]> git.saurik.com Git - apple/ipsec.git/blob - ipsec-tools/racoon/cfparse.y
projects / apple / ipsec.git / blob
? search:


9089a3e623373302cfaa86d19cca908d4e909ee8
[apple/ipsec.git] / ipsec-tools / racoon / cfparse.y
1 /* $NetBSD: cfparse.y,v 1.18.4.3 2007/08/01 11:52:19 vanhu Exp $ */
2
3 /* Id: cfparse.y,v 1.66 2006/08/22 18:17:17 manubsd Exp */
4
5 %{
6 /*
7 * Copyright (C) 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002 and 2003 WIDE Project.
8 * All rights reserved.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 * 3. Neither the name of the project nor the names of its contributors
19 * may be used to endorse or promote products derived from this software
20 * without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 * SUCH DAMAGE.
33 */
34
35 #include "config.h"
36
37 #include <sys/types.h>
38 #include <sys/param.h>
39 #include <sys/queue.h>
40 #include <sys/socket.h>
41
42 #include <netinet/in.h>
43 #ifdef HAVE_NETINET6_IPSEC
44 # include <netinet6/ipsec.h>
45 #else
46 # include <netinet/ipsec.h>
47 #endif
48
49 #ifdef ENABLE_HYBRID
50 #include <arpa/inet.h>
51 #endif
52
53 #include <stdlib.h>
54 #include <stdio.h>
55 #include <string.h>
56 #include <errno.h>
57 #include <netdb.h>
58 #include <pwd.h>
59 #include <grp.h>
60 #include <signal.h>
61
62 #include "var.h"
63 #include "misc.h"
64 #include "vmbuf.h"
65 #include "plog.h"
66 #include "sockmisc.h"
67 #include "str2val.h"
68 #include "genlist.h"
69 #include "debug.h"
70
71 #include "admin.h"
72 #include "privsep.h"
73 #include "cfparse_proto.h"
74 #include "cftoken_proto.h"
75 #include "algorithm.h"
76 #include "localconf.h"
77 #include "policy.h"
78 #include "sainfo.h"
79 #include "oakley.h"
80 #include "pfkey.h"
81 #include "remoteconf.h"
82 #include "grabmyaddr.h"
83 #include "isakmp_var.h"
84 #include "handler.h"
85 #include "isakmp.h"
86 #include "nattraversal.h"
87 #include "isakmp_frag.h"
88 #include "session.h"
89 #ifdef ENABLE_HYBRID
90 #include "resolv.h"
91 #include "isakmp_unity.h"
92 #include "isakmp_xauth.h"
93 #include "isakmp_cfg.h"
94 #endif
95 #include "ipsec_doi.h"
96 #include "strnames.h"
97 #include "gcmalloc.h"
98 #ifdef HAVE_GSSAPI
99 #include "gssapi.h"
100 #endif
101 #include "vendorid.h"
102 #include "ipsecConfigTracer.h"
103 #include "ipsecMessageTracer.h"
104
105
106 static int num2dhgroup[] = {
107 0,
108 OAKLEY_ATTR_GRP_DESC_MODP768,
109 OAKLEY_ATTR_GRP_DESC_MODP1024,
110 OAKLEY_ATTR_GRP_DESC_EC2N155,
111 OAKLEY_ATTR_GRP_DESC_EC2N185,
112 OAKLEY_ATTR_GRP_DESC_MODP1536,
113 0,
114 0,
115 0,
116 0,
117 0,
118 0,
119 0,
120 0,
121 OAKLEY_ATTR_GRP_DESC_MODP2048,
122 OAKLEY_ATTR_GRP_DESC_MODP3072,
123 OAKLEY_ATTR_GRP_DESC_MODP4096,
124 OAKLEY_ATTR_GRP_DESC_MODP6144,
125 OAKLEY_ATTR_GRP_DESC_MODP8192
126 };
127
128 struct remote_index_val {
129 int prefix;
130 struct sockaddr_storage *addr;
131 };
132
133 static struct remoteconf *cur_rmconf;
134 static int tmpalgtype[MAXALGCLASS];
135 static struct sainfo *cur_sainfo;
136 static int cur_algclass;
137 static int oldloglevel = LLV_BASE;
138
139 static struct proposalspec *newprspec __P((void));
140 static void insprspec __P((struct proposalspec *, struct proposalspec **));
141 static struct secprotospec *newspspec __P((void));
142 static void insspspec __P((struct secprotospec *, struct proposalspec **));
143 static void adminsock_conf __P((vchar_t *, vchar_t *, vchar_t *, int));
144
145 static int set_isakmp_proposal
146 __P((struct remoteconf *, struct proposalspec *));
147 static void clean_tmpalgtype __P((void));
148 static int expand_isakmpspec __P((int, int, int *,
149 int, int, time_t, int, int, int, char *, struct remoteconf *));
150 static int listen_addr __P((struct sockaddr_storage *addr, int udp_encap));
151
152 void freeetypes (struct etypes **etypes);
153
154 #if 0
155 static int fix_lifebyte __P((u_long));
156 #endif
157 %}
158
159 %union {
160 unsigned long num;
161 vchar_t *val;
162 struct remoteconf *rmconf;
163 struct sockaddr_storage *saddr;
164 struct sainfoalg *alg;
165 struct remote_index_val *rmidx;
166 }
167
168 /* privsep */
169 %token PRIVSEP USER GROUP CHROOT
170 /* path */
171 %token PATH PATHTYPE
172 /* include */
173 %token INCLUDE
174 /* self information */
175 %token IDENTIFIER VENDORID
176 /* logging */
177 %token LOGGING LOGLEV
178 /* padding */
179 %token PADDING PAD_RANDOMIZE PAD_RANDOMIZELEN PAD_MAXLEN PAD_STRICT PAD_EXCLTAIL
180 /* listen */
181 %token LISTEN X_ISAKMP X_ISAKMP_NATT X_ADMIN STRICT_ADDRESS ADMINSOCK DISABLED
182 /* modecfg */
183 %token MODECFG CFG_NET4 CFG_MASK4 CFG_DNS4 CFG_NBNS4 CFG_DEFAULT_DOMAIN
184 %token CFG_AUTH_SOURCE CFG_AUTH_GROUPS CFG_SYSTEM CFG_RADIUS CFG_PAM CFG_LDAP CFG_LOCAL CFG_NONE
185 %token CFG_GROUP_SOURCE CFG_ACCOUNTING CFG_CONF_SOURCE CFG_MOTD CFG_POOL_SIZE CFG_AUTH_THROTTLE
186 %token CFG_SPLIT_NETWORK CFG_SPLIT_LOCAL CFG_SPLIT_INCLUDE CFG_SPLIT_DNS
187 %token CFG_PFS_GROUP CFG_SAVE_PASSWD
188 /* timer */
189 %token RETRY RETRY_COUNTER RETRY_INTERVAL RETRY_PERSEND
190 %token RETRY_PHASE1 RETRY_PHASE2 NATT_KA AUTO_EXIT_DELAY
191 /* algorithm */
192 %token ALGORITHM_CLASS ALGORITHMTYPE STRENGTHTYPE
193 /* sainfo */
194 %token SAINFO FROM
195 /* remote */
196 %token REMOTE ANONYMOUS INHERIT
197 %token EXCHANGE_MODE EXCHANGETYPE DOI DOITYPE SITUATION SITUATIONTYPE
198 %token CERTIFICATE_TYPE CERTTYPE PEERS_CERTFILE CA_TYPE
199 %token VERIFY_CERT SEND_CERT SEND_CR
200 %token IDENTIFIERTYPE IDENTIFIERQUAL MY_IDENTIFIER
201 %token PEERS_IDENTIFIER VERIFY_IDENTIFIER
202 %token SHARED_SECRET SECRETTYPE
203 %token OPEN_DIR_AUTH_GROUP IN_KEYCHAIN
204 %token CERTIFICATE_VERIFICATION VERIFICATION_MODULE VERIFICATION_OPTION
205 %token DNSSEC CERT_X509 CERT_PLAINRSA
206 %token NONCE_SIZE DH_GROUP KEEPALIVE PASSIVE INITIAL_CONTACT
207 %token NAT_TRAVERSAL REMOTE_FORCE_LEVEL NAT_TRAVERSAL_LEVEL NAT_TRAVERSAL_MULTI_USER NAT_TRAVERSAL_KEEPALIVE
208 %token PROPOSAL_CHECK PROPOSAL_CHECK_LEVEL
209 %token GENERATE_POLICY GENERATE_LEVEL SUPPORT_PROXY
210 %token PROPOSAL
211 %token EXEC_PATH EXEC_COMMAND EXEC_SUCCESS EXEC_FAILURE
212 %token GSS_ID GSS_ID_ENC GSS_ID_ENCTYPE
213 %token COMPLEX_BUNDLE
214 %token DPD DPD_DELAY DPD_RETRY DPD_MAXFAIL DPD_ALGORITHM
215 %token DISCONNECT_ON_IDLE IDLE_TIMEOUT IDLE_DIRECTION
216 %token XAUTH_LOGIN WEAK_PHASE1_CHECK
217
218 %token PREFIX PORT PORTANY UL_PROTO ANY IKE_FRAG ESP_FRAG MODE_CFG
219 %token PFS_GROUP LIFETIME LIFETYPE_TIME LIFETYPE_BYTE STRENGTH REMOTEID
220
221 %token SCRIPT PHASE1_UP PHASE1_DOWN
222
223 %token NUMBER SWITCH BOOLEAN
224 %token HEXSTRING QUOTEDSTRING ADDRSTRING ADDRRANGE
225 %token UNITTYPE_BYTE UNITTYPE_KBYTES UNITTYPE_MBYTES UNITTYPE_TBYTES
226 %token UNITTYPE_SEC UNITTYPE_MIN UNITTYPE_HOUR
227 %token EOS BOC EOC COMMA
228 %token DPD_ALGO_TYPE_DEFAULT DPD_ALGO_TYPE_INBOUND DPD_ALGO_TYPE_BLACKHOLE
229 %token IDLE_DIRECTION_IN IDLE_DIRECTION_OUT IDLE_DIRECTION_ANY
230
231 %type <num> NUMBER BOOLEAN SWITCH keylength
232 %type <num> PATHTYPE IDENTIFIERTYPE IDENTIFIERQUAL LOGLEV GSS_ID_ENCTYPE
233 %type <num> SECRETTYPE
234 %type <num> ALGORITHM_CLASS dh_group_num
235 %type <num> ALGORITHMTYPE STRENGTHTYPE
236 %type <num> PREFIX prefix PORT port ike_port
237 %type <num> ul_proto UL_PROTO
238 %type <num> EXCHANGETYPE DOITYPE SITUATIONTYPE
239 %type <num> CERTTYPE CERT_X509 CERT_PLAINRSA PROPOSAL_CHECK_LEVEL NAT_TRAVERSAL_LEVEL GENERATE_LEVEL
240 %type <num> VERIFICATION_MODULE VERIFICATION_OPTION
241 %type <num> unittype_time unittype_byte
242 %type <val> QUOTEDSTRING HEXSTRING ADDRSTRING ADDRRANGE sainfo_id
243 %type <val> identifierstring
244 %type <saddr> ike_addrinfo_port
245 %type <alg> algorithm
246 %type <num> dpd_algo_type
247 %type <num> idle_dir_type
248 %type <rmidx> remote_index ike_addrinfo_prefix_port
249
250 %%
251
252 statements
253 : /* nothing */
254 | statements statement
255 ;
256 statement
257 : privsep_statement
258 | path_statement
259 | include_statement
260 | gssenc_statement
261 | identifier_statement
262 | logging_statement
263 | padding_statement
264 | listen_statement
265 | modecfg_statement
266 | timer_statement
267 | sainfo_statement
268 | remote_statement
269 | special_statement
270 ;
271
272 /* privsep */
273 privsep_statement
274 : PRIVSEP BOC privsep_stmts EOC
275 ;
276 privsep_stmts
277 : /* nothing */
278 | privsep_stmts privsep_stmt
279 ;
280 privsep_stmt
281 : USER QUOTEDSTRING
282 {
283 struct passwd *pw;
284
285 if ((pw = getpwnam($2->v)) == NULL) {
286 racoon_yyerror("unknown user \"%s\"", $2->v);
287 return -1;
288 }
289 lcconf->uid = pw->pw_uid;
290 }
291 EOS
292 | USER NUMBER { lcconf->uid = $2; } EOS
293 | GROUP QUOTEDSTRING
294 {
295 struct group *gr;
296
297 if ((gr = getgrnam($2->v)) == NULL) {
298 racoon_yyerror("unknown group \"%s\"", $2->v);
299 return -1;
300 }
301 lcconf->gid = gr->gr_gid;
302 }
303 EOS
304 | GROUP NUMBER { lcconf->gid = $2; } EOS
305 | CHROOT QUOTEDSTRING { lcconf->chroot = $2->v; } EOS
306 ;
307
308 /* path */
309 path_statement
310 : PATH PATHTYPE QUOTEDSTRING
311 {
312 if ($2 >= LC_PATHTYPE_MAX) {
313 racoon_yyerror("invalid path type %d", $2);
314 return -1;
315 }
316
317 /* free old pathinfo */
318 if (lcconf->pathinfo[$2])
319 racoon_free(lcconf->pathinfo[$2]);
320
321 /* set new pathinfo */
322 lcconf->pathinfo[$2] = racoon_strdup($3->v);
323 STRDUP_FATAL(lcconf->pathinfo[$2]);
324 vfree($3);
325 }
326 EOS
327 ;
328
329 /* special */
330 special_statement
331 : COMPLEX_BUNDLE SWITCH { lcconf->complex_bundle = $2; } EOS
332 ;
333
334 /* include */
335 include_statement
336 : INCLUDE QUOTEDSTRING EOS
337 {
338 char path[MAXPATHLEN];
339
340 getpathname(path, sizeof(path),
341 LC_PATHTYPE_INCLUDE, $2->v);
342 vfree($2);
343 if (yycf_switch_buffer(path) != 0)
344 return -1;
345 }
346 ;
347
348 /* gss_id_enc */
349 gssenc_statement
350 : GSS_ID_ENC GSS_ID_ENCTYPE EOS
351 {
352 if ($2 >= LC_GSSENC_MAX) {
353 racoon_yyerror("invalid GSS ID encoding %d", $2);
354 return -1;
355 }
356 lcconf->gss_id_enc = $2;
357 }
358 ;
359
360 /* self information */
361 identifier_statement
362 : IDENTIFIER identifier_stmt
363 ;
364 identifier_stmt
365 : VENDORID
366 {
367 /*XXX to be deleted */
368 }
369 QUOTEDSTRING EOS
370 | IDENTIFIERTYPE QUOTEDSTRING
371 {
372 /*XXX to be deleted */
373 $2->l--; /* nuke '\0' */
374 lcconf->ident[$1] = $2;
375 if (lcconf->ident[$1] == NULL) {
376 racoon_yyerror("failed to set my ident: %s",
377 strerror(errno));
378 return -1;
379 }
380 }
381 EOS
382 ;
383
384 /* logging */
385 logging_statement
386 : LOGGING log_level EOS
387 ;
388 log_level
389 : HEXSTRING
390 {
391 /*
392 * XXX ignore it because this specification
393 * will be obsoleted.
