Home | History | Annotate | Download | only in racoon
      1 /*	$NetBSD: cftoken.l,v 1.11.4.2 2007/09/03 18:07:29 mgrooms Exp $	*/
      2 
      3 /* Id: cftoken.l,v 1.53 2006/08/22 18:17:17 manubsd Exp */
      4 
      5 %{
      6 /*
      7  * Copyright (C) 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002 and 2003 WIDE Project.
      8  * All rights reserved.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  * 3. Neither the name of the project nor the names of its contributors
     19  *    may be used to endorse or promote products derived from this software
     20  *    without specific prior written permission.
     21  *
     22  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
     23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
     26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     32  * SUCH DAMAGE.
     33  */
     34 
     35 #include "config.h"
     36 
     37 #include <sys/types.h>
     38 #include <sys/param.h>
     39 #include <sys/socket.h>
     40 
     41 #include <netinet/in.h>
     42 #include PATH_IPSEC_H
     43 
     44 #include <stdlib.h>
     45 #include <stdio.h>
     46 #include <string.h>
     47 #include <errno.h>
     48 #include <limits.h>
     49 #include <ctype.h>
     50 #include <glob.h>
     51 #ifdef HAVE_STDARG_H
     52 #include <stdarg.h>
     53 #else
     54 #include <varargs.h>
     55 #endif
     56 
     57 #include "var.h"
     58 #include "misc.h"
     59 #include "vmbuf.h"
     60 #include "plog.h"
     61 #include "debug.h"
     62 
     63 #include "algorithm.h"
     64 #include "cfparse_proto.h"
     65 #include "cftoken_proto.h"
     66 #include "localconf.h"
     67 #include "oakley.h"
     68 #include "isakmp_var.h"
     69 #include "isakmp.h"
     70 #include "ipsec_doi.h"
     71 #include "policy.h"
     72 #include "proposal.h"
     73 #include "remoteconf.h"
     74 #ifdef GC
     75 #include "gcmalloc.h"
     76 #endif
     77 
     78 #include "cfparse.h"
     79 
     80 int yyerrorcount = 0;
     81 
     82 #if defined(YIPS_DEBUG)
     83 #  define YYDB plog(LLV_DEBUG2, LOCATION, NULL,                                \
     84 		"begin <%d>%s\n", yy_start, yytext);
     85 #  define YYD {                                                                \
     86 	plog(LLV_DEBUG2, LOCATION, NULL, "<%d>%s",                             \
     87 	    yy_start, loglevel >= LLV_DEBUG2 ? "\n" : "");                     \
     88 }
     89 #else
     90 #  define YYDB
     91 #  define YYD
     92 #endif /* defined(YIPS_DEBUG) */
     93 
     94 #define MAX_INCLUDE_DEPTH 10
     95 
     96 static struct include_stack {
     97 	char *path;
     98 	FILE *fp;
     99 	YY_BUFFER_STATE prevstate;
    100 	int lineno;
    101 	glob_t matches;
    102 	int matchon;
    103 } incstack[MAX_INCLUDE_DEPTH];
    104 static int incstackp = 0;
    105 
    106 static int yy_first_time = 1;
    107 %}
    108 
    109 /* common seciton */
    110 nl		\n
    111 ws		[ \t]+
    112 digit		[0-9]
    113 letter		[A-Za-z]
    114 hexdigit	[0-9A-Fa-f]
    115 /*octet		(([01]?{digit}?{digit})|((2([0-4]{digit}))|(25[0-5]))) */
    116 special		[()+\|\?\*]
    117 comma		\,
    118 dot		\.
    119 slash		\/
    120 bcl		\{
    121 ecl		\}
    122 blcl		\[
    123 elcl		\]
    124 hyphen          \-
    125 percent		\%
    126 semi		\;
    127 comment		\#.*
    128 ccomment	"/*"
    129 bracketstring	\<[^>]*\>
    130 quotedstring	\"[^"]*\"
    131 addrstring	[a-fA-F0-9:]([a-fA-F0-9:\.]*|[a-fA-F0-9:\.]*%[a-zA-Z0-9]*)
    132 decstring	{digit}+
    133 hexstring	0x{hexdigit}+
    134 
    135 %s S_INI S_PRIV S_PTH S_INF S_LOG S_PAD S_LST S_RTRY S_CFG S_LDAP
    136 %s S_ALGST S_ALGCL
    137 %s S_SAINF S_SAINFS
    138 %s S_RMT S_RMTS S_RMTP
    139 %s S_SA
    140 %s S_GSSENC
    141 
    142 %%
    143 %{
    144 	if (yy_first_time) {
    145 		BEGIN S_INI;
    146 		yy_first_time = 0;
    147 	}
    148 %}
    149 
    150 	/* privsep */
    151 <S_INI>privsep		{ BEGIN S_PRIV; YYDB; return(PRIVSEP); }
    152 <S_PRIV>{bcl}		{ return(BOC); }
    153 <S_PRIV>user		{ YYD; return(USER); }
