xref: /onnv-gate/usr/src/lib/libnsl/ipsec/algs.c (revision 10824:c47254a96e5d)
10Sstevel@tonic-gate /*
20Sstevel@tonic-gate  * CDDL HEADER START
30Sstevel@tonic-gate  *
40Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
51914Scasper  * Common Development and Distribution License (the "License").
61914Scasper  * You may not use this file except in compliance with the License.
70Sstevel@tonic-gate  *
80Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
90Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
100Sstevel@tonic-gate  * See the License for the specific language governing permissions
110Sstevel@tonic-gate  * and limitations under the License.
120Sstevel@tonic-gate  *
130Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
140Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
150Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
160Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
170Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
180Sstevel@tonic-gate  *
190Sstevel@tonic-gate  * CDDL HEADER END
200Sstevel@tonic-gate  */
21132Srobinson 
220Sstevel@tonic-gate /*
23*10824SMark.Fenwick@Sun.COM  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
240Sstevel@tonic-gate  * Use is subject to license terms.
250Sstevel@tonic-gate  */
260Sstevel@tonic-gate 
271219Sraf #include "mt.h"
280Sstevel@tonic-gate #include <sys/types.h>
290Sstevel@tonic-gate #include <sys/errno.h>
300Sstevel@tonic-gate #include <sys/stat.h>
310Sstevel@tonic-gate #include <ipsec_util.h>
320Sstevel@tonic-gate #include <netdb.h>
330Sstevel@tonic-gate #include <fcntl.h>
340Sstevel@tonic-gate #include <unistd.h>
350Sstevel@tonic-gate #include <synch.h>
360Sstevel@tonic-gate #include <string.h>
370Sstevel@tonic-gate #include <strings.h>
380Sstevel@tonic-gate #include <stdlib.h>
390Sstevel@tonic-gate #include <unistd.h>
400Sstevel@tonic-gate #include <syslog.h>
410Sstevel@tonic-gate 
420Sstevel@tonic-gate /* Globals... */
430Sstevel@tonic-gate static rwlock_t proto_rw = DEFAULTRWLOCK; /* Protects cached algorithm list. */
440Sstevel@tonic-gate static time_t proto_last_update;
450Sstevel@tonic-gate static ipsec_proto_t *protos;
460Sstevel@tonic-gate static int num_protos;
470Sstevel@tonic-gate 
480Sstevel@tonic-gate void
_clean_trash(ipsec_proto_t * proto,int num)490Sstevel@tonic-gate _clean_trash(ipsec_proto_t *proto, int num)
500Sstevel@tonic-gate {
510Sstevel@tonic-gate 	int alg_offset;
520Sstevel@tonic-gate 
530Sstevel@tonic-gate 	if (proto == NULL)
540Sstevel@tonic-gate 		return;
550Sstevel@tonic-gate 
560Sstevel@tonic-gate 	while (num-- != 0) {
570Sstevel@tonic-gate 		free(proto[num].proto_name);
580Sstevel@tonic-gate 		free(proto[num].proto_pkg);
590Sstevel@tonic-gate 		for (alg_offset = 0; alg_offset < proto[num].proto_numalgs;
600Sstevel@tonic-gate 		    alg_offset++)
610Sstevel@tonic-gate 			freeipsecalgent(proto[num].proto_algs[alg_offset]);
620Sstevel@tonic-gate 		free(proto[num].proto_algs);
630Sstevel@tonic-gate 		for (alg_offset = 0; alg_offset < proto[num].proto_algs_npkgs;
640Sstevel@tonic-gate 		    alg_offset++)
650Sstevel@tonic-gate 			free(proto[num].proto_algs_pkgs[alg_offset].pkg_name);
660Sstevel@tonic-gate 		free(proto[num].proto_algs_pkgs);
670Sstevel@tonic-gate 	}
680Sstevel@tonic-gate 
690Sstevel@tonic-gate 	free(proto);
700Sstevel@tonic-gate }
710Sstevel@tonic-gate 
720Sstevel@tonic-gate static const char *pipechar = "|";
730Sstevel@tonic-gate static const char *comma = ",";
740Sstevel@tonic-gate static const char *dash = "-";
750Sstevel@tonic-gate static const char *slash = "/";
760Sstevel@tonic-gate 
770Sstevel@tonic-gate /*
780Sstevel@tonic-gate  * Returns >= 0 if success (and > 0 means "increment").
790Sstevel@tonic-gate  * Returns -1 if failure.
800Sstevel@tonic-gate  */
810Sstevel@tonic-gate static int
build_keysizes(int ** sizep,char * input_string)820Sstevel@tonic-gate build_keysizes(int **sizep, char *input_string)
830Sstevel@tonic-gate {
840Sstevel@tonic-gate 	char *lasts, *token;
850Sstevel@tonic-gate 	int *key_sizes = NULL, num_sizes, key_low, key_high, key_default;
860Sstevel@tonic-gate 	int key_increment = 0;
870Sstevel@tonic-gate 
880Sstevel@tonic-gate 	/*
890Sstevel@tonic-gate 	 * Okay, let's check the format of the key string.  It'll be either:
900Sstevel@tonic-gate 	 *
910Sstevel@tonic-gate 	 * enumeration: size1,size2...,sizeN
920Sstevel@tonic-gate 	 * range: defaultSize/sizeLow-sizeHi,increment
930Sstevel@tonic-gate 	 *
940Sstevel@tonic-gate 	 * In the case of an enumeration, the default key size is the
950Sstevel@tonic-gate 	 * first one in the list.
960Sstevel@tonic-gate 	 */
970Sstevel@tonic-gate 
980Sstevel@tonic-gate 	if (strchr(input_string, '/') != NULL) {
990Sstevel@tonic-gate 		/* key sizes specified by range */
1000Sstevel@tonic-gate 
1010Sstevel@tonic-gate 		/* default */
1020Sstevel@tonic-gate 		token = strtok_r(input_string, slash, &lasts);
1030Sstevel@tonic-gate 		if (token == NULL || (key_default = atoi(token)) == 0)
1040Sstevel@tonic-gate 			return (-1);
1050Sstevel@tonic-gate 
1060Sstevel@tonic-gate 		/* low */
1070Sstevel@tonic-gate 		token = strtok_r(NULL, dash, &lasts);
1080Sstevel@tonic-gate 		if (token == NULL || (key_low = atoi(token)) == 0)
1090Sstevel@tonic-gate 			return (-1);
1100Sstevel@tonic-gate 
1110Sstevel@tonic-gate 		/* high */
1120Sstevel@tonic-gate 		token = strtok_r(NULL, comma, &lasts);
1130Sstevel@tonic-gate 		if (token == NULL || (key_high = atoi(token)) == 0 ||
1140Sstevel@tonic-gate 		    key_high <= key_low)
1150Sstevel@tonic-gate 			return (-1);
1160Sstevel@tonic-gate 
1170Sstevel@tonic-gate 		/* increment */
1180Sstevel@tonic-gate 		token = strtok_r(NULL, "", &lasts);
1190Sstevel@tonic-gate 		if (token == NULL || (key_increment = atoi(token)) == 0)
1200Sstevel@tonic-gate 			return (-1);
1210Sstevel@tonic-gate 
1220Sstevel@tonic-gate 		key_sizes = (int *)malloc(LIBIPSEC_ALGS_KEY_NUM_VAL *
1230Sstevel@tonic-gate 		    sizeof (int));
1240Sstevel@tonic-gate 		if (key_sizes == NULL)
1250Sstevel@tonic-gate 			return (-1);
1260Sstevel@tonic-gate 
1270Sstevel@tonic-gate 		key_sizes[LIBIPSEC_ALGS_KEY_DEF_IDX] = key_default;
1280Sstevel@tonic-gate 		key_sizes[LIBIPSEC_ALGS_KEY_MIN_IDX] = key_low;
1290Sstevel@tonic-gate 		key_sizes[LIBIPSEC_ALGS_KEY_MAX_IDX] = key_high;
1300Sstevel@tonic-gate 		key_sizes[LIBIPSEC_ALGS_KEY_MAX_IDX + 1] = 0;
1310Sstevel@tonic-gate 	} else {
1320Sstevel@tonic-gate 		/* key sizes specified by enumeration */
1330Sstevel@tonic-gate 
1340Sstevel@tonic-gate 		key_sizes = (int *)malloc(sizeof (int));
1350Sstevel@tonic-gate 		if (key_sizes == NULL)
1360Sstevel@tonic-gate 			return (-1);
1370Sstevel@tonic-gate 		num_sizes = 0;
1380Sstevel@tonic-gate 
1390Sstevel@tonic-gate 		token = strtok_r(input_string, comma, &lasts);
1404979Sdm199272 		if (token == NULL) {
1414979Sdm199272 			free(key_sizes);
1420Sstevel@tonic-gate 			return (-1);
1434979Sdm199272 		}
1440Sstevel@tonic-gate 		*key_sizes = 0;
1450Sstevel@tonic-gate 		do {
1460Sstevel@tonic-gate 			int *nks;
1470Sstevel@tonic-gate 
1480Sstevel@tonic-gate 			nks = (int *)realloc(key_sizes,
1490Sstevel@tonic-gate 			    sizeof (int) * ((++num_sizes) + 1));
1500Sstevel@tonic-gate 			if (nks == NULL) {
1510Sstevel@tonic-gate 				free(key_sizes);
1520Sstevel@tonic-gate 				return (-1);
1530Sstevel@tonic-gate 			}
1540Sstevel@tonic-gate 			key_sizes = nks;
1550Sstevel@tonic-gate 			/* Can't check for atoi() == 0 here... */
1560Sstevel@tonic-gate 			key_sizes[num_sizes - 1] = atoi(token);
1570Sstevel@tonic-gate 			key_sizes[num_sizes] = 0;
1580Sstevel@tonic-gate 		} while ((token = strtok_r(NULL, comma, &lasts)) != NULL);
1590Sstevel@tonic-gate 	}
1600Sstevel@tonic-gate 	*sizep = key_sizes;
1610Sstevel@tonic-gate 
1620Sstevel@tonic-gate 	return (key_increment);
1630Sstevel@tonic-gate }
1640Sstevel@tonic-gate 
1650Sstevel@tonic-gate /*
1660Sstevel@tonic-gate  * Find the execution mode corresponding to the given string.