394 */
395 racoon_yywarn("see racoon.conf(5), such a log specification will be obsoleted.");
396 vfree($1);
397 }
398 | LOGLEV
399 {
400 /*
401 * set the loglevel to the value specified
402 * in the configuration file plus the number
403 * of -d options specified on the command line
404 */
405 loglevel += $1 - oldloglevel;
406 oldloglevel = $1;
407 }
408 ;
409
410 /* padding */
411 padding_statement
412 : PADDING BOC padding_stmts EOC
413 ;
414 padding_stmts
415 : /* nothing */
416 | padding_stmts padding_stmt
417 ;
418 padding_stmt
419 : PAD_RANDOMIZE SWITCH { lcconf->pad_random = $2; } EOS
420 | PAD_RANDOMIZELEN SWITCH { lcconf->pad_randomlen = $2; } EOS
421 | PAD_MAXLEN NUMBER { lcconf->pad_maxsize = $2; } EOS
422 | PAD_STRICT SWITCH { lcconf->pad_strict = $2; } EOS
423 | PAD_EXCLTAIL SWITCH { lcconf->pad_excltail = $2; } EOS
424 ;
425
426 /* listen */
427 listen_statement
428 : LISTEN BOC listen_stmts EOC
429 ;
430 listen_stmts
431 : /* nothing */
432 | listen_stmts listen_stmt
433 ;
434 listen_stmt
435 : X_ISAKMP ike_addrinfo_port
436 {
437 listen_addr ($2, 0);
438 }
439 EOS
440 | X_ISAKMP_NATT ike_addrinfo_port
441 {
442 #ifdef ENABLE_NATT
443 listen_addr ($2, 1);
444 #else
445 racoon_yyerror("NAT-T support not compiled in.");
446 #endif
447 }
448 EOS
449 | X_ADMIN
450 {
451 racoon_yyerror("admin directive is obsoleted.");
452 }
453 PORT EOS
454 | ADMINSOCK QUOTEDSTRING QUOTEDSTRING QUOTEDSTRING NUMBER
455 {
456 #ifdef ENABLE_ADMINPORT
457 adminsock_conf($2, $3, $4, $5);
458 #else
459 racoon_yywarn("admin port support not compiled in");
460 #endif
461 }
462 EOS
463 | ADMINSOCK QUOTEDSTRING
464 {
465 #ifdef ENABLE_ADMINPORT
466 adminsock_conf($2, NULL, NULL, -1);
467 #else
468 racoon_yywarn("admin port support not compiled in");
469 #endif
470 }
471 EOS
472 | ADMINSOCK DISABLED
473 {
474 #ifdef ENABLE_ADMINPORT
475 adminsock_path = NULL;
476 #else
477 racoon_yywarn("admin port support not compiled in");
478 #endif
479 }
480 EOS
481 | STRICT_ADDRESS { lcconf->strict_address = TRUE; } EOS
482 ;
483 ike_addrinfo_port
484 : ADDRSTRING ike_port
485 {
486 char portbuf[10];
487
488 snprintf(portbuf, sizeof(portbuf), "%ld", $2);
489 $$ = str2saddr($1->v, portbuf);
490 vfree($1);
491 if (!$$)
492 return -1;
493 }
494 ;
495 ike_addrinfo_prefix_port
496 : ADDRSTRING prefix ike_port
497 {
498 char portbuf[10];
499 struct remote_index_val *new;
500
501 new = racoon_calloc(1, sizeof(*new));
502 if (new == NULL) {
503 racoon_yyerror("failed to allocate remote index struct");
504 vfree($1);
505 return -1;
506 }
507 snprintf(portbuf, sizeof(portbuf), "%ld", $3);
508 new->addr = str2saddr($1->v, portbuf);
509 vfree($1);
510 if (!new->addr) {
511 racoon_yyerror("failed to allocate sockaddr storage");
512 return -1;
513 }
514 new->prefix = $2;
515 $$ = new;
516 }
517 ;
518 ike_port
519 : /* nothing */ { $$ = PORT_ISAKMP; }
520 | PORT { $$ = $1; }
521 ;
522 /* modecfg */
523 modecfg_statement
524 : MODECFG BOC modecfg_stmts EOC
525 ;
526 modecfg_stmts
527 : /* nothing */
528 | modecfg_stmts modecfg_stmt
529 ;
530 modecfg_stmt
531 : CFG_NET4 ADDRSTRING
532 {
533 #ifdef ENABLE_HYBRID
534 if (inet_pton(AF_INET, $2->v,
535 &isakmp_cfg_config.network4) != 1)
536 racoon_yyerror("bad IPv4 network address.");
537 vfree($2);
538 #else
539 racoon_yyerror("racoon not configured with --enable-hybrid");
540 #endif
541 }
542 EOS
543 | CFG_MASK4 ADDRSTRING
544 {
545 #ifdef ENABLE_HYBRID
546 if (inet_pton(AF_INET, $2->v,
547 &isakmp_cfg_config.netmask4) != 1)
548 racoon_yyerror("bad IPv4 netmask address.");
549 vfree($2);
550 #else
551 racoon_yyerror("racoon not configured with --enable-hybrid");
552 #endif
553 }
554 EOS
555 | CFG_DNS4 addrdnslist
556 EOS
557 | CFG_NBNS4 addrwinslist
558 EOS
559 | CFG_SPLIT_NETWORK CFG_SPLIT_LOCAL splitnetlist
560 {
561 #ifdef ENABLE_HYBRID
562 isakmp_cfg_config.splitnet_type = UNITY_LOCAL_LAN;
563 #else
564 racoon_yyerror("racoon not configured with --enable-hybrid");
565 #endif
566 }
567 EOS
568 | CFG_SPLIT_NETWORK CFG_SPLIT_INCLUDE splitnetlist
569 {
570 #ifdef ENABLE_HYBRID
571 isakmp_cfg_config.splitnet_type = UNITY_SPLIT_INCLUDE;
572 #else
573 racoon_yyerror("racoon not configured with --enable-hybrid");
574 #endif
575 }
576 EOS
577 | CFG_SPLIT_DNS splitdnslist
578 {
579 #ifndef ENABLE_HYBRID
580 racoon_yyerror("racoon not configured with --enable-hybrid");
581 #endif
582 }
583 EOS
584 | CFG_DEFAULT_DOMAIN QUOTEDSTRING
585 {
586 #ifdef ENABLE_HYBRID
587 strlcpy(&isakmp_cfg_config.default_domain[0],
588 $2->v, sizeof(isakmp_cfg_config.default_domain));
589 vfree($2);
590 #else
591 racoon_yyerror("racoon not configured with --enable-hybrid");
592 #endif
593 }
594 EOS
595 | CFG_AUTH_SOURCE CFG_SYSTEM
596 {
597 #ifdef ENABLE_HYBRID
598 isakmp_cfg_config.authsource = ISAKMP_CFG_AUTH_SYSTEM;
599 #else
600 racoon_yyerror("racoon not configured with --enable-hybrid");
601 #endif
602 }
603 EOS
604 | CFG_AUTH_SOURCE CFG_RADIUS
605 {
606 #ifdef ENABLE_HYBRID
607 #ifdef HAVE_LIBRADIUS
608 isakmp_cfg_config.authsource = ISAKMP_CFG_AUTH_RADIUS;
609 #else /* HAVE_LIBRADIUS */
610 racoon_yyerror("racoon not configured with --with-libradius");
611 #endif /* HAVE_LIBRADIUS */
612 #else /* ENABLE_HYBRID */
613 racoon_yyerror("racoon not configured with --enable-hybrid");
614 #endif /* ENABLE_HYBRID */
615 }
616 EOS
617 | CFG_AUTH_SOURCE CFG_PAM
618 {
619 #ifdef ENABLE_HYBRID
620 #ifdef HAVE_LIBPAM
621 isakmp_cfg_config.authsource = ISAKMP_CFG_AUTH_PAM;
622 #else /* HAVE_LIBPAM */
623 racoon_yyerror("racoon not configured with --with-libpam");
624 #endif /* HAVE_LIBPAM */
625 #else /* ENABLE_HYBRID */
626 racoon_yyerror("racoon not configured with --enable-hybrid");
627 #endif /* ENABLE_HYBRID */
628 }
629 EOS
630 | CFG_AUTH_SOURCE CFG_LDAP
631 {
632 #ifdef ENABLE_HYBRID
633 #ifdef HAVE_LIBLDAP
634 isakmp_cfg_config.authsource = ISAKMP_CFG_AUTH_LDAP;
635 #else /* HAVE_LIBLDAP */
636 racoon_yyerror("racoon not configured with --with-libldap");
637 #endif /* HAVE_LIBLDAP */
638 #else /* ENABLE_HYBRID */
639 racoon_yyerror("racoon not configured with --enable-hybrid");
640 #endif /* ENABLE_HYBRID */
641 }
642 EOS
643 | CFG_AUTH_GROUPS authgrouplist
644 {
645 #ifndef ENABLE_HYBRID
646 racoon_yyerror("racoon not configured with --enable-hybrid");
647 #endif
648 }
649 EOS
650 | CFG_GROUP_SOURCE CFG_SYSTEM
651 {
652 #ifdef ENABLE_HYBRID
653 isakmp_cfg_config.groupsource = ISAKMP_CFG_GROUP_SYSTEM;
654 #else
655 racoon_yyerror("racoon not configured with --enable-hybrid");
656 #endif
657 }
658 EOS
659 | CFG_GROUP_SOURCE CFG_LDAP
660 {
661 #ifdef ENABLE_HYBRID
662 #ifdef HAVE_LIBLDAP
663 isakmp_cfg_config.groupsource = ISAKMP_CFG_GROUP_LDAP;
664 #else /* HAVE_LIBLDAP */
665 racoon_yyerror("racoon not configured with --with-libldap");
666 #endif /* HAVE_LIBLDAP */
667 #else /* ENABLE_HYBRID */
668 racoon_yyerror("racoon not configured with --enable-hybrid");
669 #endif /* ENABLE_HYBRID */
670 }
671 EOS
672 | CFG_ACCOUNTING CFG_NONE
673 {
674 #ifdef ENABLE_HYBRID
675 isakmp_cfg_config.accounting = ISAKMP_CFG_ACCT_NONE;
676 #else
677 racoon_yyerror("racoon not configured with --enable-hybrid");
678 #endif
679 }
680 EOS
681 | CFG_ACCOUNTING CFG_SYSTEM
682 {
683 #ifdef ENABLE_HYBRID
684 isakmp_cfg_config.accounting = ISAKMP_CFG_ACCT_SYSTEM;
685 #else
686 racoon_yyerror("racoon not configured with --enable-hybrid");
687 #endif
688 }
689 EOS
690 | CFG_ACCOUNTING CFG_RADIUS
691 {
692 #ifdef ENABLE_HYBRID
693 #ifdef HAVE_LIBRADIUS
694 isakmp_cfg_config.accounting = ISAKMP_CFG_ACCT_RADIUS;
695 #else /* HAVE_LIBRADIUS */
696 racoon_yyerror("racoon not configured with --with-libradius");
697 #endif /* HAVE_LIBRADIUS */
698 #else /* ENABLE_HYBRID */
699 racoon_yyerror("racoon not configured with --enable-hybrid");
