1 /*
2 *
3 * CDDL HEADER START
4 *
5 * The contents of this file are subject to the terms of the
6 * Common Development and Distribution License (the "License").
7 * You may not use this file except in compliance with the License.
8 *
9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10 * or http://www.opensolaris.org/os/licensing.
11 * See the License for the specific language governing permissions
12 * and limitations under the License.
13 *
14 * When distributing Covered Code, include this CDDL HEADER in each
15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16 * If applicable, add the following below this CDDL HEADER, with the
17 * fields enclosed by brackets "[]" replaced with your own identifying
18 * information: Portions Copyright [yyyy] [name of copyright owner]
19 *
20 * CDDL HEADER END
21 */
22 /*
23 * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
24 * Use is subject to license terms.
25 * Copyright 2012 Milan Juri. All rights reserved.
26 * Copyright 2018 Joyent, Inc.
27 * Copyright 2018 OmniOS Community Edition (OmniOSce) Association.
28 * Copyright 2024 Oxide Computer Company
29 * Copyright 2026 Edgecast Cloud LLC.
30 */
31
32 #include <unistd.h>
33 #include <stdio.h>
34 #include <stdlib.h>
35 #include <stdarg.h>
36 #include <sys/types.h>
37 #include <sys/stat.h>
38 #include <fcntl.h>
39 #include <sys/sysconf.h>
40 #include <strings.h>
41 #include <ctype.h>
42 #include <errno.h>
43 #include <sys/socket.h>
44 #include <netdb.h>
45 #include <netinet/in.h>
46 #include <arpa/inet.h>
47 #include <net/pfkeyv2.h>
48 #include <net/pfpolicy.h>
49 #include <libintl.h>
50 #include <setjmp.h>
51 #include <libgen.h>
52 #include <libscf.h>
53 #include <kmfapi.h>
54 #include <ber_der.h>
55
56 #include "ipsec_util.h"
57 #include "ikedoor.h"
58
59 /*
60 * This file contains support functions that are shared by the ipsec
61 * utilities and daemons including ipseckey(8), ikeadm(8) and in.iked(8).
62 */
63
64
65 #define EFD(file) (((file) == stdout) ? stderr : (file))
66
67 /* Limits for interactive mode. */
68 #define MAX_LINE_LEN IBUF_SIZE
69 #define MAX_CMD_HIST 64000 /* in bytes */
70
71 /* Set standard default/initial values for globals... */
72 boolean_t pflag = B_FALSE; /* paranoid w.r.t. printing keying material */
73 boolean_t nflag = B_FALSE; /* avoid nameservice? */
74 boolean_t interactive = B_FALSE; /* util not running on cmdline */
75 boolean_t readfile = B_FALSE; /* cmds are being read from a file */
76 uint_t lineno = 0; /* track location if reading cmds from file */
77 uint_t lines_added = 0;
78 uint_t lines_parsed = 0;
79 jmp_buf env; /* for error recovery in interactive/readfile modes */
80 char *my_fmri = NULL;
81 FILE *debugfile = stderr;
82 static GetLine *gl = NULL; /* for interactive mode */
83
84 /*
85 * Print errno and exit if cmdline or readfile, reset state if interactive
86 * The error string *what should be dgettext()'d before calling bail().
87 */
88 void
bail(char * what)89 bail(char *what)
90 {
91 if (errno != 0)
92 warn(what);
93 else
94 warnx(dgettext(TEXT_DOMAIN, "Error: %s"), what);
95 if (readfile) {
96 return;
97 }
98 if (interactive && !readfile)
99 longjmp(env, 2);
100 EXIT_FATAL(NULL);
101 }
102
103 /*
104 * Print caller-supplied variable-arg error msg, then exit if cmdline or
105 * readfile, or reset state if interactive.
106 */
107 /*PRINTFLIKE1*/
108 void
bail_msg(char * fmt,...)109 bail_msg(char *fmt, ...)
110 {
111 va_list ap;
112 char msgbuf[BUFSIZ];
113
114 va_start(ap, fmt);
115 (void) vsnprintf(msgbuf, BUFSIZ, fmt, ap);
116 va_end(ap);
117 if (readfile)
118 warnx(dgettext(TEXT_DOMAIN,
119 "ERROR on line %u:\n%s\n"), lineno, msgbuf);
120 else
121 warnx(dgettext(TEXT_DOMAIN, "ERROR: %s\n"), msgbuf);
122
123 if (interactive && !readfile)
124 longjmp(env, 1);
125
126 EXIT_FATAL(NULL);
127 }
128
129 /*
130 * bytecnt2str() wrapper. Zeroes out the input buffer and if the number
131 * of bytes to be converted is more than 1K, it will produce readable string
132 * in parentheses, store it in the original buffer and return the pointer to it.
133 * Maximum length of the returned string is 14 characters (not including
134 * the terminating zero).
135 */
136 char *
bytecnt2out(uint64_t num,char * buf,size_t bufsiz,int flags)137 bytecnt2out(uint64_t num, char *buf, size_t bufsiz, int flags)
138 {
139 char *str;
140
141 (void) memset(buf, '\0', bufsiz);
142
143 if (num > 1024) {
144 /* Return empty string in case of out-of-memory. */
145 if ((str = malloc(bufsiz)) == NULL)
146 return (buf);
147
148 (void) bytecnt2str(num, str, bufsiz);
149 /* Detect overflow. */
150 if (strlen(str) == 0) {
151 free(str);
152 return (buf);
153 }
154
155 /* Emit nothing in case of overflow. */
156 if (snprintf(buf, bufsiz, "%s(%sB)%s",
157 flags & SPC_BEGIN ? " " : "", str,
158 flags & SPC_END ? " " : "") >= bufsiz)
159 (void) memset(buf, '\0', bufsiz);
160
161 free(str);
162 }
163
164 return (buf);
165 }
166
167 /*
168 * Convert 64-bit number to human readable string. Useful mainly for the
169 * byte lifetime counters. Returns pointer to the user supplied buffer.
170 * Able to convert up to Exabytes. Maximum length of the string produced
171 * is 9 characters (not counting the terminating zero).
172 */
173 char *
bytecnt2str(uint64_t num,char * buf,size_t buflen)174 bytecnt2str(uint64_t num, char *buf, size_t buflen)
175 {
176 uint64_t n = num;
177 char u;
178 int index = 0;
179
180 while (n >= 1024) {
181 n /= 1024;
182 index++;
183 }
184
185 /* The field has all units this function can represent. */
186 u = " KMGTPE"[index];
187
188 if (index == 0) {
189 /* Less than 1K */
190 if (snprintf(buf, buflen, "%llu ", num) >= buflen)
191 (void) memset(buf, '\0', buflen);
192 } else {
193 /* Otherwise display 2 precision digits. */
194 if (snprintf(buf, buflen, "%.2f %c",
195 (double)num / (1ULL << index * 10), u) >= buflen)
196 (void) memset(buf, '\0', buflen);
197 }
198
199 return (buf);
200 }
201
202 /*
203 * secs2str() wrapper. Zeroes out the input buffer and if the number of
204 * seconds to be converted is more than minute, it will produce readable
205 * string in parentheses, store it in the original buffer and return the
206 * pointer to it.
207 */
208 char *
secs2out(unsigned int secs,char * buf,int bufsiz,int flags)209 secs2out(unsigned int secs, char *buf, int bufsiz, int flags)
210 {
211 char *str;
212
213 (void) memset(buf, '\0', bufsiz);
214
215 if (secs > 60) {
216 /* Return empty string in case of out-of-memory. */
217 if ((str = malloc(bufsiz)) == NULL)
218 return (buf);
219
220 (void) secs2str(secs, str, bufsiz);
221 /* Detect overflow. */
222 if (strlen(str) == 0) {
223 free(str);
224 return (buf);
225 }
226
227 /* Emit nothing in case of overflow. */
228 if (snprintf(buf, bufsiz, "%s(%s)%s",
229 flags & SPC_BEGIN ? " " : "", str,
230 flags & SPC_END ? " " : "") >= bufsiz)
231 (void) memset(buf, '\0', bufsiz);
232
233 free(str);
234 }
235
236 return (buf);
237 }
238
239 /*
240 * Convert number of seconds to human readable string. Useful mainly for
241 * the lifetime counters. Returns pointer to the user supplied buffer.
242 * Able to convert up to days.
243 */
244 char *
secs2str(unsigned int secs,char * buf,int bufsiz)245 secs2str(unsigned int secs, char *buf, int bufsiz)
246 {
247 double val = secs;
248 char *unit = "second";
249
250 if (val >= 24*60*60) {
251 val /= 86400;
252 unit = "day";
253 } else if (val >= 60*60) {
254 val /= 60*60;
255 unit = "hour";
256 } else if (val >= 60) {
257 val /= 60;
258 unit = "minute";
259 }
260
261 /* Emit nothing in case of overflow. */
262 if (snprintf(buf, bufsiz, "%.2f %s%s", val, unit,
263 val >= 2 ? "s" : "") >= bufsiz)
264 (void) memset(buf, '\0', bufsiz);
265
266 return (buf);
267 }
268
269 /*
270 * dump_XXX functions produce ASCII output from various structures.
271 *
272 * Because certain errors need to do this to stderr, dump_XXX functions
273 * take a FILE pointer.
274 *
275 * If an error occured while writing to the specified file, these
276 * functions return -1, zero otherwise.
277 */
278
279 int
dump_sockaddr(struct sockaddr * sa,uint8_t prefixlen,boolean_t addr_only,FILE * where,boolean_t ignore_nss)280 dump_sockaddr(struct sockaddr *sa, uint8_t prefixlen, boolean_t addr_only,
281 FILE *where, boolean_t ignore_nss)
282 {
283 struct sockaddr_in *sin;
284 struct sockaddr_in6 *sin6;
285 char *printable_addr, *protocol;
286 uint8_t *addrptr;
287 /* Add 4 chars to hold '/nnn' for prefixes. */
288 char storage[INET6_ADDRSTRLEN + 4];
289 uint16_t port;
290 boolean_t unspec;
291 struct hostent *hp;
292 int getipnode_errno, addrlen;
293
294 switch (sa->sa_family) {
295 case AF_INET:
296 /* LINTED E_BAD_PTR_CAST_ALIGN */
297 sin = (struct sockaddr_in *)sa;
298 addrptr = (uint8_t *)&sin->sin_addr;
299 port = sin->sin_port;
300 protocol = "AF_INET";
301 unspec = (sin->sin_addr.s_addr == 0);
302 addrlen = sizeof (sin->sin_addr);
303 break;
304 case AF_INET6:
305 /* LINTED E_BAD_PTR_CAST_ALIGN */
306 sin6 = (struct sockaddr_in6 *)sa;
307 addrptr = (uint8_t *)&sin6->sin6_addr;
308 port = sin6->sin6_port;
309 protocol = "AF_INET6";
310 unspec = IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr);
311 addrlen = sizeof (sin6->sin6_addr);
312 break;
313 default:
314 return (0);
315 }
316
317 if (inet_ntop(sa->sa_family, addrptr, storage, INET6_ADDRSTRLEN) ==
318 NULL) {
319 printable_addr = dgettext(TEXT_DOMAIN, "Invalid IP address.");
320 } else {
321 char prefix[5]; /* "/nnn" with terminator. */
322
323 (void) snprintf(prefix, sizeof (prefix), "/%d", prefixlen);
324 printable_addr = storage;
325 if (prefixlen != 0) {
326 (void) strlcat(printable_addr, prefix,
327 sizeof (storage));
328 }
329 }
330 if (addr_only) {
331 if (fprintf(where, "%s", printable_addr) < 0)
332 return (-1);
333 } else {
334 if (fprintf(where, dgettext(TEXT_DOMAIN,
335 "%s: port %d, %s"), protocol,
336 ntohs(port), printable_addr) < 0)
337 return (-1);
338 if (ignore_nss == B_FALSE) {
339 /*
340 * Do AF_independent reverse hostname lookup here.
341 */
342 if (unspec) {
343 if (fprintf(where,
344 dgettext(TEXT_DOMAIN,
345 " <unspecified>")) < 0)
346 return (-1);
347 } else {
348 hp = getipnodebyaddr((char *)addrptr, addrlen,
349 sa->sa_family, &getipnode_errno);
350 if (hp != NULL) {
351 if (fprintf(where,
352 " (%s)", hp->h_name) < 0)
353 return (-1);
354 freehostent(hp);
355 } else {
356 if (fprintf(where,
357 dgettext(TEXT_DOMAIN,
358 " <unknown>")) < 0)
359 return (-1);
360 }
361 }
362 }
363 if (fputs(".\n", where) == EOF)
364 return (-1);
365 }
366 return (0);
367 }
368
369 /*
370 * Dump a key, any salt and bitlen.
371 * The key is made up of a stream of bits. If the algorithm requires a salt
372 * value, this will also be part of the dumped key. The last "saltbits" of the
373 * key string, reading left to right will be the salt value. To make it easier
374 * to see which bits make up the key, the salt value is enclosed in []'s.
375 * This function can also be called when ipseckey(8) -s is run, this "saves"
376 * the SAs, including the key to a file. When this is the case, the []'s are
377 * not printed.
378 *
379 * The implementation allows the kernel to be told about the length of the salt
380 * in whole bytes only. If this changes, this function will need to be updated.
381 */
382 int
dump_key(uint8_t * keyp,uint_t bitlen,uint_t saltbits,FILE * where,boolean_t separate_salt)383 dump_key(uint8_t *keyp, uint_t bitlen, uint_t saltbits, FILE *where,
384 boolean_t separate_salt)
385 {
386 int numbytes, saltbytes;
387
388 numbytes = SADB_1TO8(bitlen);
389 saltbytes = SADB_1TO8(saltbits);
390 numbytes += saltbytes;
391
392 /* The & 0x7 is to check for leftover bits. */
393 if ((bitlen & 0x7) != 0)
394 numbytes++;
395
396 while (numbytes-- != 0) {
397 if (pflag) {
398 /* Print no keys if paranoid */
399 if (fprintf(where, "XX") < 0)
400 return (-1);
401 } else {
402 if (fprintf(where, "%02x", *keyp++) < 0)
403 return (-1);
404 }
405 if (separate_salt && saltbytes != 0 &&
406 numbytes == saltbytes) {
407 if (fprintf(where, "[") < 0)
408 return (-1);
409 }
410 }
411
412 if (separate_salt && saltbits != 0) {
413 if (fprintf(where, "]/%u+%u", bitlen, saltbits) < 0)
414 return (-1);
415 } else {
416 if (fprintf(where, "/%u", bitlen + saltbits) < 0)
417 return (-1);
418 }
419
420 return (0);
421 }
422
423 int
dump_keystr(uint8_t * keystr,uint_t bitlen,FILE * where)424 dump_keystr(uint8_t *keystr, uint_t bitlen, FILE *where)
425 {
426 size_t keylen;
427 uint_t i;
428
429 /* There should be no leftover bits for a key string */
430 if ((bitlen & 0x7) != 0)
431 return (-1);
432
433 keylen = SADB_1TO8(bitlen);
434
435 for (i = 0; i < keylen; i++) {
436 if (pflag)
437 (void) fprintf(where, "XX");
438 else if (isprint(keystr[i]))
439 (void) fprintf(where, "%c", keystr[i]);
440 else
441 (void) fprintf(where, "\\x%x", keystr[i]);
442 }
443
444 return (0);
445 }
446
447
448 static struct tcpsigalg {
449 uint8_t ta_value;
450 const char *ta_name;
451 } tcpalgs[] = {
452 { .ta_name = "md5", .ta_value = SADB_AALG_MD5 }
453 };
454
455 uint8_t
gettcpsigalgbyname(const char * name)456 gettcpsigalgbyname(const char *name)
457 {
458 uint_t i;
459
460 for (i = 0; i < ARRAY_SIZE(tcpalgs); i++) {
461 if (strcmp(name, tcpalgs[i].ta_name) == 0)
462 return (tcpalgs[i].ta_value);
463 }
464 return (0);
465 }
466
467 const char *
gettcpsigalgbynum(uint8_t num)468 gettcpsigalgbynum(uint8_t num)
469 {
470 uint_t i;
471
472 for (i = 0; i < ARRAY_SIZE(tcpalgs); i++) {
473 if (num == tcpalgs[i].ta_value)
474 return (tcpalgs[i].ta_name);
475 }
476 return (NULL);
477 }
478
479 /*
480 * Print an authentication or encryption algorithm
481 */
482 static int
dump_generic_alg(uint8_t alg_num,int proto_num,FILE * where)483 dump_generic_alg(uint8_t alg_num, int proto_num, FILE *where)
484 {
485 struct ipsecalgent *alg;
486
487 alg = getipsecalgbynum(alg_num, proto_num, NULL);
488 if (alg == NULL) {
489 if (fprintf(where, dgettext(TEXT_DOMAIN,
490 "<unknown %u>"), alg_num) < 0)
491 return (-1);
492 return (0);
493 }
494
495 /*
496 * Special-case <none> for backward output compat.
497 * Assume that SADB_AALG_NONE == SADB_EALG_NONE.
498 */
499 if (alg_num == SADB_AALG_NONE) {
500 if (fputs(dgettext(TEXT_DOMAIN,
501 "<none>"), where) == EOF)
502 return (-1);
503 } else {
504 if (fputs(alg->a_names[0], where) == EOF)
505 return (-1);
506 }
507
508 freeipsecalgent(alg);
509 return (0);
510 }
511
512 int
dump_aalg(uint8_t aalg,FILE * where)513 dump_aalg(uint8_t aalg, FILE *where)
514 {
515 return (dump_generic_alg(aalg, IPSEC_PROTO_AH, where));
516 }
517
518 int
dump_ealg(uint8_t ealg,FILE * where)519 dump_ealg(uint8_t ealg, FILE *where)
520 {
521 return (dump_generic_alg(ealg, IPSEC_PROTO_ESP, where));
522 }
523
524 int
dump_tcpsigalg(uint8_t aalg,FILE * where)525 dump_tcpsigalg(uint8_t aalg, FILE *where)
526 {
527 const char *name = gettcpsigalgbynum(aalg);
528
529 if (name == NULL) {
530 if (fprintf(where, dgettext(TEXT_DOMAIN,
531 "<unknown %u>"), aalg) < 0) {
532 return (-1);
533 }
534 return (0);
535 }
536
537 if (fputs(name, where) == EOF)
538 return (-1);
539
540 return (0);
541 }
542
543 /*
544 * Print an SADB_IDENTTYPE string
545 *
546 * Also return TRUE if the actual ident may be printed, FALSE if not.
547 *
548 * If rc is not NULL, set its value to -1 if an error occured while writing
549 * to the specified file, zero otherwise.
