/home/build/quick-libreswan-2/lib/libipsecconf/confread.c

Bug Summary

File:	lib/libipsecconf/confread.c
Warning:	line 1086, column 10 Null pointer passed to 1st parameter expecting 'nonnull'
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple x86_64-redhat-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name confread.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fmath-errno -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/home/build/quick-libreswan-2/lib/libipsecconf -resource-dir /usr/lib64/clang/13.0.0 -D TimeZoneOffset=timezone -D PIE -D NSS_IPSEC_PROFILE -D XFRM_LIFETIME_DEFAULT=30 -D USE_IKEv1 -D XFRM_SUPPORT -D USE_XFRM_INTERFACE -D USE_DNSSEC -D DEFAULT_DNSSEC_ROOTKEY_FILE="/var/lib/unbound/root.key" -D HAVE_LABELED_IPSEC -D HAVE_SECCOMP -D LIBCURL -D USE_LINUX_AUDIT -D HAVE_NM -D USE_PAM_AUTH -D USE_3DES -D USE_AES -D USE_CAMELLIA -D USE_CHACHA -D USE_DH31 -D USE_MD5 -D USE_SHA1 -D USE_SHA2 -D USE_PRF_AES_XCBC -D USE_NSS_KDF -D DEFAULT_RUNDIR="/run/pluto" -D IPSEC_CONF="/etc/ipsec.conf" -D IPSEC_CONFDDIR="/etc/ipsec.d" -D IPSEC_NSSDIR="/var/lib/ipsec/nss" -D IPSEC_CONFDIR="/etc" -D IPSEC_EXECDIR="/usr/local/libexec/ipsec" -D IPSEC_SBINDIR="/usr/local/sbin" -D IPSEC_VARDIR="/var" -D POLICYGROUPSDIR="/etc/ipsec.d/policies" -D IPSEC_SECRETS_FILE="/etc/ipsec.secrets" -D FORCE_PR_ASSERT -D USE_FORK=1 -D USE_VFORK=0 -D USE_DAEMON=0 -D USE_PTHREAD_SETSCHEDPRIO=1 -D GCC_LINT -D HAVE_LIBCAP_NG -I . -I ../../OBJ.linux.x86_64/lib/libipsecconf -I ../../include -I /usr/include/nss3 -I /usr/include/nspr4 -D HERE_FILENAME="lib/libipsecconf/confread.c" -internal-isystem /usr/lib64/clang/13.0.0/include -internal-isystem /usr/local/include -internal-isystem /usr/bin/../lib/gcc/x86_64-redhat-linux/11/../../../../x86_64-redhat-linux/include -internal-externc-isystem /include -internal-externc-isystem /usr/include -std=gnu99 -fdebug-compilation-dir=/home/build/quick-libreswan-2/lib/libipsecconf -ferror-limit 19 -stack-protector 3 -fgnuc-version=4.2.1 -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/scan-build-2022-01-01-205714-1273399-1 -x c /home/build/quick-libreswan-2/lib/libipsecconf/confread.c
1/* Libreswan config file parser (confread.c)
* Copyright (C) 2001-2002 Mathieu Lafon - Arkoon Network Security
* Copyright (C) 2004 Xelerance Corporation
* Copyright (C) 2006-2008 Michael Richardson <mcr@xelerance.com>
* Copyright (C) 2007 Ken Bantoft <ken@xelerance.com>
* Copyright (C) 2006-2012 Paul Wouters <paul@xelerance.com>
* Copyright (C) 2010 Michael Smith <msmith@cbnco.com>
* Copyright (C) 2010 Tuomo Soini <tis@foobar.fi>
* Copyright (C) 2012-2019 Paul Wouters <pwouters@redhat.com>
* Copyright (C) 2012 Avesh Agarwal <avagarwa@redhat.com>
* Copyright (C) 2012 Antony Antony <antony@phenome.org>
* Copyright (C) 2013 Florian Weimer <fweimer@redhat.com>
* Copyright (C) 2013 David McCullough <ucdevel@gmail.com>
* Copyright (C) 2013-2019 D. Hugh Redelmeier <hugh@mimosa.com>
* Copyright (C) 2016 Andrew Cagney <cagney@gnu.org>
* Copyright (C) 2017-2018 Vukasin Karadzic <vukasin.karadzic@gmail.com>
* Copyright (C) 2017 Mayank Totale <mtotale@gmail.com>
* Copyright (C) 2020 Yulia Kuzovkova <ukuzovkova@gmail.com>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version.  See <https://www.gnu.org/licenses/gpl2.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
* for more details.
*/

31#include <stdlib.h>
32#include <stdarg.h>
33#include <stdio.h>
34#include <string.h>
35#include <assert.h>
36#include <sys/socket.h>		/* for AF_UNSPEC */

38#include "lswalloc.h"
39#include "ip_address.h"
40#include "ip_info.h"
41#include "hunk.h"		/* for char_is_space() */
42#include "ip_cidr.h"

44#include "ipsecconf/confread.h"
45#include "ipsecconf/starterlog.h"
46#include "ipsecconf/interfaces.h"

48#include "ipsecconf/keywords.h"
49#include "ipsecconf/parser.h"	/* includes parser.tab.h generated by bison; requires keywords.h */

51#include "whack.h" /* for DEFAULT_CTL_SOCKET */
52#include "lswlog.h"
53#ifdef USE_DNSSEC1
54# include <unbound.h>
55# include <arpa/inet.h> /* for inet_ntop */
56# include "dnssec.h"
57#endif /* USE_DNSSEC */

59/**
* Set up hardcoded defaults, from data in programs/pluto/constants.h
*
* @param cfg starter_config struct
* @return void
*/
65static void ipsecconf_default_values(struct starter_config *cfg)
66{
static const struct starter_config empty_starter_config;	/* zero or null everywhere */
*cfg = empty_starter_config;

TAILQ_INIT(&cfg->conns)do { (&cfg->conns)->tqh_first = ((void*)0); (&cfg
->conns)->tqh_last = &(&cfg->conns)->tqh_first
; } while ( 0);

/* ==== config setup ==== */

74# define SOPT(kbf, v)  { cfg->setup.options[kbf] = (v) ; }

SOPT(KBF_LOGTIME, TRUE1);
SOPT(KBF_LOGAPPEND, TRUE1);
SOPT(KBF_LOGIP, TRUE1);
SOPT(KBF_AUDIT_LOG, TRUE1);
SOPT(KBF_UNIQUEIDS, TRUE1);
SOPT(KBF_LISTEN_UDP, TRUE1);
SOPT(KBF_LISTEN_TCP, FALSE0);
SOPT(KBF_DO_DNSSEC, TRUE1);
SOPT(KBF_PERPEERLOG, FALSE0);
SOPT(KBF_IKEBUF, IKE_BUF_AUTO0);
SOPT(KBF_IKE_ERRQUEUE, TRUE1);
SOPT(KBF_NFLOG_ALL, 0); /* disabled per default */
SOPT(KBF_XFRMLIFETIME, XFRM_LIFETIME_DEFAULT30); /* not used by pluto itself */
SOPT(KBF_NHELPERS, -1); /* see also plutomain.c */

SOPT(KBF_KEEPALIVE, 0);                  /* config setup */
SOPT(KBF_DDOS_IKE_THRESHOLD, DEFAULT_IKE_SA_DDOS_THRESHOLD25000);
SOPT(KBF_MAX_HALFOPEN_IKE, DEFAULT_MAXIMUM_HALFOPEN_IKE_SA50000);
SOPT(KBF_SHUNTLIFETIME, PLUTO_SHUNT_LIFE_DURATION_DEFAULT(15 * secs_per_minute));
/* Don't inflict BSI requirements on everyone */
SOPT(KBF_SEEDBITS, 0);
SOPT(KBF_DROP_OPPO_NULL, FALSE0);

99#ifdef HAVE_LABELED_IPSEC1
SOPT(KBF_SECCTX, SECCTX);
101#endif
SOPT(KBF_DDOS_MODE, DDOS_AUTO);

SOPT(KBF_OCSP_CACHE_SIZE, OCSP_DEFAULT_CACHE_SIZE1000);
SOPT(KBF_OCSP_CACHE_MIN, OCSP_DEFAULT_CACHE_MIN_AGE3600);
SOPT(KBF_OCSP_CACHE_MAX, OCSP_DEFAULT_CACHE_MAX_AGE24 * 3600);
SOPT(KBF_OCSP_METHOD, OCSP_METHOD_GET);
SOPT(KBF_OCSP_TIMEOUT, OCSP_DEFAULT_TIMEOUT2);

SOPT(KBF_SECCOMP, SECCOMP_DISABLED); /* will be enabled in the future */

112# undef SOPT

cfg->setup.strings[KSF_PLUTO_DNSSEC_ROOTKEY_FILE] = clone_str(DEFAULT_DNSSEC_ROOTKEY_FILE, "default dnssec rootkey file")(("/var/lib/unbound/root.key") == ((void*)0) ? ((void*)0) : clone_bytes
(("/var/lib/unbound/root.key"), strlen(("/var/lib/unbound/root.key"
)) + 1, ("default dnssec rootkey file")));
cfg->setup.strings[KSF_NSSDIR] = clone_str(IPSEC_NSSDIR, "default ipsec nssdir")(("/var/lib/ipsec/nss") == ((void*)0) ? ((void*)0) : clone_bytes
(("/var/lib/ipsec/nss"), strlen(("/var/lib/ipsec/nss")) + 1, (
"default ipsec nssdir")));
cfg->setup.strings[KSF_SECRETSFILE] = clone_str(IPSEC_SECRETS_FILE, "default ipsec.secrets file")(("/etc/ipsec.secrets") == ((void*)0) ? ((void*)0) : clone_bytes
(("/etc/ipsec.secrets"), strlen(("/etc/ipsec.secrets")) + 1, (
"default ipsec.secrets file")));
cfg->setup.strings[KSF_DUMPDIR] = clone_str(DEFAULT_RUNDIR, "default dumpdir")(("/run/pluto") == ((void*)0) ? ((void*)0) : clone_bytes(("/run/pluto"
), strlen(("/run/pluto")) + 1, ("default dumpdir")));
cfg->setup.strings[KSF_IPSECDIR] = clone_str(IPSEC_CONFDDIR, "default ipsec.d dir")(("/etc/ipsec.d") == ((void*)0) ? ((void*)0) : clone_bytes(("/etc/ipsec.d"
), strlen(("/etc/ipsec.d")) + 1, ("default ipsec.d dir")));

/* ==== end of config setup ==== */

cfg->ctlsocket = clone_str(DEFAULT_CTL_SOCKET, "default control socket")(("/run/pluto" "/pluto.ctl") == ((void*)0) ? ((void*)0) : clone_bytes
(("/run/pluto" "/pluto.ctl"), strlen(("/run/pluto" "/pluto.ctl"
)) + 1, ("default control socket")));

/* ==== conn %default ==== */

struct starter_conn *d = &cfg->conn_default;

128# define DOPT(kbf, v)  { d->options[kbf] = (v); }

DOPT(KNCF_NAT_KEEPALIVE, TRUE1);    /* per conn */
DOPT(KNCF_TYPE, KS_TUNNEL);

DOPT(KNCF_INITIAL_CONTACT, TRUE1);
DOPT(KNCF_CISCO_UNITY, FALSE0);
DOPT(KNCF_NO_ESP_TFC, FALSE0);
DOPT(KNCF_VID_STRONGSWAN, FALSE0);
DOPT(KNCF_SEND_VENDORID, FALSE0);

DOPT(KNCF_REMOTEPEERTYPE, NON_CISCO);

DOPT(KNCF_IKEPAD, TRUE1);

DOPT(KNCF_IKEV1_NATT, NATT_BOTH);
DOPT(KNCF_ENCAPS, yna_auto);

DOPT(KNCF_TCP, IKE_TCP_NO);
DOPT(KNCF_REMOTE_TCPPORT, NAT_IKE_UDP_PORT4500);

/* Network Manager support */
150#ifdef HAVE_NM1
DOPT(KNCF_NMCONFIGURED, FALSE0);
152#endif

DOPT(KNCF_XAUTHBY, XAUTHBY_FILE);
DOPT(KNCF_XAUTHFAIL, XAUTHFAIL_HARD);

DOPT(KNCF_NIC_OFFLOAD, yna_auto);
DOPT(KNCF_IKELIFETIME, IKE_SA_LIFETIME_DEFAULTsecs_per_hour * 8);

DOPT(KNCF_REPLAY_WINDOW, IPSEC_SA_DEFAULT_REPLAY_WINDOW32);

DOPT(KNCF_RETRANSMIT_TIMEOUT, RETRANSMIT_TIMEOUT_DEFAULT60);
DOPT(KNCF_RETRANSMIT_INTERVAL_MS, RETRANSMIT_INTERVAL_DEFAULT_MS500);