700 #endif /* ENABLE_HYBRID */
701 }
702 EOS
703 | CFG_ACCOUNTING CFG_PAM
704 {
705 #ifdef ENABLE_HYBRID
706 #ifdef HAVE_LIBPAM
707 isakmp_cfg_config.accounting = ISAKMP_CFG_ACCT_PAM;
708 #else /* HAVE_LIBPAM */
709 racoon_yyerror("racoon not configured with --with-libpam");
710 #endif /* HAVE_LIBPAM */
711 #else /* ENABLE_HYBRID */
712 racoon_yyerror("racoon not configured with --enable-hybrid");
713 #endif /* ENABLE_HYBRID */
714 }
715 EOS
716 | CFG_POOL_SIZE NUMBER
717 {
718 #ifdef ENABLE_HYBRID
719 if (isakmp_cfg_resize_pool($2) != 0)
720 racoon_yyerror("cannot allocate memory for pool");
721 #else /* ENABLE_HYBRID */
722 racoon_yyerror("racoon not configured with --enable-hybrid");
723 #endif /* ENABLE_HYBRID */
724 }
725 EOS
726 | CFG_PFS_GROUP NUMBER
727 {
728 #ifdef ENABLE_HYBRID
729 isakmp_cfg_config.pfs_group = $2;
730 #ifndef HAVE_OPENSSL
731 if (isakmp_cfg_config.pfs_group != OAKLEY_ATTR_GRP_DESC_MODP1024
732 && isakmp_cfg_config.pfs_group != OAKLEY_ATTR_GRP_DESC_MODP1536) {
733 racoon_yyerror("PFS group must be 2 or 5");
734 return -1;
735 }
736 #endif
737 #else /* ENABLE_HYBRID */
738 racoon_yyerror("racoon not configured with --enable-hybrid");
739 #endif /* ENABLE_HYBRID */
740 }
741 EOS
742 | CFG_SAVE_PASSWD SWITCH
743 {
744 #ifdef ENABLE_HYBRID
745 isakmp_cfg_config.save_passwd = $2;
746 #else /* ENABLE_HYBRID */
747 racoon_yyerror("racoon not configured with --enable-hybrid");
748 #endif /* ENABLE_HYBRID */
749 }
750 EOS
751 | CFG_AUTH_THROTTLE NUMBER
752 {
753 #ifdef ENABLE_HYBRID
754 isakmp_cfg_config.auth_throttle = $2;
755 #else /* ENABLE_HYBRID */
756 racoon_yyerror("racoon not configured with --enable-hybrid");
757 #endif /* ENABLE_HYBRID */
758 }
759 EOS
760 | CFG_CONF_SOURCE CFG_LOCAL
761 {
762 #ifdef ENABLE_HYBRID
763 isakmp_cfg_config.confsource = ISAKMP_CFG_CONF_LOCAL;
764 #else /* ENABLE_HYBRID */
765 racoon_yyerror("racoon not configured with --enable-hybrid");
766 #endif /* ENABLE_HYBRID */
767 }
768 EOS
769 | CFG_CONF_SOURCE CFG_RADIUS
770 {
771 #ifdef ENABLE_HYBRID
772 #ifdef HAVE_LIBRADIUS
773 isakmp_cfg_config.confsource = ISAKMP_CFG_CONF_RADIUS;
774 #else /* HAVE_LIBRADIUS */
775 racoon_yyerror("racoon not configured with --with-libradius");
776 #endif /* HAVE_LIBRADIUS */
777 #else /* ENABLE_HYBRID */
778 racoon_yyerror("racoon not configured with --enable-hybrid");
779 #endif /* ENABLE_HYBRID */
780 }
781 EOS
782 | CFG_CONF_SOURCE CFG_LDAP
783 {
784 #ifdef ENABLE_HYBRID
785 #ifdef HAVE_LIBLDAP
786 isakmp_cfg_config.confsource = ISAKMP_CFG_CONF_LDAP;
787 #else /* HAVE_LIBLDAP */
788 racoon_yyerror("racoon not configured with --with-libldap");
789 #endif /* HAVE_LIBLDAP */
790 #else /* ENABLE_HYBRID */
791 racoon_yyerror("racoon not configured with --enable-hybrid");
792 #endif /* ENABLE_HYBRID */
793 }
794 EOS
795 | CFG_MOTD QUOTEDSTRING
796 {
797 #ifdef ENABLE_HYBRID
798 strlcpy(&isakmp_cfg_config.motd[0], $2->v, sizeof(isakmp_cfg_config.motd));
799 vfree($2);
800 #else
801 racoon_yyerror("racoon not configured with --enable-hybrid");
802 #endif
803 }
804 EOS
805 ;
806
807 addrdnslist
808 : addrdns
809 | addrdns COMMA addrdnslist
810 ;
811 addrdns
812 : ADDRSTRING
813 {
814 #ifdef ENABLE_HYBRID
815 struct isakmp_cfg_config *icc = &isakmp_cfg_config;
816
817 if (icc->dns4_index > MAXNS)
818 racoon_yyerror("No more than %d DNS", MAXNS);
819 if (inet_pton(AF_INET, $1->v,
820 &icc->dns4[icc->dns4_index++]) != 1)
821 racoon_yyerror("bad IPv4 DNS address.");
822
823 vfree($1);
824 #else
825 racoon_yyerror("racoon not configured with --enable-hybrid");
826 #endif
827 }
828 ;
829
830 addrwinslist
831 : addrwins
832 | addrwins COMMA addrwinslist
833 ;
834 addrwins
835 : ADDRSTRING
836 {
837 #ifdef ENABLE_HYBRID
838 struct isakmp_cfg_config *icc = &isakmp_cfg_config;
839
840 if (icc->nbns4_index > MAXWINS)
841 racoon_yyerror("No more than %d WINS", MAXWINS);
842 if (inet_pton(AF_INET, $1->v,
843 &icc->nbns4[icc->nbns4_index++]) != 1)
844 racoon_yyerror("bad IPv4 WINS address.");
845
846 vfree($1);
847 #else
848 racoon_yyerror("racoon not configured with --enable-hybrid");
849 #endif
850 }
851 ;
852
853 splitnetlist
854 : splitnet
855 | splitnetlist COMMA splitnet
856 ;
857 splitnet
858 : ADDRSTRING PREFIX
859 {
860 #ifdef ENABLE_HYBRID
861 struct isakmp_cfg_config *icc = &isakmp_cfg_config;
862 struct unity_network network;
863
864 if (inet_pton(AF_INET, $1->v, &network.addr4) != 1)
865 racoon_yyerror("bad IPv4 SPLIT address.");
866
867 /* Turn $2 (the prefix) into a subnet mask */
868 network.mask4.s_addr = ($2) ? htonl(~((1 << (32 - $2)) - 1)) : 0;
869
870 /* add the network to our list */
871 if (splitnet_list_add(&icc->splitnet_list, &network,&icc->splitnet_count))
872 racoon_yyerror("Unable to allocate split network");
873
874 vfree($1);
875 #else
876 racoon_yyerror("racoon not configured with --enable-hybrid");
877 #endif
878 }
879 ;
880
881 authgrouplist
882 : authgroup
883 | authgroup COMMA authgrouplist
884 ;
885 authgroup
886 : QUOTEDSTRING
887 {
888 #ifdef ENABLE_HYBRID
889 char * groupname = NULL;
890 char ** grouplist = NULL;
891 struct isakmp_cfg_config *icc = &isakmp_cfg_config;
892
893 grouplist = racoon_realloc(icc->grouplist,
894 sizeof(char**)*(icc->groupcount+1));
895 if (grouplist == NULL)
896 racoon_yyerror("unable to allocate auth group list");
897
898 groupname = racoon_malloc($1->l+1);
899 if (groupname == NULL)
900 racoon_yyerror("unable to allocate auth group name");
901
902 memcpy(groupname,$1->v,$1->l);
903 groupname[$1->l]=0;
904 grouplist[icc->groupcount]=groupname;
905 icc->grouplist = grouplist;
906 icc->groupcount++;
907
908 vfree($1);
909 #else
910 racoon_yyerror("racoon not configured with --enable-hybrid");
911 #endif
912 }
913 ;
914
915 splitdnslist
916 : splitdns
917 | splitdns COMMA splitdnslist
918 ;
919 splitdns
920 : QUOTEDSTRING
921 {
922 #ifdef ENABLE_HYBRID
923 struct isakmp_cfg_config *icc = &isakmp_cfg_config;
924
925 if (!icc->splitdns_len)
926 {
927 icc->splitdns_list = racoon_malloc($1->l);
928 if(icc->splitdns_list == NULL)
929 racoon_yyerror("error allocating splitdns list buffer");
930 memcpy(icc->splitdns_list,$1->v,$1->l);
931 icc->splitdns_len = $1->l;
932 }
933 else
934 {
935 int len = icc->splitdns_len + $1->l + 1;
936 icc->splitdns_list = racoon_realloc(icc->splitdns_list,len);
937 if(icc->splitdns_list == NULL)
938 racoon_yyerror("error allocating splitdns list buffer");
939 icc->splitdns_list[icc->splitdns_len] = ',';
940 memcpy(icc->splitdns_list + icc->splitdns_len + 1, $1->v, $1->l);
941 icc->splitdns_len = len;
942 }
943 vfree($1);
944 #else
945 racoon_yyerror("racoon not configured with --enable-hybrid");
946 #endif
947 }
948 ;
949
950
951 /* timer */
952 timer_statement
953 : RETRY BOC timer_stmts EOC
954 ;
955 timer_stmts
956 : /* nothing */
957 | timer_stmts timer_stmt
958 ;
959 timer_stmt
960 : RETRY_COUNTER NUMBER
961 {
962 lcconf->retry_counter = $2;
963 }
964 EOS
965 | RETRY_INTERVAL NUMBER unittype_time
966 {
967 lcconf->retry_interval = $2 * $3;
968 }
969 EOS
970 | RETRY_PERSEND NUMBER
971 {
972 lcconf->count_persend = $2;
973 }
974 EOS
975 | RETRY_PHASE1 NUMBER unittype_time
976 {
977 lcconf->retry_checkph1 = $2 * $3;
978 }
979 EOS
980 | RETRY_PHASE2 NUMBER unittype_time
981 {
982 lcconf->wait_ph2complete = $2 * $3;
983 }
984 EOS
985 | AUTO_EXIT_DELAY NUMBER unittype_time
986 {
987 lcconf->auto_exit_delay = $2 * $3;
988 lcconf->auto_exit_state |= LC_AUTOEXITSTATE_SET;
989 }
990 EOS
991
992 | NATT_KA NUMBER unittype_time
993 {
994 #ifdef ENABLE_NATT
995 lcconf->natt_ka_interval = $2 * $3;
996 #else
997 racoon_yyerror("NAT-T support not compiled in.");
998 #endif
999 }
1000 EOS
1001 ;
1002
1003 /* sainfo */
1004 sainfo_statement
1005 : SAINFO
1006 {
