1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #ifndef _IPSEC_UTIL_H 27 #define _IPSEC_UTIL_H 28 29 #pragma ident "%Z%%M% %I% %E% SMI" 30 31 /* 32 * Headers and definitions for support functions that are shared by 33 * the ipsec utilities ipseckey and ikeadm. 34 */ 35 36 #ifdef __cplusplus 37 extern "C" { 38 #endif 39 40 #include <sys/types.h> 41 #include <sys/socket.h> 42 #include <net/pfkeyv2.h> 43 #include <netinet/in.h> 44 #include <inet/ip.h> 45 #include <setjmp.h> 46 #include <stdio.h> 47 #include <err.h> 48 #include <net/pfpolicy.h> 49 50 #ifndef A_CNT 51 /* macros for array manipulation */ 52 #define A_CNT(arr) (sizeof (arr)/sizeof (arr[0])) 53 #define A_END(arr) (&arr[A_CNT(arr)]) 54 #endif 55 56 /* used for file parsing */ 57 #define NBUF_SIZE 16 58 #define IBUF_SIZE 512 59 #define COMMENT_CHAR '#' 60 #define CONT_CHAR '\\' 61 #define QUOTE_CHAR '"' 62 63 /* used for command-line parsing */ 64 #define START_ARG 8 65 #define TOO_MANY_ARGS (START_ARG << 9) 66 67 /* Return codes for argv/argc vector creation */ 68 #define TOO_MANY_TOKENS -3 69 #define MEMORY_ALLOCATION -2 70 #define COMMENT_LINE 1 71 #define SUCCESS 0 72 73 /* 74 * Time printing defines... 75 * 76 * TBUF_SIZE is pretty arbitrary. Perhaps it shouldn't be. 77 */ 78 #define TBUF_SIZE 50 79 #define TIME_MAX LONG_MAX 80 81 /* For keyword-lookup tables */ 82 typedef struct keywdtab { 83 uint_t kw_tag; 84 char *kw_str; 85 } keywdtab_t; 86 87 88 /* 89 * Function Prototypes 90 */ 91 92 /* 93 * Print errno and if cmdline or readfile, exit; if interactive reset state 94 */ 95 extern void bail(char *); 96 97 /* 98 * Localization macro - Only to be used from usr/src/cmd because Macros 99 * are not expanded in usr/src/lib when message catalogs are built. 100 */ 101 #define Bail(s) bail(dgettext(TEXT_DOMAIN, s)) 102 103 /* 104 * Print caller-supplied, variable-arg error message, then exit if cmdline 105 * or readfile, or reset state if interactive. 106 */ 107 extern void bail_msg(char *, ...); 108 109 /* 110 * dump_XXX functions produce ASCII output from the passed in data. 111 * 112 * Because certain errors need to do this stderr, dump_XXX functions 113 * take a FILE pointer. 114 */ 115 116 extern int dump_sockaddr(struct sockaddr *, uint8_t, boolean_t, FILE *); 117 118 extern int dump_key(uint8_t *, uint_t, FILE *); 119 120 extern int dump_aalg(uint8_t, FILE *); 121 122 extern int dump_ealg(uint8_t, FILE *); 123 124 /* return true if sadb string is printable (based on type), false otherwise */ 125 extern boolean_t dump_sadb_idtype(uint8_t, FILE *, int *); 126 127 /* 128 * do_interactive: Enter a mode where commands are read from a file; 129 * treat stdin special. infile is the file cmds are read from; 130 * promptstring is the string printed to stdout (if the cmds are 131 * being read from stdin) to prompt for a new command; parseit is 132 * the function to be called to process the command line once it's 133 * been read in and broken up into an argv/argc vector. 134 */ 135 136 /* callback function passed in to do_interactive() */ 137 typedef void (*parse_cmdln_fn)(int, char **); 138 139 extern void do_interactive(FILE *, char *, parse_cmdln_fn); 140 141 /* convert a string to an IKE_PRIV_* constant */ 142 extern int privstr2num(char *); 143 144 /* convert a string to a D_* debug flag */ 145 extern int dbgstr2num(char *); 146 147 /* convert a string of debug strings with +|- delimiters to a debug level */ 148 extern int parsedbgopts(char *); 149 150 151 /* 152 * functions to manipulate the kmcookie-label mapping file 153 */ 154 155 #define KMCFILE "/var/run/ipsec_kmc_map" 156 157 /* 158 * Insert a mapping into the file (if it's not already there), given the 159 * new label. Return the assigned cookie, or -1 on error. 