17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 58810c16bSdanmcd * Common Development and Distribution License (the "License"). 68810c16bSdanmcd * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 217c478bd9Sstevel@tonic-gate /* 22e3320f40Smarkfen * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 237c478bd9Sstevel@tonic-gate * Use is subject to license terms. 247c478bd9Sstevel@tonic-gate */ 257c478bd9Sstevel@tonic-gate 267c478bd9Sstevel@tonic-gate /* 277c478bd9Sstevel@tonic-gate * NOTE:I'm trying to use "struct sadb_foo" instead of "sadb_foo_t" 287c478bd9Sstevel@tonic-gate * as a maximal PF_KEY portability test. 297c478bd9Sstevel@tonic-gate * 307c478bd9Sstevel@tonic-gate * Also, this is a deliberately single-threaded app, also for portability 317c478bd9Sstevel@tonic-gate * to systems without POSIX threads. 327c478bd9Sstevel@tonic-gate */ 337c478bd9Sstevel@tonic-gate 347c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 357c478bd9Sstevel@tonic-gate 367c478bd9Sstevel@tonic-gate 377c478bd9Sstevel@tonic-gate #include <sys/types.h> 387c478bd9Sstevel@tonic-gate #include <sys/stat.h> 397c478bd9Sstevel@tonic-gate #include <sys/socket.h> 407c478bd9Sstevel@tonic-gate #include <sys/sysmacros.h> 417c478bd9Sstevel@tonic-gate #include <sys/fcntl.h> 427c478bd9Sstevel@tonic-gate #include <net/pfkeyv2.h> 437c478bd9Sstevel@tonic-gate #include <arpa/inet.h> 447c478bd9Sstevel@tonic-gate #include <netinet/in.h> 457c478bd9Sstevel@tonic-gate #include <sys/uio.h> 467c478bd9Sstevel@tonic-gate 477c478bd9Sstevel@tonic-gate #include <syslog.h> 487c478bd9Sstevel@tonic-gate #include <signal.h> 497c478bd9Sstevel@tonic-gate #include <unistd.h> 507c478bd9Sstevel@tonic-gate #include <limits.h> 517c478bd9Sstevel@tonic-gate #include <stdlib.h> 527c478bd9Sstevel@tonic-gate #include <stdio.h> 53e3320f40Smarkfen #include <stdarg.h> 547c478bd9Sstevel@tonic-gate #include <netdb.h> 557c478bd9Sstevel@tonic-gate #include <pwd.h> 567c478bd9Sstevel@tonic-gate #include <errno.h> 577c478bd9Sstevel@tonic-gate #include <libintl.h> 587c478bd9Sstevel@tonic-gate #include <locale.h> 597c478bd9Sstevel@tonic-gate #include <fcntl.h> 607c478bd9Sstevel@tonic-gate #include <strings.h> 617c478bd9Sstevel@tonic-gate #include <ctype.h> 627c478bd9Sstevel@tonic-gate 637c478bd9Sstevel@tonic-gate #include <ipsec_util.h> 647c478bd9Sstevel@tonic-gate 657c478bd9Sstevel@tonic-gate static int keysock; 667c478bd9Sstevel@tonic-gate static uint32_t seq; 677c478bd9Sstevel@tonic-gate static pid_t mypid; 687c478bd9Sstevel@tonic-gate static boolean_t vflag = B_FALSE; /* Verbose? */ 69e3320f40Smarkfen static boolean_t cflag = B_FALSE; /* Check Only */ 70e3320f40Smarkfen 71e3320f40Smarkfen char *my_fmri = NULL; 72e3320f40Smarkfen FILE *debugfile = stdout; 737c478bd9Sstevel@tonic-gate 747c478bd9Sstevel@tonic-gate #define MAX_GET_SIZE 1024 75e3320f40Smarkfen /* 76*ec485834Spwernau * WARN() and ERROR() do the same thing really, with ERROR() the function 77e3320f40Smarkfen * that prints the error buffer needs to be called at the end of a code block 78e3320f40Smarkfen * This will print out all accumulated errors before bailing. The WARN() 79e3320f40Smarkfen * macro calls handle_errors() in such a way that it prints the message 80e3320f40Smarkfen * then continues. 81e3320f40Smarkfen * If the FATAL() macro used call handle_errors() immediately. 82e3320f40Smarkfen */ 83e3320f40Smarkfen #define ERROR(x, y, z) x = record_error(x, y, z) 84e3320f40Smarkfen #define ERROR1(w, x, y, z) w = record_error(w, x, y, z) 85e3320f40Smarkfen #define ERROR2(v, w, x, y, z) v = record_error(v, w, x, y, z) 86e3320f40Smarkfen #define WARN(x, y, z) ERROR(x, y, z);\ 87e3320f40Smarkfen handle_errors(x, NULL, B_FALSE, B_FALSE); x = NULL 88e3320f40Smarkfen #define WARN1(w, x, y, z) ERROR1(w, x, y, z);\ 89e3320f40Smarkfen handle_errors(w, NULL, B_FALSE, B_FALSE); w = NULL 90e3320f40Smarkfen #define WARN2(v, w, x, y, z) ERROR2(v, w, x, y, z);\ 91e3320f40Smarkfen handle_errors(v, NULL, B_FALSE, B_FALSE); v = NULL 92e3320f40Smarkfen #define FATAL(x, y, z) ERROR(x, y, z);\ 93e3320f40Smarkfen handle_errors(x, y, B_TRUE, B_TRUE) 94e3320f40Smarkfen #define FATAL1(w, x, y, z) ERROR1(w, x, y, z);\ 95e3320f40Smarkfen handle_errors(w, x, B_TRUE, B_TRUE) 96e3320f40Smarkfen 977c478bd9Sstevel@tonic-gate /* Defined as a uint64_t array for alignment purposes. */ 987c478bd9Sstevel@tonic-gate static uint64_t get_buffer[MAX_GET_SIZE]; 997c478bd9Sstevel@tonic-gate 1007c478bd9Sstevel@tonic-gate /* 101e3320f40Smarkfen * Create/Grow a buffer large enough to hold error messages. If *ebuf 102e3320f40Smarkfen * is not NULL then it will contain a copy of the command line that 103e3320f40Smarkfen * triggered the error/warning, copy this into a new buffer or 104e3320f40Smarkfen * append new messages to the existing buffer. 105e3320f40Smarkfen */ 106e3320f40Smarkfen /*PRINTFLIKE1*/ 107e3320f40Smarkfen char * 108e3320f40Smarkfen record_error(char *ep, char *ebuf, char *fmt, ...) 109e3320f40Smarkfen { 110e3320f40Smarkfen char *err_ptr; 111e3320f40Smarkfen char tmp_buff[1024]; 112e3320f40Smarkfen va_list ap; 113e3320f40Smarkfen int length = 0; 114e3320f40Smarkfen err_ptr = ep; 115e3320f40Smarkfen 116e3320f40Smarkfen va_start(ap, fmt); 117e3320f40Smarkfen (void) vsnprintf(tmp_buff, sizeof (tmp_buff), fmt, ap); 118e3320f40Smarkfen va_end(ap); 119e3320f40Smarkfen 120e3320f40Smarkfen if (ep == NULL) { 121e3320f40Smarkfen /* 122e3320f40Smarkfen * This is the first error to record, get a 123e3320f40Smarkfen * new buffer, copy in the command line that 124e3320f40Smarkfen * triggered this error/warning. 125e3320f40Smarkfen */ 126e3320f40Smarkfen if (ebuf != NULL) { 127e3320f40Smarkfen length = strlen(ebuf); 128e3320f40Smarkfen err_ptr = calloc(length, sizeof (char)); 129e3320f40Smarkfen if (err_ptr == NULL) 130e3320f40Smarkfen Bail("calloc() failed"); 131e3320f40Smarkfen (void) strlcpy(err_ptr, ebuf, length); 132e3320f40Smarkfen } 133e3320f40Smarkfen } else { 134e3320f40Smarkfen length = strlen(ep); 135e3320f40Smarkfen } 136e3320f40Smarkfen length += strlen(tmp_buff); 137e3320f40Smarkfen /* There is a new line character */ 138e3320f40Smarkfen length++; 139e3320f40Smarkfen err_ptr = realloc(err_ptr, length); 140e3320f40Smarkfen if (err_ptr == NULL) 141e3320f40Smarkfen Bail("realloc() failure"); 142e3320f40Smarkfen (void) strlcat(err_ptr, tmp_buff, length); 143e3320f40Smarkfen return (err_ptr); 144e3320f40Smarkfen } 145e3320f40Smarkfen 146e3320f40Smarkfen /* 147e3320f40Smarkfen * Print usage message. 1487c478bd9Sstevel@tonic-gate */ 1497c478bd9Sstevel@tonic-gate static void 1507c478bd9Sstevel@tonic-gate usage(void) 1517c478bd9Sstevel@tonic-gate { 1527c478bd9Sstevel@tonic-gate if (!interactive) { 1537c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("Usage:\t" 1547c478bd9Sstevel@tonic-gate "ipseckey [ -nvp ] | cmd [sa_type] [extfield value]*\n")); 1557c478bd9Sstevel@tonic-gate (void) fprintf(stderr, 1567c478bd9Sstevel@tonic-gate gettext("\tipseckey [ -nvp ] -f infile\n")); 1577c478bd9Sstevel@tonic-gate (void) fprintf(stderr, 1587c478bd9Sstevel@tonic-gate gettext("\tipseckey [ -nvp ] -s outfile\n")); 159e3320f40Smarkfen } 160e3320f40Smarkfen EXIT_FATAL(NULL); 161e3320f40Smarkfen } 162e3320f40Smarkfen 163e3320f40Smarkfen 164e3320f40Smarkfen /* 165e3320f40Smarkfen * Print out any errors, tidy up as required. 166e3320f40Smarkfen * error pointer ep will be free()'d 167e3320f40Smarkfen */ 168e3320f40Smarkfen void 169e3320f40Smarkfen handle_errors(char *ep, char *ebuf, boolean_t fatal, boolean_t done) 170e3320f40Smarkfen { 171e3320f40Smarkfen if (ep != NULL) { 172e3320f40Smarkfen if (my_fmri == NULL) { 173e3320f40Smarkfen /* 174e3320f40Smarkfen * For now suppress the errors when run from smf(5) 175e3320f40Smarkfen * because potentially sensitive information could 176e3320f40Smarkfen * end up in a publicly readable logfile. 177e3320f40Smarkfen */ 178e3320f40Smarkfen (void) fprintf(stdout, "%s\n", ep); 179e3320f40Smarkfen (void) fflush(stdout); 180e3320f40Smarkfen } 181e3320f40Smarkfen free(ep); 182e3320f40Smarkfen if (fatal) { 183e3320f40Smarkfen if (ebuf != NULL) { 184e3320f40Smarkfen free(ebuf); 185e3320f40Smarkfen } 186e3320f40Smarkfen /* reset command buffer */ 187e3320f40Smarkfen if (interactive) 188e3320f40Smarkfen longjmp(env, 1); 189e3320f40Smarkfen } else { 190e3320f40Smarkfen return; 191e3320f40Smarkfen } 1927c478bd9Sstevel@tonic-gate } else { 193e3320f40Smarkfen /* 194e3320f40Smarkfen * No errors, if this is the last time that this function 195e3320f40Smarkfen * is called, free(ebuf) and reset command buffer. 196e3320f40Smarkfen */ 197e3320f40Smarkfen if (done) { 198e3320f40Smarkfen if (ebuf != NULL) { 199e3320f40Smarkfen free(ebuf); 200e3320f40Smarkfen } 201e3320f40Smarkfen /* reset command buffer */ 202e3320f40Smarkfen if (interactive) 203e3320f40Smarkfen longjmp(env, 1); 204e3320f40Smarkfen } 205e3320f40Smarkfen return; 2067c478bd9Sstevel@tonic-gate } 2077c478bd9Sstevel@tonic-gate } 2087c478bd9Sstevel@tonic-gate 2097c478bd9Sstevel@tonic-gate /* 2107c478bd9Sstevel@tonic-gate * Initialize a PF_KEY base message. 2117c478bd9Sstevel@tonic-gate */ 2127c478bd9Sstevel@tonic-gate static void 2137c478bd9Sstevel@tonic-gate msg_init(struct sadb_msg *msg, uint8_t type, uint8_t satype) 2147c478bd9Sstevel@tonic-gate { 2157c478bd9Sstevel@tonic-gate msg->sadb_msg_version = PF_KEY_V2; 2167c478bd9Sstevel@tonic-gate msg->sadb_msg_type = type; 2177c478bd9Sstevel@tonic-gate msg->sadb_msg_errno = 0; 2187c478bd9Sstevel@tonic-gate msg->sadb_msg_satype = satype; 2197c478bd9Sstevel@tonic-gate /* For starters... */ 2207c478bd9Sstevel@tonic-gate msg->sadb_msg_len = SADB_8TO64(sizeof (*msg)); 2217c478bd9Sstevel@tonic-gate msg->sadb_msg_reserved = 0; 2227c478bd9Sstevel@tonic-gate msg->sadb_msg_seq = ++seq; 2237c478bd9Sstevel@tonic-gate msg->sadb_msg_pid = mypid; 2247c478bd9Sstevel@tonic-gate } 2257c478bd9Sstevel@tonic-gate 2267c478bd9Sstevel@tonic-gate /* 2277c478bd9Sstevel@tonic-gate * parseXXX and rparseXXX commands parse input and convert them to PF_KEY 2287c478bd9Sstevel@tonic-gate * field values, or do the reverse for the purposes of saving the SA tables. 2297c478bd9Sstevel@tonic-gate * (See the save_XXX functions.) 2307c478bd9Sstevel@tonic-gate */ 2317c478bd9Sstevel@tonic-gate 2327c478bd9Sstevel@tonic-gate #define CMD_NONE 0 2337c478bd9Sstevel@tonic-gate #define CMD_UPDATE 2 2347c478bd9Sstevel@tonic-gate #define CMD_ADD 3 2357c478bd9Sstevel@tonic-gate #define CMD_DELETE 4 2367c478bd9Sstevel@tonic-gate #define CMD_GET 5 2377c478bd9Sstevel@tonic-gate #define CMD_FLUSH 9 2387c478bd9Sstevel@tonic-gate #define CMD_DUMP 10 2397c478bd9Sstevel@tonic-gate #define CMD_MONITOR 11 2407c478bd9Sstevel@tonic-gate #define CMD_PMONITOR 12 2417c478bd9Sstevel@tonic-gate #define CMD_QUIT 13 2427c478bd9Sstevel@tonic-gate #define CMD_SAVE 14 2437c478bd9Sstevel@tonic-gate #define CMD_HELP 15 2447c478bd9Sstevel@tonic-gate 2457c478bd9Sstevel@tonic-gate /* 2467c478bd9Sstevel@tonic-gate * Parse the command. 2477c478bd9Sstevel@tonic-gate */ 2487c478bd9Sstevel@tonic-gate static int 2497c478bd9Sstevel@tonic-gate parsecmd(char *cmdstr) 2507c478bd9Sstevel@tonic-gate { 2517c478bd9Sstevel@tonic-gate static struct cmdtable { 2527c478bd9Sstevel@tonic-gate char *cmd; 2537c478bd9Sstevel@tonic-gate int token; 2547c478bd9Sstevel@tonic-gate } table[] = { 2557c478bd9Sstevel@tonic-gate /* 2567c478bd9Sstevel@tonic-gate * Q: Do we want to do GETSPI? 2577c478bd9Sstevel@tonic-gate * A: No, it's for automated key mgmt. only. Either that, 2587c478bd9Sstevel@tonic-gate * or it isn't relevant until we support non IPsec SA types. 2597c478bd9Sstevel@tonic-gate */ 2607c478bd9Sstevel@tonic-gate {"update", CMD_UPDATE}, 2617c478bd9Sstevel@tonic-gate {"add", CMD_ADD}, 2627c478bd9Sstevel@tonic-gate {"delete", CMD_DELETE}, 2637c478bd9Sstevel@tonic-gate {"get", CMD_GET}, 2647c478bd9Sstevel@tonic-gate /* 2657c478bd9Sstevel@tonic-gate * Q: And ACQUIRE and REGISTER and EXPIRE? 2667c478bd9Sstevel@tonic-gate * A: not until we support non IPsec SA types. 2677c478bd9Sstevel@tonic-gate */ 2687c478bd9Sstevel@tonic-gate {"flush", CMD_FLUSH}, 2697c478bd9Sstevel@tonic-gate {"dump", CMD_DUMP}, 2707c478bd9Sstevel@tonic-gate {"monitor", CMD_MONITOR}, 2717c478bd9Sstevel@tonic-gate {"passive_monitor", CMD_PMONITOR}, 2727c478bd9Sstevel@tonic-gate {"pmonitor", CMD_PMONITOR}, 2737c478bd9Sstevel@tonic-gate {"quit", CMD_QUIT}, 2747c478bd9Sstevel@tonic-gate {"exit", CMD_QUIT}, 2757c478bd9Sstevel@tonic-gate {"save", CMD_SAVE}, 2767c478bd9Sstevel@tonic-gate {"help", CMD_HELP}, 2777c478bd9Sstevel@tonic-gate {"?", CMD_HELP}, 2787c478bd9Sstevel@tonic-gate {NULL, CMD_NONE} 2797c478bd9Sstevel@tonic-gate }; 2807c478bd9Sstevel@tonic-gate struct cmdtable *ct = table; 2817c478bd9Sstevel@tonic-gate 2827c478bd9Sstevel@tonic-gate while (ct->cmd != NULL && strcmp(ct->cmd, cmdstr) != 0) 2837c478bd9Sstevel@tonic-gate ct++; 2847c478bd9Sstevel@tonic-gate return (ct->token); 2857c478bd9Sstevel@tonic-gate } 2867c478bd9Sstevel@tonic-gate 2877c478bd9Sstevel@tonic-gate /* 2887c478bd9Sstevel@tonic-gate * Convert a number from a command line. I picked "u_longlong_t" for the 2897c478bd9Sstevel@tonic-gate * number because we need the largest number available. Also, the strto<num> 2907c478bd9Sstevel@tonic-gate * calls don't deal in units of uintNN_t. 2917c478bd9Sstevel@tonic-gate */ 2927c478bd9Sstevel@tonic-gate static u_longlong_t 293e3320f40Smarkfen parsenum(char *num, boolean_t bail, char *ebuf) 2947c478bd9Sstevel@tonic-gate { 295e3320f40Smarkfen u_longlong_t rc = 0; 2967c478bd9Sstevel@tonic-gate char *end = NULL; 297e3320f40Smarkfen char *ep = NULL; 2987c478bd9Sstevel@tonic-gate 2997c478bd9Sstevel@tonic-gate if (num == NULL) { 300e3320f40Smarkfen FATAL(ep, ebuf, gettext("Unexpected end of command line," 301e3320f40Smarkfen " was expecting a number.\n")); 302e3320f40Smarkfen /* NOTREACHED */ 3037c478bd9Sstevel@tonic-gate } 3047c478bd9Sstevel@tonic-gate 3057c478bd9Sstevel@tonic-gate errno = 0; 3067c478bd9Sstevel@tonic-gate rc = strtoull(num, &end, 0); 3077c478bd9Sstevel@tonic-gate if (errno != 0 || end == num || *end != '\0') { 3087c478bd9Sstevel@tonic-gate if (bail) { 309e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 310e3320f40Smarkfen "Expecting a number, not \"%s\"!\n"), num); 3117c478bd9Sstevel@tonic-gate } else { 3127c478bd9Sstevel@tonic-gate /* 3137c478bd9Sstevel@tonic-gate * -1, while not optimal, is sufficiently out of range 3147c478bd9Sstevel@tonic-gate * for most of this function's applications when 3157c478bd9Sstevel@tonic-gate * we don't just bail. 3167c478bd9Sstevel@tonic-gate */ 3177c478bd9Sstevel@tonic-gate return ((u_longlong_t)-1); 3187c478bd9Sstevel@tonic-gate } 3197c478bd9Sstevel@tonic-gate } 320e3320f40Smarkfen handle_errors(ep, NULL, B_FALSE, B_FALSE); 3217c478bd9Sstevel@tonic-gate return (rc); 3227c478bd9Sstevel@tonic-gate } 3237c478bd9Sstevel@tonic-gate 3247c478bd9Sstevel@tonic-gate /* 3257c478bd9Sstevel@tonic-gate * Parse and reverse parse a specific SA type (AH, ESP, etc.). 3267c478bd9Sstevel@tonic-gate */ 3277c478bd9Sstevel@tonic-gate static struct typetable { 3287c478bd9Sstevel@tonic-gate char *type; 3297c478bd9Sstevel@tonic-gate int token; 3307c478bd9Sstevel@tonic-gate } type_table[] = { 3317c478bd9Sstevel@tonic-gate {"all", SADB_SATYPE_UNSPEC}, 3327c478bd9Sstevel@tonic-gate {"ah", SADB_SATYPE_AH}, 3337c478bd9Sstevel@tonic-gate {"esp", SADB_SATYPE_ESP}, 3347c478bd9Sstevel@tonic-gate /* PF_KEY NOTE: More to come if net/pfkeyv2.h gets updated. */ 3357c478bd9Sstevel@tonic-gate {NULL, 0} /* Token value is irrelevant for this entry. */ 3367c478bd9Sstevel@tonic-gate }; 3377c478bd9Sstevel@tonic-gate 3387c478bd9Sstevel@tonic-gate 3397c478bd9Sstevel@tonic-gate static int 340e3320f40Smarkfen parsesatype(char *type, char *ebuf) 3417c478bd9Sstevel@tonic-gate { 3427c478bd9Sstevel@tonic-gate struct typetable *tt = type_table; 343e3320f40Smarkfen char *ep = NULL; 3447c478bd9Sstevel@tonic-gate 3457c478bd9Sstevel@tonic-gate if (type == NULL) 3467c478bd9Sstevel@tonic-gate return (SADB_SATYPE_UNSPEC); 3477c478bd9Sstevel@tonic-gate 3487c478bd9Sstevel@tonic-gate while (tt->type != NULL && strcasecmp(tt->type, type) != 0) 3497c478bd9Sstevel@tonic-gate tt++; 3507c478bd9Sstevel@tonic-gate 3517c478bd9Sstevel@tonic-gate /* 3527c478bd9Sstevel@tonic-gate * New SA types (including ones keysock maintains for user-land 3537c478bd9Sstevel@tonic-gate * protocols) may be added, so parse a numeric value if possible. 3547c478bd9Sstevel@tonic-gate */ 3557c478bd9Sstevel@tonic-gate if (tt->type == NULL) { 356e3320f40Smarkfen tt->token = (int)parsenum(type, B_FALSE, ebuf); 3577c478bd9Sstevel@tonic-gate if (tt->token == -1) { 358e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 359e3320f40Smarkfen "Unknown SA type (%s).\n"), type); 360e3320f40Smarkfen tt->token = SADB_SATYPE_UNSPEC; 3617c478bd9Sstevel@tonic-gate } 3627c478bd9Sstevel@tonic-gate } 363e3320f40Smarkfen handle_errors(ep, NULL, B_FALSE, B_FALSE); 3647c478bd9Sstevel@tonic-gate return (tt->token); 3657c478bd9Sstevel@tonic-gate } 3667c478bd9Sstevel@tonic-gate 3677c478bd9Sstevel@tonic-gate #define NEXTEOF 0 3687c478bd9Sstevel@tonic-gate #define NEXTNONE 1 3697c478bd9Sstevel@tonic-gate #define NEXTNUM 2 3707c478bd9Sstevel@tonic-gate #define NEXTSTR 3 3717c478bd9Sstevel@tonic-gate #define NEXTNUMSTR 4 3727c478bd9Sstevel@tonic-gate #define NEXTADDR 5 3737c478bd9Sstevel@tonic-gate #define NEXTHEX 6 3747c478bd9Sstevel@tonic-gate #define NEXTIDENT 7 3757c478bd9Sstevel@tonic-gate #define NEXTADDR4 8 3767c478bd9Sstevel@tonic-gate #define NEXTADDR6 9 3777c478bd9Sstevel@tonic-gate 3787c478bd9Sstevel@tonic-gate #define TOK_EOF 0 3797c478bd9Sstevel@tonic-gate #define TOK_UNKNOWN 1 3807c478bd9Sstevel@tonic-gate #define TOK_SPI 2 3817c478bd9Sstevel@tonic-gate #define TOK_REPLAY 3 3827c478bd9Sstevel@tonic-gate #define TOK_STATE 4 3837c478bd9Sstevel@tonic-gate #define TOK_AUTHALG 5 3847c478bd9Sstevel@tonic-gate #define TOK_ENCRALG 6 3857c478bd9Sstevel@tonic-gate #define TOK_FLAGS 7 3867c478bd9Sstevel@tonic-gate #define TOK_SOFT_ALLOC 8 3877c478bd9Sstevel@tonic-gate #define TOK_SOFT_BYTES 9 3887c478bd9Sstevel@tonic-gate #define TOK_SOFT_ADDTIME 10 3897c478bd9Sstevel@tonic-gate #define TOK_SOFT_USETIME 11 3907c478bd9Sstevel@tonic-gate #define TOK_HARD_ALLOC 12 3917c478bd9Sstevel@tonic-gate #define TOK_HARD_BYTES 13 3927c478bd9Sstevel@tonic-gate #define TOK_HARD_ADDTIME 14 3937c478bd9Sstevel@tonic-gate #define TOK_HARD_USETIME 15 3947c478bd9Sstevel@tonic-gate #define TOK_CURRENT_ALLOC 16 3957c478bd9Sstevel@tonic-gate #define TOK_CURRENT_BYTES 17 3967c478bd9Sstevel@tonic-gate #define TOK_CURRENT_ADDTIME 18 3977c478bd9Sstevel@tonic-gate #define TOK_CURRENT_USETIME 19 3987c478bd9Sstevel@tonic-gate #define TOK_SRCADDR 20 3997c478bd9Sstevel@tonic-gate #define TOK_DSTADDR 21 4007c478bd9Sstevel@tonic-gate #define TOK_PROXYADDR 22 4017c478bd9Sstevel@tonic-gate #define TOK_AUTHKEY 23 4027c478bd9Sstevel@tonic-gate #define TOK_ENCRKEY 24 4037c478bd9Sstevel@tonic-gate #define TOK_SRCIDTYPE 25 4047c478bd9Sstevel@tonic-gate #define TOK_DSTIDTYPE 26 4057c478bd9Sstevel@tonic-gate #define TOK_DPD 27 4067c478bd9Sstevel@tonic-gate #define TOK_SENS_LEVEL 28 4077c478bd9Sstevel@tonic-gate #define TOK_SENS_MAP 29 4087c478bd9Sstevel@tonic-gate #define TOK_INTEG_LEVEL 30 4097c478bd9Sstevel@tonic-gate #define TOK_INTEG_MAP 31 4107c478bd9Sstevel@tonic-gate #define TOK_SRCADDR6 32 4117c478bd9Sstevel@tonic-gate #define TOK_DSTADDR6 33 4127c478bd9Sstevel@tonic-gate #define TOK_PROXYADDR6 34 4137c478bd9Sstevel@tonic-gate #define TOK_SRCPORT 35 4147c478bd9Sstevel@tonic-gate #define TOK_DSTPORT 36 4157c478bd9Sstevel@tonic-gate #define TOK_PROTO 37 4167c478bd9Sstevel@tonic-gate #define TOK_ENCAP 38 4177c478bd9Sstevel@tonic-gate #define TOK_NATLOC 39 4187c478bd9Sstevel@tonic-gate #define TOK_NATREM 40 4197c478bd9Sstevel@tonic-gate #define TOK_NATLPORT 41 4207c478bd9Sstevel@tonic-gate #define TOK_NATRPORT 42 4218810c16bSdanmcd #define TOK_IPROTO 43 4228810c16bSdanmcd #define TOK_IDSTADDR 44 4238810c16bSdanmcd #define TOK_IDSTADDR6 45 4248810c16bSdanmcd #define TOK_ISRCPORT 46 4258810c16bSdanmcd #define TOK_IDSTPORT 47 4267c478bd9Sstevel@tonic-gate 4277c478bd9Sstevel@tonic-gate static struct toktable { 4287c478bd9Sstevel@tonic-gate char *string; 4297c478bd9Sstevel@tonic-gate int token; 4307c478bd9Sstevel@tonic-gate int next; 4317c478bd9Sstevel@tonic-gate } tokens[] = { 4327c478bd9Sstevel@tonic-gate /* "String", token value, next arg is */ 4337c478bd9Sstevel@tonic-gate {"spi", TOK_SPI, NEXTNUM}, 4347c478bd9Sstevel@tonic-gate {"replay", TOK_REPLAY, NEXTNUM}, 4357c478bd9Sstevel@tonic-gate {"state", TOK_STATE, NEXTNUMSTR}, 4367c478bd9Sstevel@tonic-gate {"auth_alg", TOK_AUTHALG, NEXTNUMSTR}, 4377c478bd9Sstevel@tonic-gate {"authalg", TOK_AUTHALG, NEXTNUMSTR}, 4387c478bd9Sstevel@tonic-gate {"encr_alg", TOK_ENCRALG, NEXTNUMSTR}, 4397c478bd9Sstevel@tonic-gate {"encralg", TOK_ENCRALG, NEXTNUMSTR}, 4407c478bd9Sstevel@tonic-gate {"flags", TOK_FLAGS, NEXTNUM}, 4417c478bd9Sstevel@tonic-gate {"soft_alloc", TOK_SOFT_ALLOC, NEXTNUM}, 4427c478bd9Sstevel@tonic-gate {"soft_bytes", TOK_SOFT_BYTES, NEXTNUM}, 4437c478bd9Sstevel@tonic-gate {"soft_addtime", TOK_SOFT_ADDTIME, NEXTNUM}, 4447c478bd9Sstevel@tonic-gate {"soft_usetime", TOK_SOFT_USETIME, NEXTNUM}, 4457c478bd9Sstevel@tonic-gate {"hard_alloc", TOK_HARD_ALLOC, NEXTNUM}, 4467c478bd9Sstevel@tonic-gate {"hard_bytes", TOK_HARD_BYTES, NEXTNUM}, 4477c478bd9Sstevel@tonic-gate {"hard_addtime", TOK_HARD_ADDTIME, NEXTNUM}, 4487c478bd9Sstevel@tonic-gate {"hard_usetime", TOK_HARD_USETIME, NEXTNUM}, 4497c478bd9Sstevel@tonic-gate {"current_alloc", TOK_CURRENT_ALLOC, NEXTNUM}, 4507c478bd9Sstevel@tonic-gate {"current_bytes", TOK_CURRENT_BYTES, NEXTNUM}, 4517c478bd9Sstevel@tonic-gate {"current_addtime", TOK_CURRENT_ADDTIME, NEXTNUM}, 4527c478bd9Sstevel@tonic-gate {"current_usetime", TOK_CURRENT_USETIME, NEXTNUM}, 4537c478bd9Sstevel@tonic-gate 4547c478bd9Sstevel@tonic-gate {"saddr", TOK_SRCADDR, NEXTADDR}, 4557c478bd9Sstevel@tonic-gate {"srcaddr", TOK_SRCADDR, NEXTADDR}, 4567c478bd9Sstevel@tonic-gate {"src", TOK_SRCADDR, NEXTADDR}, 4577c478bd9Sstevel@tonic-gate {"daddr", TOK_DSTADDR, NEXTADDR}, 4587c478bd9Sstevel@tonic-gate {"dstaddr", TOK_DSTADDR, NEXTADDR}, 4597c478bd9Sstevel@tonic-gate {"dst", TOK_DSTADDR, NEXTADDR}, 4607c478bd9Sstevel@tonic-gate {"proxyaddr", TOK_PROXYADDR, NEXTADDR}, 4617c478bd9Sstevel@tonic-gate {"proxy", TOK_PROXYADDR, NEXTADDR}, 4628810c16bSdanmcd {"innersrc", TOK_PROXYADDR, NEXTADDR}, 4638810c16bSdanmcd {"isrc", TOK_PROXYADDR, NEXTADDR}, 4648810c16bSdanmcd {"innerdst", TOK_IDSTADDR, NEXTADDR}, 4658810c16bSdanmcd {"idst", TOK_IDSTADDR, NEXTADDR}, 4667c478bd9Sstevel@tonic-gate 4677c478bd9Sstevel@tonic-gate {"sport", TOK_SRCPORT, NEXTNUM}, 4687c478bd9Sstevel@tonic-gate {"dport", TOK_DSTPORT, NEXTNUM}, 4698810c16bSdanmcd {"innersport", TOK_ISRCPORT, NEXTNUM}, 4708810c16bSdanmcd {"isport", TOK_ISRCPORT, NEXTNUM}, 4718810c16bSdanmcd {"innerdport", TOK_IDSTPORT, NEXTNUM}, 4728810c16bSdanmcd {"idport", TOK_IDSTPORT, NEXTNUM}, 4737c478bd9Sstevel@tonic-gate {"proto", TOK_PROTO, NEXTNUM}, 474eeda67c6Sjojemann {"ulp", TOK_PROTO, NEXTNUM}, 4758810c16bSdanmcd {"iproto", TOK_IPROTO, NEXTNUM}, 4768810c16bSdanmcd {"iulp", TOK_IPROTO, NEXTNUM}, 4777c478bd9Sstevel@tonic-gate 4787c478bd9Sstevel@tonic-gate {"saddr6", TOK_SRCADDR6, NEXTADDR}, 4797c478bd9Sstevel@tonic-gate {"srcaddr6", TOK_SRCADDR6, NEXTADDR}, 4807c478bd9Sstevel@tonic-gate {"src6", TOK_SRCADDR6, NEXTADDR}, 4817c478bd9Sstevel@tonic-gate {"daddr6", TOK_DSTADDR6, NEXTADDR}, 4827c478bd9Sstevel@tonic-gate {"dstaddr6", TOK_DSTADDR6, NEXTADDR}, 4837c478bd9Sstevel@tonic-gate {"dst6", TOK_DSTADDR6, NEXTADDR}, 4847c478bd9Sstevel@tonic-gate {"proxyaddr6", TOK_PROXYADDR6, NEXTADDR}, 4857c478bd9Sstevel@tonic-gate {"proxy6", TOK_PROXYADDR6, NEXTADDR}, 4868810c16bSdanmcd {"innersrc6", TOK_PROXYADDR6, NEXTADDR}, 4878810c16bSdanmcd {"isrc6", TOK_PROXYADDR6, NEXTADDR}, 4888810c16bSdanmcd {"innerdst6", TOK_IDSTADDR6, NEXTADDR}, 4898810c16bSdanmcd {"idst6", TOK_IDSTADDR6, NEXTADDR}, 4907c478bd9Sstevel@tonic-gate 4917c478bd9Sstevel@tonic-gate {"authkey", TOK_AUTHKEY, NEXTHEX}, 4927c478bd9Sstevel@tonic-gate {"encrkey", TOK_ENCRKEY, NEXTHEX}, 4937c478bd9Sstevel@tonic-gate {"srcidtype", TOK_SRCIDTYPE, NEXTIDENT}, 4947c478bd9Sstevel@tonic-gate {"dstidtype", TOK_DSTIDTYPE, NEXTIDENT}, 4957c478bd9Sstevel@tonic-gate {"dpd", TOK_DPD, NEXTNUM}, 4967c478bd9Sstevel@tonic-gate {"sens_level", TOK_SENS_LEVEL, NEXTNUM}, 4977c478bd9Sstevel@tonic-gate {"sens_map", TOK_SENS_MAP, NEXTHEX}, 4987c478bd9Sstevel@tonic-gate {"integ_level", TOK_INTEG_LEVEL, NEXTNUM}, 4997c478bd9Sstevel@tonic-gate {"integ_map", TOK_INTEG_MAP, NEXTHEX}, 5007c478bd9Sstevel@tonic-gate {"nat_loc", TOK_NATLOC, NEXTADDR}, 5017c478bd9Sstevel@tonic-gate {"nat_rem", TOK_NATREM, NEXTADDR}, 5027c478bd9Sstevel@tonic-gate {"nat_lport", TOK_NATLPORT, NEXTNUM}, 5037c478bd9Sstevel@tonic-gate {"nat_rport", TOK_NATRPORT, NEXTNUM}, 5047c478bd9Sstevel@tonic-gate {"encap", TOK_ENCAP, NEXTNUMSTR}, 5057c478bd9Sstevel@tonic-gate {NULL, TOK_UNKNOWN, NEXTEOF} 5067c478bd9Sstevel@tonic-gate }; 5077c478bd9Sstevel@tonic-gate 5087c478bd9Sstevel@tonic-gate /* 5097c478bd9Sstevel@tonic-gate * Q: Do I need stuff for proposals, combinations, supported algorithms, 5107c478bd9Sstevel@tonic-gate * or SPI ranges? 5117c478bd9Sstevel@tonic-gate * 5127c478bd9Sstevel@tonic-gate * A: Probably not, but you never know. 5137c478bd9Sstevel@tonic-gate * 5147c478bd9Sstevel@tonic-gate * Parse out extension header type values. 5157c478bd9Sstevel@tonic-gate */ 5167c478bd9Sstevel@tonic-gate static int 5177c478bd9Sstevel@tonic-gate parseextval(char *value, int *next) 5187c478bd9Sstevel@tonic-gate { 5197c478bd9Sstevel@tonic-gate struct toktable *tp; 5207c478bd9Sstevel@tonic-gate 5217c478bd9Sstevel@tonic-gate if (value == NULL) 5227c478bd9Sstevel@tonic-gate return (TOK_EOF); 5237c478bd9Sstevel@tonic-gate 5247c478bd9Sstevel@tonic-gate for (tp = tokens; tp->string != NULL; tp++) 5257c478bd9Sstevel@tonic-gate if (strcmp(value, tp->string) == 0) 5267c478bd9Sstevel@tonic-gate break; 5277c478bd9Sstevel@tonic-gate 5287c478bd9Sstevel@tonic-gate /* 5297c478bd9Sstevel@tonic-gate * Since the OS controls what extensions are available, we don't have 5307c478bd9Sstevel@tonic-gate * to parse numeric values here. 5317c478bd9Sstevel@tonic-gate */ 5327c478bd9Sstevel@tonic-gate 5337c478bd9Sstevel@tonic-gate *next = tp->next; 5347c478bd9Sstevel@tonic-gate return (tp->token); 5357c478bd9Sstevel@tonic-gate } 5367c478bd9Sstevel@tonic-gate 5377c478bd9Sstevel@tonic-gate /* 5387c478bd9Sstevel@tonic-gate * Parse possible state values. 5397c478bd9Sstevel@tonic-gate */ 5407c478bd9Sstevel@tonic-gate static uint8_t 541e3320f40Smarkfen parsestate(char *state, char *ebuf) 5427c478bd9Sstevel@tonic-gate { 5437c478bd9Sstevel@tonic-gate struct states { 5447c478bd9Sstevel@tonic-gate char *state; 5457c478bd9Sstevel@tonic-gate uint8_t retval; 5467c478bd9Sstevel@tonic-gate } states[] = { 5477c478bd9Sstevel@tonic-gate {"larval", SADB_SASTATE_LARVAL}, 5487c478bd9Sstevel@tonic-gate {"mature", SADB_SASTATE_MATURE}, 5497c478bd9Sstevel@tonic-gate {"dying", SADB_SASTATE_DYING}, 5507c478bd9Sstevel@tonic-gate {"dead", SADB_SASTATE_DEAD}, 5517c478bd9Sstevel@tonic-gate {NULL, 0} 5527c478bd9Sstevel@tonic-gate }; 5537c478bd9Sstevel@tonic-gate struct states *sp; 554e3320f40Smarkfen char *ep = NULL; 5557c478bd9Sstevel@tonic-gate 5567c478bd9Sstevel@tonic-gate if (state == NULL) { 557e3320f40Smarkfen FATAL(ep, ebuf, "Unexpected end of command line " 558e3320f40Smarkfen "was expecting a state.\n"); 5597c478bd9Sstevel@tonic-gate } 5607c478bd9Sstevel@tonic-gate 5617c478bd9Sstevel@tonic-gate for (sp = states; sp->state != NULL; sp++) { 5627c478bd9Sstevel@tonic-gate if (strcmp(sp->state, state) == 0) 5637c478bd9Sstevel@tonic-gate return (sp->retval); 5647c478bd9Sstevel@tonic-gate } 565e3320f40Smarkfen ERROR1(ep, ebuf, gettext("Unknown state type \"%s\"\n"), state); 566e3320f40Smarkfen handle_errors(ep, NULL, B_FALSE, B_FALSE); 567eeda67c6Sjojemann return (0); 5687c478bd9Sstevel@tonic-gate } 5697c478bd9Sstevel@tonic-gate 5707c478bd9Sstevel@tonic-gate /* 5717c478bd9Sstevel@tonic-gate * Return the numerical algorithm identifier corresponding to the specified 5727c478bd9Sstevel@tonic-gate * algorithm name. 5737c478bd9Sstevel@tonic-gate */ 5747c478bd9Sstevel@tonic-gate static uint8_t 575e3320f40Smarkfen parsealg(char *alg, int proto_num, char *ebuf) 5767c478bd9Sstevel@tonic-gate { 5777c478bd9Sstevel@tonic-gate u_longlong_t invalue; 5787c478bd9Sstevel@tonic-gate struct ipsecalgent *algent; 579e3320f40Smarkfen char *ep = NULL; 5807c478bd9Sstevel@tonic-gate 5817c478bd9Sstevel@tonic-gate if (alg == NULL) { 582e3320f40Smarkfen FATAL(ep, ebuf, gettext("Unexpected end of command line, " 583e3320f40Smarkfen "was expecting an algorithm name.\n")); 5847c478bd9Sstevel@tonic-gate } 5857c478bd9Sstevel@tonic-gate 5867c478bd9Sstevel@tonic-gate algent = getipsecalgbyname(alg, proto_num, NULL); 5877c478bd9Sstevel@tonic-gate if (algent != NULL) { 5887c478bd9Sstevel@tonic-gate uint8_t alg_num; 5897c478bd9Sstevel@tonic-gate 5907c478bd9Sstevel@tonic-gate alg_num = algent->a_alg_num; 5917c478bd9Sstevel@tonic-gate freeipsecalgent(algent); 5927c478bd9Sstevel@tonic-gate 5937c478bd9Sstevel@tonic-gate return (alg_num); 5947c478bd9Sstevel@tonic-gate } 5957c478bd9Sstevel@tonic-gate 5967c478bd9Sstevel@tonic-gate /* 5977c478bd9Sstevel@tonic-gate * Since algorithms can be loaded during kernel run-time, check for 5987c478bd9Sstevel@tonic-gate * numeric algorithm values too. PF_KEY can catch bad ones with EINVAL. 5997c478bd9Sstevel@tonic-gate */ 600e3320f40Smarkfen invalue = parsenum(alg, B_FALSE, ebuf); 6017c478bd9Sstevel@tonic-gate if (invalue != (u_longlong_t)-1 && 6027c478bd9Sstevel@tonic-gate (u_longlong_t)(invalue & (u_longlong_t)0xff) == invalue) 6037c478bd9Sstevel@tonic-gate return ((uint8_t)invalue); 6047c478bd9Sstevel@tonic-gate 605e3320f40Smarkfen if (proto_num == IPSEC_PROTO_ESP) { 606e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 607e3320f40Smarkfen "Unknown encryption algorithm type \"%s\"\n"), alg); 608e3320f40Smarkfen } else { 609e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 610e3320f40Smarkfen "Unknown authentication algorithm type \"%s\"\n"), alg); 611e3320f40Smarkfen } 612e3320f40Smarkfen handle_errors(ep, NULL, B_FALSE, B_FALSE); 613eeda67c6Sjojemann return (0); 6147c478bd9Sstevel@tonic-gate } 6157c478bd9Sstevel@tonic-gate 6167c478bd9Sstevel@tonic-gate /* 6177c478bd9Sstevel@tonic-gate * Parse and reverse parse out a source/destination ID type. 6187c478bd9Sstevel@tonic-gate */ 6197c478bd9Sstevel@tonic-gate static struct idtypes { 6207c478bd9Sstevel@tonic-gate char *idtype; 6217c478bd9Sstevel@tonic-gate uint8_t retval; 6227c478bd9Sstevel@tonic-gate } idtypes[] = { 6237c478bd9Sstevel@tonic-gate {"prefix", SADB_IDENTTYPE_PREFIX}, 6247c478bd9Sstevel@tonic-gate {"fqdn", SADB_IDENTTYPE_FQDN}, 6257c478bd9Sstevel@tonic-gate {"domain", SADB_IDENTTYPE_FQDN}, 6267c478bd9Sstevel@tonic-gate {"domainname", SADB_IDENTTYPE_FQDN}, 6277c478bd9Sstevel@tonic-gate {"user_fqdn", SADB_IDENTTYPE_USER_FQDN}, 6287c478bd9Sstevel@tonic-gate {"mailbox", SADB_IDENTTYPE_USER_FQDN}, 6297c478bd9Sstevel@tonic-gate {"der_dn", SADB_X_IDENTTYPE_DN}, 6307c478bd9Sstevel@tonic-gate {"der_gn", SADB_X_IDENTTYPE_GN}, 6317c478bd9Sstevel@tonic-gate {NULL, 0} 6327c478bd9Sstevel@tonic-gate }; 6337c478bd9Sstevel@tonic-gate 6347c478bd9Sstevel@tonic-gate static uint16_t 635e3320f40Smarkfen parseidtype(char *type, char *ebuf) 6367c478bd9Sstevel@tonic-gate { 6377c478bd9Sstevel@tonic-gate struct idtypes *idp; 6387c478bd9Sstevel@tonic-gate u_longlong_t invalue; 639e3320f40Smarkfen char *ep = NULL; 6407c478bd9Sstevel@tonic-gate 6417c478bd9Sstevel@tonic-gate if (type == NULL) { 6427c478bd9Sstevel@tonic-gate /* Shouldn't reach here, see callers for why. */ 643e3320f40Smarkfen FATAL(ep, ebuf, gettext("Unexpected end of command line, " 644e3320f40Smarkfen "was expecting a type.\n")); 6457c478bd9Sstevel@tonic-gate } 6467c478bd9Sstevel@tonic-gate 6477c478bd9Sstevel@tonic-gate for (idp = idtypes; idp->idtype != NULL; idp++) { 6487c478bd9Sstevel@tonic-gate if (strcasecmp(idp->idtype, type) == 0) 6497c478bd9Sstevel@tonic-gate return (idp->retval); 6507c478bd9Sstevel@tonic-gate } 6517c478bd9Sstevel@tonic-gate /* 6527c478bd9Sstevel@tonic-gate * Since identity types are almost arbitrary, check for numeric 6537c478bd9Sstevel@tonic-gate * algorithm values too. PF_KEY can catch bad ones with EINVAL. 6547c478bd9Sstevel@tonic-gate */ 655e3320f40Smarkfen invalue = parsenum(type, B_FALSE, ebuf); 6567c478bd9Sstevel@tonic-gate if (invalue != (u_longlong_t)-1 && 6577c478bd9Sstevel@tonic-gate (u_longlong_t)(invalue & (u_longlong_t)0xffff) == invalue) 6587c478bd9Sstevel@tonic-gate return ((uint16_t)invalue); 6597c478bd9Sstevel@tonic-gate 6607c478bd9Sstevel@tonic-gate 661e3320f40Smarkfen ERROR1(ep, ebuf, gettext("Unknown identity type \"%s\"\n"), type); 662e3320f40Smarkfen 663e3320f40Smarkfen handle_errors(ep, NULL, B_FALSE, B_FALSE); 664eeda67c6Sjojemann return (0); 6657c478bd9Sstevel@tonic-gate } 6667c478bd9Sstevel@tonic-gate 6677c478bd9Sstevel@tonic-gate /* 6687c478bd9Sstevel@tonic-gate * Parse an address off the command line. Return length of sockaddr, 6697c478bd9Sstevel@tonic-gate * and either return a hostent pointer (caller frees). The new 6707c478bd9Sstevel@tonic-gate * getipnodebyname() call does the Right Thing (TM), even with 6717c478bd9Sstevel@tonic-gate * raw addresses (colon-separated IPv6 or dotted decimal IPv4). 6727c478bd9Sstevel@tonic-gate */ 6737c478bd9Sstevel@tonic-gate 6747c478bd9Sstevel@tonic-gate static struct { 6757c478bd9Sstevel@tonic-gate struct hostent he; 6767c478bd9Sstevel@tonic-gate char *addtl[2]; 6777c478bd9Sstevel@tonic-gate } dummy; 6787c478bd9Sstevel@tonic-gate static union { 6797c478bd9Sstevel@tonic-gate struct in6_addr ipv6; 6807c478bd9Sstevel@tonic-gate struct in_addr ipv4; 6817c478bd9Sstevel@tonic-gate uint64_t aligner; 6827c478bd9Sstevel@tonic-gate } addr1; 6837c478bd9Sstevel@tonic-gate 6847c478bd9Sstevel@tonic-gate static int 685e3320f40Smarkfen parseaddr(char *addr, struct hostent **hpp, boolean_t v6only, char *ebuf) 6867c478bd9Sstevel@tonic-gate { 6877c478bd9Sstevel@tonic-gate int hp_errno; 6887c478bd9Sstevel@tonic-gate struct hostent *hp = NULL; 689e3320f40Smarkfen char *ep = NULL; 6907c478bd9Sstevel@tonic-gate 6917c478bd9Sstevel@tonic-gate if (addr == NULL) { 692e3320f40Smarkfen FATAL(ep, ebuf, gettext("Unexpected end of command line, " 693e3320f40Smarkfen "was expecting an address.\n")); 6947c478bd9Sstevel@tonic-gate } 6957c478bd9Sstevel@tonic-gate 6967c478bd9Sstevel@tonic-gate if (!nflag) { 6977c478bd9Sstevel@tonic-gate /* 6987c478bd9Sstevel@tonic-gate * Try name->address first. Assume AF_INET6, and 6997c478bd9Sstevel@tonic-gate * get IPv4's, plus IPv6's if and only if IPv6 is configured. 7007c478bd9Sstevel@tonic-gate * This means to add IPv6 SAs, you must have IPv6 7017c478bd9Sstevel@tonic-gate * up-and-running. (AI_DEFAULT works here.) 7027c478bd9Sstevel@tonic-gate */ 7037c478bd9Sstevel@tonic-gate hp = getipnodebyname(addr, AF_INET6, 7047c478bd9Sstevel@tonic-gate (v6only ? AI_ADDRCONFIG : (AI_DEFAULT | AI_ALL)), 7057c478bd9Sstevel@tonic-gate &hp_errno); 7067c478bd9Sstevel@tonic-gate } else { 7077c478bd9Sstevel@tonic-gate /* 7087c478bd9Sstevel@tonic-gate * Try a normal address conversion only. Use "dummy" 7097c478bd9Sstevel@tonic-gate * to construct a fake hostent. Caller will know not 7107c478bd9Sstevel@tonic-gate * to free this one. 7117c478bd9Sstevel@tonic-gate */ 7127c478bd9Sstevel@tonic-gate if (inet_pton(AF_INET6, addr, &addr1) == 1) { 7137c478bd9Sstevel@tonic-gate dummy.he.h_addr_list = dummy.addtl; 7147c478bd9Sstevel@tonic-gate dummy.addtl[0] = (char *)&addr1; 7157c478bd9Sstevel@tonic-gate dummy.addtl[1] = NULL; 7167c478bd9Sstevel@tonic-gate hp = &dummy.he; 7177c478bd9Sstevel@tonic-gate dummy.he.h_addrtype = AF_INET6; 7187c478bd9Sstevel@tonic-gate dummy.he.h_length = sizeof (struct in6_addr); 7197c478bd9Sstevel@tonic-gate } else if (inet_pton(AF_INET, addr, &addr1) == 1) { 7207c478bd9Sstevel@tonic-gate /* 7218810c16bSdanmcd * Remap to AF_INET6 anyway. 7227c478bd9Sstevel@tonic-gate */ 7237c478bd9Sstevel@tonic-gate dummy.he.h_addr_list = dummy.addtl; 7247c478bd9Sstevel@tonic-gate dummy.addtl[0] = (char *)&addr1; 7257c478bd9Sstevel@tonic-gate dummy.addtl[1] = NULL; 7267c478bd9Sstevel@tonic-gate hp = &dummy.he; 7277c478bd9Sstevel@tonic-gate dummy.he.h_addrtype = AF_INET6; 7287c478bd9Sstevel@tonic-gate dummy.he.h_length = sizeof (struct in6_addr); 7297c478bd9Sstevel@tonic-gate /* 7307c478bd9Sstevel@tonic-gate * NOTE: If macro changes to disallow in-place 7317c478bd9Sstevel@tonic-gate * conversion, rewhack this. 7327c478bd9Sstevel@tonic-gate */ 7337c478bd9Sstevel@tonic-gate IN6_INADDR_TO_V4MAPPED(&addr1.ipv4, &addr1.ipv6); 7347c478bd9Sstevel@tonic-gate } else { 7357c478bd9Sstevel@tonic-gate hp = NULL; 7367c478bd9Sstevel@tonic-gate } 7377c478bd9Sstevel@tonic-gate } 7387c478bd9Sstevel@tonic-gate 739e3320f40Smarkfen if (hp == NULL) 740e3320f40Smarkfen WARN1(ep, ebuf, gettext("Unknown address %s."), addr); 7417c478bd9Sstevel@tonic-gate 7427c478bd9Sstevel@tonic-gate *hpp = hp; 7438810c16bSdanmcd /* Always return sockaddr_in6 for now. */ 744e3320f40Smarkfen handle_errors(ep, NULL, B_FALSE, B_FALSE); 7458810c16bSdanmcd return (sizeof (struct sockaddr_in6)); 7467c478bd9Sstevel@tonic-gate } 7477c478bd9Sstevel@tonic-gate 7487c478bd9Sstevel@tonic-gate /* 7497c478bd9Sstevel@tonic-gate * Parse a hex character for a key. A string will take the form: 7507c478bd9Sstevel@tonic-gate * xxxxxxxxx/nn 7517c478bd9Sstevel@tonic-gate * where 7527c478bd9Sstevel@tonic-gate * xxxxxxxxx == a string of hex characters ([0-9][a-f][A-F]) 7537c478bd9Sstevel@tonic-gate * nn == an optional decimal "mask". If it is not present, it 7547c478bd9Sstevel@tonic-gate * is assumed that the hex string will be rounded to the nearest 7557c478bd9Sstevel@tonic-gate * byte, where odd nibbles, like 123 will become 0x0123. 7567c478bd9Sstevel@tonic-gate * 7577c478bd9Sstevel@tonic-gate * NOTE:Unlike the expression of IP addresses, I will not allow an 7587c478bd9Sstevel@tonic-gate * excessive "mask". For example 2112/50 is very illegal. 7597c478bd9Sstevel@tonic-gate * NOTE2: This key should be in canonical order. Consult your man 7607c478bd9Sstevel@tonic-gate * pages per algorithm about said order. 7617c478bd9Sstevel@tonic-gate */ 7627c478bd9Sstevel@tonic-gate 7637c478bd9Sstevel@tonic-gate #define hd2num(hd) (((hd) >= '0' && (hd) <= '9') ? ((hd) - '0') : \ 7647c478bd9Sstevel@tonic-gate (((hd) >= 'a' && (hd) <= 'f') ? ((hd) - 'a' + 10) : ((hd) - 'A' + 10))) 7657c478bd9Sstevel@tonic-gate 7667c478bd9Sstevel@tonic-gate static struct sadb_key * 767e3320f40Smarkfen parsekey(char *input, char *ebuf) 7687c478bd9Sstevel@tonic-gate { 7697c478bd9Sstevel@tonic-gate struct sadb_key *retval; 7707c478bd9Sstevel@tonic-gate uint_t i, hexlen = 0, bits, alloclen; 7717c478bd9Sstevel@tonic-gate uint8_t *key; 772e3320f40Smarkfen char *ep = NULL; 7737c478bd9Sstevel@tonic-gate 7747c478bd9Sstevel@tonic-gate if (input == NULL) { 775e3320f40Smarkfen FATAL(ep, ebuf, gettext("Unexpected end of command line, " 776e3320f40Smarkfen "was expecting a key.\n")); 7777c478bd9Sstevel@tonic-gate } 778*ec485834Spwernau /* Allow hex values prepended with 0x convention */ 779*ec485834Spwernau if ((strnlen(input, sizeof (hexlen)) > 2) && 780*ec485834Spwernau (strncasecmp(input, "0x", 2) == 0)) 781*ec485834Spwernau input += 2; 7827c478bd9Sstevel@tonic-gate 7837c478bd9Sstevel@tonic-gate for (i = 0; input[i] != '\0' && input[i] != '/'; i++) 7847c478bd9Sstevel@tonic-gate hexlen++; 7857c478bd9Sstevel@tonic-gate 7867c478bd9Sstevel@tonic-gate if (input[i] == '\0') { 7877c478bd9Sstevel@tonic-gate bits = 0; 7887c478bd9Sstevel@tonic-gate } else { 7897c478bd9Sstevel@tonic-gate /* Have /nn. */ 7907c478bd9Sstevel@tonic-gate input[i] = '\0'; 7917c478bd9Sstevel@tonic-gate if (sscanf((input + i + 1), "%u", &bits) != 1) { 792e3320f40Smarkfen FATAL1(ep, ebuf, gettext( 793e3320f40Smarkfen "\"%s\" is not a bit specifier.\n"), 7947c478bd9Sstevel@tonic-gate (input + i + 1)); 7957c478bd9Sstevel@tonic-gate } 7967c478bd9Sstevel@tonic-gate /* hexlen in nibbles */ 7977c478bd9Sstevel@tonic-gate if (((bits + 3) >> 2) > hexlen) { 798e3320f40Smarkfen ERROR2(ep, ebuf, gettext( 799e3320f40Smarkfen "bit length %d is too big for %s.\n"), bits, input); 8007c478bd9Sstevel@tonic-gate } 8017c478bd9Sstevel@tonic-gate /* 8027c478bd9Sstevel@tonic-gate * Adjust hexlen down if user gave us too small of a bit 8037c478bd9Sstevel@tonic-gate * count. 8047c478bd9Sstevel@tonic-gate */ 8057c478bd9Sstevel@tonic-gate if ((hexlen << 2) > bits + 3) { 806e3320f40Smarkfen WARN2(ep, ebuf, gettext( 807e3320f40Smarkfen "WARNING: Lower bits will be truncated " 808e3320f40Smarkfen "for:\n\t%s/%d.\n"), input, bits); 8097c478bd9Sstevel@tonic-gate hexlen = (bits + 3) >> 2; 8107c478bd9Sstevel@tonic-gate input[hexlen] = '\0'; 8117c478bd9Sstevel@tonic-gate } 8127c478bd9Sstevel@tonic-gate } 8137c478bd9Sstevel@tonic-gate 8147c478bd9Sstevel@tonic-gate /* 8157c478bd9Sstevel@tonic-gate * Allocate. Remember, hexlen is in nibbles. 