1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 * 21 * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 22 * Use is subject to license terms. 23 */ 24 25 #pragma ident "%Z%%M% %I% %E% SMI" 26 27 #include <unistd.h> 28 #include <stdio.h> 29 #include <stdarg.h> 30 #include <stdlib.h> 31 #include <sys/sysconf.h> 32 #include <string.h> 33 #include <strings.h> 34 #include <libintl.h> 35 #include <locale.h> 36 #include <ctype.h> 37 #include <time.h> 38 #include <sys/sysmacros.h> 39 #include <sys/stat.h> 40 #include <sys/mman.h> 41 #include <fcntl.h> 42 #include <sys/socket.h> 43 #include <netdb.h> 44 #include <errno.h> 45 #include <assert.h> 46 #include <netinet/in.h> 47 #include <arpa/inet.h> 48 #include <door.h> 49 #include <setjmp.h> 50 51 #include <ipsec_util.h> 52 #include <ikedoor.h> 53 54 static int doorfd = -1; 55 56 /* 57 * These are additional return values for the command line parsing 58 * function (parsecmd()). They are specific to this utility, but 59 * need to share the same space as the IKE_SVC_* defs, without conflicts. 60 * So they're defined relative to the end of that range. 61 */ 62 #define IKEADM_HELP_GENERAL IKE_SVC_MAX + 1 63 #define IKEADM_HELP_GET IKE_SVC_MAX + 2 64 #define IKEADM_HELP_SET IKE_SVC_MAX + 3 65 #define IKEADM_HELP_ADD IKE_SVC_MAX + 4 66 #define IKEADM_HELP_DEL IKE_SVC_MAX + 5 67 #define IKEADM_HELP_DUMP IKE_SVC_MAX + 6 68 #define IKEADM_HELP_FLUSH IKE_SVC_MAX + 7 69 #define IKEADM_HELP_READ IKE_SVC_MAX + 8 70 #define IKEADM_HELP_WRITE IKE_SVC_MAX + 9 71 #define IKEADM_HELP_HELP IKE_SVC_MAX + 10 72 #define IKEADM_EXIT IKE_SVC_MAX + 11 73 74 static void 75 command_complete(int s) 76 { 77 if (interactive) { 78 longjmp(env, 1); 79 } else { 80 exit(s); 81 } 82 } 83 84 static void 85 usage() 86 { 87 if (!interactive) { 88 (void) fprintf(stderr, gettext("Usage:\t" 89 "ikeadm [ -hnp ] cmd obj [cmd-specific options]\n")); 90 (void) fprintf(stderr, gettext(" \tikeadm help\n")); 91 } 92 93 command_complete(1); 94 } 95 96 static void 97 print_help() 98 { 99 (void) printf(gettext("Valid commands and objects:\n")); 100 (void) printf( 101 "\tget debug|priv|stats|p1|rule|preshared|defaults [%s]\n", 102 gettext("identifier")); 103 (void) printf("\tset priv %s\n", gettext("level")); 104 (void) printf("\tset debug %s [%s]\n", 105 gettext("level"), gettext("filename")); 106 (void) printf("\tadd rule|preshared {%s}|%s\n", 107 gettext("definition"), gettext("filename")); 108 (void) printf("\tdel p1|rule|preshared %s\n", gettext("identifier")); 109 (void) printf("\tdump p1|rule|preshared\n"); 110 (void) printf("\tflush p1\n"); 111 (void) printf("\tread rule|preshared [%s]\n", gettext("filename")); 112 (void) printf("\twrite rule|preshared %s\n", gettext("filename")); 113 (void) printf( 114 "\thelp [get|set|add|del|dump|flush|read|write|help]\n"); 115 (void) printf("\texit %s\n", gettext("exit the program")); 116 (void) printf("\tquit %s\n", gettext("exit the program")); 117 (void) printf("\n"); 118 119 command_complete(0); 120 } 121 122 static void 123 print_get_help() 124 { 125 (void) printf( 126 gettext("This command gets information from in.iked.\n\n")); 127 (void) printf(gettext("Objects that may be retrieved include:\n")); 128 (void) printf("\tdebug\t\t"); 129 (void) printf(gettext("the current debug level\n")); 130 (void) printf("\tpriv\t\t"); 131 (void) printf(gettext("the current privilege level\n")); 132 (void) printf("\tstats\t\t"); 133 (void) printf(gettext("current usage statistics\n")); 134 (void) printf("\tp1\t\t"); 135 (void) printf(gettext("a phase 1 SA, identified by\n")); 136 (void) printf(gettext("\t\t\t local_ip remote_ip OR\n")); 137 (void) printf(gettext("\t\t\t init_cookie resp_cookie\n")); 138 (void) printf("\trule\t\t"); 139 (void) printf(gettext("a phase 1 rule, identified by its label\n")); 140 (void) printf("\tpreshared\t"); 141 (void) printf(gettext("a preshared key, identified by\n")); 142 (void) printf(gettext("\t\t\t local_ip remote_ip OR\n")); 143 (void) printf(gettext("\t\t\t local_id remote_id\n")); 144 (void) printf("\n"); 145 146 command_complete(0); 147 } 148 149 static void 150 print_set_help() 151 { 152 (void) printf(gettext("This command sets values in in.iked.\n\n")); 153 (void) printf(gettext("Objects that may be set include:\n")); 154 (void) printf("\tdebug\t\t"); 155 (void) printf(gettext("change the debug level\n")); 156 (void) printf("\tpriv\t\t"); 157 (void) printf( 158 gettext("change the privilege level (may only be lowered)\n")); 159 (void) printf("\n"); 160 161 command_complete(0); 162 } 163 164 static void 165 print_add_help() 166 { 167 (void) printf( 168 gettext("This command adds items to in.iked's tables.\n\n")); 169 (void) printf(gettext("Objects that may be set include:\n")); 170 (void) printf("\trule\t\t"); 171 (void) printf(gettext("a phase 1 policy rule\n")); 172 (void) printf("\tpreshared\t"); 173 (void) printf(gettext("a preshared key\n")); 174 (void) printf( 175 gettext("\nObjects may be entered on the command-line, as a\n")); 176 (void) printf( 177 gettext("series of keywords and tokens contained in curly\n")); 178 (void) printf( 179 gettext("braces ('{', '}'); or the name of a file containing\n")); 180 (void) printf(gettext("the object definition may be provided.\n\n")); 181 (void) printf( 182 gettext("For security purposes, preshared keys may only be\n")); 183 (void) printf( 184 gettext("entered on the command-line if ikeadm is running in\n")); 185 (void) printf(gettext("interactive mode.\n")); 186 (void) printf("\n"); 187 188 command_complete(0); 189 } 190 191 static void 192 print_del_help() 193 { 194 (void) printf( 195 gettext("This command deletes an item from in.iked's tables.\n\n")); 196 (void) printf(gettext("Objects that may be deleted include:\n")); 197 (void) printf("\tp1\t\t"); 198 (void) printf(gettext("a phase 1 SA, identified by\n")); 199 (void) printf(gettext("\t\t\t local_ip remote_ip OR\n")); 200 (void) printf(gettext("\t\t\t init_cookie resp_cookie\n")); 201 (void) printf("\trule\t\t"); 202 (void) printf(gettext("a phase 1 rule, identified by its label\n")); 203 (void) printf("\tpreshared\t"); 204 (void) printf(gettext("a preshared key, identified by\n")); 205 (void) printf(gettext("\t\t\t local_ip remote_ip OR\n")); 206 (void) printf(gettext("\t\t\t local_id remote_id\n")); 207 (void) printf("\n"); 208 209 command_complete(0); 210 } 211 212 static void 213 print_dump_help() 214 { 215 (void) printf( 216 gettext("This command dumps one of in.iked's tables.\n\n")); 217 (void) printf(gettext("Tables that may be dumped include:\n")); 218 (void) printf("\tp1\t\t"); 219 (void) printf(gettext("all phase 1 SAs\n")); 220 (void) printf("\trule\t\t"); 221 (void) printf(gettext("all phase 1 rules\n")); 222 (void) printf("\tpreshared\t"); 223 (void) printf(gettext("all preshared keys\n")); 224 (void) printf("\n"); 225 226 command_complete(0); 227 } 228 229 static void 230 print_flush_help() 231 { 232 (void) printf( 233 gettext("This command clears one of in.iked's tables.\n\n")); 234 (void) printf(gettext("Tables that may be flushed include:\n")); 235 (void) printf("\tp1\t\t"); 236 (void) printf(gettext("all phase 1 SAs\n")); 237 (void) printf("\n"); 238 239 command_complete(0); 240 } 241 242 static void 243 print_read_help() 244 { 245 (void) printf( 246 gettext("This command reads a new configuration file into\n")); 247 (void) printf( 248 gettext("in.iked, discarding the old configuration info.\n\n")); 249 (void) printf(gettext("Sets of data that may be read include:\n")); 250 (void) printf("\trule\t\t"); 251 (void) printf(gettext("all phase 1 rules\n")); 252 (void) printf("\tpreshared\t"); 253 (void) printf(gettext("all preshared keys\n\n")); 254 (void) printf( 255 gettext("A filename may be provided to specify a source file\n")); 256 (void) printf(gettext("other than the default.\n")); 257 (void) printf("\n"); 258 259 command_complete(0); 260 } 261 262 static void 263 print_write_help() 264 { 265 (void) printf( 266 gettext("This command writes in.iked's current configuration\n")); 267 (void) printf(gettext("out to a config file.\n\n")); 268 (void) printf(gettext("Sets of data that may be written include:\n")); 269 (void) printf("\trule\t\t"); 270 (void) printf(gettext("all phase 1 rules\n")); 271 (void) printf("\tpreshared\t"); 272 (void) printf(gettext("all preshared keys\n\n")); 273 (void) printf( 274 gettext("A filename must be provided to specify the file to\n")); 275 (void) printf(gettext("which the information should be written.\n")); 276 (void) printf("\n"); 277 278 command_complete(0); 279 } 280 281 static void 282 print_help_help() 283 { 284 (void) printf( 285 gettext("This command provides information about commands.\n\n")); 286 (void) printf( 287 gettext("The 'help' command alone provides a list of valid\n")); 288 (void) printf( 289 gettext("commands, along with the valid objects for each.\n")); 290 (void) printf( 291 gettext("'help' followed by a valid command name provides\n")); 292 (void) printf(gettext("further information about that command.\n")); 293 (void) printf("\n"); 294 295 command_complete(0); 296 } 297 298 /*PRINTFLIKE1*/ 299 static void 300 message(char *fmt, ...) 