/usr/src/sbin/isakmpd/pf_key

Bug Summary

File:	src/sbin/isakmpd/pf_key_v2.c
Warning:	line 1450, column 2 Potential leak of memory pointed to by 'stag'
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name pf_key_v2.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sbin/isakmpd/obj -resource-dir /usr/local/llvm16/lib/clang/16 -I /usr/src/sbin/isakmpd -I . -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/sbin/isakmpd/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/sbin/isakmpd/pf_key_v2.c
1/* $OpenBSD: pf_key_v2.c,v 1.205 2023/08/07 04:01:30 dlg Exp $  */
2/* $EOM: pf_key_v2.c,v 1.79 2000/12/12 00:33:19 niklas Exp $	 */

4/*
* Copyright (c) 1999, 2000, 2001 Niklas Hallqvist.  All rights reserved.
* Copyright (c) 1999, 2000, 2001 Angelos D. Keromytis.  All rights reserved.
* Copyright (c) 2001 H�kan Olsson.  All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/

30/*
* This code was written under funding by Ericsson Radio Systems.
*/

34#include <sys/types.h>
35#include <sys/ioctl.h>
36#include <sys/queue.h>
37#include <sys/socket.h>
38#include <sys/uio.h>

40#include <net/pfkeyv2.h>
41#include <netinet/in.h>
42#include <netinet/ip_ipsp.h>
43#include <arpa/inet.h>
44#include <stdlib.h>
45#include <poll.h>
46#include <string.h>
47#include <unistd.h>
48#include <pwd.h>
49#include <errno(*__errno()).h>
50#include <bitstring.h>

52#include "cert.h"
53#include "conf.h"
54#include "connection.h"
55#include "exchange.h"
56#include "ipsec.h"
57#include "ipsec_num.h"
58#include "key.h"
59#include "log.h"
60#include "pf_key_v2.h"
61#include "sa.h"
62#include "timer.h"
63#include "transport.h"
64#include "ui.h"
65#include "util.h"

67#include "policy.h"

69#include "udp_encap.h"

71#define IN6_IS_ADDR_FULL(a)((*(u_int32_t *)(void *)(&(a)->__u6_addr.__u6_addr8[0]
) == 0xffffffff) && (*(u_int32_t *)(void *)(&(a)->
__u6_addr.__u6_addr8[4]) == 0xffffffff) && (*(u_int32_t
 *)(void *)(&(a)->__u6_addr.__u6_addr8[8]) == 0xffffffff
) && (*(u_int32_t *)(void *)(&(a)->__u6_addr.__u6_addr8
[12]) == 0xffffffff))						\
((*(u_int32_t *)(void *)(&(a)->s6_addr__u6_addr.__u6_addr8[0]) == 0xffffffff) &&	\
(*(u_int32_t *)(void *)(&(a)->s6_addr__u6_addr.__u6_addr8[4]) == 0xffffffff) &&	\
(*(u_int32_t *)(void *)(&(a)->s6_addr__u6_addr.__u6_addr8[8]) == 0xffffffff) &&	\
(*(u_int32_t *)(void *)(&(a)->s6_addr__u6_addr.__u6_addr8[12]) == 0xffffffff))

77#define ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255" sizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255"

79/*
* PF_KEY v2 always work with 64-bit entities and aligns on 64-bit boundaries.
*/
82#define PF_KEY_V2_CHUNK8 8
83#define PF_KEY_V2_ROUND(x)(((x) + 8 - 1) & ~(8 - 1))						\
(((x) + PF_KEY_V2_CHUNK8 - 1) & ~(PF_KEY_V2_CHUNK8 - 1))

86/* How many microseconds we will wait for a reply from the PF_KEY socket.  */
87#define PF_KEY_REPLY_TIMEOUT1000 1000

89struct pf_key_v2_node {
TAILQ_ENTRY(pf_key_v2_node)struct { struct pf_key_v2_node *tqe_next; struct pf_key_v2_node
 **tqe_prev; } link;
void           *seg;
size_t		sz;
int		cnt;
u_int16_t       type;
u_int8_t	flags;
96};

98TAILQ_HEAD(pf_key_v2_msg, pf_key_v2_node)struct pf_key_v2_msg { struct pf_key_v2_node *tqh_first; struct
 pf_key_v2_node **tqh_last; };

100#define PF_KEY_V2_NODE_MALLOCED1 1
101#define PF_KEY_V2_NODE_MARK2 2

103/* Used to derive "unique" connection identifiers. */
104int		connection_seq = 0;

106static u_int8_t *pf_key_v2_convert_id(u_int8_t *, int, size_t *, int *);
107static struct pf_key_v2_msg *pf_key_v2_call(struct pf_key_v2_msg *);
108static struct pf_key_v2_node *pf_key_v2_find_ext(struct pf_key_v2_msg *,
    u_int16_t);
110static void     pf_key_v2_notify(struct pf_key_v2_msg *);
111static struct pf_key_v2_msg *pf_key_v2_read(u_int32_t);
112static u_int32_t pf_key_v2_seq(void);
113static u_int32_t pf_key_v2_write(struct pf_key_v2_msg *);
114static int      pf_key_v2_remove_conf(char *);
115static int      pf_key_v2_conf_refhandle(int, char *);

117static int      pf_key_v2_conf_refinc(int, char *);

119/* The socket to use for PF_KEY interactions.  */
120int      pf_key_v2_socket;

122static struct pf_key_v2_msg *
123pf_key_v2_msg_new(struct sadb_msg *msg, int flags)
124{
struct pf_key_v2_node *node;
struct pf_key_v2_msg *ret;

node = malloc(sizeof *node);
if (!node)
goto cleanup;
ret = malloc(sizeof *ret);
if (!ret)
goto cleanup;
TAILQ_INIT(ret)do { (ret)->tqh_first = ((void *)0); (ret)->tqh_last = &
(ret)->tqh_first; } while (0);
node->seg = msg;
node->sz = sizeof *msg;
node->type = 0;
node->cnt = 1;
node->flags = flags;
TAILQ_INSERT_HEAD(ret, node, link)do { if (((node)->link.tqe_next = (ret)->tqh_first) != (
(void *)0)) (ret)->tqh_first->link.tqe_prev = &(node
)->link.tqe_next; else (ret)->tqh_last = &(node)->
link.tqe_next; (ret)->tqh_first = (node); (node)->link.
tqe_prev = &(ret)->tqh_first; } while (0);
return ret;

143cleanup:
free(node);
return 0;
146}

148/* Add a SZ sized segment SEG to the PF_KEY message MSG.  */
149static int
150pf_key_v2_msg_add(struct pf_key_v2_msg *msg, struct sadb_ext *ext, int flags)
151{
struct pf_key_v2_node *node;

node = malloc(sizeof *node);
if (!node)
return -1;
node->seg = ext;
node->sz = ext->sadb_ext_len * PF_KEY_V2_CHUNK8;
node->type = ext->sadb_ext_type;
node->flags = flags;
TAILQ_FIRST(msg)((msg)->tqh_first)->cnt++;
TAILQ_INSERT_TAIL(msg, node, link)do { (node)->link.tqe_next = ((void *)0); (node)->link.
tqe_prev = (msg)->tqh_last; *(msg)->tqh_last = (node); (
msg)->tqh_last = &(node)->link.tqe_next; } while (0
);
return 0;
164}

166/* Deallocate the PF_KEY message MSG.  */
167static void
168pf_key_v2_msg_free(struct pf_key_v2_msg *msg)
169{
struct pf_key_v2_node *np;

np = TAILQ_FIRST(msg)((msg)->tqh_first);
while (np) {
TAILQ_REMOVE(msg, np, link)do { if (((np)->link.tqe_next) != ((void *)0)) (np)->link
.tqe_next->link.tqe_prev = (np)->link.tqe_prev; else (msg
)->tqh_last = (np)->link.tqe_prev; *(np)->link.tqe_prev
 = (np)->link.tqe_next; ; ; } while (0);
if (np->flags & PF_KEY_V2_NODE_MALLOCED1)
	free(np->seg);
free(np);
np = TAILQ_FIRST(msg)((msg)->tqh_first);
}
free(msg);
181}

183/* Just return a new sequence number.  */
184static u_int32_t
185pf_key_v2_seq(void)
186{
static u_int32_t seq = 0;

return ++seq;
190}

192/*
* Read a PF_KEY packet with SEQ as the sequence number, looping if necessary.
* If SEQ is zero just read the first message we see, otherwise we queue
* messages up until both the PID and the sequence number match.
*/
197static struct pf_key_v2_msg *
198pf_key_v2_read(u_int32_t seq)
199{
ssize_t		n;
u_int8_t       *buf = 0;
struct pf_key_v2_msg *ret = 0;
struct sadb_msg *msg;
struct sadb_msg hdr;
struct sadb_ext *ext;
struct timespec	ts;
struct pollfd	pfd[1];

pfd[0].fd = pf_key_v2_socket;
pfd[0].events = POLLIN0x0001;

while (1) {
/*
 * If this is a read of a reply we should actually expect the
 * reply to get lost as PF_KEY is an unreliable service per
 * the specs. Currently we do this by setting a short timeout,
 * and if it is not readable in that time, we fail the read.
 */
if (seq) {
	n = poll(pfd, 1, PF_KEY_REPLY_TIMEOUT1000 / 1000);
	if (n == -1) {
		log_error("pf_key_v2_read: poll() failed");
		goto cleanup;
	}
	if (!n) {
		log_print("pf_key_v2_read: "
		    "no reply from PF_KEY");
		goto cleanup;
	}
}
n = recv(pf_key_v2_socket, &hdr, sizeof hdr, MSG_PEEK0x2);
if (n == -1) {
	log_error("pf_key_v2_read: recv (%d, ...) failed",
	    pf_key_v2_socket);
	goto cleanup;
}
if (n != sizeof hdr) {
	log_error("pf_key_v2_read: recv (%d, ...) "
	    "returned short packet (%lu bytes)",
	    pf_key_v2_socket, (unsigned long) n);
	goto cleanup;
}
buf = reallocarray(NULL((void *)0), hdr.sadb_msg_len, PF_KEY_V2_CHUNK8);
if (!buf) {
	log_error("pf_key_v2_read: reallocarray (%d, %d) failed",
	    hdr.sadb_msg_len, PF_KEY_V2_CHUNK8);
	goto cleanup;
}
n = hdr.sadb_msg_len * PF_KEY_V2_CHUNK8;

n = read(pf_key_v2_socket, buf, n);
if (n == -1) {
	log_error("pf_key_v2_read: read (%d, ...) failed",
		  pf_key_v2_socket);
	goto cleanup;
}
if (n != hdr.sadb_msg_len * PF_KEY_V2_CHUNK8) {
	log_print("pf_key_v2_read: read (%d, ...) "
	    "returned short packet (%lu bytes)",
	    pf_key_v2_socket, (unsigned long) n);
	goto cleanup;
}
LOG_DBG_BUF((LOG_SYSDEP, 80, "pf_key_v2_read: msg", buf, n))log_debug_buf (LOG_SYSDEP, 80, "pf_key_v2_read: msg", buf, n);

/* We drop all messages that is not what we expect.  */
msg = (struct sadb_msg *) buf;
if (msg->sadb_msg_version != PF_KEY_V22 ||
    (msg->sadb_msg_pid != 0 &&
    msg->sadb_msg_pid != (u_int32_t) getpid())) {
	if (seq) {
		free(buf);
		buf = 0;
		continue;
	} else {
		LOG_DBG((LOG_SYSDEP, 90, "pf_key_v2_read:"log_debug (LOG_SYSDEP, 90, "pf_key_v2_read:" "bad version (%d) or PID (%d, mine is "
 "%ld), ignored", msg->sadb_msg_version, msg->sadb_msg_pid
, (long) getpid())
		    "bad version (%d) or PID (%d, mine is "log_debug (LOG_SYSDEP, 90, "pf_key_v2_read:" "bad version (%d) or PID (%d, mine is "
 "%ld), ignored", msg->sadb_msg_version, msg->sadb_msg_pid
, (long) getpid())
		    "%ld), ignored", msg->sadb_msg_version,log_debug (LOG_SYSDEP, 90, "pf_key_v2_read:" "bad version (%d) or PID (%d, mine is "
 "%ld), ignored", msg->sadb_msg_version, msg->sadb_msg_pid
, (long) getpid())
		    msg->sadb_msg_pid, (long) getpid()))log_debug (LOG_SYSDEP, 90, "pf_key_v2_read:" "bad version (%d) or PID (%d, mine is "
 "%ld), ignored", msg->sadb_msg_version, msg->sadb_msg_pid
, (long) getpid());
		goto cleanup;
	}
}
/* Parse the message.  */
ret = pf_key_v2_msg_new(msg, PF_KEY_V2_NODE_MALLOCED1);
if (!ret)
	goto cleanup;
buf = 0;
for (ext = (struct sadb_ext *) (msg + 1);
    (u_int8_t *) ext - (u_int8_t *) msg <
    msg->sadb_msg_len * PF_KEY_V2_CHUNK8;
    ext = (struct sadb_ext *) ((u_int8_t *) ext +
    ext->sadb_ext_len * PF_KEY_V2_CHUNK8))
	pf_key_v2_msg_add(ret, ext, 0);

/*
 * If the message is not the one we are waiting for, queue it
 * up.
 */
if (seq && (msg->sadb_msg_pid != (u_int32_t) getpid() ||
    msg->sadb_msg_seq != seq)) {
	clock_gettime(CLOCK_MONOTONIC3, &ts);
	timer_add_event("pf_key_v2_notify",
	    (void (*) (void *)) pf_key_v2_notify, ret, &ts);
	ret = 0;
	continue;
}
return ret;
}

309cleanup:
free(buf);
if (ret)
pf_key_v2_msg_free(ret);
return 0;
314}

316/* Write the message in PMSG to the PF_KEY socket.  */
317u_int32_t
318pf_key_v2_write(struct pf_key_v2_msg *pmsg)
319{
struct iovec   *iov = 0;
ssize_t		n;
size_t		len;
int		i, cnt = TAILQ_FIRST(pmsg)((pmsg)->tqh_first)->cnt;
char		header[80];
struct sadb_msg *msg = TAILQ_FIRST(pmsg)((pmsg)->tqh_first)->seg;
struct pf_key_v2_node *np = TAILQ_FIRST(pmsg)((pmsg)->tqh_first);

iov = calloc(cnt, sizeof *iov);
if (!iov) {
log_error("pf_key_v2_write: malloc (%lu) failed",
    cnt * (unsigned long) sizeof *iov);
return 0;
}
msg->sadb_msg_version = PF_KEY_V22;
msg->sadb_msg_errno = 0;
msg->sadb_msg_reserved = 0;
msg->sadb_msg_pid = getpid();
if (!msg->sadb_msg_seq)
msg->sadb_msg_seq = pf_key_v2_seq();

/* Compute the iovec segments as well as the message length.  */
len = 0;
for (i = 0; i < cnt; i++) {
iov[i].iov_base = np->seg;
len += iov[i].iov_len = np->sz;

/*
 * XXX One can envision setting specific extension fields,
 * like *_reserved ones here.  For now we require them to be
 * set by the caller.
 */

np = TAILQ_NEXT(np, link)((np)->link.tqe_next);
}
msg->sadb_msg_len = len / PF_KEY_V2_CHUNK8;

for (i = 0; i < cnt; i++) {
snprintf(header, sizeof header, "pf_key_v2_write: iov[%d]", i);
LOG_DBG_BUF((LOG_SYSDEP, 80, header,log_debug_buf (LOG_SYSDEP, 80, header, (u_int8_t *) iov[i].iov_base
, iov[i].iov_len)
    (u_int8_t *) iov[i].iov_base, iov[i].iov_len))log_debug_buf (LOG_SYSDEP, 80, header, (u_int8_t *) iov[i].iov_base
, iov[i].iov_len);
}

do {
n = writev(pf_key_v2_socket, iov, cnt);
} while (n == -1 && (errno(*__errno()) == EAGAIN35 || errno(*__errno()) == EINTR4));
if (n == -1) {
log_error("pf_key_v2_write: writev (%d, %p, %d) failed",
    pf_key_v2_socket, iov, cnt);
goto cleanup;
}
if ((size_t) n != len) {
log_error("pf_key_v2_write: "
    "writev (%d, ...) returned prematurely (%lu)",
    pf_key_v2_socket, (unsigned long) n);
goto cleanup;
}
free(iov);
return msg->sadb_msg_seq;

380cleanup:
free(iov);
return 0;
383}

385/*
* Do a PF_KEY "call", i.e. write a message MSG, read the reply and return
* it to the caller.
*/
389static struct pf_key_v2_msg *
390pf_key_v2_call(struct pf_key_v2_msg *msg)
391{
u_int32_t       seq;

seq = pf_key_v2_write(msg);
if (!seq)
return 0;
return pf_key_v2_read(seq);
398}

400/* Find the TYPE extension in MSG.  Return zero if none found.  */
401static struct pf_key_v2_node *
402pf_key_v2_find_ext(struct pf_key_v2_msg *msg, u_int16_t type)
403{
struct pf_key_v2_node *ext;

for (ext = TAILQ_NEXT(TAILQ_FIRST(msg), link)((((msg)->tqh_first))->link.tqe_next); ext;
   ext = TAILQ_NEXT(ext, link)((ext)->link.tqe_next))
if (ext->type == type)
	return ext;
return 0;
411}

413/*
* Open the PF_KEYv2 sockets and return the descriptor used for notifies.
* Return -1 for failure and -2 if no notifies will show up.
*/
417int
418pf_key_v2_open(void)
419{
int		fd = -1, err;
struct sadb_msg msg;
struct pf_key_v2_msg *regmsg = 0, *ret = 0;

/* Open the socket we use to speak to IPsec. */
pf_key_v2_socket = -1;
fd = socket(PF_KEY30, SOCK_RAW3, PF_KEY_V22);
if (fd == -1) {
log_error("pf_key_v2_open: "
    "socket (PF_KEY, SOCK_RAW, PF_KEY_V2) failed");
goto cleanup;
}
pf_key_v2_socket = fd;

/* Register it to get ESP and AH acquires from the kernel.  */
msg.sadb_msg_seq = 0;
msg.sadb_msg_type = SADB_REGISTER7;
msg.sadb_msg_satype = SADB_SATYPE_ESP2;
regmsg = pf_key_v2_msg_new(&msg, 0);
if (!regmsg)
goto cleanup;
ret = pf_key_v2_call(regmsg);
pf_key_v2_msg_free(regmsg);
if (!ret)
goto cleanup;
err = ((struct sadb_msg *)TAILQ_FIRST(ret)((ret)->tqh_first)->seg)->sadb_msg_errno;
if (err) {
log_print("pf_key_v2_open: REGISTER: %s", strerror(err));
goto cleanup;
}
/* XXX Register the accepted transforms.  */

pf_key_v2_msg_free(ret);
ret = 0;

msg.sadb_msg_seq = 0;
msg.sadb_msg_type = SADB_REGISTER7;
msg.sadb_msg_satype = SADB_SATYPE_AH1;
regmsg = pf_key_v2_msg_new(&msg, 0);
if (!regmsg)
goto cleanup;
ret = pf_key_v2_call(regmsg);
pf_key_v2_msg_free(regmsg);
if (!ret)
goto cleanup;
err = ((struct sadb_msg *)TAILQ_FIRST(ret)((ret)->tqh_first)->seg)->sadb_msg_errno;
if (err) {
log_print("pf_key_v2_open: REGISTER: %s", strerror(err));
goto cleanup;
}
/* XXX Register the accepted transforms.  */

pf_key_v2_msg_free(ret);
ret = 0;

msg.sadb_msg_seq = 0;
msg.sadb_msg_type = SADB_REGISTER7;
msg.sadb_msg_satype = SADB_X_SATYPE_IPCOMP9;
regmsg = pf_key_v2_msg_new(&msg, 0);
if (!regmsg)
goto cleanup;
ret = pf_key_v2_call(regmsg);
pf_key_v2_msg_free(regmsg);
if (!ret)
goto cleanup;
err = ((struct sadb_msg *)TAILQ_FIRST(ret)((ret)->tqh_first)->seg)->sadb_msg_errno;
if (err) {
log_print("pf_key_v2_open: REGISTER: %s", strerror(err));
goto cleanup;
}
/* XXX Register the accepted transforms.  */

pf_key_v2_msg_free(ret);

return fd;