DOPT(KNCF_SALIFETIME, IPSEC_SA_LIFETIME_DEFAULTsecs_per_hour * 8);
DOPT(KNCF_REKEYMARGIN, SA_REPLACEMENT_MARGIN_DEFAULT(9 * secs_per_minute));
DOPT(KNCF_REKEYFUZZ, SA_REPLACEMENT_FUZZ_DEFAULT100);

DOPT(KNCF_KEYINGTRIES, SA_REPLACEMENT_RETRIES_DEFAULT0);

DOPT(KNCF_HOSTADDRFAMILY, AF_UNSPEC0);
DOPT(KNCF_CLIENTADDRFAMILY, AF_UNSPEC0);

DOPT(KNCF_AUTO, STARTUP_IGNORE);
DOPT(KNCF_XFRM_IF_ID, UINT32_MAX(4294967295U));

177# undef DOPT

d->ike_version = IKEv2;
d->policy =
POLICY_TUNNEL((lset_t)1 << (POLICY_TUNNEL_IX)) |
POLICY_ECDSA((lset_t)1 << (POLICY_ECDSA_IX)) | POLICY_RSASIG((lset_t)1 << (POLICY_RSASIG_IX)) | POLICY_RSASIG_v1_5((lset_t)1 << (POLICY_RSASIG_v1_5_IX)) | /* authby= */
POLICY_ENCRYPT((lset_t)1 << (POLICY_ENCRYPT_IX)) | POLICY_PFS((lset_t)1 << (POLICY_PFS_IX)) |
POLICY_IKE_FRAG_ALLOW((lset_t)1 << (POLICY_IKE_FRAG_ALLOW_IX)) |      /* ike_frag=yes */
POLICY_ESN_NO((lset_t)1 << (POLICY_ESN_NO_IX));      	     /* esn=no */

d->sighash_policy =
POL_SIGHASH_SHA2_256((lset_t)1 << (POL_SIGHASH_SHA2_256_IX)) | POL_SIGHASH_SHA2_384((lset_t)1 << (POL_SIGHASH_SHA2_384_IX)) | POL_SIGHASH_SHA2_512((lset_t)1 << (POL_SIGHASH_SHA2_512_IX));

d->left.host_family = &ipv4_info;
d->left.addr = ipv4_info.address.any;
d->left.nexttype = KH_NOTSET;
d->left.nexthop = ipv4_info.address.any;

d->right.host_family = &ipv4_info;
d->right.addr = ipv4_info.address.any;
d->right.nexttype = KH_NOTSET;
d->right.nexthop = ipv4_info.address.any;

d->xfrm_if_id = UINT32_MAX(4294967295U);

/* default is NOT to look in DNS */
d->left.key_from_DNS_on_demand = FALSE0;
d->right.key_from_DNS_on_demand = FALSE0;

d->state = STATE_LOADED;

d->left.authby = AUTHBY_UNSET;
d->right.authby = AUTHBY_UNSET;

d->left.updown = clone_str(DEFAULT_UPDOWN, "conn default left updown")(("ipsec _updown") == ((void*)0) ? ((void*)0) : clone_bytes((
"ipsec _updown"), strlen(("ipsec _updown")) + 1, ("conn default left updown"
)));
d->right.updown = clone_str(DEFAULT_UPDOWN, "conn default right updown")(("ipsec _updown") == ((void*)0) ? ((void*)0) : clone_bytes((
"ipsec _updown"), strlen(("ipsec _updown")) + 1, ("conn default right updown"
)));
/* ==== end of conn %default ==== */
214}

216/*
* format error, and append to string of errors
* The messages are separated by newline: not perfect.
*/
220void starter_error_append(starter_errors_t *perrl, const char *fmt, ...)
221{
va_list args;
char tmp_err[512];

va_start(args, fmt)__builtin_va_start(args, fmt);
vsnprintf(tmp_err, sizeof(tmp_err) - 1, fmt, args);
va_end(args)__builtin_va_end(args);

if (perrl->errors == NULL((void*)0)) {
/* first error */
perrl->errors = clone_str(tmp_err, "starter error")((tmp_err) == ((void*)0) ? ((void*)0) : clone_bytes((tmp_err)
, strlen((tmp_err)) + 1, ("starter error")));
} else {
/* subsequent error: append to previous messages */
size_t ol = strlen(perrl->errors);
size_t al = strlen(tmp_err);
char *nerr = alloc_bytes(ol + al + 2, "starter errors");

memcpy(nerr, perrl->errors, ol);
nerr[ol] = '\n';
memcpy(&nerr[ol + 1], tmp_err, al + 1);
pfree(perrl->errors);
perrl->errors = nerr;
}
244}

246#define KW_POLICY_FLAG(val, fl){ if (conn->options_set[val]) conn->policy = (conn->
policy & ~(fl)) | (conn->options[val] ? (fl) : ((lset_t
)0)); } { \
if (conn->options_set[val]) \
	conn->policy = (conn->policy & ~(fl)) | \
		(conn->options[val] ? (fl) : LEMPTY((lset_t)0)); \
}

252#define KW_POLICY_NEGATIVE_FLAG(val, fl){ if (conn->options_set[val]) { conn->policy = (conn->
policy & ~(fl)) | (!conn->options[val] ? (fl) : ((lset_t
)0)); } } { \
if (conn->options_set[val]) { \
	conn->policy = (conn->policy & ~(fl)) | \
		(!conn->options[val] ? (fl) : LEMPTY((lset_t)0)); \
} \
}

259/**
* Create a NULL-terminated array of tokens from a string of whitespace-separated tokens.
*
* @param value string to be broken up at blanks, creating strings for list
* @param n where to place element count (excluding terminating NULL)
* @return tokens_from_string (NULL or pointer to NULL-terminated array of pointers to strings)
*/
266static char **tokens_from_string(const char *value, int *n)
267{
*n = 0;	/* in case of early exit */

if (value14.1
'value' is not equal to NULL
 == NULL((void*)0))
15
←
Taking false branch→
return NULL((void*)0);

/* avoid damaging original string */
char *const val = clone_str(value, "tokens_from_string value")((value) == ((void*)0) ? ((void*)0) : clone_bytes((value), strlen
((value)) + 1, ("tokens_from_string value")));
16
←
'?' condition is false→
if (val == NULL((void*)0))
17
←
Assuming 'val' is not equal to NULL→
18
←
Taking false branch→
return NULL((void*)0);	/* cannot happen -- silence a coverity warning */

char *const end = val + strlen(val);

/* count number of items in string and terminate each with NUL */
int count = 0;
for (char *b = val; b < end; ) {
19
←
Assuming 'b' is < 'end'→
20
←
Loop condition is true.  Entering loop body→
26
←
Assuming 'b' is >= 'end'→
27
←
Loop condition is false. Execution continues on line 292→
char *e;
for (e = b; *e != '\0' && !char_isspace(*e); e++)
21
←
Assuming the condition is true→
22
←
Assuming the condition is true→
23
←
Loop condition is true.  Entering loop body→
24
←
Assuming the condition is false→
	;
*e = '\0';
if (e24.1
'e' is not equal to 'b'
 != b)
25
←
Taking true branch→
	count++;
b = e + 1;
}

*n = count;

if (count27.1
'count' is not equal to 0
 == 0) {
28
←
Taking false branch→
pfree(val);
return NULL((void*)0);
}

char **const nlist = (char **)alloc_bytes((count + 1) * sizeof(char *), "tokens_from_string nlist");

count = 0;
for (char *b = val; b28.1
'b' is < 'end'
 < end; ) {
29
←
Loop condition is true.  Entering loop body→
32
←
Assuming 'b' is >= 'end'→
33
←
Loop condition is false. Execution continues on line 308→
char *e = b + strlen(b);
if (e != b)
30
←
Assuming 'e' is equal to 'b'→
31
←
Taking false branch→
	nlist[count++] = clone_str(b, "tokens_from_string item")((b) == ((void*)0) ? ((void*)0) : clone_bytes((b), strlen((b)
) + 1, ("tokens_from_string item")));
b = e + 1;
}
nlist[count] = NULL((void*)0);
34
←
Storing null pointer value→
pfree(val);
return nlist;
311}

313/**
* Load a parsed config
*
* @param cfg starter_config structure
* @param cfgp config_parsed (ie: valid) struct
* @param perr pointer to store errors in
* @return bool TRUE if unsuccessful
*/
321static bool_Bool load_setup(struct starter_config *cfg,
       const struct config_parsed *cfgp)
323{
bool_Bool err = FALSE0;
const struct kw_list *kw;

for (kw = cfgp->config_setup; kw != NULL((void*)0); kw = kw->next) {
/**
 * the parser already made sure that only config keywords were used,
 * but we double check!
 */
assert(kw->keyword.keydef->validity & kv_config)((void) sizeof ((kw->keyword.keydef->validity & kv_config
) ? 1 : 0), __extension__ ({ if (kw->keyword.keydef->validity
 & kv_config) ; else __assert_fail ("kw->keyword.keydef->validity & kv_config"
, "/home/build/quick-libreswan-2/lib/libipsecconf/confread.c"
, 332, __extension__ __PRETTY_FUNCTION__); }));
unsigned f = kw->keyword.keydef->field;

switch (kw->keyword.keydef->type) {
case kt_string:
case kt_filename:
case kt_dirname:
case kt_loose_enum:
	/* all treated as strings for now */
	assert(f < elemsof(cfg->setup.strings))((void) sizeof ((f < (sizeof(cfg->setup.strings) / sizeof
(*(cfg->setup.strings)))) ? 1 : 0), __extension__ ({ if (f
 < (sizeof(cfg->setup.strings) / sizeof(*(cfg->setup
.strings)))) ; else __assert_fail ("f < elemsof(cfg->setup.strings)"
, "/home/build/quick-libreswan-2/lib/libipsecconf/confread.c"
, 341, __extension__ __PRETTY_FUNCTION__); }));
	pfreeany(cfg->setup.strings[f]){ typeof(cfg->setup.strings[f]) *pp_ = &(cfg->setup
.strings[f]); if (*pp_ != ((void*)0)) { pfree(*pp_); *pp_ = (
(void*)0); } };
	cfg->setup.strings[f] =
		clone_str(kw->string, "kt_loose_enum kw->string")((kw->string) == ((void*)0) ? ((void*)0) : clone_bytes((kw
->string), strlen((kw->string)) + 1, ("kt_loose_enum kw->string"
)));
	cfg->setup.strings_set[f] = TRUE1;
	break;

case kt_list:
case kt_lset:
case kt_bool:
case kt_invertbool:
case kt_enum:
case kt_number:
case kt_time:
case kt_percent:
	/* all treated as a number for now */
	assert(f < elemsof(cfg->setup.options))((void) sizeof ((f < (sizeof(cfg->setup.options) / sizeof
(*(cfg->setup.options)))) ? 1 : 0), __extension__ ({ if (f
 < (sizeof(cfg->setup.options) / sizeof(*(cfg->setup
.options)))) ; else __assert_fail ("f < elemsof(cfg->setup.options)"
, "/home/build/quick-libreswan-2/lib/libipsecconf/confread.c"
, 357, __extension__ __PRETTY_FUNCTION__); }));
	cfg->setup.options[f] = kw->number;
	cfg->setup.options_set[f] = TRUE1;
	break;

case kt_bitstring:
case kt_rsasigkey:
case kt_ipaddr:
case kt_subnet:
case kt_range:
case kt_idtype:
	err = TRUE1;
	break;

case kt_comment:
	break;

case kt_obsolete:
	starter_log(LOG_LEVEL_INFO1,
		    "Warning: ignored obsolete keyword '%s'",
		    kw->keyword.keydef->keyname);
	break;
case kt_obsolete_quiet:
	starter_log(LOG_LEVEL_ERR2,
		    "Warning: ignored obsolete keyword '%s'",
		    kw->keyword.keydef->keyname);
	break;
default:
	/* NEVER HAPPENS */
	break;
}
}

return err;
391}

393/**
* Validate that yes in fact we are one side of the tunnel
*
* The function checks that IP addresses are valid, nexthops are
* present (if needed) as well as policies, and sets the leftID
* from the left= if it isn't set. It sets the conn's sec_label
* into its left/right struct end options
*
* @param conn_st a connection definition
* @param end a connection end
* @param leftright const char * "left" or "right"
* @param perrl pointer to starter_errors_t
* @return bool TRUE if failed
*/

408static bool_Bool validate_end(struct starter_conn *conn_st,
	 struct starter_end *end,
	 const char *leftright,
	 starter_errors_t *perrl,
	 struct logger *logger)
413{
err_t er = NULL((void*)0);
bool_Bool err = FALSE0;

