1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License, Version 1.0 only 6 * (the "License"). You may not use this file except in compliance 7 * with the License. 8 * 9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10 * or http://www.opensolaris.org/os/licensing. 11 * See the License for the specific language governing permissions 12 * and limitations under the License. 13 * 14 * When distributing Covered Code, include this CDDL HEADER in each 15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16 * If applicable, add the following below this CDDL HEADER, with the 17 * fields enclosed by brackets "[]" replaced with your own identifying 18 * information: Portions Copyright [yyyy] [name of copyright owner] 19 * 20 * CDDL HEADER END 21 */ 22 /* 23 * Copyright 2005 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27 #ifndef _IPSEC_UTIL_H 28 #define _IPSEC_UTIL_H 29 30 #pragma ident "%Z%%M% %I% %E% SMI" 31 32 /* 33 * Headers and definitions for support functions that are shared by 34 * the ipsec utilities ipseckey and ikeadm. 35 */ 36 37 #ifdef __cplusplus 38 extern "C" { 39 #endif 40 41 #include <sys/types.h> 42 #include <sys/socket.h> 43 #include <setjmp.h> 44 #include <stdio.h> 45 #include <err.h> 46 #include <net/pfpolicy.h> 47 48 /* macros for array manipulation */ 49 #define A_CNT(arr) (sizeof (arr)/sizeof (arr[0])) 50 #define A_END(arr) (&arr[A_CNT(arr)]) 51 52 /* used for file parsing */ 53 #define NBUF_SIZE 16 54 #define IBUF_SIZE 512 55 #define COMMENT_CHAR '#' 56 #define CONT_CHAR '\\' 57 #define QUOTE_CHAR '"' 58 59 /* used for command-line parsing */ 60 #define START_ARG 8 61 #define TOO_MANY_ARGS (START_ARG << 9) 62 63 /* Return codes for argv/argc vector creation */ 64 #define TOO_MANY_TOKENS -3 65 #define MEMORY_ALLOCATION -2 66 #define COMMENT_LINE 1 67 #define SUCCESS 0 68 69 /* 70 * Time printing defines... 71 * 72 * TBUF_SIZE is pretty arbitrary. Perhaps it shouldn't be. 73 */ 74 #define TBUF_SIZE 50 75 #define TIME_MAX LONG_MAX 76 77 /* For keyword-lookup tables */ 78 typedef struct keywdtab { 79 uint_t kw_tag; 80 char *kw_str; 81 } keywdtab_t; 82 83 84 /* 85 * Function Prototypes 86 */ 87 88 /* 89 * Print errno and if cmdline or readfile, exit; if interactive reset state 90 */ 91 extern void bail(char *); 92 93 /* 94 * Localization macro... 95 */ 96 #define Bail(s) bail(gettext(s)) 97 98 /* 99 * Print caller-supplied, variable-arg error message, then exit if cmdline 100 * or readfile, or reset state if interactive. 101 */ 102 extern void bail_msg(char *, ...); 103 104 /* 105 * dump_XXX functions produce ASCII output from the passed in data. 106 * 107 * Because certain errors need to do this stderr, dump_XXX functions 108 * take a FILE pointer. 109 */ 110 111 extern int dump_sockaddr(struct sockaddr *, boolean_t, FILE *); 112 113 extern int dump_key(uint8_t *, uint_t, FILE *); 114 115 extern int dump_aalg(uint8_t, FILE *); 116 117 extern int dump_ealg(uint8_t, FILE *); 118 119 /* return true if sadb string is printable (based on type), false otherwise */ 120 extern boolean_t dump_sadb_idtype(uint8_t, FILE *, int *); 121 122 /* 123 * do_interactive: Enter a mode where commands are read from a file; 124 * treat stdin special. infile is the file cmds are read from; 125 * promptstring is the string printed to stdout (if the cmds are 126 * being read from stdin) to prompt for a new command; parseit is 127 * the function to be called to process the command line once it's 128 * been read in and broken up into an argv/argc vector. 129 */ 130 131 /* callback function passed in to do_interactive() */ 132 typedef void (*parse_cmdln_fn)(int, char **); 133 134 extern void do_interactive(FILE *, char *, parse_cmdln_fn); 135 136 /* convert a string to an IKE_PRIV_* constant */ 137 extern int privstr2num(char *); 138 139 /* convert a string to a D_* debug flag */ 140 extern int dbgstr2num(char *); 141 142 /* convert a string of debug strings with +|- delimiters to a debug level */ 143 extern int parsedbgopts(char *); 144 145 146 /* 147 * functions to manipulate the kmcookie-label mapping file 148 */ 149 150 #define KMCFILE "/var/run/ipsec_kmc_map" 151 152 /* 153 * Insert a mapping into the file (if it's not already there), given the 154 * new label. Return the assigned cookie, or -1 on error. 155 */ 156 extern int kmc_insert_mapping(char *); 157 158 /* 159 * Lookup the given cookie and return its corresponding label. Return 160 * a pointer to the label on success, NULL on error (or if the label is 161 * not found). 