1007 cur_sainfo = newsainfo();
1008 if (cur_sainfo == NULL) {
1009 racoon_yyerror("failed to allocate sainfo");
1010 return -1;
1011 }
1012 }
1013 sainfo_name sainfo_param BOC sainfo_specs
1014 {
1015 struct sainfo *check;
1016
1017 /* default */
1018 if (cur_sainfo->algs[algclass_ipsec_enc] == 0) {
1019 racoon_yyerror("no encryption algorithm at %s",
1020 sainfo2str(cur_sainfo));
1021 return -1;
1022 }
1023 if (cur_sainfo->algs[algclass_ipsec_auth] == 0) {
1024 racoon_yyerror("no authentication algorithm at %s",
1025 sainfo2str(cur_sainfo));
1026 return -1;
1027 }
1028 if (cur_sainfo->algs[algclass_ipsec_comp] == 0) {
1029 racoon_yyerror("no compression algorithm at %s",
1030 sainfo2str(cur_sainfo));
1031 return -1;
1032 }
1033
1034 /* duplicate check */
1035 check = getsainfo(cur_sainfo->idsrc,
1036 cur_sainfo->iddst,
1037 cur_sainfo->id_i, 0);
1038 if (check && (!check->idsrc && !cur_sainfo->idsrc)) {
1039 racoon_yyerror("duplicated sainfo: %s",
1040 sainfo2str(cur_sainfo));
1041 return -1;
1042 }
1043 inssainfo(cur_sainfo);
1044 }
1045 EOC
1046 ;
1047 sainfo_name
1048 : ANONYMOUS
1049 {
1050 cur_sainfo->idsrc = NULL;
1051 cur_sainfo->iddst = NULL;
1052 }
1053 | ANONYMOUS sainfo_id
1054 {
1055 cur_sainfo->idsrc = NULL;
1056 cur_sainfo->iddst = $2;
1057 }
1058 | sainfo_id ANONYMOUS
1059 {
1060 cur_sainfo->idsrc = $1;
1061 cur_sainfo->iddst = NULL;
1062 }
1063 | sainfo_id sainfo_id
1064 {
1065 cur_sainfo->idsrc = $1;
1066 cur_sainfo->iddst = $2;
1067 }
1068 ;
1069 sainfo_id
1070 : IDENTIFIERTYPE ADDRSTRING prefix port ul_proto
1071 {
1072 char portbuf[10];
1073 struct sockaddr_storage *saddr;
1074
1075 if (($5 == IPPROTO_ICMP || $5 == IPPROTO_ICMPV6)
1076 && ($4 != IPSEC_PORT_ANY || $4 != IPSEC_PORT_ANY)) {
1077 racoon_yyerror("port number must be \"any\".");
1078 return -1;
1079 }
1080
1081 snprintf(portbuf, sizeof(portbuf), "%lu", $4);
1082 saddr = str2saddr($2->v, portbuf);
1083 vfree($2);
1084 if (saddr == NULL)
1085 return -1;
1086
1087 switch (saddr->ss_family) {
1088 case AF_INET:
1089 if ($5 == IPPROTO_ICMPV6) {
1090 racoon_yyerror("upper layer protocol mismatched.\n");
1091 racoon_free(saddr);
1092 return -1;
1093 }
1094 $$ = ipsecdoi_sockaddr2id(saddr,
1095 $3 == ~0 ? (sizeof(struct in_addr) << 3): $3,
1096 $5);
1097 break;
1098 #ifdef INET6
1099 case AF_INET6:
1100 if ($5 == IPPROTO_ICMP) {
1101 racoon_yyerror("upper layer protocol mismatched.\n");
1102 racoon_free(saddr);
1103 return -1;
1104 }
1105 $$ = ipsecdoi_sockaddr2id(saddr,
1106 $3 == ~0 ? (sizeof(struct in6_addr) << 3): $3,
1107 $5);
1108 break;
1109 #endif
1110 default:
1111 racoon_yyerror("invalid family: %d", saddr->ss_family);
1112 $$ = NULL;
1113 break;
1114 }
1115 racoon_free(saddr);
1116 if ($$ == NULL)
1117 return -1;
1118 }
1119 | IDENTIFIERTYPE ADDRSTRING ADDRRANGE prefix port ul_proto
1120 {
1121 char portbuf[10];
1122 struct sockaddr_storage *laddr = NULL, *haddr = NULL;
1123
1124 if (($6 == IPPROTO_ICMP || $6 == IPPROTO_ICMPV6)
1125 && ($5 != IPSEC_PORT_ANY || $5 != IPSEC_PORT_ANY)) {
1126 racoon_yyerror("port number must be \"any\".");
1127 return -1;
1128 }
1129
1130 snprintf(portbuf, sizeof(portbuf), "%lu", $5);
1131
1132 laddr = str2saddr($2->v, portbuf);
1133 if (laddr == NULL) {
1134 return -1;
1135 }
1136 vfree($2);
1137 haddr = str2saddr($3->v, portbuf);
1138 if (haddr == NULL) {
1139 racoon_free(laddr);
1140 return -1;
1141 }
1142 vfree($3);
1143
1144 switch (laddr->ss_family) {
1145 case AF_INET:
1146 if ($6 == IPPROTO_ICMPV6) {
1147 racoon_yyerror("upper layer protocol mismatched.\n");
1148 if (laddr)
1149 racoon_free(laddr);
1150 if (haddr)
1151 racoon_free(haddr);
1152 return -1;
1153 }
1154 $$ = ipsecdoi_sockrange2id(laddr, haddr,
1155 $6);
1156 break;
1157 #ifdef INET6
1158 case AF_INET6:
1159 if ($6 == IPPROTO_ICMP) {
1160 racoon_yyerror("upper layer protocol mismatched.\n");
1161 if (laddr)
1162 racoon_free(laddr);
1163 if (haddr)
1164 racoon_free(haddr);
1165 return -1;
1166 }
1167 $$ = ipsecdoi_sockrange2id(laddr, haddr,
1168 $6);
1169 break;
1170 #endif
1171 default:
1172 racoon_yyerror("invalid family: %d", laddr->ss_family);
1173 $$ = NULL;
1174 break;
1175 }
1176 if (laddr)
1177 racoon_free(laddr);
1178 if (haddr)
1179 racoon_free(haddr);
1180 if ($$ == NULL)
1181 return -1;
1182 }
1183 | IDENTIFIERTYPE QUOTEDSTRING
1184 {
1185 struct ipsecdoi_id_b *id_b;
1186
1187 if ($1 == IDTYPE_ASN1DN) {
1188 racoon_yyerror("id type forbidden: %d", $1);
1189 $$ = NULL;
1190 return -1;
1191 }
1192
1193 $2->l--;
1194
1195 $$ = vmalloc(sizeof(*id_b) + $2->l);
1196 if ($$ == NULL) {
1197 racoon_yyerror("failed to allocate identifier");
1198 return -1;
1199 }
1200
1201 id_b = ALIGNED_CAST(struct ipsecdoi_id_b *)$$->v;
1202 id_b->type = idtype2doi($1);
1203
1204 id_b->proto_id = 0;
1205 id_b->port = 0;
1206
1207 memcpy($$->v + sizeof(*id_b), $2->v, $2->l);
1208 }
1209 ;
1210 sainfo_param
1211 : /* nothing */
1212 {
1213 cur_sainfo->id_i = NULL;
1214 }
1215
1216 | FROM IDENTIFIERTYPE identifierstring
1217 {
1218 struct ipsecdoi_id_b *id_b;
1219 vchar_t *idv;
1220
1221 if (set_identifier(&idv, $2, $3) != 0) {
1222 racoon_yyerror("failed to set identifer.\n");
1223 return -1;
1224 }
1225 cur_sainfo->id_i = vmalloc(sizeof(*id_b) + idv->l);
1226 if (cur_sainfo->id_i == NULL) {
1227 racoon_yyerror("failed to allocate identifier");
1228 return -1;
1229 }
1230
1231 id_b = ALIGNED_CAST(struct ipsecdoi_id_b *)cur_sainfo->id_i->v;
1232 id_b->type = idtype2doi($2);
1233
1234 id_b->proto_id = 0;
1235 id_b->port = 0;
1236
1237 memcpy(cur_sainfo->id_i->v + sizeof(*id_b),
1238 idv->v, idv->l);
1239 vfree(idv);
1240 }
1241 | GROUP QUOTEDSTRING
1242 {
1243 #ifdef ENABLE_HYBRID
1244 if ((cur_sainfo->group = vdup($2)) == NULL) {
1245 racoon_yyerror("failed to set sainfo xauth group.\n");
1246 return -1;
1247 }
1248 #else
1249 racoon_yyerror("racoon not configured with --enable-hybrid");
1250 return -1;
1251 #endif
1252 }
1253 ;
1254 sainfo_specs
1255 : /* nothing */
1256 | sainfo_specs sainfo_spec
1257 ;
1258 sainfo_spec
1259 : PFS_GROUP dh_group_num
1260 {
1261 cur_sainfo->pfs_group = $2;
1262 #ifndef HAVE_OPENSSL
1263 if (cur_sainfo->pfs_group != OAKLEY_ATTR_GRP_DESC_MODP1024
1264 && cur_sainfo->pfs_group != OAKLEY_ATTR_GRP_DESC_MODP1536) {
1265 racoon_yyerror("PFS group must be 2 or 5");
1266 return -1;
1267 }
1268 #endif
1269 }
1270 EOS
1271 | LIFETIME LIFETYPE_TIME NUMBER unittype_time
1272 {
1273 cur_sainfo->lifetime = $3 * $4;
1274 }
1275 EOS
1276 | LIFETIME LIFETYPE_BYTE NUMBER unittype_byte
1277 {
1278 #if 1
1279 racoon_yyerror("byte lifetime support is deprecated");
1280 return -1;
1281 #else
1282 cur_sainfo->lifebyte = fix_lifebyte($3 * $4);
1283 if (cur_sainfo->lifebyte == 0)
1284 return -1;
1285 #endif
1286 }
1287 EOS
1288 | ALGORITHM_CLASS {
1289 cur_algclass = $1;
1290 }
1291 algorithms EOS
1292 | IDENTIFIER IDENTIFIERTYPE
1293 {
1294 racoon_yyerror("it's deprecated to specify a identifier in phase 2");
1295 }
1296 EOS
1297 | MY_IDENTIFIER IDENTIFIERTYPE QUOTEDSTRING
1298 {
1299 racoon_yyerror("it's deprecated to specify a identifier in phase 2");
1300 }
1301 EOS
1302 ;
1303
1304 algorithms
1305 : algorithm
1306 {
1307 inssainfoalg(&cur_sainfo->algs[cur_algclass], $1);
1308 }
1309 | algorithm
1310 {
1311 inssainfoalg(&cur_sainfo->algs[cur_algclass], $1);
1312 }
1313 COMMA algorithms
1314 ;
1315 algorithm
1316 : ALGORITHMTYPE keylength
1317 {
1318 int defklen;
1319
1320 $$ = newsainfoalg();
1321 if ($$ == NULL) {
1322 racoon_yyerror("failed to get algorithm allocation");
1323 return -1;
1324 }
1325
1326 $$->alg = algtype2doi(cur_algclass, $1);
1327 if ($$->alg == -1) {
1328 racoon_yyerror("algorithm mismatched");
1329 racoon_free($$);
1330 $$ = NULL;
1331 return -1;
1332 }
1333
1334 defklen = default_keylen(cur_algclass, $1);
1335 if (defklen == 0) {
1336 if ($2) {
1337 racoon_yyerror("keylen not allowed");
1338 racoon_free($$);
1339 $$ = NULL;
1340 return -1;
1341 }
1342 } else {
1343 if ($2 && check_keylen(cur_algclass, $1, $2) < 0) {
1344 racoon_yyerror("invalid keylen %d", $2);
1345 racoon_free($$);
1346 $$ = NULL;
1347 return -1;
1348 }
1349 }
1350
1351 if ($2)
1352 $$->encklen = $2;
1353 else
1354 $$->encklen = defklen;
1355
1356 /* check if it's supported algorithm by kernel */
1357 if (!(cur_algclass == algclass_ipsec_auth && $1 == algtype_non_auth)
1358 && pk_checkalg(cur_algclass, $1, $$->encklen)) {
1359 int a = algclass2doi(cur_algclass);
1360 int b = algtype2doi(cur_algclass, $1);
1361 if (a == IPSECDOI_ATTR_AUTH)
1362 a = IPSECDOI_PROTO_IPSEC_AH;
1363 racoon_yyerror("algorithm %s not supported by the kernel (missing module?)",
1364 s_ipsecdoi_trns(a, b));
1365 racoon_free($$);
1366 $$ = NULL;
1367 return -1;
1368 }
1369 }
1370 ;
1371 prefix
1372 : /* nothing */ { $$ = ~0; }
1373 | PREFIX { $$ = $1; }
1374 ;
1375 port
1376 : /* nothing */ { $$ = IPSEC_PORT_ANY; }
1377 | PORT { $$ = $1; }
1378 | PORTANY { $$ = IPSEC_PORT_ANY; }
1379 ;
1380 ul_proto
1381 : NUMBER { $$ = $1; }
1382 | UL_PROTO { $$ = $1; }
1383 | ANY { $$ = IPSEC_ULPROTO_ANY; }
1384 ;
1385 keylength
1386 : /* nothing */ { $$ = 0; }
1387 | NUMBER { $$ = $1; }
1388 ;
1389
1390 /* remote */
1391 remote_statement
1392 : REMOTE remote_index INHERIT remote_index
1393 {
1394 struct remoteconf *new;
1395 struct proposalspec *prspec;
1396
1397 new = copyrmconf($4->addr);
1398 if (new == NULL) {
1399 racoon_yyerror("failed to get remoteconf for %s.", saddr2str((struct sockaddr *)$4));
1400 racoon_free($2->addr);
1401 racoon_free($2);
1402 racoon_free($4->addr);
1403 racoon_free($4);
1404 return -1;
1405 }
1406
1407 new->remote = $2->addr;
1408 new->remote_prefix = ($2->prefix == ~0 ? 0 : $2->prefix);
1409 new->inherited_from = getrmconf_strict($4->addr, 1);
1410 new->proposal = NULL;
1411 new->prhead = NULL;
1412 cur_rmconf = new;
1413 racoon_free($2);
1414 racoon_free($4->addr);
1415 racoon_free($4);
1416
1417 prspec = newprspec();
1418 if (prspec == NULL || !cur_rmconf->inherited_from
1419 || !cur_rmconf->inherited_from->proposal)
1420 return -1;
1421 prspec->lifetime = cur_rmconf->inherited_from->proposal->lifetime;
1422 prspec->lifebyte = cur_rmconf->inherited_from->proposal->lifebyte;
1423 insprspec(prspec, &cur_rmconf->prhead);
1424 }
1425 remote_specs_block
1426 | REMOTE remote_index
1427 {
1428 struct remoteconf *new;
1429 struct proposalspec *prspec;
1430
1431 new = newrmconf();
1432 if (new == NULL) {
1433 racoon_yyerror("failed to get new remoteconf.");
1434 racoon_free($2->addr);
1435 racoon_free($2);
1436 return -1;
1437 }
1438 new->remote = $2->addr;
1439 new->remote_prefix = ($2->prefix == ~0 ? 0 : $2->prefix);
1440 cur_rmconf = new;
1441 racoon_free($2);
1442
1443 prspec = newprspec();
1444 if (prspec == NULL)
1445 return -1;
1446 prspec->lifetime = oakley_get_defaultlifetime();
1447 insprspec(prspec, &cur_rmconf->prhead);
1448 }
1449 remote_specs_block
1450 ;
1451
1452 remote_specs_block
1453 : BOC remote_specs EOC
1454 {
1455 /* check a exchange mode */
1456 if (cur_rmconf->etypes == NULL) {
1457 racoon_yyerror("no exchange mode specified.\n");
1458 return -1;
1459 }
1460
1461 if (cur_rmconf->idvtype == IDTYPE_UNDEFINED)
1462 cur_rmconf->idvtype = IDTYPE_ADDRESS;
1463
1464
1465 if (cur_rmconf->idvtype == IDTYPE_ASN1DN) {
1466 if (cur_rmconf->mycertfile
1467 || cur_rmconf->identity_in_keychain)
1468 {
1469 if (cur_rmconf->idv)
1470 racoon_yywarn("Both CERT and ASN1 ID "
1471 "are set. Hope this is OK.\n");
1472 /* TODO: Preparse the DN here */
1473 } else if (cur_rmconf->idv) {
1474 /* OK, using asn1dn without X.509. */
1475 } else {
1476 racoon_yyerror("ASN1 ID not specified "
1477 "and no CERT defined!\n");
1478 return -1;
1479 }
1480 }
1481
1482 if (cur_rmconf->cert_verification_option == VERIFICATION_OPTION_PEERS_IDENTIFIER) {
1483 struct genlist_entry *gpb;
1484 if (genlist_next(cur_rmconf->idvl_p, &gpb) == NULL) {
1485 racoon_yyerror("peers_identifier required for specified certificate "
1486 "verification option.\n");
1487 return -1;
1488 }
1489 }
1490
1491 if (cur_rmconf->prhead->spspec == NULL
1492 && cur_rmconf->inherited_from
1493 && cur_rmconf->inherited_from->prhead) {
1494 cur_rmconf->prhead->spspec = cur_rmconf->inherited_from->prhead->spspec;
1495 }
1496 if (set_isakmp_proposal(cur_rmconf, cur_rmconf->prhead) != 0)
1497 return -1;
1498
1499 /* DH group settting if aggressive mode is there. */
1500 if (check_etypeok(cur_rmconf, ISAKMP_ETYPE_AGG) != NULL) {
1501 struct isakmpsa *p;
1502 int b = 0;
1503
1504 /* DH group */
1505 for (p = cur_rmconf->proposal; p; p = p->next) {
1506 if (b == 0 || (b && b == p->dh_group)) {
1507 b = p->dh_group;
1508 continue;
1509 }
1510 racoon_yyerror("DH group must be equal "
1511 "in all proposals "
1512 "when aggressive mode is "
1513 "used.\n");
1514 return -1;
1515 }
1516 cur_rmconf->dh_group = b;
1517
1518 if (cur_rmconf->dh_group == 0) {
1519 racoon_yyerror("DH group must be set in the proposal.\n");
1520 return -1;
1521 }
1522
1523 /* DH group settting if PFS is required. */
1524 if (oakley_setdhgroup(cur_rmconf->dh_group,
1525 &cur_rmconf->dhgrp) < 0) {
1526 racoon_yyerror("failed to set DH value.\n");
1527 return -1;
1528 }
1529 }
1530
1531 insrmconf(cur_rmconf);
1532 }
1533 ;
1534 remote_index
1535 : ANONYMOUS ike_port
1536 {
1537
1538 struct remote_index_val *new;
1539
1540 new = racoon_calloc(1, sizeof(*new));
1541 if (new == NULL) {
1542 racoon_yyerror("failed to allocate remote index struct");
1543 return -1;
1544 }
1545 new->addr = newsaddr(sizeof(struct sockaddr_storage));
1546 if (new->addr == NULL) {
1547 racoon_yyerror("failed to allocate sockaddr storage");
1548 racoon_free(new);
1549 return -1;
1550 }
1551 new->addr->ss_family = AF_UNSPEC;
1552 (ALIGNED_CAST(struct sockaddr_in *)new->addr)->sin_port = htons($2);
1553 new->prefix = ~0;
1554 $$ = new;
1555 }
1556 | ike_addrinfo_prefix_port
1557 {
1558 $$ = $1;
1559 if ($$ == NULL) {
1560 racoon_yyerror("failed to allocate sockaddr_storage");
1561 return -1;
1562 }
1563 }
1564 ;
1565 remote_specs
1566 : /* nothing */
1567 | remote_specs remote_spec
1568 ;
1569 remote_spec
1570 : EXCHANGE_MODE
1571 {
1572 cur_rmconf->etypes = NULL;
1573 }
1574 exchange_types EOS
1575 | DOI DOITYPE { cur_rmconf->doitype = $2; } EOS
1576 | SITUATION SITUATIONTYPE { cur_rmconf->sittype = $2; } EOS
1577 | CERTIFICATE_TYPE cert_spec
1578 | PEERS_CERTFILE QUOTEDSTRING
1579 {
1580 #ifdef HAVE_OPENSSL
1581 racoon_yywarn("This directive without certtype will be removed!\n");
1582 racoon_yywarn("Please use 'peers_certfile x509 \"%s\";' instead\n", $2->v);
1583 cur_rmconf->getcert_method = ISAKMP_GETCERT_LOCALFILE;
1584
1585 if (cur_rmconf->peerscertfile != NULL)
1586 racoon_free(cur_rmconf->peerscertfile);
1587 cur_rmconf->peerscertfile = racoon_strdup($2->v);
1588 STRDUP_FATAL(cur_rmconf->peerscertfile);
1589 vfree($2);
1590 #else
1591 racoon_yyerror("cert files not supported.\n");
1592 return -1;
1593 #endif
1594 }
1595 EOS
1596 | CA_TYPE CERT_X509 QUOTEDSTRING
1597 {
1598 #ifdef HAVE_OPENSSL
1599 cur_rmconf->cacerttype = $2;
1600 cur_rmconf->getcacert_method = ISAKMP_GETCERT_LOCALFILE;
1601 if (cur_rmconf->cacertfile != NULL)
1602 racoon_free(cur_rmconf->cacertfile);
1603 cur_rmconf->cacertfile = racoon_strdup($3->v);
1604 STRDUP_FATAL(cur_rmconf->cacertfile);
1605 vfree($3);
1606 #else
1607 racoon_yyerror("cert files not supported.\n");
1608 return -1;
1609 #endif
1610
1611 }
1612 EOS
1613 | PEERS_CERTFILE CERT_X509 QUOTEDSTRING
1614 {
1615 #ifdef HAVE_OPENSSL
