1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 /* 26 * Copyright 2018 Joyent, Inc. 27 */ 28 29 #ifndef _IPSEC_UTIL_H 30 #define _IPSEC_UTIL_H 31 32 /* 33 * Headers and definitions for support functions that are shared by 34 * the ipsec utilities ipseckey and ikeadm. 35 */ 36 37 #ifdef __cplusplus 38 extern "C" { 39 #endif 40 41 #include <sys/types.h> 42 #include <sys/socket.h> 43 #include <net/pfkeyv2.h> 44 #include <netinet/in.h> 45 #include <inet/ip.h> 46 #include <setjmp.h> 47 #include <stdio.h> 48 #include <err.h> 49 #include <errfp.h> 50 #include <net/pfpolicy.h> 51 #include <libtecla.h> 52 53 #ifndef A_CNT 54 /* macros for array manipulation */ 55 #define A_CNT(arr) (sizeof (arr)/sizeof (arr[0])) 56 #define A_END(arr) (&arr[A_CNT(arr)]) 57 #endif 58 59 /* used for file parsing */ 60 #define NBUF_SIZE 16 61 #define COMMENT_CHAR '#' 62 #define CONT_CHAR '\\' 63 #define QUOTE_CHAR '"' 64 /* 65 * Input buffer size limits maximum line length for both file parsing and 66 * interactive mode. 4K chars should be enough even for broad commands and 67 * all possible key lenghts of today's symmetric ciphers entered via 68 * ipseckey(8) which has the most bifurcated grammar from all IPsec commands. 69 */ 70 #define IBUF_SIZE 4096 71 72 /* used for command-line parsing */ 73 #define START_ARG 8 74 #define TOO_MANY_ARGS (START_ARG << 9) 75 76 /* Return codes for argv/argc vector creation */ 77 #define TOO_MANY_TOKENS -3 78 #define MEMORY_ALLOCATION -2 79 #define COMMENT_LINE 1 80 #define SUCCESS 0 81 82 /* Flags for {bytecnt,secs}2out() */ 83 #define SPC_NOSPACES 0x00000000 /* no space prefix/suffix */ 84 #define SPC_BEGIN 0x00000001 /* put space at the beginning */ 85 #define SPC_END 0x00000002 /* put space at the end */ 86 #define SPC_BOTH SPC_BEGIN|SPC_END /* print both spaces */ 87 88 /* 89 * The following lengths should be sufficient for character buffers passed to 90 * bytecnt2str(),secs2str(). This is because the string output of these 91 * functions consists of limited number and units. The lengths should be also 92 * sufficient for bytecnt2out(),secs2out() functions. 93 */ 94 #define BYTE_STR_SIZE 16 95 #define SECS_STR_SIZE 20 96 97 /* 98 * Time printing defines... 99 * 100 * TBUF_SIZE is pretty arbitrary. Perhaps it shouldn't be. 101 */ 102 #define TBUF_SIZE 50 103 #define TIME_MAX LONG_MAX 104 105 #ifndef INSECURE_PERMS 106 #define INSECURE_PERMS(sbuf) (((sbuf).st_uid != 0) || \ 107 ((sbuf).st_mode & S_IRWXG) || ((sbuf).st_mode & S_IRWXO)) 108 #endif 109 110 #ifndef PKCS11_TOKSIZE 111 #define PKCS11_TOKSIZE 32 /* Fixed length of PKCS#11 token string len. */ 112 #endif 113 114 /* 115 * Solaris UDP port used to communicate with the Solaris Cluster 116 * daemon. It is used only when the node is booted in cluster mode. 117 */ 118 #define CLUSTER_UDP_PORT 2005 119 120 /* For keyword-lookup tables */ 121 typedef struct keywdtab { 122 uint_t kw_tag; 123 char *kw_str; 124 } keywdtab_t; 125 126 /* 127 * These different exit states are designed to give consistant behaviour 128 * when a program needs to exit because of an error. These exit_types 129 * are used in macros, defined later in this file, which call ipsecutil_exit(). 130 * What happens when ipsecutil_exit() may differ if the command was started 131 * on the command line or via smf(7), See ipsecutil_exit() source for details. 