887b782b0b
(MD5 signatures for TCP, as used with BGP). Credit for original FreeBSD code goes to Bruce M. Simpson, with FreeBSD sponsorship credited to sentex.net. Shortening of the setsockopt() name attributed to Vincent Jardin. This commit is a minimal, working version of the FreeBSD code, as MFC'ed to FreeBSD-4. It has received minimal testing with a ttcp modified to set the TCP-MD5 option; BMS's additions to tcpdump-current (tcpdump -M) confirm that the MD5 signatures are correct. Committed as-is for further testing between a NetBSD BGP speaker (e.g., quagga) and industry-standard BGP speakers (e.g., Cisco, Juniper). NOTE: This version has two potential flaws. First, I do see any code that verifies recieved TCP-MD5 signatures. Second, the TCP-MD5 options are internally padded and assumed to be 32-bit aligned. A more space-efficient scheme is to pack all TCP options densely (and possibly unaligned) into the TCP header ; then do one final padding to a 4-byte boundary. Pre-existing comments note that accounting for TCP-option space when we add SACK is yet to be done. For now, I'm punting on that; we can solve it properly, in a way that will handle SACK blocks, as a separate exercise. In case a pullup to NetBSD-2 is requested, this adds sys/netipsec/xform_tcp.c ,and modifies: sys/net/pfkeyv2.h,v 1.15 sys/netinet/files.netinet,v 1.5 sys/netinet/ip.h,v 1.25 sys/netinet/tcp.h,v 1.15 sys/netinet/tcp_input.c,v 1.200 sys/netinet/tcp_output.c,v 1.109 sys/netinet/tcp_subr.c,v 1.165 sys/netinet/tcp_usrreq.c,v 1.89 sys/netinet/tcp_var.h,v 1.109 sys/netipsec/files.netipsec,v 1.3 sys/netipsec/ipsec.c,v 1.11 sys/netipsec/ipsec.h,v 1.7 sys/netipsec/key.c,v 1.11 share/man/man4/tcp.4,v 1.16 lib/libipsec/pfkey.c,v 1.20 lib/libipsec/pfkey_dump.c,v 1.17 lib/libipsec/policy_token.l,v 1.8 sbin/setkey/parse.y,v 1.14 sbin/setkey/setkey.8,v 1.27 sbin/setkey/token.l,v 1.15 Note that the preceding two revisions to tcp.4 will be required to cleanly apply this diff.
160 lines
4.4 KiB
Plaintext
160 lines
4.4 KiB
Plaintext
/* $FreeBSD: /usr/local/www/cvsroot/FreeBSD/src/lib/libipsec/policy_token.l,v 1.2.2.3 2004/02/14 22:28:29 bms Exp $ */
|
|
/* $KAME: policy_token.l,v 1.13 2003/05/09 05:19:55 sakane Exp $ */
|
|
|
|
/*
|
|
* Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project.
|
|
* All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
* 3. Neither the name of the project nor the names of its contributors
|
|
* may be used to endorse or promote products derived from this software
|
|
* without specific prior written permission.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
* SUCH DAMAGE.
|
|
*/
|
|
|
|
%{
|
|
#include <sys/types.h>
|
|
#include <sys/param.h>
|
|
#include <sys/socket.h>
|
|
#include <net/route.h>
|
|
#include <net/pfkeyv2.h>
|
|
#include <netkey/keydb.h>
|
|
#include <netinet/in.h>
|
|
#include <netinet6/ipsec.h>
|
|
|
|
#include <stdlib.h>
|
|
#include <limits.h>
|
|
#include <string.h>
|
|
#include <unistd.h>
|
|
#include <errno.h>
|
|
|
|
#ifndef __NetBSD__
|
|
#include "y.tab.h"
|
|
#else
|
|
#include "policy_parse.h"
|
|
#endif
|
|
#define yylval __libyylval /* XXX */
|
|
|
|
int yylex __P((void));
|
|
%}
|
|
|
|
%option noyywrap
|
|
%option nounput
|
|
|
|
/* common section */
|
|
nl \n
|
|
ws [ \t]+
|
|
digit [0-9]
|
|
hexdigit [0-9A-Fa-f]
|
|
special [()+\|\?\*,]
|
|
dot \.
