1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
23 * Use is subject to license terms.
24 */
25 /*
26 * Copyright 2017 Joyent, Inc.
27 */
28
29 #ifndef _IPSEC_UTIL_H
30 #define _IPSEC_UTIL_H
31
32 /*
33 * Headers and definitions for support functions that are shared by
34 * the ipsec utilities ipseckey and ikeadm.
35 */
36
37 #ifdef __cplusplus
38 extern "C" {
39 #endif
40
41 #include <sys/types.h>
42 #include <sys/socket.h>
43 #include <net/pfkeyv2.h>
44 #include <netinet/in.h>
45 #include <inet/ip.h>
46 #include <setjmp.h>
47 #include <stdio.h>
48 #include <err.h>
49 #include <errfp.h>
50 #include <net/pfpolicy.h>
51 #include <libtecla.h>
52
53 #ifndef A_CNT
54 /* macros for array manipulation */
55 #define A_CNT(arr) (sizeof (arr)/sizeof (arr[0]))
56 #define A_END(arr) (&arr[A_CNT(arr)])
57 #endif
58
59 /* used for file parsing */
60 #define NBUF_SIZE 16
61 #define COMMENT_CHAR '#'
62 #define CONT_CHAR '\\'
63 #define QUOTE_CHAR '"'
64 /*
65 * Input buffer size limits maximum line length for both file parsing and
66 * interactive mode. 4K chars should be enough even for broad commands and
67 * all possible key lenghts of today's symmetric ciphers entered via
68 * ipseckey(1M) which has the most bifurcated grammar from all IPsec commands.
69 */
70 #define IBUF_SIZE 4096
71
72 /* used for command-line parsing */
73 #define START_ARG 8
74 #define TOO_MANY_ARGS (START_ARG << 9)
75
76 /* Return codes for argv/argc vector creation */
77 #define TOO_MANY_TOKENS -3
78 #define MEMORY_ALLOCATION -2
79 #define COMMENT_LINE 1
80 #define SUCCESS 0
81
82 /* Flags for {bytecnt,secs}2out() */
83 #define SPC_NOSPACES 0x00000000 /* no space prefix/suffix */
84 #define SPC_BEGIN 0x00000001 /* put space at the beginning */
85 #define SPC_END 0x00000002 /* put space at the end */
86 #define SPC_BOTH SPC_BEGIN|SPC_END /* print both spaces */
87
88 /*
89 * The following lengths should be sufficient for character buffers passed to
90 * bytecnt2str(),secs2str(). This is because the string output of these
91 * functions consists of limited number and units. The lengths should be also
92 * sufficient for bytecnt2out(),secs2out() functions.
93 */
94 #define BYTE_STR_SIZE 16
95 #define SECS_STR_SIZE 20
96
97 /*
98 * Time printing defines...
99 *
100 * TBUF_SIZE is pretty arbitrary. Perhaps it shouldn't be.
101 */
102 #define TBUF_SIZE 50
103 #define TIME_MAX LONG_MAX
104
105 #ifndef INSECURE_PERMS
106 #define INSECURE_PERMS(sbuf) (((sbuf).st_uid != 0) || \
107 ((sbuf).st_mode & S_IRWXG) || ((sbuf).st_mode & S_IRWXO))
108 #endif
109
110 #ifndef PKCS11_TOKSIZE
111 #define PKCS11_TOKSIZE 32 /* Fixed length of PKCS#11 token string len. */
112 #endif
113
114 /*
115 * Solaris UDP port used to communicate with the Solaris Cluster
116 * daemon. It is used only when the node is booted in cluster mode.
117 */
118 #define CLUSTER_UDP_PORT 2005
119
120 /* For keyword-lookup tables */
121 typedef struct keywdtab {
122 uint_t kw_tag;
123 char *kw_str;
124 } keywdtab_t;
125
126 /*
127 * These different exit states are designed to give consistant behaviour
128 * when a program needs to exit because of an error. These exit_types
129 * are used in macros, defined later in this file, which call ipsecutil_exit().
130 * What happens when ipsecutil_exit() may differ if the command was started
131 * on the command line or via smf(5), See ipsecutil_exit() source for details.
