1/*	$NetBSD: ipsec.c,v 1.3 2009/01/08 21:37:20 christos Exp $	*/
2
3/*
4 * Copyright (C) 1999 WIDE Project.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 * 3. Neither the name of the project nor the names of its contributors
16 *    may be used to endorse or promote products derived from this software
17 *    without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 */
31
32#include <sys/param.h>
33#include <sys/stat.h>
34#include <sys/socket.h>
35
36#include <netinet/in.h>
37#include <arpa/inet.h>
38
39#include <stdio.h>
40#include <stdlib.h>
41#include <string.h>
42#include <unistd.h>
43#include <ctype.h>
44
45#ifdef IPSEC
46#include <netipsec/ipsec.h>
47#ifndef IPSEC_POLICY_IPSEC	/* no ipsec support on old ipsec */
48#undef IPSEC
49#endif
50#endif
51
52#include "ipsec.h"
53
54#ifdef IPSEC
55int
56ipsecsetup(int af, int fd, const char *policy)
57{
58	char *p0, *p;
59	int error;
60
61	if (!policy || policy == '\0')
62		p0 = p = strdup("in entrust; out entrust");
63	else
64		p0 = p = strdup(policy);
65
66	error = 0;
67	for (;;) {
68		p = strtok(p, ";");
69		if (p == NULL)
70			break;
71		while (*p && isspace((unsigned char)*p))
72			p++;
73		if (!*p) {
74			p = NULL;
75			continue;
76		}
77		error = ipsecsetup0(af, fd, p, 1);
78		if (error < 0)
79			break;
80		p = NULL;
81	}
82
83	free(p0);
84	return error;
85}
86
87int
88ipsecsetup_test(const char *policy)
89{
90	char *p0, *p;
91	char *buf;
92	int error;
93
94	if (!policy)
95		return -1;
96	p0 = p = strdup(policy);
97	if (p == NULL)
98		return -1;
99
100	error = 0;
101	for (;;) {
102		p = strtok(p, ";");
103		if (p == NULL)
104			break;
105		while (*p && isspace((unsigned char)*p))
106			p++;
107		if (!*p) {
108			p = NULL;
109			continue;
110		}
111		buf = ipsec_set_policy(p, (int)strlen(p));
112		if (buf == NULL) {
113			error = -1;
114			break;
115		}
116		free(buf);
117		p = NULL;
118	}
119
120	free(p0);
121	return error;
122}
123
124int
125ipsecsetup0(int af, int fd, const char *policy, int commit)
126{
127	int level;
128	int opt;
129	char *buf;
130	int error;
131
132	switch (af) {
133	case AF_INET:
134		level = IPPROTO_IP;
135		opt = IP_IPSEC_POLICY;
136		break;
137#ifdef INET6
138	case AF_INET6:
139		level = IPPROTO_IPV6;
140		opt = IPV6_IPSEC_POLICY;
141		break;
142#endif
143	default:
144		return -1;
145	}
146
147	buf = ipsec_set_policy(policy, (int)strlen(policy));
148	if (buf != NULL) {
149		error = 0;
150		if (commit && setsockopt(fd, level, opt,
151		    buf, (socklen_t)ipsec_get_policylen(buf)) < 0) {
152			error = -1;
153		}
154		free(buf);
155	} else
156		error = -1;
157	return error;
158}
159#endif
160