17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate  * CDDL HEADER START
37c478bd9Sstevel@tonic-gate  *
47c478bd9Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
58810c16bSdanmcd  * Common Development and Distribution License (the "License").
68810c16bSdanmcd  * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate  *
87c478bd9Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate  * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate  * and limitations under the License.
127c478bd9Sstevel@tonic-gate  *
137c478bd9Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate  *
197c478bd9Sstevel@tonic-gate  * CDDL HEADER END
207c478bd9Sstevel@tonic-gate  */
217c478bd9Sstevel@tonic-gate /*
22*e3320f40Smarkfen  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
237c478bd9Sstevel@tonic-gate  * Use is subject to license terms.
247c478bd9Sstevel@tonic-gate  */
257c478bd9Sstevel@tonic-gate 
267c478bd9Sstevel@tonic-gate /*
277c478bd9Sstevel@tonic-gate  * NOTE:I'm trying to use "struct sadb_foo" instead of "sadb_foo_t"
287c478bd9Sstevel@tonic-gate  *	as a maximal PF_KEY portability test.
297c478bd9Sstevel@tonic-gate  *
307c478bd9Sstevel@tonic-gate  *	Also, this is a deliberately single-threaded app, also for portability
317c478bd9Sstevel@tonic-gate  *	to systems without POSIX threads.
327c478bd9Sstevel@tonic-gate  */
337c478bd9Sstevel@tonic-gate 
347c478bd9Sstevel@tonic-gate #pragma ident	"%Z%%M%	%I%	%E% SMI"
357c478bd9Sstevel@tonic-gate 
367c478bd9Sstevel@tonic-gate 
377c478bd9Sstevel@tonic-gate #include <sys/types.h>
387c478bd9Sstevel@tonic-gate #include <sys/stat.h>
397c478bd9Sstevel@tonic-gate #include <sys/socket.h>
407c478bd9Sstevel@tonic-gate #include <sys/sysmacros.h>
417c478bd9Sstevel@tonic-gate #include <sys/fcntl.h>
427c478bd9Sstevel@tonic-gate #include <net/pfkeyv2.h>
437c478bd9Sstevel@tonic-gate #include <arpa/inet.h>
447c478bd9Sstevel@tonic-gate #include <netinet/in.h>
457c478bd9Sstevel@tonic-gate #include <sys/uio.h>
467c478bd9Sstevel@tonic-gate 
477c478bd9Sstevel@tonic-gate #include <syslog.h>
487c478bd9Sstevel@tonic-gate #include <signal.h>
497c478bd9Sstevel@tonic-gate #include <unistd.h>
507c478bd9Sstevel@tonic-gate #include <limits.h>
517c478bd9Sstevel@tonic-gate #include <stdlib.h>
527c478bd9Sstevel@tonic-gate #include <stdio.h>
53*e3320f40Smarkfen #include <stdarg.h>
547c478bd9Sstevel@tonic-gate #include <netdb.h>
557c478bd9Sstevel@tonic-gate #include <pwd.h>
567c478bd9Sstevel@tonic-gate #include <errno.h>
577c478bd9Sstevel@tonic-gate #include <libintl.h>
587c478bd9Sstevel@tonic-gate #include <locale.h>
597c478bd9Sstevel@tonic-gate #include <fcntl.h>
607c478bd9Sstevel@tonic-gate #include <strings.h>
617c478bd9Sstevel@tonic-gate #include <ctype.h>
627c478bd9Sstevel@tonic-gate 
637c478bd9Sstevel@tonic-gate #include <ipsec_util.h>
647c478bd9Sstevel@tonic-gate 
657c478bd9Sstevel@tonic-gate static int keysock;
667c478bd9Sstevel@tonic-gate static uint32_t seq;
677c478bd9Sstevel@tonic-gate static pid_t mypid;
687c478bd9Sstevel@tonic-gate static boolean_t vflag = B_FALSE;	/* Verbose? */
69*e3320f40Smarkfen static boolean_t cflag = B_FALSE;	/* Check Only */
70*e3320f40Smarkfen 
71*e3320f40Smarkfen char *my_fmri = NULL;
72*e3320f40Smarkfen FILE *debugfile = stdout;
737c478bd9Sstevel@tonic-gate 
747c478bd9Sstevel@tonic-gate #define	MAX_GET_SIZE	1024
75*e3320f40Smarkfen /*
76*e3320f40Smarkfen  * WARN() and ERROR() do the same thing really, with ERROR() the fucntion
77*e3320f40Smarkfen  * that prints the error buffer needs to be called at the end of a code block
78*e3320f40Smarkfen  * This will print out all accumulated errors before bailing. The WARN()
79*e3320f40Smarkfen  * macro calls handle_errors() in such a way that it prints the message
80*e3320f40Smarkfen  * then continues.
81*e3320f40Smarkfen  * If the FATAL() macro used call handle_errors() immediately.
82*e3320f40Smarkfen  */
83*e3320f40Smarkfen #define	ERROR(x, y, z)  x = record_error(x, y, z)
84*e3320f40Smarkfen #define	ERROR1(w, x, y, z)  w = record_error(w, x, y, z)
85*e3320f40Smarkfen #define	ERROR2(v, w, x, y, z)  v = record_error(v, w, x, y, z)
86*e3320f40Smarkfen #define	WARN(x, y, z) ERROR(x, y, z);\
87*e3320f40Smarkfen 	handle_errors(x, NULL, B_FALSE, B_FALSE); x = NULL
88*e3320f40Smarkfen #define	WARN1(w, x, y, z) ERROR1(w, x, y, z);\
89*e3320f40Smarkfen 	handle_errors(w, NULL, B_FALSE, B_FALSE); w = NULL
90*e3320f40Smarkfen #define	WARN2(v, w, x, y, z) ERROR2(v, w, x, y, z);\
91*e3320f40Smarkfen 	handle_errors(v, NULL, B_FALSE, B_FALSE); v = NULL
92*e3320f40Smarkfen #define	FATAL(x, y, z) ERROR(x, y, z);\
93*e3320f40Smarkfen 	handle_errors(x, y, B_TRUE, B_TRUE)
94*e3320f40Smarkfen #define	FATAL1(w, x, y, z) ERROR1(w, x, y, z);\
95*e3320f40Smarkfen 	handle_errors(w, x, B_TRUE, B_TRUE)
96*e3320f40Smarkfen 
977c478bd9Sstevel@tonic-gate /* Defined as a uint64_t array for alignment purposes. */
987c478bd9Sstevel@tonic-gate static uint64_t get_buffer[MAX_GET_SIZE];
997c478bd9Sstevel@tonic-gate 
1007c478bd9Sstevel@tonic-gate /*
101*e3320f40Smarkfen  * Create/Grow a buffer large enough to hold error messages. If *ebuf
102*e3320f40Smarkfen  * is not NULL then it will contain a copy of the command line that
103*e3320f40Smarkfen  * triggered the error/warning, copy this into a new buffer or
104*e3320f40Smarkfen  * append new messages to the existing buffer.
105*e3320f40Smarkfen  */
106*e3320f40Smarkfen /*PRINTFLIKE1*/
107*e3320f40Smarkfen char *
108*e3320f40Smarkfen record_error(char *ep, char *ebuf, char *fmt, ...)
109*e3320f40Smarkfen {
110*e3320f40Smarkfen 	char *err_ptr;
111*e3320f40Smarkfen 	char tmp_buff[1024];
112*e3320f40Smarkfen 	va_list ap;
113*e3320f40Smarkfen 	int length = 0;
114*e3320f40Smarkfen 	err_ptr = ep;
115*e3320f40Smarkfen 
116*e3320f40Smarkfen 	va_start(ap, fmt);
117*e3320f40Smarkfen 	(void) vsnprintf(tmp_buff, sizeof (tmp_buff), fmt, ap);
118*e3320f40Smarkfen 	va_end(ap);
119*e3320f40Smarkfen 
120*e3320f40Smarkfen 	if (ep == NULL) {
121*e3320f40Smarkfen 		/*
122*e3320f40Smarkfen 		 * This is the first error to record, get a
123*e3320f40Smarkfen 		 * new buffer, copy in the command line that
124*e3320f40Smarkfen 		 * triggered this error/warning.
125*e3320f40Smarkfen 		 */
126*e3320f40Smarkfen 		if (ebuf != NULL) {
127*e3320f40Smarkfen 			length = strlen(ebuf);
128*e3320f40Smarkfen 			err_ptr = calloc(length, sizeof (char));
129*e3320f40Smarkfen 			if (err_ptr == NULL)
130*e3320f40Smarkfen 				Bail("calloc() failed");
131*e3320f40Smarkfen 			(void) strlcpy(err_ptr, ebuf, length);
132*e3320f40Smarkfen 		}
133*e3320f40Smarkfen 	} else {
134*e3320f40Smarkfen 		length = strlen(ep);
135*e3320f40Smarkfen 	}
136*e3320f40Smarkfen 	length += strlen(tmp_buff);
137*e3320f40Smarkfen 	/* There is a new line character */
138*e3320f40Smarkfen 	length++;
139*e3320f40Smarkfen 	err_ptr = realloc(err_ptr, length);
140*e3320f40Smarkfen 	if (err_ptr == NULL)
141*e3320f40Smarkfen 		Bail("realloc() failure");
142*e3320f40Smarkfen 	(void) strlcat(err_ptr, tmp_buff, length);
143*e3320f40Smarkfen 	return (err_ptr);
144*e3320f40Smarkfen }
145*e3320f40Smarkfen 
146*e3320f40Smarkfen /*
147*e3320f40Smarkfen  * Print usage message.
1487c478bd9Sstevel@tonic-gate  */
1497c478bd9Sstevel@tonic-gate static void
1507c478bd9Sstevel@tonic-gate usage(void)
1517c478bd9Sstevel@tonic-gate {
1527c478bd9Sstevel@tonic-gate 	if (!interactive) {
1537c478bd9Sstevel@tonic-gate 		(void) fprintf(stderr, gettext("Usage:\t"
1547c478bd9Sstevel@tonic-gate 		    "ipseckey [ -nvp ] | cmd [sa_type] [extfield value]*\n"));
1557c478bd9Sstevel@tonic-gate 		(void) fprintf(stderr,
1567c478bd9Sstevel@tonic-gate 		    gettext("\tipseckey [ -nvp ] -f infile\n"));
1577c478bd9Sstevel@tonic-gate 		(void) fprintf(stderr,
1587c478bd9Sstevel@tonic-gate 		    gettext("\tipseckey [ -nvp ] -s outfile\n"));
159*e3320f40Smarkfen 	}
160*e3320f40Smarkfen 	EXIT_FATAL(NULL);
161*e3320f40Smarkfen }
162*e3320f40Smarkfen 
163*e3320f40Smarkfen 
164*e3320f40Smarkfen /*
165*e3320f40Smarkfen  * Print out any errors, tidy up as required.
166*e3320f40Smarkfen  * error pointer ep will be free()'d
167*e3320f40Smarkfen  */
168*e3320f40Smarkfen void
169*e3320f40Smarkfen handle_errors(char *ep, char *ebuf, boolean_t fatal, boolean_t done)
170*e3320f40Smarkfen {
171*e3320f40Smarkfen 	if (ep != NULL) {
172*e3320f40Smarkfen 		if (my_fmri == NULL) {
173*e3320f40Smarkfen 			/*
174*e3320f40Smarkfen 			 * For now suppress the errors when run from smf(5)
175*e3320f40Smarkfen 			 * because potentially sensitive information could
176*e3320f40Smarkfen 			 * end up in a publicly readable logfile.
177*e3320f40Smarkfen 			 */
178*e3320f40Smarkfen 			(void) fprintf(stdout, "%s\n", ep);
179*e3320f40Smarkfen 			(void) fflush(stdout);
180*e3320f40Smarkfen 		}
181*e3320f40Smarkfen 		free(ep);
182*e3320f40Smarkfen 		if (fatal) {
183*e3320f40Smarkfen 			if (ebuf != NULL) {
184*e3320f40Smarkfen 				free(ebuf);
185*e3320f40Smarkfen 			}
186*e3320f40Smarkfen 			/* reset command buffer */
187*e3320f40Smarkfen 			if (interactive)
188*e3320f40Smarkfen 				longjmp(env, 1);
189*e3320f40Smarkfen 		} else {
190*e3320f40Smarkfen 			return;
191*e3320f40Smarkfen 		}
1927c478bd9Sstevel@tonic-gate 	} else {
193*e3320f40Smarkfen 		/*
194*e3320f40Smarkfen 		 * No errors, if this is the last time that this function
195*e3320f40Smarkfen 		 * is called, free(ebuf) and reset command buffer.
196*e3320f40Smarkfen 		 */
197*e3320f40Smarkfen 		if (done) {
198*e3320f40Smarkfen 			if (ebuf != NULL) {
199*e3320f40Smarkfen 				free(ebuf);
200*e3320f40Smarkfen 			}
201*e3320f40Smarkfen 			/* reset command buffer */
202*e3320f40Smarkfen 			if (interactive)
203*e3320f40Smarkfen 				longjmp(env, 1);
204*e3320f40Smarkfen 		}
205*e3320f40Smarkfen 		return;
2067c478bd9Sstevel@tonic-gate 	}
2077c478bd9Sstevel@tonic-gate }
2087c478bd9Sstevel@tonic-gate 
2097c478bd9Sstevel@tonic-gate /*
2107c478bd9Sstevel@tonic-gate  * Initialize a PF_KEY base message.
2117c478bd9Sstevel@tonic-gate  */
2127c478bd9Sstevel@tonic-gate static void
2137c478bd9Sstevel@tonic-gate msg_init(struct sadb_msg *msg, uint8_t type, uint8_t satype)
2147c478bd9Sstevel@tonic-gate {
2157c478bd9Sstevel@tonic-gate 	msg->sadb_msg_version = PF_KEY_V2;
2167c478bd9Sstevel@tonic-gate 	msg->sadb_msg_type = type;
2177c478bd9Sstevel@tonic-gate 	msg->sadb_msg_errno = 0;
2187c478bd9Sstevel@tonic-gate 	msg->sadb_msg_satype = satype;
2197c478bd9Sstevel@tonic-gate 	/* For starters... */
2207c478bd9Sstevel@tonic-gate 	msg->sadb_msg_len = SADB_8TO64(sizeof (*msg));
2217c478bd9Sstevel@tonic-gate 	msg->sadb_msg_reserved = 0;
2227c478bd9Sstevel@tonic-gate 	msg->sadb_msg_seq = ++seq;
2237c478bd9Sstevel@tonic-gate 	msg->sadb_msg_pid = mypid;
2247c478bd9Sstevel@tonic-gate }
2257c478bd9Sstevel@tonic-gate 
2267c478bd9Sstevel@tonic-gate /*
2277c478bd9Sstevel@tonic-gate  * parseXXX and rparseXXX commands parse input and convert them to PF_KEY
2287c478bd9Sstevel@tonic-gate  * field values, or do the reverse for the purposes of saving the SA tables.
2297c478bd9Sstevel@tonic-gate  * (See the save_XXX functions.)
2307c478bd9Sstevel@tonic-gate  */
2317c478bd9Sstevel@tonic-gate 
2327c478bd9Sstevel@tonic-gate #define	CMD_NONE	0
2337c478bd9Sstevel@tonic-gate #define	CMD_UPDATE	2
2347c478bd9Sstevel@tonic-gate #define	CMD_ADD		3
2357c478bd9Sstevel@tonic-gate #define	CMD_DELETE	4
2367c478bd9Sstevel@tonic-gate #define	CMD_GET		5
2377c478bd9Sstevel@tonic-gate #define	CMD_FLUSH	9
2387c478bd9Sstevel@tonic-gate #define	CMD_DUMP	10
2397c478bd9Sstevel@tonic-gate #define	CMD_MONITOR	11
2407c478bd9Sstevel@tonic-gate #define	CMD_PMONITOR	12
2417c478bd9Sstevel@tonic-gate #define	CMD_QUIT	13
2427c478bd9Sstevel@tonic-gate #define	CMD_SAVE	14
2437c478bd9Sstevel@tonic-gate #define	CMD_HELP	15
2447c478bd9Sstevel@tonic-gate 
2457c478bd9Sstevel@tonic-gate /*
2467c478bd9Sstevel@tonic-gate  * Parse the command.
2477c478bd9Sstevel@tonic-gate  */
2487c478bd9Sstevel@tonic-gate static int
2497c478bd9Sstevel@tonic-gate parsecmd(char *cmdstr)
2507c478bd9Sstevel@tonic-gate {
2517c478bd9Sstevel@tonic-gate 	static struct cmdtable {
2527c478bd9Sstevel@tonic-gate 		char *cmd;
2537c478bd9Sstevel@tonic-gate 		int token;
2547c478bd9Sstevel@tonic-gate 	} table[] = {
2557c478bd9Sstevel@tonic-gate 		/*
2567c478bd9Sstevel@tonic-gate 		 * Q: Do we want to do GETSPI?
2577c478bd9Sstevel@tonic-gate 		 * A: No, it's for automated key mgmt. only.  Either that,
2587c478bd9Sstevel@tonic-gate 		 *    or it isn't relevant until we support non IPsec SA types.
2597c478bd9Sstevel@tonic-gate 		 */
2607c478bd9Sstevel@tonic-gate 		{"update",		CMD_UPDATE},
2617c478bd9Sstevel@tonic-gate 		{"add",			CMD_ADD},
2627c478bd9Sstevel@tonic-gate 		{"delete", 		CMD_DELETE},
2637c478bd9Sstevel@tonic-gate 		{"get", 		CMD_GET},
2647c478bd9Sstevel@tonic-gate 		/*
2657c478bd9Sstevel@tonic-gate 		 * Q: And ACQUIRE and REGISTER and EXPIRE?
2667c478bd9Sstevel@tonic-gate 		 * A: not until we support non IPsec SA types.
2677c478bd9Sstevel@tonic-gate 		 */
2687c478bd9Sstevel@tonic-gate 		{"flush",		CMD_FLUSH},
2697c478bd9Sstevel@tonic-gate 		{"dump",		CMD_DUMP},
2707c478bd9Sstevel@tonic-gate 		{"monitor",		CMD_MONITOR},
2717c478bd9Sstevel@tonic-gate 		{"passive_monitor",	CMD_PMONITOR},
2727c478bd9Sstevel@tonic-gate 		{"pmonitor",		CMD_PMONITOR},
2737c478bd9Sstevel@tonic-gate 		{"quit",		CMD_QUIT},
2747c478bd9Sstevel@tonic-gate 		{"exit",		CMD_QUIT},
2757c478bd9Sstevel@tonic-gate 		{"save",		CMD_SAVE},
2767c478bd9Sstevel@tonic-gate 		{"help",		CMD_HELP},
2777c478bd9Sstevel@tonic-gate 		{"?",			CMD_HELP},
2787c478bd9Sstevel@tonic-gate 		{NULL,			CMD_NONE}
2797c478bd9Sstevel@tonic-gate 	};
2807c478bd9Sstevel@tonic-gate 	struct cmdtable *ct = table;
2817c478bd9Sstevel@tonic-gate 
2827c478bd9Sstevel@tonic-gate 	while (ct->cmd != NULL && strcmp(ct->cmd, cmdstr) != 0)
2837c478bd9Sstevel@tonic-gate 		ct++;
2847c478bd9Sstevel@tonic-gate 	return (ct->token);
2857c478bd9Sstevel@tonic-gate }
2867c478bd9Sstevel@tonic-gate 
2877c478bd9Sstevel@tonic-gate /*
2887c478bd9Sstevel@tonic-gate  * Convert a number from a command line.  I picked "u_longlong_t" for the
2897c478bd9Sstevel@tonic-gate  * number because we need the largest number available.  Also, the strto<num>
2907c478bd9Sstevel@tonic-gate  * calls don't deal in units of uintNN_t.
2917c478bd9Sstevel@tonic-gate  */
2927c478bd9Sstevel@tonic-gate static u_longlong_t
293*e3320f40Smarkfen parsenum(char *num, boolean_t bail, char *ebuf)
2947c478bd9Sstevel@tonic-gate {
295*e3320f40Smarkfen 	u_longlong_t rc = 0;
2967c478bd9Sstevel@tonic-gate 	char *end = NULL;
297*e3320f40Smarkfen 	char *ep = NULL;
2987c478bd9Sstevel@tonic-gate 
2997c478bd9Sstevel@tonic-gate 	if (num == NULL) {
300*e3320f40Smarkfen 		FATAL(ep, ebuf, gettext("Unexpected end of command line,"
301*e3320f40Smarkfen 		    " was expecting a number.\n"));
302*e3320f40Smarkfen 		/* NOTREACHED */
3037c478bd9Sstevel@tonic-gate 	}
3047c478bd9Sstevel@tonic-gate 
3057c478bd9Sstevel@tonic-gate 	errno = 0;
3067c478bd9Sstevel@tonic-gate 	rc = strtoull(num, &end, 0);
3077c478bd9Sstevel@tonic-gate 	if (errno != 0 || end == num || *end != '\0') {
3087c478bd9Sstevel@tonic-gate 		if (bail) {
309*e3320f40Smarkfen 			ERROR1(ep, ebuf, gettext(
310*e3320f40Smarkfen 			"Expecting a number, not \"%s\"!\n"), num);
3117c478bd9Sstevel@tonic-gate 		} else {
3127c478bd9Sstevel@tonic-gate 			/*
3137c478bd9Sstevel@tonic-gate 			 * -1, while not optimal, is sufficiently out of range
3147c478bd9Sstevel@tonic-gate 			 * for most of this function's applications when
3157c478bd9Sstevel@tonic-gate 			 * we don't just bail.
3167c478bd9Sstevel@tonic-gate 			 */
3177c478bd9Sstevel@tonic-gate 			return ((u_longlong_t)-1);
3187c478bd9Sstevel@tonic-gate 		}
3197c478bd9Sstevel@tonic-gate 	}
320*e3320f40Smarkfen 	handle_errors(ep, NULL, B_FALSE, B_FALSE);
3217c478bd9Sstevel@tonic-gate 	return (rc);
3227c478bd9Sstevel@tonic-gate }
3237c478bd9Sstevel@tonic-gate 
3247c478bd9Sstevel@tonic-gate /*
3257c478bd9Sstevel@tonic-gate  * Parse and reverse parse a specific SA type (AH, ESP, etc.).
3267c478bd9Sstevel@tonic-gate  */
3277c478bd9Sstevel@tonic-gate static struct typetable {
3287c478bd9Sstevel@tonic-gate 	char *type;
3297c478bd9Sstevel@tonic-gate 	int token;
3307c478bd9Sstevel@tonic-gate } type_table[] = {
3317c478bd9Sstevel@tonic-gate 	{"all",	SADB_SATYPE_UNSPEC},
3327c478bd9Sstevel@tonic-gate 	{"ah",	SADB_SATYPE_AH},
3337c478bd9Sstevel@tonic-gate 	{"esp",	SADB_SATYPE_ESP},
3347c478bd9Sstevel@tonic-gate 	/* PF_KEY NOTE:  More to come if net/pfkeyv2.h gets updated. */
3357c478bd9Sstevel@tonic-gate 	{NULL,	0}	/* Token value is irrelevant for this entry. */
3367c478bd9Sstevel@tonic-gate };
3377c478bd9Sstevel@tonic-gate 
3387c478bd9Sstevel@tonic-gate 
3397c478bd9Sstevel@tonic-gate static int
340*e3320f40Smarkfen parsesatype(char *type, char *ebuf)
3417c478bd9Sstevel@tonic-gate {
3427c478bd9Sstevel@tonic-gate 	struct typetable *tt = type_table;
343*e3320f40Smarkfen 	char *ep = NULL;
3447c478bd9Sstevel@tonic-gate 
3457c478bd9Sstevel@tonic-gate 	if (type == NULL)
3467c478bd9Sstevel@tonic-gate 		return (SADB_SATYPE_UNSPEC);
3477c478bd9Sstevel@tonic-gate 
3487c478bd9Sstevel@tonic-gate 	while (tt->type != NULL && strcasecmp(tt->type, type) != 0)
3497c478bd9Sstevel@tonic-gate 		tt++;
3507c478bd9Sstevel@tonic-gate 
3517c478bd9Sstevel@tonic-gate 	/*
3527c478bd9Sstevel@tonic-gate 	 * New SA types (including ones keysock maintains for user-land
3537c478bd9Sstevel@tonic-gate 	 * protocols) may be added, so parse a numeric value if possible.
