ipsec-tools/racoon/cfparse.y

   1 /*      $NetBSD: cfparse.y,v 1.18.4.3 2007/08/01 11:52:19 vanhu Exp $   */
   2
   3 /* Id: cfparse.y,v 1.66 2006/08/22 18:17:17 manubsd Exp */
   4
   5 %{
   6 /*
   7  * Copyright (C) 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002 and 2003 WIDE Project.
   8  * All rights reserved.
   9  *
  10  * Redistribution and use in source and binary forms, with or without
  11  * modification, are permitted provided that the following conditions
  12  * are met:
  13  * 1. Redistributions of source code must retain the above copyright
  14  *    notice, this list of conditions and the following disclaimer.
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  * 3. Neither the name of the project nor the names of its contributors
  19  *    may be used to endorse or promote products derived from this software
  20  *    without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  32  * SUCH DAMAGE.
  33  */
  34
  35 #include "config.h"
  36
  37 #include <sys/types.h>
  38 #include <sys/param.h>
  39 #include <sys/queue.h>
  40 #include <sys/socket.h>
  41
  42 #include <netinet/in.h>
  43 #ifdef HAVE_NETINET6_IPSEC
  44 #  include <netinet6/ipsec.h>
  45 #else
  46 #  include <netinet/ipsec.h>
  47 #endif
  48
  49 #ifdef ENABLE_HYBRID
  50 #include <arpa/inet.h>
  51 #endif
  52
  53 #include <stdlib.h>
  54 #include <stdio.h>
  55 #include <string.h>
  56 #include <errno.h>
  57 #include <netdb.h>
  58 #include <pwd.h>
  59 #include <grp.h>
  60 #include <signal.h>
  61
  62 #include "var.h"
  63 #include "misc.h"
  64 #include "vmbuf.h"
  65 #include "plog.h"
  66 #include "sockmisc.h"
  67 #include "str2val.h"
  68 #include "genlist.h"
  69 #include "debug.h"
  70
  71 #include "cfparse_proto.h"
  72 #include "cftoken_proto.h"
  73 #include "algorithm.h"
  74 #include "localconf.h"
  75 #include "policy.h"
  76 #include "sainfo.h"
  77 #include "oakley.h"
  78 #include "pfkey.h"
  79 #include "remoteconf.h"
  80 #include "grabmyaddr.h"
  81 #include "isakmp_var.h"
  82 #include "handler.h"
  83 #include "isakmp.h"
  84 #include "nattraversal.h"
  85 #include "isakmp_frag.h"
  86 #include "session.h"
  87 #ifdef ENABLE_HYBRID
  88 #include "isakmp_unity.h"
  89 #include "isakmp_xauth.h"
  90 #include "isakmp_cfg.h"
  91 #endif
  92 #include "ipsec_doi.h"
  93 #include "strnames.h"
  94 #include "gcmalloc.h"
  95 #include "vendorid.h"
  96
  97 static int num2dhgroup[] = {
  98         0,
  99         OAKLEY_ATTR_GRP_DESC_MODP768,
 100         OAKLEY_ATTR_GRP_DESC_MODP1024,
 101         OAKLEY_ATTR_GRP_DESC_EC2N155,
 102         OAKLEY_ATTR_GRP_DESC_EC2N185,
 103         OAKLEY_ATTR_GRP_DESC_MODP1536,
 104         0,
 105         0,
 106         0,
 107         0,
 108         0,
 109         0,
 110         0,
 111         0,
 112         OAKLEY_ATTR_GRP_DESC_MODP2048,
 113         OAKLEY_ATTR_GRP_DESC_MODP3072,
 114         OAKLEY_ATTR_GRP_DESC_MODP4096,
 115         OAKLEY_ATTR_GRP_DESC_MODP6144,
 116         OAKLEY_ATTR_GRP_DESC_MODP8192
 117 };
 118
 119 struct remote_index_val {
 120     int prefix;
 121     struct sockaddr_storage *addr;
 122 };
 123
 124 static struct remoteconf *cur_rmconf;
 125 static int tmpalgtype[MAXALGCLASS];
 126 static struct sainfo *cur_sainfo;
 127 static int cur_algclass;
 128
 129 static struct proposalspec *newprspec (void);
 130 static void insprspec (struct proposalspec *, struct proposalspec **);
 131 static struct secprotospec *newspspec (void);
 132 static void insspspec (struct secprotospec *, struct proposalspec **);
 133
 134 static int set_isakmp_proposal (struct remoteconf *, struct proposalspec *);
 135 static void clean_tmpalgtype (void);
 136 static int expand_isakmpspec (int, int, int *,
 137         int, int, time_t, int, int, int, char *, struct remoteconf *);
 138 static int listen_addr (struct sockaddr_storage *addr, int udp_encap);
 139
 140 void freeetypes (struct etypes **etypes);
 141
 142 #if 0
 143 static int fix_lifebyte (u_long);
 144 #endif
 145 %}
 146
 147 %union {
 148         unsigned long num;
 149         vchar_t *val;
 150         struct remoteconf *rmconf;
 151         struct sockaddr_storage *saddr;
 152         struct sainfoalg *alg;
 153     struct remote_index_val *rmidx;
 154 }
 155
 156         /* path */
 157 %token PATH PATHTYPE
 158         /* include */
 159 %token INCLUDE
 160         /* self information */
 161 %token IDENTIFIER VENDORID
 162         /* logging */
 163 %token LOGGING LOGLEV
 164         /* padding */
 165 %token PADDING PAD_RANDOMIZE PAD_RANDOMIZELEN PAD_MAXLEN PAD_STRICT PAD_EXCLTAIL
 166         /* listen */
 167 %token LISTEN X_ISAKMP X_ISAKMP_NATT X_ADMIN STRICT_ADDRESS ADMINSOCK DISABLED
 168         /* modecfg */
 169 %token MODECFG CFG_NET4 CFG_MASK4 CFG_DNS4 CFG_NBNS4 CFG_DEFAULT_DOMAIN
 170 %token CFG_AUTH_SOURCE CFG_AUTH_GROUPS CFG_SYSTEM CFG_RADIUS CFG_PAM CFG_LDAP CFG_LOCAL CFG_NONE
 171 %token CFG_GROUP_SOURCE CFG_ACCOUNTING CFG_CONF_SOURCE CFG_MOTD CFG_POOL_SIZE CFG_AUTH_THROTTLE
 172 %token CFG_SPLIT_NETWORK CFG_SPLIT_LOCAL CFG_SPLIT_INCLUDE CFG_SPLIT_DNS
 173 %token CFG_PFS_GROUP CFG_SAVE_PASSWD
 174         /* timer */
 175 %token RETRY RETRY_COUNTER RETRY_INTERVAL RETRY_PERSEND
 176 %token RETRY_PHASE1 RETRY_PHASE2 NATT_KA AUTO_EXIT_DELAY
 177         /* algorithm */
 178 %token ALGORITHM_CLASS ALGORITHMTYPE STRENGTHTYPE
 179         /* sainfo */
 180 %token SAINFO FROM GROUP
 181         /* remote */
 182 %token REMOTE ANONYMOUS INHERIT
 183 %token EXCHANGE_MODE EXCHANGETYPE DOI DOITYPE SITUATION SITUATIONTYPE
 184 %token CERTIFICATE_TYPE CERTTYPE PEERS_CERTFILE CA_TYPE
 185 %token VERIFY_CERT SEND_CERT SEND_CR
 186 %token IDENTIFIERTYPE IDENTIFIERQUAL MY_IDENTIFIER
 187 %token PEERS_IDENTIFIER VERIFY_IDENTIFIER
 188 %token LOCAL_ADDRESS
 189 %token SHARED_SECRET SECRETTYPE
 190 %token OPEN_DIR_AUTH_GROUP IN_KEYCHAIN
 191 %token CERTIFICATE_VERIFICATION VERIFICATION_MODULE VERIFICATION_OPTION
 192 %token DNSSEC CERT_X509 CERT_PLAINRSA
 193 %token NONCE_SIZE DH_GROUP KEEPALIVE PASSIVE INITIAL_CONTACT
 194 %token NAT_TRAVERSAL REMOTE_FORCE_LEVEL NAT_TRAVERSAL_LEVEL NAT_TRAVERSAL_MULTI_USER NAT_TRAVERSAL_KEEPALIVE
 195 %token PROPOSAL_CHECK PROPOSAL_CHECK_LEVEL
 196 %token GENERATE_POLICY GENERATE_LEVEL SUPPORT_PROXY
 197 %token PROPOSAL
 198 %token EXEC_PATH EXEC_COMMAND EXEC_SUCCESS EXEC_FAILURE
 199 %token GSS_ID GSS_ID_ENC GSS_ID_ENCTYPE
 200 %token COMPLEX_BUNDLE
 201 %token DPD DPD_DELAY DPD_RETRY DPD_MAXFAIL DPD_ALGORITHM
 202 %token DISCONNECT_ON_IDLE IDLE_TIMEOUT IDLE_DIRECTION
 203 %token XAUTH_LOGIN WEAK_PHASE1_CHECK
 204
 205 %token PREFIX PORT PORTANY UL_PROTO ANY IKE_FRAG ESP_FRAG MODE_CFG
 206 %token PFS_GROUP LIFETIME LIFETYPE_TIME LIFETYPE_BYTE STRENGTH REMOTEID
 207
 208 %token NUMBER SWITCH BOOLEAN
 209 %token HEXSTRING QUOTEDSTRING ADDRSTRING ADDRRANGE
 210 %token UNITTYPE_BYTE UNITTYPE_KBYTES UNITTYPE_MBYTES UNITTYPE_TBYTES
 211 %token UNITTYPE_SEC UNITTYPE_MIN UNITTYPE_HOUR
 212 %token EOS BOC EOC COMMA
 213 %token DPD_ALGO_TYPE_DEFAULT DPD_ALGO_TYPE_INBOUND DPD_ALGO_TYPE_BLACKHOLE
 214 %token IDLE_DIRECTION_IN IDLE_DIRECTION_OUT IDLE_DIRECTION_ANY IKE_VERSION
 215
 216 %type <num> NUMBER BOOLEAN SWITCH keylength
 217 %type <num> PATHTYPE IDENTIFIERTYPE IDENTIFIERQUAL LOGLEV GSS_ID_ENCTYPE
 218 %type <num> SECRETTYPE
 219 %type <num> ALGORITHM_CLASS dh_group_num
 220 %type <num> ALGORITHMTYPE STRENGTHTYPE
 221 %type <num> PREFIX prefix PORT port ike_port
 222 %type <num> ul_proto UL_PROTO
 223 %type <num> EXCHANGETYPE DOITYPE SITUATIONTYPE
 224 %type <num> CERTTYPE CERT_X509 CERT_PLAINRSA PROPOSAL_CHECK_LEVEL NAT_TRAVERSAL_LEVEL GENERATE_LEVEL
 225 %type <num> VERIFICATION_MODULE VERIFICATION_OPTION
 226 %type <num> unittype_time unittype_byte
 227 %type <val> QUOTEDSTRING HEXSTRING ADDRSTRING ADDRRANGE sainfo_id
 228 %type <val> identifierstring
 229 %type <saddr> ike_addrinfo_port
 230 %type <alg> algorithm
 231 %type <num> dpd_algo_type
 232 %type <num> idle_dir_type
 233 %type <rmidx> remote_index ike_addrinfo_prefix_port
 234
 235 %%
 236
 237 statements
 238         :       /* nothing */
 239         |       statements statement
 240         ;
 241 statement
 242         :       path_statement
 243         |       include_statement
 244         |       identifier_statement
 245         |       logging_statement
 246         |       padding_statement
 247         |       listen_statement
 248         |       modecfg_statement
 249         |       timer_statement
 250         |       sainfo_statement
 251         |       remote_statement
 252         |       special_statement
 253         ;
 254
 255         /* path */
 256 path_statement
 257         :       PATH PATHTYPE QUOTEDSTRING
 258                 {
 259                         if ($2 >= LC_PATHTYPE_MAX) {
 260                                 racoon_yyerror("invalid path type %d", $2);
 261                                 return -1;
 262                         }
 263
 264                         /* free old pathinfo */
 265                         if (lcconf->pathinfo[$2])
 266                                 racoon_free(lcconf->pathinfo[$2]);
 267
 268                         /* set new pathinfo */
 269                         lcconf->pathinfo[$2] = racoon_strdup($3->v);
 270                         STRDUP_FATAL(lcconf->pathinfo[$2]);
 271                         vfree($3);
 272                 }
 273                 EOS
 274         ;
 275
 276         /* special */
 277 special_statement
 278         :       COMPLEX_BUNDLE SWITCH { lcconf->complex_bundle = $2; } EOS
 279         ;
 280
 281         /* include */
 282 include_statement
 283         :       INCLUDE QUOTEDSTRING EOS
 284                 {
 285                         char path[MAXPATHLEN];
 286
 287                         getpathname(path, sizeof(path),
 288                                 LC_PATHTYPE_INCLUDE, $2->v);
 289                         vfree($2);
 290                         if (yycf_switch_buffer(path) != 0)
 291                                 return -1;
 292                 }
 293         ;
 294
 295         /* self information */
 296 identifier_statement
 297         :       IDENTIFIER identifier_stmt
 298         ;
 299 identifier_stmt
 300         :       VENDORID
 301                 {
 302                         /*XXX to be deleted */
 303                 }
 304                 QUOTEDSTRING EOS
 305         |       IDENTIFIERTYPE QUOTEDSTRING
 306                 {
 307                         /*XXX to be deleted */
 308                         $2->l--;        /* nuke '\0' */
 309                         lcconf->ident[$1] = $2;
 310                         if (lcconf->ident[$1] == NULL) {
 311                                 racoon_yyerror("failed to set my ident: %s",
 312                                         strerror(errno));
 313                                 return -1;
 314                         }
 315                 }
 316                 EOS
 317         ;
 318
 319         /* logging */
 320 logging_statement
 321         :       LOGGING log_level EOS
 322         ;
 323 log_level
 324         :       QUOTEDSTRING
 325                 {
 326                         /*
 327                          * XXX ignore it because this specification
 328                          * will be obsoleted.