/*
* TODO:
* The address family default should come in either via
* a config setup option, or via gai.conf / RFC3484
* For now, %defaultroute and %any means IPv4 only
*/
const struct ip_info *hostfam = aftoinfo(conn_st->options[KNCF_HOSTADDRFAMILY]);
if (hostfam == NULL((void*)0)) {
const char *ips = end->strings[KNCF_IP];
hostfam = &ipv4_info;
if (ips != NULL((void*)0) &&
    (strchr(ips, ':') != NULL((void*)0) ||
     streq(ips, "%defaultroute6")(strcmp((ips), ("%defaultroute6")) == 0) ||
     streq(ips, "%any6")(strcmp((ips), ("%any6")) == 0))) {
	hostfam = &ipv6_info;
}
}
pexpect(hostfam == &ipv4_info || hostfam == &ipv6_info)({ _Bool assertion__ = hostfam == &ipv4_info || hostfam ==
 &ipv6_info; if (!assertion__) { where_t here_ = ({ static
 const struct where here = { .func = __func__, .file = "lib/libipsecconf/confread.c"
, .line = 434, }; &here; }); const struct logger *logger_
 = &failsafe_logger; llog_pexpect(logger_, here_, "%s", "hostfam == &ipv4_info || hostfam == &ipv6_info"
); } assertion__; }); /* i.e., not NULL */

436#  define ERR_FOUND(...) { starter_error_append(perrl, __VA_ARGS__); err = TRUE1; }

if (!end->options_set[KNCF_IP])
conn_st->state = STATE_INCOMPLETE;

/* validate the KSCF_IP/KNCF_IP */
end->addrtype = end->options[KNCF_IP];
switch (end->addrtype) {
case KH_ANY:
end->addr = hostfam->address.any;
break;

case KH_IFACE:
/* generally, this doesn't show up at this stage */
starter_log(LOG_LEVEL_DEBUG3, "starter: %s is KH_IFACE", leftright);
break;

case KH_IPADDR:
assert(end->strings[KSCF_IP] != NULL)((void) sizeof ((end->strings[KSCF_IP] != ((void*)0)) ? 1 :
 0), __extension__ ({ if (end->strings[KSCF_IP] != ((void*
)0)) ; else __assert_fail ("end->strings[KSCF_IP] != NULL"
, "/home/build/quick-libreswan-2/lib/libipsecconf/confread.c"
, 454, __extension__ __PRETTY_FUNCTION__); }));

if (end->strings[KSCF_IP][0] == '%') {
	pfree(end->iface);
	end->iface = clone_str(end->strings[KSCF_IP] + 1, "KH_IPADDR end->iface")((end->strings[KSCF_IP] + 1) == ((void*)0) ? ((void*)0) : clone_bytes
((end->strings[KSCF_IP] + 1), strlen((end->strings[KSCF_IP
] + 1)) + 1, ("KH_IPADDR end->iface")));
	if (!starter_iface_find(end->iface, hostfam,
			       &end->addr,
			       &end->nexthop))
		conn_st->state = STATE_INVALID;
	/* not numeric, so set the type to the iface type */
	end->addrtype = KH_IFACE;
	break;
}

er = ttoaddress_num(shunk1(end->strings[KNCF_IP]), hostfam, &end->addr);
if (er != NULL((void*)0)) {
	/* not an IP address, so set the type to the string */
	end->addrtype = KH_IPHOSTNAME;
} else {
	hostfam = address_type(&end->addr);
}

if (end->id == NULL((void*)0)) {
	ipstr_buf b;

	end->id = clone_str(ipstr(&end->addr, &b), "end if")((ipstr(&end->addr, &b)) == ((void*)0) ? ((void*)0
) : clone_bytes((ipstr(&end->addr, &b)), strlen((ipstr
(&end->addr, &b))) + 1, ("end if")));
}
break;

case KH_OPPO:
conn_st->policy |= POLICY_OPPORTUNISTIC((lset_t)1 << (POLICY_OPPORTUNISTIC_IX));
break;

case KH_OPPOGROUP:
conn_st->policy |= POLICY_OPPORTUNISTIC((lset_t)1 << (POLICY_OPPORTUNISTIC_IX)) | POLICY_GROUP((lset_t)1 << (POLICY_GROUP_IX));
break;

case KH_GROUP:
conn_st->policy |= POLICY_GROUP((lset_t)1 << (POLICY_GROUP_IX));
break;

case KH_IPHOSTNAME:
/* generally, this doesn't show up at this stage */
starter_log(LOG_LEVEL_DEBUG3,
	    "starter: %s is KH_IPHOSTNAME", leftright);
break;

case KH_DEFAULTROUTE:
starter_log(LOG_LEVEL_DEBUG3,
	    "starter: %s is KH_DEFAULTROUTE", leftright);
break;

case KH_NOTSET:
/* cannot error out here, it might be a partial also= conn */
break;
}

/* now that HOSTFAM has been pined down */
end->host_family = hostfam;

if (end->strings_set[KSCF_VTI_IP]) {
const char *value = end->strings[KSCF_VTI_IP];
err_t oops = numeric_to_cidr(shunk1(value), NULL((void*)0), &end->vti_ip);
if (oops != NULL((void*)0)) {
	ERR_FOUND("bad addr %s%s=%s [%s]",
		  leftright, "vti", value, oops);
}
oops = cidr_specified(end->vti_ip);
if (oops != NULL((void*)0)) {
	ERR_FOUND("bad addr %s%s=%s [%s]",
		  leftright, "vti", value, oops);
}
/* XXX: check type? */
}

/* validate the KSCF_SUBNET */
if (end->strings_set[KSCF_SUBNET]) {
char *value = end->strings[KSCF_SUBNET];

if (end->strings_set[KSCF_ADDRESSPOOL]) {
	ERR_FOUND("cannot specify both %ssubnet= and %saddresspool=", leftright,
		leftright);
}

if (startswith(value, "vhost:")(strncmp(((value)), (("vhost:")), (strlen("vhost:"))) == 0) || startswith(value, "vnet:")(strncmp(((value)), (("vnet:")), (strlen("vnet:"))) == 0)) {
	if (conn_st->ike_version != IKEv1) {
		ERR_FOUND("The vnet: and vhost: keywords are only valid for IKEv1 connections");
	}

	er = NULL((void*)0);
	end->virt = clone_str(value, "validate_end item")((value) == ((void*)0) ? ((void*)0) : clone_bytes((value), strlen
((value)) + 1, ("validate_end item")));
} else {
	end->has_client = TRUE1;
	er = ttosubnet(shunk1(value), AF_UNSPEC0, '0',
		       &end->subnet, logger);
}
if (er != NULL((void*)0))
	ERR_FOUND("bad subnet %ssubnet=%s [%s]", leftright,
		  value, er);
}

/*
* validate the KSCF_NEXTHOP; set nexthop address to
* something consistent, by default
*/
end->nexthop = hostfam->address.any;
if (end->strings_set[KSCF_NEXTHOP]) {
char *value = end->strings[KSCF_NEXTHOP];

if (strcaseeq(value, "%defaultroute")(strcasecmp((value), ("%defaultroute")) == 0)) {
	end->nexttype = KH_DEFAULTROUTE;
} else {
	ip_address nexthop = unset_address;
567#ifdef USE_DNSSEC1
	if (ttoaddress_num(shunk1(value), hostfam, &nexthop) != NULL((void*)0)) {
		starter_log(LOG_LEVEL_DEBUG3,
			    "Calling unbound_resolve() for %snexthop value",
			    leftright);
		if (!unbound_resolve(value, hostfam, &nexthop, logger))
			ERR_FOUND("bad value for %snexthop=%s\n",
				  leftright, value);
	}
576#else
	err_t e = ttoaddress_dns(shunk1(value), hostfam, &nexthop);
	if (e != NULL((void*)0)) {
		ERR_FOUND("bad value for %snexthop=%s [%s]",
			  leftright, value, e);
	}
582#endif
	end->nexthop = nexthop;
	end->nexttype = KH_IPADDR;
}
} else {
end->nexthop = hostfam->address.any;

if (end->addrtype == KH_DEFAULTROUTE) {
	end->nexttype = KH_DEFAULTROUTE;
}
}

/* validate the KSCF_ID */
if (end->strings_set[KSCF_ID]) {
char *value = end->strings[KSCF_ID];

pfreeany(end->id){ typeof(end->id) *pp_ = &(end->id); if (*pp_ != ((
void*)0)) { pfree(*pp_); *pp_ = ((void*)0); } };
end->id = clone_str(value, "end->id")((value) == ((void*)0) ? ((void*)0) : clone_bytes((value), strlen
((value)) + 1, ("end->id")));
/* fixup old ",," in a ID_DER_ASN1_DN to proper backslash comma */
if ((end->id[0] != '@') && (strstr(end->id, ",,") != NULL((void*)0))
	&& strstr(end->id, "=") != NULL((void*)0))
{
	char *cc;
	while ((cc = strstr(end->id, ",,")) != NULL((void*)0)) {
		cc[0] = '\\';
	}
}
}

if (end->options_set[KSCF_RSASIGKEY]) {
end->rsasigkey_type = end->options[KSCF_RSASIGKEY];

switch (end->options[KSCF_RSASIGKEY]) {
case PUBKEY_DNSONDEMAND:
	end->key_from_DNS_on_demand = TRUE1;
	break;

default:
	end->key_from_DNS_on_demand = FALSE0;
	/* validate the KSCF_RSASIGKEY1/RSASIGKEY2 */
	if (end->strings[KSCF_RSASIGKEY] != NULL((void*)0)) {
		char *value = end->strings[KSCF_RSASIGKEY];
		pfreeany(end->rsasigkey){ typeof(end->rsasigkey) *pp_ = &(end->rsasigkey); if
 (*pp_ != ((void*)0)) { pfree(*pp_); *pp_ = ((void*)0); } };
		end->rsasigkey = clone_str(value, "end->rsasigkey")((value) == ((void*)0) ? ((void*)0) : clone_bytes((value), strlen
((value)) + 1, ("end->rsasigkey")));
	}
}
}

/* validate the KSCF_SOURCEIP, if any, and if set,
* set the subnet to same value, if not set.
*/
if (end->strings_set[KSCF_SOURCEIP]) {
char *value = end->strings[KSCF_SOURCEIP];

/*
 * XXX: suspect this lookup should be forced to use
 * the same family as the client.
 */
ip_address sourceip = unset_address;
641#ifdef USE_DNSSEC1
/* try numeric first */
err_t e = ttoaddress_num(shunk1(value), NULL((void*)0)/*UNSPEC*/, &sourceip);
if (e != NULL((void*)0)) {
	starter_log(LOG_LEVEL_DEBUG3,
		    "Calling unbound_resolve() for %ssourceip value",
		    leftright);
	if (!unbound_resolve(value, &ipv4_info, &end->sourceip, logger) &&
	    !unbound_resolve(value, &ipv6_info, &end->sourceip, logger))
		ERR_FOUND("bad value for %ssourceip=%s\n",
			  leftright, value);
}
653#else
/* try numeric then DNS */
err_t e = ttoaddress_dns(shunk1(value), AF_UNSPEC0, &sourceip);
if (e != NULL((void*)0)) {
	ERR_FOUND("bad addr %ssourceip=%s [%s]",
		  leftright, value, e);
}
660#endif
end->sourceip = sourceip;
if (!end->has_client) {
	end->subnet = subnet_from_address(end->sourceip);
	end->has_client = TRUE1;
}
if (end->strings_set[KSCF_INTERFACE_IP]) {
	ERR_FOUND("cannot specify  %sinterface-ip=%s and  %sssourceip=%s",
			leftright,
			end->strings[KSCF_INTERFACE_IP],
			leftright,
			end->strings[KSCF_SOURCEIP]);
}
}

