tonic-gate free(dstid); 28397c478bd9Sstevel@tonic-gate } 28407c478bd9Sstevel@tonic-gate 28417c478bd9Sstevel@tonic-gate if (dst != NULL) { 28427c478bd9Sstevel@tonic-gate bcopy(dst, nexthdr, SADB_64TO8(dst->sadb_address_len)); 28437c478bd9Sstevel@tonic-gate free(dst); 28447c478bd9Sstevel@tonic-gate dst = (struct sadb_address *)nexthdr; 28458810c16bSdanmcd dst->sadb_address_proto = proto; 28468810c16bSdanmcd ((struct sockaddr_in6 *)(dst + 1))->sin6_port = htons(dstport); 28477c478bd9Sstevel@tonic-gate nexthdr += dst->sadb_address_len; 28487c478bd9Sstevel@tonic-gate } else { 2849e3320f40Smarkfen FATAL1(ep, ebuf, gettext( 2850e3320f40Smarkfen "Need destination address for %s.\n"), thiscmd); 28517c478bd9Sstevel@tonic-gate } 28527c478bd9Sstevel@tonic-gate 28537c478bd9Sstevel@tonic-gate if (use_natt) { 28547c478bd9Sstevel@tonic-gate if (natt_remote == NULL && natt_local == NULL) { 2855e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2856e3320f40Smarkfen "Must specify NAT-T remote or local address " 2857e3320f40Smarkfen "for UDP encapsulation.\n")); 28587c478bd9Sstevel@tonic-gate } 28597c478bd9Sstevel@tonic-gate 28607c478bd9Sstevel@tonic-gate if (natt_remote != NULL) { 28618810c16bSdanmcd bcopy(natt_remote, nexthdr, 28628810c16bSdanmcd SADB_64TO8(natt_remote->sadb_address_len)); 28637c478bd9Sstevel@tonic-gate free(natt_remote); 28647c478bd9Sstevel@tonic-gate natt_remote = (struct sadb_address *)nexthdr; 28657c478bd9Sstevel@tonic-gate nexthdr += natt_remote->sadb_address_len; 28668810c16bSdanmcd ((struct sockaddr_in6 *)(natt_remote + 1))->sin6_port = 28678810c16bSdanmcd htons(natt_rport); 28687c478bd9Sstevel@tonic-gate } 28698810c16bSdanmcd 28707c478bd9Sstevel@tonic-gate if (natt_local != NULL) { 28717c478bd9Sstevel@tonic-gate bcopy(natt_local, nexthdr, 28727c478bd9Sstevel@tonic-gate SADB_64TO8(natt_local->sadb_address_len)); 28737c478bd9Sstevel@tonic-gate free(natt_local); 28747c478bd9Sstevel@tonic-gate natt_local = (struct sadb_address *)nexthdr; 28757c478bd9Sstevel@tonic-gate nexthdr += natt_local->sadb_address_len; 28768810c16bSdanmcd ((struct sockaddr_in6 *)(natt_local + 1))->sin6_port = 28778810c16bSdanmcd htons(natt_lport); 28787c478bd9Sstevel@tonic-gate } 28797c478bd9Sstevel@tonic-gate } 2880e3320f40Smarkfen 2881e3320f40Smarkfen handle_errors(ep, ebuf, B_TRUE, B_FALSE); 2882e3320f40Smarkfen 28837c478bd9Sstevel@tonic-gate /* 28847c478bd9Sstevel@tonic-gate * PF_KEY requires a source address extension, even if the source 28857c478bd9Sstevel@tonic-gate * address itself is unspecified. (See "Set explicit unspecified..." 28867c478bd9Sstevel@tonic-gate * code fragment above. Destination reality check was above.) 28877c478bd9Sstevel@tonic-gate */ 28887c478bd9Sstevel@tonic-gate bcopy(src, nexthdr, SADB_64TO8(src->sadb_address_len)); 28897c478bd9Sstevel@tonic-gate free(src); 28907c478bd9Sstevel@tonic-gate src = (struct sadb_address *)nexthdr; 28918810c16bSdanmcd src->sadb_address_proto = proto; 28928810c16bSdanmcd ((struct sockaddr_in6 *)(src + 1))->sin6_port = htons(srcport); 28937c478bd9Sstevel@tonic-gate nexthdr += src->sadb_address_len; 28947c478bd9Sstevel@tonic-gate 28958810c16bSdanmcd if (isrc != NULL) { 28968810c16bSdanmcd bcopy(isrc, nexthdr, SADB_64TO8(isrc->sadb_address_len)); 28978810c16bSdanmcd free(isrc); 28988810c16bSdanmcd isrc = (struct sadb_address *)nexthdr; 28998810c16bSdanmcd isrc->sadb_address_proto = iproto; 29008810c16bSdanmcd ((struct sockaddr_in6 *)(isrc + 1))->sin6_port = 29018810c16bSdanmcd htons(isrcport); 29028810c16bSdanmcd nexthdr += isrc->sadb_address_len; 29037c478bd9Sstevel@tonic-gate } 29047c478bd9Sstevel@tonic-gate 29058810c16bSdanmcd if (idst != NULL) { 29068810c16bSdanmcd bcopy(idst, nexthdr, SADB_64TO8(idst->sadb_address_len)); 29078810c16bSdanmcd free(idst); 29088810c16bSdanmcd idst = (struct sadb_address *)nexthdr; 29098810c16bSdanmcd idst->sadb_address_proto = iproto; 29108810c16bSdanmcd ((struct sockaddr_in6 *)(idst + 1))->sin6_port = 29118810c16bSdanmcd htons(idstport); 29128810c16bSdanmcd nexthdr += idst->sadb_address_len; 29138810c16bSdanmcd } 29147c478bd9Sstevel@tonic-gate 29159c2c14abSThejaswini Singarajipura if (replay_ctr != NULL) { 29169c2c14abSThejaswini Singarajipura bcopy(replay_ctr, nexthdr, 29179c2c14abSThejaswini Singarajipura SADB_64TO8(replay_ctr->sadb_x_rc_len)); 29189c2c14abSThejaswini Singarajipura nexthdr += replay_ctr->sadb_x_rc_len; 29199c2c14abSThejaswini Singarajipura free(replay_ctr); 29209c2c14abSThejaswini Singarajipura } 29219c2c14abSThejaswini Singarajipura 2922*5d3b8cb7SBill Sommerfeld if (label != NULL) { 2923*5d3b8cb7SBill Sommerfeld bcopy(label, nexthdr, SADB_64TO8(label->sadb_sens_len)); 2924*5d3b8cb7SBill Sommerfeld nexthdr += label->sadb_sens_len; 2925*5d3b8cb7SBill Sommerfeld free(label); 2926*5d3b8cb7SBill Sommerfeld label = NULL; 2927*5d3b8cb7SBill Sommerfeld } 2928*5d3b8cb7SBill Sommerfeld 2929*5d3b8cb7SBill Sommerfeld if (olabel != NULL) { 2930*5d3b8cb7SBill Sommerfeld bcopy(olabel, nexthdr, SADB_64TO8(olabel->sadb_sens_len)); 2931*5d3b8cb7SBill Sommerfeld nexthdr += olabel->sadb_sens_len; 2932*5d3b8cb7SBill Sommerfeld free(olabel); 2933*5d3b8cb7SBill Sommerfeld olabel = NULL; 2934*5d3b8cb7SBill Sommerfeld } 2935*5d3b8cb7SBill Sommerfeld 293625e435e0Spwernau if (cflag) { 293725e435e0Spwernau /* 293825e435e0Spwernau * Assume the checked cmd would have worked if it was actually 293925e435e0Spwernau * used. doaddresses() will increment lines_added if it 294025e435e0Spwernau * succeeds. 