    154 <S_PRIV>group		{ YYD; return(GROUP); }
    155 <S_PRIV>chroot		{ YYD; return(CHROOT); }
    156 <S_PRIV>{ecl}		{ BEGIN S_INI; return(EOC); }
    157 
    158 	/* path */
    159 <S_INI>path		{ BEGIN S_PTH; YYDB; return(PATH); }
    160 <S_PTH>include		{ YYD; yylval.num = LC_PATHTYPE_INCLUDE;
    161 				return(PATHTYPE); }
    162 <S_PTH>pre_shared_key	{ YYD; yylval.num = LC_PATHTYPE_PSK;
    163 				return(PATHTYPE); }
    164 <S_PTH>certificate	{ YYD; yylval.num = LC_PATHTYPE_CERT;
    165 				return(PATHTYPE); }
    166 <S_PTH>script		{ YYD; yylval.num = LC_PATHTYPE_SCRIPT;
    167 				return(PATHTYPE); }
    168 <S_PTH>backupsa		{ YYD; yylval.num = LC_PATHTYPE_BACKUPSA;
    169 				return(PATHTYPE); }
    170 <S_PTH>pidfile		{ YYD; yylval.num = LC_PATHTYPE_PIDFILE;
    171 				return(PATHTYPE); }
    172 <S_PTH>{semi}		{ BEGIN S_INI; YYDB; return(EOS); }
    173 
    174 	/* include */
    175 <S_INI>include		{ YYDB; return(INCLUDE); }
    176 
    177 	/* self information */
    178 <S_INI>identifier	{ BEGIN S_INF; YYDB; yywarn("it is obsoleted.  use \"my_identifier\" in each remote directives."); return(IDENTIFIER); }
    179 <S_INF>{semi}		{ BEGIN S_INI; return(EOS); }
    180 
    181 	/* special */
    182 <S_INI>complex_bundle	{ YYDB; return(COMPLEX_BUNDLE); }
    183 
    184 	/* logging */
    185 <S_INI>log		{ BEGIN S_LOG; YYDB; return(LOGGING); }
    186 <S_LOG>error		{ YYD; yylval.num = LLV_ERROR; return(LOGLEV); }
    187 <S_LOG>warning		{ YYD; yylval.num = LLV_WARNING; return(LOGLEV); }
    188 <S_LOG>notify		{ YYD; yylval.num = LLV_NOTIFY; return(LOGLEV); }
    189 <S_LOG>info		{ YYD; yylval.num = LLV_INFO; return(LOGLEV); }
    190 <S_LOG>debug		{ YYD; yylval.num = LLV_DEBUG; return(LOGLEV); }
    191 <S_LOG>debug2		{ YYD; yylval.num = LLV_DEBUG2; return(LOGLEV); }
    192 <S_LOG>debug3		{ YYD; yywarn("it is obsoleted.  use \"debug2\""); yylval.num = LLV_DEBUG2; return(LOGLEV); }
    193 <S_LOG>debug4		{ YYD; yywarn("it is obsoleted.  use \"debug2\""); yylval.num = LLV_DEBUG2; return(LOGLEV); }
    194 <S_LOG>{semi}		{ BEGIN S_INI; return(EOS); }
    195 
    196 	/* padding */
    197 <S_INI>padding		{ BEGIN S_PAD; YYDB; return(PADDING); }
    198 <S_PAD>{bcl}		{ return(BOC); }
    199 <S_PAD>randomize	{ YYD; return(PAD_RANDOMIZE); }
    200 <S_PAD>randomize_length	{ YYD; return(PAD_RANDOMIZELEN); }
    201 <S_PAD>maximum_length	{ YYD; return(PAD_MAXLEN); }
    202 <S_PAD>strict_check	{ YYD; return(PAD_STRICT); }
    203 <S_PAD>exclusive_tail	{ YYD; return(PAD_EXCLTAIL); }
    204 <S_PAD>{ecl}		{ BEGIN S_INI; return(EOC); }
    205 
    206 	/* listen */
    207 <S_INI>listen		{ BEGIN S_LST; YYDB; return(LISTEN); }
    208 <S_LST>{bcl}		{ return(BOC); }
    209 <S_LST>isakmp		{ YYD; return(X_ISAKMP); }
    210 <S_LST>isakmp_natt	{ YYD; return(X_ISAKMP_NATT); }
    211 <S_LST>admin		{ YYD; return(X_ADMIN); }
    212 <S_LST>adminsock	{ YYD; return(ADMINSOCK); }
    213 <S_LST>disabled		{ YYD; return(DISABLED); }
    214 <S_LST>strict_address	{ YYD; return(STRICT_ADDRESS); }
    215 <S_LST>{ecl}		{ BEGIN S_INI; return(EOC); }
    216 
    217 	/* ldap config */
    218 <S_INI>ldapcfg		{ BEGIN S_LDAP; YYDB; return(LDAPCFG); }
    219 <S_LDAP>{bcl}		{ return(BOC); }
    220 <S_LDAP>version		{ YYD; return(LDAP_PVER); }
    221 <S_LDAP>host		{ YYD; return(LDAP_HOST); }
    222 <S_LDAP>port		{ YYD; return(LDAP_PORT); }
    223 <S_LDAP>base		{ YYD; return(LDAP_BASE); }
    224 <S_LDAP>subtree		{ YYD; return(LDAP_SUBTREE); }
    225 <S_LDAP>bind_dn		{ YYD; return(LDAP_BIND_DN); }
    226 <S_LDAP>bind_pw		{ YYD; return(LDAP_BIND_PW); }
    227 <S_LDAP>attr_user	{ YYD; return(LDAP_ATTR_USER); }
    228 <S_LDAP>attr_addr	{ YYD; return(LDAP_ATTR_ADDR); }
    229 <S_LDAP>attr_mask	{ YYD; return(LDAP_ATTR_MASK); }
    230 <S_LDAP>attr_group	{ YYD; return(LDAP_ATTR_GROUP); }
    231 <S_LDAP>attr_member	{ YYD; return(LDAP_ATTR_MEMBER); }
    232 <S_LDAP>{ecl}		{ BEGIN S_INI; return(EOC); }
    233 
    234 	/* mode_cfg */
    235 <S_INI>mode_cfg		{ BEGIN S_CFG; YYDB; return(MODECFG); }
    236 <S_CFG>{bcl}		{ return(BOC); }