132 *
133 * Note: The calling function should decide what "debug mode" is before calling
134 * ipsecutil_exit() with DEBUG_FATAL.
135 */
136 typedef enum exit_type {
137 SERVICE_EXIT_OK, /* Exit without error. */
138 SERVICE_DEGRADE, /* A hint that service should be degraded. */
139 SERVICE_BADPERM, /* A Permission error occured. */
140 SERVICE_BADCONF, /* Misconfiguration. */
141 SERVICE_MAINTAIN, /* smf(5) to put service in maintenance mode. */
142 SERVICE_DISABLE, /* Tell smf(5) to disable me. */
143 SERVICE_FATAL, /* Whatever happened is not fixable. */
144 SERVICE_RESTART, /* Tell smf(5) to restart the service. */
145 DEBUG_FATAL /* Exit in debug mode. */
146 } exit_type_t;
147
148 /*
149 * Function Prototypes
150 */
151
152 /*
153 * Print errno and if cmdline or readfile, exit; if interactive reset state
154 */
155 extern void ipsecutil_exit(exit_type_t, char *, FILE *, const char *fmt, ...);
156 extern void bail(char *);
157
158 /*
159 * Localization macro - Only to be used from usr/src/cmd because Macros
160 * are not expanded in usr/src/lib when message catalogs are built.
161 */
162 #define Bail(s) bail(dgettext(TEXT_DOMAIN, s))
163
164 /*
165 * Print caller-supplied, variable-arg error message, then exit if cmdline
166 * or readfile, or reset state if interactive.
167 */
168 extern void bail_msg(char *, ...);
169
170 /*
171 * dump_XXX functions produce ASCII output from the passed in data.
172 *
173 * Because certain errors need to do this stderr, dump_XXX functions
174 * take a FILE pointer.
175 */
176
177 extern int dump_sockaddr(struct sockaddr *, uint8_t, boolean_t, FILE *,
178 boolean_t);
179
180 extern int dump_key(uint8_t *, uint_t, uint_t, FILE *, boolean_t);
181
182 extern int dump_aalg(uint8_t, FILE *);
183
184 extern int dump_ealg(uint8_t, FILE *);
185
186 /* return true if sadb string is printable (based on type), false otherwise */
187 extern boolean_t dump_sadb_idtype(uint8_t, FILE *, int *);
188
189 /*
190 * do_interactive: Enter a mode where commands are read from a file;
191 * treat stdin special. infile is the file cmds are read from;
192 * promptstring is the string printed to stdout (if the cmds are
193 * being read from stdin) to prompt for a new command; parseit is
194 * the function to be called to process the command line once it's
195 * been read in and broken up into an argv/argc vector.
196 */
197
198 /* callback function passed in to do_interactive() */
199 typedef void (*parse_cmdln_fn)(int, char **, char *, boolean_t);
200
201 extern void do_interactive(FILE *, char *, char *, char *, parse_cmdln_fn,
202 CplMatchFn *);
203
204 extern uint_t lines_parsed;
205 extern uint_t lines_added;
206
207 /* convert a string to an IKE_PRIV_* constant */
208 extern int privstr2num(char *);
209
210 /* convert a string to a D_* debug flag */
211 extern int dbgstr2num(char *);
212
213 /* convert a string of debug strings with +|- delimiters to a debug level */
214 extern int parsedbgopts(char *);
215
216 /*
217 * SSL library (OpenSSL)
218 */
219 #define LIBSSL "libssl.so"
220
221 void libssl_load(void);
222
223 /*
224 * crypto library (OpenSSL)
225 */
226 #define LIBCRYPTO "libcrypto.so"
227
228 void libcrypto_load(void);
229
230 /*
231 * functions to manipulate the IKEv1 kmcookie-label mapping file
232 */
233
234 #define KMCFILE "/var/run/ipsec_kmc_map"
235
236 /*
237 * Insert a mapping into the file (if it's not already there), given the
238 * new label. Return the assigned cookie, or -1 on error.
239 */
240 extern int kmc_insert_mapping(char *);
241
242 /*
243 * Lookup the given cookie and return its corresponding label. Return
244 * a pointer to the label on success, NULL on error (or if the label is
245 * not found).
246 */
247 extern char *kmc_lookup_by_cookie(int);
248
249 /*
250 * These globals are declared for us in ipsec_util.c, since it needs to
251 * refer to them also...