294125e435e0Spwernau */ 294225e435e0Spwernau lines_added++; 294325e435e0Spwernau } else { 294438d95a78Smarkfen doaddresses(sadb_msg_type, satype, 2945e3320f40Smarkfen cmd, srchp, dsthp, src, dst, unspec_src, buffer, totallen, 2946e3320f40Smarkfen spi, ebuf); 2947e3320f40Smarkfen } 29487c478bd9Sstevel@tonic-gate 29498810c16bSdanmcd if (isrchp != NULL && isrchp != &dummy.he) 295025e435e0Spwernau freehostent(isrchp); 29518810c16bSdanmcd if (idsthp != NULL && idsthp != &dummy.he) 295225e435e0Spwernau freehostent(idsthp); 29537c478bd9Sstevel@tonic-gate if (srchp != NULL && srchp != &dummy.he) 295425e435e0Spwernau freehostent(srchp); 29557c478bd9Sstevel@tonic-gate if (dsthp != NULL && dsthp != &dummy.he) 295625e435e0Spwernau freehostent(dsthp); 29577c478bd9Sstevel@tonic-gate if (natt_lhp != NULL && natt_lhp != &dummy.he) 295825e435e0Spwernau freehostent(natt_lhp); 29597c478bd9Sstevel@tonic-gate if (natt_rhp != NULL && natt_rhp != &dummy.he) 296025e435e0Spwernau freehostent(natt_rhp); 2961e3320f40Smarkfen free(ebuf); 2962e3320f40Smarkfen free(buffer); 29637c478bd9Sstevel@tonic-gate } 29647c478bd9Sstevel@tonic-gate 29657c478bd9Sstevel@tonic-gate /* 29667c478bd9Sstevel@tonic-gate * DELETE and GET are similar, in that they only need the extensions 29677c478bd9Sstevel@tonic-gate * required to _find_ an SA, and then either delete it or obtain its 29687c478bd9Sstevel@tonic-gate * information. 29697c478bd9Sstevel@tonic-gate */ 29707c478bd9Sstevel@tonic-gate static void 2971e3320f40Smarkfen dodelget(int cmd, int satype, char *argv[], char *ebuf) 29727c478bd9Sstevel@tonic-gate { 29737c478bd9Sstevel@tonic-gate struct sadb_msg *msg = (struct sadb_msg *)get_buffer; 29747c478bd9Sstevel@tonic-gate uint64_t *nextext; 29757c478bd9Sstevel@tonic-gate struct sadb_sa *assoc = NULL; 29767c478bd9Sstevel@tonic-gate struct sadb_address *src = NULL, *dst = NULL; 29777c478bd9Sstevel@tonic-gate int next, token, sa_len; 29787c478bd9Sstevel@tonic-gate char *thiscmd; 29797c478bd9Sstevel@tonic-gate uint32_t spi; 298038d95a78Smarkfen uint8_t sadb_msg_type; 29817c478bd9Sstevel@tonic-gate struct hostent *srchp = NULL, *dsthp = NULL; 29827c478bd9Sstevel@tonic-gate struct sockaddr_in6 *sin6; 29837c478bd9Sstevel@tonic-gate boolean_t unspec_src = B_TRUE; 29847c478bd9Sstevel@tonic-gate uint16_t srcport = 0, dstport = 0; 29857c478bd9Sstevel@tonic-gate uint8_t proto = 0; 2986e3320f40Smarkfen char *ep = NULL; 29877c478bd9Sstevel@tonic-gate 29887c478bd9Sstevel@tonic-gate /* Set the first extension header to right past the base message. */ 29897c478bd9Sstevel@tonic-gate nextext = (uint64_t *)(msg + 1); 29907c478bd9Sstevel@tonic-gate bzero(nextext, sizeof (get_buffer) - sizeof (*msg)); 29917c478bd9Sstevel@tonic-gate 299238d95a78Smarkfen switch (cmd) { 299338d95a78Smarkfen case CMD_GET: 299438d95a78Smarkfen thiscmd = "get"; 299538d95a78Smarkfen sadb_msg_type = SADB_GET; 299638d95a78Smarkfen break; 299738d95a78Smarkfen case CMD_DELETE: 299838d95a78Smarkfen thiscmd = "delete"; 299938d95a78Smarkfen sadb_msg_type = SADB_DELETE; 300038d95a78Smarkfen break; 300138d95a78Smarkfen case CMD_DELETE_PAIR: 300238d95a78Smarkfen thiscmd = "delete-pair"; 300338d95a78Smarkfen sadb_msg_type = SADB_X_DELPAIR; 300438d95a78Smarkfen break; 300538d95a78Smarkfen } 300638d95a78Smarkfen 300738d95a78Smarkfen msg_init(msg, sadb_msg_type, (uint8_t)satype); 30087c478bd9Sstevel@tonic-gate 300907b56925Ssommerfe #define ALLOC_ADDR_EXT(ext, exttype) \ 301007b56925Ssommerfe (ext) = (struct sadb_address *)nextext; \ 301107b56925Ssommerfe nextext = (uint64_t *)((ext) + 1); \ 301207b56925Ssommerfe nextext += SADB_8TO64(roundup(sa_len, 8)); \ 301307b56925Ssommerfe (ext)->sadb_address_exttype = exttype; \ 301407b56925Ssommerfe (ext)->sadb_address_len = nextext - ((uint64_t *)ext); 301507b56925Ssommerfe 30167c478bd9Sstevel@tonic-gate /* Assume last element in argv is set to NULL. */ 30177c478bd9Sstevel@tonic-gate do { 30187c478bd9Sstevel@tonic-gate token = parseextval(*argv, &next); 30197c478bd9Sstevel@tonic-gate argv++; 30207c478bd9Sstevel@tonic-gate switch (token) { 30217c478bd9Sstevel@tonic-gate case TOK_EOF: 30227c478bd9Sstevel@tonic-gate /* Do nothing, I'm done. */ 30237c478bd9Sstevel@tonic-gate break; 30247c478bd9Sstevel@tonic-gate case TOK_UNKNOWN: 3025e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 3026e3320f40Smarkfen "Unknown extension field \"%s\"\n"), *(argv - 1)); 30277c478bd9Sstevel@tonic-gate break; 30287c478bd9Sstevel@tonic-gate case TOK_SPI: 30297c478bd9Sstevel@tonic-gate if (assoc != NULL) { 3030e3320f40Smarkfen ERROR(ep, ebuf, gettext( 3031e3320f40Smarkfen "Can only specify single SPI value.\n")); 3032e3320f40Smarkfen break; 30337c478bd9Sstevel@tonic-gate } 30347c478bd9Sstevel@tonic-gate assoc = (struct sadb_sa *)nextext; 30357c478bd9Sstevel@tonic-gate nextext = (uint64_t *)(assoc + 1); 30367c478bd9Sstevel@tonic-gate assoc->sadb_sa_len = SADB_8TO64(sizeof (*assoc)); 30377c478bd9Sstevel@tonic-gate assoc->sadb_sa_exttype = SADB_EXT_SA; 30387c478bd9Sstevel@tonic-gate assoc->sadb_sa_spi = htonl((uint32_t)parsenum(*argv, 3039e3320f40Smarkfen B_TRUE, ebuf)); 30407c478bd9Sstevel@tonic-gate spi = assoc->sadb_sa_spi; 30417c478bd9Sstevel@tonic-gate argv++; 30427c478bd9Sstevel@tonic-gate break; 30437c478bd9Sstevel@tonic-gate case TOK_SRCPORT: 30447c478bd9Sstevel@tonic-gate if (srcport != 0) { 3045e3320f40Smarkfen ERROR(ep, ebuf, gettext( 3046e3320f40Smarkfen "Can only specify single source port.