Print this page
fromto and inbound worker
| Split |
Close |
| Expand all |
| Collapse all |
--- old/usr/src/lib/libipsecutil/common/ipsec_util.h
+++ new/usr/src/lib/libipsecutil/common/ipsec_util.h
1 1 /*
2 2 * CDDL HEADER START
3 3 *
4 4 * The contents of this file are subject to the terms of the
5 5 * Common Development and Distribution License (the "License").
6 6 * You may not use this file except in compliance with the License.
7 7 *
8 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 9 * or http://www.opensolaris.org/os/licensing.
10 10 * See the License for the specific language governing permissions
11 11 * and limitations under the License.
12 12 *
13 13 * When distributing Covered Code, include this CDDL HEADER in each
14 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 15 * If applicable, add the following below this CDDL HEADER, with the
16 16 * fields enclosed by brackets "[]" replaced with your own identifying
17 17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 18 *
19 19 * CDDL HEADER END
20 20 */
21 21 /*
22 22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
23 23 * Use is subject to license terms.
24 24 */
25 25
26 26 #ifndef _IPSEC_UTIL_H
27 27 #define _IPSEC_UTIL_H
28 28
29 29 /*
30 30 * Headers and definitions for support functions that are shared by
31 31 * the ipsec utilities ipseckey and ikeadm.
32 32 */
33 33
34 34 #ifdef __cplusplus
35 35 extern "C" {
36 36 #endif
37 37
38 38 #include <sys/types.h>
39 39 #include <sys/socket.h>
40 40 #include <net/pfkeyv2.h>
41 41 #include <netinet/in.h>
42 42 #include <inet/ip.h>
43 43 #include <setjmp.h>
44 44 #include <stdio.h>
45 45 #include <err.h>
46 46 #include <errfp.h>
47 47 #include <net/pfpolicy.h>
48 48 #include <libtecla.h>
49 49
50 50 #ifndef A_CNT
51 51 /* macros for array manipulation */
52 52 #define A_CNT(arr) (sizeof (arr)/sizeof (arr[0]))
53 53 #define A_END(arr) (&arr[A_CNT(arr)])
54 54 #endif
55 55
56 56 /* used for file parsing */
57 57 #define NBUF_SIZE 16
58 58 #define COMMENT_CHAR '#'
59 59 #define CONT_CHAR '\\'
60 60 #define QUOTE_CHAR '"'
61 61 /*
62 62 * Input buffer size limits maximum line length for both file parsing and
63 63 * interactive mode. 4K chars should be enough even for broad commands and
64 64 * all possible key lenghts of today's symmetric ciphers entered via
65 65 * ipseckey(1M) which has the most bifurcated grammar from all IPsec commands.
66 66 */
67 67 #define IBUF_SIZE 4096
68 68
69 69 /* used for command-line parsing */
70 70 #define START_ARG 8
71 71 #define TOO_MANY_ARGS (START_ARG << 9)
72 72
73 73 /* Return codes for argv/argc vector creation */
74 74 #define TOO_MANY_TOKENS -3
75 75 #define MEMORY_ALLOCATION -2
76 76 #define COMMENT_LINE 1
77 77 #define SUCCESS 0
78 78
79 79 /* Flags for {bytecnt,secs}2out() */
80 80 #define SPC_NOSPACES 0x00000000 /* no space prefix/suffix */
81 81 #define SPC_BEGIN 0x00000001 /* put space at the beginning */
82 82 #define SPC_END 0x00000002 /* put space at the end */
83 83 #define SPC_BOTH SPC_BEGIN|SPC_END /* print both spaces */
84 84
85 85 /*
86 86 * The following lengths should be sufficient for character buffers passed to
87 87 * bytecnt2str(),secs2str(). This is because the string output of these
88 88 * functions consists of limited number and units. The lengths should be also
89 89 * sufficient for bytecnt2out(),secs2out() functions.
90 90 */
91 91 #define BYTE_STR_SIZE 16
92 92 #define SECS_STR_SIZE 20
93 93
94 94 /*
95 95 * Time printing defines...
96 96 *
97 97 * TBUF_SIZE is pretty arbitrary. Perhaps it shouldn't be.