496cleanup:
if (pf_key_v2_socket != -1) {
close(pf_key_v2_socket);
pf_key_v2_socket = -1;
}
if (ret)
pf_key_v2_msg_free(ret);
return -1;
504}

506/*
* Generate a SPI for protocol PROTO and the source/destination pair given by
* SRC, SRCLEN, DST & DSTLEN.  Stash the SPI size in SZ.
*/
510u_int8_t *
511pf_key_v2_get_spi(size_t *sz, u_int8_t proto, struct sockaddr *src,
  struct sockaddr *dst, u_int32_t seq)
513{
struct sadb_msg msg;
struct sadb_sa *sa;
struct sadb_address *addr = 0;
struct sadb_spirange spirange;
struct pf_key_v2_msg *getspi = 0, *ret = 0;
struct pf_key_v2_node *ext;
u_int8_t       *spi = 0;
int		len, err;

msg.sadb_msg_type = SADB_GETSPI1;
switch (proto) {
case IPSEC_PROTO_IPSEC_ESP3:
msg.sadb_msg_satype = SADB_SATYPE_ESP2;
break;
case IPSEC_PROTO_IPSEC_AH2:
msg.sadb_msg_satype = SADB_SATYPE_AH1;
break;
case IPSEC_PROTO_IPCOMP4:
msg.sadb_msg_satype = SADB_X_SATYPE_IPCOMP9;
break;
default:
log_print("pf_key_v2_get_spi: invalid proto %d", proto);
goto cleanup;
}

/* Set the sequence number from the ACQUIRE message. */
msg.sadb_msg_seq = seq;
getspi = pf_key_v2_msg_new(&msg, 0);
if (!getspi)
goto cleanup;

/* Setup the ADDRESS extensions.  */
len =
   sizeof(struct sadb_address) + PF_KEY_V2_ROUND(SA_LEN(src))(((((src)->sa_len)) + 8 - 1) & ~(8 - 1));
addr = calloc(1, len);
if (!addr)
goto cleanup;
addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC5;
addr->sadb_address_len = len / PF_KEY_V2_CHUNK8;
addr->sadb_address_reserved = 0;
memcpy(addr + 1, src, SA_LEN(src)((src)->sa_len));
switch (((struct sockaddr *) (addr + 1))->sa_family) {
case AF_INET2:
((struct sockaddr_in *) (addr + 1))->sin_port = 0;
break;
case AF_INET624:
((struct sockaddr_in6 *) (addr + 1))->sin6_port = 0;
break;
}
if (pf_key_v2_msg_add(getspi, (struct sadb_ext *) addr,
   PF_KEY_V2_NODE_MALLOCED1) == -1)
goto cleanup;
addr = 0;

len = sizeof(struct sadb_address) + PF_KEY_V2_ROUND(SA_LEN(dst))(((((dst)->sa_len)) + 8 - 1) & ~(8 - 1));
addr = calloc(1, len);
if (!addr)
goto cleanup;
addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST6;
addr->sadb_address_len = len / PF_KEY_V2_CHUNK8;
addr->sadb_address_reserved = 0;
memcpy(addr + 1, dst, SA_LEN(dst)((dst)->sa_len));
switch (((struct sockaddr *) (addr + 1))->sa_family) {
case AF_INET2:
((struct sockaddr_in *) (addr + 1))->sin_port = 0;
break;
case AF_INET624:
((struct sockaddr_in6 *) (addr + 1))->sin6_port = 0;
break;
}
if (pf_key_v2_msg_add(getspi, (struct sadb_ext *) addr,
   PF_KEY_V2_NODE_MALLOCED1) == -1)
goto cleanup;
addr = 0;

/* Setup the SPIRANGE extension.  */
spirange.sadb_spirange_exttype = SADB_EXT_SPIRANGE16;
spirange.sadb_spirange_len = sizeof spirange / PF_KEY_V2_CHUNK8;
if (proto == IPSEC_PROTO_IPCOMP4) {
spirange.sadb_spirange_min = CPI_RESERVED_MAX255 + 1;
spirange.sadb_spirange_max = CPI_PRIVATE_MIN61440 - 1;
} else {
spirange.sadb_spirange_min = IPSEC_SPI_LOW0x100;
spirange.sadb_spirange_max = 0xffffffff;
}
spirange.sadb_spirange_reserved = 0;
if (pf_key_v2_msg_add(getspi, (struct sadb_ext *)&spirange, 0) == -1)
goto cleanup;

ret = pf_key_v2_call(getspi);
pf_key_v2_msg_free(getspi);
getspi = 0;
if (!ret)
goto cleanup;
err = ((struct sadb_msg *)TAILQ_FIRST(ret)((ret)->tqh_first)->seg)->sadb_msg_errno;
if (err) {
log_print("pf_key_v2_get_spi: GETSPI: %s", strerror(err));
goto cleanup;
}
ext = pf_key_v2_find_ext(ret, SADB_EXT_SA1);
if (!ext) {
log_print("pf_key_v2_get_spi: no SA extension found");
goto cleanup;
}
sa = ext->seg;

/* IPCOMP CPIs are only 16 bits long.  */
*sz = (proto == IPSEC_PROTO_IPCOMP4) ? sizeof(u_int16_t)
: sizeof sa->sadb_sa_spi;
spi = malloc(*sz);
if (!spi)
goto cleanup;
/* XXX This is ugly.  */
if (proto == IPSEC_PROTO_IPCOMP4) {
u_int32_t       tspi = ntohl(sa->sadb_sa_spi)(__uint32_t)(__builtin_constant_p(sa->sadb_sa_spi) ? (__uint32_t
)(((__uint32_t)(sa->sadb_sa_spi) & 0xff) << 24 |
 ((__uint32_t)(sa->sadb_sa_spi) & 0xff00) << 8 |
 ((__uint32_t)(sa->sadb_sa_spi) & 0xff0000) >> 8
 | ((__uint32_t)(sa->sadb_sa_spi) & 0xff000000) >>
 24) : __swap32md(sa->sadb_sa_spi));
*(u_int16_t *) spi = htons((u_int16_t) tspi)(__uint16_t)(__builtin_constant_p((u_int16_t) tspi) ? (__uint16_t
)(((__uint16_t)((u_int16_t) tspi) & 0xffU) << 8 | (
(__uint16_t)((u_int16_t) tspi) & 0xff00U) >> 8) : __swap16md
((u_int16_t) tspi));
} else
memcpy(spi, &sa->sadb_sa_spi, *sz);

pf_key_v2_msg_free(ret);

LOG_DBG_BUF((LOG_SYSDEP, 50, "pf_key_v2_get_spi: spi", spi, *sz))log_debug_buf (LOG_SYSDEP, 50, "pf_key_v2_get_spi: spi", spi,
 *sz);
return spi;

638cleanup:
free(spi);
free(addr);
if (getspi)
pf_key_v2_msg_free(getspi);
if (ret)
pf_key_v2_msg_free(ret);
return 0;
646}

648/* Fetch SA information from the kernel. XXX OpenBSD only?  */
649struct sa_kinfo *
650pf_key_v2_get_kernel_sa(u_int8_t *spi, size_t spi_sz, u_int8_t proto,
  struct sockaddr *dst)
652{
struct sadb_msg msg;
struct sadb_sa *ssa;
struct sadb_address *addr = 0;
struct sockaddr *sa;
struct sadb_lifetime *life;
struct pf_key_v2_msg *gettdb = 0, *ret = 0;
struct pf_key_v2_node *ext;
static struct sa_kinfo ksa;
struct sadb_x_udpencap *udpencap;
int len, err;

if (spi_sz != sizeof (ssa->sadb_sa_spi))
return 0;

msg.sadb_msg_type = SADB_GET5;
switch (proto) {
case IPSEC_PROTO_IPSEC_ESP3:
msg.sadb_msg_satype = SADB_SATYPE_ESP2;
break;
case IPSEC_PROTO_IPSEC_AH2:
msg.sadb_msg_satype = SADB_SATYPE_AH1;
break;
case IPSEC_PROTO_IPCOMP4:
msg.sadb_msg_satype = SADB_X_SATYPE_IPCOMP9;
break;
default:
log_print("pf_key_v2_get_kernel_sa: invalid proto %d", proto);
goto cleanup;
}

gettdb = pf_key_v2_msg_new(&msg, 0);
if (!gettdb)
goto cleanup;

/* SPI */
ssa = calloc(1, sizeof *ssa);
if (!ssa) {
log_print("pf_key_v2_get_kernel_sa: calloc(1, %lu) failed",
    (unsigned long)sizeof *ssa);
goto cleanup;
}

ssa->sadb_sa_exttype = SADB_EXT_SA1;
ssa->sadb_sa_len = sizeof *ssa / PF_KEY_V2_CHUNK8;
memcpy(&ssa->sadb_sa_spi, spi, sizeof ssa->sadb_sa_spi);
ssa->sadb_sa_state = SADB_SASTATE_MATURE1;
if (pf_key_v2_msg_add(gettdb, (struct sadb_ext *)ssa,
   PF_KEY_V2_NODE_MALLOCED1) == -1)
goto cleanup;
ssa = 0;

/* Address */
len =
   sizeof(struct sadb_address) + PF_KEY_V2_ROUND(SA_LEN(dst))(((((dst)->sa_len)) + 8 - 1) & ~(8 - 1));
addr = calloc(1, len);
if (!addr)
goto cleanup;
addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST6;
addr->sadb_address_len = len / PF_KEY_V2_CHUNK8;
addr->sadb_address_reserved = 0;
memcpy(addr + 1, dst, SA_LEN(dst)((dst)->sa_len));
switch (((struct sockaddr *) (addr + 1))->sa_family) {
case AF_INET2:
((struct sockaddr_in *) (addr + 1))->sin_port = 0;
break;
case AF_INET624:
((struct sockaddr_in6 *) (addr + 1))->sin6_port = 0;
break;
}
if (pf_key_v2_msg_add(gettdb, (struct sadb_ext *)addr,
   PF_KEY_V2_NODE_MALLOCED1) == -1)
goto cleanup;
addr = 0;

ret = pf_key_v2_call(gettdb);
pf_key_v2_msg_free(gettdb);
gettdb = 0;
if (!ret)
goto cleanup;
err = ((struct sadb_msg *)TAILQ_FIRST(ret)((ret)->tqh_first)->seg)->sadb_msg_errno;
if (err) {
log_print("pf_key_v2_get_kernel_sa: SADB_GET: %s",
    strerror(err));
goto cleanup;
}

/* Extract the data.  */
bzero(&ksa, sizeof ksa);

ext = pf_key_v2_find_ext(ret, SADB_EXT_SA1);
if (!ext)
goto cleanup;

ssa = (struct sadb_sa *)ext;
ksa.spi = ssa->sadb_sa_spi;
ksa.wnd = ssa->sadb_sa_replay;
ksa.flags = ssa->sadb_sa_flags;

ext = pf_key_v2_find_ext(ret, SADB_EXT_LIFETIME_CURRENT2);
if (ext) {
life = (struct sadb_lifetime *)ext->seg;
ksa.cur_allocations = life->sadb_lifetime_allocations;
ksa.cur_bytes =	life->sadb_lifetime_bytes;
ksa.first_use = life->sadb_lifetime_usetime;
ksa.established = life->sadb_lifetime_addtime;
}

ext = pf_key_v2_find_ext(ret, SADB_EXT_LIFETIME_SOFT4);
if (ext) {
life = (struct sadb_lifetime *)ext->seg;
ksa.soft_allocations = life->sadb_lifetime_allocations;
ksa.soft_bytes = life->sadb_lifetime_bytes;
ksa.soft_timeout = life->sadb_lifetime_addtime;
ksa.soft_first_use = life->sadb_lifetime_usetime;
}

ext = pf_key_v2_find_ext(ret, SADB_EXT_LIFETIME_HARD3);
if (ext) {
life = (struct sadb_lifetime *)ext->seg;
ksa.exp_allocations = life->sadb_lifetime_allocations;
ksa.exp_bytes = life->sadb_lifetime_bytes;
ksa.exp_timeout = life->sadb_lifetime_addtime;
ksa.exp_first_use = life->sadb_lifetime_usetime;
}

ext = pf_key_v2_find_ext(ret, SADB_X_EXT_LIFETIME_LASTUSE32);
if (ext) {
life = (struct sadb_lifetime *)ext->seg;
ksa.last_used = life->sadb_lifetime_usetime;
}

ext = pf_key_v2_find_ext(ret, SADB_EXT_ADDRESS_SRC5);
if (ext) {
sa = (struct sockaddr *)ext->seg;
memcpy(&ksa.src, sa,
    sa->sa_family == AF_INET2 ? sizeof(struct sockaddr_in) :
    sizeof(struct sockaddr_in6));
}

ext = pf_key_v2_find_ext(ret, SADB_EXT_ADDRESS_DST6);
if (ext) {
sa = (struct sockaddr *)ext->seg;
memcpy(&ksa.dst, sa,
    sa->sa_family == AF_INET2 ? sizeof(struct sockaddr_in) :
    sizeof(struct sockaddr_in6));
}

ext = pf_key_v2_find_ext(ret, SADB_X_EXT_UDPENCAP31);
if (ext) {
udpencap = (struct sadb_x_udpencap *)ext->seg;
ksa.udpencap_port = udpencap->sadb_x_udpencap_port;
}

pf_key_v2_msg_free(ret);

LOG_DBG_BUF((LOG_SYSDEP, 50, "pf_key_v2_get_kernel_sa: spi", spi,log_debug_buf (LOG_SYSDEP, 50, "pf_key_v2_get_kernel_sa: spi"
, spi, spi_sz)
   spi_sz))log_debug_buf (LOG_SYSDEP, 50, "pf_key_v2_get_kernel_sa: spi"
, spi, spi_sz);

return &ksa;

cleanup:
free(addr);
if (gettdb)
pf_key_v2_msg_free(gettdb);
if (ret)
pf_key_v2_msg_free(ret);
return 0;
820}

822static void
823pf_key_v2_setup_sockaddr(void *res, struct sockaddr *src,
  struct sockaddr *dst, in_port_t port, int ingress)
825{
struct sockaddr_in *ip4_sa;
struct sockaddr_in6 *ip6_sa;
u_int8_t       *p;

switch (src->sa_family) {
case AF_INET2:
ip4_sa = (struct sockaddr_in *) res;
ip4_sa->sin_family = AF_INET2;
ip4_sa->sin_len = sizeof *ip4_sa;
ip4_sa->sin_port = port;
if (dst)
	p = (u_int8_t *) (ingress ?
	    &((struct sockaddr_in *)src)->sin_addr.s_addr :
	    &((struct sockaddr_in *)dst)->sin_addr.s_addr);
else
	p = (u_int8_t *)&((struct sockaddr_in *)src)->sin_addr.s_addr;
ip4_sa->sin_addr.s_addr = *((in_addr_t *) p);
break;

case AF_INET624:
ip6_sa = (struct sockaddr_in6 *) res;
ip6_sa->sin6_family = AF_INET624;
ip6_sa->sin6_len = sizeof *ip6_sa;
ip6_sa->sin6_port = port;
if (dst)
	p = (u_int8_t *) (ingress ?
	    &((struct sockaddr_in6 *)src)->sin6_addr.s6_addr__u6_addr.__u6_addr8 :
	    &((struct sockaddr_in6 *)dst)->sin6_addr.s6_addr__u6_addr.__u6_addr8);
else
	p = (u_int8_t *)&((struct sockaddr_in6 *)src)->sin6_addr.s6_addr__u6_addr.__u6_addr8;
memcpy(ip6_sa->sin6_addr.s6_addr__u6_addr.__u6_addr8, p, sizeof(struct in6_addr));
break;

default:
log_print("pf_key_v2_setup_sockaddr: unknown family %d\n",
    src->sa_family);
break;
}
864}

866/*
* Store/update a PF_KEY_V2 security association with full information from the
* IKE SA and PROTO into the kernel.  INCOMING is set if we are setting the
* parameters for the incoming SA, and cleared otherwise.
*/
871int
872pf_key_v2_set_spi(struct sa *sa, struct proto *proto, int incoming,
  struct sa *isakmp_sa)
874{
struct sadb_msg msg;
struct sadb_sa  ssa;
struct sadb_x_tag *stag = NULL((void *)0);
struct sadb_lifetime *life = 0;
struct sadb_address *addr = 0;
struct sadb_key *key = 0;
struct sadb_ident *sid = 0;
struct sockaddr *src, *dst;
struct pf_key_v2_msg *update = 0, *ret = 0;
struct ipsec_proto *iproto = proto->data;
size_t		len;
int		keylen, hashlen, err;
u_int8_t       *pp;
int		idtype;
struct ipsec_sa *isa = sa->data;
struct sadb_protocol flowtype, tprotocol;
struct sadb_x_udpencap udpencap;
char           *addr_str, *s;
char		iface_str[32];

msg.sadb_msg_type = incoming ? SADB_UPDATE2 : SADB_ADD3;
1
Assuming 'incoming' is 0→
2
←
'?' condition is false→
switch (proto->proto) {
3
←
Control jumps to 'case 4:'  at line 1017→
case IPSEC_PROTO_IPSEC_ESP3:
msg.sadb_msg_satype = SADB_SATYPE_ESP2;
keylen = ipsec_esp_enckeylength(proto);
hashlen = ipsec_esp_authkeylength(proto);

switch (proto->id) {
case IPSEC_ESP_3DES3:
	ssa.sadb_sa_encrypt = SADB_EALG_3DESCBC3;
	break;

case IPSEC_ESP_AES12:
	ssa.sadb_sa_encrypt = SADB_X_EALG_AES12;
	break;

case IPSEC_ESP_AES_CTR13:
	ssa.sadb_sa_encrypt = SADB_X_EALG_AESCTR13;
	break;

case IPSEC_ESP_AES_GCM_1620:
	ssa.sadb_sa_encrypt = SADB_X_EALG_AESGCM1620;
	break;

case IPSEC_ESP_AES_GMAC23:
	ssa.sadb_sa_encrypt = SADB_X_EALG_AESGMAC21;
	break;

case IPSEC_ESP_CAST6:
	ssa.sadb_sa_encrypt = SADB_X_EALG_CAST6;
	break;

case IPSEC_ESP_BLOWFISH7:
	ssa.sadb_sa_encrypt = SADB_X_EALG_BLF7;
	break;

case IPSEC_ESP_NULL11:
	ssa.sadb_sa_encrypt = SADB_EALG_NULL11;
	break;

default:
	LOG_DBG((LOG_SYSDEP, 50, "pf_key_v2_set_spi: "log_debug (LOG_SYSDEP, 50, "pf_key_v2_set_spi: " "unknown encryption algorithm %d"
, proto->id)
	    "unknown encryption algorithm %d", proto->id))log_debug (LOG_SYSDEP, 50, "pf_key_v2_set_spi: " "unknown encryption algorithm %d"
, proto->id);
	return -1;
}