 329                          */
 330                         plogsetlevelquotedstr($1->v);
 331                         vfree($1);
 332                 }
 333         |       LOGLEV
 334                 {
 335                         plogsetlevel($1);
 336                 }
 337         ;
 338
 339         /* padding */
 340 padding_statement
 341         :       PADDING BOC padding_stmts EOC
 342         ;
 343 padding_stmts
 344         :       /* nothing */
 345         |       padding_stmts padding_stmt
 346         ;
 347 padding_stmt
 348         :       PAD_RANDOMIZE SWITCH { lcconf->pad_random = $2; } EOS
 349         |       PAD_RANDOMIZELEN SWITCH { lcconf->pad_randomlen = $2; } EOS
 350         |       PAD_MAXLEN NUMBER { lcconf->pad_maxsize = $2; } EOS
 351         |       PAD_STRICT SWITCH { lcconf->pad_strict = $2; } EOS
 352         |       PAD_EXCLTAIL SWITCH { lcconf->pad_excltail = $2; } EOS
 353         ;
 354
 355         /* listen */
 356 listen_statement
 357         :       LISTEN BOC listen_stmts EOC
 358         ;
 359 listen_stmts
 360         :       /* nothing */
 361         |       listen_stmts listen_stmt
 362         ;
 363 listen_stmt
 364         :       X_ISAKMP ike_addrinfo_port
 365                 {
 366                         listen_addr ($2, 0);
 367                 }
 368                 EOS
 369         |       X_ISAKMP_NATT ike_addrinfo_port
 370                 {
 371 #ifdef ENABLE_NATT
 372                         listen_addr ($2, 1);
 373 #else
 374                         racoon_yyerror("NAT-T support not compiled in.");
 375 #endif
 376                 }
 377                 EOS
 378         |       X_ADMIN
 379                 {
 380                         racoon_yyerror("admin directive is obsoleted.");
 381                 }
 382                 PORT EOS
 383         |       ADMINSOCK QUOTEDSTRING QUOTEDSTRING QUOTEDSTRING NUMBER
 384                 {
 385                         racoon_yywarn("admin port support not compiled in");
 386                 }
 387                 EOS
 388         |       ADMINSOCK QUOTEDSTRING
 389                 {
 390                         racoon_yywarn("admin port support not compiled in");
 391                 }
 392                 EOS
 393         |       ADMINSOCK DISABLED
 394                 {
 395                         racoon_yywarn("admin port support not compiled in");
 396                 }
 397                 EOS
 398         |       STRICT_ADDRESS { lcconf->strict_address = TRUE; } EOS
 399         ;
 400 ike_addrinfo_port
 401         :       ADDRSTRING ike_port
 402                 {
 403                         char portbuf[10];
 404
 405                         snprintf(portbuf, sizeof(portbuf), "%ld", $2);
 406                         $$ = str2saddr($1->v, portbuf);
 407                         vfree($1);
 408                         if (!$$)
 409                                 return -1;
 410                 }
 411         ;
 412 ike_addrinfo_prefix_port
 413         :       ADDRSTRING prefix ike_port
 414                 {
 415                         char portbuf[10];
 416             struct remote_index_val *new;
 417
 418             new = racoon_calloc(1, sizeof(*new));
 419             if (new == NULL) {
 420                 racoon_yyerror("failed to allocate remote index struct");
 421                 vfree($1);
 422                 return -1;
 423             }
 424                         snprintf(portbuf, sizeof(portbuf), "%ld", $3);
 425                         new->addr = str2saddr($1->v, portbuf);
 426             vfree($1);
 427                         if (!new->addr) {
 428                 racoon_yyerror("failed to allocate sockaddr storage");
 429                                 return -1;
 430             }
 431             new->prefix = $2;
 432             $$ = new;
 433                 }
 434         ;
 435 ike_port
 436         :       /* nothing */   { $$ = PORT_ISAKMP; }
 437         |       PORT            { $$ = $1; }
 438         ;
 439         /* modecfg */
 440 modecfg_statement
 441         :       MODECFG BOC modecfg_stmts EOC
 442         ;
 443 modecfg_stmts
 444         :       /* nothing */
 445         |       modecfg_stmts modecfg_stmt
 446         ;
 447 modecfg_stmt
 448         :       CFG_NET4 ADDRSTRING
 449                 {
 450 #ifdef ENABLE_HYBRID
 451                         if (inet_pton(AF_INET, $2->v,
 452                              &isakmp_cfg_config.network4) != 1)
 453                                 racoon_yyerror("bad IPv4 network address.");
 454                         vfree($2);
 455 #else
 456                         racoon_yyerror("racoon not configured with --enable-hybrid");
 457 #endif
 458                 }
 459                 EOS
 460         |       CFG_MASK4 ADDRSTRING
 461                 {
 462 #ifdef ENABLE_HYBRID
 463                         if (inet_pton(AF_INET, $2->v,
 464                             &isakmp_cfg_config.netmask4) != 1)
 465                                 racoon_yyerror("bad IPv4 netmask address.");
 466                         vfree($2);
 467 #else
 468                         racoon_yyerror("racoon not configured with --enable-hybrid");
 469 #endif
 470                 }
 471                 EOS
 472         |       CFG_DNS4 addrdnslist
 473                 EOS
 474         |       CFG_NBNS4 addrwinslist
 475                 EOS
 476         |       CFG_SPLIT_NETWORK CFG_SPLIT_LOCAL splitnetlist
 477                 {
 478 #ifdef ENABLE_HYBRID
 479                         isakmp_cfg_config.splitnet_type = UNITY_LOCAL_LAN;
 480 #else
 481                         racoon_yyerror("racoon not configured with --enable-hybrid");
 482 #endif
 483                 }
 484                 EOS
 485         |       CFG_SPLIT_NETWORK CFG_SPLIT_INCLUDE splitnetlist
 486                 {
 487 #ifdef ENABLE_HYBRID
 488                         isakmp_cfg_config.splitnet_type = UNITY_SPLIT_INCLUDE;
 489 #else
 490                         racoon_yyerror("racoon not configured with --enable-hybrid");
 491 #endif
 492                 }
 493                 EOS
 494         |       CFG_SPLIT_DNS splitdnslist
 495                 {
 496 #ifndef ENABLE_HYBRID
 497                         racoon_yyerror("racoon not configured with --enable-hybrid");
 498 #endif
 499                 }
 500                 EOS
 501         |       CFG_DEFAULT_DOMAIN QUOTEDSTRING
 502                 {
 503 #ifdef ENABLE_HYBRID
 504                         strlcpy(&isakmp_cfg_config.default_domain[0],
 505                             $2->v, sizeof(isakmp_cfg_config.default_domain));
 506                         vfree($2);
 507 #else
 508                         racoon_yyerror("racoon not configured with --enable-hybrid");
 509 #endif
 510                 }
 511                 EOS
 512         |       CFG_AUTH_SOURCE CFG_SYSTEM
 513                 {
 514 #ifdef ENABLE_HYBRID
 515                         isakmp_cfg_config.authsource = ISAKMP_CFG_AUTH_SYSTEM;
 516 #else
 517                         racoon_yyerror("racoon not configured with --enable-hybrid");
 518 #endif
 519                 }
 520                 EOS
 521         |       CFG_AUTH_SOURCE CFG_RADIUS
 522                 {
 523 #ifdef ENABLE_HYBRID
 524                         racoon_yyerror("racoon not configured with --with-libradius");
 525 #else /* ENABLE_HYBRID */
 526                         racoon_yyerror("racoon not configured with --enable-hybrid");
 527 #endif /* ENABLE_HYBRID */
 528                 }
 529                 EOS
 530         |       CFG_AUTH_SOURCE CFG_PAM
 531                 {
 532 #ifdef ENABLE_HYBRID
 533                         racoon_yyerror("racoon not configured with --with-libpam");
 534 #else /* ENABLE_HYBRID */
 535                         racoon_yyerror("racoon not configured with --enable-hybrid");
 536 #endif /* ENABLE_HYBRID */
 537                 }
 538                 EOS
 539         |       CFG_AUTH_SOURCE CFG_LDAP
 540                 {
 541 #ifdef ENABLE_HYBRID
 542                         racoon_yyerror("racoon not configured with --with-libldap");
 543 #else /* ENABLE_HYBRID */
 544                         racoon_yyerror("racoon not configured with --enable-hybrid");
 545 #endif /* ENABLE_HYBRID */
 546                 }
 547                 EOS
 548         |       CFG_AUTH_GROUPS authgrouplist
 549                 {
 550 #ifndef ENABLE_HYBRID
 551                         racoon_yyerror("racoon not configured with --enable-hybrid");
 552 #endif
 553                 }
 554                 EOS
 555         |       CFG_GROUP_SOURCE CFG_SYSTEM
 556                 {
 557 #ifdef ENABLE_HYBRID
 558                         isakmp_cfg_config.groupsource = ISAKMP_CFG_GROUP_SYSTEM;
 559 #else
 560                         racoon_yyerror("racoon not configured with --enable-hybrid");
 561 #endif
 562                 }
 563                 EOS
 564         |       CFG_GROUP_SOURCE CFG_LDAP
 565                 {
 566 #ifdef ENABLE_HYBRID
 567                         racoon_yyerror("racoon not configured with --with-libldap");
 568 #else /* ENABLE_HYBRID */
 569                         racoon_yyerror("racoon not configured with --enable-hybrid");
 570 #endif /* ENABLE_HYBRID */
 571                 }
 572                 EOS
 573         |       CFG_ACCOUNTING CFG_NONE
 574                 {
 575 #ifdef ENABLE_HYBRID
 576                         isakmp_cfg_config.accounting = ISAKMP_CFG_ACCT_NONE;
 577 #else
 578                         racoon_yyerror("racoon not configured with --enable-hybrid");
 579 #endif
 580                 }
 581                 EOS
 582         |       CFG_ACCOUNTING CFG_SYSTEM
 583                 {
 584 #ifdef ENABLE_HYBRID
 585                         isakmp_cfg_config.accounting = ISAKMP_CFG_ACCT_SYSTEM;
 586 #else
 587                         racoon_yyerror("racoon not configured with --enable-hybrid");
 588 #endif
 589                 }
 590                 EOS
 591         |       CFG_ACCOUNTING CFG_RADIUS
 592                 {
 593 #ifdef ENABLE_HYBRID
 594                         racoon_yyerror("racoon not configured with --with-libradius");
 595 #else /* ENABLE_HYBRID */
 596                         racoon_yyerror("racoon not configured with --enable-hybrid");
 597 #endif /* ENABLE_HYBRID */
 598                 }
 599                 EOS
 600         |       CFG_ACCOUNTING CFG_PAM
 601                 {
 602 #ifdef ENABLE_HYBRID
 603                         racoon_yyerror("racoon not configured with --with-libpam");
 604 #else /* ENABLE_HYBRID */
 605                         racoon_yyerror("racoon not configured with --enable-hybrid");
 606 #endif /* ENABLE_HYBRID */
 607                 }
 608                 EOS
 609         |       CFG_POOL_SIZE NUMBER
 610                 {
 611 #ifdef ENABLE_HYBRID
 612                         if (isakmp_cfg_resize_pool($2) != 0)
 613                                 racoon_yyerror("cannot allocate memory for pool");
 614 #else /* ENABLE_HYBRID */
 615                         racoon_yyerror("racoon not configured with --enable-hybrid");
 616 #endif /* ENABLE_HYBRID */
 617                 }
 618                 EOS
 619         |       CFG_PFS_GROUP NUMBER
 620                 {
 621 #ifdef ENABLE_HYBRID
 622                         isakmp_cfg_config.pfs_group = $2;
 623             switch (isakmp_cfg_config.pfs_group)
 624             {
 625                 case OAKLEY_ATTR_GRP_DESC_MODP768:
 626                 case OAKLEY_ATTR_GRP_DESC_MODP1024:
 627                 case OAKLEY_ATTR_GRP_DESC_MODP1536:
 628                 case OAKLEY_ATTR_GRP_DESC_MODP2048:
 629                 case OAKLEY_ATTR_GRP_DESC_MODP3072:
 630                 case OAKLEY_ATTR_GRP_DESC_MODP4096:
 631                 case OAKLEY_ATTR_GRP_DESC_MODP6144:
 632                 case OAKLEY_ATTR_GRP_DESC_MODP8192:
 633                     break;
 634                 default:
 635                     racoon_yyerror("Invalid PFS group specified");
 636                     return -1;
 637                     break;
 638                         }
 639 #else /* ENABLE_HYBRID */
