usr/src/lib/libipsecutil/common/ipsec_util.h

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  23  * Use is subject to license terms.
  24  */
  25
  26 #ifndef _IPSEC_UTIL_H
  27 #define _IPSEC_UTIL_H
  28
  29 /*
  30  * Headers and definitions for support functions that are shared by
  31  * the ipsec utilities ipseckey and ikeadm.
  32  */
  33
  34 #ifdef __cplusplus
  35 extern "C" {
  36 #endif
  37
  38 #include <sys/types.h>
  39 #include <sys/socket.h>
  40 #include <net/pfkeyv2.h>
  41 #include <netinet/in.h>
  42 #include <inet/ip.h>
  43 #include <setjmp.h>
  44 #include <stdio.h>
  45 #include <err.h>
  46 #include <errfp.h>
  47 #include <net/pfpolicy.h>
  48 #include <libtecla.h>
  49
  50 #ifndef A_CNT
  51 /* macros for array manipulation */
  52 #define A_CNT(arr)      (sizeof (arr)/sizeof (arr[0]))
  53 #define A_END(arr)      (&arr[A_CNT(arr)])
  54 #endif
  55
  56 /* used for file parsing */
  57 #define NBUF_SIZE       16
  58 #define COMMENT_CHAR    '#'
  59 #define CONT_CHAR       '\\'
  60 #define QUOTE_CHAR      '"'
  61 /*
  62  * Input buffer size limits maximum line length for both file parsing and
  63  * interactive mode. 4K chars should be enough even for broad commands and
  64  * all possible key lenghts of today's symmetric ciphers entered via
  65  * ipseckey(1M) which has the most bifurcated grammar from all IPsec commands.
  66  */
  67 #define IBUF_SIZE       4096
  68
  69 /* used for command-line parsing */
  70 #define START_ARG       8
  71 #define TOO_MANY_ARGS   (START_ARG << 9)
  72
  73 /* Return codes for argv/argc vector creation */
  74 #define TOO_MANY_TOKENS         -3
  75 #define MEMORY_ALLOCATION       -2
  76 #define COMMENT_LINE            1
  77 #define SUCCESS                 0
  78
  79 /* Flags for {bytecnt,secs}2out() */
  80 #define SPC_NOSPACES    0x00000000              /* no space prefix/suffix */
  81 #define SPC_BEGIN       0x00000001              /* put space at the beginning */
  82 #define SPC_END         0x00000002              /* put space at the end */
  83 #define SPC_BOTH        SPC_BEGIN|SPC_END       /* print both spaces */
  84
  85 /*
  86  * The following lengths should be sufficient for character buffers passed to
  87  * bytecnt2str(),secs2str(). This is because the string output of these
  88  * functions consists of limited number and units. The lengths should be also
  89  * sufficient for bytecnt2out(),secs2out() functions.
  90  */
  91 #define BYTE_STR_SIZE           16
  92 #define SECS_STR_SIZE           20
  93
  94 /*
  95  * Time printing defines...
  96  *
  97  * TBUF_SIZE is pretty arbitrary.  Perhaps it shouldn't be.
  98  */
  99 #define TBUF_SIZE       50
 100 #define TIME_MAX        LONG_MAX
 101
 102 #ifndef INSECURE_PERMS
 103 #define INSECURE_PERMS(sbuf)    (((sbuf).st_uid != 0) || \
 104         ((sbuf).st_mode & S_IRWXG) || ((sbuf).st_mode & S_IRWXO))
 105 #endif
 106
 107 #ifndef PKCS11_TOKSIZE
 108 #define PKCS11_TOKSIZE 32       /* Fixed length of PKCS#11 token string len. */
 109 #endif
 110
 111 /*
 112  * Solaris UDP port used to communicate with the Solaris Cluster
 113  * daemon. It is used only when the node is booted in cluster mode.
 114  */
 115 #define CLUSTER_UDP_PORT        2005
 116
 117 /* For keyword-lookup tables */
 118 typedef struct keywdtab {
 119         uint_t  kw_tag;
 120         char    *kw_str;
 121 } keywdtab_t;
 122
 123 /*
 124  * These different exit states are designed to give consistant behaviour
 125  * when a program needs to exit because of an error. These exit_types
 126  * are used in macros, defined later in this file, which call ipsecutil_exit().