3547c478bd9Sstevel@tonic-gate 	 */
3557c478bd9Sstevel@tonic-gate 	if (tt->type == NULL) {
356*e3320f40Smarkfen 		tt->token = (int)parsenum(type, B_FALSE, ebuf);
3577c478bd9Sstevel@tonic-gate 		if (tt->token == -1) {
358*e3320f40Smarkfen 			ERROR1(ep, ebuf, gettext(
359*e3320f40Smarkfen 			    "Unknown SA type (%s).\n"), type);
360*e3320f40Smarkfen 			tt->token = SADB_SATYPE_UNSPEC;
3617c478bd9Sstevel@tonic-gate 		}
3627c478bd9Sstevel@tonic-gate 	}
363*e3320f40Smarkfen 	handle_errors(ep, NULL, B_FALSE, B_FALSE);
3647c478bd9Sstevel@tonic-gate 	return (tt->token);
3657c478bd9Sstevel@tonic-gate }
3667c478bd9Sstevel@tonic-gate 
3677c478bd9Sstevel@tonic-gate #define	NEXTEOF		0
3687c478bd9Sstevel@tonic-gate #define	NEXTNONE	1
3697c478bd9Sstevel@tonic-gate #define	NEXTNUM		2
3707c478bd9Sstevel@tonic-gate #define	NEXTSTR		3
3717c478bd9Sstevel@tonic-gate #define	NEXTNUMSTR	4
3727c478bd9Sstevel@tonic-gate #define	NEXTADDR	5
3737c478bd9Sstevel@tonic-gate #define	NEXTHEX		6
3747c478bd9Sstevel@tonic-gate #define	NEXTIDENT	7
3757c478bd9Sstevel@tonic-gate #define	NEXTADDR4	8
3767c478bd9Sstevel@tonic-gate #define	NEXTADDR6	9
3777c478bd9Sstevel@tonic-gate 
3787c478bd9Sstevel@tonic-gate #define	TOK_EOF			0
3797c478bd9Sstevel@tonic-gate #define	TOK_UNKNOWN		1
3807c478bd9Sstevel@tonic-gate #define	TOK_SPI			2
3817c478bd9Sstevel@tonic-gate #define	TOK_REPLAY		3
3827c478bd9Sstevel@tonic-gate #define	TOK_STATE		4
3837c478bd9Sstevel@tonic-gate #define	TOK_AUTHALG		5
3847c478bd9Sstevel@tonic-gate #define	TOK_ENCRALG		6
3857c478bd9Sstevel@tonic-gate #define	TOK_FLAGS		7
3867c478bd9Sstevel@tonic-gate #define	TOK_SOFT_ALLOC		8
3877c478bd9Sstevel@tonic-gate #define	TOK_SOFT_BYTES		9
3887c478bd9Sstevel@tonic-gate #define	TOK_SOFT_ADDTIME	10
3897c478bd9Sstevel@tonic-gate #define	TOK_SOFT_USETIME	11
3907c478bd9Sstevel@tonic-gate #define	TOK_HARD_ALLOC		12
3917c478bd9Sstevel@tonic-gate #define	TOK_HARD_BYTES		13
3927c478bd9Sstevel@tonic-gate #define	TOK_HARD_ADDTIME	14
3937c478bd9Sstevel@tonic-gate #define	TOK_HARD_USETIME	15
3947c478bd9Sstevel@tonic-gate #define	TOK_CURRENT_ALLOC	16
3957c478bd9Sstevel@tonic-gate #define	TOK_CURRENT_BYTES	17
3967c478bd9Sstevel@tonic-gate #define	TOK_CURRENT_ADDTIME	18
3977c478bd9Sstevel@tonic-gate #define	TOK_CURRENT_USETIME	19
3987c478bd9Sstevel@tonic-gate #define	TOK_SRCADDR		20
3997c478bd9Sstevel@tonic-gate #define	TOK_DSTADDR		21
4007c478bd9Sstevel@tonic-gate #define	TOK_PROXYADDR		22
4017c478bd9Sstevel@tonic-gate #define	TOK_AUTHKEY		23
4027c478bd9Sstevel@tonic-gate #define	TOK_ENCRKEY		24
4037c478bd9Sstevel@tonic-gate #define	TOK_SRCIDTYPE		25
4047c478bd9Sstevel@tonic-gate #define	TOK_DSTIDTYPE		26
4057c478bd9Sstevel@tonic-gate #define	TOK_DPD			27
4067c478bd9Sstevel@tonic-gate #define	TOK_SENS_LEVEL		28
4077c478bd9Sstevel@tonic-gate #define	TOK_SENS_MAP		29
4087c478bd9Sstevel@tonic-gate #define	TOK_INTEG_LEVEL		30
4097c478bd9Sstevel@tonic-gate #define	TOK_INTEG_MAP		31
4107c478bd9Sstevel@tonic-gate #define	TOK_SRCADDR6		32
4117c478bd9Sstevel@tonic-gate #define	TOK_DSTADDR6		33
4127c478bd9Sstevel@tonic-gate #define	TOK_PROXYADDR6		34
4137c478bd9Sstevel@tonic-gate #define	TOK_SRCPORT		35
4147c478bd9Sstevel@tonic-gate #define	TOK_DSTPORT		36
4157c478bd9Sstevel@tonic-gate #define	TOK_PROTO		37
4167c478bd9Sstevel@tonic-gate #define	TOK_ENCAP		38
4177c478bd9Sstevel@tonic-gate #define	TOK_NATLOC		39
4187c478bd9Sstevel@tonic-gate #define	TOK_NATREM		40
4197c478bd9Sstevel@tonic-gate #define	TOK_NATLPORT		41
4207c478bd9Sstevel@tonic-gate #define	TOK_NATRPORT		42
4218810c16bSdanmcd #define	TOK_IPROTO		43
4228810c16bSdanmcd #define	TOK_IDSTADDR		44
4238810c16bSdanmcd #define	TOK_IDSTADDR6		45
4248810c16bSdanmcd #define	TOK_ISRCPORT		46
4258810c16bSdanmcd #define	TOK_IDSTPORT		47
4267c478bd9Sstevel@tonic-gate 
4277c478bd9Sstevel@tonic-gate static struct toktable {
4287c478bd9Sstevel@tonic-gate 	char *string;
4297c478bd9Sstevel@tonic-gate 	int token;
4307c478bd9Sstevel@tonic-gate 	int next;
4317c478bd9Sstevel@tonic-gate } tokens[] = {
4327c478bd9Sstevel@tonic-gate 	/* "String",		token value,		next arg is */
4337c478bd9Sstevel@tonic-gate 	{"spi",			TOK_SPI,		NEXTNUM},
4347c478bd9Sstevel@tonic-gate 	{"replay",		TOK_REPLAY,		NEXTNUM},
4357c478bd9Sstevel@tonic-gate 	{"state",		TOK_STATE,		NEXTNUMSTR},
4367c478bd9Sstevel@tonic-gate 	{"auth_alg",		TOK_AUTHALG,		NEXTNUMSTR},
4377c478bd9Sstevel@tonic-gate 	{"authalg",		TOK_AUTHALG,		NEXTNUMSTR},
4387c478bd9Sstevel@tonic-gate 	{"encr_alg",		TOK_ENCRALG,		NEXTNUMSTR},
4397c478bd9Sstevel@tonic-gate 	{"encralg",		TOK_ENCRALG,		NEXTNUMSTR},
4407c478bd9Sstevel@tonic-gate 	{"flags",		TOK_FLAGS,		NEXTNUM},
4417c478bd9Sstevel@tonic-gate 	{"soft_alloc",		TOK_SOFT_ALLOC,		NEXTNUM},
4427c478bd9Sstevel@tonic-gate 	{"soft_bytes",		TOK_SOFT_BYTES,		NEXTNUM},
4437c478bd9Sstevel@tonic-gate 	{"soft_addtime",	TOK_SOFT_ADDTIME,	NEXTNUM},
4447c478bd9Sstevel@tonic-gate 	{"soft_usetime",	TOK_SOFT_USETIME,	NEXTNUM},
4457c478bd9Sstevel@tonic-gate 	{"hard_alloc",		TOK_HARD_ALLOC,		NEXTNUM},
4467c478bd9Sstevel@tonic-gate 	{"hard_bytes",		TOK_HARD_BYTES,		NEXTNUM},
4477c478bd9Sstevel@tonic-gate 	{"hard_addtime",	TOK_HARD_ADDTIME,	NEXTNUM},
4487c478bd9Sstevel@tonic-gate 	{"hard_usetime",	TOK_HARD_USETIME,	NEXTNUM},
4497c478bd9Sstevel@tonic-gate 	{"current_alloc",	TOK_CURRENT_ALLOC,	NEXTNUM},
4507c478bd9Sstevel@tonic-gate 	{"current_bytes",	TOK_CURRENT_BYTES,	NEXTNUM},
4517c478bd9Sstevel@tonic-gate 	{"current_addtime",	TOK_CURRENT_ADDTIME,	NEXTNUM},
4527c478bd9Sstevel@tonic-gate 	{"current_usetime",	TOK_CURRENT_USETIME,	NEXTNUM},
4537c478bd9Sstevel@tonic-gate 
4547c478bd9Sstevel@tonic-gate 	{"saddr",		TOK_SRCADDR,		NEXTADDR},
4557c478bd9Sstevel@tonic-gate 	{"srcaddr",		TOK_SRCADDR,		NEXTADDR},
4567c478bd9Sstevel@tonic-gate 	{"src",			TOK_SRCADDR,		NEXTADDR},
4577c478bd9Sstevel@tonic-gate 	{"daddr",		TOK_DSTADDR,		NEXTADDR},
4587c478bd9Sstevel@tonic-gate 	{"dstaddr",		TOK_DSTADDR,		NEXTADDR},
4597c478bd9Sstevel@tonic-gate 	{"dst",			TOK_DSTADDR,		NEXTADDR},
4607c478bd9Sstevel@tonic-gate 	{"proxyaddr",		TOK_PROXYADDR,		NEXTADDR},
4617c478bd9Sstevel@tonic-gate 	{"proxy",		TOK_PROXYADDR,		NEXTADDR},
4628810c16bSdanmcd 	{"innersrc",		TOK_PROXYADDR,		NEXTADDR},
4638810c16bSdanmcd 	{"isrc",		TOK_PROXYADDR,		NEXTADDR},
4648810c16bSdanmcd 	{"innerdst",		TOK_IDSTADDR,		NEXTADDR},
4658810c16bSdanmcd 	{"idst",		TOK_IDSTADDR,		NEXTADDR},
4667c478bd9Sstevel@tonic-gate 
4677c478bd9Sstevel@tonic-gate 	{"sport",		TOK_SRCPORT,		NEXTNUM},
4687c478bd9Sstevel@tonic-gate 	{"dport",		TOK_DSTPORT,		NEXTNUM},
4698810c16bSdanmcd 	{"innersport",		TOK_ISRCPORT,		NEXTNUM},
4708810c16bSdanmcd 	{"isport",		TOK_ISRCPORT,		NEXTNUM},
4718810c16bSdanmcd 	{"innerdport",		TOK_IDSTPORT,		NEXTNUM},
4728810c16bSdanmcd 	{"idport",		TOK_IDSTPORT,		NEXTNUM},
4737c478bd9Sstevel@tonic-gate 	{"proto",		TOK_PROTO,		NEXTNUM},
474eeda67c6Sjojemann 	{"ulp",			TOK_PROTO,		NEXTNUM},
4758810c16bSdanmcd 	{"iproto",		TOK_IPROTO,		NEXTNUM},
4768810c16bSdanmcd 	{"iulp",		TOK_IPROTO,		NEXTNUM},
4777c478bd9Sstevel@tonic-gate 
4787c478bd9Sstevel@tonic-gate 	{"saddr6",		TOK_SRCADDR6,		NEXTADDR},
4797c478bd9Sstevel@tonic-gate 	{"srcaddr6",		TOK_SRCADDR6,		NEXTADDR},
4807c478bd9Sstevel@tonic-gate 	{"src6",		TOK_SRCADDR6,		NEXTADDR},
4817c478bd9Sstevel@tonic-gate 	{"daddr6",		TOK_DSTADDR6,		NEXTADDR},
4827c478bd9Sstevel@tonic-gate 	{"dstaddr6",		TOK_DSTADDR6,		NEXTADDR},
4837c478bd9Sstevel@tonic-gate 	{"dst6",		TOK_DSTADDR6,		NEXTADDR},
4847c478bd9Sstevel@tonic-gate 	{"proxyaddr6",		TOK_PROXYADDR6,		NEXTADDR},
4857c478bd9Sstevel@tonic-gate 	{"proxy6",		TOK_PROXYADDR6,		NEXTADDR},
4868810c16bSdanmcd 	{"innersrc6",		TOK_PROXYADDR6,		NEXTADDR},
4878810c16bSdanmcd 	{"isrc6",		TOK_PROXYADDR6,		NEXTADDR},
4888810c16bSdanmcd 	{"innerdst6",		TOK_IDSTADDR6,		NEXTADDR},
4898810c16bSdanmcd 	{"idst6",		TOK_IDSTADDR6,		NEXTADDR},
4907c478bd9Sstevel@tonic-gate 
4917c478bd9Sstevel@tonic-gate 	{"authkey",		TOK_AUTHKEY,		NEXTHEX},
4927c478bd9Sstevel@tonic-gate 	{"encrkey",		TOK_ENCRKEY,		NEXTHEX},
4937c478bd9Sstevel@tonic-gate 	{"srcidtype",		TOK_SRCIDTYPE,		NEXTIDENT},
4947c478bd9Sstevel@tonic-gate 	{"dstidtype",		TOK_DSTIDTYPE,		NEXTIDENT},
4957c478bd9Sstevel@tonic-gate 	{"dpd",			TOK_DPD,		NEXTNUM},
4967c478bd9Sstevel@tonic-gate 	{"sens_level",		TOK_SENS_LEVEL,		NEXTNUM},
4977c478bd9Sstevel@tonic-gate 	{"sens_map",		TOK_SENS_MAP,		NEXTHEX},
4987c478bd9Sstevel@tonic-gate 	{"integ_level",		TOK_INTEG_LEVEL,	NEXTNUM},
4997c478bd9Sstevel@tonic-gate 	{"integ_map",		TOK_INTEG_MAP,		NEXTHEX},
5007c478bd9Sstevel@tonic-gate 	{"nat_loc",		TOK_NATLOC,		NEXTADDR},
5017c478bd9Sstevel@tonic-gate 	{"nat_rem",		TOK_NATREM,		NEXTADDR},
5027c478bd9Sstevel@tonic-gate 	{"nat_lport",		TOK_NATLPORT,		NEXTNUM},
5037c478bd9Sstevel@tonic-gate 	{"nat_rport",		TOK_NATRPORT,		NEXTNUM},
5047c478bd9Sstevel@tonic-gate 	{"encap",		TOK_ENCAP,		NEXTNUMSTR},
5057c478bd9Sstevel@tonic-gate 	{NULL,			TOK_UNKNOWN,		NEXTEOF}
5067c478bd9Sstevel@tonic-gate };
5077c478bd9Sstevel@tonic-gate 
5087c478bd9Sstevel@tonic-gate /*
5097c478bd9Sstevel@tonic-gate  * Q:	Do I need stuff for proposals, combinations, supported algorithms,
5107c478bd9Sstevel@tonic-gate  *	or SPI ranges?
5117c478bd9Sstevel@tonic-gate  *
5127c478bd9Sstevel@tonic-gate  * A:	Probably not, but you never know.
5137c478bd9Sstevel@tonic-gate  *
5147c478bd9Sstevel@tonic-gate  * Parse out extension header type values.
5157c478bd9Sstevel@tonic-gate  */
5167c478bd9Sstevel@tonic-gate static int
5177c478bd9Sstevel@tonic-gate parseextval(char *value, int *next)
5187c478bd9Sstevel@tonic-gate {
5197c478bd9Sstevel@tonic-gate 	struct toktable *tp;
5207c478bd9Sstevel@tonic-gate 
5217c478bd9Sstevel@tonic-gate 	if (value == NULL)
5227c478bd9Sstevel@tonic-gate 		return (TOK_EOF);
5237c478bd9Sstevel@tonic-gate 
5247c478bd9Sstevel@tonic-gate 	for (tp = tokens; tp->string != NULL; tp++)
5257c478bd9Sstevel@tonic-gate 		if (strcmp(value, tp->string) == 0)
5267c478bd9Sstevel@tonic-gate 			break;
5277c478bd9Sstevel@tonic-gate 
5287c478bd9Sstevel@tonic-gate 	/*
5297c478bd9Sstevel@tonic-gate 	 * Since the OS controls what extensions are available, we don't have
5307c478bd9Sstevel@tonic-gate 	 * to parse numeric values here.
5317c478bd9Sstevel@tonic-gate 	 */
5327c478bd9Sstevel@tonic-gate 
5337c478bd9Sstevel@tonic-gate 	*next = tp->next;
5347c478bd9Sstevel@tonic-gate 	return (tp->token);
5357c478bd9Sstevel@tonic-gate }
5367c478bd9Sstevel@tonic-gate 
5377c478bd9Sstevel@tonic-gate /*
5387c478bd9Sstevel@tonic-gate  * Parse possible state values.
5397c478bd9Sstevel@tonic-gate  */
5407c478bd9Sstevel@tonic-gate static uint8_t
541*e3320f40Smarkfen parsestate(char *state, char *ebuf)
5427c478bd9Sstevel@tonic-gate {
5437c478bd9Sstevel@tonic-gate 	struct states {
5447c478bd9Sstevel@tonic-gate 		char *state;
5457c478bd9Sstevel@tonic-gate 		uint8_t retval;
5467c478bd9Sstevel@tonic-gate 	} states[] = {
5477c478bd9Sstevel@tonic-gate 		{"larval",	SADB_SASTATE_LARVAL},
5487c478bd9Sstevel@tonic-gate 		{"mature",	SADB_SASTATE_MATURE},
5497c478bd9Sstevel@tonic-gate 		{"dying",	SADB_SASTATE_DYING},
5507c478bd9Sstevel@tonic-gate 		{"dead",	SADB_SASTATE_DEAD},
5517c478bd9Sstevel@tonic-gate 		{NULL,		0}
5527c478bd9Sstevel@tonic-gate 	};
5537c478bd9Sstevel@tonic-gate 	struct states *sp;
554*e3320f40Smarkfen 	char *ep = NULL;
5557c478bd9Sstevel@tonic-gate 
5567c478bd9Sstevel@tonic-gate 	if (state == NULL) {
557*e3320f40Smarkfen 		FATAL(ep, ebuf, "Unexpected end of command line "
558*e3320f40Smarkfen 		    "was expecting a state.\n");
5597c478bd9Sstevel@tonic-gate 	}
5607c478bd9Sstevel@tonic-gate 
5617c478bd9Sstevel@tonic-gate 	for (sp = states; sp->state != NULL; sp++) {
5627c478bd9Sstevel@tonic-gate 		if (strcmp(sp->state, state) == 0)
5637c478bd9Sstevel@tonic-gate 			return (sp->retval);
5647c478bd9Sstevel@tonic-gate 	}
565*e3320f40Smarkfen 	ERROR1(ep, ebuf, gettext("Unknown state type \"%s\"\n"), state);
566*e3320f40Smarkfen 	handle_errors(ep, NULL, B_FALSE, B_FALSE);
567eeda67c6Sjojemann 	return (0);
5687c478bd9Sstevel@tonic-gate }
5697c478bd9Sstevel@tonic-gate 
5707c478bd9Sstevel@tonic-gate /*
5717c478bd9Sstevel@tonic-gate  * Return the numerical algorithm identifier corresponding to the specified
5727c478bd9Sstevel@tonic-gate  * algorithm name.
5737c478bd9Sstevel@tonic-gate  */
5747c478bd9Sstevel@tonic-gate static uint8_t
575*e3320f40Smarkfen parsealg(char *alg, int proto_num, char *ebuf)
5767c478bd9Sstevel@tonic-gate {
5777c478bd9Sstevel@tonic-gate 	u_longlong_t invalue;
5787c478bd9Sstevel@tonic-gate 	struct ipsecalgent *algent;
579*e3320f40Smarkfen 	char *ep = NULL;
5807c478bd9Sstevel@tonic-gate 
5817c478bd9Sstevel@tonic-gate 	if (alg == NULL) {
582*e3320f40Smarkfen 		FATAL(ep, ebuf, gettext("Unexpected end of command line, "
583*e3320f40Smarkfen 		    "was expecting an algorithm name.\n"));
5847c478bd9Sstevel@tonic-gate 	}
5857c478bd9Sstevel@tonic-gate 
5867c478bd9Sstevel@tonic-gate 	algent = getipsecalgbyname(alg, proto_num, NULL);
5877c478bd9Sstevel@tonic-gate 	if (algent != NULL) {
5887c478bd9Sstevel@tonic-gate 		uint8_t alg_num;
5897c478bd9Sstevel@tonic-gate 
5907c478bd9Sstevel@tonic-gate 		alg_num = algent->a_alg_num;
5917c478bd9Sstevel@tonic-gate 		freeipsecalgent(algent);
5927c478bd9Sstevel@tonic-gate 
5937c478bd9Sstevel@tonic-gate 		return (alg_num);
5947c478bd9Sstevel@tonic-gate 	}
5957c478bd9Sstevel@tonic-gate 
5967c478bd9Sstevel@tonic-gate 	/*
5977c478bd9Sstevel@tonic-gate 	 * Since algorithms can be loaded during kernel run-time, check for
5987c478bd9Sstevel@tonic-gate 	 * numeric algorithm values too.  PF_KEY can catch bad ones with EINVAL.
5997c478bd9Sstevel@tonic-gate 	 */
600*e3320f40Smarkfen 	invalue = parsenum(alg, B_FALSE, ebuf);
6017c478bd9Sstevel@tonic-gate 	if (invalue != (u_longlong_t)-1 &&
6027c478bd9Sstevel@tonic-gate 	    (u_longlong_t)(invalue & (u_longlong_t)0xff) == invalue)
6037c478bd9Sstevel@tonic-gate 		return ((uint8_t)invalue);
6047c478bd9Sstevel@tonic-gate 
605*e3320f40Smarkfen 	if (proto_num == IPSEC_PROTO_ESP) {
606*e3320f40Smarkfen 		ERROR1(ep, ebuf, gettext(
607*e3320f40Smarkfen 		    "Unknown encryption algorithm type \"%s\"\n"), alg);
608*e3320f40Smarkfen 	} else {
609*e3320f40Smarkfen 		ERROR1(ep, ebuf, gettext(
610*e3320f40Smarkfen 		    "Unknown authentication algorithm type \"%s\"\n"), alg);
611*e3320f40Smarkfen 	}
612*e3320f40Smarkfen 	handle_errors(ep, NULL, B_FALSE, B_FALSE);
613eeda67c6Sjojemann 	return (0);
6147c478bd9Sstevel@tonic-gate }
6157c478bd9Sstevel@tonic-gate 
6167c478bd9Sstevel@tonic-gate /*
6177c478bd9Sstevel@tonic-gate  * Parse and reverse parse out a source/destination ID type.
6187c478bd9Sstevel@tonic-gate  */
6197c478bd9Sstevel@tonic-gate static struct idtypes {
6207c478bd9Sstevel@tonic-gate 	char *idtype;
6217c478bd9Sstevel@tonic-gate 	uint8_t retval;
6227c478bd9Sstevel@tonic-gate } idtypes[] = {
6237c478bd9Sstevel@tonic-gate 	{"prefix",	SADB_IDENTTYPE_PREFIX},
6247c478bd9Sstevel@tonic-gate 	{"fqdn",	SADB_IDENTTYPE_FQDN},
6257c478bd9Sstevel@tonic-gate 	{"domain",	SADB_IDENTTYPE_FQDN},
6267c478bd9Sstevel@tonic-gate 	{"domainname",	SADB_IDENTTYPE_FQDN},
6277c478bd9Sstevel@tonic-gate 	{"user_fqdn",	SADB_IDENTTYPE_USER_FQDN},
6287c478bd9Sstevel@tonic-gate 	{"mailbox",	SADB_IDENTTYPE_USER_FQDN},
6297c478bd9Sstevel@tonic-gate 	{"der_dn",	SADB_X_IDENTTYPE_DN},
6307c478bd9Sstevel@tonic-gate 	{"der_gn",	SADB_X_IDENTTYPE_GN},
6317c478bd9Sstevel@tonic-gate 	{NULL,		0}
6327c478bd9Sstevel@tonic-gate };
6337c478bd9Sstevel@tonic-gate 
6347c478bd9Sstevel@tonic-gate static uint16_t
635*e3320f40Smarkfen parseidtype(char *type, char *ebuf)
6367c478bd9Sstevel@tonic-gate {
6377c478bd9Sstevel@tonic-gate 	struct idtypes *idp;
6387c478bd9Sstevel@tonic-gate 	u_longlong_t invalue;
639*e3320f40Smarkfen 	char *ep = NULL;
6407c478bd9Sstevel@tonic-gate 
6417c478bd9Sstevel@tonic-gate 	if (type == NULL) {
6427c478bd9Sstevel@tonic-gate 		/* Shouldn't reach here, see callers for why. */
643*e3320f40Smarkfen 		FATAL(ep, ebuf, gettext("Unexpected end of command line, "
644*e3320f40Smarkfen 		    "was expecting a type.\n"));
6457c478bd9Sstevel@tonic-gate 	}
6467c478bd9Sstevel@tonic-gate 
6477c478bd9Sstevel@tonic-gate 	for (idp = idtypes; idp->idtype != NULL; idp++) {
6487c478bd9Sstevel@tonic-gate 		if (strcasecmp(idp->idtype, type) == 0)
6497c478bd9Sstevel@tonic-gate 			return (idp->retval);
6507c478bd9Sstevel@tonic-gate 	}
6517c478bd9Sstevel@tonic-gate 	/*
6527c478bd9Sstevel@tonic-gate 	 * Since identity types are almost arbitrary, check for numeric
6537c478bd9Sstevel@tonic-gate 	 * algorithm values too.  PF_KEY can catch bad ones with EINVAL.
6547c478bd9Sstevel@tonic-gate 	 */
655*e3320f40Smarkfen 	invalue = parsenum(type, B_FALSE, ebuf);
6567c478bd9Sstevel@tonic-gate 	if (invalue != (u_longlong_t)-1 &&
6577c478bd9Sstevel@tonic-gate 	    (u_longlong_t)(invalue & (u_longlong_t)0xffff) == invalue)
6587c478bd9Sstevel@tonic-gate 		return ((uint16_t)invalue);
6597c478bd9Sstevel@tonic-gate 
6607c478bd9Sstevel@tonic-gate 
661*e3320f40Smarkfen 	ERROR1(ep, ebuf, gettext("Unknown identity type \"%s\"\n"), type);
662*e3320f40Smarkfen 
663*e3320f40Smarkfen 	handle_errors(ep, NULL, B_FALSE, B_FALSE);
664eeda67c6Sjojemann 	return (0);
6657c478bd9Sstevel@tonic-gate }
6667c478bd9Sstevel@tonic-gate 
6677c478bd9Sstevel@tonic-gate /*
6687c478bd9Sstevel@tonic-gate  * Parse an address off the command line.  Return length of sockaddr,
6697c478bd9Sstevel@tonic-gate  * and either return a hostent pointer (caller frees).  The new
6707c478bd9Sstevel@tonic-gate  * getipnodebyname() call does the Right Thing (TM), even with
6717c478bd9Sstevel@tonic-gate  * raw addresses (colon-separated IPv6 or dotted decimal IPv4).
6727c478bd9Sstevel@tonic-gate  */
6737c478bd9Sstevel@tonic-gate 
6747c478bd9Sstevel@tonic-gate static struct {
6757c478bd9Sstevel@tonic-gate 	struct hostent he;
6767c478bd9Sstevel@tonic-gate 	char *addtl[2];
6777c478bd9Sstevel@tonic-gate 	} dummy;
6787c478bd9Sstevel@tonic-gate static union {
6797c478bd9Sstevel@tonic-gate 	struct in6_addr ipv6;
6807c478bd9Sstevel@tonic-gate 	struct in_addr ipv4;
6817c478bd9Sstevel@tonic-gate 	uint64_t aligner;
6827c478bd9Sstevel@tonic-gate } addr1;
6837c478bd9Sstevel@tonic-gate 
6847c478bd9Sstevel@tonic-gate static int
685*e3320f40Smarkfen parseaddr(char *addr, struct hostent **hpp, boolean_t v6only, char *ebuf)
6867c478bd9Sstevel@tonic-gate {
6877c478bd9Sstevel@tonic-gate 	int hp_errno;
6887c478bd9Sstevel@tonic-gate 	struct hostent *hp = NULL;
689*e3320f40Smarkfen 	char *ep = NULL;
6907c478bd9Sstevel@tonic-gate 
6917c478bd9Sstevel@tonic-gate 	if (addr == NULL) {
692*e3320f40Smarkfen 		FATAL(ep, ebuf, gettext("Unexpected end of command line, "
693*e3320f40Smarkfen 		    "was expecting an address.\n"));
6947c478bd9Sstevel@tonic-gate 	}
6957c478bd9Sstevel@tonic-gate 
6967c478bd9Sstevel@tonic-gate 	if (!nflag) {
6977c478bd9Sstevel@tonic-gate 		/*
6987c478bd9Sstevel@tonic-gate 		 * Try name->address first.  Assume AF_INET6, and
6997c478bd9Sstevel@tonic-gate 		 * get IPv4's, plus IPv6's if and only if IPv6 is configured.
7007c478bd9Sstevel@tonic-gate 		 * This means to add IPv6 SAs, you must have IPv6
7017c478bd9Sstevel@tonic-gate 		 * up-and-running.  (AI_DEFAULT works here.)
7027c478bd9Sstevel@tonic-gate 		 */
7037c478bd9Sstevel@tonic-gate 		hp = getipnodebyname(addr, AF_INET6,
7047c478bd9Sstevel@tonic-gate 		    (v6only ? AI_ADDRCONFIG : (AI_DEFAULT | AI_ALL)),
7057c478bd9Sstevel@tonic-gate 		    &hp_errno);
7067c478bd9Sstevel@tonic-gate 	} else {
7077c478bd9Sstevel@tonic-gate 		/*
7087c478bd9Sstevel@tonic-gate 		 * Try a normal address conversion only.  Use "dummy"
7097c478bd9Sstevel@tonic-gate 		 * to construct a fake hostent.  Caller will know not
7107c478bd9Sstevel@tonic-gate 		 * to free this one.
7117c478bd9Sstevel@tonic-gate 		 */
7127c478bd9Sstevel@tonic-gate 		if (inet_pton(AF_INET6, addr, &addr1) == 1) {
7137c478bd9Sstevel@tonic-gate 			dummy.he.h_addr_list = dummy.addtl;
7147c478bd9Sstevel@tonic-gate 			dummy.addtl[0] = (char *)&addr1;
7157c478bd9Sstevel@tonic-gate 			dummy.addtl[1] = NULL;
7167c478bd9Sstevel@tonic-gate 			hp = &dummy.he;
7177c478bd9Sstevel@tonic-gate 			dummy.he.h_addrtype = AF_INET6;
7187c478bd9Sstevel@tonic-gate 			dummy.he.h_length = sizeof (struct in6_addr);
7197c478bd9Sstevel@tonic-gate 		} else if (inet_pton(AF_INET, addr, &addr1) == 1) {
7207c478bd9Sstevel@tonic-gate 			/*
7218810c16bSdanmcd 			 * Remap to AF_INET6 anyway.
7227c478bd9Sstevel@tonic-gate 			 */
7237c478bd9Sstevel@tonic-gate 			dummy.he.h_addr_list = dummy.addtl;
7247c478bd9Sstevel@tonic-gate 			dummy.addtl[0] = (char *)&addr1;
7257c478bd9Sstevel@tonic-gate 			dummy.addtl[1] = NULL;
7267c478bd9Sstevel@tonic-gate 			hp = &dummy.he;
7277c478bd9Sstevel@tonic-gate 			dummy.he.h_addrtype = AF_INET6;
7287c478bd9Sstevel@tonic-gate 			dummy.he.h_length = sizeof (struct in6_addr);
7297c478bd9Sstevel@tonic-gate 			/*
7307c478bd9Sstevel@tonic-gate 			 * NOTE:  If macro changes to disallow in-place
7317c478bd9Sstevel@tonic-gate 			 * conversion, rewhack this.
7327c478bd9Sstevel@tonic-gate 			 */
7337c478bd9Sstevel@tonic-gate 			IN6_INADDR_TO_V4MAPPED(&addr1.ipv4, &addr1.ipv6);
7347c478bd9Sstevel@tonic-gate 		} else {
7357c478bd9Sstevel@tonic-gate 			hp = NULL;
7367c478bd9Sstevel@tonic-gate 		}
7377c478bd9Sstevel@tonic-gate 	}
7387c478bd9Sstevel@tonic-gate 
739*e3320f40Smarkfen 	if (hp == NULL)
740*e3320f40Smarkfen 		WARN1(ep, ebuf, gettext("Unknown address %s."), addr);
7417c478bd9Sstevel@tonic-gate 
7427c478bd9Sstevel@tonic-gate 	*hpp = hp;
7438810c16bSdanmcd 	/* Always return sockaddr_in6 for now. */
744*e3320f40Smarkfen 	handle_errors(ep, NULL, B_FALSE, B_FALSE);
7458810c16bSdanmcd 	return (sizeof (struct sockaddr_in6));
7467c478bd9Sstevel@tonic-gate }
7477c478bd9Sstevel@tonic-gate 
7487c478bd9Sstevel@tonic-gate /*
7497c478bd9Sstevel@tonic-gate  * Parse a hex character for a key.  A string will take the form:
7507c478bd9Sstevel@tonic-gate  *	xxxxxxxxx/nn
7517c478bd9Sstevel@tonic-gate  * where
7527c478bd9Sstevel@tonic-gate  *	xxxxxxxxx == a string of hex characters ([0-9][a-f][A-F])
7537c478bd9Sstevel@tonic-gate  *	nn == an optional decimal "mask".  If it is not present, it
7547c478bd9Sstevel@tonic-gate  *	is assumed that the hex string will be rounded to the nearest
7557c478bd9Sstevel@tonic-gate  *	byte, where odd nibbles, like 123 will become 0x0123.
7567c478bd9Sstevel@tonic-gate  *
7577c478bd9Sstevel@tonic-gate  * NOTE:Unlike the expression of IP addresses, I will not allow an
7587c478bd9Sstevel@tonic-gate  *	excessive "mask".  For example 2112/50 is very illegal.
7597c478bd9Sstevel@tonic-gate  * NOTE2:	This key should be in canonical order.  Consult your man
7607c478bd9Sstevel@tonic-gate  *		pages per algorithm about said order.
7617c478bd9Sstevel@tonic-gate  */
7627c478bd9Sstevel@tonic-gate 
7637c478bd9Sstevel@tonic-gate #define	hd2num(hd) (((hd) >= '0' && (hd) <= '9') ? ((hd) - '0') : \
7647c478bd9Sstevel@tonic-gate 	(((hd) >= 'a' && (hd) <= 'f') ? ((hd) - 'a' + 10) : ((hd) - 'A' + 10)))
7657c478bd9Sstevel@tonic-gate 
7667c478bd9Sstevel@tonic-gate static struct sadb_key *
767*e3320f40Smarkfen parsekey(char *input, char *ebuf)
7687c478bd9Sstevel@tonic-gate {
7697c478bd9Sstevel@tonic-gate 	struct sadb_key *retval;
7707c478bd9Sstevel@tonic-gate 	uint_t i, hexlen = 0, bits, alloclen;
7717c478bd9Sstevel@tonic-gate 	uint8_t *key;
772*e3320f40Smarkfen 	char *ep = NULL;
7737c478bd9Sstevel@tonic-gate 
7747c478bd9Sstevel@tonic-gate 	if (input == NULL) {
775*e3320f40Smarkfen 		FATAL(ep, ebuf, gettext("Unexpected end of command line, "
776*e3320f40Smarkfen 		    "was expecting a key.\n"));
7777c478bd9Sstevel@tonic-gate 	}
7787c478bd9Sstevel@tonic-gate 
7797c478bd9Sstevel@tonic-gate 	for (i = 0; input[i] != '\0' && input[i] != '/'; i++)
7807c478bd9Sstevel@tonic-gate 		hexlen++;
7817c478bd9Sstevel@tonic-gate 
7827c478bd9Sstevel@tonic-gate 	if (input[i] == '\0') {
7837c478bd9Sstevel@tonic-gate 		bits = 0;
7847c478bd9Sstevel@tonic-gate 	} else {
7857c478bd9Sstevel@tonic-gate 		/* Have /nn. */
7867c478bd9Sstevel@tonic-gate 		input[i] = '\0';
7877c478bd9Sstevel@tonic-gate 		if (sscanf((input + i + 1), "%u", &bits) != 1) {
788*e3320f40Smarkfen 			FATAL1(ep, ebuf, gettext(
789*e3320f40Smarkfen 			    "\"%s\" is not a bit specifier.\n"),
7907c478bd9Sstevel@tonic-gate 			    (input + i + 1));
7917c478bd9Sstevel@tonic-gate 		}
7927c478bd9Sstevel@tonic-gate 		/* hexlen in nibbles */
7937c478bd9Sstevel@tonic-gate 		if (((bits + 3) >> 2) > hexlen) {
794*e3320f40Smarkfen 			ERROR2(ep, ebuf, gettext(
795*e3320f40Smarkfen 			    "bit length %d is too big for %s.\n"), bits, input);
7967c478bd9Sstevel@tonic-gate 		}
7977c478bd9Sstevel@tonic-gate 		/*
7987c478bd9Sstevel@tonic-gate 		 * Adjust hexlen down if user gave us too small of a bit
7997c478bd9Sstevel@tonic-gate 		 * count.