301 { 302 va_list ap; 303 char msgbuf[BUFSIZ]; 304 305 va_start(ap, fmt); 306 (void) vsnprintf(msgbuf, BUFSIZ, fmt, ap); 307 (void) fprintf(stderr, gettext("ikeadm: %s\n"), msgbuf); 308 va_end(ap); 309 } 310 311 static int 312 open_door(void) 313 { 314 if (doorfd >= 0) 315 (void) close(doorfd); 316 doorfd = open(DOORNM, O_RDWR); 317 return (doorfd); 318 } 319 320 static ike_service_t * 321 ikedoor_call(char *reqp, int size, door_desc_t *descp, int ndesc) 322 { 323 door_arg_t arg; 324 int retries = 0; 325 326 arg.data_ptr = reqp; 327 arg.data_size = size; 328 arg.desc_ptr = descp; 329 arg.desc_num = ndesc; 330 arg.rbuf = (char *)NULL; 331 arg.rsize = 0; 332 333 retry: 334 if (door_call(doorfd, &arg) < 0) { 335 if ((errno == EBADF) && ((++retries < 2) && 336 (open_door() >= 0))) 337 goto retry; 338 (void) fprintf(stderr, 339 gettext("Unable to communicate with in.iked\n")); 340 Bail("door_call failed"); 341 } 342 343 if ((ndesc > 0) && (descp->d_attributes & DOOR_RELEASE) && 344 ((errno == EBADF) || (errno == EFAULT))) { 345 /* callers assume passed fds will be closed no matter what */ 346 (void) close(descp->d_data.d_desc.d_descriptor); 347 } 348 349 /* LINTED E_BAD_PTR_CAST_ALIGN */ 350 return ((ike_service_t *)arg.rbuf); 351 } 352 353 /* 354 * Parsing functions 355 */ 356 357 /* stolen from ipseckey.c, with a second tier added */ 358 static int 359 parsecmd(char *cmdstr, char *objstr) 360 { 361 #define MAXOBJS 10 362 struct objtbl { 363 char *obj; 364 int token; 365 }; 366 static struct cmdtbl { 367 char *cmd; 368 int null_obj_token; 369 struct objtbl objt[MAXOBJS]; 370 } table[] = { 371 {"get", IKE_SVC_ERROR, { 372 {"debug", IKE_SVC_GET_DBG}, 373 {"priv", IKE_SVC_GET_PRIV}, 374 {"stats", IKE_SVC_GET_STATS}, 375 {"p1", IKE_SVC_GET_P1}, 376 {"rule", IKE_SVC_GET_RULE}, 377 {"preshared", IKE_SVC_GET_PS}, 378 {"defaults", IKE_SVC_GET_DEFS}, 379 {NULL, IKE_SVC_ERROR}, 380 } 381 }, 382 {"set", IKE_SVC_ERROR, { 383 {"debug", IKE_SVC_SET_DBG}, 384 {"priv", IKE_SVC_SET_PRIV}, 385 {NULL, IKE_SVC_ERROR}, 386 } 387 }, 388 {"add", IKE_SVC_ERROR, { 389 {"rule", IKE_SVC_NEW_RULE}, 390 {"preshared", IKE_SVC_NEW_PS}, 391 {NULL, IKE_SVC_ERROR}, 392 } 393 }, 394 {"del", IKE_SVC_ERROR, { 395 {"p1", IKE_SVC_DEL_P1}, 396 {"rule", IKE_SVC_DEL_RULE}, 397 {"preshared", IKE_SVC_DEL_PS}, 398 {NULL, IKE_SVC_ERROR}, 399 } 400 }, 401 {"dump", IKE_SVC_ERROR, { 402 {"p1", IKE_SVC_DUMP_P1S}, 403 {"rule", IKE_SVC_DUMP_RULES}, 404 {"preshared", IKE_SVC_DUMP_PS}, 405 {NULL, IKE_SVC_ERROR}, 406 } 407 }, 408 {"flush", IKE_SVC_ERROR, { 409 {"p1", IKE_SVC_FLUSH_P1S}, 410 {NULL, IKE_SVC_ERROR}, 411 } 412 }, 413 {"read", IKE_SVC_ERROR, { 414 {"rule", IKE_SVC_READ_RULES}, 415 {"preshared", IKE_SVC_READ_PS}, 416 {NULL, IKE_SVC_ERROR}, 417 } 418 }, 419 {"write", IKE_SVC_ERROR, { 420 {"rule", IKE_SVC_WRITE_RULES}, 421 {"preshared", IKE_SVC_WRITE_PS}, 422 {NULL, IKE_SVC_ERROR}, 423 } 424 }, 425 {"help", IKEADM_HELP_GENERAL, { 426 {"get", IKEADM_HELP_GET}, 427 {"set", IKEADM_HELP_SET}, 428 {"add", IKEADM_HELP_ADD}, 429 {"del", IKEADM_HELP_DEL}, 430 {"dump", IKEADM_HELP_DUMP}, 431 {"flush", IKEADM_HELP_FLUSH}, 432 {"read", IKEADM_HELP_READ}, 433 {"write", IKEADM_HELP_WRITE}, 434 {"help", IKEADM_HELP_HELP}, 435 {NULL, IKE_SVC_ERROR}, 436 } 437 }, 438 {"exit", IKEADM_EXIT, { 439 {NULL, IKE_SVC_ERROR}, 440 } 441 }, 442 {"quit", IKEADM_EXIT, { 443 {NULL, IKE_SVC_ERROR}, 444 } 445 }, 446 {"dbg", IKE_SVC_ERROR, { 447 {"rbdump", IKE_SVC_DBG_RBDUMP}, 448 {NULL, IKE_SVC_ERROR}, 449 } 450 }, 451 {NULL, IKE_SVC_ERROR, { 452 {NULL, IKE_SVC_ERROR}, 453 } 454 }, 455 }; 456 struct cmdtbl *ct = table; 457 struct objtbl *ot; 458 459 if (cmdstr == NULL) { 460 return (IKE_SVC_ERROR); 461 } 462 463 while (ct->cmd != NULL && strcmp(ct->cmd, cmdstr) != 0) 464 ct++; 465 ot = ct->objt; 466 467 if (ct->cmd == NULL) { 468 message(gettext("Unrecognized command '%s'"), cmdstr); 469 return (ot->token); 470 } 471 472 if (objstr == NULL) { 473 return (ct->null_obj_token); 474 } 475 476 while (ot->obj != NULL && strcmp(ot->obj, objstr) != 0) 477 ot++; 478 479 if (ot->obj == NULL) 480 message(gettext("Unrecognized object '%s'"), objstr); 481 482 return (ot->token); 483 } 484 485 /* 486 * Parsing functions: 487 * Parse command-line identification info. All return -1 on failure, 488 * or the number of cmd-line args "consumed" on success (though argc 489 * and argv params are not actually modified). 490 */ 491 492 static int 493 parse_label(int argc, char **argv, char *label) 494 { 495 if ((argc < 1) || (argv == NULL)) 496 return (-1); 497 498 if (strlcpy(label, argv[0], MAX_LABEL_LEN) >= MAX_LABEL_LEN) 499 return (-1); 500 501 return (1); 502 } 503 504 /* 505 * Parse an address off the command line. In the hpp param, either 506 * return a hostent pointer (caller frees) or a pointer to a dummy_he_t 507 * (must also be freed by the caller; both cases are handled by the 508 * macro FREE_HE). The new getipnodebyname() call does the Right Thing 509 * (TM), even with raw addresses (colon-separated IPv6 or dotted decimal 510 * IPv4). 511 * (mostly stolen from ipseckey.c, though some tweaks were made 512 * to better serve our purposes here.) 513 */ 514 515 typedef struct { 516 struct hostent he; 517 char *addtl[2]; 518 } dummy_he_t; 519 520 static int 521 parse_addr(int argc, char **argv, struct hostent **hpp) 522 { 523 int hp_errno; 524 struct hostent *hp = NULL; 525 dummy_he_t *dhp; 526 char *addr1; 527 528 if ((argc < 1) || (argv == NULL) || (argv[0] == NULL)) 529 return (-1); 530 531 if (!nflag) { 532 /* 533 * Try name->address first. Assume AF_INET6, and 534 * get IPV4s, plus IPv6s iff IPv6 is configured. 535 */ 536 hp = getipnodebyname(argv[0], AF_INET6, AI_DEFAULT | AI_ALL, 537 &hp_errno); 538 } else { 539 /* 540 * Try a normal address conversion only. malloc a 541 * dummy_he_t to construct a fake hostent. Caller 542 * will know to free this one using free_he(). 543 */ 544 dhp = (dummy_he_t *)malloc(sizeof (dummy_he_t)); 545 addr1 = (char *)malloc(sizeof (struct in6_addr)); 546 if (inet_pton(AF_INET6, argv[0], addr1) == 1) { 547 dhp->he.h_addr_list = dhp->addtl; 548 dhp->addtl[0] = addr1; 549 dhp->addtl[1] = NULL; 550 hp = &dhp->he; 551 dhp->he.h_addrtype = AF_INET6; 552 dhp->he.h_length = sizeof (struct in6_addr); 553 } else if (inet_pton(AF_INET, argv[0], addr1) == 1) { 554 dhp->he.h_addr_list = dhp->addtl; 555 dhp->addtl[0] = addr1; 556 dhp->addtl[1] = NULL; 557 hp = &dhp->he; 558 dhp->he.h_addrtype = AF_INET; 559 dhp->he.h_length = sizeof (struct in_addr); 560 } else { 561 hp = NULL; 562 } 563 } 564 565 *hpp = hp; 566 567 if (hp == NULL) { 568 message(gettext("Unknown address %s."), argv[0]); 569 return (-1); 570 } 571 572 return (1); 573 } 574 575 /* 576 * Free a dummy_he_t structure that was malloc'd in parse_addr(). 577 * Unfortunately, callers of parse_addr don't want to know about 578 * dummy_he_t structs, so all they have is a pointer to the struct 579 * hostent; so that's what's passed in. To manage this, we make 580 * the assumption that the struct hostent is the first field in 581 * the dummy_he_t, and therefore a pointer to it is a pointer to 582 * the dummy_he_t. 583 */ 584 static void 585 free_he(struct hostent *hep) 586 { 587 dummy_he_t *p = (dummy_he_t *)hep; 588 589 assert(p != NULL); 590 591 if (p->addtl[0]) 592 free(p->addtl[0]); 593 if (p->addtl[1]) 594 free(p->addtl[1]); 595 596 free(p); 597 } 598 599 #define FREE_HE(x) \ 600 if (nflag) \ 601 free_he(x); \ 602 else \ 603 freehostent(x) 604 605 static void 606 headdr2sa(char *hea, struct sockaddr_storage *sa, int len) 607 { 608 struct sockaddr_in *sin; 609 struct sockaddr_in6 *sin6; 610 611 if (len == sizeof (struct in6_addr)) { 612 /* LINTED E_BAD_PTR_CAST_ALIGN */ 613 if (IN6_IS_ADDR_V4MAPPED((struct in6_addr *)hea)) { 614 sin = (struct sockaddr_in *)sa; 615 (void) memset(sin, 0, sizeof (*sin)); 616 /* LINTED E_BAD_PTR_CAST_ALIGN */ 617 IN6_V4MAPPED_TO_INADDR((struct in6_addr *)hea, 618 &sin->sin_addr); 619 sin->sin_family = AF_INET; 620 } else { 621 sin6 = (struct sockaddr_in6 *)sa; 622 (void) memset(sin6, 0, sizeof (*sin6)); 623 (void) memcpy(&sin6->sin6_addr, hea, 624 sizeof (struct in6_addr)); 625 sin6->sin6_family = AF_INET6; 626 } 627 } else { 628 sin = (struct sockaddr_in *)sa; 629 (void) memset(sin, 0, sizeof (*sin)); 630 (void) memcpy(&sin->sin_addr, hea, sizeof (struct in_addr)); 631 sin->sin_family = AF_INET; 632 } 633 } 634 635 /* 636 * The possible ident-type keywords that might be used on the command 637 * line. This is a superset of the ones supported by ipseckey, those 638 * in the ike config file, and those in ike.preshared. 639 */ 640 static keywdtab_t idtypes[] = { 641 /* ip, ipv4, and ipv6 are valid for preshared keys... */ 642 {SADB_IDENTTYPE_RESERVED, "ip"}, 643 {SADB_IDENTTYPE_RESERVED, "ipv4"}, 644 {SADB_IDENTTYPE_RESERVED, "ipv6"}, 645 {SADB_IDENTTYPE_PREFIX, "prefix"}, 646 {SADB_IDENTTYPE_PREFIX, "ipv4-prefix"}, 647 {SADB_IDENTTYPE_PREFIX, "ipv6-prefix"}, 648 {SADB_IDENTTYPE_PREFIX, "subnet"}, 649 {SADB_IDENTTYPE_PREFIX, "subnetv4"}, 650 {SADB_IDENTTYPE_PREFIX, "subnetv6"}, 651 {SADB_IDENTTYPE_FQDN, "fqdn"}, 652 {SADB_IDENTTYPE_FQDN, "dns"}, 653 {SADB_IDENTTYPE_FQDN, "domain"}, 654 {SADB_IDENTTYPE_FQDN, "domainname"}, 655 {SADB_IDENTTYPE_USER_FQDN, "user_fqdn"}, 656 {SADB_IDENTTYPE_USER_FQDN, "mbox"}, 657 {SADB_IDENTTYPE_USER_FQDN, "mailbox"}, 658 {SADB_X_IDENTTYPE_DN, "dn"}, 659 {SADB_X_IDENTTYPE_DN, "asn1dn"}, 660 {SADB_X_IDENTTYPE_GN, "gn"}, 661 {SADB_X_IDENTTYPE_GN, "asn1gn"}, 662 {SADB_X_IDENTTYPE_ADDR_RANGE, "ipv4-range"}, 663 {SADB_X_IDENTTYPE_ADDR_RANGE, "ipv6-range"}, 664 {SADB_X_IDENTTYPE_ADDR_RANGE, "rangev4"}, 665 {SADB_X_IDENTTYPE_ADDR_RANGE, "rangev6"}, 666 {SADB_X_IDENTTYPE_KEY_ID, "keyid"}, 667 {NULL, 0} 668 }; 669 670 static int 671 parse_idtype(char *type, uint16_t *idnum) 672 { 673 keywdtab_t *idp; 674 675 if (type == NULL) 676 return (-1); 677 678 for (idp = idtypes; idp->kw_str != NULL; idp++) { 679 if (strcasecmp(idp->kw_str, type) == 0) { 680 if (idnum != NULL) 681 *idnum = idp->kw_tag; 682 return (1); 683 } 684 } 685 686 return (-1); 687 } 688 689 /* 690 * The sadb_ident_t is malloc'd, since its length varies; 691 * so the caller must free() it when done with the data. 692 */ 693 static int 694 parse_ident(int argc, char **argv, sadb_ident_t **idpp) 695 { 696 int alloclen, consumed; 697 sadb_ident_t *idp; 698 if ((argc < 2) || (argv == NULL) || (argv[0] == NULL) || 699 (argv[1] == NULL)) 700 return (-1); 701 702 alloclen = sizeof (sadb_ident_t) + IKEDOORROUNDUP(strlen(argv[1]) + 1); 703 *idpp = idp = (sadb_ident_t *)malloc(alloclen); 704 if (idp == NULL) 705 Bail("parsing identity"); 706 707 if ((consumed = parse_idtype(argv[0], &idp->sadb_ident_type)) < 0) { 708 message(gettext("unknown identity type %s."), argv[0]); 709 return (-1); 710 } 711 712 idp->sadb_ident_len = SADB_8TO64(alloclen); 713 idp->sadb_ident_reserved = 0; 714 idp->sadb_ident_id = 0; 715 716 /* now copy in identity param */ 717 (void) strlcpy((char *)(idp + 1), argv[1], 718 alloclen - (sizeof (sadb_ident_t))); 719 720 return (++consumed); 721 } 722 723 static int 724 parse_cky(int argc, char **argv, uint64_t *ckyp) 725 { 726 u_longlong_t arg; 727 728 if ((argc < 1) || (argv[0] == NULL)) 729 return (-1); 730 731 errno = 0; 732 arg = strtoull(argv[0], NULL, 0); 733 if (errno != 0) { 734 message(gettext("failed to parse cookie %s."), argv[0]); 735 return (-1); 736 } 737 738 *ckyp = (uint64_t)arg; 739 740 return (1); 741 } 742 743 static int 744 parse_addr_pr(int argc, char **argv, struct hostent **h1pp, 745 struct hostent **h2pp) 746 { 747 int rtn, consumed = 0; 748 749 if ((rtn = parse_addr(argc, argv, h1pp)) < 0) { 750 return (-1); 751 } 752 consumed = rtn; 753 argc -= rtn; 754 argv += rtn; 755 756 if ((rtn = parse_addr(argc, argv, h2pp)) < 0) { 757 FREE_HE(*h1pp); 758 return (-1); 759 } 760 consumed += rtn; 761 762 return (consumed); 763 } 764 765 /* 766 * The sadb_ident_ts are malloc'd, since their length varies; 767 * so the caller