|
|
comma \,
|
|
hyphen \-
|
|
colon \:
|
|
slash \/
|
|
bcl \{
|
|
ecl \}
|
|
blcl \[
|
|
elcl \]
|
|
percent \%
|
|
semi \;
|
|
usec {dot}{digit}{1,6}
|
|
comment \#.*
|
|
ccomment "/*"
|
|
bracketstring \<[^>]*\>
|
|
quotedstring \"[^"]*\"
|
|
decstring {digit}+
|
|
hexpair {hexdigit}{hexdigit}
|
|
hexstring 0[xX]{hexdigit}+
|
|
octetstring {octet}({dot}{octet})+
|
|
ipaddress [a-zA-Z0-9:\._][a-zA-Z0-9:\._]*(%[a-zA-Z0-9]+)?
|
|
|
|
%%
|
|
|
|
in { yylval.num = IPSEC_DIR_INBOUND; return(DIR); }
|
|
out { yylval.num = IPSEC_DIR_OUTBOUND; return(DIR); }
|
|
|
|
discard { yylval.num = IPSEC_POLICY_DISCARD; return(ACTION); }
|
|
none { yylval.num = IPSEC_POLICY_NONE; return(ACTION); }
|
|
ipsec { yylval.num = IPSEC_POLICY_IPSEC; return(ACTION); }
|
|
bypass { yylval.num = IPSEC_POLICY_BYPASS; return(ACTION); }
|
|
entrust { yylval.num = IPSEC_POLICY_ENTRUST; return(ACTION); }
|
|
|
|
esp { yylval.num = IPPROTO_ESP; return(PROTOCOL); }
|
|
ah { yylval.num = IPPROTO_AH; return(PROTOCOL); }
|
|
ipcomp { yylval.num = IPPROTO_IPCOMP; return(PROTOCOL); }
|
|
tcp { yylval.num = IPPROTO_TCP; return(PROTOCOL); }
|
|
|
|
transport { yylval.num = IPSEC_MODE_TRANSPORT; return(MODE); }
|
|
tunnel { yylval.num = IPSEC_MODE_TUNNEL; return(MODE); }
|
|
|
|
me { return(ME); }
|
|
any { return(ANY); }
|
|
|
|
default { yylval.num = IPSEC_LEVEL_DEFAULT; return(LEVEL); }
|
|
use { yylval.num = IPSEC_LEVEL_USE; return(LEVEL); }
|
|
require { yylval.num = IPSEC_LEVEL_REQUIRE; return(LEVEL); }
|
|
unique{colon}{decstring} {
|
|
yylval.val.len = strlen(yytext + 7);
|
|
yylval.val.buf = yytext + 7;
|
|
return(LEVEL_SPECIFY);
|
|
}
|
|
unique { yylval.num = IPSEC_LEVEL_UNIQUE; return(LEVEL); }
|
|
{slash} { return(SLASH); }
|
|
|
|
{ipaddress} {
|
|
yylval.val.len = strlen(yytext);
|
|
yylval.val.buf = yytext;
|
|
return(IPADDRESS);
|
|
}
|
|
|
|
{hyphen} { return(HYPHEN); }
|
|
|
|
{ws} { ; }
|
|
{nl} { ; }
|
|
|
|
%%
|
|
|
|
void __policy__strbuffer__init__ __P((char *));
|
|
void __policy__strbuffer__free__ __P((void));
|
|
|
|
static YY_BUFFER_STATE strbuffer;
|
|
|
|
void
|
|
__policy__strbuffer__init__(msg)
|
|
char *msg;
|
|
{
|
|
if (yy_current_buffer)
|
|
yy_delete_buffer(yy_current_buffer);
|
|
strbuffer = (YY_BUFFER_STATE)yy_scan_string(msg);
|
|
yy_switch_to_buffer(strbuffer);
|
|
|
|
return;
|
|
}
|
|
|
|
void
|
|
__policy__strbuffer__free__()
|
|
{
|
|
yy_delete_buffer(strbuffer);
|
|
|
|
return;
|
|
}
|