8007c478bd9Sstevel@tonic-gate 		 */
8017c478bd9Sstevel@tonic-gate 		if ((hexlen << 2) > bits + 3) {
802*e3320f40Smarkfen 			WARN2(ep, ebuf, gettext(
803*e3320f40Smarkfen 			    "WARNING: Lower bits will be truncated "
804*e3320f40Smarkfen 			    "for:\n\t%s/%d.\n"), input, bits);
8057c478bd9Sstevel@tonic-gate 			hexlen = (bits + 3) >> 2;
8067c478bd9Sstevel@tonic-gate 			input[hexlen] = '\0';
8077c478bd9Sstevel@tonic-gate 		}
8087c478bd9Sstevel@tonic-gate 	}
8097c478bd9Sstevel@tonic-gate 
8107c478bd9Sstevel@tonic-gate 	/*
8117c478bd9Sstevel@tonic-gate 	 * Allocate.  Remember, hexlen is in nibbles.
8127c478bd9Sstevel@tonic-gate 	 */
8137c478bd9Sstevel@tonic-gate 
8147c478bd9Sstevel@tonic-gate 	alloclen = sizeof (*retval) + roundup((hexlen/2 + (hexlen & 0x1)), 8);
8157c478bd9Sstevel@tonic-gate 	retval = malloc(alloclen);
8167c478bd9Sstevel@tonic-gate 
8177c478bd9Sstevel@tonic-gate 	if (retval == NULL)
8187c478bd9Sstevel@tonic-gate 		Bail("malloc(parsekey)");
8197c478bd9Sstevel@tonic-gate 	retval->sadb_key_len = SADB_8TO64(alloclen);
8207c478bd9Sstevel@tonic-gate 	retval->sadb_key_reserved = 0;
8217c478bd9Sstevel@tonic-gate 	if (bits == 0)
8227c478bd9Sstevel@tonic-gate 		retval->sadb_key_bits = (hexlen + (hexlen & 0x1)) << 2;
8237c478bd9Sstevel@tonic-gate 	else
8247c478bd9Sstevel@tonic-gate 		retval->sadb_key_bits = bits;
8257c478bd9Sstevel@tonic-gate 
8267c478bd9Sstevel@tonic-gate 	/*
8277c478bd9Sstevel@tonic-gate 	 * Read in nibbles.  Read in odd-numbered as shifted high.
8287c478bd9Sstevel@tonic-gate 	 * (e.g. 123 becomes 0x1230).
8297c478bd9Sstevel@tonic-gate 	 */
8307c478bd9Sstevel@tonic-gate 
8317c478bd9Sstevel@tonic-gate 	key = (uint8_t *)(retval + 1);
8327c478bd9Sstevel@tonic-gate 	for (i = 0; input[i] != '\0'; i += 2) {
8337c478bd9Sstevel@tonic-gate 		boolean_t second = (input[i + 1] != '\0');
8347c478bd9Sstevel@tonic-gate 
8357c478bd9Sstevel@tonic-gate 		if (!isxdigit(input[i]) ||
8367c478bd9Sstevel@tonic-gate 		    (!isxdigit(input[i + 1]) && second)) {
837*e3320f40Smarkfen 			ERROR1(ep, ebuf, gettext(
838*e3320f40Smarkfen 			    "string '%s' not a hex value.\n"), input);
839*e3320f40Smarkfen 			free(retval);
840*e3320f40Smarkfen 			retval = NULL;
841*e3320f40Smarkfen 			break;
8427c478bd9Sstevel@tonic-gate 		}
8437c478bd9Sstevel@tonic-gate 		*key = (hd2num(input[i]) << 4);
8447c478bd9Sstevel@tonic-gate 		if (second)
8457c478bd9Sstevel@tonic-gate 			*key |= hd2num(input[i + 1]);
8467c478bd9Sstevel@tonic-gate 		else
8477c478bd9Sstevel@tonic-gate 			break;	/* out of for loop. */
8487c478bd9Sstevel@tonic-gate 		key++;
8497c478bd9Sstevel@tonic-gate 	}
8507c478bd9Sstevel@tonic-gate 
8517c478bd9Sstevel@tonic-gate 	/* bzero the remaining bits if we're a non-octet amount. */
8527c478bd9Sstevel@tonic-gate 	if (bits & 0x7)
8537c478bd9Sstevel@tonic-gate 		*((input[i] == '\0') ? key - 1 : key) &=
8547c478bd9Sstevel@tonic-gate 		    0xff << (8 - (bits & 0x7));
8557c478bd9Sstevel@tonic-gate 
856*e3320f40Smarkfen 	handle_errors(ep, NULL, B_FALSE, B_FALSE);
8577c478bd9Sstevel@tonic-gate 	return (retval);
8587c478bd9Sstevel@tonic-gate }
8597c478bd9Sstevel@tonic-gate 
8607c478bd9Sstevel@tonic-gate /*
8617c478bd9Sstevel@tonic-gate  * Write a message to the PF_KEY socket.  If verbose, print the message
8627c478bd9Sstevel@tonic-gate  * heading into the kernel.
8637c478bd9Sstevel@tonic-gate  */
8647c478bd9Sstevel@tonic-gate static int
8657c478bd9Sstevel@tonic-gate key_write(int fd, void *msg, size_t len)
8667c478bd9Sstevel@tonic-gate {
8677c478bd9Sstevel@tonic-gate 	if (vflag) {
8687c478bd9Sstevel@tonic-gate 		(void) printf(
8697c478bd9Sstevel@tonic-gate 		    gettext("VERBOSE ON:  Message to kernel looks like:\n"));
8707c478bd9Sstevel@tonic-gate 		(void) printf("==========================================\n");
8718810c16bSdanmcd 		print_samsg(msg, B_FALSE, vflag);
8727c478bd9Sstevel@tonic-gate 		(void) printf("==========================================\n");
8737c478bd9Sstevel@tonic-gate 	}
8747c478bd9Sstevel@tonic-gate 
8757c478bd9Sstevel@tonic-gate 	return (write(fd, msg, len));
8767c478bd9Sstevel@tonic-gate }
8777c478bd9Sstevel@tonic-gate 
8787c478bd9Sstevel@tonic-gate /*
8797c478bd9Sstevel@tonic-gate  * SIGALRM handler for time_critical_enter.
8807c478bd9Sstevel@tonic-gate  */
8817c478bd9Sstevel@tonic-gate static void
8827c478bd9Sstevel@tonic-gate time_critical_catch(int signal)
8837c478bd9Sstevel@tonic-gate {
8847c478bd9Sstevel@tonic-gate 	if (signal == SIGALRM) {
8857c478bd9Sstevel@tonic-gate 		errx(1, gettext("Reply message from PF_KEY timed out."));
8867c478bd9Sstevel@tonic-gate 	} else {
8877c478bd9Sstevel@tonic-gate 		errx(1, gettext("Caught signal %d while trying to receive"
8887c478bd9Sstevel@tonic-gate 			"PF_KEY reply message"), signal);
8897c478bd9Sstevel@tonic-gate 	}
8907c478bd9Sstevel@tonic-gate 	/* errx() calls exit. */
8917c478bd9Sstevel@tonic-gate }
8927c478bd9Sstevel@tonic-gate 
8937c478bd9Sstevel@tonic-gate #define	TIME_CRITICAL_TIME 10	/* In seconds */
8947c478bd9Sstevel@tonic-gate 
8957c478bd9Sstevel@tonic-gate /*
8967c478bd9Sstevel@tonic-gate  * Enter a "time critical" section where key is waiting for a return message.
8977c478bd9Sstevel@tonic-gate  */
8987c478bd9Sstevel@tonic-gate static void
8997c478bd9Sstevel@tonic-gate time_critical_enter(void)
9007c478bd9Sstevel@tonic-gate {
9017c478bd9Sstevel@tonic-gate 	(void) signal(SIGALRM, time_critical_catch);
9027c478bd9Sstevel@tonic-gate 	(void) alarm(TIME_CRITICAL_TIME);
9037c478bd9Sstevel@tonic-gate }
9047c478bd9Sstevel@tonic-gate 
9057c478bd9Sstevel@tonic-gate /*
9067c478bd9Sstevel@tonic-gate  * Exit the "time critical" section after getting an appropriate return
9077c478bd9Sstevel@tonic-gate  * message.
9087c478bd9Sstevel@tonic-gate  */
9097c478bd9Sstevel@tonic-gate static void
9107c478bd9Sstevel@tonic-gate time_critical_exit(void)
9117c478bd9Sstevel@tonic-gate {
9127c478bd9Sstevel@tonic-gate 	(void) alarm(0);
9137c478bd9Sstevel@tonic-gate 	(void) signal(SIGALRM, SIG_DFL);
9147c478bd9Sstevel@tonic-gate }
9157c478bd9Sstevel@tonic-gate 
9167c478bd9Sstevel@tonic-gate /*
9177c478bd9Sstevel@tonic-gate  * Construct a PF_KEY FLUSH message for the SA type specified.
9187c478bd9Sstevel@tonic-gate  */
9197c478bd9Sstevel@tonic-gate static void
9207c478bd9Sstevel@tonic-gate doflush(int satype)
9217c478bd9Sstevel@tonic-gate {
9227c478bd9Sstevel@tonic-gate 	struct sadb_msg msg;
9237c478bd9Sstevel@tonic-gate 	int rc;
9247c478bd9Sstevel@tonic-gate 
9257c478bd9Sstevel@tonic-gate 	msg_init(&msg, SADB_FLUSH, (uint8_t)satype);
9267c478bd9Sstevel@tonic-gate 	rc = key_write(keysock, &msg, sizeof (msg));
9277c478bd9Sstevel@tonic-gate 	if (rc == -1)
9287c478bd9Sstevel@tonic-gate 		Bail("write() to PF_KEY socket failed (in doflush)");
9297c478bd9Sstevel@tonic-gate 
9307c478bd9Sstevel@tonic-gate 	time_critical_enter();
9317c478bd9Sstevel@tonic-gate 	do {
9327c478bd9Sstevel@tonic-gate 		rc = read(keysock, &msg, sizeof (msg));
9337c478bd9Sstevel@tonic-gate 		if (rc == -1)
9347c478bd9Sstevel@tonic-gate 			Bail("read (in doflush)");
9357c478bd9Sstevel@tonic-gate 	} while (msg.sadb_msg_seq != seq || msg.sadb_msg_pid != mypid);
9367c478bd9Sstevel@tonic-gate 	time_critical_exit();
9377c478bd9Sstevel@tonic-gate 
9387c478bd9Sstevel@tonic-gate 	/*
9397c478bd9Sstevel@tonic-gate 	 * I should _never_ hit the following unless:
9407c478bd9Sstevel@tonic-gate 	 *
9417c478bd9Sstevel@tonic-gate 	 * 1. There is a kernel bug.
9427c478bd9Sstevel@tonic-gate 	 * 2. There is another process filling in its pid with mine, and
9437c478bd9Sstevel@tonic-gate 	 *    issuing a different message that would cause a different result.
9447c478bd9Sstevel@tonic-gate 	 */
9457c478bd9Sstevel@tonic-gate 	if (msg.sadb_msg_type != SADB_FLUSH ||
9467c478bd9Sstevel@tonic-gate 	    msg.sadb_msg_satype != (uint8_t)satype) {
9477c478bd9Sstevel@tonic-gate 		syslog((LOG_NOTICE|LOG_AUTH),
9487c478bd9Sstevel@tonic-gate 		    gettext("doflush: Return message not of type SADB_FLUSH!"));
9497c478bd9Sstevel@tonic-gate 		Bail("doflush: Return message not of type SADB_FLUSH!");
9507c478bd9Sstevel@tonic-gate 	}
9517c478bd9Sstevel@tonic-gate 
9527c478bd9Sstevel@tonic-gate 	if (msg.sadb_msg_errno != 0) {
9537c478bd9Sstevel@tonic-gate 		errno = msg.sadb_msg_errno;
9547c478bd9Sstevel@tonic-gate 		if (errno == EINVAL) {
9557c478bd9Sstevel@tonic-gate 			print_diagnostic(stderr, msg.sadb_x_msg_diagnostic);
9567c478bd9Sstevel@tonic-gate 			warnx(gettext("Cannot flush SA type %d."), satype);
9577c478bd9Sstevel@tonic-gate 		}
9587c478bd9Sstevel@tonic-gate 		Bail("return message (in doflush)");
9597c478bd9Sstevel@tonic-gate 	}
9607c478bd9Sstevel@tonic-gate }
9617c478bd9Sstevel@tonic-gate 
9627c478bd9Sstevel@tonic-gate /*
9637c478bd9Sstevel@tonic-gate  * save_XXX functions are used when "saving" the SA tables to either a
9647c478bd9Sstevel@tonic-gate  * file or standard output.  They use the dump_XXX functions where needed,
9657c478bd9Sstevel@tonic-gate  * but mostly they use the rparseXXX functions.
9667c478bd9Sstevel@tonic-gate  */
9677c478bd9Sstevel@tonic-gate 
9687c478bd9Sstevel@tonic-gate /*
9697c478bd9Sstevel@tonic-gate  * Because "save" and "dump" both use the SADB_DUMP message, fold both
9707c478bd9Sstevel@tonic-gate  * into the same function.
9717c478bd9Sstevel@tonic-gate  */
9727c478bd9Sstevel@tonic-gate static void
9737c478bd9Sstevel@tonic-gate dodump(int satype, FILE *ofile)
9747c478bd9Sstevel@tonic-gate {
9757c478bd9Sstevel@tonic-gate 	struct sadb_msg *msg = (struct sadb_msg *)get_buffer;
9767c478bd9Sstevel@tonic-gate 	int rc;
9777c478bd9Sstevel@tonic-gate 
9787c478bd9Sstevel@tonic-gate 	if (ofile != NULL) {
9797c478bd9Sstevel@tonic-gate 		(void) fprintf(ofile,
9807c478bd9Sstevel@tonic-gate 		    gettext("# This key file was generated by the"));
9817c478bd9Sstevel@tonic-gate 		(void) fprintf(ofile,
9827c478bd9Sstevel@tonic-gate 		    gettext(" ipseckey(1m) command's 'save' feature.\n\n"));
9837c478bd9Sstevel@tonic-gate 	}
9847c478bd9Sstevel@tonic-gate 	msg_init(msg, SADB_DUMP, (uint8_t)satype);
9857c478bd9Sstevel@tonic-gate 	rc = key_write(keysock, msg, sizeof (*msg));
9867c478bd9Sstevel@tonic-gate 	if (rc == -1)
9877c478bd9Sstevel@tonic-gate 		Bail("write to PF_KEY socket failed (in dodump)");
9887c478bd9Sstevel@tonic-gate 
9897c478bd9Sstevel@tonic-gate 	do {
9907c478bd9Sstevel@tonic-gate 		/*
9917c478bd9Sstevel@tonic-gate 		 * For DUMP, do only the read as a time critical section.
9927c478bd9Sstevel@tonic-gate 		 */
9937c478bd9Sstevel@tonic-gate 		time_critical_enter();
9947c478bd9Sstevel@tonic-gate 		rc = read(keysock, get_buffer, sizeof (get_buffer));
9957c478bd9Sstevel@tonic-gate 		time_critical_exit();
9967c478bd9Sstevel@tonic-gate 		if (rc == -1)
9977c478bd9Sstevel@tonic-gate 			Bail("read (in dodump)");
9987c478bd9Sstevel@tonic-gate 		if (msg->sadb_msg_pid == mypid &&
9997c478bd9Sstevel@tonic-gate 		    msg->sadb_msg_type == SADB_DUMP &&
10007c478bd9Sstevel@tonic-gate 		    msg->sadb_msg_seq != 0 &&
10017c478bd9Sstevel@tonic-gate 		    msg->sadb_msg_errno == 0) {
10027c478bd9Sstevel@tonic-gate 			if (ofile == NULL) {
10038810c16bSdanmcd 				print_samsg(get_buffer, B_FALSE, vflag);
10047c478bd9Sstevel@tonic-gate 				(void) putchar('\n');
10057c478bd9Sstevel@tonic-gate 			} else {
10067c478bd9Sstevel@tonic-gate 				save_assoc(get_buffer, ofile);
10077c478bd9Sstevel@tonic-gate 			}
10087c478bd9Sstevel@tonic-gate 		}
10097c478bd9Sstevel@tonic-gate 	} while (msg->sadb_msg_pid != mypid ||
10107c478bd9Sstevel@tonic-gate 	    (msg->sadb_msg_errno == 0 && msg->sadb_msg_seq != 0));
10117c478bd9Sstevel@tonic-gate 
10127c478bd9Sstevel@tonic-gate 	if (ofile != NULL && ofile != stdout)
10137c478bd9Sstevel@tonic-gate 		(void) fclose(ofile);
10147c478bd9Sstevel@tonic-gate 
10157c478bd9Sstevel@tonic-gate 	if (msg->sadb_msg_errno == 0) {
10167c478bd9Sstevel@tonic-gate 		if (ofile == NULL)
10177c478bd9Sstevel@tonic-gate 			(void) printf(
10187c478bd9Sstevel@tonic-gate 			    gettext("Dump succeeded for SA type %d.\n"),
10197c478bd9Sstevel@tonic-gate 			    satype);
10207c478bd9Sstevel@tonic-gate 	} else {
10217c478bd9Sstevel@tonic-gate 		print_diagnostic(stderr, msg->sadb_x_msg_diagnostic);
10227c478bd9Sstevel@tonic-gate 		errno = msg->sadb_msg_errno;
10237c478bd9Sstevel@tonic-gate 		Bail("Dump failed");
10247c478bd9Sstevel@tonic-gate 	}
10257c478bd9Sstevel@tonic-gate }
10267c478bd9Sstevel@tonic-gate 
10277c478bd9Sstevel@tonic-gate #define	SCOPE_UNSPEC 0
10287c478bd9Sstevel@tonic-gate #define	SCOPE_LINKLOCAL 1
10297c478bd9Sstevel@tonic-gate #define	SCOPE_SITELOCAL 2
10307c478bd9Sstevel@tonic-gate #define	SCOPE_GLOBAL 3
10317c478bd9Sstevel@tonic-gate #define	SCOPE_V4COMPAT 4
10327c478bd9Sstevel@tonic-gate #define	SCOPE_LOOPBACK 5	/* Pedantic, yes, but necessary. */
10337c478bd9Sstevel@tonic-gate 
10347c478bd9Sstevel@tonic-gate static int
10357c478bd9Sstevel@tonic-gate ipv6_addr_scope(struct in6_addr *addr)
10367c478bd9Sstevel@tonic-gate {
10377c478bd9Sstevel@tonic-gate 	/* Don't return anything regarding multicast for now... */
10387c478bd9Sstevel@tonic-gate 
10397c478bd9Sstevel@tonic-gate 	if (IN6_IS_ADDR_UNSPECIFIED(addr))
10407c478bd9Sstevel@tonic-gate 		return (SCOPE_UNSPEC);
10417c478bd9Sstevel@tonic-gate 
10427c478bd9Sstevel@tonic-gate 	if (IN6_IS_ADDR_LINKLOCAL(addr))
10437c478bd9Sstevel@tonic-gate 		return (SCOPE_LINKLOCAL);
10447c478bd9Sstevel@tonic-gate 
10457c478bd9Sstevel@tonic-gate 	if (IN6_IS_ADDR_SITELOCAL(addr))
10467c478bd9Sstevel@tonic-gate 		return (SCOPE_SITELOCAL);
10477c478bd9Sstevel@tonic-gate 
10487c478bd9Sstevel@tonic-gate 	if (IN6_IS_ADDR_V4COMPAT(addr))
10497c478bd9Sstevel@tonic-gate 		return (SCOPE_V4COMPAT);
10507c478bd9Sstevel@tonic-gate 
10517c478bd9Sstevel@tonic-gate 	if (IN6_IS_ADDR_LOOPBACK(addr))
10527c478bd9Sstevel@tonic-gate 		return (SCOPE_LOOPBACK);
10537c478bd9Sstevel@tonic-gate 
10547c478bd9Sstevel@tonic-gate 	/* For now, return global by default. */
10557c478bd9Sstevel@tonic-gate 	return (SCOPE_GLOBAL);
10567c478bd9Sstevel@tonic-gate }
10577c478bd9Sstevel@tonic-gate 
10587c478bd9Sstevel@tonic-gate /*
10597c478bd9Sstevel@tonic-gate  * doaddresses():
10607c478bd9Sstevel@tonic-gate  *
10617c478bd9Sstevel@tonic-gate  * Used by doaddup() and dodelget() to create new SA's based on the
10627c478bd9Sstevel@tonic-gate  * provided source and destination addresses hostent.
10637c478bd9Sstevel@tonic-gate  *
10647c478bd9Sstevel@tonic-gate  * sadb_msg_type: expected PF_KEY reply message type
10657c478bd9Sstevel@tonic-gate  * sadb_msg_satype: expected PF_KEY reply satype
10667c478bd9Sstevel@tonic-gate  * cmd: user command
10677c478bd9Sstevel@tonic-gate  * srchp: hostent for the source address(es)
10687c478bd9Sstevel@tonic-gate  * dsthp: hostent for the destination address(es)
10697c478bd9Sstevel@tonic-gate  * src: points to the SADB source address extension
10707c478bd9Sstevel@tonic-gate  * dst: points to the SADB destination address extension
10717c478bd9Sstevel@tonic-gate  * unspec_src: indicates an unspecified source address.
10727c478bd9Sstevel@tonic-gate  * buffer: pointer to the SADB buffer to use with PF_KEY
10737c478bd9Sstevel@tonic-gate  * buffer_size: size of buffer
10747c478bd9Sstevel@tonic-gate  * spi: spi for this message (set by caller)
10757c478bd9Sstevel@tonic-gate  * srcport: source port if specified
10768810c16bSdanmcd  * dstport: destination port if specified
10777c478bd9Sstevel@tonic-gate  * proto: IP protocol number if specified
10788810c16bSdanmcd  * iproto: Inner (tunnel mode) IP protocol number if specified
10797c478bd9Sstevel@tonic-gate  * NATT note: we are going to assume a semi-sane world where NAT
10807c478bd9Sstevel@tonic-gate  * boxen don't explode to multiple addresses.
10817c478bd9Sstevel@tonic-gate  */
10827c478bd9Sstevel@tonic-gate static void
10837c478bd9Sstevel@tonic-gate doaddresses(uint8_t sadb_msg_type, uint8_t sadb_msg_satype, int cmd,
10847c478bd9Sstevel@tonic-gate     struct hostent *srchp, struct hostent *dsthp,
10857c478bd9Sstevel@tonic-gate     struct sadb_address *src, struct sadb_address *dst,
1086*e3320f40Smarkfen     boolean_t unspec_src, uint64_t *buffer, int buffer_size, uint32_t spi,
1087*e3320f40Smarkfen     char *ebuf)
10887c478bd9Sstevel@tonic-gate {
10897c478bd9Sstevel@tonic-gate 	boolean_t single_dst;
10907c478bd9Sstevel@tonic-gate 	struct sockaddr_in6 *sin6;
10917c478bd9Sstevel@tonic-gate 	struct sadb_msg *msgp;
10927c478bd9Sstevel@tonic-gate 	int i, rc;
10937c478bd9Sstevel@tonic-gate 	char **walker;	/* For the SRC and PROXY walking functions. */
10947c478bd9Sstevel@tonic-gate 	char *first_match;
10958810c16bSdanmcd 	uint64_t savebuf[MAX_GET_SIZE];
10968810c16bSdanmcd 	uint16_t srcport = 0, dstport = 0;
1097*e3320f40Smarkfen 	char *ep = NULL;
10987c478bd9Sstevel@tonic-gate 
10997c478bd9Sstevel@tonic-gate 	/*
11007c478bd9Sstevel@tonic-gate 	 * Okay, now we have "src", "dst", and maybe "proxy" reassigned
11017c478bd9Sstevel@tonic-gate 	 * to point into the buffer to be written to PF_KEY, we can do
11027c478bd9Sstevel@tonic-gate 	 * potentially several writes based on destination address.
11037c478bd9Sstevel@tonic-gate 	 *
11048810c16bSdanmcd 	 * First, obtain port numbers from passed-in extensions.
11057c478bd9Sstevel@tonic-gate 	 */
11067c478bd9Sstevel@tonic-gate 
11077c478bd9Sstevel@tonic-gate 	if (src != NULL) {
11087c478bd9Sstevel@tonic-gate 		sin6 = (struct sockaddr_in6 *)(src + 1);
11098810c16bSdanmcd 		srcport = ntohs(sin6->sin6_port);
11107c478bd9Sstevel@tonic-gate 	}
11117c478bd9Sstevel@tonic-gate 	if (dst != NULL) {
11127c478bd9Sstevel@tonic-gate 		sin6 = (struct sockaddr_in6 *)(dst + 1);
11138810c16bSdanmcd 		dstport = ntohs(sin6->sin6_port);
11147c478bd9Sstevel@tonic-gate 	}
11157c478bd9Sstevel@tonic-gate 
11167c478bd9Sstevel@tonic-gate 	/*
11177c478bd9Sstevel@tonic-gate 	 * The rules for ADD, GET, and UPDATE: (NOTE:  This assumes IPsec.
11187c478bd9Sstevel@tonic-gate 	 * If other consumers of PF_KEY happen, this will have to be
11197c478bd9Sstevel@tonic-gate 	 * rewhacked.):
11207c478bd9Sstevel@tonic-gate 	 *
11217c478bd9Sstevel@tonic-gate 	 *	Do a message for every possible DST address.
11227c478bd9Sstevel@tonic-gate 	 *
11237c478bd9Sstevel@tonic-gate 	 *	If a source or proxy address explodes, keep unspecified
11247c478bd9Sstevel@tonic-gate 	 *	(and mention unspecified).
11257c478bd9Sstevel@tonic-gate 	 *
11267c478bd9Sstevel@tonic-gate 	 * If dsthp is == dummy.he, then go through the loop once.
11277c478bd9Sstevel@tonic-gate 	 * If any other hp is == dummy.he, then you don't have to apply any
11287c478bd9Sstevel@tonic-gate 	 * silly rules.
11297c478bd9Sstevel@tonic-gate 	 *
11307c478bd9Sstevel@tonic-gate 	 * DELETE is different, because you can leave either "src" or "dst"
11317c478bd9Sstevel@tonic-gate 	 * blank!  You need to explode if one of them is full, and not assume
11327c478bd9Sstevel@tonic-gate 	 * that the other is set.
11337c478bd9Sstevel@tonic-gate 	 */
11347c478bd9Sstevel@tonic-gate 
11357c478bd9Sstevel@tonic-gate 	if (dsthp == NULL) {
11367c478bd9Sstevel@tonic-gate 		/*
11377c478bd9Sstevel@tonic-gate 		 * No destination address specified.
11387c478bd9Sstevel@tonic-gate 		 * With extended diagnostics, we don't have to bail the
11397c478bd9Sstevel@tonic-gate 		 * non-DELETE cases here.  The EINVAL diagnostics will be
11407c478bd9Sstevel@tonic-gate 		 * enough to inform the user(s) what happened.
11417c478bd9Sstevel@tonic-gate 		 */
11427c478bd9Sstevel@tonic-gate 		i = 0;
11437c478bd9Sstevel@tonic-gate 		do {
11447c478bd9Sstevel@tonic-gate 			if (srchp == &dummy.he) {
11457c478bd9Sstevel@tonic-gate 				/* Just to be sure... */
11467c478bd9Sstevel@tonic-gate 				srchp->h_addr_list[1] = NULL;
11477c478bd9Sstevel@tonic-gate 			} else if (srchp != NULL) {
11487c478bd9Sstevel@tonic-gate 				/* Degenerate case, h_addr_list[0] == NULL. */
11497c478bd9Sstevel@tonic-gate 				if (srchp->h_addr_list[i] == NULL)
11507c478bd9Sstevel@tonic-gate 					Bail("Empty source address list");
11517c478bd9Sstevel@tonic-gate 
11527c478bd9Sstevel@tonic-gate 				/*
11537c478bd9Sstevel@tonic-gate 				 * Fill in the src sockaddr.
