1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 /*
26  * Copyright 2018 Joyent, Inc.
27  */
28 
29 #ifndef	_IPSEC_UTIL_H
30 #define	_IPSEC_UTIL_H
31 
32 /*
33  * Headers and definitions for support functions that are shared by
34  * the ipsec utilities ipseckey and ikeadm.
35  */
36 
37 #ifdef __cplusplus
38 extern "C" {
39 #endif
40 
41 #include <sys/types.h>
42 #include <sys/socket.h>
43 #include <net/pfkeyv2.h>
44 #include <netinet/in.h>
45 #include <inet/ip.h>
46 #include <setjmp.h>
47 #include <stdio.h>
48 #include <err.h>
49 #include <errfp.h>
50 #include <net/pfpolicy.h>
51 #include <libtecla.h>
52 
53 #ifndef A_CNT
54 /* macros for array manipulation */
55 #define	A_CNT(arr)	(sizeof (arr)/sizeof (arr[0]))
56 #define	A_END(arr)	(&arr[A_CNT(arr)])
57 #endif
58 
59 /* used for file parsing */
60 #define	NBUF_SIZE	16
61 #define	COMMENT_CHAR	'#'
62 #define	CONT_CHAR	'\\'
63 #define	QUOTE_CHAR	'"'
64 /*
65  * Input buffer size limits maximum line length for both file parsing and
66  * interactive mode. 4K chars should be enough even for broad commands and
67  * all possible key lenghts of today's symmetric ciphers entered via
68  * ipseckey(8) which has the most bifurcated grammar from all IPsec commands.
69  */
70 #define	IBUF_SIZE	4096
71 
72 /* used for command-line parsing */
73 #define	START_ARG	8
74 #define	TOO_MANY_ARGS	(START_ARG << 9)
75 
76 /* Return codes for argv/argc vector creation */
77 #define	TOO_MANY_TOKENS		-3
78 #define	MEMORY_ALLOCATION	-2
79 #define	COMMENT_LINE		1
80 #define	SUCCESS			0
81 
82 /* Flags for {bytecnt,secs}2out() */
83 #define	SPC_NOSPACES	0x00000000		/* no space prefix/suffix */
84 #define	SPC_BEGIN	0x00000001		/* put space at the beginning */
85 #define	SPC_END		0x00000002		/* put space at the end */
86 #define	SPC_BOTH	SPC_BEGIN|SPC_END	/* print both spaces */
87 
88 /*
89  * The following lengths should be sufficient for character buffers passed to
90  * bytecnt2str(),secs2str(). This is because the string output of these
91  * functions consists of limited number and units. The lengths should be also
92  * sufficient for bytecnt2out(),secs2out() functions.
93  */
94 #define	BYTE_STR_SIZE		16
95 #define	SECS_STR_SIZE		20
96 
97 /*
98  * Time printing defines...
99  *
100  * TBUF_SIZE is pretty arbitrary.  Perhaps it shouldn't be.
101  */
102 #define	TBUF_SIZE	50
103 #define	TIME_MAX	LONG_MAX
104 
105 #ifndef INSECURE_PERMS
106 #define	INSECURE_PERMS(sbuf)	(((sbuf).st_uid != 0) || \
107 	((sbuf).st_mode & S_IRWXG) || ((sbuf).st_mode & S_IRWXO))
108 #endif
109 
110 #ifndef PKCS11_TOKSIZE
111 #define	PKCS11_TOKSIZE 32	/* Fixed length of PKCS#11 token string len. */
112 #endif
113 
114 /*
115  * Solaris UDP port used to communicate with the Solaris Cluster
116  * daemon. It is used only when the node is booted in cluster mode.
117  */
118 #define	CLUSTER_UDP_PORT	2005
119 
120 /* For keyword-lookup tables */
121 typedef struct keywdtab {
122 	uint_t	kw_tag;
123 	char	*kw_str;
124 } keywdtab_t;
125 
126 /*
127  * These different exit states are designed to give consistant behaviour
128  * when a program needs to exit because of an error. These exit_types
129  * are used in macros, defined later in this file, which call ipsecutil_exit().
130  * What happens when ipsecutil_exit() may differ if the command was started
131  * on the command line or via smf(7), See ipsecutil_exit() source for details.