550 */
551 boolean_t
dump_sadb_idtype(uint8_t idtype,FILE * where,int * rc)552 dump_sadb_idtype(uint8_t idtype, FILE *where, int *rc)
553 {
554 boolean_t canprint = B_TRUE;
555 int rc_val = 0;
556
557 switch (idtype) {
558 case SADB_IDENTTYPE_PREFIX:
559 if (fputs(dgettext(TEXT_DOMAIN, "prefix"), where) == EOF)
560 rc_val = -1;
561 break;
562 case SADB_IDENTTYPE_FQDN:
563 if (fputs(dgettext(TEXT_DOMAIN, "FQDN"), where) == EOF)
564 rc_val = -1;
565 break;
566 case SADB_IDENTTYPE_USER_FQDN:
567 if (fputs(dgettext(TEXT_DOMAIN,
568 "user-FQDN (mbox)"), where) == EOF)
569 rc_val = -1;
570 break;
571 case SADB_X_IDENTTYPE_DN:
572 if (fputs(dgettext(TEXT_DOMAIN, "ASN.1 DER Distinguished Name"),
573 where) == EOF)
574 rc_val = -1;
575 canprint = B_FALSE;
576 break;
577 case SADB_X_IDENTTYPE_GN:
578 if (fputs(dgettext(TEXT_DOMAIN, "ASN.1 DER Generic Name"),
579 where) == EOF)
580 rc_val = -1;
581 canprint = B_FALSE;
582 break;
583 case SADB_X_IDENTTYPE_KEY_ID:
584 if (fputs(dgettext(TEXT_DOMAIN, "Generic key id"),
585 where) == EOF)
586 rc_val = -1;
587 break;
588 case SADB_X_IDENTTYPE_ADDR_RANGE:
589 if (fputs(dgettext(TEXT_DOMAIN, "Address range"), where) == EOF)
590 rc_val = -1;
591 break;
592 default:
593 if (fprintf(where, dgettext(TEXT_DOMAIN,
594 "<unknown %u>"), idtype) < 0)
595 rc_val = -1;
596 break;
597 }
598
599 if (rc != NULL)
600 *rc = rc_val;
601
602 return (canprint);
603 }
604
605 /*
606 * Slice an argv/argc vector from an interactive line or a read-file line.
607 */
608 static int
create_argv(char * ibuf,int * newargc,char *** thisargv)609 create_argv(char *ibuf, int *newargc, char ***thisargv)
610 {
611 unsigned int argvlen = START_ARG;
612 char **current;
613 boolean_t firstchar = B_TRUE;
614 boolean_t inquotes = B_FALSE;
615
616 *thisargv = malloc(sizeof (char *) * argvlen);
617 if ((*thisargv) == NULL)
618 return (MEMORY_ALLOCATION);
619 current = *thisargv;
620 *current = NULL;
621
622 for (; *ibuf != '\0'; ibuf++) {
623 if (isspace(*ibuf)) {
624 if (inquotes) {
625 continue;
626 }
627 if (*current != NULL) {
628 *ibuf = '\0';
629 current++;
630 if (*thisargv + argvlen == current) {
631 /* Regrow ***thisargv. */
632 if (argvlen == TOO_MANY_ARGS) {
633 free(*thisargv);
634 return (TOO_MANY_TOKENS);
635 }
636 /* Double the allocation. */
637 current = realloc(*thisargv,
638 sizeof (char *) * (argvlen << 1));
639 if (current == NULL) {
640 free(*thisargv);
641 return (MEMORY_ALLOCATION);
642 }
643 *thisargv = current;
644 current += argvlen;
645 argvlen <<= 1; /* Double the size. */
646 }
647 *current = NULL;
648 }
649 } else {
650 if (firstchar) {
651 firstchar = B_FALSE;
652 if (*ibuf == COMMENT_CHAR || *ibuf == '\n') {
653 free(*thisargv);
654 return (COMMENT_LINE);
655 }
656 }
657 if (*ibuf == QUOTE_CHAR) {
658 if (inquotes) {
659 inquotes = B_FALSE;
660 *ibuf = '\0';
661 } else {
662 inquotes = B_TRUE;
663 }
664 continue;
665 }
666 if (*current == NULL) {
667 *current = ibuf;
668 (*newargc)++;
669 }
670 }
671 }
672
673 /*
674 * Tricky corner case...
675 * I've parsed _exactly_ the amount of args as I have space. It
676 * won't return NULL-terminated, and bad things will happen to
677 * the caller.
678 */
679 if (argvlen == *newargc) {
680 current = realloc(*thisargv, sizeof (char *) * (argvlen + 1));
681 if (current == NULL) {
682 free(*thisargv);
683 return (MEMORY_ALLOCATION);
684 }
685 *thisargv = current;
686 current[argvlen] = NULL;
687 }
688
689 return (SUCCESS);
690 }
691
692 /*
693 * init interactive mode if needed and not yet initialized
694 */
695 static void
init_interactive(FILE * infile,CplMatchFn * match_fn)696 init_interactive(FILE *infile, CplMatchFn *match_fn)
697 {
698 if (infile == stdin) {
699 if (gl == NULL) {
700 if ((gl = new_GetLine(MAX_LINE_LEN,
701 MAX_CMD_HIST)) == NULL)
702 errx(1, dgettext(TEXT_DOMAIN,
703 "tecla initialization failed"));
704
705 if (gl_customize_completion(gl, NULL,
706 match_fn) != 0) {
707 (void) del_GetLine(gl);
708 errx(1, dgettext(TEXT_DOMAIN,
709 "tab completion failed to initialize"));
710 }
711
712 /*
713 * In interactive mode we only want to terminate
714 * when explicitly requested (e.g. by a command).
715 */
716 (void) sigset(SIGINT, SIG_IGN);
717 }
718 } else {
719 readfile = B_TRUE;
720 }
721 }
722
723 /*
724 * free tecla data structure
725 */
726 static void
fini_interactive(void)727 fini_interactive(void)
728 {
729 if (gl != NULL)
730 (void) del_GetLine(gl);
731 }
732
733 /*
734 * Get single input line, wrapping around interactive and non-interactive
735 * mode.
736 */
737 static char *
do_getstr(FILE * infile,char * prompt,char * ibuf,size_t ibuf_size)738 do_getstr(FILE *infile, char *prompt, char *ibuf, size_t ibuf_size)
739 {
740 char *line;
741
742 if (infile != stdin)
743 return (fgets(ibuf, ibuf_size, infile));
744
745 /*
746 * If the user hits ^C then we want to catch it and
747 * start over. If the user hits EOF then we want to
748 * bail out.
749 */
750 once_again:
751 line = gl_get_line(gl, prompt, NULL, -1);
752 if (gl_return_status(gl) == GLR_SIGNAL) {
753 gl_abandon_line(gl);
754 goto once_again;
755 } else if (gl_return_status(gl) == GLR_ERROR) {
756 gl_abandon_line(gl);
757 errx(1, dgettext(TEXT_DOMAIN, "Error reading terminal: %s\n"),
758 gl_error_message(gl, NULL, 0));
759 } else {
760 if (line != NULL) {
761 if (strlcpy(ibuf, line, ibuf_size) >= ibuf_size)
762 warnx(dgettext(TEXT_DOMAIN,
763 "Line too long (max=%zu chars)"),
764 ibuf_size);
765 line = ibuf;
766 }
767 }
768
769 return (line);
770 }
771
772 /*
773 * Enter a mode where commands are read from a file. Treat stdin special.
774 */
775 void
do_interactive(FILE * infile,char * configfile,char * promptstring,char * my_fmri,parse_cmdln_fn parseit,CplMatchFn * match_fn)776 do_interactive(FILE *infile, char *configfile, char *promptstring,
777 char *my_fmri, parse_cmdln_fn parseit, CplMatchFn *match_fn)
778 {
779 char ibuf[IBUF_SIZE], holder[IBUF_SIZE];
780 char *volatile hptr, **thisargv, *ebuf;
781 int thisargc;
782 volatile boolean_t continue_in_progress = B_FALSE;
783 char *s;
784
785 (void) setjmp(env);
786
787 ebuf = NULL;
788 interactive = B_TRUE;
789 bzero(ibuf, IBUF_SIZE);
790
791 /* panics for us */
792 init_interactive(infile, match_fn);
793
794 while ((s = do_getstr(infile, promptstring, ibuf, IBUF_SIZE)) != NULL) {
795 if (readfile)
796 lineno++;
797 thisargc = 0;
798 thisargv = NULL;
799
800 /*
801 * Check byte IBUF_SIZE - 2, because byte IBUF_SIZE - 1 will
802 * be null-terminated because of fgets().
803 */
804 if (ibuf[IBUF_SIZE - 2] != '\0') {
805 if (infile == stdin) {
806 /* do_getstr() issued a warning already */
807 bzero(ibuf, IBUF_SIZE);
808 continue;
809 } else {
810 ipsecutil_exit(SERVICE_FATAL, my_fmri,
811 debugfile, dgettext(TEXT_DOMAIN,
812 "Line %d too big."), lineno);
813 }
814 }
815
816 if (!continue_in_progress) {
817 /* Use -2 because of \n from fgets. */
818 if (ibuf[strlen(ibuf) - 2] == CONT_CHAR) {
819 /*
820 * Can use strcpy here, I've checked the
821 * length already.
822 */
823 (void) strcpy(holder, ibuf);
824 hptr = &(holder[strlen(holder)]);
825
826 /* Remove the CONT_CHAR from the string. */
827 hptr[-2] = ' ';
828
829 continue_in_progress = B_TRUE;
830 bzero(ibuf, IBUF_SIZE);
831 continue;
832 }
833 } else {
834 /* Handle continuations... */
835 (void) strncpy(hptr, ibuf,
836 (size_t)(&(holder[IBUF_SIZE]) - hptr));
837 if (holder[IBUF_SIZE - 1] != '\0') {
838 ipsecutil_exit(SERVICE_FATAL, my_fmri,
839 debugfile, dgettext(TEXT_DOMAIN,
840 "Command buffer overrun."));
841 }
842 /* Use - 2 because of \n from fgets. */
843 if (hptr[strlen(hptr) - 2] == CONT_CHAR) {
844 bzero(ibuf, IBUF_SIZE);
845 hptr += strlen(hptr);
846
847 /* Remove the CONT_CHAR from the string. */
848 hptr[-2] = ' ';
849
850 continue;
851 } else {
852 continue_in_progress = B_FALSE;
853 /*
854 * I've already checked the length...
855 */
856 (void) strcpy(ibuf, holder);
857 }
858 }
859
860 /*
861 * Just in case the command fails keep a copy of the
862 * command buffer for diagnostic output.
863 */
864 if (readfile) {
865 /*
866 * The error buffer needs to be big enough to
867 * hold the longest command string, plus
868 * some extra text, see below.
869 */
870 ebuf = calloc((IBUF_SIZE * 2), sizeof (char));
871 if (ebuf == NULL) {
872 ipsecutil_exit(SERVICE_FATAL, my_fmri,
873 debugfile, dgettext(TEXT_DOMAIN,
874 "Memory allocation error."));
875 } else {
876 (void) snprintf(ebuf, (IBUF_SIZE * 2),
877 dgettext(TEXT_DOMAIN,
878 "Config file entry near line %u "
879 "caused error(s) or warnings:\n\n%s\n\n"),
880 lineno, ibuf);
881 }
882 }
883
884 switch (create_argv(ibuf, &thisargc, &thisargv)) {
885 case TOO_MANY_TOKENS:
886 ipsecutil_exit(SERVICE_BADCONF, my_fmri, debugfile,
887 dgettext(TEXT_DOMAIN, "Too many input tokens."));
888 break;
889 case MEMORY_ALLOCATION:
890 ipsecutil_exit(SERVICE_BADCONF, my_fmri, debugfile,
891 dgettext(TEXT_DOMAIN, "Memory allocation error."));
892 break;
893 case COMMENT_LINE:
894 /* Comment line. */
895 free(ebuf);
896 break;
897 default:
898 if (thisargc != 0) {
899 lines_parsed++;
900 /* ebuf consumed */
901 parseit(thisargc, thisargv, ebuf, readfile);
902 } else {
903 free(ebuf);
904 }
905 free(thisargv);
906 if (infile == stdin) {
907 (void) printf("%s", promptstring);
908 (void) fflush(stdout);
909 }
910 break;
911 }
912 bzero(ibuf, IBUF_SIZE);
913 }
914
915 /*
916 * The following code is ipseckey specific. This should never be
917 * used by ikeadm which also calls this function because ikeadm
918 * only runs interactively. If this ever changes this code block
919 * sould be revisited.
920 */
921 if (readfile) {
922 if (lines_parsed != 0 && lines_added == 0) {
923 ipsecutil_exit(SERVICE_BADCONF, my_fmri, debugfile,
924 dgettext(TEXT_DOMAIN, "Configuration file did not "
925 "contain any valid SAs"));
926 }
927
928 /*
929 * There were errors. Putting the service in maintenance mode.
930 * When svc.startd(8) allows services to degrade themselves,
931 * this should be revisited.
932 *
933 * If this function was called from a program running as a
934 * smf_method(7), print a warning message. Don't spew out the
935 * errors as these will end up in the smf(7) log file which is
936 * publically readable, the errors may contain sensitive
937 * information.
938 */
939 if ((lines_added < lines_parsed) && (configfile != NULL)) {
940 if (my_fmri != NULL) {
941 ipsecutil_exit(SERVICE_BADCONF, my_fmri,
942 debugfile, dgettext(TEXT_DOMAIN,
943 "The configuration file contained %d "
944 "errors.\n"
945 "Manually check the configuration with:\n"
946 "ipseckey -c %s\n"
947 "Use svcadm(8) to clear maintenance "
948 "condition when errors are resolved.\n"),
949 lines_parsed - lines_added, configfile);
950 } else {
951 EXIT_BADCONFIG(NULL);
952 }
953 } else {
954 if (my_fmri != NULL)
955 ipsecutil_exit(SERVICE_EXIT_OK, my_fmri,
956 debugfile, dgettext(TEXT_DOMAIN,
957 "%d actions successfully processed."),
958 lines_added);
959 }
960 } else {
961 /* no newline upon Ctrl-D */
962 if (s != NULL)
963 (void) putchar('\n');
964 (void) fflush(stdout);
965 }
966
967 fini_interactive();
968
969 EXIT_OK(NULL);
970 }
971
972 /*
973 * Functions to parse strings that represent a debug or privilege level.
974 * These functions are copied from main.c and door.c in usr.lib/in.iked/common.
975 * If this file evolves into a common library that may be used by in.iked
976 * as well as the usr.sbin utilities, those duplicate functions should be
977 * deleted.
978 *
979 * A privilege level may be represented by a simple keyword, corresponding
980 * to one of the possible levels. A debug level may be represented by a
981 * series of keywords, separated by '+' or '-', indicating categories to
982 * be added or removed from the set of categories in the debug level.
983 * For example, +all-op corresponds to level 0xfffffffb (all flags except
984 * for D_OP set); while p1+p2+pfkey corresponds to level 0x38. Note that
985 * the leading '+' is implicit; the first keyword in the list must be for
986 * a category that is to be added.
987 *
988 * These parsing functions make use of a local version of strtok, strtok_d,
989 * which includes an additional parameter, char *delim. This param is filled
990 * in with the character which ends the returned token. In other words,
991 * this version of strtok, in addition to returning the token, also returns
992 * the single character delimiter from the original string which marked the
993 * end of the token.
994 */
995 static char *
strtok_d(char * string,const char * sepset,char * delim)996 strtok_d(char *string, const char *sepset, char *delim)
997 {
998 static char *lasts;
999 char *q, *r;
1000
1001 /* first or subsequent call */
1002 if (string == NULL)
1003 string = lasts;
1004
1005 if (string == 0) /* return if no tokens remaining */
1006 return (NULL);
1007
1008 q = string + strspn(string, sepset); /* skip leading separators */
1009
1010 if (*q == '\0') /* return if no tokens remaining */
1011 return (NULL);
1012
1013 if ((r = strpbrk(q, sepset)) == NULL) { /* move past token */
1014 lasts = 0; /* indicate that this is last token */
1015 } else {
1016 *delim = *r; /* save delimitor */
1017 *r = '\0';
1018 lasts = r + 1;
1019 }
1020 return (q);
1021 }
1022
1023 static keywdtab_t privtab[] = {
1024 { IKE_PRIV_MINIMUM, "base" },
1025 { IKE_PRIV_MODKEYS, "modkeys" },
1026 { IKE_PRIV_KEYMAT, "keymat" },
1027 { IKE_PRIV_MINIMUM, "0" },
1028 };
1029
1030 int
privstr2num(char * str)1031 privstr2num(char *str)
1032 {
1033 keywdtab_t *pp;
1034 char *endp;
1035 int priv;
1036
1037 for (pp = privtab; pp < A_END(privtab); pp++) {
1038 if (strcasecmp(str, pp->kw_str) == 0)
1039 return (pp->kw_tag);
1040 }
1041
1042 priv = strtol(str, &endp, 0);
1043 if (*endp == '\0')
1044 return (priv);
1045
1046 return (-1);
1047 }
1048
1049 static keywdtab_t dbgtab[] = {
1050 { D_CERT, "cert" },
1051 { D_KEY, "key" },
1052 { D_OP, "op" },
1053 { D_P1, "p1" },
1054 { D_P1, "phase1" },
1055 { D_P2, "p2" },
1056 { D_P2, "phase2" },
1057 { D_PFKEY, "pfkey" },
1058 { D_POL, "pol" },
1059 { D_POL, "policy" },
1060 { D_PROP, "prop" },
1061 { D_DOOR, "door" },
1062 { D_CONFIG, "config" },
1063 { D_LABEL, "label" },
1064 { D_ALL, "all" },
1065 { 0, "0" },
1066 };
1067
1068 int
dbgstr2num(char * str)1069 dbgstr2num(char *str)
1070 {
1071 keywdtab_t *dp;
1072
1073 for (dp = dbgtab; dp < A_END(dbgtab); dp++) {
1074 if (strcasecmp(str, dp->kw_str) == 0)
1075 return (dp->kw_tag);
1076 }
1077 return (D_INVALID);
1078 }
1079
1080 int
parsedbgopts(char * optarg)1081 parsedbgopts(char *optarg)
1082 {
1083 char *argp, *endp, op, nextop;
1084 int mask = 0, new;
1085
1086 mask = strtol(optarg, &endp, 0);
1087 if (*endp == '\0')
1088 return (mask);
1089
1090 op = optarg[0];
1091 if (op != '-')
1092 op = '+';
1093 argp = strtok_d(optarg, "+-", &nextop);
1094 do {
1095 new = dbgstr2num(argp);
1096 if (new == D_INVALID) {
1097 /* we encountered an invalid keywd */
1098 return (new);
1099 }
1100 if (op == '+') {
1101 mask |= new;
1102 } else {
1103 mask &= ~new;
1104 }
1105 op = nextop;
1106 } while ((argp = strtok_d(NULL, "+-", &nextop)) != NULL);
1107
1108 return (mask);
1109 }
1110
1111
1112 /*
1113 * functions to manipulate the kmcookie-label mapping file
1114 */
1115
1116 /*
1117 * Open, lockf, fdopen the given file, returning a FILE * on success,
1118 * or NULL on failure.
1119 */
1120 FILE *
kmc_open_and_lock(char * name)1121 kmc_open_and_lock(char *name)
1122 {
1123 int fd, rtnerr;
1124 FILE *fp;
1125
1126 if ((fd = open(name, O_RDWR | O_CREAT, S_IRUSR | S_IWUSR)) < 0) {
1127 return (NULL);
1128 }
1129 if (lockf(fd, F_LOCK, 0) < 0) {
1130 return (NULL);
1131 }
1132 if ((fp = fdopen(fd, "a+")) == NULL) {
1133 return (NULL);
1134 }
1135 if (fseek(fp, 0, SEEK_SET) < 0) {
1136 /* save errno in case fclose changes it */
1137 rtnerr = errno;
1138 (void) fclose(fp);
1139 errno = rtnerr;
1140 return (NULL);
1141 }
1142 return (fp);
1143 }
1144
1145 /*
1146 * Extract an integer cookie and string label from a line from the
1147 * kmcookie-label file. Return -1 on failure, 0 on success.