switch (iproto->auth) {
case IPSEC_AUTH_HMAC_MD51:
	ssa.sadb_sa_auth = SADB_AALG_MD5HMAC2;
	break;

case IPSEC_AUTH_HMAC_SHA2:
	ssa.sadb_sa_auth = SADB_AALG_SHA1HMAC3;
	break;

case IPSEC_AUTH_HMAC_RIPEMD8:
	ssa.sadb_sa_auth = SADB_X_AALG_RIPEMD160HMAC8;
	break;

case IPSEC_AUTH_HMAC_SHA2_2565:
	ssa.sadb_sa_auth = SADB_X_AALG_SHA2_2565;
	break;

case IPSEC_AUTH_HMAC_SHA2_3846:
	ssa.sadb_sa_auth = SADB_X_AALG_SHA2_3846;
	break;

case IPSEC_AUTH_HMAC_SHA2_5127:
	ssa.sadb_sa_auth = SADB_X_AALG_SHA2_5127;
	break;

case IPSEC_AUTH_DES_MAC3:
case IPSEC_AUTH_KPDK4:
	/* XXX We should be supporting KPDK */
	LOG_DBG((LOG_SYSDEP, 50, "pf_key_v2_set_spi: "log_debug (LOG_SYSDEP, 50, "pf_key_v2_set_spi: " "unknown authentication algorithm %d"
, iproto->auth)
	    "unknown authentication algorithm %d",log_debug (LOG_SYSDEP, 50, "pf_key_v2_set_spi: " "unknown authentication algorithm %d"
, iproto->auth)
	    iproto->auth))log_debug (LOG_SYSDEP, 50, "pf_key_v2_set_spi: " "unknown authentication algorithm %d"
, iproto->auth);
	return -1;

default:
	ssa.sadb_sa_auth = SADB_AALG_NONE0;
}
break;

case IPSEC_PROTO_IPSEC_AH2:
msg.sadb_msg_satype = SADB_SATYPE_AH1;
hashlen = ipsec_ah_keylength(proto);
keylen = 0;

ssa.sadb_sa_encrypt = SADB_EALG_NONE0;
switch (proto->id) {
case IPSEC_AH_MD52:
	ssa.sadb_sa_auth = SADB_AALG_MD5HMAC2;
	break;

case IPSEC_AH_SHA3:
	ssa.sadb_sa_auth = SADB_AALG_SHA1HMAC3;
	break;

case IPSEC_AH_RIPEMD8:
	ssa.sadb_sa_auth = SADB_X_AALG_RIPEMD160HMAC8;
	break;

case IPSEC_AH_SHA2_2565:
	ssa.sadb_sa_auth = SADB_X_AALG_SHA2_2565;
	break;

case IPSEC_AH_SHA2_3846:
	ssa.sadb_sa_auth = SADB_X_AALG_SHA2_3846;
	break;

case IPSEC_AH_SHA2_5127:
	ssa.sadb_sa_auth = SADB_X_AALG_SHA2_5127;
	break;

default:
	LOG_DBG((LOG_SYSDEP, 50, "pf_key_v2_set_spi: "log_debug (LOG_SYSDEP, 50, "pf_key_v2_set_spi: " "unknown authentication algorithm %d"
, proto->id)
	    "unknown authentication algorithm %d", proto->id))log_debug (LOG_SYSDEP, 50, "pf_key_v2_set_spi: " "unknown authentication algorithm %d"
, proto->id);
	goto cleanup;
}
break;

case IPSEC_PROTO_IPCOMP4:
msg.sadb_msg_satype = SADB_X_SATYPE_IPCOMP9;
ssa.sadb_sa_auth = SADB_AALG_NONE0;
keylen = 0;
hashlen = 0;

/*
 * Put compression algorithm type in the sadb_sa_encrypt
 * field.
 */
switch (proto->id) {
4
←
Control jumps to the 'default' case at line 1036→
case IPSEC_IPCOMP_OUI1:
	ssa.sadb_sa_encrypt = SADB_X_CALG_OUI1;
	break;

case IPSEC_IPCOMP_DEFLATE2:
	ssa.sadb_sa_encrypt = SADB_X_CALG_DEFLATE2;
	break;

default:
	break;
5
←
 Execution continues on line 1039→
}
break;

default:
log_print("pf_key_v2_set_spi: invalid proto %d", proto->proto);
goto cleanup;
}
if (incoming6.1
'incoming' is 0
)
6
←
 Execution continues on line 1045→
7
←
Taking false branch→
sa->transport->vtbl->get_src(sa->transport, &dst);
else
sa->transport->vtbl->get_dst(sa->transport, &dst);
msg.sadb_msg_seq = sa->seq;
update = pf_key_v2_msg_new(&msg, 0);
if (!update)
8
←
Assuming 'update' is non-null→
9
←
Taking false branch→
goto cleanup;

/* Setup the rest of the SA extension.  */
ssa.sadb_sa_exttype = SADB_EXT_SA1;
ssa.sadb_sa_len = sizeof ssa / PF_KEY_V2_CHUNK8;
if (proto->spi_sz[incoming] == 2)	/* IPCOMP uses 16bit CPIs.  */
10
←
Assuming the condition is false→
11
←
Taking false branch→
ssa.sadb_sa_spi = htonl(proto->spi[incoming][0] << 8 |(__uint32_t)(__builtin_constant_p(proto->spi[incoming][0] <<
| proto->spi[incoming][1]) ? (__uint32_t)(((__uint32_t)
(proto->spi[incoming][0] << 8 | proto->spi[incoming
][1]) & 0xff) << 24 | ((__uint32_t)(proto->spi[incoming
][0] << 8 | proto->spi[incoming][1]) & 0xff00) <<
| ((__uint32_t)(proto->spi[incoming][0] << 8 | proto
->spi[incoming][1]) & 0xff0000) >> 8 | ((__uint32_t
)(proto->spi[incoming][0] << 8 | proto->spi[incoming
][1]) & 0xff000000) >> 24) : __swap32md(proto->spi
[incoming][0] << 8 | proto->spi[incoming][1]))
    proto->spi[incoming][1])(__uint32_t)(__builtin_constant_p(proto->spi[incoming][0] <<
| proto->spi[incoming][1]) ? (__uint32_t)(((__uint32_t)
(proto->spi[incoming][0] << 8 | proto->spi[incoming
][1]) & 0xff) << 24 | ((__uint32_t)(proto->spi[incoming
][0] << 8 | proto->spi[incoming][1]) & 0xff00) <<
| ((__uint32_t)(proto->spi[incoming][0] << 8 | proto
->spi[incoming][1]) & 0xff0000) >> 8 | ((__uint32_t
)(proto->spi[incoming][0] << 8 | proto->spi[incoming
][1]) & 0xff000000) >> 24) : __swap32md(proto->spi
[incoming][0] << 8 | proto->spi[incoming][1]));
else
memcpy(&ssa.sadb_sa_spi, proto->spi[incoming],
    sizeof ssa.sadb_sa_spi);
ssa.sadb_sa_replay = conf_get_str("General", "Shared-SADB") ? 0 :
12
←
Assuming the condition is false→
13
←
'?' condition is false→
   iproto->replay_window;
ssa.sadb_sa_state = SADB_SASTATE_MATURE1;
ssa.sadb_sa_flags = 0;
if (iproto->encap_mode == IPSEC_ENCAP_TUNNEL1 ||
14
←
Assuming field 'encap_mode' is not equal to IPSEC_ENCAP_TUNNEL→
17
←
Taking false branch→
   iproto->encap_mode == IPSEC_ENCAP_UDP_ENCAP_TUNNEL3 ||
15
←
Assuming field 'encap_mode' is not equal to IPSEC_ENCAP_UDP_ENCAP_TUNNEL→
   iproto->encap_mode == IPSEC_ENCAP_UDP_ENCAP_TUNNEL_DRAFT61443)
16
←
Assuming field 'encap_mode' is not equal to IPSEC_ENCAP_UDP_ENCAP_TUNNEL_DRAFT→
ssa.sadb_sa_flags = SADB_X_SAFLAGS_TUNNEL0x004;

if (isakmp_sa->flags & SA_FLAG_NAT_T_ENABLE0x100) {
18
←
Assuming the condition is false→
19
←
Taking false branch→
bzero(&udpencap, sizeof udpencap);
ssa.sadb_sa_flags |= SADB_X_SAFLAGS_UDPENCAP0x200;
udpencap.sadb_x_udpencap_exttype = SADB_X_EXT_UDPENCAP31;
udpencap.sadb_x_udpencap_len =
    sizeof udpencap / PF_KEY_V2_CHUNK8;
udpencap.sadb_x_udpencap_port = sockaddr_port(dst);
if (pf_key_v2_msg_add(update, (struct sadb_ext *)&udpencap, 0)
    == -1)
	goto cleanup;
}

if (pf_key_v2_msg_add(update, (struct sadb_ext *)&ssa, 0) == -1)
goto cleanup;

if (sa->seconds || sa->kilobytes) {
20
←
Assuming field 'seconds' is 0→
21
←
Assuming field 'kilobytes' is 0→
22
←
Taking false branch→
/* Setup the hard limits.  */
life = malloc(sizeof *life);
if (!life)
	goto cleanup;
life->sadb_lifetime_len = sizeof *life / PF_KEY_V2_CHUNK8;
life->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD3;
life->sadb_lifetime_allocations = 0;
life->sadb_lifetime_bytes = sa->kilobytes * 1024;
/*
 * XXX I am not sure which one is best in security respect.
 * Maybe the RFCs actually mandate what a lifetime really is.
 */
1100#if 0
life->sadb_lifetime_addtime = 0;
life->sadb_lifetime_usetime = sa->seconds;
1103#else
life->sadb_lifetime_addtime = sa->seconds;
life->sadb_lifetime_usetime = 0;
1106#endif
if (pf_key_v2_msg_add(update, (struct sadb_ext *) life,
    PF_KEY_V2_NODE_MALLOCED1) == -1)
	goto cleanup;
life = 0;

/*
 * Setup the soft limits, we use 90 % of the hard ones.
 * XXX A configurable ratio would be better.
 */
life = malloc(sizeof *life);
if (!life)
	goto cleanup;
life->sadb_lifetime_len = sizeof *life / PF_KEY_V2_CHUNK8;
life->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT4;
life->sadb_lifetime_allocations = 0;
life->sadb_lifetime_bytes = sa->kilobytes * 1024 * 9 / 10;
/*
 * XXX I am not sure which one is best in security respect.
 * Maybe the RFCs actually mandate what a lifetime really is.
 */
1127#if 0
life->sadb_lifetime_addtime = 0;
life->sadb_lifetime_usetime = sa->seconds * 9 / 10;
1130#else
life->sadb_lifetime_addtime = sa->seconds * 9 / 10;
life->sadb_lifetime_usetime = 0;
1133#endif
if (pf_key_v2_msg_add(update, (struct sadb_ext *) life,
    PF_KEY_V2_NODE_MALLOCED1) == -1)
	goto cleanup;
life = 0;
}
/*
* Setup the ADDRESS extensions.
*/
if (incoming22.1
'incoming' is 0
)
23
←
Taking false branch→
sa->transport->vtbl->get_dst(sa->transport, &src);
else
sa->transport->vtbl->get_src(sa->transport, &src);
len = sizeof *addr + PF_KEY_V2_ROUND(SA_LEN(src))(((((src)->sa_len)) + 8 - 1) & ~(8 - 1));
addr = calloc(1, len);
if (!addr)
24
←
Assuming 'addr' is non-null→
25
←
Taking false branch→
goto cleanup;
addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC5;
addr->sadb_address_len = len / PF_KEY_V2_CHUNK8;
addr->sadb_address_reserved = 0;
memcpy(addr + 1, src, SA_LEN(src)((src)->sa_len));
switch (((struct sockaddr *) (addr + 1))->sa_family) {
case AF_INET2:
((struct sockaddr_in *) (addr + 1))->sin_port = 0;
break;
case AF_INET624:
((struct sockaddr_in6 *) (addr + 1))->sin6_port = 0;
break;
}
if (pf_key_v2_msg_add(update, (struct sadb_ext *) addr,
26
←
'Default' branch taken. Execution continues on line 1162→
27
←
Taking false branch→
   PF_KEY_V2_NODE_MALLOCED1) == -1)
goto cleanup;
addr = 0;

len = sizeof *addr + PF_KEY_V2_ROUND(SA_LEN(dst))(((((dst)->sa_len)) + 8 - 1) & ~(8 - 1));
addr = calloc(1, len);
if (!addr)
28
←
Assuming 'addr' is non-null→
29
←
Taking false branch→
goto cleanup;
addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST6;
addr->sadb_address_len = len / PF_KEY_V2_CHUNK8;
addr->sadb_address_reserved = 0;
memcpy(addr + 1, dst, SA_LEN(dst)((dst)->sa_len));
switch (((struct sockaddr *) (addr + 1))->sa_family) {
case AF_INET2:
((struct sockaddr_in *) (addr + 1))->sin_port = 0;
break;
case AF_INET624:
((struct sockaddr_in6 *) (addr + 1))->sin6_port = 0;
break;
}
if (pf_key_v2_msg_add(update, (struct sadb_ext *) addr,
30
←
'Default' branch taken. Execution continues on line 1183→
31
←
Taking false branch→
   PF_KEY_V2_NODE_MALLOCED1) == -1)
goto cleanup;
addr = 0;

if (proto->proto31.1
Field 'proto' is equal to IPSEC_PROTO_IPCOMP
 != IPSEC_PROTO_IPCOMP4) {
32
←
Taking false branch→
/* Setup the KEY extensions.  */
if (hashlen) {
	len = sizeof *key + PF_KEY_V2_ROUND(hashlen)(((hashlen) + 8 - 1) & ~(8 - 1));
	key = malloc(len);
	if (!key)
		goto cleanup;
	key->sadb_key_exttype = SADB_EXT_KEY_AUTH8;
	key->sadb_key_len = len / PF_KEY_V2_CHUNK8;
	key->sadb_key_bits = hashlen * 8;
	key->sadb_key_reserved = 0;
	memcpy(key + 1,
	    iproto->keymat[incoming] +
	    (proto->proto ==
		IPSEC_PROTO_IPSEC_ESP3 ? keylen : 0),
	    hashlen);
	if (pf_key_v2_msg_add(update, (struct sadb_ext *) key,
	    PF_KEY_V2_NODE_MALLOCED1) == -1)
		goto cleanup;
	key = 0;
}
if (keylen) {
	len = sizeof *key + PF_KEY_V2_ROUND(keylen)(((keylen) + 8 - 1) & ~(8 - 1));
	key = malloc(len);
	if (!key)
		goto cleanup;
	key->sadb_key_exttype = SADB_EXT_KEY_ENCRYPT9;
	key->sadb_key_len = len / PF_KEY_V2_CHUNK8;
	key->sadb_key_bits = keylen * 8;
	key->sadb_key_reserved = 0;
	memcpy(key + 1, iproto->keymat[incoming], keylen);
	if (pf_key_v2_msg_add(update, (struct sadb_ext *) key,
	    PF_KEY_V2_NODE_MALLOCED1) == -1)
		goto cleanup;
	key = 0;
}
}
/* Setup identity extensions. */
if (isakmp_sa->id_i) {
33
←
Assuming field 'id_i' is null→
34
←
Taking false branch→
pp = pf_key_v2_convert_id(isakmp_sa->id_i, isakmp_sa->id_i_len,
    &len, &idtype);
if (!pp)
	goto nosid;

sid = calloc(PF_KEY_V2_ROUND(len + 1)(((len + 1) + 8 - 1) & ~(8 - 1)) + sizeof *sid,
    sizeof(u_int8_t));
if (!sid) {
	free(pp);
	goto cleanup;
}
sid->sadb_ident_type = idtype;
sid->sadb_ident_len = ((sizeof *sid) / PF_KEY_V2_CHUNK8) +
    PF_KEY_V2_ROUND(len + 1)(((len + 1) + 8 - 1) & ~(8 - 1)) / PF_KEY_V2_CHUNK8;
if ((isakmp_sa->initiator && !incoming) ||
    (!isakmp_sa->initiator && incoming))
	sid->sadb_ident_exttype = SADB_EXT_IDENTITY_SRC10;
else
	sid->sadb_ident_exttype = SADB_EXT_IDENTITY_DST11;

memcpy(sid + 1, pp, len);
free(pp);

if (pf_key_v2_msg_add(update, (struct sadb_ext *) sid,
    PF_KEY_V2_NODE_MALLOCED1) == -1)
	goto cleanup;
sid = 0;

1255nosid:
free(sid);
sid = 0;
}
if (isakmp_sa->id_r) {
35
←
Assuming field 'id_r' is null→
36
←
Taking false branch→
pp = pf_key_v2_convert_id(isakmp_sa->id_r, isakmp_sa->id_r_len,
    &len, &idtype);
if (!pp)
	goto nodid;

sid = calloc(PF_KEY_V2_ROUND(len + 1)(((len + 1) + 8 - 1) & ~(8 - 1)) + sizeof *sid,
    sizeof(u_int8_t));
if (!sid) {
	free(pp);
	goto cleanup;
}
sid->sadb_ident_type = idtype;
sid->sadb_ident_len = ((sizeof *sid) / PF_KEY_V2_CHUNK8) +
    PF_KEY_V2_ROUND(len + 1)(((len + 1) + 8 - 1) & ~(8 - 1)) / PF_KEY_V2_CHUNK8;
if ((isakmp_sa->initiator && !incoming) ||
    (!isakmp_sa->initiator && incoming))
	sid->sadb_ident_exttype = SADB_EXT_IDENTITY_DST11;
else
	sid->sadb_ident_exttype = SADB_EXT_IDENTITY_SRC10;

memcpy(sid + 1, pp, len);
free(pp);

if (pf_key_v2_msg_add(update, (struct sadb_ext *) sid,
    PF_KEY_V2_NODE_MALLOCED1) == -1)
	goto cleanup;
sid = 0;