\n")); 3047e3320f40Smarkfen break; 30487c478bd9Sstevel@tonic-gate } 3049e3320f40Smarkfen srcport = parsenum(*argv, B_TRUE, ebuf); 30507c478bd9Sstevel@tonic-gate argv++; 30517c478bd9Sstevel@tonic-gate break; 30527c478bd9Sstevel@tonic-gate case TOK_DSTPORT: 30537c478bd9Sstevel@tonic-gate if (dstport != 0) { 3054e3320f40Smarkfen ERROR(ep, ebuf, gettext( 3055e3320f40Smarkfen "Can only " 3056e3320f40Smarkfen "specify single destination port.\n")); 3057e3320f40Smarkfen break; 30587c478bd9Sstevel@tonic-gate } 3059e3320f40Smarkfen dstport = parsenum(*argv, B_TRUE, ebuf); 30607c478bd9Sstevel@tonic-gate argv++; 30617c478bd9Sstevel@tonic-gate break; 30627c478bd9Sstevel@tonic-gate case TOK_PROTO: 30637c478bd9Sstevel@tonic-gate if (proto != 0) { 3064e3320f40Smarkfen ERROR(ep, ebuf, gettext( 3065e3320f40Smarkfen "Can only specify single protocol.\n")); 3066e3320f40Smarkfen break; 30677c478bd9Sstevel@tonic-gate } 3068e3320f40Smarkfen proto = parsenum(*argv, B_TRUE, ebuf); 30697c478bd9Sstevel@tonic-gate argv++; 30707c478bd9Sstevel@tonic-gate break; 30717c478bd9Sstevel@tonic-gate case TOK_SRCADDR: 30727c478bd9Sstevel@tonic-gate case TOK_SRCADDR6: 30737c478bd9Sstevel@tonic-gate if (src != NULL) { 3074e3320f40Smarkfen ERROR(ep, ebuf, gettext( 3075e3320f40Smarkfen "Can only specify single source addr.\n")); 3076e3320f40Smarkfen break; 30777c478bd9Sstevel@tonic-gate } 30787c478bd9Sstevel@tonic-gate sa_len = parseaddr(*argv, &srchp, 3079e3320f40Smarkfen (token == TOK_SRCADDR6), ebuf); 3080e3320f40Smarkfen if (srchp == NULL) { 3081e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 3082e3320f40Smarkfen "Unknown source address \"%s\"\n"), *argv); 3083e3320f40Smarkfen break; 3084e3320f40Smarkfen } 30857c478bd9Sstevel@tonic-gate argv++; 30867c478bd9Sstevel@tonic-gate 30877c478bd9Sstevel@tonic-gate unspec_src = B_FALSE; 308807b56925Ssommerfe 308907b56925Ssommerfe ALLOC_ADDR_EXT(src, SADB_EXT_ADDRESS_SRC); 309007b56925Ssommerfe 30917c478bd9Sstevel@tonic-gate if (srchp == &dummy.he) { 30927c478bd9Sstevel@tonic-gate /* 30937c478bd9Sstevel@tonic-gate * Single address with -n flag. 30947c478bd9Sstevel@tonic-gate */ 30957c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(src + 1); 30967c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6)); 30977c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6; 30987c478bd9Sstevel@tonic-gate bcopy(srchp->h_addr_list[0], &sin6->sin6_addr, 30997c478bd9Sstevel@tonic-gate sizeof (struct in6_addr)); 31007c478bd9Sstevel@tonic-gate } 31017c478bd9Sstevel@tonic-gate /* The rest is pre-bzeroed for us. */ 31027c478bd9Sstevel@tonic-gate break; 31037c478bd9Sstevel@tonic-gate case TOK_DSTADDR: 31047c478bd9Sstevel@tonic-gate case TOK_DSTADDR6: 31057c478bd9Sstevel@tonic-gate if (dst != NULL) { 3106e3320f40Smarkfen ERROR(ep, ebuf, gettext( 3107e3320f40Smarkfen "Can only specify single destination " 3108e3320f40Smarkfen "address.\n")); 3109e3320f40Smarkfen break; 31107c478bd9Sstevel@tonic-gate } 31117c478bd9Sstevel@tonic-gate sa_len = parseaddr(*argv, &dsthp, 3112e3320f40Smarkfen (token == TOK_SRCADDR6), ebuf); 3113e3320f40Smarkfen if (dsthp == NULL) { 3114e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 3115e3320f40Smarkfen "Unknown destination address \"%s\"\n"), 3116e3320f40Smarkfen *argv); 3117e3320f40Smarkfen break; 3118e3320f40Smarkfen } 31197c478bd9Sstevel@tonic-gate argv++; 31207c478bd9Sstevel@tonic-gate 312107b56925Ssommerfe ALLOC_ADDR_EXT(dst, SADB_EXT_ADDRESS_DST); 312207b56925Ssommerfe 31237c478bd9Sstevel@tonic-gate if (dsthp == &dummy.he) { 31247c478bd9Sstevel@tonic-gate /* 31257c478bd9Sstevel@tonic-gate * Single address with -n flag. 31267c478bd9Sstevel@tonic-gate */ 31277c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(dst + 1); 31287c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6)); 31297c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6; 31307c478bd9Sstevel@tonic-gate bcopy(dsthp->h_addr_list[0], &sin6->sin6_addr, 31317c478bd9Sstevel@tonic-gate sizeof (struct in6_addr)); 31327c478bd9Sstevel@tonic-gate } 31337c478bd9Sstevel@tonic-gate /* The rest is pre-bzeroed for us. */ 31347c478bd9Sstevel@tonic-gate break; 313538d95a78Smarkfen case TOK_FLAG_INBOUND: 313638d95a78Smarkfen assoc->sadb_sa_flags |= SADB_X_SAFLAGS_INBOUND; 313738d95a78Smarkfen break; 313838d95a78Smarkfen case TOK_FLAG_OUTBOUND: 313938d95a78Smarkfen assoc->sadb_sa_flags |= SADB_X_SAFLAGS_OUTBOUND; 314038d95a78Smarkfen break; 31417c478bd9Sstevel@tonic-gate default: 3142e3320f40Smarkfen ERROR2(ep, ebuf, gettext( 3143e3320f40Smarkfen "Don't use extension %s for '%s' command.\n"), 3144e3320f40Smarkfen *(argv - 1), thiscmd); 31457c478bd9Sstevel@tonic-gate break; 31467c478bd9Sstevel@tonic-gate } 31477c478bd9Sstevel@tonic-gate } while (token != TOK_EOF); 31487c478bd9Sstevel@tonic-gate 3149e3320f40Smarkfen handle_errors(ep, ebuf, B_TRUE, B_FALSE); 3150e3320f40Smarkfen 315107b56925Ssommerfe if ((srcport != 0) && (src == NULL)) { 315207b56925Ssommerfe ALLOC_ADDR_EXT(src, SADB_EXT_ADDRESS_SRC); 315307b56925Ssommerfe sin6 = (struct sockaddr_in6 *)(src + 1); 31548810c16bSdanmcd src->sadb_address_proto = proto; 315507b56925Ssommerfe bzero(sin6, sizeof (*sin6)); 315607b56925Ssommerfe sin6->sin6_family = AF_INET6; 31578810c16bSdanmcd sin6->sin6_port = htons(srcport); 315807b56925Ssommerfe } 315907b56925Ssommerfe 316007b56925Ssommerfe if ((dstport != 0) && (dst == NULL)) { 316107b56925Ssommerfe ALLOC_ADDR_EXT(dst, SADB_EXT_ADDRESS_DST); 316207b56925Ssommerfe sin6 = (struct sockaddr_in6 *)(dst + 1); 31638810c16bSdanmcd src->sadb_address_proto = proto; 316407b56925Ssommerfe bzero(sin6, sizeof (*sin6)); 316507b56925Ssommerfe sin6->sin6_family = AF_INET6; 31668810c16bSdanmcd sin6->sin6_port = htons(dstport); 316707b56925Ssommerfe } 316807b56925Ssommerfe 31697c478bd9Sstevel@tonic-gate /* So I have enough of the message to send it down! */ 31707c478bd9Sstevel@tonic-gate msg->sadb_msg_len = nextext - get_buffer; 31717c478bd9Sstevel@tonic-gate 3172e3320f40Smarkfen if (assoc == NULL) { 3173e3320f40Smarkfen FATAL1(ep, ebuf, gettext( 3174e3320f40Smarkfen "Need SA parameters for %s.