Home | History | Annotate | Download | only in common
      1 /*
      2  * CDDL HEADER START
      3  *
      4  * The contents of this file are subject to the terms of the
      5  * Common Development and Distribution License (the "License").
      6  * You may not use this file except in compliance with the License.
      7  *
      8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
      9  * or http://www.opensolaris.org/os/licensing.
     10  * See the License for the specific language governing permissions
     11  * and limitations under the License.
     12  *
     13  * When distributing Covered Code, include this CDDL HEADER in each
     14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
     15  * If applicable, add the following below this CDDL HEADER, with the
     16  * fields enclosed by brackets "[]" replaced with your own identifying
     17  * information: Portions Copyright [yyyy] [name of copyright owner]
     18  *
     19  * CDDL HEADER END
     20  */
     21 /*
     22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
     23  * Use is subject to license terms.
     24  */
     25 
     26 #ifndef	_IPSEC_UTIL_H
     27 #define	_IPSEC_UTIL_H
     28 
     29 /*
     30  * Headers and definitions for support functions that are shared by
     31  * the ipsec utilities ipseckey and ikeadm.
     32  */
     33 
     34 #ifdef __cplusplus
     35 extern "C" {
     36 #endif
     37 
     38 #include <sys/types.h>
     39 #include <sys/socket.h>
     40 #include <net/pfkeyv2.h>
     41 #include <netinet/in.h>
     42 #include <inet/ip.h>
     43 #include <setjmp.h>
     44 #include <stdio.h>
     45 #include <err.h>
     46 #include <errfp.h>
     47 #include <net/pfpolicy.h>
     48 #include <libtecla.h>
     49 
     50 #ifndef A_CNT
     51 /* macros for array manipulation */
     52 #define	A_CNT(arr)	(sizeof (arr)/sizeof (arr[0]))
     53 #define	A_END(arr)	(&arr[A_CNT(arr)])
     54 #endif
     55 
     56 /* used for file parsing */
     57 #define	NBUF_SIZE	16
     58 #define	COMMENT_CHAR	'#'
     59 #define	CONT_CHAR	'\\'
     60 #define	QUOTE_CHAR	'"'
     61 /*
     62  * Input buffer size limits maximum line length for both file parsing and
     63  * interactive mode. 4K chars should be enough even for broad commands and
     64  * all possible key lenghts of today's symmetric ciphers entered via
     65  * ipseckey(1M) which has the most bifurcated grammar from all IPsec commands.
     66  */
     67 #define	IBUF_SIZE	4096
     68 
     69 /* used for command-line parsing */
     70 #define	START_ARG	8
     71 #define	TOO_MANY_ARGS	(START_ARG << 9)
     72 
     73 /* Return codes for argv/argc vector creation */
     74 #define	TOO_MANY_TOKENS		-3
     75 #define	MEMORY_ALLOCATION	-2
     76 #define	COMMENT_LINE		1
     77 #define	SUCCESS			0
     78 
     79 /* Flags for {bytecnt,secs}2out() */
     80 #define	SPC_NOSPACES	0x00000000		/* no space prefix/suffix */
     81 #define	SPC_BEGIN	0x00000001		/* put space at the beginning */
     82 #define	SPC_END		0x00000002		/* put space at the end */
     83 #define	SPC_BOTH	SPC_BEGIN|SPC_END	/* print both spaces */
     84 
     85 /*
     86  * The following lengths should be sufficient for character buffers passed to
     87  * bytecnt2str(),secs2str(). This is because the string output of these
     88  * functions consists of limited number and units. The lengths should be also
     89  * sufficient for bytecnt2out(),secs2out() functions.
     90  */
     91 #define	BYTE_STR_SIZE		16
     92 #define	SECS_STR_SIZE		20
     93 
     94 /*
     95  * Time printing defines...
     96  *
     97  * TBUF_SIZE is pretty arbitrary.  Perhaps it shouldn't be.