252 */
253 extern boolean_t nflag; /* Avoid nameservice? */
254 extern boolean_t pflag; /* Paranoid w.r.t. printing keying material? */
255 extern boolean_t interactive;
256 extern boolean_t readfile;
257 extern uint_t lineno;
258 extern char numprint[NBUF_SIZE];
259
260 /* For error recovery in interactive or read-file mode. */
261 extern jmp_buf env;
262
263 /*
264 * Back-end stuff for getalgby*().
265 */
266
267 #define INET_IPSECALGSPATH "/etc/inet/"
268 #define INET_IPSECALGSFILE (INET_IPSECALGSPATH "ipsecalgs")
269
270 /* To preserve packages delimiters in /etc/inet/ipsecalgs */
271 typedef struct ipsecalgs_pkg {
272 int alg_num;
273 char *pkg_name;
274 } ipsecalgs_pkg_t;
275
276 /*
277 * The cached representation of /etc/inet/ipsecalgs is represented by:
278 * - A dynamically-grown (optionally sorted) array of IPsec protocols
279 * - Each protocol has an array (again, dynamically grown and sorted)
280 * of algorithms, each a full-fledged struct ipsecalgent.
281 * - The getipsecalg*() routines will search the list, then duplicate the
282 * struct ipsecalgent and return it.
283 */
284
285 typedef enum {
286 LIBIPSEC_ALGS_EXEC_SYNC,
287 LIBIPSEC_ALGS_EXEC_ASYNC
288 } ipsecalgs_exec_mode_t;
289
290 typedef struct ipsec_proto {
291 int proto_num;
292 char *proto_name;
293 char *proto_pkg;
294 int proto_numalgs;
295 struct ipsecalgent **proto_algs;
296 ipsecalgs_pkg_t *proto_algs_pkgs;
297 int proto_algs_npkgs;
298 ipsecalgs_exec_mode_t proto_exec_mode;
299 } ipsec_proto_t;
300
301 extern void _build_internal_algs(ipsec_proto_t **, int *);
302 extern int _str_to_ipsec_exec_mode(char *, ipsecalgs_exec_mode_t *);
303
304 extern int addipsecalg(struct ipsecalgent *, uint_t);
305 extern int delipsecalgbyname(const char *, int);
306 extern int delipsecalgbynum(int, int);
307 extern int addipsecproto(const char *, int, ipsecalgs_exec_mode_t, uint_t);
308 extern int delipsecprotobyname(const char *);
309 extern int delipsecprotobynum(int);
310 extern int *getipsecprotos(int *);
311 extern int *getipsecalgs(int *, int);
312 extern int list_ints(FILE *, int *);
313 extern const char *ipsecalgs_diag(int);
314 extern int ipsecproto_get_exec_mode(int, ipsecalgs_exec_mode_t *);
315 extern int ipsecproto_set_exec_mode(int, ipsecalgs_exec_mode_t);
316
317 /* Flags for add/delete routines. */
318 #define LIBIPSEC_ALGS_ADD_FORCE 0x00000001
319
320 /*
321 * Helper definitions for indices into array of key sizes when key sizes
322 * are defined by range.