\n"), thiscmd); 3175e3320f40Smarkfen } 3176e3320f40Smarkfen 317725e435e0Spwernau if (cflag) { 317825e435e0Spwernau /* 317925e435e0Spwernau * Assume the checked cmd would have worked if it was actually 318025e435e0Spwernau * used. doaddresses() will increment lines_added if it 318125e435e0Spwernau * succeeds. 318225e435e0Spwernau */ 318325e435e0Spwernau lines_added++; 318425e435e0Spwernau } else { 318538d95a78Smarkfen doaddresses(sadb_msg_type, satype, 3186e3320f40Smarkfen cmd, srchp, dsthp, src, dst, unspec_src, get_buffer, 3187e3320f40Smarkfen sizeof (get_buffer), spi, NULL); 3188e3320f40Smarkfen } 31897c478bd9Sstevel@tonic-gate 31907c478bd9Sstevel@tonic-gate if (srchp != NULL && srchp != &dummy.he) 31917c478bd9Sstevel@tonic-gate freehostent(srchp); 31927c478bd9Sstevel@tonic-gate if (dsthp != NULL && dsthp != &dummy.he) 31937c478bd9Sstevel@tonic-gate freehostent(dsthp); 31947c478bd9Sstevel@tonic-gate } 31957c478bd9Sstevel@tonic-gate 31967c478bd9Sstevel@tonic-gate /* 3197bfe6f8f5SVladimir Kotal * "ipseckey monitor" should exit very gracefully if ^C is tapped provided 3198bfe6f8f5SVladimir Kotal * it is not running in interactive mode. 31997c478bd9Sstevel@tonic-gate */ 32007c478bd9Sstevel@tonic-gate static void 32017c478bd9Sstevel@tonic-gate monitor_catch(int signal) 32027c478bd9Sstevel@tonic-gate { 3203bfe6f8f5SVladimir Kotal if (!interactive) 3204bfe6f8f5SVladimir Kotal errx(signal, gettext("Bailing on signal %d."), signal); 32057c478bd9Sstevel@tonic-gate } 32067c478bd9Sstevel@tonic-gate 32077c478bd9Sstevel@tonic-gate /* 32087c478bd9Sstevel@tonic-gate * Loop forever, listening on PF_KEY messages. 32097c478bd9Sstevel@tonic-gate */ 32107c478bd9Sstevel@tonic-gate static void 32117c478bd9Sstevel@tonic-gate domonitor(boolean_t passive) 32127c478bd9Sstevel@tonic-gate { 32137c478bd9Sstevel@tonic-gate struct sadb_msg *samsg; 3214bfe6f8f5SVladimir Kotal struct sigaction newsig, oldsig; 32157c478bd9Sstevel@tonic-gate int rc; 32167c478bd9Sstevel@tonic-gate 32177c478bd9Sstevel@tonic-gate /* Catch ^C. */ 3218bfe6f8f5SVladimir Kotal newsig.sa_handler = monitor_catch; 3219bfe6f8f5SVladimir Kotal newsig.sa_flags = 0; 3220bfe6f8f5SVladimir Kotal (void) sigemptyset(&newsig.sa_mask); 3221bfe6f8f5SVladimir Kotal (void) sigaddset(&newsig.sa_mask, SIGINT); 3222bfe6f8f5SVladimir Kotal (void) sigaction(SIGINT, &newsig, &oldsig); 32237c478bd9Sstevel@tonic-gate 32247c478bd9Sstevel@tonic-gate samsg = (struct sadb_msg *)get_buffer; 32257c478bd9Sstevel@tonic-gate if (!passive) { 32267c478bd9Sstevel@tonic-gate (void) printf(gettext("Actively")); 32277c478bd9Sstevel@tonic-gate msg_init(samsg, SADB_X_PROMISC, 1); /* Turn ON promisc. */ 32287c478bd9Sstevel@tonic-gate rc = key_write(keysock, samsg, sizeof (*samsg)); 32297c478bd9Sstevel@tonic-gate if (rc == -1) 32307c478bd9Sstevel@tonic-gate Bail("write (SADB_X_PROMISC)"); 32317c478bd9Sstevel@tonic-gate } else { 32327c478bd9Sstevel@tonic-gate (void) printf(gettext("Passively")); 32337c478bd9Sstevel@tonic-gate } 32347c478bd9Sstevel@tonic-gate (void) printf(gettext(" monitoring the PF_KEY socket.\n")); 32357c478bd9Sstevel@tonic-gate 32367c478bd9Sstevel@tonic-gate for (; ; ) { 32377c478bd9Sstevel@tonic-gate /* 32387c478bd9Sstevel@tonic-gate * I assume that read() is non-blocking, and will never 32397c478bd9Sstevel@tonic-gate * return 0. 32407c478bd9Sstevel@tonic-gate */ 32417c478bd9Sstevel@tonic-gate rc = read(keysock, samsg, sizeof (get_buffer)); 3242bfe6f8f5SVladimir Kotal if (rc == -1) { 3243bfe6f8f5SVladimir Kotal if (errno == EINTR && interactive) 3244bfe6f8f5SVladimir Kotal goto out; 3245bfe6f8f5SVladimir Kotal else 3246bfe6f8f5SVladimir Kotal Bail("read (in domonitor)"); 3247bfe6f8f5SVladimir Kotal } 32487c478bd9Sstevel@tonic-gate (void) printf(gettext("Read %d bytes.\n"), rc); 32497c478bd9Sstevel@tonic-gate /* 32507c478bd9Sstevel@tonic-gate * Q: Should I use the same method of printing as GET does? 32517c478bd9Sstevel@tonic-gate * A: For now, yes. 32527c478bd9Sstevel@tonic-gate */ 3253bb3ed8dfSpwernau print_samsg(stdout, get_buffer, B_TRUE, vflag, nflag); 32547c478bd9Sstevel@tonic-gate (void) putchar('\n'); 32557c478bd9Sstevel@tonic-gate } 3256bfe6f8f5SVladimir Kotal 3257bfe6f8f5SVladimir Kotal out: 3258bfe6f8f5SVladimir Kotal if (interactive) 3259bfe6f8f5SVladimir Kotal /* restore SIGINT behavior */ 3260bfe6f8f5SVladimir Kotal (void) sigaction(SIGINT, &oldsig, NULL); 32617c478bd9Sstevel@tonic-gate } 32627c478bd9Sstevel@tonic-gate 32637c478bd9Sstevel@tonic-gate /* 32647c478bd9Sstevel@tonic-gate * Either mask or unmask all relevant signals. 