op public repos

Blob

Date:: Fri Jul 23 14:30:30 2021 UTC
Message:: error also if `tls pki' is missing
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2021 Omar Polo <op@omarpolo.com>
3  * Copyright (c) 2018 Florian Obser <florian@openbsd.org>
4  * Copyright (c) 2004, 2005 Esben Norby <norby@openbsd.org>
5  * Copyright (c) 2004 Ryan McBride <mcbride@openbsd.org>
6  * Copyright (c) 2002, 2003, 2004 Henning Brauer <henning@openbsd.org>
7  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
8  * Copyright (c) 2001 Daniel Hartmeier.  All rights reserved.
9  * Copyright (c) 2001 Theo de Raadt.  All rights reserved.
10  *
11  * Permission to use, copy, modify, and distribute this software for any
12  * purpose with or without fee is hereby granted, provided that the above
13  * copyright notice and this permission notice appear in all copies.
14  *
15  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
16  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
17  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
18  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
19  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
20  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
21  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
22  */
23 
24 %{
25 #include "compat.h"
26 
27 #include <sys/stat.h>
28 
29 #include <ctype.h>
30 #include <err.h>
31 #include <errno.h>
32 #include <event.h>
33 #include <inttypes.h>
34 #include <limits.h>
35 #include <stdarg.h>
36 #include <stdio.h>
37 #include <stdlib.h>
38 #include <string.h>
39 #include <syslog.h>
40 #include <unistd.h>
41 
42 #include "log.h"
43 #include "kamid.h"
44 #include "table.h"
45 #include "utils.h"
46 
47 TAILQ_HEAD(files, file)		 files = TAILQ_HEAD_INITIALIZER(files);
48 static struct file {
49 	TAILQ_ENTRY(file)	 entry;
50 	FILE			*stream;
51 	char			*name;
52 	size_t	 		 ungetpos;
53 	size_t			 ungetsize;
54 	u_char			*ungetbuf;
55 	int			 eof_reached;
56 	int			 lineno;
57 	int			 errors;
58 } *file, *topfile;
59 struct file	*pushfile(const char *, int);
60 int		 popfile(void);
61 int		 check_file_secrecy(int, const char *);
62 int		 yyparse(void);
63 int		 yylex(void);
64 int		 yyerror(const char *, ...)
65     __attribute__((__format__ (printf, 1, 2)))
66     __attribute__((__nonnull__ (1)));
67 int		 kw_cmp(const void *, const void *);
68 int		 lookup(char *);
69 int		 igetc(void);
70 int		 lgetc(int);
71 void		 lungetc(int);
72 int		 findeol(void);
73 
74 TAILQ_HEAD(symhead, sym)	 symhead = TAILQ_HEAD_INITIALIZER(symhead);
75 struct sym {
76 	TAILQ_ENTRY(sym)	 entry;
77 	int			 used;
78 	int			 persist;
79 	char			*nam;
80 	char			*val;
81 };
82 
83 int	 symset(const char *, const char *, int);
84 char	*symget(const char *);
85 
86 void	 clear_config(struct kd_conf *xconf);
87 
88 static void		 add_table(const char *, const char *, const char *);
89 static struct table	*findtable(const char *name);
90 static void		 add_cert(const char *, const char *);
91 static void		 add_key(const char *, const char *);
92 static struct kd_listen_conf *listen_new(void);
93 
94 static uint32_t			 counter;
95 static struct table		*table;
96 static struct kd_listen_conf	*listener;
97 static struct kd_conf		*conf;
98 static int			 errors;
99 
100 typedef struct {
101 	union {
102 		int64_t		 number;
103 		char		*string;
104 		struct table	*table;
105 	} v;
106 	int lineno;
107 } YYSTYPE;
108 
109 %}
110 
111 %token	AUTH
112 %token	CERT
113 %token	ERROR
114 %token	INCLUDE
115 %token	KEY
116 %token	LISTEN
117 %token	NO
118 %token	ON
119 %token	PKI PORT
120 %token	TABLE TLS
121 %token	YES
122 
123 %token	<v.string>	STRING
124 %token	<v.number>	NUMBER
125 %type	<v.number>	yesno
126 %type	<v.string>	string
127 %type	<v.table>	tableref
128 
129 %%
130 
131 grammar		: /* empty */
132 		| grammar include '\n'
133 		| grammar '\n'