8167c478bd9Sstevel@tonic-gate */ 8177c478bd9Sstevel@tonic-gate 8187c478bd9Sstevel@tonic-gate alloclen = sizeof (*retval) + roundup((hexlen/2 + (hexlen & 0x1)), 8); 8197c478bd9Sstevel@tonic-gate retval = malloc(alloclen); 8207c478bd9Sstevel@tonic-gate 8217c478bd9Sstevel@tonic-gate if (retval == NULL) 8227c478bd9Sstevel@tonic-gate Bail("malloc(parsekey)"); 8237c478bd9Sstevel@tonic-gate retval->sadb_key_len = SADB_8TO64(alloclen); 8247c478bd9Sstevel@tonic-gate retval->sadb_key_reserved = 0; 8257c478bd9Sstevel@tonic-gate if (bits == 0) 8267c478bd9Sstevel@tonic-gate retval->sadb_key_bits = (hexlen + (hexlen & 0x1)) << 2; 8277c478bd9Sstevel@tonic-gate else 8287c478bd9Sstevel@tonic-gate retval->sadb_key_bits = bits; 8297c478bd9Sstevel@tonic-gate 8307c478bd9Sstevel@tonic-gate /* 8317c478bd9Sstevel@tonic-gate * Read in nibbles. Read in odd-numbered as shifted high. 8327c478bd9Sstevel@tonic-gate * (e.g. 123 becomes 0x1230). 8337c478bd9Sstevel@tonic-gate */ 8347c478bd9Sstevel@tonic-gate 8357c478bd9Sstevel@tonic-gate key = (uint8_t *)(retval + 1); 8367c478bd9Sstevel@tonic-gate for (i = 0; input[i] != '\0'; i += 2) { 8377c478bd9Sstevel@tonic-gate boolean_t second = (input[i + 1] != '\0'); 8387c478bd9Sstevel@tonic-gate 8397c478bd9Sstevel@tonic-gate if (!isxdigit(input[i]) || 8407c478bd9Sstevel@tonic-gate (!isxdigit(input[i + 1]) && second)) { 841e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 842e3320f40Smarkfen "string '%s' not a hex value.\n"), input); 843e3320f40Smarkfen free(retval); 844e3320f40Smarkfen retval = NULL; 845e3320f40Smarkfen break; 8467c478bd9Sstevel@tonic-gate } 8477c478bd9Sstevel@tonic-gate *key = (hd2num(input[i]) << 4); 8487c478bd9Sstevel@tonic-gate if (second) 8497c478bd9Sstevel@tonic-gate *key |= hd2num(input[i + 1]); 8507c478bd9Sstevel@tonic-gate else 8517c478bd9Sstevel@tonic-gate break; /* out of for loop. */ 8527c478bd9Sstevel@tonic-gate key++; 8537c478bd9Sstevel@tonic-gate } 8547c478bd9Sstevel@tonic-gate 8557c478bd9Sstevel@tonic-gate /* bzero the remaining bits if we're a non-octet amount. */ 8567c478bd9Sstevel@tonic-gate if (bits & 0x7) 8577c478bd9Sstevel@tonic-gate *((input[i] == '\0') ? key - 1 : key) &= 8587c478bd9Sstevel@tonic-gate 0xff << (8 - (bits & 0x7)); 8597c478bd9Sstevel@tonic-gate 860e3320f40Smarkfen handle_errors(ep, NULL, B_FALSE, B_FALSE); 8617c478bd9Sstevel@tonic-gate return (retval); 8627c478bd9Sstevel@tonic-gate } 8637c478bd9Sstevel@tonic-gate 8647c478bd9Sstevel@tonic-gate /* 8657c478bd9Sstevel@tonic-gate * Write a message to the PF_KEY socket. If verbose, print the message 8667c478bd9Sstevel@tonic-gate * heading into the kernel. 8677c478bd9Sstevel@tonic-gate */ 8687c478bd9Sstevel@tonic-gate static int 8697c478bd9Sstevel@tonic-gate key_write(int fd, void *msg, size_t len) 8707c478bd9Sstevel@tonic-gate { 8717c478bd9Sstevel@tonic-gate if (vflag) { 8727c478bd9Sstevel@tonic-gate (void) printf( 8737c478bd9Sstevel@tonic-gate gettext("VERBOSE ON: Message to kernel looks like:\n")); 8747c478bd9Sstevel@tonic-gate (void) printf("==========================================\n"); 8758810c16bSdanmcd print_samsg(msg, B_FALSE, vflag); 8767c478bd9Sstevel@tonic-gate (void) printf("==========================================\n"); 8777c478bd9Sstevel@tonic-gate } 8787c478bd9Sstevel@tonic-gate 8797c478bd9Sstevel@tonic-gate return (write(fd, msg, len)); 8807c478bd9Sstevel@tonic-gate } 8817c478bd9Sstevel@tonic-gate 8827c478bd9Sstevel@tonic-gate /* 8837c478bd9Sstevel@tonic-gate * SIGALRM handler for time_critical_enter. 8847c478bd9Sstevel@tonic-gate */ 8857c478bd9Sstevel@tonic-gate static void 8867c478bd9Sstevel@tonic-gate time_critical_catch(int signal) 8877c478bd9Sstevel@tonic-gate { 8887c478bd9Sstevel@tonic-gate if (signal == SIGALRM) { 8897c478bd9Sstevel@tonic-gate errx(1, gettext("Reply message from PF_KEY timed out.")); 8907c478bd9Sstevel@tonic-gate } else { 8917c478bd9Sstevel@tonic-gate errx(1, gettext("Caught signal %d while trying to receive" 89225e435e0Spwernau "PF_KEY reply message"), signal); 8937c478bd9Sstevel@tonic-gate } 8947c478bd9Sstevel@tonic-gate /* errx() calls exit. */ 8957c478bd9Sstevel@tonic-gate } 8967c478bd9Sstevel@tonic-gate 8977c478bd9Sstevel@tonic-gate #define TIME_CRITICAL_TIME 10 /* In seconds */ 8987c478bd9Sstevel@tonic-gate 8997c478bd9Sstevel@tonic-gate /* 9007c478bd9Sstevel@tonic-gate * Enter a "time critical" section where key is waiting for a return message. 9017c478bd9Sstevel@tonic-gate */ 9027c478bd9Sstevel@tonic-gate static void 9037c478bd9Sstevel@tonic-gate time_critical_enter(void) 9047c478bd9Sstevel@tonic-gate { 9057c478bd9Sstevel@tonic-gate (void) signal(SIGALRM, time_critical_catch); 9067c478bd9Sstevel@tonic-gate (void) alarm(TIME_CRITICAL_TIME); 9077c478bd9Sstevel@tonic-gate } 9087c478bd9Sstevel@tonic-gate 9097c478bd9Sstevel@tonic-gate /* 9107c478bd9Sstevel@tonic-gate * Exit the "time critical" section after getting an appropriate return 9117c478bd9Sstevel@tonic-gate * message. 9127c478bd9Sstevel@tonic-gate */ 9137c478bd9Sstevel@tonic-gate static void 9147c478bd9Sstevel@tonic-gate time_critical_exit(void) 9157c478bd9Sstevel@tonic-gate { 9167c478bd9Sstevel@tonic-gate (void) alarm(0); 9177c478bd9Sstevel@tonic-gate (void) signal(SIGALRM, SIG_DFL); 9187c478bd9Sstevel@tonic-gate } 9197c478bd9Sstevel@tonic-gate 9207c478bd9Sstevel@tonic-gate /* 9217c478bd9Sstevel@tonic-gate * Construct a PF_KEY FLUSH message for the SA type specified. 9227c478bd9Sstevel@tonic-gate */ 9237c478bd9Sstevel@tonic-gate static void 9247c478bd9Sstevel@tonic-gate doflush(int satype) 9257c478bd9Sstevel@tonic-gate { 9267c478bd9Sstevel@tonic-gate struct sadb_msg msg; 9277c478bd9Sstevel@tonic-gate int rc; 9287c478bd9Sstevel@tonic-gate 9297c478bd9Sstevel@tonic-gate msg_init(&msg, SADB_FLUSH, (uint8_t)satype); 9307c478bd9Sstevel@tonic-gate rc = key_write(keysock, &msg, sizeof (msg)); 9317c478bd9Sstevel@tonic-gate if (rc == -1) 9327c478bd9Sstevel@tonic-gate Bail("write() to PF_KEY socket failed (in doflush)"); 9337c478bd9Sstevel@tonic-gate 9347c478bd9Sstevel@tonic-gate time_critical_enter(); 9357c478bd9Sstevel@tonic-gate do { 9367c478bd9Sstevel@tonic-gate rc = read(keysock, &msg, sizeof (msg)); 9377c478bd9Sstevel@tonic-gate if (rc == -1) 9387c478bd9Sstevel@tonic-gate Bail("read (in doflush)"); 9397c478bd9Sstevel@tonic-gate } while (msg.sadb_msg_seq != seq || msg.sadb_msg_pid != mypid); 9407c478bd9Sstevel@tonic-gate time_critical_exit(); 9417c478bd9Sstevel@tonic-gate 9427c478bd9Sstevel@tonic-gate /* 9437c478bd9Sstevel@tonic-gate * I should _never_ hit the following unless: 9447c478bd9Sstevel@tonic-gate * 9457c478bd9Sstevel@tonic-gate * 1. There is a kernel bug. 9467c478bd9Sstevel@tonic-gate * 2. There is another process filling in its pid with mine, and 9477c478bd9Sstevel@tonic-gate * issuing a different message that would cause a different result. 9487c478bd9Sstevel@tonic-gate */ 9497c478bd9Sstevel@tonic-gate if (msg.sadb_msg_type != SADB_FLUSH || 9507c478bd9Sstevel@tonic-gate msg.sadb_msg_satype != (uint8_t)satype) { 9517c478bd9Sstevel@tonic-gate syslog((LOG_NOTICE|LOG_AUTH), 9527c478bd9Sstevel@tonic-gate gettext("doflush: Return message not of type SADB_FLUSH!")); 9537c478bd9Sstevel@tonic-gate Bail("doflush: Return message not of type SADB_FLUSH!"); 9547c478bd9Sstevel@tonic-gate } 9557c478bd9Sstevel@tonic-gate 9567c478bd9Sstevel@tonic-gate if (msg.sadb_msg_errno != 0) { 9577c478bd9Sstevel@tonic-gate errno = msg.sadb_msg_errno; 9587c478bd9Sstevel@tonic-gate if (errno == EINVAL) { 9597c478bd9Sstevel@tonic-gate print_diagnostic(stderr, msg.sadb_x_msg_diagnostic); 9607c478bd9Sstevel@tonic-gate warnx(gettext("Cannot flush SA type %d."), satype); 9617c478bd9Sstevel@tonic-gate } 9627c478bd9Sstevel@tonic-gate Bail("return message (in doflush)"); 9637c478bd9Sstevel@tonic-gate } 9647c478bd9Sstevel@tonic-gate } 9657c478bd9Sstevel@tonic-gate 9667c478bd9Sstevel@tonic-gate /* 9677c478bd9Sstevel@tonic-gate * save_XXX functions are used when "saving" the SA tables to either a 9687c478bd9Sstevel@tonic-gate * file or standard output. They use the dump_XXX functions where needed, 9697c478bd9Sstevel@tonic-gate * but mostly they use the rparseXXX functions. 9707c478bd9Sstevel@tonic-gate */ 9717c478bd9Sstevel@tonic-gate 9727c478bd9Sstevel@tonic-gate /* 9737c478bd9Sstevel@tonic-gate * Because "save" and "dump" both use the SADB_DUMP message, fold both 9747c478bd9Sstevel@tonic-gate * into the same function. 9757c478bd9Sstevel@tonic-gate */ 9767c478bd9Sstevel@tonic-gate static void 9777c478bd9Sstevel@tonic-gate dodump(int satype, FILE *ofile) 9787c478bd9Sstevel@tonic-gate { 9797c478bd9Sstevel@tonic-gate struct sadb_msg *msg = (struct sadb_msg *)get_buffer; 9807c478bd9Sstevel@tonic-gate int rc; 9817c478bd9Sstevel@tonic-gate 9827c478bd9Sstevel@tonic-gate if (ofile != NULL) { 9837c478bd9Sstevel@tonic-gate (void) fprintf(ofile, 9847c478bd9Sstevel@tonic-gate gettext("# This key file was generated by the")); 9857c478bd9Sstevel@tonic-gate (void) fprintf(ofile, 9867c478bd9Sstevel@tonic-gate gettext(" ipseckey(1m) command's 'save' feature.\n\n")); 9877c478bd9Sstevel@tonic-gate } 9887c478bd9Sstevel@tonic-gate msg_init(msg, SADB_DUMP, (uint8_t)satype); 9897c478bd9Sstevel@tonic-gate rc = key_write(keysock, msg, sizeof (*msg)); 9907c478bd9Sstevel@tonic-gate if (rc == -1) 9917c478bd9Sstevel@tonic-gate Bail("write to PF_KEY socket failed (in dodump)"); 9927c478bd9Sstevel@tonic-gate 9937c478bd9Sstevel@tonic-gate do { 9947c478bd9Sstevel@tonic-gate /* 9957c478bd9Sstevel@tonic-gate * For DUMP, do only the read as a time critical section. 9967c478bd9Sstevel@tonic-gate */ 9977c478bd9Sstevel@tonic-gate time_critical_enter(); 9987c478bd9Sstevel@tonic-gate rc = read(keysock, get_buffer, sizeof (get_buffer)); 9997c478bd9Sstevel@tonic-gate time_critical_exit(); 10007c478bd9Sstevel@tonic-gate if (rc == -1) 10017c478bd9Sstevel@tonic-gate Bail("read (in dodump)"); 10027c478bd9Sstevel@tonic-gate if (msg->sadb_msg_pid == mypid && 10037c478bd9Sstevel@tonic-gate msg->sadb_msg_type == SADB_DUMP && 10047c478bd9Sstevel@tonic-gate msg->sadb_msg_seq != 0 && 10057c478bd9Sstevel@tonic-gate msg->sadb_msg_errno == 0) { 10067c478bd9Sstevel@tonic-gate if (ofile == NULL) { 10078810c16bSdanmcd print_samsg(get_buffer, B_FALSE, vflag); 10087c478bd9Sstevel@tonic-gate (void) putchar('\n'); 10097c478bd9Sstevel@tonic-gate } else { 10107c478bd9Sstevel@tonic-gate save_assoc(get_buffer, ofile); 10117c478bd9Sstevel@tonic-gate } 10127c478bd9Sstevel@tonic-gate } 10137c478bd9Sstevel@tonic-gate } while (msg->sadb_msg_pid != mypid || 10147c478bd9Sstevel@tonic-gate (msg->sadb_msg_errno == 0 && msg->sadb_msg_seq != 0)); 10157c478bd9Sstevel@tonic-gate 10167c478bd9Sstevel@tonic-gate if (ofile != NULL && ofile != stdout) 10177c478bd9Sstevel@tonic-gate (void) fclose(ofile); 10187c478bd9Sstevel@tonic-gate 10197c478bd9Sstevel@tonic-gate if (msg->sadb_msg_errno == 0) { 10207c478bd9Sstevel@tonic-gate if (ofile == NULL) 10217c478bd9Sstevel@tonic-gate (void) printf( 10227c478bd9Sstevel@tonic-gate gettext("Dump succeeded for SA type %d.\n"), 10237c478bd9Sstevel@tonic-gate satype); 10247c478bd9Sstevel@tonic-gate } else { 10257c478bd9Sstevel@tonic-gate print_diagnostic(stderr, msg->sadb_x_msg_diagnostic); 10267c478bd9Sstevel@tonic-gate errno = msg->sadb_msg_errno; 10277c478bd9Sstevel@tonic-gate Bail("Dump failed"); 10287c478bd9Sstevel@tonic-gate } 10297c478bd9Sstevel@tonic-gate } 10307c478bd9Sstevel@tonic-gate 10317c478bd9Sstevel@tonic-gate #define SCOPE_UNSPEC 0 10327c478bd9Sstevel@tonic-gate #define SCOPE_LINKLOCAL 1 10337c478bd9Sstevel@tonic-gate #define SCOPE_SITELOCAL 2 10347c478bd9Sstevel@tonic-gate #define SCOPE_GLOBAL 3 10357c478bd9Sstevel@tonic-gate #define SCOPE_V4COMPAT 4 10367c478bd9Sstevel@tonic-gate #define SCOPE_LOOPBACK 5 /* Pedantic, yes, but necessary. */ 10377c478bd9Sstevel@tonic-gate 10387c478bd9Sstevel@tonic-gate static int 10397c478bd9Sstevel@tonic-gate ipv6_addr_scope(struct in6_addr *addr) 10407c478bd9Sstevel@tonic-gate { 10417c478bd9Sstevel@tonic-gate /* Don't return anything regarding multicast for now... */ 10427c478bd9Sstevel@tonic-gate 10437c478bd9Sstevel@tonic-gate if (IN6_IS_ADDR_UNSPECIFIED(addr)) 10447c478bd9Sstevel@tonic-gate return (SCOPE_UNSPEC); 10457c478bd9Sstevel@tonic-gate 10467c478bd9Sstevel@tonic-gate if (IN6_IS_ADDR_LINKLOCAL(addr)) 10477c478bd9Sstevel@tonic-gate return (SCOPE_LINKLOCAL); 10487c478bd9Sstevel@tonic-gate 10497c478bd9Sstevel@tonic-gate if (IN6_IS_ADDR_SITELOCAL(addr)) 10507c478bd9Sstevel@tonic-gate return (SCOPE_SITELOCAL); 10517c478bd9Sstevel@tonic-gate 10527c478bd9Sstevel@tonic-gate if (IN6_IS_ADDR_V4COMPAT(addr)) 10537c478bd9Sstevel@tonic-gate return (SCOPE_V4COMPAT); 10547c478bd9Sstevel@tonic-gate 10557c478bd9Sstevel@tonic-gate if (IN6_IS_ADDR_LOOPBACK(addr)) 10567c478bd9Sstevel@tonic-gate return (SCOPE_LOOPBACK); 10577c478bd9Sstevel@tonic-gate 10587c478bd9Sstevel@tonic-gate /* For now, return global by default. */ 10597c478bd9Sstevel@tonic-gate return (SCOPE_GLOBAL); 10607c478bd9Sstevel@tonic-gate } 10617c478bd9Sstevel@tonic-gate 10627c478bd9Sstevel@tonic-gate /* 10637c478bd9Sstevel@tonic-gate * doaddresses(): 10647c478bd9Sstevel@tonic-gate * 10657c478bd9Sstevel@tonic-gate * Used by doaddup() and dodelget() to create new SA's based on the 10667c478bd9Sstevel@tonic-gate * provided source and destination addresses hostent. 10677c478bd9Sstevel@tonic-gate * 10687c478bd9Sstevel@tonic-gate * sadb_msg_type: expected PF_KEY reply message type 10697c478bd9Sstevel@tonic-gate * sadb_msg_satype: expected PF_KEY reply satype 10707c478bd9Sstevel@tonic-gate * cmd: user command 10717c478bd9Sstevel@tonic-gate * srchp: hostent for the source address(es) 10727c478bd9Sstevel@tonic-gate * dsthp: hostent for the destination address(es) 10737c478bd9Sstevel@tonic-gate * src: points to the SADB source address extension 10747c478bd9Sstevel@tonic-gate * dst: points to the SADB destination address extension 10757c478bd9Sstevel@tonic-gate * unspec_src: indicates an unspecified source address. 10767c478bd9Sstevel@tonic-gate * buffer: pointer to the SADB buffer to use with PF_KEY 10777c478bd9Sstevel@tonic-gate * buffer_size: size of buffer 10787c478bd9Sstevel@tonic-gate * spi: spi for this message (set by caller) 10797c478bd9Sstevel@tonic-gate * srcport: source port if specified 10808810c16bSdanmcd * dstport: destination port if specified 10817c478bd9Sstevel@tonic-gate * proto: IP protocol number if specified 10828810c16bSdanmcd * iproto: Inner (tunnel mode) IP protocol number if specified 10837c478bd9Sstevel@tonic-gate * NATT note: we are going to assume a semi-sane world where NAT 10847c478bd9Sstevel@tonic-gate * boxen don't explode to multiple addresses. 10857c478bd9Sstevel@tonic-gate */ 10867c478bd9Sstevel@tonic-gate static void 10877c478bd9Sstevel@tonic-gate doaddresses(uint8_t sadb_msg_type, uint8_t sadb_msg_satype, int cmd, 10887c478bd9Sstevel@tonic-gate struct hostent *srchp, struct hostent *dsthp, 10897c478bd9Sstevel@tonic-gate struct sadb_address *src, struct sadb_address *dst, 1090e3320f40Smarkfen boolean_t unspec_src, uint64_t *buffer, int buffer_size, uint32_t spi, 1091e3320f40Smarkfen char *ebuf) 10927c478bd9Sstevel@tonic-gate { 10937c478bd9Sstevel@tonic-gate boolean_t single_dst; 10947c478bd9Sstevel@tonic-gate struct sockaddr_in6 *sin6; 10957c478bd9Sstevel@tonic-gate struct sadb_msg *msgp; 10967c478bd9Sstevel@tonic-gate int i, rc; 10977c478bd9Sstevel@tonic-gate char **walker; /* For the SRC and PROXY walking functions. */ 10987c478bd9Sstevel@tonic-gate char *first_match; 10998810c16bSdanmcd uint64_t savebuf[MAX_GET_SIZE]; 11008810c16bSdanmcd uint16_t srcport = 0, dstport = 0; 1101e3320f40Smarkfen char *ep = NULL; 11027c478bd9Sstevel@tonic-gate 11037c478bd9Sstevel@tonic-gate /* 11047c478bd9Sstevel@tonic-gate * Okay, now we have "src", "dst", and maybe "proxy" reassigned 11057c478bd9Sstevel@tonic-gate * to point into the buffer to be written to PF_KEY, we can do 11067c478bd9Sstevel@tonic-gate * potentially several writes based on destination address. 11077c478bd9Sstevel@tonic-gate * 11088810c16bSdanmcd * First, obtain port numbers from passed-in extensions. 11097c478bd9Sstevel@tonic-gate */ 11107c478bd9Sstevel@tonic-gate 11117c478bd9Sstevel@tonic-gate if (src != NULL) { 11127c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(src + 1); 11138810c16bSdanmcd srcport = ntohs(sin6->sin6_port); 11147c478bd9Sstevel@tonic-gate } 11157c478bd9Sstevel@tonic-gate if (dst != NULL) { 11167c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(dst + 1); 11178810c16bSdanmcd dstport = ntohs(sin6->sin6_port); 11187c478bd9Sstevel@tonic-gate } 11197c478bd9Sstevel@tonic-gate 11207c478bd9Sstevel@tonic-gate /* 11217c478bd9Sstevel@tonic-gate * The rules for ADD, GET, and UPDATE: (NOTE: This assumes IPsec. 11227c478bd9Sstevel@tonic-gate * If other consumers of PF_KEY happen, this will have to be 11237c478bd9Sstevel@tonic-gate * rewhacked.): 11247c478bd9Sstevel@tonic-gate * 11257c478bd9Sstevel@tonic-gate * Do a message for every possible DST address. 11267c478bd9Sstevel@tonic-gate * 11277c478bd9Sstevel@tonic-gate * If a source or proxy address explodes, keep unspecified 11287c478bd9Sstevel@tonic-gate * (and mention unspecified). 11297c478bd9Sstevel@tonic-gate * 11307c478bd9Sstevel@tonic-gate * If dsthp is == dummy.he, then go through the loop once. 11317c478bd9Sstevel@tonic-gate * If any other hp is == dummy.he, then you don't have to apply any 11327c478bd9Sstevel@tonic-gate * silly rules. 11337c478bd9Sstevel@tonic-gate * 11347c478bd9Sstevel@tonic-gate * DELETE is different, because you can leave either "src" or "dst" 11357c478bd9Sstevel@tonic-gate * blank! You need to explode if one of them is full, and not assume 11367c478bd9Sstevel@tonic-gate * that the other is set. 11377c478bd9Sstevel@tonic-gate */ 11387c478bd9Sstevel@tonic-gate 11397c478bd9Sstevel@tonic-gate if (dsthp == NULL) { 11407c478bd9Sstevel@tonic-gate /* 11417c478bd9Sstevel@tonic-gate * No destination address specified. 11427c478bd9Sstevel@tonic-gate * With extended diagnostics, we don't have to bail the 11437c478bd9Sstevel@tonic-gate * non-DELETE cases here. The EINVAL diagnostics will be 11447c478bd9Sstevel@tonic-gate * enough to inform the user(s) what happened. 11457c478bd9Sstevel@tonic-gate */ 11467c478bd9Sstevel@tonic-gate i = 0; 11477c478bd9Sstevel@tonic-gate do { 11487c478bd9Sstevel@tonic-gate if (srchp == &dummy.he) { 11497c478bd9Sstevel@tonic-gate /* Just to be sure... */ 11507c478bd9Sstevel@tonic-gate srchp->h_addr_list[1] = NULL; 11517c478bd9Sstevel@tonic-gate } else if (srchp != NULL) { 11527c478bd9Sstevel@tonic-gate /* Degenerate case, h_addr_list[0] == NULL. */ 11537c478bd9Sstevel@tonic-gate if (srchp->h_addr_list[i] == NULL) 11547c478bd9Sstevel@tonic-gate Bail("Empty source address list"); 11557c478bd9Sstevel@tonic-gate 11567c478bd9Sstevel@tonic-gate /* 11577c478bd9Sstevel@tonic-gate * Fill in the src sockaddr. 11587c478bd9Sstevel@tonic-gate */ 11597c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(src + 1); 11607c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6)); 11617c478bd9Sstevel@tonic-gate bcopy(srchp->h_addr_list[i], &sin6->sin6_addr, 11627c478bd9Sstevel@tonic-gate sizeof (struct in6_addr)); 11637c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6; 11647c478bd9Sstevel@tonic-gate sin6->sin6_port = htons(srcport); 11657c478bd9Sstevel@tonic-gate } 11667c478bd9Sstevel@tonic-gate 11677c478bd9Sstevel@tonic-gate /* Save off a copy for later writing... */ 11687c478bd9Sstevel@tonic-gate msgp = (struct sadb_msg *)buffer; 11697c478bd9Sstevel@tonic-gate bcopy(buffer, savebuf, SADB_64TO8(msgp->sadb_msg_len)); 11707c478bd9Sstevel@tonic-gate 11717c478bd9Sstevel@tonic-gate rc = key_write(keysock, buffer, 11727c478bd9Sstevel@tonic-gate SADB_64TO8(msgp->sadb_msg_len)); 11737c478bd9Sstevel@tonic-gate if (rc == -1) 11747c478bd9Sstevel@tonic-gate Bail("write() to PF_KEY socket " 11757c478bd9Sstevel@tonic-gate "(in doaddresses)"); 11767c478bd9Sstevel@tonic-gate 11777c478bd9Sstevel@tonic-gate time_critical_enter(); 11787c478bd9Sstevel@tonic-gate do { 11797c478bd9Sstevel@tonic-gate rc = read(keysock, buffer, buffer_size); 11807c478bd9Sstevel@tonic-gate if (rc == -1) 11817c478bd9Sstevel@tonic-gate Bail("read (in doaddresses)"); 11827c478bd9Sstevel@tonic-gate } while (msgp->sadb_msg_seq != seq || 11837c478bd9Sstevel@tonic-gate msgp->sadb_msg_pid != mypid); 11847c478bd9Sstevel@tonic-gate time_critical_exit(); 11857c478bd9Sstevel@tonic-gate 11867c478bd9Sstevel@tonic-gate if (msgp->sadb_msg_type != sadb_msg_type || 11877c478bd9Sstevel@tonic-gate msgp->sadb_msg_satype != sadb_msg_satype) { 11887c478bd9Sstevel@tonic-gate syslog((LOG_NOTICE|LOG_AUTH), gettext( 11897c478bd9Sstevel@tonic-gate "doaddresses: Unexpected returned message " 11907c478bd9Sstevel@tonic-gate "(%d exp %d)\n"), msgp->sadb_msg_type, 11917c478bd9Sstevel@tonic-gate sadb_msg_type); 11927c478bd9Sstevel@tonic-gate Bail("doaddresses: Unexpected returned " 11937c478bd9Sstevel@tonic-gate "message"); 11947c478bd9Sstevel@tonic-gate } 11957c478bd9Sstevel@tonic-gate 11967c478bd9Sstevel@tonic-gate errno = msgp->sadb_msg_errno; 11977c478bd9Sstevel@tonic-gate if (errno != 0) { 11987c478bd9Sstevel@tonic-gate if (errno == EINVAL) { 1199e3320f40Smarkfen WARN(ep, ebuf, gettext( 1200e3320f40Smarkfen "One of the entered " 1201e3320f40Smarkfen "values is incorrect.")); 12027c478bd9Sstevel@tonic-gate print_diagnostic(stderr, 12037c478bd9Sstevel@tonic-gate msgp->sadb_x_msg_diagnostic); 1204e3320f40Smarkfen } else { 1205e3320f40Smarkfen Bail("return message (in doaddresses)"); 12067c478bd9Sstevel@tonic-gate } 12077c478bd9Sstevel@tonic-gate } 12087c478bd9Sstevel@tonic-gate 12097c478bd9Sstevel@tonic-gate /* ...and then restore the saved buffer. */ 12107c478bd9Sstevel@tonic-gate msgp = (struct sadb_msg *)savebuf; 12117c478bd9Sstevel@tonic-gate bcopy(savebuf, buffer, SADB_64TO8(msgp->sadb_msg_len)); 12127c478bd9Sstevel@tonic-gate } while (srchp != NULL && srchp->h_addr_list[++i] != NULL); 12137c478bd9Sstevel@tonic-gate return; 12147c478bd9Sstevel@tonic-gate } 12157c478bd9Sstevel@tonic-gate 12167c478bd9Sstevel@tonic-gate single_dst = (dsthp == &dummy.he || dsthp->h_addr_list[1] == NULL); 12177c478bd9Sstevel@tonic-gate 12187c478bd9Sstevel@tonic-gate for (i = 0; dsthp->h_addr_list[i] != NULL; i++) { 12197c478bd9Sstevel@tonic-gate if (dsthp == &dummy.he) { 12207c478bd9Sstevel@tonic-gate /* Just to be sure... */ 12217c478bd9Sstevel@tonic-gate dsthp->h_addr_list[1] = NULL; 12227c478bd9Sstevel@tonic-gate } else { 12237c478bd9Sstevel@tonic-gate /* 12247c478bd9Sstevel@tonic-gate * Fill in the dst sockaddr. 