32657c478bd9Sstevel@tonic-gate */ 32667c478bd9Sstevel@tonic-gate static void 32677c478bd9Sstevel@tonic-gate mask_signals(boolean_t unmask) 32687c478bd9Sstevel@tonic-gate { 32697c478bd9Sstevel@tonic-gate sigset_t set; 32707c478bd9Sstevel@tonic-gate static sigset_t oset; 32717c478bd9Sstevel@tonic-gate 32727c478bd9Sstevel@tonic-gate if (unmask) { 32737c478bd9Sstevel@tonic-gate (void) sigprocmask(SIG_SETMASK, &oset, NULL); 32747c478bd9Sstevel@tonic-gate } else { 32757c478bd9Sstevel@tonic-gate (void) sigfillset(&set); 32767c478bd9Sstevel@tonic-gate (void) sigprocmask(SIG_SETMASK, &set, &oset); 32777c478bd9Sstevel@tonic-gate } 32787c478bd9Sstevel@tonic-gate } 32797c478bd9Sstevel@tonic-gate 32807c478bd9Sstevel@tonic-gate /* 32817c478bd9Sstevel@tonic-gate * Assorted functions to print help text. 32827c478bd9Sstevel@tonic-gate */ 32837c478bd9Sstevel@tonic-gate #define puts_tr(s) (void) puts(gettext(s)) 32847c478bd9Sstevel@tonic-gate 32857c478bd9Sstevel@tonic-gate static void 32867c478bd9Sstevel@tonic-gate doattrhelp() 32877c478bd9Sstevel@tonic-gate { 32887c478bd9Sstevel@tonic-gate int i; 32897c478bd9Sstevel@tonic-gate 32907c478bd9Sstevel@tonic-gate puts_tr("\nSA attributes:"); 32917c478bd9Sstevel@tonic-gate 32927c478bd9Sstevel@tonic-gate for (i = 0; tokens[i].string != NULL; i++) { 32937c478bd9Sstevel@tonic-gate if (i%3 == 0) 32947c478bd9Sstevel@tonic-gate (void) printf("\n"); 32957c478bd9Sstevel@tonic-gate (void) printf(" %-15.15s", tokens[i].string); 32967c478bd9Sstevel@tonic-gate } 32977c478bd9Sstevel@tonic-gate (void) printf("\n"); 32987c478bd9Sstevel@tonic-gate } 32997c478bd9Sstevel@tonic-gate 33007c478bd9Sstevel@tonic-gate static void 33017c478bd9Sstevel@tonic-gate dohelpcmd(char *cmds) 33027c478bd9Sstevel@tonic-gate { 33037c478bd9Sstevel@tonic-gate int cmd; 33047c478bd9Sstevel@tonic-gate 33057c478bd9Sstevel@tonic-gate if (strcmp(cmds, "attr") == 0) { 33067c478bd9Sstevel@tonic-gate doattrhelp(); 33077c478bd9Sstevel@tonic-gate return; 33087c478bd9Sstevel@tonic-gate } 33097c478bd9Sstevel@tonic-gate 33107c478bd9Sstevel@tonic-gate cmd = parsecmd(cmds); 33117c478bd9Sstevel@tonic-gate switch (cmd) { 33127c478bd9Sstevel@tonic-gate case CMD_UPDATE: 33137c478bd9Sstevel@tonic-gate puts_tr("update - Update an existing SA"); 33147c478bd9Sstevel@tonic-gate break; 331538d95a78Smarkfen case CMD_UPDATE_PAIR: 331638d95a78Smarkfen puts_tr("update-pair - Update an existing pair of SA's"); 331738d95a78Smarkfen break; 33187c478bd9Sstevel@tonic-gate case CMD_ADD: 33197c478bd9Sstevel@tonic-gate puts_tr("add - Add a new security association (SA)"); 33207c478bd9Sstevel@tonic-gate break; 33217c478bd9Sstevel@tonic-gate case CMD_DELETE: 33227c478bd9Sstevel@tonic-gate puts_tr("delete - Delete an SA"); 33237c478bd9Sstevel@tonic-gate break; 332438d95a78Smarkfen case CMD_DELETE_PAIR: 332538d95a78Smarkfen puts_tr("delete-pair - Delete a pair of SA's"); 332638d95a78Smarkfen break; 33277c478bd9Sstevel@tonic-gate case CMD_GET: 33287c478bd9Sstevel@tonic-gate puts_tr("get - Display an SA"); 33297c478bd9Sstevel@tonic-gate break; 33307c478bd9Sstevel@tonic-gate case CMD_FLUSH: 33317c478bd9Sstevel@tonic-gate puts_tr("flush - Delete all SAs"); 3332bfe6f8f5SVladimir Kotal puts_tr(""); 3333bfe6f8f5SVladimir Kotal puts_tr("Optional arguments:"); 3334bfe6f8f5SVladimir Kotal puts_tr("all delete all SAs"); 3335bfe6f8f5SVladimir Kotal puts_tr("esp delete just ESP SAs"); 3336bfe6f8f5SVladimir Kotal puts_tr("ah delete just AH SAs"); 3337bfe6f8f5SVladimir Kotal puts_tr("<number> delete just SAs with type given by number"); 3338bfe6f8f5SVladimir Kotal puts_tr(""); 33397c478bd9Sstevel@tonic-gate break; 33407c478bd9Sstevel@tonic-gate case CMD_DUMP: 33417c478bd9Sstevel@tonic-gate puts_tr("dump - Display all SAs"); 3342bfe6f8f5SVladimir Kotal puts_tr(""); 3343bfe6f8f5SVladimir Kotal puts_tr("Optional arguments:"); 3344bfe6f8f5SVladimir Kotal puts_tr("all display all SAs"); 3345bfe6f8f5SVladimir Kotal puts_tr("esp display just ESP SAs"); 3346bfe6f8f5SVladimir Kotal puts_tr("ah display just AH SAs"); 3347bfe6f8f5SVladimir Kotal puts_tr("<number> display just SAs with type " 3348bfe6f8f5SVladimir Kotal "given by number"); 3349bfe6f8f5SVladimir Kotal puts_tr(""); 33507c478bd9Sstevel@tonic-gate break; 33517c478bd9Sstevel@tonic-gate case CMD_MONITOR: 33527c478bd9Sstevel@tonic-gate puts_tr("monitor - Monitor all PF_KEY reply messages."); 33537c478bd9Sstevel@tonic-gate break; 33547c478bd9Sstevel@tonic-gate case CMD_PMONITOR: 33557c478bd9Sstevel@tonic-gate puts_tr( 33567c478bd9Sstevel@tonic-gate "pmonitor, passive_monitor - Monitor PF_KEY messages that"); 33577c478bd9Sstevel@tonic-gate puts_tr( 33587c478bd9Sstevel@tonic-gate " reply to all PF_KEY sockets."); 33597c478bd9Sstevel@tonic-gate break; 33607c478bd9Sstevel@tonic-gate 33617c478bd9Sstevel@tonic-gate case CMD_QUIT: 33627c478bd9Sstevel@tonic-gate puts_tr("quit, exit - Exit the program"); 33637c478bd9Sstevel@tonic-gate break; 33647c478bd9Sstevel@tonic-gate case CMD_SAVE: 33657c478bd9Sstevel@tonic-gate puts_tr("save - Saves all SAs to a file"); 33667c478bd9Sstevel@tonic-gate break; 33677c478bd9Sstevel@tonic-gate case CMD_HELP: 33687c478bd9Sstevel@tonic-gate puts_tr("help - Display list of commands"); 33697c478bd9Sstevel@tonic-gate puts_tr("help <cmd> - Display help for command"); 33707c478bd9Sstevel@tonic-gate puts_tr("help attr - Display possible SA attributes"); 33717c478bd9Sstevel@tonic-gate break; 33727c478bd9Sstevel@tonic-gate default: 33737c478bd9Sstevel@tonic-gate (void) printf(gettext("%s: Unknown command\n"), cmds); 33747c478bd9Sstevel@tonic-gate break; 33757c478bd9Sstevel@tonic-gate } 