1148 */
1149 int
kmc_parse_line(char * line,int * cookie,char ** label)1150 kmc_parse_line(char *line, int *cookie, char **label)
1151 {
1152 char *cookiestr;
1153
1154 *cookie = 0;
1155 *label = NULL;
1156
1157 cookiestr = strtok(line, " \t\n");
1158 if (cookiestr == NULL) {
1159 return (-1);
1160 }
1161
1162 /* Everything that follows, up to the newline, is the label. */
1163 *label = strtok(NULL, "\n");
1164 if (*label == NULL) {
1165 return (-1);
1166 }
1167
1168 *cookie = atoi(cookiestr);
1169 return (0);
1170 }
1171
1172 /*
1173 * Insert a mapping into the file (if it's not already there), given the
1174 * new label. Return the assigned cookie, or -1 on error.
1175 */
1176 int
kmc_insert_mapping(char * label)1177 kmc_insert_mapping(char *label)
1178 {
1179 FILE *map;
1180 char linebuf[IBUF_SIZE];
1181 char *cur_label;
1182 int max_cookie = 0, cur_cookie, rtn_cookie;
1183 int rtnerr = 0;
1184 boolean_t found = B_FALSE;
1185
1186 /* open and lock the file; will sleep until lock is available */
1187 if ((map = kmc_open_and_lock(KMCFILE)) == NULL) {
1188 /* kmc_open_and_lock() sets errno appropriately */
1189 return (-1);
1190 }
1191
1192 while (fgets(linebuf, sizeof (linebuf), map) != NULL) {
1193
1194 /* Skip blank lines, which often come near EOF. */
1195 if (strlen(linebuf) == 0)
1196 continue;
1197
1198 if (kmc_parse_line(linebuf, &cur_cookie, &cur_label) < 0) {
1199 rtnerr = EINVAL;
1200 goto error;
1201 }
1202
1203 if (cur_cookie > max_cookie)
1204 max_cookie = cur_cookie;
1205
1206 if ((!found) && (strcmp(cur_label, label) == 0)) {
1207 found = B_TRUE;
1208 rtn_cookie = cur_cookie;
1209 }
1210 }
1211
1212 if (!found) {
1213 rtn_cookie = ++max_cookie;
1214 if ((fprintf(map, "%u\t%s\n", rtn_cookie, label) < 0) ||
1215 (fflush(map) < 0)) {
1216 rtnerr = errno;
1217 goto error;
1218 }
1219 }
1220 (void) fclose(map);
1221
1222 return (rtn_cookie);
1223
1224 error:
1225 (void) fclose(map);
1226 errno = rtnerr;
1227 return (-1);
1228 }
1229
1230 /*
1231 * Lookup the given cookie and return its corresponding label. Return
1232 * a pointer to the label on success, NULL on error (or if the label is
1233 * not found). Note that the returned label pointer points to a static
1234 * string, so the label will be overwritten by a subsequent call to the
1235 * function; the function is also not thread-safe as a result.
1236 *
1237 * Because this is possibly publically exported, do not change its name,
1238 * but this is for all intents and purposes an IKEv1/in.iked function.
1239 */
1240 char *
kmc_lookup_by_cookie(int cookie)1241 kmc_lookup_by_cookie(int cookie)
1242 {
1243 FILE *map;
1244 static char linebuf[IBUF_SIZE];
1245 char *cur_label;
1246 int cur_cookie;
1247
1248 if ((map = kmc_open_and_lock(KMCFILE)) == NULL) {
1249 return (NULL);
1250 }
1251
1252 while (fgets(linebuf, sizeof (linebuf), map) != NULL) {
1253
1254 if (kmc_parse_line(linebuf, &cur_cookie, &cur_label) < 0) {
1255 (void) fclose(map);
1256 return (NULL);
1257 }
1258
1259 if (cookie == cur_cookie) {
1260 (void) fclose(map);
1261 return (cur_label);
1262 }
1263 }
1264 (void) fclose(map);
1265
1266 return (NULL);
1267 }
1268
1269 /*
1270 * Parse basic extension headers and return in the passed-in pointer vector.
1271 * Return values include:
1272 *
1273 * KGE_OK Everything's nice and parsed out.
1274 * If there are no extensions, place NULL in extv[0].
1275 * KGE_DUP There is a duplicate extension.
1276 * First instance in appropriate bin. First duplicate in
1277 * extv[0].
1278 * KGE_UNK Unknown extension type encountered. extv[0] contains
1279 * unknown header.
1280 * KGE_LEN Extension length error.
1281 * KGE_CHK High-level reality check failed on specific extension.
1282 *
1283 * My apologies for some of the pointer arithmetic in here. I'm thinking
1284 * like an assembly programmer, yet trying to make the compiler happy.
1285 */
1286 int
spdsock_get_ext(spd_ext_t * extv[],spd_msg_t * basehdr,uint_t msgsize,char * diag_buf,uint_t diag_buf_len)1287 spdsock_get_ext(spd_ext_t *extv[], spd_msg_t *basehdr, uint_t msgsize,
1288 char *diag_buf, uint_t diag_buf_len)
1289 {
1290 int i;
1291
1292 if (diag_buf != NULL)
1293 diag_buf[0] = '\0';
1294
1295 for (i = 1; i <= SPD_EXT_MAX; i++)
1296 extv[i] = NULL;
1297
1298 i = 0;
1299 /* Use extv[0] as the "current working pointer". */
1300
1301 extv[0] = (spd_ext_t *)(basehdr + 1);
1302 msgsize = SPD_64TO8(msgsize);
1303
1304 while ((char *)extv[0] < ((char *)basehdr + msgsize)) {
1305 /* Check for unknown headers. */
1306 i++;
1307 if (extv[0]->spd_ext_type == 0 ||
1308 extv[0]->spd_ext_type > SPD_EXT_MAX) {
1309 if (diag_buf != NULL) {
1310 (void) snprintf(diag_buf, diag_buf_len,
1311 "spdsock ext 0x%X unknown: 0x%X",
1312 i, extv[0]->spd_ext_type);
1313 }
1314 return (KGE_UNK);
1315 }
1316
1317 /*
1318 * Check length. Use uint64_t because extlen is in units
1319 * of 64-bit words. If length goes beyond the msgsize,
1320 * return an error. (Zero length also qualifies here.)
1321 */
1322 if (extv[0]->spd_ext_len == 0 ||
1323 (uint8_t *)((uint64_t *)extv[0] + extv[0]->spd_ext_len) >
1324 (uint8_t *)((uint8_t *)basehdr + msgsize))
1325 return (KGE_LEN);
1326
1327 /* Check for redundant headers. */
1328 if (extv[extv[0]->spd_ext_type] != NULL)
1329 return (KGE_DUP);
1330
1331 /* If I make it here, assign the appropriate bin. */
1332 extv[extv[0]->spd_ext_type] = extv[0];
1333
1334 /* Advance pointer (See above for uint64_t ptr reasoning.) */
1335 extv[0] = (spd_ext_t *)
1336 ((uint64_t *)extv[0] + extv[0]->spd_ext_len);
1337 }
1338
1339 /* Everything's cool. */
1340
1341 /*
1342 * If extv[0] == NULL, then there are no extension headers in this
1343 * message. Ensure that this is the case.
1344 */
1345 if (extv[0] == (spd_ext_t *)(basehdr + 1))
1346 extv[0] = NULL;
1347
1348 return (KGE_OK);
1349 }
1350
1351 const char *
spdsock_diag(int diagnostic)1352 spdsock_diag(int diagnostic)
1353 {
1354 switch (diagnostic) {
1355 case SPD_DIAGNOSTIC_NONE:
1356 return (dgettext(TEXT_DOMAIN, "no error"));
1357 case SPD_DIAGNOSTIC_UNKNOWN_EXT:
1358 return (dgettext(TEXT_DOMAIN, "unknown extension"));
1359 case SPD_DIAGNOSTIC_BAD_EXTLEN:
1360 return (dgettext(TEXT_DOMAIN, "bad extension length"));
1361 case SPD_DIAGNOSTIC_NO_RULE_EXT:
1362 return (dgettext(TEXT_DOMAIN, "no rule extension"));
1363 case SPD_DIAGNOSTIC_BAD_ADDR_LEN:
1364 return (dgettext(TEXT_DOMAIN, "bad address len"));
1365 case SPD_DIAGNOSTIC_MIXED_AF:
1366 return (dgettext(TEXT_DOMAIN, "mixed address family"));
1367 case SPD_DIAGNOSTIC_ADD_NO_MEM:
1368 return (dgettext(TEXT_DOMAIN, "add: no memory"));
1369 case SPD_DIAGNOSTIC_ADD_WRONG_ACT_COUNT:
1370 return (dgettext(TEXT_DOMAIN, "add: wrong action count"));
1371 case SPD_DIAGNOSTIC_ADD_BAD_TYPE:
1372 return (dgettext(TEXT_DOMAIN, "add: bad type"));
1373 case SPD_DIAGNOSTIC_ADD_BAD_FLAGS:
1374 return (dgettext(TEXT_DOMAIN, "add: bad flags"));
1375 case SPD_DIAGNOSTIC_ADD_INCON_FLAGS:
1376 return (dgettext(TEXT_DOMAIN, "add: inconsistent flags"));
1377 case SPD_DIAGNOSTIC_MALFORMED_LCLPORT:
1378 return (dgettext(TEXT_DOMAIN, "malformed local port"));
1379 case SPD_DIAGNOSTIC_DUPLICATE_LCLPORT:
1380 return (dgettext(TEXT_DOMAIN, "duplicate local port"));
1381 case SPD_DIAGNOSTIC_MALFORMED_REMPORT:
1382 return (dgettext(TEXT_DOMAIN, "malformed remote port"));
1383 case SPD_DIAGNOSTIC_DUPLICATE_REMPORT:
1384 return (dgettext(TEXT_DOMAIN, "duplicate remote port"));
1385 case SPD_DIAGNOSTIC_MALFORMED_PROTO:
1386 return (dgettext(TEXT_DOMAIN, "malformed proto"));
1387 case SPD_DIAGNOSTIC_DUPLICATE_PROTO:
1388 return (dgettext(TEXT_DOMAIN, "duplicate proto"));
1389 case SPD_DIAGNOSTIC_MALFORMED_LCLADDR:
1390 return (dgettext(TEXT_DOMAIN, "malformed local address"));
1391 case SPD_DIAGNOSTIC_DUPLICATE_LCLADDR:
1392 return (dgettext(TEXT_DOMAIN, "duplicate local address"));
1393 case SPD_DIAGNOSTIC_MALFORMED_REMADDR:
1394 return (dgettext(TEXT_DOMAIN, "malformed remote address"));
1395 case SPD_DIAGNOSTIC_DUPLICATE_REMADDR:
1396 return (dgettext(TEXT_DOMAIN, "duplicate remote address"));
1397 case SPD_DIAGNOSTIC_MALFORMED_ACTION:
1398 return (dgettext(TEXT_DOMAIN, "malformed action"));
1399 case SPD_DIAGNOSTIC_DUPLICATE_ACTION:
1400 return (dgettext(TEXT_DOMAIN, "duplicate action"));
1401 case SPD_DIAGNOSTIC_MALFORMED_RULE:
1402 return (dgettext(TEXT_DOMAIN, "malformed rule"));
1403 case SPD_DIAGNOSTIC_DUPLICATE_RULE:
1404 return (dgettext(TEXT_DOMAIN, "duplicate rule"));
1405 case SPD_DIAGNOSTIC_MALFORMED_RULESET:
1406 return (dgettext(TEXT_DOMAIN, "malformed ruleset"));
1407 case SPD_DIAGNOSTIC_DUPLICATE_RULESET:
1408 return (dgettext(TEXT_DOMAIN, "duplicate ruleset"));
1409 case SPD_DIAGNOSTIC_INVALID_RULE_INDEX:
1410 return (dgettext(TEXT_DOMAIN, "invalid rule index"));
1411 case SPD_DIAGNOSTIC_BAD_SPDID:
1412 return (dgettext(TEXT_DOMAIN, "bad spdid"));
1413 case SPD_DIAGNOSTIC_BAD_MSG_TYPE:
1414 return (dgettext(TEXT_DOMAIN, "bad message type"));
1415 case SPD_DIAGNOSTIC_UNSUPP_AH_ALG:
1416 return (dgettext(TEXT_DOMAIN, "unsupported AH algorithm"));
1417 case SPD_DIAGNOSTIC_UNSUPP_ESP_ENCR_ALG:
1418 return (dgettext(TEXT_DOMAIN,
1419 "unsupported ESP encryption algorithm"));
1420 case SPD_DIAGNOSTIC_UNSUPP_ESP_AUTH_ALG:
1421 return (dgettext(TEXT_DOMAIN,
1422 "unsupported ESP authentication algorithm"));
1423 case SPD_DIAGNOSTIC_UNSUPP_AH_KEYSIZE:
1424 return (dgettext(TEXT_DOMAIN, "unsupported AH key size"));
1425 case SPD_DIAGNOSTIC_UNSUPP_ESP_ENCR_KEYSIZE:
1426 return (dgettext(TEXT_DOMAIN,
1427 "unsupported ESP encryption key size"));
1428 case SPD_DIAGNOSTIC_UNSUPP_ESP_AUTH_KEYSIZE:
1429 return (dgettext(TEXT_DOMAIN,
1430 "unsupported ESP authentication key size"));
1431 case SPD_DIAGNOSTIC_NO_ACTION_EXT:
1432 return (dgettext(TEXT_DOMAIN, "No ACTION extension"));
1433 case SPD_DIAGNOSTIC_ALG_ID_RANGE:
1434 return (dgettext(TEXT_DOMAIN, "invalid algorithm identifer"));
1435 case SPD_DIAGNOSTIC_ALG_NUM_KEY_SIZES:
1436 return (dgettext(TEXT_DOMAIN,
1437 "number of key sizes inconsistent"));
1438 case SPD_DIAGNOSTIC_ALG_NUM_BLOCK_SIZES:
1439 return (dgettext(TEXT_DOMAIN,
1440 "number of block sizes inconsistent"));
1441 case SPD_DIAGNOSTIC_ALG_MECH_NAME_LEN:
1442 return (dgettext(TEXT_DOMAIN, "invalid mechanism name length"));
1443 case SPD_DIAGNOSTIC_NOT_GLOBAL_OP:
1444 return (dgettext(TEXT_DOMAIN,
1445 "operation not applicable to all policies"));
1446 case SPD_DIAGNOSTIC_NO_TUNNEL_SELECTORS:
1447 return (dgettext(TEXT_DOMAIN,
1448 "using selectors on a transport-mode tunnel"));
1449 default:
1450 return (dgettext(TEXT_DOMAIN, "unknown diagnostic"));
1451 }
1452 }
1453
1454 /*
1455 * PF_KEY Diagnostic table.
1456 *
1457 * PF_KEY NOTE: If you change pfkeyv2.h's SADB_X_DIAGNOSTIC_* space, this is
1458 * where you need to add new messages.