1616 cur_rmconf->getcert_method = ISAKMP_GETCERT_LOCALFILE;
1617 if (cur_rmconf->peerscertfile != NULL)
1618 racoon_free(cur_rmconf->peerscertfile);
1619 cur_rmconf->peerscertfile = racoon_strdup($3->v);
1620 STRDUP_FATAL(cur_rmconf->peerscertfile);
1621 vfree($3);
1622 #else
1623 racoon_yyerror("cert files not supported.\n");
1624 return -1;
1625 #endif
1626
1627 }
1628 EOS
1629 | PEERS_CERTFILE CERT_PLAINRSA QUOTEDSTRING
1630 {
1631 racoon_yyerror("plainrsa not supported.\n");
1632 return -1;
1633 }
1634 EOS
1635 | PEERS_CERTFILE DNSSEC
1636 {
1637 if (cur_rmconf->getcert_method) {
1638 racoon_yyerror("Different peers_certfile method already defined!\n");
1639 return -1;
1640 }
1641 cur_rmconf->getcert_method = ISAKMP_GETCERT_DNS;
1642 cur_rmconf->peerscertfile = NULL;
1643 }
1644 EOS
1645 | VERIFY_CERT SWITCH { cur_rmconf->verify_cert = $2; } EOS
1646 | SEND_CERT SWITCH { cur_rmconf->send_cert = $2; } EOS
1647 | SEND_CR SWITCH { cur_rmconf->send_cr = $2; } EOS
1648 | CERTIFICATE_VERIFICATION VERIFICATION_MODULE
1649 {
1650 cur_rmconf->cert_verification = $2;
1651 } EOS
1652 | CERTIFICATE_VERIFICATION VERIFICATION_MODULE VERIFICATION_OPTION
1653 {
1654 cur_rmconf->cert_verification = $2;
1655 cur_rmconf->cert_verification_option = $3;
1656 }
1657 EOS
1658 | OPEN_DIR_AUTH_GROUP QUOTEDSTRING
1659 {
1660 #if HAVE_OPENDIR
1661 cur_rmconf->open_dir_auth_group = $2;
1662 #else
1663 racoon_yyerror("Apple specific features not compiled in.");
1664 return -1;
1665 #endif
1666 } EOS
1667 | MY_IDENTIFIER IDENTIFIERTYPE identifierstring
1668 {
1669 if (set_identifier(&cur_rmconf->idv, $2, $3) != 0) {
1670 racoon_yyerror("failed to set identifer.\n");
1671 vfree($3); //%%% BUG FIX - memory leak
1672 return -1;
1673 }
1674 vfree($3); //%%% BUG FIX - memory leak
1675 cur_rmconf->idvtype = $2;
1676 }
1677 EOS
1678 | MY_IDENTIFIER IDENTIFIERTYPE IDENTIFIERQUAL identifierstring
1679 {
1680 if (set_identifier_qual(&cur_rmconf->idv, $2, $4, $3) != 0) {
1681 racoon_yyerror("failed to set identifer.\n");
1682 return -1;
1683 }
1684 cur_rmconf->idvtype = $2;
1685 }
1686 EOS
1687 | XAUTH_LOGIN identifierstring
1688 {
1689 #ifdef ENABLE_HYBRID
1690 /* formerly identifier type login */
1691 if (xauth_rmconf_used(&cur_rmconf->xauth) == -1) {
1692 racoon_yyerror("failed to allocate xauth state\n");
1693 return -1;
1694 }
1695 if ((cur_rmconf->xauth->login = vdup($2)) == NULL) {
1696 racoon_yyerror("failed to set identifer.\n");
1697 return -1;
1698 }
1699 vfree($2); //%%% BUG FIX - memory leak
1700 #else
1701 racoon_yyerror("racoon not configured with --enable-hybrid");
1702 #endif
1703 }
1704 EOS
1705 | PEERS_IDENTIFIER IDENTIFIERTYPE identifierstring
1706 {
1707 struct idspec *id;
1708 id = newidspec();
1709 if (id == NULL) {
1710 racoon_yyerror("failed to allocate idspec");
1711 return -1;
1712 }
1713 if (set_identifier(&id->id, $2, $3) != 0) {
1714 racoon_yyerror("failed to set identifer.\n");
1715 racoon_free(id);
1716 vfree($3); //%%% BUG FIX - memory leak
1717 return -1;
1718 }
1719 vfree($3); //%%% BUG FIX - memory leak
1720 id->idtype = $2;
1721 genlist_append (cur_rmconf->idvl_p, id);
1722 }
1723 EOS
1724 | PEERS_IDENTIFIER IDENTIFIERTYPE IDENTIFIERQUAL identifierstring
1725 {
1726 struct idspec *id;
1727 id = newidspec();
1728 if (id == NULL) {
1729 racoon_yyerror("failed to allocate idspec");
1730 return -1;
1731 }
1732 if (set_identifier_qual(&id->id, $2, $4, $3) != 0) {
1733 racoon_yyerror("failed to set identifer.\n");
1734 racoon_free(id);
1735 return -1;
1736 }
1737 id->idtype = $2;
1738 genlist_append (cur_rmconf->idvl_p, id);
1739 }
1740 EOS
1741 | VERIFY_IDENTIFIER SWITCH { cur_rmconf->verify_identifier = $2; } EOS
1742 | SHARED_SECRET SECRETTYPE QUOTEDSTRING
1743 {
1744 cur_rmconf->secrettype = $2;
1745 cur_rmconf->shared_secret = $3;
1746 } EOS
1747 | SHARED_SECRET SECRETTYPE
1748 {
1749 if ($2 != SECRETTYPE_KEYCHAIN_BY_ID) {
1750 racoon_yyerror("shared secret value missing.\n");
1751 return -1;
1752 }
1753 cur_rmconf->secrettype = $2;
1754 } EOS
1755 | NONCE_SIZE NUMBER { cur_rmconf->nonce_size = $2; } EOS
1756 | DH_GROUP
1757 {
1758 racoon_yyerror("dh_group cannot be defined here.");
1759 return -1;
1760 }
1761 dh_group_num EOS
1762 | PASSIVE SWITCH { cur_rmconf->passive = $2; } EOS
1763 | IKE_FRAG SWITCH { cur_rmconf->ike_frag = $2; } EOS
1764 | IKE_FRAG REMOTE_FORCE_LEVEL { cur_rmconf->ike_frag = ISAKMP_FRAG_FORCE; } EOS
1765 | ESP_FRAG NUMBER {
1766 #ifdef SADB_X_EXT_NAT_T_FRAG
1767 if (libipsec_opt & LIBIPSEC_OPT_FRAG)
1768 cur_rmconf->esp_frag = $2;
1769 else
1770 racoon_yywarn("libipsec lacks IKE frag support");
1771 #else
1772 racoon_yywarn("Your kernel does not support esp_frag");
1773 #endif
1774 } EOS
1775 | SCRIPT QUOTEDSTRING PHASE1_UP {
1776 if (cur_rmconf->script[SCRIPT_PHASE1_UP] != NULL)
1777 vfree(cur_rmconf->script[SCRIPT_PHASE1_UP]);
1778
1779 cur_rmconf->script[SCRIPT_PHASE1_UP] =
1780 script_path_add(vdup($2));
1781 } EOS
1782 | SCRIPT QUOTEDSTRING PHASE1_DOWN {
1783 if (cur_rmconf->script[SCRIPT_PHASE1_DOWN] != NULL)
1784 vfree(cur_rmconf->script[SCRIPT_PHASE1_DOWN]);
1785
1786 cur_rmconf->script[SCRIPT_PHASE1_DOWN] =
1787 script_path_add(vdup($2));
1788 } EOS
1789 | MODE_CFG SWITCH { cur_rmconf->mode_cfg = $2; } EOS
1790 | WEAK_PHASE1_CHECK SWITCH {
1791 cur_rmconf->weak_phase1_check = $2;
1792 } EOS
1793 | GENERATE_POLICY SWITCH { cur_rmconf->gen_policy = $2; } EOS
1794 | GENERATE_POLICY GENERATE_LEVEL { cur_rmconf->gen_policy = $2; } EOS
1795 | SUPPORT_PROXY SWITCH { cur_rmconf->support_proxy = $2; } EOS
1796 | INITIAL_CONTACT SWITCH { cur_rmconf->ini_contact = $2; } EOS
1797 | NAT_TRAVERSAL SWITCH
1798 {
1799 #ifdef ENABLE_NATT
1800 cur_rmconf->nat_traversal = $2;
1801 #else
1802 racoon_yyerror("NAT-T support not compiled in.");
1803 #endif
1804 } EOS
1805 | NAT_TRAVERSAL NAT_TRAVERSAL_LEVEL
1806 {
1807 #ifdef ENABLE_NATT
1808 cur_rmconf->nat_traversal = $2;
1809 #else
1810 racoon_yyerror("NAT-T support not compiled in.");
1811 #endif
1812 } EOS
1813 | NAT_TRAVERSAL_MULTI_USER SWITCH
1814 {
1815 #ifdef ENABLE_NATT
1816 cur_rmconf->natt_multiple_user = $2;
1817 #else
1818 racoon_yyerror("NAT-T support not compiled in.");
1819 #endif
1820 } EOS
1821 | NAT_TRAVERSAL_KEEPALIVE SWITCH
1822 {
1823 #ifdef ENABLE_NATT
1824 cur_rmconf->natt_keepalive = $2;
1825 #else
1826 racoon_yyerror("NAT-T support not compiled in.");
1827 #endif
1828 } EOS
1829 | DPD SWITCH
1830 {
1831 #ifdef ENABLE_DPD
1832 cur_rmconf->dpd = $2;
1833 #else
1834 racoon_yyerror("DPD support not compiled in.");
1835 #endif
1836 } EOS
1837 | DPD_DELAY NUMBER
1838 {
1839 #ifdef ENABLE_DPD
1840 cur_rmconf->dpd_interval = $2;
1841 #else
1842 racoon_yyerror("DPD support not compiled in.");
1843 #endif
1844 }
1845 EOS
1846 | DPD_RETRY NUMBER
1847 {
1848 #ifdef ENABLE_DPD
1849 cur_rmconf->dpd_retry = $2;
1850 #else
1851 racoon_yyerror("DPD support not compiled in.");
1852 #endif
1853 }
1854 EOS
1855 | DPD_MAXFAIL NUMBER
1856 {
1857 #ifdef ENABLE_DPD
1858 cur_rmconf->dpd_maxfails = $2;
1859 #else
1860 racoon_yyerror("DPD support not compiled in.");
1861 #endif
1862 }
1863 EOS
1864 | DPD_ALGORITHM dpd_algo_type
1865 {
1866 #ifdef ENABLE_DPD
1867 cur_rmconf->dpd_algo = $2;
1868 #else
1869 racoon_yyerror("DPD support not compiled in.");
1870 #endif
1871 }
1872 EOS
1873 | DISCONNECT_ON_IDLE IDLE_TIMEOUT NUMBER IDLE_DIRECTION idle_dir_type
1874 {
1875 cur_rmconf->idle_timeout = $3;
1876 cur_rmconf->idle_timeout_dir = $5;
1877 }
1878 EOS
1879 | LIFETIME LIFETYPE_TIME NUMBER unittype_time
1880 {
1881 cur_rmconf->prhead->lifetime = $3 * $4;
1882 }
1883 EOS
1884 | PROPOSAL_CHECK PROPOSAL_CHECK_LEVEL { cur_rmconf->pcheck_level = $2; } EOS
1885 | LIFETIME LIFETYPE_BYTE NUMBER unittype_byte
1886 {
1887 #if 1