 640                         racoon_yyerror("racoon not configured with --enable-hybrid");
 641 #endif /* ENABLE_HYBRID */
 642                 }
 643                 EOS
 644         |       CFG_SAVE_PASSWD SWITCH
 645                 {
 646 #ifdef ENABLE_HYBRID
 647                         isakmp_cfg_config.save_passwd = $2;
 648 #else /* ENABLE_HYBRID */
 649                         racoon_yyerror("racoon not configured with --enable-hybrid");
 650 #endif /* ENABLE_HYBRID */
 651                 }
 652                 EOS
 653         |       CFG_AUTH_THROTTLE NUMBER
 654                 {
 655 #ifdef ENABLE_HYBRID
 656                         isakmp_cfg_config.auth_throttle = $2;
 657 #else /* ENABLE_HYBRID */
 658                         racoon_yyerror("racoon not configured with --enable-hybrid");
 659 #endif /* ENABLE_HYBRID */
 660                 }
 661                 EOS
 662         |       CFG_CONF_SOURCE CFG_LOCAL
 663                 {
 664 #ifdef ENABLE_HYBRID
 665                         isakmp_cfg_config.confsource = ISAKMP_CFG_CONF_LOCAL;
 666 #else /* ENABLE_HYBRID */
 667                         racoon_yyerror("racoon not configured with --enable-hybrid");
 668 #endif /* ENABLE_HYBRID */
 669                 }
 670                 EOS
 671         |       CFG_CONF_SOURCE CFG_RADIUS
 672                 {
 673 #ifdef ENABLE_HYBRID
 674                         racoon_yyerror("racoon not configured with --with-libradius");
 675 #else /* ENABLE_HYBRID */
 676                         racoon_yyerror("racoon not configured with --enable-hybrid");
 677 #endif /* ENABLE_HYBRID */
 678                 }
 679                 EOS
 680         |       CFG_CONF_SOURCE CFG_LDAP
 681                 {
 682 #ifdef ENABLE_HYBRID
 683                         racoon_yyerror("racoon not configured with --with-libldap");
 684 #else /* ENABLE_HYBRID */
 685                         racoon_yyerror("racoon not configured with --enable-hybrid");
 686 #endif /* ENABLE_HYBRID */
 687                 }
 688                 EOS
 689         |       CFG_MOTD QUOTEDSTRING
 690                 {
 691 #ifdef ENABLE_HYBRID
 692                         strlcpy(&isakmp_cfg_config.motd[0], $2->v, sizeof(isakmp_cfg_config.motd));
 693                         vfree($2);
 694 #else
 695                         racoon_yyerror("racoon not configured with --enable-hybrid");
 696 #endif
 697                 }
 698                 EOS
 699         ;
 700
 701 addrdnslist
 702         :       addrdns
 703         |       addrdns COMMA addrdnslist
 704         ;
 705 addrdns
 706         :       ADDRSTRING
 707                 {
 708 #ifdef ENABLE_HYBRID
 709                         struct isakmp_cfg_config *icc = &isakmp_cfg_config;
 710
 711                         if (icc->dns4_index >= MAXNS) {
 712                                 racoon_yyerror("No more than %d DNS", MAXNS);
 713                 return -1;
 714             }
 715                         if (inet_pton(AF_INET, $1->v,
 716                             &icc->dns4[icc->dns4_index++]) != 1)
 717                                 racoon_yyerror("bad IPv4 DNS address.");
 718
 719                         vfree($1);
 720 #else
 721                         racoon_yyerror("racoon not configured with --enable-hybrid");
 722 #endif
 723                 }
 724         ;
 725
 726 addrwinslist
 727         :       addrwins
 728         |       addrwins COMMA addrwinslist
 729         ;
 730 addrwins
 731         :       ADDRSTRING
 732                 {
 733 #ifdef ENABLE_HYBRID
 734                         struct isakmp_cfg_config *icc = &isakmp_cfg_config;
 735
 736                         if (icc->nbns4_index >= MAXWINS) {
 737                                 racoon_yyerror("No more than %d WINS", MAXWINS);
 738                 return -1;
 739             }
 740                         if (inet_pton(AF_INET, $1->v,
 741                             &icc->nbns4[icc->nbns4_index++]) != 1)
 742                                 racoon_yyerror("bad IPv4 WINS address.");
 743
 744                         vfree($1);
 745 #else
 746                         racoon_yyerror("racoon not configured with --enable-hybrid");
 747 #endif
 748                 }
 749         ;
 750
 751 splitnetlist
 752         :       splitnet
 753         |       splitnetlist COMMA splitnet
 754         ;
 755 splitnet
 756         :       ADDRSTRING PREFIX
 757                 {
 758 #ifdef ENABLE_HYBRID
 759                         struct isakmp_cfg_config *icc = &isakmp_cfg_config;
 760                         struct unity_network network;
 761
 762                         if (inet_pton(AF_INET, $1->v, &network.addr4) != 1)
 763                                 racoon_yyerror("bad IPv4 SPLIT address.");
 764
 765                         /* Turn $2 (the prefix) into a subnet mask */
 766                         network.mask4.s_addr = ($2) ? htonl(~((1 << (32 - $2)) - 1)) : 0;
 767
 768                         /* add the network to our list */
 769                         if (splitnet_list_add(&icc->splitnet_list, &network,&icc->splitnet_count))
 770                                 racoon_yyerror("Unable to allocate split network");
 771
 772                         vfree($1);
 773 #else
 774                         racoon_yyerror("racoon not configured with --enable-hybrid");
 775 #endif
 776                 }
 777         ;
 778
 779 authgrouplist
 780         :       authgroup
 781         |       authgroup COMMA authgrouplist
 782         ;
 783 authgroup
 784         :       QUOTEDSTRING
 785                 {
 786 #ifdef ENABLE_HYBRID
 787                         char * groupname = NULL;
 788                         char ** grouplist = NULL;
 789                         struct isakmp_cfg_config *icc = &isakmp_cfg_config;
 790
 791                         grouplist = racoon_realloc(icc->grouplist,
 792                                         sizeof(char**)*(icc->groupcount+1));
 793                         if (grouplist == NULL)
 794                                 racoon_yyerror("unable to allocate auth group list");
 795
 796                         groupname = racoon_malloc($1->l+1);
 797                         if (groupname == NULL)
 798                                 racoon_yyerror("unable to allocate auth group name");
 799
 800                         memcpy(groupname,$1->v,$1->l);
 801                         groupname[$1->l]=0;
 802                         grouplist[icc->groupcount]=groupname;
 803                         icc->grouplist = grouplist;
 804                         icc->groupcount++;
 805
 806                         vfree($1);
 807 #else
 808                         racoon_yyerror("racoon not configured with --enable-hybrid");
 809 #endif
 810                 }
 811         ;
 812
 813 splitdnslist
 814         :       splitdns
 815         |       splitdns COMMA splitdnslist
 816         ;
 817 splitdns
 818         :       QUOTEDSTRING
 819                 {
 820 #ifdef ENABLE_HYBRID
 821                         struct isakmp_cfg_config *icc = &isakmp_cfg_config;
 822
 823                         if (!icc->splitdns_len)
 824                         {
 825                                 icc->splitdns_list = racoon_malloc($1->l);
 826                                 if(icc->splitdns_list == NULL)
 827                                         racoon_yyerror("error allocating splitdns list buffer");
 828                                 memcpy(icc->splitdns_list,$1->v,$1->l);
 829                                 icc->splitdns_len = $1->l;
 830                         }
 831                         else
 832                         {
 833                                 int len = icc->splitdns_len + $1->l + 1;
 834                                 icc->splitdns_list = racoon_realloc(icc->splitdns_list,len);
 835                                 if(icc->splitdns_list == NULL)
 836                                         racoon_yyerror("error allocating splitdns list buffer");
 837                                 icc->splitdns_list[icc->splitdns_len] = ',';
 838                                 memcpy(icc->splitdns_list + icc->splitdns_len + 1, $1->v, $1->l);
 839                                 icc->splitdns_len = len;
 840                         }
 841                         vfree($1);
 842 #else
 843                         racoon_yyerror("racoon not configured with --enable-hybrid");
 844 #endif
 845                 }
 846         ;
 847
 848
 849         /* timer */
 850 timer_statement
 851         :       RETRY BOC timer_stmts EOC
 852         ;
 853 timer_stmts
 854         :       /* nothing */
 855         |       timer_stmts timer_stmt
 856         ;
 857 timer_stmt
 858         :       RETRY_COUNTER NUMBER
 859                 {
 860                         lcconf->retry_counter = $2;
 861                 }
 862                 EOS
 863         |       RETRY_INTERVAL NUMBER unittype_time
 864                 {
 865                         lcconf->retry_interval = $2 * $3;
 866                 }
 867                 EOS
 868         |       RETRY_PERSEND NUMBER
 869                 {
 870                         lcconf->count_persend = $2;
 871                 }
 872                 EOS
 873         |       RETRY_PHASE1 NUMBER unittype_time
 874                 {
 875                         lcconf->retry_checkph1 = $2 * $3;
 876                 }
 877                 EOS
 878         |       RETRY_PHASE2 NUMBER unittype_time
 879                 {
 880                         lcconf->wait_ph2complete = $2 * $3;
 881                 }
 882                 EOS
 883         |       AUTO_EXIT_DELAY NUMBER unittype_time
 884                 {
 885                         lcconf->auto_exit_delay = $2 * $3;
 886                         lcconf->auto_exit_state |= LC_AUTOEXITSTATE_SET;
 887                 }
 888                 EOS
 889
 890         |       NATT_KA NUMBER unittype_time
 891                 {
 892 #ifdef ENABLE_NATT
 893                         lcconf->natt_ka_interval = $2 * $3;
 894 #else
 895                         racoon_yyerror("NAT-T support not compiled in.");
 896 #endif
 897                 }
 898                 EOS
 899         ;
 900
 901         /* sainfo */
 902 sainfo_statement
 903         :       SAINFO
 904                 {
 905                         cur_sainfo = create_sainfo();
 906                         if (cur_sainfo == NULL) {
 907                                 racoon_yyerror("failed to allocate sainfo");
 908                                 return -1;
 909                         }
 910                 }
 911                 sainfo_name sainfo_param BOC sainfo_specs
 912                 {
 913                         struct sainfo *check;
 914
 915                         /* default */
 916                         if (cur_sainfo->algs[algclass_ipsec_enc] == 0) {
 917                                 racoon_yyerror("no encryption algorithm at %s",
 918                                         sainfo2str(cur_sainfo));
 919                                 return -1;
 920                         }
 921                         if (cur_sainfo->algs[algclass_ipsec_auth] == 0) {
 922                                 racoon_yyerror("no authentication algorithm at %s",
 923                                         sainfo2str(cur_sainfo));
 924                                 return -1;
 925                         }
 926                         if (cur_sainfo->algs[algclass_ipsec_comp] == 0) {
 927                                 racoon_yyerror("no compression algorithm at %s",
 928                                         sainfo2str(cur_sainfo));
 929                                 return -1;
 930                         }
 931
 932                         /* duplicate check */
 933                         check = getsainfo(cur_sainfo->idsrc,
 934                                           cur_sainfo->iddst,
 935                                           cur_sainfo->id_i, 0);
 936                         if (check && (!check->idsrc && !cur_sainfo->idsrc)) {