33767c478bd9Sstevel@tonic-gate } 33777c478bd9Sstevel@tonic-gate 33787c478bd9Sstevel@tonic-gate 33797c478bd9Sstevel@tonic-gate static void 33807c478bd9Sstevel@tonic-gate dohelp(char *cmds) 33817c478bd9Sstevel@tonic-gate { 33827c478bd9Sstevel@tonic-gate if (cmds != NULL) { 33837c478bd9Sstevel@tonic-gate dohelpcmd(cmds); 33847c478bd9Sstevel@tonic-gate return; 33857c478bd9Sstevel@tonic-gate } 33867c478bd9Sstevel@tonic-gate puts_tr("Commands"); 33877c478bd9Sstevel@tonic-gate puts_tr("--------"); 33887c478bd9Sstevel@tonic-gate puts_tr("?, help - Display this list"); 33897c478bd9Sstevel@tonic-gate puts_tr("help <cmd> - Display help for command"); 33907c478bd9Sstevel@tonic-gate puts_tr("help attr - Display possible SA attributes"); 33917c478bd9Sstevel@tonic-gate puts_tr("quit, exit - Exit the program"); 33927c478bd9Sstevel@tonic-gate puts_tr("monitor - Monitor all PF_KEY reply messages."); 33937c478bd9Sstevel@tonic-gate puts_tr("pmonitor, passive_monitor - Monitor PF_KEY messages that"); 33947c478bd9Sstevel@tonic-gate puts_tr(" reply to all PF_KEY sockets."); 33957c478bd9Sstevel@tonic-gate puts_tr(""); 33967c478bd9Sstevel@tonic-gate puts_tr("The following commands are of the form:"); 33977c478bd9Sstevel@tonic-gate puts_tr(" <command> {SA type} {attribute value}*"); 33987c478bd9Sstevel@tonic-gate puts_tr(""); 33997c478bd9Sstevel@tonic-gate puts_tr("add (interactive only) - Add a new security association (SA)"); 34007c478bd9Sstevel@tonic-gate puts_tr("update (interactive only) - Update an existing SA"); 340138d95a78Smarkfen puts_tr("update-pair (interactive only) - Update an existing SA pair"); 34027c478bd9Sstevel@tonic-gate puts_tr("delete - Delete an SA"); 340338d95a78Smarkfen puts_tr("delete-pair - Delete an SA pair"); 34047c478bd9Sstevel@tonic-gate puts_tr("get - Display an SA"); 34057c478bd9Sstevel@tonic-gate puts_tr("flush - Delete all SAs"); 34067c478bd9Sstevel@tonic-gate puts_tr("dump - Display all SAs"); 34077c478bd9Sstevel@tonic-gate puts_tr("save - Saves all SAs to a file"); 34087c478bd9Sstevel@tonic-gate } 34097c478bd9Sstevel@tonic-gate 34107c478bd9Sstevel@tonic-gate /* 34117c478bd9Sstevel@tonic-gate * "Parse" a command line from argv. 34127c478bd9Sstevel@tonic-gate */ 34137c478bd9Sstevel@tonic-gate static void 341425e435e0Spwernau parseit(int argc, char *argv[], char *ebuf, boolean_t read_cmdfile) 34157c478bd9Sstevel@tonic-gate { 34167c478bd9Sstevel@tonic-gate int cmd, satype; 3417e3320f40Smarkfen char *ep = NULL; 34187c478bd9Sstevel@tonic-gate 34197c478bd9Sstevel@tonic-gate if (argc == 0) 34207c478bd9Sstevel@tonic-gate return; 34217c478bd9Sstevel@tonic-gate cmd = parsecmd(*argv++); 34227c478bd9Sstevel@tonic-gate 342325e435e0Spwernau /* 342425e435e0Spwernau * Some commands loop forever and should only be run from the command 342525e435e0Spwernau * line, they should never be run from a command file as this may 342625e435e0Spwernau * be used at boot time. 342725e435e0Spwernau */ 34287c478bd9Sstevel@tonic-gate switch (cmd) { 34297c478bd9Sstevel@tonic-gate case CMD_HELP: 343025e435e0Spwernau if (read_cmdfile) 343125e435e0Spwernau ERROR(ep, ebuf, gettext("Help not appropriate in " 343225e435e0Spwernau "config file.")); 343325e435e0Spwernau else 343425e435e0Spwernau dohelp(*argv); 34357c478bd9Sstevel@tonic-gate return; 34367c478bd9Sstevel@tonic-gate case CMD_MONITOR: 343725e435e0Spwernau if (read_cmdfile) 343825e435e0Spwernau ERROR(ep, ebuf, gettext("Monitor not appropriate in " 343925e435e0Spwernau "config file.")); 3440bfe6f8f5SVladimir Kotal else { 344125e435e0Spwernau domonitor(B_FALSE); 3442bfe6f8f5SVladimir Kotal /* 3443bfe6f8f5SVladimir Kotal * Return from the function in interactive mode to 3444bfe6f8f5SVladimir Kotal * avoid error message in the next switch statement. 3445bfe6f8f5SVladimir Kotal * Also print newline to prevent prompt clobbering. 3446bfe6f8f5SVladimir Kotal * The same is done for CMD_PMONITOR. 3447bfe6f8f5SVladimir Kotal */ 3448bfe6f8f5SVladimir Kotal if (interactive) { 3449bfe6f8f5SVladimir Kotal (void) printf("\n"); 3450bfe6f8f5SVladimir Kotal return; 3451bfe6f8f5SVladimir Kotal } 3452bfe6f8f5SVladimir Kotal } 34537c478bd9Sstevel@tonic-gate break; 34547c478bd9Sstevel@tonic-gate case CMD_PMONITOR: 345525e435e0Spwernau if (read_cmdfile) 345625e435e0Spwernau ERROR(ep, ebuf, gettext("Monitor not appropriate in " 345725e435e0Spwernau "config file.")); 3458bfe6f8f5SVladimir Kotal else { 345925e435e0Spwernau domonitor(B_TRUE); 3460bfe6f8f5SVladimir Kotal if (interactive) { 3461bfe6f8f5SVladimir Kotal (void) printf("\n"); 3462bfe6f8f5SVladimir Kotal return; 3463bfe6f8f5SVladimir Kotal } 3464bfe6f8f5SVladimir Kotal } 34657c478bd9Sstevel@tonic-gate break; 34667c478bd9Sstevel@tonic-gate case CMD_QUIT: 3467e3320f40Smarkfen EXIT_OK(NULL); 34687c478bd9Sstevel@tonic-gate } 34697c478bd9Sstevel@tonic-gate 347025e435e0Spwernau handle_errors(ep, ebuf, B_FALSE, B_FALSE); 347125e435e0Spwernau 3472e3320f40Smarkfen satype = parsesatype(*argv, ebuf); 34737c478bd9Sstevel@tonic-gate 34747c478bd9Sstevel@tonic-gate if (satype != SADB_SATYPE_UNSPEC) { 34757c478bd9Sstevel@tonic-gate argv++; 34767c478bd9Sstevel@tonic-gate } else { 34777c478bd9Sstevel@tonic-gate /* 34787c478bd9Sstevel@tonic-gate * You must specify either "all" or a specific SA type 34797c478bd9Sstevel@tonic-gate * for the "save" command. 