1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #ifndef _IPSEC_UTIL_H 27 #define _IPSEC_UTIL_H 28 29 /* 30 * Headers and definitions for support functions that are shared by 31 * the ipsec utilities ipseckey and ikeadm. 32 */ 33 34 #ifdef __cplusplus 35 extern "C" { 36 #endif 37 38 #include <sys/types.h> 39 #include <sys/socket.h> 40 #include <net/pfkeyv2.h> 41 #include <netinet/in.h> 42 #include <inet/ip.h> 43 #include <setjmp.h> 44 #include <stdio.h> 45 #include <err.h> 46 #include <errfp.h> 47 #include <net/pfpolicy.h> 48 #include <libtecla.h> 49 50 #ifndef A_CNT 51 /* macros for array manipulation */ 52 #define A_CNT(arr) (sizeof (arr)/sizeof (arr[0])) 53 #define A_END(arr) (&arr[A_CNT(arr)]) 54 #endif 55 56 /* used for file parsing */ 57 #define NBUF_SIZE 16 58 #define COMMENT_CHAR '#' 59 #define CONT_CHAR '\\' 60 #define QUOTE_CHAR '"' 61 /* 62 * Input buffer size limits maximum line length for both file parsing and 63 * interactive mode. 4K chars should be enough even for broad commands and 64 * all possible key lenghts of today's symmetric ciphers entered via 65 * ipseckey(1M) which has the most bifurcated grammar from all IPsec commands. 66 */ 67 #define IBUF_SIZE 4096 68 69 /* used for command-line parsing */ 70 #define START_ARG 8 71 #define TOO_MANY_ARGS (START_ARG << 9) 72 73 /* Return codes for argv/argc vector creation */ 74 #define TOO_MANY_TOKENS -3 75 #define MEMORY_ALLOCATION -2 76 #define COMMENT_LINE 1 77 #define SUCCESS 0 78 79 /* 80 * Time printing defines... 81 * 82 * TBUF_SIZE is pretty arbitrary. Perhaps it shouldn't be. 83 */ 84 #define TBUF_SIZE 50 85 #define TIME_MAX LONG_MAX 86 87 #ifndef INSECURE_PERMS 88 #define INSECURE_PERMS(sbuf) (((sbuf).st_uid != 0) || \ 89 ((sbuf).st_mode & S_IRWXG) || ((sbuf).st_mode & S_IRWXO)) 90 #endif 91 92 #ifndef PKCS11_TOKSIZE 93 #define PKCS11_TOKSIZE 32 /* Fixed length of PKCS#11 token string len. */ 94 #endif 95 96 /* 97 * Solaris UDP port used to communicate with the Solaris Cluster 98 * daemon. It is used only when the node is booted in cluster mode. 99 */ 100 #define CLUSTER_UDP_PORT 2005 101 102 /* For keyword-lookup tables */ 103 typedef struct keywdtab { 104 uint_t kw_tag; 105 char *kw_str; 106 } keywdtab_t; 107 108 /* 109 * These different exit states are designed to give consistant behaviour 110 * when a program needs to exit because of an error. These exit_types 111 * are used in macros, defined later in this file, which call ipsecutil_exit(). 112 * What happens when ipsecutil_exit() may differ if the command was started 113 * on the command line or via smf(5), See ipsecutil_exit() source for details. 114 * 115 * Note: The calling function should decide what "debug mode" is before calling 116 * ipsecutil_exit() with DEBUG_FATAL. 