/* copy certificate path name */
if (end->strings_set[KSCF_CERT] && end->strings_set[KSCF_CKAID]) {
ERR_FOUND("only one of %scert and %sckaid can be specified",
	  leftright, leftright);
}
if (end->strings_set[KSCF_CERT]) {
end->certx = clone_str(end->strings[KSCF_CERT], "KSCF_CERT")((end->strings[KSCF_CERT]) == ((void*)0) ? ((void*)0) : clone_bytes
((end->strings[KSCF_CERT]), strlen((end->strings[KSCF_CERT
])) + 1, ("KSCF_CERT")));
}
if (end->strings_set[KSCF_CKAID]) {
const char *ckaid = end->strings[KSCF_CKAID];
/* try parsing it */
const char *ugh = ttodata(ckaid, 0, 16, NULL((void*)0), 0, NULL((void*)0));
if (ugh != NULL((void*)0)) {
	ERR_FOUND("invalid %sckaid: %s", leftright, ugh);
}
end->ckaid = clone_str(ckaid, "KSCF_CKAID")((ckaid) == ((void*)0) ? ((void*)0) : clone_bytes((ckaid), strlen
((ckaid)) + 1, ("KSCF_CKAID")));
}

if (end->strings_set[KSCF_CA])
end->ca = clone_str(end->strings[KSCF_CA], "KSCF_CA")((end->strings[KSCF_CA]) == ((void*)0) ? ((void*)0) : clone_bytes
((end->strings[KSCF_CA]), strlen((end->strings[KSCF_CA]
)) + 1, ("KSCF_CA")));

if (end->strings_set[KSCF_UPDOWN]) {
pfreeany(end->updown){ typeof(end->updown) *pp_ = &(end->updown); if (*pp_
 != ((void*)0)) { pfree(*pp_); *pp_ = ((void*)0); } };
end->updown = clone_str(end->strings[KSCF_UPDOWN], "KSCF_UPDOWN")((end->strings[KSCF_UPDOWN]) == ((void*)0) ? ((void*)0) : clone_bytes
((end->strings[KSCF_UPDOWN]), strlen((end->strings[KSCF_UPDOWN
])) + 1, ("KSCF_UPDOWN")));
}

if (end->strings_set[KSCF_PROTOPORT]) {
char *value = end->strings[KSCF_PROTOPORT];
err_t ugh = ttoprotoport(value, &end->protoport);
if (ugh != NULL((void*)0))
	ERR_FOUND("bad %sprotoport=%s [%s]", leftright, value,
		  ugh);
}

if (end->strings_set[KSCF_ADDRESSPOOL]) {
char *addresspool = end->strings[KSCF_ADDRESSPOOL];

if (end->strings_set[KSCF_SUBNET])
	ERR_FOUND("cannot specify both %ssubnet= and %saddresspool=",
		leftright, leftright);
starter_log(LOG_LEVEL_DEBUG3,
	    "connection's %saddresspool set to: %s",
	    leftright, end->strings[KSCF_ADDRESSPOOL] );

er = ttorange(addresspool, NULL((void*)0), &end->pool_range);
if (er != NULL((void*)0))
	ERR_FOUND("bad %saddresspool=%s [%s]", leftright,
			addresspool, er);

if (range_type(&end->pool_range) == &ipv6_info &&
    !end->pool_range.is_subnet) {
	ERR_FOUND("bad IPv6 %saddresspool=%s not subnet", leftright,
			addresspool);
}
}

if (end->strings_set[KSCF_INTERFACE_IP]) {
const char *value = end->strings[KSCF_INTERFACE_IP];
err_t oops = numeric_to_cidr(shunk1(value), NULL((void*)0), &end->ifaceip);
if (oops != NULL((void*)0)) {
	ERR_FOUND("bad addr %s%s=%s [%s]",
		  leftright, "interface-ip", value, oops);
}
oops = cidr_specified(end->ifaceip);
if (oops != NULL((void*)0)) {
	ERR_FOUND("bad addr %s%s=%s [%s]",
		  leftright, "interface-ip", value, oops);
}
if (end->strings_set[KSCF_SOURCEIP]) {
	ERR_FOUND("cannot specify  %sinterface-ip=%s and  %sssourceip=%s",
			leftright,
			end->strings[KSCF_INTERFACE_IP],
			leftright,
			end->strings[KSCF_SOURCEIP]);
}
}

if (end->options_set[KNCF_XAUTHSERVER] ||
   end->options_set[KNCF_XAUTHCLIENT])
conn_st->policy |= POLICY_XAUTH((lset_t)1 << (POLICY_XAUTH_IX));

return err;
757#  undef ERR_FOUND
758}

760/**
* Take keywords from ipsec.conf syntax and load into a conn struct
*
* @param conn a connection definition
* @param sl a section_list
* @param assigned_value is set to either k_set, or k_default.
*        k_default is used when we are loading a conn that should be
*        considered to be a "default" value, and that replacing this
*        value is considered acceptable.
* @return bool TRUE if unsuccessful
*/
771static bool_Bool translate_conn(struct starter_conn *conn,
    const struct section_list *sl,
    enum keyword_set assigned_value,
    starter_errors_t *perrl)
775{
/* note: not all errors are considered serious */
bool_Bool serious_err = FALSE0;

for (const struct kw_list *kw = sl->kw; kw != NULL((void*)0); kw = kw->next) {
4
←
Assuming 'kw' is equal to NULL→
5
←
Loop condition is false. Execution continues on line 986→
if ((kw->keyword.keydef->validity & kv_conn) == 0) {
	/* this isn't valid in a conn! */
	char tmp_err[512];

	snprintf(tmp_err, sizeof(tmp_err),
		 "keyword '%s' is not valid in a conn (%s)\n",
		 kw->keyword.keydef->keyname, sl->name);
	starter_log(LOG_LEVEL_INFO1, "%s", tmp_err);
	starter_error_append(perrl, "%s", tmp_err);
	continue;
}

ksf *the_strings;
str_set *set_strings;
unsigned str_floor, str_roof;

knf *the_options;
int_set *set_options;
unsigned opt_floor, opt_roof;

if (kw->keyword.keydef->validity & kv_leftright) {
	struct starter_end *this = kw->keyword.keyleft ?
		&conn->left : &conn->right;

	the_strings = &this->strings;
	set_strings = &this->strings_set;
	str_floor = KSCF_last_loose + 1;
	str_roof = KSCF_last_leftright + 1;

	the_options = &this->options;
	set_options = &this->options_set;
	opt_floor = KSCF_last_loose + 1;
	opt_roof = KNCF_last_leftright + 1;
} else {
	the_strings = &conn->strings;
	set_strings = &conn->strings_set;
	str_floor = KSCF_last_leftright + 1;
	str_roof = KSCF_ROOF;

	the_options = &conn->options;
	set_options = &conn->options_set;
	opt_floor = KNCF_last_leftright + 1;
	opt_roof = KNCF_ROOF;
}

unsigned int field = kw->keyword.keydef->field;

assert(kw->keyword.keydef != NULL)((void) sizeof ((kw->keyword.keydef != ((void*)0)) ? 1 : 0
), __extension__ ({ if (kw->keyword.keydef != ((void*)0)) ;
 else __assert_fail ("kw->keyword.keydef != NULL", "/home/build/quick-libreswan-2/lib/libipsecconf/confread.c"
, 827, __extension__ __PRETTY_FUNCTION__); }));

switch (kw->keyword.keydef->type) {
case kt_string:
case kt_filename:
case kt_dirname:
case kt_bitstring:
case kt_ipaddr:
case kt_range:
case kt_subnet:
case kt_idtype:
	/* all treated as strings for now, even loose enums */
	assert(field < str_roof)((void) sizeof ((field < str_roof) ? 1 : 0), __extension__
 ({ if (field < str_roof) ; else __assert_fail ("field < str_roof"
, "/home/build/quick-libreswan-2/lib/libipsecconf/confread.c"
, 839, __extension__ __PRETTY_FUNCTION__); }));

	if ((*set_strings)[field] == k_set) {
		char tmp_err[512];

		snprintf(tmp_err, sizeof(tmp_err),
			 "duplicate key '%s' in conn %s while processing def %s",
			 kw->keyword.keydef->keyname,
			 conn->name,
			 sl->name);

		starter_log(LOG_LEVEL_INFO1, "%s", tmp_err);
		starter_error_append(perrl, "%s", tmp_err);

		/* only fatal if we try to change values */
		if (kw->keyword.string == NULL((void*)0) ||
		    (*the_strings)[field] == NULL((void*)0) ||
		    !streq(kw->keyword.string,(strcmp((kw->keyword.string), ((*the_strings)[field])) == 0
)
			   (*the_strings)[field])(strcmp((kw->keyword.string), ((*the_strings)[field])) == 0
))
		{
			serious_err = TRUE1;
			break;
		}
	}
	pfreeany((*the_strings)[field]){ typeof((*the_strings)[field]) *pp_ = &((*the_strings)[field
]); if (*pp_ != ((void*)0)) { pfree(*pp_); *pp_ = ((void*)0);
 } };

	if (kw->string == NULL((void*)0)) {
		starter_error_append(perrl, "Invalid %s value",
			 kw->keyword.keydef->keyname);
		serious_err = TRUE1;
		break;
	}

	(*the_strings)[field] = clone_str(kw->string, "kt_idtype kw->string")((kw->string) == ((void*)0) ? ((void*)0) : clone_bytes((kw
->string), strlen((kw->string)) + 1, ("kt_idtype kw->string"
)));
	(*set_strings)[field] = assigned_value;
	break;

case kt_appendstring:
case kt_appendlist:
	/* implicitly, this field can have multiple values */
	assert(str_floor <= field && field < str_roof)((void) sizeof ((str_floor <= field && field < str_roof
) ? 1 : 0), __extension__ ({ if (str_floor <= field &&
 field < str_roof) ; else __assert_fail ("str_floor <= field && field < str_roof"
, "/home/build/quick-libreswan-2/lib/libipsecconf/confread.c"
, 879, __extension__ __PRETTY_FUNCTION__); }));
	if ((*the_strings)[field] == NULL((void*)0)) {
		(*the_strings)[field] = clone_str(kw->string, "kt_appendlist kw->string")((kw->string) == ((void*)0) ? ((void*)0) : clone_bytes((kw
->string), strlen((kw->string)) + 1, ("kt_appendlist kw->string"
)));
	} else {
		char *s = (*the_strings)[field];
		size_t old_len = strlen(s);	/* excludes '\0' */
		size_t new_len = strlen(kw->string);
		char *n = alloc_bytes(old_len + 1 + new_len + 1, "kt_appendlist");

		memcpy(n, s, old_len);
		n[old_len] = ' ';
		memcpy(n + old_len + 1, kw->string, new_len + 1);	/* includes '\0' */
		(*the_strings)[field] = n;
		pfree(s);
	}
	(*set_strings)[field] = TRUE1;
	break;

case kt_rsasigkey:
case kt_loose_enum:
	assert(field <= KSCF_last_loose)((void) sizeof ((field <= KSCF_last_loose) ? 1 : 0), __extension__
 ({ if (field <= KSCF_last_loose) ; else __assert_fail ("field <= KSCF_last_loose"
, "/home/build/quick-libreswan-2/lib/libipsecconf/confread.c"
, 899, __extension__ __PRETTY_FUNCTION__); }));

	if ((*set_options)[field] == k_set) {
		char tmp_err[512];

		snprintf(tmp_err, sizeof(tmp_err),
			 "duplicate key '%s' in conn %s while processing def %s",
			 kw->keyword.keydef->keyname,
			 conn->name,
			 sl->name);

		starter_log(LOG_LEVEL_INFO1, "%s", tmp_err);
		starter_error_append(perrl, "%s", tmp_err);

		/* only fatal if we try to change values */
		if ((*the_options)[field] != (int)kw->number ||
		    !((*the_options)[field] ==
			LOOSE_ENUM_OTHER255 &&
		      kw->number == LOOSE_ENUM_OTHER255 &&
		      kw->keyword.string != NULL((void*)0) &&
		      (*the_strings)[field] != NULL((void*)0) &&
		      streq(kw->keyword.string,(strcmp((kw->keyword.string), ((*the_strings)[field])) == 0
)
			     (*the_strings)[field])(strcmp((kw->keyword.string), ((*the_strings)[field])) == 0
)))
		{
			serious_err = TRUE1;
			break;
		}
	}