98 98 */
99 99 #define TBUF_SIZE 50
100 100 #define TIME_MAX LONG_MAX
101 101
102 102 #ifndef INSECURE_PERMS
103 103 #define INSECURE_PERMS(sbuf) (((sbuf).st_uid != 0) || \
104 104 ((sbuf).st_mode & S_IRWXG) || ((sbuf).st_mode & S_IRWXO))
105 105 #endif
106 106
107 107 #ifndef PKCS11_TOKSIZE
108 108 #define PKCS11_TOKSIZE 32 /* Fixed length of PKCS#11 token string len. */
109 109 #endif
110 110
111 111 /*
112 112 * Solaris UDP port used to communicate with the Solaris Cluster
113 113 * daemon. It is used only when the node is booted in cluster mode.
114 114 */
115 115 #define CLUSTER_UDP_PORT 2005
116 116
117 117 /* For keyword-lookup tables */
118 118 typedef struct keywdtab {
119 119 uint_t kw_tag;
120 120 char *kw_str;
121 121 } keywdtab_t;
122 122
123 123 /*
124 124 * These different exit states are designed to give consistant behaviour
125 125 * when a program needs to exit because of an error. These exit_types
126 126 * are used in macros, defined later in this file, which call ipsecutil_exit().
127 127 * What happens when ipsecutil_exit() may differ if the command was started
128 128 * on the command line or via smf(5), See ipsecutil_exit() source for details.
129 129 *
130 130 * Note: The calling function should decide what "debug mode" is before calling
131 131 * ipsecutil_exit() with DEBUG_FATAL.
132 132 */
133 133 typedef enum exit_type {
134 134 SERVICE_EXIT_OK, /* Exit without error. */
135 135 SERVICE_DEGRADE, /* A hint that service should be degraded. */
136 136 SERVICE_BADPERM, /* A Permission error occured. */
137 137 SERVICE_BADCONF, /* Misconfiguration. */
138 138 SERVICE_MAINTAIN, /* smf(5) to put service in maintenance mode. */
139 139 SERVICE_DISABLE, /* Tell smf(5) to disable me. */
140 140 SERVICE_FATAL, /* Whatever happened is not fixable. */
141 141 SERVICE_RESTART, /* Tell smf(5) to restart the service. */
142 142 DEBUG_FATAL /* Exit in debug mode. */
143 143 } exit_type_t;
144 144
145 145 /*
146 146 * Function Prototypes
147 147 */
148 148
149 149 /*
150 150 * Print errno and if cmdline or readfile, exit; if interactive reset state
151 151 */
152 152 extern void ipsecutil_exit(exit_type_t, char *, FILE *, const char *fmt, ...);
153 153 extern void bail(char *);
154 154
155 155 /*
156 156 * Localization macro - Only to be used from usr/src/cmd because Macros
157 157 * are not expanded in usr/src/lib when message catalogs are built.
158 158 */
159 159 #define Bail(s) bail(dgettext(TEXT_DOMAIN, s))
160 160
161 161 /*
162 162 * Print caller-supplied, variable-arg error message, then exit if cmdline
163 163 * or readfile, or reset state if interactive.
164 164 */
165 165 extern void bail_msg(char *, ...);
166 166
167 167 /*
168 168 * dump_XXX functions produce ASCII output from the passed in data.
169 169 *
170 170 * Because certain errors need to do this stderr, dump_XXX functions
171 171 * take a FILE pointer.
172 172 */
173 173
174 174 extern int dump_sockaddr(struct sockaddr *, uint8_t, boolean_t, FILE *,
175 175 boolean_t);
176 176
177 177 extern int dump_key(uint8_t *, uint_t, uint_t, FILE *, boolean_t);
178 178
179 179 extern int dump_aalg(uint8_t, FILE *);
180 180
181 181 extern int dump_ealg(uint8_t, FILE *);
182 182
183 183 /* return true if sadb string is printable (based on type), false otherwise */
184 184 extern boolean_t dump_sadb_idtype(uint8_t, FILE *, int *);
185 185
186 186 /*
187 187 * do_interactive: Enter a mode where commands are read from a file;
188 188 * treat stdin special. infile is the file cmds are read from;
189 189 * promptstring is the string printed to stdout (if the cmds are
190 190 * being read from stdin) to prompt for a new command; parseit is
191 191 * the function to be called to process the command line once it's
192 192 * been read in and broken up into an argv/argc vector.