132  *
133  * Note: The calling function should decide what "debug mode" is before calling
134  * ipsecutil_exit() with DEBUG_FATAL.
135  */
136 typedef enum exit_type {
137 	SERVICE_EXIT_OK,	/* Exit without error. */
138 	SERVICE_DEGRADE,	/* A hint that service should be degraded. */
139 	SERVICE_BADPERM,	/* A Permission error occured. */
140 	SERVICE_BADCONF,	/* Misconfiguration. */
141 	SERVICE_MAINTAIN,	/* smf(7) to put service in maintenance mode. */
142 	SERVICE_DISABLE,	/* Tell smf(7) to disable me. */
143 	SERVICE_FATAL,		/* Whatever happened is not fixable. */
144 	SERVICE_RESTART,	/* Tell smf(7) to restart the service. */
145 	DEBUG_FATAL		/* Exit in debug mode. */
146 } exit_type_t;
147 
148 /*
149  * Function Prototypes
150  */
151 
152 /*
153  * Print errno and if cmdline or readfile, exit; if interactive reset state
154  */
155 extern void ipsecutil_exit(exit_type_t, char *, FILE *, const char *fmt, ...);
156 extern void bail(char *);
157 
158 /*
159  * Localization macro - Only to be used from usr/src/cmd because Macros
160  * are not expanded in usr/src/lib when message catalogs are built.
161  */
162 #define	Bail(s)	bail(dgettext(TEXT_DOMAIN, s))
163 
164 /*
165  * Print caller-supplied, variable-arg error message, then exit if cmdline
166  * or readfile, or reset state if interactive.
167  */
168 extern void bail_msg(char *, ...);
169 
170 /*
171  * dump_XXX functions produce ASCII output from the passed in data.
172  *
173  * Because certain errors need to do this stderr, dump_XXX functions
174  * take a FILE pointer.
175  */
176 
177 extern int dump_sockaddr(struct sockaddr *, uint8_t, boolean_t, FILE *,
178     boolean_t);
179 
180 extern int dump_key(uint8_t *, uint_t, uint_t, FILE *, boolean_t);
181 
182 extern int dump_aalg(uint8_t, FILE *);
183 
184 extern int dump_ealg(uint8_t, FILE *);
185 
186 /* return true if sadb string is printable (based on type), false otherwise */
187 extern boolean_t dump_sadb_idtype(uint8_t, FILE *, int *);
188 
189 /*
190  * do_interactive: Enter a mode where commands are read from a file;
191  * treat stdin special.  infile is the file cmds are read from;
192  * promptstring is the string printed to stdout (if the cmds are
193  * being read from stdin) to prompt for a new command; parseit is
194  * the function to be called to process the command line once it's
195  * been read in and broken up into an argv/argc vector.
196  */
197 
198 /* callback function passed in to do_interactive() */
199 typedef void (*parse_cmdln_fn)(int, char **, char *, boolean_t);
200 
201 extern void do_interactive(FILE *, char *, char *, char *, parse_cmdln_fn,
202     CplMatchFn *);
203 
204 extern uint_t lines_parsed;
205 extern uint_t lines_added;
206 
207 /* convert a string to an IKE_PRIV_* constant */
208 extern int privstr2num(char *);
209 
210 /* convert a string to a D_* debug flag */
211 extern int dbgstr2num(char *);
212 
213 /* convert a string of debug strings with +|- delimiters to a debug level */
214 extern int parsedbgopts(char *);
215 
216 /*
217  * functions to manipulate the IKEv1 kmcookie-label mapping file
218  */
219 
220 #define	KMCFILE		"/var/run/ipsec_kmc_map"
221 
222 /*
223  * Insert a mapping into the file (if it's not already there), given the
224  * new label.  Return the assigned cookie, or -1 on error.
225  */
226 extern int kmc_insert_mapping(char *);
227 
228 /*
229  * Lookup the given cookie and return its corresponding label.  Return
230  * a pointer to the label on success, NULL on error (or if the label is
231  * not found).
232  */
233 extern char *kmc_lookup_by_cookie(int);
234 
235 /*
236  * These globals are declared for us in ipsec_util.c, since it needs to
237  * refer to them also...