	(*the_options)[field] = kw->number;
	if (kw->number == LOOSE_ENUM_OTHER255) {
		assert(kw->keyword.string != NULL)((void) sizeof ((kw->keyword.string != ((void*)0)) ? 1 : 0
), __extension__ ({ if (kw->keyword.string != ((void*)0)) ;
 else __assert_fail ("kw->keyword.string != NULL", "/home/build/quick-libreswan-2/lib/libipsecconf/confread.c"
, 930, __extension__ __PRETTY_FUNCTION__); }));
		pfreeany((*the_strings)[field]){ typeof((*the_strings)[field]) *pp_ = &((*the_strings)[field
]); if (*pp_ != ((void*)0)) { pfree(*pp_); *pp_ = ((void*)0);
 } };
		(*the_strings)[field] = clone_str(((kw->keyword.string) == ((void*)0) ? ((void*)0) : clone_bytes
((kw->keyword.string), strlen((kw->keyword.string)) + 1
, ("kt_loose_enum kw->keyword.string")))
			kw->keyword.string, "kt_loose_enum kw->keyword.string")((kw->keyword.string) == ((void*)0) ? ((void*)0) : clone_bytes
((kw->keyword.string), strlen((kw->keyword.string)) + 1
, ("kt_loose_enum kw->keyword.string")));
	}
	(*set_options)[field] = assigned_value;
	break;

case kt_list:
case kt_lset:
case kt_bool:
case kt_invertbool:
case kt_enum:
case kt_number:
case kt_time:
case kt_percent:
	/* all treated as a number for now */
	assert(opt_floor <= field && field < opt_roof)((void) sizeof ((opt_floor <= field && field < opt_roof
) ? 1 : 0), __extension__ ({ if (opt_floor <= field &&
 field < opt_roof) ; else __assert_fail ("opt_floor <= field && field < opt_roof"
, "/home/build/quick-libreswan-2/lib/libipsecconf/confread.c"
, 947, __extension__ __PRETTY_FUNCTION__); }));

	if ((*set_options)[field] == k_set) {
		char tmp_err[512];

		snprintf(tmp_err, sizeof(tmp_err),
			 "duplicate key '%s' in conn %s while processing def %s",
			 kw->keyword.keydef->keyname,
			 conn->name,
			 sl->name);
		starter_log(LOG_LEVEL_INFO1, "%s", tmp_err);
		starter_error_append(perrl, "%s", tmp_err);
		/* only fatal if we try to change values */
		if ((*the_options)[field] != (int)kw->number) {
			serious_err = TRUE1;
			break;
		}
	}

	(*the_options)[field] = kw->number;
	(*set_options)[field] = assigned_value;
	break;

case kt_comment:
	break;

case kt_obsolete:
	starter_log(LOG_LEVEL_INFO1,
		    "Warning: obsolete keyword '%s' ignored",
		    kw->keyword.keydef->keyname);
	break;

case kt_obsolete_quiet:
	starter_log(LOG_LEVEL_ERR2,
		    "Warning: obsolete keyword '%s' ignored",
		    kw->keyword.keydef->keyname);
	break;
}
}
return serious_err;
6
←
Returning zero (loaded from 'serious_err'), which participates in a condition later→
987}

989static void move_comment_list(struct starter_comments_list *to,
       struct starter_comments_list *from)
991{
struct starter_comments *sc, *scnext;

for (sc = from->tqh_first;
    sc != NULL((void*)0);
    sc = scnext) {
scnext = sc->link.tqe_next;
TAILQ_REMOVE(from, sc, link)do { if (((sc)->link.tqe_next) != ((void*)0)) (sc)->link
.tqe_next->link.tqe_prev = (sc)->link.tqe_prev; else (from
)->tqh_last = (sc)->link.tqe_prev; *(sc)->link.tqe_prev
 = (sc)->link.tqe_next; } while ( 0);
TAILQ_INSERT_TAIL(to, sc, link)do { (sc)->link.tqe_next = ((void*)0); (sc)->link.tqe_prev
 = (to)->tqh_last; *(to)->tqh_last = (sc); (to)->tqh_last
 = &(sc)->link.tqe_next; } while ( 0);
}
1001}

1003static bool_Bool load_conn(struct starter_conn *conn,
      const struct config_parsed *cfgp,
      struct section_list *sl,
      bool_Bool alsoprocessing,
      bool_Bool defaultconn,
      starter_errors_t *perrl,
      struct logger *logger)
1010{
bool_Bool err;

/* turn all of the keyword/value pairs into options/strings in left/right */
err = translate_conn(conn, sl,
3
←
Calling 'translate_conn'→
7
←
Returning from 'translate_conn'→
	defaultconn ? k_default : k_set,
1
Assuming 'defaultconn' is false→
2
←
'?' condition is false→
	perrl);

move_comment_list(&conn->comments, &sl->comments);

if (err7.1
'err' is false
)
8
←
Taking false branch→
return err;

if (conn->strings[KSCF_ALSO] != NULL((void*)0) &&
9
←
Assuming the condition is true→
11
←
Taking false branch→
   !alsoprocessing) {
10
←
Assuming 'alsoprocessing' is true→
starter_log(LOG_LEVEL_INFO1,
	    "also= is not valid in section '%s'",
	    sl->name);
starter_error_append(perrl, "also= is not valid in section '%s'",
	sl->name);
return TRUE1;	/* error */
}

/*
* Process the also list
*
* Note: conn->alsos will be NULL until we finish
* and the appropriate list will be in local variable alsos.
*/

/* free any residual alsos list */
if (conn->alsos != NULL((void*)0)) {
12
←
Assuming field 'alsos' is equal to NULL→
13
←
Taking false branch→
for (char **s = conn->alsos; *s != NULL((void*)0); s++)
	pfreeany(*s){ typeof(*s) *pp_ = &(*s); if (*pp_ != ((void*)0)) { pfree
(*pp_); *pp_ = ((void*)0); } };
pfree(conn->alsos);
conn->alsos = NULL((void*)0);
}

int alsosize;
char **alsos = tokens_from_string(conn->strings[KSCF_ALSO], &alsosize);
14
←
Calling 'tokens_from_string'→
35
←
Returning from 'tokens_from_string'→

if (alsoprocessing35.1
'alsoprocessing' is true
 && alsos35.2
'alsos' is not equal to NULL
 != NULL((void*)0)) {
36
←
Taking true branch→
/* reset all of the "beenhere" flags */
for (struct section_list *s = cfgp->sections.tqh_first; s != NULL((void*)0);
37
←
Assuming 's' is not equal to NULL→
38
←
Loop condition is true.  Entering loop body→
39
←
Assuming 's' is equal to NULL→
40
←
Loop condition is false. Execution continues on line 1056→
     s = s->link.tqe_next)
	s->beenhere = FALSE0;
sl->beenhere = TRUE1;

for (int alsoplace = 0; alsoplace < alsosize; alsoplace++) {
41
←
'alsoplace' initialized to 0→
42
←
Loop condition is true.  Entering loop body→
	/*
	 * Check for too many alsos.
	 * Inside the loop because of indirect alsos.
	 */
	if (alsosize42.1
'alsosize' is < ALSO_LIMIT
 >= ALSO_LIMIT32) {
43
←
Taking false branch→
		starter_log(LOG_LEVEL_INFO1,
			    "while loading conn '%s', too many also= used at section %s. Limit is %d",
			    conn->name,
			    alsos[alsosize],
			    ALSO_LIMIT32);
		starter_error_append(perrl, "while loading conn '%s', too many also= used at section %s. Limit is %d",
			conn->name,
			alsos[alsosize],
			ALSO_LIMIT32);
		return TRUE1;	/* error */
	}

	/*
	 * for each also= listed, go find this section's keyword list, and
	 * load it as well. This may extend the also= list (and the end),
	 * which we handle by zeroing the also list, and adding to it after
	 * checking for duplicates.
	 */
	struct section_list *addin;

	for (addin = cfgp->sections.tqh_first;
	     addin43.1
'addin' is not equal to NULL
 != NULL((void*)0) &&
	     !streq(alsos[alsoplace], addin->name)(strcmp((alsos[alsoplace]), (addin->name)) == 0);
44
←
Null pointer passed to 1st parameter expecting 'nonnull'
	     addin = addin->link.tqe_next)
		;

	if (addin == NULL((void*)0)) {
		starter_log(LOG_LEVEL_ERR2,
			    "cannot find conn '%s' needed by conn '%s'",
			    alsos[alsoplace], conn->name);
		starter_error_append(perrl, "cannot find conn '%s' needed by conn '%s'",
			alsos[alsoplace], conn->name);
		err = TRUE1;
		continue;	/* allowing further error detection */
	}

	if (addin->beenhere)
		continue;	/* already handled */

	starter_log(LOG_LEVEL_DEBUG3,
		    "\twhile loading conn '%s' also including '%s'",
		    conn->name, alsos[alsoplace]);

	conn->strings_set[KSCF_ALSO] = FALSE0;
	pfreeany(conn->strings[KSCF_ALSO]){ typeof(conn->strings[KSCF_ALSO]) *pp_ = &(conn->strings
[KSCF_ALSO]); if (*pp_ != ((void*)0)) { pfree(*pp_); *pp_ = (
(void*)0); } };
	conn->strings[KSCF_ALSO] = NULL((void*)0);
	addin->beenhere = TRUE1;

	/* translate things, but do not replace earlier settings! */
	err |= translate_conn(conn, addin, k_set, perrl);

	if (conn->strings[KSCF_ALSO] != NULL((void*)0)) {
		/* add this guy's alsos too */
		int newalsosize;
		char **newalsos = tokens_from_string(
			conn->strings[KSCF_ALSO], &newalsosize);

		if (newalsos != NULL((void*)0)) {
			/*
			 * Append newalsos onto alsos.
			 * Requires a re-allocation.
			 * Copying is shallow: the lists
			 * are copied and freed but
			 * the underlying strings are unchanged.
			 */
			char **ra = alloc_bytes((alsosize +
				newalsosize + 1) *
				sizeof(char *),
				"conn->alsos");
			memcpy(ra, alsos, alsosize * sizeof(char *));
			pfree(alsos);
			alsos = ra;

			memcpy(ra + alsosize, newalsos,
				(newalsosize + 1) * sizeof(char *));
			pfree(newalsos);

			alsosize += newalsosize;
		}
	}
}
}

/*
* Migrate alsos back to conn->alsos.
* Note that this is the transitive closure.
*/
conn->alsos = alsos;

if (conn->options_set[KNCF_TYPE]) {
switch ((enum keyword_satype)conn->options[KNCF_TYPE]) {
case KS_TUNNEL:
	conn->policy &= ~POLICY_SHUNT_MASK(((lset_t)1 << (POLICY_SHUNT1_IX)) - ((lset_t)1 <<
 (POLICY_SHUNT0_IX)) + ((lset_t)1 << (POLICY_SHUNT1_IX)
));
	conn->policy |= POLICY_TUNNEL((lset_t)1 << (POLICY_TUNNEL_IX)) | POLICY_SHUNT_TRAP(SHUNT_DEFAULT * ((lset_t)1 << (POLICY_SHUNT0_IX)));
	break;

case KS_TRANSPORT:
	conn->policy &= ~POLICY_TUNNEL((lset_t)1 << (POLICY_TUNNEL_IX)) & ~POLICY_SHUNT_MASK(((lset_t)1 << (POLICY_SHUNT1_IX)) - ((lset_t)1 <<
 (POLICY_SHUNT0_IX)) + ((lset_t)1 << (POLICY_SHUNT1_IX)
));
	conn->policy |=  POLICY_SHUNT_TRAP(SHUNT_DEFAULT * ((lset_t)1 << (POLICY_SHUNT0_IX)));
	break;

case KS_PASSTHROUGH:
	conn->policy &=
		~(POLICY_ENCRYPT((lset_t)1 << (POLICY_ENCRYPT_IX)) | POLICY_AUTHENTICATE((lset_t)1 << (POLICY_AUTHENTICATE_IX)) |
		  POLICY_TUNNEL((lset_t)1 << (POLICY_TUNNEL_IX)) | POLICY_RSASIG((lset_t)1 << (POLICY_RSASIG_IX)) |
		  POLICY_SHUNT_MASK(((lset_t)1 << (POLICY_SHUNT1_IX)) - ((lset_t)1 <<
 (POLICY_SHUNT0_IX)) + ((lset_t)1 << (POLICY_SHUNT1_IX)
)));
	conn->policy |= POLICY_SHUNT_PASS(SHUNT_PASS * ((lset_t)1 << (POLICY_SHUNT0_IX)));
	break;

case KS_DROP:
	conn->policy &=
		~(POLICY_ENCRYPT((lset_t)1 << (POLICY_ENCRYPT_IX)) | POLICY_AUTHENTICATE((lset_t)1 << (POLICY_AUTHENTICATE_IX)) |
		  POLICY_TUNNEL((lset_t)1 << (POLICY_TUNNEL_IX)) | POLICY_RSASIG((lset_t)1 << (POLICY_RSASIG_IX)) |
		  POLICY_SHUNT_MASK(((lset_t)1 << (POLICY_SHUNT1_IX)) - ((lset_t)1 <<
 (POLICY_SHUNT0_IX)) + ((lset_t)1 << (POLICY_SHUNT1_IX)
)));
	conn->policy |= POLICY_SHUNT_DROP(SHUNT_DROP * ((lset_t)1 << (POLICY_SHUNT0_IX)));
	break;

case KS_REJECT:
	conn->policy &=
		~(POLICY_ENCRYPT((lset_t)1 << (POLICY_ENCRYPT_IX)) | POLICY_AUTHENTICATE((lset_t)1 << (POLICY_AUTHENTICATE_IX)) |
		  POLICY_TUNNEL((lset_t)1 << (POLICY_TUNNEL_IX)) | POLICY_RSASIG((lset_t)1 << (POLICY_RSASIG_IX)) |
		  POLICY_SHUNT_MASK(((lset_t)1 << (POLICY_SHUNT1_IX)) - ((lset_t)1 <<
 (POLICY_SHUNT0_IX)) + ((lset_t)1 << (POLICY_SHUNT1_IX)
)));
	conn->policy |= POLICY_SHUNT_REJECT(SHUNT_REJECT * ((lset_t)1 << (POLICY_SHUNT0_IX)));
	break;
}
}