must free() them when done with the data. 768 */ 769 static int 770 parse_ident_pr(int argc, char **argv, sadb_ident_t **id1pp, 771 sadb_ident_t **id2pp) 772 { 773 int rtn, consumed = 0; 774 775 if ((rtn = parse_ident(argc, argv, id1pp)) < 0) { 776 return (-1); 777 } 778 consumed = rtn; 779 argc -= rtn; 780 argv += rtn; 781 782 (*id1pp)->sadb_ident_exttype = SADB_EXT_IDENTITY_SRC; 783 784 if ((rtn = parse_ident(argc, argv, id2pp)) < 0) { 785 free(*id1pp); 786 return (-1); 787 } 788 consumed += rtn; 789 790 (*id2pp)->sadb_ident_exttype = SADB_EXT_IDENTITY_DST; 791 792 return (consumed); 793 } 794 795 static int 796 parse_cky_pr(int argc, char **argv, ike_cky_pr_t *cpr) 797 { 798 int rtn, consumed = 0; 799 800 if ((rtn = parse_cky(argc, argv, &cpr->cky_i)) < 0) { 801 return (-1); 802 } 803 consumed = rtn; 804 argc -= rtn; 805 argv += rtn; 806 807 if ((rtn = parse_cky(argc, argv, &cpr->cky_r)) < 0) { 808 return (-1); 809 } 810 consumed += rtn; 811 812 return (consumed); 813 } 814 815 /* 816 * Preshared key field types...used for parsing preshared keys that 817 * have been entered on the command line. The code to parse preshared 818 * keys (parse_ps, parse_key, parse_psfldid, parse_ikmtype, ...) is 819 * mostly duplicated from in.iked's readps.c. 820 */ 821 #define PSFLD_LOCID 1 822 #define PSFLD_LOCIDTYPE 2 823 #define PSFLD_REMID 3 824 #define PSFLD_REMIDTYPE 4 825 #define PSFLD_MODE 5 826 #define PSFLD_KEY 6 827 828 static keywdtab_t psfldtypes[] = { 829 {PSFLD_LOCID, "localid"}, 830 {PSFLD_LOCIDTYPE, "localidtype"}, 831 {PSFLD_REMID, "remoteid"}, 832 {PSFLD_REMIDTYPE, "remoteidtype"}, 833 {PSFLD_MODE, "ike_mode"}, 834 {PSFLD_KEY, "key"}, 835 {NULL, 0} 836 }; 837 838 static int 839 parse_psfldid(char *type, uint16_t *idnum) 840 { 841 keywdtab_t *pfp; 842 843 if (type == NULL) 844 return (-1); 845 846 for (pfp = psfldtypes; pfp->kw_str != NULL; pfp++) { 847 if (strcasecmp(pfp->kw_str, type) == 0) { 848 if (idnum != NULL) 849 *idnum = pfp->kw_tag; 850 return (1); 851 } 852 } 853 854 return (-1); 855 } 856 857 static keywdtab_t ikemodes[] = { 858 {IKE_XCHG_IDENTITY_PROTECT, "main"}, 859 {IKE_XCHG_AGGRESSIVE, "aggressive"}, 860 {IKE_XCHG_IP_AND_AGGR, "both"}, 861 {NULL, 0} 862 }; 863 864 static int 865 parse_ikmtype(char *mode, uint16_t *modenum) 866 { 867 keywdtab_t *ikmp; 868 869 if (mode == NULL) 870 return (-1); 871 872 for (ikmp = ikemodes; ikmp->kw_str != NULL; ikmp++) { 873 if (strcasecmp(ikmp->kw_str, mode) == 0) { 874 if (modenum != NULL) 875 *modenum = ikmp->kw_tag; 876 return (1); 877 } 878 } 879 880 return (-1); 881 } 882 883 #define hd2num(hd) (((hd) >= '0' && (hd) <= '9') ? ((hd) - '0') : \ 884 (((hd) >= 'a' && (hd) <= 'f') ? ((hd) - 'a' + 10) : ((hd) - 'A' + 10))) 885 886 static uint8_t * 887 parse_key(char *input, uint_t *keybuflen, uint_t *lbits) 888 { 889 uint8_t *keyp, *keybufp; 890 uint_t i, hexlen = 0, bits, alloclen; 891 892 for (i = 0; input[i] != '\0' && input[i] != '/'; i++) 893 hexlen++; 894 895 if (input[i] == '\0') { 896 bits = 0; 897 } else { 898 /* Have /nn. */ 899 input[i] = '\0'; 900 if (sscanf((input + i + 1), "%u", &bits) != 1) 901 return (NULL); 902 903 /* hexlen is in nibbles */ 904 if (((bits + 3) >> 2) > hexlen) 905 return (NULL); 906 907 /* 908 * Adjust hexlen down if user gave us too small of a bit 909 * count. 910 */ 911 if ((hexlen << 2) > bits + 3) { 912 hexlen = (bits + 3) >> 2; 913 input[hexlen] = '\0'; 914 } 915 } 916 917 /* 918 * Allocate. Remember, hexlen is in nibbles. 919 */ 920 921 alloclen = (hexlen/2 + (hexlen & 0x1)); 922 keyp = malloc(alloclen); 923 924 if (keyp == NULL) 925 return (NULL); 926 927 keybufp = keyp; 928 *keybuflen = alloclen; 929 if (bits == 0) 930 *lbits = (hexlen + (hexlen & 0x1)) << 2; 931 else 932 *lbits = bits; 933 934 /* 935 * Read in nibbles. Read in odd-numbered as shifted high. 936 * (e.g. 123 becomes 0x1230). 937 */ 938 for (i = 0; input[i] != '\0'; i += 2) { 939 boolean_t second = (input[i + 1] != '\0'); 940 941 if (!isxdigit(input[i]) || 942 (!isxdigit(input[i + 1]) && second)) { 943 free(keyp); 944 return (NULL); 945 } 946 *keyp = (hd2num(input[i]) << 4); 947 if (second) 948 *keyp |= hd2num(input[i + 1]); 949 else 950 break; /* out of for loop. */ 951 keyp++; 952 } 953 954 /* zero the remaining bits if we're a non-octet amount. */ 955 if (bits & 0x7) 956 *((input[i] == '\0') ? keyp - 1 : keyp) &= 957 0xff << (8 - (bits & 0x7)); 958 return (keybufp); 959 } 960 961 /* 962 * the ike_ps_t struct (plus trailing data) will be allocated here, 963 * so it will need to be freed by the caller. 964 */ 965 static int 966 parse_ps(int argc, char **argv, ike_ps_t **presharedpp, int *len) 967 { 968 uint_t c = 0, locidlen, remidlen, keylen, keybits; 969 uint_t a_locidtotal = 0, a_remidtotal = 0; 970 char *locid, *remid; 971 uint8_t *keyp = NULL; 972 uint16_t fldid, locidtype, remidtype, mtype; 973 struct hostent *loche = NULL, *remhe = NULL; 974 ike_ps_t *psp = NULL; 975 sadb_ident_t *sidp; 976 boolean_t whacked = B_FALSE; 977 978 if ((argv[c] == NULL) || (argv[c][0] != '{')) 979 return (-1); 980 if (argv[c][1] != 0) { 981 /* no space between '{' and first token */ 982 argv[c]++; 983 } else { 984 c++; 985 } 986 if ((argv[argc - 1][strlen(argv[argc - 1]) - 1] == '}') && 987 (argv[argc - 1][0] != '}')) { 988 /* 989 * whack '}' without a space before it or parsers break. 990 * Remember this trailing character for later 991 */ 992 argv[argc - 1][strlen(argv[argc - 1]) - 1] = '\0'; 993 whacked = B_TRUE; 994 } 995 996 while ((c < argc) && (argv[c] != NULL) && (argv[c][0] != '}')) { 997 if ((argv[c + 1] == NULL) || (argv[c + 1][0] == '}')) 998 goto bail; 999 if (parse_psfldid(argv[c++], &fldid) < 0) 1000 goto bail; 1001 switch (fldid) { 1002 case PSFLD_LOCID: 1003 locid = argv[c++]; 1004 locidlen = strlen(locid) + 1; 1005 break; 1006 case PSFLD_LOCIDTYPE: 1007 if (parse_idtype(argv[c++], &locidtype) < 0) 1008 goto bail; 1009 break; 1010 case PSFLD_REMID: 1011 remid = argv[c++]; 1012 remidlen = strlen(remid) + 1; 1013 break; 1014 case PSFLD_REMIDTYPE: 1015 if (parse_idtype(argv[c++], &remidtype) < 0) 1016 goto bail; 1017 break; 1018 case PSFLD_MODE: 1019 if (parse_ikmtype(argv[c++], &mtype) < 0) 1020 goto bail; 1021 break; 1022 case PSFLD_KEY: 1023 keyp = parse_key(argv[c++], &keylen, &keybits); 1024 if (keyp == NULL) 1025 goto bail; 1026 break; 1027 } 1028 } 1029 1030 /* Make sure the line was terminated with '}' */ 1031 if (argv[c] == NULL) { 1032 if (!whacked) 1033 goto bail; 1034 } else if (argv[c][0] != '}') { 1035 goto bail; 1036 } 1037 1038 /* 1039 * make sure we got all the required fields. If no idtype, assume 1040 * ip addr; if that translation fails, we'll catch the error then. 1041 */ 1042 if (locid == NULL || remid == NULL || keyp == NULL || mtype == 0) 1043 goto bail; 1044 1045 /* figure out the size buffer we need */ 1046 *len = sizeof (ike_ps_t); 1047 if (locidtype != SADB_IDENTTYPE_RESERVED) { 1048 a_locidtotal = IKEDOORROUNDUP(sizeof (sadb_ident_t) + locidlen); 1049 *len += a_locidtotal; 1050 } 1051 if (remidtype != SADB_IDENTTYPE_RESERVED) { 1052 a_remidtotal = IKEDOORROUNDUP(sizeof (sadb_ident_t) + remidlen); 1053 *len += a_remidtotal; 1054 } 1055 *len += keylen; 1056 1057 psp = malloc(*len); 1058 if (psp == NULL) 1059 goto bail; 1060 (void) memset(psp, 0, *len); 1061 1062 psp->ps_ike_mode = mtype; 1063 1064 psp->ps_localid_off = sizeof (ike_ps_t); 1065 if (locidtype == SADB_IDENTTYPE_RESERVED) { 1066 /* 1067 * this is an ip address, store in the sockaddr field; 1068 * we won't use an sadb_ident_t. 1069 */ 1070 psp->ps_localid_len = 0; 1071 if (parse_addr(1, &locid, &loche) < 0) 1072 goto bail; 1073 if (loche->h_addr_list[1] != NULL) { 1074 message(gettext("preshared key identifier cannot " 1075 "match multiple IP addresses")); 1076 goto bail; 1077 } 1078 headdr2sa(loche->h_addr_list[0], &psp->ps_ipaddrs.loc_addr, 1079 loche->h_length); 1080 FREE_HE(loche); 1081 } else { 1082 psp->ps_localid_len = sizeof (sadb_ident_t) + locidlen; 1083 sidp = (sadb_ident_t *)((int)psp + psp->ps_localid_off); 1084 sidp->sadb_ident_len = psp->ps_localid_len; 1085 sidp->sadb_ident_type = locidtype; 1086 (void) strlcpy((char *)(sidp + 1), locid, a_locidtotal); 1087 } 1088 1089 psp->ps_remoteid_off = psp->ps_localid_off + a_locidtotal; 1090 if (remidtype == SADB_IDENTTYPE_RESERVED) { 1091 /* 1092 * this is an ip address, store in the sockaddr field; 1093 * we won't use an sadb_ident_t. 1094 */ 1095 psp->ps_remoteid_len = 0; 1096 if (parse_addr(1, &remid, &remhe) < 0) 1097 goto bail; 1098 if (remhe->h_addr_list[1] != NULL) { 1099 message(gettext("preshared key identifier cannot " 1100 "match multiple IP addresses")); 1101 goto bail; 1102 } 1103 headdr2sa(remhe->h_addr_list[0], &psp->ps_ipaddrs.rem_addr, 1104 remhe->h_length); 1105 FREE_HE(remhe); 1106 } else { 1107 /* make sure we have at least 16-bit alignment */ 1108 if (remidlen & 0x1) 1109 remidlen++; 1110 psp->ps_remoteid_len = sizeof (sadb_ident_t) + remidlen; 1111 sidp = (sadb_ident_t *)((int)psp + psp->ps_remoteid_off); 1112 sidp->sadb_ident_len = psp->ps_remoteid_len; 1113 sidp->sadb_ident_type = remidtype; 1114 (void) strlcpy((char *)(sidp + 1), remid, a_remidtotal); 1115 } 1116 1117 psp->ps_key_off = psp->ps_remoteid_off + a_remidtotal; 1118 psp->ps_key_len = keylen; 1119 psp->ps_key_bits = keybits; 1120 (void) memcpy((uint8_t *)((int)psp + psp->ps_key_off), keyp, keylen); 1121 1122 *presharedpp = psp; 1123 1124 return (c); 1125 1126 bail: 1127 if (loche != NULL) 1128 FREE_HE(loche); 1129 if (remhe != NULL) 1130 FREE_HE(remhe); 1131 if (keyp != NULL) 1132 free(keyp); 1133 if (psp != NULL) 1134 free(psp); 1135 1136 *presharedpp = NULL; 1137 1138 return (-1); 1139 } 1140 1141 /* stolen from libdhcputil (dhcp_inittab.c) */ 1142 static uint64_t 1143 ike_ntohll(uint64_t nll) 1144 { 1145 #ifdef _LITTLE_ENDIAN 1146 return ((uint64_t)ntohl(nll & 0xffffffff) << 32 | ntohl(nll >> 32)); 1147 #else 1148 return (nll); 1149 #endif 1150 } 1151 1152 /* 1153 * Printing functions 1154 * 1155 * A potential point of confusion here is that the ikeadm-specific string- 1156 * producing functions do not match the ipsec_util.c versions in style: the 1157 * ikeadm-specific functions return a string (and are named foostr), while 1158 * the ipsec_util.c functions actually print the string to the file named 1159 * in the second arg to the function (and are named dump_foo). 1160 * 1161 * The reason for this is that in the context of the ikeadm output, it 1162 * seemed like the localization of the text would be more straightforward 1163 * (and could more easily accomodate non-english grammar!) if more complete 1164 * phrases were being translated, rather than a bit of a phrase followed by 1165 * a call to dump_foo() followed by more of the phrase. 