/* $KAME: cftoken.l,v 1.69 2002/09/27 06:03:51 itojun Exp $ */ %{ #include #include #include #include #include #include #include #include #include #include #include #include #ifdef HAVE_STDARG_H #include #else #include #endif #include "var.h" #include "misc.h" #include "vmbuf.h" #include "plog.h" #include "debug.h" #include "algorithm.h" #include "cfparse.h" #include "cftoken.h" #include "localconf.h" #include "oakley.h" #include "isakmp_var.h" #include "isakmp.h" #include "ipsec_doi.h" #include "proposal.h" #ifdef GC #include "gcmalloc.h" #endif /*#include "y.tab.h"*/ int yyerrorcount = 0; #if defined(YIPS_DEBUG) # define YYDB plog(LLV_DEBUG2, LOCATION, NULL, \ "begin <%d>%s\n", yy_start, yytext); # define YYD { \ plog(LLV_DEBUG2, LOCATION, NULL, "<%d>%s", \ yy_start, loglevel >= LLV_DEBUG2 ? "\n" : ""); \ } #else # define YYDB # define YYD #endif /* defined(YIPS_DEBUG) */ #define MAX_INCLUDE_DEPTH 10 static struct include_stack { char *path; FILE *fp; YY_BUFFER_STATE prevstate; int lineno; glob_t matches; int matchon; } incstack[MAX_INCLUDE_DEPTH]; static int incstackp = 0; static int yy_first_time = 1; %} /* common section */ nl \n ws [ \t]+ digit [0-9] letter [A-Za-z] hexdigit [0-9A-Fa-f] /*octet (([01]?{digit}?{digit})|((2([0-4]{digit}))|(25[0-5]))) */ special [()+\|\?\*] comma \, dot \. slash \/ bcl \{ ecl \} blcl \[ elcl \] percent \% semi \; comment \#.* ccomment "/*" bracketstring \<[^>]*\> quotedstring \"[^"]*\" addrstring [a-fA-F0-9:]([a-fA-F0-9:\.]*|[a-fA-F0-9:\.]*%[a-zA-Z0-9]*) decstring {digit}+ hexstring 0x{hexdigit}+ %s S_INI S_PTH S_INF S_LOG S_PAD S_LST S_RTRY %s S_ALGST S_ALGCL %s S_SAINF S_SAINFS %s S_RMT S_RMTS S_RMTP %s S_SA %% %{ if (yy_first_time) { BEGIN S_INI; yy_first_time = 0; } %} /* path */ path { BEGIN S_PTH; YYDB; return(PATH); } include { YYD; yylval.num = LC_PATHTYPE_INCLUDE; return(PATHTYPE); } pre_shared_key { YYD; yylval.num = LC_PATHTYPE_PSK; return(PATHTYPE); } certificate { YYD; yylval.num = LC_PATHTYPE_CERT; return(PATHTYPE); } backupsa { YYD; yylval.num = LC_PATHTYPE_BACKUPSA; return(PATHTYPE); } {semi} { BEGIN S_INI; YYDB; return(EOS); } /* include */ include { YYDB; return(INCLUDE); } /* self information */ identifier { BEGIN S_INF; YYDB; yywarn("it is obsoleted. use \"my_identifier\" in each remote directives."); return(IDENTIFIER); } {semi} { BEGIN S_INI; return(EOS); } /* special */ complex_bundle { YYDB; return(COMPLEX_BUNDLE); } /* logging */ log { BEGIN S_LOG; YYDB; return(LOGGING); } info { YYD; yywarn("it is obsoleted. use \"notify\""); yylval.num = 0; return(LOGLEV); } notify { YYD; yylval.num = 0; return(LOGLEV); } debug { YYD; yylval.num = 1; return(LOGLEV); } debug2 { YYD; yylval.num = 2; return(LOGLEV); } debug3 { YYD; yywarn("it is osboleted. use \"debug2\""); yylval.num = 2; return(LOGLEV); } debug4 { YYD; yywarn("it is obsoleted. use \"debug2\""); yylval.num = 2; return(LOGLEV); } {semi} { BEGIN