11547c478bd9Sstevel@tonic-gate 				 */
11557c478bd9Sstevel@tonic-gate 				sin6 = (struct sockaddr_in6 *)(src + 1);
11567c478bd9Sstevel@tonic-gate 				bzero(sin6, sizeof (*sin6));
11577c478bd9Sstevel@tonic-gate 				bcopy(srchp->h_addr_list[i], &sin6->sin6_addr,
11587c478bd9Sstevel@tonic-gate 				    sizeof (struct in6_addr));
11597c478bd9Sstevel@tonic-gate 				sin6->sin6_family = AF_INET6;
11607c478bd9Sstevel@tonic-gate 				sin6->sin6_port = htons(srcport);
11617c478bd9Sstevel@tonic-gate 			}
11627c478bd9Sstevel@tonic-gate 
11637c478bd9Sstevel@tonic-gate 			/* Save off a copy for later writing... */
11647c478bd9Sstevel@tonic-gate 			msgp = (struct sadb_msg *)buffer;
11657c478bd9Sstevel@tonic-gate 			bcopy(buffer, savebuf, SADB_64TO8(msgp->sadb_msg_len));
11667c478bd9Sstevel@tonic-gate 
11677c478bd9Sstevel@tonic-gate 			rc = key_write(keysock, buffer,
11687c478bd9Sstevel@tonic-gate 			    SADB_64TO8(msgp->sadb_msg_len));
11697c478bd9Sstevel@tonic-gate 			if (rc == -1)
11707c478bd9Sstevel@tonic-gate 				Bail("write() to PF_KEY socket "
11717c478bd9Sstevel@tonic-gate 				    "(in doaddresses)");
11727c478bd9Sstevel@tonic-gate 
11737c478bd9Sstevel@tonic-gate 			time_critical_enter();
11747c478bd9Sstevel@tonic-gate 			do {
11757c478bd9Sstevel@tonic-gate 				rc = read(keysock, buffer, buffer_size);
11767c478bd9Sstevel@tonic-gate 				if (rc == -1)
11777c478bd9Sstevel@tonic-gate 					Bail("read (in doaddresses)");
11787c478bd9Sstevel@tonic-gate 			} while (msgp->sadb_msg_seq != seq ||
11797c478bd9Sstevel@tonic-gate 			    msgp->sadb_msg_pid != mypid);
11807c478bd9Sstevel@tonic-gate 			time_critical_exit();
11817c478bd9Sstevel@tonic-gate 
11827c478bd9Sstevel@tonic-gate 			if (msgp->sadb_msg_type != sadb_msg_type ||
11837c478bd9Sstevel@tonic-gate 			    msgp->sadb_msg_satype != sadb_msg_satype) {
11847c478bd9Sstevel@tonic-gate 				syslog((LOG_NOTICE|LOG_AUTH), gettext(
11857c478bd9Sstevel@tonic-gate 				    "doaddresses: Unexpected returned message "
11867c478bd9Sstevel@tonic-gate 				    "(%d exp %d)\n"), msgp->sadb_msg_type,
11877c478bd9Sstevel@tonic-gate 				    sadb_msg_type);
11887c478bd9Sstevel@tonic-gate 				Bail("doaddresses: Unexpected returned "
11897c478bd9Sstevel@tonic-gate 				    "message");
11907c478bd9Sstevel@tonic-gate 			}
11917c478bd9Sstevel@tonic-gate 
11927c478bd9Sstevel@tonic-gate 			errno = msgp->sadb_msg_errno;
11937c478bd9Sstevel@tonic-gate 			if (errno != 0) {
11947c478bd9Sstevel@tonic-gate 				if (errno == EINVAL) {
1195*e3320f40Smarkfen 					WARN(ep, ebuf, gettext(
1196*e3320f40Smarkfen 					    "One of the entered "
1197*e3320f40Smarkfen 					    "values is incorrect."));
11987c478bd9Sstevel@tonic-gate 					print_diagnostic(stderr,
11997c478bd9Sstevel@tonic-gate 					    msgp->sadb_x_msg_diagnostic);
1200*e3320f40Smarkfen 				} else {
1201*e3320f40Smarkfen 					Bail("return message (in doaddresses)");
12027c478bd9Sstevel@tonic-gate 				}
12037c478bd9Sstevel@tonic-gate 			}
12047c478bd9Sstevel@tonic-gate 
12057c478bd9Sstevel@tonic-gate 			/* ...and then restore the saved buffer. */
12067c478bd9Sstevel@tonic-gate 			msgp = (struct sadb_msg *)savebuf;
12077c478bd9Sstevel@tonic-gate 			bcopy(savebuf, buffer, SADB_64TO8(msgp->sadb_msg_len));
12087c478bd9Sstevel@tonic-gate 		} while (srchp != NULL && srchp->h_addr_list[++i] != NULL);
12097c478bd9Sstevel@tonic-gate 		return;
12107c478bd9Sstevel@tonic-gate 	}
12117c478bd9Sstevel@tonic-gate 
12127c478bd9Sstevel@tonic-gate 	single_dst = (dsthp == &dummy.he || dsthp->h_addr_list[1] == NULL);
12137c478bd9Sstevel@tonic-gate 
12147c478bd9Sstevel@tonic-gate 	for (i = 0; dsthp->h_addr_list[i] != NULL; i++) {
12157c478bd9Sstevel@tonic-gate 		if (dsthp == &dummy.he) {
12167c478bd9Sstevel@tonic-gate 			/* Just to be sure... */
12177c478bd9Sstevel@tonic-gate 			dsthp->h_addr_list[1] = NULL;
12187c478bd9Sstevel@tonic-gate 		} else {
12197c478bd9Sstevel@tonic-gate 			/*
12207c478bd9Sstevel@tonic-gate 			 * Fill in the dst sockaddr.
12217c478bd9Sstevel@tonic-gate 			 */
12227c478bd9Sstevel@tonic-gate 			sin6 = (struct sockaddr_in6 *)(dst + 1);
12237c478bd9Sstevel@tonic-gate 			bzero(sin6, sizeof (*sin6));
12247c478bd9Sstevel@tonic-gate 			bcopy(dsthp->h_addr_list[i], &sin6->sin6_addr,
12257c478bd9Sstevel@tonic-gate 			    sizeof (struct in6_addr));
12267c478bd9Sstevel@tonic-gate 			sin6->sin6_family = AF_INET6;
12277c478bd9Sstevel@tonic-gate 			sin6->sin6_port = htons(dstport);
12287c478bd9Sstevel@tonic-gate 		}
12297c478bd9Sstevel@tonic-gate 
12307c478bd9Sstevel@tonic-gate 		/*
12317c478bd9Sstevel@tonic-gate 		 * Try and assign src, if there's any ambiguity.
12327c478bd9Sstevel@tonic-gate 		 */
12337c478bd9Sstevel@tonic-gate 		if (!unspec_src && srchp != &dummy.he) {
12347c478bd9Sstevel@tonic-gate 			if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
12357c478bd9Sstevel@tonic-gate 				/*
12367c478bd9Sstevel@tonic-gate 				 * IPv4 address.  Find an IPv4 address, then
12377c478bd9Sstevel@tonic-gate 				 * keep looking for a second one.  If a second
12387c478bd9Sstevel@tonic-gate 				 * exists, print a message, and fill in the
12397c478bd9Sstevel@tonic-gate 				 * unspecified address.
12407c478bd9Sstevel@tonic-gate 				 */
12417c478bd9Sstevel@tonic-gate 				first_match = NULL;
12427c478bd9Sstevel@tonic-gate 
12437c478bd9Sstevel@tonic-gate 				for (walker = srchp->h_addr_list;
12447c478bd9Sstevel@tonic-gate 				    *walker != NULL; walker++) {
12457c478bd9Sstevel@tonic-gate 					/* LINTED E_BAD_PTR_CAST_ALIGN */
12467c478bd9Sstevel@tonic-gate 					if (IN6_IS_ADDR_V4MAPPED(
12477c478bd9Sstevel@tonic-gate 					    (struct in6_addr *)*walker)) {
12487c478bd9Sstevel@tonic-gate 						if (first_match != NULL)
12497c478bd9Sstevel@tonic-gate 							break;
12507c478bd9Sstevel@tonic-gate 						else
12517c478bd9Sstevel@tonic-gate 							first_match = *walker;
12527c478bd9Sstevel@tonic-gate 					}
12537c478bd9Sstevel@tonic-gate 				}
12547c478bd9Sstevel@tonic-gate 				sin6 = (struct sockaddr_in6 *)(src + 1);
12557c478bd9Sstevel@tonic-gate 				bzero(sin6, sizeof (*sin6));
12567c478bd9Sstevel@tonic-gate 
12577c478bd9Sstevel@tonic-gate 				if (first_match == NULL) {
12587c478bd9Sstevel@tonic-gate 					/*
12597c478bd9Sstevel@tonic-gate 					 * No IPv4 hits.  Is this a single
12607c478bd9Sstevel@tonic-gate 					 * dest?
12617c478bd9Sstevel@tonic-gate 					 */
1262*e3320f40Smarkfen 					WARN1(ep, ebuf, gettext(
12637c478bd9Sstevel@tonic-gate 					    "No IPv4 source address "
1264*e3320f40Smarkfen 					    "for name %s.\n"), srchp->h_name);
12657c478bd9Sstevel@tonic-gate 					if (single_dst) {
1266*e3320f40Smarkfen 						ERROR(ep, ebuf, gettext(
1267*e3320f40Smarkfen 						    "Only single destination "
1268*e3320f40Smarkfen 						    "IP address.\n"));
12697c478bd9Sstevel@tonic-gate 					} else {
12707c478bd9Sstevel@tonic-gate 						/* Continue, but do I print? */
12717c478bd9Sstevel@tonic-gate 						continue;  /* for loop */
12727c478bd9Sstevel@tonic-gate 					}
12737c478bd9Sstevel@tonic-gate 
12747c478bd9Sstevel@tonic-gate 					/* I should never reach here. */
12757c478bd9Sstevel@tonic-gate 				}
12767c478bd9Sstevel@tonic-gate 
12777c478bd9Sstevel@tonic-gate 				sin6->sin6_family = AF_INET6;
12787c478bd9Sstevel@tonic-gate 				sin6->sin6_port = htons(srcport);
12797c478bd9Sstevel@tonic-gate 				if (*walker != NULL) {
12807c478bd9Sstevel@tonic-gate 					/*
12817c478bd9Sstevel@tonic-gate 					 * Early loop exit.  It must've been
12827c478bd9Sstevel@tonic-gate 					 * multiple hits...
12837c478bd9Sstevel@tonic-gate 					 *
12847c478bd9Sstevel@tonic-gate 					 * Issue a null-source warning?
12857c478bd9Sstevel@tonic-gate 					 */
1286*e3320f40Smarkfen 					WARN1(ep, ebuf, gettext(
12877c478bd9Sstevel@tonic-gate 					    "Multiple IPv4 source addresses "
12887c478bd9Sstevel@tonic-gate 					    "for %s, using unspecified source "
12897c478bd9Sstevel@tonic-gate 					    "instead."), srchp->h_name);
12907c478bd9Sstevel@tonic-gate 				} else {
12917c478bd9Sstevel@tonic-gate 					/*
12927c478bd9Sstevel@tonic-gate 					 * If I reach here w/o hitting the
12937c478bd9Sstevel@tonic-gate 					 * previous if statements, I have a
12947c478bd9Sstevel@tonic-gate 					 * single source address for this
12957c478bd9Sstevel@tonic-gate 					 * destination.
12967c478bd9Sstevel@tonic-gate 					 */
12977c478bd9Sstevel@tonic-gate 					bcopy(first_match, &sin6->sin6_addr,
12987c478bd9Sstevel@tonic-gate 					    sizeof (struct in6_addr));
12997c478bd9Sstevel@tonic-gate 				}
13007c478bd9Sstevel@tonic-gate 			} else {
13017c478bd9Sstevel@tonic-gate 				/*
13027c478bd9Sstevel@tonic-gate 				 * IPv6 address.  Find an IPv6 address.
13037c478bd9Sstevel@tonic-gate 				 * Unlike IPv4 addresses, things can get a
13047c478bd9Sstevel@tonic-gate 				 * little more sticky with scopes, etc.
13057c478bd9Sstevel@tonic-gate 				 */
13067c478bd9Sstevel@tonic-gate 				int dst_scope, src_scope;
13077c478bd9Sstevel@tonic-gate 
13087c478bd9Sstevel@tonic-gate 				dst_scope = ipv6_addr_scope(&sin6->sin6_addr);
13097c478bd9Sstevel@tonic-gate 
13107c478bd9Sstevel@tonic-gate 				first_match = NULL;
13117c478bd9Sstevel@tonic-gate 				for (walker = srchp->h_addr_list;
13127c478bd9Sstevel@tonic-gate 				    *walker != NULL; walker++) {
13137c478bd9Sstevel@tonic-gate 					/* LINTED E_BAD_PTR_CAST_ALIGN */
13147c478bd9Sstevel@tonic-gate 					if (!IN6_IS_ADDR_V4MAPPED(
13157c478bd9Sstevel@tonic-gate 					    (struct in6_addr *)*walker)) {
13167c478bd9Sstevel@tonic-gate 						/*
13177c478bd9Sstevel@tonic-gate 						 * Set first-match, etc.
13187c478bd9Sstevel@tonic-gate 						 * Take into account scopes,
13197c478bd9Sstevel@tonic-gate 						 * and other IPv6 thingies.
13207c478bd9Sstevel@tonic-gate 						 */
13217c478bd9Sstevel@tonic-gate 						src_scope = ipv6_addr_scope(
13227c478bd9Sstevel@tonic-gate 						    /* LINTED E_BAD_PTR_CAST */
13237c478bd9Sstevel@tonic-gate 						    (struct in6_addr *)*walker);
13247c478bd9Sstevel@tonic-gate 						if (src_scope == SCOPE_UNSPEC ||
13257c478bd9Sstevel@tonic-gate 						    src_scope == dst_scope) {
13267c478bd9Sstevel@tonic-gate 							if (first_match !=
13277c478bd9Sstevel@tonic-gate 							    NULL)
13287c478bd9Sstevel@tonic-gate 								break;
13297c478bd9Sstevel@tonic-gate 							else
13307c478bd9Sstevel@tonic-gate 								first_match =
13317c478bd9Sstevel@tonic-gate 								    *walker;
13327c478bd9Sstevel@tonic-gate 						}
13337c478bd9Sstevel@tonic-gate 					}
13347c478bd9Sstevel@tonic-gate 				}
13357c478bd9Sstevel@tonic-gate 
13367c478bd9Sstevel@tonic-gate 				sin6 = (struct sockaddr_in6 *)(src + 1);
13377c478bd9Sstevel@tonic-gate 				bzero(sin6, sizeof (*sin6));
13387c478bd9Sstevel@tonic-gate 				sin6->sin6_port = htons(srcport);
13397c478bd9Sstevel@tonic-gate 				if (first_match == NULL) {
13407c478bd9Sstevel@tonic-gate 					/*
13417c478bd9Sstevel@tonic-gate 					 * No IPv6 hits.  Is this a single
13427c478bd9Sstevel@tonic-gate 					 * dest?
13437c478bd9Sstevel@tonic-gate 					 */
1344*e3320f40Smarkfen 					WARN1(ep, ebuf, gettext(
13457c478bd9Sstevel@tonic-gate 					    "No IPv6 source address of "
1346*e3320f40Smarkfen 					    "matching scope for name %s.\n"),
13477c478bd9Sstevel@tonic-gate 					    srchp->h_name);
13487c478bd9Sstevel@tonic-gate 					if (single_dst) {
1349*e3320f40Smarkfen 						ERROR(ep, ebuf, gettext(
1350*e3320f40Smarkfen 						    "Only a single IPV6 "
1351*e3320f40Smarkfen 						    "destination "
1352*e3320f40Smarkfen 						    "address.\n"));
13537c478bd9Sstevel@tonic-gate 					} else {
13547c478bd9Sstevel@tonic-gate 						/* Continue, but do I print? */
13557c478bd9Sstevel@tonic-gate 						continue;  /* for loop */
13567c478bd9Sstevel@tonic-gate 					}
13577c478bd9Sstevel@tonic-gate 
13587c478bd9Sstevel@tonic-gate 					/* I should never reach here. */
13597c478bd9Sstevel@tonic-gate 				}
13607c478bd9Sstevel@tonic-gate 				sin6->sin6_family = AF_INET6;
13617c478bd9Sstevel@tonic-gate 				if (*walker != NULL) {
13627c478bd9Sstevel@tonic-gate 					/*
13637c478bd9Sstevel@tonic-gate 					 * Early loop exit.  Issue a
13647c478bd9Sstevel@tonic-gate 					 * null-source warning?
13657c478bd9Sstevel@tonic-gate 					 */
1366*e3320f40Smarkfen 					WARN1(ep, ebuf, gettext(
13677c478bd9Sstevel@tonic-gate 					    "Multiple IPv6 source addresses "
13687c478bd9Sstevel@tonic-gate 					    "for %s of the same scope, using "
1369*e3320f40Smarkfen 					    "unspecified source instead.\n"),
13707c478bd9Sstevel@tonic-gate 					    srchp->h_name);
13717c478bd9Sstevel@tonic-gate 				} else {
13727c478bd9Sstevel@tonic-gate 					/*
13737c478bd9Sstevel@tonic-gate 					 * If I reach here w/o hitting the
13747c478bd9Sstevel@tonic-gate 					 * previous if statements, I have a
13757c478bd9Sstevel@tonic-gate 					 * single source address for this
13767c478bd9Sstevel@tonic-gate 					 * destination.
13777c478bd9Sstevel@tonic-gate 					 */
13787c478bd9Sstevel@tonic-gate 					bcopy(first_match, &sin6->sin6_addr,
13797c478bd9Sstevel@tonic-gate 					    sizeof (struct in6_addr));
13807c478bd9Sstevel@tonic-gate 				}
13817c478bd9Sstevel@tonic-gate 			}
13827c478bd9Sstevel@tonic-gate 		}
13837c478bd9Sstevel@tonic-gate 
1384*e3320f40Smarkfen 		/*
1385*e3320f40Smarkfen 		 * If there are errors at this point there is no
1386*e3320f40Smarkfen 		 * point sending anything to PF_KEY.
1387*e3320f40Smarkfen 		 */
1388*e3320f40Smarkfen 		handle_errors(ep, ebuf, B_TRUE, B_FALSE);
1389*e3320f40Smarkfen 
13907c478bd9Sstevel@tonic-gate 		/* Save off a copy for later writing... */
13917c478bd9Sstevel@tonic-gate 		msgp = (struct sadb_msg *)buffer;
13927c478bd9Sstevel@tonic-gate 		bcopy(buffer, savebuf, SADB_64TO8(msgp->sadb_msg_len));
13937c478bd9Sstevel@tonic-gate 
13947c478bd9Sstevel@tonic-gate 		rc = key_write(keysock, buffer, SADB_64TO8(msgp->sadb_msg_len));
13957c478bd9Sstevel@tonic-gate 		if (rc == -1)
13967c478bd9Sstevel@tonic-gate 			Bail("write() to PF_KEY socket (in doaddresses)");
13977c478bd9Sstevel@tonic-gate 
13987c478bd9Sstevel@tonic-gate 		/* Blank the key for paranoia's sake. */
13997c478bd9Sstevel@tonic-gate 		bzero(buffer, buffer_size);
14007c478bd9Sstevel@tonic-gate 		time_critical_enter();
14017c478bd9Sstevel@tonic-gate 		do {
14027c478bd9Sstevel@tonic-gate 			rc = read(keysock, buffer, buffer_size);
14037c478bd9Sstevel@tonic-gate 			if (rc == -1)
14047c478bd9Sstevel@tonic-gate 				Bail("read (in doaddresses)");
14057c478bd9Sstevel@tonic-gate 		} while (msgp->sadb_msg_seq != seq ||
14067c478bd9Sstevel@tonic-gate 		    msgp->sadb_msg_pid != mypid);
14077c478bd9Sstevel@tonic-gate 		time_critical_exit();
14087c478bd9Sstevel@tonic-gate 
14097c478bd9Sstevel@tonic-gate 		/*
14107c478bd9Sstevel@tonic-gate 		 * I should _never_ hit the following unless:
14117c478bd9Sstevel@tonic-gate 		 *
14127c478bd9Sstevel@tonic-gate 		 * 1. There is a kernel bug.
14137c478bd9Sstevel@tonic-gate 		 * 2. Another process is mistakenly using my pid in a PF_KEY
14147c478bd9Sstevel@tonic-gate 		 *    message.
14157c478bd9Sstevel@tonic-gate 		 */
14167c478bd9Sstevel@tonic-gate 		if (msgp->sadb_msg_type != sadb_msg_type ||
14177c478bd9Sstevel@tonic-gate 		    msgp->sadb_msg_satype != sadb_msg_satype) {
14187c478bd9Sstevel@tonic-gate 			syslog((LOG_NOTICE|LOG_AUTH), gettext(
14197c478bd9Sstevel@tonic-gate 			    "doaddresses: Unexpected returned message "
14207c478bd9Sstevel@tonic-gate 			    "(%d exp %d)\n"), msgp->sadb_msg_type,
14217c478bd9Sstevel@tonic-gate 			    sadb_msg_type);
14227c478bd9Sstevel@tonic-gate 			Bail("doaddresses: Unexpected returned message");
14237c478bd9Sstevel@tonic-gate 		}
14247c478bd9Sstevel@tonic-gate 
14257c478bd9Sstevel@tonic-gate 		if (msgp->sadb_msg_errno != 0) {
14267c478bd9Sstevel@tonic-gate 			char addrprint[INET6_ADDRSTRLEN];
14277c478bd9Sstevel@tonic-gate 			int on_errno = 0;
14287c478bd9Sstevel@tonic-gate 			char *on_errno_msg;
14297c478bd9Sstevel@tonic-gate 
14307c478bd9Sstevel@tonic-gate 			/*
14317c478bd9Sstevel@tonic-gate 			 * Print different error messages depending
14327c478bd9Sstevel@tonic-gate 			 * on the SADB message type being processed.
14337c478bd9Sstevel@tonic-gate 			 * If we get a ESRCH error for a GET/DELETE
14347c478bd9Sstevel@tonic-gate 			 * messages, we report that the SA does not
14357c478bd9Sstevel@tonic-gate 			 * exist. If we get a EEXIST error for a
14367c478bd9Sstevel@tonic-gate 			 * ADD/UPDATE message, we report that the
14377c478bd9Sstevel@tonic-gate 			 * SA already exists.
14387c478bd9Sstevel@tonic-gate 			 */
14397c478bd9Sstevel@tonic-gate 			if (sadb_msg_type == SADB_GET ||
14407c478bd9Sstevel@tonic-gate 			    sadb_msg_type == SADB_DELETE) {
14417c478bd9Sstevel@tonic-gate 				on_errno = ESRCH;
14427c478bd9Sstevel@tonic-gate 				on_errno_msg = "does not exist";
14437c478bd9Sstevel@tonic-gate 			} else if (sadb_msg_type == SADB_ADD ||
14447c478bd9Sstevel@tonic-gate 			    sadb_msg_type == SADB_UPDATE) {
14457c478bd9Sstevel@tonic-gate 				on_errno = EEXIST;
14467c478bd9Sstevel@tonic-gate 				on_errno_msg = "already exists";
14477c478bd9Sstevel@tonic-gate 			}
14487c478bd9Sstevel@tonic-gate 
14497c478bd9Sstevel@tonic-gate 			errno = msgp->sadb_msg_errno;
14507c478bd9Sstevel@tonic-gate 			if (errno == on_errno) {
1451*e3320f40Smarkfen 				ERROR2(ep, ebuf, gettext(
1452*e3320f40Smarkfen 				    "Association (type = %s) "
1453*e3320f40Smarkfen 				    "with spi 0x%x and addr\n"),
14547c478bd9Sstevel@tonic-gate 				    rparsesatype(msgp->sadb_msg_satype),
1455*e3320f40Smarkfen 				    ntohl(spi));
1456*e3320f40Smarkfen 				ERROR2(ep, ebuf, "%s %s.\n",
14577c478bd9Sstevel@tonic-gate 				    do_inet_ntop(dsthp->h_addr_list[i],
14587c478bd9Sstevel@tonic-gate 					addrprint, sizeof (addrprint)),
14597c478bd9Sstevel@tonic-gate 				    on_errno_msg);
14607c478bd9Sstevel@tonic-gate 				msgp = (struct sadb_msg *)savebuf;
14617c478bd9Sstevel@tonic-gate 				bcopy(savebuf, buffer,
14627c478bd9Sstevel@tonic-gate 				    SADB_64TO8(msgp->sadb_msg_len));
14637c478bd9Sstevel@tonic-gate 				continue;
14647c478bd9Sstevel@tonic-gate 			} else {
14657c478bd9Sstevel@tonic-gate 				if (errno == EINVAL) {
1466*e3320f40Smarkfen 					ERROR2(ep, ebuf, gettext(
1467*e3320f40Smarkfen 					    "PF_KEY Diagnostic code %u: %s.\n"),
1468*e3320f40Smarkfen 					    msgp->sadb_x_msg_diagnostic,
1469*e3320f40Smarkfen 					    keysock_diag(
1470*e3320f40Smarkfen 					    msgp->sadb_x_msg_diagnostic));
1471*e3320f40Smarkfen 				} else {
1472*e3320f40Smarkfen 					Bail("return message (in doaddresses)");
14737c478bd9Sstevel@tonic-gate 				}
14747c478bd9Sstevel@tonic-gate 			}
14757c478bd9Sstevel@tonic-gate 		}
1476*e3320f40Smarkfen 
14777c478bd9Sstevel@tonic-gate 		if (cmd == CMD_GET) {
14788810c16bSdanmcd 			if (msgp->sadb_msg_len > MAX_GET_SIZE) {
1479*e3320f40Smarkfen 				WARN1(ep, ebuf, gettext("WARNING:  "
1480*e3320f40Smarkfen 				    "SA information bigger than %d bytes.\n"),
14818810c16bSdanmcd 				    SADB_64TO8(MAX_GET_SIZE));
14827c478bd9Sstevel@tonic-gate 			}
14838810c16bSdanmcd 			print_samsg(buffer, B_FALSE, vflag);
14847c478bd9Sstevel@tonic-gate 		}
14857c478bd9Sstevel@tonic-gate 
1486*e3320f40Smarkfen 		handle_errors(ep, ebuf, B_TRUE, B_FALSE);
1487*e3320f40Smarkfen 
14887c478bd9Sstevel@tonic-gate 		/* ...and then restore the saved buffer. */
14897c478bd9Sstevel@tonic-gate 		msgp = (struct sadb_msg *)savebuf;
14907c478bd9Sstevel@tonic-gate 		bcopy(savebuf, buffer, SADB_64TO8(msgp->sadb_msg_len));
1491*e3320f40Smarkfen 		lines_added++;
14927c478bd9Sstevel@tonic-gate 	}
14937c478bd9Sstevel@tonic-gate 
14947c478bd9Sstevel@tonic-gate 	/* Degenerate case, h_addr_list[0] == NULL. */
14957c478bd9Sstevel@tonic-gate 	if (i == 0)
14967c478bd9Sstevel@tonic-gate 		Bail("Empty destination address list");
1497*e3320f40Smarkfen 
1498*e3320f40Smarkfen 	/*
1499*e3320f40Smarkfen 	 * free(ebuf) even if there are no errors.
1500*e3320f40Smarkfen 	 * handle_errors() won't return here.
1501*e3320f40Smarkfen 	 */
1502*e3320f40Smarkfen 	handle_errors(ep, ebuf, B_TRUE, B_TRUE);
15037c478bd9Sstevel@tonic-gate }
15047c478bd9Sstevel@tonic-gate 
15057c478bd9Sstevel@tonic-gate /*
15067c478bd9Sstevel@tonic-gate  * Perform an add or an update.  ADD and UPDATE are similar in the extensions
15077c478bd9Sstevel@tonic-gate  * they need.
15087c478bd9Sstevel@tonic-gate  */
15097c478bd9Sstevel@tonic-gate static void
1510*e3320f40Smarkfen doaddup(int cmd, int satype, char *argv[], char *ebuf)
15117c478bd9Sstevel@tonic-gate {
15127c478bd9Sstevel@tonic-gate 	uint64_t *buffer, *nexthdr;
15137c478bd9Sstevel@tonic-gate 	struct sadb_msg msg;
15147c478bd9Sstevel@tonic-gate 	struct sadb_sa *assoc = NULL;
15158810c16bSdanmcd 	struct sadb_address *src = NULL, *dst = NULL;
15168810c16bSdanmcd 	struct sadb_address *isrc = NULL, *idst = NULL;
15177c478bd9Sstevel@tonic-gate 	struct sadb_address *natt_local = NULL, *natt_remote = NULL;
15187c478bd9Sstevel@tonic-gate 	struct sadb_key *encrypt = NULL, *auth = NULL;
15197c478bd9Sstevel@tonic-gate 	struct sadb_ident *srcid = NULL, *dstid = NULL;
15207c478bd9Sstevel@tonic-gate 	struct sadb_lifetime *hard = NULL, *soft = NULL;  /* Current? */
15217c478bd9Sstevel@tonic-gate 	struct sockaddr_in6 *sin6;
15227c478bd9Sstevel@tonic-gate 	/* MLS TODO:  Need sensitivity eventually. */
15238810c16bSdanmcd 	int next, token, sa_len, alloclen, totallen = sizeof (msg), prefix;
15247c478bd9Sstevel@tonic-gate 	uint32_t spi;
15258810c16bSdanmcd 	char *thiscmd, *pstr;
15268810c16bSdanmcd 	boolean_t readstate = B_FALSE, unspec_src = B_FALSE;
15278810c16bSdanmcd 	boolean_t alloc_inner = B_FALSE, use_natt = B_FALSE;
15288810c16bSdanmcd 	struct hostent *srchp = NULL, *dsthp = NULL, *isrchp = NULL,
15298810c16bSdanmcd 	    *idsthp = NULL;
15307c478bd9Sstevel@tonic-gate 	struct hostent *natt_lhp = NULL, *natt_rhp = NULL;
15318810c16bSdanmcd 	uint16_t srcport = 0, dstport = 0, natt_lport = 0, natt_rport = 0,
15328810c16bSdanmcd 	    isrcport = 0, idstport = 0;
15338810c16bSdanmcd 	uint8_t proto = 0, iproto = 0;
1534*e3320f40Smarkfen 	char *ep = NULL;
15357c478bd9Sstevel@tonic-gate 
15367c478bd9Sstevel@tonic-gate 	thiscmd = (cmd == CMD_ADD) ? "add" : "update";
15377c478bd9Sstevel@tonic-gate 
15387c478bd9Sstevel@tonic-gate 	msg_init(&msg, ((cmd == CMD_ADD) ? SADB_ADD : SADB_UPDATE),
15397c478bd9Sstevel@tonic-gate 	    (uint8_t)satype);
15407c478bd9Sstevel@tonic-gate 
15417c478bd9Sstevel@tonic-gate 	/* Assume last element in argv is set to NULL. */
15427c478bd9Sstevel@tonic-gate 	do {
15437c478bd9Sstevel@tonic-gate 		token = parseextval(*argv, &next);
15447c478bd9Sstevel@tonic-gate 		argv++;
15457c478bd9Sstevel@tonic-gate 		switch (token) {
15467c478bd9Sstevel@tonic-gate 		case TOK_EOF:
15477c478bd9Sstevel@tonic-gate 			/* Do nothing, I'm done. */
15487c478bd9Sstevel@tonic-gate 			break;
15497c478bd9Sstevel@tonic-gate 		case TOK_UNKNOWN:
1550*e3320f40Smarkfen 			ERROR1(ep, ebuf, gettext(
1551*e3320f40Smarkfen 			    "Unknown extension field \"%s\" \n"), *(argv - 1));
15527c478bd9Sstevel@tonic-gate 			break;
15537c478bd9Sstevel@tonic-gate 		case TOK_SPI:
15547c478bd9Sstevel@tonic-gate 		case TOK_REPLAY:
15557c478bd9Sstevel@tonic-gate 		case TOK_STATE:
15567c478bd9Sstevel@tonic-gate 		case TOK_AUTHALG:
15577c478bd9Sstevel@tonic-gate 		case TOK_ENCRALG:
15587c478bd9Sstevel@tonic-gate 		case TOK_ENCAP:
15597c478bd9Sstevel@tonic-gate 			/*
15607c478bd9Sstevel@tonic-gate 			 * May want to place this chunk of code in a function.
15617c478bd9Sstevel@tonic-gate 			 *
15627c478bd9Sstevel@tonic-gate 			 * This code checks for duplicate entries on a command
15637c478bd9Sstevel@tonic-gate 			 * line.