1166 */ 1167 1168 static char * 1169 errstr(int err) 1170 { 1171 static char rtn[MAXLINESIZE]; 1172 1173 switch (err) { 1174 case IKE_ERR_NO_OBJ: 1175 return (gettext("No data returned")); 1176 case IKE_ERR_NO_DESC: 1177 return (gettext("No destination provided")); 1178 case IKE_ERR_ID_INVALID: 1179 return (gettext("Id info invalid")); 1180 case IKE_ERR_LOC_INVALID: 1181 return (gettext("Destination invalid")); 1182 case IKE_ERR_CMD_INVALID: 1183 return (gettext("Command invalid")); 1184 case IKE_ERR_DATA_INVALID: 1185 return (gettext("Supplied data invalid")); 1186 case IKE_ERR_CMD_NOTSUP: 1187 return (gettext("Unknown command")); 1188 case IKE_ERR_REQ_INVALID: 1189 return (gettext("Request invalid")); 1190 case IKE_ERR_NO_PRIV: 1191 return (gettext("Not allowed at current privilege level")); 1192 case IKE_ERR_SYS_ERR: 1193 return (gettext("System error")); 1194 case IKE_ERR_DUP_IGNORED: 1195 return (gettext("One or more duplicate entries ignored")); 1196 default: 1197 (void) snprintf(rtn, MAXLINESIZE, 1198 gettext("<unknown error %d>"), err); 1199 return (rtn); 1200 } 1201 } 1202 1203 static char * 1204 dbgstr(int bit) 1205 { 1206 static char rtn[MAXLINESIZE]; 1207 1208 switch (bit) { 1209 case D_CERT: 1210 return (gettext("Certificate management")); 1211 case D_KEY: 1212 return (gettext("Key management")); 1213 case D_OP: 1214 return (gettext("Operational")); 1215 case D_P1: 1216 return (gettext("Phase 1 SA creation")); 1217 case D_P2: 1218 return (gettext("Phase 2 SA creation")); 1219 case D_PFKEY: 1220 return (gettext("PF_KEY interface")); 1221 case D_POL: 1222 return (gettext("Policy management")); 1223 case D_PROP: 1224 return (gettext("Proposal construction")); 1225 case D_DOOR: 1226 return (gettext("Door interface")); 1227 case D_CONFIG: 1228 return (gettext("Config file processing")); 1229 default: 1230 (void) snprintf(rtn, MAXLINESIZE, 1231 gettext("<unknown flag 0x%x>"), bit); 1232 return (rtn); 1233 } 1234 } 1235 1236 static char * 1237 privstr(int priv) 1238 { 1239 static char rtn[MAXLINESIZE]; 1240 1241 switch (priv) { 1242 case IKE_PRIV_MINIMUM: 1243 return (gettext("base privileges")); 1244 case IKE_PRIV_MODKEYS: 1245 return (gettext("access to preshared key information")); 1246 case IKE_PRIV_KEYMAT: 1247 return (gettext("access to keying material")); 1248 default: 1249 (void) snprintf(rtn, MAXLINESIZE, 1250 gettext("<unknown level %d>"), priv); 1251 return (rtn); 1252 } 1253 } 1254 1255 static char * 1256 xchgstr(int xchg) 1257 { 1258 static char rtn[MAXLINESIZE]; 1259 1260 switch (xchg) { 1261 case IKE_XCHG_NONE: 1262 return (gettext("<unspecified>")); 1263 case IKE_XCHG_BASE: 1264 return (gettext("base")); 1265 case IKE_XCHG_IDENTITY_PROTECT: 1266 return (gettext("main mode (identity protect)")); 1267 case IKE_XCHG_AUTH_ONLY: 1268 return (gettext("authentication only")); 1269 case IKE_XCHG_AGGRESSIVE: 1270 return (gettext("aggressive mode")); 1271 case IKE_XCHG_IP_AND_AGGR: 1272 return (gettext("main and aggressive mode")); 1273 case IKE_XCHG_ANY: 1274 return (gettext("any mode")); 1275 default: 1276 (void) snprintf(rtn, MAXLINESIZE, 1277 gettext("<unknown %d>"), xchg); 1278 return (rtn); 1279 } 1280 } 1281 1282 static char * 1283 statestr(int state) 1284 { 1285 static char rtn[MAXLINESIZE]; 1286 1287 switch (state) { 1288 case IKE_SA_STATE_INIT: 1289 return (gettext("INITIALIZING")); 1290 case IKE_SA_STATE_SENT_SA: 1291 return (gettext("SENT FIRST MSG (SA)")); 1292 case IKE_SA_STATE_SENT_KE: 1293 return (gettext("SENT SECOND MSG (KE)")); 1294 case IKE_SA_STATE_SENT_LAST: 1295 return (gettext("SENT FINAL MSG")); 1296 case IKE_SA_STATE_DONE: 1297 return (gettext("ACTIVE")); 1298 case IKE_SA_STATE_DELETED: 1299 return (gettext("DELETED")); 1300 case IKE_SA_STATE_INVALID: 1301 return (gettext("<invalid>")); 1302 default: 1303 (void) snprintf(rtn, MAXLINESIZE, 1304 gettext("<unknown %d>"), state); 1305 return (rtn); 1306 } 1307 } 1308 1309 static char * 1310 authmethstr(int meth) 1311 { 1312 static char rtn[MAXLINESIZE]; 1313 1314 switch (meth) { 1315 case IKE_AUTH_METH_PRE_SHARED_KEY: 1316 return (gettext("pre-shared key")); 1317 case IKE_AUTH_METH_DSS_SIG: 1318 return (gettext("DSS signatures")); 1319 case IKE_AUTH_METH_RSA_SIG: 1320 return (gettext("RSA signatures")); 1321 case IKE_AUTH_METH_RSA_ENCR: 1322 return (gettext("RSA Encryption")); 1323 case IKE_AUTH_METH_RSA_ENCR_REVISED: 1324 return (gettext("Revised RSA Encryption")); 1325 default: 1326 (void) snprintf(rtn, MAXLINESIZE, 1327 gettext("<unknown %d>"), meth); 1328 return (rtn); 1329 } 1330 } 1331 1332 static char * 1333 prfstr(int prf) 1334 { 1335 static char rtn[MAXLINESIZE]; 1336 1337 switch (prf) { 1338 case IKE_PRF_NONE: 1339 return (gettext("<unknown>")); 1340 case IKE_PRF_HMAC_MD5: 1341 return ("HMAC MD5"); 1342 case IKE_PRF_HMAC_SHA1: 1343 return ("HMAC SHA1"); 1344 default: 1345 (void) snprintf(rtn, MAXLINESIZE, 1346 gettext("<unknown %d>"), prf); 1347 return (rtn); 1348 } 1349 } 1350 1351 static char * 1352 dhstr(int grp) 1353 { 1354 static char rtn[MAXLINESIZE]; 1355 1356 switch (grp) { 1357 case 0: 1358 return (gettext("<unknown>")); 1359 case IKE_GRP_DESC_MODP_768: 1360 return (gettext("768-bit MODP")); 1361 case IKE_GRP_DESC_MODP_1024: 1362 return (gettext("1024-bit MODP")); 1363 case IKE_GRP_DESC_EC2N_155: 1364 return (gettext("EC2N group on GP[2^155]")); 1365 case IKE_GRP_DESC_EC2N_185: 1366 return (gettext("EC2N group on GP[2^185]")); 1367 case IKE_GRP_DESC_MODP_1536: 1368 return (gettext("1536-bit MODP")); 1369 default: 1370 (void) snprintf(rtn, MAXLINESIZE, gettext("<unknown %d>"), grp); 1371 return (rtn); 1372 } 1373 } 1374 1375 static void 1376 print_hdr(char *prefix, ike_p1_hdr_t *hdrp) 1377 { 1378 (void) printf( 1379 gettext("%s Cookies: Initiator 0x%llx Responder 0x%llx\n"), 1380 prefix, ike_ntohll(hdrp->p1hdr_cookies.cky_i), 1381 ike_ntohll(hdrp->p1hdr_cookies.cky_r)); 1382 (void) printf(gettext("%s The local host is the %s.\n"), prefix, 1383 hdrp->p1hdr_isinit ? gettext("initiator") : gettext("responder")); 1384 (void) printf(gettext("%s ISAKMP version %d.%d; %s exchange\n"), prefix, 1385 hdrp->p1hdr_major, hdrp->p1hdr_minor, xchgstr(hdrp->p1hdr_xchg)); 1386 (void) printf(gettext("%s Current state is %s"), prefix, 1387 statestr(hdrp->p1hdr_state)); 1388 (void) printf("\n"); 1389 } 1390 1391 static void 1392 print_lt_limits(char *prefix, ike_p1_xform_t *xfp) 1393 { 1394 (void) printf(gettext("%s Lifetime limits:\n"), prefix); 1395 (void) printf(gettext("%s %u seconds; %u kbytes protected; "), 1396 prefix, xfp->p1xf_max_secs, xfp->p1xf_max_kbytes); 1397 (void) printf(gettext("%u keymat provided.\n"), xfp->p1xf_max_keyuses); 1398 } 1399 1400 #define LT_USAGE_LEN 16 /* 1 uint64 + 2 uint32s */ 1401 static void 1402 print_lt_usage(char *prefix, ike_p1_stats_t *sp) 1403 { 1404 time_t scratch; 1405 char tbuf[TBUF_SIZE]; 1406 1407 (void) printf(gettext("%s Current usage:\n"), prefix); 1408 scratch = (time_t)sp->p1stat_start; 1409 if (strftime(tbuf, TBUF_SIZE, NULL, localtime(&scratch)) == 0) 1410 (void) strlcpy(tbuf, gettext("<time conversion failed>"), 1411 TBUF_SIZE); 1412 (void) printf(gettext("%s SA was created at %s\n"), prefix, tbuf); 1413 (void) printf(gettext("%s %u kbytes protected; %u keymat provided.\n"), 1414 prefix, sp->p1stat_kbytes, sp->p1stat_keyuses); 1415 } 1416 1417 static void 1418 print_xform(char *prefix, ike_p1_xform_t *xfp, boolean_t print_lifetimes) 1419 { 1420 (void) printf(gettext("%s Authentication method: %s"), prefix, 1421 authmethstr(xfp->p1xf_auth_meth)); 1422 (void) printf(gettext("\n%s Encryption alg: "), prefix); 1423 (void) dump_ealg(xfp->p1xf_encr_alg, stdout); 1424 if (xfp->p1xf_encr_low_bits != 0) { 1425 (void) printf(gettext("(%d..%d)"), xfp->p1xf_encr_low_bits, 1426 xfp->p1xf_encr_high_bits); 1427 } 1428 (void) printf(gettext("; Authentication alg: ")); 1429 (void) dump_aalg(xfp->p1xf_auth_alg, stdout); 1430 (void) printf(gettext("\n%s PRF: %s"), prefix, prfstr(xfp->p1xf_prf)); 1431 (void) printf(gettext("; Oakley Group: %s\n"), 1432 dhstr(xfp->p1xf_dh_group)); 1433 if (xfp->p1xf_pfs == 0) { 1434 (void) printf(gettext("%s Phase 2 PFS is not used\n"), prefix); 1435 } else { 1436 (void) printf(gettext( 1437 "%s Phase 2 PFS is required (Oakley Group: %s)\n"), 1438 prefix, dhstr(xfp->p1xf_pfs)); 1439 } 1440 1441 if (print_lifetimes) 1442 print_lt_limits(prefix, xfp); 1443 } 1444 1445 static void 1446 print_lifetime(char *prefix, ike_p1_xform_t *xfp, ike_p1_stats_t *sp, 1447 int statlen) 1448 { 1449 time_t current, remain, exp; 1450 char tbuf[TBUF_SIZE]; 1451 1452 current = time(NULL); 1453 1454 print_lt_limits(prefix, xfp); 1455 1456 /* 1457 * make sure the stats struct we've been passed is as big 1458 * as we expect it to be. The usage stats are at the end, 1459 * so anything less than the size we expect won't work. 1460 */ 1461 if (statlen >= sizeof (ike_p1_stats_t)) { 1462 print_lt_usage(prefix, sp); 1463 } else { 1464 return; 1465 } 1466 1467 (void) printf(gettext("%s Expiration info:\n"), prefix); 1468 1469 if (xfp->p1xf_max_kbytes != 0) 1470 (void) printf(gettext("%s %u more bytes can be protected.\n"), 1471 prefix, xfp->p1xf_max_kbytes - sp->p1stat_kbytes); 1472 1473 if (xfp->p1xf_max_keyuses != 0) 1474 (void) printf(gettext("%s Keying material can be provided " 1475 "%u more times.\n"), prefix, 1476 xfp->p1xf_max_keyuses - sp->p1stat_keyuses); 1477 1478 if (xfp->p1xf_max_secs != 0) { 1479 exp = (time_t)sp->p1stat_start + (time_t)xfp->p1xf_max_secs; 1480 remain = exp - current; 1481 if (strftime(tbuf, TBUF_SIZE, NULL, localtime(&exp)) == 0) 1482 (void) strlcpy(tbuf, 1483 gettext("<time conversion failed>"), TBUF_SIZE); 1484 /* 1485 * The SA may have expired but still exist because libike 1486 * has not freed it yet. 1487 */ 1488 if (remain > 0) 1489 (void) printf(gettext( 1490 "%s SA expires in %lu seconds, at %s\n"), 1491 prefix, remain, tbuf); 1492 else 1493 (void) printf(gettext("%s SA Expired at %s\n"), 1494 prefix, tbuf); 1495 } 1496 } 1497 1498 /* used to verify structure lengths... */ 1499 #define COUNTER_32BIT 4 1500 #define COUNTER_PAIR 8 1501 1502 static void 1503 print_p1stats(char *prefix, ike_p1_stats_t *sp, int statlen, 1504 boolean_t print_lifetimes) 1505 { 1506 if (statlen < COUNTER_PAIR) 1507 return; 1508 (void) printf(gettext("%s %u Quick Mode SAs created; "), prefix, 1509 sp->p1stat_new_qm_sas); 1510 (void) printf(gettext("%u Quick Mode SAs deleted\n"), 1511 sp->p1stat_del_qm_sas); 1512 statlen -= COUNTER_PAIR; 1513 1514 if ((print_lifetimes) && (statlen >= LT_USAGE_LEN)) 1515 print_lt_usage(prefix, sp); 1516 } 1517 1518 static void 1519 print_errs(char *prefix, ike_p1_errors_t *errp, int errlen) 1520 { 1521 /* 1522 * Don't try to break this one up; it's either all or nothing! 