238  */
239 extern boolean_t nflag;	/* Avoid nameservice? */
240 extern boolean_t pflag;	/* Paranoid w.r.t. printing keying material? */
241 extern boolean_t interactive;
242 extern boolean_t readfile;
243 extern uint_t lineno;
244 extern char numprint[NBUF_SIZE];
245 
246 /* For error recovery in interactive or read-file mode. */
247 extern jmp_buf env;
248 
249 /*
250  * Back-end stuff for getalgby*().
251  */
252 
253 #define	INET_IPSECALGSPATH	"/etc/inet/"
254 #define	INET_IPSECALGSFILE	(INET_IPSECALGSPATH "ipsecalgs")
255 
256 /* To preserve packages delimiters in /etc/inet/ipsecalgs */
257 typedef struct ipsecalgs_pkg {
258 	int alg_num;
259 	char *pkg_name;
260 } ipsecalgs_pkg_t;
261 
262 /*
263  * The cached representation of /etc/inet/ipsecalgs is represented by:
264  * - A dynamically-grown (optionally sorted) array of IPsec protocols
265  * - Each protocol has an array (again, dynamically grown and sorted)
266  *   of algorithms, each a full-fledged struct ipsecalgent.
267  * - The getipsecalg*() routines will search the list, then duplicate the
268  *   struct ipsecalgent and return it.
269  */
270 
271 typedef enum {
272 	LIBIPSEC_ALGS_EXEC_SYNC,
273 	LIBIPSEC_ALGS_EXEC_ASYNC
274 } ipsecalgs_exec_mode_t;
275 
276 typedef struct ipsec_proto {
277 	int proto_num;
278 	char *proto_name;
279 	char *proto_pkg;
280 	int proto_numalgs;
281 	struct ipsecalgent **proto_algs;
282 	ipsecalgs_pkg_t *proto_algs_pkgs;
283 	int proto_algs_npkgs;
284 	ipsecalgs_exec_mode_t proto_exec_mode;
285 } ipsec_proto_t;
286 
287 extern void _build_internal_algs(ipsec_proto_t **, int *);
288 extern int _str_to_ipsec_exec_mode(char *, ipsecalgs_exec_mode_t *);
289 
290 extern int addipsecalg(struct ipsecalgent *, uint_t);
291 extern int delipsecalgbyname(const char *, int);
292 extern int delipsecalgbynum(int, int);
293 extern int addipsecproto(const char *, int, ipsecalgs_exec_mode_t, uint_t);
294 extern int delipsecprotobyname(const char *);
295 extern int delipsecprotobynum(int);
296 extern int *getipsecprotos(int *);
297 extern int *getipsecalgs(int *, int);
298 extern int list_ints(FILE *, int *);
299 extern const char *ipsecalgs_diag(int);
300 extern int ipsecproto_get_exec_mode(int, ipsecalgs_exec_mode_t *);
301 extern int ipsecproto_set_exec_mode(int, ipsecalgs_exec_mode_t);
302 
303 /* Flags for add/delete routines. */
304 #define	LIBIPSEC_ALGS_ADD_FORCE 0x00000001
305 
306 /*
307  * Helper definitions for indices into array of key sizes when key sizes
308  * are defined by range.