 127  * What happens when ipsecutil_exit() may differ if the command was started
 128  * on the command line or via smf(5), See ipsecutil_exit() source for details.
 129  *
 130  * Note: The calling function should decide what "debug mode" is before calling
 131  * ipsecutil_exit() with DEBUG_FATAL.
 132  */
 133 typedef enum exit_type {
 134         SERVICE_EXIT_OK,        /* Exit without error. */
 135         SERVICE_DEGRADE,        /* A hint that service should be degraded. */
 136         SERVICE_BADPERM,        /* A Permission error occured. */
 137         SERVICE_BADCONF,        /* Misconfiguration. */
 138         SERVICE_MAINTAIN,       /* smf(5) to put service in maintenance mode. */
 139         SERVICE_DISABLE,        /* Tell smf(5) to disable me. */
 140         SERVICE_FATAL,          /* Whatever happened is not fixable. */
 141         SERVICE_RESTART,        /* Tell smf(5) to restart the service. */
 142         DEBUG_FATAL             /* Exit in debug mode. */
 143 } exit_type_t;
 144
 145 /*
 146  * Function Prototypes
 147  */
 148
 149 /*
 150  * Print errno and if cmdline or readfile, exit; if interactive reset state
 151  */
 152 extern void ipsecutil_exit(exit_type_t, char *, FILE *, const char *fmt, ...);
 153 extern void bail(char *);
 154
 155 /*
 156  * Localization macro - Only to be used from usr/src/cmd because Macros
 157  * are not expanded in usr/src/lib when message catalogs are built.
 158  */
 159 #define Bail(s) bail(dgettext(TEXT_DOMAIN, s))
 160
 161 /*
 162  * Print caller-supplied, variable-arg error message, then exit if cmdline
 163  * or readfile, or reset state if interactive.
 164  */
 165 extern void bail_msg(char *, ...);
 166
 167 /*
 168  * dump_XXX functions produce ASCII output from the passed in data.
 169  *
 170  * Because certain errors need to do this stderr, dump_XXX functions
 171  * take a FILE pointer.
 172  */
 173
 174 extern int dump_sockaddr(struct sockaddr *, uint8_t, boolean_t, FILE *,
 175     boolean_t);
 176
 177 extern int dump_key(uint8_t *, uint_t, uint_t, FILE *, boolean_t);
 178
 179 extern int dump_aalg(uint8_t, FILE *);
 180
 181 extern int dump_ealg(uint8_t, FILE *);
 182
 183 /* return true if sadb string is printable (based on type), false otherwise */
 184 extern boolean_t dump_sadb_idtype(uint8_t, FILE *, int *);
 185
 186 /*
 187  * do_interactive: Enter a mode where commands are read from a file;
 188  * treat stdin special.  infile is the file cmds are read from;
 189  * promptstring is the string printed to stdout (if the cmds are
 190  * being read from stdin) to prompt for a new command; parseit is
 191  * the function to be called to process the command line once it's
 192  * been read in and broken up into an argv/argc vector.
 193  */
 194
 195 /* callback function passed in to do_interactive() */
 196 typedef void (*parse_cmdln_fn)(int, char **, char *, boolean_t);
 197
 198 extern void do_interactive(FILE *, char *, char *, char *, parse_cmdln_fn,
 199     CplMatchFn *);
 200
 201 extern uint_t lines_parsed;
 202 extern uint_t lines_added;
 203
 204 /* convert a string to an IKE_PRIV_* constant */
 205 extern int privstr2num(char *);
 206
 207 /* convert a string to a D_* debug flag */
 208 extern int dbgstr2num(char *);
 209
 210 /* convert a string of debug strings with +|- delimiters to a debug level */
 211 extern int parsedbgopts(char *);
 212
 213 /*
 214  * SSL library (OpenSSL)
 215  */
 216 #define LIBSSL  "libssl.so"
 217
 218 void libssl_load(void);
 219
 220 /*
 221  * crypto library (OpenSSL)
 222  */
 223 #define LIBCRYPTO       "libcrypto.so"
 224
 225 void libcrypto_load(void);
 226
 227 /*
 228  * functions to manipulate the kmcookie-label mapping file
 229  */
 230
 231 #define KMCFILE         "/var/run/ipsec_kmc_map"
 232
 233 /*
 234  * Insert a mapping into the file (if it's not already there), given the
 235  * new label.  Return the assigned cookie, or -1 on error.