    237 <S_CFG>network4		{ YYD; return(CFG_NET4); }
    238 <S_CFG>netmask4		{ YYD; return(CFG_MASK4); }
    239 <S_CFG>dns4		{ YYD; return(CFG_DNS4); }
    240 <S_CFG>nbns4		{ YYD; return(CFG_NBNS4); }
    241 <S_CFG>wins4		{ YYD; return(CFG_NBNS4); }
    242 <S_CFG>default_domain	{ YYD; return(CFG_DEFAULT_DOMAIN); }
    243 <S_CFG>auth_source	{ YYD; return(CFG_AUTH_SOURCE); }
    244 <S_CFG>auth_groups	{ YYD; return(CFG_AUTH_GROUPS); }
    245 <S_CFG>group_source	{ YYD; return(CFG_GROUP_SOURCE); }
    246 <S_CFG>conf_source	{ YYD; return(CFG_CONF_SOURCE); }
    247 <S_CFG>accounting	{ YYD; return(CFG_ACCOUNTING); }
    248 <S_CFG>system		{ YYD; return(CFG_SYSTEM); }
    249 <S_CFG>local		{ YYD; return(CFG_LOCAL); }
    250 <S_CFG>none		{ YYD; return(CFG_NONE); }
    251 <S_CFG>radius		{ YYD; return(CFG_RADIUS); }
    252 <S_CFG>pam		{ YYD; return(CFG_PAM); }
    253 <S_CFG>ldap		{ YYD; return(CFG_LDAP); }
    254 <S_CFG>pool_size	{ YYD; return(CFG_POOL_SIZE); }
    255 <S_CFG>banner		{ YYD; return(CFG_MOTD); }
    256 <S_CFG>auth_throttle	{ YYD; return(CFG_AUTH_THROTTLE); }
    257 <S_CFG>split_network	{ YYD; return(CFG_SPLIT_NETWORK); }
    258 <S_CFG>local_lan	{ YYD; return(CFG_SPLIT_LOCAL); }
    259 <S_CFG>include		{ YYD; return(CFG_SPLIT_INCLUDE); }
    260 <S_CFG>split_dns	{ YYD; return(CFG_SPLIT_DNS); }
    261 <S_CFG>pfs_group	{ YYD; return(CFG_PFS_GROUP); }
    262 <S_CFG>save_passwd	{ YYD; return(CFG_SAVE_PASSWD); }
    263 <S_CFG>{comma}		{ YYD; return(COMMA); }
    264 <S_CFG>{ecl}		{ BEGIN S_INI; return(EOC); }
    265 
    266 	/* timer */
    267 <S_INI>timer		{ BEGIN S_RTRY; YYDB; return(RETRY); }
    268 <S_RTRY>{bcl}		{ return(BOC); }
    269 <S_RTRY>counter		{ YYD; return(RETRY_COUNTER); }
    270 <S_RTRY>interval	{ YYD; return(RETRY_INTERVAL); }
    271 <S_RTRY>persend		{ YYD; return(RETRY_PERSEND); }
    272 <S_RTRY>phase1		{ YYD; return(RETRY_PHASE1); }
    273 <S_RTRY>phase2		{ YYD; return(RETRY_PHASE2); }
    274 <S_RTRY>natt_keepalive	{ YYD; return(NATT_KA); }
    275 <S_RTRY>{ecl}		{ BEGIN S_INI; return(EOC); }
    276 
    277 	/* sainfo */
    278 <S_INI>sainfo		{ BEGIN S_SAINF; YYDB; return(SAINFO); }
    279 <S_SAINF>anonymous	{ YYD; return(ANONYMOUS); }
    280 <S_SAINF>{blcl}any{elcl}	{ YYD; return(PORTANY); }
    281 <S_SAINF>any		{ YYD; return(ANY); }
    282 <S_SAINF>from		{ YYD; return(FROM); }
    283 <S_SAINF>group		{ YYD; return(GROUP); }
    284 	/* sainfo spec */
    285 <S_SAINF>{bcl}		{ BEGIN S_SAINFS; return(BOC); }
    286 <S_SAINF>{semi}		{ BEGIN S_INI; return(EOS); }
    287 <S_SAINFS>{ecl}		{ BEGIN S_INI; return(EOC); }
    288 <S_SAINFS>pfs_group	{ YYD; return(PFS_GROUP); }
    289 <S_SAINFS>remoteid	{ YYD; return(REMOTEID); }
    290 <S_SAINFS>identifier	{ YYD; yywarn("it is obsoleted.  use \"my_identifier\"."); return(IDENTIFIER); }
    291 <S_SAINFS>my_identifier	{ YYD; return(MY_IDENTIFIER); }
    292 <S_SAINFS>lifetime	{ YYD; return(LIFETIME); }
    293 <S_SAINFS>time		{ YYD; return(LIFETYPE_TIME); }
    294 <S_SAINFS>byte		{ YYD; return(LIFETYPE_BYTE); }
    295 <S_SAINFS>encryption_algorithm { YYD; yylval.num = algclass_ipsec_enc; return(ALGORITHM_CLASS); }
    296 <S_SAINFS>authentication_algorithm { YYD; yylval.num = algclass_ipsec_auth; return(ALGORITHM_CLASS); }
    297 <S_SAINFS>compression_algorithm	{ YYD; yylval.num = algclass_ipsec_comp; return(ALGORITHM_CLASS); }
    298 <S_SAINFS>{comma}	{ YYD; return(COMMA); }
    299 
    300 	/* remote */
    301 <S_INI>remote		{ BEGIN S_RMT; YYDB; return(REMOTE); }
    302 <S_RMT>anonymous	{ YYD; return(ANONYMOUS); }
    303 <S_RMT>inherit		{ YYD; return(INHERIT); }
    304 	/* remote spec */
    305 <S_RMT>{bcl}		{ BEGIN S_RMTS; return(BOC); }
    306 <S_RMTS>{ecl}		{ BEGIN S_INI; return(EOC); }
    307 <S_RMTS>exchange_mode	{ YYD; return(EXCHANGE_MODE); }
    308 <S_RMTS>{comma}		{ YYD; /* XXX ignored, but to be handled. */ ; }
    309 <S_RMTS>base		{ YYD; yylval.num = ISAKMP_ETYPE_BASE; return(EXCHANGETYPE); }
    310 <S_RMTS>main		{ YYD; yylval.num = ISAKMP_ETYPE_IDENT; return(EXCHANGETYPE); }
    311 <S_RMTS>aggressive	{ YYD; yylval.num = ISAKMP_ETYPE_AGG; return(EXCHANGETYPE); }