160 */ 161 extern int kmc_insert_mapping(char *); 162 163 /* 164 * Lookup the given cookie and return its corresponding label. Return 165 * a pointer to the label on success, NULL on error (or if the label is 166 * not found). 167 */ 168 extern char *kmc_lookup_by_cookie(int); 169 170 /* 171 * These globals are declared for us in ipsec_util.c, since it needs to 172 * refer to them also... 173 */ 174 extern boolean_t nflag; /* Avoid nameservice? */ 175 extern boolean_t pflag; /* Paranoid w.r.t. printing keying material? */ 176 extern boolean_t interactive; 177 extern boolean_t readfile; 178 extern uint_t lineno; 179 extern char numprint[NBUF_SIZE]; 180 181 /* For error recovery in interactive or read-file mode. */ 182 extern jmp_buf env; 183 184 /* 185 * Back-end stuff for getalgby*(). 186 */ 187 188 #define INET_IPSECALGSPATH "/etc/inet/" 189 #define INET_IPSECALGSFILE (INET_IPSECALGSPATH "ipsecalgs") 190 191 /* To preserve packages delimiters in /etc/inet/ipsecalgs */ 192 typedef struct ipsecalgs_pkg { 193 int alg_num; 194 char *pkg_name; 195 } ipsecalgs_pkg_t; 196 197 /* 198 * The cached representation of /etc/inet/ipsecalgs is represented by: 199 * - A dynamically-grown (optionally sorted) array of IPsec protocols 200 * - Each protocol has an array (again, dynamically grown and sorted) 201 * of algorithms, each a full-fledged struct ipsecalgent. 202 * - The getipsecalg*() routines will search the list, then duplicate the 203 * struct ipsecalgent and return it. 204 */ 205 206 typedef enum { 207 LIBIPSEC_ALGS_EXEC_SYNC, 208 LIBIPSEC_ALGS_EXEC_ASYNC 209 } ipsecalgs_exec_mode_t; 210 211 typedef struct ipsec_proto { 212 int proto_num; 213 char *proto_name; 214 char *proto_pkg; 215 int proto_numalgs; 216 struct ipsecalgent **proto_algs; 217 ipsecalgs_pkg_t *proto_algs_pkgs; 218 int proto_algs_npkgs; 219 ipsecalgs_exec_mode_t proto_exec_mode; 220 } ipsec_proto_t; 221 222 extern void _build_internal_algs(ipsec_proto_t **, int *); 223 extern int _str_to_ipsec_exec_mode(char *, ipsecalgs_exec_mode_t *); 224 225 extern int addipsecalg(struct ipsecalgent *, uint_t); 226 extern int delipsecalgbyname(const char *, int); 227 extern int delipsecalgbynum(int, int); 228 extern int addipsecproto(const char *, int, ipsecalgs_exec_mode_t, uint_t); 229 extern int delipsecprotobyname(const char *); 230 extern int delipsecprotobynum(int); 231 extern int *getipsecprotos(int *); 232 extern int *getipsecalgs(int *, int); 233 extern int list_ints(FILE *, int *); 234 extern const char *ipsecalgs_diag(int); 235 extern int ipsecproto_get_exec_mode(int, ipsecalgs_exec_mode_t *); 236 extern int ipsecproto_set_exec_mode(int, ipsecalgs_exec_mode_t); 237 238 /* Flags for add/delete routines. */ 239 #define LIBIPSEC_ALGS_ADD_FORCE 0x00000001 240 241 /* 242 * Helper definitions for indices into array of key sizes when key sizes 243 * are defined by range. 