1670Sstevel@tonic-gate  * Returns 0 on success, -1 on failure.
1680Sstevel@tonic-gate  */
1690Sstevel@tonic-gate int
_str_to_ipsec_exec_mode(char * str,ipsecalgs_exec_mode_t * exec_mode)1700Sstevel@tonic-gate _str_to_ipsec_exec_mode(char *str, ipsecalgs_exec_mode_t *exec_mode)
1710Sstevel@tonic-gate {
1720Sstevel@tonic-gate 	if (strcmp(str, "sync") == 0) {
1730Sstevel@tonic-gate 		*exec_mode = LIBIPSEC_ALGS_EXEC_SYNC;
1740Sstevel@tonic-gate 		return (0);
1750Sstevel@tonic-gate 	} else if (strcmp(str, "async") == 0) {
1760Sstevel@tonic-gate 		*exec_mode = LIBIPSEC_ALGS_EXEC_ASYNC;
1770Sstevel@tonic-gate 		return (0);
1780Sstevel@tonic-gate 	}
1790Sstevel@tonic-gate 
1800Sstevel@tonic-gate 	return (-1);
1810Sstevel@tonic-gate }
1820Sstevel@tonic-gate 
1830Sstevel@tonic-gate /*
1840Sstevel@tonic-gate  * Given a file pointer, read all the text from the file and convert it into
1850Sstevel@tonic-gate  * a bunch of ipsec_proto_t's, each with an array of struct ipsecalgent
1860Sstevel@tonic-gate  * pointers - one for each algorithm.
1870Sstevel@tonic-gate  */
1880Sstevel@tonic-gate static ipsec_proto_t *
build_list(FILE * f,int * num)1890Sstevel@tonic-gate build_list(FILE *f, int *num)
1900Sstevel@tonic-gate {
1910Sstevel@tonic-gate 	char line[1024];
1920Sstevel@tonic-gate 	char *token, *lasts, *alg_names, *ef_name, *key_string, *block_string;
193*10824SMark.Fenwick@Sun.COM 	char *proto_name, *params_string;
1940Sstevel@tonic-gate 	ipsec_proto_t *rc = NULL, *new_proto = NULL;
195*10824SMark.Fenwick@Sun.COM 	int *block_sizes = NULL, *key_sizes = NULL, *mech_params = NULL;
1960Sstevel@tonic-gate 	int rc_num = 0, key_increment;
197*10824SMark.Fenwick@Sun.COM 	int new_num, alg_num, num_sizes, flags = 0;
1980Sstevel@tonic-gate 	struct ipsecalgent *curalg, **newalglist;
1990Sstevel@tonic-gate 	char cur_pkg[1024];
2000Sstevel@tonic-gate 	boolean_t doing_pkg = B_FALSE;
2010Sstevel@tonic-gate 	ipsecalgs_exec_mode_t exec_mode;
2020Sstevel@tonic-gate 	char diag_buf[128];
2030Sstevel@tonic-gate 
2040Sstevel@tonic-gate 	diag_buf[0] = '\0';
2050Sstevel@tonic-gate 
2060Sstevel@tonic-gate 	while (fgets(line, sizeof (line), f) != NULL) {
2070Sstevel@tonic-gate 		if (strncasecmp(line, LIBIPSEC_ALGS_LINE_PROTO,
2080Sstevel@tonic-gate 		    sizeof (LIBIPSEC_ALGS_LINE_PROTO) - 1) != 0 &&
2090Sstevel@tonic-gate 		    strncasecmp(line, LIBIPSEC_ALGS_LINE_ALG,
2100Sstevel@tonic-gate 		    sizeof (LIBIPSEC_ALGS_LINE_ALG) - 1) != 0 &&
2110Sstevel@tonic-gate 		    strncasecmp(line, LIBIPSEC_ALGS_LINE_PKGSTART,
2120Sstevel@tonic-gate 		    sizeof (LIBIPSEC_ALGS_LINE_PKGSTART) - 1) != 0 &&
2130Sstevel@tonic-gate 		    strncasecmp(line, LIBIPSEC_ALGS_LINE_PKGEND,
2140Sstevel@tonic-gate 		    sizeof (LIBIPSEC_ALGS_LINE_PKGEND) - 1) != 0) {
2150Sstevel@tonic-gate 			if ((token = strtok_r(line, " \t\n", &lasts)) == NULL ||
2160Sstevel@tonic-gate 			    token[0] == '#') {
2170Sstevel@tonic-gate 				continue;
2180Sstevel@tonic-gate 			} else {
219132Srobinson 				(void) snprintf(diag_buf, sizeof (diag_buf),
2204979Sdm199272 				    "non-recognized start of line");
2210Sstevel@tonic-gate 				goto bail;
2220Sstevel@tonic-gate 			}
2230Sstevel@tonic-gate 		}
2240Sstevel@tonic-gate 
2250Sstevel@tonic-gate 		if (strncasecmp(line, LIBIPSEC_ALGS_LINE_PROTO,
2260Sstevel@tonic-gate 		    sizeof (LIBIPSEC_ALGS_LINE_PROTO) - 1) == 0) {
2270Sstevel@tonic-gate 			/* current line defines a new protocol */
2280Sstevel@tonic-gate 
2290Sstevel@tonic-gate 			/* skip the protocol token */
2300Sstevel@tonic-gate 			token = strtok_r(line, pipechar, &lasts);
2310Sstevel@tonic-gate 
2320Sstevel@tonic-gate 			/* protocol number */
2330Sstevel@tonic-gate 			token = strtok_r(NULL, pipechar, &lasts);
2340Sstevel@tonic-gate 			if (token == NULL || (new_num = atoi(token)) == 0) {
235132Srobinson 				(void) snprintf(diag_buf, sizeof (diag_buf),
2360Sstevel@tonic-gate 				    "invalid protocol number");
2370Sstevel@tonic-gate 				goto bail;
2380Sstevel@tonic-gate 			}
2390Sstevel@tonic-gate 
2400Sstevel@tonic-gate 			/* protocol name */
2410Sstevel@tonic-gate 			token = strtok_r(NULL, pipechar, &lasts);
2420Sstevel@tonic-gate 			if (token == NULL) {
243132Srobinson 				(void) snprintf(diag_buf, sizeof (diag_buf),
2440Sstevel@tonic-gate 				    "cannot read protocol name");
2450Sstevel@tonic-gate 				goto bail;
2460Sstevel@tonic-gate 			}
2470Sstevel@tonic-gate 			proto_name = token;
2480Sstevel@tonic-gate 
2490Sstevel@tonic-gate 			/* execution mode */
2500Sstevel@tonic-gate 			token = strtok_r(NULL, pipechar, &lasts);
2510Sstevel@tonic-gate 			if (token == NULL) {
252132Srobinson 				(void) snprintf(diag_buf, sizeof (diag_buf),
2530Sstevel@tonic-gate 				    "cannot read execution mode");
2540Sstevel@tonic-gate 				goto bail;
2550Sstevel@tonic-gate 			}
2560Sstevel@tonic-gate 			/* remove trailing '\n' */
2570Sstevel@tonic-gate 			token[strlen(token) - 1] = '\0';
2580Sstevel@tonic-gate 			if (_str_to_ipsec_exec_mode(token, &exec_mode) != 0) {
259132Srobinson 				(void) snprintf(diag_buf, sizeof (diag_buf),
2600Sstevel@tonic-gate 				    "invalid execution mode: \"%s\"", token);
2610Sstevel@tonic-gate 				goto bail;
2620Sstevel@tonic-gate 			}
2630Sstevel@tonic-gate 
2640Sstevel@tonic-gate 			/* initialize protocol structure */
2650Sstevel@tonic-gate 			rc_num++;
2660Sstevel@tonic-gate 			new_proto = (ipsec_proto_t *)realloc(rc,
2670Sstevel@tonic-gate 			    sizeof (ipsec_proto_t) * rc_num);