if (conn->options_set[KNCF_FAILURESHUNT]) {
conn->policy &= ~POLICY_FAIL_MASK(((lset_t)1 << (POLICY_FAIL1_IX)) - ((lset_t)1 <<
 (POLICY_FAIL0_IX)) + ((lset_t)1 << (POLICY_FAIL1_IX)));
switch (conn->options[KNCF_FAILURESHUNT]) {
case KFS_FAIL_NONE:
	conn->policy |= POLICY_FAIL_NONE(SHUNT_DEFAULT * ((lset_t)1 << (POLICY_FAIL0_IX)));
	break;
case KFS_FAIL_PASS:
	conn->policy |= POLICY_FAIL_PASS(SHUNT_PASS * ((lset_t)1 << (POLICY_FAIL0_IX)));
	break;
case KFS_FAIL_DROP:
	conn->policy |= POLICY_FAIL_DROP(SHUNT_DROP * ((lset_t)1 << (POLICY_FAIL0_IX)));
	break;
case KFS_FAIL_REJECT:
	conn->policy |= POLICY_FAIL_REJECT(SHUNT_REJECT * ((lset_t)1 << (POLICY_FAIL0_IX)));
	break;
}
}

if (conn->options_set[KNCF_NEGOTIATIONSHUNT]) {
switch (conn->options[KNCF_NEGOTIATIONSHUNT]) {
case KNS_FAIL_PASS:
	conn->policy |= POLICY_NEGO_PASS((lset_t)1 << (POLICY_NEGO_PASS_IX));
	break;
case KNS_FAIL_DROP:
	conn->policy &= ~POLICY_NEGO_PASS((lset_t)1 << (POLICY_NEGO_PASS_IX));
	break;
}
}

KW_POLICY_FLAG(KNCF_COMPRESS, POLICY_COMPRESS){ if (conn->options_set[KNCF_COMPRESS]) conn->policy = (
conn->policy & ~(((lset_t)1 << (POLICY_COMPRESS_IX
)))) | (conn->options[KNCF_COMPRESS] ? (((lset_t)1 <<
 (POLICY_COMPRESS_IX))) : ((lset_t)0)); };
KW_POLICY_FLAG(KNCF_PFS, POLICY_PFS){ if (conn->options_set[KNCF_PFS]) conn->policy = (conn
->policy & ~(((lset_t)1 << (POLICY_PFS_IX)))) | (
conn->options[KNCF_PFS] ? (((lset_t)1 << (POLICY_PFS_IX
))) : ((lset_t)0)); };

/* reset authby= flags */
if (conn->strings_set[KSCF_AUTHBY]) {

conn->policy &= ~POLICY_ID_AUTH_MASK(((lset_t)1 << (POLICY_AUTH_NULL_IX)) - ((lset_t)1 <<
 (POLICY_PSK_IX)) + ((lset_t)1 << (POLICY_AUTH_NULL_IX)
));
conn->sighash_policy = LEMPTY((lset_t)0);
}

KW_POLICY_NEGATIVE_FLAG(KNCF_IKEPAD, POLICY_NO_IKEPAD){ if (conn->options_set[KNCF_IKEPAD]) { conn->policy = (
conn->policy & ~(((lset_t)1 << (POLICY_NO_IKEPAD_IX
)))) | (!conn->options[KNCF_IKEPAD] ? (((lset_t)1 <<
 (POLICY_NO_IKEPAD_IX))) : ((lset_t)0)); } };

KW_POLICY_NEGATIVE_FLAG(KNCF_REKEY, POLICY_DONT_REKEY){ if (conn->options_set[KNCF_REKEY]) { conn->policy = (
conn->policy & ~(((lset_t)1 << (POLICY_DONT_REKEY_IX
)))) | (!conn->options[KNCF_REKEY] ? (((lset_t)1 << (
POLICY_DONT_REKEY_IX))) : ((lset_t)0)); } };
KW_POLICY_FLAG(KNCF_REAUTH, POLICY_REAUTH){ if (conn->options_set[KNCF_REAUTH]) conn->policy = (conn
->policy & ~(((lset_t)1 << (POLICY_REAUTH_IX))))
 | (conn->options[KNCF_REAUTH] ? (((lset_t)1 << (POLICY_REAUTH_IX
))) : ((lset_t)0)); };

KW_POLICY_FLAG(KNCF_AGGRMODE, POLICY_AGGRESSIVE){ if (conn->options_set[KNCF_AGGRMODE]) conn->policy = (
conn->policy & ~(((lset_t)1 << (POLICY_AGGRESSIVE_IX
)))) | (conn->options[KNCF_AGGRMODE] ? (((lset_t)1 <<
 (POLICY_AGGRESSIVE_IX))) : ((lset_t)0)); };

KW_POLICY_FLAG(KNCF_MODECONFIGPULL, POLICY_MODECFG_PULL){ if (conn->options_set[KNCF_MODECONFIGPULL]) conn->policy
 = (conn->policy & ~(((lset_t)1 << (POLICY_MODECFG_PULL_IX
)))) | (conn->options[KNCF_MODECONFIGPULL] ? (((lset_t)1 <<
 (POLICY_MODECFG_PULL_IX))) : ((lset_t)0)); };

KW_POLICY_FLAG(KNCF_OVERLAPIP, POLICY_OVERLAPIP){ if (conn->options_set[KNCF_OVERLAPIP]) conn->policy =
 (conn->policy & ~(((lset_t)1 << (POLICY_OVERLAPIP_IX
)))) | (conn->options[KNCF_OVERLAPIP] ? (((lset_t)1 <<
 (POLICY_OVERLAPIP_IX))) : ((lset_t)0)); };

KW_POLICY_FLAG(KNCF_IKEv2_ALLOW_NARROWING,{ if (conn->options_set[KNCF_IKEv2_ALLOW_NARROWING]) conn->
policy = (conn->policy & ~(((lset_t)1 << (POLICY_IKEV2_ALLOW_NARROWING_IX
)))) | (conn->options[KNCF_IKEv2_ALLOW_NARROWING] ? (((lset_t
)1 << (POLICY_IKEV2_ALLOW_NARROWING_IX))) : ((lset_t)0)
); }
       POLICY_IKEV2_ALLOW_NARROWING){ if (conn->options_set[KNCF_IKEv2_ALLOW_NARROWING]) conn->
policy = (conn->policy & ~(((lset_t)1 << (POLICY_IKEV2_ALLOW_NARROWING_IX
)))) | (conn->options[KNCF_IKEv2_ALLOW_NARROWING] ? (((lset_t
)1 << (POLICY_IKEV2_ALLOW_NARROWING_IX))) : ((lset_t)0)
); };

KW_POLICY_FLAG(KNCF_MOBIKE, POLICY_MOBIKE){ if (conn->options_set[KNCF_MOBIKE]) conn->policy = (conn
->policy & ~(((lset_t)1 << (POLICY_MOBIKE_IX))))
 | (conn->options[KNCF_MOBIKE] ? (((lset_t)1 << (POLICY_MOBIKE_IX
))) : ((lset_t)0)); };

KW_POLICY_FLAG(KNCF_IKEv2_PAM_AUTHORIZE,{ if (conn->options_set[KNCF_IKEv2_PAM_AUTHORIZE]) conn->
policy = (conn->policy & ~(((lset_t)1 << (POLICY_IKEV2_PAM_AUTHORIZE_IX
)))) | (conn->options[KNCF_IKEv2_PAM_AUTHORIZE] ? (((lset_t
)1 << (POLICY_IKEV2_PAM_AUTHORIZE_IX))) : ((lset_t)0));
 }
       POLICY_IKEV2_PAM_AUTHORIZE){ if (conn->options_set[KNCF_IKEv2_PAM_AUTHORIZE]) conn->
policy = (conn->policy & ~(((lset_t)1 << (POLICY_IKEV2_PAM_AUTHORIZE_IX
)))) | (conn->options[KNCF_IKEv2_PAM_AUTHORIZE] ? (((lset_t
)1 << (POLICY_IKEV2_PAM_AUTHORIZE_IX))) : ((lset_t)0));
 };

KW_POLICY_FLAG(KNCF_DECAP_DSCP, POLICY_DECAP_DSCP){ if (conn->options_set[KNCF_DECAP_DSCP]) conn->policy =
 (conn->policy & ~(((lset_t)1 << (POLICY_DECAP_DSCP_IX
)))) | (conn->options[KNCF_DECAP_DSCP] ? (((lset_t)1 <<
 (POLICY_DECAP_DSCP_IX))) : ((lset_t)0)); };
KW_POLICY_FLAG(KNCF_NOPMTUDISC, POLICY_NOPMTUDISC){ if (conn->options_set[KNCF_NOPMTUDISC]) conn->policy =
 (conn->policy & ~(((lset_t)1 << (POLICY_NOPMTUDISC_IX
)))) | (conn->options[KNCF_NOPMTUDISC] ? (((lset_t)1 <<
 (POLICY_NOPMTUDISC_IX))) : ((lset_t)0)); };
KW_POLICY_FLAG(KNCF_MSDH_DOWNGRADE, POLICY_MSDH_DOWNGRADE){ if (conn->options_set[KNCF_MSDH_DOWNGRADE]) conn->policy
 = (conn->policy & ~(((lset_t)1 << (POLICY_MSDH_DOWNGRADE_IX
)))) | (conn->options[KNCF_MSDH_DOWNGRADE] ? (((lset_t)1 <<
 (POLICY_MSDH_DOWNGRADE_IX))) : ((lset_t)0)); };
KW_POLICY_FLAG(KNCF_DNS_MATCH_ID, POLICY_DNS_MATCH_ID){ if (conn->options_set[KNCF_DNS_MATCH_ID]) conn->policy
 = (conn->policy & ~(((lset_t)1 << (POLICY_DNS_MATCH_ID_IX
)))) | (conn->options[KNCF_DNS_MATCH_ID] ? (((lset_t)1 <<
 (POLICY_DNS_MATCH_ID_IX))) : ((lset_t)0)); };
KW_POLICY_FLAG(KNCF_SHA2_TRUNCBUG, POLICY_SHA2_TRUNCBUG){ if (conn->options_set[KNCF_SHA2_TRUNCBUG]) conn->policy
 = (conn->policy & ~(((lset_t)1 << (POLICY_SHA2_TRUNCBUG_IX
)))) | (conn->options[KNCF_SHA2_TRUNCBUG] ? (((lset_t)1 <<
 (POLICY_SHA2_TRUNCBUG_IX))) : ((lset_t)0)); };
KW_POLICY_FLAG(KNCF_INTERMEDIATE, POLICY_INTERMEDIATE){ if (conn->options_set[KNCF_INTERMEDIATE]) conn->policy
 = (conn->policy & ~(((lset_t)1 << (POLICY_INTERMEDIATE_IX
)))) | (conn->options[KNCF_INTERMEDIATE] ? (((lset_t)1 <<
 (POLICY_INTERMEDIATE_IX))) : ((lset_t)0)); };
KW_POLICY_FLAG(KNCF_IGNORE_PEER_DNS, POLICY_IGNORE_PEER_DNS){ if (conn->options_set[KNCF_IGNORE_PEER_DNS]) conn->policy
 = (conn->policy & ~(((lset_t)1 << (POLICY_IGNORE_PEER_DNS_IX
)))) | (conn->options[KNCF_IGNORE_PEER_DNS] ? (((lset_t)1 <<
 (POLICY_IGNORE_PEER_DNS_IX))) : ((lset_t)0)); };

if (conn->options_set[KNCF_SAN_ON_CERT]) {
if (!conn->options[KNCF_SAN_ON_CERT])
	conn->policy |= POLICY_ALLOW_NO_SAN((lset_t)1 << (POLICY_ALLOW_NO_SAN_IX));
}