S_INI; return(EOS); } /* padding */ padding { BEGIN S_PAD; YYDB; return(PADDING); } {bcl} { return(BOC); } randomize { YYD; return(PAD_RANDOMIZE); } randomize_length { YYD; return(PAD_RANDOMIZELEN); } maximum_length { YYD; return(PAD_MAXLEN); } strict_check { YYD; return(PAD_STRICT); } exclusive_tail { YYD; return(PAD_EXCLTAIL); } {ecl} { BEGIN S_INI; return(EOC); } /* listen */ listen { BEGIN S_LST; YYDB; return(LISTEN); } {bcl} { return(BOC); } isakmp { YYD; return(X_ISAKMP); } admin { YYD; return(X_ADMIN); } strict_address { YYD; return(STRICT_ADDRESS); } {ecl} { BEGIN S_INI; return(EOC); } /* timer */ timer { BEGIN S_RTRY; YYDB; return(RETRY); } {bcl} { return(BOC); } counter { YYD; return(RETRY_COUNTER); } interval { YYD; return(RETRY_INTERVAL); } persend { YYD; return(RETRY_PERSEND); } phase1 { YYD; return(RETRY_PHASE1); } phase2 { YYD; return(RETRY_PHASE2); } {ecl} { BEGIN S_INI; return(EOC); } /* sainfo */ sainfo { BEGIN S_SAINF; YYDB; return(SAINFO); } anonymous { YYD; return(ANONYMOUS); } {blcl}any{elcl} { YYD; return(PORTANY); } any { YYD; return(ANY); } /* sainfo spec */ {bcl} { BEGIN S_SAINFS; return(BOC); } {semi} { BEGIN S_INI; return(EOS); } {ecl} { BEGIN S_INI; return(EOC); } pfs_group { YYD; return(PFS_GROUP); } identifier { YYD; yywarn("it is obsoleted. use \"my_identifier\"."); return(IDENTIFIER); } my_identifier { YYD; return(MY_IDENTIFIER); } lifetime { YYD; return(LIFETIME); } time { YYD; return(LIFETYPE_TIME); } byte { YYD; return(LIFETYPE_BYTE); } encryption_algorithm { YYD; yylval.num = algclass_ipsec_enc; return(ALGORITHM_CLASS); } authentication_algorithm { YYD; yylval.num = algclass_ipsec_auth; return(ALGORITHM_CLASS); } compression_algorithm { YYD; yylval.num = algclass_ipsec_comp; return(ALGORITHM_CLASS); } {comma} { YYD; return(COMMA); } /* remote */ remote { BEGIN S_RMT; YYDB; return(REMOTE); } anonymous { YYD; return(ANONYMOUS); } /* remote spec */ {bcl} { BEGIN S_RMTS; return(BOC); } {ecl} { BEGIN S_INI; return(EOC); } exchange_mode { YYD; return(EXCHANGE_MODE); } {comma} { YYD; /* XXX ignored, but to be handled. */ ; } base { YYD; yylval.num = ISAKMP_ETYPE_BASE; return(EXCHANGETYPE); } main { YYD; yylval.num = ISAKMP_ETYPE_IDENT; return(EXCHANGETYPE); } aggressive { YYD; yylval.num = ISAKMP_ETYPE_AGG; return(EXCHANGETYPE); } doi { YYD; return(DOI); } ipsec_doi { YYD; yylval.num = IPSEC_DOI; return(DOITYPE); } situation { YYD; return(SITUATION); } identity_only { YYD; yylval.num = IPSECDOI_SIT_IDENTITY_ONLY; return(SITUATIONTYPE); } secrecy { YYD; yylval.num = IPSECDOI_SIT_SECRECY; return(SITUATIONTYPE); } integrity { YYD; yylval.num = IPSECDOI_SIT_INTEGRITY; return(SITUATIONTYPE); } identifier { YYD; yywarn("it is obsoleted. use \"my_identifier\"."); return(IDENTIFIER); } my_identifier { YYD; return(MY_IDENTIFIER); } peers_identifier { YYD; return(PEERS_IDENTIFIER); } verify_identifier { YYD; return(VERIFY_IDENTIFIER); } open_dir_auth_group { YYD; return(OPEN_DIR_AUTH_GROUP); } certificate_type { YYD; return(CERTIFICATE_TYPE); } shared_secret { YYD; return(SHARED_SECRET); } x509 { YYD; yylval.num = ISAKMP_CERT_X509SIGN; return(CERT_X509); } in_keychain { YYD; return(IN_KEYCHAIN); } certificate_verification { YYD; return(CERTIFICATE_VERIFICATION); } peers_certfile { YYD; return(PEERS_CERTFILE); } dnssec { YYD; return(DNSSEC); } verify_cert { YYD; return(VERIFY_CERT); } send_cert { YYD; return(SEND_CERT); } send_cr { YYD; return(SEND_CR); } dh_group { YYD; return(DH_GROUP); } nonce_size { YYD; return(NONCE_SIZE); } generate_policy { YYD; return(GENERATE_POLICY); } support_mip6 { YYD; return(SUPPORT_MIP6); } initial_contact { YYD; return(INITIAL_CONTACT); } proposal_check { YYD; return(PROPOSAL_CHECK); } obey { YYD; yylval.num = PROP_CHECK_OBEY; return(PROPOSAL_CHECK_LEVEL); } strict { YYD; yylval.num = PROP_CHECK_STRICT; return(PROPOSAL_CHECK_LEVEL); } exact { YYD; yylval.num = PROP_CHECK_EXACT; return(PROPOSAL_CHECK_LEVEL); } claim { YYD; yylval.num = PROP_CHECK_CLAIM; return(PROPOSAL_CHECK_LEVEL); } keepalive { YYD; return(KEEPALIVE); } passive { YYD; return(PASSIVE); } lifetime { YYD; return(LIFETIME); } time { YYD; return(LIFETYPE_TIME); } byte { YYD; return(LIFETYPE_BYTE); } /* remote proposal */ proposal { BEGIN S_RMTP; YYDB; return(PROPOSAL); } {bcl} { return(BOC); } {ecl} { BEGIN S_RMTS; return(EOC); } lifetime { YYD; return(LIFETIME); } time { YYD; return(LIFETYPE_TIME); } byte { YYD; return(LIFETYPE_BYTE); } encryption_algorithm { YYD; yylval.num = algclass_isakmp_enc; return(ALGORITHM_CLASS); } authentication_method { YYD; yylval.num = algclass_isakmp_ameth; return(ALGORITHM_CLASS); } hash_algorithm { YYD; yylval.num = algclass_isakmp_hash; return(ALGORITHM_CLASS); } dh_group { YYD; return(DH_GROUP); } gssapi_id { YYD; return(GSSAPI_ID); } /* parameter */ on { YYD; yylval.num = TRUE; return(SWITCH); } off { YYD; yylval.num = FALSE; return(SWITCH); } /* prefix */ {slash}{digit}{1,3} { YYD; yytext++; yylval.num = atoi(yytext); return(PREFIX); } /* port number */ {blcl}{decstring}{elcl} { char *p = yytext; YYD; while (*++p != ']') ; *p = NULL; yytext++; yylval.num = atoi(yytext); return(PORT); } /* upper protocol */ esp { YYD; yylval.num = IPPROTO_ESP; return(UL_PROTO); } ah { YYD; yylval.num = IPPROTO_AH; return(UL_PROTO); } ipcomp { YYD; yylval.num = IPPROTO_IPCOMP; return(UL_PROTO); } icmp { YYD; yylval.num = IPPROTO_ICMP; return(UL_PROTO); } icmp6 { YYD; yylval.num = IPPROTO_ICMPV6; return(UL_PROTO); } tcp { YYD; yylval.num = IPPROTO_TCP; return(UL_PROTO); } udp { YYD; yylval.num = IPPROTO_UDP; return(UL_PROTO); } /* algorithm type */ des_iv64 { YYD; yylval.num = algtype_des_iv64; return(ALGORITHMTYPE); } des { YYD; yylval.num = algtype_des; return(ALGORITHMTYPE); } 3des { YYD; yylval.num = algtype_3des; return(ALGORITHMTYPE); } rc5 { YYD; yylval.num = algtype_rc5; return(ALGORITHMTYPE); } idea { YYD; yylval.num = algtype_idea; return(ALGORITHMTYPE); } cast128 { YYD; yylval.num = algtype_cast128; return(ALGORITHMTYPE); } blowfish { YYD; yylval.num = algtype_blowfish; return(ALGORITHMTYPE); } 3idea { YYD; yylval.num = algtype_3idea; return(ALGORITHMTYPE); } des_iv32 { YYD; yylval.num = algtype_des_iv32; return(ALGORITHMTYPE); } rc4 { YYD; yylval.num = algtype_rc4; return(ALGORITHMTYPE); } null_enc { YYD; yylval.num = algtype_null_enc; return(ALGORITHMTYPE); } rijndael { YYD; yylval.num = algtype_rijndael; return(ALGORITHMTYPE); } aes { YYD; yylval.num = algtype_rijndael; return(ALGORITHMTYPE); } twofish { YYD; yylval.num = algtype_twofish; return(ALGORITHMTYPE); } non_auth { YYD; yylval.num = algtype_non_auth; return(ALGORITHMTYPE); } hmac_md5 { YYD; yylval.num = algtype_hmac_md5; return(ALGORITHMTYPE); } hmac_sha1 { YYD; yylval.num = algtype_hmac_sha1; return(ALGORITHMTYPE); } hmac_sha2_256 { YYD; yylval.num = algtype_hmac_sha2_256; return(ALGORITHMTYPE); } hmac_sha2_384 { YYD; yylval.num = algtype_hmac_sha2_384; return(ALGORITHMTYPE); } hmac_sha2_512 { YYD; yylval.num = algtype_hmac_sha2_512; return(ALGORITHMTYPE); } des_mac { YYD; yylval.num = algtype_des_mac; return(ALGORITHMTYPE); } kpdk { YYD; yylval.num = algtype_kpdk; return(ALGORITHMTYPE); } md5 { YYD; yylval.num = algtype_md5; return(ALGORITHMTYPE); } sha1 { YYD; yylval.num = algtype_sha1; return(ALGORITHMTYPE); } tiger { YYD; yylval.num = algtype_tiger; return(ALGORITHMTYPE); } sha2_256 { YYD; yylval.num = algtype_sha2_256; return(ALGORITHMTYPE); } sha2_384 { YYD; yylval.num = algtype_sha2_384; return(ALGORITHMTYPE); } sha2_512 { YYD; yylval.num = algtype_sha2_512; return(ALGORITHMTYPE); } oui { YYD; yylval.num = algtype_oui; return(ALGORITHMTYPE); } deflate { YYD; yylval.num = algtype_deflate; return(ALGORITHMTYPE); } lzs { YYD; yylval.num = algtype_lzs; return(ALGORITHMTYPE); } modp768 { YYD; yylval.num = algtype_modp768; return(ALGORITHMTYPE); } modp1024 { YYD; yylval.num = algtype_modp1024; return(ALGORITHMTYPE); } modp1536 { YYD; yylval.num = algtype_modp1536; return(ALGORITHMTYPE); } ec2n155 { YYD; yylval.num = algtype_ec2n155; return(ALGORITHMTYPE); } ec2n185 { YYD; yylval.num = algtype_ec2n185; return(ALGORITHMTYPE); } modp2048 { YYD; yylval.num = algtype_modp2048; return(ALGORITHMTYPE); } modp3072 { YYD; yylval.num = algtype_modp3072; return(ALGORITHMTYPE); } modp4096 { YYD; yylval.num = algtype_modp4096; return(ALGORITHMTYPE); } modp6144 { YYD; yylval.num = algtype_modp6144; return(ALGORITHMTYPE); } modp8192 { YYD; yylval.num = algtype_modp8192; return(ALGORITHMTYPE); } pre_shared_key { YYD; yylval.num = algtype_psk; return(ALGORITHMTYPE); } rsasig { YYD; yylval.num = algtype_rsasig; return(ALGORITHMTYPE); } dsssig { YYD; yylval.num = algtype_dsssig; return(ALGORITHMTYPE); } rsaenc { YYD; yylval.num = algtype_rsaenc; return(ALGORITHMTYPE); } rsarev { YYD; yylval.num = algtype_rsarev; return(ALGORITHMTYPE); } gssapi_krb { YYD; yylval.num = algtype_gssapikrb; return(ALGORITHMTYPE); } /* identifier type */ vendor_id { YYD; yywarn("it is obsoleted."); return(VENDORID); } user_fqdn { YYD; yylval.num = IDTYPE_USERFQDN; return(IDENTIFIERTYPE); } fqdn { YYD; yylval.num = IDTYPE_FQDN; return(IDENTIFIERTYPE); } keyid { YYD; yylval.num = IDTYPE_KEYID; return(IDENTIFIERTYPE); } keyid_use { YYD; yylval.num = IDTYPE_KEYIDUSE; return(IDENTIFIERTYPE); } address { YYD; yylval.num = IDTYPE_ADDRESS; return(IDENTIFIERTYPE); } asn1dn { YYD; yylval.num = IDTYPE_ASN1DN; return(IDENTIFIERTYPE); } certname { YYD; yywarn("certname will be obsoleted in near future."); yylval.num = IDTYPE_ASN1DN; return(IDENTIFIERTYPE); } /* shared secret type */ use { YYD; yylval.num = SECRETTYPE_USE; return(SECRETTYPE); } key { YYD; yylval.num = SECRETTYPE_KEY; return(SECRETTYPE); } keychain { YYD; yylval.num = SECRETTYPE_KEYCHAIN; return(SECRETTYPE); } /* certificate verification */ openssl { YYD; yylval.num = VERIFICATION_MODULE_OPENSSL; return(VERIFICATION_MODULE); } sec_framework { YYD; yylval.num = VERIFICATION_MODULE_SEC_FRAMEWORK; return(VERIFICATION_MODULE); } use_open_dir { YYD; yylval.num = VERIFICATION_OPTION_OPEN_DIR; return(VERIFICATION_OPTION); } use_peers_identifier { YYD; yylval.num = VERIFICATION_OPTION_PEERS_IDENTIFIER; return(VERIFICATION_OPTION); } /* units */ B|byte|bytes { YYD; return(UNITTYPE_BYTE); } KB { YYD; return(UNITTYPE_KBYTES); } MB { YYD; return(UNITTYPE_MBYTES); } TB { YYD; return(UNITTYPE_TBYTES); } sec|secs|second|seconds { YYD; return(UNITTYPE_SEC); } min|mins|minute|minutes { YYD; return(UNITTYPE_MIN); } hour|hours { YYD; return(UNITTYPE_HOUR); } /* boolean */ yes { YYD; yylval.num = TRUE; return(BOOLEAN); } no { YYD; yylval.num = FALSE; return(BOOLEAN); } {decstring} { char *bp; YYD; yylval.num = strtol(yytext, &bp, 10); return(NUMBER); } {hexstring} { char *p; YYD; yylval.val = vmalloc(yyleng + (yyleng & 1) + 1); if (yylval.val == NULL) { yyerror("vmalloc failed"); return -1; } p = yylval.val->v; *p++ = '0'; *p++ = 'x'; /* fixed string if length is odd. */ if (yyleng & 1) *p++ = '0'; memcpy(p, &yytext[2], yyleng - 1); return(HEXSTRING); } {quotedstring} { u_char *p = yytext; YYD; while (*++p != '"') ; *p = '\0'; yylval.val = vmalloc(yyleng - 1); if (yylval.val == NULL) { yyerror("vmalloc failed"); return -1; } memcpy(yylval.val->v, &yytext[1], yylval.val->l); return(QUOTEDSTRING); } {addrstring} { YYD; yylval.val = vmalloc(yyleng + 1); if (yylval.val == NULL) { yyerror("vmalloc failed"); return -1; } memcpy(yylval.val->v, yytext, yylval.val->l); return(ADDRSTRING); } <> { yy_delete_buffer(YY_CURRENT_BUFFER); fclose(incstack[incstackp].fp); incstack[incstackp].fp = -1; racoon_free(incstack[incstackp].path); incstack[incstackp].path = NULL; incstackp--; nextfile: if (incstack[incstackp].matchon < incstack[incstackp].matches.gl_pathc) { char* filepath = incstack[incstackp].matches.gl_pathv[incstack[incstackp].matchon]; incstack[incstackp].matchon++; incstackp++; if (yycf_set_buffer(filepath) != 0) { incstackp--; goto nextfile; } yy_switch_to_buffer(yy_create_buffer(yyin, YY_BUF_SIZE)); BEGIN(S_INI); } else { globfree(&incstack[incstackp].matches); if (incstackp == 0) yyterminate(); else yy_switch_to_buffer(incstack[incstackp].prevstate); } } /* ... */ {ws} { ; } {nl} { incstack[incstackp].lineno++; } {comment} { YYD; } {semi} { return(EOS); } . { yymore(); } %% void yyerror(char *s, ...) { char fmt[512]; va_list ap; #ifdef HAVE_STDARG_H va_start(ap, s); #else va_start(ap); #endif snprintf(fmt, sizeof(fmt), "%s:%d: \"%s\" %s\n", incstack[incstackp].path, incstack[incstackp].lineno, yytext, s); plogv(LLV_ERROR, LOCATION, NULL, fmt, ap); va_end(ap); yyerrorcount++; } void yywarn(char *s, ...) { char fmt[512]; va_list ap; #ifdef HAVE_STDARG_H va_start(ap, s); #else va_start(ap); #endif snprintf(fmt, sizeof(fmt), "%s:%d: \"%s\" %s\n", incstack[incstackp].path, incstack[incstackp].lineno, yytext, s); plogv(LLV_WARNING, LOCATION, NULL, fmt, ap); va_end(ap); } int yycf_switch_buffer(path) char *path; { char* filepath = NULL; /* got the include file name */ if (incstackp >= MAX_INCLUDE_DEPTH) { plog(LLV_ERROR, LOCATION, NULL, "Includes nested too deeply"); return -1; } if (glob(path, GLOB_TILDE, NULL, &incstack[incstackp].matches) != 0 || incstack[incstackp].matches.gl_pathc == 0) { plog(LLV_DEBUG, LOCATION, NULL, "glob found no matches for path\n"); return 0; } incstack[incstackp].matchon = 0; incstack[incstackp].prevstate = YY_CURRENT_BUFFER; nextmatch: if (incstack[incstackp].matchon >= incstack[incstackp].matches.gl_pathc) return -1; filepath = incstack[incstackp].matches.gl_pathv[incstack[incstackp].matchon]; incstack[incstackp].matchon++; incstackp++; if (yycf_set_buffer(filepath) != 0) { incstackp--; goto nextmatch; } yy_switch_to_buffer(yy_create_buffer(yyin, YY_BUF_SIZE)); BEGIN(S_INI); return 0; } int yycf_set_buffer(path) char *path; { yyin = fopen(path, "r"); if (yyin == NULL) { fprintf(stderr, "failed to open file %s (%s)\n", path, strerror(errno)); plog(LLV_ERROR, LOCATION, NULL, "failed to open file %s (%s)\n", path, strerror(errno)); return -1; } /* initialize */ incstack[incstackp].fp = yyin; incstack[incstackp].path = strdup(path); incstack[incstackp].lineno = 1; plog(LLV_DEBUG, LOCATION, NULL, "reading config file %s\n", path, 0); return 0; } void yycf_init_buffer() { int i; for (i = 0; i < MAX_INCLUDE_DEPTH; i++) memset(&incstack[i], 0, sizeof(incstack[i])); incstackp = 0; } void yycf_clean_buffer() { int i; for (i = 0; i < MAX_INCLUDE_DEPTH; i++) { if (incstack[i].path != NULL) { if (incstack[i].fp >= 0) fclose(incstack[i].fp); racoon_free(incstack[i].path); incstack[i].path = NULL; } } }