134 		| grammar table '\n'
135 		| grammar pki '\n'
136 		| grammar listen '\n'
137 		| grammar varset '\n'
138 		| grammar error '\n'		{ file->errors++; }
139 		;
140 
141 include		: INCLUDE STRING		{
142 			struct file	*nfile;
143 
144 			if ((nfile = pushfile($2, 0)) == NULL) {
145 				yyerror("failed to include file %s", $2);
146 				free($2);
147 				YYERROR;
148 			}
149 			free($2);
150 
151 			file = nfile;
152 			lungetc('\n');
153 		}
154 		;
155 
156 string		: string STRING	{
157 			if (asprintf(&$$, "%s %s", $1, $2) == -1) {
158 				free($1);
159 				free($2);
160 				yyerror("string: asprintf");
161 				YYERROR;
162 			}
163 			free($1);
164 			free($2);
165 		}
166 		| STRING
167 		;
168 
169 yesno		: YES	{ $$ = 1; }
170 		| NO	{ $$ = 0; }
171 		;
172 
173 optnl		: '\n' optnl		/* zero or more newlines */
174 		| /*empty*/
175 		;
176 
177 nl		: '\n' optnl		/* one or more newlines */
178 		;
179 
180 arrow		: '=' '>' ;
181 
182 comma		: ',' optnl
183 		| nl
184 		;
185 
186 varset		: STRING '=' string		{
187 			char *s = $1;
188 			if (verbose)
189 				printf("%s = \"%s\"\n", $1, $3);
190 			while (*s++) {
191 				if (isspace((unsigned char)*s)) {
192 					yyerror("macro name cannot contain "
193 					    "whitespace");
194 					free($1);
195 					free($3);
196 					YYERROR;
197 				}
198 			}
199 			if (symset($1, $3, 0) == -1)
200 				fatal("cannot store variable");
201 			free($1);
202 			free($3);
203 		}
204 		;
205 
206 pki		: PKI STRING CERT STRING { add_cert($2, $4); }
207 		| PKI STRING KEY STRING  { add_key($2, $4); }
208 		;
209 
210 table_kp	: string arrow string {
211 			if (table_add(table, $1, $3) == -1)
212 				yyerror("can't add to table %s",
213 				    table->t_name);
214 			free($1);
215 			free($3);
216 		}
217 		;
218 
219 table_kps	: table_kp
220 		| table_kp comma table_kps
221 		;
222 
223 stringel	: STRING {
224 			if (table_add(table, $1, NULL) == -1)
225 				yyerror("can't add to table %s",
226 				    table->t_name);
227 			free($1);
228 		}
229 		;
230 
231 string_list	: stringel
232 		| stringel comma string_list
233 		;
234 
235 table_vals	: table_kps
236 		| string_list
237 		;
238 
239 table		: TABLE STRING STRING {
240 			char *p;
241 
242 			if ((p = strchr($3, ':')) == NULL) {
243 				yyerror("invalid table %s", $2);
244 				YYERROR;
245 			}
246 
247 			*p = '\0';
248 			add_table($2, $3, p+1);
249 			free($2);
250 			free($3);
251 		}
252 		| TABLE STRING {
253 			add_table($2, "static", NULL);
254 		} '{' table_vals '}' {
255 			table = NULL;
256 		}
257 		;
258 
259 tableref	: '<' STRING '>' {
260 			struct table *t;
261 
262 			t = findtable($2);
263 			free($2);
264 			if (t == NULL)
265 				YYERROR;
266 			$$ = t;
267 		}
268 		;
269 
270 listen		: LISTEN { listener = listen_new(); }
271 		listen_opts {
272 			if (listener->auth_table == NULL)
273 				yyerror("missing auth table");
274 			if (!(listener->flags & L_TLS))
275 				yyerror("can't define a non-tls listener");
276 
277 			listener = NULL;
278 		};
279 
280 listen_opts	: listen_opt
281 		| listen_opt listen_opts
282 		;
283 
284 listen_opt	: ON STRING PORT NUMBER	{
285 			if (*listener->iface != '\0')
286 				yyerror("listen address and port already"
287 				    " defined");
288 			strlcpy(listener->iface, $2, sizeof(listener->iface));
289 			listener->port = $4;
290 		}
291 		| TLS PKI STRING {
292 			if (*listener->pki != '\0')
293 				yyerror("listen tls pki already defined");
294 			listener->flags |= L_TLS;
295 			strlcpy(listener->pki, $3, sizeof(listener->pki));
296 		}
297 		| AUTH tableref {
298 			if (listener->auth_table != NULL)
299 				yyerror("listen auth already defined");
300 			listener->auth_table = $2;
301 		}
302 		;
303 
304 %%
305 
306 struct keywords {
307 	const char	*k_name;
308 	int		 k_val;
309 };
310 
311 int
312 yyerror(const char *fmt, ...)