1288nodid:
free(sid);
sid = 0;
}

/* Setup the flow type extension.  */
bzero(&flowtype, sizeof flowtype);
flowtype.sadb_protocol_exttype = SADB_X_EXT_FLOW_TYPE20;
flowtype.sadb_protocol_len = sizeof flowtype / PF_KEY_V2_CHUNK8;
flowtype.sadb_protocol_direction = incoming36.1
'incoming' is 0
 ?
37
←
'?' condition is false→
   IPSP_DIRECTION_IN0x1 : IPSP_DIRECTION_OUT0x2;

if (pf_key_v2_msg_add(update, (struct sadb_ext *)&flowtype, 0) == -1)
38
←
Taking false branch→
goto cleanup;

bzero(&tprotocol, sizeof tprotocol);
tprotocol.sadb_protocol_exttype = SADB_X_EXT_PROTOCOL19;
tprotocol.sadb_protocol_len = sizeof tprotocol / PF_KEY_V2_CHUNK8;
tprotocol.sadb_protocol_proto = isa->tproto;

if (pf_key_v2_msg_add(update, (struct sadb_ext *)&tprotocol,
39
←
Taking false branch→
   0) == -1)
goto cleanup;

len = sizeof *addr + PF_KEY_V2_ROUND(SA_LEN(isa->src_net))(((((isa->src_net)->sa_len)) + 8 - 1) & ~(8 - 1));
addr = calloc(1, len);
if (!addr)
40
←
Assuming 'addr' is non-null→
goto cleanup;
addr->sadb_address_exttype = incoming41.1
'incoming' is 0
 ?
41
←
Taking false branch→
42
←
'?' condition is false→
   SADB_X_EXT_DST_FLOW22 : SADB_X_EXT_SRC_FLOW21;
addr->sadb_address_len = len / PF_KEY_V2_CHUNK8;
addr->sadb_address_reserved = 0;
pf_key_v2_setup_sockaddr(addr + 1, isa->src_net, 0, isa->sport, 0);
if (pf_key_v2_msg_add(update, (struct sadb_ext *) addr,
43
←
Taking false branch→
   PF_KEY_V2_NODE_MALLOCED1) == -1)
goto cleanup;
addr = 0;

addr = calloc(1, len);
if (!addr)
44
←
Assuming 'addr' is non-null→
goto cleanup;
addr->sadb_address_exttype =
45
←
Taking false branch→
incoming45.1
'incoming' is 0
 ? SADB_X_EXT_DST_MASK18 : SADB_X_EXT_SRC_MASK17;
46
←
'?' condition is false→
addr->sadb_address_len = len / PF_KEY_V2_CHUNK8;
addr->sadb_address_reserved = 0;
pf_key_v2_setup_sockaddr(addr + 1, isa->src_mask, 0,
   isa->sport ? 0xffff : 0, 0);
47
←
Assuming field 'sport' is 0→
48
←
'?' condition is false→
if (pf_key_v2_msg_add(update, (struct sadb_ext *) addr,
49
←
Taking false branch→
   PF_KEY_V2_NODE_MALLOCED1) == -1)
goto cleanup;
addr = 0;

addr = calloc(1, len);
if (!addr)
50
←
Assuming 'addr' is non-null→
goto cleanup;
addr->sadb_address_exttype = incoming51.1
'incoming' is 0
 ?
51
←
Taking false branch→
52
←
'?' condition is false→
   SADB_X_EXT_SRC_FLOW21 : SADB_X_EXT_DST_FLOW22;
addr->sadb_address_len = len / PF_KEY_V2_CHUNK8;
addr->sadb_address_reserved = 0;
pf_key_v2_setup_sockaddr(addr + 1, isa->dst_net, 0, isa->dport, 0);
if (pf_key_v2_msg_add(update, (struct sadb_ext *) addr,
53
←
Taking false branch→
   PF_KEY_V2_NODE_MALLOCED1) == -1)
goto cleanup;
addr = 0;

addr = calloc(1, len);
if (!addr)
54
←
Assuming 'addr' is non-null→
goto cleanup;
addr->sadb_address_exttype =
55
←
Taking false branch→
incoming55.1
'incoming' is 0
 ? SADB_X_EXT_SRC_MASK17 : SADB_X_EXT_DST_MASK18;
56
←
'?' condition is false→
addr->sadb_address_len = len / PF_KEY_V2_CHUNK8;
addr->sadb_address_reserved = 0;
pf_key_v2_setup_sockaddr(addr + 1, isa->dst_mask, 0,
   isa->dport ? 0xffff : 0, 0);
57
←
Assuming field 'dport' is 0→
58
←
'?' condition is false→
if (pf_key_v2_msg_add(update, (struct sadb_ext *) addr,
59
←
Taking false branch→
   PF_KEY_V2_NODE_MALLOCED1) == -1)
goto cleanup;
addr = 0;

/* Add a pf tag to matching packets of this SA. */
if (sa->tag != NULL((void *)0)) {
60
←
Assuming field 'tag' is not equal to NULL→
61
←
Taking true branch→
len = sizeof(*stag) + PF_KEY_V2_ROUND(strlen(sa->tag) + 1)(((strlen(sa->tag) + 1) + 8 - 1) & ~(8 - 1));
if ((stag = calloc(1, len)) == NULL((void *)0))
62
←
Memory is allocated→
63
←
Assuming the condition is false→
64
←
Taking false branch→
	goto cleanup;
stag->sadb_x_tag_exttype = SADB_X_EXT_TAG33;
stag->sadb_x_tag_len = len / PF_KEY_V2_CHUNK8;
stag->sadb_x_tag_taglen = strlen(sa->tag) + 1;
s = (char *)(stag + 1);
strlcpy(s, sa->tag, stag->sadb_x_tag_taglen);
if (pf_key_v2_msg_add(update, (struct sadb_ext *)stag,
65
←
Taking true branch→
    PF_KEY_V2_NODE_MALLOCED1) == -1)
	goto cleanup;
66
←
Control jumps to line 1450→
}

if (sa->flags & SA_FLAG_IFACE0x400) {
struct sadb_x_iface *siface;

len = sizeof(*siface);
siface = calloc(1, len);
if (siface == NULL((void *)0))
	goto cleanup;

siface->sadb_x_iface_len = len / PF_KEY_V2_CHUNK8;
siface->sadb_x_iface_exttype = SADB_X_EXT_IFACE40;
siface->sadb_x_iface_unit = sa->iface;
siface->sadb_x_iface_direction = incoming ?
    IPSP_DIRECTION_IN0x1 : IPSP_DIRECTION_OUT0x2;

if (pf_key_v2_msg_add(update, (struct sadb_ext *)siface,
    PF_KEY_V2_NODE_MALLOCED1) == -1)
	goto cleanup;

snprintf(iface_str, sizeof(iface_str), "iface %u", sa->iface);
}

/* XXX Here can sensitivity extensions be setup.  */

if (sockaddr2text(dst, &addr_str, 0))
addr_str = 0;

LOG_DBG((LOG_SYSDEP, 10, "pf_key_v2_set_spi: "log_debug (LOG_SYSDEP, 10, "pf_key_v2_set_spi: " "satype %d dst %s SPI 0x%x%s%s%s"
, msg.sadb_msg_satype, addr_str ? addr_str : "unknown", (__uint32_t
)(__builtin_constant_p(ssa.sadb_sa_spi) ? (__uint32_t)(((__uint32_t
)(ssa.sadb_sa_spi) & 0xff) << 24 | ((__uint32_t)(ssa
.sadb_sa_spi) & 0xff00) << 8 | ((__uint32_t)(ssa.sadb_sa_spi
) & 0xff0000) >> 8 | ((__uint32_t)(ssa.sadb_sa_spi)
 & 0xff000000) >> 24) : __swap32md(ssa.sadb_sa_spi)
), sa->tag ? " tag " : "", sa->tag ? sa->tag : "", iface_str
)
   "satype %d dst %s SPI 0x%x%s%s%s", msg.sadb_msg_satype,log_debug (LOG_SYSDEP, 10, "pf_key_v2_set_spi: " "satype %d dst %s SPI 0x%x%s%s%s"
, msg.sadb_msg_satype, addr_str ? addr_str : "unknown", (__uint32_t
)(__builtin_constant_p(ssa.sadb_sa_spi) ? (__uint32_t)(((__uint32_t
)(ssa.sadb_sa_spi) & 0xff) << 24 | ((__uint32_t)(ssa
.sadb_sa_spi) & 0xff00) << 8 | ((__uint32_t)(ssa.sadb_sa_spi
) & 0xff0000) >> 8 | ((__uint32_t)(ssa.sadb_sa_spi)
 & 0xff000000) >> 24) : __swap32md(ssa.sadb_sa_spi)
), sa->tag ? " tag " : "", sa->tag ? sa->tag : "", iface_str
)
   addr_str ? addr_str : "unknown",log_debug (LOG_SYSDEP, 10, "pf_key_v2_set_spi: " "satype %d dst %s SPI 0x%x%s%s%s"
, msg.sadb_msg_satype, addr_str ? addr_str : "unknown", (__uint32_t
)(__builtin_constant_p(ssa.sadb_sa_spi) ? (__uint32_t)(((__uint32_t
)(ssa.sadb_sa_spi) & 0xff) << 24 | ((__uint32_t)(ssa
.sadb_sa_spi) & 0xff00) << 8 | ((__uint32_t)(ssa.sadb_sa_spi
) & 0xff0000) >> 8 | ((__uint32_t)(ssa.sadb_sa_spi)
 & 0xff000000) >> 24) : __swap32md(ssa.sadb_sa_spi)
), sa->tag ? " tag " : "", sa->tag ? sa->tag : "", iface_str
)
   ntohl(ssa.sadb_sa_spi), sa->tag ? " tag " : "",log_debug (LOG_SYSDEP, 10, "pf_key_v2_set_spi: " "satype %d dst %s SPI 0x%x%s%s%s"
, msg.sadb_msg_satype, addr_str ? addr_str : "unknown", (__uint32_t
)(__builtin_constant_p(ssa.sadb_sa_spi) ? (__uint32_t)(((__uint32_t
)(ssa.sadb_sa_spi) & 0xff) << 24 | ((__uint32_t)(ssa
.sadb_sa_spi) & 0xff00) << 8 | ((__uint32_t)(ssa.sadb_sa_spi
) & 0xff0000) >> 8 | ((__uint32_t)(ssa.sadb_sa_spi)
 & 0xff000000) >> 24) : __swap32md(ssa.sadb_sa_spi)
), sa->tag ? " tag " : "", sa->tag ? sa->tag : "", iface_str
)
   sa->tag ? sa->tag : "", iface_str))log_debug (LOG_SYSDEP, 10, "pf_key_v2_set_spi: " "satype %d dst %s SPI 0x%x%s%s%s"
, msg.sadb_msg_satype, addr_str ? addr_str : "unknown", (__uint32_t
)(__builtin_constant_p(ssa.sadb_sa_spi) ? (__uint32_t)(((__uint32_t
)(ssa.sadb_sa_spi) & 0xff) << 24 | ((__uint32_t)(ssa
.sadb_sa_spi) & 0xff00) << 8 | ((__uint32_t)(ssa.sadb_sa_spi
) & 0xff0000) >> 8 | ((__uint32_t)(ssa.sadb_sa_spi)
 & 0xff000000) >> 24) : __swap32md(ssa.sadb_sa_spi)
), sa->tag ? " tag " : "", sa->tag ? sa->tag : "", iface_str
);

free(addr_str);

/*
* Although PF_KEY knows about expirations, it is unreliable per the
* specs thus we need to do them inside isakmpd as well.
*/
if (sa->seconds)
if (sa_setup_expirations(sa))
	goto cleanup;

ret = pf_key_v2_call(update);
pf_key_v2_msg_free(update);
update = 0;
if (!ret)
goto cleanup;
err = ((struct sadb_msg *)TAILQ_FIRST(ret)((ret)->tqh_first)->seg)->sadb_msg_errno;
pf_key_v2_msg_free(ret);
ret = 0;

/*
* If we are doing an addition into an SADB shared with our peer,
* errors here are to be expected as the peer will already have
* created the SA, and can thus be ignored.
*/
if (err && !(msg.sadb_msg_type == SADB_ADD3 &&
   conf_get_str("General", "Shared-SADB"))) {
log_print("pf_key_v2_set_spi: %s: %s",
    msg.sadb_msg_type == SADB_ADD3 ? "ADD" : "UPDATE",
    strerror(err));
goto cleanup;
}
LOG_DBG((LOG_SYSDEP, 50, "pf_key_v2_set_spi: done"))log_debug (LOG_SYSDEP, 50, "pf_key_v2_set_spi: done");

return 0;

1449cleanup:
free(sid);
67
←
Potential leak of memory pointed to by 'stag'
free(addr);
free(life);
free(key);
if (update)
pf_key_v2_msg_free(update);
if (ret)
pf_key_v2_msg_free(ret);
return -1;
1459}

1461static __inline__ int
1462pf_key_v2_mask_to_bits(u_int32_t mask)
1463{
u_int32_t       hmask = ntohl(mask)(__uint32_t)(__builtin_constant_p(mask) ? (__uint32_t)(((__uint32_t
)(mask) & 0xff) << 24 | ((__uint32_t)(mask) & 0xff00
) << 8 | ((__uint32_t)(mask) & 0xff0000) >> 8
 | ((__uint32_t)(mask) & 0xff000000) >> 24) : __swap32md
(mask));

return (33 - ffs(~hmask + 1)) % 33;
1467}

1469static int
1470pf_key_v2_mask6_to_bits(u_int8_t *mask)
1471{
int		n;

bit_ffc(mask, 128, &n)do { register bitstr_t *__name = (mask); register int __bit, __nbits
 = (128), __value = -1; for (__bit = 0; __bit < __nbits; ++
__bit) if (!((__name)[((__bit) >> 3)] & (1 <<
 ((__bit)&0x7)))) { __value = __bit; break; } *(&n) =
 __value; } while(0);
return n == -1 ? 128 : n;
1476}

1478/*
* Enable/disable a flow.
* XXX Assumes OpenBSD {ADD,DEL}FLOW extensions.
*/
1482static int
1483pf_key_v2_flow(struct sockaddr *laddr, struct sockaddr *lmask,
  struct sockaddr *raddr, struct sockaddr *rmask,
  u_int8_t tproto, u_int16_t sport, u_int16_t dport,
  u_int8_t *spi, u_int8_t proto, struct sockaddr *dst,
  struct sockaddr *src, int delete, int ingress,
  u_int8_t srcid_type, u_int8_t *srcid, int srcid_len,
  u_int8_t dstid_type, u_int8_t *dstid, int dstid_len,
  struct ipsec_proto *iproto)
1491{
char           *laddr_str, *lmask_str, *raddr_str, *rmask_str;

struct sadb_msg msg;
struct sadb_protocol flowtype;
struct sadb_ident *sid = 0;
struct sadb_address *addr = 0;
struct sadb_protocol tprotocol;
struct pf_key_v2_msg *flow = 0, *ret = 0;
size_t		len;
int		err;

msg.sadb_msg_type = delete ? SADB_X_DELFLOW13 : SADB_X_ADDFLOW12;
switch (proto) {
case IPSEC_PROTO_IPSEC_ESP3:
msg.sadb_msg_satype = SADB_SATYPE_ESP2;
break;
case IPSEC_PROTO_IPSEC_AH2:
msg.sadb_msg_satype = SADB_SATYPE_AH1;
break;
case IPSEC_PROTO_IPCOMP4:
msg.sadb_msg_satype = SADB_X_SATYPE_IPCOMP9;
break;
default:
log_print("pf_key_v2_flow: invalid proto %d", proto);
goto cleanup;
}
msg.sadb_msg_seq = 0;
flow = pf_key_v2_msg_new(&msg, 0);
if (!flow)
goto cleanup;

if (!delete) {
/* Setup the source ID, if provided. */
if (srcid) {
	sid = calloc(
	    PF_KEY_V2_ROUND(srcid_len + 1)(((srcid_len + 1) + 8 - 1) & ~(8 - 1)) + sizeof *sid,
	    sizeof(u_int8_t));
	if (!sid)
		goto cleanup;

	sid->sadb_ident_len = ((sizeof *sid) / PF_KEY_V2_CHUNK8)
	    + PF_KEY_V2_ROUND(srcid_len + 1)(((srcid_len + 1) + 8 - 1) & ~(8 - 1)) / PF_KEY_V2_CHUNK8;
	sid->sadb_ident_exttype = SADB_EXT_IDENTITY_SRC10;
	sid->sadb_ident_type = srcid_type;

	memcpy(sid + 1, srcid, srcid_len);

	if (pf_key_v2_msg_add(flow, (struct sadb_ext *) sid,
	    PF_KEY_V2_NODE_MALLOCED1) == -1)
		goto cleanup;

	sid = 0;
}
/* Setup the destination ID, if provided. */
if (dstid) {
	sid = calloc(
	    PF_KEY_V2_ROUND(dstid_len + 1)(((dstid_len + 1) + 8 - 1) & ~(8 - 1)) + sizeof *sid,
	    sizeof(u_int8_t));
	if (!sid)
		goto cleanup;

	sid->sadb_ident_len = ((sizeof *sid) / PF_KEY_V2_CHUNK8)
	    + PF_KEY_V2_ROUND(dstid_len + 1)(((dstid_len + 1) + 8 - 1) & ~(8 - 1)) / PF_KEY_V2_CHUNK8;
	sid->sadb_ident_exttype = SADB_EXT_IDENTITY_DST11;
	sid->sadb_ident_type = dstid_type;

	memcpy(sid + 1, dstid, dstid_len);

	if (pf_key_v2_msg_add(flow, (struct sadb_ext *) sid,
	    PF_KEY_V2_NODE_MALLOCED1) == -1)
		goto cleanup;

	sid = 0;
}
}
/* Setup the flow type extension.  */
bzero(&flowtype, sizeof flowtype);
flowtype.sadb_protocol_exttype = SADB_X_EXT_FLOW_TYPE20;
flowtype.sadb_protocol_len = sizeof flowtype / PF_KEY_V2_CHUNK8;
flowtype.sadb_protocol_direction =
   ingress ? IPSP_DIRECTION_IN0x1 : IPSP_DIRECTION_OUT0x2;
flowtype.sadb_protocol_proto = SADB_X_FLOW_TYPE_REQUIRE3;

if (pf_key_v2_msg_add(flow, (struct sadb_ext *)&flowtype, 0) == -1)
goto cleanup;

/*
* Setup the ADDRESS extensions.
*/
len = sizeof *addr + PF_KEY_V2_ROUND(SA_LEN(src))(((((src)->sa_len)) + 8 - 1) & ~(8 - 1));
if (!delete)
{
addr = calloc(1, len);
if (!addr)
	goto cleanup;
addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST6;
addr->sadb_address_len = len / PF_KEY_V2_CHUNK8;
addr->sadb_address_reserved = 0;
pf_key_v2_setup_sockaddr(addr + 1, src, dst, 0, ingress);
if (pf_key_v2_msg_add(flow, (struct sadb_ext *) addr,
    PF_KEY_V2_NODE_MALLOCED1) == -1)
	goto cleanup;
addr = 0;
}
len = sizeof *addr + PF_KEY_V2_ROUND(SA_LEN(laddr))(((((laddr)->sa_len)) + 8 - 1) & ~(8 - 1));
addr = calloc(1, len);
if (!addr)
goto cleanup;
addr->sadb_address_exttype = SADB_X_EXT_SRC_FLOW21;
addr->sadb_address_len = len / PF_KEY_V2_CHUNK8;
addr->sadb_address_reserved = 0;
pf_key_v2_setup_sockaddr(addr + 1, laddr, 0, sport, 0);
if (pf_key_v2_msg_add(flow, (struct sadb_ext *) addr,
   PF_KEY_V2_NODE_MALLOCED1) == -1)
goto cleanup;
addr = 0;

addr = calloc(1, len);
if (!addr)
goto cleanup;
addr->sadb_address_exttype = SADB_X_EXT_SRC_MASK17;
addr->sadb_address_len = len / PF_KEY_V2_CHUNK8;
addr->sadb_address_reserved = 0;
pf_key_v2_setup_sockaddr(addr + 1, lmask, 0, sport ? 0xffff : 0, 0);
if (pf_key_v2_msg_add(flow, (struct sadb_ext *) addr,
   PF_KEY_V2_NODE_MALLOCED1) == -1)
goto cleanup;
addr = 0;

addr = calloc(1, len);
if (!addr)
goto cleanup;
addr->sadb_address_exttype = SADB_X_EXT_DST_FLOW22;
addr->sadb_address_len = len / PF_KEY_V2_CHUNK8;
addr->sadb_address_reserved = 0;
pf_key_v2_setup_sockaddr(addr + 1, raddr, 0, dport, 0);
if (pf_key_v2_msg_add(flow, (struct sadb_ext *) addr,
   PF_KEY_V2_NODE_MALLOCED1) == -1)
goto cleanup;
addr = 0;

addr = calloc(1, len);
if (!addr)
goto cleanup;
addr->sadb_address_exttype = SADB_X_EXT_DST_MASK18;
addr->sadb_address_len = len / PF_KEY_V2_CHUNK8;
addr->sadb_address_reserved = 0;
pf_key_v2_setup_sockaddr(addr + 1, rmask, 0, dport ? 0xffff : 0, 0);
if (pf_key_v2_msg_add(flow, (struct sadb_ext *) addr,
   PF_KEY_V2_NODE_MALLOCED1) == -1)
goto cleanup;
addr = 0;