117 */ 118 typedef enum exit_type { 119 SERVICE_EXIT_OK, /* Exit without error. */ 120 SERVICE_DEGRADE, /* A hint that service should be degraded. */ 121 SERVICE_BADPERM, /* A Permission error occured. */ 122 SERVICE_BADCONF, /* Misconfiguration. */ 123 SERVICE_MAINTAIN, /* smf(5) to put service in maintenance mode. */ 124 SERVICE_DISABLE, /* Tell smf(5) to disable me. */ 125 SERVICE_FATAL, /* Whatever happened is not fixable. */ 126 SERVICE_RESTART, /* Tell smf(5) to restart the service. */ 127 DEBUG_FATAL /* Exit in debug mode. */ 128 } exit_type_t; 129 130 /* 131 * Function Prototypes 132 */ 133 134 /* 135 * Print errno and if cmdline or readfile, exit; if interactive reset state 136 */ 137 extern void ipsecutil_exit(exit_type_t, char *, FILE *, const char *fmt, ...); 138 extern void bail(char *); 139 140 /* 141 * Localization macro - Only to be used from usr/src/cmd because Macros 142 * are not expanded in usr/src/lib when message catalogs are built. 143 */ 144 #define Bail(s) bail(dgettext(TEXT_DOMAIN, s)) 145 146 /* 147 * Print caller-supplied, variable-arg error message, then exit if cmdline 148 * or readfile, or reset state if interactive. 149 */ 150 extern void bail_msg(char *, ...); 151 152 /* 153 * dump_XXX functions produce ASCII output from the passed in data. 154 * 155 * Because certain errors need to do this stderr, dump_XXX functions 156 * take a FILE pointer. 157 */ 158 159 extern int dump_sockaddr(struct sockaddr *, uint8_t, boolean_t, FILE *, 160 boolean_t); 161 162 extern int dump_key(uint8_t *, uint_t, FILE *); 163 164 extern int dump_aalg(uint8_t, FILE *); 165 166 extern int dump_ealg(uint8_t, FILE *); 167 168 /* return true if sadb string is printable (based on type), false otherwise */ 169 extern boolean_t dump_sadb_idtype(uint8_t, FILE *, int *); 170 171 /* 172 * do_interactive: Enter a mode where commands are read from a file; 173 * treat stdin special. infile is the file cmds are read from; 174 * promptstring is the string printed to stdout (if the cmds are 175 * being read from stdin) to prompt for a new command; parseit is 176 * the function to be called to process the command line once it's 177 * been read in and broken up into an argv/argc vector. 178 */ 179 180 /* callback function passed in to do_interactive() */ 181 typedef void (*parse_cmdln_fn)(int, char **, char *, boolean_t); 182 183 extern void do_interactive(FILE *, char *, char *, char *, parse_cmdln_fn, 184 CplMatchFn *); 185 186 extern uint_t lines_parsed; 187 extern uint_t lines_added; 188 189 /* convert a string to an IKE_PRIV_* constant */ 190 extern int privstr2num(char *); 191 192 /* convert a string to a D_* debug flag */ 193 extern int dbgstr2num(char *); 194 195 /* convert a string of debug strings with +|- delimiters to a debug level */ 196 extern int parsedbgopts(char *); 197 198 /* 199 * OpenSSL library 200 */ 201 #define LIBSSL "libssl.so" 202 203 void libssl_load(void); 204 boolean_t libssl_loaded; 205 206 /* 207 * functions to manipulate the kmcookie-label mapping file 208 */ 209 210 #define KMCFILE "/var/run/ipsec_kmc_map" 211 212 /* 213 * Insert a mapping into the file (if it's not already there), given the 214 * new label. Return the assigned cookie, or -1 on error. 