 236  */
 237 extern int kmc_insert_mapping(char *);
 238
 239 /*
 240  * Lookup the given cookie and return its corresponding label.  Return
 241  * a pointer to the label on success, NULL on error (or if the label is
 242  * not found).
 243  */
 244 extern char *kmc_lookup_by_cookie(int);
 245
 246 /*
 247  * These globals are declared for us in ipsec_util.c, since it needs to
 248  * refer to them also...
 249  */
 250 extern boolean_t nflag; /* Avoid nameservice? */
 251 extern boolean_t pflag; /* Paranoid w.r.t. printing keying material? */
 252 extern boolean_t interactive;
 253 extern boolean_t readfile;
 254 extern uint_t lineno;
 255 extern char numprint[NBUF_SIZE];
 256
 257 /* For error recovery in interactive or read-file mode. */
 258 extern jmp_buf env;
 259
 260 /*
 261  * Back-end stuff for getalgby*().
 262  */
 263
 264 #define INET_IPSECALGSPATH      "/etc/inet/"
 265 #define INET_IPSECALGSFILE      (INET_IPSECALGSPATH "ipsecalgs")
 266
 267 /* To preserve packages delimiters in /etc/inet/ipsecalgs */
 268 typedef struct ipsecalgs_pkg {
 269         int alg_num;
 270         char *pkg_name;
 271 } ipsecalgs_pkg_t;
 272
 273 /*
 274  * The cached representation of /etc/inet/ipsecalgs is represented by:
 275  * - A dynamically-grown (optionally sorted) array of IPsec protocols
 276  * - Each protocol has an array (again, dynamically grown and sorted)
 277  *   of algorithms, each a full-fledged struct ipsecalgent.
 278  * - The getipsecalg*() routines will search the list, then duplicate the
 279  *   struct ipsecalgent and return it.
 280  */
 281
 282 typedef enum {
 283         LIBIPSEC_ALGS_EXEC_SYNC,
 284         LIBIPSEC_ALGS_EXEC_ASYNC
 285 } ipsecalgs_exec_mode_t;
 286
 287 typedef struct ipsec_proto {
 288         int proto_num;
 289         char *proto_name;
 290         char *proto_pkg;
 291         int proto_numalgs;
 292         struct ipsecalgent **proto_algs;
 293         ipsecalgs_pkg_t *proto_algs_pkgs;
 294         int proto_algs_npkgs;
 295         ipsecalgs_exec_mode_t proto_exec_mode;
 296 } ipsec_proto_t;
 297
 298 extern void _build_internal_algs(ipsec_proto_t **, int *);
 299 extern int _str_to_ipsec_exec_mode(char *, ipsecalgs_exec_mode_t *);
 300
 301 extern int addipsecalg(struct ipsecalgent *, uint_t);
 302 extern int delipsecalgbyname(const char *, int);
 303 extern int delipsecalgbynum(int, int);
 304 extern int addipsecproto(const char *, int, ipsecalgs_exec_mode_t, uint_t);
 305 extern int delipsecprotobyname(const char *);
 306 extern int delipsecprotobynum(int);
 307 extern int *getipsecprotos(int *);
 308 extern int *getipsecalgs(int *, int);
 309 extern int list_ints(FILE *, int *);
 310 extern const char *ipsecalgs_diag(int);
 311 extern int ipsecproto_get_exec_mode(int, ipsecalgs_exec_mode_t *);
 312 extern int ipsecproto_set_exec_mode(int, ipsecalgs_exec_mode_t);
 313
 314 /* Flags for add/delete routines. */
 315 #define LIBIPSEC_ALGS_ADD_FORCE 0x00000001
 316
 317 /*
 318  * Helper definitions for indices into array of key sizes when key sizes
 319  * are defined by range.