244 */ 245 #define LIBIPSEC_ALGS_KEY_DEF_IDX 0 /* default key size */ 246 #define LIBIPSEC_ALGS_KEY_MIN_IDX 1 /* min key size */ 247 #define LIBIPSEC_ALGS_KEY_MAX_IDX 2 /* max key size */ 248 #define LIBIPSEC_ALGS_KEY_NUM_VAL 4 /* def, min, max, 0 */ 249 250 /* Error codes for IPsec algorithms management */ 251 #define LIBIPSEC_ALGS_DIAG_ALG_EXISTS -1 252 #define LIBIPSEC_ALGS_DIAG_PROTO_EXISTS -2 253 #define LIBIPSEC_ALGS_DIAG_UNKN_PROTO -3 254 #define LIBIPSEC_ALGS_DIAG_UNKN_ALG -4 255 #define LIBIPSEC_ALGS_DIAG_NOMEM -5 256 #define LIBIPSEC_ALGS_DIAG_ALGSFILEOPEN -6 257 #define LIBIPSEC_ALGS_DIAG_ALGSFILEFDOPEN -7 258 #define LIBIPSEC_ALGS_DIAG_ALGSFILELOCK -8 259 #define LIBIPSEC_ALGS_DIAG_ALGSFILERENAME -9 260 #define LIBIPSEC_ALGS_DIAG_ALGSFILEWRITE -10 261 #define LIBIPSEC_ALGS_DIAG_ALGSFILECHMOD -11 262 #define LIBIPSEC_ALGS_DIAG_ALGSFILECHOWN -12 263 #define LIBIPSEC_ALGS_DIAG_ALGSFILECLOSE -13 264 265 /* /etc/inet/ipsecalgs keywords and package sections delimiters */ 266 #define LIBIPSEC_ALGS_LINE_PROTO "PROTO|" 267 #define LIBIPSEC_ALGS_LINE_ALG "ALG|" 268 #define LIBIPSEC_ALGS_LINE_PKGSTART "# Start " 269 #define LIBIPSEC_ALGS_LINE_PKGEND "# End " 270 271 /* Put these in libnsl for and process caching testing. */ 272 extern int *_real_getipsecprotos(int *); 273 extern int *_real_getipsecalgs(int *, int); 274 extern struct ipsecalgent *_duplicate_alg(struct ipsecalgent *); 275 extern void _clean_trash(ipsec_proto_t *, int); 276 277 /* spdsock support functions */ 278 279 /* Return values for spdsock_get_ext(). */ 280 #define KGE_OK 0 281 #define KGE_DUP 1 282 #define KGE_UNK 2 283 #define KGE_LEN 3 284 #define KGE_CHK 4 285 286 extern int spdsock_get_ext(spd_ext_t *[], spd_msg_t *, uint_t, char *, uint_t); 287 extern const char *spdsock_diag(int); 288 289 /* PF_KEY (keysock) support functions */ 290 extern const char *keysock_diag(int); 291 extern int in_masktoprefix(uint8_t *, boolean_t); 292 293 /* SA support functions */ 294 295 extern void print_diagnostic(FILE *, uint16_t); 296 extern void print_sadb_msg(struct sadb_msg *, time_t, boolean_t); 297 extern void print_sa(char *, struct sadb_sa *); 298 extern void printsatime(int64_t, const char *, const char *, const char *, 299 boolean_t); 300 extern void print_lifetimes(time_t, struct sadb_lifetime *, 301 struct sadb_lifetime *, struct sadb_lifetime *, boolean_t vflag); 302 extern void print_address(char *, struct sadb_address *); 303 extern void print_key(char *, struct sadb_key *); 304 extern void print_ident(char *, struct sadb_ident *); 305 extern void print_sens(char *, struct sadb_sens *); 306 extern void print_prop(char *, struct sadb_prop *); 307 extern void print_eprop(char *, struct sadb_prop *); 308 extern void print_supp(char *, struct sadb_supported *); 309 extern void print_spirange(char *, struct sadb_spirange *); 310 extern void print_kmc(char *, struct sadb_x_kmc *); 311 extern void print_samsg(uint64_t *, boolean_t, boolean_t); 312 extern char *rparsesatype(int); 313 extern char *rparsealg(uint8_t, int); 314 extern char *rparseidtype(uint16_t); 315 extern boolean_t save_lifetime(struct sadb_lifetime *, FILE *); 316 extern boolean_t save_address(struct sadb_address *, FILE *); 317 extern boolean_t save_key(struct sadb_key *, FILE *); 318 extern boolean_t save_ident(struct sadb_ident *, FILE *); 319 extern void save_assoc(uint64_t *, FILE *); 320 extern FILE *opensavefile(char *); 321 extern const char *do_inet_ntop(const void *, char *, size_t); 322 323 #ifdef __cplusplus 324 } 325 #endif 326 327 #endif /* _IPSEC_UTIL_H */ 328