2680Sstevel@tonic-gate 			rc = new_proto;
2690Sstevel@tonic-gate 			if (new_proto == NULL)
2700Sstevel@tonic-gate 				goto bail;
2710Sstevel@tonic-gate 			new_proto += (rc_num - 1);
2720Sstevel@tonic-gate 			new_proto->proto_num = new_num;
2730Sstevel@tonic-gate 			new_proto->proto_algs = NULL;
2740Sstevel@tonic-gate 			new_proto->proto_numalgs = 0;
2750Sstevel@tonic-gate 			new_proto->proto_name = strdup(proto_name);
2760Sstevel@tonic-gate 			if (new_proto->proto_name == NULL)
2770Sstevel@tonic-gate 				goto bail;
2780Sstevel@tonic-gate 			new_proto->proto_exec_mode = exec_mode;
2790Sstevel@tonic-gate 
2800Sstevel@tonic-gate 			if (doing_pkg) {
2810Sstevel@tonic-gate 				/* record proto as being part of current pkg */
2820Sstevel@tonic-gate 				new_proto->proto_pkg = strdup(cur_pkg);
2830Sstevel@tonic-gate 				if (new_proto->proto_pkg == NULL)
2840Sstevel@tonic-gate 					goto bail;
2850Sstevel@tonic-gate 			} else {
2860Sstevel@tonic-gate 				new_proto->proto_pkg = NULL;
2870Sstevel@tonic-gate 			}
2880Sstevel@tonic-gate 
2890Sstevel@tonic-gate 			new_proto->proto_algs_pkgs = NULL;
2900Sstevel@tonic-gate 			new_proto->proto_algs_npkgs = 0;
2910Sstevel@tonic-gate 
2920Sstevel@tonic-gate 		} else if (strncasecmp(line, LIBIPSEC_ALGS_LINE_ALG,
2930Sstevel@tonic-gate 		    sizeof (LIBIPSEC_ALGS_LINE_ALG) - 1) == 0) {
2940Sstevel@tonic-gate 			/* current line defines a new algorithm */
2950Sstevel@tonic-gate 
2960Sstevel@tonic-gate 			/* skip the algorithm token */
2970Sstevel@tonic-gate 			token = strtok_r(line, pipechar, &lasts);
2980Sstevel@tonic-gate 
2990Sstevel@tonic-gate 			/* protocol number */
3000Sstevel@tonic-gate 			token = strtok_r(NULL, pipechar, &lasts);
3010Sstevel@tonic-gate 			if (token == NULL || (new_num = atoi(token)) == 0) {
302132Srobinson 				(void) snprintf(diag_buf, sizeof (diag_buf),
3030Sstevel@tonic-gate 				    "invalid algorithm number");
3040Sstevel@tonic-gate 				goto bail;
3050Sstevel@tonic-gate 			}
3060Sstevel@tonic-gate 
3070Sstevel@tonic-gate 			/* We can be O(N) for now.  There aren't that many. */
3080Sstevel@tonic-gate 			for (new_proto = rc; new_proto < (rc + new_num);
3090Sstevel@tonic-gate 			    new_proto++)
3100Sstevel@tonic-gate 				if (new_proto->proto_num == new_num)
3110Sstevel@tonic-gate 					break;
3120Sstevel@tonic-gate 			if (new_proto == (rc + new_num)) {
313132Srobinson 				(void) snprintf(diag_buf, sizeof (diag_buf),
3140Sstevel@tonic-gate 				    "invalid protocol number %d for algorithm",
3150Sstevel@tonic-gate 				    new_num);
3160Sstevel@tonic-gate 				goto bail;
3170Sstevel@tonic-gate 			}
3180Sstevel@tonic-gate 
3190Sstevel@tonic-gate 			/* algorithm number */
3200Sstevel@tonic-gate 			token = strtok_r(NULL, pipechar, &lasts);
3210Sstevel@tonic-gate 			if (token == NULL) {
322132Srobinson 				(void) snprintf(diag_buf, sizeof (diag_buf),
3230Sstevel@tonic-gate 				    "cannot read algorithm number");
3240Sstevel@tonic-gate 				goto bail;
3250Sstevel@tonic-gate 			}
3260Sstevel@tonic-gate 			/* Can't check for 0 here. */
3270Sstevel@tonic-gate 			alg_num = atoi(token);
3280Sstevel@tonic-gate 
3290Sstevel@tonic-gate 			/* algorithm names */
3300Sstevel@tonic-gate 			token = strtok_r(NULL, pipechar, &lasts);
3310Sstevel@tonic-gate 			if (token == NULL) {
332132Srobinson 				(void) snprintf(diag_buf, sizeof (diag_buf),
3330Sstevel@tonic-gate 				    "cannot read algorithm number");
3340Sstevel@tonic-gate 				goto bail;
3350Sstevel@tonic-gate 			}
3360Sstevel@tonic-gate 			alg_names = token;
3370Sstevel@tonic-gate 
3380Sstevel@tonic-gate 			/* mechanism name */
3390Sstevel@tonic-gate 			token = strtok_r(NULL, pipechar, &lasts);
3400Sstevel@tonic-gate 			if (token == NULL) {
341132Srobinson 				(void) snprintf(diag_buf, sizeof (diag_buf),
3420Sstevel@tonic-gate 				    "cannot read mechanism name for alg %d "
3430Sstevel@tonic-gate 				    "(proto %d)", alg_num,
3440Sstevel@tonic-gate 				    new_proto->proto_num);
3450Sstevel@tonic-gate 				goto bail;
3460Sstevel@tonic-gate 			}
3470Sstevel@tonic-gate 			ef_name = token;
3480Sstevel@tonic-gate 
3490Sstevel@tonic-gate 			/* key sizes */
3500Sstevel@tonic-gate 			token = strtok_r(NULL, pipechar, &lasts);
3510Sstevel@tonic-gate 			if (token == NULL) {
352132Srobinson 				(void) snprintf(diag_buf, sizeof (diag_buf),
3530Sstevel@tonic-gate 				    "cannot read key sizes for alg %d "
3540Sstevel@tonic-gate 				    "(proto %d)", alg_num,
3550Sstevel@tonic-gate 				    new_proto->proto_num);
3560Sstevel@tonic-gate 				goto bail;
3570Sstevel@tonic-gate 			}
3580Sstevel@tonic-gate 			key_string = token;
3590Sstevel@tonic-gate 
3600Sstevel@tonic-gate 			/* block sizes */
3610Sstevel@tonic-gate 			token = strtok_r(NULL, pipechar, &lasts);
3620Sstevel@tonic-gate 			if (token == NULL) {
363132Srobinson 				(void) snprintf(diag_buf, sizeof (diag_buf),
364*10824SMark.Fenwick@Sun.COM 				    "cannot read block sizes for alg %d "
3650Sstevel@tonic-gate 				    "(proto %d)", alg_num,
3660Sstevel@tonic-gate 				    new_proto->proto_num);
3670Sstevel@tonic-gate 				goto bail;
3680Sstevel@tonic-gate 			}
3690Sstevel@tonic-gate 			block_string = token;
3700Sstevel@tonic-gate 
371*10824SMark.Fenwick@Sun.COM 			/*
372*10824SMark.Fenwick@Sun.COM 			 * Check for mechanism params and flags. As these
373*10824SMark.Fenwick@Sun.COM 			 * are optional, we won't bail if they don't exist.