313 {
314 	va_list		 ap;
315 	char		*msg;
316 
317 	file->errors++;
318 	va_start(ap, fmt);
319 	if (vasprintf(&msg, fmt, ap) == -1)
320 		fatalx("yyerror vasprintf");
321 	va_end(ap);
322 	logit(LOG_CRIT, "%s:%d: %s", file->name, yylval.lineno, msg);
323 	free(msg);
324 	return 0;
325 }
326 
327 int
328 kw_cmp(const void *k, const void *e)
329 {
330 	return strcmp(k, ((const struct keywords *)e)->k_name);
331 }
332 
333 int
334 lookup(char *s)
335 {
336 	/* This has to be sorted always. */
337 	static const struct keywords keywords[] = {
338 		{"auth",		AUTH},
339 		{"cert",		CERT},
340 		{"include",		INCLUDE},
341 		{"key",			KEY},
342 		{"listen",		LISTEN},
343 		{"no",			NO},
344 		{"on",			ON},
345 		{"pki",			PKI},
346 		{"port",		PORT},
347 		{"table",		TABLE},
348 		{"tls",			TLS},
349 		{"yes",			YES},
350 	};
351 	const struct keywords	*p;
352 
353 	p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]),
354 	    sizeof(keywords[0]), kw_cmp);
355 
356 	if (p)
357 		return p->k_val;
358 	else
359 		return STRING;
360 }
361 
362 #define START_EXPAND	1
363 #define DONE_EXPAND	2
364 
365 static int	expanding;
366 
367 int
368 igetc(void)
369 {
370 	int	c;
371 
372 	while (1) {
373 		if (file->ungetpos > 0)
374 			c = file->ungetbuf[--file->ungetpos];
375 		else
376 			c = getc(file->stream);
377 
378 		if (c == START_EXPAND)
379 			expanding = 1;
380 		else if (c == DONE_EXPAND)
381 			expanding = 0;
382 		else
383 			break;
384 	}
385 	return c;
386 }
387 
388 int
389 lgetc(int quotec)
390 {
391 	int		c, next;
392 
393 	if (quotec) {
394 		if ((c = igetc()) == EOF) {
395 			yyerror("reached end of file while parsing "
396 			    "quoted string");
397 			if (file == topfile || popfile() == EOF)
398 				return EOF;
399 			return quotec;
400 		}
401 		return c;
402 	}
403 
404 	while ((c = igetc()) == '\\') {
405 		next = igetc();
406 		if (next != '\n') {
407 			c = next;
408 			break;
409 		}
410 		yylval.lineno = file->lineno;
411 		file->lineno++;
412 	}
413 
414 	if (c == EOF) {
415 		/*
416 		 * Fake EOL when hit EOF for the first time. This gets line
417 		 * count right if last line in included file is syntactically
418 		 * invalid and has no newline.