1523 */ 1524 if (errlen < sizeof (ike_p1_errors_t)) 1525 return; 1526 1527 (void) printf(gettext("%s %u RX errors: "), prefix, 1528 errp->p1err_decrypt + errp->p1err_hash + errp->p1err_otherrx); 1529 (void) printf(gettext("%u decryption, %u hash, %u other\n"), 1530 errp->p1err_decrypt, errp->p1err_hash, errp->p1err_otherrx); 1531 (void) printf(gettext("%s %u TX errors\n"), prefix, errp->p1err_tx); 1532 } 1533 1534 static void 1535 print_addr_range(char *prefix, ike_addr_pr_t *pr) 1536 { 1537 boolean_t range = B_TRUE; 1538 struct sockaddr_storage *beg, *end; 1539 struct sockaddr_in *bsin, *esin; 1540 struct sockaddr_in6 *bsin6, *esin6; 1541 1542 beg = &pr->beg_iprange; 1543 end = &pr->end_iprange; 1544 1545 if (beg->ss_family != end->ss_family) { 1546 (void) printf(gettext("%s invalid address range\n"), prefix); 1547 return; 1548 } 1549 1550 switch (beg->ss_family) { 1551 case AF_INET: 1552 bsin = (struct sockaddr_in *)beg; 1553 esin = (struct sockaddr_in *)end; 1554 if ((uint32_t)bsin->sin_addr.s_addr == 1555 (uint32_t)esin->sin_addr.s_addr) 1556 range = B_FALSE; 1557 break; 1558 case AF_INET6: 1559 bsin6 = (struct sockaddr_in6 *)beg; 1560 esin6 = (struct sockaddr_in6 *)end; 1561 if (IN6_ARE_ADDR_EQUAL(&bsin6->sin6_addr, &esin6->sin6_addr)) 1562 range = B_FALSE; 1563 break; 1564 default: 1565 (void) printf(gettext("%s invalid address range\n"), prefix); 1566 return; 1567 } 1568 1569 (void) printf("%s ", prefix); 1570 (void) dump_sockaddr((struct sockaddr *)beg, 0, B_TRUE, stdout); 1571 if (range) { 1572 (void) printf(" - "); 1573 (void) dump_sockaddr((struct sockaddr *)end, 0, B_TRUE, stdout); 1574 } 1575 (void) printf("\n"); 1576 1577 } 1578 1579 /* 1580 * used to tell printing function if info should be identified 1581 * as belonging to initiator, responder, or neither 1582 */ 1583 #define IS_INITIATOR 1 1584 #define IS_RESPONDER 2 1585 #define DONT_PRINT_INIT 3 1586 1587 static void 1588 print_addr(char *prefix, struct sockaddr_storage *sa, int init_instr) 1589 { 1590 (void) printf(gettext("%s Address"), prefix); 1591 1592 if (init_instr != DONT_PRINT_INIT) 1593 (void) printf(" (%s):\n", (init_instr == IS_INITIATOR) ? 1594 gettext("Initiator") : gettext("Responder")); 1595 else 1596 (void) printf(":\n"); 1597 1598 (void) printf("%s ", prefix); 1599 (void) dump_sockaddr((struct sockaddr *)sa, 0, B_FALSE, stdout); 1600 } 1601 1602 static void 1603 print_id(char *prefix, sadb_ident_t *idp, int init_instr) 1604 { 1605 boolean_t canprint; 1606 1607 switch (init_instr) { 1608 case IS_INITIATOR: 1609 (void) printf(gettext("%s Initiator identity, "), prefix); 1610 break; 1611 case IS_RESPONDER: 1612 (void) printf(gettext("%s Responder identity, "), prefix); 1613 break; 1614 case DONT_PRINT_INIT: 1615 (void) printf(gettext("%s Identity, "), prefix); 1616 break; 1617 default: 1618 (void) printf(gettext("<invalid identity>\n")); 1619 return; 1620 } 1621 (void) printf(gettext("uid=%d, type "), idp->sadb_ident_id); 1622 canprint = dump_sadb_idtype(idp->sadb_ident_type, stdout, NULL); 1623 if (canprint) 1624 (void) printf("\n%s %s\n", prefix, (char *)(idp + 1)); 1625 else 1626 (void) printf(gettext("\n%s <cannot print>\n"), prefix); 1627 } 1628 1629 static void 1630 print_idspec(char *prefix, char *idp, int icnt, int ecnt) 1631 { 1632 int i; 1633 1634 (void) printf(gettext("%s Identity descriptors:\n"), prefix); 1635 1636 for (i = 0; i < icnt; i++) { 1637 if (i == 0) 1638 (void) printf(gettext("%s Includes:\n"), prefix); 1639 (void) printf("%s %s\n", prefix, idp); 1640 idp += strlen(idp) + 1; 1641 } 1642 1643 for (i = 0; i < ecnt; i++) { 1644 if (i == 0) 1645 (void) printf(gettext("%s Excludes:\n"), prefix); 1646 (void) printf("%s %s\n", prefix, idp); 1647 idp += strlen(idp) + 1; 1648 } 1649 } 1650 1651 static void 1652 print_keys(char *prefix, ike_p1_key_t *keyp, int size) 1653 { 1654 uint32_t *curp; 1655 ike_p1_key_t *p; 1656 int ssize; 1657 1658 curp = (uint32_t *)keyp; 1659 1660 ssize = sizeof (ike_p1_key_t); 1661 1662 while ((intptr_t)curp - (intptr_t)keyp < size) { 1663 size_t p1klen, len; 1664 1665 p = (ike_p1_key_t *)curp; 1666 p1klen = p->p1key_len; 1667 len = p1klen - ssize; 1668 1669 p1klen = roundup(p1klen, sizeof (ike_p1_key_t)); 1670 if (p1klen < ssize) { 1671 (void) printf(gettext("Short key\n")); 1672 break; 1673 } 1674 1675 switch (p->p1key_type) { 1676 case IKE_KEY_PRESHARED: 1677 (void) printf(gettext("%s Pre-shared key (%d bytes): "), 1678 prefix, len); 1679 (void) dump_key((uint8_t *)(p + 1), SADB_8TO1(len), 1680 stdout); 1681 break; 1682 case IKE_KEY_SKEYID: 1683 (void) printf(gettext("%s SKEYID (%d bytes): "), 1684 prefix, len); 1685 (void) dump_key((uint8_t *)(p + 1), SADB_8TO1(len), 1686 stdout); 1687 break; 1688 case IKE_KEY_SKEYID_D: 1689 (void) printf(gettext("%s SKEYID_d (%d bytes): "), 1690 prefix, len); 1691 (void) dump_key((uint8_t *)(p + 1), SADB_8TO1(len), 1692 stdout); 1693 break; 1694 case IKE_KEY_SKEYID_A: 1695 (void) printf(gettext("%s SKEYID_a (%d bytes): "), 1696 prefix, len); 1697 (void) dump_key((uint8_t *)(p + 1), SADB_8TO1(len), 1698 stdout); 1699 break; 1700 case IKE_KEY_SKEYID_E: 1701 (void) printf(gettext("%s SKEYID_e (%d bytes): "), 1702 prefix, len); 1703 (void) dump_key((uint8_t *)(p + 1), SADB_8TO1(len), 1704 stdout); 1705 break; 1706 case IKE_KEY_ENCR: 1707 (void) printf(gettext("%s Encryption key (%d bytes): "), 1708 prefix, len); 1709 (void) dump_key((uint8_t *)(p + 1), SADB_8TO1(len), 1710 stdout); 1711 break; 1712 case IKE_KEY_IV: 1713 (void) printf( 1714 gettext("%s Initialization vector (%d bytes): "), 1715 prefix, len); 1716 (void) dump_key((uint8_t *)(p + 1), SADB_8TO1(len), 1717 stdout); 1718 break; 1719 default: 1720 (void) printf(gettext("%s Unidentified key info %p %d"), 1721 prefix, p, p1klen); 1722 } 1723 (void) printf("\n"); 1724 assert(IS_P2ALIGNED(p1klen, 8)); 1725 curp += (p1klen >> 2); 1726 } 1727 } 1728 1729 static void 1730 print_p1(ike_p1_sa_t *p1) 1731 { 1732 ike_p1_stats_t *sp; 1733 ike_p1_errors_t *ep; 1734 ike_p1_key_t *kp; 1735 sadb_ident_t *lidp, *ridp; 1736 int lstat, rstat; 1737 1738 (void) printf("\n"); 1739 print_hdr("IKESA:", &p1->p1sa_hdr); 1740 print_xform("XFORM:", &p1->p1sa_xform, B_FALSE); 1741 1742 if (p1->p1sa_hdr.p1hdr_isinit) { 1743 lstat = IS_INITIATOR; 1744 rstat = IS_RESPONDER; 1745 } else { 1746 lstat = IS_RESPONDER; 1747 rstat = IS_INITIATOR; 1748 } 1749 print_addr("LOCIP:", &p1->p1sa_ipaddrs.loc_addr, lstat); 1750 print_addr("REMIP:", &p1->p1sa_ipaddrs.rem_addr, rstat); 1751 1752 /* 1753 * the stat len might be 0; but still make the call 1754 * to print_lifetime() to pick up the xform info 1755 */ 1756 sp = (ike_p1_stats_t *)((int)(p1) + p1->p1sa_stat_off); 1757 print_lifetime("LIFTM:", &p1->p1sa_xform, sp, p1->p1sa_stat_len); 1758 1759 if (p1->p1sa_stat_len > 0) { 1760 print_p1stats("STATS:", sp, p1->p1sa_stat_len, B_FALSE); 1761 } 1762 1763 if (p1->p1sa_error_len > 0) { 1764 ep = (ike_p1_errors_t *)((int)(p1) + p1->p1sa_error_off); 1765 print_errs("ERRS: ", ep, p1->p1sa_error_len); 1766 } 1767 1768 if (p1->p1sa_localid_len > 0) { 1769 lidp = (sadb_ident_t *)((int)(p1) + p1->p1sa_localid_off); 1770 print_id("LOCID:", lidp, lstat); 1771 } 1772 1773 if (p1->p1sa_remoteid_len > 0) { 1774 ridp = (sadb_ident_t *)((int)(p1) + p1->p1sa_remoteid_off); 1775 print_id("REMID:", ridp, rstat); 1776 } 1777 1778 if (p1->p1sa_key_len > 0) { 1779 kp = (ike_p1_key_t *)((int)(p1) + p1->p1sa_key_off); 1780 print_keys("KEY: ", kp, p1->p1sa_key_len); 1781 } 1782 } 1783 1784 static void 1785 print_ps(ike_ps_t *ps) 1786 { 1787 sadb_ident_t *lidp, *ridp; 1788 uint8_t *keyp; 1789 1790 (void) printf("\n"); 1791 1792 (void) printf(gettext("PSKEY: For %s exchanges\n"), 1793 xchgstr(ps->ps_ike_mode)); 1794 1795 if (ps->ps_key_len > 0) { 1796 keyp = (uint8_t *)((int)(ps) + ps->ps_key_off); 1797 (void) printf(gettext("PSKEY: Pre-shared key (%d bytes): "), 1798 ps->ps_key_len); 1799 (void) dump_key(keyp, ps->ps_key_bits, stdout); 1800 (void) printf("\n"); 1801 } 1802 1803 /* 1804 * We get *either* and address or an ident, never both. So if 1805 * the ident is there, don't try printing an address. 1806 */ 1807 if (ps->ps_localid_len > 0) { 1808 lidp = (sadb_ident_t *) 1809 ((int)(ps) + ps->ps_localid_off); 1810 print_id("LOCID:", lidp, DONT_PRINT_INIT); 1811 } else { 1812 print_addr("LOCIP:", &ps->ps_ipaddrs.loc_addr, DONT_PRINT_INIT); 1813 } 1814 1815 if (ps->ps_remoteid_len > 0) { 1816 ridp = (sadb_ident_t *) 1817 ((int)(ps) + ps->ps_remoteid_off); 1818 print_id("REMID:", ridp, DONT_PRINT_INIT); 1819 } else { 1820 print_addr("REMIP:", &ps->ps_ipaddrs.rem_addr, DONT_PRINT_INIT); 1821 } 1822 } 1823 1824 #define PREFIXLEN 16 1825 1826 static void 1827 print_rule(ike_rule_t *rp) 1828 { 1829 char prefix[PREFIXLEN]; 1830 int i; 1831 ike_p1_xform_t *xfp; 1832 ike_addr_pr_t *lipp, *ripp; 1833 char *lidp, *ridp; 1834 1835 (void) printf("\n"); 1836 (void) printf(gettext("GLOBL: Label '%s', key manager cookie %u\n"), 1837 rp->rule_label, rp->rule_kmcookie); 1838 (void) printf(gettext("GLOBL: local_idtype=")); 1839 (void) dump_sadb_idtype(rp->rule_local_idtype, stdout, NULL); 1840 (void) printf(gettext(", ike_mode=%s\n"), xchgstr(rp->rule_ike_mode)); 1841 (void) printf(gettext( 1842 "GLOBL: p1_nonce_len=%u, p2_nonce_len=%u, p2_pfs=%s (group %u)\n"), 1843 rp->rule_p1_nonce_len, rp->rule_p2_nonce_len, 1844 (rp->rule_p2_pfs) ? gettext("true") : gettext("false"), 1845 rp->rule_p2_pfs); 1846 (void) printf( 1847 gettext("GLOBL: p2_lifetime=%u seconds, p2_softlife=%u seconds\n"), 1848 rp->rule_p2_lifetime_secs, rp->rule_p2_softlife_secs); 1849 (void) printf( 1850 gettext("GLOBL: p2_lifetime_kb=%u seconds," 1851 " p2_softlife_kb=%u seconds\n"), 1852 rp->rule_p2_lifetime_kb, rp->rule_p2_softlife_kb); 1853 1854 if (rp->rule_locip_cnt > 0) { 1855 (void) printf(gettext("LOCIP: IP address range(s):\n")); 1856 lipp = (ike_addr_pr_t *)((int)rp + rp->rule_locip_off); 1857 for (i = 0; i < rp->rule_locip_cnt; i++, lipp++) { 1858 print_addr_range("LOCIP:", lipp); 1859 } 1860 } 1861 1862 if (rp->rule_remip_cnt > 0) { 1863 (void) printf(gettext("REMIP: IP address range(s):\n")); 1864 ripp = (ike_addr_pr_t *)((int)rp + rp->rule_remip_off); 1865 for (i = 0; i < rp->rule_remip_cnt; i++, ripp++) { 1866 print_addr_range("REMIP:", ripp); 1867 } 1868 } 1869 1870 if (rp->rule_locid_inclcnt + rp->rule_locid_exclcnt > 0) { 1871 lidp = (char *)((int)rp + rp->rule_locid_off); 1872 print_idspec("LOCID:", lidp, rp->rule_locid_inclcnt, 1873 rp->rule_locid_exclcnt); 1874 } 1875 1876 if (rp->rule_remid_inclcnt + rp->rule_remid_exclcnt > 0) { 1877 ridp = (char *)((int)rp + rp->rule_remid_off); 1878 print_idspec("REMID:", ridp, rp->rule_remid_inclcnt, 1879 rp->rule_remid_exclcnt); 1880 } 1881 1882 if (rp->rule_xform_cnt > 0) { 1883 (void) printf(gettext("XFRMS: Available Transforms:\n")); 1884 xfp = (ike_p1_xform_t *)((int)rp + rp->rule_xform_off); 1885 for (i = 0; i < rp->rule_xform_cnt; i++, xfp++) { 1886 (void) snprintf(prefix, PREFIXLEN, "XF %2u:", i); 1887 print_xform(prefix, xfp, B_TRUE); 1888 } 1889 } 1890 } 1891 1892 #undef PREFIXLEN 1893 1894 #define PRSACNTS(init, resp) \ 1895 (void) printf(gettext("initiator: %10u responder: %10u\n"), \ 1896 (init), (resp)) 1897 1898 static void 1899 print_stats(ike_stats_t *sp, int len) 1900 { 1901 /* 1902 * before printing each line, make sure the structure we were 1903 * given is big enough to include the fields needed. 