    312 <S_RMTS>doi		{ YYD; return(DOI); }
    313 <S_RMTS>ipsec_doi	{ YYD; yylval.num = IPSEC_DOI; return(DOITYPE); }
    314 <S_RMTS>situation	{ YYD; return(SITUATION); }
    315 <S_RMTS>identity_only	{ YYD; yylval.num = IPSECDOI_SIT_IDENTITY_ONLY; return(SITUATIONTYPE); }
    316 <S_RMTS>secrecy		{ YYD; yylval.num = IPSECDOI_SIT_SECRECY; return(SITUATIONTYPE); }
    317 <S_RMTS>integrity	{ YYD; yylval.num = IPSECDOI_SIT_INTEGRITY; return(SITUATIONTYPE); }
    318 <S_RMTS>identifier	{ YYD; yywarn("it is obsoleted.  use \"my_identifier\"."); return(IDENTIFIER); }
    319 <S_RMTS>my_identifier	{ YYD; return(MY_IDENTIFIER); }
    320 <S_RMTS>xauth_login	{ YYD; return(XAUTH_LOGIN); /* formerly identifier type login */ }
    321 <S_RMTS>peers_identifier	{ YYD; return(PEERS_IDENTIFIER); }
    322 <S_RMTS>verify_identifier	{ YYD; return(VERIFY_IDENTIFIER); }
    323 <S_RMTS>certificate_type	{ YYD; return(CERTIFICATE_TYPE); }
    324 <S_RMTS>ca_type		{ YYD; return(CA_TYPE); }
    325 <S_RMTS>x509		{ YYD; yylval.num = ISAKMP_CERT_X509SIGN; return(CERT_X509); }
    326 <S_RMTS>plain_rsa	{ YYD; yylval.num = ISAKMP_CERT_PLAINRSA; return(CERT_PLAINRSA); }
    327 <S_RMTS>peers_certfile	{ YYD; return(PEERS_CERTFILE); }
    328 <S_RMTS>dnssec		{ YYD; return(DNSSEC); }
    329 <S_RMTS>verify_cert	{ YYD; return(VERIFY_CERT); }
    330 <S_RMTS>send_cert	{ YYD; return(SEND_CERT); }
    331 <S_RMTS>send_cr		{ YYD; return(SEND_CR); }
    332 <S_RMTS>dh_group	{ YYD; return(DH_GROUP); }
    333 <S_RMTS>nonce_size	{ YYD; return(NONCE_SIZE); }
    334 <S_RMTS>generate_policy	{ YYD; return(GENERATE_POLICY); }
    335 <S_RMTS>unique		{ YYD; yylval.num = GENERATE_POLICY_UNIQUE; return(GENERATE_LEVEL); }
    336 <S_RMTS>require		{ YYD; yylval.num = GENERATE_POLICY_REQUIRE; return(GENERATE_LEVEL); }
    337 <S_RMTS>support_mip6	{ YYD; yywarn("it is obsoleted.  use \"support_proxy\"."); return(SUPPORT_PROXY); }
    338 <S_RMTS>support_proxy	{ YYD; return(SUPPORT_PROXY); }
    339 <S_RMTS>initial_contact	{ YYD; return(INITIAL_CONTACT); }
    340 <S_RMTS>nat_traversal	{ YYD; return(NAT_TRAVERSAL); }
    341 <S_RMTS>force		{ YYD; return(REMOTE_FORCE_LEVEL); }
    342 <S_RMTS>proposal_check	{ YYD; return(PROPOSAL_CHECK); }
    343 <S_RMTS>obey		{ YYD; yylval.num = PROP_CHECK_OBEY; return(PROPOSAL_CHECK_LEVEL); }
    344 <S_RMTS>strict		{ YYD; yylval.num = PROP_CHECK_STRICT; return(PROPOSAL_CHECK_LEVEL); }
    345 <S_RMTS>exact		{ YYD; yylval.num = PROP_CHECK_EXACT; return(PROPOSAL_CHECK_LEVEL); }
    346 <S_RMTS>claim		{ YYD; yylval.num = PROP_CHECK_CLAIM; return(PROPOSAL_CHECK_LEVEL); }
    347 <S_RMTS>keepalive	{ YYD; return(KEEPALIVE); }
    348 <S_RMTS>passive		{ YYD; return(PASSIVE); }
    349 <S_RMTS>lifetime	{ YYD; return(LIFETIME); }
    350 <S_RMTS>time		{ YYD; return(LIFETYPE_TIME); }
    351 <S_RMTS>byte		{ YYD; return(LIFETYPE_BYTE); }
    352 <S_RMTS>dpd			{ YYD; return(DPD); }
    353 <S_RMTS>dpd_delay	{ YYD; return(DPD_DELAY); }
    354 <S_RMTS>dpd_retry	{ YYD; return(DPD_RETRY); }
    355 <S_RMTS>dpd_maxfail	{ YYD; return(DPD_MAXFAIL); }
    356 <S_RMTS>ph1id		{ YYD; return(PH1ID); }
    357 <S_RMTS>ike_frag	{ YYD; return(IKE_FRAG); }
    358 <S_RMTS>esp_frag	{ YYD; return(ESP_FRAG); }
    359 <S_RMTS>script		{ YYD; return(SCRIPT); }
    360 <S_RMTS>phase1_up	{ YYD; return(PHASE1_UP); }
    361 <S_RMTS>phase1_down	{ YYD; return(PHASE1_DOWN); }
    362 <S_RMTS>mode_cfg	{ YYD; return(MODE_CFG); }
    363 <S_RMTS>weak_phase1_check { YYD; return(WEAK_PHASE1_CHECK); }
    364 	/* remote proposal */
    365 <S_RMTS>proposal	{ BEGIN S_RMTP; YYDB; return(PROPOSAL); }
    366 <S_RMTP>{bcl}		{ return(BOC); }
    367 <S_RMTP>{ecl}		{ BEGIN S_RMTS; return(EOC); }
    368 <S_RMTP>lifetime	{ YYD; return(LIFETIME); }
    369 <S_RMTP>time		{ YYD; return(LIFETYPE_TIME); }
    370 <S_RMTP>byte		{ YYD; return(LIFETYPE_BYTE); }
    371 <S_RMTP>encryption_algorithm { YYD; yylval.num = algclass_isakmp_enc; return(ALGORITHM_CLASS); }
    372 <S_RMTP>authentication_method { YYD; yylval.num = algclass_isakmp_ameth; return(ALGORITHM_CLASS); }