419 		 */
420 		if (file->eof_reached == 0) {
421 			file->eof_reached = 1;
422 			return '\n';
423 		}
424 		while (c == EOF) {
425 			if (file == topfile || popfile() == EOF)
426 				return EOF;
427 			c = igetc();
428 		}
429 	}
430 	return c;
431 }
432 
433 void
434 lungetc(int c)
435 {
436 	if (c == EOF)
437 		return;
438 
439 	if (file->ungetpos >= file->ungetsize) {
440 		void *p = reallocarray(file->ungetbuf, file->ungetsize, 2);
441 		if (p == NULL)
442 			err(1, "lungetc");
443 		file->ungetbuf = p;
444 		file->ungetsize *= 2;
445 	}
446 	file->ungetbuf[file->ungetpos++] = c;
447 }
448 
449 int
450 findeol(void)
451 {
452 	int	c;
453 
454 	/* Skip to either EOF or the first real EOL. */
455 	while (1) {
456 		c = lgetc(0);
457 		if (c == '\n') {
458 			file->lineno++;
459 			break;
460 		}
461 		if (c == EOF)
462 			break;
463 	}
464 	return ERROR;
465 }
466 
467 int
468 yylex(void)
469 {
470 	unsigned char	 buf[8096];
471 	unsigned char	*p, *val;
472 	int		 quotec, next, c;
473 	int		 token;
474 
475 top:
476 	p = buf;
477 	while ((c = lgetc(0)) == ' ' || c == '\t')
478 		; /* nothing */
479 
480 	yylval.lineno = file->lineno;
481 	if (c == '#')
482 		while ((c = lgetc(0)) != '\n' && c != EOF)
483 			; /* nothing */
484 	if (c == '$' && !expanding) {
485 		while (1) {
486 			if ((c = lgetc(0)) == EOF)
487 				return 0;
488 
489 			if (p + 1 >= buf + sizeof(buf) - 1) {
490 				yyerror("string too long");
491 				return findeol();
492 			}
493 			if (isalnum(c) || c == '_') {
494 				*p++ = c;
495 				continue;
496 			}
497 			*p = '\0';
498 			lungetc(c);
499 			break;
500 		}
501 		val = symget(buf);
502 		if (val == NULL) {
503 			yyerror("macro '%s' not defined", buf);
504 			return findeol();
505 		}
506 		p = val + strlen(val) - 1;
507 		lungetc(DONE_EXPAND);
508 		while (p >= val) {
509 			lungetc(*p);
510 			p--;
511 		}
512 		lungetc(START_EXPAND);
513 		goto top;
514 	}
515 
516 	switch (c) {
517 	case '\'':
518 	case '"':
519 		quotec = c;
520 		while (1) {
521 			if ((c = lgetc(quotec)) == EOF)
522 				return 0;
523 			if (c == '\n') {
524 				file->lineno++;
525 				continue;
526 			} else if (c == '\\') {
527 				if ((next = lgetc(quotec)) == EOF)
528 					return (0);
529 				if (next == quotec || next == ' ' ||
530 				    next == '\t')
531 					c = next;
532 				else if (next == '\n') {
533 					file->lineno++;
534 					continue;
535 				} else
536 					lungetc(next);
537 			} else if (c == quotec) {
538 				*p = '\0';
539 				break;
540 			} else if (c == '\0') {
541 				yyerror("syntax error");
542 				return findeol();
543 			}
544 			if (p + 1 >= buf + sizeof(buf) - 1) {
545 				yyerror("string too long");
546 				return findeol();
547 			}
548 			*p++ = c;
549 		}
550 		yylval.v.string = strdup(buf);
551 		if (yylval.v.string == NULL)
552 			err(1, "yylex: strdup");
553 		return STRING;
554 	}
555 
556 #define allowed_to_end_number(x) \
557 	(isspace(x) || x == ')' || x ==',' || x == '/' || x == '}' || x == '=')
558 
559 	if (c == '-' || isdigit(c)) {
560 		do {
561 			*p++ = c;
562 			if ((size_t)(p-buf) >= sizeof(buf)) {
563 				yyerror("string too long");
564 				return findeol();
565 			}
566 		} while ((c = lgetc(0)) != EOF && isdigit(c));
567 		lungetc(c);
568 		if (p == buf + 1 && buf[0] == '-')
569 			goto nodigits;
570 		if (c == EOF || allowed_to_end_number(c)) {
571 			const char *errstr = NULL;
572 
573 			*p = '\0';
574 			yylval.v.number = strtonum(buf, LLONG_MIN,
575 			    LLONG_MAX, &errstr);
576 			if (errstr) {
577 				yyerror("\"%s\" invalid number: %s",
578 				    buf, errstr);
579 				return findeol();