132 * 133 * Note: The calling function should decide what "debug mode" is before calling 134 * ipsecutil_exit() with DEBUG_FATAL. 135 */ 136 typedef enum exit_type { 137 SERVICE_EXIT_OK, /* Exit without error. */ 138 SERVICE_DEGRADE, /* A hint that service should be degraded. */ 139 SERVICE_BADPERM, /* A Permission error occured. */ 140 SERVICE_BADCONF, /* Misconfiguration. */ 141 SERVICE_MAINTAIN, /* smf(7) to put service in maintenance mode. */ 142 SERVICE_DISABLE, /* Tell smf(7) to disable me. */ 143 SERVICE_FATAL, /* Whatever happened is not fixable. */ 144 SERVICE_RESTART, /* Tell smf(7) to restart the service. */ 145 DEBUG_FATAL /* Exit in debug mode. */ 146 } exit_type_t; 147 148 /* 149 * Function Prototypes 150 */ 151 152 /* 153 * Print errno and if cmdline or readfile, exit; if interactive reset state 154 */ 155 extern void ipsecutil_exit(exit_type_t, char *, FILE *, const char *fmt, ...); 156 extern void bail(char *); 157 158 /* 159 * Localization macro - Only to be used from usr/src/cmd because Macros 160 * are not expanded in usr/src/lib when message catalogs are built. 161 */ 162 #define Bail(s) bail(dgettext(TEXT_DOMAIN, s)) 163 164 /* 165 * Print caller-supplied, variable-arg error message, then exit if cmdline 166 * or readfile, or reset state if interactive. 167 */ 168 extern void bail_msg(char *, ...); 169 170 /* 171 * dump_XXX functions produce ASCII output from the passed in data. 172 * 173 * Because certain errors need to do this stderr, dump_XXX functions 174 * take a FILE pointer. 175 */ 176 177 extern int dump_sockaddr(struct sockaddr *, uint8_t, boolean_t, FILE *, 178 boolean_t); 179 180 extern int dump_key(uint8_t *, uint_t, uint_t, FILE *, boolean_t); 181 182 extern int dump_aalg(uint8_t, FILE *); 183 184 extern int dump_ealg(uint8_t, FILE *); 185 186 /* return true if sadb string is printable (based on type), false otherwise */ 187 extern boolean_t dump_sadb_idtype(uint8_t, FILE *, int *); 188 189 /* 190 * do_interactive: Enter a mode where commands are read from a file; 191 * treat stdin special. infile is the file cmds are read from; 192 * promptstring is the string printed to stdout (if the cmds are 193 * being read from stdin) to prompt for a new command; parseit is 194 * the function to be called to process the command line once it's 195 * been read in and broken up into an argv/argc vector. 196 */ 197 198 /* callback function passed in to do_interactive() */ 199 typedef void (*parse_cmdln_fn)(int, char **, char *, boolean_t); 200 201 extern void do_interactive(FILE *, char *, char *, char *, parse_cmdln_fn, 202 CplMatchFn *); 203 204 extern uint_t lines_parsed; 205 extern uint_t lines_added; 206 207 /* convert a string to an IKE_PRIV_* constant */ 208 extern int privstr2num(char *); 209 210 /* convert a string to a D_* debug flag */ 211 extern int dbgstr2num(char *); 212 213 /* convert a string of debug strings with +|- delimiters to a debug level */ 214 extern int parsedbgopts(char *); 215 216 /* 217 * functions to manipulate the IKEv1 kmcookie-label mapping file 218 */ 219 220 #define KMCFILE "/var/run/ipsec_kmc_map" 221 222 /* 223 * Insert a mapping into the file (if it's not already there), given the 224 * new label. Return the assigned cookie, or -1 on error. 