374*10824SMark.Fenwick@Sun.COM 			 */
375*10824SMark.Fenwick@Sun.COM 			token = strtok_r(NULL, pipechar, &lasts);
376*10824SMark.Fenwick@Sun.COM 			params_string = token;
377*10824SMark.Fenwick@Sun.COM 
378*10824SMark.Fenwick@Sun.COM 			token = strtok_r(NULL, pipechar, &lasts);
379*10824SMark.Fenwick@Sun.COM 			if (token != NULL)
380*10824SMark.Fenwick@Sun.COM 				flags = atoi(token);
381*10824SMark.Fenwick@Sun.COM 
3820Sstevel@tonic-gate 			/* extract key sizes */
3830Sstevel@tonic-gate 			key_increment = build_keysizes(&key_sizes, key_string);
3840Sstevel@tonic-gate 			if (key_increment == -1) {
385132Srobinson 				(void) snprintf(diag_buf, sizeof (diag_buf),
3860Sstevel@tonic-gate 				    "invalid key sizes for alg %d (proto %d)",
3870Sstevel@tonic-gate 				    alg_num, new_proto->proto_num);
3880Sstevel@tonic-gate 				goto bail;
3890Sstevel@tonic-gate 			}
3900Sstevel@tonic-gate 
3910Sstevel@tonic-gate 			/* extract block sizes */
3920Sstevel@tonic-gate 			block_sizes = (int *)malloc(sizeof (int));
3930Sstevel@tonic-gate 			if (block_sizes == NULL) {
3940Sstevel@tonic-gate 				goto bail;
3950Sstevel@tonic-gate 			}
3960Sstevel@tonic-gate 			num_sizes = 0;
3970Sstevel@tonic-gate 			token = strtok_r(block_string, comma, &lasts);
3980Sstevel@tonic-gate 			if (token == NULL) {
399132Srobinson 				(void) snprintf(diag_buf, sizeof (diag_buf),
4000Sstevel@tonic-gate 				    "invalid block sizes for alg %d (proto %d)",
4010Sstevel@tonic-gate 				    alg_num, new_proto->proto_num);
4020Sstevel@tonic-gate 				goto bail;
4030Sstevel@tonic-gate 			}
4040Sstevel@tonic-gate 			*block_sizes = 0;
4050Sstevel@tonic-gate 			do {
4060Sstevel@tonic-gate 				int *nbk;
4070Sstevel@tonic-gate 
4080Sstevel@tonic-gate 				nbk = (int *)realloc(block_sizes,
4090Sstevel@tonic-gate 				    sizeof (int) * ((++num_sizes) + 1));
4100Sstevel@tonic-gate 				if (nbk == NULL) {
4110Sstevel@tonic-gate 					goto bail;
4120Sstevel@tonic-gate 				}
4130Sstevel@tonic-gate 				block_sizes = nbk;
4140Sstevel@tonic-gate 				/* Can't check for 0 here... */
4150Sstevel@tonic-gate 				block_sizes[num_sizes - 1] = atoi(token);
4160Sstevel@tonic-gate 				block_sizes[num_sizes] = 0;
4170Sstevel@tonic-gate 			} while ((token = strtok_r(NULL, comma, &lasts)) !=
4180Sstevel@tonic-gate 			    NULL);
4190Sstevel@tonic-gate 
420*10824SMark.Fenwick@Sun.COM 			/* extract mech params */
421*10824SMark.Fenwick@Sun.COM 			mech_params = (int *)malloc(sizeof (int));
422*10824SMark.Fenwick@Sun.COM 			if (mech_params == NULL) {
423*10824SMark.Fenwick@Sun.COM 				goto bail;
424*10824SMark.Fenwick@Sun.COM 			}
425*10824SMark.Fenwick@Sun.COM 			*mech_params = 0;
426*10824SMark.Fenwick@Sun.COM 			num_sizes = 0;
427*10824SMark.Fenwick@Sun.COM 			if (params_string != NULL) {
428*10824SMark.Fenwick@Sun.COM 				token = strtok_r(params_string, comma, &lasts);
429*10824SMark.Fenwick@Sun.COM 				if (token == NULL) {
430*10824SMark.Fenwick@Sun.COM 					(void) snprintf(diag_buf,
431*10824SMark.Fenwick@Sun.COM 					    sizeof (diag_buf), "invalid mech "
432*10824SMark.Fenwick@Sun.COM 					    "params for alg %d (proto %d)",
433*10824SMark.Fenwick@Sun.COM 					    alg_num, new_proto->proto_num);
434*10824SMark.Fenwick@Sun.COM 					goto bail;
435*10824SMark.Fenwick@Sun.COM 				}
436*10824SMark.Fenwick@Sun.COM 				do {
437*10824SMark.Fenwick@Sun.COM 					int *nbk;
438*10824SMark.Fenwick@Sun.COM 
439*10824SMark.Fenwick@Sun.COM 					nbk = (int *)realloc(mech_params,
440*10824SMark.Fenwick@Sun.COM 					    sizeof (int) * ((++num_sizes) + 1));
441*10824SMark.Fenwick@Sun.COM 					if (nbk == NULL) {
442*10824SMark.Fenwick@Sun.COM 						goto bail;
443*10824SMark.Fenwick@Sun.COM 					}
444*10824SMark.Fenwick@Sun.COM 					mech_params = nbk;
445*10824SMark.Fenwick@Sun.COM 					/* Can't check for 0 here... */
446*10824SMark.Fenwick@Sun.COM 					mech_params[num_sizes - 1] =
447*10824SMark.Fenwick@Sun.COM 					    atoi(token);
448*10824SMark.Fenwick@Sun.COM 					mech_params[num_sizes] = 0;
449*10824SMark.Fenwick@Sun.COM 				} while ((token = strtok_r(NULL, comma, &lasts))
450*10824SMark.Fenwick@Sun.COM 				    != NULL);
451*10824SMark.Fenwick@Sun.COM 			}
4520Sstevel@tonic-gate 			/* Allocate a new struct ipsecalgent. */
4530Sstevel@tonic-gate 			curalg = (struct ipsecalgent *)calloc(
4540Sstevel@tonic-gate 			    sizeof (struct ipsecalgent), 1);
4550Sstevel@tonic-gate 			if (curalg == NULL) {
4560Sstevel@tonic-gate 				goto bail;
4570Sstevel@tonic-gate 			}
4580Sstevel@tonic-gate 			curalg->a_proto_num = new_num;
4590Sstevel@tonic-gate 			curalg->a_alg_num = alg_num;
4600Sstevel@tonic-gate 			curalg->a_block_sizes = block_sizes;
461*10824SMark.Fenwick@Sun.COM 			curalg->a_alg_flags = flags;
462*10824SMark.Fenwick@Sun.COM 			curalg->a_mech_params = mech_params;
4630Sstevel@tonic-gate 			curalg->a_key_sizes = key_sizes;
4640Sstevel@tonic-gate 			curalg->a_key_increment = key_increment;
4650Sstevel@tonic-gate 			if ((curalg->a_mech_name = strdup(ef_name)) == NULL) {
4660Sstevel@tonic-gate 				freeipsecalgent(curalg);
4670Sstevel@tonic-gate 				goto bail;
4680Sstevel@tonic-gate 			}
4690Sstevel@tonic-gate 			/* Set names. */
4700Sstevel@tonic-gate 			curalg->a_names = (char **)malloc(sizeof (char *));
4710Sstevel@tonic-gate 			num_sizes = 0;	/* Recycle "sizes" */
4720Sstevel@tonic-gate 			token = strtok_r(alg_names, comma, &lasts);
4730Sstevel@tonic-gate 			if (curalg->a_names == NULL || token == NULL) {
4740Sstevel@tonic-gate 				freeipsecalgent(curalg);
4750Sstevel@tonic-gate 				goto bail;
4760Sstevel@tonic-gate 			}
4770Sstevel@tonic-gate 			do {
4780Sstevel@tonic-gate 				char **nnames;
4790Sstevel@tonic-gate 
4800Sstevel@tonic-gate 				nnames = (char **)realloc(curalg->a_names,
4810Sstevel@tonic-gate 				    sizeof (char *) * ((++num_sizes) + 1));
4820Sstevel@tonic-gate 				if (nnames == NULL) {
4830Sstevel@tonic-gate 					freeipsecalgent(curalg);
4840Sstevel@tonic-gate 					goto bail;
4850Sstevel@tonic-gate 				}
4860Sstevel@tonic-gate 				curalg->a_names = nnames;
4870Sstevel@tonic-gate 				curalg->a_names[num_sizes] = NULL;
4880Sstevel@tonic-gate 				curalg->a_names[num_sizes - 1] =
4890Sstevel@tonic-gate 				    strdup(token);
4900Sstevel@tonic-gate 				if (curalg->a_names[num_sizes - 1] == NULL) {
4910Sstevel@tonic-gate 					freeipsecalgent(curalg);
4920Sstevel@tonic-gate 					goto bail;
4930Sstevel@tonic-gate 				}
4940Sstevel@tonic-gate 			} while ((token = strtok_r(NULL, comma, &lasts)) !=
4950Sstevel@tonic-gate 			    NULL);
4960Sstevel@tonic-gate 
4970Sstevel@tonic-gate 			if (doing_pkg) {
4980Sstevel@tonic-gate 				/* record alg as being part of current pkg */
4990Sstevel@tonic-gate 				int npkgs = new_proto->proto_algs_npkgs;
5000Sstevel@tonic-gate 
5010Sstevel@tonic-gate 				new_proto->proto_algs_pkgs = realloc(
5020Sstevel@tonic-gate 				    new_proto->proto_algs_pkgs,
5030Sstevel@tonic-gate 				    (npkgs + 1) * sizeof (ipsecalgs_pkg_t));
5040Sstevel@tonic-gate 				if (new_proto->proto_algs_pkgs == NULL)
5050Sstevel@tonic-gate 					goto bail;
5060Sstevel@tonic-gate 
5070Sstevel@tonic-gate 				new_proto->proto_algs_pkgs[npkgs].alg_num =
5084979Sdm199272 				    curalg->a_alg_num;
5090Sstevel@tonic-gate 				new_proto->proto_algs_pkgs[npkgs].pkg_name =
5104979Sdm199272 				    strdup(cur_pkg);
5110Sstevel@tonic-gate 				if (new_proto->proto_algs_pkgs[npkgs].pkg_name
5120Sstevel@tonic-gate 				    == NULL)
5130Sstevel@tonic-gate 					goto bail;
5140Sstevel@tonic-gate 
5150Sstevel@tonic-gate 				new_proto->proto_algs_npkgs = npkgs + 1;
5160Sstevel@tonic-gate 			}
5170Sstevel@tonic-gate 
5180Sstevel@tonic-gate 			/* add new alg to protocol */
5190Sstevel@tonic-gate 			newalglist = realloc(new_proto->proto_algs,
5200Sstevel@tonic-gate 			    (new_proto->proto_numalgs + 1) *
5210Sstevel@tonic-gate 			    sizeof (struct ipsecalgent *));
5220Sstevel@tonic-gate 			if (newalglist == NULL) {
5230Sstevel@tonic-gate 				freeipsecalgent(curalg);
5240Sstevel@tonic-gate 				goto bail;
5250Sstevel@tonic-gate 			}
5260Sstevel@tonic-gate 			newalglist[new_proto->proto_numalgs] = curalg;
5270Sstevel@tonic-gate 			new_proto->proto_numalgs++;
5280Sstevel@tonic-gate 			new_proto->proto_algs = newalglist;
5290Sstevel@tonic-gate 
5300Sstevel@tonic-gate 		} else if (strncasecmp(line, LIBIPSEC_ALGS_LINE_PKGSTART,
5310Sstevel@tonic-gate 		    sizeof (LIBIPSEC_ALGS_LINE_PKGSTART) - 1) == 0) {
5320Sstevel@tonic-gate 			/* start of package delimiter */
5330Sstevel@tonic-gate 			if (doing_pkg) {
534132Srobinson 				(void) snprintf(diag_buf, sizeof (diag_buf),
5350Sstevel@tonic-gate 				    "duplicate package start delimiters");
5360Sstevel@tonic-gate 				goto bail;
5370Sstevel@tonic-gate 			}
5380Sstevel@tonic-gate 			(void) strncpy(cur_pkg, line +
5390Sstevel@tonic-gate 			    (sizeof (LIBIPSEC_ALGS_LINE_PKGSTART) - 1),
5400Sstevel@tonic-gate 			    sizeof (cur_pkg));
5410Sstevel@tonic-gate 			/* remove trailing '\n' */
5420Sstevel@tonic-gate 			cur_pkg[strlen(cur_pkg) - 1] = '\0';
5430Sstevel@tonic-gate 			doing_pkg = B_TRUE;
5440Sstevel@tonic-gate 
5450Sstevel@tonic-gate 		} else {
5460Sstevel@tonic-gate 			/* end of package delimiter */
5470Sstevel@tonic-gate 			char tmp_pkg[1024];
5480Sstevel@tonic-gate 
5490Sstevel@tonic-gate 			if (!doing_pkg) {
550132Srobinson 				(void) snprintf(diag_buf, sizeof (diag_buf),
5510Sstevel@tonic-gate 				    "end package delimiter without start");
5520Sstevel@tonic-gate 				goto bail;
5530Sstevel@tonic-gate 			}
5540Sstevel@tonic-gate 			/*
5550Sstevel@tonic-gate 			 * Get specified pkg name, fail if it doesn't match
5560Sstevel@tonic-gate 			 * the package specified by the last # Begin.
5570Sstevel@tonic-gate 			 */
5580Sstevel@tonic-gate 			(void) strncpy(tmp_pkg, line +
5590Sstevel@tonic-gate 			    (sizeof (LIBIPSEC_ALGS_LINE_PKGEND) - 1),
5600Sstevel@tonic-gate 			    sizeof (tmp_pkg));
5610Sstevel@tonic-gate 			/* remove trailing '\n' */
5620Sstevel@tonic-gate 			tmp_pkg[strlen(tmp_pkg) - 1] = '\0';
5630Sstevel@tonic-gate 			if (strncmp(cur_pkg, tmp_pkg, sizeof (cur_pkg)) != 0)
5640Sstevel@tonic-gate 				goto bail;
5650Sstevel@tonic-gate 			doing_pkg = B_FALSE;
5660Sstevel@tonic-gate 		}
5670Sstevel@tonic-gate 	}
5680Sstevel@tonic-gate 
5690Sstevel@tonic-gate 	*num = rc_num;
5700Sstevel@tonic-gate 	return (rc);
5710Sstevel@tonic-gate 
5720Sstevel@tonic-gate bail:
5730Sstevel@tonic-gate 	if (strlen(diag_buf) > 0) {
5740Sstevel@tonic-gate 		syslog(LOG_ERR, "possibly corrupt %s file: %s\n",
5750Sstevel@tonic-gate 		    INET_IPSECALGSFILE, diag_buf);
5760Sstevel@tonic-gate 	}
577*10824SMark.Fenwick@Sun.COM 	free(key_sizes);
578*10824SMark.Fenwick@Sun.COM 	free(block_sizes);
579*10824SMark.Fenwick@Sun.COM 	free(mech_params);
5800Sstevel@tonic-gate 	_clean_trash(rc, rc_num);
5810Sstevel@tonic-gate 	return (NULL);
5820Sstevel@tonic-gate }
5830Sstevel@tonic-gate 
5840Sstevel@tonic-gate /*
5850Sstevel@tonic-gate  * If alg_context is NULL, update the library's cached copy of
5860Sstevel@tonic-gate  * INET_IPSECALGSFILE.  If alg_context is non-NULL, hang a
5870Sstevel@tonic-gate  * library-internal representation of a cached copy.  The latter is useful
5880Sstevel@tonic-gate  * for routines in libipsecutil that _write_ the contents out.