1904 */ 1905 if (len < COUNTER_PAIR) 1906 return; 1907 (void) printf(gettext("Phase 1 SA counts:\n")); 1908 (void) printf(gettext("Current: ")); 1909 PRSACNTS(sp->st_init_p1_current, sp->st_resp_p1_current); 1910 len -= COUNTER_PAIR; 1911 1912 if (len < COUNTER_PAIR) 1913 return; 1914 (void) printf(gettext("Total: ")); 1915 PRSACNTS(sp->st_init_p1_total, sp->st_resp_p1_total); 1916 len -= COUNTER_PAIR; 1917 1918 if (len < COUNTER_PAIR) 1919 return; 1920 (void) printf(gettext("Attempted: ")); 1921 PRSACNTS(sp->st_init_p1_attempts, sp->st_resp_p1_attempts); 1922 len -= COUNTER_PAIR; 1923 1924 if (len < (COUNTER_PAIR + COUNTER_32BIT)) 1925 return; 1926 (void) printf(gettext("Failed: ")); 1927 PRSACNTS(sp->st_init_p1_noresp + sp->st_init_p1_respfail, 1928 sp->st_resp_p1_fail); 1929 (void) printf( 1930 gettext(" initiator fails include %u time-out(s)\n"), 1931 sp->st_init_p1_noresp); 1932 1933 if (len < PATH_MAX) 1934 return; 1935 if (*(sp->st_pkcs11_libname) != '\0') 1936 (void) printf(gettext("PKCS#11 library linked in from %s\n"), 1937 sp->st_pkcs11_libname); 1938 } 1939 1940 static void 1941 print_defaults(char *label, char *description, char *unit, boolean_t kbytes, 1942 uint_t current, uint_t def) 1943 { 1944 (void) printf("%-18s%-10s%14u%s%-10s%-26s\n", label, 1945 (current != def) ? gettext("config") : gettext("default"), 1946 (current != def) ? current : def, (kbytes) ? "K " : " ", 1947 unit, description); 1948 } 1949 1950 /* 1951 * Print out defaults used by in.iked, the argument is a buffer containing 1952 * two ike_defaults_t's, the first contains the hard coded defaults, the second 1953 * contains the actual values used. If these differ, then the defaults have been 1954 * changed via a config file entry. Note that "-" indicates this default 1955 * is not tunable. 1956 */ 1957 static void 1958 do_print_defaults(ike_defaults_t *dp) 1959 { 1960 ike_defaults_t *ddp; 1961 ddp = (ike_defaults_t *)(dp + 1); 1962 1963 (void) printf(gettext("\nGlobal defaults. Some values can be" 1964 " over-ridden on a per rule basis.\n\n")); 1965 1966 (void) printf("%-18s%-10s%-16s%-10s%-26s\n\n", 1967 gettext("Token:"), gettext("Source:"), gettext("Value:"), 1968 gettext("Unit:"), gettext("Description:")); 1969 1970 print_defaults("p1_lifetime_secs", gettext("phase 1 lifetime"), 1971 gettext("seconds"), B_FALSE, ddp->rule_p1_lifetime_secs, 1972 dp->rule_p1_lifetime_secs); 1973 1974 print_defaults("-", gettext("minimum phase 1 lifetime"), 1975 gettext("seconds"), B_FALSE, ddp->rule_p1_minlife, 1976 dp->rule_p1_minlife); 1977 1978 print_defaults("p1_nonce_len", gettext("phase 1 nonce length"), 1979 gettext("bytes"), B_FALSE, ddp->rule_p1_nonce_len, 1980 dp->rule_p1_nonce_len); 1981 1982 print_defaults("p2_lifetime_secs", gettext("phase 2 lifetime"), 1983 gettext("seconds"), B_FALSE, ddp->rule_p2_lifetime_secs, 1984 dp->rule_p2_lifetime_secs); 1985 1986 print_defaults("p2_softlife_secs", gettext("phase 2 soft lifetime"), 1987 gettext("seconds"), B_FALSE, ddp->rule_p2_softlife_secs, 1988 dp->rule_p2_softlife_secs); 1989 1990 print_defaults("p2_lifetime_kb", gettext("phase 2 lifetime"), 1991 gettext("bytes"), B_TRUE, ddp->rule_p2_lifetime_kb, 1992 dp->rule_p2_lifetime_kb); 1993 1994 print_defaults("p2_softlife_kb", gettext("phase 2 soft lifetime"), 1995 gettext("bytes"), B_TRUE, ddp->rule_p2_softlife_kb, 1996 dp->rule_p2_softlife_kb); 1997 1998 print_defaults("-", gettext("minimum phase 2 lifetime"), 1999 gettext("seconds"), B_FALSE, ddp->rule_p2_minlife, 2000 dp->rule_p2_minlife); 2001 2002 print_defaults("p2_nonce_len", gettext("phase 2 nonce length"), 2003 gettext("bytes"), B_FALSE, ddp->rule_p2_nonce_len, 2004 dp->rule_p2_nonce_len); 2005 2006 print_defaults("-", gettext("default phase 2 lifetime"), 2007 gettext("seconds"), B_FALSE, ddp->rule_p2_def_minlife, 2008 dp->rule_p2_def_minlife); 2009 2010 print_defaults("-", gettext("minimum phase 2 soft delta"), 2011 gettext("seconds"), B_FALSE, ddp->rule_p2_minsoft, 2012 dp->rule_p2_minsoft); 2013 2014 print_defaults("p2_pfs", gettext("phase 2 PFS"), 2015 " ", B_FALSE, ddp->rule_p2_pfs, dp->rule_p2_pfs); 2016 2017 print_defaults("max_certs", gettext("max certificates"), 2018 " ", B_FALSE, ddp->rule_max_certs, dp->rule_max_certs); 2019 2020 print_defaults("-", gettext("IKE port number"), 2021 " ", B_FALSE, ddp->rule_ike_port, dp->rule_ike_port); 2022 2023 print_defaults("-", gettext("NAT-T port number"), 2024 " ", B_FALSE, ddp->rule_natt_port, dp->rule_natt_port); 2025 } 2026 2027 static void 2028 print_categories(int level) 2029 { 2030 int mask; 2031 2032 if (level == 0) { 2033 (void) printf(gettext("No debug categories enabled.\n")); 2034 return; 2035 } 2036 2037 (void) printf(gettext("Debug categories enabled:")); 2038 for (mask = 1; mask <= D_HIGHBIT; mask <<= 1) { 2039 if (level & mask) 2040 (void) printf("\n\t%s", dbgstr(mask)); 2041 } 2042 (void) printf("\n"); 2043 } 2044 2045 /*PRINTFLIKE2*/ 2046 static void 2047 ikeadm_err_exit(ike_err_t *err, char *fmt, ...) 2048 { 2049 va_list ap; 2050 char bailbuf[BUFSIZ]; 2051 2052 va_start(ap, fmt); 2053 (void) vsnprintf(bailbuf, BUFSIZ, fmt, ap); 2054 va_end(ap); 2055 if ((err != NULL) && (err->ike_err == IKE_ERR_SYS_ERR)) { 2056 bail_msg("%s: %s", bailbuf, (err->ike_err_unix == 0) ? 2057 gettext("<unknown error>") : strerror(err->ike_err_unix)); 2058 } else { 2059 bail_msg("%s: %s", bailbuf, (err == NULL) ? 2060 gettext("<unknown error>") : errstr(err->ike_err)); 2061 } 2062 } 2063 2064 /*PRINTFLIKE2*/ 2065 static void 2066 ikeadm_err_msg(ike_err_t *err, char *fmt, ...) 2067 { 2068 va_list ap; 2069 char mbuf[BUFSIZ]; 2070 2071 va_start(ap, fmt); 2072 (void) vsnprintf(mbuf, BUFSIZ, fmt, ap); 2073 va_end(ap); 2074 if ((err != NULL) && (err->ike_err == IKE_ERR_SYS_ERR)) { 2075 message("%s: %s", mbuf, (err->ike_err_unix == 0) ? 2076 gettext("<unknown error>") : 2077 ((err->ike_err_unix == EEXIST) ? 2078 gettext("Duplicate entry") : 2079 strerror(err->ike_err_unix))); 2080 } else { 2081 message("%s: %s", mbuf, (err == NULL) ? 2082 gettext("<unknown error>") : errstr(err->ike_err)); 2083 } 2084 } 2085 2086 2087 /* 2088 * Command functions 2089 */ 2090 2091 /* 2092 * Exploit the fact that ike_dbg_t and ike_priv_t have identical 2093 * formats in the following two functions. 2094 */ 2095 static void 2096 do_getvar(int cmd) 2097 { 2098 ike_service_t req, *rtn; 2099 ike_dbg_t *dreq; 2100 char *varname; 2101 2102 switch (cmd) { 2103 case IKE_SVC_GET_DBG: 2104 varname = gettext("debug"); 2105 break; 2106 case IKE_SVC_GET_PRIV: 2107 varname = gettext("privilege"); 2108 break; 2109 default: 2110 bail_msg(gettext("unrecognized get command (%d)"), cmd); 2111 } 2112 2113 dreq = &req.svc_dbg; 2114 dreq->cmd = cmd; 2115 dreq->dbg_level = 0; 2116 2117 rtn = ikedoor_call((char *)&req, sizeof (ike_dbg_t), NULL, 0); 2118 2119 if ((rtn == NULL) || (rtn->svc_err.cmd == IKE_SVC_ERROR)) { 2120 ikeadm_err_exit(&rtn->svc_err, 2121 gettext("error getting %s level"), varname); 2122 } 2123 dreq = &rtn->svc_dbg; 2124 (void) printf(gettext("Current %s level is 0x%x"), 2125 varname, dreq->dbg_level); 2126 2127 if (cmd == IKE_SVC_GET_DBG) { 2128 (void) printf("\n"); 2129 print_categories(dreq->dbg_level); 2130 } else { 2131 (void) printf(gettext(", %s enabled\n"), 2132 privstr(dreq->dbg_level)); 2133 } 2134 } 2135 2136 static void 2137 do_setvar(int cmd, int argc, char **argv) 2138 { 2139 ike_service_t req, *rtn; 2140 ike_dbg_t *dreq; 2141 door_desc_t *descp = NULL, desc; 2142 int fd, ndesc = 0; 2143 uint32_t reqlevel; 2144 char *varname; 2145 2146 if (argc < 1) 2147 Bail("unspecified level"); 2148 reqlevel = strtoul(argv[0], NULL, 0); 2149 2150 switch (cmd) { 2151 case IKE_SVC_SET_DBG: 2152 if (argc > 2) 2153 Bail("Too many arguments to \"set debug\""); 2154 varname = gettext("debug"); 2155 if (reqlevel == 0) { 2156 /* check for a string... */ 2157 reqlevel = parsedbgopts(argv[0]); 2158 } 2159 if (reqlevel == D_INVALID) 2160 bail_msg(gettext("Bad debug flag: %s"), argv[0]); 2161 break; 2162 case IKE_SVC_SET_PRIV: 2163 if (argc > 1) 2164 Bail("Too many arguments to \"set priv\""); 2165 2166 varname = gettext("privilege"); 2167 if (reqlevel == 0) { 2168 /* check for a string... */ 2169 reqlevel = privstr2num(argv[0]); 2170 } 2171 if (reqlevel > IKE_PRIV_MAXIMUM) 2172 bail_msg(gettext("Bad privilege flag: %s"), argv[0]); 2173 break; 2174 default: 2175 bail_msg(gettext("unrecognized set command (%d)"), cmd); 2176 } 2177 2178 dreq = &req.svc_dbg; 2179 dreq->cmd = cmd; 2180 dreq->dbg_level = reqlevel; 2181 2182 if ((argc == 2) && (cmd == IKE_SVC_SET_DBG)) { 2183 fd = open(argv[1], O_RDWR | O_CREAT | O_APPEND, 2184 S_IRUSR | S_IWUSR); 2185 if (fd < 0) 2186 Bail("open debug file"); 2187 desc.d_data.d_desc.d_descriptor = fd; 2188 desc.d_attributes = DOOR_DESCRIPTOR; 2189 descp = &desc; 2190 ndesc = 1; 2191 } 2192 2193 rtn = ikedoor_call((char *)&req, sizeof (ike_dbg_t), descp, ndesc); 2194 2195 if ((rtn == NULL) || (rtn->svc_err.cmd == IKE_SVC_ERROR)) { 2196 ikeadm_err_exit(&rtn->svc_err, 2197 gettext("error setting %s level"), varname); 2198 } 2199 dreq = &rtn->svc_dbg; 2200 (void) printf( 2201 gettext("Successfully changed %s level from 0x%x to 0x%x\n"), 2202 varname, dreq->dbg_level, reqlevel); 2203 2204 if (cmd == IKE_SVC_SET_DBG) { 2205 print_categories(reqlevel); 2206 } else { 2207 (void) printf(gettext("New privilege level 0x%x enables %s\n"), 2208 reqlevel, privstr(reqlevel)); 2209 } 2210 } 2211 2212 static void 2213 do_getstats(int cmd) 2214 { 2215 ike_service_t *rtn; 2216 ike_statreq_t sreq, *sreqp; 2217 ike_stats_t *sp; 2218 2219 sreq.cmd = cmd; 2220 2221 rtn = ikedoor_call((char *)&sreq, sizeof (ike_statreq_t), NULL, 0); 2222 if ((rtn == NULL) || (rtn->svc_err.cmd == IKE_SVC_ERROR)) { 2223 ikeadm_err_exit(&rtn->svc_err, gettext("error getting stats")); 2224 } 2225 2226 sreqp = &rtn->svc_stats; 2227 sp = (ike_stats_t *)(sreqp + 1); 2228 print_stats(sp, sreqp->stat_len); 2229 } 2230 2231 static void 2232 do_getdefs(int cmd) 2233 { 2234 ike_service_t *rtn; 2235 ike_defreq_t dreq, *dreqp; 2236 ike_defaults_t *dp; 2237 2238 dreq.cmd = cmd; 2239 2240 rtn = ikedoor_call((char *)&dreq, sizeof (ike_defreq_t), NULL, 0); 2241 if ((rtn == NULL) || (rtn->svc_err.cmd == IKE_SVC_ERROR)) { 2242 ikeadm_err_exit(&rtn->svc_err, 2243 gettext("error getting defaults")); 2244 } 2245 2246 dreqp = &rtn->svc_defaults; 2247 dp = (ike_defaults_t *)(dreqp + 1); 2248 2249 /* 2250 * Before printing each line, make sure the structure we were 2251 * given is big enough to include the fields needed. 