/* Setup the protocol extension.  */
bzero(&tprotocol, sizeof tprotocol);
tprotocol.sadb_protocol_exttype = SADB_X_EXT_PROTOCOL19;
tprotocol.sadb_protocol_len = sizeof tprotocol / PF_KEY_V2_CHUNK8;
tprotocol.sadb_protocol_proto = tproto;

if (pf_key_v2_msg_add(flow, (struct sadb_ext *)&tprotocol, 0) == -1)
goto cleanup;

if (sockaddr2text(laddr, &laddr_str, 0))
laddr_str = 0;
if (sockaddr2text(lmask, &lmask_str, 0))
lmask_str = 0;
if (sockaddr2text(raddr, &raddr_str, 0))
raddr_str = 0;
if (sockaddr2text(rmask, &rmask_str, 0))
rmask_str = 0;

LOG_DBG((LOG_SYSDEP, 50,log_debug (LOG_SYSDEP, 50, "pf_key_v2_flow: src %s %s dst %s %s proto %u sport %u dport %u"
, laddr_str ? laddr_str : "<??\?>", lmask_str ? lmask_str
 : "<??\?>", raddr_str ? raddr_str : "<??\?>", rmask_str
 ? rmask_str : "<??\?>", tproto, (__uint16_t)(__builtin_constant_p
(sport) ? (__uint16_t)(((__uint16_t)(sport) & 0xffU) <<
| ((__uint16_t)(sport) & 0xff00U) >> 8) : __swap16md
(sport)), (__uint16_t)(__builtin_constant_p(dport) ? (__uint16_t
)(((__uint16_t)(dport) & 0xffU) << 8 | ((__uint16_t
)(dport) & 0xff00U) >> 8) : __swap16md(dport)))
  "pf_key_v2_flow: src %s %s dst %s %s proto %u sport %u dport %u",log_debug (LOG_SYSDEP, 50, "pf_key_v2_flow: src %s %s dst %s %s proto %u sport %u dport %u"
, laddr_str ? laddr_str : "<??\?>", lmask_str ? lmask_str
 : "<??\?>", raddr_str ? raddr_str : "<??\?>", rmask_str
 ? rmask_str : "<??\?>", tproto, (__uint16_t)(__builtin_constant_p
(sport) ? (__uint16_t)(((__uint16_t)(sport) & 0xffU) <<
| ((__uint16_t)(sport) & 0xff00U) >> 8) : __swap16md
(sport)), (__uint16_t)(__builtin_constant_p(dport) ? (__uint16_t
)(((__uint16_t)(dport) & 0xffU) << 8 | ((__uint16_t
)(dport) & 0xff00U) >> 8) : __swap16md(dport)))
laddr_str ? laddr_str : "<??\?>", lmask_str ? lmask_str : "<??\?>",log_debug (LOG_SYSDEP, 50, "pf_key_v2_flow: src %s %s dst %s %s proto %u sport %u dport %u"
, laddr_str ? laddr_str : "<??\?>", lmask_str ? lmask_str
 : "<??\?>", raddr_str ? raddr_str : "<??\?>", rmask_str
 ? rmask_str : "<??\?>", tproto, (__uint16_t)(__builtin_constant_p
(sport) ? (__uint16_t)(((__uint16_t)(sport) & 0xffU) <<
| ((__uint16_t)(sport) & 0xff00U) >> 8) : __swap16md
(sport)), (__uint16_t)(__builtin_constant_p(dport) ? (__uint16_t
)(((__uint16_t)(dport) & 0xffU) << 8 | ((__uint16_t
)(dport) & 0xff00U) >> 8) : __swap16md(dport)))
raddr_str ? raddr_str : "<??\?>", rmask_str ? rmask_str : "<??\?>",log_debug (LOG_SYSDEP, 50, "pf_key_v2_flow: src %s %s dst %s %s proto %u sport %u dport %u"
, laddr_str ? laddr_str : "<??\?>", lmask_str ? lmask_str
 : "<??\?>", raddr_str ? raddr_str : "<??\?>", rmask_str
 ? rmask_str : "<??\?>", tproto, (__uint16_t)(__builtin_constant_p
(sport) ? (__uint16_t)(((__uint16_t)(sport) & 0xffU) <<
| ((__uint16_t)(sport) & 0xff00U) >> 8) : __swap16md
(sport)), (__uint16_t)(__builtin_constant_p(dport) ? (__uint16_t
)(((__uint16_t)(dport) & 0xffU) << 8 | ((__uint16_t
)(dport) & 0xff00U) >> 8) : __swap16md(dport)))
 tproto, ntohs(sport), ntohs(dport)))log_debug (LOG_SYSDEP, 50, "pf_key_v2_flow: src %s %s dst %s %s proto %u sport %u dport %u"
, laddr_str ? laddr_str : "<??\?>", lmask_str ? lmask_str
 : "<??\?>", raddr_str ? raddr_str : "<??\?>", rmask_str
 ? rmask_str : "<??\?>", tproto, (__uint16_t)(__builtin_constant_p
(sport) ? (__uint16_t)(((__uint16_t)(sport) & 0xffU) <<
| ((__uint16_t)(sport) & 0xff00U) >> 8) : __swap16md
(sport)), (__uint16_t)(__builtin_constant_p(dport) ? (__uint16_t
)(((__uint16_t)(dport) & 0xffU) << 8 | ((__uint16_t
)(dport) & 0xff00U) >> 8) : __swap16md(dport)));

free(laddr_str);
free(lmask_str);
free(raddr_str);
free(rmask_str);

ret = pf_key_v2_call(flow);
pf_key_v2_msg_free(flow);
flow = 0;
if (!ret)
goto cleanup;
err = ((struct sadb_msg *)TAILQ_FIRST(ret)((ret)->tqh_first)->seg)->sadb_msg_errno;
if (err) {
if (err == ESRCH3)	/* These are common and usually
			 * harmless.  */
	LOG_DBG((LOG_SYSDEP, 10, "pf_key_v2_flow: %sFLOW: %s",log_debug (LOG_SYSDEP, 10, "pf_key_v2_flow: %sFLOW: %s", delete
 ? "DEL" : "ADD", strerror(err))
		 delete ? "DEL" : "ADD", strerror(err)))log_debug (LOG_SYSDEP, 10, "pf_key_v2_flow: %sFLOW: %s", delete
 ? "DEL" : "ADD", strerror(err));
else
	log_print("pf_key_v2_flow: %sFLOW: %s",
	    delete ? "DEL" : "ADD", strerror(err));
goto cleanup;
}
pf_key_v2_msg_free(ret);

LOG_DBG((LOG_MISC, 50, "pf_key_v2_flow: %sFLOW: done",log_debug (LOG_MISC, 50, "pf_key_v2_flow: %sFLOW: done", delete
 ? "DEL" : "ADD")
 delete ? "DEL" : "ADD"))log_debug (LOG_MISC, 50, "pf_key_v2_flow: %sFLOW: done", delete
 ? "DEL" : "ADD");

return 0;

1697cleanup:
free(sid);
free(addr);
if (flow)
pf_key_v2_msg_free(flow);
if (ret)
pf_key_v2_msg_free(ret);
return -1;
1705}

1707static u_int8_t *
1708pf_key_v2_convert_id(u_int8_t *id, int idlen, size_t *reslen, int *idtype)
1709{
u_int8_t       *addr, *res = 0;
char		addrbuf[ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255" + 5];

switch (id[0]) {
case IPSEC_ID_FQDN2:
res = calloc(idlen - ISAKMP_ID_DATA_OFF8 + ISAKMP_GEN_SZ4,
    sizeof(u_int8_t));
if (!res)
	return 0;

*reslen = idlen - ISAKMP_ID_DATA_OFF8 + ISAKMP_GEN_SZ4;
memcpy(res, id + ISAKMP_ID_DATA_OFF8 - ISAKMP_GEN_SZ4, *reslen);
*idtype = SADB_IDENTTYPE_FQDN2;
LOG_DBG((LOG_SYSDEP, 40, "pf_key_v2_convert_id: FQDN %.*s",log_debug (LOG_SYSDEP, 40, "pf_key_v2_convert_id: FQDN %.*s",
 (int) *reslen, res)
    (int) *reslen, res))log_debug (LOG_SYSDEP, 40, "pf_key_v2_convert_id: FQDN %.*s",
 (int) *reslen, res);
return res;

case IPSEC_ID_USER_FQDN3:
res = calloc(idlen - ISAKMP_ID_DATA_OFF8 + ISAKMP_GEN_SZ4,
    sizeof(u_int8_t));
if (!res)
	return 0;

*reslen = idlen - ISAKMP_ID_DATA_OFF8 + ISAKMP_GEN_SZ4;
memcpy(res, id + ISAKMP_ID_DATA_OFF8 - ISAKMP_GEN_SZ4, *reslen);
*idtype = SADB_IDENTTYPE_USERFQDN3;
LOG_DBG((LOG_SYSDEP, 40, "pf_key_v2_convert_id: UFQDN %.*s",log_debug (LOG_SYSDEP, 40, "pf_key_v2_convert_id: UFQDN %.*s"
, (int) *reslen, res)
    (int) *reslen, res))log_debug (LOG_SYSDEP, 40, "pf_key_v2_convert_id: UFQDN %.*s"
, (int) *reslen, res);
return res;

case IPSEC_ID_IPV4_ADDR1:
if (inet_ntop(AF_INET2, id + ISAKMP_ID_DATA_OFF8 - ISAKMP_GEN_SZ4,
    addrbuf, ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0))
	return 0;
*reslen = strlen(addrbuf) + 3;
strlcat(addrbuf, "/32", ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255" + 5);
res = (u_int8_t *) strdup(addrbuf);
if (!res)
	return 0;
*idtype = SADB_IDENTTYPE_PREFIX1;
LOG_DBG((LOG_SYSDEP, 40, "pf_key_v2_convert_id: "log_debug (LOG_SYSDEP, 40, "pf_key_v2_convert_id: " "IPv4 address %s"
, res)
    "IPv4 address %s", res))log_debug (LOG_SYSDEP, 40, "pf_key_v2_convert_id: " "IPv4 address %s"
, res);
return res;

case IPSEC_ID_IPV6_ADDR5:
if (inet_ntop(AF_INET624,
    id + ISAKMP_ID_DATA_OFF8 - ISAKMP_GEN_SZ4,
    addrbuf, ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0))
	return 0;
*reslen = strlen(addrbuf) + 4;
strlcat(addrbuf, "/128", ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255" + 5);
res = (u_int8_t *) strdup(addrbuf);
if (!res)
	return 0;
LOG_DBG((LOG_SYSDEP, 40, "pf_key_v2_convert_id: "log_debug (LOG_SYSDEP, 40, "pf_key_v2_convert_id: " "IPv6 address %s"
, res)
    "IPv6 address %s", res))log_debug (LOG_SYSDEP, 40, "pf_key_v2_convert_id: " "IPv6 address %s"
, res);
*idtype = SADB_IDENTTYPE_PREFIX1;
return res;

case IPSEC_ID_IPV4_ADDR_SUBNET4:	/* XXX PREFIX */
addr = id + ISAKMP_ID_DATA_OFF8 - ISAKMP_GEN_SZ4;
if (inet_ntop(AF_INET2, addr, addrbuf, ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0))
	return 0;
snprintf(addrbuf + strlen(addrbuf),
    ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255" - strlen(addrbuf), "/%d",
    pf_key_v2_mask_to_bits(*(u_int32_t *)(addr +
	sizeof(struct in_addr))));
*reslen = strlen(addrbuf);
res = (u_int8_t *) strdup(addrbuf);
if (!res)
	return 0;
*idtype = SADB_IDENTTYPE_PREFIX1;
LOG_DBG((LOG_SYSDEP, 40, "pf_key_v2_convert_id: "log_debug (LOG_SYSDEP, 40, "pf_key_v2_convert_id: " "IPv4 subnet %s"
, res)
    "IPv4 subnet %s", res))log_debug (LOG_SYSDEP, 40, "pf_key_v2_convert_id: " "IPv4 subnet %s"
, res);
return res;

case IPSEC_ID_IPV6_ADDR_SUBNET6:	/* XXX PREFIX */
addr = id + ISAKMP_ID_DATA_OFF8 - ISAKMP_GEN_SZ4;
if (inet_ntop(AF_INET624, addr, addrbuf, ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0))
	return 0;
snprintf(addrbuf + strlen(addrbuf),
    ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255" - strlen(addrbuf), "/%d",
    pf_key_v2_mask6_to_bits(addr +
	sizeof(struct in6_addr)));
*reslen = strlen(addrbuf);
res = (u_int8_t *) strdup(addrbuf);
if (!res)
	return 0;
LOG_DBG((LOG_SYSDEP, 40, "pf_key_v2_convert_id: "log_debug (LOG_SYSDEP, 40, "pf_key_v2_convert_id: " "IPv6 subnet %s"
, res)
    "IPv6 subnet %s", res))log_debug (LOG_SYSDEP, 40, "pf_key_v2_convert_id: " "IPv6 subnet %s"
, res);
*idtype = SADB_IDENTTYPE_PREFIX1;
return res;

case IPSEC_ID_IPV4_RANGE7:
case IPSEC_ID_IPV6_RANGE8:
case IPSEC_ID_DER_ASN1_DN9:
case IPSEC_ID_DER_ASN1_GN10:
case IPSEC_ID_KEY_ID11:
/* XXX Not implemented yet.  */
return 0;
}

return 0;
1813}

1815/* Enable a flow given an SA.  */
1816int
1817pf_key_v2_enable_sa(struct sa *sa, struct sa *isakmp_sa)
1818{
struct ipsec_sa *isa = sa->data;
struct sockaddr *dst, *src;
int		error;
struct proto   *proto = TAILQ_FIRST(&sa->protos)((&sa->protos)->tqh_first);
int		sidtype = 0, didtype = 0;
size_t		sidlen = 0, didlen = 0;
u_int8_t       *sid = 0, *did = 0;

if (proto == NULL((void *)0)) {
log_print("pf_key_v2_enable_sa: no proto");
return EINVAL22;
}

sa->transport->vtbl->get_dst(sa->transport, &dst);
sa->transport->vtbl->get_src(sa->transport, &src);

if (isakmp_sa->id_i) {
if (isakmp_sa->initiator)
	sid = pf_key_v2_convert_id(isakmp_sa->id_i,
	    isakmp_sa->id_i_len, &sidlen, &sidtype);
else
	did = pf_key_v2_convert_id(isakmp_sa->id_i,
	    isakmp_sa->id_i_len, &didlen, &didtype);
}
if (isakmp_sa->id_r) {
if (isakmp_sa->initiator)
	did = pf_key_v2_convert_id(isakmp_sa->id_r,
	    isakmp_sa->id_r_len, &didlen, &didtype);
else
	sid = pf_key_v2_convert_id(isakmp_sa->id_r,
	    isakmp_sa->id_r_len, &sidlen, &sidtype);
}

error = pf_key_v2_flow(isa->src_net, isa->src_mask, isa->dst_net,
   isa->dst_mask, isa->tproto, isa->sport, isa->dport, proto->spi[0],
   proto->proto, dst, src, 0, 0, sidtype, sid, sidlen, didtype, did,
   didlen, proto->data);
if (error)
goto cleanup;

error = pf_key_v2_flow(isa->dst_net, isa->dst_mask, isa->src_net,
   isa->src_mask, isa->tproto, isa->dport, isa->sport, proto->spi[1],
   proto->proto, src, dst, 0, 1, sidtype, sid, sidlen, didtype, did,
   didlen, proto->data);

1864cleanup:
free(sid);
free(did);

return error;
1869}

1871/* Increase reference count of refcounted sections. */
1872static int
1873pf_key_v2_conf_refinc(int af, char *section)
1874{
char		conn[22];
int		num;

if (!section)
return 0;

num = conf_get_num(section, "Refcount", 0);
if (num == 0)
return 0;

snprintf(conn, sizeof conn, "%d", num + 1);
conf_set(af, section, "Refcount", conn, 1, 0);
return 0;
1888}

1890/*
* Return 0 if the section didn't exist or was removed, non-zero otherwise.
* Don't touch non-refcounted (statically defined) sections.
*/
1894static int
1895pf_key_v2_conf_refhandle(int af, char *section)
1896{
char		conn[22];
int		num;

if (!section)
return 0;

num = conf_get_num(section, "Refcount", 0);
if (num == 1) {
conf_remove_section(af, section);
num--;
} else if (num != 0) {
snprintf(conn, sizeof conn, "%d", num - 1);
conf_set(af, section, "Refcount", conn, 1, 0);
}
return num;
1912}

1914/* Remove all dynamically-established configuration entries.  */
1915static int
1916pf_key_v2_remove_conf(char *section)
1917{
char           *ikepeer, *localid, *remoteid, *configname;
struct conf_list_node *attr;
struct conf_list *attrs;
int		af;

if (!section)
return 0;

if (!conf_get_str(section, "Phase"))
return 0;

/* Only remove dynamically-established entries. */
attrs = conf_get_list(section, "Flags");
if (attrs) {
for (attr = TAILQ_FIRST(&attrs->fields)((&attrs->fields)->tqh_first); attr;
    attr = TAILQ_NEXT(attr, link)((attr)->link.tqe_next))
	if (!strcasecmp(attr->field, "__ondemand"))
		goto passed;

conf_free_list(attrs);
}
return 0;

1941passed:
conf_free_list(attrs);

af = conf_begin();

configname = conf_get_str(section, "Configuration");
pf_key_v2_conf_refhandle(af, configname);

/* These are the Phase 2 Local/Remote IDs. */
localid = conf_get_str(section, "Local-ID");
pf_key_v2_conf_refhandle(af, localid);

remoteid = conf_get_str(section, "Remote-ID");
pf_key_v2_conf_refhandle(af, remoteid);

ikepeer = conf_get_str(section, "ISAKMP-peer");

pf_key_v2_conf_refhandle(af, section);

if (ikepeer) {
remoteid = conf_get_str(ikepeer, "Remote-ID");
localid = conf_get_str(ikepeer, "ID");
configname = conf_get_str(ikepeer, "Configuration");

pf_key_v2_conf_refhandle(af, ikepeer);
pf_key_v2_conf_refhandle(af, configname);

/* Phase 1 IDs */
pf_key_v2_conf_refhandle(af, localid);
pf_key_v2_conf_refhandle(af, remoteid);
}
conf_end(af, 1);
return 0;
1974}

1976/* Disable a flow given a SA.  */
1977int
1978pf_key_v2_disable_sa(struct sa *sa, int incoming)
1979{
struct ipsec_sa *isa = sa->data;
struct sockaddr *dst, *src;
struct proto   *proto = TAILQ_FIRST(&sa->protos)((&sa->protos)->tqh_first);

sa->transport->vtbl->get_dst(sa->transport, &dst);
sa->transport->vtbl->get_src(sa->transport, &src);

if (!incoming)
return pf_key_v2_flow(isa->src_net, isa->src_mask,
    isa->dst_net, isa->dst_mask, isa->tproto, isa->sport,
    isa->dport, proto->spi[0], proto->proto, src, dst, 1, 0,
    0, 0, 0, 0, 0, 0, proto->data);
else {
return pf_key_v2_flow(isa->dst_net, isa->dst_mask,
    isa->src_net, isa->src_mask, isa->tproto, isa->dport,
    isa->sport, proto->spi[1], proto->proto, src, dst, 1, 1,
    0, 0, 0, 0, 0, 0, proto->data);
}
1998}