5890Sstevel@tonic-gate  */
5900Sstevel@tonic-gate void
_build_internal_algs(ipsec_proto_t ** alg_context,int * alg_nums)5910Sstevel@tonic-gate _build_internal_algs(ipsec_proto_t **alg_context, int *alg_nums)
5920Sstevel@tonic-gate {
5931914Scasper 	FILE *f;
5941914Scasper 	int rc, trash_num;
5950Sstevel@tonic-gate 	ipsec_proto_t *new_protos = NULL, *trash;
5960Sstevel@tonic-gate 	time_t filetime;
5970Sstevel@tonic-gate 	struct stat statbuf;
5980Sstevel@tonic-gate 
5990Sstevel@tonic-gate 	/*
6000Sstevel@tonic-gate 	 * Construct new_protos from the file.
6010Sstevel@tonic-gate 	 */
6020Sstevel@tonic-gate 	if (alg_context == NULL) {
6030Sstevel@tonic-gate 		/*
6040Sstevel@tonic-gate 		 * Check the time w/o holding the lock.  This is just a
6050Sstevel@tonic-gate 		 * cache reality check.  We'll do it again for real if this
6060Sstevel@tonic-gate 		 * surface check fails.
6070Sstevel@tonic-gate 		 */
6080Sstevel@tonic-gate 		if (stat(INET_IPSECALGSFILE, &statbuf) == -1 ||
6094979Sdm199272 		    (statbuf.st_mtime < proto_last_update && protos != NULL))
6100Sstevel@tonic-gate 			return;
611132Srobinson 		(void) rw_wrlock(&proto_rw);
6120Sstevel@tonic-gate 	}
6130Sstevel@tonic-gate 
6141914Scasper 	f = fopen(INET_IPSECALGSFILE, "rF");
6151914Scasper 	if (f != NULL) {
6161914Scasper 		rc = fstat(fileno(f), &statbuf);
6171914Scasper 		if (rc != -1) {
6181914Scasper 			/*
6191914Scasper 			 * Update if the file is newer than our
6201914Scasper 			 * last cached copy.
6211914Scasper 			 */
6221914Scasper 			filetime = statbuf.st_mtime;
6231914Scasper 			if (alg_context != NULL ||
6241914Scasper 			    filetime > proto_last_update)
6251914Scasper 				new_protos = build_list(f, &rc);
6260Sstevel@tonic-gate 		}
6271914Scasper 		/* Since f is read-only, can avoid all of the failures... */
6281914Scasper 		(void) fclose(f);
6290Sstevel@tonic-gate 	}
6300Sstevel@tonic-gate 
6310Sstevel@tonic-gate 	if (alg_context == NULL) {
6320Sstevel@tonic-gate 		/*
6330Sstevel@tonic-gate 		 * If we have failed anywhere above, new_protoss will be NULL.
6340Sstevel@tonic-gate 		 * This way, the previous cached protos will still be intact.
6350Sstevel@tonic-gate 		 */
6360Sstevel@tonic-gate 		if (new_protos != NULL) {
6370Sstevel@tonic-gate 			proto_last_update = filetime;
6380Sstevel@tonic-gate 			trash = protos;
6390Sstevel@tonic-gate 			trash_num = num_protos;
6400Sstevel@tonic-gate 			protos = new_protos;
6410Sstevel@tonic-gate 			num_protos = rc;
6420Sstevel@tonic-gate 		} else {
6430Sstevel@tonic-gate 			/*
6440Sstevel@tonic-gate 			 * Else the original protocols and algorithms lists
6450Sstevel@tonic-gate 			 * remains the same.
6460Sstevel@tonic-gate 			 */
6470Sstevel@tonic-gate 			trash = NULL;
6480Sstevel@tonic-gate 		}
649132Srobinson 		(void) rw_unlock(&proto_rw);
6500Sstevel@tonic-gate 		_clean_trash(trash, trash_num);
6510Sstevel@tonic-gate 	} else {
6520Sstevel@tonic-gate 		/*
6530Sstevel@tonic-gate 		 * Assume caller has done the appropriate locking,
6540Sstevel@tonic-gate 		 * cleanup, etc.  And if new_protos is NULL, it's the caller's
6550Sstevel@tonic-gate 		 * problem.
6560Sstevel@tonic-gate 		 */
6570Sstevel@tonic-gate 		*alg_context = new_protos;
6580Sstevel@tonic-gate 		*alg_nums = rc;
6590Sstevel@tonic-gate 	}
6600Sstevel@tonic-gate 
6610Sstevel@tonic-gate }
6620Sstevel@tonic-gate 
6630Sstevel@tonic-gate /*
6640Sstevel@tonic-gate  * Assume input is 0-terminated.
6650Sstevel@tonic-gate  */
6660Sstevel@tonic-gate static int *
duplicate_intarr(int * orig)6670Sstevel@tonic-gate duplicate_intarr(int *orig)
6680Sstevel@tonic-gate {
6690Sstevel@tonic-gate 	size_t allocsize = sizeof (int);
6700Sstevel@tonic-gate 	int *iwalker = orig;
6710Sstevel@tonic-gate 
6720Sstevel@tonic-gate 	if (orig == NULL)
6730Sstevel@tonic-gate 		return (NULL);
6740Sstevel@tonic-gate 
6750Sstevel@tonic-gate 	while (*iwalker != 0) {
6760Sstevel@tonic-gate 		allocsize += sizeof (int);
6770Sstevel@tonic-gate 		iwalker++;
6780Sstevel@tonic-gate 	}
6790Sstevel@tonic-gate 
6800Sstevel@tonic-gate 	iwalker = malloc(allocsize);
6810Sstevel@tonic-gate 	if (iwalker != NULL)
682132Srobinson 		(void) memcpy(iwalker, orig, allocsize);
6830Sstevel@tonic-gate 
6840Sstevel@tonic-gate 	return (iwalker);
6850Sstevel@tonic-gate }
6860Sstevel@tonic-gate 
6870Sstevel@tonic-gate /*
6880Sstevel@tonic-gate  * Assume input is NULL terminated.
