1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #ifndef _IPSEC_UTIL_H 27 #define _IPSEC_UTIL_H 28 29 #pragma ident "%Z%%M% %I% %E% SMI" 30 31 /* 32 * Headers and definitions for support functions that are shared by 33 * the ipsec utilities ipseckey and ikeadm. 34 */ 35 36 #ifdef __cplusplus 37 extern "C" { 38 #endif 39 40 #include <sys/types.h> 41 #include <sys/socket.h> 42 #include <net/pfkeyv2.h> 43 #include <netinet/in.h> 44 #include <inet/ip.h> 45 #include <setjmp.h> 46 #include <stdio.h> 47 #include <err.h> 48 #include <errfp.h> 49 #include <net/pfpolicy.h> 50 51 #ifndef A_CNT 52 /* macros for array manipulation */ 53 #define A_CNT(arr) (sizeof (arr)/sizeof (arr[0])) 54 #define A_END(arr) (&arr[A_CNT(arr)]) 55 #endif 56 57 /* used for file parsing */ 58 #define NBUF_SIZE 16 59 #define IBUF_SIZE 2048 60 #define COMMENT_CHAR '#' 61 #define CONT_CHAR '\\' 62 #define QUOTE_CHAR '"' 63 64 /* used for command-line parsing */ 65 #define START_ARG 8 66 #define TOO_MANY_ARGS (START_ARG << 9) 67 68 /* Return codes for argv/argc vector creation */ 69 #define TOO_MANY_TOKENS -3 70 #define MEMORY_ALLOCATION -2 71 #define COMMENT_LINE 1 72 #define SUCCESS 0 73 74 /* 75 * Time printing defines... 76 * 77 * TBUF_SIZE is pretty arbitrary. Perhaps it shouldn't be. 78 */ 79 #define TBUF_SIZE 50 80 #define TIME_MAX LONG_MAX 81 82 #ifndef INSECURE_PERMS 83 #define INSECURE_PERMS(sbuf) (((sbuf).st_uid != 0) || \ 84 ((sbuf).st_mode & S_IRWXG) || ((sbuf).st_mode & S_IRWXO)) 85 #endif 86 87 /* For keyword-lookup tables */ 88 typedef struct keywdtab { 89 uint_t kw_tag; 90 char *kw_str; 91 } keywdtab_t; 92 93 /* Exit the programe and enter new state */ 94 typedef enum exit_type { 95 SERVICE_EXIT_OK, 96 SERVICE_DEGRADE, 97 SERVICE_BADPERM, 98 SERVICE_BADCONF, 99 SERVICE_MAINTAIN, 100 SERVICE_DISABLE, 101 SERVICE_FATAL, 102 SERVICE_RESTART 103 } exit_type_t; 104 105 /* 106 * Function Prototypes 107 */ 108 109 /* 110 * Print errno and if cmdline or readfile, exit; if interactive reset state 111 */ 112 extern void ipsecutil_exit(exit_type_t, char *, FILE *, const char *fmt, ...); 113 extern void bail(char *); 114 115 /* 116 * Localization macro - Only to be used from usr/src/cmd because Macros 117 * are not expanded in usr/src/lib when message catalogs are built. 118 */ 119 #define Bail(s) bail(dgettext(TEXT_DOMAIN, s)) 120 121 /* 122 * Print caller-supplied, variable-arg error message, then exit if cmdline 123 * or readfile, or reset state if interactive. 124 */ 125 extern void bail_msg(char *, ...); 126 127 /* 128 * dump_XXX functions produce ASCII output from the passed in data. 129 * 130 * Because certain errors need to do this stderr, dump_XXX functions 131 * take a FILE pointer. 132 */ 133 134 extern int dump_sockaddr(struct sockaddr *, uint8_t, boolean_t, FILE *, 135 boolean_t); 136 137 extern int dump_key(uint8_t *, uint_t, FILE *); 138 139 extern int dump_aalg(uint8_t, FILE *); 140 141 extern int dump_ealg(uint8_t, FILE *); 142 143 /* return true if sadb string is printable (based on type), false otherwise */ 144 extern boolean_t dump_sadb_idtype(uint8_t, FILE *, int *); 145 146 /* 147 * do_interactive: Enter a mode where commands are read from a file; 148 * treat stdin special. infile is the file cmds are read from; 149 * promptstring is the string printed to stdout (if the cmds are 150 * being read from stdin) to prompt for a new command; parseit is 151 * the function to be called to process the command line once it's 152 * been read in and broken up into an argv/argc vector. 