580 			}
581 			return NUMBER;
582 		} else {
583 nodigits:
584 			while (p > buf + 1)
585 				lungetc(*--p);
586 			c = *--p;
587 			if (c == '-')
588 				return c;
589 		}
590 	}
591 
592 #define allowed_in_string(x) \
593 	(isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \
594 	x != '{' && x != '}' && \
595 	x != '!' && x != '=' && x != '#' && \
596 	x != ','))
597 
598 	if (isalnum(c) || c == ':' || c == '_') {
599 		do {
600 			*p++ = c;
601 			if ((size_t)(p-buf) >= sizeof(buf)) {
602 				yyerror("string too long");
603 				return findeol();
604 			}
605 		} while ((c = lgetc(0)) != EOF && (allowed_in_string(c)));
606 		lungetc(c);
607 		*p = '\0';
608 		if ((token = lookup(buf)) == STRING)
609 			if ((yylval.v.string = strdup(buf)) == NULL)
610 				err(1, "yylex: strdup");
611 		return token;
612 	}
613 	if (c == '\n') {
614 		yylval.lineno = file->lineno;
615 		file->lineno++;
616 	}
617 	if (c == EOF)
618 		return 0;
619 	return c;
620 }
621 
622 int
623 check_file_secrecy(int fd, const char *fname)
624 {
625 	struct stat	st;
626 
627 	if (fstat(fd, &st)) {
628 		log_warn("cannot stat %s", fname);
629 		return -1;
630 	}
631 	if (st.st_uid != 0 && st.st_uid != getuid()) {
632 		log_warnx("%s: owner not root or current user", fname);
633 		return -1;
634 	}
635 	if (st.st_mode & (S_IWGRP | S_IXGRP | S_IRWXO)) {
636 		log_warnx("%s: group writable or world read/writable", fname);
637 		return -1;
638 	}
639 	return 0;
640 }
641 
642 struct file *
643 pushfile(const char *name, int secret)
644 {
645 	struct file	*nfile;
646 
647 	if ((nfile = calloc(1, sizeof(struct file))) == NULL) {
648 		log_warn("calloc");
649 		return NULL;
650 	}
651 	if ((nfile->name = strdup(name)) == NULL) {
652 		log_warn("strdup");
653 		free(nfile);
654 		return NULL;
655 	}
656 	if ((nfile->stream = fopen(nfile->name, "r")) == NULL) {
657 		log_warn("%s", nfile->name);
658 		free(nfile->name);
659 		free(nfile);
660 		return NULL;
661 	} else if (secret &&
662 	    check_file_secrecy(fileno(nfile->stream), nfile->name)) {
663 		fclose(nfile->stream);
664 		free(nfile->name);
665 		free(nfile);
666 		return NULL;
667 	}
668 	nfile->lineno = TAILQ_EMPTY(&files) ? 1 : 0;
669 	nfile->ungetsize = 16;
670 	nfile->ungetbuf = malloc(nfile->ungetsize);
671 	if (nfile->ungetbuf == NULL) {
672 		log_warn("malloc");
673 		fclose(nfile->stream);
674 		free(nfile->name);
675 		free(nfile);
676 		return NULL;
677 	}
678 	TAILQ_INSERT_TAIL(&files, nfile, entry);
679 	return nfile;
680 }
681 
682 int
683 popfile(void)
684 {
685 	struct file	*prev;
686 
687 	if ((prev = TAILQ_PREV(file, files, entry)) != NULL)
688 		prev->errors += file->errors;
689 
690 	TAILQ_REMOVE(&files, file, entry);
691 	fclose(file->stream);
692 	free(file->name);
693 	free(file->ungetbuf);
694 	free(file);
695 	file = prev;
696 	return file ? 0 : EOF;
697 }
698 
699 struct kd_conf *
700 parse_config(const char *filename)
701 {
702 	struct sym		*sym, *next;
703 
704 	counter = 0;
705 	conf = config_new_empty();
706 
707 	file = pushfile(filename, 0);
708 	if (file == NULL) {
709 		free(conf);
710 		return NULL;
711 	}
712 	topfile = file;
713 
714 	yyparse();
715 	errors = file->errors;
716 	popfile();
717 
718 	/* Free macros and check which have not been used. */
719 	TAILQ_FOREACH_SAFE(sym, &symhead, entry, next) {
720 		if (verbose && !sym->used)
721 			fprintf(stderr, "warning: macro '%s' not used\n",
722 			    sym->nam);
723 		if (!sym->persist) {
724 			free(sym->nam);
725 			free(sym->val);
726 			TAILQ_REMOVE(&symhead, sym, entry);
727 			free(sym);
728 		}
729 	}
730 
731 	if (errors) {