 937                                 racoon_yyerror("duplicated sainfo: %s",
 938                                         sainfo2str(cur_sainfo));
 939                                 return -1;
 940                         }
 941                         inssainfo(cur_sainfo);
 942                 }
 943                 EOC
 944         ;
 945 sainfo_name
 946         :       ANONYMOUS
 947                 {
 948                         cur_sainfo->idsrc = NULL;
 949                         cur_sainfo->iddst = NULL;
 950                 }
 951         |       ANONYMOUS sainfo_id
 952                 {
 953                         cur_sainfo->idsrc = NULL;
 954                         cur_sainfo->iddst = $2;
 955                 }
 956         |       sainfo_id ANONYMOUS
 957                 {
 958                         cur_sainfo->idsrc = $1;
 959                         cur_sainfo->iddst = NULL;
 960                 }
 961         |       sainfo_id sainfo_id
 962                 {
 963                         cur_sainfo->idsrc = $1;
 964                         cur_sainfo->iddst = $2;
 965                 }
 966         ;
 967 sainfo_id
 968         :       IDENTIFIERTYPE ADDRSTRING prefix port ul_proto
 969                 {
 970                         char portbuf[10];
 971                         struct sockaddr_storage *saddr;
 972
 973                         if (($5 == IPPROTO_ICMP || $5 == IPPROTO_ICMPV6)
 974                          && ($4 != IPSEC_PORT_ANY || $4 != IPSEC_PORT_ANY)) {
 975                                 racoon_yyerror("port number must be \"any\".");
 976                                 return -1;
 977                         }
 978
 979                         snprintf(portbuf, sizeof(portbuf), "%lu", $4);
 980                         saddr = str2saddr($2->v, portbuf);
 981                         vfree($2);
 982                         if (saddr == NULL)
 983                                 return -1;
 984
 985                         switch (saddr->ss_family) {
 986                         case AF_INET:
 987                                 if ($5 == IPPROTO_ICMPV6) {
 988                                         racoon_yyerror("upper layer protocol mismatched.\n");
 989                                         racoon_free(saddr);
 990                                         return -1;
 991                                 }
 992                                 $$ = ipsecdoi_sockaddr2id(saddr,
 993                                                                                   $3 == ~0 ? (sizeof(struct in_addr) << 3): $3,
 994                                                                                   $5);
 995                                 break;
 996 #ifdef INET6
 997                         case AF_INET6:
 998                                 if ($5 == IPPROTO_ICMP) {
 999                                         racoon_yyerror("upper layer protocol mismatched.\n");
1000                                         racoon_free(saddr);
1001                                         return -1;
1002                                 }
1003                                 $$ = ipsecdoi_sockaddr2id(saddr,
1004                                                                                   $3 == ~0 ? (sizeof(struct in6_addr) << 3): $3,
1005                                                                                   $5);
1006                                 break;
1007 #endif
1008                         default:
1009                                 racoon_yyerror("invalid family: %d", saddr->ss_family);
1010                                 $$ = NULL;
1011                                 break;
1012                         }
1013                         racoon_free(saddr);
1014                         if ($$ == NULL)
1015                                 return -1;
1016                 }
1017         |       IDENTIFIERTYPE ADDRSTRING ADDRRANGE prefix port ul_proto
1018                 {
1019                         char portbuf[10];
1020                         struct sockaddr_storage *laddr = NULL, *haddr = NULL;
1021
1022                         if (($6 == IPPROTO_ICMP || $6 == IPPROTO_ICMPV6)
1023                          && ($5 != IPSEC_PORT_ANY || $5 != IPSEC_PORT_ANY)) {
1024                                 racoon_yyerror("port number must be \"any\".");
1025                                 return -1;
1026                         }
1027
1028                         snprintf(portbuf, sizeof(portbuf), "%lu", $5);
1029
1030                         laddr = str2saddr($2->v, portbuf);
1031                         if (laddr == NULL) {
1032                             return -1;
1033                         }
1034                         vfree($2);
1035                         haddr = str2saddr($3->v, portbuf);
1036                         if (haddr == NULL) {
1037                             racoon_free(laddr);
1038                             return -1;
1039                         }
1040                         vfree($3);
1041
1042                         switch (laddr->ss_family) {
1043                         case AF_INET:
1044                                 if ($6 == IPPROTO_ICMPV6) {
1045                                     racoon_yyerror("upper layer protocol mismatched.\n");
1046                                     if (laddr)
1047                                         racoon_free(laddr);
1048                                     if (haddr)
1049                                         racoon_free(haddr);
1050                                     return -1;
1051                                 }
1052                                 $$ = ipsecdoi_sockrange2id(laddr, haddr,
1053                                                            $6);
1054                                 break;
1055 #ifdef INET6
1056                         case AF_INET6:
1057                                 if ($6 == IPPROTO_ICMP) {
1058                                         racoon_yyerror("upper layer protocol mismatched.\n");
1059                                         if (laddr)
1060                                             racoon_free(laddr);
1061                                         if (haddr)
1062                                             racoon_free(haddr);
1063                                         return -1;
1064                                 }
1065                                 $$ = ipsecdoi_sockrange2id(laddr, haddr,
1066                                                                $6);
1067                                 break;
1068 #endif
1069                         default:
1070                                 racoon_yyerror("invalid family: %d", laddr->ss_family);
1071                                 $$ = NULL;
1072                                 break;
1073                         }
1074                         if (laddr)
1075                             racoon_free(laddr);
1076                         if (haddr)
1077                             racoon_free(haddr);
1078                         if ($$ == NULL)
1079                                 return -1;
1080                 }
1081         |       IDENTIFIERTYPE QUOTEDSTRING
1082                 {
1083                         struct ipsecdoi_id_b *id_b;
1084
1085                         if ($1 == IDTYPE_ASN1DN) {
1086                                 racoon_yyerror("id type forbidden: %d", $1);
1087                                 $$ = NULL;
1088                                 return -1;
1089                         }
1090
1091                         $2->l--;
1092
1093                         $$ = vmalloc(sizeof(*id_b) + $2->l);
1094                         if ($$ == NULL) {
1095                                 racoon_yyerror("failed to allocate identifier");
1096                                 return -1;
1097                         }
1098
1099                         id_b = ALIGNED_CAST(struct ipsecdoi_id_b *)$$->v;
1100                         id_b->type = idtype2doi($1);
1101
1102                         id_b->proto_id = 0;
1103                         id_b->port = 0;
1104
1105                         memcpy($$->v + sizeof(*id_b), $2->v, $2->l);
1106                 }
1107         ;
1108 sainfo_param
1109         :       /* nothing */
1110                 {
1111                         cur_sainfo->id_i = NULL;
1112                 }
1113
1114         |       FROM IDENTIFIERTYPE identifierstring
1115                 {
1116                         struct ipsecdoi_id_b *id_b;
1117                         vchar_t *idv;
1118
1119                         if (set_identifier(&idv, $2, $3) != 0) {
1120                                 racoon_yyerror("failed to set identifer.\n");
1121                                 return -1;
1122                         }
1123                         cur_sainfo->id_i = vmalloc(sizeof(*id_b) + idv->l);
1124                         if (cur_sainfo->id_i == NULL) {
1125                                 racoon_yyerror("failed to allocate identifier");
1126                                 return -1;
1127                         }
1128
1129                         id_b = ALIGNED_CAST(struct ipsecdoi_id_b *)cur_sainfo->id_i->v;
1130                         id_b->type = idtype2doi($2);
1131
1132                         id_b->proto_id = 0;
1133                         id_b->port = 0;
1134
1135                         memcpy(cur_sainfo->id_i->v + sizeof(*id_b),
1136                                idv->v, idv->l);
1137                         vfree(idv);
1138                 }
1139         |       GROUP QUOTEDSTRING
1140                 {
1141 #ifdef ENABLE_HYBRID
1142                         if ((cur_sainfo->group = vdup($2)) == NULL) {
1143                                 racoon_yyerror("failed to set sainfo xauth group.\n");
1144                                 return -1;
1145                         }
1146 #else
1147                         racoon_yyerror("racoon not configured with --enable-hybrid");
1148                         return -1;
1149 #endif
1150                 }
1151         ;
1152 sainfo_specs
1153         :       /* nothing */
1154         |       sainfo_specs sainfo_spec
1155         ;
1156 sainfo_spec
1157         :       PFS_GROUP dh_group_num
1158                 {
1159                         cur_sainfo->pfs_group = $2;
1160             switch (cur_sainfo->pfs_group)
1161             {
1162                 case OAKLEY_ATTR_GRP_DESC_MODP768:
1163                 case OAKLEY_ATTR_GRP_DESC_MODP1024:
1164                 case OAKLEY_ATTR_GRP_DESC_MODP1536:
1165                 case OAKLEY_ATTR_GRP_DESC_MODP2048:
1166                 case OAKLEY_ATTR_GRP_DESC_MODP3072:
1167                 case OAKLEY_ATTR_GRP_DESC_MODP4096:
1168                 case OAKLEY_ATTR_GRP_DESC_MODP6144:
1169                 case OAKLEY_ATTR_GRP_DESC_MODP8192:
1170                     break;
1171                 default:
1172                     racoon_yyerror("Invalid PFS group specified");
1173                     return -1;
1174                     break;
1175                         }
1176                 }
1177                 EOS
1178         |       LIFETIME LIFETYPE_TIME NUMBER unittype_time
1179                 {
1180                         cur_sainfo->lifetime = $3 * $4;
1181                 }
1182                 EOS
1183         |       LIFETIME LIFETYPE_BYTE NUMBER unittype_byte
1184                 {
1185 #if 1
1186                         racoon_yyerror("byte lifetime support is deprecated");
1187                         return -1;
1188 #else
1189                         cur_sainfo->lifebyte = fix_lifebyte($3 * $4);
1190                         if (cur_sainfo->lifebyte == 0)
1191                                 return -1;
1192 #endif
1193                 }
1194                 EOS
1195         |       ALGORITHM_CLASS {
1196                         cur_algclass = $1;
1197                 }
1198                 algorithms EOS
1199         |       IDENTIFIER IDENTIFIERTYPE
1200                 {
1201                         racoon_yyerror("it's deprecated to specify a identifier in phase 2");
1202                 }
1203                 EOS
1204         |       MY_IDENTIFIER IDENTIFIERTYPE QUOTEDSTRING