     98  */
     99 #define	TBUF_SIZE	50
    100 #define	TIME_MAX	LONG_MAX
    101 
    102 #ifndef INSECURE_PERMS
    103 #define	INSECURE_PERMS(sbuf)	(((sbuf).st_uid != 0) || \
    104 	((sbuf).st_mode & S_IRWXG) || ((sbuf).st_mode & S_IRWXO))
    105 #endif
    106 
    107 #ifndef PKCS11_TOKSIZE
    108 #define	PKCS11_TOKSIZE 32	/* Fixed length of PKCS#11 token string len. */
    109 #endif
    110 
    111 /*
    112  * Solaris UDP port used to communicate with the Solaris Cluster
    113  * daemon. It is used only when the node is booted in cluster mode.
    114  */
    115 #define	CLUSTER_UDP_PORT	2005
    116 
    117 /* For keyword-lookup tables */
    118 typedef struct keywdtab {
    119 	uint_t	kw_tag;
    120 	char	*kw_str;
    121 } keywdtab_t;
    122 
    123 /*
    124  * These different exit states are designed to give consistant behaviour
    125  * when a program needs to exit because of an error. These exit_types
    126  * are used in macros, defined later in this file, which call ipsecutil_exit().
    127  * What happens when ipsecutil_exit() may differ if the command was started
    128  * on the command line or via smf(5), See ipsecutil_exit() source for details.
    129  *
    130  * Note: The calling function should decide what "debug mode" is before calling
    131  * ipsecutil_exit() with DEBUG_FATAL.
    132  */
    133 typedef enum exit_type {
    134 	SERVICE_EXIT_OK,	/* Exit without error. */
    135 	SERVICE_DEGRADE,	/* A hint that service should be degraded. */
    136 	SERVICE_BADPERM,	/* A Permission error occured. */
    137 	SERVICE_BADCONF,	/* Misconfiguration. */
    138 	SERVICE_MAINTAIN,	/* smf(5) to put service in maintenance mode. */
    139 	SERVICE_DISABLE,	/* Tell smf(5) to disable me. */
    140 	SERVICE_FATAL,		/* Whatever happened is not fixable. */
    141 	SERVICE_RESTART,	/* Tell smf(5) to restart the service. */
    142 	DEBUG_FATAL		/* Exit in debug mode. */
    143 } exit_type_t;
    144 
    145 /*
    146  * Function Prototypes
    147  */
    148 
    149 /*
    150  * Print errno and if cmdline or readfile, exit; if interactive reset state
    151  */
    152 extern void ipsecutil_exit(exit_type_t, char *, FILE *, const char *fmt, ...);
    153 extern void bail(char *);
    154 
    155 /*
    156  * Localization macro - Only to be used from usr/src/cmd because Macros
    157  * are not expanded in usr/src/lib when message catalogs are built.
    158  */
    159 #define	Bail(s)	bail(dgettext(TEXT_DOMAIN, s))
    160 
    161 /*
    162  * Print caller-supplied, variable-arg error message, then exit if cmdline
    163  * or readfile, or reset state if interactive.
    164  */
    165 extern void bail_msg(char *, ...);
    166 
    167 /*
    168  * dump_XXX functions produce ASCII output from the passed in data.
    169  *
    170  * Because certain errors need to do this stderr, dump_XXX functions
    171  * take a FILE pointer.
    172  */
    173 
    174 extern int dump_sockaddr(struct sockaddr *, uint8_t, boolean_t, FILE *,
    175     boolean_t);
    176 
    177 extern int dump_key(uint8_t *, uint_t, uint_t, FILE *, boolean_t);
    178 
    179 extern int dump_aalg(uint8_t, FILE *);
    180 
    181 extern int dump_ealg(uint8_t, FILE *);
    182 
    183 /* return true if sadb string is printable (based on type), false otherwise */
    184 extern boolean_t dump_sadb_idtype(uint8_t, FILE *, int *);
    185 
    186 /*
    187  * do_interactive: Enter a mode where commands are read from a file;
    188  * treat stdin special.  infile is the file cmds are read from;
    189  * promptstring is the string printed to stdout (if the cmds are
    190  * being read from stdin) to prompt for a new command; parseit is
    191  * the function to be called to process the command line once it's
    192  * been read in and broken up into an argv/argc vector.