34807c478bd9Sstevel@tonic-gate */ 34817c478bd9Sstevel@tonic-gate if (cmd == CMD_SAVE) 34827c478bd9Sstevel@tonic-gate if (*argv == NULL) { 3483e3320f40Smarkfen FATAL(ep, ebuf, gettext( 3484e3320f40Smarkfen "Must specify a specific " 3485e3320f40Smarkfen "SA type for save.\n")); 34867c478bd9Sstevel@tonic-gate } else { 34877c478bd9Sstevel@tonic-gate argv++; 34887c478bd9Sstevel@tonic-gate } 34897c478bd9Sstevel@tonic-gate } 34907c478bd9Sstevel@tonic-gate 34917c478bd9Sstevel@tonic-gate switch (cmd) { 34927c478bd9Sstevel@tonic-gate case CMD_FLUSH: 3493bfe6f8f5SVladimir Kotal if (argc > 2) { 3494bfe6f8f5SVladimir Kotal ERROR(ep, ebuf, gettext("Too many arguments for " 3495bfe6f8f5SVladimir Kotal "flush command")); 3496bfe6f8f5SVladimir Kotal handle_errors(ep, ebuf, 3497bfe6f8f5SVladimir Kotal interactive ? B_TRUE : B_FALSE, B_FALSE); 3498bfe6f8f5SVladimir Kotal } 349925e435e0Spwernau if (!cflag) 350025e435e0Spwernau doflush(satype); 350125e435e0Spwernau /* 350225e435e0Spwernau * If this was called because of an entry in a cmd file 350325e435e0Spwernau * then this action needs to be counted to prevent 350425e435e0Spwernau * do_interactive() treating this as an error. 350525e435e0Spwernau */ 350625e435e0Spwernau lines_added++; 35077c478bd9Sstevel@tonic-gate break; 35087c478bd9Sstevel@tonic-gate case CMD_ADD: 35097c478bd9Sstevel@tonic-gate case CMD_UPDATE: 351038d95a78Smarkfen case CMD_UPDATE_PAIR: 35117c478bd9Sstevel@tonic-gate /* 35127c478bd9Sstevel@tonic-gate * NOTE: Shouldn't allow ADDs or UPDATEs with keying material 35137c478bd9Sstevel@tonic-gate * from the command line. 35147c478bd9Sstevel@tonic-gate */ 35157c478bd9Sstevel@tonic-gate if (!interactive) { 35167c478bd9Sstevel@tonic-gate errx(1, gettext( 3517e3320f40Smarkfen "can't do ADD or UPDATE from the command line.\n")); 35187c478bd9Sstevel@tonic-gate } 35197c478bd9Sstevel@tonic-gate if (satype == SADB_SATYPE_UNSPEC) { 3520e3320f40Smarkfen FATAL(ep, ebuf, gettext( 3521e3320f40Smarkfen "Must specify a specific SA type.")); 35227c478bd9Sstevel@tonic-gate /* NOTREACHED */ 35237c478bd9Sstevel@tonic-gate } 35247c478bd9Sstevel@tonic-gate /* Parse for extensions, including keying material. */ 3525e3320f40Smarkfen doaddup(cmd, satype, argv, ebuf); 35267c478bd9Sstevel@tonic-gate break; 35277c478bd9Sstevel@tonic-gate case CMD_DELETE: 352838d95a78Smarkfen case CMD_DELETE_PAIR: 35297c478bd9Sstevel@tonic-gate case CMD_GET: 35307c478bd9Sstevel@tonic-gate if (satype == SADB_SATYPE_UNSPEC) { 3531e3320f40Smarkfen FATAL(ep, ebuf, gettext( 3532e3320f40Smarkfen "Must specify a single SA type.")); 35337c478bd9Sstevel@tonic-gate /* NOTREACHED */ 35347c478bd9Sstevel@tonic-gate } 35357c478bd9Sstevel@tonic-gate /* Parse for bare minimum to locate an SA. */ 3536e3320f40Smarkfen dodelget(cmd, satype, argv, ebuf); 35377c478bd9Sstevel@tonic-gate break; 35387c478bd9Sstevel@tonic-gate case CMD_DUMP: 353925e435e0Spwernau if (read_cmdfile) 354025e435e0Spwernau ERROR(ep, ebuf, gettext("Dump not appropriate in " 354125e435e0Spwernau "config file.")); 3542bfe6f8f5SVladimir Kotal else { 3543bfe6f8f5SVladimir Kotal if (argc > 2) { 3544bfe6f8f5SVladimir Kotal ERROR(ep, ebuf, gettext("Too many arguments " 3545bfe6f8f5SVladimir Kotal "for dump command")); 3546bfe6f8f5SVladimir Kotal handle_errors(ep, ebuf, 3547bfe6f8f5SVladimir Kotal interactive ? B_TRUE : B_FALSE, B_FALSE); 3548bfe6f8f5SVladimir Kotal } 354925e435e0Spwernau dodump(satype, NULL); 3550bfe6f8f5SVladimir Kotal } 35517c478bd9Sstevel@tonic-gate break; 35527c478bd9Sstevel@tonic-gate case CMD_SAVE: 355325e435e0Spwernau if (read_cmdfile) { 355425e435e0Spwernau ERROR(ep, ebuf, gettext("Save not appropriate in " 355525e435e0Spwernau "config file.")); 355625e435e0Spwernau } else { 355725e435e0Spwernau mask_signals(B_FALSE); /* Mask signals */ 355825e435e0Spwernau dodump(satype, opensavefile(argv[0])); 355925e435e0Spwernau mask_signals(B_TRUE); /* Unmask signals */ 356025e435e0Spwernau } 35617c478bd9Sstevel@tonic-gate break; 35627c478bd9Sstevel@tonic-gate default: 3563e3320f40Smarkfen warnx(gettext("Unknown command (%s).\n"), 35647c478bd9Sstevel@tonic-gate *(argv - ((satype == SADB_SATYPE_UNSPEC) ? 1 : 2))); 35657c478bd9Sstevel@tonic-gate usage(); 35667c478bd9Sstevel@tonic-gate } 356725e435e0Spwernau handle_errors(ep, ebuf, B_FALSE, B_FALSE); 35687c478bd9Sstevel@tonic-gate } 35697c478bd9Sstevel@tonic-gate 35707c478bd9Sstevel@tonic-gate int 35717c478bd9Sstevel@tonic-gate main(int argc, char *argv[]) 35727c478bd9Sstevel@tonic-gate { 35737c478bd9Sstevel@tonic-gate int ch; 35747c478bd9Sstevel@tonic-gate FILE *infile = stdin, *savefile; 35757c478bd9Sstevel@tonic-gate boolean_t dosave = B_FALSE, readfile = B_FALSE; 3576e3320f40Smarkfen char *configfile = NULL; 357723c73eccSpwernau struct stat sbuf; 35789c2c14abSThejaswini Singarajipura int bootflags; 35797c478bd9Sstevel@tonic-gate 35807c478bd9Sstevel@tonic-gate (void) setlocale(LC_ALL, ""); 35817c478bd9Sstevel@tonic-gate #if !defined(TEXT_DOMAIN) 35827c478bd9Sstevel@tonic-gate #define TEXT_DOMAIN "SYS_TEST" 35837c478bd9Sstevel@tonic-gate #endif 35847c478bd9Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN); 35857c478bd9Sstevel@tonic-gate 3586e3320f40Smarkfen /* 3587e3320f40Smarkfen * Check to see if the command is being run from smf(5). 