1459 */
1460
1461 const char *
keysock_diag(int diagnostic)1462 keysock_diag(int diagnostic)
1463 {
1464 switch (diagnostic) {
1465 case SADB_X_DIAGNOSTIC_NONE:
1466 return (dgettext(TEXT_DOMAIN, "No diagnostic"));
1467 case SADB_X_DIAGNOSTIC_UNKNOWN_MSG:
1468 return (dgettext(TEXT_DOMAIN, "Unknown message type"));
1469 case SADB_X_DIAGNOSTIC_UNKNOWN_EXT:
1470 return (dgettext(TEXT_DOMAIN, "Unknown extension type"));
1471 case SADB_X_DIAGNOSTIC_BAD_EXTLEN:
1472 return (dgettext(TEXT_DOMAIN, "Bad extension length"));
1473 case SADB_X_DIAGNOSTIC_UNKNOWN_SATYPE:
1474 return (dgettext(TEXT_DOMAIN,
1475 "Unknown Security Association type"));
1476 case SADB_X_DIAGNOSTIC_SATYPE_NEEDED:
1477 return (dgettext(TEXT_DOMAIN,
1478 "Specific Security Association type needed"));
1479 case SADB_X_DIAGNOSTIC_NO_SADBS:
1480 return (dgettext(TEXT_DOMAIN,
1481 "No Security Association Databases present"));
1482 case SADB_X_DIAGNOSTIC_NO_EXT:
1483 return (dgettext(TEXT_DOMAIN,
1484 "No extensions needed for message"));
1485 case SADB_X_DIAGNOSTIC_BAD_SRC_AF:
1486 return (dgettext(TEXT_DOMAIN, "Bad source address family"));
1487 case SADB_X_DIAGNOSTIC_BAD_DST_AF:
1488 return (dgettext(TEXT_DOMAIN,
1489 "Bad destination address family"));
1490 case SADB_X_DIAGNOSTIC_BAD_PROXY_AF:
1491 return (dgettext(TEXT_DOMAIN,
1492 "Bad inner-source address family"));
1493 case SADB_X_DIAGNOSTIC_AF_MISMATCH:
1494 return (dgettext(TEXT_DOMAIN,
1495 "Source/destination address family mismatch"));
1496 case SADB_X_DIAGNOSTIC_BAD_SRC:
1497 return (dgettext(TEXT_DOMAIN, "Bad source address value"));
1498 case SADB_X_DIAGNOSTIC_BAD_DST:
1499 return (dgettext(TEXT_DOMAIN, "Bad destination address value"));
1500 case SADB_X_DIAGNOSTIC_ALLOC_HSERR:
1501 return (dgettext(TEXT_DOMAIN,
1502 "Soft allocations limit more than hard limit"));
1503 case SADB_X_DIAGNOSTIC_BYTES_HSERR:
1504 return (dgettext(TEXT_DOMAIN,
1505 "Soft bytes limit more than hard limit"));
1506 case SADB_X_DIAGNOSTIC_ADDTIME_HSERR:
1507 return (dgettext(TEXT_DOMAIN, "Soft add expiration time later "
1508 "than hard expiration time"));
1509 case SADB_X_DIAGNOSTIC_USETIME_HSERR:
1510 return (dgettext(TEXT_DOMAIN, "Soft use expiration time later "
1511 "than hard expiration time"));
1512 case SADB_X_DIAGNOSTIC_MISSING_SRC:
1513 return (dgettext(TEXT_DOMAIN, "Missing source address"));
1514 case SADB_X_DIAGNOSTIC_MISSING_DST:
1515 return (dgettext(TEXT_DOMAIN, "Missing destination address"));
1516 case SADB_X_DIAGNOSTIC_MISSING_SA:
1517 return (dgettext(TEXT_DOMAIN, "Missing SA extension"));
1518 case SADB_X_DIAGNOSTIC_MISSING_EKEY:
1519 return (dgettext(TEXT_DOMAIN, "Missing encryption key"));
1520 case SADB_X_DIAGNOSTIC_MISSING_AKEY:
1521 return (dgettext(TEXT_DOMAIN, "Missing authentication key"));
1522 case SADB_X_DIAGNOSTIC_MISSING_RANGE:
1523 return (dgettext(TEXT_DOMAIN, "Missing SPI range"));
1524 case SADB_X_DIAGNOSTIC_DUPLICATE_SRC:
1525 return (dgettext(TEXT_DOMAIN, "Duplicate source address"));
1526 case SADB_X_DIAGNOSTIC_DUPLICATE_DST:
1527 return (dgettext(TEXT_DOMAIN, "Duplicate destination address"));
1528 case SADB_X_DIAGNOSTIC_DUPLICATE_SA:
1529 return (dgettext(TEXT_DOMAIN, "Duplicate SA extension"));
1530 case SADB_X_DIAGNOSTIC_DUPLICATE_EKEY:
1531 return (dgettext(TEXT_DOMAIN, "Duplicate encryption key"));
1532 case SADB_X_DIAGNOSTIC_DUPLICATE_AKEY:
1533 return (dgettext(TEXT_DOMAIN, "Duplicate authentication key"));
1534 case SADB_X_DIAGNOSTIC_DUPLICATE_RANGE:
1535 return (dgettext(TEXT_DOMAIN, "Duplicate SPI range"));
1536 case SADB_X_DIAGNOSTIC_MALFORMED_SRC:
1537 return (dgettext(TEXT_DOMAIN, "Malformed source address"));
1538 case SADB_X_DIAGNOSTIC_MALFORMED_DST:
1539 return (dgettext(TEXT_DOMAIN, "Malformed destination address"));
1540 case SADB_X_DIAGNOSTIC_MALFORMED_SA:
1541 return (dgettext(TEXT_DOMAIN, "Malformed SA extension"));
1542 case SADB_X_DIAGNOSTIC_MALFORMED_EKEY:
1543 return (dgettext(TEXT_DOMAIN, "Malformed encryption key"));
1544 case SADB_X_DIAGNOSTIC_MALFORMED_AKEY:
1545 return (dgettext(TEXT_DOMAIN, "Malformed authentication key"));
1546 case SADB_X_DIAGNOSTIC_MALFORMED_RANGE:
1547 return (dgettext(TEXT_DOMAIN, "Malformed SPI range"));
1548 case SADB_X_DIAGNOSTIC_AKEY_PRESENT:
1549 return (dgettext(TEXT_DOMAIN, "Authentication key not needed"));
1550 case SADB_X_DIAGNOSTIC_EKEY_PRESENT:
1551 return (dgettext(TEXT_DOMAIN, "Encryption key not needed"));
1552 case SADB_X_DIAGNOSTIC_PROP_PRESENT:
1553 return (dgettext(TEXT_DOMAIN, "Proposal extension not needed"));
1554 case SADB_X_DIAGNOSTIC_SUPP_PRESENT:
1555 return (dgettext(TEXT_DOMAIN,
1556 "Supported algorithms extension not needed"));
1557 case SADB_X_DIAGNOSTIC_BAD_AALG:
1558 return (dgettext(TEXT_DOMAIN,
1559 "Unsupported authentication algorithm"));
1560 case SADB_X_DIAGNOSTIC_BAD_EALG:
1561 return (dgettext(TEXT_DOMAIN,
1562 "Unsupported encryption algorithm"));
1563 case SADB_X_DIAGNOSTIC_BAD_SAFLAGS:
1564 return (dgettext(TEXT_DOMAIN, "Invalid SA flags"));
1565 case SADB_X_DIAGNOSTIC_BAD_SASTATE:
1566 return (dgettext(TEXT_DOMAIN, "Invalid SA state"));
1567 case SADB_X_DIAGNOSTIC_BAD_AKEYBITS:
1568 return (dgettext(TEXT_DOMAIN,
1569 "Bad number of authentication bits"));
1570 case SADB_X_DIAGNOSTIC_BAD_EKEYBITS:
1571 return (dgettext(TEXT_DOMAIN,
1572 "Bad number of encryption bits"));
1573 case SADB_X_DIAGNOSTIC_ENCR_NOTSUPP:
1574 return (dgettext(TEXT_DOMAIN,
1575 "Encryption not supported for this SA type"));
1576 case SADB_X_DIAGNOSTIC_WEAK_EKEY:
1577 return (dgettext(TEXT_DOMAIN, "Weak encryption key"));
1578 case SADB_X_DIAGNOSTIC_WEAK_AKEY:
1579 return (dgettext(TEXT_DOMAIN, "Weak authentication key"));
1580 case SADB_X_DIAGNOSTIC_DUPLICATE_KMP:
1581 return (dgettext(TEXT_DOMAIN,
1582 "Duplicate key management protocol"));
1583 case SADB_X_DIAGNOSTIC_DUPLICATE_KMC:
1584 return (dgettext(TEXT_DOMAIN,
1585 "Duplicate key management cookie"));
1586 case SADB_X_DIAGNOSTIC_MISSING_NATT_LOC:
1587 return (dgettext(TEXT_DOMAIN, "Missing NAT-T local address"));
1588 case SADB_X_DIAGNOSTIC_MISSING_NATT_REM:
1589 return (dgettext(TEXT_DOMAIN, "Missing NAT-T remote address"));
1590 case SADB_X_DIAGNOSTIC_DUPLICATE_NATT_LOC:
1591 return (dgettext(TEXT_DOMAIN, "Duplicate NAT-T local address"));
1592 case SADB_X_DIAGNOSTIC_DUPLICATE_NATT_REM:
1593 return (dgettext(TEXT_DOMAIN,
1594 "Duplicate NAT-T remote address"));
1595 case SADB_X_DIAGNOSTIC_MALFORMED_NATT_LOC:
1596 return (dgettext(TEXT_DOMAIN, "Malformed NAT-T local address"));
1597 case SADB_X_DIAGNOSTIC_MALFORMED_NATT_REM:
1598 return (dgettext(TEXT_DOMAIN,
1599 "Malformed NAT-T remote address"));
1600 case SADB_X_DIAGNOSTIC_DUPLICATE_NATT_PORTS:
1601 return (dgettext(TEXT_DOMAIN, "Duplicate NAT-T ports"));
1602 case SADB_X_DIAGNOSTIC_MISSING_INNER_SRC:
1603 return (dgettext(TEXT_DOMAIN, "Missing inner source address"));
1604 case SADB_X_DIAGNOSTIC_MISSING_INNER_DST:
1605 return (dgettext(TEXT_DOMAIN,
1606 "Missing inner destination address"));
1607 case SADB_X_DIAGNOSTIC_DUPLICATE_INNER_SRC:
1608 return (dgettext(TEXT_DOMAIN,
1609 "Duplicate inner source address"));
1610 case SADB_X_DIAGNOSTIC_DUPLICATE_INNER_DST:
1611 return (dgettext(TEXT_DOMAIN,
1612 "Duplicate inner destination address"));
1613 case SADB_X_DIAGNOSTIC_MALFORMED_INNER_SRC:
1614 return (dgettext(TEXT_DOMAIN,
1615 "Malformed inner source address"));
1616 case SADB_X_DIAGNOSTIC_MALFORMED_INNER_DST:
1617 return (dgettext(TEXT_DOMAIN,
1618 "Malformed inner destination address"));
1619 case SADB_X_DIAGNOSTIC_PREFIX_INNER_SRC:
1620 return (dgettext(TEXT_DOMAIN,
1621 "Invalid inner-source prefix length "));
1622 case SADB_X_DIAGNOSTIC_PREFIX_INNER_DST:
1623 return (dgettext(TEXT_DOMAIN,
1624 "Invalid inner-destination prefix length"));
1625 case SADB_X_DIAGNOSTIC_BAD_INNER_DST_AF:
1626 return (dgettext(TEXT_DOMAIN,
1627 "Bad inner-destination address family"));
1628 case SADB_X_DIAGNOSTIC_INNER_AF_MISMATCH:
1629 return (dgettext(TEXT_DOMAIN,
1630 "Inner source/destination address family mismatch"));
1631 case SADB_X_DIAGNOSTIC_BAD_NATT_REM_AF:
1632 return (dgettext(TEXT_DOMAIN,
1633 "Bad NAT-T remote address family"));
1634 case SADB_X_DIAGNOSTIC_BAD_NATT_LOC_AF:
1635 return (dgettext(TEXT_DOMAIN,
1636 "Bad NAT-T local address family"));
1637 case SADB_X_DIAGNOSTIC_PROTO_MISMATCH:
1638 return (dgettext(TEXT_DOMAIN,
1639 "Source/desination protocol mismatch"));
1640 case SADB_X_DIAGNOSTIC_INNER_PROTO_MISMATCH:
1641 return (dgettext(TEXT_DOMAIN,
1642 "Inner source/desination protocol mismatch"));
1643 case SADB_X_DIAGNOSTIC_DUAL_PORT_SETS:
1644 return (dgettext(TEXT_DOMAIN,
1645 "Both inner ports and outer ports are set"));
1646 case SADB_X_DIAGNOSTIC_PAIR_INAPPROPRIATE:
1647 return (dgettext(TEXT_DOMAIN,
1648 "Pairing failed, target SA unsuitable for pairing"));
1649 case SADB_X_DIAGNOSTIC_PAIR_ADD_MISMATCH:
1650 return (dgettext(TEXT_DOMAIN,
1651 "Source/destination address differs from pair SA"));
1652 case SADB_X_DIAGNOSTIC_PAIR_ALREADY:
1653 return (dgettext(TEXT_DOMAIN,
1654 "Already paired with another security association"));
1655 case SADB_X_DIAGNOSTIC_PAIR_SA_NOTFOUND:
1656 return (dgettext(TEXT_DOMAIN,
1657 "Command failed, pair security association not found"));
1658 case SADB_X_DIAGNOSTIC_BAD_SA_DIRECTION:
1659 return (dgettext(TEXT_DOMAIN,
1660 "Inappropriate SA direction"));
1661 case SADB_X_DIAGNOSTIC_SA_NOTFOUND:
1662 return (dgettext(TEXT_DOMAIN,
1663 "Security association not found"));
1664 case SADB_X_DIAGNOSTIC_SA_EXPIRED:
1665 return (dgettext(TEXT_DOMAIN,
1666 "Security association is not valid"));
1667 case SADB_X_DIAGNOSTIC_BAD_CTX:
1668 return (dgettext(TEXT_DOMAIN,
1669 "Algorithm invalid or not supported by Crypto Framework"));
1670 case SADB_X_DIAGNOSTIC_INVALID_REPLAY:
1671 return (dgettext(TEXT_DOMAIN,
1672 "Invalid Replay counter"));
1673 case SADB_X_DIAGNOSTIC_MISSING_LIFETIME:
1674 return (dgettext(TEXT_DOMAIN,
1675 "Inappropriate lifetimes"));
1676 case SADB_X_DIAGNOSTIC_MISSING_ASTR:
1677 return (dgettext(TEXT_DOMAIN, "Missing authentication string"));
1678 case SADB_X_DIAGNOSTIC_DUPLICATE_ASTR:
1679 return (dgettext(TEXT_DOMAIN,
1680 "Duplicate authentication string"));
1681 case SADB_X_DIAGNOSTIC_MALFORMED_ASTR:
1682 return (dgettext(TEXT_DOMAIN,
1683 "Malformed authentication string"));
1684 default:
1685 return (dgettext(TEXT_DOMAIN, "Unknown diagnostic code"));
1686 }
1687 }
1688
1689 /*
1690 * Convert an IPv6 mask to a prefix len. I assume all IPv6 masks are
1691 * contiguous, so I stop at the first zero bit!
1692 */
1693 int
in_masktoprefix(uint8_t * mask,boolean_t is_v4mapped)1694 in_masktoprefix(uint8_t *mask, boolean_t is_v4mapped)
1695 {
1696 int rc = 0;
1697 uint8_t last;
1698 int limit = IPV6_ABITS;
1699
1700 if (is_v4mapped) {
1701 mask += ((IPV6_ABITS - IP_ABITS)/8);
1702 limit = IP_ABITS;
1703 }
1704
1705 while (*mask == 0xff) {
1706 rc += 8;
1707 if (rc == limit)
1708 return (limit);
1709 mask++;
1710 }
1711
1712 last = *mask;
1713 while (last != 0) {
1714 rc++;
1715 last = (last << 1) & 0xff;
1716 }
1717
1718 return (rc);
1719 }
1720
1721 /*
1722 * Expand the diagnostic code into a message.
1723 */
1724 void
print_diagnostic(FILE * file,uint16_t diagnostic)1725 print_diagnostic(FILE *file, uint16_t diagnostic)
1726 {
1727 /* Use two spaces so above strings can fit on the line. */
1728 (void) fprintf(file, dgettext(TEXT_DOMAIN,
1729 " Diagnostic code %u: %s.\n"),
1730 diagnostic, keysock_diag(diagnostic));
1731 }
1732
1733 /*
1734 * Prints the base PF_KEY message.
1735 */
1736 void
print_sadb_msg(FILE * file,struct sadb_msg * samsg,time_t wallclock,boolean_t vflag)1737 print_sadb_msg(FILE *file, struct sadb_msg *samsg, time_t wallclock,
1738 boolean_t vflag)
1739 {
1740 if (wallclock != 0)
1741 printsatime(file, wallclock, dgettext(TEXT_DOMAIN,
1742 "%sTimestamp: %s\n"), "", NULL,
1743 vflag);
1744
1745 (void) fprintf(file, dgettext(TEXT_DOMAIN,
1746 "Base message (version %u) type "),
1747 samsg->sadb_msg_version);
1748 switch (samsg->sadb_msg_type) {
1749 case SADB_RESERVED:
1750 (void) fprintf(file, dgettext(TEXT_DOMAIN,
1751 "RESERVED (warning: set to 0)"));
1752 break;
1753 case SADB_GETSPI:
1754 (void) fprintf(file, "GETSPI");
1755 break;
1756 case SADB_UPDATE:
1757 (void) fprintf(file, "UPDATE");
1758 break;
1759 case SADB_X_UPDATEPAIR:
1760 (void) fprintf(file, "UPDATE PAIR");
1761 break;
1762 case SADB_ADD:
1763 (void) fprintf(file, "ADD");
1764 break;
1765 case SADB_DELETE:
1766 (void) fprintf(file, "DELETE");
1767 break;
1768 case SADB_X_DELPAIR:
1769 (void) fprintf(file, "DELETE PAIR");
1770 break;
1771 case SADB_GET:
1772 (void) fprintf(file, "GET");
1773 break;
1774 case SADB_ACQUIRE:
1775 (void) fprintf(file, "ACQUIRE");
1776 break;
1777 case SADB_REGISTER:
1778 (void) fprintf(file, "REGISTER");
1779 break;
1780 case SADB_EXPIRE:
1781 (void) fprintf(file, "EXPIRE");
1782 break;
1783 case SADB_FLUSH:
1784 (void) fprintf(file, "FLUSH");
1785 break;
1786 case SADB_DUMP:
1787 (void) fprintf(file, "DUMP");
1788 break;
1789 case SADB_X_PROMISC:
1790 (void) fprintf(file, "X_PROMISC");
1791 break;
1792 case SADB_X_INVERSE_ACQUIRE:
1793 (void) fprintf(file, "X_INVERSE_ACQUIRE");
1794 break;
1795 default:
1796 (void) fprintf(file, dgettext(TEXT_DOMAIN,
1797 "Unknown (%u)"), samsg->sadb_msg_type);
1798 break;
1799 }
1800 (void) fprintf(file, dgettext(TEXT_DOMAIN, ", SA type "));
1801
1802 switch (samsg->sadb_msg_satype) {
1803 case SADB_SATYPE_UNSPEC:
1804 (void) fprintf(file, dgettext(TEXT_DOMAIN,
1805 "<unspecified/all>"));
1806 break;
1807 case SADB_SATYPE_AH:
1808 (void) fprintf(file, "AH");
1809 break;
1810 case SADB_SATYPE_ESP:
1811 (void) fprintf(file, "ESP");
1812 break;
1813 case SADB_X_SATYPE_TCPSIG:
1814 (void) fprintf(file, "TCPSIG");
1815 break;
1816 case SADB_SATYPE_RSVP:
1817 (void) fprintf(file, "RSVP");
1818 break;
1819 case SADB_SATYPE_OSPFV2:
1820 (void) fprintf(file, "OSPFv2");
1821 break;
1822 case SADB_SATYPE_RIPV2:
1823 (void) fprintf(file, "RIPv2");
1824 break;
1825 case SADB_SATYPE_MIP:
1826 (void) fprintf(file, dgettext(TEXT_DOMAIN, "Mobile IP"));
1827 break;
1828 default:
1829 (void) fprintf(file, dgettext(TEXT_DOMAIN,
1830 "<unknown %u>"), samsg->sadb_msg_satype);
1831 break;
1832 }
1833
1834 (void) fprintf(file, ".\n");
1835
1836 if (samsg->sadb_msg_errno != 0) {
1837 (void) fprintf(file, dgettext(TEXT_DOMAIN,
1838 "Error %s from PF_KEY.\n"),
1839 strerror(samsg->sadb_msg_errno));
1840 print_diagnostic(file, samsg->sadb_x_msg_diagnostic);
1841 }
1842
1843 (void) fprintf(file, dgettext(TEXT_DOMAIN,
1844 "Message length %u bytes, seq=%u, pid=%u.\n"),
1845 SADB_64TO8(samsg->sadb_msg_len), samsg->sadb_msg_seq,
1846 samsg->sadb_msg_pid);
1847 }
1848
1849 /*
1850 * Print the SA extension for PF_KEY.