    373 <S_RMTP>hash_algorithm	{ YYD; yylval.num = algclass_isakmp_hash; return(ALGORITHM_CLASS); }
    374 <S_RMTP>dh_group	{ YYD; return(DH_GROUP); }
    375 <S_RMTP>gss_id		{ YYD; return(GSS_ID); }
    376 <S_RMTP>gssapi_id	{ YYD; return(GSS_ID); } /* for back compatibility */
    377 
    378 	/* GSS ID encoding type (global) */
    379 <S_INI>gss_id_enc	{ BEGIN S_GSSENC; YYDB; return(GSS_ID_ENC); }
    380 <S_GSSENC>latin1	{ YYD; yylval.num = LC_GSSENC_LATIN1;
    381 				return(GSS_ID_ENCTYPE); }
    382 <S_GSSENC>utf-16le	{ YYD; yylval.num = LC_GSSENC_UTF16LE;
    383 				return(GSS_ID_ENCTYPE); }
    384 <S_GSSENC>{semi}	{ BEGIN S_INI; YYDB; return(EOS); }
    385 
    386 	/* parameter */
    387 on		{ YYD; yylval.num = TRUE; return(SWITCH); }
    388 off		{ YYD; yylval.num = FALSE; return(SWITCH); }
    389 
    390 	/* prefix */
    391 {slash}{digit}{1,3} {
    392 			YYD;
    393 			yytext++;
    394 			yylval.num = atoi(yytext);
    395 			return(PREFIX);
    396 		}
    397 
    398 	/* port number */
    399 {blcl}{decstring}{elcl}	{
    400 			char *p = yytext;
    401 			YYD;
    402 			while (*++p != ']') ;
    403 			*p = 0;
    404 			yytext++;
    405 			yylval.num = atoi(yytext);
    406 			return(PORT);
    407 		}
    408 
    409 	/* address range */
    410 {hyphen}{addrstring} {
    411                         YYD;
    412                         yytext++;
    413 			yylval.val = vmalloc(yyleng + 1);
    414 			if (yylval.val == NULL) {
    415 				yyerror("vmalloc failed");
    416 				return -1;
    417 			}
    418 			memcpy(yylval.val->v, yytext, yylval.val->l);
    419                         return(ADDRRANGE);
    420                 }
    421 
    422 	/* upper protocol */
    423 esp		{ YYD; yylval.num = IPPROTO_ESP; return(UL_PROTO); }
    424 ah		{ YYD; yylval.num = IPPROTO_AH; return(UL_PROTO); }
    425 ipcomp		{ YYD; yylval.num = IPPROTO_IPCOMP; return(UL_PROTO); }
    426 icmp		{ YYD; yylval.num = IPPROTO_ICMP; return(UL_PROTO); }
    427 icmp6		{ YYD; yylval.num = IPPROTO_ICMPV6; return(UL_PROTO); }
    428 tcp		{ YYD; yylval.num = IPPROTO_TCP; return(UL_PROTO); }
    429 udp		{ YYD; yylval.num = IPPROTO_UDP; return(UL_PROTO); }
    430 
    431 	/* algorithm type */
    432 des_iv64	{ YYD; yylval.num = algtype_des_iv64;	return(ALGORITHMTYPE); }
    433 des		{ YYD; yylval.num = algtype_des;	return(ALGORITHMTYPE); }
    434 3des		{ YYD; yylval.num = algtype_3des;	return(ALGORITHMTYPE); }
    435 rc5		{ YYD; yylval.num = algtype_rc5;	return(ALGORITHMTYPE); }
    436 idea 		{ YYD; yylval.num = algtype_idea;	return(ALGORITHMTYPE); }
    437 cast128		{ YYD; yylval.num = algtype_cast128;	return(ALGORITHMTYPE); }
    438 blowfish	{ YYD; yylval.num = algtype_blowfish;	return(ALGORITHMTYPE); }
    439 3idea		{ YYD; yylval.num = algtype_3idea;	return(ALGORITHMTYPE); }
    440 des_iv32	{ YYD; yylval.num = algtype_des_iv32;	return(ALGORITHMTYPE); }
    441 rc4 		{ YYD; yylval.num = algtype_rc4;	return(ALGORITHMTYPE); }
    442 null_enc	{ YYD; yylval.num = algtype_null_enc;	return(ALGORITHMTYPE); }
    443 null		{ YYD; yylval.num = algtype_null_enc;	return(ALGORITHMTYPE); }
    444 aes		{ YYD; yylval.num = algtype_aes;	return(ALGORITHMTYPE); }
    445 rijndael	{ YYD; yylval.num = algtype_aes;	return(ALGORITHMTYPE); }
    446 twofish		{ YYD; yylval.num = algtype_twofish;	return(ALGORITHMTYPE); }
    447 camellia	{ YYD; yylval.num = algtype_camellia;	return(ALGORITHMTYPE); }
    448 non_auth	{ YYD; yylval.num = algtype_non_auth;	return(ALGORITHMTYPE); }
    449 hmac_md5	{ YYD; yylval.num = algtype_hmac_md5;	return(ALGORITHMTYPE); }
    450 hmac_sha1	{ YYD; yylval.num = algtype_hmac_sha1;	return(ALGORITHMTYPE); }
    451 hmac_sha2_256	{ YYD; yylval.num = algtype_hmac_sha2_256;	return(ALGORITHMTYPE); }
    452 hmac_sha256	{ YYD; yylval.num = algtype_hmac_sha2_256;	return(ALGORITHMTYPE); }
    453 hmac_sha2_384	{ YYD; yylval.num = algtype_hmac_sha2_384;	return(ALGORITHMTYPE); }
    454 hmac_sha384	{ YYD; yylval.num = algtype_hmac_sha2_384;	return(ALGORITHMTYPE); }
    455 hmac_sha2_512	{ YYD; yylval.num = algtype_hmac_sha2_512;	return(ALGORITHMTYPE); }