1888 racoon_yyerror("byte lifetime support is deprecated in Phase1");
1889 return -1;
1890 #else
1891 racoon_yywarn("the lifetime of bytes in phase 1 "
1892 "will be ignored at the moment.");
1893 cur_rmconf->prhead->lifebyte = fix_lifebyte($3 * $4);
1894 if (cur_rmconf->prhead->lifebyte == 0)
1895 return -1;
1896 #endif
1897 }
1898 EOS
1899 | PROPOSAL
1900 {
1901 struct secprotospec *spspec;
1902
1903 spspec = newspspec();
1904 if (spspec == NULL)
1905 return -1;
1906 insspspec(spspec, &cur_rmconf->prhead);
1907 }
1908 BOC isakmpproposal_specs EOC
1909 ;
1910 exchange_types
1911 : /* nothing */
1912 | exchange_types EXCHANGETYPE
1913 {
1914 struct etypes *new;
1915 new = racoon_malloc(sizeof(struct etypes));
1916 if (new == NULL) {
1917 racoon_yyerror("failed to allocate etypes");
1918 return -1;
1919 }
1920 new->type = $2;
1921 new->next = NULL;
1922 if (cur_rmconf->etypes == NULL)
1923 cur_rmconf->etypes = new;
1924 else {
1925 struct etypes *p;
1926 for (p = cur_rmconf->etypes;
1927 p->next != NULL;
1928 p = p->next)
1929 ;
1930 p->next = new;
1931 }
1932 }
1933 ;
1934 cert_spec
1935 : CERT_X509 QUOTEDSTRING QUOTEDSTRING
1936 {
1937 cur_rmconf->certtype = $1;
1938 if (cur_rmconf->mycertfile != NULL)
1939 racoon_free(cur_rmconf->mycertfile);
1940 cur_rmconf->mycertfile = racoon_strdup($2->v);
1941 STRDUP_FATAL(cur_rmconf->mycertfile);
1942 vfree($2);
1943 if (cur_rmconf->myprivfile != NULL)
1944 racoon_free(cur_rmconf->myprivfile);
1945 cur_rmconf->myprivfile = racoon_strdup($3->v);
1946 STRDUP_FATAL(cur_rmconf->myprivfile);
1947 vfree($3);
1948 }
1949 EOS
1950 | CERT_X509 IN_KEYCHAIN
1951 {
1952 cur_rmconf->certtype = $1;
1953 cur_rmconf->identity_in_keychain = 1;
1954 cur_rmconf->keychainCertRef = NULL;
1955 }
1956 EOS
1957 ;
1958 | CERT_X509 IN_KEYCHAIN QUOTEDSTRING
1959 {
1960 cur_rmconf->certtype = $1;
1961 cur_rmconf->identity_in_keychain = 1;
1962 cur_rmconf->keychainCertRef = $3;
1963 }
1964 EOS
1965 ;
1966 | CERT_PLAINRSA QUOTEDSTRING
1967 {
1968 racoon_yyerror("plainrsa not supported.\n");
1969 return -1;
1970 }
1971 EOS
1972 ;
1973 dh_group_num
1974 : ALGORITHMTYPE
1975 {
1976 $$ = algtype2doi(algclass_isakmp_dh, $1);
1977 if ($$ == -1) {
1978 racoon_yyerror("must be DH group");
1979 return -1;
1980 }
1981 #ifndef HAVE_OPENSSL
1982 if ($$ != OAKLEY_ATTR_GRP_DESC_MODP1024 && $$ != OAKLEY_ATTR_GRP_DESC_MODP1536) {
1983 racoon_yyerror("DH group must be 2 or 5");
1984 return -1;
1985 }
1986 #endif
1987 }
1988 | NUMBER
1989 {
1990 if (ARRAYLEN(num2dhgroup) > $1 && num2dhgroup[$1] != 0) {
1991 $$ = num2dhgroup[$1];
1992 } else {
1993 racoon_yyerror("must be DH group");
1994 $$ = 0;
1995 return -1;
1996 }
1997 #ifndef HAVE_OPENSSL
1998 if ($$ != OAKLEY_ATTR_GRP_DESC_MODP1024 && $$ != OAKLEY_ATTR_GRP_DESC_MODP1536) {
1999 racoon_yyerror("DH group must be 2 or 5");
2000 return -1;
2001 }
2002 #endif
2003 }
2004 ;
2005 identifierstring
2006 : /* nothing */ { $$ = NULL; }
2007 | ADDRSTRING { $$ = $1; }
2008 | QUOTEDSTRING { $$ = $1; }
2009 ;
2010 isakmpproposal_specs
2011 : /* nothing */
2012 | isakmpproposal_specs isakmpproposal_spec
2013 ;
2014 isakmpproposal_spec
2015 : STRENGTH
2016 {
2017 racoon_yyerror("strength directive is obsoleted.");
2018 } STRENGTHTYPE EOS
2019 | LIFETIME LIFETYPE_TIME NUMBER unittype_time
2020 {
2021 cur_rmconf->prhead->spspec->lifetime = $3 * $4;
2022 }
2023 EOS
2024 | LIFETIME LIFETYPE_BYTE NUMBER unittype_byte
2025 {
2026 #if 1
2027 racoon_yyerror("byte lifetime support is deprecated");
2028 return -1;
2029 #else
2030 cur_rmconf->prhead->spspec->lifebyte = fix_lifebyte($3 * $4);
2031 if (cur_rmconf->prhead->spspec->lifebyte == 0)
2032 return -1;
2033 #endif
2034 }
2035 EOS
2036 | DH_GROUP dh_group_num
2037 {
2038 cur_rmconf->prhead->spspec->algclass[algclass_isakmp_dh] = $2;
2039 }
2040 EOS
2041 | GSS_ID QUOTEDSTRING
2042 {
2043 if (cur_rmconf->prhead->spspec->vendorid != VENDORID_GSSAPI) {
2044 racoon_yyerror("wrong Vendor ID for gssapi_id");
2045 return -1;
2046 }
2047 if (cur_rmconf->prhead->spspec->gssid != NULL)
2048 racoon_free(cur_rmconf->prhead->spspec->gssid);
2049 cur_rmconf->prhead->spspec->gssid =
2050 racoon_strdup($2->v);
2051 STRDUP_FATAL(cur_rmconf->prhead->spspec->gssid);
2052 }
2053 EOS
2054 | ALGORITHM_CLASS ALGORITHMTYPE keylength
2055 {
2056 int doi;
2057 int defklen;
2058
2059 doi = algtype2doi($1, $2);
2060 if (doi == -1) {
2061 racoon_yyerror("algorithm mismatched 1");
2062 return -1;
2063 }
2064
2065 switch ($1) {
2066 case algclass_isakmp_enc:
2067 /* reject suppressed algorithms */
2068 cur_rmconf->prhead->spspec->algclass[algclass_isakmp_enc] = doi;
2069 defklen = default_keylen($1, $2);
2070 if (defklen == 0) {
2071 if ($3) {
2072 racoon_yyerror("keylen not allowed");
2073 return -1;
2074 }
2075 } else {
2076 if ($3 && check_keylen($1, $2, $3) < 0) {
2077 racoon_yyerror("invalid keylen %d", $3);
2078 return -1;
2079 }
2080 }
2081 if ($3)
2082 cur_rmconf->prhead->spspec->encklen = $3;
2083 else
2084 cur_rmconf->prhead->spspec->encklen = defklen;
2085 break;
2086 case algclass_isakmp_hash:
2087 cur_rmconf->prhead->spspec->algclass[algclass_isakmp_hash] = doi;
2088 break;
2089 case algclass_isakmp_ameth:
2090 cur_rmconf->prhead->spspec->algclass[algclass_isakmp_ameth] = doi;
2091 /*
2092 * We may have to set the Vendor ID for the
2093 * authentication method we're using.
2094 */
2095 switch ($2) {
2096 case algtype_gssapikrb:
2097 if (cur_rmconf->prhead->spspec->vendorid !=
2098 VENDORID_UNKNOWN) {
2099 racoon_yyerror("Vendor ID mismatch "
2100 "for auth method");
2101 return -1;
2102 }
2103 /*
2104 * For interoperability with Win2k,
2105 * we set the Vendor ID to "GSSAPI".
2106 */
2107 cur_rmconf->prhead->spspec->vendorid =
2108 VENDORID_GSSAPI;
2109 break;
2110 default:
2111 break;
2112 }
2113 break;
2114 default:
2115 racoon_yyerror("algorithm mismatched 2");
2116 return -1;
2117 }
2118 }
2119 EOS
2120 ;
2121
2122 unittype_time
2123 : UNITTYPE_SEC { $$ = 1; }
2124 | UNITTYPE_MIN { $$ = 60; }
2125 | UNITTYPE_HOUR { $$ = (60 * 60); }
2126 ;
2127 unittype_byte
2128 : UNITTYPE_BYTE { $$ = 1; }
2129 | UNITTYPE_KBYTES { $$ = 1024; }
2130 | UNITTYPE_MBYTES { $$ = (1024 * 1024); }
2131 | UNITTYPE_TBYTES { $$ = (1024 * 1024 * 1024); }
2132 ;
2133 dpd_algo_type
2134 : DPD_ALGO_TYPE_DEFAULT { $$ = DPD_ALGO_DEFAULT; }
2135 | DPD_ALGO_TYPE_INBOUND { $$ = DPD_ALGO_INBOUND_DETECT; }
2136 | DPD_ALGO_TYPE_BLACKHOLE { $$ = DPD_ALGO_BLACKHOLE_DETECT; }
2137 ;
2138 idle_dir_type
2139 : IDLE_DIRECTION_ANY { $$ = IPSEC_DIR_ANY; }
2140 | IDLE_DIRECTION_IN { $$ = IPSEC_DIR_INBOUND; }
2141 | IDLE_DIRECTION_OUT { $$ = IPSEC_DIR_OUTBOUND; }
2142 ;
2143 %%
2144
2145 static struct proposalspec *
2146 newprspec()
2147 {
2148 struct proposalspec *new;
2149
2150 new = racoon_calloc(1, sizeof(*new));
2151 if (new == NULL)
2152 racoon_yyerror("failed to allocate proposal");
2153
2154 return new;
2155 }
2156
2157 /*
2158 * insert into head of list.
2159 */
2160 static void
2161 insprspec(prspec, head)
2162 struct proposalspec *prspec;
2163 struct proposalspec **head;
2164 {
2165 if (*head != NULL)
2166 (*head)->prev = prspec;
2167 prspec->next = *head;
2168 *head = prspec;
2169 }
2170
2171 static struct secprotospec *
2172 newspspec()
2173 {
2174 struct secprotospec *new;
2175
2176 new = racoon_calloc(1, sizeof(*new));
2177 if (new == NULL) {
2178 racoon_yyerror("failed to allocate spproto");
2179 return NULL;
2180 }
2181
2182 new->encklen = 0; /*XXX*/
2183
2184 /*
2185 * Default to "uknown" vendor -- we will override this
2186 * as necessary. When we send a Vendor ID payload, an
2187 * "unknown" will be translated to a KAME/racoon ID.
2188 */
2189 new->vendorid = VENDORID_UNKNOWN;
2190
2191 return new;
2192 }
2193
2194 /*
2195 * insert into head of list.