/* ??? sometimes (when? why?) the member is already set */

1264#	define str_to_conn(member, kscf) { \
if (conn->strings_set[kscf]) { \
	pfreeany(conn->member){ typeof(conn->member) *pp_ = &(conn->member); if (
*pp_ != ((void*)0)) { pfree(*pp_); *pp_ = ((void*)0); } }; \
	conn->member = clone_str(conn->strings[kscf], #kscf)((conn->strings[kscf]) == ((void*)0) ? ((void*)0) : clone_bytes
((conn->strings[kscf]), strlen((conn->strings[kscf])) +
 1, (#kscf))); \
} \
}

str_to_conn(connalias, KSCF_CONNALIAS);

str_to_conn(ike_crypto, KSCF_IKE);
str_to_conn(esp, KSCF_ESP);

str_to_conn(modecfg_dns, KSCF_MODECFGDNS);
str_to_conn(modecfg_domains, KSCF_MODECFGDOMAINS);
str_to_conn(modecfg_banner, KSCF_MODECFGBANNER);

str_to_conn(sec_label, KSCF_SA_SEC_LABEL); /* copied to left/right later */

str_to_conn(conn_mark_both, KSCF_CONN_MARK_BOTH);
str_to_conn(conn_mark_in, KSCF_CONN_MARK_IN);
str_to_conn(conn_mark_out, KSCF_CONN_MARK_OUT);
str_to_conn(vti_iface, KSCF_VTI_IFACE);

str_to_conn(redirect_to, KSCF_REDIRECT_TO);
str_to_conn(accept_redirect_to, KSCF_ACCEPT_REDIRECT_TO);

1290#	undef str_to_conn

if (conn->options_set[KNCF_PHASE2]) {
conn->policy &= ~(POLICY_AUTHENTICATE((lset_t)1 << (POLICY_AUTHENTICATE_IX)) | POLICY_ENCRYPT((lset_t)1 << (POLICY_ENCRYPT_IX)));
conn->policy |= conn->options[KNCF_PHASE2];
}

/*
* This option has really been turned into a boolean, but
* we need the keywords for backwards compatibility for now
*/
if (conn->options_set[KNCF_IKEv2]) {

switch (conn->options[KNCF_IKEv2]) {
case fo_never:
case fo_permit:
	conn->ike_version = IKEv1;
	break;

case fo_propose:
case fo_insist:
	conn->ike_version = IKEv2;
	break;
}
}

if (conn->options_set[KNCF_SEND_REDIRECT]) {
if (conn->ike_version >= IKEv2) {
	switch (conn->options[KNCF_SEND_REDIRECT]) {
	case yna_yes:
		conn->policy |= POLICY_SEND_REDIRECT_ALWAYS((lset_t)1 << (POLICY_SEND_REDIRECT_ALWAYS_IX));
		if (conn->redirect_to == NULL((void*)0)) {
			starter_log(LOG_LEVEL_INFO1,
			"redirect-to is not specified, although send-redirect is set to yes");
		}
		break;

	case yna_no:
		conn->policy |= POLICY_SEND_REDIRECT_NEVER((lset_t)1 << (POLICY_SEND_REDIRECT_NEVER_IX));
		break;

	case yna_auto:
		break;
	}
}
}

if (conn->options_set[KNCF_ACCEPT_REDIRECT]) {
if (conn->ike_version >= IKEv2) {
	switch (conn->options[KNCF_ACCEPT_REDIRECT]) {
	case yna_yes:
		conn->policy |= POLICY_ACCEPT_REDIRECT_YES((lset_t)1 << (POLICY_ACCEPT_REDIRECT_YES_IX));
		break;

	/* default policy is no, so there is no POLICY_ACCEPT_REDIRECT_YES
	 * in policy.
	 *
	 * technically the values for this option are yes/no,
	 * although we use yna option set (we do not want to
	 * make new yes-no enum)
	 */
	case yna_auto:
	case yna_no:
		break;
	}
}
}

if (conn->options_set[KNCF_PPK]) {
lset_t ppk = LEMPTY((lset_t)0);

if (conn->ike_version >= IKEv2) {
	switch (conn->options[KNCF_PPK]) {
	case fo_propose:
		ppk = POLICY_PPK_ALLOW((lset_t)1 << (POLICY_PPK_ALLOW_IX));
		break;

	case fo_permit:
		ppk = POLICY_PPK_ALLOW((lset_t)1 << (POLICY_PPK_ALLOW_IX));
		break;

	case fo_insist:
		ppk = POLICY_PPK_ALLOW((lset_t)1 << (POLICY_PPK_ALLOW_IX)) | POLICY_PPK_INSIST((lset_t)1 << (POLICY_PPK_INSIST_IX));
		break;

	case fo_never:
		break;
	}
}
conn->policy = conn->policy | ppk;
}

if (conn->options_set[KNCF_ESN]) {
conn->policy &= ~(POLICY_ESN_NO((lset_t)1 << (POLICY_ESN_NO_IX)) | POLICY_ESN_YES((lset_t)1 << (POLICY_ESN_YES_IX)));

switch (conn->options[KNCF_ESN]) {
case ESN_YES:
	conn->policy |= POLICY_ESN_YES((lset_t)1 << (POLICY_ESN_YES_IX));
	break;

case ESN_NO:
	/* this is the default for now */
	conn->policy |= POLICY_ESN_NO((lset_t)1 << (POLICY_ESN_NO_IX));
	break;

case ESN_EITHER:
	conn->policy |= POLICY_ESN_NO((lset_t)1 << (POLICY_ESN_NO_IX)) | POLICY_ESN_YES((lset_t)1 << (POLICY_ESN_YES_IX));
	break;
}
}

if (conn->options_set[KNCF_IKE_FRAG]) {
conn->policy &= ~(POLICY_IKE_FRAG_ALLOW((lset_t)1 << (POLICY_IKE_FRAG_ALLOW_IX)) | POLICY_IKE_FRAG_FORCE((lset_t)1 << (POLICY_IKE_FRAG_FORCE_IX)));

switch (conn->options[KNCF_IKE_FRAG]) {
case ynf_no:
	break;

case ynf_yes:
	/* this is the default */
	conn->policy |= POLICY_IKE_FRAG_ALLOW((lset_t)1 << (POLICY_IKE_FRAG_ALLOW_IX));
	break;

case ynf_force:
	conn->policy |= POLICY_IKE_FRAG_ALLOW((lset_t)1 << (POLICY_IKE_FRAG_ALLOW_IX)) |
			POLICY_IKE_FRAG_FORCE((lset_t)1 << (POLICY_IKE_FRAG_FORCE_IX));
	break;
}
}

/* read in the authby string and translate to policy bits
* this is the symmetric (left+right) version
* there is also leftauthby/rightauthby version stored in 'end'
*
* authby=secret|rsasig|null|never|rsa-HASH
*
* using authby=rsasig results in legacy POLICY_RSASIG_v1_5 and RSA_PSS
*
* HASH needs to use full syntax - eg sha2_256 and not sha256, to avoid
* confusion with sha3_256
*/
if (conn->strings_set[KSCF_AUTHBY]) {
char *val = strtok(conn->strings[KSCF_AUTHBY], ", ");

conn->sighash_policy = LEMPTY((lset_t)0);
conn->policy &= ~POLICY_ID_AUTH_MASK(((lset_t)1 << (POLICY_AUTH_NULL_IX)) - ((lset_t)1 <<
 (POLICY_PSK_IX)) + ((lset_t)1 << (POLICY_AUTH_NULL_IX)
));
conn->policy &= ~POLICY_RSASIG_v1_5((lset_t)1 << (POLICY_RSASIG_v1_5_IX));

while (val != NULL((void*)0)) {
	/* Supported for IKEv1 and IKEv2 */
	if (streq(val, "secret")(strcmp((val), ("secret")) == 0)) {
		conn->policy |= POLICY_PSK((lset_t)1 << (POLICY_PSK_IX));
	} else if (streq(val, "rsasig")(strcmp((val), ("rsasig")) == 0) || streq(val, "rsa")(strcmp((val), ("rsa")) == 0)) {
		conn->policy |= POLICY_RSASIG((lset_t)1 << (POLICY_RSASIG_IX));
		conn->policy |= POLICY_RSASIG_v1_5((lset_t)1 << (POLICY_RSASIG_v1_5_IX));
		conn->sighash_policy |= POL_SIGHASH_SHA2_256((lset_t)1 << (POL_SIGHASH_SHA2_256_IX));
		conn->sighash_policy |= POL_SIGHASH_SHA2_384((lset_t)1 << (POL_SIGHASH_SHA2_384_IX));
		conn->sighash_policy |= POL_SIGHASH_SHA2_512((lset_t)1 << (POL_SIGHASH_SHA2_512_IX));
	} else if (streq(val, "never")(strcmp((val), ("never")) == 0)) {
		conn->policy |= POLICY_AUTH_NEVER((lset_t)1 << (POLICY_AUTH_NEVER_IX));
	/* everything else is only supported for IKEv2 */
	} else if (conn->ike_version == IKEv1) {
		starter_error_append(perrl, "ikev1 connection must use authby= of rsasig, secret or never");
		return TRUE1;
	} else if (streq(val, "null")(strcmp((val), ("null")) == 0)) {
		conn->policy |= POLICY_AUTH_NULL((lset_t)1 << (POLICY_AUTH_NULL_IX));
	} else if (streq(val, "rsa-sha1")(strcmp((val), ("rsa-sha1")) == 0)) {
		conn->policy |= POLICY_RSASIG((lset_t)1 << (POLICY_RSASIG_IX));
		conn->policy |= POLICY_RSASIG_v1_5((lset_t)1 << (POLICY_RSASIG_v1_5_IX));
	} else if (streq(val, "rsa-sha2")(strcmp((val), ("rsa-sha2")) == 0)) {
		conn->policy |= POLICY_RSASIG((lset_t)1 << (POLICY_RSASIG_IX));
		conn->sighash_policy |= POL_SIGHASH_SHA2_256((lset_t)1 << (POL_SIGHASH_SHA2_256_IX));
		conn->sighash_policy |= POL_SIGHASH_SHA2_384((lset_t)1 << (POL_SIGHASH_SHA2_384_IX));
		conn->sighash_policy |= POL_SIGHASH_SHA2_512((lset_t)1 << (POL_SIGHASH_SHA2_512_IX));
	} else if (streq(val, "rsa-sha2_256")(strcmp((val), ("rsa-sha2_256")) == 0)) {
		conn->sighash_policy |= POL_SIGHASH_SHA2_256((lset_t)1 << (POL_SIGHASH_SHA2_256_IX));
	} else if (streq(val, "rsa-sha2_384")(strcmp((val), ("rsa-sha2_384")) == 0)) {
		conn->policy |= POLICY_RSASIG((lset_t)1 << (POLICY_RSASIG_IX));
		conn->sighash_policy |= POL_SIGHASH_SHA2_384((lset_t)1 << (POL_SIGHASH_SHA2_384_IX));
	} else if (streq(val, "rsa-sha2_512")(strcmp((val), ("rsa-sha2_512")) == 0)) {
		conn->policy |= POLICY_RSASIG((lset_t)1 << (POLICY_RSASIG_IX));
		conn->sighash_policy |= POL_SIGHASH_SHA2_512((lset_t)1 << (POL_SIGHASH_SHA2_512_IX));
	} else if (streq(val, "ecdsa")(strcmp((val), ("ecdsa")) == 0) || streq(val, "ecdsa-sha2")(strcmp((val), ("ecdsa-sha2")) == 0)) {
		conn->policy |= POLICY_ECDSA((lset_t)1 << (POLICY_ECDSA_IX));
		conn->sighash_policy |= POL_SIGHASH_SHA2_256((lset_t)1 << (POL_SIGHASH_SHA2_256_IX));
		conn->sighash_policy |= POL_SIGHASH_SHA2_384((lset_t)1 << (POL_SIGHASH_SHA2_384_IX));
		conn->sighash_policy |= POL_SIGHASH_SHA2_512((lset_t)1 << (POL_SIGHASH_SHA2_512_IX));
	} else if (streq(val, "ecdsa-sha2_256")(strcmp((val), ("ecdsa-sha2_256")) == 0)) {
		conn->policy |= POLICY_ECDSA((lset_t)1 << (POLICY_ECDSA_IX));
		conn->sighash_policy |= POL_SIGHASH_SHA2_256((lset_t)1 << (POL_SIGHASH_SHA2_256_IX));
	} else if (streq(val, "ecdsa-sha2_384")(strcmp((val), ("ecdsa-sha2_384")) == 0)) {
		conn->policy |= POLICY_ECDSA((lset_t)1 << (POLICY_ECDSA_IX));
		conn->sighash_policy |= POL_SIGHASH_SHA2_384((lset_t)1 << (POL_SIGHASH_SHA2_384_IX));
	} else if (streq(val, "ecdsa-sha2_512")(strcmp((val), ("ecdsa-sha2_512")) == 0)) {
		conn->policy |= POLICY_ECDSA((lset_t)1 << (POLICY_ECDSA_IX));
		conn->sighash_policy |= POL_SIGHASH_SHA2_512((lset_t)1 << (POL_SIGHASH_SHA2_512_IX));
	} else if (streq(val, "ecdsa-sha1")(strcmp((val), ("ecdsa-sha1")) == 0)) {
		starter_error_append(perrl, "authby=ecdsa cannot use sha1, only sha2");
		return TRUE1;
	} else {
		starter_error_append(perrl, "connection authby= value is unknown");
		return TRUE1;
	}
	val = strtok(NULL((void*)0), ", ");
}
}