1205                 {
1206                         racoon_yyerror("it's deprecated to specify a identifier in phase 2");
1207                 }
1208                 EOS
1209         ;
1210
1211 algorithms
1212         :       algorithm
1213                 {
1214                         inssainfoalg(&cur_sainfo->algs[cur_algclass], $1);
1215                 }
1216         |       algorithm
1217                 {
1218                         inssainfoalg(&cur_sainfo->algs[cur_algclass], $1);
1219                 }
1220                 COMMA algorithms
1221         ;
1222 algorithm
1223         :       ALGORITHMTYPE keylength
1224                 {
1225                         int defklen;
1226
1227                         $$ = newsainfoalg();
1228                         if ($$ == NULL) {
1229                                 racoon_yyerror("failed to get algorithm allocation");
1230                                 return -1;
1231                         }
1232
1233                         $$->alg = algtype2doi(cur_algclass, $1);
1234                         if ($$->alg == -1) {
1235                                 racoon_yyerror("algorithm mismatched");
1236                                 racoon_free($$);
1237                                 $$ = NULL;
1238                                 return -1;
1239                         }
1240
1241                         defklen = default_keylen(cur_algclass, $1);
1242                         if (defklen == 0) {
1243                                 if ($2) {
1244                                         racoon_yyerror("keylen not allowed");
1245                                         racoon_free($$);
1246                                         $$ = NULL;
1247                                         return -1;
1248                                 }
1249                         } else {
1250                                 if ($2 && check_keylen(cur_algclass, $1, $2) < 0) {
1251                                         racoon_yyerror("invalid keylen %d", $2);
1252                                         racoon_free($$);
1253                                         $$ = NULL;
1254                                         return -1;
1255                                 }
1256                         }
1257
1258                         if ($2)
1259                                 $$->encklen = $2;
1260                         else
1261                                 $$->encklen = defklen;
1262
1263                         /* check if it's supported algorithm by kernel */
1264                         if (!(cur_algclass == algclass_ipsec_auth && $1 == algtype_non_auth)
1265                          && pk_checkalg(cur_algclass, $1, $$->encklen)) {
1266                                 int a = algclass2doi(cur_algclass);
1267                                 int b = algtype2doi(cur_algclass, $1);
1268                                 if (a == IPSECDOI_ATTR_AUTH)
1269                                         a = IPSECDOI_PROTO_IPSEC_AH;
1270                                 racoon_yyerror("algorithm %s not supported by the kernel (missing module?)",
1271                                         s_ipsecdoi_trns(a, b));
1272                                 racoon_free($$);
1273                                 $$ = NULL;
1274                                 return -1;
1275                         }
1276                 }
1277         ;
1278 prefix
1279         :       /* nothing */ { $$ = ~0; }
1280         |       PREFIX { $$ = $1; }
1281         ;
1282 port
1283         :       /* nothing */ { $$ = IPSEC_PORT_ANY; }
1284         |       PORT { $$ = $1; }
1285         |       PORTANY { $$ = IPSEC_PORT_ANY; }
1286         ;
1287 ul_proto
1288         :       NUMBER { $$ = $1; }
1289         |       UL_PROTO { $$ = $1; }
1290         |       ANY { $$ = IPSEC_ULPROTO_ANY; }
1291         ;
1292 keylength
1293         :       /* nothing */ { $$ = 0; }
1294         |       NUMBER { $$ = $1; }
1295         ;
1296
1297         /* remote */
1298 remote_statement
1299         :       REMOTE remote_index INHERIT remote_index
1300                 {
1301                         struct remoteconf *new;
1302                         struct proposalspec *prspec;
1303
1304                         new = copyrmconf($4->addr);
1305                         if (new == NULL) {
1306                                 racoon_yyerror("failed to get remoteconf for %s.", saddr2str((struct sockaddr *)$4));
1307                 racoon_free($2->addr);
1308                 racoon_free($2);
1309                 racoon_free($4->addr);
1310                 racoon_free($4);
1311                                 return -1;
1312                         }
1313
1314                         new->remote = $2->addr;
1315             new->remote_prefix = ($2->prefix == ~0 ? 0 : $2->prefix);
1316                         new->inherited_from = getrmconf_strict($4->addr, 1);
1317                         new->proposal = NULL;
1318                         new->prhead = NULL;
1319                         cur_rmconf = new;
1320             racoon_free($2);
1321             racoon_free($4->addr);
1322             racoon_free($4);
1323
1324                         prspec = newprspec();
1325                         if (prspec == NULL || !cur_rmconf->inherited_from
1326                                 || !cur_rmconf->inherited_from->proposal)
1327                                 return -1;
1328                         prspec->lifetime = cur_rmconf->inherited_from->proposal->lifetime;
1329                         prspec->lifebyte = cur_rmconf->inherited_from->proposal->lifebyte;
1330                         insprspec(prspec, &cur_rmconf->prhead);
1331                 }
1332                 remote_specs_block
1333         |       REMOTE remote_index
1334                 {
1335                         struct remoteconf *new;
1336                         struct proposalspec *prspec;
1337
1338                         new = create_rmconf();
1339                         if (new == NULL) {
1340                                 racoon_yyerror("failed to get new remoteconf.");
1341                 racoon_free($2->addr);
1342                 racoon_free($2);
1343                                 return -1;
1344                         }
1345                         new->remote = $2->addr;
1346             new->remote_prefix = ($2->prefix == ~0 ? 0 : $2->prefix);
1347                         cur_rmconf = new;
1348             racoon_free($2);
1349
1350                         prspec = newprspec();
1351                         if (prspec == NULL)
1352                                 return -1;
1353                         prspec->lifetime = oakley_get_defaultlifetime();
1354                         insprspec(prspec, &cur_rmconf->prhead);
1355                 }
1356                 remote_specs_block
1357         ;
1358
1359 remote_specs_block
1360         :       BOC remote_specs EOC
1361                 {
1362                         /* check a exchange mode */
1363                         if (cur_rmconf->etypes == NULL) {
1364                                 racoon_yyerror("no exchange mode specified.\n");
1365                                 return -1;
1366                         }
1367
1368                         if (cur_rmconf->idvtype == IDTYPE_UNDEFINED)
1369                                 cur_rmconf->idvtype = IDTYPE_ADDRESS;
1370
1371
1372                         if (cur_rmconf->idvtype == IDTYPE_ASN1DN) {
1373                                 if (cur_rmconf->identity_in_keychain)
1374                                 {
1375                                         if (cur_rmconf->idv)
1376                                                 racoon_yywarn("Both CERT and ASN1 ID "
1377                                                        "are set. Hope this is OK.\n");
1378                                         /* TODO: Preparse the DN here */
1379                                 } else if (cur_rmconf->idv) {
1380                                         /* OK, using asn1dn without X.509. */
1381                                 } else {
1382                                         racoon_yyerror("ASN1 ID not specified "
1383                                                 "and no CERT defined!\n");
1384                                         return -1;
1385                                 }
1386                         }
1387
1388                         if (cur_rmconf->cert_verification_option == VERIFICATION_OPTION_PEERS_IDENTIFIER) {
1389                                 struct genlist_entry *gpb;
1390                                 if (genlist_next(cur_rmconf->idvl_p, &gpb) == NULL) {
1391                                         racoon_yyerror("peers_identifier required for specified certificate "
1392                                                 "verification option.\n");
1393                                                 return -1;
1394                                 }
1395                         }
1396
1397                         if (cur_rmconf->prhead->spspec == NULL
1398                                 && cur_rmconf->inherited_from
1399                                 && cur_rmconf->inherited_from->prhead) {
1400                                 cur_rmconf->prhead->spspec = cur_rmconf->inherited_from->prhead->spspec;
1401                         }
1402                         if (set_isakmp_proposal(cur_rmconf, cur_rmconf->prhead) != 0)
1403                                 return -1;
1404
1405                         /* DH group setting if aggressive mode or IKEv2. */
1406                         if (check_etypeok(cur_rmconf, ISAKMP_ETYPE_AGG) != NULL) {
1407                                 struct isakmpsa *p;
1408                                 int b = 0;
1409
1410                                 /* DH group */
1411                                 for (p = cur_rmconf->proposal; p; p = p->next) {
1412                                         if (b == 0 || (b && b == p->dh_group)) {
1413                                                 b = p->dh_group;
1414                                                 continue;
1415                                         }
1416                                         racoon_yyerror("DH group must be equal "
1417                                                 "in all proposals "
1418                                                 "when aggressive mode is "
1419                                                 "used.\n");
1420                                         return -1;
1421                                 }
1422                                 cur_rmconf->dh_group = b;
1423
1424                                 if (cur_rmconf->dh_group == 0) {
1425                                         racoon_yyerror("DH group must be set in the proposal.\n");
1426                                         return -1;
1427                                 }
1428
1429                                 /* DH group settting if PFS is required. */
1430                                 if (oakley_setdhgroup(cur_rmconf->dh_group,
1431                                                 &cur_rmconf->dhgrp) < 0) {
1432                                         racoon_yyerror("failed to set DH value.\n");
1433                                         return -1;
1434                                 }
1435                         }
1436
1437                         insrmconf(cur_rmconf);
1438                 }
1439         ;
1440 remote_index
1441         :       ANONYMOUS ike_port
1442                 {
1443
1444             struct remote_index_val *new;
1445
1446             new = racoon_calloc(1, sizeof(*new));
1447             if (new == NULL) {
1448                 racoon_yyerror("failed to allocate remote index struct");
1449                 return -1;
1450             }
1451                         new->addr = newsaddr(sizeof(struct sockaddr_storage));
1452             if (new->addr == NULL) {
1453                 racoon_yyerror("failed to allocate sockaddr storage");
1454                 racoon_free(new);
1455                 return -1;
1456             }