12257c478bd9Sstevel@tonic-gate */ 12267c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(dst + 1); 12277c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6)); 12287c478bd9Sstevel@tonic-gate bcopy(dsthp->h_addr_list[i], &sin6->sin6_addr, 12297c478bd9Sstevel@tonic-gate sizeof (struct in6_addr)); 12307c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6; 12317c478bd9Sstevel@tonic-gate sin6->sin6_port = htons(dstport); 12327c478bd9Sstevel@tonic-gate } 12337c478bd9Sstevel@tonic-gate 12347c478bd9Sstevel@tonic-gate /* 12357c478bd9Sstevel@tonic-gate * Try and assign src, if there's any ambiguity. 12367c478bd9Sstevel@tonic-gate */ 12377c478bd9Sstevel@tonic-gate if (!unspec_src && srchp != &dummy.he) { 12387c478bd9Sstevel@tonic-gate if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 12397c478bd9Sstevel@tonic-gate /* 12407c478bd9Sstevel@tonic-gate * IPv4 address. Find an IPv4 address, then 12417c478bd9Sstevel@tonic-gate * keep looking for a second one. If a second 12427c478bd9Sstevel@tonic-gate * exists, print a message, and fill in the 12437c478bd9Sstevel@tonic-gate * unspecified address. 12447c478bd9Sstevel@tonic-gate */ 12457c478bd9Sstevel@tonic-gate first_match = NULL; 12467c478bd9Sstevel@tonic-gate 12477c478bd9Sstevel@tonic-gate for (walker = srchp->h_addr_list; 12487c478bd9Sstevel@tonic-gate *walker != NULL; walker++) { 12497c478bd9Sstevel@tonic-gate /* LINTED E_BAD_PTR_CAST_ALIGN */ 12507c478bd9Sstevel@tonic-gate if (IN6_IS_ADDR_V4MAPPED( 12517c478bd9Sstevel@tonic-gate (struct in6_addr *)*walker)) { 12527c478bd9Sstevel@tonic-gate if (first_match != NULL) 12537c478bd9Sstevel@tonic-gate break; 12547c478bd9Sstevel@tonic-gate else 12557c478bd9Sstevel@tonic-gate first_match = *walker; 12567c478bd9Sstevel@tonic-gate } 12577c478bd9Sstevel@tonic-gate } 12587c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(src + 1); 12597c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6)); 12607c478bd9Sstevel@tonic-gate 12617c478bd9Sstevel@tonic-gate if (first_match == NULL) { 12627c478bd9Sstevel@tonic-gate /* 12637c478bd9Sstevel@tonic-gate * No IPv4 hits. Is this a single 12647c478bd9Sstevel@tonic-gate * dest? 12657c478bd9Sstevel@tonic-gate */ 1266e3320f40Smarkfen WARN1(ep, ebuf, gettext( 12677c478bd9Sstevel@tonic-gate "No IPv4 source address " 1268e3320f40Smarkfen "for name %s.\n"), srchp->h_name); 12697c478bd9Sstevel@tonic-gate if (single_dst) { 1270e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1271e3320f40Smarkfen "Only single destination " 1272e3320f40Smarkfen "IP address.\n")); 12737c478bd9Sstevel@tonic-gate } else { 12747c478bd9Sstevel@tonic-gate /* Continue, but do I print? */ 12757c478bd9Sstevel@tonic-gate continue; /* for loop */ 12767c478bd9Sstevel@tonic-gate } 12777c478bd9Sstevel@tonic-gate 12787c478bd9Sstevel@tonic-gate /* I should never reach here. */ 12797c478bd9Sstevel@tonic-gate } 12807c478bd9Sstevel@tonic-gate 12817c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6; 12827c478bd9Sstevel@tonic-gate sin6->sin6_port = htons(srcport); 12837c478bd9Sstevel@tonic-gate if (*walker != NULL) { 12847c478bd9Sstevel@tonic-gate /* 12857c478bd9Sstevel@tonic-gate * Early loop exit. It must've been 12867c478bd9Sstevel@tonic-gate * multiple hits... 12877c478bd9Sstevel@tonic-gate * 12887c478bd9Sstevel@tonic-gate * Issue a null-source warning? 12897c478bd9Sstevel@tonic-gate */ 1290e3320f40Smarkfen WARN1(ep, ebuf, gettext( 12917c478bd9Sstevel@tonic-gate "Multiple IPv4 source addresses " 12927c478bd9Sstevel@tonic-gate "for %s, using unspecified source " 12937c478bd9Sstevel@tonic-gate "instead."), srchp->h_name); 12947c478bd9Sstevel@tonic-gate } else { 12957c478bd9Sstevel@tonic-gate /* 12967c478bd9Sstevel@tonic-gate * If I reach here w/o hitting the 12977c478bd9Sstevel@tonic-gate * previous if statements, I have a 12987c478bd9Sstevel@tonic-gate * single source address for this 12997c478bd9Sstevel@tonic-gate * destination. 13007c478bd9Sstevel@tonic-gate */ 13017c478bd9Sstevel@tonic-gate bcopy(first_match, &sin6->sin6_addr, 13027c478bd9Sstevel@tonic-gate sizeof (struct in6_addr)); 13037c478bd9Sstevel@tonic-gate } 13047c478bd9Sstevel@tonic-gate } else { 13057c478bd9Sstevel@tonic-gate /* 13067c478bd9Sstevel@tonic-gate * IPv6 address. Find an IPv6 address. 13077c478bd9Sstevel@tonic-gate * Unlike IPv4 addresses, things can get a 13087c478bd9Sstevel@tonic-gate * little more sticky with scopes, etc. 13097c478bd9Sstevel@tonic-gate */ 13107c478bd9Sstevel@tonic-gate int dst_scope, src_scope; 13117c478bd9Sstevel@tonic-gate 13127c478bd9Sstevel@tonic-gate dst_scope = ipv6_addr_scope(&sin6->sin6_addr); 13137c478bd9Sstevel@tonic-gate 13147c478bd9Sstevel@tonic-gate first_match = NULL; 13157c478bd9Sstevel@tonic-gate for (walker = srchp->h_addr_list; 13167c478bd9Sstevel@tonic-gate *walker != NULL; walker++) { 13177c478bd9Sstevel@tonic-gate /* LINTED E_BAD_PTR_CAST_ALIGN */ 13187c478bd9Sstevel@tonic-gate if (!IN6_IS_ADDR_V4MAPPED( 13197c478bd9Sstevel@tonic-gate (struct in6_addr *)*walker)) { 13207c478bd9Sstevel@tonic-gate /* 13217c478bd9Sstevel@tonic-gate * Set first-match, etc. 13227c478bd9Sstevel@tonic-gate * Take into account scopes, 13237c478bd9Sstevel@tonic-gate * and other IPv6 thingies. 13247c478bd9Sstevel@tonic-gate */ 13257c478bd9Sstevel@tonic-gate src_scope = ipv6_addr_scope( 13267c478bd9Sstevel@tonic-gate /* LINTED E_BAD_PTR_CAST */ 13277c478bd9Sstevel@tonic-gate (struct in6_addr *)*walker); 13287c478bd9Sstevel@tonic-gate if (src_scope == SCOPE_UNSPEC || 13297c478bd9Sstevel@tonic-gate src_scope == dst_scope) { 13307c478bd9Sstevel@tonic-gate if (first_match != 13317c478bd9Sstevel@tonic-gate NULL) 13327c478bd9Sstevel@tonic-gate break; 13337c478bd9Sstevel@tonic-gate else 13347c478bd9Sstevel@tonic-gate first_match = 13357c478bd9Sstevel@tonic-gate *walker; 13367c478bd9Sstevel@tonic-gate } 13377c478bd9Sstevel@tonic-gate } 13387c478bd9Sstevel@tonic-gate } 13397c478bd9Sstevel@tonic-gate 13407c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(src + 1); 13417c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6)); 13427c478bd9Sstevel@tonic-gate sin6->sin6_port = htons(srcport); 13437c478bd9Sstevel@tonic-gate if (first_match == NULL) { 13447c478bd9Sstevel@tonic-gate /* 13457c478bd9Sstevel@tonic-gate * No IPv6 hits. Is this a single 13467c478bd9Sstevel@tonic-gate * dest? 13477c478bd9Sstevel@tonic-gate */ 1348e3320f40Smarkfen WARN1(ep, ebuf, gettext( 13497c478bd9Sstevel@tonic-gate "No IPv6 source address of " 1350e3320f40Smarkfen "matching scope for name %s.\n"), 13517c478bd9Sstevel@tonic-gate srchp->h_name); 13527c478bd9Sstevel@tonic-gate if (single_dst) { 1353e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1354e3320f40Smarkfen "Only a single IPV6 " 1355e3320f40Smarkfen "destination " 1356e3320f40Smarkfen "address.\n")); 13577c478bd9Sstevel@tonic-gate } else { 13587c478bd9Sstevel@tonic-gate /* Continue, but do I print? */ 13597c478bd9Sstevel@tonic-gate continue; /* for loop */ 13607c478bd9Sstevel@tonic-gate } 13617c478bd9Sstevel@tonic-gate 13627c478bd9Sstevel@tonic-gate /* I should never reach here. */ 13637c478bd9Sstevel@tonic-gate } 13647c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6; 13657c478bd9Sstevel@tonic-gate if (*walker != NULL) { 13667c478bd9Sstevel@tonic-gate /* 13677c478bd9Sstevel@tonic-gate * Early loop exit. Issue a 13687c478bd9Sstevel@tonic-gate * null-source warning? 13697c478bd9Sstevel@tonic-gate */ 1370e3320f40Smarkfen WARN1(ep, ebuf, gettext( 13717c478bd9Sstevel@tonic-gate "Multiple IPv6 source addresses " 13727c478bd9Sstevel@tonic-gate "for %s of the same scope, using " 1373e3320f40Smarkfen "unspecified source instead.\n"), 13747c478bd9Sstevel@tonic-gate srchp->h_name); 13757c478bd9Sstevel@tonic-gate } else { 13767c478bd9Sstevel@tonic-gate /* 13777c478bd9Sstevel@tonic-gate * If I reach here w/o hitting the 13787c478bd9Sstevel@tonic-gate * previous if statements, I have a 13797c478bd9Sstevel@tonic-gate * single source address for this 13807c478bd9Sstevel@tonic-gate * destination. 13817c478bd9Sstevel@tonic-gate */ 13827c478bd9Sstevel@tonic-gate bcopy(first_match, &sin6->sin6_addr, 13837c478bd9Sstevel@tonic-gate sizeof (struct in6_addr)); 13847c478bd9Sstevel@tonic-gate } 13857c478bd9Sstevel@tonic-gate } 13867c478bd9Sstevel@tonic-gate } 13877c478bd9Sstevel@tonic-gate 1388e3320f40Smarkfen /* 1389e3320f40Smarkfen * If there are errors at this point there is no 1390e3320f40Smarkfen * point sending anything to PF_KEY. 1391e3320f40Smarkfen */ 1392e3320f40Smarkfen handle_errors(ep, ebuf, B_TRUE, B_FALSE); 1393e3320f40Smarkfen 13947c478bd9Sstevel@tonic-gate /* Save off a copy for later writing... */ 13957c478bd9Sstevel@tonic-gate msgp = (struct sadb_msg *)buffer; 13967c478bd9Sstevel@tonic-gate bcopy(buffer, savebuf, SADB_64TO8(msgp->sadb_msg_len)); 13977c478bd9Sstevel@tonic-gate 13987c478bd9Sstevel@tonic-gate rc = key_write(keysock, buffer, SADB_64TO8(msgp->sadb_msg_len)); 13997c478bd9Sstevel@tonic-gate if (rc == -1) 14007c478bd9Sstevel@tonic-gate Bail("write() to PF_KEY socket (in doaddresses)"); 14017c478bd9Sstevel@tonic-gate 14027c478bd9Sstevel@tonic-gate /* Blank the key for paranoia's sake. */ 14037c478bd9Sstevel@tonic-gate bzero(buffer, buffer_size); 14047c478bd9Sstevel@tonic-gate time_critical_enter(); 14057c478bd9Sstevel@tonic-gate do { 14067c478bd9Sstevel@tonic-gate rc = read(keysock, buffer, buffer_size); 14077c478bd9Sstevel@tonic-gate if (rc == -1) 14087c478bd9Sstevel@tonic-gate Bail("read (in doaddresses)"); 14097c478bd9Sstevel@tonic-gate } while (msgp->sadb_msg_seq != seq || 14107c478bd9Sstevel@tonic-gate msgp->sadb_msg_pid != mypid); 14117c478bd9Sstevel@tonic-gate time_critical_exit(); 14127c478bd9Sstevel@tonic-gate 14137c478bd9Sstevel@tonic-gate /* 14147c478bd9Sstevel@tonic-gate * I should _never_ hit the following unless: 14157c478bd9Sstevel@tonic-gate * 14167c478bd9Sstevel@tonic-gate * 1. There is a kernel bug. 14177c478bd9Sstevel@tonic-gate * 2. Another process is mistakenly using my pid in a PF_KEY 14187c478bd9Sstevel@tonic-gate * message. 14197c478bd9Sstevel@tonic-gate */ 14207c478bd9Sstevel@tonic-gate if (msgp->sadb_msg_type != sadb_msg_type || 14217c478bd9Sstevel@tonic-gate msgp->sadb_msg_satype != sadb_msg_satype) { 14227c478bd9Sstevel@tonic-gate syslog((LOG_NOTICE|LOG_AUTH), gettext( 14237c478bd9Sstevel@tonic-gate "doaddresses: Unexpected returned message " 14247c478bd9Sstevel@tonic-gate "(%d exp %d)\n"), msgp->sadb_msg_type, 14257c478bd9Sstevel@tonic-gate sadb_msg_type); 14267c478bd9Sstevel@tonic-gate Bail("doaddresses: Unexpected returned message"); 14277c478bd9Sstevel@tonic-gate } 14287c478bd9Sstevel@tonic-gate 14297c478bd9Sstevel@tonic-gate if (msgp->sadb_msg_errno != 0) { 14307c478bd9Sstevel@tonic-gate char addrprint[INET6_ADDRSTRLEN]; 14317c478bd9Sstevel@tonic-gate int on_errno = 0; 14327c478bd9Sstevel@tonic-gate char *on_errno_msg; 14337c478bd9Sstevel@tonic-gate 14347c478bd9Sstevel@tonic-gate /* 14357c478bd9Sstevel@tonic-gate * Print different error messages depending 14367c478bd9Sstevel@tonic-gate * on the SADB message type being processed. 14377c478bd9Sstevel@tonic-gate * If we get a ESRCH error for a GET/DELETE 14387c478bd9Sstevel@tonic-gate * messages, we report that the SA does not 14397c478bd9Sstevel@tonic-gate * exist. If we get a EEXIST error for a 14407c478bd9Sstevel@tonic-gate * ADD/UPDATE message, we report that the 14417c478bd9Sstevel@tonic-gate * SA already exists. 14427c478bd9Sstevel@tonic-gate */ 14437c478bd9Sstevel@tonic-gate if (sadb_msg_type == SADB_GET || 14447c478bd9Sstevel@tonic-gate sadb_msg_type == SADB_DELETE) { 14457c478bd9Sstevel@tonic-gate on_errno = ESRCH; 14467c478bd9Sstevel@tonic-gate on_errno_msg = "does not exist"; 14477c478bd9Sstevel@tonic-gate } else if (sadb_msg_type == SADB_ADD || 14487c478bd9Sstevel@tonic-gate sadb_msg_type == SADB_UPDATE) { 14497c478bd9Sstevel@tonic-gate on_errno = EEXIST; 14507c478bd9Sstevel@tonic-gate on_errno_msg = "already exists"; 14517c478bd9Sstevel@tonic-gate } 14527c478bd9Sstevel@tonic-gate 14537c478bd9Sstevel@tonic-gate errno = msgp->sadb_msg_errno; 14547c478bd9Sstevel@tonic-gate if (errno == on_errno) { 1455e3320f40Smarkfen ERROR2(ep, ebuf, gettext( 1456e3320f40Smarkfen "Association (type = %s) " 1457e3320f40Smarkfen "with spi 0x%x and addr\n"), 14587c478bd9Sstevel@tonic-gate rparsesatype(msgp->sadb_msg_satype), 1459e3320f40Smarkfen ntohl(spi)); 1460e3320f40Smarkfen ERROR2(ep, ebuf, "%s %s.\n", 14617c478bd9Sstevel@tonic-gate do_inet_ntop(dsthp->h_addr_list[i], 146225e435e0Spwernau addrprint, sizeof (addrprint)), 14637c478bd9Sstevel@tonic-gate on_errno_msg); 14647c478bd9Sstevel@tonic-gate msgp = (struct sadb_msg *)savebuf; 14657c478bd9Sstevel@tonic-gate bcopy(savebuf, buffer, 14667c478bd9Sstevel@tonic-gate SADB_64TO8(msgp->sadb_msg_len)); 14677c478bd9Sstevel@tonic-gate continue; 14687c478bd9Sstevel@tonic-gate } else { 14697c478bd9Sstevel@tonic-gate if (errno == EINVAL) { 1470e3320f40Smarkfen ERROR2(ep, ebuf, gettext( 1471e3320f40Smarkfen "PF_KEY Diagnostic code %u: %s.\n"), 1472e3320f40Smarkfen msgp->sadb_x_msg_diagnostic, 1473e3320f40Smarkfen keysock_diag( 1474e3320f40Smarkfen msgp->sadb_x_msg_diagnostic)); 1475e3320f40Smarkfen } else { 1476e3320f40Smarkfen Bail("return message (in doaddresses)"); 14777c478bd9Sstevel@tonic-gate } 14787c478bd9Sstevel@tonic-gate } 14797c478bd9Sstevel@tonic-gate } 1480e3320f40Smarkfen 14817c478bd9Sstevel@tonic-gate if (cmd == CMD_GET) { 14828810c16bSdanmcd if (msgp->sadb_msg_len > MAX_GET_SIZE) { 1483e3320f40Smarkfen WARN1(ep, ebuf, gettext("WARNING: " 1484e3320f40Smarkfen "SA information bigger than %d bytes.\n"), 14858810c16bSdanmcd SADB_64TO8(MAX_GET_SIZE)); 14867c478bd9Sstevel@tonic-gate } 14878810c16bSdanmcd print_samsg(buffer, B_FALSE, vflag); 14887c478bd9Sstevel@tonic-gate } 14897c478bd9Sstevel@tonic-gate 1490e3320f40Smarkfen handle_errors(ep, ebuf, B_TRUE, B_FALSE); 1491e3320f40Smarkfen 14927c478bd9Sstevel@tonic-gate /* ...and then restore the saved buffer. */ 14937c478bd9Sstevel@tonic-gate msgp = (struct sadb_msg *)savebuf; 14947c478bd9Sstevel@tonic-gate bcopy(savebuf, buffer, SADB_64TO8(msgp->sadb_msg_len)); 1495e3320f40Smarkfen lines_added++; 14967c478bd9Sstevel@tonic-gate } 14977c478bd9Sstevel@tonic-gate 14987c478bd9Sstevel@tonic-gate /* Degenerate case, h_addr_list[0] == NULL. */ 14997c478bd9Sstevel@tonic-gate if (i == 0) 15007c478bd9Sstevel@tonic-gate Bail("Empty destination address list"); 1501e3320f40Smarkfen 1502e3320f40Smarkfen /* 1503e3320f40Smarkfen * free(ebuf) even if there are no errors. 1504e3320f40Smarkfen * handle_errors() won't return here. 1505e3320f40Smarkfen */ 1506e3320f40Smarkfen handle_errors(ep, ebuf, B_TRUE, B_TRUE); 15077c478bd9Sstevel@tonic-gate } 15087c478bd9Sstevel@tonic-gate 15097c478bd9Sstevel@tonic-gate /* 15107c478bd9Sstevel@tonic-gate * Perform an add or an update. ADD and UPDATE are similar in the extensions 15117c478bd9Sstevel@tonic-gate * they need. 15127c478bd9Sstevel@tonic-gate */ 15137c478bd9Sstevel@tonic-gate static void 1514e3320f40Smarkfen doaddup(int cmd, int satype, char *argv[], char *ebuf) 15157c478bd9Sstevel@tonic-gate { 15167c478bd9Sstevel@tonic-gate uint64_t *buffer, *nexthdr; 15177c478bd9Sstevel@tonic-gate struct sadb_msg msg; 15187c478bd9Sstevel@tonic-gate struct sadb_sa *assoc = NULL; 15198810c16bSdanmcd struct sadb_address *src = NULL, *dst = NULL; 15208810c16bSdanmcd struct sadb_address *isrc = NULL, *idst = NULL; 15217c478bd9Sstevel@tonic-gate struct sadb_address *natt_local = NULL, *natt_remote = NULL; 15227c478bd9Sstevel@tonic-gate struct sadb_key *encrypt = NULL, *auth = NULL; 15237c478bd9Sstevel@tonic-gate struct sadb_ident *srcid = NULL, *dstid = NULL; 15247c478bd9Sstevel@tonic-gate struct sadb_lifetime *hard = NULL, *soft = NULL; /* Current? */ 15257c478bd9Sstevel@tonic-gate struct sockaddr_in6 *sin6; 15267c478bd9Sstevel@tonic-gate /* MLS TODO: Need sensitivity eventually. */ 15278810c16bSdanmcd int next, token, sa_len, alloclen, totallen = sizeof (msg), prefix; 15287c478bd9Sstevel@tonic-gate uint32_t spi; 15298810c16bSdanmcd char *thiscmd, *pstr; 15308810c16bSdanmcd boolean_t readstate = B_FALSE, unspec_src = B_FALSE; 15318810c16bSdanmcd boolean_t alloc_inner = B_FALSE, use_natt = B_FALSE; 15328810c16bSdanmcd struct hostent *srchp = NULL, *dsthp = NULL, *isrchp = NULL, 15338810c16bSdanmcd *idsthp = NULL; 15347c478bd9Sstevel@tonic-gate struct hostent *natt_lhp = NULL, *natt_rhp = NULL; 15358810c16bSdanmcd uint16_t srcport = 0, dstport = 0, natt_lport = 0, natt_rport = 0, 15368810c16bSdanmcd isrcport = 0, idstport = 0; 15378810c16bSdanmcd uint8_t proto = 0, iproto = 0; 1538e3320f40Smarkfen char *ep = NULL; 15397c478bd9Sstevel@tonic-gate 15407c478bd9Sstevel@tonic-gate thiscmd = (cmd == CMD_ADD) ? "add" : "update"; 15417c478bd9Sstevel@tonic-gate 15427c478bd9Sstevel@tonic-gate msg_init(&msg, ((cmd == CMD_ADD) ? SADB_ADD : SADB_UPDATE), 15437c478bd9Sstevel@tonic-gate (uint8_t)satype); 15447c478bd9Sstevel@tonic-gate 15457c478bd9Sstevel@tonic-gate /* Assume last element in argv is set to NULL. */ 15467c478bd9Sstevel@tonic-gate do { 15477c478bd9Sstevel@tonic-gate token = parseextval(*argv, &next); 15487c478bd9Sstevel@tonic-gate argv++; 15497c478bd9Sstevel@tonic-gate switch (token) { 15507c478bd9Sstevel@tonic-gate case TOK_EOF: 15517c478bd9Sstevel@tonic-gate /* Do nothing, I'm done. */ 15527c478bd9Sstevel@tonic-gate break; 15537c478bd9Sstevel@tonic-gate case TOK_UNKNOWN: 1554e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 1555e3320f40Smarkfen "Unknown extension field \"%s\" \n"), *(argv - 1)); 15567c478bd9Sstevel@tonic-gate break; 15577c478bd9Sstevel@tonic-gate case TOK_SPI: 15587c478bd9Sstevel@tonic-gate case TOK_REPLAY: 15597c478bd9Sstevel@tonic-gate case TOK_STATE: 15607c478bd9Sstevel@tonic-gate case TOK_AUTHALG: 15617c478bd9Sstevel@tonic-gate case TOK_ENCRALG: 15627c478bd9Sstevel@tonic-gate case TOK_ENCAP: 15637c478bd9Sstevel@tonic-gate /* 15647c478bd9Sstevel@tonic-gate * May want to place this chunk of code in a function. 15657c478bd9Sstevel@tonic-gate * 15667c478bd9Sstevel@tonic-gate * This code checks for duplicate entries on a command 15677c478bd9Sstevel@tonic-gate * line. 15687c478bd9Sstevel@tonic-gate */ 15697c478bd9Sstevel@tonic-gate 15707c478bd9Sstevel@tonic-gate /* Allocate the SADB_EXT_SA extension. */ 15717c478bd9Sstevel@tonic-gate if (assoc == NULL) { 15727c478bd9Sstevel@tonic-gate assoc = malloc(sizeof (*assoc)); 15737c478bd9Sstevel@tonic-gate if (assoc == NULL) 15747c478bd9Sstevel@tonic-gate Bail("malloc(assoc)"); 15757c478bd9Sstevel@tonic-gate bzero(assoc, sizeof (*assoc)); 15767c478bd9Sstevel@tonic-gate assoc->sadb_sa_exttype = SADB_EXT_SA; 15777c478bd9Sstevel@tonic-gate assoc->sadb_sa_len = 15787c478bd9Sstevel@tonic-gate SADB_8TO64(sizeof (*assoc)); 15797c478bd9Sstevel@tonic-gate totallen += sizeof (*assoc); 15807c478bd9Sstevel@tonic-gate } 15817c478bd9Sstevel@tonic-gate switch (token) { 15827c478bd9Sstevel@tonic-gate case TOK_SPI: 15837c478bd9Sstevel@tonic-gate /* 15847c478bd9Sstevel@tonic-gate * If some cretin types in "spi 0" then he/she 15857c478bd9Sstevel@tonic-gate * can type in another SPI. 15867c478bd9Sstevel@tonic-gate */ 15877c478bd9Sstevel@tonic-gate if (assoc->sadb_sa_spi != 0) { 1588e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1589e3320f40Smarkfen "Can only specify " 1590e3320f40Smarkfen "single SPI value.