193 193 */
194 194
195 195 /* callback function passed in to do_interactive() */
196 196 typedef void (*parse_cmdln_fn)(int, char **, char *, boolean_t);
197 197
198 198 extern void do_interactive(FILE *, char *, char *, char *, parse_cmdln_fn,
199 199 CplMatchFn *);
200 200
201 201 extern uint_t lines_parsed;
202 202 extern uint_t lines_added;
203 203
204 204 /* convert a string to an IKE_PRIV_* constant */
205 205 extern int privstr2num(char *);
206 206
207 207 /* convert a string to a D_* debug flag */
208 208 extern int dbgstr2num(char *);
209 209
210 210 /* convert a string of debug strings with +|- delimiters to a debug level */
211 211 extern int parsedbgopts(char *);
212 212
213 213 /*
214 214 * SSL library (OpenSSL)
215 215 */
216 216 #define LIBSSL "libssl.so"
217 217
218 218 void libssl_load(void);
219 219
220 220 /*
221 221 * crypto library (OpenSSL)
222 222 */
223 223 #define LIBCRYPTO "libcrypto.so"
224 224
225 225 void libcrypto_load(void);
226 226
227 227 /*
228 228 * functions to manipulate the kmcookie-label mapping file
229 229 */
230 230
231 231 #define KMCFILE "/var/run/ipsec_kmc_map"
232 232
233 233 /*
234 234 * Insert a mapping into the file (if it's not already there), given the
235 235 * new label. Return the assigned cookie, or -1 on error.
236 236 */
237 237 extern int kmc_insert_mapping(char *);
238 238
239 239 /*
240 240 * Lookup the given cookie and return its corresponding label. Return
241 241 * a pointer to the label on success, NULL on error (or if the label is
242 242 * not found).
243 243 */
244 244 extern char *kmc_lookup_by_cookie(int);
245 245
246 246 /*
247 247 * These globals are declared for us in ipsec_util.c, since it needs to
248 248 * refer to them also...
249 249 */
250 250 extern boolean_t nflag; /* Avoid nameservice? */
251 251 extern boolean_t pflag; /* Paranoid w.r.t. printing keying material? */
252 252 extern boolean_t interactive;
253 253 extern boolean_t readfile;
254 254 extern uint_t lineno;
255 255 extern char numprint[NBUF_SIZE];
256 256
257 257 /* For error recovery in interactive or read-file mode. */
258 258 extern jmp_buf env;
259 259
260 260 /*
261 261 * Back-end stuff for getalgby*().
262 262 */
263 263
264 264 #define INET_IPSECALGSPATH "/etc/inet/"
265 265 #define INET_IPSECALGSFILE (INET_IPSECALGSPATH "ipsecalgs")
266 266
267 267 /* To preserve packages delimiters in /etc/inet/ipsecalgs */
268 268 typedef struct ipsecalgs_pkg {
269 269 int alg_num;
270 270 char *pkg_name;
271 271 } ipsecalgs_pkg_t;
272 272
273 273 /*
274 274 * The cached representation of /etc/inet/ipsecalgs is represented by:
275 275 * - A dynamically-grown (optionally sorted) array of IPsec protocols
276 276 * - Each protocol has an array (again, dynamically grown and sorted)
277 277 * of algorithms, each a full-fledged struct ipsecalgent.
278 278 * - The getipsecalg*() routines will search the list, then duplicate the
279 279 * struct ipsecalgent and return it.