1457             new->addr->ss_family = AF_UNSPEC;
1458             (ALIGNED_CAST(struct sockaddr_in *)new->addr)->sin_port = htons($2);
1459             new->prefix = ~0;
1460             $$ = new;
1461                 }
1462         |       ike_addrinfo_prefix_port
1463                 {
1464                         $$ = $1;
1465                         if ($$ == NULL) {
1466                                 racoon_yyerror("failed to allocate sockaddr_storage");
1467                                 return -1;
1468                         }
1469                 }
1470         ;
1471 remote_specs
1472         :       /* nothing */
1473         |       remote_specs remote_spec
1474         ;
1475 remote_spec
1476         :       EXCHANGE_MODE
1477                 {
1478                         cur_rmconf->etypes = NULL;
1479                 }
1480                 exchange_types EOS
1481         |       DOI DOITYPE { cur_rmconf->doitype = $2; } EOS
1482         |       SITUATION SITUATIONTYPE { cur_rmconf->sittype = $2; } EOS
1483     |   IKE_VERSION NUMBER
1484         {
1485             if ($2 == 1)
1486                 cur_rmconf->ike_version = ISAKMP_VERSION_NUMBER_IKEV1;
1487             else {
1488                 racoon_yyerror("invalid IKE version specified.\n");
1489                 return -1;
1490             }
1491         } EOS
1492         |       CERTIFICATE_TYPE cert_spec
1493         |       VERIFY_CERT SWITCH { cur_rmconf->verify_cert = $2; } EOS
1494         |       SEND_CERT SWITCH { cur_rmconf->send_cert = $2; } EOS
1495         |       SEND_CR SWITCH { cur_rmconf->send_cr = $2; } EOS
1496         |       CERTIFICATE_VERIFICATION VERIFICATION_MODULE
1497                 {
1498                         cur_rmconf->cert_verification = $2;
1499                 } EOS
1500         |       CERTIFICATE_VERIFICATION VERIFICATION_MODULE VERIFICATION_OPTION
1501                 {
1502                         cur_rmconf->cert_verification = $2;
1503                         cur_rmconf->cert_verification_option = $3;
1504                 }
1505                 EOS
1506         |       OPEN_DIR_AUTH_GROUP QUOTEDSTRING
1507                 {
1508 #if HAVE_OPENDIR
1509                         cur_rmconf->open_dir_auth_group = $2;
1510 #else
1511                         racoon_yyerror("Apple specific features not compiled in.");
1512                         return -1;
1513 #endif
1514                 } EOS
1515         |       MY_IDENTIFIER IDENTIFIERTYPE identifierstring
1516                 {
1517                         if (set_identifier(&cur_rmconf->idv, $2, $3) != 0) {
1518                                 racoon_yyerror("failed to set identifer.\n");
1519                                 vfree($3);      //%%% BUG FIX - memory leak
1520                                 return -1;
1521                         }
1522                         vfree($3);      //%%% BUG FIX - memory leak
1523                         cur_rmconf->idvtype = $2;
1524                 }
1525                 EOS
1526         |       MY_IDENTIFIER IDENTIFIERTYPE IDENTIFIERQUAL identifierstring
1527                 {
1528                         if (set_identifier_qual(&cur_rmconf->idv, $2, $4, $3) != 0) {
1529                                 racoon_yyerror("failed to set identifer.\n");
1530                                 return -1;
1531                         }
1532                         cur_rmconf->idvtype = $2;
1533                 }
1534                 EOS
1535         |       XAUTH_LOGIN identifierstring
1536                 {
1537 #ifdef ENABLE_HYBRID
1538                         /* formerly identifier type login */
1539                         if (xauth_rmconf_used(&cur_rmconf->xauth) == -1) {
1540                                 racoon_yyerror("failed to allocate xauth state\n");
1541                                 return -1;
1542                         }
1543                         if ((cur_rmconf->xauth->login = vdup($2)) == NULL) {
1544                                 racoon_yyerror("failed to set identifer.\n");
1545                                 return -1;
1546                         }
1547                         vfree($2);      //%%% BUG FIX - memory leak
1548 #else
1549                         racoon_yyerror("racoon not configured with --enable-hybrid");
1550 #endif
1551                 }
1552                 EOS
1553         |       PEERS_IDENTIFIER IDENTIFIERTYPE identifierstring
1554                 {
1555                         struct idspec  *id;
1556                         id = newidspec();
1557                         if (id == NULL) {
1558                                 racoon_yyerror("failed to allocate idspec");
1559                                 return -1;
1560                         }
1561                         if (set_identifier(&id->id, $2, $3) != 0) {
1562                                 racoon_yyerror("failed to set identifer.\n");
1563                                 racoon_free(id);
1564                                 vfree($3);      //%%% BUG FIX - memory leak
1565                                 return -1;
1566                         }
1567                         vfree($3);      //%%% BUG FIX - memory leak
1568                         id->idtype = $2;
1569                         genlist_append (cur_rmconf->idvl_p, id);
1570                 }
1571                 EOS
1572         |       PEERS_IDENTIFIER IDENTIFIERTYPE IDENTIFIERQUAL identifierstring
1573                 {
1574                         struct idspec  *id;
1575                         id = newidspec();
1576                         if (id == NULL) {
1577                                 racoon_yyerror("failed to allocate idspec");
1578                                 return -1;
1579                         }
1580                         if (set_identifier_qual(&id->id, $2, $4, $3) != 0) {
1581                                 racoon_yyerror("failed to set identifer.\n");
1582                                 racoon_free(id);
1583                                 return -1;
1584                         }
1585                         id->idtype = $2;
1586                         genlist_append (cur_rmconf->idvl_p, id);
1587                 }
1588                 EOS
1589         |       VERIFY_IDENTIFIER SWITCH { cur_rmconf->verify_identifier = $2; } EOS
1590         |       LOCAL_ADDRESS ADDRSTRING
1591                 {
1592                         struct sockaddr_storage *saddr;
1593                         saddr = str2saddr($2->v, NULL);
1594                         vfree($2);
1595                         if (saddr == NULL)
1596                         return -1;
1597                         cur_rmconf->forced_local = saddr;
1598                 } EOS
1599         |       SHARED_SECRET SECRETTYPE QUOTEDSTRING
1600                 {
1601                         cur_rmconf->secrettype = $2;
1602                         cur_rmconf->shared_secret = $3;
1603                 } EOS
1604         |       SHARED_SECRET SECRETTYPE
1605                 {
1606                         if ($2 != SECRETTYPE_KEYCHAIN_BY_ID) {
1607                                 racoon_yyerror("shared secret value missing.\n");
1608                                 return -1;
1609                         }
1610                         cur_rmconf->secrettype = $2;
1611                 } EOS
1612         |       NONCE_SIZE NUMBER { cur_rmconf->nonce_size = $2; } EOS
1613         |       DH_GROUP
1614                 {
1615                         racoon_yyerror("dh_group cannot be defined here.");
1616                         return -1;
1617                 }
1618                 dh_group_num EOS
1619         |       PASSIVE SWITCH { cur_rmconf->passive = $2; } EOS
1620         |       IKE_FRAG SWITCH { cur_rmconf->ike_frag = $2; } EOS
1621         |       IKE_FRAG REMOTE_FORCE_LEVEL { cur_rmconf->ike_frag = ISAKMP_FRAG_FORCE; } EOS
1622         |       ESP_FRAG NUMBER {
1623 #ifdef SADB_X_EXT_NAT_T_FRAG
1624                         if (libipsec_opt & LIBIPSEC_OPT_FRAG)
1625                                 cur_rmconf->esp_frag = $2;
1626                         else
1627                                 racoon_yywarn("libipsec lacks IKE frag support");
1628 #else
1629                         racoon_yywarn("Your kernel does not support esp_frag");
1630 #endif
1631                 } EOS
1632         |       MODE_CFG SWITCH { cur_rmconf->mode_cfg = $2; } EOS
1633         |       WEAK_PHASE1_CHECK SWITCH {
1634                         cur_rmconf->weak_phase1_check = $2;
1635                 } EOS
1636         |       GENERATE_POLICY SWITCH { cur_rmconf->gen_policy = $2; } EOS
1637         |       GENERATE_POLICY GENERATE_LEVEL { cur_rmconf->gen_policy = $2; } EOS
1638         |       SUPPORT_PROXY SWITCH { cur_rmconf->support_proxy = $2; } EOS
1639         |       INITIAL_CONTACT SWITCH { cur_rmconf->ini_contact = $2; } EOS
1640         |       NAT_TRAVERSAL SWITCH
1641                 {
1642 #ifdef ENABLE_NATT
1643                         cur_rmconf->nat_traversal = $2;
1644 #else
1645                         racoon_yyerror("NAT-T support not compiled in.");
1646 #endif
1647                 } EOS
1648         |       NAT_TRAVERSAL NAT_TRAVERSAL_LEVEL
1649                 {
1650 #ifdef ENABLE_NATT
1651                         cur_rmconf->nat_traversal = $2;
1652 #else
1653                         racoon_yyerror("NAT-T support not compiled in.");
1654 #endif
1655                 } EOS
1656         |       NAT_TRAVERSAL_MULTI_USER SWITCH
1657                 {
1658 #ifdef ENABLE_NATT
1659                         cur_rmconf->natt_multiple_user = $2;
1660 #else
1661                         racoon_yyerror("NAT-T support not compiled in.");
1662 #endif
1663                 } EOS
1664         |       NAT_TRAVERSAL_KEEPALIVE SWITCH
1665         {
1666 #ifdef ENABLE_NATT
1667                         cur_rmconf->natt_keepalive = $2;
1668 #else
1669                         racoon_yyerror("NAT-T support not compiled in.");
1670 #endif
1671         } EOS
1672 |       DPD SWITCH
1673                 {
1674 #ifdef ENABLE_DPD
1675                         cur_rmconf->dpd = $2;
1676 #else
1677                         racoon_yyerror("DPD support not compiled in.");
1678 #endif
1679                 } EOS
1680         |       DPD_DELAY NUMBER
1681                 {
1682 #ifdef ENABLE_DPD
1683                         cur_rmconf->dpd_interval = $2;
1684 #else
1685                         racoon_yyerror("DPD support not compiled in.");
1686 #endif
1687                 }
1688                 EOS
1689         |       DPD_RETRY NUMBER
1690                 {
1691 #ifdef ENABLE_DPD
1692                         cur_rmconf->dpd_retry = $2;
1693 #else
1694                         racoon_yyerror("DPD support not compiled in.");
1695 #endif
1696                 }
1697                 EOS
1698         |       DPD_MAXFAIL NUMBER
1699                 {
1700 #ifdef ENABLE_DPD
1701                         cur_rmconf->dpd_maxfails = $2;
1702 #else
1703                         racoon_yyerror("DPD support not compiled in.");
1704 #endif
1705                 }
1706                 EOS
1707     |   DPD_ALGORITHM dpd_algo_type
1708         {
1709 #ifdef ENABLE_DPD
1710             cur_rmconf->dpd_algo = $2;
1711 #else
1712             racoon_yyerror("DPD support not compiled in.");
1713 #endif
1714         }
1715         EOS
1716     |   DISCONNECT_ON_IDLE IDLE_TIMEOUT NUMBER IDLE_DIRECTION idle_dir_type
1717         {
1718             cur_rmconf->idle_timeout     = $3;
1719             cur_rmconf->idle_timeout_dir = $5;
1720         }
1721                 EOS
1722         |       LIFETIME LIFETYPE_TIME NUMBER unittype_time
1723                 {
1724                         cur_rmconf->prhead->lifetime = $3 * $4;
1725                 }
1726                 EOS
1727         |       PROPOSAL_CHECK PROPOSAL_CHECK_LEVEL { cur_rmconf->pcheck_level = $2; } EOS
1728         |       LIFETIME LIFETYPE_BYTE NUMBER unittype_byte
1729                 {
1730 #if 1
1731                         racoon_yyerror("byte lifetime support is deprecated in Phase 1");
1732                         return -1;
1733 #else
1734                         racoon_yywarn("the lifetime of bytes in phase 1 "
1735                                 "will be ignored at the moment.");
1736                         cur_rmconf->prhead->lifebyte = fix_lifebyte($3 * $4);
1737                         if (cur_rmconf->prhead->lifebyte == 0)
1738                                 return -1;
1739 #endif
1740                 }
1741                 EOS
1742         |       PROPOSAL
1743                 {
1744                         struct secprotospec *spspec;
1745
1746                         spspec = newspspec();
1747                         if (spspec == NULL)
1748                                 return -1;
1749                         insspspec(spspec, &cur_rmconf->prhead);
1750                 }
1751                 BOC isakmpproposal_specs EOC
1752         ;
1753 exchange_types
1754         :       /* nothing */
1755         |       exchange_types EXCHANGETYPE
1756                 {
1757                         struct etypes *new;
1758                         new = racoon_malloc(sizeof(struct etypes));
1759                         if (new == NULL) {
1760                                 racoon_yyerror("failed to allocate etypes");
1761                                 return -1;
1762                         }
1763                         new->type = $2;
1764                         new->next = NULL;
1765                         if (cur_rmconf->etypes == NULL)
1766                                 cur_rmconf->etypes = new;
1767                         else {
1768                                 struct etypes *p;
1769                                 for (p = cur_rmconf->etypes;
1770                                      p->next != NULL;
1771                                      p = p->next)
1772                                         ;
1773                                 p->next = new;
1774                         }
1775                 }
1776         ;
1777 cert_spec
1778         :       CERT_X509 IN_KEYCHAIN
1779                 {
1780                         cur_rmconf->certtype = $1;
1781                         cur_rmconf->identity_in_keychain = 1;
1782                         cur_rmconf->keychainCertRef = NULL;
1783                 }
1784                 EOS
1785         ;
1786         |       CERT_X509 IN_KEYCHAIN QUOTEDSTRING
1787                 {
1788                         cur_rmconf->certtype = $1;
1789                         cur_rmconf->identity_in_keychain = 1;
1790                         cur_rmconf->keychainCertRef = $3;
1791                 }
1792                 EOS
1793         ;
1794 dh_group_num
1795         :       ALGORITHMTYPE
1796                 {
1797                         $$ = algtype2doi(algclass_isakmp_dh, $1);
1798                         if ($$ == -1) {
1799                                 racoon_yyerror("must be DH group");
1800                                 return -1;
1801                         }
1802             switch ($$)
1803             {
1804                 case OAKLEY_ATTR_GRP_DESC_MODP768:
1805                 case OAKLEY_ATTR_GRP_DESC_MODP1024:
1806                 case OAKLEY_ATTR_GRP_DESC_MODP1536:
1807                 case OAKLEY_ATTR_GRP_DESC_MODP2048:
1808                 case OAKLEY_ATTR_GRP_DESC_MODP3072:
1809                 case OAKLEY_ATTR_GRP_DESC_MODP4096:
1810                 case OAKLEY_ATTR_GRP_DESC_MODP6144:
1811                 case OAKLEY_ATTR_GRP_DESC_MODP8192:
1812                     break;
1813                 default:
1814                     racoon_yyerror("Invalid DH group specified");
1815                     return -1;
1816                     break;
1817                         }
1818                 }
1819         |       NUMBER
1820                 {
1821                         if (ARRAYLEN(num2dhgroup) > $1 && num2dhgroup[$1] != 0) {
1822                                 $$ = num2dhgroup[$1];
1823                         } else {
1824                                 racoon_yyerror("must be DH group");
1825                                 $$ = 0;
1826                                 return -1;
1827                         }
1828             switch ($$)
1829             {
1830                 case OAKLEY_ATTR_GRP_DESC_MODP768:
1831                 case OAKLEY_ATTR_GRP_DESC_MODP1024:
1832                 case OAKLEY_ATTR_GRP_DESC_MODP1536:
1833                 case OAKLEY_ATTR_GRP_DESC_MODP2048:
1834                 case OAKLEY_ATTR_GRP_DESC_MODP3072:
1835                 case OAKLEY_ATTR_GRP_DESC_MODP4096:
1836                 case OAKLEY_ATTR_GRP_DESC_MODP6144:
1837                 case OAKLEY_ATTR_GRP_DESC_MODP8192:
1838                     break;
1839                 default:
1840                     racoon_yyerror("Invalid DH group specified");
1841                     return -1;
1842                     break;
1843                         }
1844         }
1845         ;
1846 identifierstring
1847         :       /* nothing */ { $$ = NULL; }
1848         |       ADDRSTRING { $$ = $1; }
1849         |       QUOTEDSTRING { $$ = $1; }
1850         ;
1851 isakmpproposal_specs
1852         :       /* nothing */
1853         |       isakmpproposal_specs isakmpproposal_spec
1854         ;
1855 isakmpproposal_spec
1856         :       STRENGTH
1857                 {
1858                         racoon_yyerror("strength directive is obsoleted.");
1859                 } STRENGTHTYPE EOS
1860         |       LIFETIME LIFETYPE_TIME NUMBER unittype_time
1861                 {
1862                         cur_rmconf->prhead->spspec->lifetime = $3 * $4;
1863                 }
1864                 EOS
1865         |       LIFETIME LIFETYPE_BYTE NUMBER unittype_byte
1866                 {
1867 #if 1
1868                         racoon_yyerror("byte lifetime support is deprecated");
1869                         return -1;
1870 #else
1871                         cur_rmconf->prhead->spspec->lifebyte = fix_lifebyte($3 * $4);
1872                         if (cur_rmconf->prhead->spspec->lifebyte == 0)
1873                                 return -1;
1874 #endif
1875                 }
1876                 EOS
1877         |       DH_GROUP dh_group_num
1878                 {
1879                         cur_rmconf->prhead->spspec->algclass[algclass_isakmp_dh] = $2;
1880                 }
1881                 EOS
1882         |       GSS_ID QUOTEDSTRING
1883                 {
1884                         if (cur_rmconf->prhead->spspec->vendorid != VENDORID_GSSAPI) {
1885                                 racoon_yyerror("wrong Vendor ID for gssapi_id");
1886                                 return -1;
1887                         }
1888                         if (cur_rmconf->prhead->spspec->gssid != NULL)
1889                                 racoon_free(cur_rmconf->prhead->spspec->gssid);
1890                         cur_rmconf->prhead->spspec->gssid =
1891                             racoon_strdup($2->v);
1892                         STRDUP_FATAL(cur_rmconf->prhead->spspec->gssid);
1893                 }
1894                 EOS
1895         |       ALGORITHM_CLASS ALGORITHMTYPE keylength
1896                 {
1897                         int doi;
1898                         int defklen;
1899             {
1900                 doi = algtype2doi($1, $2);
1901                 if (doi == -1) {
1902                     racoon_yyerror("algorithm mismatched 1");
1903                     return -1;
1904                 }
1905             }
1906
1907                         switch ($1) {
1908                         case algclass_isakmp_enc:
1909                         /* reject suppressed algorithms */
1910                                 cur_rmconf->prhead->spspec->algclass[algclass_isakmp_enc] = doi;
1911                                 defklen = default_keylen($1, $2);
1912                                 if (defklen == 0) {
1913                                         if ($3) {
1914                                                 racoon_yyerror("keylen not allowed");
1915                                                 return -1;
1916                                         }
1917                                 } else {
1918                                         if ($3 && check_keylen($1, $2, $3) < 0) {
1919                                                 racoon_yyerror("invalid keylen %d", $3);
1920                                                 return -1;
1921                                         }
1922                                 }
1923                                 if ($3)
1924                                         cur_rmconf->prhead->spspec->encklen = $3;
1925                                 else
1926                                         cur_rmconf->prhead->spspec->encklen = defklen;
1927                                 break;
1928                         case algclass_isakmp_hash:
1929                                 cur_rmconf->prhead->spspec->algclass[algclass_isakmp_hash] = doi;
1930                                 break;
1931                         case algclass_isakmp_ameth:
1932                                 cur_rmconf->prhead->spspec->algclass[algclass_isakmp_ameth] = doi;
1933                                 /*
1934                                  * We may have to set the Vendor ID for the
1935                                  * authentication method we're using.
1936                                  */
1937                                 switch ($2) {
1938                                 case algtype_gssapikrb:
1939                                         if (cur_rmconf->prhead->spspec->vendorid !=
1940                                             VENDORID_UNKNOWN) {
1941                                                 racoon_yyerror("Vendor ID mismatch "
1942                                                     "for auth method");
1943                                                 return -1;
1944                                         }
1945                                         /*
1946                                          * For interoperability with Win2k,
1947                                          * we set the Vendor ID to "GSSAPI".
1948                                          */
1949                                         cur_rmconf->prhead->spspec->vendorid =
1950                                             VENDORID_GSSAPI;
1951                                         break;
1952                                 default:
1953                                         break;
1954                                 }
1955                                 break;
1956                         default:
1957                                 racoon_yyerror("algorithm mismatched 2");
1958                                 return -1;
1959                         }
1960                 }
1961                 EOS
1962         ;
1963
1964 unittype_time
1965         :       UNITTYPE_SEC    { $$ = 1; }
1966         |       UNITTYPE_MIN    { $$ = 60; }
1967         |       UNITTYPE_HOUR   { $$ = (60 * 60); }
1968         ;
1969 unittype_byte
1970         :       UNITTYPE_BYTE   { $$ = 1; }
1971         |       UNITTYPE_KBYTES { $$ = 1024; }
1972         |       UNITTYPE_MBYTES { $$ = (1024 * 1024); }
1973         |       UNITTYPE_TBYTES { $$ = (1024 * 1024 * 1024); }
1974         ;
1975 dpd_algo_type
1976     :   DPD_ALGO_TYPE_DEFAULT   { $$ = DPD_ALGO_DEFAULT; }
1977     |   DPD_ALGO_TYPE_INBOUND   { $$ = DPD_ALGO_INBOUND_DETECT; }
1978     |   DPD_ALGO_TYPE_BLACKHOLE { $$ = DPD_ALGO_BLACKHOLE_DETECT; }
1979     ;
1980 idle_dir_type
1981     :   IDLE_DIRECTION_ANY      { $$ = IPSEC_DIR_ANY; }
1982     |   IDLE_DIRECTION_IN       { $$ = IPSEC_DIR_INBOUND; }
1983     |   IDLE_DIRECTION_OUT      { $$ = IPSEC_DIR_OUTBOUND; }
1984     ;
1985 %%
1986
1987 static struct proposalspec *
1988 newprspec()
1989 {
1990         struct proposalspec *new;
1991
1992         new = racoon_calloc(1, sizeof(*new));
1993         if (new == NULL)
1994                 racoon_yyerror("failed to allocate proposal");
1995
1996         return new;
1997 }
1998
1999 /*
2000  * insert into head of list.
2001  */
2002 static void
2003 insprspec(prspec, head)
2004         struct proposalspec *prspec;
2005         struct proposalspec **head;
2006 {
2007         if (*head != NULL)
2008                 (*head)->prev = prspec;
2009         prspec->next = *head;
2010         *head = prspec;
2011 }
2012
2013 static struct secprotospec *
2014 newspspec()
2015 {
2016         struct secprotospec *new;
2017
2018         new = racoon_calloc(1, sizeof(*new));
2019         if (new == NULL) {
2020                 racoon_yyerror("failed to allocate spproto");
2021                 return NULL;
2022         }
2023
2024         new->encklen = 0;       /*XXX*/
2025
2026         /*
2027          * Default to "uknown" vendor -- we will override this
2028          * as necessary.  When we send a Vendor ID payload, an
2029          * "unknown" will be translated to a KAME/racoon ID.
2030          */
2031         new->vendorid = VENDORID_UNKNOWN;
2032
2033         return new;
2034 }
2035
2036 /*
2037  * insert into head of list.
2038  */
2039 static void
2040 insspspec(spspec, head)
2041         struct secprotospec *spspec;
2042         struct proposalspec **head;
2043 {
2044         spspec->back = *head;
2045
2046         if ((*head)->spspec != NULL)
2047                 (*head)->spspec->prev = spspec;
2048         spspec->next = (*head)->spspec;
2049         (*head)->spspec = spspec;
2050 }
2051
2052 /* set final acceptable proposal */
2053 static int
2054 set_isakmp_proposal(rmconf, prspec)
2055         struct remoteconf *rmconf;
2056         struct proposalspec *prspec;
2057 {
2058         struct proposalspec *p;
2059         struct secprotospec *s;
2060         int prop_no = 1;
2061         int trns_no = 1;
2062         int32_t types[MAXALGCLASS];
2063
2064         p = prspec;
2065         if (p->next != 0) {
2066                 plog(ASL_LEVEL_ERR,
2067                         "multiple proposal definition.\n");
2068                 return -1;
2069         }
2070
2071         /* mandatory check */
2072         if (p->spspec == NULL) {
2073                 racoon_yyerror("no remote specification found: %s.\n",
2074                         saddr2str((struct sockaddr *)rmconf->remote));
2075                 return -1;
2076         }
2077         for (s = p->spspec; s != NULL; s = s->next) {
2078                 /* XXX need more to check */
2079                 if (s->algclass[algclass_isakmp_enc] == 0) {
2080                         racoon_yyerror("encryption algorithm required.");
2081                         return -1;
2082                 }
2083                 if (s->algclass[algclass_isakmp_hash] == 0) {
2084             racoon_yyerror("hash algorithm required.");
2085             return -1;
2086                 }
2087                 if (s->algclass[algclass_isakmp_dh] == 0) {
2088                         racoon_yyerror("DH group required.");
2089                         return -1;
2090                 }
2091                 if (s->algclass[algclass_isakmp_ameth] == 0) {
2092                         racoon_yyerror("authentication method required.");
2093                         return -1;
2094                 }
2095         }
2096
2097         /* skip to last part */
2098         for (s = p->spspec; s->next != NULL; s = s->next)
2099                 ;
2100
2101         while (s != NULL) {
2102                 plog(ASL_LEVEL_DEBUG,
2103                         "lifetime = %ld\n", (long)
2104                         (s->lifetime ? s->lifetime : p->lifetime));
2105                 plog(ASL_LEVEL_DEBUG,
2106                         "lifebyte = %d\n",
2107                         s->lifebyte ? s->lifebyte : p->lifebyte);
2108                 plog(ASL_LEVEL_DEBUG,
2109                         "encklen=%d\n", s->encklen);
2110
2111                 memset(types, 0, ARRAYLEN(types));
2112                 types[algclass_isakmp_enc] = s->algclass[algclass_isakmp_enc];
2113         types[algclass_isakmp_hash] = s->algclass[algclass_isakmp_hash];
2114                 types[algclass_isakmp_dh] = s->algclass[algclass_isakmp_dh];
2115                 types[algclass_isakmp_ameth] =
2116                     s->algclass[algclass_isakmp_ameth];
2117
2118                 /* expanding spspec */
2119                 clean_tmpalgtype();
2120                 trns_no = expand_isakmpspec(prop_no, trns_no, types,
2121                                 algclass_isakmp_enc, algclass_isakmp_ameth + 1,
2122                                 s->lifetime ? s->lifetime : p->lifetime,
2123                                 s->lifebyte ? s->lifebyte : p->lifebyte,
2124                                 s->encklen, s->vendorid, s->gssid,
2125                                 rmconf);
2126                 if (trns_no == -1) {
2127                         plog(ASL_LEVEL_ERR,
2128                                 "failed to expand isakmp proposal.\n");
2129                         return -1;
2130                 }
2131
2132                 s = s->prev;
2133         }
2134
2135         if (rmconf->proposal == NULL) {
2136                 plog(ASL_LEVEL_ERR,
2137                         "no proposal found.\n");
2138                 return -1;
2139         }
2140
2141         return 0;
2142 }
2143
2144 static void
2145 clean_tmpalgtype()
2146 {
2147         int i;
2148         for (i = 0; i < MAXALGCLASS; i++)
2149                 tmpalgtype[i] = 0;      /* means algorithm undefined. */
2150 }
2151
2152 static int
2153 expand_isakmpspec(prop_no, trns_no, types,
2154                 class, last, lifetime, lifebyte, encklen, vendorid, gssid,
2155                 rmconf)
2156         int prop_no, trns_no;
2157         int *types, class, last;
2158         time_t lifetime;
2159         int lifebyte;
2160         int encklen;
2161         int vendorid;
2162         char *gssid;
2163         struct remoteconf *rmconf;
2164 {
2165         struct isakmpsa *new;
2166
2167         /* debugging */
2168     {
2169         int j;
2170         char tb[10];
2171         plog(ASL_LEVEL_DEBUG,
2172                 "p:%d t:%d\n", prop_no, trns_no);
2173         for (j = class; j < MAXALGCLASS; j++) {
2174                 snprintf(tb, sizeof(tb), "%d", types[j]);
2175                 plog(ASL_LEVEL_DEBUG,
2176                         "%s%s%s%s\n",
2177                         s_algtype(j, types[j]),
2178                         types[j] ? "(" : "",
2179                         tb[0] == '0' ? "" : tb,
2180                         types[j] ? ")" : "");
2181         }
2182         plog(ASL_LEVEL_DEBUG, "\n");
2183     }
2184
2185 #define TMPALGTYPE2STR(n) \
2186         s_algtype(algclass_isakmp_##n, types[algclass_isakmp_##n])
2187                 /* check mandatory values */
2188                 if (types[algclass_isakmp_enc] == 0
2189                  || types[algclass_isakmp_ameth] == 0
2190                  || types[algclass_isakmp_dh] == 0) {
2191                         racoon_yyerror("few definition of algorithm "
2192                                 "enc=%s ameth=%s hash=%s dhgroup=%s.\n",
2193                                 TMPALGTYPE2STR(enc),
2194                                 TMPALGTYPE2STR(ameth),
2195                                 TMPALGTYPE2STR(hash),
2196                                 TMPALGTYPE2STR(dh));
2197                         return -1;
2198                 }
2199 #undef TMPALGTYPE2STR
2200
2201         /* set new sa */
2202         new = newisakmpsa();
2203         if (new == NULL) {
2204                 racoon_yyerror("failed to allocate isakmp sa");
2205                 return -1;
2206         }
2207         new->prop_no = prop_no;
2208         new->trns_no = trns_no++;
2209         new->lifetime = lifetime;
2210         new->lifebyte = lifebyte;
2211         new->enctype = types[algclass_isakmp_enc];
2212         new->encklen = encklen;
2213         new->authmethod = types[algclass_isakmp_ameth];
2214     new->hashtype = types[algclass_isakmp_hash];
2215     new->prf = types[algclass_isakmp_hash];
2216         new->dh_group = types[algclass_isakmp_dh];
2217         new->vendorid = vendorid;
2218         insisakmpsa(new, rmconf);
2219
2220         return trns_no;
2221 }
2222
2223 static int
2224 listen_addr (struct sockaddr_storage *addr, int udp_encap)
2225 {
2226         struct myaddrs *p;
2227
2228         p = newmyaddr();
2229         if (p == NULL) {
2230                 racoon_yyerror("failed to allocate myaddrs");
2231                 return -1;
2232         }
2233         p->addr = addr;
2234         if (p->addr == NULL) {
2235                 racoon_yyerror("failed to copy sockaddr_storage ");
2236                 delmyaddr(p);
2237                 return -1;
2238         }
2239         p->udp_encap = udp_encap;
2240         /* These need to be initialized for Apple modifications
2241          * to open code for isakmp sockets
2242      */
2243         p->sock = -1;
2244         p->in_use = 1;
2245
2246         insmyaddr(p, &lcconf->myaddrs);
2247
2248         lcconf->autograbaddr = 0;
2249         return 0;
2250 }
2251
2252 #if 0
2253 /*
2254  * fix lifebyte.
2255  * Must be more than 1024B because its unit is kilobytes.
2256  * That is defined RFC2407.
2257  */
2258 static int
2259 fix_lifebyte(t)
2260         unsigned long t;
2261 {
2262         if (t < 1024) {
2263                 racoon_yyerror("byte size should be more than 1024B.");
2264                 return 0;
2265         }
2266
2267         return(t / 1024);
2268 }
2269 #endif
2270
2271 int
2272 cfparse()
2273 {
2274         int error;
2275
2276         plog(ASL_LEVEL_DEBUG, "===== parsing configuration\n");
2277
2278         yycf_init_buffer();
2279
2280         if (yycf_switch_buffer(lcconf->racoon_conf) != 0) {
2281                 plog(ASL_LEVEL_ERR,
2282                     "could not read configuration file \"%s\"\n",
2283                     lcconf->racoon_conf);
2284                 return -1;
2285         }
2286
2287         error = yyparse();
2288         if (error != 0) {
2289                 if (yyerrorcount) {
2290                         plog(ASL_LEVEL_ERR,
2291                                 "fatal parse failure (%d errors)\n",
2292                                 yyerrorcount);
2293                 } else {
2294                         plog(ASL_LEVEL_ERR,
2295                                 "fatal parse failure.\n");
2296                 }
2297                 yycf_clean_buffer();
2298                 return -1;
2299         }
2300
2301         if (error == 0 && yyerrorcount) {
2302                 plog(ASL_LEVEL_ERR,
2303                         "parse error is nothing, but yyerrorcount is %d.\n",
2304                                 yyerrorcount);
2305                 yycf_clean_buffer();
2306                 exit(1);
2307         }
2308
2309         yycf_clean_buffer();
2310
2311         plog(ASL_LEVEL_DEBUG, "parse succeeded.\n");
2312
2313         return 0;
2314 }
2315
2316 int
2317 cfreparse(int sig)
2318 {
2319     int result;
2320         int ignore_estab_or_assert_handles = (sig == SIGUSR1);
2321
2322         if (sig >= 0 && sig < NSIG) {
2323                 plog(ASL_LEVEL_DEBUG, "==== Got %s signal - re-parsing configuration.\n", sys_signame[sig]);
2324         } else {
2325                 plog(ASL_LEVEL_ERR, "==== Got Unknown signal - re-parsing configuration.\n");
2326         }
2327         plog(ASL_LEVEL_DEBUG, "==== %s sessions.\n", ignore_estab_or_assert_handles? "flush negotiating" : "flush all");
2328
2329         ike_session_flush_all_phase2(ignore_estab_or_assert_handles);
2330         ike_session_flush_all_phase1(ignore_estab_or_assert_handles);
2331         flushrmconf();
2332         flushsainfo();
2333         check_auto_exit();      /* check/change state of auto exit */
2334         clean_tmpalgtype();
2335     savelcconf();
2336         result = cfparse();
2337     restorelcconf();
2338     return result;
2339 }
2340
2341