2196 */
2197 static void
2198 insspspec(spspec, head)
2199 struct secprotospec *spspec;
2200 struct proposalspec **head;
2201 {
2202 spspec->back = *head;
2203
2204 if ((*head)->spspec != NULL)
2205 (*head)->spspec->prev = spspec;
2206 spspec->next = (*head)->spspec;
2207 (*head)->spspec = spspec;
2208 }
2209
2210 /* set final acceptable proposal */
2211 static int
2212 set_isakmp_proposal(rmconf, prspec)
2213 struct remoteconf *rmconf;
2214 struct proposalspec *prspec;
2215 {
2216 struct proposalspec *p;
2217 struct secprotospec *s;
2218 int prop_no = 1;
2219 int trns_no = 1;
2220 int32_t types[MAXALGCLASS];
2221
2222 p = prspec;
2223 if (p->next != 0) {
2224 plog(LLV_ERROR, LOCATION, NULL,
2225 "multiple proposal definition.\n");
2226 return -1;
2227 }
2228
2229 /* mandatory check */
2230 if (p->spspec == NULL) {
2231 racoon_yyerror("no remote specification found: %s.\n",
2232 saddr2str((struct sockaddr *)rmconf->remote));
2233 return -1;
2234 }
2235 for (s = p->spspec; s != NULL; s = s->next) {
2236 /* XXX need more to check */
2237 if (s->algclass[algclass_isakmp_enc] == 0) {
2238 racoon_yyerror("encryption algorithm required.");
2239 return -1;
2240 }
2241 if (s->algclass[algclass_isakmp_hash] == 0) {
2242 racoon_yyerror("hash algorithm required.");
2243 return -1;
2244 }
2245 if (s->algclass[algclass_isakmp_dh] == 0) {
2246 racoon_yyerror("DH group required.");
2247 return -1;
2248 }
2249 if (s->algclass[algclass_isakmp_ameth] == 0) {
2250 racoon_yyerror("authentication method required.");
2251 return -1;
2252 }
2253 }
2254
2255 /* skip to last part */
2256 for (s = p->spspec; s->next != NULL; s = s->next)
2257 ;
2258
2259 while (s != NULL) {
2260 plog(LLV_DEBUG2, LOCATION, NULL,
2261 "lifetime = %ld\n", (long)
2262 (s->lifetime ? s->lifetime : p->lifetime));
2263 plog(LLV_DEBUG2, LOCATION, NULL,
2264 "lifebyte = %d\n",
2265 s->lifebyte ? s->lifebyte : p->lifebyte);
2266 plog(LLV_DEBUG2, LOCATION, NULL,
2267 "encklen=%d\n", s->encklen);
2268
2269 memset(types, 0, ARRAYLEN(types));
2270 types[algclass_isakmp_enc] = s->algclass[algclass_isakmp_enc];
2271 types[algclass_isakmp_hash] = s->algclass[algclass_isakmp_hash];
2272 types[algclass_isakmp_dh] = s->algclass[algclass_isakmp_dh];
2273 types[algclass_isakmp_ameth] =
2274 s->algclass[algclass_isakmp_ameth];
2275
2276 /* expanding spspec */
2277 clean_tmpalgtype();
2278 trns_no = expand_isakmpspec(prop_no, trns_no, types,
2279 algclass_isakmp_enc, algclass_isakmp_ameth + 1,
2280 s->lifetime ? s->lifetime : p->lifetime,
2281 s->lifebyte ? s->lifebyte : p->lifebyte,
2282 s->encklen, s->vendorid, s->gssid,
2283 rmconf);
2284 if (trns_no == -1) {
2285 plog(LLV_ERROR, LOCATION, NULL,
2286 "failed to expand isakmp proposal.\n");
2287 return -1;
2288 }
2289
2290 s = s->prev;
2291 }
2292
2293 if (rmconf->proposal == NULL) {
2294 plog(LLV_ERROR, LOCATION, NULL,
2295 "no proposal found.\n");
2296 return -1;
2297 }
2298
2299 return 0;
2300 }
2301
2302 static void
2303 clean_tmpalgtype()
2304 {
2305 int i;
2306 for (i = 0; i < MAXALGCLASS; i++)
2307 tmpalgtype[i] = 0; /* means algorithm undefined. */
2308 }
2309
2310 static int
2311 expand_isakmpspec(prop_no, trns_no, types,
2312 class, last, lifetime, lifebyte, encklen, vendorid, gssid,
2313 rmconf)
2314 int prop_no, trns_no;
2315 int *types, class, last;
2316 time_t lifetime;
2317 int lifebyte;
2318 int encklen;
2319 int vendorid;
2320 char *gssid;
2321 struct remoteconf *rmconf;
2322 {
2323 struct isakmpsa *new;
2324
2325 /* debugging */
2326 {
2327 int j;
2328 char tb[10];
2329 plog(LLV_DEBUG2, LOCATION, NULL,
2330 "p:%d t:%d\n", prop_no, trns_no);
2331 for (j = class; j < MAXALGCLASS; j++) {
2332 snprintf(tb, sizeof(tb), "%d", types[j]);
2333 plog(LLV_DEBUG2, LOCATION, NULL,
2334 "%s%s%s%s\n",
2335 s_algtype(j, types[j]),
2336 types[j] ? "(" : "",
2337 tb[0] == '0' ? "" : tb,
2338 types[j] ? ")" : "");
2339 }
2340 plog(LLV_DEBUG2, LOCATION, NULL, "\n");
2341 }
2342
2343 #define TMPALGTYPE2STR(n) \
2344 s_algtype(algclass_isakmp_##n, types[algclass_isakmp_##n])
2345 /* check mandatory values */
2346 if (types[algclass_isakmp_enc] == 0
2347 || types[algclass_isakmp_ameth] == 0
2348 || types[algclass_isakmp_hash] == 0
2349 || types[algclass_isakmp_dh] == 0) {
2350 racoon_yyerror("few definition of algorithm "
2351 "enc=%s ameth=%s hash=%s dhgroup=%s.\n",
2352 TMPALGTYPE2STR(enc),
2353 TMPALGTYPE2STR(ameth),
2354 TMPALGTYPE2STR(hash),
2355 TMPALGTYPE2STR(dh));
2356 return -1;
2357 }
2358 #undef TMPALGTYPE2STR
2359
2360 /* set new sa */
2361 new = newisakmpsa();
2362 if (new == NULL) {
2363 racoon_yyerror("failed to allocate isakmp sa");
2364 return -1;
2365 }
2366 new->prop_no = prop_no;
2367 new->trns_no = trns_no++;
2368 new->lifetime = lifetime;
2369 new->lifebyte = lifebyte;
2370 new->enctype = types[algclass_isakmp_enc];
2371 new->encklen = encklen;
2372 new->authmethod = types[algclass_isakmp_ameth];
2373 new->hashtype = types[algclass_isakmp_hash];
2374 new->dh_group = types[algclass_isakmp_dh];
2375 new->vendorid = vendorid;
2376 #ifdef HAVE_GSSAPI
2377 if (new->authmethod == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB) {
2378 if (gssid != NULL) {
2379 if ((new->gssid = vmalloc(strlen(gssid))) == NULL) {
2380 racoon_free(new);
2381 racoon_yyerror("failed to allocate gssid");
2382 return -1;
2383 }
2384 memcpy(new->gssid->v, gssid, new->gssid->l);
2385 racoon_free(gssid);
2386 } else {
2387 /*
2388 * Allocate the default ID so that it gets put
2389 * into a GSS ID attribute during the Phase 1
2390 * exchange.
2391 */
2392 new->gssid = gssapi_get_default_gss_id();
2393 }
2394 }
2395 #endif
2396 insisakmpsa(new, rmconf);
2397
2398 return trns_no;
2399 }
2400
2401 static int
2402 listen_addr (struct sockaddr_storage *addr, int udp_encap)
2403 {
2404 struct myaddrs *p;
2405
2406 p = newmyaddr();
2407 if (p == NULL) {
2408 racoon_yyerror("failed to allocate myaddrs");
2409 return -1;
2410 }
2411 p->addr = addr;
2412 if (p->addr == NULL) {
2413 racoon_yyerror("failed to copy sockaddr_storage ");
2414 delmyaddr(p);
2415 return -1;
2416 }
2417 p->udp_encap = udp_encap;
2418 /* These need to be initialized for Apple modifications
2419 * to open code for isakmp sockets
2420 */
2421 p->sock = -1;
2422 p->in_use = 1;
2423
2424 insmyaddr(p, &lcconf->myaddrs);
2425
2426 lcconf->autograbaddr = 0;
2427 return 0;
2428 }
2429
2430 #if 0
2431 /*
2432 * fix lifebyte.
2433 * Must be more than 1024B because its unit is kilobytes.
2434 * That is defined RFC2407.
2435 */
2436 static int
2437 fix_lifebyte(t)
2438 unsigned long t;
2439 {
2440 if (t < 1024) {
2441 racoon_yyerror("byte size should be more than 1024B.");
2442 return 0;
2443 }
2444
2445 return(t / 1024);
2446 }
2447 #endif
2448
2449 int
2450 cfparse()
2451 {
2452 int error;
2453
2454 plog(LLV_DEBUG, LOCATION, NULL, "===== parse config\n");
2455
2456 yycf_init_buffer();
2457
2458 if (yycf_switch_buffer(lcconf->racoon_conf) != 0) {
2459 IPSECCONFIGTRACEREVENT(CONSTSTR(lcconf->racoon_conf),
2460 IPSECCONFIGEVENTCODE_PARSE_ERROR,
2461 CONSTSTR("could not read configuration file"),
2462 CONSTSTR("cfparse: yycf_switch_buffer erred"));
2463 plog(LLV_ERROR, LOCATION, NULL,
2464 "could not read configuration file \"%s\"\n",
2465 lcconf->racoon_conf);
2466 return -1;
2467 }
2468
2469 error = yyparse();
2470 if (error != 0) {
2471 if (yyerrorcount) {
2472 plog(LLV_ERROR, LOCATION, NULL,
2473 "fatal parse failure (%d errors)\n",
2474 yyerrorcount);
2475 } else {
2476 plog(LLV_ERROR, LOCATION, NULL,
2477 "fatal parse failure.\n");
2478 }
2479 IPSECCONFIGTRACEREVENT(CONSTSTR(lcconf->racoon_conf),
2480 IPSECCONFIGEVENTCODE_PARSE_ERROR,
2481 CONSTSTR("fatal parse failure"),
2482 CONSTSTR("cfparse: yyparse erred"));
2483 yycf_clean_buffer();
2484 return -1;
2485 }
2486
2487 if (error == 0 && yyerrorcount) {
2488 plog(LLV_ERROR, LOCATION, NULL,
2489 "parse error is nothing, but yyerrorcount is %d.\n",
2490 yyerrorcount);
2491 IPSECCONFIGTRACEREVENT(CONSTSTR(lcconf->racoon_conf),
2492 IPSECCONFIGEVENTCODE_PARSE_ERROR,
2493 CONSTSTR("ambivalent error code"),
2494 CONSTSTR("cfparse: error == 0 && yerrorcount"));
2495 yycf_clean_buffer();
2496 exit(1);
2497 }
2498
2499 yycf_clean_buffer();
2500
2501 plog(LLV_DEBUG2, LOCATION, NULL, "parse successed.\n");
2502
2503 return 0;
2504 }
2505
2506 int
2507 cfreparse(int sig)
2508 {
2509 int ignore_estab_or_assert_handles = (sig == SIGUSR1);
2510
2511 if (sig >= 0 && sig < NSIG) {
2512 plog(LLV_DEBUG, LOCATION, NULL, "==== Got %s signal - re-parsing.\n", sys_signame[sig]);
2513 } else {
2514 plog(LLV_ERROR, LOCATION, NULL, "==== Got Unknown signal - re-parsing.\n");
2515 IPSECCONFIGTRACEREVENT(CONSTSTR("reparse"),
2516 IPSECCONFIGEVENTCODE_REPARSE_ERROR,
2517 CONSTSTR("Unknown signal"),
2518 CONSTSTR("cfreparse: triggered by unknown signal"));
2519 }
2520
2521 flushph2(ignore_estab_or_assert_handles);
2522 flushph1(ignore_estab_or_assert_handles);
2523 flushrmconf();
2524 flushsainfo();
2525 flushlcconf();
2526 #ifdef HAVE_LIBLDAP
2527 xauth_ldap_flush();
2528 #endif
2529 check_auto_exit(); /* check/change state of auto exit */
2530 clean_tmpalgtype();
2531
2532 return(cfparse());
2533 }
2534
2535
2536 #ifdef ENABLE_ADMINPORT
2537 static void
2538 adminsock_conf(path, owner, group, mode_dec)
2539 vchar_t *path;
2540 vchar_t *owner;
2541 vchar_t *group;
2542 int mode_dec;
2543 {
2544 struct passwd *pw = NULL;
2545 struct group *gr = NULL;
2546 mode_t mode = 0;
2547 uid_t uid;
2548 gid_t gid;
2549 int isnum;
2550
2551 adminsock_path = path->v;
2552
2553 if (owner == NULL)
2554 return;
2555
2556 errno = 0;
2557 uid = atoi(owner->v);
2558 isnum = !errno;
2559 if (((pw = getpwnam(owner->v)) == NULL) && !isnum)
2560 racoon_yyerror("User \"%s\" does not exist", owner->v);
2561
2562 if (pw)
2563 adminsock_owner = pw->pw_uid;
2564 else
2565 adminsock_owner = uid;
2566
2567 if (group == NULL)
2568 return;
2569
2570 errno = 0;
2571 gid = atoi(group->v);
2572 isnum = !errno;
2573 if (((gr = getgrnam(group->v)) == NULL) && !isnum)
2574 racoon_yyerror("Group \"%s\" does not exist", group->v);
2575
2576 if (gr)
2577 adminsock_group = gr->gr_gid;
2578 else
2579 adminsock_group = gid;
2580
2581 if (mode_dec == -1)
2582 return;
2583
2584 if (mode_dec > 777)
2585 racoon_yyerror("Mode 0%03o is invalid", mode_dec);
2586 if (mode_dec >= 400) { mode += 0400; mode_dec -= 400; }
2587 if (mode_dec >= 200) { mode += 0200; mode_dec -= 200; }
2588 if (mode_dec >= 100) { mode += 0200; mode_dec -= 100; }
2589
2590 if (mode_dec > 77)
2591 racoon_yyerror("Mode 0%03o is invalid", mode_dec);
2592 if (mode_dec >= 40) { mode += 040; mode_dec -= 40; }
2593 if (mode_dec >= 20) { mode += 020; mode_dec -= 20; }
2594 if (mode_dec >= 10) { mode += 020; mode_dec -= 10; }
2595
2596 if (mode_dec > 7)
2597 racoon_yyerror("Mode 0%03o is invalid", mode_dec);
2598 if (mode_dec >= 4) { mode += 04; mode_dec -= 4; }
2599 if (mode_dec >= 2) { mode += 02; mode_dec -= 2; }
2600 if (mode_dec >= 1) { mode += 02; mode_dec -= 1; }
2601
2602 adminsock_mode = mode;
2603
2604 return;
2605 }
2606 #endif
mirror of ipsec