1851 */
1852 void
print_sa(FILE * file,char * prefix,struct sadb_sa * assoc)1853 print_sa(FILE *file, char *prefix, struct sadb_sa *assoc)
1854 {
1855 if (assoc->sadb_sa_len != SADB_8TO64(sizeof (*assoc))) {
1856 warnxfp(EFD(file), dgettext(TEXT_DOMAIN,
1857 "WARNING: SA info extension length (%u) is bad."),
1858 SADB_64TO8(assoc->sadb_sa_len));
1859 }
1860
1861 if ((assoc->sadb_sa_flags & SADB_X_SAFLAGS_TCPSIG) == 0) {
1862 (void) fprintf(file, dgettext(TEXT_DOMAIN,
1863 "%sSADB_ASSOC spi=0x%x, replay window size=%u, state="),
1864 prefix, ntohl(assoc->sadb_sa_spi), assoc->sadb_sa_replay);
1865 } else {
1866 (void) fprintf(file,
1867 dgettext(TEXT_DOMAIN, "%sSADB_ASSOC state="), prefix);
1868 }
1869 switch (assoc->sadb_sa_state) {
1870 case SADB_SASTATE_LARVAL:
1871 (void) fprintf(file, dgettext(TEXT_DOMAIN, "LARVAL"));
1872 break;
1873 case SADB_SASTATE_MATURE:
1874 (void) fprintf(file, dgettext(TEXT_DOMAIN, "MATURE"));
1875 break;
1876 case SADB_SASTATE_DYING:
1877 (void) fprintf(file, dgettext(TEXT_DOMAIN, "DYING"));
1878 break;
1879 case SADB_SASTATE_DEAD:
1880 (void) fprintf(file, dgettext(TEXT_DOMAIN, "DEAD"));
1881 break;
1882 case SADB_X_SASTATE_ACTIVE_ELSEWHERE:
1883 (void) fprintf(file, dgettext(TEXT_DOMAIN,
1884 "ACTIVE_ELSEWHERE"));
1885 break;
1886 case SADB_X_SASTATE_IDLE:
1887 (void) fprintf(file, dgettext(TEXT_DOMAIN, "IDLE"));
1888 break;
1889 default:
1890 (void) fprintf(file, dgettext(TEXT_DOMAIN,
1891 "<unknown %u>"), assoc->sadb_sa_state);
1892 }
1893
1894 if (assoc->sadb_sa_auth != SADB_AALG_NONE) {
1895 (void) fprintf(file, dgettext(TEXT_DOMAIN,
1896 "\n%sAuthentication algorithm = "),
1897 prefix);
1898 if ((assoc->sadb_sa_flags & SADB_X_SAFLAGS_TCPSIG) != 0)
1899 (void) dump_tcpsigalg(assoc->sadb_sa_auth, file);
1900 else
1901 (void) dump_aalg(assoc->sadb_sa_auth, file);
1902 }
1903
1904 if (assoc->sadb_sa_encrypt != SADB_EALG_NONE) {
1905 (void) fprintf(file, dgettext(TEXT_DOMAIN,
1906 "\n%sEncryption algorithm = "), prefix);
1907 (void) dump_ealg(assoc->sadb_sa_encrypt, file);
1908 }
1909
1910 (void) fprintf(file, dgettext(TEXT_DOMAIN, "\n%sflags=0x%x < "), prefix,
1911 assoc->sadb_sa_flags);
1912 if (assoc->sadb_sa_flags & SADB_SAFLAGS_PFS)
1913 (void) fprintf(file, "PFS ");
1914 if (assoc->sadb_sa_flags & SADB_SAFLAGS_NOREPLAY)
1915 (void) fprintf(file, "NOREPLAY ");
1916
1917 /* BEGIN Solaris-specific flags. */
1918 if (assoc->sadb_sa_flags & SADB_X_SAFLAGS_USED)
1919 (void) fprintf(file, "X_USED ");
1920 if (assoc->sadb_sa_flags & SADB_X_SAFLAGS_PAIRED)
1921 (void) fprintf(file, "X_PAIRED ");
1922 if (assoc->sadb_sa_flags & SADB_X_SAFLAGS_OUTBOUND)
1923 (void) fprintf(file, "X_OUTBOUND ");
1924 if (assoc->sadb_sa_flags & SADB_X_SAFLAGS_INBOUND)
1925 (void) fprintf(file, "X_INBOUND ");
1926 if (assoc->sadb_sa_flags & SADB_X_SAFLAGS_UNIQUE)
1927 (void) fprintf(file, "X_UNIQUE ");
1928 if (assoc->sadb_sa_flags & SADB_X_SAFLAGS_AALG1)
1929 (void) fprintf(file, "X_AALG1 ");
1930 if (assoc->sadb_sa_flags & SADB_X_SAFLAGS_AALG2)
1931 (void) fprintf(file, "X_AALG2 ");
1932 if (assoc->sadb_sa_flags & SADB_X_SAFLAGS_EALG1)
1933 (void) fprintf(file, "X_EALG1 ");
1934 if (assoc->sadb_sa_flags & SADB_X_SAFLAGS_EALG2)
1935 (void) fprintf(file, "X_EALG2 ");
1936 if (assoc->sadb_sa_flags & SADB_X_SAFLAGS_NATT_LOC)
1937 (void) fprintf(file, "X_NATT_LOC ");
1938 if (assoc->sadb_sa_flags & SADB_X_SAFLAGS_NATT_REM)
1939 (void) fprintf(file, "X_NATT_REM ");
1940 if (assoc->sadb_sa_flags & SADB_X_SAFLAGS_TUNNEL)
1941 (void) fprintf(file, "X_TUNNEL ");
1942 if (assoc->sadb_sa_flags & SADB_X_SAFLAGS_NATTED)
1943 (void) fprintf(file, "X_NATTED ");
1944 if (assoc->sadb_sa_flags & SADB_X_SAFLAGS_TCPSIG)
1945 (void) fprintf(file, "X_TCPSIG ");
1946 /* END Solaris-specific flags. */
1947
1948 (void) fprintf(file, ">\n");
1949 }
1950
1951 void
printsatime(FILE * file,int64_t lt,const char * msg,const char * pfx,const char * pfx2,boolean_t vflag)1952 printsatime(FILE *file, int64_t lt, const char *msg, const char *pfx,
1953 const char *pfx2, boolean_t vflag)
1954 {
1955 char tbuf[TBUF_SIZE]; /* For strftime() call. */
1956 const char *tp = tbuf;
1957 time_t t = lt;
1958 struct tm res;
1959
1960 if (t != lt) {
1961 if (lt > 0)
1962 t = LONG_MAX;
1963 else
1964 t = LONG_MIN;
1965 }
1966
1967 if (strftime(tbuf, TBUF_SIZE, NULL, localtime_r(&t, &res)) == 0)
1968 tp = dgettext(TEXT_DOMAIN, "<time conversion failed>");
1969 (void) fprintf(file, msg, pfx, tp);
1970 if (vflag && (pfx2 != NULL))
1971 (void) fprintf(file, dgettext(TEXT_DOMAIN,
1972 "%s\t(raw time value %" PRIu64 ")\n"), pfx2, lt);
1973 }
1974
1975 /*
1976 * Print the SA lifetime information. (An SADB_EXT_LIFETIME_* extension.)
1977 */
1978 void
print_lifetimes(FILE * file,time_t wallclock,struct sadb_lifetime * current,struct sadb_lifetime * hard,struct sadb_lifetime * soft,struct sadb_lifetime * idle,boolean_t vflag)1979 print_lifetimes(FILE *file, time_t wallclock, struct sadb_lifetime *current,
1980 struct sadb_lifetime *hard, struct sadb_lifetime *soft,
1981 struct sadb_lifetime *idle, boolean_t vflag)
1982 {
1983 int64_t scratch;
1984 char *soft_prefix = dgettext(TEXT_DOMAIN, "SLT: ");
1985 char *hard_prefix = dgettext(TEXT_DOMAIN, "HLT: ");
1986 char *current_prefix = dgettext(TEXT_DOMAIN, "CLT: ");
1987 char *idle_prefix = dgettext(TEXT_DOMAIN, "ILT: ");
1988 char byte_str[BYTE_STR_SIZE]; /* byte lifetime string representation */
1989 char secs_str[SECS_STR_SIZE]; /* buffer for seconds representation */
1990
1991 if (current != NULL &&
1992 current->sadb_lifetime_len != SADB_8TO64(sizeof (*current))) {
1993 warnxfp(EFD(file), dgettext(TEXT_DOMAIN,
1994 "WARNING: CURRENT lifetime extension length (%u) is bad."),
1995 SADB_64TO8(current->sadb_lifetime_len));
1996 }
1997
1998 if (hard != NULL &&
1999 hard->sadb_lifetime_len != SADB_8TO64(sizeof (*hard))) {
2000 warnxfp(EFD(file), dgettext(TEXT_DOMAIN,
2001 "WARNING: HARD lifetime extension length (%u) is bad."),
2002 SADB_64TO8(hard->sadb_lifetime_len));
2003 }
2004
2005 if (soft != NULL &&
2006 soft->sadb_lifetime_len != SADB_8TO64(sizeof (*soft))) {
2007 warnxfp(EFD(file), dgettext(TEXT_DOMAIN,
2008 "WARNING: SOFT lifetime extension length (%u) is bad."),
2009 SADB_64TO8(soft->sadb_lifetime_len));
2010 }
2011
2012 if (idle != NULL &&
2013 idle->sadb_lifetime_len != SADB_8TO64(sizeof (*idle))) {
2014 warnxfp(EFD(file), dgettext(TEXT_DOMAIN,
2015 "WARNING: IDLE lifetime extension length (%u) is bad."),
2016 SADB_64TO8(idle->sadb_lifetime_len));
2017 }
2018
2019 (void) fprintf(file, " LT: Lifetime information\n");
2020 if (current != NULL) {
2021 /* Express values as current values. */
2022 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2023 "%sCurrent lifetime information:\n"),
2024 current_prefix);
2025 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2026 "%s%" PRIu64 " bytes %sprotected, %u allocations "
2027 "used.\n"), current_prefix,
2028 current->sadb_lifetime_bytes,
2029 bytecnt2out(current->sadb_lifetime_bytes, byte_str,
2030 sizeof (byte_str), SPC_END),
2031 current->sadb_lifetime_allocations);
2032 printsatime(file, current->sadb_lifetime_addtime,
2033 dgettext(TEXT_DOMAIN, "%sSA added at time: %s\n"),
2034 current_prefix, current_prefix, vflag);
2035 if (current->sadb_lifetime_usetime != 0) {
2036 printsatime(file, current->sadb_lifetime_usetime,
2037 dgettext(TEXT_DOMAIN,
2038 "%sSA first used at time %s\n"),
2039 current_prefix, current_prefix, vflag);
2040 }
2041 printsatime(file, wallclock, dgettext(TEXT_DOMAIN,
2042 "%sTime now is %s\n"), current_prefix, current_prefix,
2043 vflag);
2044 }
2045
2046 if (soft != NULL) {
2047 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2048 "%sSoft lifetime information:\n"),
2049 soft_prefix);
2050 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2051 "%s%" PRIu64 " bytes %sof lifetime, %u allocations.\n"),
2052 soft_prefix,
2053 soft->sadb_lifetime_bytes,
2054 bytecnt2out(soft->sadb_lifetime_bytes, byte_str,
2055 sizeof (byte_str), SPC_END),
2056 soft->sadb_lifetime_allocations);
2057 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2058 "%s%" PRIu64 " seconds %sof post-add lifetime.\n"),
2059 soft_prefix, soft->sadb_lifetime_addtime,
2060 secs2out(soft->sadb_lifetime_addtime, secs_str,
2061 sizeof (secs_str), SPC_END));
2062 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2063 "%s%" PRIu64 " seconds %sof post-use lifetime.\n"),
2064 soft_prefix, soft->sadb_lifetime_usetime,
2065 secs2out(soft->sadb_lifetime_usetime, secs_str,
2066 sizeof (secs_str), SPC_END));
2067 /* If possible, express values as time remaining. */
2068 if (current != NULL) {
2069 if (soft->sadb_lifetime_bytes != 0)
2070 (void) fprintf(file, dgettext(TEXT_DOMAIN, "%s"
2071 "%" PRIu64 " bytes %smore can be "
2072 "protected.\n"), soft_prefix,
2073 (soft->sadb_lifetime_bytes >
2074 current->sadb_lifetime_bytes) ?
2075 soft->sadb_lifetime_bytes -
2076 current->sadb_lifetime_bytes : 0,
2077 (soft->sadb_lifetime_bytes >
2078 current->sadb_lifetime_bytes) ?
2079 bytecnt2out(soft->sadb_lifetime_bytes -
2080 current->sadb_lifetime_bytes, byte_str,
2081 sizeof (byte_str), SPC_END) : "");
2082 if (soft->sadb_lifetime_addtime != 0 ||
2083 (soft->sadb_lifetime_usetime != 0 &&
2084 current->sadb_lifetime_usetime != 0)) {
2085 int64_t adddelta, usedelta;
2086
2087 if (soft->sadb_lifetime_addtime != 0) {
2088 adddelta =
2089 current->sadb_lifetime_addtime +
2090 soft->sadb_lifetime_addtime -
2091 wallclock;
2092 } else {
2093 adddelta = TIME_MAX;
2094 }
2095
2096 if (soft->sadb_lifetime_usetime != 0 &&
2097 current->sadb_lifetime_usetime != 0) {
2098 usedelta =
2099 current->sadb_lifetime_usetime +
2100 soft->sadb_lifetime_usetime -
2101 wallclock;
2102 } else {
2103 usedelta = TIME_MAX;
2104 }
2105 (void) fprintf(file, "%s", soft_prefix);
2106 scratch = MIN(adddelta, usedelta);
2107 if (scratch >= 0) {
2108 (void) fprintf(file,
2109 dgettext(TEXT_DOMAIN,
2110 "Soft expiration occurs in %"
2111 PRId64 " seconds%s\n"), scratch,
2112 secs2out(scratch, secs_str,
2113 sizeof (secs_str), SPC_BEGIN));
2114 } else {
2115 (void) fprintf(file,
2116 dgettext(TEXT_DOMAIN,
2117 "Soft expiration occurred\n"));
2118 }
2119 scratch += wallclock;
2120 printsatime(file, scratch, dgettext(TEXT_DOMAIN,
2121 "%sTime of expiration: %s.\n"),
2122 soft_prefix, soft_prefix, vflag);
2123 }
2124 }
2125 }
2126
2127 if (hard != NULL) {
2128 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2129 "%sHard lifetime information:\n"), hard_prefix);
2130 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2131 "%s%" PRIu64 " bytes %sof lifetime, %u allocations.\n"),
2132 hard_prefix,
2133 hard->sadb_lifetime_bytes,
2134 bytecnt2out(hard->sadb_lifetime_bytes, byte_str,
2135 sizeof (byte_str), SPC_END),
2136 hard->sadb_lifetime_allocations);
2137 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2138 "%s%" PRIu64 " seconds %sof post-add lifetime.\n"),
2139 hard_prefix, hard->sadb_lifetime_addtime,
2140 secs2out(hard->sadb_lifetime_addtime, secs_str,
2141 sizeof (secs_str), SPC_END));
2142 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2143 "%s%" PRIu64 " seconds %sof post-use lifetime.\n"),
2144 hard_prefix, hard->sadb_lifetime_usetime,
2145 secs2out(hard->sadb_lifetime_usetime, secs_str,
2146 sizeof (secs_str), SPC_END));
2147 /* If possible, express values as time remaining. */
2148 if (current != NULL) {
2149 if (hard->sadb_lifetime_bytes != 0)
2150 (void) fprintf(file, dgettext(TEXT_DOMAIN, "%s"
2151 "%" PRIu64 " bytes %smore can be "
2152 "protected.\n"), hard_prefix,
2153 (hard->sadb_lifetime_bytes >
2154 current->sadb_lifetime_bytes) ?
2155 hard->sadb_lifetime_bytes -
2156 current->sadb_lifetime_bytes : 0,
2157 (hard->sadb_lifetime_bytes >
2158 current->sadb_lifetime_bytes) ?
2159 bytecnt2out(hard->sadb_lifetime_bytes -
2160 current->sadb_lifetime_bytes, byte_str,
2161 sizeof (byte_str), SPC_END) : "");
2162 if (hard->sadb_lifetime_addtime != 0 ||
2163 (hard->sadb_lifetime_usetime != 0 &&
2164 current->sadb_lifetime_usetime != 0)) {
2165 int64_t adddelta, usedelta;
2166
2167 if (hard->sadb_lifetime_addtime != 0) {
2168 adddelta =
2169 current->sadb_lifetime_addtime +
2170 hard->sadb_lifetime_addtime -
2171 wallclock;
2172 } else {
2173 adddelta = TIME_MAX;
2174 }
2175
2176 if (hard->sadb_lifetime_usetime != 0 &&
2177 current->sadb_lifetime_usetime != 0) {
2178 usedelta =
2179 current->sadb_lifetime_usetime +
2180 hard->sadb_lifetime_usetime -
2181 wallclock;
2182 } else {
2183 usedelta = TIME_MAX;
2184 }
2185 (void) fprintf(file, "%s", hard_prefix);
2186 scratch = MIN(adddelta, usedelta);
2187 if (scratch >= 0) {
2188 (void) fprintf(file,
2189 dgettext(TEXT_DOMAIN,
2190 "Hard expiration occurs in %"
2191 PRId64 " seconds%s\n"), scratch,
2192 secs2out(scratch, secs_str,
2193 sizeof (secs_str), SPC_BEGIN));
2194 } else {
2195 (void) fprintf(file,
2196 dgettext(TEXT_DOMAIN,
2197 "Hard expiration occurred\n"));
2198 }
2199 scratch += wallclock;
2200 printsatime(file, scratch, dgettext(TEXT_DOMAIN,
2201 "%sTime of expiration: %s.\n"),
2202 hard_prefix, hard_prefix, vflag);
2203 }
2204 }
2205 }
2206 if (idle != NULL) {
2207 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2208 "%sIdle lifetime information:\n"), idle_prefix);
2209 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2210 "%s%" PRIu64 " seconds %sof post-add lifetime.\n"),
2211 idle_prefix, idle->sadb_lifetime_addtime,
2212 secs2out(idle->sadb_lifetime_addtime, secs_str,
2213 sizeof (secs_str), SPC_END));
2214 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2215 "%s%" PRIu64 " seconds %sof post-use lifetime.\n"),
2216 idle_prefix, idle->sadb_lifetime_usetime,
2217 secs2out(idle->sadb_lifetime_usetime, secs_str,
2218 sizeof (secs_str), SPC_END));
2219 }
2220 }
2221
2222 /*
2223 * Print an SADB_EXT_ADDRESS_* extension.
2224 */
2225 void
print_address(FILE * file,char * prefix,struct sadb_address * addr,boolean_t ignore_nss)2226 print_address(FILE *file, char *prefix, struct sadb_address *addr,
2227 boolean_t ignore_nss)
2228 {
2229 struct protoent *pe;
2230
2231 (void) fprintf(file, "%s", prefix);
2232 switch (addr->sadb_address_exttype) {
2233 case SADB_EXT_ADDRESS_SRC:
2234 (void) fprintf(file, dgettext(TEXT_DOMAIN, "Source address "));
2235 break;
2236 case SADB_X_EXT_ADDRESS_INNER_SRC:
2237 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2238 "Inner source address "));
2239 break;
2240 case SADB_EXT_ADDRESS_DST:
2241 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2242 "Destination address "));
2243 break;
2244 case SADB_X_EXT_ADDRESS_INNER_DST:
2245 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2246 "Inner destination address "));
2247 break;
2248 case SADB_X_EXT_ADDRESS_NATT_LOC:
2249 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2250 "NAT-T local address "));
2251 break;
2252 case SADB_X_EXT_ADDRESS_NATT_REM:
2253 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2254 "NAT-T remote address "));
2255 break;
2256 }
2257
2258 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2259 "(proto=%d"), addr->sadb_address_proto);
2260 if (ignore_nss == B_FALSE) {
2261 if (addr->sadb_address_proto == 0) {
2262 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2263 "/<unspecified>"));
2264 } else if ((pe = getprotobynumber(addr->sadb_address_proto))
2265 != NULL) {
2266 (void) fprintf(file, "/%s", pe->p_name);
2267 } else {
2268 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2269 "/<unknown>"));
2270 }
2271 }
2272 (void) fprintf(file, dgettext(TEXT_DOMAIN, ")\n%s"), prefix);
2273 (void) dump_sockaddr((struct sockaddr *)(addr + 1),
2274 addr->sadb_address_prefixlen, B_FALSE, file, ignore_nss);
2275 }
2276
2277 /*
2278 * Print an SADB_EXT_KEY extension.
2279 */
2280 void
print_key(FILE * file,char * prefix,struct sadb_key * key)2281 print_key(FILE *file, char *prefix, struct sadb_key *key)
2282 {
2283 (void) fprintf(file, "%s", prefix);
2284
2285 switch (key->sadb_key_exttype) {
2286 case SADB_EXT_KEY_AUTH:
2287 (void) fprintf(file, dgettext(TEXT_DOMAIN, "Authentication"));
2288 break;
2289 case SADB_EXT_KEY_ENCRYPT:
2290 (void) fprintf(file, dgettext(TEXT_DOMAIN, "Encryption"));
2291 break;
2292 }
2293
2294 (void) fprintf(file, dgettext(TEXT_DOMAIN, " key.\n%s"), prefix);
2295 (void) dump_key((uint8_t *)(key + 1), key->sadb_key_bits,
2296 key->sadb_key_reserved, file, B_TRUE);
2297 (void) fprintf(file, "\n");
2298 }
2299
2300 /*
2301 * Print an SADB_X_EXT_STR_AUTH extension.
2302 */
2303 void
print_keystr(FILE * file,char * prefix,struct sadb_key * key)2304 print_keystr(FILE *file, char *prefix, struct sadb_key *key)
2305 {
2306 (void) fprintf(file, "%s", prefix);
2307 (void) fprintf(file, dgettext(TEXT_DOMAIN, "Authentication"));
2308 (void) fprintf(file, dgettext(TEXT_DOMAIN, " string.\n%s"), prefix);
2309 (void) fprintf(file, "\"");
2310 (void) dump_keystr((uint8_t *)(key + 1), key->sadb_key_bits, file);
2311 (void) fprintf(file, "\"\n");
2312 }
2313
2314 /*
2315 * Print an SADB_EXT_IDENTITY_* extension.