15647c478bd9Sstevel@tonic-gate 			 */
15657c478bd9Sstevel@tonic-gate 
15667c478bd9Sstevel@tonic-gate 			/* Allocate the SADB_EXT_SA extension. */
15677c478bd9Sstevel@tonic-gate 			if (assoc == NULL) {
15687c478bd9Sstevel@tonic-gate 				assoc = malloc(sizeof (*assoc));
15697c478bd9Sstevel@tonic-gate 				if (assoc == NULL)
15707c478bd9Sstevel@tonic-gate 					Bail("malloc(assoc)");
15717c478bd9Sstevel@tonic-gate 				bzero(assoc, sizeof (*assoc));
15727c478bd9Sstevel@tonic-gate 				assoc->sadb_sa_exttype = SADB_EXT_SA;
15737c478bd9Sstevel@tonic-gate 				assoc->sadb_sa_len =
15747c478bd9Sstevel@tonic-gate 				    SADB_8TO64(sizeof (*assoc));
15757c478bd9Sstevel@tonic-gate 				totallen += sizeof (*assoc);
15767c478bd9Sstevel@tonic-gate 			}
15777c478bd9Sstevel@tonic-gate 			switch (token) {
15787c478bd9Sstevel@tonic-gate 			case TOK_SPI:
15797c478bd9Sstevel@tonic-gate 				/*
15807c478bd9Sstevel@tonic-gate 				 * If some cretin types in "spi 0" then he/she
15817c478bd9Sstevel@tonic-gate 				 * can type in another SPI.
15827c478bd9Sstevel@tonic-gate 				 */
15837c478bd9Sstevel@tonic-gate 				if (assoc->sadb_sa_spi != 0) {
1584*e3320f40Smarkfen 					ERROR(ep, ebuf, gettext(
1585*e3320f40Smarkfen 					    "Can only specify "
1586*e3320f40Smarkfen 					    "single SPI value.\n"));
1587*e3320f40Smarkfen 					break;
15887c478bd9Sstevel@tonic-gate 				}
15897c478bd9Sstevel@tonic-gate 				/* Must convert SPI to network order! */
15907c478bd9Sstevel@tonic-gate 				assoc->sadb_sa_spi =
1591*e3320f40Smarkfen 				    htonl((uint32_t)parsenum(*argv, B_TRUE,
1592*e3320f40Smarkfen 				    ebuf));
1593*e3320f40Smarkfen 				if (assoc->sadb_sa_spi == 0) {
1594*e3320f40Smarkfen 					ERROR(ep, ebuf, gettext(
1595*e3320f40Smarkfen 					    "Invalid SPI value \"0\" .\n"));
1596*e3320f40Smarkfen 				}
15977c478bd9Sstevel@tonic-gate 				break;
15987c478bd9Sstevel@tonic-gate 			case TOK_REPLAY:
15997c478bd9Sstevel@tonic-gate 				/*
16007c478bd9Sstevel@tonic-gate 				 * That same cretin can do the same with
16017c478bd9Sstevel@tonic-gate 				 * replay.
16027c478bd9Sstevel@tonic-gate 				 */
16037c478bd9Sstevel@tonic-gate 				if (assoc->sadb_sa_replay != 0) {
1604*e3320f40Smarkfen 					ERROR(ep, ebuf, gettext(
1605*e3320f40Smarkfen 					    "Can only specify "
1606*e3320f40Smarkfen 					    "single replay window size.\n"));
1607*e3320f40Smarkfen 					break;
16087c478bd9Sstevel@tonic-gate 				}
16097c478bd9Sstevel@tonic-gate 				assoc->sadb_sa_replay =
1610*e3320f40Smarkfen 				    (uint8_t)parsenum(*argv, B_TRUE, ebuf);
16117c478bd9Sstevel@tonic-gate 				if (assoc->sadb_sa_replay != 0) {
1612*e3320f40Smarkfen 					WARN(ep, ebuf, gettext(
16137c478bd9Sstevel@tonic-gate 					    "WARNING:  Replay with manual"
1614*e3320f40Smarkfen 					    " keying considered harmful.\n"));
16157c478bd9Sstevel@tonic-gate 				}
16167c478bd9Sstevel@tonic-gate 				break;
16177c478bd9Sstevel@tonic-gate 			case TOK_STATE:
16187c478bd9Sstevel@tonic-gate 				/*
16197c478bd9Sstevel@tonic-gate 				 * 0 is an actual state value, LARVAL.  This
16207c478bd9Sstevel@tonic-gate 				 * means that one can type in the larval state
16217c478bd9Sstevel@tonic-gate 				 * and then type in another state on the same
16227c478bd9Sstevel@tonic-gate 				 * command line.
16237c478bd9Sstevel@tonic-gate 				 */
16247c478bd9Sstevel@tonic-gate 				if (assoc->sadb_sa_state != 0) {
1625*e3320f40Smarkfen 					ERROR(ep, ebuf, gettext(
1626*e3320f40Smarkfen 					    "Can only specify "
1627*e3320f40Smarkfen 					    "single SA state.\n"));
1628*e3320f40Smarkfen 					break;
16297c478bd9Sstevel@tonic-gate 				}
1630*e3320f40Smarkfen 				assoc->sadb_sa_state = parsestate(*argv,
1631*e3320f40Smarkfen 				    ebuf);
16327c478bd9Sstevel@tonic-gate 				readstate = B_TRUE;
16337c478bd9Sstevel@tonic-gate 				break;
16347c478bd9Sstevel@tonic-gate 			case TOK_AUTHALG:
16357c478bd9Sstevel@tonic-gate 				if (assoc->sadb_sa_auth != 0) {
1636*e3320f40Smarkfen 					ERROR(ep, ebuf, gettext(
1637*e3320f40Smarkfen 					    "Can only specify "
1638*e3320f40Smarkfen 					    "single auth algorithm.\n"));
1639*e3320f40Smarkfen 					break;
16407c478bd9Sstevel@tonic-gate 				}
16417c478bd9Sstevel@tonic-gate 				assoc->sadb_sa_auth = parsealg(*argv,
1642*e3320f40Smarkfen 				    IPSEC_PROTO_AH, ebuf);
16437c478bd9Sstevel@tonic-gate 				break;
16447c478bd9Sstevel@tonic-gate 			case TOK_ENCRALG:
16458810c16bSdanmcd 				if (satype == SADB_SATYPE_AH) {
1646*e3320f40Smarkfen 					ERROR(ep, ebuf, gettext("Cannot specify"
1647*e3320f40Smarkfen 					    " encryption with SA type ah.\n"));
1648*e3320f40Smarkfen 					break;
16498810c16bSdanmcd 				}
16507c478bd9Sstevel@tonic-gate 				if (assoc->sadb_sa_encrypt != 0) {
1651*e3320f40Smarkfen 					ERROR(ep, ebuf, gettext(
1652*e3320f40Smarkfen 					    "Can only specify "
1653*e3320f40Smarkfen 					    "single encryption algorithm.\n"));
1654*e3320f40Smarkfen 					break;
16557c478bd9Sstevel@tonic-gate 				}
16567c478bd9Sstevel@tonic-gate 				assoc->sadb_sa_encrypt = parsealg(*argv,
1657*e3320f40Smarkfen 				    IPSEC_PROTO_ESP, ebuf);
16587c478bd9Sstevel@tonic-gate 				break;
16597c478bd9Sstevel@tonic-gate 			case TOK_ENCAP:
16607c478bd9Sstevel@tonic-gate 				if (use_natt) {
1661*e3320f40Smarkfen 					ERROR(ep, ebuf, gettext(
1662*e3320f40Smarkfen 					    "Can only specify single"
1663*e3320f40Smarkfen 					    " encapsulation.\n"));
1664*e3320f40Smarkfen 					break;
16657c478bd9Sstevel@tonic-gate 				}
16667c478bd9Sstevel@tonic-gate 				if (strncmp(*argv, "udp", 3)) {
1667*e3320f40Smarkfen 					ERROR(ep, ebuf, gettext(
1668*e3320f40Smarkfen 					    "Can only specify udp"
1669*e3320f40Smarkfen 					    " encapsulation.\n"));
1670*e3320f40Smarkfen 					break;
16717c478bd9Sstevel@tonic-gate 				}
16727c478bd9Sstevel@tonic-gate 				use_natt = B_TRUE;
16737c478bd9Sstevel@tonic-gate 				/* set assoc flags later */
16747c478bd9Sstevel@tonic-gate 				break;
16757c478bd9Sstevel@tonic-gate 			}
16767c478bd9Sstevel@tonic-gate 			argv++;
16777c478bd9Sstevel@tonic-gate 			break;
16787c478bd9Sstevel@tonic-gate 		case TOK_SRCPORT:
16797c478bd9Sstevel@tonic-gate 			if (srcport != 0) {
1680*e3320f40Smarkfen 				ERROR(ep, ebuf,  gettext("Can only specify "
1681*e3320f40Smarkfen 				    "single source port.\n"));
1682*e3320f40Smarkfen 				break;
16837c478bd9Sstevel@tonic-gate 			}
1684*e3320f40Smarkfen 			srcport = parsenum(*argv, B_TRUE, ebuf);
16857c478bd9Sstevel@tonic-gate 			argv++;
16867c478bd9Sstevel@tonic-gate 			break;
16877c478bd9Sstevel@tonic-gate 		case TOK_DSTPORT:
16887c478bd9Sstevel@tonic-gate 			if (dstport != 0) {
1689*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext("Can only specify "
1690*e3320f40Smarkfen 				    "single destination port.\n"));
1691*e3320f40Smarkfen 				break;
16927c478bd9Sstevel@tonic-gate 			}
1693*e3320f40Smarkfen 			dstport = parsenum(*argv, B_TRUE, ebuf);
16947c478bd9Sstevel@tonic-gate 			argv++;
16957c478bd9Sstevel@tonic-gate 			break;
16968810c16bSdanmcd 		case TOK_ISRCPORT:
16978810c16bSdanmcd 			alloc_inner = B_TRUE;
16988810c16bSdanmcd 			if (isrcport != 0) {
1699*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext(
1700*e3320f40Smarkfen 				    "Can only specify "
1701*e3320f40Smarkfen 				    "single inner-source port.\n"));
1702*e3320f40Smarkfen 				break;
17038810c16bSdanmcd 			}
1704*e3320f40Smarkfen 			isrcport = parsenum(*argv, B_TRUE, ebuf);
17058810c16bSdanmcd 			argv++;
17068810c16bSdanmcd 			break;
17078810c16bSdanmcd 		case TOK_IDSTPORT:
17088810c16bSdanmcd 			alloc_inner = B_TRUE;
17098810c16bSdanmcd 			if (idstport != 0) {
1710*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext(
1711*e3320f40Smarkfen 				    "Can only specify "
1712*e3320f40Smarkfen 				    "single inner-destination port.\n"));
1713*e3320f40Smarkfen 				break;
17148810c16bSdanmcd 			}
1715*e3320f40Smarkfen 			idstport = parsenum(*argv, B_TRUE, ebuf);
17168810c16bSdanmcd 			argv++;
17178810c16bSdanmcd 			break;
17187c478bd9Sstevel@tonic-gate 		case TOK_NATLPORT:
17197c478bd9Sstevel@tonic-gate 			if (natt_lport != 0) {
1720*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext(
1721*e3320f40Smarkfen 				    "Can only specify "
1722*e3320f40Smarkfen 				    "single NAT-T local port.\n"));
1723*e3320f40Smarkfen 				break;
17247c478bd9Sstevel@tonic-gate 			}
17257c478bd9Sstevel@tonic-gate 
17267c478bd9Sstevel@tonic-gate 			if (natt_rport != 0) {
1727*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext(
1728*e3320f40Smarkfen 				    "Can only specify "
1729*e3320f40Smarkfen 				    "one of NAT-T remote and local port.\n"));
1730*e3320f40Smarkfen 				break;
17317c478bd9Sstevel@tonic-gate 			}
1732*e3320f40Smarkfen 			natt_lport = parsenum(*argv, B_TRUE, ebuf);
17337c478bd9Sstevel@tonic-gate 			argv++;
17347c478bd9Sstevel@tonic-gate 			break;
17357c478bd9Sstevel@tonic-gate 		case TOK_NATRPORT:
17367c478bd9Sstevel@tonic-gate 			if (natt_rport != 0) {
1737*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext(
1738*e3320f40Smarkfen 				    "Can only specify "
1739*e3320f40Smarkfen 				    "single NAT-T remote port.\n"));
1740*e3320f40Smarkfen 				break;
17417c478bd9Sstevel@tonic-gate 			}
17427c478bd9Sstevel@tonic-gate 
17437c478bd9Sstevel@tonic-gate 			if (natt_lport != 0) {
1744*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext(
1745*e3320f40Smarkfen 				    "Can only specify "
1746*e3320f40Smarkfen 				    "one of NAT-T remote and local port.\n"));
1747*e3320f40Smarkfen 				break;
17487c478bd9Sstevel@tonic-gate 			}
1749*e3320f40Smarkfen 			natt_rport = parsenum(*argv, B_TRUE, ebuf);
17507c478bd9Sstevel@tonic-gate 			argv++;
17517c478bd9Sstevel@tonic-gate 			break;
17527c478bd9Sstevel@tonic-gate 
17537c478bd9Sstevel@tonic-gate 		case TOK_PROTO:
17547c478bd9Sstevel@tonic-gate 			if (proto != 0) {
1755*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext(
1756*e3320f40Smarkfen 				    "Can only specify "
1757*e3320f40Smarkfen 				    "single protocol.\n"));
1758*e3320f40Smarkfen 				break;
17597c478bd9Sstevel@tonic-gate 			}
1760*e3320f40Smarkfen 			proto = parsenum(*argv, B_TRUE, ebuf);
17617c478bd9Sstevel@tonic-gate 			argv++;
17627c478bd9Sstevel@tonic-gate 			break;
17638810c16bSdanmcd 		case TOK_IPROTO:
17648810c16bSdanmcd 			alloc_inner = B_TRUE;
17658810c16bSdanmcd 			if (iproto != 0) {
1766*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext(
1767*e3320f40Smarkfen 				    "Can only specify "
1768*e3320f40Smarkfen 				    "single inner protocol.\n"));
1769*e3320f40Smarkfen 				break;
17708810c16bSdanmcd 			}
1771*e3320f40Smarkfen 			iproto = parsenum(*argv, B_TRUE, ebuf);
17728810c16bSdanmcd 			argv++;
17738810c16bSdanmcd 			break;
17747c478bd9Sstevel@tonic-gate 		case TOK_SRCADDR:
17757c478bd9Sstevel@tonic-gate 		case TOK_SRCADDR6:
17767c478bd9Sstevel@tonic-gate 			if (src != NULL) {
1777*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext(
1778*e3320f40Smarkfen 				    "Can only specify "
1779*e3320f40Smarkfen 				    "single source address.\n"));
1780*e3320f40Smarkfen 				break;
17817c478bd9Sstevel@tonic-gate 			}
17827c478bd9Sstevel@tonic-gate 			sa_len = parseaddr(*argv, &srchp,
1783*e3320f40Smarkfen 			    (token == TOK_SRCADDR6), ebuf);
1784*e3320f40Smarkfen 			if (srchp == NULL) {
1785*e3320f40Smarkfen 				ERROR1(ep, ebuf, gettext(
1786*e3320f40Smarkfen 				    "Unknown src address \"%s\"\n"), *argv);
1787*e3320f40Smarkfen 				break;
1788*e3320f40Smarkfen 			}
17897c478bd9Sstevel@tonic-gate 			argv++;
17907c478bd9Sstevel@tonic-gate 			/*
17917c478bd9Sstevel@tonic-gate 			 * Round of the sockaddr length to an 8 byte
17927c478bd9Sstevel@tonic-gate 			 * boundary to make PF_KEY happy.
17937c478bd9Sstevel@tonic-gate 			 */
17947c478bd9Sstevel@tonic-gate 			alloclen = sizeof (*src) + roundup(sa_len, 8);
17957c478bd9Sstevel@tonic-gate 			src = malloc(alloclen);
17967c478bd9Sstevel@tonic-gate 			if (src == NULL)
17977c478bd9Sstevel@tonic-gate 				Bail("malloc(src)");
17987c478bd9Sstevel@tonic-gate 			totallen += alloclen;
17997c478bd9Sstevel@tonic-gate 			src->sadb_address_len = SADB_8TO64(alloclen);
18007c478bd9Sstevel@tonic-gate 			src->sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
18017c478bd9Sstevel@tonic-gate 			src->sadb_address_reserved = 0;
18027c478bd9Sstevel@tonic-gate 			src->sadb_address_prefixlen = 0;
18037c478bd9Sstevel@tonic-gate 			src->sadb_address_proto = 0;
18047c478bd9Sstevel@tonic-gate 			if (srchp == &dummy.he) {
18057c478bd9Sstevel@tonic-gate 				/*
18067c478bd9Sstevel@tonic-gate 				 * Single address with -n flag.
18077c478bd9Sstevel@tonic-gate 				 */
18087c478bd9Sstevel@tonic-gate 				sin6 = (struct sockaddr_in6 *)(src + 1);
18097c478bd9Sstevel@tonic-gate 				bzero(sin6, sizeof (*sin6));
18107c478bd9Sstevel@tonic-gate 				sin6->sin6_family = AF_INET6;
18117c478bd9Sstevel@tonic-gate 				bcopy(srchp->h_addr_list[0], &sin6->sin6_addr,
18127c478bd9Sstevel@tonic-gate 				    sizeof (struct in6_addr));
18137c478bd9Sstevel@tonic-gate 			}
18147c478bd9Sstevel@tonic-gate 			break;
18157c478bd9Sstevel@tonic-gate 		case TOK_DSTADDR:
18167c478bd9Sstevel@tonic-gate 		case TOK_DSTADDR6:
18177c478bd9Sstevel@tonic-gate 			if (dst != NULL) {
1818*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext(
1819*e3320f40Smarkfen 				    "Can only specify single "
1820*e3320f40Smarkfen 				    "destination address.\n"));
1821*e3320f40Smarkfen 				break;
18227c478bd9Sstevel@tonic-gate 			}
18237c478bd9Sstevel@tonic-gate 			sa_len = parseaddr(*argv, &dsthp,
1824*e3320f40Smarkfen 			    (token == TOK_DSTADDR6), ebuf);
1825*e3320f40Smarkfen 			if (dsthp == NULL) {
1826*e3320f40Smarkfen 				ERROR1(ep, ebuf, gettext(
1827*e3320f40Smarkfen 				    "Unknown dst address \"%s\"\n"), *argv);
1828*e3320f40Smarkfen 				break;
1829*e3320f40Smarkfen 			}
18307c478bd9Sstevel@tonic-gate 			argv++;
18317c478bd9Sstevel@tonic-gate 			alloclen = sizeof (*dst) + roundup(sa_len, 8);
18327c478bd9Sstevel@tonic-gate 			dst = malloc(alloclen);
18337c478bd9Sstevel@tonic-gate 			if (dst == NULL)
18347c478bd9Sstevel@tonic-gate 				Bail("malloc(dst)");
18357c478bd9Sstevel@tonic-gate 			totallen += alloclen;
18367c478bd9Sstevel@tonic-gate 			dst->sadb_address_len = SADB_8TO64(alloclen);
18377c478bd9Sstevel@tonic-gate 			dst->sadb_address_exttype = SADB_EXT_ADDRESS_DST;
18387c478bd9Sstevel@tonic-gate 			dst->sadb_address_reserved = 0;
18397c478bd9Sstevel@tonic-gate 			dst->sadb_address_prefixlen = 0;
18407c478bd9Sstevel@tonic-gate 			dst->sadb_address_proto = 0;
18417c478bd9Sstevel@tonic-gate 			if (dsthp == &dummy.he) {
18427c478bd9Sstevel@tonic-gate 				/*
18437c478bd9Sstevel@tonic-gate 				 * Single address with -n flag.
18447c478bd9Sstevel@tonic-gate 				 */
18457c478bd9Sstevel@tonic-gate 				sin6 = (struct sockaddr_in6 *)(dst + 1);
18467c478bd9Sstevel@tonic-gate 				bzero(sin6, sizeof (*sin6));
18477c478bd9Sstevel@tonic-gate 				sin6->sin6_family = AF_INET6;
18487c478bd9Sstevel@tonic-gate 				bcopy(dsthp->h_addr_list[0], &sin6->sin6_addr,
18497c478bd9Sstevel@tonic-gate 				    sizeof (struct in6_addr));
18507c478bd9Sstevel@tonic-gate 			}
18517c478bd9Sstevel@tonic-gate 			break;
18527c478bd9Sstevel@tonic-gate 		case TOK_PROXYADDR:
18537c478bd9Sstevel@tonic-gate 		case TOK_PROXYADDR6:
18548810c16bSdanmcd 			if (isrc != NULL) {
1855*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext(
1856*e3320f40Smarkfen 				    "Can only specify single "
1857*e3320f40Smarkfen 				    "proxy/inner-source address.\n"));
1858*e3320f40Smarkfen 				break;
18597c478bd9Sstevel@tonic-gate 			}
18608810c16bSdanmcd 			if ((pstr = strchr(*argv, '/')) != NULL) {
18618810c16bSdanmcd 				/* Parse out the prefix. */
18628810c16bSdanmcd 				errno = 0;
18638810c16bSdanmcd 				prefix = strtol(pstr + 1, NULL, 10);
18648810c16bSdanmcd 				if (errno != 0) {
1865*e3320f40Smarkfen 					ERROR1(ep, ebuf, gettext(
1866*e3320f40Smarkfen 					    "Invalid prefix %s."), pstr);
1867*e3320f40Smarkfen 					break;
18688810c16bSdanmcd 				}
18698810c16bSdanmcd 				/* Recycle pstr */
18708810c16bSdanmcd 				alloclen = (int)(pstr - *argv);
18718810c16bSdanmcd 				pstr = malloc(alloclen + 1);
18728810c16bSdanmcd 				if (pstr == NULL) {
18738810c16bSdanmcd 					Bail("malloc(pstr)");
18748810c16bSdanmcd 				}
18758810c16bSdanmcd 				(void) strlcpy(pstr, *argv, alloclen + 1);
18768810c16bSdanmcd 			} else {
18778810c16bSdanmcd 				pstr = *argv;
18788810c16bSdanmcd 				/*
18798810c16bSdanmcd 				 * Assume mapping to AF_INET6, and we're a host.
18808810c16bSdanmcd 				 * XXX some miscreants may still make classful
18818810c16bSdanmcd 				 * assumptions.  If this is a problem, fix it
18828810c16bSdanmcd 				 * here.
18838810c16bSdanmcd 				 */
18848810c16bSdanmcd 				prefix = 128;
18858810c16bSdanmcd 			}
18868810c16bSdanmcd 			sa_len = parseaddr(pstr, &isrchp,
1887*e3320f40Smarkfen 			    (token == TOK_PROXYADDR6), ebuf);
1888*e3320f40Smarkfen 			if (isrchp == NULL) {
1889*e3320f40Smarkfen 				ERROR1(ep, ebuf, gettext(
1890*e3320f40Smarkfen 				    "Unknown proxy/inner-source address "
1891*e3320f40Smarkfen 				    "\"%s\"\n"), *argv);
1892*e3320f40Smarkfen 				break;
1893*e3320f40Smarkfen 			}
18948810c16bSdanmcd 			if (pstr != *argv)
18958810c16bSdanmcd 				free(pstr);
18967c478bd9Sstevel@tonic-gate 			argv++;
18978810c16bSdanmcd 			alloclen = sizeof (*isrc) + roundup(sa_len, 8);
18988810c16bSdanmcd 			isrc = malloc(alloclen);
18998810c16bSdanmcd 			if (isrc == NULL)
19008810c16bSdanmcd 				Bail("malloc(isrc)");
19017c478bd9Sstevel@tonic-gate 			totallen += alloclen;
19028810c16bSdanmcd 			isrc->sadb_address_len = SADB_8TO64(alloclen);
19038810c16bSdanmcd 			isrc->sadb_address_exttype = SADB_EXT_ADDRESS_PROXY;
19048810c16bSdanmcd 			isrc->sadb_address_reserved = 0;
19058810c16bSdanmcd 			isrc->sadb_address_prefixlen = prefix;
19068810c16bSdanmcd 			isrc->sadb_address_proto = 0;
19078810c16bSdanmcd 			if (isrchp == &dummy.he ||
19088810c16bSdanmcd 			    isrchp->h_addr_list[1] == NULL) {
19097c478bd9Sstevel@tonic-gate 				/*
19107c478bd9Sstevel@tonic-gate 				 * Single address with -n flag or single name.
19117c478bd9Sstevel@tonic-gate 				 */
19128810c16bSdanmcd 				sin6 = (struct sockaddr_in6 *)(isrc + 1);
19137c478bd9Sstevel@tonic-gate 				bzero(sin6, sizeof (*sin6));
19147c478bd9Sstevel@tonic-gate 				sin6->sin6_family = AF_INET6;
19158810c16bSdanmcd 				bcopy(isrchp->h_addr_list[0], &sin6->sin6_addr,
19167c478bd9Sstevel@tonic-gate 				    sizeof (struct in6_addr));
19178810c16bSdanmcd 				/*
19188810c16bSdanmcd 				 * normalize prefixlen for IPv4-mapped
19198810c16bSdanmcd 				 * addresses.
19208810c16bSdanmcd 				 */
19218810c16bSdanmcd 				if (prefix <= 32 &&
19228810c16bSdanmcd 				    IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr))
19238810c16bSdanmcd 					isrc->sadb_address_prefixlen += 96;
19248810c16bSdanmcd 				alloc_inner = B_TRUE;
19257c478bd9Sstevel@tonic-gate 			} else {
19267c478bd9Sstevel@tonic-gate 				/*
19278810c16bSdanmcd 				 * If the proxy/isrc address is vague, don't
19288810c16bSdanmcd 				 * bother.
19297c478bd9Sstevel@tonic-gate 				 */
19307c478bd9Sstevel@tonic-gate 				totallen -= alloclen;
19318810c16bSdanmcd 				free(isrc);
19328810c16bSdanmcd 				isrc = NULL;
1933*e3320f40Smarkfen 				WARN1(ep, ebuf, gettext(
1934*e3320f40Smarkfen 				    "Proxy/inner-source address %s "
1935*e3320f40Smarkfen 				    "is vague, not using.\n"), isrchp->h_name);
19368810c16bSdanmcd 				freehostent(isrchp);
19378810c16bSdanmcd 				isrchp = NULL;
1938*e3320f40Smarkfen 				break;
19398810c16bSdanmcd 			}
19408810c16bSdanmcd 			break;
19418810c16bSdanmcd 		case TOK_IDSTADDR:
19428810c16bSdanmcd 		case TOK_IDSTADDR6:
19438810c16bSdanmcd 			if (idst != NULL) {
1944*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext(
1945*e3320f40Smarkfen 				    "Can only specify single "
1946*e3320f40Smarkfen 				    "inner-destination address.\n"));
1947*e3320f40Smarkfen 				break;
19488810c16bSdanmcd 			}
19498810c16bSdanmcd 			if ((pstr = strchr(*argv, '/')) != NULL) {
19508810c16bSdanmcd 				/* Parse out the prefix. */
19518810c16bSdanmcd 				errno = 0;
19528810c16bSdanmcd 				prefix = strtol(pstr + 1, NULL, 10);
19538810c16bSdanmcd 				if (errno != 0) {
1954*e3320f40Smarkfen 					ERROR1(ep, ebuf, gettext(
1955*e3320f40Smarkfen 					    "Invalid prefix %s.\n"), pstr);
1956*e3320f40Smarkfen 					break;
19578810c16bSdanmcd 				}
19588810c16bSdanmcd 				/* Recycle pstr */
19598810c16bSdanmcd 				alloclen = (int)(pstr - *argv);
19608810c16bSdanmcd 				pstr = malloc(alloclen + 1);
19618810c16bSdanmcd 				if (pstr == NULL) {
19628810c16bSdanmcd 					Bail("malloc(pstr)");
19638810c16bSdanmcd 				}
19648810c16bSdanmcd 				(void) strlcpy(pstr, *argv, alloclen + 1);
19658810c16bSdanmcd 			} else {
19668810c16bSdanmcd 				pstr = *argv;
19678810c16bSdanmcd 				/*
19688810c16bSdanmcd 				 * Assume mapping to AF_INET6, and we're a host.
19698810c16bSdanmcd 				 * XXX some miscreants may still make classful
19708810c16bSdanmcd 				 * assumptions.  If this is a problem, fix it
19718810c16bSdanmcd 				 * here.
19728810c16bSdanmcd 				 */
19738810c16bSdanmcd 				prefix = 128;
19748810c16bSdanmcd 			}
19758810c16bSdanmcd 			sa_len = parseaddr(pstr, &idsthp,
1976*e3320f40Smarkfen 			    (token == TOK_IDSTADDR6), ebuf);
1977*e3320f40Smarkfen 			if (idsthp == NULL) {
1978*e3320f40Smarkfen 				ERROR1(ep, ebuf, gettext(
1979*e3320f40Smarkfen 				    "Unknown Inner Src address "
1980*e3320f40Smarkfen 				    " \"%s\"\n"), *argv);
1981*e3320f40Smarkfen 				break;
1982*e3320f40Smarkfen 			}
19838810c16bSdanmcd 			if (pstr != *argv)
19848810c16bSdanmcd 				free(pstr);
19858810c16bSdanmcd 			argv++;
19868810c16bSdanmcd 			alloclen = sizeof (*idst) + roundup(sa_len, 8);
19878810c16bSdanmcd 			idst = malloc(alloclen);
19888810c16bSdanmcd 			if (idst == NULL)
19898810c16bSdanmcd 				Bail("malloc(idst)");
19908810c16bSdanmcd 			totallen += alloclen;
19918810c16bSdanmcd 			idst->sadb_address_len = SADB_8TO64(alloclen);
19928810c16bSdanmcd 			idst->sadb_address_exttype =
19938810c16bSdanmcd 			    SADB_X_EXT_ADDRESS_INNER_DST;
19948810c16bSdanmcd 			idst->sadb_address_reserved = 0;
19958810c16bSdanmcd 			idst->sadb_address_prefixlen = prefix;
19968810c16bSdanmcd 			idst->sadb_address_proto = 0;
19978810c16bSdanmcd 			if (idsthp == &dummy.he ||
19988810c16bSdanmcd 			    idsthp->h_addr_list[1] == NULL) {
19998810c16bSdanmcd 				/*
20008810c16bSdanmcd 				 * Single address with -n flag or single name.