\n")); 1591e3320f40Smarkfen break; 15927c478bd9Sstevel@tonic-gate } 15937c478bd9Sstevel@tonic-gate /* Must convert SPI to network order! */ 15947c478bd9Sstevel@tonic-gate assoc->sadb_sa_spi = 1595e3320f40Smarkfen htonl((uint32_t)parsenum(*argv, B_TRUE, 1596e3320f40Smarkfen ebuf)); 1597e3320f40Smarkfen if (assoc->sadb_sa_spi == 0) { 1598e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1599e3320f40Smarkfen "Invalid SPI value \"0\" .\n")); 1600e3320f40Smarkfen } 16017c478bd9Sstevel@tonic-gate break; 16027c478bd9Sstevel@tonic-gate case TOK_REPLAY: 16037c478bd9Sstevel@tonic-gate /* 16047c478bd9Sstevel@tonic-gate * That same cretin can do the same with 16057c478bd9Sstevel@tonic-gate * replay. 16067c478bd9Sstevel@tonic-gate */ 16077c478bd9Sstevel@tonic-gate if (assoc->sadb_sa_replay != 0) { 1608e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1609e3320f40Smarkfen "Can only specify " 1610e3320f40Smarkfen "single replay window size.\n")); 1611e3320f40Smarkfen break; 16127c478bd9Sstevel@tonic-gate } 16137c478bd9Sstevel@tonic-gate assoc->sadb_sa_replay = 1614e3320f40Smarkfen (uint8_t)parsenum(*argv, B_TRUE, ebuf); 16157c478bd9Sstevel@tonic-gate if (assoc->sadb_sa_replay != 0) { 1616e3320f40Smarkfen WARN(ep, ebuf, gettext( 16177c478bd9Sstevel@tonic-gate "WARNING: Replay with manual" 1618e3320f40Smarkfen " keying considered harmful.\n")); 16197c478bd9Sstevel@tonic-gate } 16207c478bd9Sstevel@tonic-gate break; 16217c478bd9Sstevel@tonic-gate case TOK_STATE: 16227c478bd9Sstevel@tonic-gate /* 16237c478bd9Sstevel@tonic-gate * 0 is an actual state value, LARVAL. This 16247c478bd9Sstevel@tonic-gate * means that one can type in the larval state 16257c478bd9Sstevel@tonic-gate * and then type in another state on the same 16267c478bd9Sstevel@tonic-gate * command line. 16277c478bd9Sstevel@tonic-gate */ 16287c478bd9Sstevel@tonic-gate if (assoc->sadb_sa_state != 0) { 1629e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1630e3320f40Smarkfen "Can only specify " 1631e3320f40Smarkfen "single SA state.\n")); 1632e3320f40Smarkfen break; 16337c478bd9Sstevel@tonic-gate } 1634e3320f40Smarkfen assoc->sadb_sa_state = parsestate(*argv, 1635e3320f40Smarkfen ebuf); 16367c478bd9Sstevel@tonic-gate readstate = B_TRUE; 16377c478bd9Sstevel@tonic-gate break; 16387c478bd9Sstevel@tonic-gate case TOK_AUTHALG: 16397c478bd9Sstevel@tonic-gate if (assoc->sadb_sa_auth != 0) { 1640e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1641e3320f40Smarkfen "Can only specify " 1642e3320f40Smarkfen "single auth algorithm.\n")); 1643e3320f40Smarkfen break; 16447c478bd9Sstevel@tonic-gate } 16457c478bd9Sstevel@tonic-gate assoc->sadb_sa_auth = parsealg(*argv, 1646e3320f40Smarkfen IPSEC_PROTO_AH, ebuf); 16477c478bd9Sstevel@tonic-gate break; 16487c478bd9Sstevel@tonic-gate case TOK_ENCRALG: 16498810c16bSdanmcd if (satype == SADB_SATYPE_AH) { 1650e3320f40Smarkfen ERROR(ep, ebuf, gettext("Cannot specify" 1651e3320f40Smarkfen " encryption with SA type ah.\n")); 1652e3320f40Smarkfen break; 16538810c16bSdanmcd } 16547c478bd9Sstevel@tonic-gate if (assoc->sadb_sa_encrypt != 0) { 1655e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1656e3320f40Smarkfen "Can only specify " 1657e3320f40Smarkfen "single encryption algorithm.\n")); 1658e3320f40Smarkfen break; 16597c478bd9Sstevel@tonic-gate } 16607c478bd9Sstevel@tonic-gate assoc->sadb_sa_encrypt = parsealg(*argv, 1661e3320f40Smarkfen IPSEC_PROTO_ESP, ebuf); 16627c478bd9Sstevel@tonic-gate break; 16637c478bd9Sstevel@tonic-gate case TOK_ENCAP: 16647c478bd9Sstevel@tonic-gate if (use_natt) { 1665e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1666e3320f40Smarkfen "Can only specify single" 1667e3320f40Smarkfen " encapsulation.\n")); 1668e3320f40Smarkfen break; 16697c478bd9Sstevel@tonic-gate } 16707c478bd9Sstevel@tonic-gate if (strncmp(*argv, "udp", 3)) { 1671e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1672e3320f40Smarkfen "Can only specify udp" 1673e3320f40Smarkfen " encapsulation.\n")); 1674e3320f40Smarkfen break; 16757c478bd9Sstevel@tonic-gate } 16767c478bd9Sstevel@tonic-gate use_natt = B_TRUE; 16777c478bd9Sstevel@tonic-gate /* set assoc flags later */ 16787c478bd9Sstevel@tonic-gate break; 16797c478bd9Sstevel@tonic-gate } 16807c478bd9Sstevel@tonic-gate argv++; 16817c478bd9Sstevel@tonic-gate break; 16827c478bd9Sstevel@tonic-gate case TOK_SRCPORT: 16837c478bd9Sstevel@tonic-gate if (srcport != 0) { 1684e3320f40Smarkfen ERROR(ep, ebuf, gettext("Can only specify " 1685e3320f40Smarkfen "single source port.\n")); 1686e3320f40Smarkfen break; 16877c478bd9Sstevel@tonic-gate } 1688e3320f40Smarkfen srcport = parsenum(*argv, B_TRUE, ebuf); 16897c478bd9Sstevel@tonic-gate argv++; 16907c478bd9Sstevel@tonic-gate break; 16917c478bd9Sstevel@tonic-gate case TOK_DSTPORT: 16927c478bd9Sstevel@tonic-gate if (dstport != 0) { 1693e3320f40Smarkfen ERROR(ep, ebuf, gettext("Can only specify " 1694e3320f40Smarkfen "single destination port.\n")); 1695e3320f40Smarkfen break; 16967c478bd9Sstevel@tonic-gate } 1697e3320f40Smarkfen dstport = parsenum(*argv, B_TRUE, ebuf); 16987c478bd9Sstevel@tonic-gate argv++; 16997c478bd9Sstevel@tonic-gate break; 17008810c16bSdanmcd case TOK_ISRCPORT: 17018810c16bSdanmcd alloc_inner = B_TRUE; 17028810c16bSdanmcd if (isrcport != 0) { 1703e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1704e3320f40Smarkfen "Can only specify " 1705e3320f40Smarkfen "single inner-source port.\n")); 1706e3320f40Smarkfen break; 17078810c16bSdanmcd } 1708e3320f40Smarkfen isrcport = parsenum(*argv, B_TRUE, ebuf); 17098810c16bSdanmcd argv++; 17108810c16bSdanmcd break; 17118810c16bSdanmcd case TOK_IDSTPORT: 17128810c16bSdanmcd alloc_inner = B_TRUE; 17138810c16bSdanmcd if (idstport != 0) { 1714e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1715e3320f40Smarkfen "Can only specify " 1716e3320f40Smarkfen "single inner-destination port.\n")); 1717e3320f40Smarkfen break; 17188810c16bSdanmcd } 1719e3320f40Smarkfen idstport = parsenum(*argv, B_TRUE, ebuf); 17208810c16bSdanmcd argv++; 17218810c16bSdanmcd break; 17227c478bd9Sstevel@tonic-gate case TOK_NATLPORT: 17237c478bd9Sstevel@tonic-gate if (natt_lport != 0) { 1724e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1725e3320f40Smarkfen "Can only specify " 1726e3320f40Smarkfen "single NAT-T local port.\n")); 1727e3320f40Smarkfen break; 17287c478bd9Sstevel@tonic-gate } 17297c478bd9Sstevel@tonic-gate 17307c478bd9Sstevel@tonic-gate if (natt_rport != 0) { 1731e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1732e3320f40Smarkfen "Can only specify " 1733e3320f40Smarkfen "one of NAT-T remote and local port.\n")); 1734e3320f40Smarkfen break; 17357c478bd9Sstevel@tonic-gate } 1736e3320f40Smarkfen natt_lport = parsenum(*argv, B_TRUE, ebuf); 17377c478bd9Sstevel@tonic-gate argv++; 17387c478bd9Sstevel@tonic-gate break; 17397c478bd9Sstevel@tonic-gate case TOK_NATRPORT: 17407c478bd9Sstevel@tonic-gate if (natt_rport != 0) { 1741e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1742e3320f40Smarkfen "Can only specify " 1743e3320f40Smarkfen "single NAT-T remote port.\n")); 1744e3320f40Smarkfen break; 17457c478bd9Sstevel@tonic-gate } 17467c478bd9Sstevel@tonic-gate 17477c478bd9Sstevel@tonic-gate if (natt_lport != 0) { 1748e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1749e3320f40Smarkfen "Can only specify " 1750e3320f40Smarkfen "one of NAT-T remote and local port.\n")); 1751e3320f40Smarkfen break; 17527c478bd9Sstevel@tonic-gate } 1753e3320f40Smarkfen natt_rport = parsenum(*argv, B_TRUE, ebuf); 17547c478bd9Sstevel@tonic-gate argv++; 17557c478bd9Sstevel@tonic-gate break; 17567c478bd9Sstevel@tonic-gate 17577c478bd9Sstevel@tonic-gate case TOK_PROTO: 17587c478bd9Sstevel@tonic-gate if (proto != 0) { 1759e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1760e3320f40Smarkfen "Can only specify " 1761e3320f40Smarkfen "single protocol.\n")); 1762e3320f40Smarkfen break; 17637c478bd9Sstevel@tonic-gate } 1764e3320f40Smarkfen proto = parsenum(*argv, B_TRUE, ebuf); 17657c478bd9Sstevel@tonic-gate argv++; 17667c478bd9Sstevel@tonic-gate break; 17678810c16bSdanmcd case TOK_IPROTO: 17688810c16bSdanmcd alloc_inner = B_TRUE; 17698810c16bSdanmcd if (iproto != 0) { 1770e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1771e3320f40Smarkfen "Can only specify " 1772e3320f40Smarkfen "single inner protocol.\n")); 1773e3320f40Smarkfen break; 17748810c16bSdanmcd } 1775e3320f40Smarkfen iproto = parsenum(*argv, B_TRUE, ebuf); 17768810c16bSdanmcd argv++; 17778810c16bSdanmcd break; 17787c478bd9Sstevel@tonic-gate case TOK_SRCADDR: 17797c478bd9Sstevel@tonic-gate case TOK_SRCADDR6: 17807c478bd9Sstevel@tonic-gate if (src != NULL) { 1781e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1782e3320f40Smarkfen "Can only specify " 1783e3320f40Smarkfen "single source address.\n")); 1784e3320f40Smarkfen break; 17857c478bd9Sstevel@tonic-gate } 17867c478bd9Sstevel@tonic-gate sa_len = parseaddr(*argv, &srchp, 1787e3320f40Smarkfen (token == TOK_SRCADDR6), ebuf); 1788e3320f40Smarkfen if (srchp == NULL) { 1789e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 1790e3320f40Smarkfen "Unknown src address \"%s\"\n"), *argv); 1791e3320f40Smarkfen break; 1792e3320f40Smarkfen } 17937c478bd9Sstevel@tonic-gate argv++; 17947c478bd9Sstevel@tonic-gate /* 17957c478bd9Sstevel@tonic-gate * Round of the sockaddr length to an 8 byte 17967c478bd9Sstevel@tonic-gate * boundary to make PF_KEY happy. 17977c478bd9Sstevel@tonic-gate */ 17987c478bd9Sstevel@tonic-gate alloclen = sizeof (*src) + roundup(sa_len, 8); 17997c478bd9Sstevel@tonic-gate src = malloc(alloclen); 18007c478bd9Sstevel@tonic-gate if (src == NULL) 18017c478bd9Sstevel@tonic-gate Bail("malloc(src)"); 18027c478bd9Sstevel@tonic-gate totallen += alloclen; 18037c478bd9Sstevel@tonic-gate src->sadb_address_len = SADB_8TO64(alloclen); 18047c478bd9Sstevel@tonic-gate src->sadb_address_exttype = SADB_EXT_ADDRESS_SRC; 18057c478bd9Sstevel@tonic-gate src->sadb_address_reserved = 0; 18067c478bd9Sstevel@tonic-gate src->sadb_address_prefixlen = 0; 18077c478bd9Sstevel@tonic-gate src->sadb_address_proto = 0; 18087c478bd9Sstevel@tonic-gate if (srchp == &dummy.he) { 18097c478bd9Sstevel@tonic-gate /* 18107c478bd9Sstevel@tonic-gate * Single address with -n flag. 18117c478bd9Sstevel@tonic-gate */ 18127c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(src + 1); 18137c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6)); 18147c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6; 18157c478bd9Sstevel@tonic-gate bcopy(srchp->h_addr_list[0], &sin6->sin6_addr, 18167c478bd9Sstevel@tonic-gate sizeof (struct in6_addr)); 18177c478bd9Sstevel@tonic-gate } 18187c478bd9Sstevel@tonic-gate break; 18197c478bd9Sstevel@tonic-gate case TOK_DSTADDR: 18207c478bd9Sstevel@tonic-gate case TOK_DSTADDR6: 18217c478bd9Sstevel@tonic-gate if (dst != NULL) { 1822e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1823e3320f40Smarkfen "Can only specify single " 1824e3320f40Smarkfen "destination address.\n")); 1825e3320f40Smarkfen break; 18267c478bd9Sstevel@tonic-gate } 18277c478bd9Sstevel@tonic-gate sa_len = parseaddr(*argv, &dsthp, 1828e3320f40Smarkfen (token == TOK_DSTADDR6), ebuf); 1829e3320f40Smarkfen if (dsthp == NULL) { 1830e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 1831e3320f40Smarkfen "Unknown dst address \"%s\"\n"), *argv); 1832e3320f40Smarkfen break; 1833e3320f40Smarkfen } 18347c478bd9Sstevel@tonic-gate argv++; 18357c478bd9Sstevel@tonic-gate alloclen = sizeof (*dst) + roundup(sa_len, 8); 18367c478bd9Sstevel@tonic-gate dst = malloc(alloclen); 18377c478bd9Sstevel@tonic-gate if (dst == NULL) 18387c478bd9Sstevel@tonic-gate Bail("malloc(dst)"); 18397c478bd9Sstevel@tonic-gate totallen += alloclen; 18407c478bd9Sstevel@tonic-gate dst->sadb_address_len = SADB_8TO64(alloclen); 18417c478bd9Sstevel@tonic-gate dst->sadb_address_exttype = SADB_EXT_ADDRESS_DST; 18427c478bd9Sstevel@tonic-gate dst->sadb_address_reserved = 0; 18437c478bd9Sstevel@tonic-gate dst->sadb_address_prefixlen = 0; 18447c478bd9Sstevel@tonic-gate dst->sadb_address_proto = 0; 18457c478bd9Sstevel@tonic-gate if (dsthp == &dummy.he) { 18467c478bd9Sstevel@tonic-gate /* 18477c478bd9Sstevel@tonic-gate * Single address with -n flag. 18487c478bd9Sstevel@tonic-gate */ 18497c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(dst + 1); 18507c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6)); 18517c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6; 18527c478bd9Sstevel@tonic-gate bcopy(dsthp->h_addr_list[0], &sin6->sin6_addr, 18537c478bd9Sstevel@tonic-gate sizeof (struct in6_addr)); 18547c478bd9Sstevel@tonic-gate } 18557c478bd9Sstevel@tonic-gate break; 18567c478bd9Sstevel@tonic-gate case TOK_PROXYADDR: 18577c478bd9Sstevel@tonic-gate case TOK_PROXYADDR6: 18588810c16bSdanmcd if (isrc != NULL) { 1859e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1860e3320f40Smarkfen "Can only specify single " 1861e3320f40Smarkfen "proxy/inner-source address.\n")); 1862e3320f40Smarkfen break; 18637c478bd9Sstevel@tonic-gate } 18648810c16bSdanmcd if ((pstr = strchr(*argv, '/')) != NULL) { 18658810c16bSdanmcd /* Parse out the prefix. */ 18668810c16bSdanmcd errno = 0; 18678810c16bSdanmcd prefix = strtol(pstr + 1, NULL, 10); 18688810c16bSdanmcd if (errno != 0) { 1869e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 1870e3320f40Smarkfen "Invalid prefix %s."), pstr); 1871e3320f40Smarkfen break; 18728810c16bSdanmcd } 18738810c16bSdanmcd /* Recycle pstr */ 18748810c16bSdanmcd alloclen = (int)(pstr - *argv); 18758810c16bSdanmcd pstr = malloc(alloclen + 1); 18768810c16bSdanmcd if (pstr == NULL) { 18778810c16bSdanmcd Bail("malloc(pstr)"); 18788810c16bSdanmcd } 18798810c16bSdanmcd (void) strlcpy(pstr, *argv, alloclen + 1); 18808810c16bSdanmcd } else { 18818810c16bSdanmcd pstr = *argv; 18828810c16bSdanmcd /* 18838810c16bSdanmcd * Assume mapping to AF_INET6, and we're a host. 18848810c16bSdanmcd * XXX some miscreants may still make classful 18858810c16bSdanmcd * assumptions. If this is a problem, fix it 18868810c16bSdanmcd * here. 18878810c16bSdanmcd */ 18888810c16bSdanmcd prefix = 128; 18898810c16bSdanmcd } 18908810c16bSdanmcd sa_len = parseaddr(pstr, &isrchp, 1891e3320f40Smarkfen (token == TOK_PROXYADDR6), ebuf); 1892e3320f40Smarkfen if (isrchp == NULL) { 1893e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 1894e3320f40Smarkfen "Unknown proxy/inner-source address " 1895e3320f40Smarkfen "\"%s\"\n"), *argv); 1896e3320f40Smarkfen break; 1897e3320f40Smarkfen } 18988810c16bSdanmcd if (pstr != *argv) 18998810c16bSdanmcd free(pstr); 19007c478bd9Sstevel@tonic-gate argv++; 19018810c16bSdanmcd alloclen = sizeof (*isrc) + roundup(sa_len, 8); 19028810c16bSdanmcd isrc = malloc(alloclen); 19038810c16bSdanmcd if (isrc == NULL) 19048810c16bSdanmcd Bail("malloc(isrc)"); 19057c478bd9Sstevel@tonic-gate totallen += alloclen; 19068810c16bSdanmcd isrc->sadb_address_len = SADB_8TO64(alloclen); 19078810c16bSdanmcd isrc->sadb_address_exttype = SADB_EXT_ADDRESS_PROXY; 19088810c16bSdanmcd isrc->sadb_address_reserved = 0; 19098810c16bSdanmcd isrc->sadb_address_prefixlen = prefix; 19108810c16bSdanmcd isrc->sadb_address_proto = 0; 19118810c16bSdanmcd if (isrchp == &dummy.he || 19128810c16bSdanmcd isrchp->h_addr_list[1] == NULL) { 19137c478bd9Sstevel@tonic-gate /* 19147c478bd9Sstevel@tonic-gate * Single address with -n flag or single name. 19157c478bd9Sstevel@tonic-gate */ 19168810c16bSdanmcd sin6 = (struct sockaddr_in6 *)(isrc + 1); 19177c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6)); 19187c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6; 19198810c16bSdanmcd bcopy(isrchp->h_addr_list[0], &sin6->sin6_addr, 19207c478bd9Sstevel@tonic-gate sizeof (struct in6_addr)); 19218810c16bSdanmcd /* 19228810c16bSdanmcd * normalize prefixlen for IPv4-mapped 19238810c16bSdanmcd * addresses. 19248810c16bSdanmcd */ 19258810c16bSdanmcd if (prefix <= 32 && 19268810c16bSdanmcd IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) 19278810c16bSdanmcd isrc->sadb_address_prefixlen += 96; 19288810c16bSdanmcd alloc_inner = B_TRUE; 19297c478bd9Sstevel@tonic-gate } else { 19307c478bd9Sstevel@tonic-gate /* 19318810c16bSdanmcd * If the proxy/isrc address is vague, don't 19328810c16bSdanmcd * bother. 19337c478bd9Sstevel@tonic-gate */ 19347c478bd9Sstevel@tonic-gate totallen -= alloclen; 19358810c16bSdanmcd free(isrc); 19368810c16bSdanmcd isrc = NULL; 1937e3320f40Smarkfen WARN1(ep, ebuf, gettext( 1938e3320f40Smarkfen "Proxy/inner-source address %s " 1939e3320f40Smarkfen "is vague, not using.\n"), isrchp->h_name); 19408810c16bSdanmcd freehostent(isrchp); 19418810c16bSdanmcd isrchp = NULL; 1942e3320f40Smarkfen break; 19438810c16bSdanmcd } 19448810c16bSdanmcd break; 19458810c16bSdanmcd case TOK_IDSTADDR: 19468810c16bSdanmcd case TOK_IDSTADDR6: 19478810c16bSdanmcd if (idst != NULL) { 1948e3320f40Smarkfen ERROR(ep, ebuf, gettext( 1949e3320f40Smarkfen "Can only specify single " 1950e3320f40Smarkfen "inner-destination address.\n")); 1951e3320f40Smarkfen break; 19528810c16bSdanmcd } 19538810c16bSdanmcd if ((pstr = strchr(*argv, '/')) != NULL) { 19548810c16bSdanmcd /* Parse out the prefix. */ 19558810c16bSdanmcd errno = 0; 19568810c16bSdanmcd prefix = strtol(pstr + 1, NULL, 10); 19578810c16bSdanmcd if (errno != 0) { 1958e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 1959e3320f40Smarkfen "Invalid prefix %s.\n"), pstr); 1960e3320f40Smarkfen break; 19618810c16bSdanmcd } 19628810c16bSdanmcd /* Recycle pstr */ 19638810c16bSdanmcd alloclen = (int)(pstr - *argv); 19648810c16bSdanmcd pstr = malloc(alloclen + 1); 19658810c16bSdanmcd if (pstr == NULL) { 19668810c16bSdanmcd Bail("malloc(pstr)"); 19678810c16bSdanmcd } 19688810c16bSdanmcd (void) strlcpy(pstr, *argv, alloclen + 1); 19698810c16bSdanmcd } else { 19708810c16bSdanmcd pstr = *argv; 19718810c16bSdanmcd /* 19728810c16bSdanmcd * Assume mapping to AF_INET6, and we're a host. 19738810c16bSdanmcd * XXX some miscreants may still make classful 19748810c16bSdanmcd * assumptions. If this is a problem, fix it 19758810c16bSdanmcd * here. 19768810c16bSdanmcd */ 19778810c16bSdanmcd prefix = 128; 19788810c16bSdanmcd } 19798810c16bSdanmcd sa_len = parseaddr(pstr, &idsthp, 1980e3320f40Smarkfen (token == TOK_IDSTADDR6), ebuf); 1981e3320f40Smarkfen if (idsthp == NULL) { 1982e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 1983e3320f40Smarkfen "Unknown Inner Src address " 1984e3320f40Smarkfen " \"%s\"\n"), *argv); 1985e3320f40Smarkfen break; 1986e3320f40Smarkfen } 19878810c16bSdanmcd if (pstr != *argv) 19888810c16bSdanmcd free(pstr); 19898810c16bSdanmcd argv++; 19908810c16bSdanmcd alloclen = sizeof (*idst) + roundup(sa_len, 8); 19918810c16bSdanmcd idst = malloc(alloclen); 19928810c16bSdanmcd if (idst == NULL) 19938810c16bSdanmcd Bail("malloc(idst)"); 19948810c16bSdanmcd totallen += alloclen; 19958810c16bSdanmcd idst->sadb_address_len = SADB_8TO64(alloclen); 19968810c16bSdanmcd idst->sadb_address_exttype = 19978810c16bSdanmcd SADB_X_EXT_ADDRESS_INNER_DST; 19988810c16bSdanmcd idst->sadb_address_reserved = 0; 19998810c16bSdanmcd idst->sadb_address_prefixlen = prefix; 20008810c16bSdanmcd idst->sadb_address_proto = 0; 20018810c16bSdanmcd if (idsthp == &dummy.he || 20028810c16bSdanmcd idsthp->h_addr_list[1] == NULL) { 20038810c16bSdanmcd /* 20048810c16bSdanmcd * Single address with -n flag or single name. 20058810c16bSdanmcd */ 20068810c16bSdanmcd sin6 = (struct sockaddr_in6 *)(idst + 1); 20078810c16bSdanmcd bzero(sin6, sizeof (*sin6)); 20088810c16bSdanmcd sin6->sin6_family = AF_INET6; 20098810c16bSdanmcd bcopy(idsthp->h_addr_list[0], &sin6->sin6_addr, 20108810c16bSdanmcd sizeof (struct in6_addr)); 20118810c16bSdanmcd /* 20128810c16bSdanmcd * normalize prefixlen for IPv4-mapped 20138810c16bSdanmcd * addresses. 20148810c16bSdanmcd */ 20158810c16bSdanmcd if (prefix <= 32 && 20168810c16bSdanmcd IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) 20178810c16bSdanmcd idst->sadb_address_prefixlen += 96; 20188810c16bSdanmcd alloc_inner = B_TRUE; 20198810c16bSdanmcd } else { 20208810c16bSdanmcd /* 20218810c16bSdanmcd * If the idst address is vague, don't bother. 20228810c16bSdanmcd */ 20238810c16bSdanmcd totallen -= alloclen; 20248810c16bSdanmcd free(idst); 20258810c16bSdanmcd idst = NULL; 2026e3320f40Smarkfen WARN1(ep, ebuf, gettext( 2027e3320f40Smarkfen "Inner destination address %s " 2028e3320f40Smarkfen "is vague, not using.\n"), idsthp->h_name); 20298810c16bSdanmcd freehostent(idsthp); 20308810c16bSdanmcd idsthp = NULL; 2031e3320f40Smarkfen break; 20327c478bd9Sstevel@tonic-gate } 20337c478bd9Sstevel@tonic-gate break; 20347c478bd9Sstevel@tonic-gate case TOK_NATLOC: 20357c478bd9Sstevel@tonic-gate if (natt_local != NULL) { 2036e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2037e3320f40Smarkfen "Can only specify " 2038e3320f40Smarkfen "single NAT-T local address.