6890Sstevel@tonic-gate  */
6900Sstevel@tonic-gate static char **
duplicate_strarr(char ** orig)6910Sstevel@tonic-gate duplicate_strarr(char **orig)
6920Sstevel@tonic-gate {
6930Sstevel@tonic-gate 	int i;
6940Sstevel@tonic-gate 	char **swalker;
6950Sstevel@tonic-gate 	char **newbie;
6960Sstevel@tonic-gate 
6970Sstevel@tonic-gate 	if (orig == NULL)
6980Sstevel@tonic-gate 		return (NULL);
6990Sstevel@tonic-gate 
7000Sstevel@tonic-gate 	/* count number of elements in source array */
7014979Sdm199272 	for (swalker = orig; *swalker != NULL; swalker++)
7024979Sdm199272 		;
7030Sstevel@tonic-gate 
7040Sstevel@tonic-gate 	/* use calloc() to get NULL-initialization */
7050Sstevel@tonic-gate 	newbie = calloc(swalker - orig + 1, sizeof (char *));
7060Sstevel@tonic-gate 
7070Sstevel@tonic-gate 	if (newbie != NULL) {
7080Sstevel@tonic-gate 		/* do the copy */
7090Sstevel@tonic-gate 		for (i = 0; orig[i] != NULL; i++) {
7100Sstevel@tonic-gate 			newbie[i] = strdup(orig[i]);
7110Sstevel@tonic-gate 			if (newbie[i] == NULL) {
7120Sstevel@tonic-gate 				for (swalker = newbie; *swalker != NULL;
7130Sstevel@tonic-gate 				    swalker++)
7140Sstevel@tonic-gate 					free(*swalker);
7150Sstevel@tonic-gate 				free(newbie);
7160Sstevel@tonic-gate 				return (NULL);
7170Sstevel@tonic-gate 			}
7180Sstevel@tonic-gate 		}
7190Sstevel@tonic-gate 	}
7200Sstevel@tonic-gate 
7210Sstevel@tonic-gate 	return (newbie);
7220Sstevel@tonic-gate }
7230Sstevel@tonic-gate 
7240Sstevel@tonic-gate struct ipsecalgent *
_duplicate_alg(struct ipsecalgent * orig)7250Sstevel@tonic-gate _duplicate_alg(struct ipsecalgent *orig)
7260Sstevel@tonic-gate {
7270Sstevel@tonic-gate 	struct ipsecalgent *rc;
7280Sstevel@tonic-gate 
7290Sstevel@tonic-gate 	/* use calloc() to get NULL-initialization. */
7300Sstevel@tonic-gate 	rc = calloc(1, sizeof (struct ipsecalgent));
7310Sstevel@tonic-gate 	if (rc == NULL)
7320Sstevel@tonic-gate 		return (NULL);
7330Sstevel@tonic-gate 
7340Sstevel@tonic-gate 	rc->a_proto_num = orig->a_proto_num;
7350Sstevel@tonic-gate 	rc->a_alg_num = orig->a_alg_num;
7360Sstevel@tonic-gate 	rc->a_key_increment = orig->a_key_increment;
7370Sstevel@tonic-gate 	rc->a_mech_name = strdup(orig->a_mech_name);
738*10824SMark.Fenwick@Sun.COM 	rc->a_alg_flags = orig->a_alg_flags;
7390Sstevel@tonic-gate 	rc->a_block_sizes = duplicate_intarr(orig->a_block_sizes);
740*10824SMark.Fenwick@Sun.COM 	rc->a_mech_params = duplicate_intarr(orig->a_mech_params);
7410Sstevel@tonic-gate 	rc->a_key_sizes = duplicate_intarr(orig->a_key_sizes);
7420Sstevel@tonic-gate 	rc->a_names = duplicate_strarr(orig->a_names);
7430Sstevel@tonic-gate 
7440Sstevel@tonic-gate 	if (rc->a_mech_name == NULL || rc->a_block_sizes == NULL ||
745*10824SMark.Fenwick@Sun.COM 	    rc->a_key_sizes == NULL || rc->a_names == NULL ||
746*10824SMark.Fenwick@Sun.COM 	    rc->a_mech_params == NULL) {
7470Sstevel@tonic-gate 		freeipsecalgent(rc);
7480Sstevel@tonic-gate 		return (NULL);
7490Sstevel@tonic-gate 	}
7500Sstevel@tonic-gate 
7510Sstevel@tonic-gate 	return (rc);
7520Sstevel@tonic-gate }
7530Sstevel@tonic-gate 
7540Sstevel@tonic-gate /*
7550Sstevel@tonic-gate  * Assume the rwlock is held for reading.
7560Sstevel@tonic-gate  */
7570Sstevel@tonic-gate static ipsec_proto_t *
findprotobynum(int proto_num)7580Sstevel@tonic-gate findprotobynum(int proto_num)
7590Sstevel@tonic-gate {
7600Sstevel@tonic-gate 	int i;
7610Sstevel@tonic-gate 
7620Sstevel@tonic-gate 	for (i = 0; i < num_protos; i++) {
7630Sstevel@tonic-gate 		if (protos[i].proto_num == proto_num)
7640Sstevel@tonic-gate 			return (protos + i);
7650Sstevel@tonic-gate 	}
7660Sstevel@tonic-gate 
7670Sstevel@tonic-gate 	return (NULL);
7680Sstevel@tonic-gate }
7690Sstevel@tonic-gate 
7700Sstevel@tonic-gate static ipsec_proto_t *
findprotobyname(const char * name)7710Sstevel@tonic-gate findprotobyname(const char *name)
7720Sstevel@tonic-gate {
7730Sstevel@tonic-gate 	int i;
7740Sstevel@tonic-gate 
7750Sstevel@tonic-gate 	if (name == NULL)
7760Sstevel@tonic-gate 		return (NULL);
7770Sstevel@tonic-gate 
7780Sstevel@tonic-gate 	for (i = 0; i < num_protos; i++) {
7790Sstevel@tonic-gate 		/* Can use strcasecmp because our proto_name is bounded. */
7800Sstevel@tonic-gate 		if (strcasecmp(protos[i].proto_name, name) == 0)
7810Sstevel@tonic-gate 			return (protos + i);
7820Sstevel@tonic-gate 	}
7830Sstevel@tonic-gate 
7840Sstevel@tonic-gate 	return (NULL);
7850Sstevel@tonic-gate }
7860Sstevel@tonic-gate 
7870Sstevel@tonic-gate int *
_real_getipsecprotos(int * nentries)7880Sstevel@tonic-gate _real_getipsecprotos(int *nentries)
7890Sstevel@tonic-gate {
7900Sstevel@tonic-gate 	int *rc, i;
7910Sstevel@tonic-gate 
7920Sstevel@tonic-gate 	if (nentries == NULL)
7930Sstevel@tonic-gate 		return (NULL);
7940Sstevel@tonic-gate 
7950Sstevel@tonic-gate 	_build_internal_algs(NULL, NULL);
7960Sstevel@tonic-gate 
797132Srobinson 	(void) rw_rdlock(&proto_rw);
7980Sstevel@tonic-gate 	*nentries = num_protos;
7990Sstevel@tonic-gate 	/*
8000Sstevel@tonic-gate 	 * Allocate 1 byte if there are no protocols so a non-NULL return
8010Sstevel@tonic-gate 	 * happens.
8020Sstevel@tonic-gate 	 */
8030Sstevel@tonic-gate 	rc = malloc((num_protos == 0) ? 1 : num_protos * sizeof (int));
8040Sstevel@tonic-gate 	if (rc != NULL) {
8050Sstevel@tonic-gate 		for (i = 0; i < num_protos; i++)
8060Sstevel@tonic-gate 			rc[i] = protos[i].proto_num;
8070Sstevel@tonic-gate 	}
808132Srobinson 	(void) rw_unlock(&proto_rw);
8090Sstevel@tonic-gate 	return (rc);
8100Sstevel@tonic-gate }
8110Sstevel@tonic-gate 
8120Sstevel@tonic-gate int *
_real_getipsecalgs(int * nentries,int proto_num)8130Sstevel@tonic-gate _real_getipsecalgs(int *nentries, int proto_num)
8140Sstevel@tonic-gate {
8150Sstevel@tonic-gate 	int *rc = NULL, i;
8160Sstevel@tonic-gate 	ipsec_proto_t *proto;
8170Sstevel@tonic-gate 
8180Sstevel@tonic-gate 	if (nentries == NULL)
8190Sstevel@tonic-gate 		return (NULL);
8200Sstevel@tonic-gate 
8210Sstevel@tonic-gate 	_build_internal_algs(NULL, NULL);
8220Sstevel@tonic-gate 
823132Srobinson 	(void) rw_rdlock(&proto_rw);
8240Sstevel@tonic-gate 	proto = findprotobynum(proto_num);
8250Sstevel@tonic-gate 	if (proto != NULL) {
8260Sstevel@tonic-gate 		*nentries = proto->proto_numalgs;
8270Sstevel@tonic-gate 		/*
8280Sstevel@tonic-gate 		 * Allocate 1 byte if there are no algorithms so a non-NULL
8290Sstevel@tonic-gate 		 * return happens.