    456 hmac_sha512	{ YYD; yylval.num = algtype_hmac_sha2_512;	return(ALGORITHMTYPE); }
    457 des_mac		{ YYD; yylval.num = algtype_des_mac;	return(ALGORITHMTYPE); }
    458 kpdk		{ YYD; yylval.num = algtype_kpdk;	return(ALGORITHMTYPE); }
    459 md5		{ YYD; yylval.num = algtype_md5;	return(ALGORITHMTYPE); }
    460 sha1		{ YYD; yylval.num = algtype_sha1;	return(ALGORITHMTYPE); }
    461 tiger		{ YYD; yylval.num = algtype_tiger;	return(ALGORITHMTYPE); }
    462 sha2_256	{ YYD; yylval.num = algtype_sha2_256;	return(ALGORITHMTYPE); }
    463 sha256		{ YYD; yylval.num = algtype_sha2_256;	return(ALGORITHMTYPE); }
    464 sha2_384	{ YYD; yylval.num = algtype_sha2_384;	return(ALGORITHMTYPE); }
    465 sha384		{ YYD; yylval.num = algtype_sha2_384;	return(ALGORITHMTYPE); }
    466 sha2_512	{ YYD; yylval.num = algtype_sha2_512;	return(ALGORITHMTYPE); }
    467 sha512		{ YYD; yylval.num = algtype_sha2_512;	return(ALGORITHMTYPE); }
    468 oui		{ YYD; yylval.num = algtype_oui;	return(ALGORITHMTYPE); }
    469 deflate		{ YYD; yylval.num = algtype_deflate;	return(ALGORITHMTYPE); }
    470 lzs		{ YYD; yylval.num = algtype_lzs;	return(ALGORITHMTYPE); }
    471 modp768		{ YYD; yylval.num = algtype_modp768;	return(ALGORITHMTYPE); }
    472 modp1024	{ YYD; yylval.num = algtype_modp1024;	return(ALGORITHMTYPE); }
    473 modp1536	{ YYD; yylval.num = algtype_modp1536;	return(ALGORITHMTYPE); }
    474 ec2n155		{ YYD; yylval.num = algtype_ec2n155;	return(ALGORITHMTYPE); }
    475 ec2n185		{ YYD; yylval.num = algtype_ec2n185;	return(ALGORITHMTYPE); }
    476 modp2048	{ YYD; yylval.num = algtype_modp2048;	return(ALGORITHMTYPE); }
    477 modp3072	{ YYD; yylval.num = algtype_modp3072;	return(ALGORITHMTYPE); }
    478 modp4096	{ YYD; yylval.num = algtype_modp4096;	return(ALGORITHMTYPE); }
    479 modp6144	{ YYD; yylval.num = algtype_modp6144;	return(ALGORITHMTYPE); }
    480 modp8192	{ YYD; yylval.num = algtype_modp8192;	return(ALGORITHMTYPE); }
    481 pre_shared_key	{ YYD; yylval.num = algtype_psk;	return(ALGORITHMTYPE); }
    482 rsasig		{ YYD; yylval.num = algtype_rsasig;	return(ALGORITHMTYPE); }
    483 dsssig		{ YYD; yylval.num = algtype_dsssig;	return(ALGORITHMTYPE); }
    484 rsaenc		{ YYD; yylval.num = algtype_rsaenc;	return(ALGORITHMTYPE); }
    485 rsarev		{ YYD; yylval.num = algtype_rsarev;	return(ALGORITHMTYPE); }
    486 gssapi_krb	{ YYD; yylval.num = algtype_gssapikrb;	return(ALGORITHMTYPE); }
    487 hybrid_rsa_server {
    488 #ifdef ENABLE_HYBRID
    489 	YYD; yylval.num = algtype_hybrid_rsa_s; return(ALGORITHMTYPE);
    490 #else
    491 	yyerror("racoon not configured with --enable-hybrid");
    492 #endif
    493 }
    494 hybrid_dss_server {
    495 #ifdef ENABLE_HYBRID
    496 	YYD; yylval.num = algtype_hybrid_dss_s; return(ALGORITHMTYPE);
    497 #else
    498 	yyerror("racoon not configured with --enable-hybrid");
    499 #endif
    500 }
    501 hybrid_rsa_client {
    502 #ifdef ENABLE_HYBRID
    503 	YYD; yylval.num = algtype_hybrid_rsa_c; return(ALGORITHMTYPE);
    504 #else
    505 	yyerror("racoon not configured with --enable-hybrid");
    506 #endif
    507 }
    508 hybrid_dss_client {
    509 #ifdef ENABLE_HYBRID
    510 	YYD; yylval.num = algtype_hybrid_dss_c; return(ALGORITHMTYPE);
    511 #else
    512 	yyerror("racoon not configured with --enable-hybrid");
    513 #endif
    514 }
    515 xauth_psk_server {
    516 #ifdef ENABLE_HYBRID
    517 	YYD; yylval.num = algtype_xauth_psk_s; return(ALGORITHMTYPE);
    518 #else
    519 	yyerror("racoon not configured with --enable-hybrid");
    520 #endif
    521 }
    522 xauth_psk_client {
    523 #ifdef ENABLE_HYBRID
    524 	YYD; yylval.num = algtype_xauth_psk_c; return(ALGORITHMTYPE);
    525 #else
    526 	yyerror("racoon not configured with --enable-hybrid");
    527 #endif
    528 }
    529 xauth_rsa_server {
    530 #ifdef ENABLE_HYBRID
    531 	YYD; yylval.num = algtype_xauth_rsa_s; return(ALGORITHMTYPE);
    532 #else
    533 	yyerror("racoon not configured with --enable-hybrid");
    534 #endif
    535 }
    536 xauth_rsa_client {
    537 #ifdef ENABLE_HYBRID
    538 	YYD; yylval.num = algtype_xauth_rsa_c; return(ALGORITHMTYPE);