323 */
324 #define LIBIPSEC_ALGS_KEY_DEF_IDX 0 /* default key size */
325 #define LIBIPSEC_ALGS_KEY_MIN_IDX 1 /* min key size */
326 #define LIBIPSEC_ALGS_KEY_MAX_IDX 2 /* max key size */
327 #define LIBIPSEC_ALGS_KEY_NUM_VAL 4 /* def, min, max, 0 */
328
329 /* Error codes for IPsec algorithms management */
330 #define LIBIPSEC_ALGS_DIAG_ALG_EXISTS -1
331 #define LIBIPSEC_ALGS_DIAG_PROTO_EXISTS -2
332 #define LIBIPSEC_ALGS_DIAG_UNKN_PROTO -3
333 #define LIBIPSEC_ALGS_DIAG_UNKN_ALG -4
334 #define LIBIPSEC_ALGS_DIAG_NOMEM -5
335 #define LIBIPSEC_ALGS_DIAG_ALGSFILEOPEN -6
336 #define LIBIPSEC_ALGS_DIAG_ALGSFILEFDOPEN -7
337 #define LIBIPSEC_ALGS_DIAG_ALGSFILELOCK -8
338 #define LIBIPSEC_ALGS_DIAG_ALGSFILERENAME -9
339 #define LIBIPSEC_ALGS_DIAG_ALGSFILEWRITE -10
340 #define LIBIPSEC_ALGS_DIAG_ALGSFILECHMOD -11
341 #define LIBIPSEC_ALGS_DIAG_ALGSFILECHOWN -12
342 #define LIBIPSEC_ALGS_DIAG_ALGSFILECLOSE -13
343
344 /* /etc/inet/ipsecalgs keywords and package sections delimiters */
345 #define LIBIPSEC_ALGS_LINE_PROTO "PROTO|"
346 #define LIBIPSEC_ALGS_LINE_ALG "ALG|"
347 #define LIBIPSEC_ALGS_LINE_PKGSTART "# Start "
348 #define LIBIPSEC_ALGS_LINE_PKGEND "# End "
349
350 /* Put these in libnsl for and process caching testing. */
351 extern int *_real_getipsecprotos(int *);
352 extern int *_real_getipsecalgs(int *, int);
353 extern struct ipsecalgent *_duplicate_alg(struct ipsecalgent *);
354 extern void _clean_trash(ipsec_proto_t *, int);
355
356 /* spdsock support functions */
357
358 /* Return values for spdsock_get_ext(). */
359 #define KGE_OK 0
360 #define KGE_DUP 1
361 #define KGE_UNK 2
362 #define KGE_LEN 3
363 #define KGE_CHK 4
364
365 extern int spdsock_get_ext(spd_ext_t *[], spd_msg_t *, uint_t, char *, uint_t);
366 extern const char *spdsock_diag(int);
367
368 /* PF_KEY (keysock) support functions */
369 extern const char *keysock_diag(int);
370 extern int in_masktoprefix(uint8_t *, boolean_t);
371
372 /* SA support functions */
373
374 extern char *secs2out(unsigned int, char *, int, int);
375 extern char *secs2str(unsigned int, char *, int);
376 extern char *bytecnt2out(uint64_t, char *, size_t, int);
377 extern char *bytecnt2str(uint64_t, char *, size_t);
378 extern void print_diagnostic(FILE *, uint16_t);
379 extern void print_sadb_msg(FILE *, struct sadb_msg *, time_t, boolean_t);
380 extern void print_sa(FILE *, char *, struct sadb_sa *);
381 extern void printsatime(FILE *, int64_t, const char *, const char *,
382 const char *, boolean_t);
383 extern void print_lifetimes(FILE *, time_t, struct sadb_lifetime *,
384 struct sadb_lifetime *, struct sadb_lifetime *, struct sadb_lifetime *,
385 boolean_t vflag);
386 extern void print_address(FILE *, char *, struct sadb_address *, boolean_t);
387 extern void print_asn1_name(FILE *, const unsigned char *, long);
388 extern void print_key(FILE *, char *, struct sadb_key *);
389 extern void print_ident(FILE *, char *, struct sadb_ident *);
390 extern void print_sens(FILE *, char *, const struct sadb_sens *, boolean_t);
391 extern void print_prop(FILE *, char *, struct sadb_prop *);
392 extern void print_eprop(FILE *, char *, struct sadb_prop *);
393 extern void print_supp(FILE *, char *, struct sadb_supported *);
394 extern void print_spirange(FILE *, char *, struct sadb_spirange *);
395 extern void print_kmc(FILE *, char *, struct sadb_x_kmc *);
396 extern void print_samsg(FILE *, uint64_t *, boolean_t, boolean_t, boolean_t);
397 extern char *rparsesatype(int);
398 extern char *rparsealg(uint8_t, int);
399 extern char *rparseidtype(uint16_t);
400 extern boolean_t save_lifetime(struct sadb_lifetime *, FILE *);
401 extern boolean_t save_address(struct sadb_address *, FILE *);
402 extern boolean_t save_key(struct sadb_key *, FILE *);
403 extern boolean_t save_ident(struct sadb_ident *, FILE *);
404 extern void save_assoc(uint64_t *, FILE *);
405 extern FILE *opensavefile(char *);
406 extern const char *do_inet_ntop(const void *, char *, size_t);
407
408 /*
409 * Label conversion convenience functions.