162 */ 163 extern char *kmc_lookup_by_cookie(int); 164 165 /* 166 * These globals are declared for us in ipsec_util.c, since it needs to 167 * refer to them also... 168 */ 169 extern boolean_t nflag; /* Avoid nameservice? */ 170 extern boolean_t pflag; /* Paranoid w.r.t. printing keying material? */ 171 extern boolean_t interactive; 172 extern boolean_t readfile; 173 extern uint_t lineno; 174 175 /* For error recovery in interactive or read-file mode. */ 176 extern jmp_buf env; 177 178 /* 179 * Back-end stuff for getalgby*(). 180 */ 181 182 #define INET_IPSECALGSPATH "/etc/inet/" 183 #define INET_IPSECALGSFILE (INET_IPSECALGSPATH "ipsecalgs") 184 185 /* To preserve packages delimiters in /etc/inet/ipsecalgs */ 186 typedef struct ipsecalgs_pkg { 187 int alg_num; 188 char *pkg_name; 189 } ipsecalgs_pkg_t; 190 191 /* 192 * The cached representation of /etc/inet/ipsecalgs is represented by: 193 * - A dynamically-grown (optionally sorted) array of IPsec protocols 194 * - Each protocol has an array (again, dynamically grown and sorted) 195 * of algorithms, each a full-fledged struct ipsecalgent. 196 * - The getipsecalg*() routines will search the list, then duplicate the 197 * struct ipsecalgent and return it. 198 */ 199 200 typedef enum { 201 LIBIPSEC_ALGS_EXEC_SYNC, 202 LIBIPSEC_ALGS_EXEC_ASYNC 203 } ipsecalgs_exec_mode_t; 204 205 typedef struct ipsec_proto { 206 int proto_num; 207 char *proto_name; 208 char *proto_pkg; 209 int proto_numalgs; 210 struct ipsecalgent **proto_algs; 211 ipsecalgs_pkg_t *proto_algs_pkgs; 212 int proto_algs_npkgs; 213 ipsecalgs_exec_mode_t proto_exec_mode; 214 } ipsec_proto_t; 215 216 extern void _build_internal_algs(ipsec_proto_t **, int *); 217 extern int _str_to_ipsec_exec_mode(char *, ipsecalgs_exec_mode_t *); 218 219 extern int addipsecalg(struct ipsecalgent *, uint_t); 220 extern int delipsecalgbyname(const char *, int); 221 extern int delipsecalgbynum(int, int); 222 extern int addipsecproto(const char *, int, ipsecalgs_exec_mode_t, uint_t); 223 extern int delipsecprotobyname(const char *); 224 extern int delipsecprotobynum(int); 225 extern int *getipsecprotos(int *); 226 extern int *getipsecalgs(int *, int); 227 extern int list_ints(FILE *, int *); 228 extern const char *ipsecalgs_diag(int); 229 extern int ipsecproto_get_exec_mode(int, ipsecalgs_exec_mode_t *); 230 extern int ipsecproto_set_exec_mode(int, ipsecalgs_exec_mode_t); 231 232 /* Flags for add/delete routines. */ 233 #define LIBIPSEC_ALGS_ADD_FORCE 0x00000001 234 235 /* 236 * Helper definitions for indices into array of key sizes when key sizes 237 * are defined by range. 238 */ 239 #define LIBIPSEC_ALGS_KEY_DEF_IDX 0 /* default key size */ 240 #define LIBIPSEC_ALGS_KEY_MIN_IDX 1 /* min key size */ 241 #define LIBIPSEC_ALGS_KEY_MAX_IDX 2 /* max key size */ 242 #define LIBIPSEC_ALGS_KEY_NUM_VAL 4 /* def, min, max, 0 */ 243 244 /* Error codes for IPsec algorithms management */ 245 #define LIBIPSEC_ALGS_DIAG_ALG_EXISTS -1 246 #define LIBIPSEC_ALGS_DIAG_PROTO_EXISTS -2 247 #define LIBIPSEC_ALGS_DIAG_UNKN_PROTO -3 248 #define LIBIPSEC_ALGS_DIAG_UNKN_ALG -4 249 #define LIBIPSEC_ALGS_DIAG_NOMEM -5 250 #define LIBIPSEC_ALGS_DIAG_ALGSFILEOPEN -6 251 #define LIBIPSEC_ALGS_DIAG_ALGSFILEFDOPEN -7 252 #define LIBIPSEC_ALGS_DIAG_ALGSFILELOCK -8 253 #define LIBIPSEC_ALGS_DIAG_ALGSFILERENAME -9 254 #define LIBIPSEC_ALGS_DIAG_ALGSFILEWRITE -10 255 #define LIBIPSEC_ALGS_DIAG_ALGSFILECHMOD -11 256 #define LIBIPSEC_ALGS_DIAG_ALGSFILECHOWN -12 257 #define LIBIPSEC_ALGS_DIAG_ALGSFILECLOSE -13 258 259 /* /etc/inet/ipsecalgs keywords and package sections delimiters */ 260 #define LIBIPSEC_ALGS_LINE_PROTO "PROTO|" 261 #define LIBIPSEC_ALGS_LINE_ALG "ALG|" 262 #define LIBIPSEC_ALGS_LINE_PKGSTART "# Start " 263 #define LIBIPSEC_ALGS_LINE_PKGEND "# End " 264 265 /* Put these in libnsl for and process caching testing. */ 266 extern int *_real_getipsecprotos(int *); 267 extern int *_real_getipsecalgs(int *, int); 268 extern struct ipsecalgent *_duplicate_alg(struct ipsecalgent *); 269 extern void _clean_trash(ipsec_proto_t *, int); 270 271 /* spdsock support functions */ 272 273 /* Return values for spdsock_get_ext(). */ 274 #define KGE_OK 0 275 #define KGE_DUP 1 276 #define KGE_UNK 2 277 #define KGE_LEN 3 278 #define KGE_CHK 4 279 280 extern int spdsock_get_ext(spd_ext_t *[], spd_msg_t *, uint_t, char *, uint_t); 281 extern const char *spdsock_diag(int); 282 283 /* PF_KEY (keysock) support functions */ 284 extern const char *keysock_diag(int); 285 286 #ifdef __cplusplus 287 } 288 #endif 289 290 #endif /* _IPSEC_UTIL_H */ 291