\n")); 2039e3320f40Smarkfen break; 2040e3320f40Smarkfen } 2041e3320f40Smarkfen sa_len = parseaddr(*argv, &natt_lhp, 0, ebuf); 2042e3320f40Smarkfen if (natt_lhp == NULL) { 2043e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 2044e3320f40Smarkfen "Unknown NAT-T local address \"%s\"\n"), 2045e3320f40Smarkfen *argv); 2046e3320f40Smarkfen break; 20477c478bd9Sstevel@tonic-gate } 20487c478bd9Sstevel@tonic-gate argv++; 20497c478bd9Sstevel@tonic-gate /* 20507c478bd9Sstevel@tonic-gate * Round of the sockaddr length to an 8 byte 20517c478bd9Sstevel@tonic-gate * boundary to make PF_KEY happy. 20527c478bd9Sstevel@tonic-gate */ 20537c478bd9Sstevel@tonic-gate alloclen = sizeof (*natt_local) + roundup(sa_len, 8); 20547c478bd9Sstevel@tonic-gate natt_local = malloc(alloclen); 20557c478bd9Sstevel@tonic-gate if (natt_local == NULL) 20567c478bd9Sstevel@tonic-gate Bail("malloc(natt_local)"); 20577c478bd9Sstevel@tonic-gate totallen += alloclen; 20587c478bd9Sstevel@tonic-gate natt_local->sadb_address_len = SADB_8TO64(alloclen); 20597c478bd9Sstevel@tonic-gate natt_local->sadb_address_exttype = 20607c478bd9Sstevel@tonic-gate SADB_X_EXT_ADDRESS_NATT_LOC; 20617c478bd9Sstevel@tonic-gate natt_local->sadb_address_reserved = 0; 20627c478bd9Sstevel@tonic-gate natt_local->sadb_address_prefixlen = 0; 20637c478bd9Sstevel@tonic-gate natt_local->sadb_address_proto = 0; 20648810c16bSdanmcd if (natt_lhp == &dummy.he || 20658810c16bSdanmcd natt_lhp->h_addr_list[1] == NULL) { 20667c478bd9Sstevel@tonic-gate /* 20678810c16bSdanmcd * Single address with -n flag or single name. 20687c478bd9Sstevel@tonic-gate */ 20697c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(natt_local + 1); 20707c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6)); 20717c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6; 20727c478bd9Sstevel@tonic-gate bcopy(natt_lhp->h_addr_list[0], 20737c478bd9Sstevel@tonic-gate &sin6->sin6_addr, sizeof (struct in6_addr)); 20748810c16bSdanmcd } else { 20758810c16bSdanmcd /* 20768810c16bSdanmcd * If the nat-local address is vague, don't 20778810c16bSdanmcd * bother. 20788810c16bSdanmcd */ 20798810c16bSdanmcd totallen -= alloclen; 20808810c16bSdanmcd free(natt_local); 20818810c16bSdanmcd natt_local = NULL; 2082e3320f40Smarkfen WARN1(ep, ebuf, gettext( 2083e3320f40Smarkfen "NAT-T local address %s " 2084e3320f40Smarkfen "is vague, not using.\n"), 2085e3320f40Smarkfen natt_lhp->h_name); 20868810c16bSdanmcd freehostent(natt_lhp); 20878810c16bSdanmcd natt_lhp = NULL; 2088e3320f40Smarkfen break; 20897c478bd9Sstevel@tonic-gate } 20907c478bd9Sstevel@tonic-gate break; 20917c478bd9Sstevel@tonic-gate case TOK_NATREM: 20927c478bd9Sstevel@tonic-gate if (natt_remote != NULL) { 2093e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2094e3320f40Smarkfen "Can only specify " 2095e3320f40Smarkfen "single NAT-T remote address.\n")); 2096e3320f40Smarkfen break; 2097e3320f40Smarkfen } 2098e3320f40Smarkfen sa_len = parseaddr(*argv, &natt_rhp, 0, ebuf); 2099e3320f40Smarkfen if (natt_rhp == NULL) { 2100e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 2101e3320f40Smarkfen "Unknown NAT-T remote address \"%s\"\n"), 2102e3320f40Smarkfen *argv); 2103e3320f40Smarkfen break; 21047c478bd9Sstevel@tonic-gate } 21057c478bd9Sstevel@tonic-gate argv++; 21067c478bd9Sstevel@tonic-gate /* 21077c478bd9Sstevel@tonic-gate * Round of the sockaddr length to an 8 byte 21087c478bd9Sstevel@tonic-gate * boundary to make PF_KEY happy. 21097c478bd9Sstevel@tonic-gate */ 21107c478bd9Sstevel@tonic-gate alloclen = sizeof (*natt_remote) + roundup(sa_len, 8); 21117c478bd9Sstevel@tonic-gate natt_remote = malloc(alloclen); 21127c478bd9Sstevel@tonic-gate if (natt_remote == NULL) 21137c478bd9Sstevel@tonic-gate Bail("malloc(natt_remote)"); 21147c478bd9Sstevel@tonic-gate totallen += alloclen; 21157c478bd9Sstevel@tonic-gate natt_remote->sadb_address_len = SADB_8TO64(alloclen); 21167c478bd9Sstevel@tonic-gate natt_remote->sadb_address_exttype = 21177c478bd9Sstevel@tonic-gate SADB_X_EXT_ADDRESS_NATT_REM; 21187c478bd9Sstevel@tonic-gate natt_remote->sadb_address_reserved = 0; 21197c478bd9Sstevel@tonic-gate natt_remote->sadb_address_prefixlen = 0; 21207c478bd9Sstevel@tonic-gate natt_remote->sadb_address_proto = 0; 21218810c16bSdanmcd if (natt_rhp == &dummy.he || 21228810c16bSdanmcd natt_rhp->h_addr_list[1] == NULL) { 21237c478bd9Sstevel@tonic-gate /* 21248810c16bSdanmcd * Single address with -n flag or single name. 21257c478bd9Sstevel@tonic-gate */ 21267c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(natt_remote + 1); 21277c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6)); 21287c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6; 21297c478bd9Sstevel@tonic-gate bcopy(natt_rhp->h_addr_list[0], 21307c478bd9Sstevel@tonic-gate &sin6->sin6_addr, sizeof (struct in6_addr)); 21318810c16bSdanmcd } else { 21328810c16bSdanmcd /* 2133e3320f40Smarkfen * If the nat-renote address is vague, don't 21348810c16bSdanmcd * bother. 21358810c16bSdanmcd */ 21368810c16bSdanmcd totallen -= alloclen; 21378810c16bSdanmcd free(natt_remote); 21388810c16bSdanmcd natt_remote = NULL; 2139e3320f40Smarkfen WARN1(ep, ebuf, gettext( 2140e3320f40Smarkfen "NAT-T remote address %s " 2141e3320f40Smarkfen "is vague, not using.\n"), 2142e3320f40Smarkfen natt_rhp->h_name); 21438810c16bSdanmcd freehostent(natt_rhp); 21448810c16bSdanmcd natt_rhp = NULL; 2145e3320f40Smarkfen break; 21467c478bd9Sstevel@tonic-gate } 21477c478bd9Sstevel@tonic-gate break; 21487c478bd9Sstevel@tonic-gate case TOK_ENCRKEY: 21497c478bd9Sstevel@tonic-gate if (encrypt != NULL) { 2150e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2151e3320f40Smarkfen "Can only specify " 2152e3320f40Smarkfen "single encryption key.\n")); 2153e3320f40Smarkfen break; 21547c478bd9Sstevel@tonic-gate } 2155*ec485834Spwernau if (assoc->sadb_sa_encrypt == SADB_EALG_NULL) { 2156*ec485834Spwernau FATAL(ep, ebuf, gettext( 2157*ec485834Spwernau "Cannot specify a key with NULL " 2158*ec485834Spwernau "encryption algorithm.\n")); 2159*ec485834Spwernau break; 2160*ec485834Spwernau } 2161e3320f40Smarkfen encrypt = parsekey(*argv, ebuf); 21627c478bd9Sstevel@tonic-gate argv++; 2163e3320f40Smarkfen if (encrypt == NULL) { 2164e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2165e3320f40Smarkfen "Invalid encryption key.\n")); 2166e3320f40Smarkfen break; 2167e3320f40Smarkfen } 2168e3320f40Smarkfen totallen += SADB_64TO8(encrypt->sadb_key_len); 21697c478bd9Sstevel@tonic-gate encrypt->sadb_key_exttype = SADB_EXT_KEY_ENCRYPT; 21707c478bd9Sstevel@tonic-gate break; 21717c478bd9Sstevel@tonic-gate case TOK_AUTHKEY: 21727c478bd9Sstevel@tonic-gate if (auth != NULL) { 2173e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2174e3320f40Smarkfen "Can only specify single" 2175e3320f40Smarkfen " authentication key.\n")); 2176e3320f40Smarkfen break; 21777c478bd9Sstevel@tonic-gate } 2178e3320f40Smarkfen auth = parsekey(*argv, ebuf); 21797c478bd9Sstevel@tonic-gate argv++; 2180e3320f40Smarkfen if (auth == NULL) { 2181e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2182e3320f40Smarkfen "Invalid authentication key.\n")); 2183e3320f40Smarkfen break; 2184e3320f40Smarkfen } 21857c478bd9Sstevel@tonic-gate totallen += SADB_64TO8(auth->sadb_key_len); 21867c478bd9Sstevel@tonic-gate auth->sadb_key_exttype = SADB_EXT_KEY_AUTH; 21877c478bd9Sstevel@tonic-gate break; 21887c478bd9Sstevel@tonic-gate case TOK_SRCIDTYPE: 21897c478bd9Sstevel@tonic-gate if (*argv == NULL || *(argv + 1) == NULL) { 2190e3320f40Smarkfen FATAL(ep, ebuf, gettext( 2191e3320f40Smarkfen "Unexpected end of command " 2192e3320f40Smarkfen "line - Expecting Src Type.\n")); 2193e3320f40Smarkfen /* NOTREACHED */ 2194e3320f40Smarkfen break; 21957c478bd9Sstevel@tonic-gate } 21967c478bd9Sstevel@tonic-gate if (srcid != NULL) { 2197e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2198e3320f40Smarkfen "Can only specify single" 2199e3320f40Smarkfen " source certificate identity.\n")); 2200e3320f40Smarkfen break; 22017c478bd9Sstevel@tonic-gate } 22027c478bd9Sstevel@tonic-gate alloclen = sizeof (*srcid) + 22037c478bd9Sstevel@tonic-gate roundup(strlen(*(argv + 1)) + 1, 8); 22047c478bd9Sstevel@tonic-gate srcid = malloc(alloclen); 22057c478bd9Sstevel@tonic-gate if (srcid == NULL) 22067c478bd9Sstevel@tonic-gate Bail("malloc(srcid)"); 22077c478bd9Sstevel@tonic-gate totallen += alloclen; 2208e3320f40Smarkfen srcid->sadb_ident_type = parseidtype(*argv, ebuf); 22097c478bd9Sstevel@tonic-gate argv++; 22107c478bd9Sstevel@tonic-gate srcid->sadb_ident_len = SADB_8TO64(alloclen); 22117c478bd9Sstevel@tonic-gate srcid->sadb_ident_exttype = SADB_EXT_IDENTITY_SRC; 22127c478bd9Sstevel@tonic-gate srcid->sadb_ident_reserved = 0; 22137c478bd9Sstevel@tonic-gate srcid->sadb_ident_id = 0; /* Not useful here. */ 2214e3320f40Smarkfen (void) strlcpy((char *)(srcid + 1), *argv, alloclen); 22157c478bd9Sstevel@tonic-gate argv++; 22167c478bd9Sstevel@tonic-gate break; 22177c478bd9Sstevel@tonic-gate case TOK_DSTIDTYPE: 22187c478bd9Sstevel@tonic-gate if (*argv == NULL || *(argv + 1) == NULL) { 2219e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2220e3320f40Smarkfen "Unexpected end of command" 2221e3320f40Smarkfen " line - expecting dst type.\n")); 2222e3320f40Smarkfen break; 22237c478bd9Sstevel@tonic-gate } 22247c478bd9Sstevel@tonic-gate if (dstid != NULL) { 2225e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2226e3320f40Smarkfen "Can only specify single destination " 222725e435e0Spwernau "certificate identity.\n")); 2228e3320f40Smarkfen break; 22297c478bd9Sstevel@tonic-gate } 22307c478bd9Sstevel@tonic-gate alloclen = sizeof (*dstid) + 22317c478bd9Sstevel@tonic-gate roundup(strlen(*(argv + 1)) + 1, 8); 22327c478bd9Sstevel@tonic-gate dstid = malloc(alloclen); 22337c478bd9Sstevel@tonic-gate if (dstid == NULL) 22347c478bd9Sstevel@tonic-gate Bail("malloc(dstid)"); 22357c478bd9Sstevel@tonic-gate totallen += alloclen; 2236e3320f40Smarkfen dstid->sadb_ident_type = parseidtype(*argv, ebuf); 22377c478bd9Sstevel@tonic-gate argv++; 22387c478bd9Sstevel@tonic-gate dstid->sadb_ident_len = SADB_8TO64(alloclen); 22397c478bd9Sstevel@tonic-gate dstid->sadb_ident_exttype = SADB_EXT_IDENTITY_DST; 22407c478bd9Sstevel@tonic-gate dstid->sadb_ident_reserved = 0; 22417c478bd9Sstevel@tonic-gate dstid->sadb_ident_id = 0; /* Not useful here. */ 2242e3320f40Smarkfen (void) strlcpy((char *)(dstid + 1), *argv, alloclen); 22437c478bd9Sstevel@tonic-gate argv++; 22447c478bd9Sstevel@tonic-gate break; 22457c478bd9Sstevel@tonic-gate case TOK_HARD_ALLOC: 22467c478bd9Sstevel@tonic-gate case TOK_HARD_BYTES: 22477c478bd9Sstevel@tonic-gate case TOK_HARD_ADDTIME: 22487c478bd9Sstevel@tonic-gate case TOK_HARD_USETIME: 22497c478bd9Sstevel@tonic-gate if (hard == NULL) { 22507c478bd9Sstevel@tonic-gate hard = malloc(sizeof (*hard)); 22517c478bd9Sstevel@tonic-gate if (hard == NULL) 22527c478bd9Sstevel@tonic-gate Bail("malloc(hard_lifetime)"); 22537c478bd9Sstevel@tonic-gate bzero(hard, sizeof (*hard)); 22547c478bd9Sstevel@tonic-gate hard->sadb_lifetime_exttype = 22557c478bd9Sstevel@tonic-gate SADB_EXT_LIFETIME_HARD; 22567c478bd9Sstevel@tonic-gate hard->sadb_lifetime_len = 22577c478bd9Sstevel@tonic-gate SADB_8TO64(sizeof (*hard)); 22587c478bd9Sstevel@tonic-gate totallen += sizeof (*hard); 22597c478bd9Sstevel@tonic-gate } 22607c478bd9Sstevel@tonic-gate switch (token) { 22617c478bd9Sstevel@tonic-gate case TOK_HARD_ALLOC: 22627c478bd9Sstevel@tonic-gate if (hard->sadb_lifetime_allocations != 0) { 2263e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2264e3320f40Smarkfen "Can only specify single" 2265e3320f40Smarkfen " hard allocation limit.\n")); 2266e3320f40Smarkfen break; 22677c478bd9Sstevel@tonic-gate } 22687c478bd9Sstevel@tonic-gate hard->sadb_lifetime_allocations = 2269e3320f40Smarkfen (uint32_t)parsenum(*argv, B_TRUE, ebuf); 22707c478bd9Sstevel@tonic-gate break; 22717c478bd9Sstevel@tonic-gate case TOK_HARD_BYTES: 22727c478bd9Sstevel@tonic-gate if (hard->sadb_lifetime_bytes != 0) { 2273e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2274e3320f40Smarkfen "Can only specify " 2275e3320f40Smarkfen "single hard byte limit.\n")); 2276e3320f40Smarkfen break; 22777c478bd9Sstevel@tonic-gate } 22787c478bd9Sstevel@tonic-gate hard->sadb_lifetime_bytes = parsenum(*argv, 2279e3320f40Smarkfen B_TRUE, ebuf); 22807c478bd9Sstevel@tonic-gate break; 22817c478bd9Sstevel@tonic-gate case TOK_HARD_ADDTIME: 22827c478bd9Sstevel@tonic-gate if (hard->sadb_lifetime_addtime != 0) { 2283e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2284e3320f40Smarkfen "Can only specify " 2285e3320f40Smarkfen "single past-add lifetime.\n")); 2286e3320f40Smarkfen break; 22877c478bd9Sstevel@tonic-gate } 22887c478bd9Sstevel@tonic-gate hard->sadb_lifetime_addtime = parsenum(*argv, 2289e3320f40Smarkfen B_TRUE, ebuf); 22907c478bd9Sstevel@tonic-gate break; 22917c478bd9Sstevel@tonic-gate case TOK_HARD_USETIME: 22927c478bd9Sstevel@tonic-gate if (hard->sadb_lifetime_usetime != 0) { 2293e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2294e3320f40Smarkfen "Can only specify " 2295e3320f40Smarkfen "single past-use lifetime.\n")); 2296e3320f40Smarkfen break; 22977c478bd9Sstevel@tonic-gate } 22987c478bd9Sstevel@tonic-gate hard->sadb_lifetime_usetime = parsenum(*argv, 2299e3320f40Smarkfen B_TRUE, ebuf); 23007c478bd9Sstevel@tonic-gate break; 23017c478bd9Sstevel@tonic-gate } 23027c478bd9Sstevel@tonic-gate argv++; 23037c478bd9Sstevel@tonic-gate break; 23047c478bd9Sstevel@tonic-gate case TOK_SOFT_ALLOC: 23057c478bd9Sstevel@tonic-gate case TOK_SOFT_BYTES: 23067c478bd9Sstevel@tonic-gate case TOK_SOFT_ADDTIME: 23077c478bd9Sstevel@tonic-gate case TOK_SOFT_USETIME: 23087c478bd9Sstevel@tonic-gate if (soft == NULL) { 23097c478bd9Sstevel@tonic-gate soft = malloc(sizeof (*soft)); 23107c478bd9Sstevel@tonic-gate if (soft == NULL) 23117c478bd9Sstevel@tonic-gate Bail("malloc(soft_lifetime)"); 23127c478bd9Sstevel@tonic-gate bzero(soft, sizeof (*soft)); 23137c478bd9Sstevel@tonic-gate soft->sadb_lifetime_exttype = 23147c478bd9Sstevel@tonic-gate SADB_EXT_LIFETIME_SOFT; 23157c478bd9Sstevel@tonic-gate soft->sadb_lifetime_len = 23167c478bd9Sstevel@tonic-gate SADB_8TO64(sizeof (*soft)); 23177c478bd9Sstevel@tonic-gate totallen += sizeof (*soft); 23187c478bd9Sstevel@tonic-gate } 23197c478bd9Sstevel@tonic-gate switch (token) { 23207c478bd9Sstevel@tonic-gate case TOK_SOFT_ALLOC: 23217c478bd9Sstevel@tonic-gate if (soft->sadb_lifetime_allocations != 0) { 2322e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2323e3320f40Smarkfen "Can only specify single" 2324e3320f40Smarkfen " soft allocation limit.\n")); 2325e3320f40Smarkfen break; 23267c478bd9Sstevel@tonic-gate } 23277c478bd9Sstevel@tonic-gate soft->sadb_lifetime_allocations = 2328e3320f40Smarkfen (uint32_t)parsenum(*argv, B_TRUE, ebuf); 23297c478bd9Sstevel@tonic-gate break; 23307c478bd9Sstevel@tonic-gate case TOK_SOFT_BYTES: 23317c478bd9Sstevel@tonic-gate if (soft->sadb_lifetime_bytes != 0) { 2332e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2333e3320f40Smarkfen "Can only specify single" 2334e3320f40Smarkfen " soft byte limit.\n")); 2335e3320f40Smarkfen break; 23367c478bd9Sstevel@tonic-gate } 23377c478bd9Sstevel@tonic-gate soft->sadb_lifetime_bytes = parsenum(*argv, 2338e3320f40Smarkfen B_TRUE, ebuf); 23397c478bd9Sstevel@tonic-gate break; 23407c478bd9Sstevel@tonic-gate case TOK_SOFT_ADDTIME: 23417c478bd9Sstevel@tonic-gate if (soft->sadb_lifetime_addtime != 0) { 2342e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2343e3320f40Smarkfen "Can only specify single" 2344e3320f40Smarkfen " past-add lifetime.\n")); 2345e3320f40Smarkfen break; 23467c478bd9Sstevel@tonic-gate } 23477c478bd9Sstevel@tonic-gate soft->sadb_lifetime_addtime = parsenum(*argv, 2348e3320f40Smarkfen B_TRUE, ebuf); 23497c478bd9Sstevel@tonic-gate break; 23507c478bd9Sstevel@tonic-gate case TOK_SOFT_USETIME: 23517c478bd9Sstevel@tonic-gate if (soft->sadb_lifetime_usetime != 0) { 2352e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2353e3320f40Smarkfen "Can only specify single" 2354e3320f40Smarkfen " past-use lifetime.\n")); 2355e3320f40Smarkfen break; 23567c478bd9Sstevel@tonic-gate } 23577c478bd9Sstevel@tonic-gate soft->sadb_lifetime_usetime = parsenum(*argv, 2358e3320f40Smarkfen B_TRUE, ebuf); 23597c478bd9Sstevel@tonic-gate break; 23607c478bd9Sstevel@tonic-gate } 23617c478bd9Sstevel@tonic-gate argv++; 23627c478bd9Sstevel@tonic-gate break; 23637c478bd9Sstevel@tonic-gate default: 2364e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 2365e3320f40Smarkfen "Don't use extension %s for add/update.\n"), 23667c478bd9Sstevel@tonic-gate *(argv - 1)); 23677c478bd9Sstevel@tonic-gate break; 23687c478bd9Sstevel@tonic-gate } 23697c478bd9Sstevel@tonic-gate } while (token != TOK_EOF); 23707c478bd9Sstevel@tonic-gate 2371e3320f40Smarkfen handle_errors(ep, ebuf, B_TRUE, B_FALSE); 2372e3320f40Smarkfen 23738810c16bSdanmcd /* 23748810c16bSdanmcd * If we specify inner ports w/o addresses, we still need to 23758810c16bSdanmcd * allocate. Also, if we have one inner address, we need the 23768810c16bSdanmcd * other, even if we don't specify anything. 23778810c16bSdanmcd */ 23788810c16bSdanmcd if (alloc_inner && idst == NULL) { 23798810c16bSdanmcd /* Allocate zeroed-out. */ 23808810c16bSdanmcd alloclen = sizeof (*idst) + sizeof (struct sockaddr_in6); 23818810c16bSdanmcd idst = calloc(1, alloclen); 23828810c16bSdanmcd if (idst == NULL) { 23838810c16bSdanmcd Bail("malloc(implicit idst)"); 23848810c16bSdanmcd } 23858810c16bSdanmcd totallen += alloclen; 23868810c16bSdanmcd idst->sadb_address_len = SADB_8TO64(alloclen); 23878810c16bSdanmcd idst->sadb_address_exttype = SADB_X_EXT_ADDRESS_INNER_DST; 23888810c16bSdanmcd sin6 = (struct sockaddr_in6 *)(idst + 1); 23898810c16bSdanmcd sin6->sin6_family = AF_INET6; 23908810c16bSdanmcd } 23918810c16bSdanmcd 23928810c16bSdanmcd if (alloc_inner && isrc == NULL) { 23938810c16bSdanmcd /* Allocate zeroed-out. */ 23948810c16bSdanmcd alloclen = sizeof (*isrc) + sizeof (struct sockaddr_in6); 23958810c16bSdanmcd isrc = calloc(1, alloclen); 23968810c16bSdanmcd if (isrc == NULL) { 23978810c16bSdanmcd Bail("malloc(implicit isrc)"); 23988810c16bSdanmcd } 23998810c16bSdanmcd totallen += alloclen; 24008810c16bSdanmcd isrc->sadb_address_len = SADB_8TO64(alloclen); 24018810c16bSdanmcd isrc->sadb_address_exttype = SADB_X_EXT_ADDRESS_INNER_SRC; 24028810c16bSdanmcd sin6 = (struct sockaddr_in6 *)(isrc + 1); 24038810c16bSdanmcd sin6->sin6_family = AF_INET6; 24048810c16bSdanmcd } 24058810c16bSdanmcd 24067c478bd9Sstevel@tonic-gate /* 24077c478bd9Sstevel@tonic-gate * Okay, so now I have all of the potential extensions! 24087c478bd9Sstevel@tonic-gate * Allocate a single contiguous buffer. Keep in mind that it'll 24097c478bd9Sstevel@tonic-gate * be enough because the key itself will be yanked. 24107c478bd9Sstevel@tonic-gate */ 24117c478bd9Sstevel@tonic-gate 24127c478bd9Sstevel@tonic-gate if (src == NULL && dst != NULL) { 24137c478bd9Sstevel@tonic-gate /* 24147c478bd9Sstevel@tonic-gate * Set explicit unspecified source address. 24157c478bd9Sstevel@tonic-gate */ 24167c478bd9Sstevel@tonic-gate size_t lenbytes = SADB_64TO8(dst->sadb_address_len); 24177c478bd9Sstevel@tonic-gate 24187c478bd9Sstevel@tonic-gate unspec_src = B_TRUE; 24197c478bd9Sstevel@tonic-gate totallen += lenbytes; 24207c478bd9Sstevel@tonic-gate src = malloc(lenbytes); 24217c478bd9Sstevel@tonic-gate if (src == NULL) 24227c478bd9Sstevel@tonic-gate Bail("malloc(implicit src)"); 24237c478bd9Sstevel@tonic-gate /* Confusing, but we're copying from DST to SRC. :) */ 24247c478bd9Sstevel@tonic-gate bcopy(dst, src, lenbytes); 24257c478bd9Sstevel@tonic-gate src->sadb_address_exttype = SADB_EXT_ADDRESS_SRC; 24267c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(src + 1); 24277c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6)); 24287c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6; 24297c478bd9Sstevel@tonic-gate } 24308810c16bSdanmcd 24317c478bd9Sstevel@tonic-gate msg.sadb_msg_len = SADB_8TO64(totallen); 24327c478bd9Sstevel@tonic-gate 24337c478bd9Sstevel@tonic-gate buffer = malloc(totallen); 24347c478bd9Sstevel@tonic-gate nexthdr = buffer; 24357c478bd9Sstevel@tonic-gate bcopy(&msg, nexthdr, sizeof (msg)); 24367c478bd9Sstevel@tonic-gate nexthdr += SADB_8TO64(sizeof (msg)); 24377c478bd9Sstevel@tonic-gate if (assoc != NULL) { 24387c478bd9Sstevel@tonic-gate if (assoc->sadb_sa_spi == 0) { 2439e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 2440e3320f40Smarkfen "The SPI value is missing for " 2441e3320f40Smarkfen "the association you wish to %s.\n"), thiscmd); 24427c478bd9Sstevel@tonic-gate } 24437c478bd9Sstevel@tonic-gate if (assoc->sadb_sa_auth == 0 && assoc->sadb_sa_encrypt == 0 && 244425e435e0Spwernau cmd == CMD_ADD) { 2445e3320f40Smarkfen free(assoc); 2446e3320f40Smarkfen FATAL(ep, ebuf, gettext( 2447e3320f40Smarkfen "Select at least one algorithm " 2448e3320f40Smarkfen "for this add.