    539 #else
    540 	yyerror("racoon not configured with --enable-hybrid");
    541 #endif
    542 }
    543 
    544 
    545 	/* identifier type */
    546 vendor_id	{ YYD; yywarn("it is obsoleted."); return(VENDORID); }
    547 user_fqdn	{ YYD; yylval.num = IDTYPE_USERFQDN; return(IDENTIFIERTYPE); }
    548 fqdn		{ YYD; yylval.num = IDTYPE_FQDN; return(IDENTIFIERTYPE); }
    549 keyid		{ YYD; yylval.num = IDTYPE_KEYID; return(IDENTIFIERTYPE); }
    550 address		{ YYD; yylval.num = IDTYPE_ADDRESS; return(IDENTIFIERTYPE); }
    551 subnet		{ YYD; yylval.num = IDTYPE_SUBNET; return(IDENTIFIERTYPE); }
    552 asn1dn		{ YYD; yylval.num = IDTYPE_ASN1DN; return(IDENTIFIERTYPE); }
    553 certname	{ YYD; yywarn("certname will be obsoleted in near future."); yylval.num = IDTYPE_ASN1DN; return(IDENTIFIERTYPE); }
    554 
    555 	/* identifier qualifier */
    556 tag		{ YYD; yylval.num = IDQUAL_TAG;  return(IDENTIFIERQUAL); }
    557 file		{ YYD; yylval.num = IDQUAL_FILE; return(IDENTIFIERQUAL); }
    558 
    559 	/* units */
    560 B|byte|bytes		{ YYD; return(UNITTYPE_BYTE); }
    561 KB			{ YYD; return(UNITTYPE_KBYTES); }
    562 MB			{ YYD; return(UNITTYPE_MBYTES); }
    563 TB			{ YYD; return(UNITTYPE_TBYTES); }
    564 sec|secs|second|seconds	{ YYD; return(UNITTYPE_SEC); }
    565 min|mins|minute|minutes	{ YYD; return(UNITTYPE_MIN); }
    566 hour|hours		{ YYD; return(UNITTYPE_HOUR); }
    567 
    568 	/* boolean */
    569 yes		{ YYD; yylval.num = TRUE; return(BOOLEAN); }
    570 no		{ YYD; yylval.num = FALSE; return(BOOLEAN); }
    571 
    572 {decstring}	{
    573 			char *bp;
    574 
    575 			YYD;
    576 			yylval.num = strtol(yytext, &bp, 10);
    577 			return(NUMBER);
    578 		}
    579 
    580 {hexstring}	{
    581 			char *p;
    582 
    583 			YYD;
    584 			yylval.val = vmalloc(yyleng + (yyleng & 1) + 1);
    585 			if (yylval.val == NULL) {
    586 				yyerror("vmalloc failed");
    587 				return -1;
    588 			}
    589 
    590 			p = yylval.val->v;
    591 			*p++ = '0';
    592 			*p++ = 'x';
    593 
    594 			/* fixed string if length is odd. */
    595 			if (yyleng & 1)
    596 				*p++ = '0';
    597 			memcpy(p, &yytext[2], yyleng - 1);
    598 
    599 			return(HEXSTRING);
    600 		}
    601 
    602 {quotedstring}	{
    603 			char *p = yytext;
    604 
    605 			YYD;
    606 			while (*++p != '"') ;
    607 			*p = '\0';
    608 
    609 			yylval.val = vmalloc(yyleng - 1);
    610 			if (yylval.val == NULL) {
    611 				yyerror("vmalloc failed");
    612 				return -1;
    613 			}
    614 			memcpy(yylval.val->v, &yytext[1], yylval.val->l);
    615 
    616 			return(QUOTEDSTRING);
    617 		}
    618 
    619 {addrstring}	{
    620 			YYD;
    621 
    622 			yylval.val = vmalloc(yyleng + 1);
    623 			if (yylval.val == NULL) {
    624 				yyerror("vmalloc failed");
    625 				return -1;
    626 			}
    627 			memcpy(yylval.val->v, yytext, yylval.val->l);
    628 
    629 			return(ADDRSTRING);
    630 		}
    631 
    632 <<EOF>>		{
    633 			yy_delete_buffer(YY_CURRENT_BUFFER);
    634 			incstackp--;
    635     nextfile:
    636 			if (incstack[incstackp].matchon <
    637 			    incstack[incstackp].matches.gl_pathc) {
    638 				char* filepath = incstack[incstackp].matches.gl_pathv[incstack[incstackp].matchon];
    639 				incstack[incstackp].matchon++;
    640 				incstackp++;
    641 				if (yycf_set_buffer(filepath) != 0) {
    642 					incstackp--;
    643 					goto nextfile;
    644 				}
    645 				yy_switch_to_buffer(yy_create_buffer(yyin, YY_BUF_SIZE));
    646 				BEGIN(S_INI);
    647 			} else {
    648 				globfree(&incstack[incstackp].matches);
    649 				if (incstackp == 0)
    650 					yyterminate();
    651 				else
    652 					yy_switch_to_buffer(incstack[incstackp].prevstate);
    653 			}
    654 		}
    655 
    656 	/* ... */
    657 {ws}		{ ; }
    658 {nl}		{ incstack[incstackp].lineno++; }
    659 {comment}	{ YYD; }
    660 {semi}		{ return(EOS); }
    661 .		{ yymore(); }
    662 
    663 %%
    664 
    665 void
    666 yyerror(char *s, ...)