    193  */
    194 
    195 /* callback function passed in to do_interactive() */
    196 typedef void (*parse_cmdln_fn)(int, char **, char *, boolean_t);
    197 
    198 extern void do_interactive(FILE *, char *, char *, char *, parse_cmdln_fn,
    199     CplMatchFn *);
    200 
    201 extern uint_t lines_parsed;
    202 extern uint_t lines_added;
    203 
    204 /* convert a string to an IKE_PRIV_* constant */
    205 extern int privstr2num(char *);
    206 
    207 /* convert a string to a D_* debug flag */
    208 extern int dbgstr2num(char *);
    209 
    210 /* convert a string of debug strings with +|- delimiters to a debug level */
    211 extern int parsedbgopts(char *);
    212 
    213 /*
    214  * SSL library (OpenSSL)
    215  */
    216 #define	LIBSSL	"libssl.so"
    217 
    218 void libssl_load(void);
    219 
    220 /*
    221  * crypto library (OpenSSL)
    222  */
    223 #define	LIBCRYPTO	"libcrypto.so"
    224 
    225 void libcrypto_load(void);
    226 
    227 /*
    228  * functions to manipulate the kmcookie-label mapping file
    229  */
    230 
    231 #define	KMCFILE		"/var/run/ipsec_kmc_map"
    232 
    233 /*
    234  * Insert a mapping into the file (if it's not already there), given the
    235  * new label.  Return the assigned cookie, or -1 on error.
    236  */
    237 extern int kmc_insert_mapping(char *);
    238 
    239 /*
    240  * Lookup the given cookie and return its corresponding label.  Return
    241  * a pointer to the label on success, NULL on error (or if the label is
    242  * not found).
    243  */
    244 extern char *kmc_lookup_by_cookie(int);
    245 
    246 /*
    247  * These globals are declared for us in ipsec_util.c, since it needs to
    248  * refer to them also...
    249  */
    250 extern boolean_t nflag;	/* Avoid nameservice? */
    251 extern boolean_t pflag;	/* Paranoid w.r.t. printing keying material? */
    252 extern boolean_t interactive;
    253 extern boolean_t readfile;
    254 extern uint_t lineno;
    255 extern char numprint[NBUF_SIZE];
    256 
    257 /* For error recovery in interactive or read-file mode. */
    258 extern jmp_buf env;
    259 
    260 /*
    261  * Back-end stuff for getalgby*().
    262  */
    263 
    264 #define	INET_IPSECALGSPATH	"/etc/inet/"
    265 #define	INET_IPSECALGSFILE	(INET_IPSECALGSPATH "ipsecalgs")
    266 
    267 /* To preserve packages delimiters in /etc/inet/ipsecalgs */
    268 typedef struct ipsecalgs_pkg {
    269 	int alg_num;
    270 	char *pkg_name;
    271 } ipsecalgs_pkg_t;
    272 
    273 /*
    274  * The cached representation of /etc/inet/ipsecalgs is represented by:
    275  * - A dynamically-grown (optionally sorted) array of IPsec protocols
    276  * - Each protocol has an array (again, dynamically grown and sorted)
    277  *   of algorithms, each a full-fledged struct ipsecalgent.
    278  * - The getipsecalg*() routines will search the list, then duplicate the
    279  *   struct ipsecalgent and return it.
    280  */
    281 
    282 typedef enum {
    283 	LIBIPSEC_ALGS_EXEC_SYNC,
    284 	LIBIPSEC_ALGS_EXEC_ASYNC
    285 } ipsecalgs_exec_mode_t;
    286 
    287 typedef struct ipsec_proto {
    288 	int proto_num;
    289 	char *proto_name;
    290 	char *proto_pkg;
    291 	int proto_numalgs;
    292 	struct ipsecalgent **proto_algs;
    293 	ipsecalgs_pkg_t *proto_algs_pkgs;
    294 	int proto_algs_npkgs;
    295 	ipsecalgs_exec_mode_t proto_exec_mode;
    296 } ipsec_proto_t;
    297 
    298 extern void _build_internal_algs(ipsec_proto_t **, int *);
    299 extern int _str_to_ipsec_exec_mode(char *, ipsecalgs_exec_mode_t *);
    300 
    301 extern int addipsecalg(struct ipsecalgent *, uint_t);
    302 extern int delipsecalgbyname(const char *, int);
    303 extern int delipsecalgbynum(int, int);
    304 extern int addipsecproto(const char *, int, ipsecalgs_exec_mode_t, uint_t);
    305 extern int delipsecprotobyname(const char *);
    306 extern int delipsecprotobynum(int);
    307 extern int *getipsecprotos(int *);
    308 extern int *getipsecalgs(int *, int);
    309 extern int list_ints(FILE *, int *);
    310 extern const char *ipsecalgs_diag(int);
    311 extern int ipsecproto_get_exec_mode(int, ipsecalgs_exec_mode_t *);
    312 extern int ipsecproto_set_exec_mode(int, ipsecalgs_exec_mode_t);
    313 
    314 /* Flags for add/delete routines. */
    315 #define	LIBIPSEC_ALGS_ADD_FORCE 0x00000001
    316 
    317 /*
    318  * Helper definitions for indices into array of key sizes when key sizes
    319  * are defined by range.
    320  */
    321 #define	LIBIPSEC_ALGS_KEY_DEF_IDX	0	/* default key size */
    322 #define	LIBIPSEC_ALGS_KEY_MIN_IDX	1	/* min key size */
    323 #define	LIBIPSEC_ALGS_KEY_MAX_IDX	2	/* max key size */
    324 #define	LIBIPSEC_ALGS_KEY_NUM_VAL	4	/* def, min, max, 0 */
    325 
    326 /* Error codes for IPsec algorithms management */
    327 #define	LIBIPSEC_ALGS_DIAG_ALG_EXISTS		-1
    328 #define	LIBIPSEC_ALGS_DIAG_PROTO_EXISTS		-2
    329 #define	LIBIPSEC_ALGS_DIAG_UNKN_PROTO		-3
    330 #define	LIBIPSEC_ALGS_DIAG_UNKN_ALG		-4
    331 #define	LIBIPSEC_ALGS_DIAG_NOMEM		-5
    332 #define	LIBIPSEC_ALGS_DIAG_ALGSFILEOPEN		-6
    333 #define	LIBIPSEC_ALGS_DIAG_ALGSFILEFDOPEN	-7
    334 #define	LIBIPSEC_ALGS_DIAG_ALGSFILELOCK		-8
    335 #define	LIBIPSEC_ALGS_DIAG_ALGSFILERENAME	-9
    336 #define	LIBIPSEC_ALGS_DIAG_ALGSFILEWRITE	-10
    337 #define	LIBIPSEC_ALGS_DIAG_ALGSFILECHMOD	-11
    338 #define	LIBIPSEC_ALGS_DIAG_ALGSFILECHOWN	-12
    339 #define	LIBIPSEC_ALGS_DIAG_ALGSFILECLOSE	-13
    340 
    341 /* /etc/inet/ipsecalgs keywords and package sections delimiters */
    342 #define	LIBIPSEC_ALGS_LINE_PROTO		"PROTO|"
    343 #define	LIBIPSEC_ALGS_LINE_ALG			"ALG|"
    344 #define	LIBIPSEC_ALGS_LINE_PKGSTART		"# Start "
    345 #define	LIBIPSEC_ALGS_LINE_PKGEND		"# End "
    346 
    347 /* Put these in libnsl for and process caching testing. */
    348 extern int *_real_getipsecprotos(int *);