2252 * Silently bail out of there is a version mismatch. 2253 */ 2254 if (dreqp->stat_len < ((2 * sizeof (ike_defaults_t)) 2255 + sizeof (ike_defreq_t)) || dreqp->version != DOORVER) { 2256 return; 2257 } 2258 do_print_defaults(dp); 2259 } 2260 2261 static void 2262 do_dump(int cmd) 2263 { 2264 char *name; 2265 ike_service_t req, *rtn; 2266 ike_dump_t *dreq, *dump; 2267 2268 switch (cmd) { 2269 case IKE_SVC_DUMP_P1S: 2270 name = gettext("phase 1 SA info"); 2271 break; 2272 case IKE_SVC_DUMP_RULES: 2273 name = gettext("policy rules"); 2274 break; 2275 case IKE_SVC_DUMP_PS: 2276 name = gettext("preshared keys"); 2277 break; 2278 default: 2279 bail_msg(gettext("unrecognized dump command (%d)"), cmd); 2280 } 2281 2282 dreq = &req.svc_dump; 2283 dreq->cmd = cmd; 2284 dreq->dump_len = 0; 2285 dreq->dump_next = 0; 2286 do { 2287 rtn = ikedoor_call((char *)&req, sizeof (ike_dump_t), 2288 NULL, 0); 2289 if ((rtn == NULL) || (rtn->svc_err.cmd == IKE_SVC_ERROR)) { 2290 if (rtn && (rtn->svc_err.ike_err == IKE_ERR_NO_OBJ)) { 2291 /* no entries to print */ 2292 break; 2293 } 2294 ikeadm_err_exit(&rtn->svc_err, 2295 gettext("error getting %s"), name); 2296 } 2297 dump = &rtn->svc_dump; 2298 2299 switch (cmd) { 2300 case IKE_SVC_DUMP_P1S: 2301 print_p1((ike_p1_sa_t *)(dump + 1)); 2302 break; 2303 case IKE_SVC_DUMP_RULES: 2304 print_rule((ike_rule_t *)(dump + 1)); 2305 break; 2306 case IKE_SVC_DUMP_PS: 2307 print_ps((ike_ps_t *)(dump + 1)); 2308 break; 2309 } 2310 2311 dreq->dump_next = dump->dump_next; 2312 2313 (void) munmap((char *)rtn, dump->dump_len); 2314 2315 } while (dreq->dump_next); 2316 2317 (void) printf(gettext("\nCompleted dump of %s\n"), name); 2318 } 2319 2320 static void 2321 do_getdel_doorcall(int cmd, int idlen, int idtype, char *idp, char *name) 2322 { 2323 int totallen; 2324 char *p; 2325 ike_service_t *reqp, *rtnp; 2326 ike_get_t *getp; 2327 boolean_t getcmd; 2328 2329 getcmd = ((cmd == IKE_SVC_GET_P1) || (cmd == IKE_SVC_GET_RULE) || 2330 (cmd == IKE_SVC_GET_PS)); 2331 2332 /* 2333 * WARNING: to avoid being redundant, this code takes advantage 2334 * of the fact that the ike_get_t and ike_del_t structures are 2335 * identical (only the field names differ, their function and 2336 * size are the same). If for some reason those structures 2337 * change, this code will need to be re-written to accomodate 2338 * that difference. 2339 */ 2340 totallen = sizeof (ike_get_t) + idlen; 2341 if ((reqp = (ike_service_t *)malloc(totallen)) == NULL) 2342 Bail("malloc(id)"); 2343 2344 getp = &reqp->svc_get; 2345 getp->cmd = cmd; 2346 getp->get_len = totallen; 2347 getp->get_idtype = idtype; 2348 p = (char *)(getp + 1); 2349 2350 (void) memcpy(p, idp, idlen); 2351 2352 rtnp = ikedoor_call((char *)reqp, totallen, NULL, 0); 2353 if ((rtnp == NULL) || (rtnp->svc_err.cmd == IKE_SVC_ERROR)) { 2354 if (rtnp && (rtnp->svc_err.ike_err == IKE_ERR_NO_OBJ)) { 2355 message(gettext("Could not find requested %s."), name); 2356 } else { 2357 ikeadm_err_msg(&rtnp->svc_err, gettext("error %s %s"), 2358 (getcmd) ? gettext("getting") : gettext("deleting"), 2359 name); 2360 } 2361 free(reqp); 2362 return; 2363 } 2364 getp = &rtnp->svc_get; 2365 2366 if (getcmd) { 2367 switch (cmd) { 2368 case IKE_SVC_GET_P1: 2369 print_p1((ike_p1_sa_t *)(getp + 1)); 2370 break; 2371 case IKE_SVC_GET_PS: 2372 print_ps((ike_ps_t *)(getp + 1)); 2373 break; 2374 case IKE_SVC_GET_RULE: 2375 print_rule((ike_rule_t *)(getp + 1)); 2376 break; 2377 } 2378 } else { 2379 message(gettext("Successfully deleted selected %s."), name); 2380 } 2381 2382 (void) munmap((char *)rtnp, getp->get_len); 2383 free(reqp); 2384 } 2385 2386 static void 2387 do_getdel(int cmd, int argc, char **argv) 2388 { 2389 int idlen, idtype = 0, i, j; 2390 int bytelen1, bytelen2; 2391 char *name, *idp, *p, *p1, *p2; 2392 ike_addr_pr_t apr; 2393 ike_cky_pr_t cpr; 2394 sadb_ident_t *sid1p, *sid2p; 2395 struct hostent *he1p, *he2p; 2396 char label[MAX_LABEL_LEN]; 2397 2398 if ((argc < 1) || (argv[0] == NULL)) { 2399 Bail("not enough identification info"); 2400 } 2401 2402 switch (cmd) { 2403 case IKE_SVC_GET_P1: 2404 case IKE_SVC_DEL_P1: 2405 name = gettext("phase 1 SA"); 2406 /* 2407 * The first token must either be an address (or hostname) 2408 * or a cookie. We require cookies to be entered as hex 2409 * numbers, beginning with 0x; so if our token starts with 2410 * that, it's a cookie. 2411 */ 2412 if (strncmp(argv[0], "0x", 2) == 0) { 2413 if (parse_cky_pr(argc, argv, &cpr) >= 0) { 2414 idtype = IKE_ID_CKY_PAIR; 2415 idlen = sizeof (ike_cky_pr_t); 2416 idp = (char *)&cpr; 2417 } 2418 } else { 2419 if (parse_addr_pr(argc, argv, &he1p, &he2p) >= 0) { 2420 idtype = IKE_ID_ADDR_PAIR; 2421 idlen = sizeof (ike_addr_pr_t); 2422 } 2423 } 2424 break; 2425 2426 case IKE_SVC_GET_RULE: 2427 case IKE_SVC_DEL_RULE: 2428 name = gettext("policy rule"); 2429 if (parse_label(argc, argv, label) >= 0) { 2430 idtype = IKE_ID_LABEL; 2431 idlen = MAX_LABEL_LEN; 2432 idp = label; 2433 } 2434 break; 2435 2436 case IKE_SVC_GET_PS: 2437 case IKE_SVC_DEL_PS: 2438 name = gettext("preshared key"); 2439 /* 2440 * The first token must either be an address or an ident 2441 * type. Check for an ident type to determine which it is. 2442 */ 2443 if (parse_idtype(argv[0], NULL) >= 0) { 2444 if (parse_ident_pr(argc, argv, &sid1p, &sid2p) >= 0) { 2445 idtype = IKE_ID_IDENT_PAIR; 2446 idlen = SADB_64TO8(sid1p->sadb_ident_len) + 2447 SADB_64TO8(sid2p->sadb_ident_len); 2448 } 2449 } else { 2450 if (parse_addr_pr(argc, argv, &he1p, &he2p) >= 0) { 2451 idtype = IKE_ID_ADDR_PAIR; 2452 idlen = sizeof (ike_addr_pr_t); 2453 } 2454 } 2455 break; 2456 2457 default: 2458 bail_msg(gettext("unrecognized get/del command (%d)"), cmd); 2459 } 2460 2461 switch (idtype) { 2462 case IKE_ID_ADDR_PAIR: 2463 /* 2464 * we might have exploding addrs here; do every possible 2465 * combination. 2466 */ 2467 i = 0; 2468 j = 0; 2469 while ((p1 = he1p->h_addr_list[i++]) != NULL) { 2470 headdr2sa(p1, &apr.loc_addr, he1p->h_length); 2471 2472 while ((p2 = he2p->h_addr_list[j++]) != NULL) { 2473 headdr2sa(p2, &apr.rem_addr, he2p->h_length); 2474 do_getdel_doorcall(cmd, idlen, idtype, 2475 (char *)&apr, name); 2476 } 2477 } 2478 FREE_HE(he1p); 2479 FREE_HE(he2p); 2480 break; 2481 2482 case IKE_ID_IDENT_PAIR: 2483 bytelen1 = SADB_64TO8(sid1p->sadb_ident_len); 2484 bytelen2 = SADB_64TO8(sid2p->sadb_ident_len); 2485 if (idlen != bytelen1 + bytelen2) 2486 Bail("ident syntax error"); 2487 idp = p = (char *)malloc(idlen); 2488 if (p == NULL) 2489 Bail("malloc(id)"); 2490 (void) memcpy(p, (char *)sid1p, bytelen1); 2491 p += bytelen1; 2492 (void) memcpy(p, (char *)sid2p, bytelen2); 2493 do_getdel_doorcall(cmd, idlen, idtype, idp, name); 2494 free(idp); 2495 free(sid1p); 2496 free(sid2p); 2497 break; 2498 2499 case IKE_ID_CKY_PAIR: 2500 case IKE_ID_LABEL: 2501 do_getdel_doorcall(cmd, idlen, idtype, idp, name); 2502 break; 2503 2504 case 0: 2505 default: 2506 bail_msg(gettext("invalid %s identification\n"), name); 2507 } 2508 } 2509 2510 /* 2511 * Copy source into target, inserting an escape character ('\') before 2512 * any quotes that appear. Return true on success, false on failure. 2513 */ 2514 static boolean_t 2515 escapequotes(char *target, char *source, int tlen) 2516 { 2517 int s, t, len = strlen(source) + 1; 2518 2519 if (tlen < len) 2520 return (B_FALSE); 2521 2522 for (s = 0, t = 0; s < len && t < tlen; s++) { 2523 if (source[s] == '\"') 2524 target[t++] = '\\'; 2525 target[t++] = source[s]; 2526 } 2527 2528 if ((t == tlen) && (s < len)) 2529 return (B_FALSE); 2530 2531 return (B_TRUE); 2532 } 2533 2534 /* 2535 * Return true if the arg following the given keyword should 2536 * be in quotes (i.e. is a string), false if not. 2537 */ 2538 static boolean_t 2539 quotedfield(char *keywd) 2540 { 2541 if ((strncmp(keywd, "label", strlen("label") + 1) == 0) || 2542 (strncmp(keywd, "local_id", strlen("local_id") + 1) == 0) || 2543 (strncmp(keywd, "remote_id", strlen("remote_id") + 1) == 0)) 2544 return (B_TRUE); 2545 2546 return (B_FALSE); 2547 } 2548 2549 static void 2550 do_new(int cmd, int argc, char **argv) 2551 { 2552 ike_service_t *rtn; 2553 ike_new_t new, *newp = NULL; 2554 door_desc_t desc, *descp = NULL; 2555 int i, fd, ndesc = 0, buflen; 2556 char *name, tmpfilepath[32]; 2557 FILE *tmpfile; 2558 2559 switch (cmd) { 2560 case IKE_SVC_NEW_PS: 2561 name = gettext("preshared key"); 2562 break; 2563 case IKE_SVC_NEW_RULE: 2564 name = gettext("policy rule"); 2565 break; 2566 default: 2567 bail_msg(gettext("unrecognized new command (%d)"), cmd); 2568 } 2569 2570 if (argc == 1) { 2571 /* We've been given a file to read from */ 2572 fd = open(argv[0], O_RDONLY); 2573 if (fd < 0) 2574 Bail("open source file"); 2575 2576 desc.d_data.d_desc.d_descriptor = fd; 2577 desc.d_attributes = DOOR_DESCRIPTOR | DOOR_RELEASE; 2578 descp = &desc; 2579 ndesc = 1; 2580 2581 new.cmd = cmd; 2582 new.new_len = 0; 2583 newp = &new; 2584 buflen = sizeof (ike_new_t); 2585 2586 } else if ((argc > 1) && (cmd == IKE_SVC_NEW_PS)) { 2587 /* 2588 * This is an alternative to using the tmpfile method 2589 * for preshared keys. It means we're duplicating the 2590 * parsing effort that happens in readps.c; but it 2591 * does avoid having the key sitting in a file. 2592 */ 2593 ike_ps_t *psp; 2594 int pslen; 2595 2596 /* 2597 * must be in interactive mode; don't want keys in 2598 * the process args. 2599 */ 2600 if (!interactive) 2601 Bail("Must be in interactive mode