2316 */
2317 void
print_ident(FILE * file,char * prefix,struct sadb_ident * id)2318 print_ident(FILE *file, char *prefix, struct sadb_ident *id)
2319 {
2320 boolean_t canprint = B_TRUE;
2321
2322 (void) fprintf(file, "%s", prefix);
2323 switch (id->sadb_ident_exttype) {
2324 case SADB_EXT_IDENTITY_SRC:
2325 (void) fprintf(file, dgettext(TEXT_DOMAIN, "Source"));
2326 break;
2327 case SADB_EXT_IDENTITY_DST:
2328 (void) fprintf(file, dgettext(TEXT_DOMAIN, "Destination"));
2329 break;
2330 }
2331
2332 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2333 " identity, uid=%d, type "), id->sadb_ident_id);
2334 canprint = dump_sadb_idtype(id->sadb_ident_type, file, NULL);
2335 (void) fprintf(file, "\n%s", prefix);
2336 if (canprint) {
2337 (void) fprintf(file, "%s\n", (char *)(id + 1));
2338 } else {
2339 print_asn1_name(file, (const unsigned char *)(id + 1),
2340 SADB_64TO8(id->sadb_ident_len) - sizeof (sadb_ident_t));
2341 }
2342 }
2343
2344 /*
2345 * Convert sadb_sens extension into binary security label.
2346 */
2347
2348 #include <tsol/label.h>
2349 #include <sys/tsol/tndb.h>
2350 #include <sys/tsol/label_macro.h>
2351
2352 void
ipsec_convert_sens_to_bslabel(const struct sadb_sens * sens,bslabel_t * sl)2353 ipsec_convert_sens_to_bslabel(const struct sadb_sens *sens, bslabel_t *sl)
2354 {
2355 uint64_t *bitmap = (uint64_t *)(sens + 1);
2356 int bitmap_len = SADB_64TO8(sens->sadb_sens_sens_len);
2357
2358 bsllow(sl);
2359 LCLASS_SET((_bslabel_impl_t *)sl, sens->sadb_sens_sens_level);
2360 bcopy(bitmap, &((_bslabel_impl_t *)sl)->compartments,
2361 bitmap_len);
2362 }
2363
2364 void
ipsec_convert_bslabel_to_string(bslabel_t * sl,char ** plabel)2365 ipsec_convert_bslabel_to_string(bslabel_t *sl, char **plabel)
2366 {
2367 if (label_to_str(sl, plabel, M_LABEL, DEF_NAMES) != 0) {
2368 *plabel = strdup(dgettext(TEXT_DOMAIN,
2369 "** Label conversion failed **"));
2370 }
2371 }
2372
2373 void
ipsec_convert_bslabel_to_hex(bslabel_t * sl,char ** plabel)2374 ipsec_convert_bslabel_to_hex(bslabel_t *sl, char **plabel)
2375 {
2376 if (label_to_str(sl, plabel, M_INTERNAL, DEF_NAMES) != 0) {
2377 *plabel = strdup(dgettext(TEXT_DOMAIN,
2378 "** Label conversion failed **"));
2379 }
2380 }
2381
2382 int
ipsec_convert_sl_to_sens(int doi,bslabel_t * sl,sadb_sens_t * sens)2383 ipsec_convert_sl_to_sens(int doi, bslabel_t *sl, sadb_sens_t *sens)
2384 {
2385 uint8_t *bitmap;
2386 int sens_len = sizeof (sadb_sens_t) + _C_LEN * 4;
2387
2388
2389 if (sens == NULL)
2390 return (sens_len);
2391
2392
2393 (void) memset(sens, 0, sens_len);
2394
2395 sens->sadb_sens_exttype = SADB_EXT_SENSITIVITY;
2396 sens->sadb_sens_len = SADB_8TO64(sens_len);
2397 sens->sadb_sens_dpd = doi;
2398
2399 sens->sadb_sens_sens_level = LCLASS(sl);
2400 sens->sadb_sens_integ_level = 0;
2401 sens->sadb_sens_sens_len = _C_LEN >> 1;
2402 sens->sadb_sens_integ_len = 0;
2403
2404 sens->sadb_x_sens_flags = 0;
2405
2406 bitmap = (uint8_t *)(sens + 1);
2407 bcopy(&(((_bslabel_impl_t *)sl)->compartments), bitmap, _C_LEN * 4);
2408
2409 return (sens_len);
2410 }
2411
2412
2413 /*
2414 * Print an SADB_SENSITIVITY extension.
2415 */
2416 void
print_sens(FILE * file,char * prefix,const struct sadb_sens * sens,boolean_t ignore_nss)2417 print_sens(FILE *file, char *prefix, const struct sadb_sens *sens,
2418 boolean_t ignore_nss)
2419 {
2420 char *plabel;
2421 char *hlabel;
2422 uint64_t *bitmap = (uint64_t *)(sens + 1);
2423 bslabel_t sl;
2424 int i;
2425 int sens_len = sens->sadb_sens_sens_len;
2426 int integ_len = sens->sadb_sens_integ_len;
2427 boolean_t inner = (sens->sadb_sens_exttype == SADB_EXT_SENSITIVITY);
2428 const char *sensname = inner ?
2429 dgettext(TEXT_DOMAIN, "Plaintext Sensitivity") :
2430 dgettext(TEXT_DOMAIN, "Ciphertext Sensitivity");
2431
2432 ipsec_convert_sens_to_bslabel(sens, &sl);
2433
2434 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2435 "%s%s DPD %d, sens level=%d, integ level=%d, flags=%x\n"),
2436 prefix, sensname, sens->sadb_sens_dpd, sens->sadb_sens_sens_level,
2437 sens->sadb_sens_integ_level, sens->sadb_x_sens_flags);
2438
2439 ipsec_convert_bslabel_to_hex(&sl, &hlabel);
2440
2441 if (ignore_nss) {
2442 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2443 "%s %s Label: %s\n"), prefix, sensname, hlabel);
2444
2445 for (i = 0; i < sens_len; i++, bitmap++)
2446 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2447 "%s %s BM extended word %d 0x%" PRIx64 "\n"),
2448 prefix, sensname, i, *bitmap);
2449
2450 } else {
2451 ipsec_convert_bslabel_to_string(&sl, &plabel);
2452
2453 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2454 "%s %s Label: %s (%s)\n"),
2455 prefix, sensname, plabel, hlabel);
2456 free(plabel);
2457
2458 }
2459 free(hlabel);
2460
2461 bitmap = (uint64_t *)(sens + 1 + sens_len);
2462
2463 for (i = 0; i < integ_len; i++, bitmap++)
2464 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2465 "%s Integrity BM extended word %d 0x%" PRIx64 "\n"),
2466 prefix, i, *bitmap);
2467 }
2468
2469 /*
2470 * Print an SADB_EXT_PROPOSAL extension.
2471 */
2472 void
print_prop(FILE * file,char * prefix,struct sadb_prop * prop)2473 print_prop(FILE *file, char *prefix, struct sadb_prop *prop)
2474 {
2475 struct sadb_comb *combs;
2476 int i, numcombs;
2477
2478 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2479 "%sProposal, replay counter = %u.\n"), prefix,
2480 prop->sadb_prop_replay);
2481
2482 numcombs = prop->sadb_prop_len - SADB_8TO64(sizeof (*prop));
2483 numcombs /= SADB_8TO64(sizeof (*combs));
2484
2485 combs = (struct sadb_comb *)(prop + 1);
2486
2487 for (i = 0; i < numcombs; i++) {
2488 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2489 "%s Combination #%u "), prefix, i + 1);
2490 if (combs[i].sadb_comb_auth != SADB_AALG_NONE) {
2491 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2492 "Authentication = "));
2493 (void) dump_aalg(combs[i].sadb_comb_auth, file);
2494 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2495 " minbits=%u, maxbits=%u.\n%s "),
2496 combs[i].sadb_comb_auth_minbits,
2497 combs[i].sadb_comb_auth_maxbits, prefix);
2498 }
2499
2500 if (combs[i].sadb_comb_encrypt != SADB_EALG_NONE) {
2501 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2502 "Encryption = "));
2503 (void) dump_ealg(combs[i].sadb_comb_encrypt, file);
2504 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2505 " minbits=%u, maxbits=%u, saltbits=%u.\n%s "),
2506 combs[i].sadb_comb_encrypt_minbits,
2507 combs[i].sadb_comb_encrypt_maxbits,
2508 combs[i].sadb_x_comb_encrypt_saltbits, prefix);
2509 }
2510
2511 (void) fprintf(file, dgettext(TEXT_DOMAIN, "HARD: "));
2512 if (combs[i].sadb_comb_hard_allocations)
2513 (void) fprintf(file, dgettext(TEXT_DOMAIN, "alloc=%u "),
2514 combs[i].sadb_comb_hard_allocations);
2515 if (combs[i].sadb_comb_hard_bytes)
2516 (void) fprintf(file, dgettext(TEXT_DOMAIN, "bytes=%"
2517 PRIu64 " "), combs[i].sadb_comb_hard_bytes);
2518 if (combs[i].sadb_comb_hard_addtime)
2519 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2520 "post-add secs=%" PRIu64 " "),
2521 combs[i].sadb_comb_hard_addtime);
2522 if (combs[i].sadb_comb_hard_usetime)
2523 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2524 "post-use secs=%" PRIu64 ""),
2525 combs[i].sadb_comb_hard_usetime);
2526
2527 (void) fprintf(file, dgettext(TEXT_DOMAIN, "\n%s SOFT: "),
2528 prefix);
2529 if (combs[i].sadb_comb_soft_allocations)
2530 (void) fprintf(file, dgettext(TEXT_DOMAIN, "alloc=%u "),
2531 combs[i].sadb_comb_soft_allocations);
2532 if (combs[i].sadb_comb_soft_bytes)
2533 (void) fprintf(file, dgettext(TEXT_DOMAIN, "bytes=%"
2534 PRIu64 " "), combs[i].sadb_comb_soft_bytes);
2535 if (combs[i].sadb_comb_soft_addtime)
2536 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2537 "post-add secs=%" PRIu64 " "),
2538 combs[i].sadb_comb_soft_addtime);
2539 if (combs[i].sadb_comb_soft_usetime)
2540 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2541 "post-use secs=%" PRIu64 ""),
2542 combs[i].sadb_comb_soft_usetime);
2543 (void) fprintf(file, "\n");
2544 }
2545 }
2546
2547 /*
2548 * Print an extended proposal (SADB_X_EXT_EPROP).
2549 */
2550 void
print_eprop(FILE * file,char * prefix,struct sadb_prop * eprop)2551 print_eprop(FILE *file, char *prefix, struct sadb_prop *eprop)
2552 {
2553 uint64_t *sofar;
2554 struct sadb_x_ecomb *ecomb;
2555 struct sadb_x_algdesc *algdesc;
2556 int i, j;
2557
2558 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2559 "%sExtended Proposal, replay counter = %u, "), prefix,
2560 eprop->sadb_prop_replay);
2561 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2562 "number of combinations = %u.\n"), eprop->sadb_x_prop_numecombs);
2563
2564 sofar = (uint64_t *)(eprop + 1);
2565 ecomb = (struct sadb_x_ecomb *)sofar;
2566
2567 for (i = 0; i < eprop->sadb_x_prop_numecombs; ) {
2568 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2569 "%s Extended combination #%u:\n"), prefix, ++i);
2570
2571 (void) fprintf(file, dgettext(TEXT_DOMAIN, "%s HARD: "),
2572 prefix);
2573 (void) fprintf(file, dgettext(TEXT_DOMAIN, "alloc=%u, "),
2574 ecomb->sadb_x_ecomb_hard_allocations);
2575 (void) fprintf(file, dgettext(TEXT_DOMAIN, "bytes=%" PRIu64
2576 ", "), ecomb->sadb_x_ecomb_hard_bytes);
2577 (void) fprintf(file, dgettext(TEXT_DOMAIN, "post-add secs=%"
2578 PRIu64 ", "), ecomb->sadb_x_ecomb_hard_addtime);
2579 (void) fprintf(file, dgettext(TEXT_DOMAIN, "post-use secs=%"
2580 PRIu64 "\n"), ecomb->sadb_x_ecomb_hard_usetime);
2581
2582 (void) fprintf(file, dgettext(TEXT_DOMAIN, "%s SOFT: "),
2583 prefix);
2584 (void) fprintf(file, dgettext(TEXT_DOMAIN, "alloc=%u, "),
2585 ecomb->sadb_x_ecomb_soft_allocations);
2586 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2587 "bytes=%" PRIu64 ", "), ecomb->sadb_x_ecomb_soft_bytes);
2588 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2589 "post-add secs=%" PRIu64 ", "),
2590 ecomb->sadb_x_ecomb_soft_addtime);
2591 (void) fprintf(file, dgettext(TEXT_DOMAIN, "post-use secs=%"
2592 PRIu64 "\n"), ecomb->sadb_x_ecomb_soft_usetime);
2593
2594 sofar = (uint64_t *)(ecomb + 1);
2595 algdesc = (struct sadb_x_algdesc *)sofar;
2596
2597 for (j = 0; j < ecomb->sadb_x_ecomb_numalgs; ) {
2598 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2599 "%s Alg #%u "), prefix, ++j);
2600 switch (algdesc->sadb_x_algdesc_satype) {
2601 case SADB_SATYPE_ESP:
2602 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2603 "for ESP "));
2604 break;
2605 case SADB_SATYPE_AH:
2606 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2607 "for AH "));
2608 break;
2609 case SADB_X_SATYPE_TCPSIG:
2610 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2611 "for TCPSIG "));
2612 break;
2613 default:
2614 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2615 "for satype=%d "),
2616 algdesc->sadb_x_algdesc_satype);
2617 }
2618 switch (algdesc->sadb_x_algdesc_algtype) {
2619 case SADB_X_ALGTYPE_CRYPT:
2620 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2621 "Encryption = "));
2622 (void) dump_ealg(algdesc->sadb_x_algdesc_alg,
2623 file);
2624 break;
2625 case SADB_X_ALGTYPE_AUTH:
2626 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2627 "Authentication = "));
2628 (void) dump_aalg(algdesc->sadb_x_algdesc_alg,
2629 file);
2630 break;
2631 default:
2632 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2633 "algtype(%d) = alg(%d)"),
2634 algdesc->sadb_x_algdesc_algtype,
2635 algdesc->sadb_x_algdesc_alg);
2636 break;
2637 }
2638
2639 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2640 " minbits=%u, maxbits=%u, saltbits=%u\n"),
2641 algdesc->sadb_x_algdesc_minbits,
2642 algdesc->sadb_x_algdesc_maxbits,
2643 algdesc->sadb_x_algdesc_saltbits);
2644
2645 sofar = (uint64_t *)(++algdesc);
2646 }
2647 ecomb = (struct sadb_x_ecomb *)sofar;
2648 }
2649 }
2650
2651 /*
2652 * Print an SADB_EXT_SUPPORTED extension.
2653 */
2654 void
print_supp(FILE * file,char * prefix,struct sadb_supported * supp)2655 print_supp(FILE *file, char *prefix, struct sadb_supported *supp)
2656 {
2657 struct sadb_alg *algs;
2658 int i, numalgs;
2659
2660 (void) fprintf(file, dgettext(TEXT_DOMAIN, "%sSupported "), prefix);
2661 switch (supp->sadb_supported_exttype) {
2662 case SADB_EXT_SUPPORTED_AUTH:
2663 (void) fprintf(file, dgettext(TEXT_DOMAIN, "authentication"));
2664 break;
2665 case SADB_EXT_SUPPORTED_ENCRYPT:
2666 (void) fprintf(file, dgettext(TEXT_DOMAIN, "encryption"));
2667 break;
2668 }
2669 (void) fprintf(file, dgettext(TEXT_DOMAIN, " algorithms.\n"));
2670
2671 algs = (struct sadb_alg *)(supp + 1);
2672 numalgs = supp->sadb_supported_len - SADB_8TO64(sizeof (*supp));
2673 numalgs /= SADB_8TO64(sizeof (*algs));
2674 for (i = 0; i < numalgs; i++) {
2675 uint16_t exttype = supp->sadb_supported_exttype;
2676
2677 (void) fprintf(file, "%s", prefix);
2678 switch (exttype) {
2679 case SADB_EXT_SUPPORTED_AUTH:
2680 (void) dump_aalg(algs[i].sadb_alg_id, file);
2681 break;
2682 case SADB_EXT_SUPPORTED_ENCRYPT:
2683 (void) dump_ealg(algs[i].sadb_alg_id, file);
2684 break;
2685 }
2686 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2687 " minbits=%u, maxbits=%u, ivlen=%u, saltbits=%u"),
2688 algs[i].sadb_alg_minbits, algs[i].sadb_alg_maxbits,
2689 algs[i].sadb_alg_ivlen, algs[i].sadb_x_alg_saltbits);
2690 if (exttype == SADB_EXT_SUPPORTED_ENCRYPT)
2691 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2692 ", increment=%u"), algs[i].sadb_x_alg_increment);
2693 (void) fprintf(file, dgettext(TEXT_DOMAIN, ".\n"));
2694 }
2695 }
2696
2697 /*
2698 * Print an SADB_EXT_SPIRANGE extension.
2699 */
2700 void
print_spirange(FILE * file,char * prefix,struct sadb_spirange * range)2701 print_spirange(FILE *file, char *prefix, struct sadb_spirange *range)
2702 {
2703 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2704 "%sSPI Range, min=0x%x, max=0x%x\n"), prefix,
2705 htonl(range->sadb_spirange_min),
2706 htonl(range->sadb_spirange_max));
2707 }
2708
2709 /*
2710 * Print an SADB_X_EXT_KM_COOKIE extension.
2711 */
2712
2713 void
print_kmc(FILE * file,char * prefix,struct sadb_x_kmc * kmc)2714 print_kmc(FILE *file, char *prefix, struct sadb_x_kmc *kmc)
2715 {
2716 char *cookie_label;
2717
2718 switch (kmc->sadb_x_kmc_proto) {
2719 case SADB_X_KMP_IKE:
2720 cookie_label = kmc_lookup_by_cookie(kmc->sadb_x_kmc_cookie);
2721 if (cookie_label == NULL)
2722 cookie_label =
2723 dgettext(TEXT_DOMAIN, "<Label not found.>");
2724 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2725 "%s Protocol %u, cookie=\"%s\" (%u)\n"), prefix,
2726 kmc->sadb_x_kmc_proto, cookie_label,
2727 kmc->sadb_x_kmc_cookie);
2728 return;
2729 case SADB_X_KMP_KINK:
2730 cookie_label = dgettext(TEXT_DOMAIN, "KINK:");
2731 break;
2732 case SADB_X_KMP_MANUAL:
2733 cookie_label = dgettext(TEXT_DOMAIN, "Manual SA with cookie:");
2734 break;
2735 case SADB_X_KMP_IKEV2:
2736 cookie_label = dgettext(TEXT_DOMAIN, "IKEV2:");
2737 break;
2738 default:
2739 cookie_label =
2740 dgettext(TEXT_DOMAIN, "<unknown KM protocol>");
2741 break;
2742 }
2743
2744 /*
2745 * Assume native-byte-order printing for now. Exceptions (like
2746 * byte-swapping) should be handled in per-KM-protocol cases above.