\n")); 24497c478bd9Sstevel@tonic-gate } 24507c478bd9Sstevel@tonic-gate 24517c478bd9Sstevel@tonic-gate /* Hack to let user specify NULL ESP implicitly. */ 24527c478bd9Sstevel@tonic-gate if (msg.sadb_msg_satype == SADB_SATYPE_ESP && 24537c478bd9Sstevel@tonic-gate assoc->sadb_sa_encrypt == 0) 24547c478bd9Sstevel@tonic-gate assoc->sadb_sa_encrypt = SADB_EALG_NULL; 24557c478bd9Sstevel@tonic-gate 24567c478bd9Sstevel@tonic-gate /* 0 is an actual value. Print a warning if it was entered. */ 24577c478bd9Sstevel@tonic-gate if (assoc->sadb_sa_state == 0) { 2458e3320f40Smarkfen if (readstate) { 2459e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2460e3320f40Smarkfen "WARNING: Cannot set LARVAL SA state.\n")); 2461e3320f40Smarkfen } 24627c478bd9Sstevel@tonic-gate assoc->sadb_sa_state = SADB_SASTATE_MATURE; 24637c478bd9Sstevel@tonic-gate } 24647c478bd9Sstevel@tonic-gate 24657c478bd9Sstevel@tonic-gate if (use_natt) { 24667c478bd9Sstevel@tonic-gate if (natt_remote != NULL) 24677c478bd9Sstevel@tonic-gate assoc->sadb_sa_flags |= SADB_X_SAFLAGS_NATT_REM; 24687c478bd9Sstevel@tonic-gate if (natt_local != NULL) 24697c478bd9Sstevel@tonic-gate assoc->sadb_sa_flags |= SADB_X_SAFLAGS_NATT_LOC; 24707c478bd9Sstevel@tonic-gate } 24717c478bd9Sstevel@tonic-gate 24728810c16bSdanmcd if (alloc_inner) { 24738810c16bSdanmcd /* 24748810c16bSdanmcd * For now, assume RFC 3884's dream of transport-mode 24758810c16bSdanmcd * SAs with inner IP address selectors will not 24768810c16bSdanmcd * happen. 24778810c16bSdanmcd */ 24788810c16bSdanmcd assoc->sadb_sa_flags |= SADB_X_SAFLAGS_TUNNEL; 24798810c16bSdanmcd if (proto != 0 && proto != IPPROTO_ENCAP && 24808810c16bSdanmcd proto != IPPROTO_IPV6) { 2481e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 2482e3320f40Smarkfen "WARNING: Protocol type %d not " 2483e3320f40Smarkfen "for use with Tunnel-Mode SA.\n"), proto); 24848810c16bSdanmcd /* Continue and let PF_KEY scream... */ 24858810c16bSdanmcd } 24868810c16bSdanmcd } 24878810c16bSdanmcd 24887c478bd9Sstevel@tonic-gate bcopy(assoc, nexthdr, SADB_64TO8(assoc->sadb_sa_len)); 24897c478bd9Sstevel@tonic-gate nexthdr += assoc->sadb_sa_len; 24907c478bd9Sstevel@tonic-gate /* Save the SPI for the case of an error. */ 24917c478bd9Sstevel@tonic-gate spi = assoc->sadb_sa_spi; 24927c478bd9Sstevel@tonic-gate free(assoc); 24937c478bd9Sstevel@tonic-gate } else { 2494e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 2495e3320f40Smarkfen "Need SA parameters for %s.\n"), thiscmd); 24967c478bd9Sstevel@tonic-gate } 24977c478bd9Sstevel@tonic-gate 24987c478bd9Sstevel@tonic-gate if (hard != NULL) { 24997c478bd9Sstevel@tonic-gate bcopy(hard, nexthdr, SADB_64TO8(hard->sadb_lifetime_len)); 25007c478bd9Sstevel@tonic-gate nexthdr += hard->sadb_lifetime_len; 25017c478bd9Sstevel@tonic-gate free(hard); 25027c478bd9Sstevel@tonic-gate } 25037c478bd9Sstevel@tonic-gate 25047c478bd9Sstevel@tonic-gate if (soft != NULL) { 25057c478bd9Sstevel@tonic-gate bcopy(soft, nexthdr, SADB_64TO8(soft->sadb_lifetime_len)); 25067c478bd9Sstevel@tonic-gate nexthdr += soft->sadb_lifetime_len; 25077c478bd9Sstevel@tonic-gate free(soft); 25087c478bd9Sstevel@tonic-gate } 25097c478bd9Sstevel@tonic-gate 25107c478bd9Sstevel@tonic-gate if (encrypt == NULL && auth == NULL && cmd == CMD_ADD) { 2511e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2512e3320f40Smarkfen "Must have at least one key for an add.\n")); 25137c478bd9Sstevel@tonic-gate } 25147c478bd9Sstevel@tonic-gate 25157c478bd9Sstevel@tonic-gate if (encrypt != NULL) { 25167c478bd9Sstevel@tonic-gate bcopy(encrypt, nexthdr, SADB_64TO8(encrypt->sadb_key_len)); 25177c478bd9Sstevel@tonic-gate nexthdr += encrypt->sadb_key_len; 25187c478bd9Sstevel@tonic-gate bzero(encrypt, SADB_64TO8(encrypt->sadb_key_len)); 25197c478bd9Sstevel@tonic-gate free(encrypt); 25207c478bd9Sstevel@tonic-gate } 25217c478bd9Sstevel@tonic-gate 25227c478bd9Sstevel@tonic-gate if (auth != NULL) { 25237c478bd9Sstevel@tonic-gate bcopy(auth, nexthdr, SADB_64TO8(auth->sadb_key_len)); 25247c478bd9Sstevel@tonic-gate nexthdr += auth->sadb_key_len; 25257c478bd9Sstevel@tonic-gate bzero(auth, SADB_64TO8(auth->sadb_key_len)); 25267c478bd9Sstevel@tonic-gate free(auth); 25277c478bd9Sstevel@tonic-gate } 25287c478bd9Sstevel@tonic-gate 25297c478bd9Sstevel@tonic-gate if (srcid != NULL) { 25307c478bd9Sstevel@tonic-gate bcopy(srcid, nexthdr, SADB_64TO8(srcid->sadb_ident_len)); 25317c478bd9Sstevel@tonic-gate nexthdr += srcid->sadb_ident_len; 25327c478bd9Sstevel@tonic-gate free(srcid); 25337c478bd9Sstevel@tonic-gate } 25347c478bd9Sstevel@tonic-gate 25357c478bd9Sstevel@tonic-gate if (dstid != NULL) { 25367c478bd9Sstevel@tonic-gate bcopy(dstid, nexthdr, SADB_64TO8(dstid->sadb_ident_len)); 25377c478bd9Sstevel@tonic-gate nexthdr += dstid->sadb_ident_len; 25387c478bd9Sstevel@tonic-gate free(dstid); 25397c478bd9Sstevel@tonic-gate } 25407c478bd9Sstevel@tonic-gate 25417c478bd9Sstevel@tonic-gate if (dst != NULL) { 25427c478bd9Sstevel@tonic-gate bcopy(dst, nexthdr, SADB_64TO8(dst->sadb_address_len)); 25437c478bd9Sstevel@tonic-gate free(dst); 25447c478bd9Sstevel@tonic-gate dst = (struct sadb_address *)nexthdr; 25458810c16bSdanmcd dst->sadb_address_proto = proto; 25468810c16bSdanmcd ((struct sockaddr_in6 *)(dst + 1))->sin6_port = htons(dstport); 25477c478bd9Sstevel@tonic-gate nexthdr += dst->sadb_address_len; 25487c478bd9Sstevel@tonic-gate } else { 2549e3320f40Smarkfen FATAL1(ep, ebuf, gettext( 2550e3320f40Smarkfen "Need destination address for %s.\n"), thiscmd); 25517c478bd9Sstevel@tonic-gate } 25527c478bd9Sstevel@tonic-gate 25537c478bd9Sstevel@tonic-gate if (use_natt) { 25547c478bd9Sstevel@tonic-gate if (natt_remote == NULL && natt_local == NULL) { 2555e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2556e3320f40Smarkfen "Must specify NAT-T remote or local address " 2557e3320f40Smarkfen "for UDP encapsulation.\n")); 25587c478bd9Sstevel@tonic-gate } 25597c478bd9Sstevel@tonic-gate 25607c478bd9Sstevel@tonic-gate if (natt_lport != 0 && natt_local == NULL) { 2561e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2562e3320f40Smarkfen "If NAT-T local port is specified, NAT-T " 2563e3320f40Smarkfen "local address must also be specified.\n")); 25647c478bd9Sstevel@tonic-gate } 25657c478bd9Sstevel@tonic-gate 25667c478bd9Sstevel@tonic-gate if (natt_rport != 0 && natt_remote == NULL) { 2567e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2568e3320f40Smarkfen "If NAT-T remote port is specified, NAT-T " 2569e3320f40Smarkfen "remote address must also be specified.\n")); 25707c478bd9Sstevel@tonic-gate } 25717c478bd9Sstevel@tonic-gate 25727c478bd9Sstevel@tonic-gate if (natt_remote != NULL) { 25738810c16bSdanmcd bcopy(natt_remote, nexthdr, 25748810c16bSdanmcd SADB_64TO8(natt_remote->sadb_address_len)); 25757c478bd9Sstevel@tonic-gate free(natt_remote); 25767c478bd9Sstevel@tonic-gate natt_remote = (struct sadb_address *)nexthdr; 25777c478bd9Sstevel@tonic-gate nexthdr += natt_remote->sadb_address_len; 25788810c16bSdanmcd ((struct sockaddr_in6 *)(natt_remote + 1))->sin6_port = 25798810c16bSdanmcd htons(natt_rport); 25807c478bd9Sstevel@tonic-gate } 25818810c16bSdanmcd 25827c478bd9Sstevel@tonic-gate if (natt_local != NULL) { 25837c478bd9Sstevel@tonic-gate bcopy(natt_local, nexthdr, 25847c478bd9Sstevel@tonic-gate SADB_64TO8(natt_local->sadb_address_len)); 25857c478bd9Sstevel@tonic-gate free(natt_local); 25867c478bd9Sstevel@tonic-gate natt_local = (struct sadb_address *)nexthdr; 25877c478bd9Sstevel@tonic-gate nexthdr += natt_local->sadb_address_len; 25888810c16bSdanmcd ((struct sockaddr_in6 *)(natt_local + 1))->sin6_port = 25898810c16bSdanmcd htons(natt_lport); 25907c478bd9Sstevel@tonic-gate } 25917c478bd9Sstevel@tonic-gate } 2592e3320f40Smarkfen 2593e3320f40Smarkfen handle_errors(ep, ebuf, B_TRUE, B_FALSE); 2594e3320f40Smarkfen 25957c478bd9Sstevel@tonic-gate /* 25967c478bd9Sstevel@tonic-gate * PF_KEY requires a source address extension, even if the source 25977c478bd9Sstevel@tonic-gate * address itself is unspecified. (See "Set explicit unspecified..." 25987c478bd9Sstevel@tonic-gate * code fragment above. Destination reality check was above.) 25997c478bd9Sstevel@tonic-gate */ 26007c478bd9Sstevel@tonic-gate bcopy(src, nexthdr, SADB_64TO8(src->sadb_address_len)); 26017c478bd9Sstevel@tonic-gate free(src); 26027c478bd9Sstevel@tonic-gate src = (struct sadb_address *)nexthdr; 26038810c16bSdanmcd src->sadb_address_proto = proto; 26048810c16bSdanmcd ((struct sockaddr_in6 *)(src + 1))->sin6_port = htons(srcport); 26057c478bd9Sstevel@tonic-gate nexthdr += src->sadb_address_len; 26067c478bd9Sstevel@tonic-gate 26078810c16bSdanmcd if (isrc != NULL) { 26088810c16bSdanmcd bcopy(isrc, nexthdr, SADB_64TO8(isrc->sadb_address_len)); 26098810c16bSdanmcd free(isrc); 26108810c16bSdanmcd isrc = (struct sadb_address *)nexthdr; 26118810c16bSdanmcd isrc->sadb_address_proto = iproto; 26128810c16bSdanmcd ((struct sockaddr_in6 *)(isrc + 1))->sin6_port = 26138810c16bSdanmcd htons(isrcport); 26148810c16bSdanmcd nexthdr += isrc->sadb_address_len; 26157c478bd9Sstevel@tonic-gate } 26167c478bd9Sstevel@tonic-gate 26178810c16bSdanmcd if (idst != NULL) { 26188810c16bSdanmcd bcopy(idst, nexthdr, SADB_64TO8(idst->sadb_address_len)); 26198810c16bSdanmcd free(idst); 26208810c16bSdanmcd idst = (struct sadb_address *)nexthdr; 26218810c16bSdanmcd idst->sadb_address_proto = iproto; 26228810c16bSdanmcd ((struct sockaddr_in6 *)(idst + 1))->sin6_port = 26238810c16bSdanmcd htons(idstport); 26248810c16bSdanmcd nexthdr += idst->sadb_address_len; 26258810c16bSdanmcd } 26267c478bd9Sstevel@tonic-gate 262725e435e0Spwernau if (cflag) { 262825e435e0Spwernau /* 262925e435e0Spwernau * Assume the checked cmd would have worked if it was actually 263025e435e0Spwernau * used. doaddresses() will increment lines_added if it 263125e435e0Spwernau * succeeds. 263225e435e0Spwernau */ 263325e435e0Spwernau lines_added++; 263425e435e0Spwernau } else { 2635e3320f40Smarkfen doaddresses((cmd == CMD_ADD) ? SADB_ADD : SADB_UPDATE, satype, 2636e3320f40Smarkfen cmd, srchp, dsthp, src, dst, unspec_src, buffer, totallen, 2637e3320f40Smarkfen spi, ebuf); 2638e3320f40Smarkfen } 26397c478bd9Sstevel@tonic-gate 26408810c16bSdanmcd if (isrchp != NULL && isrchp != &dummy.he) 264125e435e0Spwernau freehostent(isrchp); 26428810c16bSdanmcd if (idsthp != NULL && idsthp != &dummy.he) 264325e435e0Spwernau freehostent(idsthp); 26447c478bd9Sstevel@tonic-gate if (srchp != NULL && srchp != &dummy.he) 264525e435e0Spwernau freehostent(srchp); 26467c478bd9Sstevel@tonic-gate if (dsthp != NULL && dsthp != &dummy.he) 264725e435e0Spwernau freehostent(dsthp); 26487c478bd9Sstevel@tonic-gate if (natt_lhp != NULL && natt_lhp != &dummy.he) 264925e435e0Spwernau freehostent(natt_lhp); 26507c478bd9Sstevel@tonic-gate if (natt_rhp != NULL && natt_rhp != &dummy.he) 265125e435e0Spwernau freehostent(natt_rhp); 2652e3320f40Smarkfen 2653e3320f40Smarkfen free(ebuf); 2654e3320f40Smarkfen free(buffer); 26557c478bd9Sstevel@tonic-gate } 26567c478bd9Sstevel@tonic-gate 26577c478bd9Sstevel@tonic-gate /* 26587c478bd9Sstevel@tonic-gate * DELETE and GET are similar, in that they only need the extensions 26597c478bd9Sstevel@tonic-gate * required to _find_ an SA, and then either delete it or obtain its 26607c478bd9Sstevel@tonic-gate * information. 26617c478bd9Sstevel@tonic-gate */ 26627c478bd9Sstevel@tonic-gate static void 2663e3320f40Smarkfen dodelget(int cmd, int satype, char *argv[], char *ebuf) 26647c478bd9Sstevel@tonic-gate { 26657c478bd9Sstevel@tonic-gate struct sadb_msg *msg = (struct sadb_msg *)get_buffer; 26667c478bd9Sstevel@tonic-gate uint64_t *nextext; 26677c478bd9Sstevel@tonic-gate struct sadb_sa *assoc = NULL; 26687c478bd9Sstevel@tonic-gate struct sadb_address *src = NULL, *dst = NULL; 26697c478bd9Sstevel@tonic-gate int next, token, sa_len; 26707c478bd9Sstevel@tonic-gate char *thiscmd; 26717c478bd9Sstevel@tonic-gate uint32_t spi; 26727c478bd9Sstevel@tonic-gate struct hostent *srchp = NULL, *dsthp = NULL; 26737c478bd9Sstevel@tonic-gate struct sockaddr_in6 *sin6; 26747c478bd9Sstevel@tonic-gate boolean_t unspec_src = B_TRUE; 26757c478bd9Sstevel@tonic-gate uint16_t srcport = 0, dstport = 0; 26767c478bd9Sstevel@tonic-gate uint8_t proto = 0; 2677e3320f40Smarkfen char *ep = NULL; 26787c478bd9Sstevel@tonic-gate 26797c478bd9Sstevel@tonic-gate msg_init(msg, ((cmd == CMD_GET) ? SADB_GET : SADB_DELETE), 26807c478bd9Sstevel@tonic-gate (uint8_t)satype); 26817c478bd9Sstevel@tonic-gate /* Set the first extension header to right past the base message. */ 26827c478bd9Sstevel@tonic-gate nextext = (uint64_t *)(msg + 1); 26837c478bd9Sstevel@tonic-gate bzero(nextext, sizeof (get_buffer) - sizeof (*msg)); 26847c478bd9Sstevel@tonic-gate 26857c478bd9Sstevel@tonic-gate thiscmd = (cmd == CMD_GET) ? "get" : "delete"; 26867c478bd9Sstevel@tonic-gate 268707b56925Ssommerfe #define ALLOC_ADDR_EXT(ext, exttype) \ 268807b56925Ssommerfe (ext) = (struct sadb_address *)nextext; \ 268907b56925Ssommerfe nextext = (uint64_t *)((ext) + 1); \ 269007b56925Ssommerfe nextext += SADB_8TO64(roundup(sa_len, 8)); \ 269107b56925Ssommerfe (ext)->sadb_address_exttype = exttype; \ 269207b56925Ssommerfe (ext)->sadb_address_len = nextext - ((uint64_t *)ext); 269307b56925Ssommerfe 26947c478bd9Sstevel@tonic-gate /* Assume last element in argv is set to NULL. */ 26957c478bd9Sstevel@tonic-gate do { 26967c478bd9Sstevel@tonic-gate token = parseextval(*argv, &next); 26977c478bd9Sstevel@tonic-gate argv++; 26987c478bd9Sstevel@tonic-gate switch (token) { 26997c478bd9Sstevel@tonic-gate case TOK_EOF: 27007c478bd9Sstevel@tonic-gate /* Do nothing, I'm done. */ 27017c478bd9Sstevel@tonic-gate break; 27027c478bd9Sstevel@tonic-gate case TOK_UNKNOWN: 2703e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 2704e3320f40Smarkfen "Unknown extension field \"%s\"\n"), *(argv - 1)); 27057c478bd9Sstevel@tonic-gate break; 27067c478bd9Sstevel@tonic-gate case TOK_SPI: 27077c478bd9Sstevel@tonic-gate if (assoc != NULL) { 2708e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2709e3320f40Smarkfen "Can only specify single SPI value.\n")); 2710e3320f40Smarkfen break; 27117c478bd9Sstevel@tonic-gate } 27127c478bd9Sstevel@tonic-gate assoc = (struct sadb_sa *)nextext; 27137c478bd9Sstevel@tonic-gate nextext = (uint64_t *)(assoc + 1); 27147c478bd9Sstevel@tonic-gate assoc->sadb_sa_len = SADB_8TO64(sizeof (*assoc)); 27157c478bd9Sstevel@tonic-gate assoc->sadb_sa_exttype = SADB_EXT_SA; 27167c478bd9Sstevel@tonic-gate assoc->sadb_sa_spi = htonl((uint32_t)parsenum(*argv, 2717e3320f40Smarkfen B_TRUE, ebuf)); 27187c478bd9Sstevel@tonic-gate spi = assoc->sadb_sa_spi; 27197c478bd9Sstevel@tonic-gate argv++; 27207c478bd9Sstevel@tonic-gate break; 27217c478bd9Sstevel@tonic-gate case TOK_SRCPORT: 27227c478bd9Sstevel@tonic-gate if (srcport != 0) { 2723e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2724e3320f40Smarkfen "Can only specify single source port.\n")); 2725e3320f40Smarkfen break; 27267c478bd9Sstevel@tonic-gate } 2727e3320f40Smarkfen srcport = parsenum(*argv, B_TRUE, ebuf); 27287c478bd9Sstevel@tonic-gate argv++; 27297c478bd9Sstevel@tonic-gate break; 27307c478bd9Sstevel@tonic-gate case TOK_DSTPORT: 27317c478bd9Sstevel@tonic-gate if (dstport != 0) { 2732e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2733e3320f40Smarkfen "Can only " 2734e3320f40Smarkfen "specify single destination port.\n")); 2735e3320f40Smarkfen break; 27367c478bd9Sstevel@tonic-gate } 2737e3320f40Smarkfen dstport = parsenum(*argv, B_TRUE, ebuf); 27387c478bd9Sstevel@tonic-gate argv++; 27397c478bd9Sstevel@tonic-gate break; 27407c478bd9Sstevel@tonic-gate case TOK_PROTO: 27417c478bd9Sstevel@tonic-gate if (proto != 0) { 2742e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2743e3320f40Smarkfen "Can only specify single protocol.\n")); 2744e3320f40Smarkfen break; 27457c478bd9Sstevel@tonic-gate } 2746e3320f40Smarkfen proto = parsenum(*argv, B_TRUE, ebuf); 27477c478bd9Sstevel@tonic-gate argv++; 27487c478bd9Sstevel@tonic-gate break; 27497c478bd9Sstevel@tonic-gate case TOK_SRCADDR: 27507c478bd9Sstevel@tonic-gate case TOK_SRCADDR6: 27517c478bd9Sstevel@tonic-gate if (src != NULL) { 2752e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2753e3320f40Smarkfen "Can only specify single source addr.\n")); 2754e3320f40Smarkfen break; 27557c478bd9Sstevel@tonic-gate } 27567c478bd9Sstevel@tonic-gate sa_len = parseaddr(*argv, &srchp, 2757e3320f40Smarkfen (token == TOK_SRCADDR6), ebuf); 2758e3320f40Smarkfen if (srchp == NULL) { 2759e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 2760e3320f40Smarkfen "Unknown source address \"%s\"\n"), *argv); 2761e3320f40Smarkfen break; 2762e3320f40Smarkfen } 27637c478bd9Sstevel@tonic-gate argv++; 27647c478bd9Sstevel@tonic-gate 27657c478bd9Sstevel@tonic-gate unspec_src = B_FALSE; 276607b56925Ssommerfe 276707b56925Ssommerfe ALLOC_ADDR_EXT(src, SADB_EXT_ADDRESS_SRC); 276807b56925Ssommerfe 27697c478bd9Sstevel@tonic-gate if (srchp == &dummy.he) { 27707c478bd9Sstevel@tonic-gate /* 27717c478bd9Sstevel@tonic-gate * Single address with -n flag. 27727c478bd9Sstevel@tonic-gate */ 27737c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(src + 1); 27747c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6)); 27757c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6; 27767c478bd9Sstevel@tonic-gate bcopy(srchp->h_addr_list[0], &sin6->sin6_addr, 27777c478bd9Sstevel@tonic-gate sizeof (struct in6_addr)); 27787c478bd9Sstevel@tonic-gate } 27797c478bd9Sstevel@tonic-gate /* The rest is pre-bzeroed for us. */ 27807c478bd9Sstevel@tonic-gate break; 27817c478bd9Sstevel@tonic-gate case TOK_DSTADDR: 27827c478bd9Sstevel@tonic-gate case TOK_DSTADDR6: 27837c478bd9Sstevel@tonic-gate if (dst != NULL) { 2784e3320f40Smarkfen ERROR(ep, ebuf, gettext( 2785e3320f40Smarkfen "Can only specify single destination " 2786e3320f40Smarkfen "address.\n")); 2787e3320f40Smarkfen break; 27887c478bd9Sstevel@tonic-gate } 27897c478bd9Sstevel@tonic-gate sa_len = parseaddr(*argv, &dsthp, 2790e3320f40Smarkfen (token == TOK_SRCADDR6), ebuf); 2791e3320f40Smarkfen if (dsthp == NULL) { 2792e3320f40Smarkfen ERROR1(ep, ebuf, gettext( 2793e3320f40Smarkfen "Unknown destination address \"%s\"\n"), 2794e3320f40Smarkfen *argv); 2795e3320f40Smarkfen break; 2796e3320f40Smarkfen } 27977c478bd9Sstevel@tonic-gate argv++; 27987c478bd9Sstevel@tonic-gate 279907b56925Ssommerfe ALLOC_ADDR_EXT(dst, SADB_EXT_ADDRESS_DST); 280007b56925Ssommerfe 28017c478bd9Sstevel@tonic-gate if (dsthp == &dummy.he) { 28027c478bd9Sstevel@tonic-gate /* 28037c478bd9Sstevel@tonic-gate * Single address with -n flag. 28047c478bd9Sstevel@tonic-gate */ 28057c478bd9Sstevel@tonic-gate sin6 = (struct sockaddr_in6 *)(dst + 1); 28067c478bd9Sstevel@tonic-gate bzero(sin6, sizeof (*sin6)); 28077c478bd9Sstevel@tonic-gate sin6->sin6_family = AF_INET6; 28087c478bd9Sstevel@tonic-gate bcopy(dsthp->h_addr_list[0], &sin6->sin6_addr, 28097c478bd9Sstevel@tonic-gate sizeof (struct in6_addr)); 28107c478bd9Sstevel@tonic-gate } 28117c478bd9Sstevel@tonic-gate /* The rest is pre-bzeroed for us. */ 28127c478bd9Sstevel@tonic-gate break; 28137c478bd9Sstevel@tonic-gate default: 2814e3320f40Smarkfen ERROR2(ep, ebuf, gettext( 2815e3320f40Smarkfen "Don't use extension %s for '%s' command.\n"), 2816e3320f40Smarkfen *(argv - 1), thiscmd); 28177c478bd9Sstevel@tonic-gate break; 28187c478bd9Sstevel@tonic-gate } 28197c478bd9Sstevel@tonic-gate } while (token != TOK_EOF); 28207c478bd9Sstevel@tonic-gate 2821e3320f40Smarkfen handle_errors(ep, ebuf, B_TRUE, B_FALSE); 2822e3320f40Smarkfen 282307b56925Ssommerfe if ((srcport != 0) && (src == NULL)) { 282407b56925Ssommerfe ALLOC_ADDR_EXT(src, SADB_EXT_ADDRESS_SRC); 282507b56925Ssommerfe sin6 = (struct sockaddr_in6 *)(src + 1); 28268810c16bSdanmcd src->sadb_address_proto = proto; 282707b56925Ssommerfe bzero(sin6, sizeof (*sin6)); 282807b56925Ssommerfe sin6->sin6_family = AF_INET6; 28298810c16bSdanmcd sin6->sin6_port = htons(srcport); 283007b56925Ssommerfe } 283107b56925Ssommerfe 283207b56925Ssommerfe if ((dstport != 0) && (dst == NULL)) { 283307b56925Ssommerfe ALLOC_ADDR_EXT(dst, SADB_EXT_ADDRESS_DST); 283407b56925Ssommerfe sin6 = (struct sockaddr_in6 *)(dst + 1); 28358810c16bSdanmcd src->sadb_address_proto = proto; 283607b56925Ssommerfe bzero(sin6, sizeof (*sin6)); 283707b56925Ssommerfe sin6->sin6_family = AF_INET6; 28388810c16bSdanmcd sin6->sin6_port = htons(dstport); 283907b56925Ssommerfe } 284007b56925Ssommerfe 28417c478bd9Sstevel@tonic-gate /* So I have enough of the message to send it down! */ 28427c478bd9Sstevel@tonic-gate msg->sadb_msg_len = nextext - get_buffer; 28437c478bd9Sstevel@tonic-gate 2844e3320f40Smarkfen if (assoc == NULL) { 2845e3320f40Smarkfen FATAL1(ep, ebuf, gettext( 2846e3320f40Smarkfen "Need SA parameters for %s.\n"), thiscmd); 2847e3320f40Smarkfen } 2848e3320f40Smarkfen 284925e435e0Spwernau if (cflag) { 285025e435e0Spwernau /* 285125e435e0Spwernau * Assume the checked cmd would have worked if it was actually 285225e435e0Spwernau * used. doaddresses() will increment lines_added if it 285325e435e0Spwernau * succeeds. 