    349 extern int *_real_getipsecalgs(int *, int);
    350 extern struct ipsecalgent *_duplicate_alg(struct ipsecalgent *);
    351 extern void _clean_trash(ipsec_proto_t *, int);
    352 
    353 /* spdsock support functions */
    354 
    355 /* Return values for spdsock_get_ext(). */
    356 #define	KGE_OK	0
    357 #define	KGE_DUP	1
    358 #define	KGE_UNK	2
    359 #define	KGE_LEN	3
    360 #define	KGE_CHK	4
    361 
    362 extern int spdsock_get_ext(spd_ext_t *[], spd_msg_t *, uint_t, char *, uint_t);
    363 extern const char *spdsock_diag(int);
    364 
    365 /* PF_KEY (keysock) support functions */
    366 extern const char *keysock_diag(int);
    367 extern int in_masktoprefix(uint8_t *, boolean_t);
    368 
    369 /* SA support functions */
    370 
    371 extern char *secs2out(unsigned int, char *, int, int);
    372 extern char *secs2str(unsigned int, char *, int);
    373 extern char *bytecnt2out(uint64_t, char *, size_t, int);
    374 extern char *bytecnt2str(uint64_t, char *, size_t);
    375 extern void print_diagnostic(FILE *, uint16_t);
    376 extern void print_sadb_msg(FILE *, struct sadb_msg *, time_t, boolean_t);
    377 extern void print_sa(FILE *, char *, struct sadb_sa *);
    378 extern void printsatime(FILE *, int64_t, const char *, const char *,
    379     const char *, boolean_t);
    380 extern void print_lifetimes(FILE *, time_t, struct sadb_lifetime *,
    381     struct sadb_lifetime *, struct sadb_lifetime *, struct sadb_lifetime *,
    382     boolean_t vflag);
    383 extern void print_address(FILE *, char *, struct sadb_address *, boolean_t);
    384 extern void print_asn1_name(FILE *, const unsigned char *, long);
    385 extern void print_key(FILE *, char *, struct sadb_key *);
    386 extern void print_ident(FILE *, char *, struct sadb_ident *);
    387 extern void print_sens(FILE *, char *, const struct sadb_sens *, boolean_t);
    388 extern void print_prop(FILE *, char *, struct sadb_prop *);
    389 extern void print_eprop(FILE *, char *, struct sadb_prop *);
    390 extern void print_supp(FILE *, char *, struct sadb_supported *);
    391 extern void print_spirange(FILE *, char *, struct sadb_spirange *);
    392 extern void print_kmc(FILE *, char *, struct sadb_x_kmc *);
    393 extern void print_samsg(FILE *, uint64_t *, boolean_t, boolean_t, boolean_t);
    394 extern char *rparsesatype(int);
    395 extern char *rparsealg(uint8_t, int);
    396 extern char *rparseidtype(uint16_t);
    397 extern boolean_t save_lifetime(struct sadb_lifetime *, FILE *);
    398 extern boolean_t save_address(struct sadb_address *, FILE *);
    399 extern boolean_t save_key(struct sadb_key *, FILE *);
    400 extern boolean_t save_ident(struct sadb_ident *, FILE *);
    401 extern void save_assoc(uint64_t *, FILE *);
    402 extern FILE *opensavefile(char *);
    403 extern const char *do_inet_ntop(const void *, char *, size_t);
    404 
    405 /*
    406  * Label conversion convenience functions.