215 */ 216 extern int kmc_insert_mapping(char *); 217 218 /* 219 * Lookup the given cookie and return its corresponding label. Return 220 * a pointer to the label on success, NULL on error (or if the label is 221 * not found). 222 */ 223 extern char *kmc_lookup_by_cookie(int); 224 225 /* 226 * These globals are declared for us in ipsec_util.c, since it needs to 227 * refer to them also... 228 */ 229 extern boolean_t nflag; /* Avoid nameservice? */ 230 extern boolean_t pflag; /* Paranoid w.r.t. printing keying material? */ 231 extern boolean_t interactive; 232 extern boolean_t readfile; 233 extern uint_t lineno; 234 extern char numprint[NBUF_SIZE]; 235 236 /* For error recovery in interactive or read-file mode. */ 237 extern jmp_buf env; 238 239 /* 240 * Back-end stuff for getalgby*(). 241 */ 242 243 #define INET_IPSECALGSPATH "/etc/inet/" 244 #define INET_IPSECALGSFILE (INET_IPSECALGSPATH "ipsecalgs") 245 246 /* To preserve packages delimiters in /etc/inet/ipsecalgs */ 247 typedef struct ipsecalgs_pkg { 248 int alg_num; 249 char *pkg_name; 250 } ipsecalgs_pkg_t; 251 252 /* 253 * The cached representation of /etc/inet/ipsecalgs is represented by: 254 * - A dynamically-grown (optionally sorted) array of IPsec protocols 255 * - Each protocol has an array (again, dynamically grown and sorted) 256 * of algorithms, each a full-fledged struct ipsecalgent. 257 * - The getipsecalg*() routines will search the list, then duplicate the 258 * struct ipsecalgent and return it. 259 */ 260 261 typedef enum { 262 LIBIPSEC_ALGS_EXEC_SYNC, 263 LIBIPSEC_ALGS_EXEC_ASYNC 264 } ipsecalgs_exec_mode_t; 265 266 typedef struct ipsec_proto { 267 int proto_num; 268 char *proto_name; 269 char *proto_pkg; 270 int proto_numalgs; 271 struct ipsecalgent **proto_algs; 272 ipsecalgs_pkg_t *proto_algs_pkgs; 273 int proto_algs_npkgs; 274 ipsecalgs_exec_mode_t proto_exec_mode; 275 } ipsec_proto_t; 276 277 extern void _build_internal_algs(ipsec_proto_t **, int *); 278 extern int _str_to_ipsec_exec_mode(char *, ipsecalgs_exec_mode_t *); 279 280 extern int addipsecalg(struct ipsecalgent *, uint_t); 281 extern int delipsecalgbyname(const char *, int); 282 extern int delipsecalgbynum(int, int); 283 extern int addipsecproto(const char *, int, ipsecalgs_exec_mode_t, uint_t); 284 extern int delipsecprotobyname(const char *); 285 extern int delipsecprotobynum(int); 286 extern int *getipsecprotos(int *); 287 extern int *getipsecalgs(int *, int); 288 extern int list_ints(FILE *, int *); 289 extern const char *ipsecalgs_diag(int); 290 extern int ipsecproto_get_exec_mode(int, ipsecalgs_exec_mode_t *); 291 extern int ipsecproto_set_exec_mode(int, ipsecalgs_exec_mode_t); 292 293 /* Flags for add/delete routines. */ 294 #define LIBIPSEC_ALGS_ADD_FORCE 0x00000001 295 296 /* 297 * Helper definitions for indices into array of key sizes when key sizes 298 * are defined by range. 