309  */
310 #define	LIBIPSEC_ALGS_KEY_DEF_IDX	0	/* default key size */
311 #define	LIBIPSEC_ALGS_KEY_MIN_IDX	1	/* min key size */
312 #define	LIBIPSEC_ALGS_KEY_MAX_IDX	2	/* max key size */
313 #define	LIBIPSEC_ALGS_KEY_NUM_VAL	4	/* def, min, max, 0 */
314 
315 /* Error codes for IPsec algorithms management */
316 #define	LIBIPSEC_ALGS_DIAG_ALG_EXISTS		-1
317 #define	LIBIPSEC_ALGS_DIAG_PROTO_EXISTS		-2
318 #define	LIBIPSEC_ALGS_DIAG_UNKN_PROTO		-3
319 #define	LIBIPSEC_ALGS_DIAG_UNKN_ALG		-4
320 #define	LIBIPSEC_ALGS_DIAG_NOMEM		-5
321 #define	LIBIPSEC_ALGS_DIAG_ALGSFILEOPEN		-6
322 #define	LIBIPSEC_ALGS_DIAG_ALGSFILEFDOPEN	-7
323 #define	LIBIPSEC_ALGS_DIAG_ALGSFILELOCK		-8
324 #define	LIBIPSEC_ALGS_DIAG_ALGSFILERENAME	-9
325 #define	LIBIPSEC_ALGS_DIAG_ALGSFILEWRITE	-10
326 #define	LIBIPSEC_ALGS_DIAG_ALGSFILECHMOD	-11
327 #define	LIBIPSEC_ALGS_DIAG_ALGSFILECHOWN	-12
328 #define	LIBIPSEC_ALGS_DIAG_ALGSFILECLOSE	-13
329 
330 /* /etc/inet/ipsecalgs keywords and package sections delimiters */
331 #define	LIBIPSEC_ALGS_LINE_PROTO		"PROTO|"
332 #define	LIBIPSEC_ALGS_LINE_ALG			"ALG|"
333 #define	LIBIPSEC_ALGS_LINE_PKGSTART		"# Start "
334 #define	LIBIPSEC_ALGS_LINE_PKGEND		"# End "
335 
336 /* Put these in libnsl for and process caching testing. */
337 extern int *_real_getipsecprotos(int *);
338 extern int *_real_getipsecalgs(int *, int);
339 extern struct ipsecalgent *_duplicate_alg(struct ipsecalgent *);
340 extern void _clean_trash(ipsec_proto_t *, int);
341 
342 /* spdsock support functions */
343 
344 /* Return values for spdsock_get_ext(). */
345 #define	KGE_OK	0
346 #define	KGE_DUP	1
347 #define	KGE_UNK	2
348 #define	KGE_LEN	3
349 #define	KGE_CHK	4
350 
351 extern int spdsock_get_ext(spd_ext_t *[], spd_msg_t *, uint_t, char *, uint_t);
352 extern const char *spdsock_diag(int);
353 
354 /* PF_KEY (keysock) support functions */
355 extern const char *keysock_diag(int);
356 extern int in_masktoprefix(uint8_t *, boolean_t);
357 
358 /* SA support functions */
359 
360 extern char *secs2out(unsigned int, char *, int, int);
361 extern char *secs2str(unsigned int, char *, int);
362 extern char *bytecnt2out(uint64_t, char *, size_t, int);
363 extern char *bytecnt2str(uint64_t, char *, size_t);
364 extern void print_diagnostic(FILE *, uint16_t);
365 extern void print_sadb_msg(FILE *, struct sadb_msg *, time_t, boolean_t);
366 extern void print_sa(FILE *, char *, struct sadb_sa *);
367 extern void printsatime(FILE *, int64_t, const char *, const char *,
368     const char *, boolean_t);
369 extern void print_lifetimes(FILE *, time_t, struct sadb_lifetime *,
370     struct sadb_lifetime *, struct sadb_lifetime *, struct sadb_lifetime *,
371     boolean_t vflag);
372 extern void print_address(FILE *, char *, struct sadb_address *, boolean_t);
373 extern void print_asn1_name(FILE *, const unsigned char *, long);
374 extern void print_key(FILE *, char *, struct sadb_key *);
375 extern void print_ident(FILE *, char *, struct sadb_ident *);
376 extern void print_sens(FILE *, char *, const struct sadb_sens *, boolean_t);
377 extern void print_prop(FILE *, char *, struct sadb_prop *);
378 extern void print_eprop(FILE *, char *, struct sadb_prop *);
379 extern void print_supp(FILE *, char *, struct sadb_supported *);
380 extern void print_spirange(FILE *, char *, struct sadb_spirange *);
381 extern void print_kmc(FILE *, char *, struct sadb_x_kmc *);
382 extern void print_samsg(FILE *, uint64_t *, boolean_t, boolean_t, boolean_t);
383 extern char *rparsesatype(int);
384 extern char *rparsealg(uint8_t, int);
385 extern char *rparseidtype(uint16_t);
386 extern boolean_t save_lifetime(struct sadb_lifetime *, FILE *);
387 extern boolean_t save_address(struct sadb_address *, FILE *);
388 extern boolean_t save_key(struct sadb_key *, FILE *);
389 extern boolean_t save_ident(struct sadb_ident *, FILE *);
390 extern void save_assoc(uint64_t *, FILE *);
391 extern FILE *opensavefile(char *);
392 extern const char *do_inet_ntop(const void *, char *, size_t);
393 
394 /*
395  * Label conversion convenience functions.