to add key info."); 2602 if (parse_ps(argc, argv, &psp, &pslen) < 0) { 2603 errno = 0; 2604 Bail("invalid preshared key definition"); 2605 } 2606 newp = malloc(sizeof (ike_new_t) + pslen); 2607 if (newp == NULL) 2608 Bail("alloc pskey"); 2609 newp->cmd = cmd; 2610 newp->new_len = sizeof (ike_new_t) + pslen; 2611 (void) memcpy((char *)(newp + 1), psp, pslen); 2612 buflen = newp->new_len; 2613 /* parse_ps allocated the ike_ps_t buffer; free it now */ 2614 free(psp); 2615 2616 } else if ((argc > 1) && (cmd == IKE_SVC_NEW_RULE)) { 2617 /* 2618 * We've been given the item in argv. However, parsing 2619 * rules can get more than a little messy, and in.iked 2620 * already has a great parser for this stuff! So don't 2621 * fool around with trying to do the parsing here. Just 2622 * write it out to a tempfile, and send the fd to in.iked. 2623 * 2624 * We could conceivably do this for preshared keys, 2625 * rather than duplicating the parsing effort; but that 2626 * would mean the key would be written out to a file, 2627 * which isn't such a good idea. 2628 */ 2629 boolean_t doquotes = B_FALSE; 2630 int rtn; 2631 2632 if ((argv[0][0] != '{') || 2633 (argv[argc - 1][strlen(argv[argc - 1]) - 1] != '}')) 2634 bail_msg(gettext("improperly formatted %s"), name); 2635 2636 /* attempt to use a fairly unpredictable file name... */ 2637 (void) sprintf(tmpfilepath, "/var/run/%x", (int)gethrtime()); 2638 fd = open(tmpfilepath, O_RDWR | O_CREAT | O_EXCL, 2639 S_IRUSR | S_IWUSR); 2640 if (fd < 0) 2641 Bail("cannot open tmpfile"); 2642 2643 /* and make it inaccessible asap */ 2644 if (unlink(tmpfilepath) < 0) { 2645 (void) close(fd); 2646 Bail("tmpfile error"); 2647 } 2648 2649 tmpfile = fdopen(fd, "w"); 2650 if (tmpfile == NULL) { 2651 (void) close(fd); 2652 Bail("cannot write to tmpfile"); 2653 } 2654 2655 for (i = 0; i < argc; i++) { 2656 /* 2657 * We have to do some gyrations with our string here, 2658 * to properly handle quotes. There are two issues: 2659 * - some of the fields of a rule may have embedded 2660 * whitespace, and thus must be quoted on the cmd 2661 * line. The shell removes the quotes, and gives 2662 * us a single argv string; but we need to put the 2663 * quotes back in when we write the string out to 2664 * file. The doquotes boolean is set when we 2665 * process a keyword which will be followed by a 2666 * string value (so the NEXT argv element will be 2667 * quoted). 2668 * - there might be a quote character in a field, 2669 * that was escaped on the cmdline. The shell 2670 * removes the escape char, and leaves the quote 2671 * in the string it gives us. We need to put the 2672 * escape char back in before writing to file. 2673 */ 2674 char field[MAXLINESIZE]; 2675 if (!escapequotes(field, argv[i], MAXLINESIZE)) 2676 Bail("write to tmpfile failed (arg too big)"); 2677 if (doquotes) { 2678 rtn = fprintf(tmpfile, "\"%s\"\n", field); 2679 doquotes = B_FALSE; 2680 } else { 2681 rtn = fprintf(tmpfile, "%s\n", field); 2682 } 2683 if (rtn < 0) 2684 Bail("write to tmpfile failed"); 2685 /* 2686 * check if this is a keyword identifying 2687 * a field that needs to be quoted. 2688 */ 2689 doquotes = quotedfield(argv[i]); 2690 } 2691 if (fflush(tmpfile) == EOF) 2692 Bail("write to tmpfile failed"); 2693 /* rewind so that the daemon will get the beginning */ 2694 rewind(tmpfile); 2695 2696 desc.d_data.d_desc.d_descriptor = fd; 2697 desc.d_attributes = DOOR_DESCRIPTOR | DOOR_RELEASE; 2698 descp = &desc; 2699 ndesc = 1; 2700 2701 new.cmd = cmd; 2702 new.new_len = 0; 2703 newp = &new; 2704 buflen = sizeof (ike_new_t); 2705 2706 } else { 2707 /* not enough information! */ 2708 bail_msg(gettext("missing %s description or file name"), name); 2709 } 2710 2711 rtn = ikedoor_call((char *)newp, buflen, descp, ndesc); 2712 2713 if ((rtn == NULL) || (rtn->svc_err.cmd == IKE_SVC_ERROR)) { 2714 ikeadm_err_msg(&rtn->svc_err, 2715 gettext("error creating new %s"), name); 2716 } else { 2717 message(gettext("Successfully created new %s."), name); 2718 } 2719 } 2720 2721 static void 2722 do_flush(int cmd) 2723 { 2724 ike_service_t *rtnp; 2725 ike_flush_t flush; 2726 2727 if (cmd != IKE_SVC_FLUSH_P1S) { 2728 bail_msg(gettext("unrecognized flush command (%d)."), cmd); 2729 } 2730 2731 flush.cmd = cmd; 2732 2733 rtnp = ikedoor_call((char *)&flush, sizeof (ike_flush_t), NULL, 0); 2734 if ((rtnp == NULL) || (rtnp->svc_err.cmd == IKE_SVC_ERROR)) { 2735 ikeadm_err_exit(&rtnp->svc_err, gettext("error doing flush")); 2736 } 2737 message(gettext("Successfully flushed P1 SAs.")); 2738 } 2739 2740 static void 2741 do_rw(int cmd, int argc, char **argv) 2742 { 2743 ike_service_t *rtnp; 2744 ike_rw_t rw; 2745 door_desc_t desc, *descp = NULL; 2746 int oflag, omode, fd, ndesc = 0; 2747 char *op, *obj = NULL; 2748 boolean_t writing = B_FALSE; 2749 2750 switch (cmd) { 2751 case IKE_SVC_READ_PS: 2752 obj = gettext("preshared key"); 2753 /* FALLTHRU */ 2754 case IKE_SVC_READ_RULES: 2755 if (obj == NULL) 2756 obj = gettext("policy rule"); 2757 op = gettext("read"); 2758 oflag = O_RDONLY; 2759 omode = 0; 2760 break; 2761 2762 case IKE_SVC_WRITE_PS: 2763 obj = gettext("preshared key"); 2764 /* FALLTHRU */ 2765 case IKE_SVC_WRITE_RULES: 2766 if (obj == NULL) 2767 obj = gettext("policy rule"); 2768 op = gettext("write"); 2769 oflag = O_RDWR | O_CREAT | O_EXCL; 2770 omode = S_IRUSR | S_IWUSR; 2771 2772 /* for write commands, dest location must be specified */ 2773 if (argc < 1) { 2774 bail_msg(gettext("destination location required " 2775 "to write %ss"), obj); 2776 } 2777 writing = B_TRUE; 2778 break; 2779 2780 default: 2781 bail_msg(gettext("unrecognized read/write command (%d)."), cmd); 2782 } 2783 2784 rw.cmd = cmd; 2785 2786 if (argc >= 1) { 2787 rw.rw_loc = IKE_RW_LOC_USER_SPEC; 2788 fd = open(argv[0], oflag, omode); 2789 if (fd < 0) 2790 Bail("open user-specified file"); 2791 2792 desc.d_data.d_desc.d_descriptor = fd; 2793 desc.d_attributes = DOOR_DESCRIPTOR | DOOR_RELEASE; 2794 descp = &desc; 2795 ndesc = 1; 2796 } else { 2797 rw.rw_loc = IKE_RW_LOC_DEFAULT; 2798 } 2799 2800 rtnp = ikedoor_call((char *)&rw, sizeof (ike_rw_t), descp, ndesc); 2801 if ((rtnp == NULL) || (rtnp->svc_err.cmd == IKE_SVC_ERROR)) { 2802 /* 2803 * Need to remove the target file in the 2804 * case of a failed write command. 2805 */ 2806 if (writing) { 2807 /* 2808 * argv[0] must be valid if we're writing; we 2809 * exit before setting this boolean if not. 2810 */ 2811 (void) unlink(argv[0]); 2812 (void) close(fd); 2813 2814 if ((rtnp != NULL) && 2815 (rtnp->svc_err.ike_err == IKE_ERR_NO_OBJ)) { 2816 message(gettext("No %s information to write."), 2817 obj); 2818 return; 2819 } 2820 } 2821 ikeadm_err_exit(&rtnp->svc_err, gettext("error doing %s"), op); 2822 } 2823 message(gettext("Completed %s of %s configuration information."), 2824 op, obj); 2825 } 2826 2827 static void 2828 do_rbdump() 2829 { 2830 ike_cmd_t req; 2831 ike_service_t *rtnp; 2832 2833 req.cmd = IKE_SVC_DBG_RBDUMP; 2834 2835 rtnp = ikedoor_call((char *)&req, sizeof (ike_cmd_t), NULL, 0); 2836 if ((rtnp == NULL) || (rtnp->svc_err.cmd == IKE_SVC_ERROR)) { 2837 ikeadm_err_exit(&rtnp->svc_err, gettext("error doing flush")); 2838 } 2839 message(gettext("Successfully dumped rulebase; check iked dbg")); 2840 } 2841 2842 #define REQ_ARG_CNT 1 2843 2844 /*ARGSUSED*/ 2845 static void 2846 parseit(int argc, char **argv, char *notused) 2847 { 2848 int cmd, cmd_obj_args = 1; 2849 char *cmdstr, *objstr; 2850 2851 if (interactive) { 2852 if (argc == 0) 2853 return; 2854 } 2855 2856 if (argc < REQ_ARG_CNT) { 2857 usage(); 2858 } 2859 2860 cmdstr = argv[0]; 2861 if (argc > REQ_ARG_CNT) { 2862 cmd_obj_args++; 2863 objstr = argv[1]; 2864 } else { 2865 objstr = NULL; 2866 } 2867 cmd = parsecmd(cmdstr, objstr); 2868 2869 /* skip over args specifying command/object */ 2870 argc -= cmd_obj_args; 2871 argv += cmd_obj_args; 2872 2873 switch (cmd) { 2874 case IKE_SVC_GET_DEFS: 2875 do_getdefs(cmd); 2876 break; 2877 case IKE_SVC_GET_DBG: 2878 case IKE_SVC_GET_PRIV: 2879 do_getvar(cmd); 2880 break; 2881 case IKE_SVC_GET_STATS: 2882 do_getstats(cmd); 2883 break; 2884 case IKE_SVC_SET_DBG: 2885 case IKE_SVC_SET_PRIV: 2886 do_setvar(cmd, argc, argv); 2887 break; 2888 case IKE_SVC_DUMP_P1S: 2889 case IKE_SVC_DUMP_RULES: 2890 case IKE_SVC_DUMP_PS: 2891 do_dump(cmd); 2892 break; 2893 case IKE_SVC_GET_P1: 2894 case IKE_SVC_GET_RULE: 2895 case IKE_SVC_GET_PS: 2896 case IKE_SVC_DEL_P1: 2897 case IKE_SVC_DEL_RULE: 2898 case IKE_SVC_DEL_PS: 2899 do_getdel(cmd, argc, argv); 2900 break; 2901 case IKE_SVC_NEW_RULE: 2902 case IKE_SVC_NEW_PS: 2903 do_new(cmd, argc, argv); 2904 break; 2905 case IKE_SVC_FLUSH_P1S: 2906 do_flush(cmd); 2907 break; 2908 case IKE_SVC_READ_RULES: 2909 case IKE_SVC_READ_PS: 2910 case IKE_SVC_WRITE_RULES: 2911 case IKE_SVC_WRITE_PS: 2912 do_rw(cmd, argc, argv); 2913 break; 2914 case IKEADM_HELP_GENERAL: 2915 print_help(); 2916 break; 2917 case IKEADM_HELP_GET: 2918 print_get_help(); 2919 break; 2920 case IKEADM_HELP_SET: 2921 print_set_help(); 2922 break; 2923 case IKEADM_HELP_ADD: 2924 print_add_help(); 2925 break; 2926 case IKEADM_HELP_DEL: 2927 print_del_help(); 2928 break; 2929 case IKEADM_HELP_DUMP: 2930 print_dump_help(); 2931 break; 2932 case IKEADM_HELP_FLUSH: 2933 print_flush_help(); 2934 break; 2935 case IKEADM_HELP_READ: 2936 print_read_help(); 2937 break; 2938 case IKEADM_HELP_WRITE: 2939 print_write_help(); 2940 break; 2941 case IKEADM_HELP_HELP: 2942 print_help_help(); 2943 break; 2944 case IKEADM_EXIT: 2945 if (interactive) 2946 exit(0); 2947 break; 2948 case IKE_SVC_DBG_RBDUMP: 2949 do_rbdump(); 2950 break; 2951 case IKE_SVC_ERROR: 2952 usage(); 2953 default: 2954 exit(0); 2955 } 2956 } 2957 2958 int 2959 main(int argc, char **argv) 2960 { 2961 char ch; 2962 2963 (void) setlocale(LC_ALL, ""); 2964 #if !defined(TEXT_DOMAIN) 2965 #define TEXT_DOMAIN "SYS_TEST" 2966 #endif 2967 (void) textdomain(TEXT_DOMAIN); 2968 2969 while ((ch = getopt(argc, argv, "hpn")) != EOF) { 2970 switch (ch) { 2971 case 'h': 2972 print_help(); 2973 return (0); 2974 case 'p': 2975 pflag = B_TRUE; 2976 break; 2977 case 'n': 2978 nflag = B_TRUE; 2979 break; 2980 default: 2981 usage(); 2982 } 2983 } 2984 argc -= optind; 2985 argv += optind; 2986 2987 if (open_door() < 0) { 2988 (void) fprintf(stderr, 2989 gettext("Unable to communicate with in.iked\n")); 2990 Bail("open_door failed"); 2991 } 2992 2993 if (*argv == NULL) { 2994 /* no cmd-line args, do interactive mode */ 2995 do_interactive(stdin, NULL, "ikeadm> ", NULL, parseit); 2996 } 2997 2998 parseit(argc, argv, NULL); 2999 3000 return (0); 3001 } 3002