    667 {
    668 	char fmt[512];
    669 
    670 	va_list ap;
    671 #ifdef HAVE_STDARG_H
    672 	va_start(ap, s);
    673 #else
    674 	va_start(ap);
    675 #endif
    676 	snprintf(fmt, sizeof(fmt), "%s:%d: \"%s\" %s\n",
    677 		incstack[incstackp].path, incstack[incstackp].lineno,
    678 		yytext, s);
    679 	plogv(LLV_ERROR, LOCATION, NULL, fmt, ap);
    680 	va_end(ap);
    681 
    682 	yyerrorcount++;
    683 }
    684 
    685 void
    686 yywarn(char *s, ...)
    687 {
    688 	char fmt[512];
    689 
    690 	va_list ap;
    691 #ifdef HAVE_STDARG_H
    692 	va_start(ap, s);
    693 #else
    694 	va_start(ap);
    695 #endif
    696 	snprintf(fmt, sizeof(fmt), "%s:%d: \"%s\" %s\n",
    697 		incstack[incstackp].path, incstack[incstackp].lineno,
    698 		yytext, s);
    699 	plogv(LLV_WARNING, LOCATION, NULL, fmt, ap);
    700 	va_end(ap);
    701 }
    702 
    703 int
    704 yycf_switch_buffer(path)
    705 	char *path;
    706 {
    707 	char *filepath = NULL;
    708 
    709 	/* got the include file name */
    710 	if (incstackp >= MAX_INCLUDE_DEPTH) {
    711 		plog(LLV_ERROR, LOCATION, NULL,
    712 			"Includes nested too deeply");
    713 		return -1;
    714 	}
    715 
    716 	if (glob(path, GLOB_TILDE, NULL, &incstack[incstackp].matches) != 0 ||
    717 	    incstack[incstackp].matches.gl_pathc == 0) {
    718 		plog(LLV_ERROR, LOCATION, NULL,
    719 			"glob found no matches for path \"%s\"\n", path);
    720 		return -1;
    721 	}
    722 	incstack[incstackp].matchon = 0;
    723 	incstack[incstackp].prevstate = YY_CURRENT_BUFFER;
    724 
    725     nextmatch:
    726 	if (incstack[incstackp].matchon >= incstack[incstackp].matches.gl_pathc)
    727 		return -1;
    728 	filepath =
    729 	    incstack[incstackp].matches.gl_pathv[incstack[incstackp].matchon];
    730 	incstack[incstackp].matchon++;
    731 	incstackp++;
    732 
    733 	if (yycf_set_buffer(filepath) != 0) {
    734 	      incstackp--;
    735 	      goto nextmatch;
    736 	}
    737 
    738 	yy_switch_to_buffer(yy_create_buffer(yyin, YY_BUF_SIZE));
    739 
    740 	BEGIN(S_INI);
    741 
    742 	return 0;
    743 }
    744 
    745 int
    746 yycf_set_buffer(path)
    747 	char *path;
    748 {
    749 	yyin = fopen(path, "r");
    750 	if (yyin == NULL) {
    751 		fprintf(stderr, "failed to open file %s (%s)\n",
    752 			path, strerror(errno));
    753 		plog(LLV_ERROR, LOCATION, NULL,
    754 			"failed to open file %s (%s)\n",
    755 			path, strerror(errno));
    756 		return -1;
    757 	}
    758 
    759 	/* initialize */
    760 	incstack[incstackp].fp = yyin;
    761 	if (incstack[incstackp].path != NULL)
    762 		racoon_free(incstack[incstackp].path);
    763 	incstack[incstackp].path = racoon_strdup(path);
    764 	STRDUP_FATAL(incstack[incstackp].path);
    765 	incstack[incstackp].lineno = 1;
    766 	plog(LLV_DEBUG, LOCATION, NULL,
    767 		"reading config file %s\n", path);
    768 
    769 	return 0;
    770 }
    771 
    772 void
    773 yycf_init_buffer()
    774 {
    775 	int i;
    776 
    777 	for (i = 0; i < MAX_INCLUDE_DEPTH; i++)
    778 		memset(&incstack[i], 0, sizeof(incstack[i]));
    779 	incstackp = 0;
    780 }
    781 
    782 void
    783 yycf_clean_buffer()
    784 {
    785 	int i;
    786 
    787 	for (i = 0; i < MAX_INCLUDE_DEPTH; i++) {
    788 		if (incstack[i].path != NULL) {
    789 			fclose(incstack[i].fp);
    790 			racoon_free(incstack[i].path);
    791 			incstack[i].path = NULL;
    792 		}
    793 	}
    794 }
    795 
    796