410 */
411
412 #include <tsol/label.h>
413
414 extern void ipsec_convert_sens_to_bslabel(const struct sadb_sens *,
415 bslabel_t *);
416 extern int ipsec_convert_sl_to_sens(int doi, bslabel_t *, struct sadb_sens *);
417 extern void ipsec_convert_bslabel_to_string(bslabel_t *, char **);
418 extern void ipsec_convert_bslabel_to_hex(bslabel_t *, char **);
419
420 /*
421 * These exit macros give a consistent exit behaviour for all
422 * programs that use libipsecutil. These wll work in usr/src/cmd
423 * and usr/src/lib, but because macros in usr/src/lib don't get
424 * expanded when I18N message catalogs are built, avoid using
425 * these with text inside libipsecutil. See source of ipsecutil_exit()
426 * for more details.
427 */
428 #define EXIT_OK(x) \
429 ipsecutil_exit(SERVICE_EXIT_OK, my_fmri, debugfile, \
430 dgettext(TEXT_DOMAIN, x))
431 #define EXIT_OK2(x, y) \
432 ipsecutil_exit(SERVICE_EXIT_OK, my_fmri, debugfile, \
433 dgettext(TEXT_DOMAIN, x), y)
434 #define EXIT_OK3(x, y, z) \
435 ipsecutil_exit(SERVICE_EXIT_OK, my_fmri, debugfile, \
436 dgettext(TEXT_DOMAIN, x), y, z)
437 #define EXIT_BADCONFIG(x) \
438 ipsecutil_exit(SERVICE_BADCONF, my_fmri, debugfile, \
439 dgettext(TEXT_DOMAIN, x))
440 #define EXIT_BADCONFIG2(x, y) \
441 ipsecutil_exit(SERVICE_BADCONF, my_fmri, debugfile, \
442 dgettext(TEXT_DOMAIN, x), y)
443 #define EXIT_BADCONFIG3(x, y, z) \
444 ipsecutil_exit(SERVICE_BADCONF, my_fmri, debugfile, \
445 dgettext(TEXT_DOMAIN, x), y, z)
446 #define EXIT_MAINTAIN(x) \
447 ipsecutil_exit(SERVICE_MAINTAIN, my_fmri, debugfile, \
448 dgettext(TEXT_DOMAIN, x))
449 #define EXIT_MAINTAIN2(x, y) \
450 ipsecutil_exit(SERVICE_MAINTAIN, my_fmri, debugfile, \
451 dgettext(TEXT_DOMAIN, x), y)
452 #define EXIT_DEGRADE(x) \
453 ipsecutil_exit(SERVICE_DEGRADE, my_fmri, debugfile, \
454 dgettext(TEXT_DOMAIN, x))
455 #define EXIT_BADPERM(x) \
456 ipsecutil_exit(SERVICE_BADPERM, my_fmri, debugfile, \
457 dgettext(TEXT_DOMAIN, x))
458 #define EXIT_BADPERM2(x, y) \
459 ipsecutil_exit(SERVICE_BADPERM, my_fmri, debugfile, \
460 dgettext(TEXT_DOMAIN, x), y)
461 #define EXIT_FATAL(x) \
462 ipsecutil_exit(SERVICE_FATAL, my_fmri, debugfile, \
463 dgettext(TEXT_DOMAIN, x))
464 #define EXIT_FATAL2(x, y) \
465 ipsecutil_exit(SERVICE_FATAL, my_fmri, debugfile, \
466 dgettext(TEXT_DOMAIN, x), y)
467 #define EXIT_FATAL3(x, y, z) \
468 ipsecutil_exit(SERVICE_FATAL, my_fmri, debugfile, \
469 dgettext(TEXT_DOMAIN, x), y, z)
470 #define EXIT_RESTART(x) \
471 ipsecutil_exit(SERVICE_RESTART, my_fmri, debugfile, \
472 dgettext(TEXT_DOMAIN, x))
473
474 #ifdef __cplusplus
475 }
476 #endif
477
478 #endif /* _IPSEC_UTIL_H */