 320  */
 321 #define LIBIPSEC_ALGS_KEY_DEF_IDX       0       /* default key size */
 322 #define LIBIPSEC_ALGS_KEY_MIN_IDX       1       /* min key size */
 323 #define LIBIPSEC_ALGS_KEY_MAX_IDX       2       /* max key size */
 324 #define LIBIPSEC_ALGS_KEY_NUM_VAL       4       /* def, min, max, 0 */
 325
 326 /* Error codes for IPsec algorithms management */
 327 #define LIBIPSEC_ALGS_DIAG_ALG_EXISTS           -1
 328 #define LIBIPSEC_ALGS_DIAG_PROTO_EXISTS         -2
 329 #define LIBIPSEC_ALGS_DIAG_UNKN_PROTO           -3
 330 #define LIBIPSEC_ALGS_DIAG_UNKN_ALG             -4
 331 #define LIBIPSEC_ALGS_DIAG_NOMEM                -5
 332 #define LIBIPSEC_ALGS_DIAG_ALGSFILEOPEN         -6
 333 #define LIBIPSEC_ALGS_DIAG_ALGSFILEFDOPEN       -7
 334 #define LIBIPSEC_ALGS_DIAG_ALGSFILELOCK         -8
 335 #define LIBIPSEC_ALGS_DIAG_ALGSFILERENAME       -9
 336 #define LIBIPSEC_ALGS_DIAG_ALGSFILEWRITE        -10
 337 #define LIBIPSEC_ALGS_DIAG_ALGSFILECHMOD        -11
 338 #define LIBIPSEC_ALGS_DIAG_ALGSFILECHOWN        -12
 339 #define LIBIPSEC_ALGS_DIAG_ALGSFILECLOSE        -13
 340
 341 /* /etc/inet/ipsecalgs keywords and package sections delimiters */
 342 #define LIBIPSEC_ALGS_LINE_PROTO                "PROTO|"
 343 #define LIBIPSEC_ALGS_LINE_ALG                  "ALG|"
 344 #define LIBIPSEC_ALGS_LINE_PKGSTART             "# Start "
 345 #define LIBIPSEC_ALGS_LINE_PKGEND               "# End "
 346
 347 /* Put these in libnsl for and process caching testing. */
 348 extern int *_real_getipsecprotos(int *);
 349 extern int *_real_getipsecalgs(int *, int);
 350 extern struct ipsecalgent *_duplicate_alg(struct ipsecalgent *);
 351 extern void _clean_trash(ipsec_proto_t *, int);
 352
 353 /* spdsock support functions */
 354
 355 /* Return values for spdsock_get_ext(). */
 356 #define KGE_OK  0
 357 #define KGE_DUP 1
 358 #define KGE_UNK 2
 359 #define KGE_LEN 3
 360 #define KGE_CHK 4
 361
 362 extern int spdsock_get_ext(spd_ext_t *[], spd_msg_t *, uint_t, char *, uint_t);
 363 extern const char *spdsock_diag(int);
 364
 365 /* PF_KEY (keysock) support functions */
 366 extern const char *keysock_diag(int);
 367 extern int in_masktoprefix(uint8_t *, boolean_t);
 368
 369 /* SA support functions */
 370
 371 extern char *secs2out(unsigned int, char *, int, int);
 372 extern char *secs2str(unsigned int, char *, int);
 373 extern char *bytecnt2out(uint64_t, char *, size_t, int);
 374 extern char *bytecnt2str(uint64_t, char *, size_t);
 375 extern void print_diagnostic(FILE *, uint16_t);
 376 extern void print_sadb_msg(FILE *, struct sadb_msg *, time_t, boolean_t);
 377 extern void print_sa(FILE *, char *, struct sadb_sa *);
 378 extern void printsatime(FILE *, int64_t, const char *, const char *,
 379     const char *, boolean_t);
 380 extern void print_lifetimes(FILE *, time_t, struct sadb_lifetime *,
 381     struct sadb_lifetime *, struct sadb_lifetime *, struct sadb_lifetime *,
 382     boolean_t vflag);
 383 extern void print_address(FILE *, char *, struct sadb_address *, boolean_t);
 384 extern void print_asn1_name(FILE *, const unsigned char *, long);
 385 extern void print_key(FILE *, char *, struct sadb_key *);
 386 extern void print_ident(FILE *, char *, struct sadb_ident *);
 387 extern void print_prop(FILE *, char *, struct sadb_prop *);
 388 extern void print_eprop(FILE *, char *, struct sadb_prop *);
 389 extern void print_supp(FILE *, char *, struct sadb_supported *);
 390 extern void print_spirange(FILE *, char *, struct sadb_spirange *);
 391 extern void print_kmc(FILE *, char *, struct sadb_x_kmc *);
 392 extern void print_samsg(FILE *, uint64_t *, boolean_t, boolean_t, boolean_t);
 393 extern char *rparsesatype(int);
 394 extern char *rparsealg(uint8_t, int);
 395 extern char *rparseidtype(uint16_t);
 396 extern boolean_t save_lifetime(struct sadb_lifetime *, FILE *);
 397 extern boolean_t save_address(struct sadb_address *, FILE *);
 398 extern boolean_t save_key(struct sadb_key *, FILE *);
 399 extern boolean_t save_ident(struct sadb_ident *, FILE *);
 400 extern void save_assoc(uint64_t *, FILE *);
 401 extern FILE *opensavefile(char *);
 402 extern const char *do_inet_ntop(const void *, char *, size_t);
 403
 404 /*
 405  * These exit macros give a consistent exit behaviour for all
 406  * programs that use libipsecutil. These wll work in usr/src/cmd
 407  * and usr/src/lib, but because macros in usr/src/lib don't get
 408  * expanded when I18N message catalogs are built, avoid using
 409  * these with text inside libipsecutil. See source of ipsecutil_exit()
 410  * for more details.