    407  */
    408 
    409 #include <tsol/label.h>
    410 
    411 extern void ipsec_convert_sens_to_bslabel(const struct sadb_sens *,
    412     bslabel_t *);
    413 extern int ipsec_convert_sl_to_sens(int doi, bslabel_t *, struct sadb_sens *);
    414 extern void ipsec_convert_bslabel_to_string(bslabel_t *, char **);
    415 extern void ipsec_convert_bslabel_to_hex(bslabel_t *, char **);
    416 
    417 /*
    418  * These exit macros give a consistent exit behaviour for all
    419  * programs that use libipsecutil. These wll work in usr/src/cmd
    420  * and usr/src/lib, but because macros in usr/src/lib don't get
    421  * expanded when I18N message catalogs are built, avoid using
    422  * these with text inside libipsecutil. See source of ipsecutil_exit()
    423  * for more details.
    424  */
    425 #define	EXIT_OK(x) \
    426 	ipsecutil_exit(SERVICE_EXIT_OK, my_fmri, debugfile, \
    427 	dgettext(TEXT_DOMAIN, x))
    428 #define	EXIT_OK2(x, y) \
    429 	ipsecutil_exit(SERVICE_EXIT_OK, my_fmri, debugfile, \
    430 	dgettext(TEXT_DOMAIN, x), y)
    431 #define	EXIT_OK3(x, y, z) \
    432 	ipsecutil_exit(SERVICE_EXIT_OK, my_fmri, debugfile, \
    433 	dgettext(TEXT_DOMAIN, x), y, z)
    434 #define	EXIT_BADCONFIG(x) \
    435 	ipsecutil_exit(SERVICE_BADCONF, my_fmri, debugfile, \
    436 	dgettext(TEXT_DOMAIN, x))
    437 #define	EXIT_BADCONFIG2(x, y) \
    438 	ipsecutil_exit(SERVICE_BADCONF, my_fmri, debugfile, \
    439 	dgettext(TEXT_DOMAIN, x), y)
    440 #define	EXIT_BADCONFIG3(x, y, z) \
    441 	ipsecutil_exit(SERVICE_BADCONF, my_fmri, debugfile, \
    442 	dgettext(TEXT_DOMAIN, x), y, z)
    443 #define	EXIT_MAINTAIN(x) \
    444 	ipsecutil_exit(SERVICE_MAINTAIN, my_fmri, debugfile, \
    445 	dgettext(TEXT_DOMAIN, x))
    446 #define	EXIT_MAINTAIN2(x, y) \
    447 	ipsecutil_exit(SERVICE_MAINTAIN, my_fmri, debugfile, \
    448 	dgettext(TEXT_DOMAIN, x), y)
    449 #define	EXIT_DEGRADE(x) \
    450 	ipsecutil_exit(SERVICE_DEGRADE, my_fmri, debugfile, \
    451 	dgettext(TEXT_DOMAIN, x))
    452 #define	EXIT_BADPERM(x) \
    453 	ipsecutil_exit(SERVICE_BADPERM, my_fmri, debugfile, \
    454 	dgettext(TEXT_DOMAIN, x))
    455 #define	EXIT_BADPERM2(x, y) \
    456 	ipsecutil_exit(SERVICE_BADPERM, my_fmri, debugfile, \
    457 	dgettext(TEXT_DOMAIN, x), y)
    458 #define	EXIT_FATAL(x) \
    459 	ipsecutil_exit(SERVICE_FATAL, my_fmri, debugfile, \
    460 	dgettext(TEXT_DOMAIN, x))
    461 #define	EXIT_FATAL2(x, y) \
    462 	ipsecutil_exit(SERVICE_FATAL, my_fmri, debugfile, \
    463 	dgettext(TEXT_DOMAIN, x), y)
    464 #define	EXIT_FATAL3(x, y, z) \
    465 	ipsecutil_exit(SERVICE_FATAL, my_fmri, debugfile, \
    466 	dgettext(TEXT_DOMAIN, x), y, z)
    467 #define	EXIT_RESTART(x) \
    468 	ipsecutil_exit(SERVICE_RESTART, my_fmri, debugfile, \
    469 	dgettext(TEXT_DOMAIN, x))
    470 
    471 #ifdef __cplusplus
    472 }
    473 #endif
    474 
    475 #endif	/* _IPSEC_UTIL_H */
    476