299 */ 300 #define LIBIPSEC_ALGS_KEY_DEF_IDX 0 /* default key size */ 301 #define LIBIPSEC_ALGS_KEY_MIN_IDX 1 /* min key size */ 302 #define LIBIPSEC_ALGS_KEY_MAX_IDX 2 /* max key size */ 303 #define LIBIPSEC_ALGS_KEY_NUM_VAL 4 /* def, min, max, 0 */ 304 305 /* Error codes for IPsec algorithms management */ 306 #define LIBIPSEC_ALGS_DIAG_ALG_EXISTS -1 307 #define LIBIPSEC_ALGS_DIAG_PROTO_EXISTS -2 308 #define LIBIPSEC_ALGS_DIAG_UNKN_PROTO -3 309 #define LIBIPSEC_ALGS_DIAG_UNKN_ALG -4 310 #define LIBIPSEC_ALGS_DIAG_NOMEM -5 311 #define LIBIPSEC_ALGS_DIAG_ALGSFILEOPEN -6 312 #define LIBIPSEC_ALGS_DIAG_ALGSFILEFDOPEN -7 313 #define LIBIPSEC_ALGS_DIAG_ALGSFILELOCK -8 314 #define LIBIPSEC_ALGS_DIAG_ALGSFILERENAME -9 315 #define LIBIPSEC_ALGS_DIAG_ALGSFILEWRITE -10 316 #define LIBIPSEC_ALGS_DIAG_ALGSFILECHMOD -11 317 #define LIBIPSEC_ALGS_DIAG_ALGSFILECHOWN -12 318 #define LIBIPSEC_ALGS_DIAG_ALGSFILECLOSE -13 319 320 /* /etc/inet/ipsecalgs keywords and package sections delimiters */ 321 #define LIBIPSEC_ALGS_LINE_PROTO "PROTO|" 322 #define LIBIPSEC_ALGS_LINE_ALG "ALG|" 323 #define LIBIPSEC_ALGS_LINE_PKGSTART "# Start " 324 #define LIBIPSEC_ALGS_LINE_PKGEND "# End " 325 326 /* Put these in libnsl for and process caching testing. */ 327 extern int *_real_getipsecprotos(int *); 328 extern int *_real_getipsecalgs(int *, int); 329 extern struct ipsecalgent *_duplicate_alg(struct ipsecalgent *); 330 extern void _clean_trash(ipsec_proto_t *, int); 331 332 /* spdsock support functions */ 333 334 /* Return values for spdsock_get_ext(). */ 335 #define KGE_OK 0 336 #define KGE_DUP 1 337 #define KGE_UNK 2 338 #define KGE_LEN 3 339 #define KGE_CHK 4 340 341 extern int spdsock_get_ext(spd_ext_t *[], spd_msg_t *, uint_t, char *, uint_t); 342 extern const char *spdsock_diag(int); 343 344 /* PF_KEY (keysock) support functions */ 345 extern const char *keysock_diag(int); 346 extern int in_masktoprefix(uint8_t *, boolean_t); 347 348 /* SA support functions */ 349 350 extern void print_diagnostic(FILE *, uint16_t); 351 extern void print_sadb_msg(FILE *, struct sadb_msg *, time_t, boolean_t); 352 extern void print_sa(FILE *, char *, struct sadb_sa *); 353 extern void printsatime(FILE *, int64_t, const char *, const char *, 354 const char *, boolean_t); 355 extern void print_lifetimes(FILE *, time_t, struct sadb_lifetime *, 356 struct sadb_lifetime *, struct sadb_lifetime *, struct sadb_lifetime *, 357 boolean_t vflag); 358 extern void print_address(FILE *, char *, struct sadb_address *, boolean_t); 359 extern void print_asn1_name(FILE *, const unsigned char *, long); 360 extern void print_key(FILE *, char *, struct sadb_key *); 361 extern void print_ident(FILE *, char *, struct sadb_ident *); 362 extern void print_sens(FILE *, char *, struct sadb_sens *); 363 extern void print_prop(FILE *, char *, struct sadb_prop *); 364 extern void print_eprop(FILE *, char *, struct sadb_prop *); 365 extern void print_supp(FILE *, char *, struct sadb_supported *); 366 extern void print_spirange(FILE *, char *, struct sadb_spirange *); 367 extern void print_kmc(FILE *, char *, struct sadb_x_kmc *); 368 extern void print_samsg(FILE *, uint64_t *, boolean_t, boolean_t, boolean_t); 369 extern char *rparsesatype(int); 370 extern char *rparsealg(uint8_t, int); 371 extern char *rparseidtype(uint16_t); 372 extern boolean_t save_lifetime(struct sadb_lifetime *, FILE *); 373 extern boolean_t save_address(struct sadb_address *, FILE *); 374 extern boolean_t save_key(struct sadb_key *, FILE *); 375 extern boolean_t save_ident(struct sadb_ident *, FILE *); 376 extern void save_assoc(uint64_t *, FILE *); 377 extern FILE *opensavefile(char *); 378 extern const char *do_inet_ntop(const void *, char *, size_t); 379 380 /* 381 * These exit macros give a consistent exit behaviour for all 382 * programs that use libipsecutil. These wll work in usr/src/cmd 383 * and usr/src/lib, but because macros in usr/src/lib don't get 384 * expanded when I18N message catalogs are built, avoid using 385 * these with text inside libipsecutil. See source of ipsecutil_exit() 386 * for more details. 387 */ 388 #define EXIT_OK(x) \ 389 ipsecutil_exit(SERVICE_EXIT_OK, my_fmri, debugfile, \ 390 dgettext(TEXT_DOMAIN, x)) 391 #define EXIT_OK2(x, y) \ 392 ipsecutil_exit(SERVICE_EXIT_OK, my_fmri, debugfile, \ 393 dgettext(TEXT_DOMAIN, x), y) 394 #define EXIT_OK3(x, y, z) \ 395 ipsecutil_exit(SERVICE_EXIT_OK, my_fmri, debugfile, \ 396 dgettext(TEXT_DOMAIN, x), y, z) 397 #define EXIT_BADCONFIG(x) \ 398 ipsecutil_exit(SERVICE_BADCONF, my_fmri, debugfile, \ 399 dgettext(TEXT_DOMAIN, x)) 400 #define EXIT_BADCONFIG2(x, y) \ 401 ipsecutil_exit(SERVICE_BADCONF, my_fmri, debugfile, \ 402 dgettext(TEXT_DOMAIN, x), y) 403 #define EXIT_BADCONFIG3(x, y, z) \ 404 ipsecutil_exit(SERVICE_BADCONF, my_fmri, debugfile, \ 405 dgettext(TEXT_DOMAIN, x), y, z) 406 #define EXIT_MAINTAIN(x) \ 407 ipsecutil_exit(SERVICE_MAINTAIN, my_fmri, debugfile, \ 408 dgettext(TEXT_DOMAIN, x)) 409 #define EXIT_MAINTAIN2(x, y) \ 410 ipsecutil_exit(SERVICE_MAINTAIN, my_fmri, debugfile, \ 411 dgettext(TEXT_DOMAIN, x), y) 412 #define EXIT_DEGRADE(x) \ 413 ipsecutil_exit(SERVICE_DEGRADE, my_fmri, debugfile, \ 414 dgettext(TEXT_DOMAIN, x)) 415 #define EXIT_BADPERM(x) \ 416 ipsecutil_exit(SERVICE_BADPERM, my_fmri, debugfile, \ 417 dgettext(TEXT_DOMAIN, x)) 418 #define EXIT_BADPERM2(x, y) \ 419 ipsecutil_exit(SERVICE_BADPERM, my_fmri, debugfile, \ 420 dgettext(TEXT_DOMAIN, x), y) 421 #define EXIT_FATAL(x) \ 422 ipsecutil_exit(SERVICE_FATAL, my_fmri, debugfile, \ 423 dgettext(TEXT_DOMAIN, x)) 424 #define EXIT_FATAL2(x, y) \ 425 ipsecutil_exit(SERVICE_FATAL, my_fmri, debugfile, \ 426 dgettext(TEXT_DOMAIN, x), y) 427 #define EXIT_FATAL3(x, y, z) \ 428 ipsecutil_exit(SERVICE_FATAL, my_fmri, debugfile, \ 429 dgettext(TEXT_DOMAIN, x), y, z) 430 #define EXIT_RESTART(x) \ 431 ipsecutil_exit(SERVICE_RESTART, my_fmri, debugfile, \ 432 dgettext(TEXT_DOMAIN, x)) 433 434 #ifdef __cplusplus 435 } 436 #endif 437 438 #endif /* _IPSEC_UTIL_H */ 439