1 /* 2 * 3 * CDDL HEADER START 4 * 5 * The contents of this file are subject to the terms of the 6 * Common Development and Distribution License (the "License"). 7 * You may not use this file except in compliance with the License. 8 * 9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10 * or http://www.opensolaris.org/os/licensing. 11 * See the License for the specific language governing permissions 12 * and limitations under the License. 13 * 14 * When distributing Covered Code, include this CDDL HEADER in each 15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16 * If applicable, add the following below this CDDL HEADER, with the 17 * fields enclosed by brackets "[]" replaced with your own identifying 18 * information: Portions Copyright [yyyy] [name of copyright owner] 19 * 20 * CDDL HEADER END 21 */ 22 /* 23 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 * Copyright 2012 Milan Juri. All rights reserved. 26 * Copyright 2018 Joyent, Inc. 27 * Copyright 2018 OmniOS Community Edition (OmniOSce) Association. 28 * Copyright 2024 Oxide Computer Company 29 * Copyright 2026 Edgecast Cloud LLC. 30 */ 31 32 #include <unistd.h> 33 #include <stdio.h> 34 #include <stdlib.h> 35 #include <stdarg.h> 36 #include <sys/types.h> 37 #include <sys/stat.h> 38 #include <fcntl.h> 39 #include <sys/sysconf.h> 40 #include <strings.h> 41 #include <ctype.h> 42 #include <errno.h> 43 #include <sys/socket.h> 44 #include <netdb.h> 45 #include <netinet/in.h> 46 #include <arpa/inet.h> 47 #include <net/pfkeyv2.h> 48 #include <net/pfpolicy.h> 49 #include <libintl.h> 50 #include <setjmp.h> 51 #include <libgen.h> 52 #include <libscf.h> 53 #include <kmfapi.h> 54 #include <ber_der.h> 55 56 #include "ipsec_util.h" 57 #include "ikedoor.h" 58 59 /* 60 * This file contains support functions that are shared by the ipsec 61 * utilities and daemons including ipseckey(8), ikeadm(8) and in.iked(8). 62 */ 63 64 65 #define EFD(file) (((file) == stdout) ? stderr : (file)) 66 67 /* Limits for interactive mode. */ 68 #define MAX_LINE_LEN IBUF_SIZE 69 #define MAX_CMD_HIST 64000 /* in bytes */ 70 71 /* Set standard default/initial values for globals... */ 72 boolean_t pflag = B_FALSE; /* paranoid w.r.t. printing keying material */ 73 boolean_t nflag = B_FALSE; /* avoid nameservice? */ 74 boolean_t interactive = B_FALSE; /* util not running on cmdline */ 75 boolean_t readfile = B_FALSE; /* cmds are being read from a file */ 76 uint_t lineno = 0; /* track location if reading cmds from file */ 77 uint_t lines_added = 0; 78 uint_t lines_parsed = 0; 79 jmp_buf env; /* for error recovery in interactive/readfile modes */ 80 char *my_fmri = NULL; 81 FILE *debugfile = stderr; 82 static GetLine *gl = NULL; /* for interactive mode */ 83 84 /* 85 * Print errno and exit if cmdline or readfile, reset state if interactive 86 * The error string *what should be dgettext()'d before calling bail(). 87 */ 88 void 89 bail(char *what) 90 { 91 if (errno != 0) 92 warn(what); 93 else 94 warnx(dgettext(TEXT_DOMAIN, "Error: %s"), what); 95 if (readfile) { 96 return; 97 } 98 if (interactive && !readfile) 99 longjmp(env, 2); 100 EXIT_FATAL(NULL); 101 } 102 103 /* 104 * Print caller-supplied variable-arg error msg, then exit if cmdline or 105 * readfile, or reset state if interactive. 106 */ 107 /*PRINTFLIKE1*/ 108 void 109 bail_msg(char *fmt, ...) 110 { 111 va_list ap; 112 char msgbuf[BUFSIZ]; 113 114 va_start(ap, fmt); 115 (void) vsnprintf(msgbuf, BUFSIZ, fmt, ap); 116 va_end(ap); 117 if (readfile) 118 warnx(dgettext(TEXT_DOMAIN, 119 "ERROR on line %u:\n%s\n"), lineno, msgbuf); 120 else 121 warnx(dgettext(TEXT_DOMAIN, "ERROR: %s\n"), msgbuf); 122 123 if (interactive && !readfile) 124 longjmp(env, 1); 125 126 EXIT_FATAL(NULL); 127 } 128 129 /* 130 * bytecnt2str() wrapper. Zeroes out the input buffer and if the number 131 * of bytes to be converted is more than 1K, it will produce readable string 132 * in parentheses, store it in the original buffer and return the pointer to it. 133 * Maximum length of the returned string is 14 characters (not including 134 * the terminating zero). 135 */ 136 char * 137 bytecnt2out(uint64_t num, char *buf, size_t bufsiz, int flags) 138 { 139 char *str; 140 141 (void) memset(buf, '\0', bufsiz); 142 143 if (num > 1024) { 144 /* Return empty string in case of out-of-memory. */ 145 if ((str = malloc(bufsiz)) == NULL) 146 return (buf); 147 148 (void) bytecnt2str(num, str, bufsiz); 149 /* Detect overflow. */ 150 if (strlen(str) == 0) { 151 free(str); 152 return (buf); 153 } 154 155 /* Emit nothing in case of overflow. */ 156 if (snprintf(buf, bufsiz, "%s(%sB)%s", 157 flags & SPC_BEGIN ? " " : "", str, 158 flags & SPC_END ? " " : "") >= bufsiz) 159 (void) memset(buf, '\0', bufsiz); 160 161 free(str); 162 } 163 164 return (buf); 165 } 166 167 /* 168 * Convert 64-bit number to human readable string. Useful mainly for the 169 * byte lifetime counters. Returns pointer to the user supplied buffer. 170 * Able to convert up to Exabytes. Maximum length of the string produced 171 * is 9 characters (not counting the terminating zero). 172 */ 173 char * 174 bytecnt2str(uint64_t num, char *buf, size_t buflen) 175 { 176 uint64_t n = num; 177 char u; 178 int index = 0; 179 180 while (n >= 1024) { 181 n /= 1024; 182 index++; 183 } 184 185 /* The field has all units this function can represent. */ 186 u = " KMGTPE"[index]; 187 188 if (index == 0) { 189 /* Less than 1K */ 190 if (snprintf(buf, buflen, "%llu ", num) >= buflen) 191 (void) memset(buf, '\0', buflen); 192 } else { 193 /* Otherwise display 2 precision digits. */ 194 if (snprintf(buf, buflen, "%.2f %c", 195 (double)num / (1ULL << index * 10), u) >= buflen) 196 (void) memset(buf, '\0', buflen); 197 } 198 199 return (buf); 200 } 201 202 /* 203 * secs2str() wrapper. Zeroes out the input buffer and if the number of 204 * seconds to be converted is more than minute, it will produce readable 205 * string in parentheses, store it in the original buffer and return the 206 * pointer to it. 207 */ 208 char * 209 secs2out(unsigned int secs, char *buf, int bufsiz, int flags) 210 { 211 char *str; 212 213 (void) memset(buf, '\0', bufsiz); 214 215 if (secs > 60) { 216 /* Return empty string in case of out-of-memory. */ 217 if ((str = malloc(bufsiz)) == NULL) 218 return (buf); 219 220 (void) secs2str(secs, str, bufsiz); 221 /* Detect overflow. */ 222 if (strlen(str) == 0) { 223 free(str); 224 return (buf); 225 } 226 227 /* Emit nothing in case of overflow. */ 228 if (snprintf(buf, bufsiz, "%s(%s)%s", 229 flags & SPC_BEGIN ? " " : "", str, 230 flags & SPC_END ? " " : "") >= bufsiz) 231 (void) memset(buf, '\0', bufsiz); 232 233 free(str); 234 } 235 236 return (buf); 237 } 238 239 /* 240 * Convert number of seconds to human readable string. Useful mainly for 241 * the lifetime counters. Returns pointer to the user supplied buffer. 242 * Able to convert up to days. 243 */ 244 char * 245 secs2str(unsigned int secs, char *buf, int bufsiz) 246 { 247 double val = secs; 248 char *unit = "second"; 249 250 if (val >= 24*60*60) { 251 val /= 86400; 252 unit = "day"; 253 } else if (val >= 60*60) { 254 val /= 60*60; 255 unit = "hour"; 256 } else if (val >= 60) { 257 val /= 60; 258 unit = "minute"; 259 } 260 261 /* Emit nothing in case of overflow. */ 262 if (snprintf(buf, bufsiz, "%.2f %s%s", val, unit, 263 val >= 2 ? "s" : "") >= bufsiz) 264 (void) memset(buf, '\0', bufsiz); 265 266 return (buf); 267 } 268 269 /* 270 * dump_XXX functions produce ASCII output from various structures. 271 * 272 * Because certain errors need to do this to stderr, dump_XXX functions 273 * take a FILE pointer. 274 * 275 * If an error occured while writing to the specified file, these 276 * functions return -1, zero otherwise. 277 */ 278 279 int 280 dump_sockaddr(struct sockaddr *sa, uint8_t prefixlen, boolean_t addr_only, 281 FILE *where, boolean_t ignore_nss) 282 { 283 struct sockaddr_in *sin; 284 struct sockaddr_in6 *sin6; 285 char *printable_addr, *protocol; 286 uint8_t *addrptr; 287 /* Add 4 chars to hold '/nnn' for prefixes. */ 288 char storage[INET6_ADDRSTRLEN + 4]; 289 uint16_t port; 290 boolean_t unspec; 291 struct hostent *hp; 292 int getipnode_errno, addrlen; 293 294 switch (sa->sa_family) { 295 case AF_INET: 296 /* LINTED E_BAD_PTR_CAST_ALIGN */ 297 sin = (struct sockaddr_in *)sa; 298 addrptr = (uint8_t *)&sin->sin_addr; 299 port = sin->sin_port; 300 protocol = "AF_INET"; 301 unspec = (sin->sin_addr.s_addr == 0); 302 addrlen = sizeof (sin->sin_addr); 303 break; 304 case AF_INET6: 305 /* LINTED E_BAD_PTR_CAST_ALIGN */ 306 sin6 = (struct sockaddr_in6 *)sa; 307 addrptr = (uint8_t *)&sin6->sin6_addr; 308 port = sin6->sin6_port; 309 protocol = "AF_INET6"; 310 unspec = IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr); 311 addrlen = sizeof (sin6->sin6_addr); 312 break; 313 default: 314 return (0); 315 } 316 317 if (inet_ntop(sa->sa_family, addrptr, storage, INET6_ADDRSTRLEN) == 318 NULL) { 319 printable_addr = dgettext(TEXT_DOMAIN, "Invalid IP address."); 320 } else { 321 char prefix[5]; /* "/nnn" with terminator. */ 322 323 (void) snprintf(prefix, sizeof (prefix), "/%d", prefixlen); 324 printable_addr = storage; 325 if (prefixlen != 0) { 326 (void) strlcat(printable_addr, prefix, 327 sizeof (storage)); 328 } 329 } 330 if (addr_only) { 331 if (fprintf(where, "%s", printable_addr) < 0) 332 return (-1); 333 } else { 334 if (fprintf(where, dgettext(TEXT_DOMAIN, 335 "%s: port %d, %s"), protocol, 336 ntohs(port), printable_addr) < 0) 337 return (-1); 338 if (ignore_nss == B_FALSE) { 339 /* 340 * Do AF_independent reverse hostname lookup here. 341 */ 342 if (unspec) { 343 if (fprintf(where, 344 dgettext(TEXT_DOMAIN, 345 " <unspecified>")) < 0) 346 return (-1); 347 } else { 348 hp = getipnodebyaddr((char *)addrptr, addrlen, 349 sa->sa_family, &getipnode_errno); 350 if (hp != NULL) { 351 if (fprintf(where, 352 " (%s)", hp->h_name) < 0) 353 return (-1); 354 freehostent(hp); 355 } else { 356 if (fprintf(where, 357 dgettext(TEXT_DOMAIN, 358 " <unknown>")) < 0) 359 return (-1); 360 } 361 } 362 } 363 if (fputs(".\n", where) == EOF) 364 return (-1); 365 } 366 return (0); 367 } 368 369 /* 370 * Dump a key, any salt and bitlen. 371 * The key is made up of a stream of bits. If the algorithm requires a salt 372 * value, this will also be part of the dumped key. The last "saltbits" of the 373 * key string, reading left to right will be the salt value. To make it easier 374 * to see which bits make up the key, the salt value is enclosed in []'s. 375 * This function can also be called when ipseckey(8) -s is run, this "saves" 376 * the SAs, including the key to a file. When this is the case, the []'s are 377 * not printed. 378 * 379 * The implementation allows the kernel to be told about the length of the salt 380 * in whole bytes only. If this changes, this function will need to be updated. 381 */ 382 int 383 dump_key(uint8_t *keyp, uint_t bitlen, uint_t saltbits, FILE *where, 384 boolean_t separate_salt) 385 { 386 int numbytes, saltbytes; 387 388 numbytes = SADB_1TO8(bitlen); 389 saltbytes = SADB_1TO8(saltbits); 390 numbytes += saltbytes; 391 392 /* The & 0x7 is to check for leftover bits. */ 393 if ((bitlen & 0x7) != 0) 394 numbytes++; 395 396 while (numbytes-- != 0) { 397 if (pflag) { 398 /* Print no keys if paranoid */ 399 if (fprintf(where, "XX") < 0) 400 return (-1); 401 } else { 402 if (fprintf(where, "%02x", *keyp++) < 0) 403 return (-1); 404 } 405 if (separate_salt && saltbytes != 0 && 406 numbytes == saltbytes) { 407 if (fprintf(where, "[") < 0) 408 return (-1); 409 } 410 } 411 412 if (separate_salt && saltbits != 0) { 413 if (fprintf(where, "]/%u+%u", bitlen, saltbits) < 0) 414 return (-1); 415 } else { 416 if (fprintf(where, "/%u", bitlen + saltbits) < 0) 417 return (-1); 418 } 419 420 return (0); 421 } 422 423 int 424 dump_keystr(uint8_t *keystr, uint_t bitlen, FILE *where) 425 { 426 size_t keylen; 427 uint_t i; 428 429 /* There should be no leftover bits for a key string */ 430 if ((bitlen & 0x7) != 0) 431 return (-1); 432 433 keylen = SADB_1TO8(bitlen); 434 435 for (i = 0; i < keylen; i++) { 436 if (pflag) 437 (void) fprintf(where, "XX"); 438 else if (isprint(keystr[i])) 439 (void) fprintf(where, "%c", keystr[i]); 440 else 441 (void) fprintf(where, "\\x%x", keystr[i]); 442 } 443 444 return (0); 445 } 446 447 448 static struct tcpsigalg { 449 uint8_t ta_value; 450 const char *ta_name; 451 } tcpalgs[] = { 452 { .ta_name = "md5", .ta_value = SADB_AALG_MD5 } 453 }; 454 455 uint8_t 456 gettcpsigalgbyname(const char *name) 457 { 458 uint_t i; 459 460 for (i = 0; i < ARRAY_SIZE(tcpalgs); i++) { 461 if (strcmp(name, tcpalgs[i].ta_name) == 0) 462 return (tcpalgs[i].ta_value); 463 } 464 return (0); 465 } 466 467 const char * 468 gettcpsigalgbynum(uint8_t num) 469 { 470 uint_t i; 471 472 for (i = 0; i < ARRAY_SIZE(tcpalgs); i++) { 473 if (num == tcpalgs[i].ta_value) 474 return (tcpalgs[i].ta_name); 475 } 476 return (NULL); 477 } 478 479 /* 480 * Print an authentication or encryption algorithm 481 */ 482 static int 483 dump_generic_alg(uint8_t alg_num, int proto_num, FILE *where) 484 { 485 struct ipsecalgent *alg; 486 487 alg = getipsecalgbynum(alg_num, proto_num, NULL); 488 if (alg == NULL) { 489 if (fprintf(where, dgettext(TEXT_DOMAIN, 490 "<unknown %u>"), alg_num) < 0) 491 return (-1); 492 return (0); 493 } 494 495 /* 496 * Special-case <none> for backward output compat. 497 * Assume that SADB_AALG_NONE == SADB_EALG_NONE. 498 */ 499 if (alg_num == SADB_AALG_NONE) { 500 if (fputs(dgettext(TEXT_DOMAIN, 501 "<none>"), where) == EOF) 502 return (-1); 503 } else { 504 if (fputs(alg->a_names[0], where) == EOF) 505 return (-1); 506 } 507 508 freeipsecalgent(alg); 509 return (0); 510 } 511 512 int 513 dump_aalg(uint8_t aalg, FILE *where) 514 { 515 return (dump_generic_alg(aalg, IPSEC_PROTO_AH, where)); 516 } 517 518 int 519 dump_ealg(uint8_t ealg, FILE *where) 520 { 521 return (dump_generic_alg(ealg, IPSEC_PROTO_ESP, where)); 522 } 523 524 int 525 dump_tcpsigalg(uint8_t aalg, FILE *where) 526 { 527 const char *name = gettcpsigalgbynum(aalg); 528 529 if (name == NULL) { 530 if (fprintf(where, dgettext(TEXT_DOMAIN, 531 "<unknown %u>"), aalg) < 0) { 532 return (-1); 533 } 534 return (0); 535 } 536 537 if (fputs(name, where) == EOF) 538 return (-1); 539 540 return (0); 541 } 542 543 /* 544 * Print an SADB_IDENTTYPE string 545 * 546 * Also return TRUE if the actual ident may be printed, FALSE if not. 547 * 548 * If rc is not NULL, set its value to -1 if an error occured while writing 549 * to the specified file, zero otherwise. 