2747 */
2748 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2749 "%s Protocol %u, cookie=\"%s\" (0x%"PRIx64"/%"PRIu64")\n"),
2750 prefix, kmc->sadb_x_kmc_proto, cookie_label,
2751 kmc->sadb_x_kmc_cookie64, kmc->sadb_x_kmc_cookie64);
2752 }
2753
2754 /*
2755 * Print an SADB_X_EXT_REPLAY_CTR extension.
2756 */
2757
2758 void
print_replay(FILE * file,char * prefix,sadb_x_replay_ctr_t * repl)2759 print_replay(FILE *file, char *prefix, sadb_x_replay_ctr_t *repl)
2760 {
2761 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2762 "%sReplay Value "), prefix);
2763 if ((repl->sadb_x_rc_replay32 == 0) &&
2764 (repl->sadb_x_rc_replay64 == 0)) {
2765 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2766 "<Value not found.>"));
2767 }
2768 /*
2769 * We currently do not support a 64-bit replay value.
2770 * RFC 4301 will require one, however, and we have a field
2771 * in place when 4301 is built.
2772 */
2773 (void) fprintf(file, "% " PRIu64 "\n",
2774 ((repl->sadb_x_rc_replay32 == 0) ?
2775 repl->sadb_x_rc_replay64 : repl->sadb_x_rc_replay32));
2776 }
2777 /*
2778 * Print an SADB_X_EXT_PAIR extension.
2779 */
2780 static void
print_pair(FILE * file,char * prefix,struct sadb_x_pair * pair)2781 print_pair(FILE *file, char *prefix, struct sadb_x_pair *pair)
2782 {
2783 (void) fprintf(file, dgettext(TEXT_DOMAIN, "%sPaired with spi=0x%x\n"),
2784 prefix, ntohl(pair->sadb_x_pair_spi));
2785 }
2786
2787 /*
2788 * Take a PF_KEY message pointed to buffer and print it. Useful for DUMP
2789 * and GET.
2790 */
2791 void
print_samsg(FILE * file,uint64_t * buffer,boolean_t want_timestamp,boolean_t vflag,boolean_t ignore_nss)2792 print_samsg(FILE *file, uint64_t *buffer, boolean_t want_timestamp,
2793 boolean_t vflag, boolean_t ignore_nss)
2794 {
2795 uint64_t *current;
2796 struct sadb_msg *samsg = (struct sadb_msg *)buffer;
2797 struct sadb_ext *ext;
2798 struct sadb_lifetime *currentlt = NULL, *hardlt = NULL, *softlt = NULL;
2799 struct sadb_lifetime *idlelt = NULL;
2800 int i;
2801 time_t wallclock;
2802
2803 (void) time(&wallclock);
2804
2805 print_sadb_msg(file, samsg, want_timestamp ? wallclock : 0, vflag);
2806 current = (uint64_t *)(samsg + 1);
2807 while (current - buffer < samsg->sadb_msg_len) {
2808 int lenbytes;
2809
2810 ext = (struct sadb_ext *)current;
2811 lenbytes = SADB_64TO8(ext->sadb_ext_len);
2812 switch (ext->sadb_ext_type) {
2813 case SADB_EXT_SA:
2814 print_sa(file, dgettext(TEXT_DOMAIN,
2815 "SA: "), (struct sadb_sa *)current);
2816 break;
2817 /*
2818 * Pluck out lifetimes and print them at the end. This is
2819 * to show relative lifetimes.
2820 */
2821 case SADB_EXT_LIFETIME_CURRENT:
2822 currentlt = (struct sadb_lifetime *)current;
2823 break;
2824 case SADB_EXT_LIFETIME_HARD:
2825 hardlt = (struct sadb_lifetime *)current;
2826 break;
2827 case SADB_EXT_LIFETIME_SOFT:
2828 softlt = (struct sadb_lifetime *)current;
2829 break;
2830 case SADB_X_EXT_LIFETIME_IDLE:
2831 idlelt = (struct sadb_lifetime *)current;
2832 break;
2833
2834 case SADB_EXT_ADDRESS_SRC:
2835 print_address(file, dgettext(TEXT_DOMAIN, "SRC: "),
2836 (struct sadb_address *)current, ignore_nss);
2837 break;
2838 case SADB_X_EXT_ADDRESS_INNER_SRC:
2839 print_address(file, dgettext(TEXT_DOMAIN, "INS: "),
2840 (struct sadb_address *)current, ignore_nss);
2841 break;
2842 case SADB_EXT_ADDRESS_DST:
2843 print_address(file, dgettext(TEXT_DOMAIN, "DST: "),
2844 (struct sadb_address *)current, ignore_nss);
2845 break;
2846 case SADB_X_EXT_ADDRESS_INNER_DST:
2847 print_address(file, dgettext(TEXT_DOMAIN, "IND: "),
2848 (struct sadb_address *)current, ignore_nss);
2849 break;
2850 case SADB_EXT_KEY_AUTH:
2851 print_key(file, dgettext(TEXT_DOMAIN,
2852 "AKY: "), (struct sadb_key *)current);
2853 break;
2854 case SADB_X_EXT_STR_AUTH:
2855 print_keystr(file, dgettext(TEXT_DOMAIN,
2856 "AST: "), (struct sadb_key *)current);
2857 break;
2858 case SADB_EXT_KEY_ENCRYPT:
2859 print_key(file, dgettext(TEXT_DOMAIN,
2860 "EKY: "), (struct sadb_key *)current);
2861 break;
2862 case SADB_EXT_IDENTITY_SRC:
2863 print_ident(file, dgettext(TEXT_DOMAIN, "SID: "),
2864 (struct sadb_ident *)current);
2865 break;
2866 case SADB_EXT_IDENTITY_DST:
2867 print_ident(file, dgettext(TEXT_DOMAIN, "DID: "),
2868 (struct sadb_ident *)current);
2869 break;
2870 case SADB_EXT_SENSITIVITY:
2871 print_sens(file, dgettext(TEXT_DOMAIN, "SNS: "),
2872 (struct sadb_sens *)current, ignore_nss);
2873 break;
2874 case SADB_EXT_PROPOSAL:
2875 print_prop(file, dgettext(TEXT_DOMAIN, "PRP: "),
2876 (struct sadb_prop *)current);
2877 break;
2878 case SADB_EXT_SUPPORTED_AUTH:
2879 print_supp(file, dgettext(TEXT_DOMAIN, "SUA: "),
2880 (struct sadb_supported *)current);
2881 break;
2882 case SADB_EXT_SUPPORTED_ENCRYPT:
2883 print_supp(file, dgettext(TEXT_DOMAIN, "SUE: "),
2884 (struct sadb_supported *)current);
2885 break;
2886 case SADB_EXT_SPIRANGE:
2887 print_spirange(file, dgettext(TEXT_DOMAIN, "SPR: "),
2888 (struct sadb_spirange *)current);
2889 break;
2890 case SADB_X_EXT_EPROP:
2891 print_eprop(file, dgettext(TEXT_DOMAIN, "EPR: "),
2892 (struct sadb_prop *)current);
2893 break;
2894 case SADB_X_EXT_KM_COOKIE:
2895 print_kmc(file, dgettext(TEXT_DOMAIN, "KMC: "),
2896 (struct sadb_x_kmc *)current);
2897 break;
2898 case SADB_X_EXT_ADDRESS_NATT_REM:
2899 print_address(file, dgettext(TEXT_DOMAIN, "NRM: "),
2900 (struct sadb_address *)current, ignore_nss);
2901 break;
2902 case SADB_X_EXT_ADDRESS_NATT_LOC:
2903 print_address(file, dgettext(TEXT_DOMAIN, "NLC: "),
2904 (struct sadb_address *)current, ignore_nss);
2905 break;
2906 case SADB_X_EXT_PAIR:
2907 print_pair(file, dgettext(TEXT_DOMAIN, "OTH: "),
2908 (struct sadb_x_pair *)current);
2909 break;
2910 case SADB_X_EXT_OUTER_SENS:
2911 print_sens(file, dgettext(TEXT_DOMAIN, "OSN: "),
2912 (struct sadb_sens *)current, ignore_nss);
2913 break;
2914 case SADB_X_EXT_REPLAY_VALUE:
2915 (void) print_replay(file, dgettext(TEXT_DOMAIN,
2916 "RPL: "), (sadb_x_replay_ctr_t *)current);
2917 break;
2918 default:
2919 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2920 "UNK: Unknown ext. %d, len %d.\n"),
2921 ext->sadb_ext_type, lenbytes);
2922 for (i = 0; i < ext->sadb_ext_len; i++)
2923 (void) fprintf(file, dgettext(TEXT_DOMAIN,
2924 "UNK: 0x%" PRIx64 "\n"),
2925 ((uint64_t *)ext)[i]);
2926 break;
2927 }
2928 current += (lenbytes == 0) ?
2929 SADB_8TO64(sizeof (struct sadb_ext)) : ext->sadb_ext_len;
2930 }
2931 /*
2932 * Print lifetimes NOW.
2933 */
2934 if (currentlt != NULL || hardlt != NULL || softlt != NULL ||
2935 idlelt != NULL)
2936 print_lifetimes(file, wallclock, currentlt, hardlt,
2937 softlt, idlelt, vflag);
2938
2939 if (current - buffer != samsg->sadb_msg_len) {
2940 warnxfp(EFD(file), dgettext(TEXT_DOMAIN,
2941 "WARNING: insufficient buffer space or corrupt message."));
2942 }
2943
2944 (void) fflush(file); /* Make sure our message is out there. */
2945 }
2946
2947 /*
2948 * save_XXX functions are used when "saving" the SA tables to either a
2949 * file or standard output. They use the dump_XXX functions where needed,
2950 * but mostly they use the rparseXXX functions.
2951 */
2952
2953 /*
2954 * Print save information for a lifetime extension.
2955 *
2956 * NOTE : It saves the lifetime in absolute terms. For example, if you
2957 * had a hard_usetime of 60 seconds, you'll save it as 60 seconds, even though
2958 * there may have been 59 seconds burned off the clock.
2959 */
2960 boolean_t
save_lifetime(struct sadb_lifetime * lifetime,FILE * ofile)2961 save_lifetime(struct sadb_lifetime *lifetime, FILE *ofile)
2962 {
2963 char *prefix;
2964
2965 switch (lifetime->sadb_lifetime_exttype) {
2966 case SADB_EXT_LIFETIME_HARD:
2967 prefix = "hard";
2968 break;
2969 case SADB_EXT_LIFETIME_SOFT:
2970 prefix = "soft";
2971 break;
2972 case SADB_X_EXT_LIFETIME_IDLE:
2973 prefix = "idle";
2974 break;
2975 }
2976
2977 if (putc('\t', ofile) == EOF)
2978 return (B_FALSE);
2979
2980 if (lifetime->sadb_lifetime_allocations != 0 && fprintf(ofile,
2981 "%s_alloc %u ", prefix, lifetime->sadb_lifetime_allocations) < 0)
2982 return (B_FALSE);
2983
2984 if (lifetime->sadb_lifetime_bytes != 0 && fprintf(ofile,
2985 "%s_bytes %" PRIu64 " ", prefix, lifetime->sadb_lifetime_bytes) < 0)
2986 return (B_FALSE);
2987
2988 if (lifetime->sadb_lifetime_addtime != 0 && fprintf(ofile,
2989 "%s_addtime %" PRIu64 " ", prefix,
2990 lifetime->sadb_lifetime_addtime) < 0)
2991 return (B_FALSE);
2992
2993 if (lifetime->sadb_lifetime_usetime != 0 && fprintf(ofile,
2994 "%s_usetime %" PRIu64 " ", prefix,
2995 lifetime->sadb_lifetime_usetime) < 0)
2996 return (B_FALSE);
2997
2998 return (B_TRUE);
2999 }
3000
3001 /*
3002 * Print save information for an address extension.
3003 */
3004 boolean_t
save_address(struct sadb_address * addr,FILE * ofile)3005 save_address(struct sadb_address *addr, FILE *ofile)
3006 {
3007 char *printable_addr, buf[INET6_ADDRSTRLEN];
3008 const char *prefix, *pprefix;
3009 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)(addr + 1);
3010 struct sockaddr_in *sin = (struct sockaddr_in *)sin6;
3011 int af = sin->sin_family;
3012
3013 /*
3014 * Address-family reality check.
3015 */
3016 if (af != AF_INET6 && af != AF_INET)
3017 return (B_FALSE);
3018
3019 switch (addr->sadb_address_exttype) {
3020 case SADB_EXT_ADDRESS_SRC:
3021 prefix = "src";
3022 pprefix = "sport";
3023 break;
3024 case SADB_X_EXT_ADDRESS_INNER_SRC:
3025 prefix = "isrc";
3026 pprefix = "isport";
3027 break;
3028 case SADB_EXT_ADDRESS_DST:
3029 prefix = "dst";
3030 pprefix = "dport";
3031 break;
3032 case SADB_X_EXT_ADDRESS_INNER_DST:
3033 prefix = "idst";
3034 pprefix = "idport";
3035 break;
3036 case SADB_X_EXT_ADDRESS_NATT_LOC:
3037 prefix = "nat_loc ";
3038 pprefix = "nat_lport";
3039 break;
3040 case SADB_X_EXT_ADDRESS_NATT_REM:
3041 prefix = "nat_rem ";
3042 pprefix = "nat_rport";
3043 break;
3044 }
3045
3046 if (fprintf(ofile, " %s ", prefix) < 0)
3047 return (B_FALSE);
3048
3049 /*
3050 * Do not do address-to-name translation, given that we live in
3051 * an age of names that explode into many addresses.
3052 */
3053 printable_addr = (char *)inet_ntop(af,
3054 (af == AF_INET) ? (char *)&sin->sin_addr : (char *)&sin6->sin6_addr,
3055 buf, sizeof (buf));
3056 if (printable_addr == NULL)
3057 printable_addr = "Invalid IP address.";
3058 if (fprintf(ofile, "%s", printable_addr) < 0)
3059 return (B_FALSE);
3060 if (addr->sadb_address_prefixlen != 0 &&
3061 !((addr->sadb_address_prefixlen == 32 && af == AF_INET) ||
3062 (addr->sadb_address_prefixlen == 128 && af == AF_INET6))) {
3063 if (fprintf(ofile, "/%d", addr->sadb_address_prefixlen) < 0)
3064 return (B_FALSE);
3065 }
3066
3067 /*
3068 * The port is in the same position for struct sockaddr_in and
3069 * struct sockaddr_in6. We exploit that property here.
3070 */
3071 if ((pprefix != NULL) && (sin->sin_port != 0))
3072 (void) fprintf(ofile, " %s %d", pprefix, ntohs(sin->sin_port));
3073
3074 return (B_TRUE);
3075 }
3076
3077 /*
3078 * Print save information for a key extension. Returns whether writing
3079 * to the specified output file was successful or not.
3080 */
3081 boolean_t
save_key(struct sadb_key * key,FILE * ofile)3082 save_key(struct sadb_key *key, FILE *ofile)
3083 {
3084 char *prefix;
3085
3086 if (putc('\t', ofile) == EOF)
3087 return (B_FALSE);
3088
3089 prefix = (key->sadb_key_exttype == SADB_EXT_KEY_AUTH) ? "auth" : "encr";
3090
3091 if (fprintf(ofile, "%skey ", prefix) < 0)
3092 return (B_FALSE);
3093
3094 if (dump_key((uint8_t *)(key + 1), key->sadb_key_bits,
3095 key->sadb_key_reserved, ofile, B_FALSE) == -1)
3096 return (B_FALSE);
3097
3098 return (B_TRUE);
3099 }
3100
3101 /*
3102 * Print save information for a key extension. Returns whether writing
3103 * to the specified output file was successful or not.
3104 */
3105 boolean_t
save_keystr(struct sadb_key * key,FILE * ofile)3106 save_keystr(struct sadb_key *key, FILE *ofile)
3107 {
3108 if (putc('\t', ofile) == EOF)
3109 return (B_FALSE);
3110
3111 if (fprintf(ofile, "authstring \"") < 0)
3112 return (B_FALSE);
3113
3114 if (dump_keystr((uint8_t *)(key + 1), key->sadb_key_bits, ofile) == -1)
3115 return (B_FALSE);
3116
3117 if (fprintf(ofile, "\"") < 0)
3118 return (B_FALSE);
3119
3120 return (B_TRUE);
3121 }
3122
3123 /*
3124 * Print save information for an identity extension.
3125 */
3126 boolean_t
save_ident(struct sadb_ident * ident,FILE * ofile)3127 save_ident(struct sadb_ident *ident, FILE *ofile)
3128 {
3129 char *prefix;
3130
3131 if (putc('\t', ofile) == EOF)
3132 return (B_FALSE);
3133
3134 prefix = (ident->sadb_ident_exttype == SADB_EXT_IDENTITY_SRC) ? "src" :
3135 "dst";
3136
3137 if (fprintf(ofile, "%sidtype %s ", prefix,
3138 rparseidtype(ident->sadb_ident_type)) < 0)
3139 return (B_FALSE);
3140
3141 if (ident->sadb_ident_type == SADB_X_IDENTTYPE_DN ||
3142 ident->sadb_ident_type == SADB_X_IDENTTYPE_GN) {
3143 if (fprintf(ofile, dgettext(TEXT_DOMAIN,
3144 "<can-not-print>")) < 0)
3145 return (B_FALSE);
3146 } else {
3147 if (fprintf(ofile, "%s", (char *)(ident + 1)) < 0)
3148 return (B_FALSE);
3149 }
3150
3151 return (B_TRUE);
3152 }
3153
3154 boolean_t
save_sens(struct sadb_sens * sens,FILE * ofile)3155 save_sens(struct sadb_sens *sens, FILE *ofile)
3156 {
3157 char *prefix;
3158 char *hlabel;
3159 bslabel_t sl;
3160
3161 if (putc('\t', ofile) == EOF)
3162 return (B_FALSE);
3163
3164 if (sens->sadb_sens_exttype == SADB_EXT_SENSITIVITY)
3165 prefix = "label";
3166 else if ((sens->sadb_x_sens_flags & SADB_X_SENS_IMPLICIT) == 0)
3167 prefix = "outer-label";
3168 else
3169 prefix = "implicit-label";
3170
3171 ipsec_convert_sens_to_bslabel(sens, &sl);
3172 ipsec_convert_bslabel_to_hex(&sl, &hlabel);
3173
3174 if (fprintf(ofile, "%s %s ", prefix, hlabel) < 0) {
3175 free(hlabel);
3176 return (B_FALSE);
3177 }
3178 free(hlabel);
3179
3180 return (B_TRUE);
3181 }
3182
3183 /*
3184 * "Save" a security association to an output file.
3185 *
3186 * NOTE the lack of calls to dgettext() because I'm outputting parseable stuff.
3187 * ALSO NOTE that if you change keywords (see parsecmd()), you'll have to
3188 * change them here as well.