153 */ 154 155 /* callback function passed in to do_interactive() */ 156 typedef void (*parse_cmdln_fn)(int, char **, char *, boolean_t); 157 158 extern void do_interactive(FILE *, char *, char *, char *, parse_cmdln_fn); 159 160 extern uint_t lines_parsed; 161 extern uint_t lines_added; 162 163 /* convert a string to an IKE_PRIV_* constant */ 164 extern int privstr2num(char *); 165 166 /* convert a string to a D_* debug flag */ 167 extern int dbgstr2num(char *); 168 169 /* convert a string of debug strings with +|- delimiters to a debug level */ 170 extern int parsedbgopts(char *); 171 172 173 /* 174 * functions to manipulate the kmcookie-label mapping file 175 */ 176 177 #define KMCFILE "/var/run/ipsec_kmc_map" 178 179 /* 180 * Insert a mapping into the file (if it's not already there), given the 181 * new label. Return the assigned cookie, or -1 on error. 182 */ 183 extern int kmc_insert_mapping(char *); 184 185 /* 186 * Lookup the given cookie and return its corresponding label. Return 187 * a pointer to the label on success, NULL on error (or if the label is 188 * not found). 189 */ 190 extern char *kmc_lookup_by_cookie(int); 191 192 /* 193 * These globals are declared for us in ipsec_util.c, since it needs to 194 * refer to them also... 195 */ 196 extern boolean_t nflag; /* Avoid nameservice? */ 197 extern boolean_t pflag; /* Paranoid w.r.t. printing keying material? */ 198 extern boolean_t interactive; 199 extern boolean_t readfile; 200 extern uint_t lineno; 201 extern char numprint[NBUF_SIZE]; 202 203 /* For error recovery in interactive or read-file mode. */ 204 extern jmp_buf env; 205 206 /* 207 * Back-end stuff for getalgby*(). 208 */ 209 210 #define INET_IPSECALGSPATH "/etc/inet/" 211 #define INET_IPSECALGSFILE (INET_IPSECALGSPATH "ipsecalgs") 212 213 /* To preserve packages delimiters in /etc/inet/ipsecalgs */ 214 typedef struct ipsecalgs_pkg { 215 int alg_num; 216 char *pkg_name; 217 } ipsecalgs_pkg_t; 218 219 /* 220 * The cached representation of /etc/inet/ipsecalgs is represented by: 221 * - A dynamically-grown (optionally sorted) array of IPsec protocols 222 * - Each protocol has an array (again, dynamically grown and sorted) 223 * of algorithms, each a full-fledged struct ipsecalgent. 224 * - The getipsecalg*() routines will search the list, then duplicate the 225 * struct ipsecalgent and return it. 226 */ 227 228 typedef enum { 229 LIBIPSEC_ALGS_EXEC_SYNC, 230 LIBIPSEC_ALGS_EXEC_ASYNC 231 } ipsecalgs_exec_mode_t; 232 233 typedef struct ipsec_proto { 234 int proto_num; 235 char *proto_name; 236 char *proto_pkg; 237 int proto_numalgs; 238 struct ipsecalgent **proto_algs; 239 ipsecalgs_pkg_t *proto_algs_pkgs; 240 int proto_algs_npkgs; 241 ipsecalgs_exec_mode_t proto_exec_mode; 242 } ipsec_proto_t; 243 244 extern void _build_internal_algs(ipsec_proto_t **, int *); 245 extern int _str_to_ipsec_exec_mode(char *, ipsecalgs_exec_mode_t *); 246 247 extern int addipsecalg(struct ipsecalgent *, uint_t); 248 extern int delipsecalgbyname(const char *, int); 249 extern int delipsecalgbynum(int, int); 250 extern int addipsecproto(const char *, int, ipsecalgs_exec_mode_t, uint_t); 251 extern int delipsecprotobyname(const char *); 252 extern int delipsecprotobynum(int); 253 extern int *getipsecprotos(int *); 254 extern int *getipsecalgs(int *, int); 255 extern int list_ints(FILE *, int *); 256 extern const char *ipsecalgs_diag(int); 257 extern int ipsecproto_get_exec_mode(int, ipsecalgs_exec_mode_t *); 258 extern int ipsecproto_set_exec_mode(int, ipsecalgs_exec_mode_t); 259 260 /* Flags for add/delete routines. */ 261 #define LIBIPSEC_ALGS_ADD_FORCE 0x00000001 262 263 /* 264 * Helper definitions for indices into array of key sizes when key sizes 265 * are defined by range. 266 */ 267 #define LIBIPSEC_ALGS_KEY_DEF_IDX 0 /* default key size */ 268 #define LIBIPSEC_ALGS_KEY_MIN_IDX 1 /* min key size */ 269 #define LIBIPSEC_ALGS_KEY_MAX_IDX 2 /* max key size */ 270 #define LIBIPSEC_ALGS_KEY_NUM_VAL 4 /* def, min, max, 0 */ 271 272 /* Error codes for IPsec algorithms management */ 273 #define LIBIPSEC_ALGS_DIAG_ALG_EXISTS -1 274 #define LIBIPSEC_ALGS_DIAG_PROTO_EXISTS -2 275 #define LIBIPSEC_ALGS_DIAG_UNKN_PROTO -3 276 #define LIBIPSEC_ALGS_DIAG_UNKN_ALG -4 277 #define LIBIPSEC_ALGS_DIAG_NOMEM -5 278 #define LIBIPSEC_ALGS_DIAG_ALGSFILEOPEN -6 279 #define LIBIPSEC_ALGS_DIAG_ALGSFILEFDOPEN -7 280 #define LIBIPSEC_ALGS_DIAG_ALGSFILELOCK -8 281 #define LIBIPSEC_ALGS_DIAG_ALGSFILERENAME -9 282 #define LIBIPSEC_ALGS_DIAG_ALGSFILEWRITE -10 283 #define LIBIPSEC_ALGS_DIAG_ALGSFILECHMOD -11 284 #define LIBIPSEC_ALGS_DIAG_ALGSFILECHOWN -12 285 #define LIBIPSEC_ALGS_DIAG_ALGSFILECLOSE -13 286 287 /* /etc/inet/ipsecalgs keywords and package sections delimiters */ 288 #define LIBIPSEC_ALGS_LINE_PROTO "PROTO|" 289 #define LIBIPSEC_ALGS_LINE_ALG "ALG|" 290 #define LIBIPSEC_ALGS_LINE_PKGSTART "# Start " 291 #define LIBIPSEC_ALGS_LINE_PKGEND "# End " 292 293 /* Put these in libnsl for and process caching testing. */ 294 extern int *_real_getipsecprotos(int *); 295 extern int *_real_getipsecalgs(int *, int); 296 extern struct ipsecalgent *_duplicate_alg(struct ipsecalgent *); 297 extern void _clean_trash(ipsec_proto_t *, int); 298 299 /* spdsock support functions */ 300 301 /* Return values for spdsock_get_ext(). */ 302 #define KGE_OK 0 303 #define KGE_DUP 1 304 #define KGE_UNK 2 305 #define KGE_LEN 3 306 #define KGE_CHK 4 307 308 extern int spdsock_get_ext(spd_ext_t *[], spd_msg_t *, uint_t, char *, uint_t); 309 extern const char *spdsock_diag(int); 310 311 /* PF_KEY (keysock) support functions */ 312 extern const char *keysock_diag(int); 313 extern int in_masktoprefix(uint8_t *, boolean_t); 314 315 /* SA support functions */ 316 317 extern void print_diagnostic(FILE *, uint16_t); 318 extern void print_sadb_msg(FILE *, struct sadb_msg *, time_t, boolean_t); 319 extern void print_sa(FILE *, char *, struct sadb_sa *); 320 extern void printsatime(FILE *, int64_t, const char *, const char *, 321 const char *, boolean_t); 322 extern void print_lifetimes(FILE *, time_t, struct sadb_lifetime *, 323 struct sadb_lifetime *, struct sadb_lifetime *, boolean_t vflag); 324 extern void print_address(FILE *, char *, struct sadb_address *, boolean_t); 325 extern void print_key(FILE *, char *, struct sadb_key *); 326 extern void print_ident(FILE *, char *, struct sadb_ident *); 327 extern void print_sens(FILE *, char *, struct sadb_sens *); 328 extern void print_prop(FILE *, char *, struct sadb_prop *); 329 extern void print_eprop(FILE *, char *, struct sadb_prop *); 330 extern void print_supp(FILE *, char *, struct sadb_supported *); 331 extern void print_spirange(FILE *, char *, struct sadb_spirange *); 332 extern void print_kmc(FILE *, char *, struct sadb_x_kmc *); 333 extern void print_samsg(FILE *, uint64_t *, boolean_t, boolean_t, boolean_t); 334 extern char *rparsesatype(int); 335 extern char *rparsealg(uint8_t, int); 336 extern char *rparseidtype(uint16_t); 337 extern boolean_t save_lifetime(struct sadb_lifetime *, FILE *); 338 extern boolean_t save_address(struct sadb_address *, FILE *); 339 extern boolean_t save_key(struct sadb_key *, FILE *); 340 extern boolean_t save_ident(struct sadb_ident *, FILE *); 341 extern void save_assoc(uint64_t *, FILE *); 342 extern FILE *opensavefile(char *); 343 extern const char *do_inet_ntop(const void *, char *, size_t); 344 345 /* 346 * These exit macros give a consistent exit behaviour for all 347 * programs that use libipsecutil. These wll work in usr/src/cmd 348 * and usr/src/lib, but because macros in usr/src/lib don't get 349 * expanded when I18N message catalogs are built, avoid using 350 * these with text inside libipsecutil. 351 */ 352 #define EXIT_OK(x) \ 353 ipsecutil_exit(SERVICE_EXIT_OK, my_fmri, debugfile, \ 354 dgettext(TEXT_DOMAIN, x)) 355 #define EXIT_OK2(x, y) \ 356 ipsecutil_exit(SERVICE_EXIT_OK, my_fmri, debugfile, \ 357 dgettext(TEXT_DOMAIN, x), y) 358 #define EXIT_OK3(x, y, z) \ 359 ipsecutil_exit(SERVICE_EXIT_OK, my_fmri, debugfile, \ 360 dgettext(TEXT_DOMAIN, x), y, z) 361 #define EXIT_BADCONFIG(x) \ 362 ipsecutil_exit(SERVICE_BADCONF, my_fmri, debugfile, \ 363 dgettext(TEXT_DOMAIN, x)) 364 #define EXIT_BADCONFIG2(x, y) \ 365 ipsecutil_exit(SERVICE_BADCONF, my_fmri, debugfile, \ 366 dgettext(TEXT_DOMAIN, x), y) 367 #define EXIT_BADCONFIG3(x, y, z) \ 368 ipsecutil_exit(SERVICE_BADCONF, my_fmri, debugfile, \ 369 dgettext(TEXT_DOMAIN, x), y, z) 370 #define EXIT_MAINTAIN(x) \ 371 ipsecutil_exit(SERVICE_MAINTAIN, my_fmri, debugfile, \ 372 dgettext(TEXT_DOMAIN, x)) 373 #define EXIT_MAINTAIN2(x, y) \ 374 ipsecutil_exit(SERVICE_MAINTAIN, my_fmri, debugfile, \ 375 dgettext(TEXT_DOMAIN, x), y) 376 #define EXIT_DEGRADE(x) \ 377 ipsecutil_exit(SERVICE_DEGRADE, my_fmri, debugfile, \ 378 dgettext(TEXT_DOMAIN, x)) 379 #define EXIT_BADPERM(x) \ 380 ipsecutil_exit(SERVICE_BADPERM, my_fmri, debugfile, \ 381 dgettext(TEXT_DOMAIN, x)) 382 #define EXIT_BADPERM2(x, y) \ 383 ipsecutil_exit(SERVICE_BADPERM, my_fmri, debugfile, \ 384 dgettext(TEXT_DOMAIN, x), y) 385 #define EXIT_FATAL(x) \ 386 ipsecutil_exit(SERVICE_FATAL, my_fmri, debugfile, \ 387 dgettext(TEXT_DOMAIN, x)) 388 #define EXIT_FATAL2(x, y) \ 389 ipsecutil_exit(SERVICE_FATAL, my_fmri, debugfile, \ 390 dgettext(TEXT_DOMAIN, x), y) 391 #define EXIT_FATAL3(x, y, z) \ 392 ipsecutil_exit(SERVICE_FATAL, my_fmri, debugfile, \ 393 dgettext(TEXT_DOMAIN, x), y, z) 394 #define EXIT_RESTART(x) \ 395 ipsecutil_exit(SERVICE_RESTART, my_fmri, debugfile, \ 396 dgettext(TEXT_DOMAIN, x)) 397 398 #ifdef __cplusplus 399 } 400 #endif 401 402 #endif /* _IPSEC_UTIL_H */ 403