 411  */
 412 #define EXIT_OK(x) \
 413         ipsecutil_exit(SERVICE_EXIT_OK, my_fmri, stderr, \
 414         dgettext(TEXT_DOMAIN, x))
 415 #define EXIT_OK2(x, y) \
 416         ipsecutil_exit(SERVICE_EXIT_OK, my_fmri, stderr, \
 417         dgettext(TEXT_DOMAIN, x), y)
 418 #define EXIT_OK3(x, y, z) \
 419         ipsecutil_exit(SERVICE_EXIT_OK, my_fmri, stderr, \
 420         dgettext(TEXT_DOMAIN, x), y, z)
 421 #define EXIT_BADCONFIG(x) \
 422         ipsecutil_exit(SERVICE_BADCONF, my_fmri, stderr, \
 423         dgettext(TEXT_DOMAIN, x))
 424 #define EXIT_BADCONFIG2(x, y) \
 425         ipsecutil_exit(SERVICE_BADCONF, my_fmri, stderr, \
 426         dgettext(TEXT_DOMAIN, x), y)
 427 #define EXIT_BADCONFIG3(x, y, z) \
 428         ipsecutil_exit(SERVICE_BADCONF, my_fmri, stderr, \
 429         dgettext(TEXT_DOMAIN, x), y, z)
 430 #define EXIT_MAINTAIN(x) \
 431         ipsecutil_exit(SERVICE_MAINTAIN, my_fmri, stderr, \
 432         dgettext(TEXT_DOMAIN, x))
 433 #define EXIT_MAINTAIN2(x, y) \
 434         ipsecutil_exit(SERVICE_MAINTAIN, my_fmri, stderr, \
 435         dgettext(TEXT_DOMAIN, x), y)
 436 #define EXIT_DEGRADE(x) \
 437         ipsecutil_exit(SERVICE_DEGRADE, my_fmri, stderr, \
 438         dgettext(TEXT_DOMAIN, x))
 439 #define EXIT_BADPERM(x) \
 440         ipsecutil_exit(SERVICE_BADPERM, my_fmri, stderr, \
 441         dgettext(TEXT_DOMAIN, x))
 442 #define EXIT_BADPERM2(x, y) \
 443         ipsecutil_exit(SERVICE_BADPERM, my_fmri, stderr, \
 444         dgettext(TEXT_DOMAIN, x), y)
 445 #define EXIT_FATAL(x) \
 446         ipsecutil_exit(SERVICE_FATAL, my_fmri, stderr, \
 447         dgettext(TEXT_DOMAIN, x))
 448 #define EXIT_FATAL2(x, y) \
 449         ipsecutil_exit(SERVICE_FATAL, my_fmri, stderr, \
 450         dgettext(TEXT_DOMAIN, x), y)
 451 #define EXIT_FATAL3(x, y, z) \
 452         ipsecutil_exit(SERVICE_FATAL, my_fmri, stderr, \
 453         dgettext(TEXT_DOMAIN, x), y, z)
 454 #define EXIT_RESTART(x) \
 455         ipsecutil_exit(SERVICE_RESTART, my_fmri, stderr, \
 456         dgettext(TEXT_DOMAIN, x))
 457
 458 #ifdef __cplusplus
 459 }
 460 #endif
 461
 462 #endif  /* _IPSEC_UTIL_H */