280 280 */
281 281
282 282 typedef enum {
283 283 LIBIPSEC_ALGS_EXEC_SYNC,
284 284 LIBIPSEC_ALGS_EXEC_ASYNC
285 285 } ipsecalgs_exec_mode_t;
286 286
287 287 typedef struct ipsec_proto {
288 288 int proto_num;
289 289 char *proto_name;
290 290 char *proto_pkg;
291 291 int proto_numalgs;
292 292 struct ipsecalgent **proto_algs;
293 293 ipsecalgs_pkg_t *proto_algs_pkgs;
294 294 int proto_algs_npkgs;
295 295 ipsecalgs_exec_mode_t proto_exec_mode;
296 296 } ipsec_proto_t;
297 297
298 298 extern void _build_internal_algs(ipsec_proto_t **, int *);
299 299 extern int _str_to_ipsec_exec_mode(char *, ipsecalgs_exec_mode_t *);
300 300
301 301 extern int addipsecalg(struct ipsecalgent *, uint_t);
302 302 extern int delipsecalgbyname(const char *, int);
303 303 extern int delipsecalgbynum(int, int);
304 304 extern int addipsecproto(const char *, int, ipsecalgs_exec_mode_t, uint_t);
305 305 extern int delipsecprotobyname(const char *);
306 306 extern int delipsecprotobynum(int);
307 307 extern int *getipsecprotos(int *);
308 308 extern int *getipsecalgs(int *, int);
309 309 extern int list_ints(FILE *, int *);
310 310 extern const char *ipsecalgs_diag(int);
311 311 extern int ipsecproto_get_exec_mode(int, ipsecalgs_exec_mode_t *);
312 312 extern int ipsecproto_set_exec_mode(int, ipsecalgs_exec_mode_t);
313 313
314 314 /* Flags for add/delete routines. */
315 315 #define LIBIPSEC_ALGS_ADD_FORCE 0x00000001
316 316
317 317 /*
318 318 * Helper definitions for indices into array of key sizes when key sizes
319 319 * are defined by range.
320 320 */
321 321 #define LIBIPSEC_ALGS_KEY_DEF_IDX 0 /* default key size */
322 322 #define LIBIPSEC_ALGS_KEY_MIN_IDX 1 /* min key size */
323 323 #define LIBIPSEC_ALGS_KEY_MAX_IDX 2 /* max key size */
324 324 #define LIBIPSEC_ALGS_KEY_NUM_VAL 4 /* def, min, max, 0 */
325 325
326 326 /* Error codes for IPsec algorithms management */
327 327 #define LIBIPSEC_ALGS_DIAG_ALG_EXISTS -1
328 328 #define LIBIPSEC_ALGS_DIAG_PROTO_EXISTS -2
329 329 #define LIBIPSEC_ALGS_DIAG_UNKN_PROTO -3
330 330 #define LIBIPSEC_ALGS_DIAG_UNKN_ALG -4
331 331 #define LIBIPSEC_ALGS_DIAG_NOMEM -5
332 332 #define LIBIPSEC_ALGS_DIAG_ALGSFILEOPEN -6
333 333 #define LIBIPSEC_ALGS_DIAG_ALGSFILEFDOPEN -7
334 334 #define LIBIPSEC_ALGS_DIAG_ALGSFILELOCK -8
335 335 #define LIBIPSEC_ALGS_DIAG_ALGSFILERENAME -9
336 336 #define LIBIPSEC_ALGS_DIAG_ALGSFILEWRITE -10
337 337 #define LIBIPSEC_ALGS_DIAG_ALGSFILECHMOD -11
338 338 #define LIBIPSEC_ALGS_DIAG_ALGSFILECHOWN -12
339 339 #define LIBIPSEC_ALGS_DIAG_ALGSFILECLOSE -13
340 340
341 341 /* /etc/inet/ipsecalgs keywords and package sections delimiters */
342 342 #define LIBIPSEC_ALGS_LINE_PROTO "PROTO|"
343 343 #define LIBIPSEC_ALGS_LINE_ALG "ALG|"
344 344 #define LIBIPSEC_ALGS_LINE_PKGSTART "# Start "
345 345 #define LIBIPSEC_ALGS_LINE_PKGEND "# End "
346 346
347 347 /* Put these in libnsl for and process caching testing. */
348 348 extern int *_real_getipsecprotos(int *);
349 349 extern int *_real_getipsecalgs(int *, int);
350 350 extern struct ipsecalgent *_duplicate_alg(struct ipsecalgent *);
351 351 extern void _clean_trash(ipsec_proto_t *, int);
352 352
353 353 /* spdsock support functions */
354 354
355 355 /* Return values for spdsock_get_ext(). */
356 356 #define KGE_OK 0
357 357 #define KGE_DUP 1
358 358 #define KGE_UNK 2
359 359 #define KGE_LEN 3
360 360 #define KGE_CHK 4