8300Sstevel@tonic-gate 		 */
8310Sstevel@tonic-gate 		rc = malloc((proto->proto_numalgs == 0) ? 1 :
8320Sstevel@tonic-gate 		    proto->proto_numalgs * sizeof (int));
8330Sstevel@tonic-gate 		if (rc != NULL) {
8340Sstevel@tonic-gate 			for (i = 0; i < proto->proto_numalgs; i++)
8350Sstevel@tonic-gate 				rc[i] = proto->proto_algs[i]->a_alg_num;
8360Sstevel@tonic-gate 		}
8370Sstevel@tonic-gate 	}
838132Srobinson 	(void) rw_unlock(&proto_rw);
8390Sstevel@tonic-gate 	return (rc);
8400Sstevel@tonic-gate }
8410Sstevel@tonic-gate 
8420Sstevel@tonic-gate struct ipsecalgent *
getipsecalgbyname(const char * name,int proto_num,int * errnop)8430Sstevel@tonic-gate getipsecalgbyname(const char *name, int proto_num, int *errnop)
8440Sstevel@tonic-gate {
8450Sstevel@tonic-gate 	ipsec_proto_t *proto;
8460Sstevel@tonic-gate 	struct ipsecalgent *rc = NULL;
8470Sstevel@tonic-gate 	int i, my_errno = ENOENT;
8480Sstevel@tonic-gate 	char **name_check;
8490Sstevel@tonic-gate 
8500Sstevel@tonic-gate 	_build_internal_algs(NULL, NULL);
8510Sstevel@tonic-gate 	if (name == NULL) {
8520Sstevel@tonic-gate 		my_errno = EFAULT;
8530Sstevel@tonic-gate 		goto bail;
8540Sstevel@tonic-gate 	}
8550Sstevel@tonic-gate 
856132Srobinson 	(void) rw_rdlock(&proto_rw);
8570Sstevel@tonic-gate 	proto = findprotobynum(proto_num);
8580Sstevel@tonic-gate 	if (proto != NULL) {
8590Sstevel@tonic-gate 		for (i = 0; i < proto->proto_numalgs; i++) {
8600Sstevel@tonic-gate 			for (name_check = proto->proto_algs[i]->a_names;
8610Sstevel@tonic-gate 			    *name_check != NULL; name_check++) {
8620Sstevel@tonic-gate 				/*
8630Sstevel@tonic-gate 				 * Can use strcasecmp because our name_check
8640Sstevel@tonic-gate 				 * is bounded.
8650Sstevel@tonic-gate 				 */
8660Sstevel@tonic-gate 				if (strcasecmp(*name_check, name) == 0) {
8670Sstevel@tonic-gate 					/* found match */
8680Sstevel@tonic-gate 					rc = _duplicate_alg(
8690Sstevel@tonic-gate 					    proto->proto_algs[i]);
8700Sstevel@tonic-gate 					my_errno = (rc == NULL) ? ENOMEM : 0;
871132Srobinson 					(void) rw_unlock(&proto_rw);
8720Sstevel@tonic-gate 					goto bail;
8730Sstevel@tonic-gate 				}
8740Sstevel@tonic-gate 			}
8750Sstevel@tonic-gate 		}
8760Sstevel@tonic-gate 	} else {
8770Sstevel@tonic-gate 		my_errno = EINVAL;
8780Sstevel@tonic-gate 	}
8790Sstevel@tonic-gate 
880132Srobinson 	(void) rw_unlock(&proto_rw);
8810Sstevel@tonic-gate bail:
8820Sstevel@tonic-gate 	if (errnop != NULL)
8830Sstevel@tonic-gate 		*errnop = my_errno;
8840Sstevel@tonic-gate 	return (rc);
8850Sstevel@tonic-gate }
8860Sstevel@tonic-gate 
8870Sstevel@tonic-gate struct ipsecalgent *
getipsecalgbynum(int alg_num,int proto_num,int * errnop)8880Sstevel@tonic-gate getipsecalgbynum(int alg_num, int proto_num, int *errnop)
8890Sstevel@tonic-gate {
8900Sstevel@tonic-gate 	ipsec_proto_t *proto;
8910Sstevel@tonic-gate 	struct ipsecalgent *rc = NULL;
8920Sstevel@tonic-gate 	int i, my_errno = ENOENT;
8930Sstevel@tonic-gate 
8940Sstevel@tonic-gate 	_build_internal_algs(NULL, NULL);
8950Sstevel@tonic-gate 
896132Srobinson 	(void) rw_rdlock(&proto_rw);
8970Sstevel@tonic-gate 
8980Sstevel@tonic-gate 	proto = findprotobynum(proto_num);
8990Sstevel@tonic-gate 	if (proto != NULL) {
9000Sstevel@tonic-gate 		for (i = 0; i < proto->proto_numalgs; i++) {
9010Sstevel@tonic-gate 			if (proto->proto_algs[i]->a_alg_num == alg_num) {
9020Sstevel@tonic-gate 				rc = _duplicate_alg(proto->proto_algs[i]);
9030Sstevel@tonic-gate 				my_errno = (rc == NULL) ? ENOMEM : 0;
9040Sstevel@tonic-gate 				break;
9050Sstevel@tonic-gate 			}
9060Sstevel@tonic-gate 		}
9070Sstevel@tonic-gate 	} else {
9080Sstevel@tonic-gate 		my_errno = EINVAL;
9090Sstevel@tonic-gate 	}
9100Sstevel@tonic-gate 
911132Srobinson 	(void) rw_unlock(&proto_rw);
9120Sstevel@tonic-gate 	if (errnop != NULL)
9130Sstevel@tonic-gate 		*errnop = my_errno;
9140Sstevel@tonic-gate 	return (rc);
9150Sstevel@tonic-gate }
9160Sstevel@tonic-gate 
9170Sstevel@tonic-gate int
getipsecprotobyname(const char * proto_name)9180Sstevel@tonic-gate getipsecprotobyname(const char *proto_name)
9190Sstevel@tonic-gate {
9200Sstevel@tonic-gate 	int rc = -1;
9210Sstevel@tonic-gate 	ipsec_proto_t *proto;
9220Sstevel@tonic-gate 
9230Sstevel@tonic-gate 	_build_internal_algs(NULL, NULL);
9240Sstevel@tonic-gate 
925132Srobinson 	(void) rw_rdlock(&proto_rw);
9260Sstevel@tonic-gate 	proto = findprotobyname(proto_name);
9270Sstevel@tonic-gate 	if (proto != NULL)
9280Sstevel@tonic-gate 		rc = proto->proto_num;
929132Srobinson 	(void) rw_unlock(&proto_rw);
9300Sstevel@tonic-gate 	return (rc);
9310Sstevel@tonic-gate }
9320Sstevel@tonic-gate 
9330Sstevel@tonic-gate char *
getipsecprotobynum(int proto_num)9340Sstevel@tonic-gate getipsecprotobynum(int proto_num)
9350Sstevel@tonic-gate {
9360Sstevel@tonic-gate 	ipsec_proto_t *proto;
9370Sstevel@tonic-gate 	char *rc = NULL;
9380Sstevel@tonic-gate 
9390Sstevel@tonic-gate 	_build_internal_algs(NULL, NULL);
9400Sstevel@tonic-gate 
941132Srobinson 	(void) rw_rdlock(&proto_rw);
9420Sstevel@tonic-gate 	proto = findprotobynum(proto_num);
9430Sstevel@tonic-gate 	if (proto != NULL)
9440Sstevel@tonic-gate 		rc = strdup(proto->proto_name);
9450Sstevel@tonic-gate 
946132Srobinson 	(void) rw_unlock(&proto_rw);
9470Sstevel@tonic-gate 	return (rc);
9480Sstevel@tonic-gate }
9490Sstevel@tonic-gate 
9500Sstevel@tonic-gate void
freeipsecalgent(struct ipsecalgent * ptr)9510Sstevel@tonic-gate freeipsecalgent(struct ipsecalgent *ptr)
9520Sstevel@tonic-gate {
9530Sstevel@tonic-gate 	char **walker;
9540Sstevel@tonic-gate 
9550Sstevel@tonic-gate 	if (ptr == NULL)
9560Sstevel@tonic-gate 		return;
9570Sstevel@tonic-gate 
9580Sstevel@tonic-gate 	if (ptr->a_names != NULL) {
9590Sstevel@tonic-gate 		for (walker = ptr->a_names; *walker != NULL; walker++)
9600Sstevel@tonic-gate 			free(*walker);
9610Sstevel@tonic-gate 	}
9620Sstevel@tonic-gate 
9630Sstevel@tonic-gate 	/*
9640Sstevel@tonic-gate 	 * Remember folks, free(NULL) works.
9650Sstevel@tonic-gate 	 */
9660Sstevel@tonic-gate 	free(ptr->a_names);
9670Sstevel@tonic-gate 	free(ptr->a_mech_name);
9680Sstevel@tonic-gate 	free(ptr->a_block_sizes);
969*10824SMark.Fenwick@Sun.COM 	free(ptr->a_mech_params);
9700Sstevel@tonic-gate 	free(ptr->a_key_sizes);
9710Sstevel@tonic-gate 	free(ptr);
9720Sstevel@tonic-gate }
973