2000/*
* Delete the IPsec SA represented by the INCOMING direction in protocol PROTO
* of the IKE security association SA.  Also delete potential flows tied to it.
*/
2004int
2005pf_key_v2_delete_spi(struct sa *sa, struct proto *proto, int incoming)
2006{
struct sadb_msg msg;
struct sadb_sa  ssa;
struct sadb_address *addr = 0;
struct sockaddr *saddr;
int		len, err;
struct pf_key_v2_msg *delete = 0, *ret = 0;

/* If it's not an established SA, don't proceed. */
if (!(sa->flags & SA_FLAG_READY0x01))
return 0;

if (sa->name && !(sa->flags & SA_FLAG_REPLACED0x08)) {
LOG_DBG((LOG_SYSDEP, 50,log_debug (LOG_SYSDEP, 50, "pf_key_v2_delete_spi: removing configuration %s"
, sa->name)
	 "pf_key_v2_delete_spi: removing configuration %s",log_debug (LOG_SYSDEP, 50, "pf_key_v2_delete_spi: removing configuration %s"
, sa->name)
	 sa->name))log_debug (LOG_SYSDEP, 50, "pf_key_v2_delete_spi: removing configuration %s"
, sa->name);
pf_key_v2_remove_conf(sa->name);
}
msg.sadb_msg_type = SADB_DELETE4;
switch (proto->proto) {
case IPSEC_PROTO_IPSEC_ESP3:
msg.sadb_msg_satype = SADB_SATYPE_ESP2;
break;
case IPSEC_PROTO_IPSEC_AH2:
msg.sadb_msg_satype = SADB_SATYPE_AH1;
break;
case IPSEC_PROTO_IPCOMP4:
msg.sadb_msg_satype = SADB_X_SATYPE_IPCOMP9;
break;
default:
log_print("pf_key_v2_delete_spi: invalid proto %d",
    proto->proto);
goto cleanup;
}
msg.sadb_msg_seq = 0;
delete = pf_key_v2_msg_new(&msg, 0);
if (!delete)
goto cleanup;

/* Setup the SA extension.  */
ssa.sadb_sa_exttype = SADB_EXT_SA1;
ssa.sadb_sa_len = sizeof ssa / PF_KEY_V2_CHUNK8;
memcpy(&ssa.sadb_sa_spi, proto->spi[incoming], sizeof ssa.sadb_sa_spi);
ssa.sadb_sa_replay = 0;
ssa.sadb_sa_state = 0;
ssa.sadb_sa_auth = 0;
ssa.sadb_sa_encrypt = 0;
ssa.sadb_sa_flags = 0;
if (pf_key_v2_msg_add(delete, (struct sadb_ext *)&ssa, 0) == -1)
goto cleanup;

/*
* Setup the ADDRESS extensions.
*/
if (incoming)
sa->transport->vtbl->get_dst(sa->transport, &saddr);
else
sa->transport->vtbl->get_src(sa->transport, &saddr);
len = sizeof *addr + PF_KEY_V2_ROUND(SA_LEN(saddr))(((((saddr)->sa_len)) + 8 - 1) & ~(8 - 1));
addr = calloc(1, len);
if (!addr)
goto cleanup;
addr->sadb_address_exttype = SADB_EXT_ADDRESS_SRC5;
addr->sadb_address_len = len / PF_KEY_V2_CHUNK8;
addr->sadb_address_reserved = 0;
memcpy(addr + 1, saddr, SA_LEN(saddr)((saddr)->sa_len));
switch (saddr->sa_family) {
case AF_INET2:
((struct sockaddr_in *) (addr + 1))->sin_port = 0;
break;
case AF_INET624:
((struct sockaddr_in6 *) (addr + 1))->sin6_port = 0;
break;
}
if (pf_key_v2_msg_add(delete, (struct sadb_ext *) addr,
   PF_KEY_V2_NODE_MALLOCED1) == -1)
goto cleanup;
addr = 0;

if (incoming)
sa->transport->vtbl->get_src(sa->transport, &saddr);
else
sa->transport->vtbl->get_dst(sa->transport, &saddr);
len = sizeof *addr + PF_KEY_V2_ROUND(SA_LEN(saddr))(((((saddr)->sa_len)) + 8 - 1) & ~(8 - 1));
addr = calloc(1, len);
if (!addr)
goto cleanup;
addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST6;
addr->sadb_address_len = len / PF_KEY_V2_CHUNK8;
addr->sadb_address_reserved = 0;
memcpy(addr + 1, saddr, SA_LEN(saddr)((saddr)->sa_len));
switch (saddr->sa_family) {
case AF_INET2:
((struct sockaddr_in *) (addr + 1))->sin_port = 0;
break;
case AF_INET624:
((struct sockaddr_in6 *) (addr + 1))->sin6_port = 0;
break;
}
if (pf_key_v2_msg_add(delete, (struct sadb_ext *) addr,
   PF_KEY_V2_NODE_MALLOCED1) == -1)
goto cleanup;
addr = 0;

ret = pf_key_v2_call(delete);
pf_key_v2_msg_free(delete);
delete = 0;
if (!ret)
goto cleanup;
err = ((struct sadb_msg *)TAILQ_FIRST(ret)((ret)->tqh_first)->seg)->sadb_msg_errno;
if (err) {
LOG_DBG((LOG_SYSDEP, 10, "pf_key_v2_delete_spi: DELETE: %s",log_debug (LOG_SYSDEP, 10, "pf_key_v2_delete_spi: DELETE: %s"
, strerror(err))
	 strerror(err)))log_debug (LOG_SYSDEP, 10, "pf_key_v2_delete_spi: DELETE: %s"
, strerror(err));
goto cleanup;
}
pf_key_v2_msg_free(ret);

LOG_DBG((LOG_SYSDEP, 50, "pf_key_v2_delete_spi: done"))log_debug (LOG_SYSDEP, 50, "pf_key_v2_delete_spi: done");

return 0;

2127cleanup:
free(addr);
if (delete)
pf_key_v2_msg_free(delete);
if (ret)
pf_key_v2_msg_free(ret);
return -1;
2134}

2136static void
2137pf_key_v2_stayalive(struct exchange *exchange, void *vconn, int fail)
2138{
char           *conn = vconn;
struct sa      *sa;

/* XXX What if it is phase 1 ? */
sa = sa_lookup_by_name(conn, 2);
if (sa)
sa->flags |= SA_FLAG_STAYALIVE0x02;

/*
* Remove failed configuration entry -- call twice because it is
* created with a Refcount of 2.
*/
if (fail && (!exchange || exchange->name)) {
pf_key_v2_remove_conf(conn);
pf_key_v2_remove_conf(conn);
}
free(conn);
2156}

2158/* Check if a connection CONN exists, otherwise establish it.  */
2159void
2160pf_key_v2_connection_check(char *conn)
2161{
if (!sa_lookup_by_name(conn, 2)) {
LOG_DBG((LOG_SYSDEP, 70,log_debug (LOG_SYSDEP, 70, "pf_key_v2_connection_check: SA for %s missing"
, conn)
    "pf_key_v2_connection_check: SA for %s missing", conn))log_debug (LOG_SYSDEP, 70, "pf_key_v2_connection_check: SA for %s missing"
, conn);
exchange_establish(conn, pf_key_v2_stayalive, conn, 0);
} else {
LOG_DBG((LOG_SYSDEP, 70, "pf_key_v2_connection_check: "log_debug (LOG_SYSDEP, 70, "pf_key_v2_connection_check: " "SA for %s exists"
, conn)
    "SA for %s exists", conn))log_debug (LOG_SYSDEP, 70, "pf_key_v2_connection_check: " "SA for %s exists"
, conn);
free(conn);
}
2171}

2173/* Handle a PF_KEY lifetime expiration message PMSG.  */
2174static void
2175pf_key_v2_expire(struct pf_key_v2_msg *pmsg)
2176{
struct sadb_msg *msg;
struct sadb_sa *ssa;
struct sadb_address *dst;
struct sockaddr *dstaddr;
struct sadb_lifetime *life, *lifecurrent;
struct sa      *sa;
struct pf_key_v2_node *lifenode, *ext;
char           *dst_str;

msg = (struct sadb_msg *)TAILQ_FIRST(pmsg)((pmsg)->tqh_first)->seg;
ext = pf_key_v2_find_ext(pmsg, SADB_EXT_SA1);
if (!ext) {
log_print("pf_key_v2_expire: no SA extension found");
return;
}
ssa = ext->seg;
ext = pf_key_v2_find_ext(pmsg, SADB_EXT_ADDRESS_DST6);
if (!ext) {
log_print("pf_key_v2_expire: "
    "no destination address extension found");
return;
}
dst = ext->seg;
dstaddr = (struct sockaddr *) (dst + 1);
lifenode = pf_key_v2_find_ext(pmsg, SADB_EXT_LIFETIME_HARD3);
if (!lifenode)
lifenode = pf_key_v2_find_ext(pmsg, SADB_EXT_LIFETIME_SOFT4);
if (!lifenode) {
log_print("pf_key_v2_expire: no lifetime extension found");
return;
}
life = lifenode->seg;

lifenode = pf_key_v2_find_ext(pmsg, SADB_EXT_LIFETIME_CURRENT2);
if (!lifenode) {
log_print("pf_key_v2_expire: "
    "no current lifetime extension found");
return;
}
lifecurrent = lifenode->seg;

if (sockaddr2text(dstaddr, &dst_str, 0))
dst_str = 0;

LOG_DBG((LOG_SYSDEP, 20, "pf_key_v2_expire: "log_debug (LOG_SYSDEP, 20, "pf_key_v2_expire: " "%s dst %s SPI %x sproto %d"
, life->sadb_lifetime_exttype == 4 ? "SOFT" : "HARD", dst_str
 ? dst_str : "<unknown>", (__uint32_t)(__builtin_constant_p
(ssa->sadb_sa_spi) ? (__uint32_t)(((__uint32_t)(ssa->sadb_sa_spi
) & 0xff) << 24 | ((__uint32_t)(ssa->sadb_sa_spi
) & 0xff00) << 8 | ((__uint32_t)(ssa->sadb_sa_spi
) & 0xff0000) >> 8 | ((__uint32_t)(ssa->sadb_sa_spi
) & 0xff000000) >> 24) : __swap32md(ssa->sadb_sa_spi
)), msg->sadb_msg_satype)
   "%s dst %s SPI %x sproto %d",log_debug (LOG_SYSDEP, 20, "pf_key_v2_expire: " "%s dst %s SPI %x sproto %d"
, life->sadb_lifetime_exttype == 4 ? "SOFT" : "HARD", dst_str
 ? dst_str : "<unknown>", (__uint32_t)(__builtin_constant_p
(ssa->sadb_sa_spi) ? (__uint32_t)(((__uint32_t)(ssa->sadb_sa_spi
) & 0xff) << 24 | ((__uint32_t)(ssa->sadb_sa_spi
) & 0xff00) << 8 | ((__uint32_t)(ssa->sadb_sa_spi
) & 0xff0000) >> 8 | ((__uint32_t)(ssa->sadb_sa_spi
) & 0xff000000) >> 24) : __swap32md(ssa->sadb_sa_spi
)), msg->sadb_msg_satype)
   life->sadb_lifetime_exttype == SADB_EXT_LIFETIME_SOFT ? "SOFT"log_debug (LOG_SYSDEP, 20, "pf_key_v2_expire: " "%s dst %s SPI %x sproto %d"
, life->sadb_lifetime_exttype == 4 ? "SOFT" : "HARD", dst_str
 ? dst_str : "<unknown>", (__uint32_t)(__builtin_constant_p
(ssa->sadb_sa_spi) ? (__uint32_t)(((__uint32_t)(ssa->sadb_sa_spi
) & 0xff) << 24 | ((__uint32_t)(ssa->sadb_sa_spi
) & 0xff00) << 8 | ((__uint32_t)(ssa->sadb_sa_spi
) & 0xff0000) >> 8 | ((__uint32_t)(ssa->sadb_sa_spi
) & 0xff000000) >> 24) : __swap32md(ssa->sadb_sa_spi
)), msg->sadb_msg_satype)
   : "HARD", dst_str ? dst_str : "<unknown>",log_debug (LOG_SYSDEP, 20, "pf_key_v2_expire: " "%s dst %s SPI %x sproto %d"
, life->sadb_lifetime_exttype == 4 ? "SOFT" : "HARD", dst_str
 ? dst_str : "<unknown>", (__uint32_t)(__builtin_constant_p
(ssa->sadb_sa_spi) ? (__uint32_t)(((__uint32_t)(ssa->sadb_sa_spi
) & 0xff) << 24 | ((__uint32_t)(ssa->sadb_sa_spi
) & 0xff00) << 8 | ((__uint32_t)(ssa->sadb_sa_spi
) & 0xff0000) >> 8 | ((__uint32_t)(ssa->sadb_sa_spi
) & 0xff000000) >> 24) : __swap32md(ssa->sadb_sa_spi
)), msg->sadb_msg_satype)
   ntohl(ssa->sadb_sa_spi), msg->sadb_msg_satype))log_debug (LOG_SYSDEP, 20, "pf_key_v2_expire: " "%s dst %s SPI %x sproto %d"
, life->sadb_lifetime_exttype == 4 ? "SOFT" : "HARD", dst_str
 ? dst_str : "<unknown>", (__uint32_t)(__builtin_constant_p
(ssa->sadb_sa_spi) ? (__uint32_t)(((__uint32_t)(ssa->sadb_sa_spi
) & 0xff) << 24 | ((__uint32_t)(ssa->sadb_sa_spi
) & 0xff00) << 8 | ((__uint32_t)(ssa->sadb_sa_spi
) & 0xff0000) >> 8 | ((__uint32_t)(ssa->sadb_sa_spi
) & 0xff000000) >> 24) : __swap32md(ssa->sadb_sa_spi
)), msg->sadb_msg_satype);

free(dst_str);

/*
* Find the IPsec SA.  The IPsec stack has two SAs for every IKE SA,
* one outgoing and one incoming, we regard expirations for any of
* them as an expiration of the full IKE SA.  Likewise, in
* protection suites consisting of more than one protocol, any
* expired individual IPsec stack SA will be seen as an expiration
* of the full suite.
*/
switch (msg->sadb_msg_satype) {
case SADB_SATYPE_ESP2:
sa = ipsec_sa_lookup(dstaddr, ssa->sadb_sa_spi,
    IPSEC_PROTO_IPSEC_ESP3);
break;

case SADB_SATYPE_AH1:
sa = ipsec_sa_lookup(dstaddr, ssa->sadb_sa_spi,
    IPSEC_PROTO_IPSEC_AH2);
break;

case SADB_X_SATYPE_IPCOMP9:
sa = ipsec_sa_lookup(dstaddr, ssa->sadb_sa_spi,
    IPSEC_PROTO_IPCOMP4);
break;

default:
/* XXX Log? */
sa = 0;
break;
}

/* If the SA is already gone, don't do anything.  */
if (!sa)
return;

/*
* If we got a notification, try to renegotiate the SA -- unless of
* course it has already been replaced by another.
* Also, ignore SAs that were not dynamically established, or that
* did not see any use.
*/
if (!(sa->flags & SA_FLAG_REPLACED0x08) &&
   (sa->flags & SA_FLAG_ONDEMAND0x04) &&
   lifecurrent->sadb_lifetime_bytes)
exchange_establish(sa->name, 0, 0, 0);

if (life->sadb_lifetime_exttype == SADB_EXT_LIFETIME_HARD3) {
/* Remove the old SA, it isn't useful anymore.  */
sa_free(sa);
}
2278}

2280static int
2281mask4len(const struct sockaddr_in *mask)
2282{
int len;
u_int32_t m;

len = 0;
for (m = 0x80000000; m & ntohl(mask->sin_addr.s_addr)(__uint32_t)(__builtin_constant_p(mask->sin_addr.s_addr) ?
 (__uint32_t)(((__uint32_t)(mask->sin_addr.s_addr) & 0xff
) << 24 | ((__uint32_t)(mask->sin_addr.s_addr) &
 0xff00) << 8 | ((__uint32_t)(mask->sin_addr.s_addr)
 & 0xff0000) >> 8 | ((__uint32_t)(mask->sin_addr
.s_addr) & 0xff000000) >> 24) : __swap32md(mask->
sin_addr.s_addr)); m >>= 1)
len++;
if (len == 32)
len = -1;
return len;
2292}

2294#ifndef s6_addr8__u6_addr.__u6_addr8
2295#define s6_addr8__u6_addr.__u6_addr8 __u6_addr.__u6_addr8
2296#endif

2298static int
2299mask6len(const struct sockaddr_in6 *mask)
2300{
int i, len;
u_int8_t m;

len = 0;
for (i = 0, m = 0; i < 16 && !m; i++)
for (m = 0x80; m & mask->sin6_addr.s6_addr8__u6_addr.__u6_addr8[i]; m >>= 1)
	len++;
if (len == 128)
len = -1;
return len;
2311}

2313static int
2314phase2id(char *str, size_t size, const char *side, const char *sflow,
  int masklen, u_int8_t proto, u_int16_t port)
2316{
char smasklen[10], sproto[10], sport[10];

smasklen[0] = sproto[0] = sport[0] = 0;
if (masklen != -1)
snprintf(smasklen, sizeof smasklen, "/%d", masklen);
if (proto)
snprintf(sproto, sizeof sproto, "=%u", proto);
if (port)
snprintf(sport, sizeof sport, ":%u", ntohs(port)(__uint16_t)(__builtin_constant_p(port) ? (__uint16_t)(((__uint16_t
)(port) & 0xffU) << 8 | ((__uint16_t)(port) & 0xff00U
) >> 8) : __swap16md(port)));

return snprintf(str, size, "%s-%s%s%s%s", side, sflow, smasklen,
   sproto, sport);
2329}

2331/* Handle a PF_KEY SA ACQUIRE message PMSG.  */
2332static void
2333pf_key_v2_acquire(struct pf_key_v2_msg *pmsg)
2334{
struct sadb_msg *msg, askpolicy_msg;
struct pf_key_v2_msg *askpolicy = 0, *ret = 0;
struct sadb_x_policy policy;
struct sadb_address *dst = 0, *src = 0;
struct sockaddr *dstaddr, *srcaddr = 0;
struct sadb_ident *srcident = 0, *dstident = 0;
char		dstbuf[ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255"], srcbuf[ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255"], *peer = 0;
char		confname[120], *conn = 0;
char           *srcid = 0, *dstid = 0, *prefstring = 0;
int		slen, af, afamily, masklen;
struct sockaddr *smask, *sflow, *dmask, *dflow;
struct sadb_protocol *sproto;
char		ssflow[ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255"], sdflow[ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255"];
char		sdmask[ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255"], ssmask[ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255"];
int		dmasklen, smasklen;
char           *sidtype = 0, *didtype = 0;
char		lname[100], dname[100], configname[200];
int		shostflag = 0, dhostflag = 0;
struct pf_key_v2_node *ext;
struct passwd  *pwd = 0;
u_int16_t       sport = 0, dport = 0;
u_int8_t	tproto = 0;
char		tmbuf[sizeof sport * 3 + 1], *xform;
int		connlen;