/*
* some options are set as part of our default, but
* some make no sense for shunts, so remove those again
*/
if (NEVER_NEGOTIATE(conn->policy)(((((conn->policy)) & (((lset_t)1 << (POLICY_ENCRYPT_IX
)) | ((lset_t)1 << (POLICY_AUTHENTICATE_IX)))) == ((lset_t
)0)))) {
/* remove IPsec related options */
conn->ike_version = 0;
conn->policy &= (~(POLICY_PFS((lset_t)1 << (POLICY_PFS_IX)) |
		   POLICY_COMPRESS((lset_t)1 << (POLICY_COMPRESS_IX)) |
		   POLICY_ESN_NO((lset_t)1 << (POLICY_ESN_NO_IX)) |
		   POLICY_ESN_YES((lset_t)1 << (POLICY_ESN_YES_IX)) |
		   POLICY_DECAP_DSCP((lset_t)1 << (POLICY_DECAP_DSCP_IX)) |
		   POLICY_NOPMTUDISC((lset_t)1 << (POLICY_NOPMTUDISC_IX))) &
		 /* remove IKE related options */
		 ~(POLICY_IKE_FRAG_ALLOW((lset_t)1 << (POLICY_IKE_FRAG_ALLOW_IX)) |
		   POLICY_IKE_FRAG_FORCE((lset_t)1 << (POLICY_IKE_FRAG_FORCE_IX))));
}

err |= validate_end(conn, &conn->left, "left", perrl, logger);
err |= validate_end(conn, &conn->right, "right", perrl, logger);

/*
* TODO:
* verify both ends are using the same inet family, if one end
* is "%any" or "%defaultroute", then perhaps adjust it.
* ensource this for left,leftnexthop,right,rightnexthop
*/

if (conn->options_set[KNCF_AUTO])
conn->desired_state = conn->options[KNCF_AUTO];

if (conn->desired_state == STARTUP_KEEP)
conn->policy |= POLICY_UP((lset_t)1 << (POLICY_UP_IX)); /* auto=keep means once up, keep up */

return err;
1532}

1534static void copy_conn_default(struct starter_conn *conn,
	      const struct starter_conn *def)
1536{
/* structure copy to start */
*conn = *def;

/* unlink it */
conn->link.tqe_next = NULL((void*)0);
conn->link.tqe_prev = NULL((void*)0);

/* Unshare all strings */

/*
* Note: string fields in struct starter_end and struct starter_conn
* should correspond to STR_FIELD calls in copy_conn_default() and confread_free_conn.
*/

assert(conn->connalias == NULL)((void) sizeof ((conn->connalias == ((void*)0)) ? 1 : 0), __extension__
 ({ if (conn->connalias == ((void*)0)) ; else __assert_fail
 ("conn->connalias == NULL", "/home/build/quick-libreswan-2/lib/libipsecconf/confread.c"
, 1551, __extension__ __PRETTY_FUNCTION__); }));

1553# define STR_FIELD(f)  { conn->f = clone_str(conn->f, #f)((conn->f) == ((void*)0) ? ((void*)0) : clone_bytes((conn->
f), strlen((conn->f)) + 1, (#f))); }

STR_FIELD(name);
STR_FIELD(connalias);

STR_FIELD(ike_crypto);
STR_FIELD(esp);

STR_FIELD(modecfg_dns);
STR_FIELD(modecfg_domains);
STR_FIELD(modecfg_banner);
STR_FIELD(conn_mark_both);
STR_FIELD(conn_mark_in);
STR_FIELD(conn_mark_out);
STR_FIELD(sec_label);
STR_FIELD(conn_mark_both);
STR_FIELD(conn_mark_in);
STR_FIELD(conn_mark_out);
STR_FIELD(vti_iface);
STR_FIELD(redirect_to);
STR_FIELD(accept_redirect_to);

for (unsigned i = 0; i < elemsof(conn->strings)(sizeof(conn->strings) / sizeof(*(conn->strings))); i++)
STR_FIELD(strings[i]);

/* handle starter_end strings */

1580# define STR_FIELD_END(f) { STR_FIELD(left.f); STR_FIELD(right.f); }

STR_FIELD_END(iface);
STR_FIELD_END(id);
STR_FIELD_END(rsasigkey);
STR_FIELD_END(virt);
STR_FIELD_END(certx);
STR_FIELD_END(ckaid);
STR_FIELD_END(ca);
STR_FIELD_END(updown);

for (unsigned i = 0; i < elemsof(conn->left.strings)(sizeof(conn->left.strings) / sizeof(*(conn->left.strings
))); i++)
STR_FIELD_END(strings[i]);

1594# undef STR_FIELD_END

1596# undef STR_FIELD
1597}

1599static struct starter_conn *alloc_add_conn(struct starter_config *cfg, const char *name)
1600{
struct starter_conn *conn = alloc_thing(struct starter_conn, "add_conn starter_conn")((struct starter_conn*) alloc_bytes(sizeof(struct starter_conn
), ("add_conn starter_conn")));

copy_conn_default(conn, &cfg->conn_default);
assert(conn->name == NULL)((void) sizeof ((conn->name == ((void*)0)) ? 1 : 0), __extension__
 ({ if (conn->name == ((void*)0)) ; else __assert_fail ("conn->name == NULL"
, "/home/build/quick-libreswan-2/lib/libipsecconf/confread.c"
, 1604, __extension__ __PRETTY_FUNCTION__); }));
conn->name = clone_str(name, "add conn name")((name) == ((void*)0) ? ((void*)0) : clone_bytes((name), strlen
((name)) + 1, ("add conn name")));
conn->desired_state = STARTUP_IGNORE;
conn->state = STATE_FAILED;

TAILQ_INIT(&conn->comments)do { (&conn->comments)->tqh_first = ((void*)0); (&
conn->comments)->tqh_last = &(&conn->comments
)->tqh_first; } while ( 0);

TAILQ_INSERT_TAIL(&cfg->conns, conn, link)do { (conn)->link.tqe_next = ((void*)0); (conn)->link.tqe_prev
 = (&cfg->conns)->tqh_last; *(&cfg->conns)->
tqh_last = (conn); (&cfg->conns)->tqh_last = &(
conn)->link.tqe_next; } while ( 0);
return conn;
1613}

1615static bool_Bool init_load_conn(struct starter_config *cfg,
	   const struct config_parsed *cfgp,
	   struct section_list *sconn,
	   bool_Bool defaultconn,
	   starter_errors_t *perrl,
	   struct logger *logger)
1621{
starter_log(LOG_LEVEL_DEBUG3, "Loading conn %s", sconn->name);

struct starter_conn *conn = alloc_add_conn(cfg, sconn->name);

bool_Bool connerr = load_conn(conn, cfgp, sconn, TRUE1,
		 defaultconn, perrl, logger);

if (connerr) {
starter_log(LOG_LEVEL_INFO1, "while loading '%s': %s",
	    sconn->name, perrl->errors);
/* ??? should caller not log perrl? */
} else {
conn->state = STATE_LOADED;
}
return connerr;
1637}

1639struct starter_config *confread_load(const char *file,
		     starter_errors_t *perrl,
		     const char *ctlsocket,
		     bool_Bool setuponly,
		     struct logger *logger)
1644{
bool_Bool err = FALSE0;

/**
* Load file
*/
struct config_parsed *cfgp = parser_load_conf(file, perrl);

if (cfgp == NULL((void*)0))
return NULL((void*)0);

struct starter_config *cfg = alloc_thing(struct starter_config, "starter_config cfg")((struct starter_config*) alloc_bytes(sizeof(struct starter_config
), ("starter_config cfg")));

/**
* Set default values
*/
ipsecconf_default_values(cfg);

if (ctlsocket != NULL((void*)0)) {
pfree(cfg->ctlsocket);
cfg->ctlsocket = clone_str(ctlsocket, "default ctlsocket")((ctlsocket) == ((void*)0) ? ((void*)0) : clone_bytes((ctlsocket
), strlen((ctlsocket)) + 1, ("default ctlsocket")));
}

/**
* Load setup
*/
err |= load_setup(cfg, cfgp);

if (err) {
parser_free_conf(cfgp);
confread_free(cfg);
return NULL((void*)0);
}

if (!setuponly) {
1679#ifdef USE_DNSSEC1
unbound_sync_init(cfg->setup.options[KBF_DO_DNSSEC],
		  cfg->setup.strings[KSF_PLUTO_DNSSEC_ROOTKEY_FILE],
		  cfg->setup.strings[KSF_PLUTO_DNSSEC_ANCHORS],
		  logger);
1684#endif

/*
 * Load %default conn
 * ??? is it correct to accept multiple %default conns?
 */
for (struct section_list *sconn = cfgp->sections.tqh_first; (!err) && sconn != NULL((void*)0);
     sconn = sconn->link.tqe_next) {
	if (streq(sconn->name, "%default")(strcmp((sconn->name), ("%default")) == 0)) {
		starter_log(LOG_LEVEL_DEBUG3,
			    "Loading default conn");
		err |= load_conn(&cfg->conn_default,
				 cfgp, sconn, false0,
				 true1/*default conn*/,
				 perrl, logger);
	}
}

/*
 * Load other conns
 */
for (struct section_list *sconn = cfgp->sections.tqh_first; sconn != NULL((void*)0);
     sconn = sconn->link.tqe_next) {
	if (!streq(sconn->name, "%default")(strcmp((sconn->name), ("%default")) == 0))
		err |= init_load_conn(cfg, cfgp, sconn,
				      false0/*default conn*/,
				      perrl, logger);
}
}

parser_free_conf(cfgp);
1715#ifdef USE_DNSSEC1
unbound_ctx_free();
1717#endif
return cfg;
1719}

1721static void confread_free_conn(struct starter_conn *conn)
1722{
/* Free all strings */

/*
* Note: string fields in struct starter_end and struct starter_conn
* should correspond to STR_FIELD calls in copy_conn_default() and confread_free_conn.
*/

1730# define STR_FIELD(f)  { pfreeany(conn->f){ typeof(conn->f) *pp_ = &(conn->f); if (*pp_ != ((
void*)0)) { pfree(*pp_); *pp_ = ((void*)0); } }; }

STR_FIELD(name);
STR_FIELD(connalias);

STR_FIELD(ike_crypto);
STR_FIELD(esp);

STR_FIELD(modecfg_dns);
STR_FIELD(modecfg_domains);
STR_FIELD(modecfg_banner);
STR_FIELD(conn_mark_both);
STR_FIELD(conn_mark_in);
STR_FIELD(conn_mark_out);
STR_FIELD(sec_label);
STR_FIELD(conn_mark_both);
STR_FIELD(conn_mark_in);
STR_FIELD(conn_mark_out);
STR_FIELD(vti_iface);
STR_FIELD(redirect_to);
STR_FIELD(accept_redirect_to);

for (unsigned i = 0; i < elemsof(conn->strings)(sizeof(conn->strings) / sizeof(*(conn->strings))); i++)
STR_FIELD(strings[i]);

/* handle starter_end strings */

1757# define STR_FIELD_END(f) { STR_FIELD(left.f); STR_FIELD(right.f); }

STR_FIELD_END(iface);
STR_FIELD_END(id);
STR_FIELD_END(rsasigkey);
STR_FIELD_END(virt);
STR_FIELD_END(certx);
STR_FIELD_END(ckaid);
STR_FIELD_END(ca);
STR_FIELD_END(updown);

for (unsigned i = 0; i < elemsof(conn->left.strings)(sizeof(conn->left.strings) / sizeof(*(conn->left.strings
))); i++)
STR_FIELD_END(strings[i]);

1771# undef STR_FIELD_END

1773# undef STR_FIELD
1774}

1776void confread_free(struct starter_config *cfg)
1777{
pfree(cfg->ctlsocket);

for (unsigned i = 0; i < elemsof(cfg->setup.strings)(sizeof(cfg->setup.strings) / sizeof(*(cfg->setup.strings
))); i++)
pfreeany(cfg->setup.strings[i]){ typeof(cfg->setup.strings[i]) *pp_ = &(cfg->setup
.strings[i]); if (*pp_ != ((void*)0)) { pfree(*pp_); *pp_ = (
(void*)0); } };

confread_free_conn(&cfg->conn_default);

for (struct starter_conn *conn = cfg->conns.tqh_first; conn != NULL((void*)0); ) {
struct starter_conn *c = conn;

conn = conn->link.tqe_next;
confread_free_conn(c);
pfree(c);
}
pfree(cfg);
1793}