20018810c16bSdanmcd 				 */
20028810c16bSdanmcd 				sin6 = (struct sockaddr_in6 *)(idst + 1);
20038810c16bSdanmcd 				bzero(sin6, sizeof (*sin6));
20048810c16bSdanmcd 				sin6->sin6_family = AF_INET6;
20058810c16bSdanmcd 				bcopy(idsthp->h_addr_list[0], &sin6->sin6_addr,
20068810c16bSdanmcd 				    sizeof (struct in6_addr));
20078810c16bSdanmcd 				/*
20088810c16bSdanmcd 				 * normalize prefixlen for IPv4-mapped
20098810c16bSdanmcd 				 * addresses.
20108810c16bSdanmcd 				 */
20118810c16bSdanmcd 				if (prefix <= 32 &&
20128810c16bSdanmcd 				    IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr))
20138810c16bSdanmcd 					idst->sadb_address_prefixlen += 96;
20148810c16bSdanmcd 				alloc_inner = B_TRUE;
20158810c16bSdanmcd 			} else {
20168810c16bSdanmcd 				/*
20178810c16bSdanmcd 				 * If the idst address is vague, don't bother.
20188810c16bSdanmcd 				 */
20198810c16bSdanmcd 				totallen -= alloclen;
20208810c16bSdanmcd 				free(idst);
20218810c16bSdanmcd 				idst = NULL;
2022*e3320f40Smarkfen 				WARN1(ep, ebuf, gettext(
2023*e3320f40Smarkfen 				    "Inner destination address %s "
2024*e3320f40Smarkfen 				    "is vague, not using.\n"), idsthp->h_name);
20258810c16bSdanmcd 				freehostent(idsthp);
20268810c16bSdanmcd 				idsthp = NULL;
2027*e3320f40Smarkfen 				break;
20287c478bd9Sstevel@tonic-gate 			}
20297c478bd9Sstevel@tonic-gate 			break;
20307c478bd9Sstevel@tonic-gate 		case TOK_NATLOC:
20317c478bd9Sstevel@tonic-gate 			if (natt_local != NULL) {
2032*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext(
2033*e3320f40Smarkfen 				    "Can only specify "
2034*e3320f40Smarkfen 				    "single NAT-T local address.\n"));
2035*e3320f40Smarkfen 				break;
2036*e3320f40Smarkfen 			}
2037*e3320f40Smarkfen 			sa_len = parseaddr(*argv, &natt_lhp, 0, ebuf);
2038*e3320f40Smarkfen 			if (natt_lhp == NULL) {
2039*e3320f40Smarkfen 				ERROR1(ep, ebuf, gettext(
2040*e3320f40Smarkfen 				    "Unknown NAT-T local address \"%s\"\n"),
2041*e3320f40Smarkfen 				    *argv);
2042*e3320f40Smarkfen 				break;
20437c478bd9Sstevel@tonic-gate 			}
20447c478bd9Sstevel@tonic-gate 			argv++;
20457c478bd9Sstevel@tonic-gate 			/*
20467c478bd9Sstevel@tonic-gate 			 * Round of the sockaddr length to an 8 byte
20477c478bd9Sstevel@tonic-gate 			 * boundary to make PF_KEY happy.
20487c478bd9Sstevel@tonic-gate 			 */
20497c478bd9Sstevel@tonic-gate 			alloclen = sizeof (*natt_local) + roundup(sa_len, 8);
20507c478bd9Sstevel@tonic-gate 			natt_local = malloc(alloclen);
20517c478bd9Sstevel@tonic-gate 			if (natt_local == NULL)
20527c478bd9Sstevel@tonic-gate 				Bail("malloc(natt_local)");
20537c478bd9Sstevel@tonic-gate 			totallen += alloclen;
20547c478bd9Sstevel@tonic-gate 			natt_local->sadb_address_len = SADB_8TO64(alloclen);
20557c478bd9Sstevel@tonic-gate 			natt_local->sadb_address_exttype =
20567c478bd9Sstevel@tonic-gate 			    SADB_X_EXT_ADDRESS_NATT_LOC;
20577c478bd9Sstevel@tonic-gate 			natt_local->sadb_address_reserved = 0;
20587c478bd9Sstevel@tonic-gate 			natt_local->sadb_address_prefixlen = 0;
20597c478bd9Sstevel@tonic-gate 			natt_local->sadb_address_proto = 0;
20608810c16bSdanmcd 			if (natt_lhp == &dummy.he ||
20618810c16bSdanmcd 			    natt_lhp->h_addr_list[1] == NULL) {
20627c478bd9Sstevel@tonic-gate 				/*
20638810c16bSdanmcd 				 * Single address with -n flag or single name.
20647c478bd9Sstevel@tonic-gate 				 */
20657c478bd9Sstevel@tonic-gate 				sin6 = (struct sockaddr_in6 *)(natt_local + 1);
20667c478bd9Sstevel@tonic-gate 				bzero(sin6, sizeof (*sin6));
20677c478bd9Sstevel@tonic-gate 				sin6->sin6_family = AF_INET6;
20687c478bd9Sstevel@tonic-gate 				bcopy(natt_lhp->h_addr_list[0],
20697c478bd9Sstevel@tonic-gate 				    &sin6->sin6_addr, sizeof (struct in6_addr));
20708810c16bSdanmcd 			} else {
20718810c16bSdanmcd 				/*
20728810c16bSdanmcd 				 * If the nat-local address is vague, don't
20738810c16bSdanmcd 				 * bother.
20748810c16bSdanmcd 				 */
20758810c16bSdanmcd 				totallen -= alloclen;
20768810c16bSdanmcd 				free(natt_local);
20778810c16bSdanmcd 				natt_local = NULL;
2078*e3320f40Smarkfen 				WARN1(ep, ebuf, gettext(
2079*e3320f40Smarkfen 				    "NAT-T local address %s "
2080*e3320f40Smarkfen 				    "is vague, not using.\n"),
2081*e3320f40Smarkfen 				    natt_lhp->h_name);
20828810c16bSdanmcd 				freehostent(natt_lhp);
20838810c16bSdanmcd 				natt_lhp = NULL;
2084*e3320f40Smarkfen 				break;
20857c478bd9Sstevel@tonic-gate 			}
20867c478bd9Sstevel@tonic-gate 			break;
20877c478bd9Sstevel@tonic-gate 		case TOK_NATREM:
20887c478bd9Sstevel@tonic-gate 			if (natt_remote != NULL) {
2089*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext(
2090*e3320f40Smarkfen 				    "Can only specify "
2091*e3320f40Smarkfen 				    "single NAT-T remote address.\n"));
2092*e3320f40Smarkfen 				break;
2093*e3320f40Smarkfen 			}
2094*e3320f40Smarkfen 			sa_len = parseaddr(*argv, &natt_rhp, 0, ebuf);
2095*e3320f40Smarkfen 			if (natt_rhp == NULL) {
2096*e3320f40Smarkfen 				ERROR1(ep, ebuf, gettext(
2097*e3320f40Smarkfen 				    "Unknown NAT-T remote address \"%s\"\n"),
2098*e3320f40Smarkfen 				    *argv);
2099*e3320f40Smarkfen 				break;
21007c478bd9Sstevel@tonic-gate 			}
21017c478bd9Sstevel@tonic-gate 			argv++;
21027c478bd9Sstevel@tonic-gate 			/*
21037c478bd9Sstevel@tonic-gate 			 * Round of the sockaddr length to an 8 byte
21047c478bd9Sstevel@tonic-gate 			 * boundary to make PF_KEY happy.
21057c478bd9Sstevel@tonic-gate 			 */
21067c478bd9Sstevel@tonic-gate 			alloclen = sizeof (*natt_remote) + roundup(sa_len, 8);
21077c478bd9Sstevel@tonic-gate 			natt_remote = malloc(alloclen);
21087c478bd9Sstevel@tonic-gate 			if (natt_remote == NULL)
21097c478bd9Sstevel@tonic-gate 				Bail("malloc(natt_remote)");
21107c478bd9Sstevel@tonic-gate 			totallen += alloclen;
21117c478bd9Sstevel@tonic-gate 			natt_remote->sadb_address_len = SADB_8TO64(alloclen);
21127c478bd9Sstevel@tonic-gate 			natt_remote->sadb_address_exttype =
21137c478bd9Sstevel@tonic-gate 			    SADB_X_EXT_ADDRESS_NATT_REM;
21147c478bd9Sstevel@tonic-gate 			natt_remote->sadb_address_reserved = 0;
21157c478bd9Sstevel@tonic-gate 			natt_remote->sadb_address_prefixlen = 0;
21167c478bd9Sstevel@tonic-gate 			natt_remote->sadb_address_proto = 0;
21178810c16bSdanmcd 			if (natt_rhp == &dummy.he ||
21188810c16bSdanmcd 			    natt_rhp->h_addr_list[1] == NULL) {
21197c478bd9Sstevel@tonic-gate 				/*
21208810c16bSdanmcd 				 * Single address with -n flag or single name.
21217c478bd9Sstevel@tonic-gate 				 */
21227c478bd9Sstevel@tonic-gate 				sin6 = (struct sockaddr_in6 *)(natt_remote + 1);
21237c478bd9Sstevel@tonic-gate 				bzero(sin6, sizeof (*sin6));
21247c478bd9Sstevel@tonic-gate 				sin6->sin6_family = AF_INET6;
21257c478bd9Sstevel@tonic-gate 				bcopy(natt_rhp->h_addr_list[0],
21267c478bd9Sstevel@tonic-gate 				    &sin6->sin6_addr, sizeof (struct in6_addr));
21278810c16bSdanmcd 			} else {
21288810c16bSdanmcd 				/*
2129*e3320f40Smarkfen 				 * If the nat-renote address is vague, don't
21308810c16bSdanmcd 				 * bother.
21318810c16bSdanmcd 				 */
21328810c16bSdanmcd 				totallen -= alloclen;
21338810c16bSdanmcd 				free(natt_remote);
21348810c16bSdanmcd 				natt_remote = NULL;
2135*e3320f40Smarkfen 				WARN1(ep, ebuf, gettext(
2136*e3320f40Smarkfen 				    "NAT-T remote address %s "
2137*e3320f40Smarkfen 				    "is vague, not using.\n"),
2138*e3320f40Smarkfen 				    natt_rhp->h_name);
21398810c16bSdanmcd 				freehostent(natt_rhp);
21408810c16bSdanmcd 				natt_rhp = NULL;
2141*e3320f40Smarkfen 				break;
21427c478bd9Sstevel@tonic-gate 			}
21437c478bd9Sstevel@tonic-gate 			break;
21447c478bd9Sstevel@tonic-gate 		case TOK_ENCRKEY:
21457c478bd9Sstevel@tonic-gate 			if (encrypt != NULL) {
2146*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext(
2147*e3320f40Smarkfen 				    "Can only specify "
2148*e3320f40Smarkfen 				    "single encryption key.\n"));
2149*e3320f40Smarkfen 				break;
21507c478bd9Sstevel@tonic-gate 			}
2151*e3320f40Smarkfen 			encrypt = parsekey(*argv, ebuf);
21527c478bd9Sstevel@tonic-gate 			argv++;
2153*e3320f40Smarkfen 			if (encrypt == NULL) {
2154*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext(
2155*e3320f40Smarkfen 				    "Invalid encryption key.\n"));
2156*e3320f40Smarkfen 				break;
2157*e3320f40Smarkfen 			}
2158*e3320f40Smarkfen 			totallen += SADB_64TO8(encrypt->sadb_key_len);
21597c478bd9Sstevel@tonic-gate 			encrypt->sadb_key_exttype = SADB_EXT_KEY_ENCRYPT;
21607c478bd9Sstevel@tonic-gate 			break;
21617c478bd9Sstevel@tonic-gate 		case TOK_AUTHKEY:
21627c478bd9Sstevel@tonic-gate 			if (auth != NULL) {
2163*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext(
2164*e3320f40Smarkfen 				    "Can only specify single"
2165*e3320f40Smarkfen 				    " authentication key.\n"));
2166*e3320f40Smarkfen 				break;
21677c478bd9Sstevel@tonic-gate 			}
2168*e3320f40Smarkfen 			auth = parsekey(*argv, ebuf);
21697c478bd9Sstevel@tonic-gate 			argv++;
2170*e3320f40Smarkfen 			if (auth == NULL) {
2171*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext(
2172*e3320f40Smarkfen 				    "Invalid authentication key.\n"));
2173*e3320f40Smarkfen 				break;
2174*e3320f40Smarkfen 			}
21757c478bd9Sstevel@tonic-gate 			totallen += SADB_64TO8(auth->sadb_key_len);
21767c478bd9Sstevel@tonic-gate 			auth->sadb_key_exttype = SADB_EXT_KEY_AUTH;
21777c478bd9Sstevel@tonic-gate 			break;
21787c478bd9Sstevel@tonic-gate 		case TOK_SRCIDTYPE:
21797c478bd9Sstevel@tonic-gate 			if (*argv == NULL || *(argv + 1) == NULL) {
2180*e3320f40Smarkfen 				FATAL(ep, ebuf, gettext(
2181*e3320f40Smarkfen 				    "Unexpected end of command "
2182*e3320f40Smarkfen 				    "line - Expecting Src Type.\n"));
2183*e3320f40Smarkfen 				/* NOTREACHED */
2184*e3320f40Smarkfen 				break;
21857c478bd9Sstevel@tonic-gate 			}
21867c478bd9Sstevel@tonic-gate 			if (srcid != NULL) {
2187*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext(
2188*e3320f40Smarkfen 				    "Can only specify single"
2189*e3320f40Smarkfen 				    " source certificate identity.\n"));
2190*e3320f40Smarkfen 				break;
21917c478bd9Sstevel@tonic-gate 			}
21927c478bd9Sstevel@tonic-gate 			alloclen = sizeof (*srcid) +
21937c478bd9Sstevel@tonic-gate 			    roundup(strlen(*(argv + 1)) + 1, 8);
21947c478bd9Sstevel@tonic-gate 			srcid = malloc(alloclen);
21957c478bd9Sstevel@tonic-gate 			if (srcid == NULL)
21967c478bd9Sstevel@tonic-gate 				Bail("malloc(srcid)");
21977c478bd9Sstevel@tonic-gate 			totallen += alloclen;
2198*e3320f40Smarkfen 			srcid->sadb_ident_type = parseidtype(*argv, ebuf);
21997c478bd9Sstevel@tonic-gate 			argv++;
22007c478bd9Sstevel@tonic-gate 			srcid->sadb_ident_len = SADB_8TO64(alloclen);
22017c478bd9Sstevel@tonic-gate 			srcid->sadb_ident_exttype = SADB_EXT_IDENTITY_SRC;
22027c478bd9Sstevel@tonic-gate 			srcid->sadb_ident_reserved = 0;
22037c478bd9Sstevel@tonic-gate 			srcid->sadb_ident_id = 0;  /* Not useful here. */
2204*e3320f40Smarkfen 			(void) strlcpy((char *)(srcid + 1), *argv, alloclen);
22057c478bd9Sstevel@tonic-gate 			argv++;
22067c478bd9Sstevel@tonic-gate 			break;
22077c478bd9Sstevel@tonic-gate 		case TOK_DSTIDTYPE:
22087c478bd9Sstevel@tonic-gate 			if (*argv == NULL || *(argv + 1) == NULL) {
2209*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext(
2210*e3320f40Smarkfen 				    "Unexpected end of command"
2211*e3320f40Smarkfen 				    " line - expecting dst type.\n"));
2212*e3320f40Smarkfen 				break;
22137c478bd9Sstevel@tonic-gate 			}
22147c478bd9Sstevel@tonic-gate 			if (dstid != NULL) {
2215*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext(
2216*e3320f40Smarkfen 				    "Can only specify single destination "
2217*e3320f40Smarkfen 					"certificate identity.\n"));
2218*e3320f40Smarkfen 				break;
22197c478bd9Sstevel@tonic-gate 			}
22207c478bd9Sstevel@tonic-gate 			alloclen = sizeof (*dstid) +
22217c478bd9Sstevel@tonic-gate 			    roundup(strlen(*(argv + 1)) + 1, 8);
22227c478bd9Sstevel@tonic-gate 			dstid = malloc(alloclen);
22237c478bd9Sstevel@tonic-gate 			if (dstid == NULL)
22247c478bd9Sstevel@tonic-gate 				Bail("malloc(dstid)");
22257c478bd9Sstevel@tonic-gate 			totallen += alloclen;
2226*e3320f40Smarkfen 			dstid->sadb_ident_type = parseidtype(*argv, ebuf);
22277c478bd9Sstevel@tonic-gate 			argv++;
22287c478bd9Sstevel@tonic-gate 			dstid->sadb_ident_len = SADB_8TO64(alloclen);
22297c478bd9Sstevel@tonic-gate 			dstid->sadb_ident_exttype = SADB_EXT_IDENTITY_DST;
22307c478bd9Sstevel@tonic-gate 			dstid->sadb_ident_reserved = 0;
22317c478bd9Sstevel@tonic-gate 			dstid->sadb_ident_id = 0;  /* Not useful here. */
2232*e3320f40Smarkfen 			(void) strlcpy((char *)(dstid + 1), *argv, alloclen);
22337c478bd9Sstevel@tonic-gate 			argv++;
22347c478bd9Sstevel@tonic-gate 			break;
22357c478bd9Sstevel@tonic-gate 		case TOK_HARD_ALLOC:
22367c478bd9Sstevel@tonic-gate 		case TOK_HARD_BYTES:
22377c478bd9Sstevel@tonic-gate 		case TOK_HARD_ADDTIME:
22387c478bd9Sstevel@tonic-gate 		case TOK_HARD_USETIME:
22397c478bd9Sstevel@tonic-gate 			if (hard == NULL) {
22407c478bd9Sstevel@tonic-gate 				hard = malloc(sizeof (*hard));
22417c478bd9Sstevel@tonic-gate 				if (hard == NULL)
22427c478bd9Sstevel@tonic-gate 					Bail("malloc(hard_lifetime)");
22437c478bd9Sstevel@tonic-gate 				bzero(hard, sizeof (*hard));
22447c478bd9Sstevel@tonic-gate 				hard->sadb_lifetime_exttype =
22457c478bd9Sstevel@tonic-gate 				    SADB_EXT_LIFETIME_HARD;
22467c478bd9Sstevel@tonic-gate 				hard->sadb_lifetime_len =
22477c478bd9Sstevel@tonic-gate 				    SADB_8TO64(sizeof (*hard));
22487c478bd9Sstevel@tonic-gate 				totallen += sizeof (*hard);
22497c478bd9Sstevel@tonic-gate 			}
22507c478bd9Sstevel@tonic-gate 			switch (token) {
22517c478bd9Sstevel@tonic-gate 			case TOK_HARD_ALLOC:
22527c478bd9Sstevel@tonic-gate 				if (hard->sadb_lifetime_allocations != 0) {
2253*e3320f40Smarkfen 					ERROR(ep, ebuf, gettext(
2254*e3320f40Smarkfen 					    "Can only specify single"
2255*e3320f40Smarkfen 					    " hard allocation limit.\n"));
2256*e3320f40Smarkfen 					break;
22577c478bd9Sstevel@tonic-gate 				}
22587c478bd9Sstevel@tonic-gate 				hard->sadb_lifetime_allocations =
2259*e3320f40Smarkfen 				    (uint32_t)parsenum(*argv, B_TRUE, ebuf);
22607c478bd9Sstevel@tonic-gate 				break;
22617c478bd9Sstevel@tonic-gate 			case TOK_HARD_BYTES:
22627c478bd9Sstevel@tonic-gate 				if (hard->sadb_lifetime_bytes != 0) {
2263*e3320f40Smarkfen 					ERROR(ep, ebuf, gettext(
2264*e3320f40Smarkfen 					    "Can only specify "
2265*e3320f40Smarkfen 					    "single hard byte limit.\n"));
2266*e3320f40Smarkfen 					break;
22677c478bd9Sstevel@tonic-gate 				}
22687c478bd9Sstevel@tonic-gate 				hard->sadb_lifetime_bytes = parsenum(*argv,
2269*e3320f40Smarkfen 				    B_TRUE, ebuf);
22707c478bd9Sstevel@tonic-gate 				break;
22717c478bd9Sstevel@tonic-gate 			case TOK_HARD_ADDTIME:
22727c478bd9Sstevel@tonic-gate 				if (hard->sadb_lifetime_addtime != 0) {
2273*e3320f40Smarkfen 					ERROR(ep, ebuf, gettext(
2274*e3320f40Smarkfen 					    "Can only specify "
2275*e3320f40Smarkfen 					    "single past-add lifetime.\n"));
2276*e3320f40Smarkfen 					break;
22777c478bd9Sstevel@tonic-gate 				}
22787c478bd9Sstevel@tonic-gate 				hard->sadb_lifetime_addtime = parsenum(*argv,
2279*e3320f40Smarkfen 				    B_TRUE, ebuf);
22807c478bd9Sstevel@tonic-gate 				break;
22817c478bd9Sstevel@tonic-gate 			case TOK_HARD_USETIME:
22827c478bd9Sstevel@tonic-gate 				if (hard->sadb_lifetime_usetime != 0) {
2283*e3320f40Smarkfen 					ERROR(ep, ebuf, gettext(
2284*e3320f40Smarkfen 					    "Can only specify "
2285*e3320f40Smarkfen 					    "single past-use lifetime.\n"));
2286*e3320f40Smarkfen 					break;
22877c478bd9Sstevel@tonic-gate 				}
22887c478bd9Sstevel@tonic-gate 				hard->sadb_lifetime_usetime = parsenum(*argv,
2289*e3320f40Smarkfen 				    B_TRUE, ebuf);
22907c478bd9Sstevel@tonic-gate 				break;
22917c478bd9Sstevel@tonic-gate 			}
22927c478bd9Sstevel@tonic-gate 			argv++;
22937c478bd9Sstevel@tonic-gate 			break;
22947c478bd9Sstevel@tonic-gate 		case TOK_SOFT_ALLOC:
22957c478bd9Sstevel@tonic-gate 		case TOK_SOFT_BYTES:
22967c478bd9Sstevel@tonic-gate 		case TOK_SOFT_ADDTIME:
22977c478bd9Sstevel@tonic-gate 		case TOK_SOFT_USETIME:
22987c478bd9Sstevel@tonic-gate 			if (soft == NULL) {
22997c478bd9Sstevel@tonic-gate 				soft = malloc(sizeof (*soft));
23007c478bd9Sstevel@tonic-gate 				if (soft == NULL)
23017c478bd9Sstevel@tonic-gate 					Bail("malloc(soft_lifetime)");
23027c478bd9Sstevel@tonic-gate 				bzero(soft, sizeof (*soft));
23037c478bd9Sstevel@tonic-gate 				soft->sadb_lifetime_exttype =
23047c478bd9Sstevel@tonic-gate 				    SADB_EXT_LIFETIME_SOFT;
23057c478bd9Sstevel@tonic-gate 				soft->sadb_lifetime_len =
23067c478bd9Sstevel@tonic-gate 				    SADB_8TO64(sizeof (*soft));
23077c478bd9Sstevel@tonic-gate 				totallen += sizeof (*soft);
23087c478bd9Sstevel@tonic-gate 			}
23097c478bd9Sstevel@tonic-gate 			switch (token) {
23107c478bd9Sstevel@tonic-gate 			case TOK_SOFT_ALLOC:
23117c478bd9Sstevel@tonic-gate 				if (soft->sadb_lifetime_allocations != 0) {
2312*e3320f40Smarkfen 					ERROR(ep, ebuf, gettext(
2313*e3320f40Smarkfen 					    "Can only specify single"
2314*e3320f40Smarkfen 					    " soft allocation limit.\n"));
2315*e3320f40Smarkfen 					break;
23167c478bd9Sstevel@tonic-gate 				}
23177c478bd9Sstevel@tonic-gate 				soft->sadb_lifetime_allocations =
2318*e3320f40Smarkfen 				    (uint32_t)parsenum(*argv, B_TRUE, ebuf);
23197c478bd9Sstevel@tonic-gate 				break;
23207c478bd9Sstevel@tonic-gate 			case TOK_SOFT_BYTES:
23217c478bd9Sstevel@tonic-gate 				if (soft->sadb_lifetime_bytes != 0) {
2322*e3320f40Smarkfen 					ERROR(ep, ebuf, gettext(
2323*e3320f40Smarkfen 					    "Can only specify single"
2324*e3320f40Smarkfen 					    " soft byte limit.\n"));
2325*e3320f40Smarkfen 					break;
23267c478bd9Sstevel@tonic-gate 				}
23277c478bd9Sstevel@tonic-gate 				soft->sadb_lifetime_bytes = parsenum(*argv,
2328*e3320f40Smarkfen 				    B_TRUE, ebuf);
23297c478bd9Sstevel@tonic-gate 				break;
23307c478bd9Sstevel@tonic-gate 			case TOK_SOFT_ADDTIME:
23317c478bd9Sstevel@tonic-gate 				if (soft->sadb_lifetime_addtime != 0) {
2332*e3320f40Smarkfen 					ERROR(ep, ebuf, gettext(
2333*e3320f40Smarkfen 					    "Can only specify single"
2334*e3320f40Smarkfen 					    " past-add lifetime.\n"));
2335*e3320f40Smarkfen 					break;
23367c478bd9Sstevel@tonic-gate 				}
23377c478bd9Sstevel@tonic-gate 				soft->sadb_lifetime_addtime = parsenum(*argv,
2338*e3320f40Smarkfen 				    B_TRUE, ebuf);
23397c478bd9Sstevel@tonic-gate 				break;
23407c478bd9Sstevel@tonic-gate 			case TOK_SOFT_USETIME:
23417c478bd9Sstevel@tonic-gate 				if (soft->sadb_lifetime_usetime != 0) {
2342*e3320f40Smarkfen 					ERROR(ep, ebuf, gettext(
2343*e3320f40Smarkfen 					    "Can only specify single"
2344*e3320f40Smarkfen 					    " past-use lifetime.\n"));
2345*e3320f40Smarkfen 					break;
23467c478bd9Sstevel@tonic-gate 				}
23477c478bd9Sstevel@tonic-gate 				soft->sadb_lifetime_usetime = parsenum(*argv,
2348*e3320f40Smarkfen 				    B_TRUE, ebuf);
23497c478bd9Sstevel@tonic-gate 				break;
23507c478bd9Sstevel@tonic-gate 			}
23517c478bd9Sstevel@tonic-gate 			argv++;
23527c478bd9Sstevel@tonic-gate 			break;
23537c478bd9Sstevel@tonic-gate 		default:
2354*e3320f40Smarkfen 			ERROR1(ep, ebuf, gettext(
2355*e3320f40Smarkfen 			    "Don't use extension %s for add/update.\n"),
23567c478bd9Sstevel@tonic-gate 			    *(argv - 1));
23577c478bd9Sstevel@tonic-gate 			break;
23587c478bd9Sstevel@tonic-gate 		}
23597c478bd9Sstevel@tonic-gate 	} while (token != TOK_EOF);
23607c478bd9Sstevel@tonic-gate 
2361*e3320f40Smarkfen 	handle_errors(ep, ebuf, B_TRUE, B_FALSE);
2362*e3320f40Smarkfen 
23638810c16bSdanmcd 	/*
23648810c16bSdanmcd 	 * If we specify inner ports w/o addresses, we still need to
23658810c16bSdanmcd 	 * allocate.  Also, if we have one inner address, we need the
23668810c16bSdanmcd 	 * other, even if we don't specify anything.
23678810c16bSdanmcd 	 */
23688810c16bSdanmcd 	if (alloc_inner && idst == NULL) {
23698810c16bSdanmcd 		/* Allocate zeroed-out. */
23708810c16bSdanmcd 		alloclen = sizeof (*idst) + sizeof (struct sockaddr_in6);
23718810c16bSdanmcd 		idst = calloc(1, alloclen);
23728810c16bSdanmcd 		if (idst == NULL) {
23738810c16bSdanmcd 			Bail("malloc(implicit idst)");
23748810c16bSdanmcd 		}
23758810c16bSdanmcd 		totallen += alloclen;
23768810c16bSdanmcd 		idst->sadb_address_len = SADB_8TO64(alloclen);
23778810c16bSdanmcd 		idst->sadb_address_exttype = SADB_X_EXT_ADDRESS_INNER_DST;
23788810c16bSdanmcd 		sin6 = (struct sockaddr_in6 *)(idst + 1);
23798810c16bSdanmcd 		sin6->sin6_family = AF_INET6;
23808810c16bSdanmcd 	}
23818810c16bSdanmcd 
23828810c16bSdanmcd 	if (alloc_inner && isrc == NULL) {
23838810c16bSdanmcd 		/* Allocate zeroed-out. */
23848810c16bSdanmcd 		alloclen = sizeof (*isrc) + sizeof (struct sockaddr_in6);
23858810c16bSdanmcd 		isrc = calloc(1, alloclen);
23868810c16bSdanmcd 		if (isrc == NULL) {
23878810c16bSdanmcd 			Bail("malloc(implicit isrc)");
23888810c16bSdanmcd 		}
23898810c16bSdanmcd 		totallen += alloclen;
23908810c16bSdanmcd 		isrc->sadb_address_len = SADB_8TO64(alloclen);
23918810c16bSdanmcd 		isrc->sadb_address_exttype = SADB_X_EXT_ADDRESS_INNER_SRC;
23928810c16bSdanmcd 		sin6 = (struct sockaddr_in6 *)(isrc + 1);
23938810c16bSdanmcd 		sin6->sin6_family = AF_INET6;
23948810c16bSdanmcd 	}
23958810c16bSdanmcd 
23967c478bd9Sstevel@tonic-gate 	/*
23977c478bd9Sstevel@tonic-gate 	 * Okay, so now I have all of the potential extensions!
23987c478bd9Sstevel@tonic-gate 	 * Allocate a single contiguous buffer.  Keep in mind that it'll
23997c478bd9Sstevel@tonic-gate 	 * be enough because the key itself will be yanked.
24007c478bd9Sstevel@tonic-gate 	 */
24017c478bd9Sstevel@tonic-gate 
24027c478bd9Sstevel@tonic-gate 	if (src == NULL && dst != NULL) {
24037c478bd9Sstevel@tonic-gate 		/*
24047c478bd9Sstevel@tonic-gate 		 * Set explicit unspecified source address.