3189 */
3190 void
save_assoc(uint64_t * buffer,FILE * ofile)3191 save_assoc(uint64_t *buffer, FILE *ofile)
3192 {
3193 int terrno;
3194 boolean_t seen_proto = B_FALSE, seen_iproto = B_FALSE;
3195 uint64_t *current;
3196 struct sadb_address *addr;
3197 struct sadb_x_replay_ctr *repl;
3198 struct sadb_msg *samsg = (struct sadb_msg *)buffer;
3199 struct sadb_ext *ext;
3200 boolean_t tcpsig = samsg->sadb_msg_satype == SADB_X_SATYPE_TCPSIG;
3201
3202 #define tidyup() \
3203 terrno = errno; (void) fclose(ofile); errno = terrno; \
3204 interactive = B_FALSE
3205
3206 #define savenl() if (fputs(" \\\n", ofile) == EOF) \
3207 { bail(dgettext(TEXT_DOMAIN, "savenl")); }
3208
3209 if (fputs("# begin assoc\n", ofile) == EOF)
3210 bail(dgettext(TEXT_DOMAIN,
3211 "save_assoc: Opening comment of SA"));
3212 if (tcpsig) {
3213 if (fprintf(ofile, "add ") < 0) {
3214 bail(dgettext(TEXT_DOMAIN,
3215 "save_assoc: First line of SA"));
3216 }
3217 seen_proto = B_TRUE;
3218 } else {
3219 if (fprintf(ofile, "add %s ",
3220 rparsesatype(samsg->sadb_msg_satype)) < 0) {
3221 bail(dgettext(TEXT_DOMAIN,
3222 "save_assoc: First line of SA"));
3223 }
3224 }
3225 savenl();
3226
3227 current = (uint64_t *)(samsg + 1);
3228 while (current - buffer < samsg->sadb_msg_len) {
3229 struct sadb_sa *assoc;
3230
3231 ext = (struct sadb_ext *)current;
3232 addr = (struct sadb_address *)ext; /* Just in case... */
3233 switch (ext->sadb_ext_type) {
3234 case SADB_EXT_SA:
3235 assoc = (struct sadb_sa *)ext;
3236 if (assoc->sadb_sa_state != SADB_SASTATE_MATURE) {
3237 if (fprintf(ofile, "# WARNING: SA was dying "
3238 "or dead.\n") < 0) {
3239 tidyup();
3240 bail(dgettext(TEXT_DOMAIN,
3241 "save_assoc: fprintf not mature"));
3242 }
3243 }
3244 if (!tcpsig) {
3245 if (fprintf(ofile, " spi 0x%x ",
3246 ntohl(assoc->sadb_sa_spi)) < 0) {
3247 tidyup();
3248 bail(dgettext(TEXT_DOMAIN,
3249 "save_assoc: fprintf spi"));
3250 }
3251 }
3252 if (assoc->sadb_sa_encrypt != SADB_EALG_NONE) {
3253 if (fprintf(ofile, "encr_alg %s ",
3254 rparsealg(assoc->sadb_sa_encrypt,
3255 IPSEC_PROTO_ESP)) < 0) {
3256 tidyup();
3257 bail(dgettext(TEXT_DOMAIN,
3258 "save_assoc: fprintf encrypt"));
3259 }
3260 }
3261 if (assoc->sadb_sa_auth != SADB_AALG_NONE) {
3262 int ret;
3263
3264 if ((assoc->sadb_sa_flags &
3265 SADB_X_SAFLAGS_TCPSIG) != 0) {
3266 ret = fprintf(ofile, " authalg %s ",
3267 rparsetcpsigalg(
3268 assoc->sadb_sa_auth));
3269 } else {
3270 ret = fprintf(ofile, "auth_alg %s ",
3271 rparsealg(assoc->sadb_sa_auth,
3272 IPSEC_PROTO_AH));
3273 }
3274 if (ret < 0) {
3275 tidyup();
3276 bail(dgettext(TEXT_DOMAIN,
3277 "save_assoc: fprintf auth"));
3278 }
3279 }
3280 if ((assoc->sadb_sa_flags &
3281 SADB_X_SAFLAGS_TCPSIG) == 0) {
3282 if (fprintf(ofile, "replay %d ",
3283 assoc->sadb_sa_replay) < 0) {
3284 tidyup();
3285 bail(dgettext(TEXT_DOMAIN,
3286 "save_assoc: fprintf replay"));
3287 }
3288 }
3289 if (assoc->sadb_sa_flags & (SADB_X_SAFLAGS_NATT_LOC |
3290 SADB_X_SAFLAGS_NATT_REM)) {
3291 if (fprintf(ofile, "encap udp") < 0) {
3292 tidyup();
3293 bail(dgettext(TEXT_DOMAIN,
3294 "save_assoc: fprintf encap"));
3295 }
3296 }
3297 savenl();
3298 break;
3299 case SADB_EXT_LIFETIME_HARD:
3300 case SADB_EXT_LIFETIME_SOFT:
3301 case SADB_X_EXT_LIFETIME_IDLE:
3302 if (!save_lifetime((struct sadb_lifetime *)ext,
3303 ofile)) {
3304 tidyup();
3305 bail(dgettext(TEXT_DOMAIN, "save_lifetime"));
3306 }
3307 savenl();
3308 break;
3309 case SADB_X_EXT_ADDRESS_INNER_SRC:
3310 case SADB_X_EXT_ADDRESS_INNER_DST:
3311 if (!seen_iproto && addr->sadb_address_proto) {
3312 (void) fprintf(ofile, " iproto %d",
3313 addr->sadb_address_proto);
3314 savenl();
3315 seen_iproto = B_TRUE;
3316 }
3317 goto skip_srcdst; /* Hack to avoid cases below... */
3318 /* FALLTHRU */
3319 case SADB_EXT_ADDRESS_SRC:
3320 case SADB_EXT_ADDRESS_DST:
3321 if (!seen_proto && addr->sadb_address_proto) {
3322 (void) fprintf(ofile, " proto %d",
3323 addr->sadb_address_proto);
3324 savenl();
3325 seen_proto = B_TRUE;
3326 }
3327 /* FALLTHRU */
3328 case SADB_X_EXT_ADDRESS_NATT_REM:
3329 case SADB_X_EXT_ADDRESS_NATT_LOC:
3330 skip_srcdst:
3331 if (!save_address(addr, ofile)) {
3332 tidyup();
3333 bail(dgettext(TEXT_DOMAIN, "save_address"));
3334 }
3335 savenl();
3336 break;
3337 case SADB_EXT_KEY_AUTH:
3338 case SADB_EXT_KEY_ENCRYPT:
3339 if (!save_key((struct sadb_key *)ext, ofile)) {
3340 tidyup();
3341 bail(dgettext(TEXT_DOMAIN, "save_key"));
3342 }
3343 savenl();
3344 break;
3345 case SADB_X_EXT_STR_AUTH:
3346 if (!save_keystr((struct sadb_key *)ext, ofile)) {
3347 tidyup();
3348 bail(dgettext(TEXT_DOMAIN, "save_keystr"));
3349 }
3350 savenl();
3351 break;
3352 case SADB_EXT_IDENTITY_SRC:
3353 case SADB_EXT_IDENTITY_DST:
3354 if (!save_ident((struct sadb_ident *)ext, ofile)) {
3355 tidyup();
3356 bail(dgettext(TEXT_DOMAIN, "save_ident"));
3357 }
3358 savenl();
3359 break;
3360 case SADB_X_EXT_REPLAY_VALUE:
3361 repl = (sadb_x_replay_ctr_t *)ext;
3362 if ((repl->sadb_x_rc_replay32 == 0) &&
3363 (repl->sadb_x_rc_replay64 == 0)) {
3364 tidyup();
3365 bail(dgettext(TEXT_DOMAIN, "Replay Value"));
3366 }
3367 if (fprintf(ofile, "replay_value %" PRIu64 "",
3368 (repl->sadb_x_rc_replay32 == 0 ?
3369 repl->sadb_x_rc_replay64 :
3370 repl->sadb_x_rc_replay32)) < 0) {
3371 tidyup();
3372 bail(dgettext(TEXT_DOMAIN,
3373 "save_assoc: fprintf replay value"));
3374 }
3375 savenl();
3376 break;
3377 case SADB_EXT_SENSITIVITY:
3378 case SADB_X_EXT_OUTER_SENS:
3379 if (!save_sens((struct sadb_sens *)ext, ofile)) {
3380 tidyup();
3381 bail(dgettext(TEXT_DOMAIN, "save_sens"));
3382 }
3383 savenl();
3384 break;
3385 default:
3386 /* Skip over irrelevant extensions. */
3387 break;
3388 }
3389 current += ext->sadb_ext_len;
3390 }
3391
3392 if (fputs(dgettext(TEXT_DOMAIN, "\n# end assoc\n\n"), ofile) == EOF) {
3393 tidyup();
3394 bail(dgettext(TEXT_DOMAIN, "save_assoc: last fputs"));
3395 }
3396 }
3397
3398 /*
3399 * Open the output file for the "save" command.
3400 */
3401 FILE *
opensavefile(char * filename)3402 opensavefile(char *filename)
3403 {
3404 int fd;
3405 FILE *retval;
3406 struct stat buf;
3407
3408 /*
3409 * If the user specifies "-" or doesn't give a filename, then
3410 * dump to stdout. Make sure to document the dangers of files
3411 * that are NFS, directing your output to strange places, etc.
3412 */
3413 if (filename == NULL || strcmp("-", filename) == 0)
3414 return (stdout);
3415
3416 /*
3417 * open the file with the create bits set. Since I check for
3418 * real UID == root in main(), I won't worry about the ownership
3419 * problem.
3420 */
3421 fd = open(filename, O_WRONLY | O_EXCL | O_CREAT | O_TRUNC, S_IRUSR);
3422 if (fd == -1) {
3423 if (errno != EEXIST)
3424 bail_msg("%s %s: %s", filename, dgettext(TEXT_DOMAIN,
3425 "open error"),
3426 strerror(errno));
3427 fd = open(filename, O_WRONLY | O_TRUNC, 0);
3428 if (fd == -1)
3429 bail_msg("%s %s: %s", filename, dgettext(TEXT_DOMAIN,
3430 "open error"), strerror(errno));
3431 if (fstat(fd, &buf) == -1) {
3432 (void) close(fd);
3433 bail_msg("%s fstat: %s", filename, strerror(errno));
3434 }
3435 if (S_ISREG(buf.st_mode) &&
3436 ((buf.st_mode & S_IAMB) != S_IRUSR)) {
3437 warnx(dgettext(TEXT_DOMAIN,
3438 "WARNING: Save file already exists with "
3439 "permission %o."), (uint_t)(buf.st_mode & S_IAMB));
3440 warnx(dgettext(TEXT_DOMAIN,
3441 "Normal users may be able to read IPsec "
3442 "keying material."));
3443 }
3444 }
3445
3446 /* Okay, we have an FD. Assign it to a stdio FILE pointer. */
3447 retval = fdopen(fd, "w");
3448 if (retval == NULL) {
3449 (void) close(fd);
3450 bail_msg("%s %s: %s", filename, dgettext(TEXT_DOMAIN,
3451 "fdopen error"), strerror(errno));
3452 }
3453 return (retval);
3454 }
3455
3456 const char *
do_inet_ntop(const void * addr,char * cp,size_t size)3457 do_inet_ntop(const void *addr, char *cp, size_t size)
3458 {
3459 boolean_t isv4;
3460 struct in6_addr *inaddr6 = (struct in6_addr *)addr;
3461 struct in_addr inaddr;
3462
3463 if ((isv4 = IN6_IS_ADDR_V4MAPPED(inaddr6)) == B_TRUE) {
3464 IN6_V4MAPPED_TO_INADDR(inaddr6, &inaddr);
3465 }
3466
3467 return (inet_ntop(isv4 ? AF_INET : AF_INET6,
3468 isv4 ? (void *)&inaddr : inaddr6, cp, size));
3469 }
3470
3471 char numprint[NBUF_SIZE];
3472
3473 /*
3474 * Parse and reverse parse a specific SA type (AH, ESP, etc.).
3475 */
3476 static struct typetable {
3477 char *type;
3478 int token;
3479 } type_table[] = {
3480 {"all", SADB_SATYPE_UNSPEC},
3481 {"ah", SADB_SATYPE_AH},
3482 {"esp", SADB_SATYPE_ESP},
3483 {"tcpsig", SADB_X_SATYPE_TCPSIG},
3484 /* PF_KEY NOTE: More to come if net/pfkeyv2.h gets updated. */
3485 {NULL, 0} /* Token value is irrelevant for this entry. */
3486 };
3487
3488 char *
rparsesatype(int type)3489 rparsesatype(int type)
3490 {
3491 struct typetable *tt = type_table;
3492
3493 while (tt->type != NULL && type != tt->token)
3494 tt++;
3495
3496 if (tt->type == NULL) {
3497 (void) snprintf(numprint, NBUF_SIZE, "%d", type);
3498 } else {
3499 return (tt->type);
3500 }
3501
3502 return (numprint);
3503 }
3504
3505
3506 /*
3507 * Return a string containing the name of the specified numerical algorithm
3508 * identifier.
3509 */
3510 char *
rparsealg(uint8_t alg,int proto_num)3511 rparsealg(uint8_t alg, int proto_num)
3512 {
3513 static struct ipsecalgent *holder = NULL; /* we're single-threaded */
3514
3515 if (holder != NULL)
3516 freeipsecalgent(holder);
3517
3518 holder = getipsecalgbynum(alg, proto_num, NULL);
3519 if (holder == NULL) {
3520 (void) snprintf(numprint, NBUF_SIZE, "%d", alg);
3521 return (numprint);
3522 }
3523
3524 return (*(holder->a_names));
3525 }
3526
3527 const char *
rparsetcpsigalg(uint8_t alg)3528 rparsetcpsigalg(uint8_t alg)
3529 {
3530 const char *name = gettcpsigalgbynum(alg);
3531
3532 if (name == NULL) {
3533 (void) snprintf(numprint, NBUF_SIZE, "%d", alg);
3534 return (numprint);
3535 }
3536
3537 return (name);
3538 }
3539
3540 /*
3541 * Parse and reverse parse out a source/destination ID type.
3542 */
3543 static struct idtypes {
3544 char *idtype;
3545 uint8_t retval;
3546 } idtypes[] = {
3547 {"prefix", SADB_IDENTTYPE_PREFIX},
3548 {"fqdn", SADB_IDENTTYPE_FQDN},
3549 {"domain", SADB_IDENTTYPE_FQDN},
3550 {"domainname", SADB_IDENTTYPE_FQDN},
3551 {"user_fqdn", SADB_IDENTTYPE_USER_FQDN},
3552 {"mailbox", SADB_IDENTTYPE_USER_FQDN},
3553 {"der_dn", SADB_X_IDENTTYPE_DN},
3554 {"der_gn", SADB_X_IDENTTYPE_GN},
3555 {NULL, 0}
3556 };
3557
3558 char *
rparseidtype(uint16_t type)3559 rparseidtype(uint16_t type)
3560 {
3561 struct idtypes *idp;
3562
3563 for (idp = idtypes; idp->idtype != NULL; idp++) {
3564 if (type == idp->retval)
3565 return (idp->idtype);
3566 }
3567
3568 (void) snprintf(numprint, NBUF_SIZE, "%d", type);
3569 return (numprint);
3570 }
3571
3572 /*
3573 * This is a general purpose exit function, calling functions can specify an
3574 * error type. If the command calling this function was started by smf(7) the
3575 * error type could be used as a hint to the restarter. In the future this
3576 * function could be used to do something more intelligent with a process that
3577 * encounters an error. If exit() is called with an error code other than those
3578 * defined by smf(7), the program will just get restarted. Unless restarting
3579 * is likely to resolve the error condition, its probably sensible to just
3580 * log the error and keep running.
3581 *
3582 * The SERVICE_* exit_types mean nothing if the command was run from the
3583 * command line, just exit(). There are two special cases:
3584 *
3585 * SERVICE_DEGRADE - Not implemented in smf(7), one day it could hint that
3586 * the service is not running as well is it could. For
3587 * now, don't do anything, just record the error.
3588 * DEBUG_FATAL - Something happened, if the command was being run in debug
3589 * mode, exit() as you really want to know something happened,
3590 * otherwise just keep running. This is ignored when running
3591 * under smf(7).
3592 *
3593 * The function will handle an optional variable args error message, this
3594 * will be written to the error stream, typically a log file or stderr.
3595 */
3596 void
ipsecutil_exit(exit_type_t type,char * fmri,FILE * fp,const char * fmt,...)3597 ipsecutil_exit(exit_type_t type, char *fmri, FILE *fp, const char *fmt, ...)
3598 {
3599 int exit_status;
3600 va_list args;
3601
3602 if (fp == NULL)
3603 fp = stderr;
3604 if (fmt != NULL) {
3605 va_start(args, fmt);
3606 vwarnxfp(fp, fmt, args);
3607 va_end(args);
3608 }
3609
3610 if (fmri == NULL) {
3611 /* Command being run directly from a shell. */
3612 switch (type) {
3613 case SERVICE_EXIT_OK:
3614 exit_status = 0;
3615 break;
3616 case SERVICE_DEGRADE:
3617 return;
3618 case SERVICE_BADPERM:
3619 case SERVICE_BADCONF:
3620 case SERVICE_MAINTAIN:
3621 case SERVICE_DISABLE:
3622 case SERVICE_FATAL:
3623 case SERVICE_RESTART:
3624 case DEBUG_FATAL:
3625 warnxfp(fp, "Fatal error - exiting.");
3626 exit_status = 1;
3627 break;
3628 }
3629 } else {
3630 /* Command being run as a smf(7) method. */
3631 switch (type) {
3632 case SERVICE_EXIT_OK:
3633 exit_status = SMF_EXIT_OK;
3634 break;
3635 case SERVICE_DEGRADE: /* Not implemented yet. */
3636 case DEBUG_FATAL:
3637 /* Keep running, don't exit(). */
3638 return;
3639 case SERVICE_BADPERM:
3640 warnxfp(fp, dgettext(TEXT_DOMAIN,
3641 "Permission error with %s."), fmri);
3642 exit_status = SMF_EXIT_ERR_PERM;
3643 break;
3644 case SERVICE_BADCONF:
3645 warnxfp(fp, dgettext(TEXT_DOMAIN,
3646 "Bad configuration of service %s."), fmri);
3647 exit_status = SMF_EXIT_ERR_FATAL;
3648 break;
3649 case SERVICE_MAINTAIN:
3650 warnxfp(fp, dgettext(TEXT_DOMAIN,
3651 "Service %s needs maintenance."), fmri);
3652 exit_status = SMF_EXIT_ERR_FATAL;
3653 break;
3654 case SERVICE_DISABLE:
3655 exit_status = SMF_EXIT_ERR_FATAL;
3656 break;
3657 case SERVICE_FATAL:
3658 warnxfp(fp, dgettext(TEXT_DOMAIN,
3659 "Service %s fatal error."), fmri);
3660 exit_status = SMF_EXIT_ERR_FATAL;
3661 break;
3662 case SERVICE_RESTART:
3663 exit_status = 1;
3664 break;
3665 }
3666 }
3667 (void) fflush(fp);
3668 (void) fclose(fp);
3669 exit(exit_status);
3670 }
3671
3672 void
print_asn1_name(FILE * file,const unsigned char * buf,long buflen)3673 print_asn1_name(FILE *file, const unsigned char *buf, long buflen)
3674 {
3675 KMF_X509_NAME name = { 0 };
3676 KMF_DATA data = { 0 };
3677 char *str = NULL;
3678
3679 data.Data = (unsigned char *)buf;
3680 data.Length = buflen;
3681
3682 if (DerDecodeName(&data, &name) != KMF_OK)
3683 goto fail;
3684
3685 if (kmf_dn_to_string(&name, &str) != KMF_OK)
3686 goto fail;
3687
3688 (void) fprintf(file, "%s\n", str);
3689 kmf_free_dn(&name);
3690 free(str);
3691 return;
3692 fail:
3693 kmf_free_dn(&name);
3694 (void) fprintf(file, dgettext(TEXT_DOMAIN, "<cannot interpret>\n"));
3695 }
3696