/* This needs to be dynamically allocated. */
connlen = 22;
conn = malloc(connlen);
if (!conn) {
log_error("pf_key_v2_acquire: malloc (%d) failed", connlen);
return;
}
msg = (struct sadb_msg *)TAILQ_FIRST(pmsg)((pmsg)->tqh_first)->seg;

ext = pf_key_v2_find_ext(pmsg, SADB_EXT_ADDRESS_DST6);
if (!ext) {
log_print("pf_key_v2_acquire: "
    "no destination address specified");
free(conn);
return;
}
dst = ext->seg;

ext = pf_key_v2_find_ext(pmsg, SADB_EXT_ADDRESS_SRC5);
if (ext)
src = ext->seg;

ext = pf_key_v2_find_ext(pmsg, SADB_EXT_IDENTITY_SRC10);
if (ext)
srcident = ext->seg;

ext = pf_key_v2_find_ext(pmsg, SADB_EXT_IDENTITY_DST11);
if (ext)
dstident = ext->seg;

/* Ask the kernel for the matching policy. */
bzero(&askpolicy_msg, sizeof askpolicy_msg);
askpolicy_msg.sadb_msg_type = SADB_X_ASKPOLICY15;
askpolicy = pf_key_v2_msg_new(&askpolicy_msg, 0);
if (!askpolicy)
goto fail;

policy.sadb_x_policy_exttype = SADB_X_EXT_POLICY25;
policy.sadb_x_policy_len = sizeof policy / PF_KEY_V2_CHUNK8;
policy.sadb_x_policy_seq = msg->sadb_msg_seq;
if (pf_key_v2_msg_add(askpolicy, (struct sadb_ext *)&policy, 0) == -1)
goto fail;

ret = pf_key_v2_call(askpolicy);
if (!ret)
goto fail;

/* Now we have all the information needed. */

ext = pf_key_v2_find_ext(ret, SADB_X_EXT_SRC_FLOW21);
if (!ext) {
log_print("pf_key_v2_acquire: no source flow extension found");
goto fail;
}
sflow = (struct sockaddr *) (((struct sadb_address *) ext->seg) + 1);

ext = pf_key_v2_find_ext(ret, SADB_X_EXT_DST_FLOW22);
if (!ext) {
log_print("pf_key_v2_acquire: "
    "no destination flow extension found");
goto fail;
}
dflow = (struct sockaddr *) (((struct sadb_address *) ext->seg) + 1);
ext = pf_key_v2_find_ext(ret, SADB_X_EXT_SRC_MASK17);
if (!ext) {
log_print("pf_key_v2_acquire: no source mask extension found");
goto fail;
}
smask = (struct sockaddr *) (((struct sadb_address *) ext->seg) + 1);

ext = pf_key_v2_find_ext(ret, SADB_X_EXT_DST_MASK18);
if (!ext) {
log_print("pf_key_v2_acquire: "
    "no destination mask extension found");
goto fail;
}
dmask = (struct sockaddr *) (((struct sadb_address *) ext->seg) + 1);

ext = pf_key_v2_find_ext(ret, SADB_X_EXT_FLOW_TYPE20);
if (!ext) {
log_print("pf_key_v2_acquire: no flow type extension found");
goto fail;
}
sproto = ext->seg;
tproto = sproto->sadb_protocol_proto;

bzero(ssflow, sizeof ssflow);
bzero(sdflow, sizeof sdflow);
bzero(ssmask, sizeof ssmask);
bzero(sdmask, sizeof sdmask);
smasklen = dmasklen = -1;

sidtype = didtype = "IPV4_ADDR_SUBNET";	/* default */

switch (sflow->sa_family) {
case AF_INET2:
if (inet_ntop(AF_INET2,
    &((struct sockaddr_in *) sflow)->sin_addr, ssflow,
    ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0)) {
	log_print("pf_key_v2_acquire: inet_ntop failed");
	goto fail;
}
sport = ((struct sockaddr_in *) sflow)->sin_port;
if (inet_ntop(AF_INET2,
    &((struct sockaddr_in *) dflow)->sin_addr, sdflow,
    ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0)) {
	log_print("pf_key_v2_acquire: inet_ntop failed");
	goto fail;
}
dport = ((struct sockaddr_in *) dflow)->sin_port;
if (inet_ntop(AF_INET2,
    &((struct sockaddr_in *) smask)->sin_addr, ssmask,
    ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0)) {
	log_print("pf_key_v2_acquire: inet_ntop failed");
	goto fail;
}
if (inet_ntop(AF_INET2,
    &((struct sockaddr_in *) dmask)->sin_addr, sdmask,
    ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0)) {
	log_print("pf_key_v2_acquire: inet_ntop failed");
	goto fail;
}
smasklen = mask4len((struct sockaddr_in *) smask);
dmasklen = mask4len((struct sockaddr_in *) dmask);
if (((struct sockaddr_in *) smask)->sin_addr.s_addr ==
    INADDR_BROADCAST((u_int32_t)(0xffffffff))) {
	shostflag = 1;
	sidtype = "IPV4_ADDR";
}
if (((struct sockaddr_in *) dmask)->sin_addr.s_addr ==
    INADDR_BROADCAST((u_int32_t)(0xffffffff))) {
	dhostflag = 1;
	didtype = "IPV4_ADDR";
}
break;

case AF_INET624:
if (inet_ntop(AF_INET624,
    &((struct sockaddr_in6 *) sflow)->sin6_addr,
    ssflow, ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0)) {
	log_print("pf_key_v2_acquire: inet_ntop failed");
	goto fail;
}
sport = ((struct sockaddr_in6 *) sflow)->sin6_port;
if (inet_ntop(AF_INET624,
    &((struct sockaddr_in6 *) dflow)->sin6_addr,
    sdflow, ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0)) {
	log_print("pf_key_v2_acquire: inet_ntop failed");
	goto fail;
}
dport = ((struct sockaddr_in6 *) dflow)->sin6_port;
if (inet_ntop(AF_INET624,
    &((struct sockaddr_in6 *) smask)->sin6_addr,
    ssmask, ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0)) {
	log_print("pf_key_v2_acquire: inet_ntop failed");
	goto fail;
}
if (inet_ntop(AF_INET624,
    &((struct sockaddr_in6 *) dmask)->sin6_addr,
    sdmask, ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0)) {
	log_print("pf_key_v2_acquire: inet_ntop failed");
	goto fail;
}
smasklen = mask6len((struct sockaddr_in6 *) smask);
dmasklen = mask6len((struct sockaddr_in6 *) dmask);
sidtype = didtype = "IPV6_ADDR_SUBNET";
if (IN6_IS_ADDR_FULL(&((struct sockaddr_in6 *)smask)->sin6_addr)((*(u_int32_t *)(void *)(&(&((struct sockaddr_in6 *)smask
)->sin6_addr)->__u6_addr.__u6_addr8[0]) == 0xffffffff) &&
 (*(u_int32_t *)(void *)(&(&((struct sockaddr_in6 *)smask
)->sin6_addr)->__u6_addr.__u6_addr8[4]) == 0xffffffff) &&
 (*(u_int32_t *)(void *)(&(&((struct sockaddr_in6 *)smask
)->sin6_addr)->__u6_addr.__u6_addr8[8]) == 0xffffffff) &&
 (*(u_int32_t *)(void *)(&(&((struct sockaddr_in6 *)smask
)->sin6_addr)->__u6_addr.__u6_addr8[12]) == 0xffffffff)
)) {
	shostflag = 1;
	sidtype = "IPV6_ADDR";
}
if (IN6_IS_ADDR_FULL(&((struct sockaddr_in6 *)dmask)->sin6_addr)((*(u_int32_t *)(void *)(&(&((struct sockaddr_in6 *)dmask
)->sin6_addr)->__u6_addr.__u6_addr8[0]) == 0xffffffff) &&
 (*(u_int32_t *)(void *)(&(&((struct sockaddr_in6 *)dmask
)->sin6_addr)->__u6_addr.__u6_addr8[4]) == 0xffffffff) &&
 (*(u_int32_t *)(void *)(&(&((struct sockaddr_in6 *)dmask
)->sin6_addr)->__u6_addr.__u6_addr8[8]) == 0xffffffff) &&
 (*(u_int32_t *)(void *)(&(&((struct sockaddr_in6 *)dmask
)->sin6_addr)->__u6_addr.__u6_addr8[12]) == 0xffffffff)
)) {
	dhostflag = 1;
	didtype = "IPV6_ADDR";
}
break;
}

dstaddr = (struct sockaddr *)(dst + 1);
bzero(dstbuf, sizeof dstbuf);
bzero(srcbuf, sizeof srcbuf);

if (dstaddr->sa_family == 0) {
/*
 * Destination was not specified in the flow -- can we derive
 * it?
 */
if (dhostflag == 0) {
	log_print("pf_key_v2_acquire: "
	    "Cannot determine precise destination");
	goto fail;
}
dstaddr = dflow;
}
switch (dstaddr->sa_family) {
case AF_INET2:
if (inet_ntop(AF_INET2,
    &((struct sockaddr_in *) dstaddr)->sin_addr,
    dstbuf, ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0)) {
	log_print("pf_key_v2_acquire: inet_ntop failed");
	goto fail;
}
LOG_DBG((LOG_SYSDEP, 20,log_debug (LOG_SYSDEP, 20, "pf_key_v2_acquire: dst=%s sproto %d"
, dstbuf, msg->sadb_msg_satype)
    "pf_key_v2_acquire: dst=%s sproto %d", dstbuf,log_debug (LOG_SYSDEP, 20, "pf_key_v2_acquire: dst=%s sproto %d"
, dstbuf, msg->sadb_msg_satype)
    msg->sadb_msg_satype))log_debug (LOG_SYSDEP, 20, "pf_key_v2_acquire: dst=%s sproto %d"
, dstbuf, msg->sadb_msg_satype);
break;

case AF_INET624:
if (inet_ntop(AF_INET624,
    &((struct sockaddr_in6 *) dstaddr)->sin6_addr,
    dstbuf, ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0)) {
	log_print("pf_key_v2_acquire: inet_ntop failed");
	goto fail;
}
LOG_DBG((LOG_SYSDEP, 20,log_debug (LOG_SYSDEP, 20, "pf_key_v2_acquire: dst=%s sproto %d"
, dstbuf, msg->sadb_msg_satype)
    "pf_key_v2_acquire: dst=%s sproto %d", dstbuf,log_debug (LOG_SYSDEP, 20, "pf_key_v2_acquire: dst=%s sproto %d"
, dstbuf, msg->sadb_msg_satype)
    msg->sadb_msg_satype))log_debug (LOG_SYSDEP, 20, "pf_key_v2_acquire: dst=%s sproto %d"
, dstbuf, msg->sadb_msg_satype);
break;
}

if (src) {
srcaddr = (struct sockaddr *) (src + 1);

switch (srcaddr->sa_family) {
case AF_INET2:
	if (inet_ntop(AF_INET2,
	    &((struct sockaddr_in *) srcaddr)->sin_addr,
	    srcbuf, ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0)) {
		log_print("pf_key_v2_acquire: "
		    "inet_ntop failed");
		goto fail;
	}
	break;

case AF_INET624:
	if (inet_ntop(AF_INET624,
	    &((struct sockaddr_in6 *)srcaddr)->sin6_addr,
	    srcbuf, ADDRESS_MAXsizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") == NULL((void *)0)) {
		log_print("pf_key_v2_acquire: "
		    "inet_ntop failed");
		goto fail;
	}
	break;

default:
	/*
	 * The kernel will pass an all '0' EXT_ADDRESS_SRC if
	 * it wasn't specified for the flow. In that case, do
	 * NOT specify the srcaddr in the Peer-name below
	 */
	srcbuf[0] = 0;
	srcaddr = NULL((void *)0);
	break;
}
}
/* Insert source ID. */
if (srcident) {
slen = (srcident->sadb_ident_len * sizeof(u_int64_t))
	- sizeof(struct sadb_ident);
if (((unsigned char *) (srcident + 1))[slen - 1] != '\0') {
	log_print("pf_key_v2_acquire: "
	    "source identity not NUL-terminated");
	goto fail;
}
/* Check for valid type. */
switch (srcident->sadb_ident_type) {
case SADB_IDENTTYPE_PREFIX1:
	/* Determine what the address family is. */
	srcid = memchr(srcident + 1, ':', slen);
	if (srcid)
		afamily = AF_INET624;
	else
		afamily = AF_INET2;

	srcid = memchr(srcident + 1, '/', slen);
	if (!srcid) {
		log_print("pf_key_v2_acquire: "
		    "badly formatted PREFIX identity");
		goto fail;
	}
	masklen = atoi(srcid + 1);

	/* XXX We only support host addresses. */
	if ((afamily == AF_INET624 && masklen != 128) ||
	    (afamily == AF_INET2 && masklen != 32)) {
		log_print("pf_key_v2_acquire: "
		    "non-host address specified in source "
		    "identity (mask length %d), ignoring "
		    "request", masklen);
		goto fail;
	}
	/*
	 * NUL-terminate the PREFIX string at the separator,
	 * then dup.
	 */
	*srcid = '\0';
	if (asprintf(&srcid, "id-%s",
	    (char *) (srcident + 1)) == -1) {
		log_error("pf_key_v2_acquire: asprintf() failed");
		goto fail;
	}

	/* Set the section if it doesn't already exist. */
	af = conf_begin();
	if (!conf_get_str(srcid, "ID-type")) {
		if (conf_set(af, srcid, "ID-type",
		    afamily == AF_INET2 ? "IPV4_ADDR" :
		    "IPV6_ADDR", 1, 0) ||
		    conf_set(af, srcid, "Refcount", "1", 1, 0) ||
		    conf_set(af, srcid, "Address",
			(char *) (srcident + 1), 1, 0)) {
			conf_end(af, 0);
			goto fail;
		}
	} else
		pf_key_v2_conf_refinc(af, srcid);
	conf_end(af, 1);
	break;

case SADB_IDENTTYPE_FQDN2:
	prefstring = "FQDN";
	/*FALLTHROUGH*/
case SADB_IDENTTYPE_USERFQDN3:
	if (!prefstring) {
		prefstring = "USER_FQDN";

		/*
		 * Check whether there is a string following
		 * the header; if no, that there is a user ID
		 * (and acquire the login name). If there is
		 * both a string and a user ID, check that
		 * they match.
		 */
		if ((slen == 0) &&
		    (srcident->sadb_ident_id == 0)) {
			log_print("pf_key_v2_acquire: "
			    "no user FQDN or ID provided");
			goto fail;
		}
		if (srcident->sadb_ident_id) {
			pwd =
			    getpwuid(srcident->sadb_ident_id);
			if (!pwd) {
				log_error("pf_key_v2_acquire: "
				    "could not acquire "
				    "username from provided "
				    "ID %llu",
				    srcident->sadb_ident_id);
				goto fail;
			}
			if (slen != 0)
				if (strcmp(pwd->pw_name,
				    (char *) (srcident + 1))
				    != 0) {
					log_print("pf_key_v2_acquire: "
					    "provided user "
					    "name and ID do "
					    "not match (%s != "
					    "%s)",
					    (char *) (srcident + 1),
					    pwd->pw_name);
					/*
					 * String has
					 * precedence, per
					 * RFC 2367.
					 */
				}
		}
	}
	if (asprintf(&srcid, "id-%s",
	    slen ? (char *) (srcident + 1) : pwd->pw_name) == -1) {
		log_error("pf_key_v2_acquire: asprintf() failed");
		goto fail;
	}
	pwd = 0;

	/* Set the section if it doesn't already exist. */
	af = conf_begin();
	if (!conf_get_str(srcid, "ID-type")) {
		if (conf_set(af, srcid, "ID-type", prefstring,
		    1, 0) ||
		    conf_set(af, srcid, "Refcount", "1", 1, 0) ||
		    conf_set(af, srcid, "Name",
			srcid + 3, 1, 0)) {
			conf_end(af, 0);
			goto fail;
		}
	} else
		pf_key_v2_conf_refinc(af, srcid);
	conf_end(af, 1);
	break;

default:
	LOG_DBG((LOG_SYSDEP, 20,log_debug (LOG_SYSDEP, 20, "pf_key_v2_acquire: invalid source ID type %d"
, srcident->sadb_ident_type)
	    "pf_key_v2_acquire: invalid source ID type %d",log_debug (LOG_SYSDEP, 20, "pf_key_v2_acquire: invalid source ID type %d"
, srcident->sadb_ident_type)
	    srcident->sadb_ident_type))log_debug (LOG_SYSDEP, 20, "pf_key_v2_acquire: invalid source ID type %d"
, srcident->sadb_ident_type);
	goto fail;
}

LOG_DBG((LOG_SYSDEP, 50,log_debug (LOG_SYSDEP, 50, "pf_key_v2_acquire: constructed source ID \"%s\""
, srcid)
    "pf_key_v2_acquire: constructed source ID \"%s\"", srcid))log_debug (LOG_SYSDEP, 50, "pf_key_v2_acquire: constructed source ID \"%s\""
, srcid);
prefstring = 0;
}
/* Insert destination ID. */
if (dstident) {
slen = (dstident->sadb_ident_len * sizeof(u_int64_t))
	- sizeof(struct sadb_ident);

/* Check for valid type. */
switch (dstident->sadb_ident_type) {
case SADB_IDENTTYPE_PREFIX1:
	/* Determine what the address family is. */
	dstid = memchr(dstident + 1, ':', slen);
	if (dstid)
		afamily = AF_INET624;
	else
		afamily = AF_INET2;

	dstid = memchr(dstident + 1, '/', slen);
	if (!dstid) {
		log_print("pf_key_v2_acquire: "
		    "badly formatted PREFIX identity");
		goto fail;
	}
	masklen = atoi(dstid + 1);

	/* XXX We only support host addresses. */
	if ((afamily == AF_INET624 && masklen != 128) ||
	    (afamily == AF_INET2 && masklen != 32)) {
		log_print("pf_key_v2_acquire: "
		    "non-host address specified in "
		    "destination identity (mask length %d), "
		    "ignoring request", masklen);
		goto fail;
	}
	/*
	 * NUL-terminate the PREFIX string at the separator,
	 * then dup.
	 */
	*dstid = '\0';
	if (asprintf(&dstid, "id-%s",
	    (char *) (dstident + 1)) == -1) {
		log_error("pf_key_v2_acquire: asprintf() failed");
		goto fail;
	}

	/* Set the section if it doesn't already exist. */
	af = conf_begin();
	if (!conf_get_str(dstid, "ID-type")) {
		if (conf_set(af, dstid, "ID-type",
		    afamily == AF_INET2 ? "IPV4_ADDR" :
		    "IPV6_ADDR", 1, 0) ||
		    conf_set(af, dstid, "Refcount", "1", 1, 0) ||
		    conf_set(af, dstid, "Address",
			(char *) (dstident + 1), 1, 0)) {
			conf_end(af, 0);
			goto fail;
		}
	} else
		pf_key_v2_conf_refinc(af, dstid);
	conf_end(af, 1);
	break;

case SADB_IDENTTYPE_FQDN2:
	prefstring = "FQDN";
	/*FALLTHROUGH*/
case SADB_IDENTTYPE_USERFQDN3:
	if (!prefstring) {
		prefstring = "USER_FQDN";