550 */ 551 boolean_t 552 dump_sadb_idtype(uint8_t idtype, FILE *where, int *rc) 553 { 554 boolean_t canprint = B_TRUE; 555 int rc_val = 0; 556 557 switch (idtype) { 558 case SADB_IDENTTYPE_PREFIX: 559 if (fputs(dgettext(TEXT_DOMAIN, "prefix"), where) == EOF) 560 rc_val = -1; 561 break; 562 case SADB_IDENTTYPE_FQDN: 563 if (fputs(dgettext(TEXT_DOMAIN, "FQDN"), where) == EOF) 564 rc_val = -1; 565 break; 566 case SADB_IDENTTYPE_USER_FQDN: 567 if (fputs(dgettext(TEXT_DOMAIN, 568 "user-FQDN (mbox)"), where) == EOF) 569 rc_val = -1; 570 break; 571 case SADB_X_IDENTTYPE_DN: 572 if (fputs(dgettext(TEXT_DOMAIN, "ASN.1 DER Distinguished Name"), 573 where) == EOF) 574 rc_val = -1; 575 canprint = B_FALSE; 576 break; 577 case SADB_X_IDENTTYPE_GN: 578 if (fputs(dgettext(TEXT_DOMAIN, "ASN.1 DER Generic Name"), 579 where) == EOF) 580 rc_val = -1; 581 canprint = B_FALSE; 582 break; 583 case SADB_X_IDENTTYPE_KEY_ID: 584 if (fputs(dgettext(TEXT_DOMAIN, "Generic key id"), 585 where) == EOF) 586 rc_val = -1; 587 break; 588 case SADB_X_IDENTTYPE_ADDR_RANGE: 589 if (fputs(dgettext(TEXT_DOMAIN, "Address range"), where) == EOF) 590 rc_val = -1; 591 break; 592 default: 593 if (fprintf(where, dgettext(TEXT_DOMAIN, 594 "<unknown %u>"), idtype) < 0) 595 rc_val = -1; 596 break; 597 } 598 599 if (rc != NULL) 600 *rc = rc_val; 601 602 return (canprint); 603 } 604 605 /* 606 * Slice an argv/argc vector from an interactive line or a read-file line. 607 */ 608 static int 609 create_argv(char *ibuf, int *newargc, char ***thisargv) 610 { 611 unsigned int argvlen = START_ARG; 612 char **current; 613 boolean_t firstchar = B_TRUE; 614 boolean_t inquotes = B_FALSE; 615 616 *thisargv = malloc(sizeof (char *) * argvlen); 617 if ((*thisargv) == NULL) 618 return (MEMORY_ALLOCATION); 619 current = *thisargv; 620 *current = NULL; 621 622 for (; *ibuf != '\0'; ibuf++) { 623 if (isspace(*ibuf)) { 624 if (inquotes) { 625 continue; 626 } 627 if (*current != NULL) { 628 *ibuf = '\0'; 629 current++; 630 if (*thisargv + argvlen == current) { 631 /* Regrow ***thisargv. */ 632 if (argvlen == TOO_MANY_ARGS) { 633 free(*thisargv); 634 return (TOO_MANY_TOKENS); 635 } 636 /* Double the allocation. */ 637 current = realloc(*thisargv, 638 sizeof (char *) * (argvlen << 1)); 639 if (current == NULL) { 640 free(*thisargv); 641 return (MEMORY_ALLOCATION); 642 } 643 *thisargv = current; 644 current += argvlen; 645 argvlen <<= 1; /* Double the size. */ 646 } 647 *current = NULL; 648 } 649 } else { 650 if (firstchar) { 651 firstchar = B_FALSE; 652 if (*ibuf == COMMENT_CHAR || *ibuf == '\n') { 653 free(*thisargv); 654 return (COMMENT_LINE); 655 } 656 } 657 if (*ibuf == QUOTE_CHAR) { 658 if (inquotes) { 659 inquotes = B_FALSE; 660 *ibuf = '\0'; 661 } else { 662 inquotes = B_TRUE; 663 } 664 continue; 665 } 666 if (*current == NULL) { 667 *current = ibuf; 668 (*newargc)++; 669 } 670 } 671 } 672 673 /* 674 * Tricky corner case... 675 * I've parsed _exactly_ the amount of args as I have space. It 676 * won't return NULL-terminated, and bad things will happen to 677 * the caller. 678 */ 679 if (argvlen == *newargc) { 680 current = realloc(*thisargv, sizeof (char *) * (argvlen + 1)); 681 if (current == NULL) { 682 free(*thisargv); 683 return (MEMORY_ALLOCATION); 684 } 685 *thisargv = current; 686 current[argvlen] = NULL; 687 } 688 689 return (SUCCESS); 690 } 691 692 /* 693 * init interactive mode if needed and not yet initialized 694 */ 695 static void 696 init_interactive(FILE *infile, CplMatchFn *match_fn) 697 { 698 if (infile == stdin) { 699 if (gl == NULL) { 700 if ((gl = new_GetLine(MAX_LINE_LEN, 701 MAX_CMD_HIST)) == NULL) 702 errx(1, dgettext(TEXT_DOMAIN, 703 "tecla initialization failed")); 704 705 if (gl_customize_completion(gl, NULL, 706 match_fn) != 0) { 707 (void) del_GetLine(gl); 708 errx(1, dgettext(TEXT_DOMAIN, 709 "tab completion failed to initialize")); 710 } 711 712 /* 713 * In interactive mode we only want to terminate 714 * when explicitly requested (e.g. by a command). 715 */ 716 (void) sigset(SIGINT, SIG_IGN); 717 } 718 } else { 719 readfile = B_TRUE; 720 } 721 } 722 723 /* 724 * free tecla data structure 725 */ 726 static void 727 fini_interactive(void) 728 { 729 if (gl != NULL) 730 (void) del_GetLine(gl); 731 } 732 733 /* 734 * Get single input line, wrapping around interactive and non-interactive 735 * mode. 736 */ 737 static char * 738 do_getstr(FILE *infile, char *prompt, char *ibuf, size_t ibuf_size) 739 { 740 char *line; 741 742 if (infile != stdin) 743 return (fgets(ibuf, ibuf_size, infile)); 744 745 /* 746 * If the user hits ^C then we want to catch it and 747 * start over. If the user hits EOF then we want to 748 * bail out. 749 */ 750 once_again: 751 line = gl_get_line(gl, prompt, NULL, -1); 752 if (gl_return_status(gl) == GLR_SIGNAL) { 753 gl_abandon_line(gl); 754 goto once_again; 755 } else if (gl_return_status(gl) == GLR_ERROR) { 756 gl_abandon_line(gl); 757 errx(1, dgettext(TEXT_DOMAIN, "Error reading terminal: %s\n"), 758 gl_error_message(gl, NULL, 0)); 759 } else { 760 if (line != NULL) { 761 if (strlcpy(ibuf, line, ibuf_size) >= ibuf_size) 762 warnx(dgettext(TEXT_DOMAIN, 763 "Line too long (max=%zu chars)"), 764 ibuf_size); 765 line = ibuf; 766 } 767 } 768 769 return (line); 770 } 771 772 /* 773 * Enter a mode where commands are read from a file. Treat stdin special. 774 */ 775 void 776 do_interactive(FILE *infile, char *configfile, char *promptstring, 777 char *my_fmri, parse_cmdln_fn parseit, CplMatchFn *match_fn) 778 { 779 char ibuf[IBUF_SIZE], holder[IBUF_SIZE]; 780 char *volatile hptr, **thisargv, *ebuf; 781 int thisargc; 782 volatile boolean_t continue_in_progress = B_FALSE; 783 char *s; 784 785 (void) setjmp(env); 786 787 ebuf = NULL; 788 interactive = B_TRUE; 789 bzero(ibuf, IBUF_SIZE); 790 791 /* panics for us */ 792 init_interactive(infile, match_fn); 793 794 while ((s = do_getstr(infile, promptstring, ibuf, IBUF_SIZE)) != NULL) { 795 if (readfile) 796 lineno++; 797 thisargc = 0; 798 thisargv = NULL; 799 800 /* 801 * Check byte IBUF_SIZE - 2, because byte IBUF_SIZE - 1 will 802 * be null-terminated because of fgets(). 803 */ 804 if (ibuf[IBUF_SIZE - 2] != '\0') { 805 if (infile == stdin) { 806 /* do_getstr() issued a warning already */ 807 bzero(ibuf, IBUF_SIZE); 808 continue; 809 } else { 810 ipsecutil_exit(SERVICE_FATAL, my_fmri, 811 debugfile, dgettext(TEXT_DOMAIN, 812 "Line %d too big."), lineno); 813 } 814 } 815 816 if (!continue_in_progress) { 817 /* Use -2 because of \n from fgets. */ 818 if (ibuf[strlen(ibuf) - 2] == CONT_CHAR) { 819 /* 820 * Can use strcpy here, I've checked the 821 * length already. 822 */ 823 (void) strcpy(holder, ibuf); 824 hptr = &(holder[strlen(holder)]); 825 826 /* Remove the CONT_CHAR from the string. */ 827 hptr[-2] = ' '; 828 829 continue_in_progress = B_TRUE; 830 bzero(ibuf, IBUF_SIZE); 831 continue; 832 } 833 } else { 834 /* Handle continuations... */ 835 (void) strncpy(hptr, ibuf, 836 (size_t)(&(holder[IBUF_SIZE]) - hptr)); 837 if (holder[IBUF_SIZE - 1] != '\0') { 838 ipsecutil_exit(SERVICE_FATAL, my_fmri, 839 debugfile, dgettext(TEXT_DOMAIN, 840 "Command buffer overrun.")); 841 } 842 /* Use - 2 because of \n from fgets. */ 843 if (hptr[strlen(hptr) - 2] == CONT_CHAR) { 844 bzero(ibuf, IBUF_SIZE); 845 hptr += strlen(hptr); 846 847 /* Remove the CONT_CHAR from the string. */ 848 hptr[-2] = ' '; 849 850 continue; 851 } else { 852 continue_in_progress = B_FALSE; 853 /* 854 * I've already checked the length... 855 */ 856 (void) strcpy(ibuf, holder); 857 } 858 } 859 860 /* 861 * Just in case the command fails keep a copy of the 862 * command buffer for diagnostic output. 863 */ 864 if (readfile) { 865 /* 866 * The error buffer needs to be big enough to 867 * hold the longest command string, plus 868 * some extra text, see below. 869 */ 870 ebuf = calloc((IBUF_SIZE * 2), sizeof (char)); 871 if (ebuf == NULL) { 872 ipsecutil_exit(SERVICE_FATAL, my_fmri, 873 debugfile, dgettext(TEXT_DOMAIN, 874 "Memory allocation error.")); 875 } else { 876 (void) snprintf(ebuf, (IBUF_SIZE * 2), 877 dgettext(TEXT_DOMAIN, 878 "Config file entry near line %u " 879 "caused error(s) or warnings:\n\n%s\n\n"), 880 lineno, ibuf); 881 } 882 } 883 884 switch (create_argv(ibuf, &thisargc, &thisargv)) { 885 case TOO_MANY_TOKENS: 886 ipsecutil_exit(SERVICE_BADCONF, my_fmri, debugfile, 887 dgettext(TEXT_DOMAIN, "Too many input tokens.")); 888 break; 889 case MEMORY_ALLOCATION: 890 ipsecutil_exit(SERVICE_BADCONF, my_fmri, debugfile, 891 dgettext(TEXT_DOMAIN, "Memory allocation error.")); 892 break; 893 case COMMENT_LINE: 894 /* Comment line. */ 895 free(ebuf); 896 break; 897 default: 898 if (thisargc != 0) { 899 lines_parsed++; 900 /* ebuf consumed */ 901 parseit(thisargc, thisargv, ebuf, readfile); 902 } else { 903 free(ebuf); 904 } 905 free(thisargv); 906 if (infile == stdin) { 907 (void) printf("%s", promptstring); 908 (void) fflush(stdout); 909 } 910 break; 911 } 912 bzero(ibuf, IBUF_SIZE); 913 } 914 915 /* 916 * The following code is ipseckey specific. This should never be 917 * used by ikeadm which also calls this function because ikeadm 918 * only runs interactively. If this ever changes this code block 919 * sould be revisited. 920 */ 921 if (readfile) { 922 if (lines_parsed != 0 && lines_added == 0) { 923 ipsecutil_exit(SERVICE_BADCONF, my_fmri, debugfile, 924 dgettext(TEXT_DOMAIN, "Configuration file did not " 925 "contain any valid SAs")); 926 } 927 928 /* 929 * There were errors. Putting the service in maintenance mode. 930 * When svc.startd(8) allows services to degrade themselves, 931 * this should be revisited. 932 * 933 * If this function was called from a program running as a 934 * smf_method(7), print a warning message. Don't spew out the 935 * errors as these will end up in the smf(7) log file which is 936 * publically readable, the errors may contain sensitive 937 * information. 938 */ 939 if ((lines_added < lines_parsed) && (configfile != NULL)) { 940 if (my_fmri != NULL) { 941 ipsecutil_exit(SERVICE_BADCONF, my_fmri, 942 debugfile, dgettext(TEXT_DOMAIN, 943 "The configuration file contained %d " 944 "errors.\n" 945 "Manually check the configuration with:\n" 946 "ipseckey -c %s\n" 947 "Use svcadm(8) to clear maintenance " 948 "condition when errors are resolved.\n"), 949 lines_parsed - lines_added, configfile); 950 } else { 951 EXIT_BADCONFIG(NULL); 952 } 953 } else { 954 if (my_fmri != NULL) 955 ipsecutil_exit(SERVICE_EXIT_OK, my_fmri, 956 debugfile, dgettext(TEXT_DOMAIN, 957 "%d actions successfully processed."), 958 lines_added); 959 } 960 } else { 961 /* no newline upon Ctrl-D */ 962 if (s != NULL) 963 (void) putchar('\n'); 964 (void) fflush(stdout); 965 } 966 967 fini_interactive(); 968 969 EXIT_OK(NULL); 970 } 971 972 /* 973 * Functions to parse strings that represent a debug or privilege level. 974 * These functions are copied from main.c and door.c in usr.lib/in.iked/common. 975 * If this file evolves into a common library that may be used by in.iked 976 * as well as the usr.sbin utilities, those duplicate functions should be 977 * deleted. 978 * 979 * A privilege level may be represented by a simple keyword, corresponding 980 * to one of the possible levels. A debug level may be represented by a 981 * series of keywords, separated by '+' or '-', indicating categories to 982 * be added or removed from the set of categories in the debug level. 983 * For example, +all-op corresponds to level 0xfffffffb (all flags except 984 * for D_OP set); while p1+p2+pfkey corresponds to level 0x38. Note that 985 * the leading '+' is implicit; the first keyword in the list must be for 986 * a category that is to be added. 987 * 988 * These parsing functions make use of a local version of strtok, strtok_d, 989 * which includes an additional parameter, char *delim. This param is filled 990 * in with the character which ends the returned token. In other words, 991 * this version of strtok, in addition to returning the token, also returns 992 * the single character delimiter from the original string which marked the 993 * end of the token. 994 */ 995 static char * 996 strtok_d(char *string, const char *sepset, char *delim) 997 { 998 static char *lasts; 999 char *q, *r; 1000 1001 /* first or subsequent call */ 1002 if (string == NULL) 1003 string = lasts; 1004 1005 if (string == 0) /* return if no tokens remaining */ 1006 return (NULL); 1007 1008 q = string + strspn(string, sepset); /* skip leading separators */ 1009 1010 if (*q == '\0') /* return if no tokens remaining */ 1011 return (NULL); 1012 1013 if ((r = strpbrk(q, sepset)) == NULL) { /* move past token */ 1014 lasts = 0; /* indicate that this is last token */ 1015 } else { 1016 *delim = *r; /* save delimitor */ 1017 *r = '\0'; 1018 lasts = r + 1; 1019 } 1020 return (q); 1021 } 1022 1023 static keywdtab_t privtab[] = { 1024 { IKE_PRIV_MINIMUM, "base" }, 1025 { IKE_PRIV_MODKEYS, "modkeys" }, 1026 { IKE_PRIV_KEYMAT, "keymat" }, 1027 { IKE_PRIV_MINIMUM, "0" }, 1028 }; 1029 1030 int 1031 privstr2num(char *str) 1032 { 1033 keywdtab_t *pp; 1034 char *endp; 1035 int priv; 1036 1037 for (pp = privtab; pp < A_END(privtab); pp++) { 1038 if (strcasecmp(str, pp->kw_str) == 0) 1039 return (pp->kw_tag); 1040 } 1041 1042 priv = strtol(str, &endp, 0); 1043 if (*endp == '\0') 1044 return (priv); 1045 1046 return (-1); 1047 } 1048 1049 static keywdtab_t dbgtab[] = { 1050 { D_CERT, "cert" }, 1051 { D_KEY, "key" }, 1052 { D_OP, "op" }, 1053 { D_P1, "p1" }, 1054 { D_P1, "phase1" }, 1055 { D_P2, "p2" }, 1056 { D_P2, "phase2" }, 1057 { D_PFKEY, "pfkey" }, 1058 { D_POL, "pol" }, 1059 { D_POL, "policy" }, 1060 { D_PROP, "prop" }, 1061 { D_DOOR, "door" }, 1062 { D_CONFIG, "config" }, 1063 { D_LABEL, "label" }, 1064 { D_ALL, "all" }, 1065 { 0, "0" }, 1066 }; 1067 1068 int 1069 dbgstr2num(char *str) 1070 { 1071 keywdtab_t *dp; 1072 1073 for (dp = dbgtab; dp < A_END(dbgtab); dp++) { 1074 if (strcasecmp(str, dp->kw_str) == 0) 1075 return (dp->kw_tag); 1076 } 1077 return (D_INVALID); 1078 } 1079 1080 int 1081 parsedbgopts(char *optarg) 1082 { 1083 char *argp, *endp, op, nextop; 1084 int mask = 0, new; 1085 1086 mask = strtol(optarg, &endp, 0); 1087 if (*endp == '\0') 1088 return (mask); 1089 1090 op = optarg[0]; 1091 if (op != '-') 1092 op = '+'; 1093 argp = strtok_d(optarg, "+-", &nextop); 1094 do { 1095 new = dbgstr2num(argp); 1096 if (new == D_INVALID) { 1097 /* we encountered an invalid keywd */ 1098 return (new); 1099 } 1100 if (op == '+') { 1101 mask |= new; 1102 } else { 1103 mask &= ~new; 1104 } 1105 op = nextop; 1106 } while ((argp = strtok_d(NULL, "+-", &nextop)) != NULL); 1107 1108 return (mask); 1109 } 1110 1111 1112 /* 1113 * functions to manipulate the kmcookie-label mapping file 1114 */ 1115 1116 /* 1117 * Open, lockf, fdopen the given file, returning a FILE * on success, 1118 * or NULL on failure. 