361 361
362 362 extern int spdsock_get_ext(spd_ext_t *[], spd_msg_t *, uint_t, char *, uint_t);
363 363 extern const char *spdsock_diag(int);
364 364
365 365 /* PF_KEY (keysock) support functions */
366 366 extern const char *keysock_diag(int);
367 367 extern int in_masktoprefix(uint8_t *, boolean_t);
368 368
369 369 /* SA support functions */
370 370
371 371 extern char *secs2out(unsigned int, char *, int, int);
372 372 extern char *secs2str(unsigned int, char *, int);
373 373 extern char *bytecnt2out(uint64_t, char *, size_t, int);
374 374 extern char *bytecnt2str(uint64_t, char *, size_t);
375 375 extern void print_diagnostic(FILE *, uint16_t);
376 376 extern void print_sadb_msg(FILE *, struct sadb_msg *, time_t, boolean_t);
377 377 extern void print_sa(FILE *, char *, struct sadb_sa *);
378 378 extern void printsatime(FILE *, int64_t, const char *, const char *,
379 379 const char *, boolean_t);
380 380 extern void print_lifetimes(FILE *, time_t, struct sadb_lifetime *,
381 381 struct sadb_lifetime *, struct sadb_lifetime *, struct sadb_lifetime *,
382 382 boolean_t vflag);
383 383 extern void print_address(FILE *, char *, struct sadb_address *, boolean_t);
384 384 extern void print_asn1_name(FILE *, const unsigned char *, long);
385 385 extern void print_key(FILE *, char *, struct sadb_key *);
386 386 extern void print_ident(FILE *, char *, struct sadb_ident *);
387 387 extern void print_sens(FILE *, char *, const struct sadb_sens *, boolean_t);
388 388 extern void print_prop(FILE *, char *, struct sadb_prop *);
389 389 extern void print_eprop(FILE *, char *, struct sadb_prop *);
390 390 extern void print_supp(FILE *, char *, struct sadb_supported *);
391 391 extern void print_spirange(FILE *, char *, struct sadb_spirange *);
392 392 extern void print_kmc(FILE *, char *, struct sadb_x_kmc *);
393 393 extern void print_samsg(FILE *, uint64_t *, boolean_t, boolean_t, boolean_t);
394 394 extern char *rparsesatype(int);
395 395 extern char *rparsealg(uint8_t, int);
396 396 extern char *rparseidtype(uint16_t);
397 397 extern boolean_t save_lifetime(struct sadb_lifetime *, FILE *);
398 398 extern boolean_t save_address(struct sadb_address *, FILE *);
399 399 extern boolean_t save_key(struct sadb_key *, FILE *);
400 400 extern boolean_t save_ident(struct sadb_ident *, FILE *);
401 401 extern void save_assoc(uint64_t *, FILE *);
402 402 extern FILE *opensavefile(char *);
403 403 extern const char *do_inet_ntop(const void *, char *, size_t);
404 404
405 405 /*
406 406 * Label conversion convenience functions.
407 407 */
408 408
409 409 #include <tsol/label.h>
410 410
411 411 extern void ipsec_convert_sens_to_bslabel(const struct sadb_sens *,
412 412 bslabel_t *);
413 413 extern int ipsec_convert_sl_to_sens(int doi, bslabel_t *, struct sadb_sens *);
414 414 extern void ipsec_convert_bslabel_to_string(bslabel_t *, char **);
415 415 extern void ipsec_convert_bslabel_to_hex(bslabel_t *, char **);
416 416
417 417 /*
418 418 * These exit macros give a consistent exit behaviour for all
419 419 * programs that use libipsecutil. These wll work in usr/src/cmd
420 420 * and usr/src/lib, but because macros in usr/src/lib don't get
421 421 * expanded when I18N message catalogs are built, avoid using
422 422 * these with text inside libipsecutil. See source of ipsecutil_exit()
423 423 * for more details.