		/*
		 * Check whether there is a string following
		 * the header; if no, that there is a user ID
		 * (and acquire the login name). If there is
		 * both a string and a user ID, check that
		 * they match.
		 */
		if (slen == 0 &&
		    dstident->sadb_ident_id == 0) {
			log_print("pf_key_v2_acquire: "
			    "no user FQDN or ID provided");
			goto fail;
		}
		if (dstident->sadb_ident_id) {
			pwd = getpwuid(dstident->sadb_ident_id);
			if (!pwd) {
				log_error("pf_key_v2_acquire: "
				    "could not acquire "
				    "username from provided "
				    "ID %llu",
				    dstident->sadb_ident_id);
				goto fail;
			}
			if (slen != 0)
				if (strcmp(pwd->pw_name,
				    (char *) (dstident + 1))
				    != 0) {
					log_print("pf_key_v2_acquire: "
					    "provided user "
					    "name and ID do "
					    "not match (%s != "
					    "%s)",
					    (char *) (dstident + 1),
					    pwd->pw_name);
					/*
					 * String has
					 * precedence, per RF
					 * 2367.
					 */
				}
		}
	}
	if (asprintf(&dstid, "id-%s",
	    slen ? (char *) (dstident + 1) : pwd->pw_name) == -1) {
		log_error("pf_key_v2_acquire: asprintf() failed");
		goto fail;
	}
	pwd = 0;

	/* Set the section if it doesn't already exist. */
	af = conf_begin();
	if (!conf_get_str(dstid, "ID-type")) {
		if (conf_set(af, dstid, "ID-type", prefstring,
		    1, 0) ||
		    conf_set(af, dstid, "Refcount", "1", 1, 0) ||
		    conf_set(af, dstid, "Name",
			dstid + 3, 1, 0)) {
			conf_end(af, 0);
			goto fail;
		}
	} else
		pf_key_v2_conf_refinc(af, dstid);
	conf_end(af, 1);
	break;

default:
	LOG_DBG((LOG_SYSDEP, 20, "pf_key_v2_acquire: "log_debug (LOG_SYSDEP, 20, "pf_key_v2_acquire: " "invalid destination ID type %d"
, dstident->sadb_ident_type)
	    "invalid destination ID type %d",log_debug (LOG_SYSDEP, 20, "pf_key_v2_acquire: " "invalid destination ID type %d"
, dstident->sadb_ident_type)
	    dstident->sadb_ident_type))log_debug (LOG_SYSDEP, 20, "pf_key_v2_acquire: " "invalid destination ID type %d"
, dstident->sadb_ident_type);
	goto fail;
}

LOG_DBG((LOG_SYSDEP, 50,log_debug (LOG_SYSDEP, 50, "pf_key_v2_acquire: constructed destination ID \"%s\""
, dstid)
    "pf_key_v2_acquire: constructed destination ID \"%s\"",log_debug (LOG_SYSDEP, 50, "pf_key_v2_acquire: constructed destination ID \"%s\""
, dstid)
    dstid))log_debug (LOG_SYSDEP, 50, "pf_key_v2_acquire: constructed destination ID \"%s\""
, dstid);
}
/* Now we've placed the necessary IDs in the configuration space. */

/* Get a new connection sequence number. */
for (;; connection_seq++) {
snprintf(conn, connlen, "Connection-%u", connection_seq);

/* Does it exist ? */
if (!conf_get_str(conn, "Phase"))
	break;
}

/*
* Set the IPsec connection entry. In particular, the following fields:
* - Phase
* - ISAKMP-peer
* - Local-ID/Remote-ID (if provided)
* - Acquire-ID (sequence number of kernel message, e.g., PF_KEYv2)
* - Configuration
*
* Also set the following section:
*    [peer-dstaddr(-local-srcaddr)]
* with these fields:
* - Phase
* - ID (if provided)
* - Remote-ID (if provided)
* - Local-address (if provided)
* - Address
* - Configuration (if an entry phase1-dstaddr-srcadd)
*                  exists -- otherwise use the defaults)
*/

/*
* The various cases:
* - peer-dstaddr
* - peer-dstaddr-local-srcaddr
*/
if (asprintf(&peer, "peer-%s%s%s", dstbuf, srcaddr ? "-local-" : "",
   srcaddr ? srcbuf : "") == -1)
goto fail;

/*
* Set the IPsec connection section. Refcount is set to 2, because
* it will be linked both to the incoming and the outgoing SA.
*/
af = conf_begin();
if (conf_set(af, conn, "Phase", "2", 0, 0) ||
   conf_set(af, conn, "Flags", "__ondemand", 0, 0) ||
   conf_set(af, conn, "Refcount", "2", 0, 0) ||
   conf_set(af, conn, "ISAKMP-peer", peer, 0, 0)) {
conf_end(af, 0);
goto fail;
}
/* Set the sequence number. */
snprintf(lname, sizeof lname, "%u", msg->sadb_msg_seq);
if (conf_set(af, conn, "Acquire-ID", lname, 0, 0)) {
conf_end(af, 0);
goto fail;
}
/*
* Set Phase 2 IDs -- this is the Local-ID section.
* - from-address
* - from-address=proto
* - from-address=proto:port
* - from-network/masklen
* - from-network/masklen=proto
* - from-network/masklen=proto:port
*/
phase2id(lname, sizeof lname, "from", ssflow, smasklen, tproto, sport);
if (conf_set(af, conn, "Local-ID", lname, 0, 0)) {
conf_end(af, 0);
goto fail;
}
if (!conf_get_str(lname, "ID-type")) {
if (conf_set(af, lname, "Refcount", "1", 0, 0)) {
	conf_end(af, 0);
	goto fail;
}
if (shostflag) {
	if (conf_set(af, lname, "ID-type", sidtype, 0, 0) ||
	    conf_set(af, lname, "Address", ssflow, 0, 0)) {
		conf_end(af, 0);
		goto fail;
	}
} else {
	if (conf_set(af, lname, "ID-type", sidtype, 0, 0) ||
	    conf_set(af, lname, "Network", ssflow, 0, 0) ||
	    conf_set(af, lname, "Netmask", ssmask, 0, 0)) {
		conf_end(af, 0);
		goto fail;
	}
}
if (tproto) {
	snprintf(tmbuf, sizeof sport * 3 + 1, "%u", tproto);
	if (conf_set(af, lname, "Protocol", tmbuf, 0, 0)) {
		conf_end(af, 0);
		goto fail;
	}
	if (sport) {
		snprintf(tmbuf, sizeof sport * 3 + 1, "%u",
		    ntohs(sport)(__uint16_t)(__builtin_constant_p(sport) ? (__uint16_t)(((__uint16_t
)(sport) & 0xffU) << 8 | ((__uint16_t)(sport) &
 0xff00U) >> 8) : __swap16md(sport)));
		if (conf_set(af, lname, "Port", tmbuf, 0, 0)) {
			conf_end(af, 0);
			goto fail;
		}
	}
}
} else
pf_key_v2_conf_refinc(af, lname);

/*
* Set Remote-ID section.
* to-address
* to-address=proto
* to-address=proto:port
* to-network/masklen
* to-network/masklen=proto
* to-network/masklen=proto:port
*/
phase2id(dname, sizeof dname, "to", sdflow, dmasklen, tproto, dport);
if (conf_set(af, conn, "Remote-ID", dname, 0, 0)) {
conf_end(af, 0);
goto fail;
}
if (!conf_get_str(dname, "ID-type")) {
if (conf_set(af, dname, "Refcount", "1", 0, 0)) {
	conf_end(af, 0);
	goto fail;
}
if (dhostflag) {
	if (conf_set(af, dname, "ID-type", didtype, 0, 0) ||
	    conf_set(af, dname, "Address", sdflow, 0, 0)) {
		conf_end(af, 0);
		goto fail;
	}
} else {
	if (conf_set(af, dname, "ID-type", didtype, 0, 0) ||
	    conf_set(af, dname, "Network", sdflow, 0, 0) ||
	    conf_set(af, dname, "Netmask", sdmask, 0, 0)) {
		conf_end(af, 0);
		goto fail;
	}
}

if (tproto) {
	snprintf(tmbuf, sizeof dport * 3 + 1, "%u", tproto);
	if (conf_set(af, dname, "Protocol", tmbuf, 0, 0)) {
		conf_end(af, 0);
		goto fail;
	}
	if (dport) {
		snprintf(tmbuf, sizeof dport * 3 + 1, "%u",
		    ntohs(dport)(__uint16_t)(__builtin_constant_p(dport) ? (__uint16_t)(((__uint16_t
)(dport) & 0xffU) << 8 | ((__uint16_t)(dport) &
 0xff00U) >> 8) : __swap16md(dport)));
		if (conf_set(af, dname, "Port", tmbuf, 0, 0)) {
			conf_end(af, 0);
			goto fail;
		}
	}
}
} else
pf_key_v2_conf_refinc(af, dname);

/*
* XXX
* We should be using information from the proposal to set this up.
* At least, we should make this selectable.
*/

/*
* Phase 2 configuration.
* - phase2-from-address-to-address
* - ...
* - phase2-from-net/len=proto:port-to-net/len=proto:port
*/
snprintf(configname, sizeof configname, "phase2-%s-%s", lname, dname);
if (conf_set(af, conn, "Configuration", configname, 0, 0)) {
conf_end(af, 0);
goto fail;
}
if (!conf_get_str(configname, "Exchange_type")) {
if (conf_set(af, configname, "Exchange_type", "Quick_mode",
    0, 0) ||
    conf_set(af, peer, "Refcount", "1", 0, 0) ||
    conf_set(af, configname, "DOI", "IPSEC", 0, 0)) {
	conf_end(af, 0);
	goto fail;
}
if (conf_get_str("General", "Default-phase-2-suites")) {
	if (conf_set(af, configname, "Suites",
	    conf_get_str("General", "Default-phase-2-suites"),
	    0, 0)) {
		conf_end(af, 0);
		goto fail;
	}
} else {
	if (conf_set(af, configname, "Suites",
	    "QM-ESP-3DES-SHA-PFS-SUITE", 0, 0)) {
		conf_end(af, 0);
		goto fail;
	}
}
} else 
pf_key_v2_conf_refinc(af, configname);

/* Set the ISAKMP-peer section. */
if (!conf_get_str(peer, "Phase")) {
if (conf_set(af, peer, "Phase", "1", 0, 0) ||
    conf_set(af, peer, "Refcount", "1", 0, 0) ||
    conf_set(af, peer, "Address", dstbuf, 0, 0)) {
	conf_end(af, 0);
	goto fail;
}
if (srcaddr && conf_set(af, peer, "Local-address", srcbuf, 0,
    0)) {
	conf_end(af, 0);
	goto fail;
}
snprintf(confname, sizeof confname, "phase1-%s", peer);
if (conf_set(af, peer, "Configuration", confname, 0, 0)) {
	conf_end(af, 0);
	goto fail;
}

/* Phase 1 configuration. */
if (!conf_get_str(confname, "exchange_type")) {
	xform = conf_get_str("Default-phase-1-configuration",
	"Transforms");
	if (conf_set(af, confname, "Transforms", xform ? xform :
	    "3DES-SHA-RSA_SIG", 0, 0)) {
		conf_end(af, 0);
		goto fail;
	}

	if (conf_set(af, confname, "Exchange_Type", "ID_PROT",
	    0, 0) ||
	    conf_set(af, confname, "DOI", "IPSEC", 0, 0) ||
	    conf_set(af, confname, "Refcount", "1", 0, 0)) {
		conf_end(af, 0);
		goto fail;
	}
} else
	pf_key_v2_conf_refinc(af, confname);

/* The ID we should use in Phase 1. */
if (srcid && conf_set(af, peer, "ID", srcid, 0, 0)) {
	conf_end(af, 0);
	goto fail;
}
/* The ID the other side should use in Phase 1. */
if (dstid && conf_set(af, peer, "Remote-ID", dstid, 0, 0)) {
	conf_end(af, 0);
	goto fail;
}
} else
pf_key_v2_conf_refinc(af, peer);

/* All done. */
conf_end(af, 1);

/* Let's rock 'n roll. */
connection_record_passive(conn);
pf_key_v2_connection_check(conn);
conn = 0;

/* Fall-through to cleanup. */
3169fail:
if (ret)
pf_key_v2_msg_free(ret);
if (askpolicy)
pf_key_v2_msg_free(askpolicy);
free(srcid);
free(dstid);
free(peer);
free(conn);
return;
3179}

3181static void
3182pf_key_v2_notify(struct pf_key_v2_msg *msg)
3183{
switch (((struct sadb_msg *)TAILQ_FIRST(msg)((msg)->tqh_first)->seg)->sadb_msg_type) {
case SADB_EXPIRE8:
pf_key_v2_expire(msg);
break;

case SADB_ACQUIRE6:
if (!ui_daemon_passive)
	pf_key_v2_acquire(msg);
break;

default:
log_print("pf_key_v2_notify: unexpected message type (%d)",
    ((struct sadb_msg *)TAILQ_FIRST(msg)((msg)->tqh_first)->seg)->sadb_msg_type);
}
pf_key_v2_msg_free(msg);
3199}

3201void
3202pf_key_v2_handler(int fd)
3203{
struct pf_key_v2_msg *msg;
int		n;

/*
* As synchronous read/writes to the socket can have taken place
* between the select(2) call of the main loop and this handler, we
* need to recheck the readability.
*/
if (ioctl(pf_key_v2_socket, FIONREAD((unsigned long)0x40000000 | ((sizeof(int) & 0x1fff) <<
 16) | ((('f')) << 8) | ((127))), &n) == -1) {
log_error("pf_key_v2_handler: ioctl (%d, FIONREAD, &n) failed",
    pf_key_v2_socket);
return;
}
if (!n)
return;

msg = pf_key_v2_read(0);
if (msg)
pf_key_v2_notify(msg);
3223}

3225/*
* Group 2 IPsec SAs given by the PROTO1 and PROTO2 protocols of the SA IKE
* security association in a chain.
* XXX Assumes OpenBSD GRPSPIS extension.
*/
3230int
3231pf_key_v2_group_spis(struct sa *sa, struct proto *proto1,
  struct proto *proto2, int incoming)
3233{
struct sadb_msg msg;
struct sadb_sa  sa1, sa2;
struct sadb_address *addr = 0;
struct sadb_protocol protocol;
struct pf_key_v2_msg *grpspis = 0, *ret = 0;
struct sockaddr *saddr;
int		err;
size_t		len;

msg.sadb_msg_type = SADB_X_GRPSPIS14;
switch (proto1->proto) {
case IPSEC_PROTO_IPSEC_ESP3:
msg.sadb_msg_satype = SADB_SATYPE_ESP2;
break;
case IPSEC_PROTO_IPSEC_AH2:
msg.sadb_msg_satype = SADB_SATYPE_AH1;
break;
case IPSEC_PROTO_IPCOMP4:
msg.sadb_msg_satype = SADB_X_SATYPE_IPCOMP9;
break;
default:
log_print("pf_key_v2_group_spis: invalid proto %d",
    proto1->proto);
goto cleanup;
}
msg.sadb_msg_seq = 0;
grpspis = pf_key_v2_msg_new(&msg, 0);
if (!grpspis)
goto cleanup;

/* Setup the SA extensions.  */
sa1.sadb_sa_exttype = SADB_EXT_SA1;
sa1.sadb_sa_len = sizeof sa1 / PF_KEY_V2_CHUNK8;
memcpy(&sa1.sadb_sa_spi, proto1->spi[incoming],
   sizeof sa1.sadb_sa_spi);
sa1.sadb_sa_replay = 0;
sa1.sadb_sa_state = 0;
sa1.sadb_sa_auth = 0;
sa1.sadb_sa_encrypt = 0;
sa1.sadb_sa_flags = 0;
if (pf_key_v2_msg_add(grpspis, (struct sadb_ext *)&sa1, 0) == -1)
goto cleanup;

sa2.sadb_sa_exttype = SADB_X_EXT_SA223;
sa2.sadb_sa_len = sizeof sa2 / PF_KEY_V2_CHUNK8;
memcpy(&sa2.sadb_sa_spi, proto2->spi[incoming],
   sizeof sa2.sadb_sa_spi);
sa2.sadb_sa_replay = 0;
sa2.sadb_sa_state = 0;
sa2.sadb_sa_auth = 0;
sa2.sadb_sa_encrypt = 0;
sa2.sadb_sa_flags = 0;
if (pf_key_v2_msg_add(grpspis, (struct sadb_ext *)&sa2, 0) == -1)
goto cleanup;

/*
* Setup the ADDRESS extensions.
*/
if (incoming)
sa->transport->vtbl->get_src(sa->transport, &saddr);
else
sa->transport->vtbl->get_dst(sa->transport, &saddr);
len = sizeof *addr + PF_KEY_V2_ROUND(SA_LEN(saddr))(((((saddr)->sa_len)) + 8 - 1) & ~(8 - 1));
addr = calloc(1, len);
if (!addr)
goto cleanup;
addr->sadb_address_exttype = SADB_EXT_ADDRESS_DST6;
addr->sadb_address_len = len / PF_KEY_V2_CHUNK8;
addr->sadb_address_reserved = 0;
memcpy(addr + 1, saddr, SA_LEN(saddr)((saddr)->sa_len));
((struct sockaddr_in *) (addr + 1))->sin_port = 0;
if (pf_key_v2_msg_add(grpspis, (struct sadb_ext *) addr,
   PF_KEY_V2_NODE_MALLOCED1) == -1)
goto cleanup;
addr = 0;

addr = calloc(1, len);
if (!addr)
goto cleanup;
addr->sadb_address_exttype = SADB_X_EXT_DST224;
addr->sadb_address_len = len / PF_KEY_V2_CHUNK8;
addr->sadb_address_reserved = 0;
memcpy(addr + 1, saddr, SA_LEN(saddr)((saddr)->sa_len));
((struct sockaddr_in *) (addr + 1))->sin_port = 0;
if (pf_key_v2_msg_add(grpspis, (struct sadb_ext *) addr,
   PF_KEY_V2_NODE_MALLOCED1) == -1)
goto cleanup;
addr = 0;

/* Setup the sa type extension.  */
protocol.sadb_protocol_exttype = SADB_X_EXT_SATYPE235;
protocol.sadb_protocol_len = sizeof protocol / PF_KEY_V2_CHUNK8;
switch (proto2->proto) {
case IPSEC_PROTO_IPSEC_ESP3:
protocol.sadb_protocol_proto = SADB_SATYPE_ESP2;
break;
case IPSEC_PROTO_IPSEC_AH2:
protocol.sadb_protocol_proto = SADB_SATYPE_AH1;
break;
case IPSEC_PROTO_IPCOMP4:
protocol.sadb_protocol_proto = SADB_X_SATYPE_IPCOMP9;
break;
default:
log_print("pf_key_v2_group_spis: invalid proto %d",
    proto2->proto);
goto cleanup;
}
protocol.sadb_protocol_reserved2 = 0;
if (pf_key_v2_msg_add(grpspis,
   (struct sadb_ext *)&protocol, 0) == -1)
goto cleanup;

ret = pf_key_v2_call(grpspis);
pf_key_v2_msg_free(grpspis);
grpspis = 0;
if (!ret)
goto cleanup;
err = ((struct sadb_msg *)TAILQ_FIRST(ret)((ret)->tqh_first)->seg)->sadb_msg_errno;
if (err) {
log_print("pf_key_v2_group_spis: GRPSPIS: %s", strerror(err));
goto cleanup;
}
pf_key_v2_msg_free(ret);

LOG_DBG((LOG_SYSDEP, 50, "pf_key_v2_group_spis: done"))log_debug (LOG_SYSDEP, 50, "pf_key_v2_group_spis: done");

return 0;

3362cleanup:
free(addr);
if (grpspis)
pf_key_v2_msg_free(grpspis);
if (ret)
pf_key_v2_msg_free(ret);
return -1;
3369}