1119 */ 1120 FILE * 1121 kmc_open_and_lock(char *name) 1122 { 1123 int fd, rtnerr; 1124 FILE *fp; 1125 1126 if ((fd = open(name, O_RDWR | O_CREAT, S_IRUSR | S_IWUSR)) < 0) { 1127 return (NULL); 1128 } 1129 if (lockf(fd, F_LOCK, 0) < 0) { 1130 return (NULL); 1131 } 1132 if ((fp = fdopen(fd, "a+")) == NULL) { 1133 return (NULL); 1134 } 1135 if (fseek(fp, 0, SEEK_SET) < 0) { 1136 /* save errno in case fclose changes it */ 1137 rtnerr = errno; 1138 (void) fclose(fp); 1139 errno = rtnerr; 1140 return (NULL); 1141 } 1142 return (fp); 1143 } 1144 1145 /* 1146 * Extract an integer cookie and string label from a line from the 1147 * kmcookie-label file. Return -1 on failure, 0 on success. 1148 */ 1149 int 1150 kmc_parse_line(char *line, int *cookie, char **label) 1151 { 1152 char *cookiestr; 1153 1154 *cookie = 0; 1155 *label = NULL; 1156 1157 cookiestr = strtok(line, " \t\n"); 1158 if (cookiestr == NULL) { 1159 return (-1); 1160 } 1161 1162 /* Everything that follows, up to the newline, is the label. */ 1163 *label = strtok(NULL, "\n"); 1164 if (*label == NULL) { 1165 return (-1); 1166 } 1167 1168 *cookie = atoi(cookiestr); 1169 return (0); 1170 } 1171 1172 /* 1173 * Insert a mapping into the file (if it's not already there), given the 1174 * new label. Return the assigned cookie, or -1 on error. 1175 */ 1176 int 1177 kmc_insert_mapping(char *label) 1178 { 1179 FILE *map; 1180 char linebuf[IBUF_SIZE]; 1181 char *cur_label; 1182 int max_cookie = 0, cur_cookie, rtn_cookie; 1183 int rtnerr = 0; 1184 boolean_t found = B_FALSE; 1185 1186 /* open and lock the file; will sleep until lock is available */ 1187 if ((map = kmc_open_and_lock(KMCFILE)) == NULL) { 1188 /* kmc_open_and_lock() sets errno appropriately */ 1189 return (-1); 1190 } 1191 1192 while (fgets(linebuf, sizeof (linebuf), map) != NULL) { 1193 1194 /* Skip blank lines, which often come near EOF. */ 1195 if (strlen(linebuf) == 0) 1196 continue; 1197 1198 if (kmc_parse_line(linebuf, &cur_cookie, &cur_label) < 0) { 1199 rtnerr = EINVAL; 1200 goto error; 1201 } 1202 1203 if (cur_cookie > max_cookie) 1204 max_cookie = cur_cookie; 1205 1206 if ((!found) && (strcmp(cur_label, label) == 0)) { 1207 found = B_TRUE; 1208 rtn_cookie = cur_cookie; 1209 } 1210 } 1211 1212 if (!found) { 1213 rtn_cookie = ++max_cookie; 1214 if ((fprintf(map, "%u\t%s\n", rtn_cookie, label) < 0) || 1215 (fflush(map) < 0)) { 1216 rtnerr = errno; 1217 goto error; 1218 } 1219 } 1220 (void) fclose(map); 1221 1222 return (rtn_cookie); 1223 1224 error: 1225 (void) fclose(map); 1226 errno = rtnerr; 1227 return (-1); 1228 } 1229 1230 /* 1231 * Lookup the given cookie and return its corresponding label. Return 1232 * a pointer to the label on success, NULL on error (or if the label is 1233 * not found). Note that the returned label pointer points to a static 1234 * string, so the label will be overwritten by a subsequent call to the 1235 * function; the function is also not thread-safe as a result. 1236 * 1237 * Because this is possibly publically exported, do not change its name, 1238 * but this is for all intents and purposes an IKEv1/in.iked function. 1239 */ 1240 char * 1241 kmc_lookup_by_cookie(int cookie) 1242 { 1243 FILE *map; 1244 static char linebuf[IBUF_SIZE]; 1245 char *cur_label; 1246 int cur_cookie; 1247 1248 if ((map = kmc_open_and_lock(KMCFILE)) == NULL) { 1249 return (NULL); 1250 } 1251 1252 while (fgets(linebuf, sizeof (linebuf), map) != NULL) { 1253 1254 if (kmc_parse_line(linebuf, &cur_cookie, &cur_label) < 0) { 1255 (void) fclose(map); 1256 return (NULL); 1257 } 1258 1259 if (cookie == cur_cookie) { 1260 (void) fclose(map); 1261 return (cur_label); 1262 } 1263 } 1264 (void) fclose(map); 1265 1266 return (NULL); 1267 } 1268 1269 /* 1270 * Parse basic extension headers and return in the passed-in pointer vector. 1271 * Return values include: 1272 * 1273 * KGE_OK Everything's nice and parsed out. 1274 * If there are no extensions, place NULL in extv[0]. 1275 * KGE_DUP There is a duplicate extension. 1276 * First instance in appropriate bin. First duplicate in 1277 * extv[0]. 1278 * KGE_UNK Unknown extension type encountered. extv[0] contains 1279 * unknown header. 1280 * KGE_LEN Extension length error. 1281 * KGE_CHK High-level reality check failed on specific extension. 1282 * 1283 * My apologies for some of the pointer arithmetic in here. I'm thinking 1284 * like an assembly programmer, yet trying to make the compiler happy. 1285 */ 1286 int 1287 spdsock_get_ext(spd_ext_t *extv[], spd_msg_t *basehdr, uint_t msgsize, 1288 char *diag_buf, uint_t diag_buf_len) 1289 { 1290 int i; 1291 1292 if (diag_buf != NULL) 1293 diag_buf[0] = '\0'; 1294 1295 for (i = 1; i <= SPD_EXT_MAX; i++) 1296 extv[i] = NULL; 1297 1298 i = 0; 1299 /* Use extv[0] as the "current working pointer". */ 1300 1301 extv[0] = (spd_ext_t *)(basehdr + 1); 1302 msgsize = SPD_64TO8(msgsize); 1303 1304 while ((char *)extv[0] < ((char *)basehdr + msgsize)) { 1305 /* Check for unknown headers. */ 1306 i++; 1307 if (extv[0]->spd_ext_type == 0 || 1308 extv[0]->spd_ext_type > SPD_EXT_MAX) { 1309 if (diag_buf != NULL) { 1310 (void) snprintf(diag_buf, diag_buf_len, 1311 "spdsock ext 0x%X unknown: 0x%X", 1312 i, extv[0]->spd_ext_type); 1313 } 1314 return (KGE_UNK); 1315 } 1316 1317 /* 1318 * Check length. Use uint64_t because extlen is in units 1319 * of 64-bit words. If length goes beyond the msgsize, 1320 * return an error. (Zero length also qualifies here.) 1321 */ 1322 if (extv[0]->spd_ext_len == 0 || 1323 (uint8_t *)((uint64_t *)extv[0] + extv[0]->spd_ext_len) > 1324 (uint8_t *)((uint8_t *)basehdr + msgsize)) 1325 return (KGE_LEN); 1326 1327 /* Check for redundant headers. */ 1328 if (extv[extv[0]->spd_ext_type] != NULL) 1329 return (KGE_DUP); 1330 1331 /* If I make it here, assign the appropriate bin. */ 1332 extv[extv[0]->spd_ext_type] = extv[0]; 1333 1334 /* Advance pointer (See above for uint64_t ptr reasoning.) */ 1335 extv[0] = (spd_ext_t *) 1336 ((uint64_t *)extv[0] + extv[0]->spd_ext_len); 1337 } 1338 1339 /* Everything's cool. */ 1340 1341 /* 1342 * If extv[0] == NULL, then there are no extension headers in this 1343 * message. Ensure that this is the case. 1344 */ 1345 if (extv[0] == (spd_ext_t *)(basehdr + 1)) 1346 extv[0] = NULL; 1347 1348 return (KGE_OK); 1349 } 1350 1351 const char * 1352 spdsock_diag(int diagnostic) 1353 { 1354 switch (diagnostic) { 1355 case SPD_DIAGNOSTIC_NONE: 1356 return (dgettext(TEXT_DOMAIN, "no error")); 1357 case SPD_DIAGNOSTIC_UNKNOWN_EXT: 1358 return (dgettext(TEXT_DOMAIN, "unknown extension")); 1359 case SPD_DIAGNOSTIC_BAD_EXTLEN: 1360 return (dgettext(TEXT_DOMAIN, "bad extension length")); 1361 case SPD_DIAGNOSTIC_NO_RULE_EXT: 1362 return (dgettext(TEXT_DOMAIN, "no rule extension")); 1363 case SPD_DIAGNOSTIC_BAD_ADDR_LEN: 1364 return (dgettext(TEXT_DOMAIN, "bad address len")); 1365 case SPD_DIAGNOSTIC_MIXED_AF: 1366 return (dgettext(TEXT_DOMAIN, "mixed address family")); 1367 case SPD_DIAGNOSTIC_ADD_NO_MEM: 1368 return (dgettext(TEXT_DOMAIN, "add: no memory")); 1369 case SPD_DIAGNOSTIC_ADD_WRONG_ACT_COUNT: 1370 return (dgettext(TEXT_DOMAIN, "add: wrong action count")); 1371 case SPD_DIAGNOSTIC_ADD_BAD_TYPE: 1372 return (dgettext(TEXT_DOMAIN, "add: bad type")); 1373 case SPD_DIAGNOSTIC_ADD_BAD_FLAGS: 1374 return (dgettext(TEXT_DOMAIN, "add: bad flags")); 1375 case SPD_DIAGNOSTIC_ADD_INCON_FLAGS: 1376 return (dgettext(TEXT_DOMAIN, "add: inconsistent flags")); 1377 case SPD_DIAGNOSTIC_MALFORMED_LCLPORT: 1378 return (dgettext(TEXT_DOMAIN, "malformed local port")); 1379 case SPD_DIAGNOSTIC_DUPLICATE_LCLPORT: 1380 return (dgettext(TEXT_DOMAIN, "duplicate local port")); 1381 case SPD_DIAGNOSTIC_MALFORMED_REMPORT: 1382 return (dgettext(TEXT_DOMAIN, "malformed remote port")); 1383 case SPD_DIAGNOSTIC_DUPLICATE_REMPORT: 1384 return (dgettext(TEXT_DOMAIN, "duplicate remote port")); 1385 case SPD_DIAGNOSTIC_MALFORMED_PROTO: 1386 return (dgettext(TEXT_DOMAIN, "malformed proto")); 1387 case SPD_DIAGNOSTIC_DUPLICATE_PROTO: 1388 return (dgettext(TEXT_DOMAIN, "duplicate proto")); 1389 case SPD_DIAGNOSTIC_MALFORMED_LCLADDR: 1390 return (dgettext(TEXT_DOMAIN, "malformed local address")); 1391 case SPD_DIAGNOSTIC_DUPLICATE_LCLADDR: 1392 return (dgettext(TEXT_DOMAIN, "duplicate local address")); 1393 case SPD_DIAGNOSTIC_MALFORMED_REMADDR: 1394 return (dgettext(TEXT_DOMAIN, "malformed remote address")); 1395 case SPD_DIAGNOSTIC_DUPLICATE_REMADDR: 1396 return (dgettext(TEXT_DOMAIN, "duplicate remote address")); 1397 case SPD_DIAGNOSTIC_MALFORMED_ACTION: 1398 return (dgettext(TEXT_DOMAIN, "malformed action")); 1399 case SPD_DIAGNOSTIC_DUPLICATE_ACTION: 1400 return (dgettext(TEXT_DOMAIN, "duplicate action")); 1401 case SPD_DIAGNOSTIC_MALFORMED_RULE: 1402 return (dgettext(TEXT_DOMAIN, "malformed rule")); 1403 case SPD_DIAGNOSTIC_DUPLICATE_RULE: 1404 return (dgettext(TEXT_DOMAIN, "duplicate rule")); 1405 case SPD_DIAGNOSTIC_MALFORMED_RULESET: 1406 return (dgettext(TEXT_DOMAIN, "malformed ruleset")); 1407 case SPD_DIAGNOSTIC_DUPLICATE_RULESET: 1408 return (dgettext(TEXT_DOMAIN, "duplicate ruleset")); 1409 case SPD_DIAGNOSTIC_INVALID_RULE_INDEX: 1410 return (dgettext(TEXT_DOMAIN, "invalid rule index")); 1411 case SPD_DIAGNOSTIC_BAD_SPDID: 1412 return (dgettext(TEXT_DOMAIN, "bad spdid")); 1413 case SPD_DIAGNOSTIC_BAD_MSG_TYPE: 1414 return (dgettext(TEXT_DOMAIN, "bad message type")); 1415 case SPD_DIAGNOSTIC_UNSUPP_AH_ALG: 1416 return (dgettext(TEXT_DOMAIN, "unsupported AH algorithm")); 1417 case SPD_DIAGNOSTIC_UNSUPP_ESP_ENCR_ALG: 1418 return (dgettext(TEXT_DOMAIN, 1419 "unsupported ESP encryption algorithm")); 1420 case SPD_DIAGNOSTIC_UNSUPP_ESP_AUTH_ALG: 1421 return (dgettext(TEXT_DOMAIN, 1422 "unsupported ESP authentication algorithm")); 1423 case SPD_DIAGNOSTIC_UNSUPP_AH_KEYSIZE: 1424 return (dgettext(TEXT_DOMAIN, "unsupported AH key size")); 1425 case SPD_DIAGNOSTIC_UNSUPP_ESP_ENCR_KEYSIZE: 1426 return (dgettext(TEXT_DOMAIN, 1427 "unsupported ESP encryption key size")); 1428 case SPD_DIAGNOSTIC_UNSUPP_ESP_AUTH_KEYSIZE: 1429 return (dgettext(TEXT_DOMAIN, 1430 "unsupported ESP authentication key size")); 1431 case SPD_DIAGNOSTIC_NO_ACTION_EXT: 1432 return (dgettext(TEXT_DOMAIN, "No ACTION extension")); 1433 case SPD_DIAGNOSTIC_ALG_ID_RANGE: 1434 return (dgettext(TEXT_DOMAIN, "invalid algorithm identifer")); 1435 case SPD_DIAGNOSTIC_ALG_NUM_KEY_SIZES: 1436 return (dgettext(TEXT_DOMAIN, 1437 "number of key sizes inconsistent")); 1438 case SPD_DIAGNOSTIC_ALG_NUM_BLOCK_SIZES: 1439 return (dgettext(TEXT_DOMAIN, 1440 "number of block sizes inconsistent")); 1441 case SPD_DIAGNOSTIC_ALG_MECH_NAME_LEN: 1442 return (dgettext(TEXT_DOMAIN, "invalid mechanism name length")); 1443 case SPD_DIAGNOSTIC_NOT_GLOBAL_OP: 1444 return (dgettext(TEXT_DOMAIN, 1445 "operation not applicable to all policies")); 1446 case SPD_DIAGNOSTIC_NO_TUNNEL_SELECTORS: 1447 return (dgettext(TEXT_DOMAIN, 1448 "using selectors on a transport-mode tunnel")); 1449 default: 1450 return (dgettext(TEXT_DOMAIN, "unknown diagnostic")); 1451 } 1452 } 1453 1454 /* 1455 * PF_KEY Diagnostic table. 1456 * 1457 * PF_KEY NOTE: If you change pfkeyv2.h's SADB_X_DIAGNOSTIC_* space, this is 1458 * where you need to add new messages. 1459 */ 1460 1461 const char * 1462 keysock_diag(int diagnostic) 1463 { 1464 switch (diagnostic) { 1465 case SADB_X_DIAGNOSTIC_NONE: 1466 return (dgettext(TEXT_DOMAIN, "No diagnostic")); 1467 case SADB_X_DIAGNOSTIC_UNKNOWN_MSG: 1468 return (dgettext(TEXT_DOMAIN, "Unknown message type")); 1469 case SADB_X_DIAGNOSTIC_UNKNOWN_EXT: 1470 return (dgettext(TEXT_DOMAIN, "Unknown extension type")); 1471 case SADB_X_DIAGNOSTIC_BAD_EXTLEN: 1472 return (dgettext(TEXT_DOMAIN, "Bad extension length")); 1473 case SADB_X_DIAGNOSTIC_UNKNOWN_SATYPE: 1474 return (dgettext(TEXT_DOMAIN, 1475 "Unknown Security Association type")); 1476 case SADB_X_DIAGNOSTIC_SATYPE_NEEDED: 1477 return (dgettext(TEXT_DOMAIN, 1478 "Specific Security Association type needed")); 1479 case SADB_X_DIAGNOSTIC_NO_SADBS: 1480 return (dgettext(TEXT_DOMAIN, 1481 "No Security Association Databases present")); 1482 case SADB_X_DIAGNOSTIC_NO_EXT: 1483 return (dgettext(TEXT_DOMAIN, 1484 "No extensions needed for message")); 1485 case SADB_X_DIAGNOSTIC_BAD_SRC_AF: 1486 return (dgettext(TEXT_DOMAIN, "Bad source address family")); 1487 case SADB_X_DIAGNOSTIC_BAD_DST_AF: 1488 return (dgettext(TEXT_DOMAIN, 1489 "Bad destination address family")); 1490 case SADB_X_DIAGNOSTIC_BAD_PROXY_AF: 1491 return (dgettext(TEXT_DOMAIN, 1492 "Bad inner-source address family")); 1493 case SADB_X_DIAGNOSTIC_AF_MISMATCH: 1494 return (dgettext(TEXT_DOMAIN, 1495 "Source/destination address family mismatch")); 1496 case SADB_X_DIAGNOSTIC_BAD_SRC: 1497 return (dgettext(TEXT_DOMAIN, "Bad source address value")); 1498 case SADB_X_DIAGNOSTIC_BAD_DST: 1499 return (dgettext(TEXT_DOMAIN, "Bad destination address value")); 1500 case SADB_X_DIAGNOSTIC_ALLOC_HSERR: 1501 return (dgettext(TEXT_DOMAIN, 1502 "Soft allocations limit more than hard limit")); 1503 case SADB_X_DIAGNOSTIC_BYTES_HSERR: 1504 return (dgettext(TEXT_DOMAIN, 1505 "Soft bytes limit more than hard limit")); 1506 case SADB_X_DIAGNOSTIC_ADDTIME_HSERR: 1507 return (dgettext(TEXT_DOMAIN, "Soft add expiration time later " 1508 "than hard expiration time")); 1509 case SADB_X_DIAGNOSTIC_USETIME_HSERR: 1510 return (dgettext(TEXT_DOMAIN, "Soft use expiration time later " 1511 "than hard expiration time")); 1512 case SADB_X_DIAGNOSTIC_MISSING_SRC: 1513 return (dgettext(TEXT_DOMAIN, "Missing source address")); 1514 case SADB_X_DIAGNOSTIC_MISSING_DST: 1515 return (dgettext(TEXT_DOMAIN, "Missing destination address")); 1516 case SADB_X_DIAGNOSTIC_MISSING_SA: 1517 return (dgettext(TEXT_DOMAIN, "Missing SA extension")); 1518 case SADB_X_DIAGNOSTIC_MISSING_EKEY: 1519 return (dgettext(TEXT_DOMAIN, "Missing encryption key")); 1520 case SADB_X_DIAGNOSTIC_MISSING_AKEY: 1521 return (dgettext(TEXT_DOMAIN, "Missing authentication key")); 1522 case SADB_X_DIAGNOSTIC_MISSING_RANGE: 1523 return (dgettext(TEXT_DOMAIN, "Missing SPI range")); 1524 case SADB_X_DIAGNOSTIC_DUPLICATE_SRC: 1525 return (dgettext(TEXT_DOMAIN, "Duplicate source address")); 1526 case SADB_X_DIAGNOSTIC_DUPLICATE_DST: 1527 return (dgettext(TEXT_DOMAIN, "Duplicate destination address")); 1528 case SADB_X_DIAGNOSTIC_DUPLICATE_SA: 1529 return (dgettext(TEXT_DOMAIN, "Duplicate SA extension")); 1530 case SADB_X_DIAGNOSTIC_DUPLICATE_EKEY: 1531 return (dgettext(TEXT_DOMAIN, "Duplicate encryption key")); 1532 case SADB_X_DIAGNOSTIC_DUPLICATE_AKEY: 1533 return (dgettext(TEXT_DOMAIN, "Duplicate authentication key")); 1534 case SADB_X_DIAGNOSTIC_DUPLICATE_RANGE: 1535 return (dgettext(TEXT_DOMAIN, "Duplicate SPI range")); 1536 case SADB_X_DIAGNOSTIC_MALFORMED_SRC: 1537 return (dgettext(TEXT_DOMAIN, "Malformed source address")); 1538 case SADB_X_DIAGNOSTIC_MALFORMED_DST: 1539 return (dgettext(TEXT_DOMAIN, "Malformed destination address")); 1540 case SADB_X_DIAGNOSTIC_MALFORMED_SA: 1541 return (dgettext(TEXT_DOMAIN, "Malformed SA extension")); 1542 case SADB_X_DIAGNOSTIC_MALFORMED_EKEY: 1543 return (dgettext(TEXT_DOMAIN, "Malformed encryption key")); 1544 case SADB_X_DIAGNOSTIC_MALFORMED_AKEY: 1545 return (dgettext(TEXT_DOMAIN, "Malformed authentication key")); 1546 case SADB_X_DIAGNOSTIC_MALFORMED_RANGE: 1547 return (dgettext(TEXT_DOMAIN, "Malformed SPI range")); 1548 case SADB_X_DIAGNOSTIC_AKEY_PRESENT: 1549 return (dgettext(TEXT_DOMAIN, "Authentication key not needed")); 1550 case SADB_X_DIAGNOSTIC_EKEY_PRESENT: 1551 return (dgettext(TEXT_DOMAIN, "Encryption key not needed")); 1552 case SADB_X_DIAGNOSTIC_PROP_PRESENT: 1553 return (dgettext(TEXT_DOMAIN, "Proposal extension not needed")); 1554 case SADB_X_DIAGNOSTIC_SUPP_PRESENT: 1555 return (dgettext(TEXT_DOMAIN, 1556 "Supported algorithms extension not needed")); 1557 case SADB_X_DIAGNOSTIC_BAD_AALG: 1558 return (dgettext(TEXT_DOMAIN, 1559 "Unsupported authentication algorithm")); 1560 case SADB_X_DIAGNOSTIC_BAD_EALG: 1561 return (dgettext(TEXT_DOMAIN, 1562 "Unsupported encryption algorithm")); 1563 case SADB_X_DIAGNOSTIC_BAD_SAFLAGS: 1564 return (dgettext(TEXT_DOMAIN, "Invalid SA flags")); 1565 case SADB_X_DIAGNOSTIC_BAD_SASTATE: 1566 return (dgettext(TEXT_DOMAIN, "Invalid SA state")); 1567 case SADB_X_DIAGNOSTIC_BAD_AKEYBITS: 1568 return (dgettext(TEXT_DOMAIN, 1569 "Bad number of authentication bits")); 1570 case SADB_X_DIAGNOSTIC_BAD_EKEYBITS: 1571 return (dgettext(TEXT_DOMAIN, 1572 "Bad number of encryption bits")); 1573 case SADB_X_DIAGNOSTIC_ENCR_NOTSUPP: 1574 return (dgettext(TEXT_DOMAIN, 1575 "Encryption not supported for this SA type")); 1576 case SADB_X_DIAGNOSTIC_WEAK_EKEY: 1577 return (dgettext(TEXT_DOMAIN, "Weak encryption key")); 1578 case SADB_X_DIAGNOSTIC_WEAK_AKEY: 1579 return (dgettext(TEXT_DOMAIN, "Weak authentication key")); 1580 case SADB_X_DIAGNOSTIC_DUPLICATE_KMP: 1581 return (dgettext(TEXT_DOMAIN, 1582 "Duplicate key management protocol")); 1583 case SADB_X_DIAGNOSTIC_DUPLICATE_KMC: 1584 return (dgettext(TEXT_DOMAIN, 1585 "Duplicate key management cookie")); 1586 case SADB_X_DIAGNOSTIC_MISSING_NATT_LOC: 1587 return (dgettext(TEXT_DOMAIN, "Missing NAT-T local address")); 1588 case SADB_X_DIAGNOSTIC_MISSING_NATT_REM: 1589 return (dgettext(TEXT_DOMAIN, "Missing NAT-T remote address")); 1590 case SADB_X_DIAGNOSTIC_DUPLICATE_NATT_LOC: 1591 return (dgettext(TEXT_DOMAIN, "Duplicate NAT-T local address")); 1592 case SADB_X_DIAGNOSTIC_DUPLICATE_NATT_REM: 1593 return (dgettext(TEXT_DOMAIN, 1594 "Duplicate NAT-T remote address")); 1595 case SADB_X_DIAGNOSTIC_MALFORMED_NATT_LOC: 1596 return (dgettext(TEXT_DOMAIN, "Malformed NAT-T local address")); 1597 case SADB_X_DIAGNOSTIC_MALFORMED_NATT_REM: 1598 return (dgettext(TEXT_DOMAIN, 1599 "Malformed NAT-T remote address")); 1600 case SADB_X_DIAGNOSTIC_DUPLICATE_NATT_PORTS: 1601 return (dgettext(TEXT_DOMAIN, "Duplicate NAT-T ports")); 1602 case SADB_X_DIAGNOSTIC_MISSING_INNER_SRC: 1603 return (dgettext(TEXT_DOMAIN, "Missing inner source address")); 1604 case SADB_X_DIAGNOSTIC_MISSING_INNER_DST: 1605 return (dgettext(TEXT_DOMAIN, 1606 "Missing inner destination address")); 1607 case SADB_X_DIAGNOSTIC_DUPLICATE_INNER_SRC: 1608 return (dgettext(TEXT_DOMAIN, 1609 "Duplicate inner source address")); 1610 case SADB_X_DIAGNOSTIC_DUPLICATE_INNER_DST: 1611 return (dgettext(TEXT_DOMAIN, 1612 "Duplicate inner destination address")); 1613 case SADB_X_DIAGNOSTIC_MALFORMED_INNER_SRC: 1614 return (dgettext(TEXT_DOMAIN, 1615 "Malformed inner source address")); 1616 case SADB_X_DIAGNOSTIC_MALFORMED_INNER_DST: 1617 return (dgettext(TEXT_DOMAIN, 1618 "Malformed inner destination address")); 1619 case SADB_X_DIAGNOSTIC_PREFIX_INNER_SRC: 1620 return (dgettext(TEXT_DOMAIN, 1621 "Invalid inner-source prefix length ")); 1622 case SADB_X_DIAGNOSTIC_PREFIX_INNER_DST: 1623 return (dgettext(TEXT_DOMAIN, 1624 "Invalid inner-destination prefix length")); 1625 case SADB_X_DIAGNOSTIC_BAD_INNER_DST_AF: 1626 return (dgettext(TEXT_DOMAIN, 1627 "Bad inner-destination address family")); 1628 case SADB_X_DIAGNOSTIC_INNER_AF_MISMATCH: 1629 return (dgettext(TEXT_DOMAIN, 1630 "Inner source/destination address family mismatch")); 1631 case SADB_X_DIAGNOSTIC_BAD_NATT_REM_AF: 1632 return (dgettext(TEXT_DOMAIN, 1633 "Bad NAT-T remote address family")); 1634 case SADB_X_DIAGNOSTIC_BAD_NATT_LOC_AF: 1635 return (dgettext(TEXT_DOMAIN, 1636 "Bad NAT-T local address family")); 1637 case SADB_X_DIAGNOSTIC_PROTO_MISMATCH: 1638 return (dgettext(TEXT_DOMAIN, 1639 "Source/desination protocol mismatch")); 1640 case SADB_X_DIAGNOSTIC_INNER_PROTO_MISMATCH: 1641 return (dgettext(TEXT_DOMAIN, 1642 "Inner source/desination protocol mismatch")); 1643 case SADB_X_DIAGNOSTIC_DUAL_PORT_SETS: 1644 return (dgettext(TEXT_DOMAIN, 1645 "Both inner ports and outer ports are set")); 1646 case SADB_X_DIAGNOSTIC_PAIR_INAPPROPRIATE: 1647 return (dgettext(TEXT_DOMAIN, 1648 "Pairing failed, target SA unsuitable for pairing")); 1649 case SADB_X_DIAGNOSTIC_PAIR_ADD_MISMATCH: 1650 return (dgettext(TEXT_DOMAIN, 1651 "Source/destination address differs from pair SA")); 1652 case SADB_X_DIAGNOSTIC_PAIR_ALREADY: 1653 return (dgettext(TEXT_DOMAIN, 1654 "Already paired with another security association")); 1655 case SADB_X_DIAGNOSTIC_PAIR_SA_NOTFOUND: 1656 return (dgettext(TEXT_DOMAIN, 1657 "Command failed, pair security association not found")); 1658 case SADB_X_DIAGNOSTIC_BAD_SA_DIRECTION: 1659 return (dgettext(TEXT_DOMAIN, 1660 "Inappropriate SA direction")); 1661 case SADB_X_DIAGNOSTIC_SA_NOTFOUND: 1662 return (dgettext(TEXT_DOMAIN, 1663 "Security association not found")); 1664 case SADB_X_DIAGNOSTIC_SA_EXPIRED: 1665 return (dgettext(TEXT_DOMAIN, 1666 "Security association is not valid")); 1667 case SADB_X_DIAGNOSTIC_BAD_CTX: 1668 return (dgettext(TEXT_DOMAIN, 1669 "Algorithm invalid or not supported by Crypto Framework")); 1670 case SADB_X_DIAGNOSTIC_INVALID_REPLAY: 1671 return (dgettext(TEXT_DOMAIN, 1672 "Invalid Replay counter")); 1673 case SADB_X_DIAGNOSTIC_MISSING_LIFETIME: 1674 return (dgettext(TEXT_DOMAIN, 1675 "Inappropriate lifetimes")); 1676 case SADB_X_DIAGNOSTIC_MISSING_ASTR: 1677 return (dgettext(TEXT_DOMAIN, "Missing authentication string")); 1678 case SADB_X_DIAGNOSTIC_DUPLICATE_ASTR: 1679 return (dgettext(TEXT_DOMAIN, 1680 "Duplicate authentication string")); 1681 case SADB_X_DIAGNOSTIC_MALFORMED_ASTR: 1682 return (dgettext(TEXT_DOMAIN, 1683 "Malformed authentication string")); 1684 default: 1685 return (dgettext(TEXT_DOMAIN, "Unknown diagnostic code")); 1686 } 1687 } 1688 1689 /* 1690 * Convert an IPv6 mask to a prefix len. I assume all IPv6 masks are 1691 * contiguous, so I stop at the first zero bit! 1692 */ 1693 int 1694 in_masktoprefix(uint8_t *mask, boolean_t is_v4mapped) 1695 { 1696 int rc = 0; 1697 uint8_t last; 1698 int limit = IPV6_ABITS; 1699 1700 if (is_v4mapped) { 1701 mask += ((IPV6_ABITS - IP_ABITS)/8); 1702 limit = IP_ABITS; 1703 } 1704 1705 while (*mask == 0xff) { 1706 rc += 8; 1707 if (rc == limit) 1708 return (limit); 1709 mask++; 1710 } 1711 1712 last = *mask; 1713 while (last != 0) { 1714 rc++; 1715 last = (last << 1) & 0xff; 1716 } 1717 1718 return (rc); 1719 } 1720 1721 /* 1722 * Expand the diagnostic code into a message. 1723 */ 1724 void 1725 print_diagnostic(FILE *file, uint16_t diagnostic) 1726 { 1727 /* Use two spaces so above strings can fit on the line. */ 1728 (void) fprintf(file, dgettext(TEXT_DOMAIN, 1729 " Diagnostic code %u: %s.\n"), 1730 diagnostic, keysock_diag(diagnostic)); 1731 } 1732 1733 /* 1734 * Prints the base PF_KEY message. 1735 */ 1736 void 1737 print_sadb_msg(FILE *file, struct sadb_msg *samsg, time_t wallclock, 1738 boolean_t vflag) 1739 { 1740 if (wallclock != 0) 1741 printsatime(file, wallclock, dgettext(TEXT_DOMAIN, 1742 "%sTimestamp: %s\n"), "", NULL, 1743 vflag); 1744 1745 (void) fprintf(file, dgettext(TEXT_DOMAIN, 1746 "Base message (version %u) type "), 1747 samsg->sadb_msg_version); 1748 switch (samsg->sadb_msg_type) { 1749 case SADB_RESERVED: 1750 (void) fprintf(file, dgettext(TEXT_DOMAIN, 1751 "RESERVED (warning: set to 0)")); 1752 break; 1753 case SADB_GETSPI: 1754 (void) fprintf(file, "GETSPI"); 1755 break; 1756 case SADB_UPDATE: 1757 (void) fprintf(file, "UPDATE"); 1758 break; 1759 case SADB_X_UPDATEPAIR: 1760 (void) fprintf(file, "UPDATE PAIR"); 1761 break; 1762 case SADB_ADD: 1763 (void) fprintf(file, "ADD"); 1764 break; 1765 case SADB_DELETE: 1766 (void) fprintf(file, "DELETE"); 1767 break; 1768 case SADB_X_DELPAIR: 1769 (void) fprintf(file, "DELETE PAIR"); 1770 break; 1771 case SADB_GET: 1772 (void) fprintf(file, "GET"); 1773 break; 1774 case SADB_ACQUIRE: 1775 (void) fprintf(file, "ACQUIRE"); 1776 break; 1777 case SADB_REGISTER: 1778 (void) fprintf(file, "REGISTER"); 1779 break; 1780 case SADB_EXPIRE: 1781 (void) fprintf(file, "EXPIRE"); 1782 break; 1783 case SADB_FLUSH: 1784 (void) fprintf(file, "FLUSH"); 1785 break; 1786 case SADB_DUMP: 1787 (void) fprintf(file, "DUMP"); 1788 break; 1789 case SADB_X_PROMISC: 1790 (void) fprintf(file, "X_PROMISC"); 1791 break; 1792 case SADB_X_INVERSE_ACQUIRE: 1793 (void) fprintf(file, "X_INVERSE_ACQUIRE"); 1794 break; 1795 default: 1796 (void) fprintf(file, dgettext(TEXT_DOMAIN, 1797 "Unknown (%u)"), samsg->sadb_msg_type); 1798 break; 1799 } 1800 (void) fprintf(file, dgettext(TEXT_DOMAIN, ", SA type ")); 1801 1802 switch (samsg->sadb_msg_satype) { 1803 case SADB_SATYPE_UNSPEC: 1804 (void) fprintf(file, dgettext(TEXT_DOMAIN, 1805 "<unspecified/all>")); 1806 break; 1807 case SADB_SATYPE_AH: 1808 (void) fprintf(file, "AH"); 1809 break; 1810 case SADB_SATYPE_ESP: 1811 (void) fprintf(file, "ESP"); 1812 break; 1813 case SADB_X_SATYPE_TCPSIG: 1814 (void) fprintf(file, "TCPSIG"); 1815 break; 1816 case SADB_SATYPE_RSVP: 1817 (void) fprintf(file, "RSVP"); 1818 break; 1819 case SADB_SATYPE_OSPFV2: 1820 (void) fprintf(file, "OSPFv2"); 1821 break; 1822 case SADB_SATYPE_RIPV2: 1823 (void) fprintf(file, "RIPv2"); 1824 break; 1825 case SADB_SATYPE_MIP: 1826 (void) fprintf(file, dgettext(TEXT_DOMAIN, "Mobile IP")); 1827 break; 1828 default: 1829 (void) fprintf(file, dgettext(TEXT_DOMAIN, 1830 "<unknown %u>"), samsg->sadb_msg_satype); 1831 break; 1832 } 1833 1834 (void) fprintf(file, ".\n"); 1835 1836 if (samsg->sadb_msg_errno != 0) { 1837 (void) fprintf(file, dgettext(TEXT_DOMAIN, 1838 "Error %s from PF_KEY.\n"), 1839 strerror(samsg->sadb_msg_errno)); 1840 print_diagnostic(file, samsg->sadb_x_msg_diagnostic); 1841 } 1842 1843 (void) fprintf(file, dgettext(TEXT_DOMAIN, 1844 "Message length %u bytes, seq=%u, pid=%u.\n"), 1845 SADB_64TO8(samsg->sadb_msg_len), samsg->sadb_msg_seq, 1846 samsg->sadb_msg_pid); 1847 } 1848 1849 /* 1850 * Print the SA extension for PF_KEY. 1851 */ 1852 void 1853 print_sa(FILE *file, char *prefix, struct sadb_sa *assoc) 1854 { 1855 if (assoc->sadb_sa_len != SADB_8TO64(sizeof (*assoc))) { 1856 warnxfp(EFD(file), dgettext(TEXT_DOMAIN, 1857 "WARNING: SA info extension length (%u) is bad."), 1858 SADB_64TO8(assoc->sadb_sa_len)); 1859 } 1860 1861 if ((assoc->sadb_sa_flags & SADB_X_SAFLAGS_TCPSIG) == 0) { 1862 (void) fprintf(file, dgettext(TEXT_DOMAIN, 1863 "%sSADB_ASSOC spi=0x%x, replay window size=%u, state="), 1864 prefix, ntohl(assoc->sadb_sa_spi), assoc->sadb_sa_replay); 1865 } else { 1866 (void) fprintf(file, 1867 dgettext(TEXT_DOMAIN, "%sSADB_ASSOC state="), prefix); 1868 } 1869 switch (assoc->sadb_sa_state) { 1870 case SADB_SASTATE_LARVAL: 1871 (void) fprintf(file, dgettext(TEXT_DOMAIN, "LARVAL")); 1872 break; 1873 case SADB_SASTATE_MATURE: 1874 (void) fprintf(file, dgettext(TEXT_DOMAIN, "MATURE")); 1875 break; 1876 case SADB_SASTATE_DYING: 1877 (void) fprintf(file, dgettext(TEXT_DOMAIN, "DYING")); 1878 break; 1879 case SADB_SASTATE_DEAD: 1880 (void) fprintf(file, dgettext(TEXT_DOMAIN, "DEAD")); 1881 break; 1882 case SADB_X_SASTATE_ACTIVE_ELSEWHERE: 1883 (void) fprintf(file, dgettext(TEXT_DOMAIN, 1884 "ACTIVE_ELSEWHERE")); 1885 break; 1886 case SADB_X_SASTATE_IDLE: 1887 (void) fprintf(file, dgettext(TEXT_DOMAIN, "IDLE")); 1888 break; 1889 default: 1890 (void) fprintf(file, dgettext(TEXT_DOMAIN, 1891 "<unknown %u>"), assoc->sadb_sa_state); 1892 } 1893 1894 if (assoc->sadb_sa_auth != SADB_AALG_NONE) { 1895 (void) fprintf(file, dgettext(TEXT_DOMAIN, 1896 "\n%sAuthentication algorithm = "), 1897 prefix); 1898 if ((assoc->sadb_sa_flags & SADB_X_SAFLAGS_TCPSIG) != 0) 1899 (void) dump_tcpsigalg(assoc->sadb_sa_auth, file); 1900 else 1901 (void) dump_aalg(assoc->sadb_sa_auth, file); 1902 } 1903 1904 if (assoc->sadb_sa_encrypt != SADB_EALG_NONE) { 1905 (void) fprintf(file, dgettext(TEXT_DOMAIN, 1906 "\n%sEncryption algorithm = "), prefix); 1907 (void) dump_ealg(assoc->sadb_sa_encrypt, file); 1908 } 1909 1910 (void) fprintf(file, dgettext(TEXT_DOMAIN, "\n%sflags=0x%x < "), prefix, 1911 assoc->sadb_sa_flags); 1912 if (assoc->sadb_sa_flags & SADB_SAFLAGS_PFS) 1913 (void) fprintf(file, "PFS "); 1914 if (assoc->sadb_sa_flags & SADB_SAFLAGS_NOREPLAY) 1915 (void) fprintf(file, "NOREPLAY "); 1916 1917 /* BEGIN Solaris-specific flags. */ 1918 if (assoc->sadb_sa_flags & SADB_X_SAFLAGS_USED) 1919 (void) fprintf(file, "X_USED "); 1920 if (assoc->sadb_sa_flags & SADB_X_SAFLAGS_PAIRED) 1921 (void) fprintf(file, "X_PAIRED "); 1922 if (assoc->sadb_sa_flags & SADB_X_SAFLAGS_OUTBOUND) 1923 (void) fprintf(file, "X_OUTBOUND "); 1924 if (assoc->sadb_sa_flags & SADB_X_SAFLAGS_INBOUND) 1925 (void) fprintf(file, "X_INBOUND "); 1926 if (assoc->sadb_sa_flags & SADB_X_SAFLAGS_UNIQUE) 1927 (void) fprintf(file, "X_UNIQUE "); 1928 if (assoc->sadb_sa_flags & SADB_X_SAFLAGS_AALG1) 1929 (void) fprintf(file, "X_AALG1 "); 1930 if (assoc->sadb_sa_flags & SADB_X_SAFLAGS_AALG2) 1931 (void) fprintf(file, "X_AALG2 "); 1932 if (assoc->sadb_sa_flags & SADB_X_SAFLAGS_EALG1) 1933 (void) fprintf(file, "X_EALG1 "); 1934 if (assoc->sadb_sa_flags & SADB_X_SAFLAGS_EALG2) 1935 (void) fprintf(file, "X_EALG2 "); 1936 if (assoc->sadb_sa_flags & SADB_X_SAFLAGS_NATT_LOC) 1937 (void) fprintf(file, "X_NATT_LOC "); 1938 if (assoc->sadb_sa_flags & SADB_X_SAFLAGS_NATT_REM) 1939 (void) fprintf(file, "X_NATT_REM "); 1940 if (assoc->sadb_sa_flags & SADB_X_SAFLAGS_TUNNEL) 1941 (void) fprintf(file, "X_TUNNEL "); 1942 if (assoc->sadb_sa_flags & SADB_X_SAFLAGS_NATTED) 1943 (void) fprintf(file, "X_NATTED "); 1944 if (assoc->sadb_sa_flags & SADB_X_SAFLAGS_TCPSIG) 1945 (void) fprintf(file, "X_TCPSIG "); 1946 /* END Solaris-specific flags. */ 1947 1948 (void) fprintf(file, ">\n"); 1949 } 1950 1951 void 1952 printsatime(FILE *file, int64_t lt, const char *msg, const char *pfx, 1953 const char *pfx2, boolean_t vflag) 1954 { 1955 char tbuf[TBUF_SIZE]; /* For strftime() call. */ 1956 const char *tp = tbuf; 1957 time_t t = lt; 1958 struct tm res; 1959 1960 if (t != lt) { 1961 if (lt > 0) 1962 t = LONG_MAX; 1963 else 1964 t = LONG_MIN; 1965 } 1966 1967 if (strftime(tbuf, TBUF_SIZE, NULL, localtime_r(&t, &res)) == 0) 1968 tp = dgettext(TEXT_DOMAIN, "<time conversion failed>"); 1969 (void) fprintf(file, msg, pfx, tp); 1970 if (vflag && (pfx2 != NULL)) 1971 (void) fprintf(file, dgettext(TEXT_DOMAIN, 1972 "%s\t(raw time value %" PRIu64 ")\n"), pfx2, lt); 1973 } 1974 1975 /* 1976 * Print the SA lifetime information. (An SADB_EXT_LIFETIME_* extension.) 1977 */ 1978 void 1979 print_lifetimes(FILE *file, time_t wallclock, struct sadb_lifetime *current, 1980 struct sadb_lifetime *hard, struct sadb_lifetime *soft, 1981 struct sadb_lifetime *idle, boolean_t vflag) 1982 { 1983 int64_t scratch; 1984 char *soft_prefix = dgettext(TEXT_DOMAIN, "SLT: "); 1985 char *hard_prefix = dgettext(TEXT_DOMAIN, "HLT: "); 1986 char *current_prefix = dgettext(TEXT_DOMAIN, "CLT: "); 1987 char *idle_prefix = dgettext(TEXT_DOMAIN, "ILT: "); 1988 char byte_str[BYTE_STR_SIZE]; /* byte lifetime string representation */ 1989 char secs_str[SECS_STR_SIZE]; /* buffer for seconds representation */ 1990 1991 if (current != NULL && 1992 current->sadb_lifetime_len != SADB_8TO64(sizeof (*current))) { 1993 warnxfp(EFD(file), dgettext(TEXT_DOMAIN, 1994 "WARNING: CURRENT lifetime extension length (%u) is bad."), 1995 SADB_64TO8(current->sadb_lifetime_len)); 1996 } 1997 1998 if (hard != NULL && 1999 hard->sadb_lifetime_len != SADB_8TO64(sizeof (*hard))) { 2000 warnxfp(EFD(file), dgettext(TEXT_DOMAIN, 2001 "WARNING: HARD lifetime extension length (%u) is bad."), 2002 SADB_64TO8(hard->sadb_lifetime_len)); 2003 } 2004 2005 if (soft != NULL && 2006 soft->sadb_lifetime_len != SADB_8TO64(sizeof (*soft))) { 2007 warnxfp(EFD(file), dgettext(TEXT_DOMAIN, 2008 "WARNING: SOFT lifetime extension length (%u) is bad."), 2009 SADB_64TO8(soft->sadb_lifetime_len)); 2010 } 2011 2012 if (idle != NULL && 2013 idle->sadb_lifetime_len != SADB_8TO64(sizeof (*idle))) { 2014 warnxfp(EFD(file), dgettext(TEXT_DOMAIN, 2015 "WARNING: IDLE lifetime extension length (%u) is bad."), 2016 SADB_64TO8(idle->sadb_lifetime_len)); 2017 } 2018 2019 (void) fprintf(file, " LT: Lifetime information\n"); 2020 if (current != NULL) { 2021 /* Express values as current values. */ 2022 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2023 "%sCurrent lifetime information:\n"), 2024 current_prefix); 2025 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2026 "%s%" PRIu64 " bytes %sprotected, %u allocations " 2027 "used.\n"), current_prefix, 2028 current->sadb_lifetime_bytes, 2029 bytecnt2out(current->sadb_lifetime_bytes, byte_str, 2030 sizeof (byte_str), SPC_END), 2031 current->sadb_lifetime_allocations); 2032 printsatime(file, current->sadb_lifetime_addtime, 2033 dgettext(TEXT_DOMAIN, "%sSA added at time: %s\n"), 2034 current_prefix, current_prefix, vflag); 2035 if (current->sadb_lifetime_usetime != 0) { 2036 printsatime(file, current->sadb_lifetime_usetime, 2037 dgettext(TEXT_DOMAIN, 2038 "%sSA first used at time %s\n"), 2039 current_prefix, current_prefix, vflag); 2040 } 2041 printsatime(file, wallclock, dgettext(TEXT_DOMAIN, 2042 "%sTime now is %s\n"), current_prefix, current_prefix, 2043 vflag); 2044 } 2045 2046 if (soft != NULL) { 2047 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2048 "%sSoft lifetime information:\n"), 2049 soft_prefix); 2050 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2051 "%s%" PRIu64 " bytes %sof lifetime, %u allocations.\n"), 2052 soft_prefix, 2053 soft->sadb_lifetime_bytes, 2054 bytecnt2out(soft->sadb_lifetime_bytes, byte_str, 2055 sizeof (byte_str), SPC_END), 2056 soft->sadb_lifetime_allocations); 2057 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2058 "%s%" PRIu64 " seconds %sof post-add lifetime.\n"), 2059 soft_prefix, soft->sadb_lifetime_addtime, 2060 secs2out(soft->sadb_lifetime_addtime, secs_str, 2061 sizeof (secs_str), SPC_END)); 2062 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2063 "%s%" PRIu64 " seconds %sof post-use lifetime.\n"), 2064 soft_prefix, soft->sadb_lifetime_usetime, 2065 secs2out(soft->sadb_lifetime_usetime, secs_str, 2066 sizeof (secs_str), SPC_END)); 2067 /* If possible, express values as time remaining. */ 2068 if (current != NULL) { 2069 if (soft->sadb_lifetime_bytes != 0) 2070 (void) fprintf(file, dgettext(TEXT_DOMAIN, "%s" 2071 "%" PRIu64 " bytes %smore can be " 2072 "protected.\n"), soft_prefix, 2073 (soft->sadb_lifetime_bytes > 2074 current->sadb_lifetime_bytes) ? 2075 soft->sadb_lifetime_bytes - 2076 current->sadb_lifetime_bytes : 0, 2077 (soft->sadb_lifetime_bytes > 2078 current->sadb_lifetime_bytes) ? 2079 bytecnt2out(soft->sadb_lifetime_bytes - 2080 current->sadb_lifetime_bytes, byte_str, 2081 sizeof (byte_str), SPC_END) : ""); 2082 if (soft->sadb_lifetime_addtime != 0 || 2083 (soft->sadb_lifetime_usetime != 0 && 2084 current->sadb_lifetime_usetime != 0)) { 2085 int64_t adddelta, usedelta; 2086 2087 if (soft->sadb_lifetime_addtime != 0) { 2088 adddelta = 2089 current->sadb_lifetime_addtime + 2090 soft->sadb_lifetime_addtime - 2091 wallclock; 2092 } else { 2093 adddelta = TIME_MAX; 2094 } 2095 2096 if (soft->sadb_lifetime_usetime != 0 && 2097 current->sadb_lifetime_usetime != 0) { 2098 usedelta = 2099 current->sadb_lifetime_usetime + 2100 soft->sadb_lifetime_usetime - 2101 wallclock; 2102 } else { 2103 usedelta = TIME_MAX; 2104 } 2105 (void) fprintf(file, "%s", soft_prefix); 2106 scratch = MIN(adddelta, usedelta); 2107 if (scratch >= 0) { 2108 (void) fprintf(file, 2109 dgettext(TEXT_DOMAIN, 2110 "Soft expiration occurs in %" 2111 PRId64 " seconds%s\n"), scratch, 2112 secs2out(scratch, secs_str, 2113 sizeof (secs_str), SPC_BEGIN)); 2114 } else { 2115 (void) fprintf(file, 2116 dgettext(TEXT_DOMAIN, 2117 "Soft expiration occurred\n")); 2118 } 2119 scratch += wallclock; 2120 printsatime(file, scratch, dgettext(TEXT_DOMAIN, 2121 "%sTime of expiration: %s.\n"), 2122 soft_prefix, soft_prefix, vflag); 2123 } 2124 } 2125 } 2126 2127 if (hard != NULL) { 2128 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2129 "%sHard lifetime information:\n"), hard_prefix); 2130 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2131 "%s%" PRIu64 " bytes %sof lifetime, %u allocations.\n"), 2132 hard_prefix, 2133 hard->sadb_lifetime_bytes, 2134 bytecnt2out(hard->sadb_lifetime_bytes, byte_str, 2135 sizeof (byte_str), SPC_END), 2136 hard->sadb_lifetime_allocations); 2137 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2138 "%s%" PRIu64 " seconds %sof post-add lifetime.\n"), 2139 hard_prefix, hard->sadb_lifetime_addtime, 2140 secs2out(hard->sadb_lifetime_addtime, secs_str, 2141 sizeof (secs_str), SPC_END)); 2142 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2143 "%s%" PRIu64 " seconds %sof post-use lifetime.\n"), 2144 hard_prefix, hard->sadb_lifetime_usetime, 2145 secs2out(hard->sadb_lifetime_usetime, secs_str, 2146 sizeof (secs_str), SPC_END)); 2147 /* If possible, express values as time remaining. */ 2148 if (current != NULL) { 2149 if (hard->sadb_lifetime_bytes != 0) 2150 (void) fprintf(file, dgettext(TEXT_DOMAIN, "%s" 2151 "%" PRIu64 " bytes %smore can be " 2152 "protected.\n"), hard_prefix, 2153 (hard->sadb_lifetime_bytes > 2154 current->sadb_lifetime_bytes) ? 2155 hard->sadb_lifetime_bytes - 2156 current->sadb_lifetime_bytes : 0, 2157 (hard->sadb_lifetime_bytes > 2158 current->sadb_lifetime_bytes) ? 2159 bytecnt2out(hard->sadb_lifetime_bytes - 2160 current->sadb_lifetime_bytes, byte_str, 2161 sizeof (byte_str), SPC_END) : ""); 2162 if (hard->sadb_lifetime_addtime != 0 || 2163 (hard->sadb_lifetime_usetime != 0 && 2164 current->sadb_lifetime_usetime != 0)) { 2165 int64_t adddelta, usedelta; 2166 2167 if (hard->sadb_lifetime_addtime != 0) { 2168 adddelta = 2169 current->sadb_lifetime_addtime + 2170 hard->sadb_lifetime_addtime - 2171 wallclock; 2172 } else { 2173 adddelta = TIME_MAX; 2174 } 2175 2176 if (hard->sadb_lifetime_usetime != 0 && 2177 current->sadb_lifetime_usetime != 0) { 2178 usedelta = 2179 current->sadb_lifetime_usetime + 2180 hard->sadb_lifetime_usetime - 2181 wallclock; 2182 } else { 2183 usedelta = TIME_MAX; 2184 } 2185 (void) fprintf(file, "%s", hard_prefix); 2186 scratch = MIN(adddelta, usedelta); 2187 if (scratch >= 0) { 2188 (void) fprintf(file, 2189 dgettext(TEXT_DOMAIN, 2190 "Hard expiration occurs in %" 2191 PRId64 " seconds%s\n"), scratch, 2192 secs2out(scratch, secs_str, 2193 sizeof (secs_str), SPC_BEGIN)); 2194 } else { 2195 (void) fprintf(file, 2196 dgettext(TEXT_DOMAIN, 2197 "Hard expiration occurred\n")); 2198 } 2199 scratch += wallclock; 2200 printsatime(file, scratch, dgettext(TEXT_DOMAIN, 2201 "%sTime of expiration: %s.\n"), 2202 hard_prefix, hard_prefix, vflag); 2203 } 2204 } 2205 } 2206 if (idle != NULL) { 2207 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2208 "%sIdle lifetime information:\n"), idle_prefix); 2209 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2210 "%s%" PRIu64 " seconds %sof post-add lifetime.\n"), 2211 idle_prefix, idle->sadb_lifetime_addtime, 2212 secs2out(idle->sadb_lifetime_addtime, secs_str, 2213 sizeof (secs_str), SPC_END)); 2214 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2215 "%s%" PRIu64 " seconds %sof post-use lifetime.\n"), 2216 idle_prefix, idle->sadb_lifetime_usetime, 2217 secs2out(idle->sadb_lifetime_usetime, secs_str, 2218 sizeof (secs_str), SPC_END)); 2219 } 2220 } 2221 2222 /* 2223 * Print an SADB_EXT_ADDRESS_* extension. 2224 */ 2225 void 2226 print_address(FILE *file, char *prefix, struct sadb_address *addr, 2227 boolean_t ignore_nss) 2228 { 2229 struct protoent *pe; 2230 2231 (void) fprintf(file, "%s", prefix); 2232 switch (addr->sadb_address_exttype) { 2233 case SADB_EXT_ADDRESS_SRC: 2234 (void) fprintf(file, dgettext(TEXT_DOMAIN, "Source address ")); 2235 break; 2236 case SADB_X_EXT_ADDRESS_INNER_SRC: 2237 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2238 "Inner source address ")); 2239 break; 2240 case SADB_EXT_ADDRESS_DST: 2241 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2242 "Destination address ")); 2243 break; 2244 case SADB_X_EXT_ADDRESS_INNER_DST: 2245 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2246 "Inner destination address ")); 2247 break; 2248 case SADB_X_EXT_ADDRESS_NATT_LOC: 2249 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2250 "NAT-T local address ")); 2251 break; 2252 case SADB_X_EXT_ADDRESS_NATT_REM: 2253 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2254 "NAT-T remote address ")); 2255 break; 2256 } 2257 2258 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2259 "(proto=%d"), addr->sadb_address_proto); 2260 if (ignore_nss == B_FALSE) { 2261 if (addr->sadb_address_proto == 0) { 2262 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2263 "/<unspecified>")); 2264 } else if ((pe = getprotobynumber(addr->sadb_address_proto)) 2265 != NULL) { 2266 (void) fprintf(file, "/%s", pe->p_name); 2267 } else { 2268 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2269 "/<unknown>")); 2270 } 2271 } 2272 (void) fprintf(file, dgettext(TEXT_DOMAIN, ")\n%s"), prefix); 2273 (void) dump_sockaddr((struct sockaddr *)(addr + 1), 2274 addr->sadb_address_prefixlen, B_FALSE, file, ignore_nss); 2275 } 2276 2277 /* 2278 * Print an SADB_EXT_KEY extension. 2279 */ 2280 void 2281 print_key(FILE *file, char *prefix, struct sadb_key *key) 2282 { 2283 (void) fprintf(file, "%s", prefix); 2284 2285 switch (key->sadb_key_exttype) { 2286 case SADB_EXT_KEY_AUTH: 2287 (void) fprintf(file, dgettext(TEXT_DOMAIN, "Authentication")); 2288 break; 2289 case SADB_EXT_KEY_ENCRYPT: 2290 (void) fprintf(file, dgettext(TEXT_DOMAIN, "Encryption")); 2291 break; 2292 } 2293 2294 (void) fprintf(file, dgettext(TEXT_DOMAIN, " key.\n%s"), prefix); 2295 (void) dump_key((uint8_t *)(key + 1), key->sadb_key_bits, 2296 key->sadb_key_reserved, file, B_TRUE); 2297 (void) fprintf(file, "\n"); 2298 } 2299 2300 /* 2301 * Print an SADB_X_EXT_STR_AUTH extension. 2302 */ 2303 void 2304 print_keystr(FILE *file, char *prefix, struct sadb_key *key) 2305 { 2306 (void) fprintf(file, "%s", prefix); 2307 (void) fprintf(file, dgettext(TEXT_DOMAIN, "Authentication")); 2308 (void) fprintf(file, dgettext(TEXT_DOMAIN, " string.\n%s"), prefix); 2309 (void) fprintf(file, "\""); 2310 (void) dump_keystr((uint8_t *)(key + 1), key->sadb_key_bits, file); 2311 (void) fprintf(file, "\"\n"); 2312 } 2313 2314 /* 2315 * Print an SADB_EXT_IDENTITY_* extension. 2316 */ 2317 void 2318 print_ident(FILE *file, char *prefix, struct sadb_ident *id) 2319 { 2320 boolean_t canprint = B_TRUE; 2321 2322 (void) fprintf(file, "%s", prefix); 2323 switch (id->sadb_ident_exttype) { 2324 case SADB_EXT_IDENTITY_SRC: 2325 (void) fprintf(file, dgettext(TEXT_DOMAIN, "Source")); 2326 break; 2327 case SADB_EXT_IDENTITY_DST: 2328 (void) fprintf(file, dgettext(TEXT_DOMAIN, "Destination")); 2329 break; 2330 } 2331 2332 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2333 " identity, uid=%d, type "), id->sadb_ident_id); 2334 canprint = dump_sadb_idtype(id->sadb_ident_type, file, NULL); 2335 (void) fprintf(file, "\n%s", prefix); 2336 if (canprint) { 2337 (void) fprintf(file, "%s\n", (char *)(id + 1)); 2338 } else { 2339 print_asn1_name(file, (const unsigned char *)(id + 1), 2340 SADB_64TO8(id->sadb_ident_len) - sizeof (sadb_ident_t)); 2341 } 2342 } 2343 2344 /* 2345 * Convert sadb_sens extension into binary security label. 2346 */ 2347 2348 #include <tsol/label.h> 2349 #include <sys/tsol/tndb.h> 2350 #include <sys/tsol/label_macro.h> 2351 2352 void 2353 ipsec_convert_sens_to_bslabel(const struct sadb_sens *sens, bslabel_t *sl) 2354 { 2355 uint64_t *bitmap = (uint64_t *)(sens + 1); 2356 int bitmap_len = SADB_64TO8(sens->sadb_sens_sens_len); 2357 2358 bsllow(sl); 2359 LCLASS_SET((_bslabel_impl_t *)sl, sens->sadb_sens_sens_level); 2360 bcopy(bitmap, &((_bslabel_impl_t *)sl)->compartments, 2361 bitmap_len); 2362 } 2363 2364 void 2365 ipsec_convert_bslabel_to_string(bslabel_t *sl, char **plabel) 2366 { 2367 if (label_to_str(sl, plabel, M_LABEL, DEF_NAMES) != 0) { 2368 *plabel = strdup(dgettext(TEXT_DOMAIN, 2369 "** Label conversion failed **")); 2370 } 2371 } 2372 2373 void 2374 ipsec_convert_bslabel_to_hex(bslabel_t *sl, char **plabel) 2375 { 2376 if (label_to_str(sl, plabel, M_INTERNAL, DEF_NAMES) != 0) { 2377 *plabel = strdup(dgettext(TEXT_DOMAIN, 2378 "** Label conversion failed **")); 2379 } 2380 } 2381 2382 int 2383 ipsec_convert_sl_to_sens(int doi, bslabel_t *sl, sadb_sens_t *sens) 2384 { 2385 uint8_t *bitmap; 2386 int sens_len = sizeof (sadb_sens_t) + _C_LEN * 4; 2387 2388 2389 if (sens == NULL) 2390 return (sens_len); 2391 2392 2393 (void) memset(sens, 0, sens_len); 2394 2395 sens->sadb_sens_exttype = SADB_EXT_SENSITIVITY; 2396 sens->sadb_sens_len = SADB_8TO64(sens_len); 2397 sens->sadb_sens_dpd = doi; 2398 2399 sens->sadb_sens_sens_level = LCLASS(sl); 2400 sens->sadb_sens_integ_level = 0; 2401 sens->sadb_sens_sens_len = _C_LEN >> 1; 2402 sens->sadb_sens_integ_len = 0; 2403 2404 sens->sadb_x_sens_flags = 0; 2405 2406 bitmap = (uint8_t *)(sens + 1); 2407 bcopy(&(((_bslabel_impl_t *)sl)->compartments), bitmap, _C_LEN * 4); 2408 2409 return (sens_len); 2410 } 2411 2412 2413 /* 2414 * Print an SADB_SENSITIVITY extension. 2415 */ 2416 void 2417 print_sens(FILE *file, char *prefix, const struct sadb_sens *sens, 2418 boolean_t ignore_nss) 2419 { 2420 char *plabel; 2421 char *hlabel; 2422 uint64_t *bitmap = (uint64_t *)(sens + 1); 2423 bslabel_t sl; 2424 int i; 2425 int sens_len = sens->sadb_sens_sens_len; 2426 int integ_len = sens->sadb_sens_integ_len; 2427 boolean_t inner = (sens->sadb_sens_exttype == SADB_EXT_SENSITIVITY); 2428 const char *sensname = inner ? 2429 dgettext(TEXT_DOMAIN, "Plaintext Sensitivity") : 2430 dgettext(TEXT_DOMAIN, "Ciphertext Sensitivity"); 2431 2432 ipsec_convert_sens_to_bslabel(sens, &sl); 2433 2434 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2435 "%s%s DPD %d, sens level=%d, integ level=%d, flags=%x\n"), 2436 prefix, sensname, sens->sadb_sens_dpd, sens->sadb_sens_sens_level, 2437 sens->sadb_sens_integ_level, sens->sadb_x_sens_flags); 2438 2439 ipsec_convert_bslabel_to_hex(&sl, &hlabel); 2440 2441 if (ignore_nss) { 2442 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2443 "%s %s Label: %s\n"), prefix, sensname, hlabel); 2444 2445 for (i = 0; i < sens_len; i++, bitmap++) 2446 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2447 "%s %s BM extended word %d 0x%" PRIx64 "\n"), 2448 prefix, sensname, i, *bitmap); 2449 2450 } else { 2451 ipsec_convert_bslabel_to_string(&sl, &plabel); 2452 2453 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2454 "%s %s Label: %s (%s)\n"), 2455 prefix, sensname, plabel, hlabel); 2456 free(plabel); 2457 2458 } 2459 free(hlabel); 2460 2461 bitmap = (uint64_t *)(sens + 1 + sens_len); 2462 2463 for (i = 0; i < integ_len; i++, bitmap++) 2464 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2465 "%s Integrity BM extended word %d 0x%" PRIx64 "\n"), 2466 prefix, i, *bitmap); 2467 } 2468 2469 /* 2470 * Print an SADB_EXT_PROPOSAL extension. 2471 */ 2472 void 2473 print_prop(FILE *file, char *prefix, struct sadb_prop *prop) 2474 { 2475 struct sadb_comb *combs; 2476 int i, numcombs; 2477 2478 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2479 "%sProposal, replay counter = %u.\n"), prefix, 2480 prop->sadb_prop_replay); 2481 2482 numcombs = prop->sadb_prop_len - SADB_8TO64(sizeof (*prop)); 2483 numcombs /= SADB_8TO64(sizeof (*combs)); 2484 2485 combs = (struct sadb_comb *)(prop + 1); 2486 2487 for (i = 0; i < numcombs; i++) { 2488 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2489 "%s Combination #%u "), prefix, i + 1); 2490 if (combs[i].sadb_comb_auth != SADB_AALG_NONE) { 2491 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2492 "Authentication = ")); 2493 (void) dump_aalg(combs[i].sadb_comb_auth, file); 2494 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2495 " minbits=%u, maxbits=%u.\n%s "), 2496 combs[i].sadb_comb_auth_minbits, 2497 combs[i].sadb_comb_auth_maxbits, prefix); 2498 } 2499 2500 if (combs[i].sadb_comb_encrypt != SADB_EALG_NONE) { 2501 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2502 "Encryption = ")); 2503 (void) dump_ealg(combs[i].sadb_comb_encrypt, file); 2504 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2505 " minbits=%u, maxbits=%u, saltbits=%u.\n%s "), 2506 combs[i].sadb_comb_encrypt_minbits, 2507 combs[i].sadb_comb_encrypt_maxbits, 2508 combs[i].sadb_x_comb_encrypt_saltbits, prefix); 2509 } 2510 2511 (void) fprintf(file, dgettext(TEXT_DOMAIN, "HARD: ")); 2512 if (combs[i].sadb_comb_hard_allocations) 2513 (void) fprintf(file, dgettext(TEXT_DOMAIN, "alloc=%u "), 2514 combs[i].sadb_comb_hard_allocations); 2515 if (combs[i].sadb_comb_hard_bytes) 2516 (void) fprintf(file, dgettext(TEXT_DOMAIN, "bytes=%" 2517 PRIu64 " "), combs[i].sadb_comb_hard_bytes); 2518 if (combs[i].sadb_comb_hard_addtime) 2519 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2520 "post-add secs=%" PRIu64 " "), 2521 combs[i].sadb_comb_hard_addtime); 2522 if (combs[i].sadb_comb_hard_usetime) 2523 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2524 "post-use secs=%" PRIu64 ""), 2525 combs[i].sadb_comb_hard_usetime); 2526 2527 (void) fprintf(file, dgettext(TEXT_DOMAIN, "\n%s SOFT: "), 2528 prefix); 2529 if (combs[i].sadb_comb_soft_allocations) 2530 (void) fprintf(file, dgettext(TEXT_DOMAIN, "alloc=%u "), 2531 combs[i].sadb_comb_soft_allocations); 2532 if (combs[i].sadb_comb_soft_bytes) 2533 (void) fprintf(file, dgettext(TEXT_DOMAIN, "bytes=%" 2534 PRIu64 " "), combs[i].sadb_comb_soft_bytes); 2535 if (combs[i].sadb_comb_soft_addtime) 2536 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2537 "post-add secs=%" PRIu64 " "), 2538 combs[i].sadb_comb_soft_addtime); 2539 if (combs[i].sadb_comb_soft_usetime) 2540 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2541 "post-use secs=%" PRIu64 ""), 2542 combs[i].sadb_comb_soft_usetime); 2543 (void) fprintf(file, "\n"); 2544 } 2545 } 2546 2547 /* 2548 * Print an extended proposal (SADB_X_EXT_EPROP). 2549 */ 2550 void 2551 print_eprop(FILE *file, char *prefix, struct sadb_prop *eprop) 2552 { 2553 uint64_t *sofar; 2554 struct sadb_x_ecomb *ecomb; 2555 struct sadb_x_algdesc *algdesc; 2556 int i, j; 2557 2558 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2559 "%sExtended Proposal, replay counter = %u, "), prefix, 2560 eprop->sadb_prop_replay); 2561 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2562 "number of combinations = %u.\n"), eprop->sadb_x_prop_numecombs); 2563 2564 sofar = (uint64_t *)(eprop + 1); 2565 ecomb = (struct sadb_x_ecomb *)sofar; 2566 2567 for (i = 0; i < eprop->sadb_x_prop_numecombs; ) { 2568 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2569 "%s Extended combination #%u:\n"), prefix, ++i); 2570 2571 (void) fprintf(file, dgettext(TEXT_DOMAIN, "%s HARD: "), 2572 prefix); 2573 (void) fprintf(file, dgettext(TEXT_DOMAIN, "alloc=%u, "), 2574 ecomb->sadb_x_ecomb_hard_allocations); 2575 (void) fprintf(file, dgettext(TEXT_DOMAIN, "bytes=%" PRIu64 2576 ", "), ecomb->sadb_x_ecomb_hard_bytes); 2577 (void) fprintf(file, dgettext(TEXT_DOMAIN, "post-add secs=%" 2578 PRIu64 ", "), ecomb->sadb_x_ecomb_hard_addtime); 2579 (void) fprintf(file, dgettext(TEXT_DOMAIN, "post-use secs=%" 2580 PRIu64 "\n"), ecomb->sadb_x_ecomb_hard_usetime); 2581 2582 (void) fprintf(file, dgettext(TEXT_DOMAIN, "%s SOFT: "), 2583 prefix); 2584 (void) fprintf(file, dgettext(TEXT_DOMAIN, "alloc=%u, "), 2585 ecomb->sadb_x_ecomb_soft_allocations); 2586 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2587 "bytes=%" PRIu64 ", "), ecomb->sadb_x_ecomb_soft_bytes); 2588 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2589 "post-add secs=%" PRIu64 ", "), 2590 ecomb->sadb_x_ecomb_soft_addtime); 2591 (void) fprintf(file, dgettext(TEXT_DOMAIN, "post-use secs=%" 2592 PRIu64 "\n"), ecomb->sadb_x_ecomb_soft_usetime); 2593 2594 sofar = (uint64_t *)(ecomb + 1); 2595 algdesc = (struct sadb_x_algdesc *)sofar; 2596 2597 for (j = 0; j < ecomb->sadb_x_ecomb_numalgs; ) { 2598 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2599 "%s Alg #%u "), prefix, ++j); 2600 switch (algdesc->sadb_x_algdesc_satype) { 2601 case SADB_SATYPE_ESP: 2602 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2603 "for ESP ")); 2604 break; 2605 case SADB_SATYPE_AH: 2606 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2607 "for AH ")); 2608 break; 2609 case SADB_X_SATYPE_TCPSIG: 2610 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2611 "for TCPSIG ")); 2612 break; 2613 default: 2614 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2615 "for satype=%d "), 2616 algdesc->sadb_x_algdesc_satype); 2617 } 2618 switch (algdesc->sadb_x_algdesc_algtype) { 2619 case SADB_X_ALGTYPE_CRYPT: 2620 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2621 "Encryption = ")); 2622 (void) dump_ealg(algdesc->sadb_x_algdesc_alg, 2623 file); 2624 break; 2625 case SADB_X_ALGTYPE_AUTH: 2626 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2627 "Authentication = ")); 2628 (void) dump_aalg(algdesc->sadb_x_algdesc_alg, 2629 file); 2630 break; 2631 default: 2632 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2633 "algtype(%d) = alg(%d)"), 2634 algdesc->sadb_x_algdesc_algtype, 2635 algdesc->sadb_x_algdesc_alg); 2636 break; 2637 } 2638 2639 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2640 " minbits=%u, maxbits=%u, saltbits=%u\n"), 2641 algdesc->sadb_x_algdesc_minbits, 2642 algdesc->sadb_x_algdesc_maxbits, 2643 algdesc->sadb_x_algdesc_saltbits); 2644 2645 sofar = (uint64_t *)(++algdesc); 2646 } 2647 ecomb = (struct sadb_x_ecomb *)sofar; 2648 } 2649 } 2650 2651 /* 2652 * Print an SADB_EXT_SUPPORTED extension. 2653 */ 2654 void 2655 print_supp(FILE *file, char *prefix, struct sadb_supported *supp) 2656 { 2657 struct sadb_alg *algs; 2658 int i, numalgs; 2659 2660 (void) fprintf(file, dgettext(TEXT_DOMAIN, "%sSupported "), prefix); 2661 switch (supp->sadb_supported_exttype) { 2662 case SADB_EXT_SUPPORTED_AUTH: 2663 (void) fprintf(file, dgettext(TEXT_DOMAIN, "authentication")); 2664 break; 2665 case SADB_EXT_SUPPORTED_ENCRYPT: 2666 (void) fprintf(file, dgettext(TEXT_DOMAIN, "encryption")); 2667 break; 2668 } 2669 (void) fprintf(file, dgettext(TEXT_DOMAIN, " algorithms.\n")); 2670 2671 algs = (struct sadb_alg *)(supp + 1); 2672 numalgs = supp->sadb_supported_len - SADB_8TO64(sizeof (*supp)); 2673 numalgs /= SADB_8TO64(sizeof (*algs)); 2674 for (i = 0; i < numalgs; i++) { 2675 uint16_t exttype = supp->sadb_supported_exttype; 2676 2677 (void) fprintf(file, "%s", prefix); 2678 switch (exttype) { 2679 case SADB_EXT_SUPPORTED_AUTH: 2680 (void) dump_aalg(algs[i].sadb_alg_id, file); 2681 break; 2682 case SADB_EXT_SUPPORTED_ENCRYPT: 2683 (void) dump_ealg(algs[i].sadb_alg_id, file); 2684 break; 2685 } 2686 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2687 " minbits=%u, maxbits=%u, ivlen=%u, saltbits=%u"), 2688 algs[i].sadb_alg_minbits, algs[i].sadb_alg_maxbits, 2689 algs[i].sadb_alg_ivlen, algs[i].sadb_x_alg_saltbits); 2690 if (exttype == SADB_EXT_SUPPORTED_ENCRYPT) 2691 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2692 ", increment=%u"), algs[i].sadb_x_alg_increment); 2693 (void) fprintf(file, dgettext(TEXT_DOMAIN, ".\n")); 2694 } 2695 } 2696 2697 /* 2698 * Print an SADB_EXT_SPIRANGE extension. 2699 */ 2700 void 2701 print_spirange(FILE *file, char *prefix, struct sadb_spirange *range) 2702 { 2703 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2704 "%sSPI Range, min=0x%x, max=0x%x\n"), prefix, 2705 htonl(range->sadb_spirange_min), 2706 htonl(range->sadb_spirange_max)); 2707 } 2708 2709 /* 2710 * Print an SADB_X_EXT_KM_COOKIE extension. 2711 */ 2712 2713 void 2714 print_kmc(FILE *file, char *prefix, struct sadb_x_kmc *kmc) 2715 { 2716 char *cookie_label; 2717 2718 switch (kmc->sadb_x_kmc_proto) { 2719 case SADB_X_KMP_IKE: 2720 cookie_label = kmc_lookup_by_cookie(kmc->sadb_x_kmc_cookie); 2721 if (cookie_label == NULL) 2722 cookie_label = 2723 dgettext(TEXT_DOMAIN, "<Label not found.>"); 2724 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2725 "%s Protocol %u, cookie=\"%s\" (%u)\n"), prefix, 2726 kmc->sadb_x_kmc_proto, cookie_label, 2727 kmc->sadb_x_kmc_cookie); 2728 return; 2729 case SADB_X_KMP_KINK: 2730 cookie_label = dgettext(TEXT_DOMAIN, "KINK:"); 2731 break; 2732 case SADB_X_KMP_MANUAL: 2733 cookie_label = dgettext(TEXT_DOMAIN, "Manual SA with cookie:"); 2734 break; 2735 case SADB_X_KMP_IKEV2: 2736 cookie_label = dgettext(TEXT_DOMAIN, "IKEV2:"); 2737 break; 2738 default: 2739 cookie_label = 2740 dgettext(TEXT_DOMAIN, "<unknown KM protocol>"); 2741 break; 2742 } 2743 2744 /* 2745 * Assume native-byte-order printing for now. Exceptions (like 2746 * byte-swapping) should be handled in per-KM-protocol cases above. 2747 */ 2748 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2749 "%s Protocol %u, cookie=\"%s\" (0x%"PRIx64"/%"PRIu64")\n"), 2750 prefix, kmc->sadb_x_kmc_proto, cookie_label, 2751 kmc->sadb_x_kmc_cookie64, kmc->sadb_x_kmc_cookie64); 2752 } 2753 2754 /* 2755 * Print an SADB_X_EXT_REPLAY_CTR extension. 2756 */ 2757 2758 void 2759 print_replay(FILE *file, char *prefix, sadb_x_replay_ctr_t *repl) 2760 { 2761 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2762 "%sReplay Value "), prefix); 2763 if ((repl->sadb_x_rc_replay32 == 0) && 2764 (repl->sadb_x_rc_replay64 == 0)) { 2765 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2766 "<Value not found.>")); 2767 } 2768 /* 2769 * We currently do not support a 64-bit replay value. 2770 * RFC 4301 will require one, however, and we have a field 2771 * in place when 4301 is built. 2772 */ 2773 (void) fprintf(file, "% " PRIu64 "\n", 2774 ((repl->sadb_x_rc_replay32 == 0) ? 2775 repl->sadb_x_rc_replay64 : repl->sadb_x_rc_replay32)); 2776 } 2777 /* 2778 * Print an SADB_X_EXT_PAIR extension. 2779 */ 2780 static void 2781 print_pair(FILE *file, char *prefix, struct sadb_x_pair *pair) 2782 { 2783 (void) fprintf(file, dgettext(TEXT_DOMAIN, "%sPaired with spi=0x%x\n"), 2784 prefix, ntohl(pair->sadb_x_pair_spi)); 2785 } 2786 2787 /* 2788 * Take a PF_KEY message pointed to buffer and print it. Useful for DUMP 2789 * and GET. 2790 */ 2791 void 2792 print_samsg(FILE *file, uint64_t *buffer, boolean_t want_timestamp, 2793 boolean_t vflag, boolean_t ignore_nss) 2794 { 2795 uint64_t *current; 2796 struct sadb_msg *samsg = (struct sadb_msg *)buffer; 2797 struct sadb_ext *ext; 2798 struct sadb_lifetime *currentlt = NULL, *hardlt = NULL, *softlt = NULL; 2799 struct sadb_lifetime *idlelt = NULL; 2800 int i; 2801 time_t wallclock; 2802 2803 (void) time(&wallclock); 2804 2805 print_sadb_msg(file, samsg, want_timestamp ? wallclock : 0, vflag); 2806 current = (uint64_t *)(samsg + 1); 2807 while (current - buffer < samsg->sadb_msg_len) { 2808 int lenbytes; 2809 2810 ext = (struct sadb_ext *)current; 2811 lenbytes = SADB_64TO8(ext->sadb_ext_len); 2812 switch (ext->sadb_ext_type) { 2813 case SADB_EXT_SA: 2814 print_sa(file, dgettext(TEXT_DOMAIN, 2815 "SA: "), (struct sadb_sa *)current); 2816 break; 2817 /* 2818 * Pluck out lifetimes and print them at the end. This is 2819 * to show relative lifetimes. 2820 */ 2821 case SADB_EXT_LIFETIME_CURRENT: 2822 currentlt = (struct sadb_lifetime *)current; 2823 break; 2824 case SADB_EXT_LIFETIME_HARD: 2825 hardlt = (struct sadb_lifetime *)current; 2826 break; 2827 case SADB_EXT_LIFETIME_SOFT: 2828 softlt = (struct sadb_lifetime *)current; 2829 break; 2830 case SADB_X_EXT_LIFETIME_IDLE: 2831 idlelt = (struct sadb_lifetime *)current; 2832 break; 2833 2834 case SADB_EXT_ADDRESS_SRC: 2835 print_address(file, dgettext(TEXT_DOMAIN, "SRC: "), 2836 (struct sadb_address *)current, ignore_nss); 2837 break; 2838 case SADB_X_EXT_ADDRESS_INNER_SRC: 2839 print_address(file, dgettext(TEXT_DOMAIN, "INS: "), 2840 (struct sadb_address *)current, ignore_nss); 2841 break; 2842 case SADB_EXT_ADDRESS_DST: 2843 print_address(file, dgettext(TEXT_DOMAIN, "DST: "), 2844 (struct sadb_address *)current, ignore_nss); 2845 break; 2846 case SADB_X_EXT_ADDRESS_INNER_DST: 2847 print_address(file, dgettext(TEXT_DOMAIN, "IND: "), 2848 (struct sadb_address *)current, ignore_nss); 2849 break; 2850 case SADB_EXT_KEY_AUTH: 2851 print_key(file, dgettext(TEXT_DOMAIN, 2852 "AKY: "), (struct sadb_key *)current); 2853 break; 2854 case SADB_X_EXT_STR_AUTH: 2855 print_keystr(file, dgettext(TEXT_DOMAIN, 2856 "AST: "), (struct sadb_key *)current); 2857 break; 2858 case SADB_EXT_KEY_ENCRYPT: 2859 print_key(file, dgettext(TEXT_DOMAIN, 2860 "EKY: "), (struct sadb_key *)current); 2861 break; 2862 case SADB_EXT_IDENTITY_SRC: 2863 print_ident(file, dgettext(TEXT_DOMAIN, "SID: "), 2864 (struct sadb_ident *)current); 2865 break; 2866 case SADB_EXT_IDENTITY_DST: 2867 print_ident(file, dgettext(TEXT_DOMAIN, "DID: "), 2868 (struct sadb_ident *)current); 2869 break; 2870 case SADB_EXT_SENSITIVITY: 2871 print_sens(file, dgettext(TEXT_DOMAIN, "SNS: "), 2872 (struct sadb_sens *)current, ignore_nss); 2873 break; 2874 case SADB_EXT_PROPOSAL: 2875 print_prop(file, dgettext(TEXT_DOMAIN, "PRP: "), 2876 (struct sadb_prop *)current); 2877 break; 2878 case SADB_EXT_SUPPORTED_AUTH: 2879 print_supp(file, dgettext(TEXT_DOMAIN, "SUA: "), 2880 (struct sadb_supported *)current); 2881 break; 2882 case SADB_EXT_SUPPORTED_ENCRYPT: 2883 print_supp(file, dgettext(TEXT_DOMAIN, "SUE: "), 2884 (struct sadb_supported *)current); 2885 break; 2886 case SADB_EXT_SPIRANGE: 2887 print_spirange(file, dgettext(TEXT_DOMAIN, "SPR: "), 2888 (struct sadb_spirange *)current); 2889 break; 2890 case SADB_X_EXT_EPROP: 2891 print_eprop(file, dgettext(TEXT_DOMAIN, "EPR: "), 2892 (struct sadb_prop *)current); 2893 break; 2894 case SADB_X_EXT_KM_COOKIE: 2895 print_kmc(file, dgettext(TEXT_DOMAIN, "KMC: "), 2896 (struct sadb_x_kmc *)current); 2897 break; 2898 case SADB_X_EXT_ADDRESS_NATT_REM: 2899 print_address(file, dgettext(TEXT_DOMAIN, "NRM: "), 2900 (struct sadb_address *)current, ignore_nss); 2901 break; 2902 case SADB_X_EXT_ADDRESS_NATT_LOC: 2903 print_address(file, dgettext(TEXT_DOMAIN, "NLC: "), 2904 (struct sadb_address *)current, ignore_nss); 2905 break; 2906 case SADB_X_EXT_PAIR: 2907 print_pair(file, dgettext(TEXT_DOMAIN, "OTH: "), 2908 (struct sadb_x_pair *)current); 2909 break; 2910 case SADB_X_EXT_OUTER_SENS: 2911 print_sens(file, dgettext(TEXT_DOMAIN, "OSN: "), 2912 (struct sadb_sens *)current, ignore_nss); 2913 break; 2914 case SADB_X_EXT_REPLAY_VALUE: 2915 (void) print_replay(file, dgettext(TEXT_DOMAIN, 2916 "RPL: "), (sadb_x_replay_ctr_t *)current); 2917 break; 2918 default: 2919 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2920 "UNK: Unknown ext. %d, len %d.\n"), 2921 ext->sadb_ext_type, lenbytes); 2922 for (i = 0; i < ext->sadb_ext_len; i++) 2923 (void) fprintf(file, dgettext(TEXT_DOMAIN, 2924 "UNK: 0x%" PRIx64 "\n"), 2925 ((uint64_t *)ext)[i]); 2926 break; 2927 } 2928 current += (lenbytes == 0) ? 2929 SADB_8TO64(sizeof (struct sadb_ext)) : ext->sadb_ext_len; 2930 } 2931 /* 2932 * Print lifetimes NOW. 2933 */ 2934 if (currentlt != NULL || hardlt != NULL || softlt != NULL || 2935 idlelt != NULL) 2936 print_lifetimes(file, wallclock, currentlt, hardlt, 2937 softlt, idlelt, vflag); 2938 2939 if (current - buffer != samsg->sadb_msg_len) { 2940 warnxfp(EFD(file), dgettext(TEXT_DOMAIN, 2941 "WARNING: insufficient buffer space or corrupt message.")); 2942 } 2943 2944 (void) fflush(file); /* Make sure our message is out there. */ 2945 } 2946 2947 /* 2948 * save_XXX functions are used when "saving" the SA tables to either a 2949 * file or standard output. They use the dump_XXX functions where needed, 2950 * but mostly they use the rparseXXX functions. 2951 */ 2952 2953 /* 2954 * Print save information for a lifetime extension. 2955 * 2956 * NOTE : It saves the lifetime in absolute terms. For example, if you 2957 * had a hard_usetime of 60 seconds, you'll save it as 60 seconds, even though 2958 * there may have been 59 seconds burned off the clock. 2959 */ 2960 boolean_t 2961 save_lifetime(struct sadb_lifetime *lifetime, FILE *ofile) 2962 { 2963 char *prefix; 2964 2965 switch (lifetime->sadb_lifetime_exttype) { 2966 case SADB_EXT_LIFETIME_HARD: 2967 prefix = "hard"; 2968 break; 2969 case SADB_EXT_LIFETIME_SOFT: 2970 prefix = "soft"; 2971 break; 2972 case SADB_X_EXT_LIFETIME_IDLE: 2973 prefix = "idle"; 2974 break; 2975 } 2976 2977 if (putc('\t', ofile) == EOF) 2978 return (B_FALSE); 2979 2980 if (lifetime->sadb_lifetime_allocations != 0 && fprintf(ofile, 2981 "%s_alloc %u ", prefix, lifetime->sadb_lifetime_allocations) < 0) 2982 return (B_FALSE); 2983 2984 if (lifetime->sadb_lifetime_bytes != 0 && fprintf(ofile, 2985 "%s_bytes %" PRIu64 " ", prefix, lifetime->sadb_lifetime_bytes) < 0) 2986 return (B_FALSE); 2987 2988 if (lifetime->sadb_lifetime_addtime != 0 && fprintf(ofile, 2989 "%s_addtime %" PRIu64 " ", prefix, 2990 lifetime->sadb_lifetime_addtime) < 0) 2991 return (B_FALSE); 2992 2993 if (lifetime->sadb_lifetime_usetime != 0 && fprintf(ofile, 2994 "%s_usetime %" PRIu64 " ", prefix, 2995 lifetime->sadb_lifetime_usetime) < 0) 2996 return (B_FALSE); 2997 2998 return (B_TRUE); 2999 } 3000 3001 /* 3002 * Print save information for an address extension. 3003 */ 3004 boolean_t 3005 save_address(struct sadb_address *addr, FILE *ofile) 3006 { 3007 char *printable_addr, buf[INET6_ADDRSTRLEN]; 3008 const char *prefix, *pprefix; 3009 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)(addr + 1); 3010 struct sockaddr_in *sin = (struct sockaddr_in *)sin6; 3011 int af = sin->sin_family; 3012 3013 /* 3014 * Address-family reality check. 3015 */ 3016 if (af != AF_INET6 && af != AF_INET) 3017 return (B_FALSE); 3018 3019 switch (addr->sadb_address_exttype) { 3020 case SADB_EXT_ADDRESS_SRC: 3021 prefix = "src"; 3022 pprefix = "sport"; 3023 break; 3024 case SADB_X_EXT_ADDRESS_INNER_SRC: 3025 prefix = "isrc"; 3026 pprefix = "isport"; 3027 break; 3028 case SADB_EXT_ADDRESS_DST: 3029 prefix = "dst"; 3030 pprefix = "dport"; 3031 break; 3032 case SADB_X_EXT_ADDRESS_INNER_DST: 3033 prefix = "idst"; 3034 pprefix = "idport"; 3035 break; 3036 case SADB_X_EXT_ADDRESS_NATT_LOC: 3037 prefix = "nat_loc "; 3038 pprefix = "nat_lport"; 3039 break; 3040 case SADB_X_EXT_ADDRESS_NATT_REM: 3041 prefix = "nat_rem "; 3042 pprefix = "nat_rport"; 3043 break; 3044 } 3045 3046 if (fprintf(ofile, " %s ", prefix) < 0) 3047 return (B_FALSE); 3048 3049 /* 3050 * Do not do address-to-name translation, given that we live in 3051 * an age of names that explode into many addresses. 3052 */ 3053 printable_addr = (char *)inet_ntop(af, 3054 (af == AF_INET) ? (char *)&sin->sin_addr : (char *)&sin6->sin6_addr, 3055 buf, sizeof (buf)); 3056 if (printable_addr == NULL) 3057 printable_addr = "Invalid IP address."; 3058 if (fprintf(ofile, "%s", printable_addr) < 0) 3059 return (B_FALSE); 3060 if (addr->sadb_address_prefixlen != 0 && 3061 !((addr->sadb_address_prefixlen == 32 && af == AF_INET) || 3062 (addr->sadb_address_prefixlen == 128 && af == AF_INET6))) { 3063 if (fprintf(ofile, "/%d", addr->sadb_address_prefixlen) < 0) 3064 return (B_FALSE); 3065 } 3066 3067 /* 3068 * The port is in the same position for struct sockaddr_in and 3069 * struct sockaddr_in6. We exploit that property here. 3070 */ 3071 if ((pprefix != NULL) && (sin->sin_port != 0)) 3072 (void) fprintf(ofile, " %s %d", pprefix, ntohs(sin->sin_port)); 3073 3074 return (B_TRUE); 3075 } 3076 3077 /* 3078 * Print save information for a key extension. Returns whether writing 3079 * to the specified output file was successful or not. 3080 */ 3081 boolean_t 3082 save_key(struct sadb_key *key, FILE *ofile) 3083 { 3084 char *prefix; 3085 3086 if (putc('\t', ofile) == EOF) 3087 return (B_FALSE); 3088 3089 prefix = (key->sadb_key_exttype == SADB_EXT_KEY_AUTH) ? "auth" : "encr"; 3090 3091 if (fprintf(ofile, "%skey ", prefix) < 0) 3092 return (B_FALSE); 3093 3094 if (dump_key((uint8_t *)(key + 1), key->sadb_key_bits, 3095 key->sadb_key_reserved, ofile, B_FALSE) == -1) 3096 return (B_FALSE); 3097 3098 return (B_TRUE); 3099 } 3100 3101 /* 3102 * Print save information for a key extension. Returns whether writing 3103 * to the specified output file was successful or not. 3104 */ 3105 boolean_t 3106 save_keystr(struct sadb_key *key, FILE *ofile) 3107 { 3108 if (putc('\t', ofile) == EOF) 3109 return (B_FALSE); 3110 3111 if (fprintf(ofile, "authstring \"") < 0) 3112 return (B_FALSE); 3113 3114 if (dump_keystr((uint8_t *)(key + 1), key->sadb_key_bits, ofile) == -1) 3115 return (B_FALSE); 3116 3117 if (fprintf(ofile, "\"") < 0) 3118 return (B_FALSE); 3119 3120 return (B_TRUE); 3121 } 3122 3123 /* 3124 * Print save information for an identity extension. 3125 */ 3126 boolean_t 3127 save_ident(struct sadb_ident *ident, FILE *ofile) 3128 { 3129 char *prefix; 3130 3131 if (putc('\t', ofile) == EOF) 3132 return (B_FALSE); 3133 3134 prefix = (ident->sadb_ident_exttype == SADB_EXT_IDENTITY_SRC) ? "src" : 3135 "dst"; 3136 3137 if (fprintf(ofile, "%sidtype %s ", prefix, 3138 rparseidtype(ident->sadb_ident_type)) < 0) 3139 return (B_FALSE); 3140 3141 if (ident->sadb_ident_type == SADB_X_IDENTTYPE_DN || 3142 ident->sadb_ident_type == SADB_X_IDENTTYPE_GN) { 3143 if (fprintf(ofile, dgettext(TEXT_DOMAIN, 3144 "<can-not-print>")) < 0) 3145 return (B_FALSE); 3146 } else { 3147 if (fprintf(ofile, "%s", (char *)(ident + 1)) < 0) 3148 return (B_FALSE); 3149 } 3150 3151 return (B_TRUE); 3152 } 3153 3154 boolean_t 3155 save_sens(struct sadb_sens *sens, FILE *ofile) 3156 { 3157 char *prefix; 3158 char *hlabel; 3159 bslabel_t sl; 3160 3161 if (putc('\t', ofile) == EOF) 3162 return (B_FALSE); 3163 3164 if (sens->sadb_sens_exttype == SADB_EXT_SENSITIVITY) 3165 prefix = "label"; 3166 else if ((sens->sadb_x_sens_flags & SADB_X_SENS_IMPLICIT) == 0) 3167 prefix = "outer-label"; 3168 else 3169 prefix = "implicit-label"; 3170 3171 ipsec_convert_sens_to_bslabel(sens, &sl); 3172 ipsec_convert_bslabel_to_hex(&sl, &hlabel); 3173 3174 if (fprintf(ofile, "%s %s ", prefix, hlabel) < 0) { 3175 free(hlabel); 3176 return (B_FALSE); 3177 } 3178 free(hlabel); 3179 3180 return (B_TRUE); 3181 } 3182 3183 /* 3184 * "Save" a security association to an output file. 3185 * 3186 * NOTE the lack of calls to dgettext() because I'm outputting parseable stuff. 3187 * ALSO NOTE that if you change keywords (see parsecmd()), you'll have to 3188 * change them here as well. 3189 */ 3190 void 3191 save_assoc(uint64_t *buffer, FILE *ofile) 3192 { 3193 int terrno; 3194 boolean_t seen_proto = B_FALSE, seen_iproto = B_FALSE; 3195 uint64_t *current; 3196 struct sadb_address *addr; 3197 struct sadb_x_replay_ctr *repl; 3198 struct sadb_msg *samsg = (struct sadb_msg *)buffer; 3199 struct sadb_ext *ext; 3200 boolean_t tcpsig = samsg->sadb_msg_satype == SADB_X_SATYPE_TCPSIG; 3201 3202 #define tidyup() \ 3203 terrno = errno; (void) fclose(ofile); errno = terrno; \ 3204 interactive = B_FALSE 3205 3206 #define savenl() if (fputs(" \\\n", ofile) == EOF) \ 3207 { bail(dgettext(TEXT_DOMAIN, "savenl")); } 3208 3209 if (fputs("# begin assoc\n", ofile) == EOF) 3210 bail(dgettext(TEXT_DOMAIN, 3211 "save_assoc: Opening comment of SA")); 3212 if (tcpsig) { 3213 if (fprintf(ofile, "add ") < 0) { 3214 bail(dgettext(TEXT_DOMAIN, 3215 "save_assoc: First line of SA")); 3216 } 3217 seen_proto = B_TRUE; 3218 } else { 3219 if (fprintf(ofile, "add %s ", 3220 rparsesatype(samsg->sadb_msg_satype)) < 0) { 3221 bail(dgettext(TEXT_DOMAIN, 3222 "save_assoc: First line of SA")); 3223 } 3224 } 3225 savenl(); 3226 3227 current = (uint64_t *)(samsg + 1); 3228 while (current - buffer < samsg->sadb_msg_len) { 3229 struct sadb_sa *assoc; 3230 3231 ext = (struct sadb_ext *)current; 3232 addr = (struct sadb_address *)ext; /* Just in case... */ 3233 switch (ext->sadb_ext_type) { 3234 case SADB_EXT_SA: 3235 assoc = (struct sadb_sa *)ext; 3236 if (assoc->sadb_sa_state != SADB_SASTATE_MATURE) { 3237 if (fprintf(ofile, "# WARNING: SA was dying " 3238 "or dead.\n") < 0) { 3239 tidyup(); 3240 bail(dgettext(TEXT_DOMAIN, 3241 "save_assoc: fprintf not mature")); 3242 } 3243 } 3244 if (!tcpsig) { 3245 if (fprintf(ofile, " spi 0x%x ", 3246 ntohl(assoc->sadb_sa_spi)) < 0) { 3247 tidyup(); 3248 bail(dgettext(TEXT_DOMAIN, 3249 "save_assoc: fprintf spi")); 3250 } 3251 } 3252 if (assoc->sadb_sa_encrypt != SADB_EALG_NONE) { 3253 if (fprintf(ofile, "encr_alg %s ", 3254 rparsealg(assoc->sadb_sa_encrypt, 3255 IPSEC_PROTO_ESP)) < 0) { 3256 tidyup(); 3257 bail(dgettext(TEXT_DOMAIN, 3258 "save_assoc: fprintf encrypt")); 3259 } 3260 } 3261 if (assoc->sadb_sa_auth != SADB_AALG_NONE) { 3262 int ret; 3263 3264 if ((assoc->sadb_sa_flags & 3265 SADB_X_SAFLAGS_TCPSIG) != 0) { 3266 ret = fprintf(ofile, " authalg %s ", 3267 rparsetcpsigalg( 3268 assoc->sadb_sa_auth)); 3269 } else { 3270 ret = fprintf(ofile, "auth_alg %s ", 3271 rparsealg(assoc->sadb_sa_auth, 3272 IPSEC_PROTO_AH)); 3273 } 3274 if (ret < 0) { 3275 tidyup(); 3276 bail(dgettext(TEXT_DOMAIN, 3277 "save_assoc: fprintf auth")); 3278 } 3279 } 3280 if ((assoc->sadb_sa_flags & 3281 SADB_X_SAFLAGS_TCPSIG) == 0) { 3282 if (fprintf(ofile, "replay %d ", 3283 assoc->sadb_sa_replay) < 0) { 3284 tidyup(); 3285 bail(dgettext(TEXT_DOMAIN, 3286 "save_assoc: fprintf replay")); 3287 } 3288 } 3289 if (assoc->sadb_sa_flags & (SADB_X_SAFLAGS_NATT_LOC | 3290 SADB_X_SAFLAGS_NATT_REM)) { 3291 if (fprintf(ofile, "encap udp") < 0) { 3292 tidyup(); 3293 bail(dgettext(TEXT_DOMAIN, 3294 "save_assoc: fprintf encap")); 3295 } 3296 } 3297 savenl(); 3298 break; 3299 case SADB_EXT_LIFETIME_HARD: 3300 case SADB_EXT_LIFETIME_SOFT: 3301 case SADB_X_EXT_LIFETIME_IDLE: 3302 if (!save_lifetime((struct sadb_lifetime *)ext, 3303 ofile)) { 3304 tidyup(); 3305 bail(dgettext(TEXT_DOMAIN, "save_lifetime")); 3306 } 3307 savenl(); 3308 break; 3309 case SADB_X_EXT_ADDRESS_INNER_SRC: 3310 case SADB_X_EXT_ADDRESS_INNER_DST: 3311 if (!seen_iproto && addr->sadb_address_proto) { 3312 (void) fprintf(ofile, " iproto %d", 3313 addr->sadb_address_proto); 3314 savenl(); 3315 seen_iproto = B_TRUE; 3316 } 3317 goto skip_srcdst; /* Hack to avoid cases below... */ 3318 /* FALLTHRU */ 3319 case SADB_EXT_ADDRESS_SRC: 3320 case SADB_EXT_ADDRESS_DST: 3321 if (!seen_proto && addr->sadb_address_proto) { 3322 (void) fprintf(ofile, " proto %d", 3323 addr->sadb_address_proto); 3324 savenl(); 3325 seen_proto = B_TRUE; 3326 } 3327 /* FALLTHRU */ 3328 case SADB_X_EXT_ADDRESS_NATT_REM: 3329 case SADB_X_EXT_ADDRESS_NATT_LOC: 3330 skip_srcdst: 3331 if (!save_address(addr, ofile)) { 3332 tidyup(); 3333 bail(dgettext(TEXT_DOMAIN, "save_address")); 3334 } 3335 savenl(); 3336 break; 3337 case SADB_EXT_KEY_AUTH: 3338 case SADB_EXT_KEY_ENCRYPT: 3339 if (!save_key((struct sadb_key *)ext, ofile)) { 3340 tidyup(); 3341 bail(dgettext(TEXT_DOMAIN, "save_key")); 3342 } 3343 savenl(); 3344 break; 3345 case SADB_X_EXT_STR_AUTH: 3346 if (!save_keystr((struct sadb_key *)ext, ofile)) { 3347 tidyup(); 3348 bail(dgettext(TEXT_DOMAIN, "save_keystr")); 3349 } 3350 savenl(); 3351 break; 3352 case SADB_EXT_IDENTITY_SRC: 3353 case SADB_EXT_IDENTITY_DST: 3354 if (!save_ident((struct sadb_ident *)ext, ofile)) { 3355 tidyup(); 3356 bail(dgettext(TEXT_DOMAIN, "save_ident")); 3357 } 3358 savenl(); 3359 break; 3360 case SADB_X_EXT_REPLAY_VALUE: 3361 repl = (sadb_x_replay_ctr_t *)ext; 3362 if ((repl->sadb_x_rc_replay32 == 0) && 3363 (repl->sadb_x_rc_replay64 == 0)) { 3364 tidyup(); 3365 bail(dgettext(TEXT_DOMAIN, "Replay Value")); 3366 } 3367 if (fprintf(ofile, "replay_value %" PRIu64 "", 3368 (repl->sadb_x_rc_replay32 == 0 ? 3369 repl->sadb_x_rc_replay64 : 3370 repl->sadb_x_rc_replay32)) < 0) { 3371 tidyup(); 3372 bail(dgettext(TEXT_DOMAIN, 3373 "save_assoc: fprintf replay value")); 3374 } 3375 savenl(); 3376 break; 3377 case SADB_EXT_SENSITIVITY: 3378 case SADB_X_EXT_OUTER_SENS: 3379 if (!save_sens((struct sadb_sens *)ext, ofile)) { 3380 tidyup(); 3381 bail(dgettext(TEXT_DOMAIN, "save_sens")); 3382 } 3383 savenl(); 3384 break; 3385 default: 3386 /* Skip over irrelevant extensions. */ 3387 break; 3388 } 3389 current += ext->sadb_ext_len; 3390 } 3391 3392 if (fputs(dgettext(TEXT_DOMAIN, "\n# end assoc\n\n"), ofile) == EOF) { 3393 tidyup(); 3394 bail(dgettext(TEXT_DOMAIN, "save_assoc: last fputs")); 3395 } 3396 } 3397 3398 /* 3399 * Open the output file for the "save" command. 3400 */ 3401 FILE * 3402 opensavefile(char *filename) 3403 { 3404 int fd; 3405 FILE *retval; 3406 struct stat buf; 3407 3408 /* 3409 * If the user specifies "-" or doesn't give a filename, then 3410 * dump to stdout. Make sure to document the dangers of files 3411 * that are NFS, directing your output to strange places, etc. 3412 */ 3413 if (filename == NULL || strcmp("-", filename) == 0) 3414 return (stdout); 3415 3416 /* 3417 * open the file with the create bits set. Since I check for 3418 * real UID == root in main(), I won't worry about the ownership 3419 * problem. 3420 */ 3421 fd = open(filename, O_WRONLY | O_EXCL | O_CREAT | O_TRUNC, S_IRUSR); 3422 if (fd == -1) { 3423 if (errno != EEXIST) 3424 bail_msg("%s %s: %s", filename, dgettext(TEXT_DOMAIN, 3425 "open error"), 3426 strerror(errno)); 3427 fd = open(filename, O_WRONLY | O_TRUNC, 0); 3428 if (fd == -1) 3429 bail_msg("%s %s: %s", filename, dgettext(TEXT_DOMAIN, 3430 "open error"), strerror(errno)); 3431 if (fstat(fd, &buf) == -1) { 3432 (void) close(fd); 3433 bail_msg("%s fstat: %s", filename, strerror(errno)); 3434 } 3435 if (S_ISREG(buf.st_mode) && 3436 ((buf.st_mode & S_IAMB) != S_IRUSR)) { 3437 warnx(dgettext(TEXT_DOMAIN, 3438 "WARNING: Save file already exists with " 3439 "permission %o."), (uint_t)(buf.st_mode & S_IAMB)); 3440 warnx(dgettext(TEXT_DOMAIN, 3441 "Normal users may be able to read IPsec " 3442 "keying material.")); 3443 } 3444 } 3445 3446 /* Okay, we have an FD. Assign it to a stdio FILE pointer. */ 3447 retval = fdopen(fd, "w"); 3448 if (retval == NULL) { 3449 (void) close(fd); 3450 bail_msg("%s %s: %s", filename, dgettext(TEXT_DOMAIN, 3451 "fdopen error"), strerror(errno)); 3452 } 3453 return (retval); 3454 } 3455 3456 const char * 3457 do_inet_ntop(const void *addr, char *cp, size_t size) 3458 { 3459 boolean_t isv4; 3460 struct in6_addr *inaddr6 = (struct in6_addr *)addr; 3461 struct in_addr inaddr; 3462 3463 if ((isv4 = IN6_IS_ADDR_V4MAPPED(inaddr6)) == B_TRUE) { 3464 IN6_V4MAPPED_TO_INADDR(inaddr6, &inaddr); 3465 } 3466 3467 return (inet_ntop(isv4 ? AF_INET : AF_INET6, 3468 isv4 ? (void *)&inaddr : inaddr6, cp, size)); 3469 } 3470 3471 char numprint[NBUF_SIZE]; 3472 3473 /* 3474 * Parse and reverse parse a specific SA type (AH, ESP, etc.). 3475 */ 3476 static struct typetable { 3477 char *type; 3478 int token; 3479 } type_table[] = { 3480 {"all", SADB_SATYPE_UNSPEC}, 3481 {"ah", SADB_SATYPE_AH}, 3482 {"esp", SADB_SATYPE_ESP}, 3483 {"tcpsig", SADB_X_SATYPE_TCPSIG}, 3484 /* PF_KEY NOTE: More to come if net/pfkeyv2.h gets updated. */ 3485 {NULL, 0} /* Token value is irrelevant for this entry. */ 3486 }; 3487 3488 char * 3489 rparsesatype(int type) 3490 { 3491 struct typetable *tt = type_table; 3492 3493 while (tt->type != NULL && type != tt->token) 3494 tt++; 3495 3496 if (tt->type == NULL) { 3497 (void) snprintf(numprint, NBUF_SIZE, "%d", type); 3498 } else { 3499 return (tt->type); 3500 } 3501 3502 return (numprint); 3503 } 3504 3505 3506 /* 3507 * Return a string containing the name of the specified numerical algorithm 3508 * identifier. 3509 */ 3510 char * 3511 rparsealg(uint8_t alg, int proto_num) 3512 { 3513 static struct ipsecalgent *holder = NULL; /* we're single-threaded */ 3514 3515 if (holder != NULL) 3516 freeipsecalgent(holder); 3517 3518 holder = getipsecalgbynum(alg, proto_num, NULL); 3519 if (holder == NULL) { 3520 (void) snprintf(numprint, NBUF_SIZE, "%d", alg); 3521 return (numprint); 3522 } 3523 3524 return (*(holder->a_names)); 3525 } 3526 3527 const char * 3528 rparsetcpsigalg(uint8_t alg) 3529 { 3530 const char *name = gettcpsigalgbynum(alg); 3531 3532 if (name == NULL) { 3533 (void) snprintf(numprint, NBUF_SIZE, "%d", alg); 3534 return (numprint); 3535 } 3536 3537 return (name); 3538 } 3539 3540 /* 3541 * Parse and reverse parse out a source/destination ID type. 3542 */ 3543 static struct idtypes { 3544 char *idtype; 3545 uint8_t retval; 3546 } idtypes[] = { 3547 {"prefix", SADB_IDENTTYPE_PREFIX}, 3548 {"fqdn", SADB_IDENTTYPE_FQDN}, 3549 {"domain", SADB_IDENTTYPE_FQDN}, 3550 {"domainname", SADB_IDENTTYPE_FQDN}, 3551 {"user_fqdn", SADB_IDENTTYPE_USER_FQDN}, 3552 {"mailbox", SADB_IDENTTYPE_USER_FQDN}, 3553 {"der_dn", SADB_X_IDENTTYPE_DN}, 3554 {"der_gn", SADB_X_IDENTTYPE_GN}, 3555 {NULL, 0} 3556 }; 3557 3558 char * 3559 rparseidtype(uint16_t type) 3560 { 3561 struct idtypes *idp; 3562 3563 for (idp = idtypes; idp->idtype != NULL; idp++) { 3564 if (type == idp->retval) 3565 return (idp->idtype); 3566 } 3567 3568 (void) snprintf(numprint, NBUF_SIZE, "%d", type); 3569 return (numprint); 3570 } 3571 3572 /* 3573 * This is a general purpose exit function, calling functions can specify an 3574 * error type. If the command calling this function was started by smf(7) the 3575 * error type could be used as a hint to the restarter. In the future this 3576 * function could be used to do something more intelligent with a process that 3577 * encounters an error. If exit() is called with an error code other than those 3578 * defined by smf(7), the program will just get restarted. Unless restarting 3579 * is likely to resolve the error condition, its probably sensible to just 3580 * log the error and keep running. 3581 * 3582 * The SERVICE_* exit_types mean nothing if the command was run from the 3583 * command line, just exit(). There are two special cases: 3584 * 3585 * SERVICE_DEGRADE - Not implemented in smf(7), one day it could hint that 3586 * the service is not running as well is it could. For 3587 * now, don't do anything, just record the error. 3588 * DEBUG_FATAL - Something happened, if the command was being run in debug 3589 * mode, exit() as you really want to know something happened, 3590 * otherwise just keep running. This is ignored when running 3591 * under smf(7). 3592 * 3593 * The function will handle an optional variable args error message, this 3594 * will be written to the error stream, typically a log file or stderr. 3595 */ 3596 void 3597 ipsecutil_exit(exit_type_t type, char *fmri, FILE *fp, const char *fmt, ...) 3598 { 3599 int exit_status; 3600 va_list args; 3601 3602 if (fp == NULL) 3603 fp = stderr; 3604 if (fmt != NULL) { 3605 va_start(args, fmt); 3606 vwarnxfp(fp, fmt, args); 3607 va_end(args); 3608 } 3609 3610 if (fmri == NULL) { 3611 /* Command being run directly from a shell. */ 3612 switch (type) { 3613 case SERVICE_EXIT_OK: 3614 exit_status = 0; 3615 break; 3616 case SERVICE_DEGRADE: 3617 return; 3618 case SERVICE_BADPERM: 3619 case SERVICE_BADCONF: 3620 case SERVICE_MAINTAIN: 3621 case SERVICE_DISABLE: 3622 case SERVICE_FATAL: 3623 case SERVICE_RESTART: 3624 case DEBUG_FATAL: 3625 warnxfp(fp, "Fatal error - exiting."); 3626 exit_status = 1; 3627 break; 3628 } 3629 } else { 3630 /* Command being run as a smf(7) method. */ 3631 switch (type) { 3632 case SERVICE_EXIT_OK: 3633 exit_status = SMF_EXIT_OK; 3634 break; 3635 case SERVICE_DEGRADE: /* Not implemented yet. */ 3636 case DEBUG_FATAL: 3637 /* Keep running, don't exit(). */ 3638 return; 3639 case SERVICE_BADPERM: 3640 warnxfp(fp, dgettext(TEXT_DOMAIN, 3641 "Permission error with %s."), fmri); 3642 exit_status = SMF_EXIT_ERR_PERM; 3643 break; 3644 case SERVICE_BADCONF: 3645 warnxfp(fp, dgettext(TEXT_DOMAIN, 3646 "Bad configuration of service %s."), fmri); 3647 exit_status = SMF_EXIT_ERR_FATAL; 3648 break; 3649 case SERVICE_MAINTAIN: 3650 warnxfp(fp, dgettext(TEXT_DOMAIN, 3651 "Service %s needs maintenance."), fmri); 3652 exit_status = SMF_EXIT_ERR_FATAL; 3653 break; 3654 case SERVICE_DISABLE: 3655 exit_status = SMF_EXIT_ERR_FATAL; 3656 break; 3657 case SERVICE_FATAL: 3658 warnxfp(fp, dgettext(TEXT_DOMAIN, 3659 "Service %s fatal error."), fmri); 3660 exit_status = SMF_EXIT_ERR_FATAL; 3661 break; 3662 case SERVICE_RESTART: 3663 exit_status = 1; 3664 break; 3665 } 3666 } 3667 (void) fflush(fp); 3668 (void) fclose(fp); 3669 exit(exit_status); 3670 } 3671 3672 void 3673 print_asn1_name(FILE *file, const unsigned char *buf, long buflen) 3674 { 3675 KMF_X509_NAME name = { 0 }; 3676 KMF_DATA data = { 0 }; 3677 char *str = NULL; 3678 3679 data.Data = (unsigned char *)buf; 3680 data.Length = buflen; 3681 3682 if (DerDecodeName(&data, &name) != KMF_OK) 3683 goto fail; 3684 3685 if (kmf_dn_to_string(&name, &str) != KMF_OK) 3686 goto fail; 3687 3688 (void) fprintf(file, "%s\n", str); 3689 kmf_free_dn(&name); 3690 free(str); 3691 return; 3692 fail: 3693 kmf_free_dn(&name); 3694 (void) fprintf(file, dgettext(TEXT_DOMAIN, "<cannot interpret>\n")); 3695 } 3696