396  */
397 
398 #include <tsol/label.h>
399 
400 extern void ipsec_convert_sens_to_bslabel(const struct sadb_sens *,
401     bslabel_t *);
402 extern int ipsec_convert_sl_to_sens(int doi, bslabel_t *, struct sadb_sens *);
403 extern void ipsec_convert_bslabel_to_string(bslabel_t *, char **);
404 extern void ipsec_convert_bslabel_to_hex(bslabel_t *, char **);
405 
406 /*
407  * These exit macros give a consistent exit behaviour for all
408  * programs that use libipsecutil. These wll work in usr/src/cmd
409  * and usr/src/lib, but because macros in usr/src/lib don't get
410  * expanded when I18N message catalogs are built, avoid using
411  * these with text inside libipsecutil. See source of ipsecutil_exit()
412  * for more details.
413  */
414 #define	EXIT_OK(x) \
415 	ipsecutil_exit(SERVICE_EXIT_OK, my_fmri, debugfile, \
416 	dgettext(TEXT_DOMAIN, x))
417 #define	EXIT_OK2(x, y) \
418 	ipsecutil_exit(SERVICE_EXIT_OK, my_fmri, debugfile, \
419 	dgettext(TEXT_DOMAIN, x), y)
420 #define	EXIT_OK3(x, y, z) \
421 	ipsecutil_exit(SERVICE_EXIT_OK, my_fmri, debugfile, \
422 	dgettext(TEXT_DOMAIN, x), y, z)
423 #define	EXIT_BADCONFIG(x) \
424 	ipsecutil_exit(SERVICE_BADCONF, my_fmri, debugfile, \
425 	dgettext(TEXT_DOMAIN, x))
426 #define	EXIT_BADCONFIG2(x, y) \
427 	ipsecutil_exit(SERVICE_BADCONF, my_fmri, debugfile, \
428 	dgettext(TEXT_DOMAIN, x), y)
429 #define	EXIT_BADCONFIG3(x, y, z) \
430 	ipsecutil_exit(SERVICE_BADCONF, my_fmri, debugfile, \
431 	dgettext(TEXT_DOMAIN, x), y, z)
432 #define	EXIT_MAINTAIN(x) \
433 	ipsecutil_exit(SERVICE_MAINTAIN, my_fmri, debugfile, \
434 	dgettext(TEXT_DOMAIN, x))
435 #define	EXIT_MAINTAIN2(x, y) \
436 	ipsecutil_exit(SERVICE_MAINTAIN, my_fmri, debugfile, \
437 	dgettext(TEXT_DOMAIN, x), y)
438 #define	EXIT_DEGRADE(x) \
439 	ipsecutil_exit(SERVICE_DEGRADE, my_fmri, debugfile, \
440 	dgettext(TEXT_DOMAIN, x))
441 #define	EXIT_BADPERM(x) \
442 	ipsecutil_exit(SERVICE_BADPERM, my_fmri, debugfile, \
443 	dgettext(TEXT_DOMAIN, x))
444 #define	EXIT_BADPERM2(x, y) \
445 	ipsecutil_exit(SERVICE_BADPERM, my_fmri, debugfile, \
446 	dgettext(TEXT_DOMAIN, x), y)
447 #define	EXIT_FATAL(x) \
448 	ipsecutil_exit(SERVICE_FATAL, my_fmri, debugfile, \
449 	dgettext(TEXT_DOMAIN, x))
450 #define	EXIT_FATAL2(x, y) \
451 	ipsecutil_exit(SERVICE_FATAL, my_fmri, debugfile, \
452 	dgettext(TEXT_DOMAIN, x), y)
453 #define	EXIT_FATAL3(x, y, z) \
454 	ipsecutil_exit(SERVICE_FATAL, my_fmri, debugfile, \
455 	dgettext(TEXT_DOMAIN, x), y, z)
456 #define	EXIT_RESTART(x) \
457 	ipsecutil_exit(SERVICE_RESTART, my_fmri, debugfile, \
458 	dgettext(TEXT_DOMAIN, x))
459 
460 #ifdef __cplusplus
461 }
462 #endif
463 
464 #endif	/* _IPSEC_UTIL_H */
465