3588e3320f40Smarkfen */ 3589e3320f40Smarkfen my_fmri = getenv("SMF_FMRI"); 3590e3320f40Smarkfen 35917c478bd9Sstevel@tonic-gate openlog("ipseckey", LOG_CONS, LOG_AUTH); 35927c478bd9Sstevel@tonic-gate if (getuid() != 0) { 3593e3320f40Smarkfen errx(1, "Insufficient privileges to run ipseckey."); 35947c478bd9Sstevel@tonic-gate } 35957c478bd9Sstevel@tonic-gate 35967c478bd9Sstevel@tonic-gate /* umask me to paranoid, I only want to create files read-only */ 35977c478bd9Sstevel@tonic-gate (void) umask((mode_t)00377); 35987c478bd9Sstevel@tonic-gate 3599e3320f40Smarkfen while ((ch = getopt(argc, argv, "pnvf:s:c:")) != EOF) 36007c478bd9Sstevel@tonic-gate switch (ch) { 36017c478bd9Sstevel@tonic-gate case 'p': 36027c478bd9Sstevel@tonic-gate pflag = B_TRUE; 36037c478bd9Sstevel@tonic-gate break; 36047c478bd9Sstevel@tonic-gate case 'n': 36057c478bd9Sstevel@tonic-gate nflag = B_TRUE; 36067c478bd9Sstevel@tonic-gate break; 36077c478bd9Sstevel@tonic-gate case 'v': 36087c478bd9Sstevel@tonic-gate vflag = B_TRUE; 36097c478bd9Sstevel@tonic-gate break; 3610e3320f40Smarkfen case 'c': 3611e3320f40Smarkfen cflag = B_TRUE; 3612e3320f40Smarkfen /* FALLTHRU */ 36137c478bd9Sstevel@tonic-gate case 'f': 36147c478bd9Sstevel@tonic-gate if (dosave) 36157c478bd9Sstevel@tonic-gate usage(); 36167c478bd9Sstevel@tonic-gate infile = fopen(optarg, "r"); 3617e3320f40Smarkfen if (infile == NULL) { 3618e3320f40Smarkfen EXIT_BADCONFIG2("Unable to open configuration " 3619e3320f40Smarkfen "file: %s\n", optarg); 3620e3320f40Smarkfen } 362123c73eccSpwernau /* 362223c73eccSpwernau * Check file permissions/ownership and warn or 362323c73eccSpwernau * fail depending on state of SMF control. 362423c73eccSpwernau */ 362523c73eccSpwernau if (fstat(fileno(infile), &sbuf) == -1) { 362623c73eccSpwernau (void) fclose(infile); 362723c73eccSpwernau EXIT_BADCONFIG2("Unable to stat configuration " 362823c73eccSpwernau "file: %s\n", optarg); 362923c73eccSpwernau } 363023c73eccSpwernau if (INSECURE_PERMS(sbuf)) { 363123c73eccSpwernau if (my_fmri != NULL) { 363223c73eccSpwernau (void) fclose(infile); 363323c73eccSpwernau EXIT_BADCONFIG2("Config file " 363423c73eccSpwernau "%s has insecure permissions.", 363523c73eccSpwernau optarg); 363623c73eccSpwernau } else { 363723c73eccSpwernau (void) fprintf(stderr, "%s %s\n", 363823c73eccSpwernau optarg, gettext( 363923c73eccSpwernau "has insecure permissions, will be " 364023c73eccSpwernau "rejected in permanent config.")); 364123c73eccSpwernau } 364223c73eccSpwernau } 3643e3320f40Smarkfen configfile = strdup(optarg); 36447c478bd9Sstevel@tonic-gate readfile = B_TRUE; 36457c478bd9Sstevel@tonic-gate break; 36467c478bd9Sstevel@tonic-gate case 's': 36477c478bd9Sstevel@tonic-gate if (readfile) 36487c478bd9Sstevel@tonic-gate usage(); 36497c478bd9Sstevel@tonic-gate dosave = B_TRUE; 36507c478bd9Sstevel@tonic-gate savefile = opensavefile(optarg); 36517c478bd9Sstevel@tonic-gate break; 36527c478bd9Sstevel@tonic-gate default: 36537c478bd9Sstevel@tonic-gate usage(); 36547c478bd9Sstevel@tonic-gate } 36557c478bd9Sstevel@tonic-gate 36567c478bd9Sstevel@tonic-gate argc -= optind; 36577c478bd9Sstevel@tonic-gate argv += optind; 36587c478bd9Sstevel@tonic-gate 36597c478bd9Sstevel@tonic-gate mypid = getpid(); 36607c478bd9Sstevel@tonic-gate 36617c478bd9Sstevel@tonic-gate keysock = socket(PF_KEY, SOCK_RAW, PF_KEY_V2); 36627c478bd9Sstevel@tonic-gate 3663e3320f40Smarkfen if (keysock == -1) { 3664e3320f40Smarkfen if (errno == EPERM) { 3665e3320f40Smarkfen EXIT_BADPERM("Insufficient privileges to open " 3666e3320f40Smarkfen "PF_KEY socket.\n"); 3667e3320f40Smarkfen } else { 3668e3320f40Smarkfen /* some other reason */ 3669e3320f40Smarkfen EXIT_FATAL("Opening PF_KEY socket"); 3670e3320f40Smarkfen } 3671e3320f40Smarkfen } 36727c478bd9Sstevel@tonic-gate 36739c2c14abSThejaswini Singarajipura if ((_cladm(CL_INITIALIZE, CL_GET_BOOTFLAG, &bootflags) != 0) || 36749c2c14abSThejaswini Singarajipura (bootflags & CLUSTER_BOOTED)) { 36759c2c14abSThejaswini Singarajipura in_cluster_mode = B_TRUE; 36769c2c14abSThejaswini Singarajipura cluster_socket = socket(AF_INET, SOCK_DGRAM, 0); 36779c2c14abSThejaswini Singarajipura cli_addr.sin_family = AF_INET; 36789c2c14abSThejaswini Singarajipura cli_addr.sin_addr.s_addr = INADDR_LOOPBACK; 36799c2c14abSThejaswini Singarajipura cli_addr.sin_port = htons(CLUSTER_UDP_PORT); 36809c2c14abSThejaswini Singarajipura } 36819c2c14abSThejaswini Singarajipura 36827c478bd9Sstevel@tonic-gate if (dosave) { 36837c478bd9Sstevel@tonic-gate mask_signals(B_FALSE); /* Mask signals */ 36847c478bd9Sstevel@tonic-gate dodump(SADB_SATYPE_UNSPEC, savefile); 36857c478bd9Sstevel@tonic-gate mask_signals(B_TRUE); /* Unmask signals */ 3686e3320f40Smarkfen EXIT_OK(NULL); 36877c478bd9Sstevel@tonic-gate } 36887c478bd9Sstevel@tonic-gate 3689e3320f40Smarkfen /* 3690e3320f40Smarkfen * When run from smf(5) flush any existing SA's first 3691e3320f40Smarkfen * otherwise you will end up in maintenance mode. 3692e3320f40Smarkfen */ 3693e3320f40Smarkfen if ((my_fmri != NULL) && readfile) { 3694e3320f40Smarkfen (void) fprintf(stdout, gettext( 3695e3320f40Smarkfen "Flushing existing SA's before adding new SA's\n")); 3696e3320f40Smarkfen (void) fflush(stdout); 3697e3320f40Smarkfen doflush(SADB_SATYPE_UNSPEC); 3698e3320f40Smarkfen } 3699bfe6f8f5SVladimir Kotal if (infile != stdin || argc == 0) { 37007c478bd9Sstevel@tonic-gate /* Go into interactive mode here. */ 3701e3320f40Smarkfen do_interactive(infile, configfile, "ipseckey> ", my_fmri, 3702bfe6f8f5SVladimir Kotal parseit, no_match); 37037c478bd9Sstevel@tonic-gate } 370425e435e0Spwernau parseit(argc, argv, NULL, B_FALSE); 37057c478bd9Sstevel@tonic-gate 37067c478bd9Sstevel@tonic-gate return (0); 37077c478bd9Sstevel@tonic-gate } 3708