225 */ 226 extern int kmc_insert_mapping(char *); 227 228 /* 229 * Lookup the given cookie and return its corresponding label. Return 230 * a pointer to the label on success, NULL on error (or if the label is 231 * not found). 232 */ 233 extern char *kmc_lookup_by_cookie(int); 234 235 /* 236 * These globals are declared for us in ipsec_util.c, since it needs to 237 * refer to them also... 238 */ 239 extern boolean_t nflag; /* Avoid nameservice? */ 240 extern boolean_t pflag; /* Paranoid w.r.t. printing keying material? */ 241 extern boolean_t interactive; 242 extern boolean_t readfile; 243 extern uint_t lineno; 244 extern char numprint[NBUF_SIZE]; 245 246 /* For error recovery in interactive or read-file mode. */ 247 extern jmp_buf env; 248 249 /* 250 * Back-end stuff for getalgby*(). 251 */ 252 253 #define INET_IPSECALGSPATH "/etc/inet/" 254 #define INET_IPSECALGSFILE (INET_IPSECALGSPATH "ipsecalgs") 255 256 /* To preserve packages delimiters in /etc/inet/ipsecalgs */ 257 typedef struct ipsecalgs_pkg { 258 int alg_num; 259 char *pkg_name; 260 } ipsecalgs_pkg_t; 261 262 /* 263 * The cached representation of /etc/inet/ipsecalgs is represented by: 264 * - A dynamically-grown (optionally sorted) array of IPsec protocols 265 * - Each protocol has an array (again, dynamically grown and sorted) 266 * of algorithms, each a full-fledged struct ipsecalgent. 267 * - The getipsecalg*() routines will search the list, then duplicate the 268 * struct ipsecalgent and return it. 269 */ 270 271 typedef enum { 272 LIBIPSEC_ALGS_EXEC_SYNC, 273 LIBIPSEC_ALGS_EXEC_ASYNC 274 } ipsecalgs_exec_mode_t; 275 276 typedef struct ipsec_proto { 277 int proto_num; 278 char *proto_name; 279 char *proto_pkg; 280 int proto_numalgs; 281 struct ipsecalgent **proto_algs; 282 ipsecalgs_pkg_t *proto_algs_pkgs; 283 int proto_algs_npkgs; 284 ipsecalgs_exec_mode_t proto_exec_mode; 285 } ipsec_proto_t; 286 287 extern void _build_internal_algs(ipsec_proto_t **, int *); 288 extern int _str_to_ipsec_exec_mode(char *, ipsecalgs_exec_mode_t *); 289 290 extern int addipsecalg(struct ipsecalgent *, uint_t); 291 extern int delipsecalgbyname(const char *, int); 292 extern int delipsecalgbynum(int, int); 293 extern int addipsecproto(const char *, int, ipsecalgs_exec_mode_t, uint_t); 294 extern int delipsecprotobyname(const char *); 295 extern int delipsecprotobynum(int); 296 extern int *getipsecprotos(int *); 297 extern int *getipsecalgs(int *, int); 298 extern int list_ints(FILE *, int *); 299 extern const char *ipsecalgs_diag(int); 300 extern int ipsecproto_get_exec_mode(int, ipsecalgs_exec_mode_t *); 301 extern int ipsecproto_set_exec_mode(int, ipsecalgs_exec_mode_t); 302 303 /* Flags for add/delete routines. */ 304 #define LIBIPSEC_ALGS_ADD_FORCE 0x00000001 305 306 /* 307 * Helper definitions for indices into array of key sizes when key sizes 308 * are defined by range. 