24057c478bd9Sstevel@tonic-gate 		 */
24067c478bd9Sstevel@tonic-gate 		size_t lenbytes = SADB_64TO8(dst->sadb_address_len);
24077c478bd9Sstevel@tonic-gate 
24087c478bd9Sstevel@tonic-gate 		unspec_src = B_TRUE;
24097c478bd9Sstevel@tonic-gate 		totallen += lenbytes;
24107c478bd9Sstevel@tonic-gate 		src = malloc(lenbytes);
24117c478bd9Sstevel@tonic-gate 		if (src == NULL)
24127c478bd9Sstevel@tonic-gate 			Bail("malloc(implicit src)");
24137c478bd9Sstevel@tonic-gate 		/* Confusing, but we're copying from DST to SRC.  :) */
24147c478bd9Sstevel@tonic-gate 		bcopy(dst, src, lenbytes);
24157c478bd9Sstevel@tonic-gate 		src->sadb_address_exttype = SADB_EXT_ADDRESS_SRC;
24167c478bd9Sstevel@tonic-gate 		sin6 = (struct sockaddr_in6 *)(src + 1);
24177c478bd9Sstevel@tonic-gate 		bzero(sin6, sizeof (*sin6));
24187c478bd9Sstevel@tonic-gate 		sin6->sin6_family = AF_INET6;
24197c478bd9Sstevel@tonic-gate 	}
24208810c16bSdanmcd 
24217c478bd9Sstevel@tonic-gate 	msg.sadb_msg_len = SADB_8TO64(totallen);
24227c478bd9Sstevel@tonic-gate 
24237c478bd9Sstevel@tonic-gate 	buffer = malloc(totallen);
24247c478bd9Sstevel@tonic-gate 	nexthdr = buffer;
24257c478bd9Sstevel@tonic-gate 	bcopy(&msg, nexthdr, sizeof (msg));
24267c478bd9Sstevel@tonic-gate 	nexthdr += SADB_8TO64(sizeof (msg));
24277c478bd9Sstevel@tonic-gate 	if (assoc != NULL) {
24287c478bd9Sstevel@tonic-gate 		if (assoc->sadb_sa_spi == 0) {
2429*e3320f40Smarkfen 			ERROR1(ep, ebuf, gettext(
2430*e3320f40Smarkfen 			    "The SPI value is missing for "
2431*e3320f40Smarkfen 			    "the association you wish to %s.\n"), thiscmd);
24327c478bd9Sstevel@tonic-gate 		}
24337c478bd9Sstevel@tonic-gate 		if (assoc->sadb_sa_auth == 0 && assoc->sadb_sa_encrypt == 0 &&
24347c478bd9Sstevel@tonic-gate 			cmd == CMD_ADD) {
2435*e3320f40Smarkfen 			free(assoc);
2436*e3320f40Smarkfen 			FATAL(ep, ebuf, gettext(
2437*e3320f40Smarkfen 			    "Select at least one algorithm "
2438*e3320f40Smarkfen 			    "for this add.\n"));
24397c478bd9Sstevel@tonic-gate 		}
24407c478bd9Sstevel@tonic-gate 
24417c478bd9Sstevel@tonic-gate 		/* Hack to let user specify NULL ESP implicitly. */
24427c478bd9Sstevel@tonic-gate 		if (msg.sadb_msg_satype == SADB_SATYPE_ESP &&
24437c478bd9Sstevel@tonic-gate 		    assoc->sadb_sa_encrypt == 0)
24447c478bd9Sstevel@tonic-gate 			assoc->sadb_sa_encrypt = SADB_EALG_NULL;
24457c478bd9Sstevel@tonic-gate 
24467c478bd9Sstevel@tonic-gate 		/* 0 is an actual value.  Print a warning if it was entered. */
24477c478bd9Sstevel@tonic-gate 		if (assoc->sadb_sa_state == 0) {
2448*e3320f40Smarkfen 			if (readstate) {
2449*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext(
2450*e3320f40Smarkfen 				    "WARNING: Cannot set LARVAL SA state.\n"));
2451*e3320f40Smarkfen 			}
24527c478bd9Sstevel@tonic-gate 			assoc->sadb_sa_state = SADB_SASTATE_MATURE;
24537c478bd9Sstevel@tonic-gate 		}
24547c478bd9Sstevel@tonic-gate 
24557c478bd9Sstevel@tonic-gate 		if (use_natt) {
24567c478bd9Sstevel@tonic-gate 			if (natt_remote != NULL)
24577c478bd9Sstevel@tonic-gate 				assoc->sadb_sa_flags |= SADB_X_SAFLAGS_NATT_REM;
24587c478bd9Sstevel@tonic-gate 			if (natt_local != NULL)
24597c478bd9Sstevel@tonic-gate 				assoc->sadb_sa_flags |= SADB_X_SAFLAGS_NATT_LOC;
24607c478bd9Sstevel@tonic-gate 		}
24617c478bd9Sstevel@tonic-gate 
24628810c16bSdanmcd 		if (alloc_inner) {
24638810c16bSdanmcd 			/*
24648810c16bSdanmcd 			 * For now, assume RFC 3884's dream of transport-mode
24658810c16bSdanmcd 			 * SAs with inner IP address selectors will not
24668810c16bSdanmcd 			 * happen.
24678810c16bSdanmcd 			 */
24688810c16bSdanmcd 			assoc->sadb_sa_flags |= SADB_X_SAFLAGS_TUNNEL;
24698810c16bSdanmcd 			if (proto != 0 && proto != IPPROTO_ENCAP &&
24708810c16bSdanmcd 			    proto != IPPROTO_IPV6) {
2471*e3320f40Smarkfen 				ERROR1(ep, ebuf, gettext(
2472*e3320f40Smarkfen 				    "WARNING: Protocol type %d not "
2473*e3320f40Smarkfen 				    "for use with Tunnel-Mode SA.\n"), proto);
24748810c16bSdanmcd 				/* Continue and let PF_KEY scream... */
24758810c16bSdanmcd 			}
24768810c16bSdanmcd 		}
24778810c16bSdanmcd 
24787c478bd9Sstevel@tonic-gate 		bcopy(assoc, nexthdr, SADB_64TO8(assoc->sadb_sa_len));
24797c478bd9Sstevel@tonic-gate 		nexthdr += assoc->sadb_sa_len;
24807c478bd9Sstevel@tonic-gate 		/* Save the SPI for the case of an error. */
24817c478bd9Sstevel@tonic-gate 		spi = assoc->sadb_sa_spi;
24827c478bd9Sstevel@tonic-gate 		free(assoc);
24837c478bd9Sstevel@tonic-gate 	} else {
2484*e3320f40Smarkfen 		ERROR1(ep, ebuf, gettext(
2485*e3320f40Smarkfen 		    "Need SA parameters for %s.\n"), thiscmd);
24867c478bd9Sstevel@tonic-gate 	}
24877c478bd9Sstevel@tonic-gate 
24887c478bd9Sstevel@tonic-gate 	if (hard != NULL) {
24897c478bd9Sstevel@tonic-gate 		bcopy(hard, nexthdr, SADB_64TO8(hard->sadb_lifetime_len));
24907c478bd9Sstevel@tonic-gate 		nexthdr += hard->sadb_lifetime_len;
24917c478bd9Sstevel@tonic-gate 		free(hard);
24927c478bd9Sstevel@tonic-gate 	}
24937c478bd9Sstevel@tonic-gate 
24947c478bd9Sstevel@tonic-gate 	if (soft != NULL) {
24957c478bd9Sstevel@tonic-gate 		bcopy(soft, nexthdr, SADB_64TO8(soft->sadb_lifetime_len));
24967c478bd9Sstevel@tonic-gate 		nexthdr += soft->sadb_lifetime_len;
24977c478bd9Sstevel@tonic-gate 		free(soft);
24987c478bd9Sstevel@tonic-gate 	}
24997c478bd9Sstevel@tonic-gate 
25007c478bd9Sstevel@tonic-gate 	if (encrypt == NULL && auth == NULL && cmd == CMD_ADD) {
2501*e3320f40Smarkfen 		ERROR(ep, ebuf, gettext(
2502*e3320f40Smarkfen 		    "Must have at least one key for an add.\n"));
25037c478bd9Sstevel@tonic-gate 	}
25047c478bd9Sstevel@tonic-gate 
25057c478bd9Sstevel@tonic-gate 	if (encrypt != NULL) {
25067c478bd9Sstevel@tonic-gate 		bcopy(encrypt, nexthdr, SADB_64TO8(encrypt->sadb_key_len));
25077c478bd9Sstevel@tonic-gate 		nexthdr += encrypt->sadb_key_len;
25087c478bd9Sstevel@tonic-gate 		bzero(encrypt, SADB_64TO8(encrypt->sadb_key_len));
25097c478bd9Sstevel@tonic-gate 		free(encrypt);
25107c478bd9Sstevel@tonic-gate 	}
25117c478bd9Sstevel@tonic-gate 
25127c478bd9Sstevel@tonic-gate 	if (auth != NULL) {
25137c478bd9Sstevel@tonic-gate 		bcopy(auth, nexthdr, SADB_64TO8(auth->sadb_key_len));
25147c478bd9Sstevel@tonic-gate 		nexthdr += auth->sadb_key_len;
25157c478bd9Sstevel@tonic-gate 		bzero(auth, SADB_64TO8(auth->sadb_key_len));
25167c478bd9Sstevel@tonic-gate 		free(auth);
25177c478bd9Sstevel@tonic-gate 	}
25187c478bd9Sstevel@tonic-gate 
25197c478bd9Sstevel@tonic-gate 	if (srcid != NULL) {
25207c478bd9Sstevel@tonic-gate 		bcopy(srcid, nexthdr, SADB_64TO8(srcid->sadb_ident_len));
25217c478bd9Sstevel@tonic-gate 		nexthdr += srcid->sadb_ident_len;
25227c478bd9Sstevel@tonic-gate 		free(srcid);
25237c478bd9Sstevel@tonic-gate 	}
25247c478bd9Sstevel@tonic-gate 
25257c478bd9Sstevel@tonic-gate 	if (dstid != NULL) {
25267c478bd9Sstevel@tonic-gate 		bcopy(dstid, nexthdr, SADB_64TO8(dstid->sadb_ident_len));
25277c478bd9Sstevel@tonic-gate 		nexthdr += dstid->sadb_ident_len;
25287c478bd9Sstevel@tonic-gate 		free(dstid);
25297c478bd9Sstevel@tonic-gate 	}
25307c478bd9Sstevel@tonic-gate 
25317c478bd9Sstevel@tonic-gate 	if (dst != NULL) {
25327c478bd9Sstevel@tonic-gate 		bcopy(dst, nexthdr, SADB_64TO8(dst->sadb_address_len));
25337c478bd9Sstevel@tonic-gate 		free(dst);
25347c478bd9Sstevel@tonic-gate 		dst = (struct sadb_address *)nexthdr;
25358810c16bSdanmcd 		dst->sadb_address_proto = proto;
25368810c16bSdanmcd 		((struct sockaddr_in6 *)(dst + 1))->sin6_port = htons(dstport);
25377c478bd9Sstevel@tonic-gate 		nexthdr += dst->sadb_address_len;
25387c478bd9Sstevel@tonic-gate 	} else {
2539*e3320f40Smarkfen 		FATAL1(ep, ebuf, gettext(
2540*e3320f40Smarkfen 		    "Need destination address for %s.\n"), thiscmd);
25417c478bd9Sstevel@tonic-gate 	}
25427c478bd9Sstevel@tonic-gate 
25437c478bd9Sstevel@tonic-gate 	if (use_natt) {
25447c478bd9Sstevel@tonic-gate 		if (natt_remote == NULL && natt_local == NULL) {
2545*e3320f40Smarkfen 			ERROR(ep, ebuf, gettext(
2546*e3320f40Smarkfen 			    "Must specify NAT-T remote or local address "
2547*e3320f40Smarkfen 			    "for UDP encapsulation.\n"));
25487c478bd9Sstevel@tonic-gate 		}
25497c478bd9Sstevel@tonic-gate 
25507c478bd9Sstevel@tonic-gate 		if (natt_lport != 0 && natt_local == NULL) {
2551*e3320f40Smarkfen 			ERROR(ep, ebuf, gettext(
2552*e3320f40Smarkfen 			    "If NAT-T local port is specified, NAT-T "
2553*e3320f40Smarkfen 			    "local address must also be specified.\n"));
25547c478bd9Sstevel@tonic-gate 		}
25557c478bd9Sstevel@tonic-gate 
25567c478bd9Sstevel@tonic-gate 		if (natt_rport != 0 && natt_remote == NULL) {
2557*e3320f40Smarkfen 			ERROR(ep, ebuf, gettext(
2558*e3320f40Smarkfen 			    "If NAT-T remote port is specified, NAT-T "
2559*e3320f40Smarkfen 			    "remote address must also be specified.\n"));
25607c478bd9Sstevel@tonic-gate 		}
25617c478bd9Sstevel@tonic-gate 
25627c478bd9Sstevel@tonic-gate 		if (natt_remote != NULL) {
25638810c16bSdanmcd 			bcopy(natt_remote, nexthdr,
25648810c16bSdanmcd 			    SADB_64TO8(natt_remote->sadb_address_len));
25657c478bd9Sstevel@tonic-gate 			free(natt_remote);
25667c478bd9Sstevel@tonic-gate 			natt_remote = (struct sadb_address *)nexthdr;
25677c478bd9Sstevel@tonic-gate 			nexthdr += natt_remote->sadb_address_len;
25688810c16bSdanmcd 			((struct sockaddr_in6 *)(natt_remote + 1))->sin6_port =
25698810c16bSdanmcd 			    htons(natt_rport);
25707c478bd9Sstevel@tonic-gate 		}
25718810c16bSdanmcd 
25727c478bd9Sstevel@tonic-gate 		if (natt_local != NULL) {
25737c478bd9Sstevel@tonic-gate 			bcopy(natt_local, nexthdr,
25747c478bd9Sstevel@tonic-gate 			    SADB_64TO8(natt_local->sadb_address_len));
25757c478bd9Sstevel@tonic-gate 			free(natt_local);
25767c478bd9Sstevel@tonic-gate 			natt_local = (struct sadb_address *)nexthdr;
25777c478bd9Sstevel@tonic-gate 			nexthdr += natt_local->sadb_address_len;
25788810c16bSdanmcd 			((struct sockaddr_in6 *)(natt_local + 1))->sin6_port =
25798810c16bSdanmcd 			    htons(natt_lport);
25807c478bd9Sstevel@tonic-gate 		}
25817c478bd9Sstevel@tonic-gate 	}
2582*e3320f40Smarkfen 
2583*e3320f40Smarkfen 	handle_errors(ep, ebuf, B_TRUE, B_FALSE);
2584*e3320f40Smarkfen 
25857c478bd9Sstevel@tonic-gate 	/*
25867c478bd9Sstevel@tonic-gate 	 * PF_KEY requires a source address extension, even if the source
25877c478bd9Sstevel@tonic-gate 	 * address itself is unspecified. (See "Set explicit unspecified..."
25887c478bd9Sstevel@tonic-gate 	 * code fragment above. Destination reality check was above.)
25897c478bd9Sstevel@tonic-gate 	 */
25907c478bd9Sstevel@tonic-gate 	bcopy(src, nexthdr, SADB_64TO8(src->sadb_address_len));
25917c478bd9Sstevel@tonic-gate 	free(src);
25927c478bd9Sstevel@tonic-gate 	src = (struct sadb_address *)nexthdr;
25938810c16bSdanmcd 	src->sadb_address_proto = proto;
25948810c16bSdanmcd 	((struct sockaddr_in6 *)(src + 1))->sin6_port = htons(srcport);
25957c478bd9Sstevel@tonic-gate 	nexthdr += src->sadb_address_len;
25967c478bd9Sstevel@tonic-gate 
25978810c16bSdanmcd 	if (isrc != NULL) {
25988810c16bSdanmcd 		bcopy(isrc, nexthdr, SADB_64TO8(isrc->sadb_address_len));
25998810c16bSdanmcd 		free(isrc);
26008810c16bSdanmcd 		isrc = (struct sadb_address *)nexthdr;
26018810c16bSdanmcd 		isrc->sadb_address_proto = iproto;
26028810c16bSdanmcd 		((struct sockaddr_in6 *)(isrc + 1))->sin6_port =
26038810c16bSdanmcd 		    htons(isrcport);
26048810c16bSdanmcd 		nexthdr += isrc->sadb_address_len;
26057c478bd9Sstevel@tonic-gate 	}
26067c478bd9Sstevel@tonic-gate 
26078810c16bSdanmcd 	if (idst != NULL) {
26088810c16bSdanmcd 		bcopy(idst, nexthdr, SADB_64TO8(idst->sadb_address_len));
26098810c16bSdanmcd 		free(idst);
26108810c16bSdanmcd 		idst = (struct sadb_address *)nexthdr;
26118810c16bSdanmcd 		idst->sadb_address_proto = iproto;
26128810c16bSdanmcd 		((struct sockaddr_in6 *)(idst + 1))->sin6_port =
26138810c16bSdanmcd 		    htons(idstport);
26148810c16bSdanmcd 		nexthdr += idst->sadb_address_len;
26158810c16bSdanmcd 	}
26167c478bd9Sstevel@tonic-gate 
2617*e3320f40Smarkfen 	if (!cflag) {
2618*e3320f40Smarkfen 		doaddresses((cmd == CMD_ADD) ? SADB_ADD : SADB_UPDATE, satype,
2619*e3320f40Smarkfen 		    cmd, srchp, dsthp, src, dst, unspec_src, buffer, totallen,
2620*e3320f40Smarkfen 		    spi, ebuf);
2621*e3320f40Smarkfen 	}
26227c478bd9Sstevel@tonic-gate 
26238810c16bSdanmcd 	if (isrchp != NULL && isrchp != &dummy.he)
2624*e3320f40Smarkfen 	    freehostent(isrchp);
26258810c16bSdanmcd 	if (idsthp != NULL && idsthp != &dummy.he)
2626*e3320f40Smarkfen 	    freehostent(idsthp);
26277c478bd9Sstevel@tonic-gate 	if (srchp != NULL && srchp != &dummy.he)
2628*e3320f40Smarkfen 	    freehostent(srchp);
26297c478bd9Sstevel@tonic-gate 	if (dsthp != NULL && dsthp != &dummy.he)
2630*e3320f40Smarkfen 	    freehostent(dsthp);
26317c478bd9Sstevel@tonic-gate 	if (natt_lhp != NULL && natt_lhp != &dummy.he)
2632*e3320f40Smarkfen 	    freehostent(natt_lhp);
26337c478bd9Sstevel@tonic-gate 	if (natt_rhp != NULL && natt_rhp != &dummy.he)
2634*e3320f40Smarkfen 	    freehostent(natt_rhp);
2635*e3320f40Smarkfen 
2636*e3320f40Smarkfen 	free(ebuf);
2637*e3320f40Smarkfen 	free(buffer);
26387c478bd9Sstevel@tonic-gate }
26397c478bd9Sstevel@tonic-gate 
26407c478bd9Sstevel@tonic-gate /*
26417c478bd9Sstevel@tonic-gate  * DELETE and GET are similar, in that they only need the extensions
26427c478bd9Sstevel@tonic-gate  * required to _find_ an SA, and then either delete it or obtain its
26437c478bd9Sstevel@tonic-gate  * information.
26447c478bd9Sstevel@tonic-gate  */
26457c478bd9Sstevel@tonic-gate static void
2646*e3320f40Smarkfen dodelget(int cmd, int satype, char *argv[], char *ebuf)
26477c478bd9Sstevel@tonic-gate {
26487c478bd9Sstevel@tonic-gate 	struct sadb_msg *msg = (struct sadb_msg *)get_buffer;
26497c478bd9Sstevel@tonic-gate 	uint64_t *nextext;
26507c478bd9Sstevel@tonic-gate 	struct sadb_sa *assoc = NULL;
26517c478bd9Sstevel@tonic-gate 	struct sadb_address *src = NULL, *dst = NULL;
26527c478bd9Sstevel@tonic-gate 	int next, token, sa_len;
26537c478bd9Sstevel@tonic-gate 	char *thiscmd;
26547c478bd9Sstevel@tonic-gate 	uint32_t spi;
26557c478bd9Sstevel@tonic-gate 	struct hostent *srchp = NULL, *dsthp = NULL;
26567c478bd9Sstevel@tonic-gate 	struct sockaddr_in6 *sin6;
26577c478bd9Sstevel@tonic-gate 	boolean_t unspec_src = B_TRUE;
26587c478bd9Sstevel@tonic-gate 	uint16_t srcport = 0, dstport = 0;
26597c478bd9Sstevel@tonic-gate 	uint8_t proto = 0;
2660*e3320f40Smarkfen 	char *ep = NULL;
26617c478bd9Sstevel@tonic-gate 
26627c478bd9Sstevel@tonic-gate 	msg_init(msg, ((cmd == CMD_GET) ? SADB_GET : SADB_DELETE),
26637c478bd9Sstevel@tonic-gate 	    (uint8_t)satype);
26647c478bd9Sstevel@tonic-gate 	/* Set the first extension header to right past the base message. */
26657c478bd9Sstevel@tonic-gate 	nextext = (uint64_t *)(msg + 1);
26667c478bd9Sstevel@tonic-gate 	bzero(nextext, sizeof (get_buffer) - sizeof (*msg));
26677c478bd9Sstevel@tonic-gate 
26687c478bd9Sstevel@tonic-gate 	thiscmd = (cmd == CMD_GET) ? "get" : "delete";
26697c478bd9Sstevel@tonic-gate 
267007b56925Ssommerfe #define	ALLOC_ADDR_EXT(ext, exttype)			\
267107b56925Ssommerfe 	(ext) = (struct sadb_address *)nextext;		\
267207b56925Ssommerfe 	nextext = (uint64_t *)((ext) + 1);		\
267307b56925Ssommerfe 	nextext += SADB_8TO64(roundup(sa_len, 8));	\
267407b56925Ssommerfe 	(ext)->sadb_address_exttype = exttype;		\
267507b56925Ssommerfe 	(ext)->sadb_address_len = nextext - ((uint64_t *)ext);
267607b56925Ssommerfe 
26777c478bd9Sstevel@tonic-gate 	/* Assume last element in argv is set to NULL. */
26787c478bd9Sstevel@tonic-gate 	do {
26797c478bd9Sstevel@tonic-gate 		token = parseextval(*argv, &next);
26807c478bd9Sstevel@tonic-gate 		argv++;
26817c478bd9Sstevel@tonic-gate 		switch (token) {
26827c478bd9Sstevel@tonic-gate 		case TOK_EOF:
26837c478bd9Sstevel@tonic-gate 			/* Do nothing, I'm done. */
26847c478bd9Sstevel@tonic-gate 			break;
26857c478bd9Sstevel@tonic-gate 		case TOK_UNKNOWN:
2686*e3320f40Smarkfen 			ERROR1(ep, ebuf, gettext(
2687*e3320f40Smarkfen 			    "Unknown extension field \"%s\"\n"), *(argv - 1));
26887c478bd9Sstevel@tonic-gate 			break;
26897c478bd9Sstevel@tonic-gate 		case TOK_SPI:
26907c478bd9Sstevel@tonic-gate 			if (assoc != NULL) {
2691*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext(
2692*e3320f40Smarkfen 				    "Can only specify single SPI value.\n"));
2693*e3320f40Smarkfen 				break;
26947c478bd9Sstevel@tonic-gate 			}
26957c478bd9Sstevel@tonic-gate 			assoc = (struct sadb_sa *)nextext;
26967c478bd9Sstevel@tonic-gate 			nextext = (uint64_t *)(assoc + 1);
26977c478bd9Sstevel@tonic-gate 			assoc->sadb_sa_len = SADB_8TO64(sizeof (*assoc));
26987c478bd9Sstevel@tonic-gate 			assoc->sadb_sa_exttype = SADB_EXT_SA;
26997c478bd9Sstevel@tonic-gate 			assoc->sadb_sa_spi = htonl((uint32_t)parsenum(*argv,
2700*e3320f40Smarkfen 			    B_TRUE, ebuf));
27017c478bd9Sstevel@tonic-gate 			spi = assoc->sadb_sa_spi;
27027c478bd9Sstevel@tonic-gate 			argv++;
27037c478bd9Sstevel@tonic-gate 			break;
27047c478bd9Sstevel@tonic-gate 		case TOK_SRCPORT:
27057c478bd9Sstevel@tonic-gate 			if (srcport != 0) {
2706*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext(
2707*e3320f40Smarkfen 				    "Can only specify single source port.\n"));
2708*e3320f40Smarkfen 				break;
27097c478bd9Sstevel@tonic-gate 			}
2710*e3320f40Smarkfen 			srcport = parsenum(*argv, B_TRUE, ebuf);
27117c478bd9Sstevel@tonic-gate 			argv++;
27127c478bd9Sstevel@tonic-gate 			break;
27137c478bd9Sstevel@tonic-gate 		case TOK_DSTPORT:
27147c478bd9Sstevel@tonic-gate 			if (dstport != 0) {
2715*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext(
2716*e3320f40Smarkfen 				    "Can only "
2717*e3320f40Smarkfen 				    "specify single destination port.\n"));
2718*e3320f40Smarkfen 				break;
27197c478bd9Sstevel@tonic-gate 			}
2720*e3320f40Smarkfen 			dstport = parsenum(*argv, B_TRUE, ebuf);
27217c478bd9Sstevel@tonic-gate 			argv++;
27227c478bd9Sstevel@tonic-gate 			break;
27237c478bd9Sstevel@tonic-gate 		case TOK_PROTO:
27247c478bd9Sstevel@tonic-gate 			if (proto != 0) {
2725*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext(
2726*e3320f40Smarkfen 				    "Can only specify single protocol.\n"));
2727*e3320f40Smarkfen 				break;
27287c478bd9Sstevel@tonic-gate 			}
2729*e3320f40Smarkfen 			proto = parsenum(*argv, B_TRUE, ebuf);
27307c478bd9Sstevel@tonic-gate 			argv++;
27317c478bd9Sstevel@tonic-gate 			break;
27327c478bd9Sstevel@tonic-gate 		case TOK_SRCADDR:
27337c478bd9Sstevel@tonic-gate 		case TOK_SRCADDR6:
27347c478bd9Sstevel@tonic-gate 			if (src != NULL) {
2735*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext(
2736*e3320f40Smarkfen 				    "Can only specify single source addr.\n"));
2737*e3320f40Smarkfen 				break;
27387c478bd9Sstevel@tonic-gate 			}
27397c478bd9Sstevel@tonic-gate 			sa_len = parseaddr(*argv, &srchp,
2740*e3320f40Smarkfen 			    (token == TOK_SRCADDR6), ebuf);
2741*e3320f40Smarkfen 			if (srchp == NULL) {
2742*e3320f40Smarkfen 				ERROR1(ep, ebuf, gettext(
2743*e3320f40Smarkfen 				    "Unknown source address \"%s\"\n"), *argv);
2744*e3320f40Smarkfen 				break;
2745*e3320f40Smarkfen 			}
27467c478bd9Sstevel@tonic-gate 			argv++;
27477c478bd9Sstevel@tonic-gate 
27487c478bd9Sstevel@tonic-gate 			unspec_src = B_FALSE;
274907b56925Ssommerfe 
275007b56925Ssommerfe 			ALLOC_ADDR_EXT(src, SADB_EXT_ADDRESS_SRC);
275107b56925Ssommerfe 
27527c478bd9Sstevel@tonic-gate 			if (srchp == &dummy.he) {
27537c478bd9Sstevel@tonic-gate 				/*
27547c478bd9Sstevel@tonic-gate 				 * Single address with -n flag.
27557c478bd9Sstevel@tonic-gate 				 */
27567c478bd9Sstevel@tonic-gate 				sin6 = (struct sockaddr_in6 *)(src + 1);
27577c478bd9Sstevel@tonic-gate 				bzero(sin6, sizeof (*sin6));
27587c478bd9Sstevel@tonic-gate 				sin6->sin6_family = AF_INET6;
27597c478bd9Sstevel@tonic-gate 				bcopy(srchp->h_addr_list[0], &sin6->sin6_addr,
27607c478bd9Sstevel@tonic-gate 				    sizeof (struct in6_addr));
27617c478bd9Sstevel@tonic-gate 			}
27627c478bd9Sstevel@tonic-gate 			/* The rest is pre-bzeroed for us. */
27637c478bd9Sstevel@tonic-gate 			break;
27647c478bd9Sstevel@tonic-gate 		case TOK_DSTADDR:
27657c478bd9Sstevel@tonic-gate 		case TOK_DSTADDR6:
27667c478bd9Sstevel@tonic-gate 			if (dst != NULL) {
2767*e3320f40Smarkfen 				ERROR(ep, ebuf, gettext(
2768*e3320f40Smarkfen 				    "Can only specify single destination "
2769*e3320f40Smarkfen 				    "address.\n"));
2770*e3320f40Smarkfen 				break;
27717c478bd9Sstevel@tonic-gate 			}
27727c478bd9Sstevel@tonic-gate 			sa_len = parseaddr(*argv, &dsthp,
2773*e3320f40Smarkfen 			    (token == TOK_SRCADDR6), ebuf);
2774*e3320f40Smarkfen 			if (dsthp == NULL) {
2775*e3320f40Smarkfen 				ERROR1(ep, ebuf, gettext(
2776*e3320f40Smarkfen 				    "Unknown destination address \"%s\"\n"),
2777*e3320f40Smarkfen 				    *argv);
2778*e3320f40Smarkfen 				break;
2779*e3320f40Smarkfen 			}
27807c478bd9Sstevel@tonic-gate 			argv++;
27817c478bd9Sstevel@tonic-gate 
278207b56925Ssommerfe 			ALLOC_ADDR_EXT(dst, SADB_EXT_ADDRESS_DST);
278307b56925Ssommerfe 
27847c478bd9Sstevel@tonic-gate 			if (dsthp == &dummy.he) {
27857c478bd9Sstevel@tonic-gate 				/*
27867c478bd9Sstevel@tonic-gate 				 * Single address with -n flag.