732 		clear_config(conf);
733 		return NULL;
734 	}
735 
736 	return conf;
737 }
738 
739 int
740 symset(const char *nam, const char *val, int persist)
741 {
742 	struct sym	*sym;
743 
744 	TAILQ_FOREACH(sym, &symhead, entry) {
745 		if (strcmp(nam, sym->nam) == 0)
746 			break;
747 	}
748 
749 	if (sym != NULL) {
750 		if (sym->persist == 1)
751 			return 0;
752 		else {
753 			free(sym->nam);
754 			free(sym->val);
755 			TAILQ_REMOVE(&symhead, sym, entry);
756 			free(sym);
757 		}
758 	}
759 	if ((sym = calloc(1, sizeof(*sym))) == NULL)
760 		return -1;
761 
762 	sym->nam = strdup(nam);
763 	if (sym->nam == NULL) {
764 		free(sym);
765 		return -1;
766 	}
767 	sym->val = strdup(val);
768 	if (sym->val == NULL) {
769 		free(sym->nam);
770 		free(sym);
771 		return -1;
772 	}
773 	sym->used = 0;
774 	sym->persist = persist;
775 	TAILQ_INSERT_TAIL(&symhead, sym, entry);
776 	return 0;
777 }
778 
779 int
780 cmdline_symset(char *s)
781 {
782 	char	*sym, *val;
783 	int	ret;
784 
785 	if ((val = strrchr(s, '=')) == NULL)
786 		return -1;
787 	sym = strndup(s, val - s);
788 	if (sym == NULL)
789 		errx(1, "%s: strndup", __func__);
790 	ret = symset(sym, val + 1, 1);
791 	free(sym);
792 
793 	return ret;
794 }
795 
796 char *
797 symget(const char *nam)
798 {
799 	struct sym	*sym;
800 
801 	TAILQ_FOREACH(sym, &symhead, entry) {
802 		if (strcmp(nam, sym->nam) == 0) {
803 			sym->used = 1;
804 			return sym->val;
805 		}
806 	}
807 	return NULL;
808 }
809 
810 void
811 clear_config(struct kd_conf *xconf)
812 {
813 	/* free stuff? */
814 
815 	free(xconf);
816 }
817 
818 static void
819 add_table(const char *name, const char *type, const char *path)
820 {
821 	if (table_open(conf, name, type, path) == -1)
822 		yyerror("can't initialize table %s", name);
823 	table = SIMPLEQ_FIRST(&conf->table_head)->table;
824 }
825 
826 static struct table *
827 findtable(const char *name)
828 {
829 	struct kd_tables_conf *i;
830 
831 	SIMPLEQ_FOREACH(i, &conf->table_head, entry) {
832 		if (!strcmp(i->table->t_name, name))
833 			return i->table;
834 	}
835 
836 	yyerror("unknown table %s", name);
837 	return NULL;
838 }
839 
840 static void
841 add_cert(const char *name, const char *path)
842 {
843 	struct kd_pki_conf *pki;
844 
845 	SIMPLEQ_FOREACH(pki, &conf->pki_head, entry) {
846 		if (strcmp(name, pki->name) != 0)
847 			continue;
848 
849 		if (pki->cert != NULL) {
850 			yyerror("duplicate `pki %s cert'", name);
851 			return;
852 		}
853 
854 		goto set;
855 	}
856 
857 	pki = xcalloc(1, sizeof(*pki));
858 	strlcpy(pki->name, name, sizeof(pki->name));
859 	SIMPLEQ_INSERT_HEAD(&conf->pki_head, pki, entry);
860 
861 set:
862 	if ((pki->cert = tls_load_file(path, &pki->certlen, NULL)) == NULL)
863 		fatal(NULL);
864 }
865 
866 static void
867 add_key(const char *name, const char *path)
868 {
869 	struct kd_pki_conf *pki;
870 
871 	SIMPLEQ_FOREACH(pki, &conf->pki_head, entry) {
872 		if (strcmp(name, pki->name) != 0)
873 			continue;
874 
875 		if (pki->key != NULL) {
876 			yyerror("duplicate `pki %s key'", name);
877 			return;
878 		}
879 
880 		goto set;
881 	}
882 
883 	pki = xcalloc(1, sizeof(*pki));
884 	strlcpy(pki->name, name, sizeof(pki->name));
885 	SIMPLEQ_INSERT_HEAD(&conf->pki_head, pki, entry);
886 
887 set:
888 	if ((pki->key = tls_load_file(path, &pki->keylen, NULL)) == NULL)
889 		fatal(NULL);
890 }
891 
892 static struct kd_listen_conf *
893 listen_new(void)
894 {
895 	struct kd_listen_conf *l;
896 
897 	l = xcalloc(1, sizeof(*l));
898 	l->id = counter++;
899 	l->fd = -1;
900 
901 	SIMPLEQ_INSERT_HEAD(&conf->listen_head, l, entry);
902 	return l;
903 }