309 */ 310 #define LIBIPSEC_ALGS_KEY_DEF_IDX 0 /* default key size */ 311 #define LIBIPSEC_ALGS_KEY_MIN_IDX 1 /* min key size */ 312 #define LIBIPSEC_ALGS_KEY_MAX_IDX 2 /* max key size */ 313 #define LIBIPSEC_ALGS_KEY_NUM_VAL 4 /* def, min, max, 0 */ 314 315 /* Error codes for IPsec algorithms management */ 316 #define LIBIPSEC_ALGS_DIAG_ALG_EXISTS -1 317 #define LIBIPSEC_ALGS_DIAG_PROTO_EXISTS -2 318 #define LIBIPSEC_ALGS_DIAG_UNKN_PROTO -3 319 #define LIBIPSEC_ALGS_DIAG_UNKN_ALG -4 320 #define LIBIPSEC_ALGS_DIAG_NOMEM -5 321 #define LIBIPSEC_ALGS_DIAG_ALGSFILEOPEN -6 322 #define LIBIPSEC_ALGS_DIAG_ALGSFILEFDOPEN -7 323 #define LIBIPSEC_ALGS_DIAG_ALGSFILELOCK -8 324 #define LIBIPSEC_ALGS_DIAG_ALGSFILERENAME -9 325 #define LIBIPSEC_ALGS_DIAG_ALGSFILEWRITE -10 326 #define LIBIPSEC_ALGS_DIAG_ALGSFILECHMOD -11 327 #define LIBIPSEC_ALGS_DIAG_ALGSFILECHOWN -12 328 #define LIBIPSEC_ALGS_DIAG_ALGSFILECLOSE -13 329 330 /* /etc/inet/ipsecalgs keywords and package sections delimiters */ 331 #define LIBIPSEC_ALGS_LINE_PROTO "PROTO|" 332 #define LIBIPSEC_ALGS_LINE_ALG "ALG|" 333 #define LIBIPSEC_ALGS_LINE_PKGSTART "# Start " 334 #define LIBIPSEC_ALGS_LINE_PKGEND "# End " 335 336 /* Put these in libnsl for and process caching testing. */ 337 extern int *_real_getipsecprotos(int *); 338 extern int *_real_getipsecalgs(int *, int); 339 extern struct ipsecalgent *_duplicate_alg(struct ipsecalgent *); 340 extern void _clean_trash(ipsec_proto_t *, int); 341 342 /* spdsock support functions */ 343 344 /* Return values for spdsock_get_ext(). */ 345 #define KGE_OK 0 346 #define KGE_DUP 1 347 #define KGE_UNK 2 348 #define KGE_LEN 3 349 #define KGE_CHK 4 350 351 extern int spdsock_get_ext(spd_ext_t *[], spd_msg_t *, uint_t, char *, uint_t); 352 extern const char *spdsock_diag(int); 353 354 /* PF_KEY (keysock) support functions */ 355 extern const char *keysock_diag(int); 356 extern int in_masktoprefix(uint8_t *, boolean_t); 357 358 /* SA support functions */ 359 360 extern char *secs2out(unsigned int, char *, int, int); 361 extern char *secs2str(unsigned int, char *, int); 362 extern char *bytecnt2out(uint64_t, char *, size_t, int); 363 extern char *bytecnt2str(uint64_t, char *, size_t); 364 extern void print_diagnostic(FILE *, uint16_t); 365 extern void print_sadb_msg(FILE *, struct sadb_msg *, time_t, boolean_t); 366 extern void print_sa(FILE *, char *, struct sadb_sa *); 367 extern void printsatime(FILE *, int64_t, const char *, const char *, 368 const char *, boolean_t); 369 extern void print_lifetimes(FILE *, time_t, struct sadb_lifetime *, 370 struct sadb_lifetime *, struct sadb_lifetime *, struct sadb_lifetime *, 371 boolean_t vflag); 372 extern void print_address(FILE *, char *, struct sadb_address *, boolean_t); 373 extern void print_asn1_name(FILE *, const unsigned char *, long); 374 extern void print_key(FILE *, char *, struct sadb_key *); 375 extern void print_keystr(FILE *, char *, struct sadb_key *); 376 extern void print_ident(FILE *, char *, struct sadb_ident *); 377 extern void print_sens(FILE *, char *, const struct sadb_sens *, boolean_t); 378 extern void print_prop(FILE *, char *, struct sadb_prop *); 379 extern void print_eprop(FILE *, char *, struct sadb_prop *); 380 extern void print_supp(FILE *, char *, struct sadb_supported *); 381 extern void print_spirange(FILE *, char *, struct sadb_spirange *); 382 extern void print_kmc(FILE *, char *, struct sadb_x_kmc *); 383 extern void print_samsg(FILE *, uint64_t *, boolean_t, boolean_t, boolean_t); 384 extern char *rparsesatype(int); 385 extern char *rparsealg(uint8_t, int); 386 extern const char *rparsetcpsigalg(uint8_t); 387 extern char *rparseidtype(uint16_t); 388 extern boolean_t save_lifetime(struct sadb_lifetime *, FILE *); 389 extern boolean_t save_address(struct sadb_address *, FILE *); 390 extern boolean_t save_key(struct sadb_key *, FILE *); 391 extern boolean_t save_keystr(struct sadb_key *, FILE *); 392 extern boolean_t save_ident(struct sadb_ident *, FILE *); 393 extern void save_assoc(uint64_t *, FILE *); 394 extern FILE *opensavefile(char *); 395 extern const char *do_inet_ntop(const void *, char *, size_t); 396 extern uint8_t gettcpsigalgbyname(const char *); 397 extern const char *gettcpsigalgbynum(uint8_t); 398 399 /* 400 * Label conversion convenience functions. 401 */ 402 403 #include <tsol/label.h> 404 405 extern void ipsec_convert_sens_to_bslabel(const struct sadb_sens *, 406 bslabel_t *); 407 extern int ipsec_convert_sl_to_sens(int doi, bslabel_t *, struct sadb_sens *); 408 extern void ipsec_convert_bslabel_to_string(bslabel_t *, char **); 409 extern void ipsec_convert_bslabel_to_hex(bslabel_t *, char **); 410 411 /* 412 * These exit macros give a consistent exit behaviour for all 413 * programs that use libipsecutil. These wll work in usr/src/cmd 414 * and usr/src/lib, but because macros in usr/src/lib don't get 415 * expanded when I18N message catalogs are built, avoid using 416 * these with text inside libipsecutil. See source of ipsecutil_exit() 417 * for more details. 418 */ 419 #define EXIT_OK(x) \ 420 ipsecutil_exit(SERVICE_EXIT_OK, my_fmri, debugfile, \ 421 dgettext(TEXT_DOMAIN, x)) 422 #define EXIT_OK2(x, y) \ 423 ipsecutil_exit(SERVICE_EXIT_OK, my_fmri, debugfile, \ 424 dgettext(TEXT_DOMAIN, x), y) 425 #define EXIT_OK3(x, y, z) \ 426 ipsecutil_exit(SERVICE_EXIT_OK, my_fmri, debugfile, \ 427 dgettext(TEXT_DOMAIN, x), y, z) 428 #define EXIT_BADCONFIG(x) \ 429 ipsecutil_exit(SERVICE_BADCONF, my_fmri, debugfile, \ 430 dgettext(TEXT_DOMAIN, x)) 431 #define EXIT_BADCONFIG2(x, y) \ 432 ipsecutil_exit(SERVICE_BADCONF, my_fmri, debugfile, \ 433 dgettext(TEXT_DOMAIN, x), y) 434 #define EXIT_BADCONFIG3(x, y, z) \ 435 ipsecutil_exit(SERVICE_BADCONF, my_fmri, debugfile, \ 436 dgettext(TEXT_DOMAIN, x), y, z) 437 #define EXIT_MAINTAIN(x) \ 438 ipsecutil_exit(SERVICE_MAINTAIN, my_fmri, debugfile, \ 439 dgettext(TEXT_DOMAIN, x)) 440 #define EXIT_MAINTAIN2(x, y) \ 441 ipsecutil_exit(SERVICE_MAINTAIN, my_fmri, debugfile, \ 442 dgettext(TEXT_DOMAIN, x), y) 443 #define EXIT_DEGRADE(x) \ 444 ipsecutil_exit(SERVICE_DEGRADE, my_fmri, debugfile, \ 445 dgettext(TEXT_DOMAIN, x)) 446 #define EXIT_BADPERM(x) \ 447 ipsecutil_exit(SERVICE_BADPERM, my_fmri, debugfile, \ 448 dgettext(TEXT_DOMAIN, x)) 449 #define EXIT_BADPERM2(x, y) \ 450 ipsecutil_exit(SERVICE_BADPERM, my_fmri, debugfile, \ 451 dgettext(TEXT_DOMAIN, x), y) 452 #define EXIT_FATAL(x) \ 453 ipsecutil_exit(SERVICE_FATAL, my_fmri, debugfile, \ 454 dgettext(TEXT_DOMAIN, x)) 455 #define EXIT_FATAL2(x, y) \ 456 ipsecutil_exit(SERVICE_FATAL, my_fmri, debugfile, \ 457 dgettext(TEXT_DOMAIN, x), y) 458 #define EXIT_FATAL3(x, y, z) \ 459 ipsecutil_exit(SERVICE_FATAL, my_fmri, debugfile, \ 460 dgettext(TEXT_DOMAIN, x), y, z) 461 #define EXIT_RESTART(x) \ 462 ipsecutil_exit(SERVICE_RESTART, my_fmri, debugfile, \ 463 dgettext(TEXT_DOMAIN, x)) 464 465 #ifdef __cplusplus 466 } 467 #endif 468 469 #endif /* _IPSEC_UTIL_H */ 470