285425e435e0Spwernau */ 285525e435e0Spwernau lines_added++; 285625e435e0Spwernau } else { 2857e3320f40Smarkfen doaddresses((cmd == CMD_GET) ? SADB_GET : SADB_DELETE, satype, 2858e3320f40Smarkfen cmd, srchp, dsthp, src, dst, unspec_src, get_buffer, 2859e3320f40Smarkfen sizeof (get_buffer), spi, NULL); 2860e3320f40Smarkfen } 28617c478bd9Sstevel@tonic-gate 28627c478bd9Sstevel@tonic-gate if (srchp != NULL && srchp != &dummy.he) 28637c478bd9Sstevel@tonic-gate freehostent(srchp); 28647c478bd9Sstevel@tonic-gate if (dsthp != NULL && dsthp != &dummy.he) 28657c478bd9Sstevel@tonic-gate freehostent(dsthp); 28667c478bd9Sstevel@tonic-gate } 28677c478bd9Sstevel@tonic-gate 28687c478bd9Sstevel@tonic-gate /* 28697c478bd9Sstevel@tonic-gate * "ipseckey monitor" should exit very gracefully if ^C is tapped. 28707c478bd9Sstevel@tonic-gate */ 28717c478bd9Sstevel@tonic-gate static void 28727c478bd9Sstevel@tonic-gate monitor_catch(int signal) 28737c478bd9Sstevel@tonic-gate { 28747c478bd9Sstevel@tonic-gate errx(signal, gettext("Bailing on signal %d."), signal); 28757c478bd9Sstevel@tonic-gate } 28767c478bd9Sstevel@tonic-gate 28777c478bd9Sstevel@tonic-gate /* 28787c478bd9Sstevel@tonic-gate * Loop forever, listening on PF_KEY messages. 28797c478bd9Sstevel@tonic-gate */ 28807c478bd9Sstevel@tonic-gate static void 28817c478bd9Sstevel@tonic-gate domonitor(boolean_t passive) 28827c478bd9Sstevel@tonic-gate { 28837c478bd9Sstevel@tonic-gate struct sadb_msg *samsg; 28847c478bd9Sstevel@tonic-gate int rc; 28857c478bd9Sstevel@tonic-gate 28867c478bd9Sstevel@tonic-gate /* Catch ^C. */ 28877c478bd9Sstevel@tonic-gate (void) signal(SIGINT, monitor_catch); 28887c478bd9Sstevel@tonic-gate 28897c478bd9Sstevel@tonic-gate samsg = (struct sadb_msg *)get_buffer; 28907c478bd9Sstevel@tonic-gate if (!passive) { 28917c478bd9Sstevel@tonic-gate (void) printf(gettext("Actively")); 28927c478bd9Sstevel@tonic-gate msg_init(samsg, SADB_X_PROMISC, 1); /* Turn ON promisc. */ 28937c478bd9Sstevel@tonic-gate rc = key_write(keysock, samsg, sizeof (*samsg)); 28947c478bd9Sstevel@tonic-gate if (rc == -1) 28957c478bd9Sstevel@tonic-gate Bail("write (SADB_X_PROMISC)"); 28967c478bd9Sstevel@tonic-gate } else { 28977c478bd9Sstevel@tonic-gate (void) printf(gettext("Passively")); 28987c478bd9Sstevel@tonic-gate } 28997c478bd9Sstevel@tonic-gate (void) printf(gettext(" monitoring the PF_KEY socket.\n")); 29007c478bd9Sstevel@tonic-gate 29017c478bd9Sstevel@tonic-gate for (; ; ) { 29027c478bd9Sstevel@tonic-gate /* 29037c478bd9Sstevel@tonic-gate * I assume that read() is non-blocking, and will never 29047c478bd9Sstevel@tonic-gate * return 0. 29057c478bd9Sstevel@tonic-gate */ 29067c478bd9Sstevel@tonic-gate rc = read(keysock, samsg, sizeof (get_buffer)); 29077c478bd9Sstevel@tonic-gate if (rc == -1) 29087c478bd9Sstevel@tonic-gate Bail("read (in domonitor)"); 29097c478bd9Sstevel@tonic-gate (void) printf(gettext("Read %d bytes.\n"), rc); 29107c478bd9Sstevel@tonic-gate /* 29117c478bd9Sstevel@tonic-gate * Q: Should I use the same method of printing as GET does? 29127c478bd9Sstevel@tonic-gate * A: For now, yes. 29137c478bd9Sstevel@tonic-gate */ 29148810c16bSdanmcd print_samsg(get_buffer, B_TRUE, vflag); 29157c478bd9Sstevel@tonic-gate (void) putchar('\n'); 29167c478bd9Sstevel@tonic-gate } 29177c478bd9Sstevel@tonic-gate } 29187c478bd9Sstevel@tonic-gate 29197c478bd9Sstevel@tonic-gate /* 29207c478bd9Sstevel@tonic-gate * Either mask or unmask all relevant signals. 29217c478bd9Sstevel@tonic-gate */ 29227c478bd9Sstevel@tonic-gate static void 29237c478bd9Sstevel@tonic-gate mask_signals(boolean_t unmask) 29247c478bd9Sstevel@tonic-gate { 29257c478bd9Sstevel@tonic-gate sigset_t set; 29267c478bd9Sstevel@tonic-gate static sigset_t oset; 29277c478bd9Sstevel@tonic-gate 29287c478bd9Sstevel@tonic-gate if (unmask) { 29297c478bd9Sstevel@tonic-gate (void) sigprocmask(SIG_SETMASK, &oset, NULL); 29307c478bd9Sstevel@tonic-gate } else { 29317c478bd9Sstevel@tonic-gate (void) sigfillset(&set); 29327c478bd9Sstevel@tonic-gate (void) sigprocmask(SIG_SETMASK, &set, &oset); 29337c478bd9Sstevel@tonic-gate } 29347c478bd9Sstevel@tonic-gate } 29357c478bd9Sstevel@tonic-gate 29367c478bd9Sstevel@tonic-gate /* 29377c478bd9Sstevel@tonic-gate * Assorted functions to print help text. 29387c478bd9Sstevel@tonic-gate */ 29397c478bd9Sstevel@tonic-gate #define puts_tr(s) (void) puts(gettext(s)) 29407c478bd9Sstevel@tonic-gate 29417c478bd9Sstevel@tonic-gate static void 29427c478bd9Sstevel@tonic-gate doattrhelp() 29437c478bd9Sstevel@tonic-gate { 29447c478bd9Sstevel@tonic-gate int i; 29457c478bd9Sstevel@tonic-gate 29467c478bd9Sstevel@tonic-gate puts_tr("\nSA attributes:"); 29477c478bd9Sstevel@tonic-gate 29487c478bd9Sstevel@tonic-gate for (i = 0; tokens[i].string != NULL; i++) { 29497c478bd9Sstevel@tonic-gate if (i%3 == 0) 29507c478bd9Sstevel@tonic-gate (void) printf("\n"); 29517c478bd9Sstevel@tonic-gate (void) printf(" %-15.15s", tokens[i].string); 29527c478bd9Sstevel@tonic-gate } 29537c478bd9Sstevel@tonic-gate (void) printf("\n"); 29547c478bd9Sstevel@tonic-gate } 29557c478bd9Sstevel@tonic-gate 29567c478bd9Sstevel@tonic-gate static void 29577c478bd9Sstevel@tonic-gate dohelpcmd(char *cmds) 29587c478bd9Sstevel@tonic-gate { 29597c478bd9Sstevel@tonic-gate int cmd; 29607c478bd9Sstevel@tonic-gate 29617c478bd9Sstevel@tonic-gate if (strcmp(cmds, "attr") == 0) { 29627c478bd9Sstevel@tonic-gate doattrhelp(); 29637c478bd9Sstevel@tonic-gate return; 29647c478bd9Sstevel@tonic-gate } 29657c478bd9Sstevel@tonic-gate 29667c478bd9Sstevel@tonic-gate cmd = parsecmd(cmds); 29677c478bd9Sstevel@tonic-gate switch (cmd) { 29687c478bd9Sstevel@tonic-gate case CMD_UPDATE: 29697c478bd9Sstevel@tonic-gate puts_tr("update - Update an existing SA"); 29707c478bd9Sstevel@tonic-gate break; 29717c478bd9Sstevel@tonic-gate case CMD_ADD: 29727c478bd9Sstevel@tonic-gate puts_tr("add - Add a new security association (SA)"); 29737c478bd9Sstevel@tonic-gate break; 29747c478bd9Sstevel@tonic-gate case CMD_DELETE: 29757c478bd9Sstevel@tonic-gate puts_tr("delete - Delete an SA"); 29767c478bd9Sstevel@tonic-gate break; 29777c478bd9Sstevel@tonic-gate case CMD_GET: 29787c478bd9Sstevel@tonic-gate puts_tr("get - Display an SA"); 29797c478bd9Sstevel@tonic-gate break; 29807c478bd9Sstevel@tonic-gate case CMD_FLUSH: 29817c478bd9Sstevel@tonic-gate puts_tr("flush - Delete all SAs"); 29827c478bd9Sstevel@tonic-gate break; 29837c478bd9Sstevel@tonic-gate case CMD_DUMP: 29847c478bd9Sstevel@tonic-gate puts_tr("dump - Display all SAs"); 29857c478bd9Sstevel@tonic-gate break; 29867c478bd9Sstevel@tonic-gate case CMD_MONITOR: 29877c478bd9Sstevel@tonic-gate puts_tr("monitor - Monitor all PF_KEY reply messages."); 29887c478bd9Sstevel@tonic-gate break; 29897c478bd9Sstevel@tonic-gate case CMD_PMONITOR: 29907c478bd9Sstevel@tonic-gate puts_tr( 29917c478bd9Sstevel@tonic-gate "pmonitor, passive_monitor - Monitor PF_KEY messages that"); 29927c478bd9Sstevel@tonic-gate puts_tr( 29937c478bd9Sstevel@tonic-gate " reply to all PF_KEY sockets."); 29947c478bd9Sstevel@tonic-gate break; 29957c478bd9Sstevel@tonic-gate 29967c478bd9Sstevel@tonic-gate case CMD_QUIT: 29977c478bd9Sstevel@tonic-gate puts_tr("quit, exit - Exit the program"); 29987c478bd9Sstevel@tonic-gate break; 29997c478bd9Sstevel@tonic-gate case CMD_SAVE: 30007c478bd9Sstevel@tonic-gate puts_tr("save - Saves all SAs to a file"); 30017c478bd9Sstevel@tonic-gate break; 30027c478bd9Sstevel@tonic-gate case CMD_HELP: 30037c478bd9Sstevel@tonic-gate puts_tr("help - Display list of commands"); 30047c478bd9Sstevel@tonic-gate puts_tr("help <cmd> - Display help for command"); 30057c478bd9Sstevel@tonic-gate puts_tr("help attr - Display possible SA attributes"); 30067c478bd9Sstevel@tonic-gate break; 30077c478bd9Sstevel@tonic-gate default: 30087c478bd9Sstevel@tonic-gate (void) printf(gettext("%s: Unknown command\n"), cmds); 30097c478bd9Sstevel@tonic-gate break; 30107c478bd9Sstevel@tonic-gate } 30117c478bd9Sstevel@tonic-gate } 30127c478bd9Sstevel@tonic-gate 30137c478bd9Sstevel@tonic-gate 30147c478bd9Sstevel@tonic-gate static void 30157c478bd9Sstevel@tonic-gate dohelp(char *cmds) 30167c478bd9Sstevel@tonic-gate { 30177c478bd9Sstevel@tonic-gate if (cmds != NULL) { 30187c478bd9Sstevel@tonic-gate dohelpcmd(cmds); 30197c478bd9Sstevel@tonic-gate return; 30207c478bd9Sstevel@tonic-gate } 30217c478bd9Sstevel@tonic-gate puts_tr("Commands"); 30227c478bd9Sstevel@tonic-gate puts_tr("--------"); 30237c478bd9Sstevel@tonic-gate puts_tr("?, help - Display this list"); 30247c478bd9Sstevel@tonic-gate puts_tr("help <cmd> - Display help for command"); 30257c478bd9Sstevel@tonic-gate puts_tr("help attr - Display possible SA attributes"); 30267c478bd9Sstevel@tonic-gate puts_tr("quit, exit - Exit the program"); 30277c478bd9Sstevel@tonic-gate puts_tr("monitor - Monitor all PF_KEY reply messages."); 30287c478bd9Sstevel@tonic-gate puts_tr("pmonitor, passive_monitor - Monitor PF_KEY messages that"); 30297c478bd9Sstevel@tonic-gate puts_tr(" reply to all PF_KEY sockets."); 30307c478bd9Sstevel@tonic-gate puts_tr(""); 30317c478bd9Sstevel@tonic-gate puts_tr("The following commands are of the form:"); 30327c478bd9Sstevel@tonic-gate puts_tr(" <command> {SA type} {attribute value}*"); 30337c478bd9Sstevel@tonic-gate puts_tr(""); 30347c478bd9Sstevel@tonic-gate puts_tr("add (interactive only) - Add a new security association (SA)"); 30357c478bd9Sstevel@tonic-gate puts_tr("update (interactive only) - Update an existing SA"); 30367c478bd9Sstevel@tonic-gate puts_tr("delete - Delete an SA"); 30377c478bd9Sstevel@tonic-gate puts_tr("get - Display an SA"); 30387c478bd9Sstevel@tonic-gate puts_tr("flush - Delete all SAs"); 30397c478bd9Sstevel@tonic-gate puts_tr("dump - Display all SAs"); 30407c478bd9Sstevel@tonic-gate puts_tr("save - Saves all SAs to a file"); 30417c478bd9Sstevel@tonic-gate } 30427c478bd9Sstevel@tonic-gate 30437c478bd9Sstevel@tonic-gate /* 30447c478bd9Sstevel@tonic-gate * "Parse" a command line from argv. 30457c478bd9Sstevel@tonic-gate */ 30467c478bd9Sstevel@tonic-gate static void 304725e435e0Spwernau parseit(int argc, char *argv[], char *ebuf, boolean_t read_cmdfile) 30487c478bd9Sstevel@tonic-gate { 30497c478bd9Sstevel@tonic-gate int cmd, satype; 3050e3320f40Smarkfen char *ep = NULL; 30517c478bd9Sstevel@tonic-gate 30527c478bd9Sstevel@tonic-gate if (argc == 0) 30537c478bd9Sstevel@tonic-gate return; 30547c478bd9Sstevel@tonic-gate cmd = parsecmd(*argv++); 30557c478bd9Sstevel@tonic-gate 305625e435e0Spwernau /* 305725e435e0Spwernau * Some commands loop forever and should only be run from the command 305825e435e0Spwernau * line, they should never be run from a command file as this may 305925e435e0Spwernau * be used at boot time. 306025e435e0Spwernau */ 30617c478bd9Sstevel@tonic-gate switch (cmd) { 30627c478bd9Sstevel@tonic-gate case CMD_HELP: 306325e435e0Spwernau if (read_cmdfile) 306425e435e0Spwernau ERROR(ep, ebuf, gettext("Help not appropriate in " 306525e435e0Spwernau "config file.")); 306625e435e0Spwernau else 306725e435e0Spwernau dohelp(*argv); 30687c478bd9Sstevel@tonic-gate return; 30697c478bd9Sstevel@tonic-gate case CMD_MONITOR: 307025e435e0Spwernau if (read_cmdfile) 307125e435e0Spwernau ERROR(ep, ebuf, gettext("Monitor not appropriate in " 307225e435e0Spwernau "config file.")); 307325e435e0Spwernau else 307425e435e0Spwernau domonitor(B_FALSE); 30757c478bd9Sstevel@tonic-gate break; 30767c478bd9Sstevel@tonic-gate case CMD_PMONITOR: 307725e435e0Spwernau if (read_cmdfile) 307825e435e0Spwernau ERROR(ep, ebuf, gettext("Monitor not appropriate in " 307925e435e0Spwernau "config file.")); 308025e435e0Spwernau else 308125e435e0Spwernau domonitor(B_TRUE); 30827c478bd9Sstevel@tonic-gate break; 30837c478bd9Sstevel@tonic-gate case CMD_QUIT: 3084e3320f40Smarkfen EXIT_OK(NULL); 30857c478bd9Sstevel@tonic-gate } 30867c478bd9Sstevel@tonic-gate 308725e435e0Spwernau handle_errors(ep, ebuf, B_FALSE, B_FALSE); 308825e435e0Spwernau 3089e3320f40Smarkfen satype = parsesatype(*argv, ebuf); 30907c478bd9Sstevel@tonic-gate 30917c478bd9Sstevel@tonic-gate if (satype != SADB_SATYPE_UNSPEC) { 30927c478bd9Sstevel@tonic-gate argv++; 30937c478bd9Sstevel@tonic-gate } else { 30947c478bd9Sstevel@tonic-gate /* 30957c478bd9Sstevel@tonic-gate * You must specify either "all" or a specific SA type 30967c478bd9Sstevel@tonic-gate * for the "save" command. 30977c478bd9Sstevel@tonic-gate */ 30987c478bd9Sstevel@tonic-gate if (cmd == CMD_SAVE) 30997c478bd9Sstevel@tonic-gate if (*argv == NULL) { 3100e3320f40Smarkfen FATAL(ep, ebuf, gettext( 3101e3320f40Smarkfen "Must specify a specific " 3102e3320f40Smarkfen "SA type for save.\n")); 31037c478bd9Sstevel@tonic-gate } else { 31047c478bd9Sstevel@tonic-gate argv++; 31057c478bd9Sstevel@tonic-gate } 31067c478bd9Sstevel@tonic-gate } 31077c478bd9Sstevel@tonic-gate 31087c478bd9Sstevel@tonic-gate switch (cmd) { 31097c478bd9Sstevel@tonic-gate case CMD_FLUSH: 311025e435e0Spwernau if (!cflag) 311125e435e0Spwernau doflush(satype); 311225e435e0Spwernau /* 311325e435e0Spwernau * If this was called because of an entry in a cmd file 311425e435e0Spwernau * then this action needs to be counted to prevent 311525e435e0Spwernau * do_interactive() treating this as an error. 311625e435e0Spwernau */ 311725e435e0Spwernau lines_added++; 31187c478bd9Sstevel@tonic-gate break; 31197c478bd9Sstevel@tonic-gate case CMD_ADD: 31207c478bd9Sstevel@tonic-gate case CMD_UPDATE: 31217c478bd9Sstevel@tonic-gate /* 31227c478bd9Sstevel@tonic-gate * NOTE: Shouldn't allow ADDs or UPDATEs with keying material 31237c478bd9Sstevel@tonic-gate * from the command line. 31247c478bd9Sstevel@tonic-gate */ 31257c478bd9Sstevel@tonic-gate if (!interactive) { 31267c478bd9Sstevel@tonic-gate errx(1, gettext( 3127e3320f40Smarkfen "can't do ADD or UPDATE from the command line.\n")); 31287c478bd9Sstevel@tonic-gate } 31297c478bd9Sstevel@tonic-gate if (satype == SADB_SATYPE_UNSPEC) { 3130e3320f40Smarkfen FATAL(ep, ebuf, gettext( 3131e3320f40Smarkfen "Must specify a specific SA type.")); 31327c478bd9Sstevel@tonic-gate /* NOTREACHED */ 31337c478bd9Sstevel@tonic-gate } 31347c478bd9Sstevel@tonic-gate /* Parse for extensions, including keying material. */ 3135e3320f40Smarkfen doaddup(cmd, satype, argv, ebuf); 31367c478bd9Sstevel@tonic-gate break; 31377c478bd9Sstevel@tonic-gate case CMD_DELETE: 31387c478bd9Sstevel@tonic-gate case CMD_GET: 31397c478bd9Sstevel@tonic-gate if (satype == SADB_SATYPE_UNSPEC) { 3140e3320f40Smarkfen FATAL(ep, ebuf, gettext( 3141e3320f40Smarkfen "Must specify a single SA type.")); 31427c478bd9Sstevel@tonic-gate /* NOTREACHED */ 31437c478bd9Sstevel@tonic-gate } 31447c478bd9Sstevel@tonic-gate /* Parse for bare minimum to locate an SA. */ 3145e3320f40Smarkfen dodelget(cmd, satype, argv, ebuf); 31467c478bd9Sstevel@tonic-gate break; 31477c478bd9Sstevel@tonic-gate case CMD_DUMP: 314825e435e0Spwernau if (read_cmdfile) 314925e435e0Spwernau ERROR(ep, ebuf, gettext("Dump not appropriate in " 315025e435e0Spwernau "config file.")); 315125e435e0Spwernau else 315225e435e0Spwernau dodump(satype, NULL); 31537c478bd9Sstevel@tonic-gate break; 31547c478bd9Sstevel@tonic-gate case CMD_SAVE: 315525e435e0Spwernau if (read_cmdfile) { 315625e435e0Spwernau ERROR(ep, ebuf, gettext("Save not appropriate in " 315725e435e0Spwernau "config file.")); 315825e435e0Spwernau } else { 315925e435e0Spwernau mask_signals(B_FALSE); /* Mask signals */ 316025e435e0Spwernau dodump(satype, opensavefile(argv[0])); 316125e435e0Spwernau mask_signals(B_TRUE); /* Unmask signals */ 316225e435e0Spwernau } 31637c478bd9Sstevel@tonic-gate break; 31647c478bd9Sstevel@tonic-gate default: 3165e3320f40Smarkfen warnx(gettext("Unknown command (%s).\n"), 31667c478bd9Sstevel@tonic-gate *(argv - ((satype == SADB_SATYPE_UNSPEC) ? 1 : 2))); 31677c478bd9Sstevel@tonic-gate usage(); 31687c478bd9Sstevel@tonic-gate } 316925e435e0Spwernau handle_errors(ep, ebuf, B_FALSE, B_FALSE); 31707c478bd9Sstevel@tonic-gate } 31717c478bd9Sstevel@tonic-gate 31727c478bd9Sstevel@tonic-gate int 31737c478bd9Sstevel@tonic-gate main(int argc, char *argv[]) 31747c478bd9Sstevel@tonic-gate { 31757c478bd9Sstevel@tonic-gate int ch; 31767c478bd9Sstevel@tonic-gate FILE *infile = stdin, *savefile; 31777c478bd9Sstevel@tonic-gate boolean_t dosave = B_FALSE, readfile = B_FALSE; 3178e3320f40Smarkfen char *configfile = NULL; 31797c478bd9Sstevel@tonic-gate 31807c478bd9Sstevel@tonic-gate (void) setlocale(LC_ALL, ""); 31817c478bd9Sstevel@tonic-gate #if !defined(TEXT_DOMAIN) 31827c478bd9Sstevel@tonic-gate #define TEXT_DOMAIN "SYS_TEST" 31837c478bd9Sstevel@tonic-gate #endif 31847c478bd9Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN); 31857c478bd9Sstevel@tonic-gate 3186e3320f40Smarkfen /* 3187e3320f40Smarkfen * Check to see if the command is being run from smf(5). 3188e3320f40Smarkfen */ 3189e3320f40Smarkfen my_fmri = getenv("SMF_FMRI"); 3190e3320f40Smarkfen 31917c478bd9Sstevel@tonic-gate openlog("ipseckey", LOG_CONS, LOG_AUTH); 31927c478bd9Sstevel@tonic-gate if (getuid() != 0) { 3193e3320f40Smarkfen errx(1, "Insufficient privileges to run ipseckey."); 31947c478bd9Sstevel@tonic-gate } 31957c478bd9Sstevel@tonic-gate 31967c478bd9Sstevel@tonic-gate /* umask me to paranoid, I only want to create files read-only */ 31977c478bd9Sstevel@tonic-gate (void) umask((mode_t)00377); 31987c478bd9Sstevel@tonic-gate 3199e3320f40Smarkfen while ((ch = getopt(argc, argv, "pnvf:s:c:")) != EOF) 32007c478bd9Sstevel@tonic-gate switch (ch) { 32017c478bd9Sstevel@tonic-gate case 'p': 32027c478bd9Sstevel@tonic-gate pflag = B_TRUE; 32037c478bd9Sstevel@tonic-gate break; 32047c478bd9Sstevel@tonic-gate case 'n': 32057c478bd9Sstevel@tonic-gate nflag = B_TRUE; 32067c478bd9Sstevel@tonic-gate break; 32077c478bd9Sstevel@tonic-gate case 'v': 32087c478bd9Sstevel@tonic-gate vflag = B_TRUE; 32097c478bd9Sstevel@tonic-gate break; 3210e3320f40Smarkfen case 'c': 3211e3320f40Smarkfen cflag = B_TRUE; 3212e3320f40Smarkfen /* FALLTHRU */ 32137c478bd9Sstevel@tonic-gate case 'f': 32147c478bd9Sstevel@tonic-gate if (dosave) 32157c478bd9Sstevel@tonic-gate usage(); 32167c478bd9Sstevel@tonic-gate infile = fopen(optarg, "r"); 3217e3320f40Smarkfen if (infile == NULL) { 3218e3320f40Smarkfen EXIT_BADCONFIG2("Unable to open configuration " 3219e3320f40Smarkfen "file: %s\n", optarg); 3220e3320f40Smarkfen } 3221e3320f40Smarkfen configfile = strdup(optarg); 32227c478bd9Sstevel@tonic-gate readfile = B_TRUE; 32237c478bd9Sstevel@tonic-gate break; 32247c478bd9Sstevel@tonic-gate case 's': 32257c478bd9Sstevel@tonic-gate if (readfile) 32267c478bd9Sstevel@tonic-gate usage(); 32277c478bd9Sstevel@tonic-gate dosave = B_TRUE; 32287c478bd9Sstevel@tonic-gate savefile = opensavefile(optarg); 32297c478bd9Sstevel@tonic-gate break; 32307c478bd9Sstevel@tonic-gate default: 32317c478bd9Sstevel@tonic-gate usage(); 32327c478bd9Sstevel@tonic-gate } 32337c478bd9Sstevel@tonic-gate 32347c478bd9Sstevel@tonic-gate argc -= optind; 32357c478bd9Sstevel@tonic-gate argv += optind; 32367c478bd9Sstevel@tonic-gate 32377c478bd9Sstevel@tonic-gate mypid = getpid(); 32387c478bd9Sstevel@tonic-gate 32397c478bd9Sstevel@tonic-gate keysock = socket(PF_KEY, SOCK_RAW, PF_KEY_V2); 32407c478bd9Sstevel@tonic-gate 3241e3320f40Smarkfen if (keysock == -1) { 3242e3320f40Smarkfen if (errno == EPERM) { 3243e3320f40Smarkfen EXIT_BADPERM("Insufficient privileges to open " 3244e3320f40Smarkfen "PF_KEY socket.\n"); 3245e3320f40Smarkfen } else { 3246e3320f40Smarkfen /* some other reason */ 3247e3320f40Smarkfen EXIT_FATAL("Opening PF_KEY socket"); 3248e3320f40Smarkfen } 3249e3320f40Smarkfen } 32507c478bd9Sstevel@tonic-gate 32517c478bd9Sstevel@tonic-gate if (dosave) { 32527c478bd9Sstevel@tonic-gate mask_signals(B_FALSE); /* Mask signals */ 32537c478bd9Sstevel@tonic-gate dodump(SADB_SATYPE_UNSPEC, savefile); 32547c478bd9Sstevel@tonic-gate mask_signals(B_TRUE); /* Unmask signals */ 3255e3320f40Smarkfen EXIT_OK(NULL); 32567c478bd9Sstevel@tonic-gate } 32577c478bd9Sstevel@tonic-gate 3258e3320f40Smarkfen /* 3259e3320f40Smarkfen * When run from smf(5) flush any existing SA's first 3260e3320f40Smarkfen * otherwise you will end up in maintenance mode. 3261e3320f40Smarkfen */ 3262e3320f40Smarkfen if ((my_fmri != NULL) && readfile) { 3263e3320f40Smarkfen (void) fprintf(stdout, gettext( 3264e3320f40Smarkfen "Flushing existing SA's before adding new SA's\n")); 3265e3320f40Smarkfen (void) fflush(stdout); 3266e3320f40Smarkfen doflush(SADB_SATYPE_UNSPEC); 3267e3320f40Smarkfen } 32687c478bd9Sstevel@tonic-gate if (infile != stdin || *argv == NULL) { 32697c478bd9Sstevel@tonic-gate /* Go into interactive mode here. */ 3270e3320f40Smarkfen do_interactive(infile, configfile, "ipseckey> ", my_fmri, 3271e3320f40Smarkfen parseit); 32727c478bd9Sstevel@tonic-gate } 327325e435e0Spwernau parseit(argc, argv, NULL, B_FALSE); 32747c478bd9Sstevel@tonic-gate 32757c478bd9Sstevel@tonic-gate return (0); 32767c478bd9Sstevel@tonic-gate } 3277