27877c478bd9Sstevel@tonic-gate 				 */
27887c478bd9Sstevel@tonic-gate 				sin6 = (struct sockaddr_in6 *)(dst + 1);
27897c478bd9Sstevel@tonic-gate 				bzero(sin6, sizeof (*sin6));
27907c478bd9Sstevel@tonic-gate 				sin6->sin6_family = AF_INET6;
27917c478bd9Sstevel@tonic-gate 				bcopy(dsthp->h_addr_list[0], &sin6->sin6_addr,
27927c478bd9Sstevel@tonic-gate 				    sizeof (struct in6_addr));
27937c478bd9Sstevel@tonic-gate 			}
27947c478bd9Sstevel@tonic-gate 			/* The rest is pre-bzeroed for us. */
27957c478bd9Sstevel@tonic-gate 			break;
27967c478bd9Sstevel@tonic-gate 		default:
2797*e3320f40Smarkfen 			ERROR2(ep, ebuf, gettext(
2798*e3320f40Smarkfen 			    "Don't use extension %s for '%s' command.\n"),
2799*e3320f40Smarkfen 			    *(argv - 1), thiscmd);
28007c478bd9Sstevel@tonic-gate 			break;
28017c478bd9Sstevel@tonic-gate 		}
28027c478bd9Sstevel@tonic-gate 	} while (token != TOK_EOF);
28037c478bd9Sstevel@tonic-gate 
2804*e3320f40Smarkfen 	handle_errors(ep, ebuf, B_TRUE, B_FALSE);
2805*e3320f40Smarkfen 
280607b56925Ssommerfe 	if ((srcport != 0) && (src == NULL)) {
280707b56925Ssommerfe 		ALLOC_ADDR_EXT(src, SADB_EXT_ADDRESS_SRC);
280807b56925Ssommerfe 		sin6 = (struct sockaddr_in6 *)(src + 1);
28098810c16bSdanmcd 		src->sadb_address_proto = proto;
281007b56925Ssommerfe 		bzero(sin6, sizeof (*sin6));
281107b56925Ssommerfe 		sin6->sin6_family = AF_INET6;
28128810c16bSdanmcd 		sin6->sin6_port = htons(srcport);
281307b56925Ssommerfe 	}
281407b56925Ssommerfe 
281507b56925Ssommerfe 	if ((dstport != 0) && (dst == NULL)) {
281607b56925Ssommerfe 		ALLOC_ADDR_EXT(dst, SADB_EXT_ADDRESS_DST);
281707b56925Ssommerfe 		sin6 = (struct sockaddr_in6 *)(dst + 1);
28188810c16bSdanmcd 		src->sadb_address_proto = proto;
281907b56925Ssommerfe 		bzero(sin6, sizeof (*sin6));
282007b56925Ssommerfe 		sin6->sin6_family = AF_INET6;
28218810c16bSdanmcd 		sin6->sin6_port = htons(dstport);
282207b56925Ssommerfe 	}
282307b56925Ssommerfe 
28247c478bd9Sstevel@tonic-gate 	/* So I have enough of the message to send it down! */
28257c478bd9Sstevel@tonic-gate 	msg->sadb_msg_len = nextext - get_buffer;
28267c478bd9Sstevel@tonic-gate 
2827*e3320f40Smarkfen 	if (assoc == NULL) {
2828*e3320f40Smarkfen 		FATAL1(ep, ebuf, gettext(
2829*e3320f40Smarkfen 		    "Need SA parameters for %s.\n"), thiscmd);
2830*e3320f40Smarkfen 	}
2831*e3320f40Smarkfen 
2832*e3320f40Smarkfen 	if (!cflag) {
2833*e3320f40Smarkfen 		doaddresses((cmd == CMD_GET) ? SADB_GET : SADB_DELETE, satype,
2834*e3320f40Smarkfen 		    cmd, srchp, dsthp, src, dst, unspec_src, get_buffer,
2835*e3320f40Smarkfen 		    sizeof (get_buffer), spi, NULL);
2836*e3320f40Smarkfen 	}
28377c478bd9Sstevel@tonic-gate 
28387c478bd9Sstevel@tonic-gate 	if (srchp != NULL && srchp != &dummy.he)
28397c478bd9Sstevel@tonic-gate 		freehostent(srchp);
28407c478bd9Sstevel@tonic-gate 	if (dsthp != NULL && dsthp != &dummy.he)
28417c478bd9Sstevel@tonic-gate 		freehostent(dsthp);
28427c478bd9Sstevel@tonic-gate }
28437c478bd9Sstevel@tonic-gate 
28447c478bd9Sstevel@tonic-gate /*
28457c478bd9Sstevel@tonic-gate  * "ipseckey monitor" should exit very gracefully if ^C is tapped.
28467c478bd9Sstevel@tonic-gate  */
28477c478bd9Sstevel@tonic-gate static void
28487c478bd9Sstevel@tonic-gate monitor_catch(int signal)
28497c478bd9Sstevel@tonic-gate {
28507c478bd9Sstevel@tonic-gate 	errx(signal, gettext("Bailing on signal %d."), signal);
28517c478bd9Sstevel@tonic-gate }
28527c478bd9Sstevel@tonic-gate 
28537c478bd9Sstevel@tonic-gate /*
28547c478bd9Sstevel@tonic-gate  * Loop forever, listening on PF_KEY messages.
28557c478bd9Sstevel@tonic-gate  */
28567c478bd9Sstevel@tonic-gate static void
28577c478bd9Sstevel@tonic-gate domonitor(boolean_t passive)
28587c478bd9Sstevel@tonic-gate {
28597c478bd9Sstevel@tonic-gate 	struct sadb_msg *samsg;
28607c478bd9Sstevel@tonic-gate 	int rc;
28617c478bd9Sstevel@tonic-gate 
28627c478bd9Sstevel@tonic-gate 	/* Catch ^C. */
28637c478bd9Sstevel@tonic-gate 	(void) signal(SIGINT, monitor_catch);
28647c478bd9Sstevel@tonic-gate 
28657c478bd9Sstevel@tonic-gate 	samsg = (struct sadb_msg *)get_buffer;
28667c478bd9Sstevel@tonic-gate 	if (!passive) {
28677c478bd9Sstevel@tonic-gate 		(void) printf(gettext("Actively"));
28687c478bd9Sstevel@tonic-gate 		msg_init(samsg, SADB_X_PROMISC, 1);	/* Turn ON promisc. */
28697c478bd9Sstevel@tonic-gate 		rc = key_write(keysock, samsg, sizeof (*samsg));
28707c478bd9Sstevel@tonic-gate 		if (rc == -1)
28717c478bd9Sstevel@tonic-gate 			Bail("write (SADB_X_PROMISC)");
28727c478bd9Sstevel@tonic-gate 	} else {
28737c478bd9Sstevel@tonic-gate 		(void) printf(gettext("Passively"));
28747c478bd9Sstevel@tonic-gate 	}
28757c478bd9Sstevel@tonic-gate 	(void) printf(gettext(" monitoring the PF_KEY socket.\n"));
28767c478bd9Sstevel@tonic-gate 
28777c478bd9Sstevel@tonic-gate 	for (; ; ) {
28787c478bd9Sstevel@tonic-gate 		/*
28797c478bd9Sstevel@tonic-gate 		 * I assume that read() is non-blocking, and will never
28807c478bd9Sstevel@tonic-gate 		 * return 0.
28817c478bd9Sstevel@tonic-gate 		 */
28827c478bd9Sstevel@tonic-gate 		rc = read(keysock, samsg, sizeof (get_buffer));
28837c478bd9Sstevel@tonic-gate 		if (rc == -1)
28847c478bd9Sstevel@tonic-gate 			Bail("read (in domonitor)");
28857c478bd9Sstevel@tonic-gate 		(void) printf(gettext("Read %d bytes.\n"), rc);
28867c478bd9Sstevel@tonic-gate 		/*
28877c478bd9Sstevel@tonic-gate 		 * Q:  Should I use the same method of printing as GET does?
28887c478bd9Sstevel@tonic-gate 		 * A:  For now, yes.
28897c478bd9Sstevel@tonic-gate 		 */
28908810c16bSdanmcd 		print_samsg(get_buffer, B_TRUE, vflag);
28917c478bd9Sstevel@tonic-gate 		(void) putchar('\n');
28927c478bd9Sstevel@tonic-gate 	}
28937c478bd9Sstevel@tonic-gate }
28947c478bd9Sstevel@tonic-gate 
28957c478bd9Sstevel@tonic-gate /*
28967c478bd9Sstevel@tonic-gate  * Either mask or unmask all relevant signals.
28977c478bd9Sstevel@tonic-gate  */
28987c478bd9Sstevel@tonic-gate static void
28997c478bd9Sstevel@tonic-gate mask_signals(boolean_t unmask)
29007c478bd9Sstevel@tonic-gate {
29017c478bd9Sstevel@tonic-gate 	sigset_t set;
29027c478bd9Sstevel@tonic-gate 	static sigset_t oset;
29037c478bd9Sstevel@tonic-gate 
29047c478bd9Sstevel@tonic-gate 	if (unmask) {
29057c478bd9Sstevel@tonic-gate 		(void) sigprocmask(SIG_SETMASK, &oset, NULL);
29067c478bd9Sstevel@tonic-gate 	} else {
29077c478bd9Sstevel@tonic-gate 		(void) sigfillset(&set);
29087c478bd9Sstevel@tonic-gate 		(void) sigprocmask(SIG_SETMASK, &set, &oset);
29097c478bd9Sstevel@tonic-gate 	}
29107c478bd9Sstevel@tonic-gate }
29117c478bd9Sstevel@tonic-gate 
29127c478bd9Sstevel@tonic-gate /*
29137c478bd9Sstevel@tonic-gate  * Assorted functions to print help text.
29147c478bd9Sstevel@tonic-gate  */
29157c478bd9Sstevel@tonic-gate #define	puts_tr(s) (void) puts(gettext(s))
29167c478bd9Sstevel@tonic-gate 
29177c478bd9Sstevel@tonic-gate static void
29187c478bd9Sstevel@tonic-gate doattrhelp()
29197c478bd9Sstevel@tonic-gate {
29207c478bd9Sstevel@tonic-gate 	int i;
29217c478bd9Sstevel@tonic-gate 
29227c478bd9Sstevel@tonic-gate 	puts_tr("\nSA attributes:");
29237c478bd9Sstevel@tonic-gate 
29247c478bd9Sstevel@tonic-gate 	for (i = 0; tokens[i].string != NULL; i++) {
29257c478bd9Sstevel@tonic-gate 		if (i%3 == 0)
29267c478bd9Sstevel@tonic-gate 			(void) printf("\n");
29277c478bd9Sstevel@tonic-gate 		(void) printf("    %-15.15s", tokens[i].string);
29287c478bd9Sstevel@tonic-gate 	}
29297c478bd9Sstevel@tonic-gate 	(void) printf("\n");
29307c478bd9Sstevel@tonic-gate }
29317c478bd9Sstevel@tonic-gate 
29327c478bd9Sstevel@tonic-gate static void
29337c478bd9Sstevel@tonic-gate dohelpcmd(char *cmds)
29347c478bd9Sstevel@tonic-gate {
29357c478bd9Sstevel@tonic-gate 	int cmd;
29367c478bd9Sstevel@tonic-gate 
29377c478bd9Sstevel@tonic-gate 	if (strcmp(cmds, "attr") == 0) {
29387c478bd9Sstevel@tonic-gate 		doattrhelp();
29397c478bd9Sstevel@tonic-gate 		return;
29407c478bd9Sstevel@tonic-gate 	}
29417c478bd9Sstevel@tonic-gate 
29427c478bd9Sstevel@tonic-gate 	cmd = parsecmd(cmds);
29437c478bd9Sstevel@tonic-gate 	switch (cmd) {
29447c478bd9Sstevel@tonic-gate 	case CMD_UPDATE:
29457c478bd9Sstevel@tonic-gate 		puts_tr("update	 - Update an existing SA");
29467c478bd9Sstevel@tonic-gate 		break;
29477c478bd9Sstevel@tonic-gate 	case CMD_ADD:
29487c478bd9Sstevel@tonic-gate 		puts_tr("add	 - Add a new security association (SA)");
29497c478bd9Sstevel@tonic-gate 		break;
29507c478bd9Sstevel@tonic-gate 	case CMD_DELETE:
29517c478bd9Sstevel@tonic-gate 		puts_tr("delete - Delete an SA");
29527c478bd9Sstevel@tonic-gate 		break;
29537c478bd9Sstevel@tonic-gate 	case CMD_GET:
29547c478bd9Sstevel@tonic-gate 		puts_tr("get - Display an SA");
29557c478bd9Sstevel@tonic-gate 		break;
29567c478bd9Sstevel@tonic-gate 	case CMD_FLUSH:
29577c478bd9Sstevel@tonic-gate 		puts_tr("flush - Delete all SAs");
29587c478bd9Sstevel@tonic-gate 		break;
29597c478bd9Sstevel@tonic-gate 	case CMD_DUMP:
29607c478bd9Sstevel@tonic-gate 		puts_tr("dump - Display all SAs");
29617c478bd9Sstevel@tonic-gate 		break;
29627c478bd9Sstevel@tonic-gate 	case CMD_MONITOR:
29637c478bd9Sstevel@tonic-gate 		puts_tr("monitor - Monitor all PF_KEY reply messages.");
29647c478bd9Sstevel@tonic-gate 		break;
29657c478bd9Sstevel@tonic-gate 	case CMD_PMONITOR:
29667c478bd9Sstevel@tonic-gate 		puts_tr(
29677c478bd9Sstevel@tonic-gate "pmonitor, passive_monitor - Monitor PF_KEY messages that");
29687c478bd9Sstevel@tonic-gate 		puts_tr(
29697c478bd9Sstevel@tonic-gate "                            reply to all PF_KEY sockets.");
29707c478bd9Sstevel@tonic-gate 		break;
29717c478bd9Sstevel@tonic-gate 
29727c478bd9Sstevel@tonic-gate 	case CMD_QUIT:
29737c478bd9Sstevel@tonic-gate 		puts_tr("quit, exit - Exit the program");
29747c478bd9Sstevel@tonic-gate 		break;
29757c478bd9Sstevel@tonic-gate 	case CMD_SAVE:
29767c478bd9Sstevel@tonic-gate 		puts_tr("save	    - Saves all SAs to a file");
29777c478bd9Sstevel@tonic-gate 		break;
29787c478bd9Sstevel@tonic-gate 	case CMD_HELP:
29797c478bd9Sstevel@tonic-gate 		puts_tr("help	    - Display list of commands");
29807c478bd9Sstevel@tonic-gate 		puts_tr("help <cmd> - Display help for command");
29817c478bd9Sstevel@tonic-gate 		puts_tr("help attr  - Display possible SA attributes");
29827c478bd9Sstevel@tonic-gate 		break;
29837c478bd9Sstevel@tonic-gate 	default:
29847c478bd9Sstevel@tonic-gate 		(void) printf(gettext("%s: Unknown command\n"), cmds);
29857c478bd9Sstevel@tonic-gate 		break;
29867c478bd9Sstevel@tonic-gate 	}
29877c478bd9Sstevel@tonic-gate }
29887c478bd9Sstevel@tonic-gate 
29897c478bd9Sstevel@tonic-gate 
29907c478bd9Sstevel@tonic-gate static void
29917c478bd9Sstevel@tonic-gate dohelp(char *cmds)
29927c478bd9Sstevel@tonic-gate {
29937c478bd9Sstevel@tonic-gate 	if (cmds != NULL) {
29947c478bd9Sstevel@tonic-gate 		dohelpcmd(cmds);
29957c478bd9Sstevel@tonic-gate 		return;
29967c478bd9Sstevel@tonic-gate 	}
29977c478bd9Sstevel@tonic-gate 	puts_tr("Commands");
29987c478bd9Sstevel@tonic-gate 	puts_tr("--------");
29997c478bd9Sstevel@tonic-gate 	puts_tr("?, help  - Display this list");
30007c478bd9Sstevel@tonic-gate 	puts_tr("help <cmd> - Display help for command");
30017c478bd9Sstevel@tonic-gate 	puts_tr("help attr  - Display possible SA attributes");
30027c478bd9Sstevel@tonic-gate 	puts_tr("quit, exit - Exit the program");
30037c478bd9Sstevel@tonic-gate 	puts_tr("monitor - Monitor all PF_KEY reply messages.");
30047c478bd9Sstevel@tonic-gate 	puts_tr("pmonitor, passive_monitor - Monitor PF_KEY messages that");
30057c478bd9Sstevel@tonic-gate 	puts_tr("                            reply to all PF_KEY sockets.");
30067c478bd9Sstevel@tonic-gate 	puts_tr("");
30077c478bd9Sstevel@tonic-gate 	puts_tr("The following commands are of the form:");
30087c478bd9Sstevel@tonic-gate 	puts_tr("    <command> {SA type} {attribute value}*");
30097c478bd9Sstevel@tonic-gate 	puts_tr("");
30107c478bd9Sstevel@tonic-gate 	puts_tr("add (interactive only) - Add a new security association (SA)");
30117c478bd9Sstevel@tonic-gate 	puts_tr("update (interactive only) - Update an existing SA");
30127c478bd9Sstevel@tonic-gate 	puts_tr("delete - Delete an SA");
30137c478bd9Sstevel@tonic-gate 	puts_tr("get - Display an SA");
30147c478bd9Sstevel@tonic-gate 	puts_tr("flush - Delete all SAs");
30157c478bd9Sstevel@tonic-gate 	puts_tr("dump - Display all SAs");
30167c478bd9Sstevel@tonic-gate 	puts_tr("save - Saves all SAs to a file");
30177c478bd9Sstevel@tonic-gate }
30187c478bd9Sstevel@tonic-gate 
30197c478bd9Sstevel@tonic-gate /*
30207c478bd9Sstevel@tonic-gate  * "Parse" a command line from argv.
30217c478bd9Sstevel@tonic-gate  */
30227c478bd9Sstevel@tonic-gate static void
3023*e3320f40Smarkfen parseit(int argc, char *argv[], char *ebuf)
30247c478bd9Sstevel@tonic-gate {
30257c478bd9Sstevel@tonic-gate 	int cmd, satype;
3026*e3320f40Smarkfen 	char *ep = NULL;
30277c478bd9Sstevel@tonic-gate 
30287c478bd9Sstevel@tonic-gate 	if (argc == 0)
30297c478bd9Sstevel@tonic-gate 		return;
30307c478bd9Sstevel@tonic-gate 	cmd = parsecmd(*argv++);
30317c478bd9Sstevel@tonic-gate 
30327c478bd9Sstevel@tonic-gate 	switch (cmd) {
30337c478bd9Sstevel@tonic-gate 	case CMD_HELP:
30347c478bd9Sstevel@tonic-gate 		dohelp(*argv);
30357c478bd9Sstevel@tonic-gate 		return;
30367c478bd9Sstevel@tonic-gate 	case CMD_MONITOR:
30377c478bd9Sstevel@tonic-gate 		domonitor(B_FALSE);
30387c478bd9Sstevel@tonic-gate 		break;
30397c478bd9Sstevel@tonic-gate 	case CMD_PMONITOR:
30407c478bd9Sstevel@tonic-gate 		domonitor(B_TRUE);
30417c478bd9Sstevel@tonic-gate 		break;
30427c478bd9Sstevel@tonic-gate 	case CMD_QUIT:
3043*e3320f40Smarkfen 		EXIT_OK(NULL);
30447c478bd9Sstevel@tonic-gate 	}
30457c478bd9Sstevel@tonic-gate 
3046*e3320f40Smarkfen 	satype = parsesatype(*argv, ebuf);
30477c478bd9Sstevel@tonic-gate 
30487c478bd9Sstevel@tonic-gate 	if (satype != SADB_SATYPE_UNSPEC) {
30497c478bd9Sstevel@tonic-gate 		argv++;
30507c478bd9Sstevel@tonic-gate 	} else {
30517c478bd9Sstevel@tonic-gate 		/*
30527c478bd9Sstevel@tonic-gate 		 * You must specify either "all" or a specific SA type
30537c478bd9Sstevel@tonic-gate 		 * for the "save" command.
30547c478bd9Sstevel@tonic-gate 		 */
30557c478bd9Sstevel@tonic-gate 		if (cmd == CMD_SAVE)
30567c478bd9Sstevel@tonic-gate 			if (*argv == NULL) {
3057*e3320f40Smarkfen 				FATAL(ep, ebuf, gettext(
3058*e3320f40Smarkfen 				    "Must specify a specific "
3059*e3320f40Smarkfen 				    "SA type for save.\n"));
30607c478bd9Sstevel@tonic-gate 			} else {
30617c478bd9Sstevel@tonic-gate 				argv++;
30627c478bd9Sstevel@tonic-gate 			}
30637c478bd9Sstevel@tonic-gate 	}
30647c478bd9Sstevel@tonic-gate 
30657c478bd9Sstevel@tonic-gate 	switch (cmd) {
30667c478bd9Sstevel@tonic-gate 	case CMD_FLUSH:
30677c478bd9Sstevel@tonic-gate 		doflush(satype);
30687c478bd9Sstevel@tonic-gate 		break;
30697c478bd9Sstevel@tonic-gate 	case CMD_ADD:
30707c478bd9Sstevel@tonic-gate 	case CMD_UPDATE:
30717c478bd9Sstevel@tonic-gate 		/*
30727c478bd9Sstevel@tonic-gate 		 * NOTE: Shouldn't allow ADDs or UPDATEs with keying material
30737c478bd9Sstevel@tonic-gate 		 * from the command line.
30747c478bd9Sstevel@tonic-gate 		 */
30757c478bd9Sstevel@tonic-gate 		if (!interactive) {
30767c478bd9Sstevel@tonic-gate 			errx(1, gettext(
3077*e3320f40Smarkfen 			    "can't do ADD or UPDATE from the command line.\n"));
30787c478bd9Sstevel@tonic-gate 		}
30797c478bd9Sstevel@tonic-gate 		if (satype == SADB_SATYPE_UNSPEC) {
3080*e3320f40Smarkfen 			FATAL(ep, ebuf, gettext(
3081*e3320f40Smarkfen 			    "Must specify a specific SA type."));
30827c478bd9Sstevel@tonic-gate 			/* NOTREACHED */
30837c478bd9Sstevel@tonic-gate 		}
30847c478bd9Sstevel@tonic-gate 		/* Parse for extensions, including keying material. */
3085*e3320f40Smarkfen 		doaddup(cmd, satype, argv, ebuf);
30867c478bd9Sstevel@tonic-gate 		break;
30877c478bd9Sstevel@tonic-gate 	case CMD_DELETE:
30887c478bd9Sstevel@tonic-gate 	case CMD_GET:
30897c478bd9Sstevel@tonic-gate 		if (satype == SADB_SATYPE_UNSPEC) {
3090*e3320f40Smarkfen 			FATAL(ep, ebuf, gettext(
3091*e3320f40Smarkfen 			    "Must specify a single SA type."));
30927c478bd9Sstevel@tonic-gate 			/* NOTREACHED */
30937c478bd9Sstevel@tonic-gate 		}
30947c478bd9Sstevel@tonic-gate 		/* Parse for bare minimum to locate an SA. */
3095*e3320f40Smarkfen 		dodelget(cmd, satype, argv, ebuf);
30967c478bd9Sstevel@tonic-gate 		break;
30977c478bd9Sstevel@tonic-gate 	case CMD_DUMP:
30987c478bd9Sstevel@tonic-gate 		dodump(satype, NULL);
30997c478bd9Sstevel@tonic-gate 		break;
31007c478bd9Sstevel@tonic-gate 	case CMD_SAVE:
31017c478bd9Sstevel@tonic-gate 		mask_signals(B_FALSE);	/* Mask signals */
31027c478bd9Sstevel@tonic-gate 		dodump(satype, opensavefile(argv[0]));
31037c478bd9Sstevel@tonic-gate 		mask_signals(B_TRUE);	/* Unmask signals */
31047c478bd9Sstevel@tonic-gate 		break;
31057c478bd9Sstevel@tonic-gate 	default:
3106*e3320f40Smarkfen 		warnx(gettext("Unknown command (%s).\n"),
31077c478bd9Sstevel@tonic-gate 		    *(argv - ((satype == SADB_SATYPE_UNSPEC) ? 1 : 2)));
31087c478bd9Sstevel@tonic-gate 		usage();
31097c478bd9Sstevel@tonic-gate 	}
31107c478bd9Sstevel@tonic-gate }
31117c478bd9Sstevel@tonic-gate 
31127c478bd9Sstevel@tonic-gate int
31137c478bd9Sstevel@tonic-gate main(int argc, char *argv[])
31147c478bd9Sstevel@tonic-gate {
31157c478bd9Sstevel@tonic-gate 	int ch;
31167c478bd9Sstevel@tonic-gate 	FILE *infile = stdin, *savefile;
31177c478bd9Sstevel@tonic-gate 	boolean_t dosave = B_FALSE, readfile = B_FALSE;
3118*e3320f40Smarkfen 	char *configfile = NULL;
31197c478bd9Sstevel@tonic-gate 
31207c478bd9Sstevel@tonic-gate 	(void) setlocale(LC_ALL, "");
31217c478bd9Sstevel@tonic-gate #if !defined(TEXT_DOMAIN)
31227c478bd9Sstevel@tonic-gate #define	TEXT_DOMAIN "SYS_TEST"
31237c478bd9Sstevel@tonic-gate #endif
31247c478bd9Sstevel@tonic-gate 	(void) textdomain(TEXT_DOMAIN);
31257c478bd9Sstevel@tonic-gate 
3126*e3320f40Smarkfen 	/*
3127*e3320f40Smarkfen 	 * Check to see if the command is being run from smf(5).
3128*e3320f40Smarkfen 	 */
3129*e3320f40Smarkfen 	my_fmri = getenv("SMF_FMRI");
3130*e3320f40Smarkfen 
31317c478bd9Sstevel@tonic-gate 	openlog("ipseckey", LOG_CONS, LOG_AUTH);
31327c478bd9Sstevel@tonic-gate 	if (getuid() != 0) {
3133*e3320f40Smarkfen 		errx(1, "Insufficient privileges to run ipseckey.");
31347c478bd9Sstevel@tonic-gate 	}
31357c478bd9Sstevel@tonic-gate 
31367c478bd9Sstevel@tonic-gate 	/* umask me to paranoid, I only want to create files read-only */
31377c478bd9Sstevel@tonic-gate 	(void) umask((mode_t)00377);
31387c478bd9Sstevel@tonic-gate 
3139*e3320f40Smarkfen 	while ((ch = getopt(argc, argv, "pnvf:s:c:")) != EOF)
31407c478bd9Sstevel@tonic-gate 		switch (ch) {
31417c478bd9Sstevel@tonic-gate 		case 'p':
31427c478bd9Sstevel@tonic-gate 			pflag = B_TRUE;
31437c478bd9Sstevel@tonic-gate 			break;
31447c478bd9Sstevel@tonic-gate 		case 'n':
31457c478bd9Sstevel@tonic-gate 			nflag = B_TRUE;
31467c478bd9Sstevel@tonic-gate 			break;
31477c478bd9Sstevel@tonic-gate 		case 'v':
31487c478bd9Sstevel@tonic-gate 			vflag = B_TRUE;
31497c478bd9Sstevel@tonic-gate 			break;
3150*e3320f40Smarkfen 		case 'c':
3151*e3320f40Smarkfen 			cflag = B_TRUE;
3152*e3320f40Smarkfen 			/* FALLTHRU */
31537c478bd9Sstevel@tonic-gate 		case 'f':
31547c478bd9Sstevel@tonic-gate 			if (dosave)
31557c478bd9Sstevel@tonic-gate 				usage();
31567c478bd9Sstevel@tonic-gate 			infile = fopen(optarg, "r");
3157*e3320f40Smarkfen 			if (infile == NULL) {
3158*e3320f40Smarkfen 				EXIT_BADCONFIG2("Unable to open configuration "
3159*e3320f40Smarkfen 				    "file: %s\n", optarg);
3160*e3320f40Smarkfen 			}
3161*e3320f40Smarkfen 			configfile = strdup(optarg);
31627c478bd9Sstevel@tonic-gate 			readfile = B_TRUE;
31637c478bd9Sstevel@tonic-gate 			break;
31647c478bd9Sstevel@tonic-gate 		case 's':
31657c478bd9Sstevel@tonic-gate 			if (readfile)
31667c478bd9Sstevel@tonic-gate 				usage();
31677c478bd9Sstevel@tonic-gate 			dosave = B_TRUE;
31687c478bd9Sstevel@tonic-gate 			savefile = opensavefile(optarg);
31697c478bd9Sstevel@tonic-gate 			break;
31707c478bd9Sstevel@tonic-gate 		default:
31717c478bd9Sstevel@tonic-gate 			usage();
31727c478bd9Sstevel@tonic-gate 		}
31737c478bd9Sstevel@tonic-gate 
31747c478bd9Sstevel@tonic-gate 	argc -= optind;
31757c478bd9Sstevel@tonic-gate 	argv += optind;
31767c478bd9Sstevel@tonic-gate 
31777c478bd9Sstevel@tonic-gate 	mypid = getpid();
31787c478bd9Sstevel@tonic-gate 
31797c478bd9Sstevel@tonic-gate 	keysock = socket(PF_KEY, SOCK_RAW, PF_KEY_V2);
31807c478bd9Sstevel@tonic-gate 
3181*e3320f40Smarkfen 	if (keysock == -1) {
3182*e3320f40Smarkfen 		if (errno == EPERM) {
3183*e3320f40Smarkfen 			EXIT_BADPERM("Insufficient privileges to open "
3184*e3320f40Smarkfen 			    "PF_KEY socket.\n");
3185*e3320f40Smarkfen 		} else {
3186*e3320f40Smarkfen 			/* some other reason */
3187*e3320f40Smarkfen 			EXIT_FATAL("Opening PF_KEY socket");
3188*e3320f40Smarkfen 		}
3189*e3320f40Smarkfen 	}
31907c478bd9Sstevel@tonic-gate 
31917c478bd9Sstevel@tonic-gate 	if (dosave) {
31927c478bd9Sstevel@tonic-gate 		mask_signals(B_FALSE);	/* Mask signals */
31937c478bd9Sstevel@tonic-gate 		dodump(SADB_SATYPE_UNSPEC, savefile);
31947c478bd9Sstevel@tonic-gate 		mask_signals(B_TRUE);	/* Unmask signals */
3195*e3320f40Smarkfen 		EXIT_OK(NULL);
31967c478bd9Sstevel@tonic-gate 	}
31977c478bd9Sstevel@tonic-gate 
3198*e3320f40Smarkfen 	/*
3199*e3320f40Smarkfen 	 * When run from smf(5) flush any existing SA's first
3200*e3320f40Smarkfen 	 * otherwise you will end up in maintenance mode.
3201*e3320f40Smarkfen 	 */
3202*e3320f40Smarkfen 	if ((my_fmri != NULL) && readfile) {
3203*e3320f40Smarkfen 		(void) fprintf(stdout, gettext(
3204*e3320f40Smarkfen 		    "Flushing existing SA's before adding new SA's\n"));
3205*e3320f40Smarkfen 		(void) fflush(stdout);
3206*e3320f40Smarkfen 		doflush(SADB_SATYPE_UNSPEC);
3207*e3320f40Smarkfen 	}
32087c478bd9Sstevel@tonic-gate 	if (infile != stdin || *argv == NULL) {
32097c478bd9Sstevel@tonic-gate 		/* Go into interactive mode here. */
3210*e3320f40Smarkfen 		do_interactive(infile, configfile, "ipseckey> ", my_fmri,
3211*e3320f40Smarkfen 		    parseit);
32127c478bd9Sstevel@tonic-gate 	}
3213*e3320f40Smarkfen 	parseit(argc, argv, NULL);
32147c478bd9Sstevel@tonic-gate 
32157c478bd9Sstevel@tonic-gate 	return (0);
32167c478bd9Sstevel@tonic-gate }
3217