424 424 */
425 425 #define EXIT_OK(x) \
426 426 ipsecutil_exit(SERVICE_EXIT_OK, my_fmri, debugfile, \
427 427 dgettext(TEXT_DOMAIN, x))
428 428 #define EXIT_OK2(x, y) \
429 429 ipsecutil_exit(SERVICE_EXIT_OK, my_fmri, debugfile, \
430 430 dgettext(TEXT_DOMAIN, x), y)
431 431 #define EXIT_OK3(x, y, z) \
432 432 ipsecutil_exit(SERVICE_EXIT_OK, my_fmri, debugfile, \
433 433 dgettext(TEXT_DOMAIN, x), y, z)
434 434 #define EXIT_BADCONFIG(x) \
435 435 ipsecutil_exit(SERVICE_BADCONF, my_fmri, debugfile, \
436 436 dgettext(TEXT_DOMAIN, x))
437 437 #define EXIT_BADCONFIG2(x, y) \
438 438 ipsecutil_exit(SERVICE_BADCONF, my_fmri, debugfile, \
439 439 dgettext(TEXT_DOMAIN, x), y)
440 440 #define EXIT_BADCONFIG3(x, y, z) \
441 441 ipsecutil_exit(SERVICE_BADCONF, my_fmri, debugfile, \
442 442 dgettext(TEXT_DOMAIN, x), y, z)
443 443 #define EXIT_MAINTAIN(x) \
444 444 ipsecutil_exit(SERVICE_MAINTAIN, my_fmri, debugfile, \
445 445 dgettext(TEXT_DOMAIN, x))
446 446 #define EXIT_MAINTAIN2(x, y) \
447 447 ipsecutil_exit(SERVICE_MAINTAIN, my_fmri, debugfile, \
|
↓ open down ↓ |
447 lines elided |
↑ open up ↑ |
448 448 dgettext(TEXT_DOMAIN, x), y)
449 449 #define EXIT_DEGRADE(x) \
450 450 ipsecutil_exit(SERVICE_DEGRADE, my_fmri, debugfile, \
451 451 dgettext(TEXT_DOMAIN, x))
452 452 #define EXIT_BADPERM(x) \
453 453 ipsecutil_exit(SERVICE_BADPERM, my_fmri, debugfile, \
454 454 dgettext(TEXT_DOMAIN, x))
455 455 #define EXIT_BADPERM2(x, y) \
456 456 ipsecutil_exit(SERVICE_BADPERM, my_fmri, debugfile, \
457 457 dgettext(TEXT_DOMAIN, x), y)
458 +#define EXIT_BADPERM3(x, y, z) \
459 + ipsecutil_exit(SERVICE_BADPERM, my_fmri, debugfile, \
460 + dgettext(TEXT_DOMAIN, x), y, z)
458 461 #define EXIT_FATAL(x) \
459 462 ipsecutil_exit(SERVICE_FATAL, my_fmri, debugfile, \
460 463 dgettext(TEXT_DOMAIN, x))
461 464 #define EXIT_FATAL2(x, y) \
462 465 ipsecutil_exit(SERVICE_FATAL, my_fmri, debugfile, \
463 466 dgettext(TEXT_DOMAIN, x), y)
464 467 #define EXIT_FATAL3(x, y, z) \
465 468 ipsecutil_exit(SERVICE_FATAL, my_fmri, debugfile, \
466 469 dgettext(TEXT_DOMAIN, x), y, z)
470 +#define EXIT_FATAL4(x, y, z, z2) \
471 + ipsecutil_exit(SERVICE_FATAL, my_fmri, debugfile, \
472 + dgettext(TEXT_DOMAIN, x), y, z, z2)
467 473 #define EXIT_RESTART(x) \
468 474 ipsecutil_exit(SERVICE_RESTART, my_fmri, debugfile, \
469 475 dgettext(TEXT_DOMAIN, x))
470 476
471 477 #ifdef __cplusplus
472 478 }
473 479 #endif
474 480
475 481 #endif /* _IPSEC_UTIL_H */
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX