sys/netipsec/key_debug.c

   1 /*      $FreeBSD$       */
   2 /*      $KAME: key_debug.c,v 1.26 2001/06/27 10:46:50 sakane Exp $      */
   3
   4 /*-
   5  * SPDX-License-Identifier: BSD-3-Clause
   6  *
   7  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
   8  * All rights reserved.
   9  *
  10  * Redistribution and use in source and binary forms, with or without
  11  * modification, are permitted provided that the following conditions
  12  * are met:
  13  * 1. Redistributions of source code must retain the above copyright
  14  *    notice, this list of conditions and the following disclaimer.
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  * 3. Neither the name of the project nor the names of its contributors
  19  *    may be used to endorse or promote products derived from this software
  20  *    without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  32  * SUCH DAMAGE.
  33  */
  34
  35 #ifdef _KERNEL
  36 #include "opt_inet.h"
  37 #include "opt_inet6.h"
  38 #include "opt_ipsec.h"
  39 #endif
  40
  41 #include <sys/param.h>
  42 #ifdef _KERNEL
  43 #include <sys/systm.h>
  44 #include <sys/lock.h>
  45 #include <sys/malloc.h>
  46 #include <sys/mbuf.h>
  47 #include <sys/mutex.h>
  48 #include <sys/queue.h>
  49 #endif
  50 #include <sys/socket.h>
  51
  52 #include <net/vnet.h>
  53
  54 #include <netipsec/key_var.h>
  55 #include <netipsec/key_debug.h>
  56
  57 #include <netinet/in.h>
  58 #include <netipsec/ipsec.h>
  59 #ifdef _KERNEL
  60 #include <netipsec/keydb.h>
  61 #include <netipsec/xform.h>
  62 #endif
  63
  64 #ifndef _KERNEL
  65 #include <ctype.h>
  66 #include <stdio.h>
  67 #include <stdlib.h>
  68 #include <arpa/inet.h>
  69 #endif /* !_KERNEL */
  70
  71 static void kdebug_sadb_prop(struct sadb_ext *);
  72 static void kdebug_sadb_identity(struct sadb_ext *);
  73 static void kdebug_sadb_supported(struct sadb_ext *);
  74 static void kdebug_sadb_lifetime(struct sadb_ext *);
  75 static void kdebug_sadb_sa(struct sadb_ext *);
  76 static void kdebug_sadb_address(struct sadb_ext *);
  77 static void kdebug_sadb_key(struct sadb_ext *);
  78 static void kdebug_sadb_x_sa2(struct sadb_ext *);
  79 static void kdebug_sadb_x_sa_replay(struct sadb_ext *);
  80 static void kdebug_sadb_x_natt(struct sadb_ext *);
  81
  82 #ifndef _KERNEL
  83 #define panic(fmt, ...) { printf(fmt, ## __VA_ARGS__); exit(-1); }
  84 #endif
  85
  86 /* NOTE: host byte order */
  87
  88 static const char*
  89 kdebug_sadb_type(uint8_t type)
  90 {
  91 #define SADB_NAME(n)    case SADB_ ## n: return (#n)
  92
  93         switch (type) {
  94         SADB_NAME(RESERVED);
  95         SADB_NAME(GETSPI);
  96         SADB_NAME(UPDATE);
  97         SADB_NAME(ADD);
  98         SADB_NAME(DELETE);
  99         SADB_NAME(GET);
 100         SADB_NAME(ACQUIRE);
 101         SADB_NAME(REGISTER);
 102         SADB_NAME(EXPIRE);
 103         SADB_NAME(FLUSH);
 104         SADB_NAME(DUMP);
 105         SADB_NAME(X_PROMISC);
 106         SADB_NAME(X_PCHANGE);
 107         SADB_NAME(X_SPDUPDATE);
 108         SADB_NAME(X_SPDADD);
 109         SADB_NAME(X_SPDDELETE);
 110         SADB_NAME(X_SPDGET);
 111         SADB_NAME(X_SPDACQUIRE);
 112         SADB_NAME(X_SPDDUMP);
 113         SADB_NAME(X_SPDFLUSH);
 114         SADB_NAME(X_SPDSETIDX);
 115         SADB_NAME(X_SPDEXPIRE);
 116         SADB_NAME(X_SPDDELETE2);
 117         default:
 118                 return ("UNKNOWN");
 119         }
 120 #undef SADB_NAME
 121 }
 122
 123 static const char*
 124 kdebug_sadb_exttype(uint16_t type)
 125 {
 126 #define EXT_NAME(n)     case SADB_EXT_ ## n: return (#n)
 127 #define X_NAME(n)       case SADB_X_EXT_ ## n: return (#n)
 128
 129         switch (type) {
 130         EXT_NAME(RESERVED);
 131         EXT_NAME(SA);
 132         EXT_NAME(LIFETIME_CURRENT);
 133         EXT_NAME(LIFETIME_HARD);
 134         EXT_NAME(LIFETIME_SOFT);
 135         EXT_NAME(ADDRESS_SRC);
 136         EXT_NAME(ADDRESS_DST);
 137         EXT_NAME(ADDRESS_PROXY);
 138         EXT_NAME(KEY_AUTH);
 139         EXT_NAME(KEY_ENCRYPT);
 140         EXT_NAME(IDENTITY_SRC);
 141         EXT_NAME(IDENTITY_DST);
 142         EXT_NAME(SENSITIVITY);
 143         EXT_NAME(PROPOSAL);
 144         EXT_NAME(SUPPORTED_AUTH);
 145         EXT_NAME(SUPPORTED_ENCRYPT);
 146         EXT_NAME(SPIRANGE);
 147         X_NAME(KMPRIVATE);
 148         X_NAME(POLICY);
 149         X_NAME(SA2);
 150         X_NAME(NAT_T_TYPE);
 151         X_NAME(NAT_T_SPORT);
 152         X_NAME(NAT_T_DPORT);
 153         X_NAME(NAT_T_OAI);
 154         X_NAME(NAT_T_OAR);
 155         X_NAME(NAT_T_FRAG);
 156         X_NAME(SA_REPLAY);
 157         X_NAME(NEW_ADDRESS_SRC);
 158         X_NAME(NEW_ADDRESS_DST);
 159         default:
 160                 return ("UNKNOWN");
 161         };
 162 #undef EXT_NAME
 163 #undef X_NAME
 164 }
 165
 166 /* %%%: about struct sadb_msg */
 167 void
 168 kdebug_sadb(struct sadb_msg *base)
 169 {
 170         struct sadb_ext *ext;
 171         int tlen, extlen;
 172
 173         /* sanity check */
 174         if (base == NULL)
 175                 panic("%s: NULL pointer was passed.\n", __func__);
 176
 177         printf("sadb_msg{ version=%u type=%u(%s) errno=%u satype=%u\n",
 178             base->sadb_msg_version, base->sadb_msg_type,
 179             kdebug_sadb_type(base->sadb_msg_type),
 180             base->sadb_msg_errno, base->sadb_msg_satype);
 181         printf("  len=%u reserved=%u seq=%u pid=%u\n",
 182             base->sadb_msg_len, base->sadb_msg_reserved,
 183             base->sadb_msg_seq, base->sadb_msg_pid);
 184
 185         tlen = PFKEY_UNUNIT64(base->sadb_msg_len) - sizeof(struct sadb_msg);
 186         ext = (struct sadb_ext *)((caddr_t)base + sizeof(struct sadb_msg));
 187
 188         while (tlen > 0) {
 189                 printf("sadb_ext{ len=%u type=%u(%s) }\n",
 190                     ext->sadb_ext_len, ext->sadb_ext_type,
 191                     kdebug_sadb_exttype(ext->sadb_ext_type));
 192
 193                 if (ext->sadb_ext_len == 0) {
 194                         printf("%s: invalid ext_len=0 was passed.\n", __func__);
 195                         return;
 196                 }
 197                 if (ext->sadb_ext_len > tlen) {
 198                         printf("%s: ext_len too big (%u > %u).\n",
 199                                 __func__, ext->sadb_ext_len, tlen);
 200                         return;
 201                 }
 202
 203                 switch (ext->sadb_ext_type) {
 204                 case SADB_EXT_SA:
 205                         kdebug_sadb_sa(ext);
 206                         break;
 207                 case SADB_EXT_LIFETIME_CURRENT:
 208                 case SADB_EXT_LIFETIME_HARD:
 209                 case SADB_EXT_LIFETIME_SOFT:
 210                         kdebug_sadb_lifetime(ext);
 211                         break;
 212                 case SADB_EXT_ADDRESS_SRC:
 213                 case SADB_EXT_ADDRESS_DST:
 214                 case SADB_EXT_ADDRESS_PROXY:
 215                 case SADB_X_EXT_NAT_T_OAI:
 216                 case SADB_X_EXT_NAT_T_OAR:
 217                 case SADB_X_EXT_NEW_ADDRESS_SRC:
 218                 case SADB_X_EXT_NEW_ADDRESS_DST:
 219                         kdebug_sadb_address(ext);
 220                         break;
 221                 case SADB_EXT_KEY_AUTH:
 222                 case SADB_EXT_KEY_ENCRYPT:
 223                         kdebug_sadb_key(ext);
 224                         break;
 225                 case SADB_EXT_IDENTITY_SRC:
 226                 case SADB_EXT_IDENTITY_DST:
 227                         kdebug_sadb_identity(ext);
 228                         break;
 229                 case SADB_EXT_SENSITIVITY:
 230                         break;
 231                 case SADB_EXT_PROPOSAL:
 232                         kdebug_sadb_prop(ext);
 233                         break;
 234                 case SADB_EXT_SUPPORTED_AUTH:
 235                 case SADB_EXT_SUPPORTED_ENCRYPT:
 236                         kdebug_sadb_supported(ext);
 237                         break;
 238                 case SADB_EXT_SPIRANGE:
 239                 case SADB_X_EXT_KMPRIVATE:
 240                         break;
 241                 case SADB_X_EXT_POLICY:
 242                         kdebug_sadb_x_policy(ext);
 243                         break;
 244                 case SADB_X_EXT_SA2:
 245                         kdebug_sadb_x_sa2(ext);
 246                         break;
 247                 case SADB_X_EXT_SA_REPLAY:
 248                         kdebug_sadb_x_sa_replay(ext);
 249                         break;
 250                 case SADB_X_EXT_NAT_T_TYPE:
 251                 case SADB_X_EXT_NAT_T_SPORT:
 252                 case SADB_X_EXT_NAT_T_DPORT:
 253                         kdebug_sadb_x_natt(ext);
 254                         break;
 255                 default:
 256                         printf("%s: invalid ext_type %u\n", __func__,
 257                             ext->sadb_ext_type);
 258                         return;
 259                 }
 260
 261                 extlen = PFKEY_UNUNIT64(ext->sadb_ext_len);
 262                 tlen -= extlen;
 263                 ext = (struct sadb_ext *)((caddr_t)ext + extlen);
 264         }
 265
 266         return;
 267 }
 268
 269 static void
 270 kdebug_sadb_prop(struct sadb_ext *ext)
 271 {
 272         struct sadb_prop *prop = (struct sadb_prop *)ext;
 273         struct sadb_comb *comb;
 274         int len;
 275
 276         /* sanity check */
 277         if (ext == NULL)
 278                 panic("%s: NULL pointer was passed.\n", __func__);
 279
 280         len = (PFKEY_UNUNIT64(prop->sadb_prop_len) - sizeof(*prop))
 281                 / sizeof(*comb);
 282         comb = (struct sadb_comb *)(prop + 1);
 283         printf("sadb_prop{ replay=%u\n", prop->sadb_prop_replay);
 284
 285         while (len--) {
 286                 printf("sadb_comb{ auth=%u encrypt=%u "
 287                         "flags=0x%04x reserved=0x%08x\n",
 288                         comb->sadb_comb_auth, comb->sadb_comb_encrypt,
 289                         comb->sadb_comb_flags, comb->sadb_comb_reserved);
 290
 291                 printf("  auth_minbits=%u auth_maxbits=%u "
 292                         "encrypt_minbits=%u encrypt_maxbits=%u\n",
 293                         comb->sadb_comb_auth_minbits,
 294                         comb->sadb_comb_auth_maxbits,
 295                         comb->sadb_comb_encrypt_minbits,
 296                         comb->sadb_comb_encrypt_maxbits);
 297
 298                 printf("  soft_alloc=%u hard_alloc=%u "
 299                         "soft_bytes=%lu hard_bytes=%lu\n",
 300                         comb->sadb_comb_soft_allocations,
 301                         comb->sadb_comb_hard_allocations,
 302                         (unsigned long)comb->sadb_comb_soft_bytes,
 303                         (unsigned long)comb->sadb_comb_hard_bytes);
 304
 305                 printf("  soft_alloc=%lu hard_alloc=%lu "
 306                         "soft_bytes=%lu hard_bytes=%lu }\n",
 307                         (unsigned long)comb->sadb_comb_soft_addtime,
 308                         (unsigned long)comb->sadb_comb_hard_addtime,
 309                         (unsigned long)comb->sadb_comb_soft_usetime,
 310                         (unsigned long)comb->sadb_comb_hard_usetime);
 311                 comb++;
 312         }
 313         printf("}\n");
 314
 315         return;
 316 }
 317
 318 static void
 319 kdebug_sadb_identity(struct sadb_ext *ext)
 320 {
 321         struct sadb_ident *id = (struct sadb_ident *)ext;
 322         int len;
 323
 324         /* sanity check */
 325         if (ext == NULL)
 326                 panic("%s: NULL pointer was passed.\n", __func__);
 327
 328         len = PFKEY_UNUNIT64(id->sadb_ident_len) - sizeof(*id);
 329         printf("sadb_ident_%s{",
 330             id->sadb_ident_exttype == SADB_EXT_IDENTITY_SRC ? "src" : "dst");
 331         switch (id->sadb_ident_type) {
 332         default:
 333                 printf(" type=%d id=%lu",
 334                         id->sadb_ident_type, (u_long)id->sadb_ident_id);
 335                 if (len) {
 336 #ifdef _KERNEL
 337                         ipsec_hexdump((caddr_t)(id + 1), len); /*XXX cast ?*/
 338 #else
 339                         char *p, *ep;
 340                         printf("\n  str=\"");
 341                         p = (char *)(id + 1);
 342                         ep = p + len;
 343                         for (/*nothing*/; *p && p < ep; p++) {
 344                                 if (isprint(*p))
 345                                         printf("%c", *p & 0xff);
 346                                 else
 347                                         printf("\\%03o", *p & 0xff);
 348                         }
 349 #endif
 350                         printf("\"");
 351                 }
 352                 break;
 353         }
 354
 355         printf(" }\n");
 356
 357         return;
 358 }
 359
 360 static void
 361 kdebug_sadb_supported(struct sadb_ext *ext)
 362 {
 363         struct sadb_supported *sup = (struct sadb_supported *)ext;
 364         struct sadb_alg *alg;
 365         int len;
 366
 367         /* sanity check */
 368         if (ext == NULL)
 369                 panic("%s: NULL pointer was passed.\n", __func__);
 370
 371         len = (PFKEY_UNUNIT64(sup->sadb_supported_len) - sizeof(*sup))
 372                 / sizeof(*alg);
 373         alg = (struct sadb_alg *)(sup + 1);
 374         printf("sadb_sup{\n");
 375         while (len--) {
 376                 printf("  { id=%d ivlen=%d min=%d max=%d }\n",
 377                         alg->sadb_alg_id, alg->sadb_alg_ivlen,
 378                         alg->sadb_alg_minbits, alg->sadb_alg_maxbits);
 379                 alg++;
 380         }
 381         printf("}\n");
 382
 383         return;
 384 }
 385
 386 static void
 387 kdebug_sadb_lifetime(struct sadb_ext *ext)
 388 {
 389         struct sadb_lifetime *lft = (struct sadb_lifetime *)ext;
 390
 391         /* sanity check */
 392         if (ext == NULL)
 393                 panic("%s: NULL pointer was passed.\n", __func__);
 394
 395         printf("sadb_lifetime{ alloc=%u, bytes=%u\n",
 396                 lft->sadb_lifetime_allocations,
 397                 (u_int32_t)lft->sadb_lifetime_bytes);
 398         printf("  addtime=%u, usetime=%u }\n",
 399                 (u_int32_t)lft->sadb_lifetime_addtime,
 400                 (u_int32_t)lft->sadb_lifetime_usetime);
 401
 402         return;
 403 }
 404
 405 static void
 406 kdebug_sadb_sa(struct sadb_ext *ext)
 407 {
 408         struct sadb_sa *sa = (struct sadb_sa *)ext;
 409
 410         /* sanity check */
 411         if (ext == NULL)
 412                 panic("%s: NULL pointer was passed.\n", __func__);
 413
 414         printf("sadb_sa{ spi=%u replay=%u state=%u\n",
 415             (u_int32_t)ntohl(sa->sadb_sa_spi), sa->sadb_sa_replay,
 416             sa->sadb_sa_state);
 417         printf("  auth=%u encrypt=%u flags=0x%08x }\n",
 418             sa->sadb_sa_auth, sa->sadb_sa_encrypt, sa->sadb_sa_flags);
 419
 420         return;
 421 }
 422
 423 static void
 424 kdebug_sadb_address(struct sadb_ext *ext)
 425 {
 426         struct sadb_address *addr = (struct sadb_address *)ext;
 427
 428         /* sanity check */
 429         if (ext == NULL)
 430                 panic("%s: NULL pointer was passed.\n", __func__);
 431
 432         printf("sadb_address{ proto=%u prefixlen=%u reserved=0x%02x%02x }\n",
 433             addr->sadb_address_proto, addr->sadb_address_prefixlen,
 434             ((u_char *)&addr->sadb_address_reserved)[0],
 435             ((u_char *)&addr->sadb_address_reserved)[1]);
 436
 437         kdebug_sockaddr((struct sockaddr *)((caddr_t)ext + sizeof(*addr)));
 438 }
 439
 440 static void
 441 kdebug_sadb_key(struct sadb_ext *ext)
 442 {
 443         struct sadb_key *key = (struct sadb_key *)ext;
 444
 445         /* sanity check */
 446         if (ext == NULL)
 447                 panic("%s: NULL pointer was passed.\n", __func__);
 448
 449         printf("sadb_key{ bits=%u reserved=%u\n",
 450             key->sadb_key_bits, key->sadb_key_reserved);
 451         printf("  key=");
 452
 453         /* sanity check 2 */
 454         if ((key->sadb_key_bits >> 3) >
 455                 (PFKEY_UNUNIT64(key->sadb_key_len) - sizeof(struct sadb_key))) {
 456                 printf("%s: key length mismatch, bit:%d len:%ld.\n",
 457                         __func__,
 458                         key->sadb_key_bits >> 3,
 459                         (long)PFKEY_UNUNIT64(key->sadb_key_len) - sizeof(struct sadb_key));
 460         }
 461
 462         ipsec_hexdump((caddr_t)key + sizeof(struct sadb_key),
 463                       key->sadb_key_bits >> 3);
 464         printf(" }\n");
 465         return;
 466 }
 467
 468 static void
 469 kdebug_sadb_x_sa2(struct sadb_ext *ext)
 470 {
 471         struct sadb_x_sa2 *sa2 = (struct sadb_x_sa2 *)ext;
 472
 473         /* sanity check */
 474         if (ext == NULL)
 475                 panic("%s: NULL pointer was passed.\n", __func__);
 476
 477         printf("sadb_x_sa2{ mode=%u reqid=%u\n",
 478             sa2->sadb_x_sa2_mode, sa2->sadb_x_sa2_reqid);
 479         printf("  reserved1=%u reserved2=%u sequence=%u }\n",
 480             sa2->sadb_x_sa2_reserved1, sa2->sadb_x_sa2_reserved2,
 481             sa2->sadb_x_sa2_sequence);
 482
 483         return;
 484 }
 485
 486 static void
 487 kdebug_sadb_x_sa_replay(struct sadb_ext *ext)
 488 {
 489         struct sadb_x_sa_replay *replay;
 490
 491         /* sanity check */
 492         if (ext == NULL)
 493                 panic("%s: NULL pointer was passed.\n", __func__);
 494
 495         replay = (struct sadb_x_sa_replay *)ext;
 496         printf("sadb_x_sa_replay{ replay=%u }\n",
 497             replay->sadb_x_sa_replay_replay);
 498 }
 499
 500 static void
 501 kdebug_sadb_x_natt(struct sadb_ext *ext)
 502 {
 503         struct sadb_x_nat_t_type *type;
 504         struct sadb_x_nat_t_port *port;
 505
 506         /* sanity check */
 507         if (ext == NULL)
 508                 panic("%s: NULL pointer was passed.\n", __func__);
 509
 510         if (ext->sadb_ext_type == SADB_X_EXT_NAT_T_TYPE) {
 511                 type = (struct sadb_x_nat_t_type *)ext;
 512                 printf("sadb_x_nat_t_type{ type=%u }\n",
 513                     type->sadb_x_nat_t_type_type);
 514         } else {
 515                 port = (struct sadb_x_nat_t_port *)ext;
 516                 printf("sadb_x_nat_t_port{ port=%u }\n",
 517                     ntohs(port->sadb_x_nat_t_port_port));
 518         }
 519 }
 520
 521 void
 522 kdebug_sadb_x_policy(struct sadb_ext *ext)
 523 {
 524         struct sadb_x_policy *xpl = (struct sadb_x_policy *)ext;
 525         struct sockaddr *addr;
 526
 527         /* sanity check */
 528         if (ext == NULL)
 529                 panic("%s: NULL pointer was passed.\n", __func__);
 530
 531         printf("sadb_x_policy{ type=%u dir=%u id=%x scope=%u %s=%u }\n",
 532                 xpl->sadb_x_policy_type, xpl->sadb_x_policy_dir,
 533                 xpl->sadb_x_policy_id, xpl->sadb_x_policy_scope,
 534                 xpl->sadb_x_policy_scope == IPSEC_POLICYSCOPE_IFNET ?
 535                 "ifindex": "priority", xpl->sadb_x_policy_priority);
 536
 537         if (xpl->sadb_x_policy_type == IPSEC_POLICY_IPSEC) {
 538                 int tlen;
 539                 struct sadb_x_ipsecrequest *xisr;
 540
 541                 tlen = PFKEY_UNUNIT64(xpl->sadb_x_policy_len) - sizeof(*xpl);
 542                 xisr = (struct sadb_x_ipsecrequest *)(xpl + 1);
 543
 544                 while (tlen > 0) {
 545                         printf(" { len=%u proto=%u mode=%u level=%u reqid=%u\n",
 546                                 xisr->sadb_x_ipsecrequest_len,
 547                                 xisr->sadb_x_ipsecrequest_proto,
 548                                 xisr->sadb_x_ipsecrequest_mode,
 549                                 xisr->sadb_x_ipsecrequest_level,
 550                                 xisr->sadb_x_ipsecrequest_reqid);
 551
 552                         if (xisr->sadb_x_ipsecrequest_len > sizeof(*xisr)) {
 553                                 addr = (struct sockaddr *)(xisr + 1);
 554                                 kdebug_sockaddr(addr);
 555                                 addr = (struct sockaddr *)((caddr_t)addr
 556                                                         + addr->sa_len);
 557                                 kdebug_sockaddr(addr);
 558                         }
 559
 560                         printf(" }\n");
 561
 562                         /* prevent infinite loop */
 563                         if (xisr->sadb_x_ipsecrequest_len <= 0) {
 564                                 printf("%s: wrong policy struct.\n", __func__);
 565                                 return;
 566                         }
 567                         /* prevent overflow */
 568                         if (xisr->sadb_x_ipsecrequest_len > tlen) {
 569                                 printf("%s: invalid ipsec policy length "
 570                                         "(%u > %u)\n", __func__,
 571                                         xisr->sadb_x_ipsecrequest_len, tlen);
 572                                 return;
 573                         }
 574
 575                         tlen -= xisr->sadb_x_ipsecrequest_len;
 576
 577                         xisr = (struct sadb_x_ipsecrequest *)((caddr_t)xisr
 578                                         + xisr->sadb_x_ipsecrequest_len);
 579                 }
 580
 581                 if (tlen != 0)
 582                         panic("%s: wrong policy struct.\n", __func__);
 583         }
 584
 585         return;
 586 }
 587
 588 #ifdef _KERNEL
 589 /* %%%: about SPD and SAD */
 590 const char*
 591 kdebug_secpolicy_state(u_int state)
 592 {
 593
 594         switch (state) {
 595         case IPSEC_SPSTATE_DEAD:
 596                 return ("dead");
 597         case IPSEC_SPSTATE_LARVAL:
 598                 return ("larval");
 599         case IPSEC_SPSTATE_ALIVE:
 600                 return ("alive");
 601         case IPSEC_SPSTATE_PCB:
 602                 return ("pcb");
 603         case IPSEC_SPSTATE_IFNET:
 604                 return ("ifnet");
 605         }
 606         return ("unknown");
 607 }
 608
 609 const char*
 610 kdebug_secpolicy_policy(u_int policy)
 611 {
 612
 613         switch (policy) {
 614         case IPSEC_POLICY_DISCARD:
 615                 return ("discard");
 616         case IPSEC_POLICY_NONE:
 617                 return ("none");
 618         case IPSEC_POLICY_IPSEC:
 619                 return ("ipsec");
 620         case IPSEC_POLICY_ENTRUST:
 621                 return ("entrust");
 622         case IPSEC_POLICY_BYPASS:
 623                 return ("bypass");
 624         }
 625         return ("unknown");
 626 }
 627
 628 const char*
 629 kdebug_secpolicyindex_dir(u_int dir)
 630 {
 631
 632         switch (dir) {
 633         case IPSEC_DIR_ANY:
 634                 return ("any");
 635         case IPSEC_DIR_INBOUND:
 636                 return ("in");
 637         case IPSEC_DIR_OUTBOUND:
 638                 return ("out");
 639         }
 640         return ("unknown");
 641 }
 642
 643 const char*
 644 kdebug_ipsecrequest_level(u_int level)
 645 {
 646
 647         switch (level) {
 648         case IPSEC_LEVEL_DEFAULT:
 649                 return ("default");
 650         case IPSEC_LEVEL_USE:
 651                 return ("use");
 652         case IPSEC_LEVEL_REQUIRE:
 653                 return ("require");
 654         case IPSEC_LEVEL_UNIQUE:
 655                 return ("unique");
 656         }
 657         return ("unknown");
 658 }
 659
 660 const char*
 661 kdebug_secasindex_mode(u_int mode)
 662 {
 663
 664         switch (mode) {
 665         case IPSEC_MODE_ANY:
 666                 return ("any");
 667         case IPSEC_MODE_TRANSPORT:
 668                 return ("transport");
 669         case IPSEC_MODE_TUNNEL:
 670                 return ("tunnel");
 671         case IPSEC_MODE_TCPMD5:
 672                 return ("tcp-md5");
 673         }
 674         return ("unknown");
 675 }
 676
 677 const char*
 678 kdebug_secasv_state(u_int state)
 679 {
 680
 681         switch (state) {
 682         case SADB_SASTATE_LARVAL:
 683                 return ("larval");
 684         case SADB_SASTATE_MATURE:
 685                 return ("mature");
 686         case SADB_SASTATE_DYING:
 687                 return ("dying");
 688         case SADB_SASTATE_DEAD:
 689                 return ("dead");
 690         }
 691         return ("unknown");
 692 }
 693
 694 static char*
 695 kdebug_port2str(const struct sockaddr *sa, char *buf, size_t len)
 696 {
 697         uint16_t port;
 698
 699         IPSEC_ASSERT(sa != NULL, ("null sa"));
 700         switch (sa->sa_family) {
 701 #ifdef INET
 702         case AF_INET:
 703                 port = ntohs(((const struct sockaddr_in *)sa)->sin_port);
 704                 break;
 705 #endif
 706 #ifdef INET6
 707         case AF_INET6:
 708                 port = ntohs(((const struct sockaddr_in6 *)sa)->sin6_port);
 709                 break;
 710 #endif
 711         default:
 712                 port = 0;
 713         }
 714         if (port == 0)
 715                 return ("*");
 716         snprintf(buf, len, "%u", port);
 717         return (buf);
 718 }
 719
 720 void
 721 kdebug_secpolicy(struct secpolicy *sp)
 722 {
 723         u_int idx;
 724
 725         IPSEC_ASSERT(sp != NULL, ("null sp"));
 726         printf("SP { refcnt=%u id=%u priority=%u state=%s policy=%s\n",
 727             sp->refcnt, sp->id, sp->priority,
 728             kdebug_secpolicy_state(sp->state),
 729             kdebug_secpolicy_policy(sp->policy));
 730         kdebug_secpolicyindex(&sp->spidx, "  ");
 731         for (idx = 0; idx < sp->tcount; idx++) {
 732                 printf("  req[%u]{ level=%s ", idx,
 733                     kdebug_ipsecrequest_level(sp->req[idx]->level));
 734                 kdebug_secasindex(&sp->req[idx]->saidx, NULL);
 735                 printf("  }\n");
 736         }
 737         printf("}\n");
 738 }
 739
 740 void
 741 kdebug_secpolicyindex(struct secpolicyindex *spidx, const char *indent)
 742 {
 743         char buf[IPSEC_ADDRSTRLEN];
 744
 745         IPSEC_ASSERT(spidx != NULL, ("null spidx"));
 746         if (indent != NULL)
 747                 printf("%s", indent);
 748         printf("spidx { dir=%s ul_proto=",
 749             kdebug_secpolicyindex_dir(spidx->dir));
 750         if (spidx->ul_proto == IPSEC_ULPROTO_ANY)
 751                 printf("* ");
 752         else
 753                 printf("%u ", spidx->ul_proto);
 754         printf("%s/%u -> ", ipsec_address(&spidx->src, buf, sizeof(buf)),
 755             spidx->prefs);
 756         printf("%s/%u }\n", ipsec_address(&spidx->dst, buf, sizeof(buf)),
 757             spidx->prefd);
 758 }
 759
 760 void
 761 kdebug_secasindex(const struct secasindex *saidx, const char *indent)
 762 {
 763         char buf[IPSEC_ADDRSTRLEN], port[6];
 764
 765         IPSEC_ASSERT(saidx != NULL, ("null saidx"));
 766         if (indent != NULL)
 767                 printf("%s", indent);
 768         printf("saidx { mode=%s proto=%u reqid=%u ",
 769             kdebug_secasindex_mode(saidx->mode), saidx->proto, saidx->reqid);
 770         printf("%s:%s -> ", ipsec_address(&saidx->src, buf, sizeof(buf)),
 771             kdebug_port2str(&saidx->src.sa, port, sizeof(port)));
 772         printf("%s:%s }\n", ipsec_address(&saidx->dst, buf, sizeof(buf)),
 773             kdebug_port2str(&saidx->dst.sa, port, sizeof(port)));
 774 }
 775
 776 static void
 777 kdebug_sec_lifetime(struct seclifetime *lft, const char *indent)
 778 {
 779
 780         IPSEC_ASSERT(lft != NULL, ("null lft"));
 781         if (indent != NULL)
 782                 printf("%s", indent);
 783         printf("lifetime { alloc=%u, bytes=%ju addtime=%ju usetime=%ju }\n",
 784             lft->allocations, (uintmax_t)lft->bytes, (uintmax_t)lft->addtime,
 785             (uintmax_t)lft->usetime);
 786 }
 787
 788 void
 789 kdebug_secash(struct secashead *sah, const char *indent)
 790 {
 791
 792         IPSEC_ASSERT(sah != NULL, ("null sah"));
 793         if (indent != NULL)
 794                 printf("%s", indent);
 795         printf("SAH { refcnt=%u state=%s\n", sah->refcnt,
 796             kdebug_secasv_state(sah->state));
 797         if (indent != NULL)
 798                 printf("%s", indent);
 799         kdebug_secasindex(&sah->saidx, indent);
 800         if (indent != NULL)
 801                 printf("%s", indent);
 802         printf("}\n");
 803 }
 804
 805 #ifdef IPSEC_DEBUG
 806 static void
 807 kdebug_secreplay(struct secreplay *rpl)
 808 {
 809         int len, l;
 810
 811         IPSEC_ASSERT(rpl != NULL, ("null rpl"));
 812         printf(" secreplay{ count=%lu bitmap_size=%u wsize=%u last=%lu",
 813             rpl->count, rpl->bitmap_size, rpl->wsize, rpl->last);
 814
 815         if (rpl->bitmap == NULL) {
 816                 printf("  }\n");
 817                 return;
 818         }
 819
 820         printf("\n    bitmap { ");
 821         for (len = 0; len < rpl->bitmap_size*4; len++) {
 822                 for (l = 7; l >= 0; l--)
 823                         printf("%u", (((rpl->bitmap)[len] >> l) & 1) ? 1 : 0);
 824         }
 825         printf("    }\n");
 826 }
 827 #endif /* IPSEC_DEBUG */
 828
 829 static void
 830 kdebug_secnatt(struct secnatt *natt)
 831 {
 832         char buf[IPSEC_ADDRSTRLEN];
 833
 834         IPSEC_ASSERT(natt != NULL, ("null natt"));
 835         printf("  natt{ sport=%u dport=%u ", ntohs(natt->sport),
 836             ntohs(natt->dport));
 837         if (natt->flags & IPSEC_NATT_F_OAI)
 838                 printf("oai=%s ", ipsec_address(&natt->oai, buf, sizeof(buf)));
 839         if (natt->flags & IPSEC_NATT_F_OAR)
 840                 printf("oar=%s ", ipsec_address(&natt->oar, buf, sizeof(buf)));
 841         printf("}\n");
 842 }
 843
 844 void
 845 kdebug_secasv(struct secasvar *sav)
 846 {
 847         struct seclifetime lft_c;
 848
 849         IPSEC_ASSERT(sav != NULL, ("null sav"));
 850
 851         printf("SA { refcnt=%u spi=%u seq=%u pid=%u flags=0x%x state=%s\n",
 852             sav->refcnt, ntohl(sav->spi), sav->seq, (uint32_t)sav->pid,
 853             sav->flags, kdebug_secasv_state(sav->state));
 854         kdebug_secash(sav->sah, "  ");
 855
 856         lft_c.addtime = sav->created;
 857         lft_c.allocations = (uint32_t)counter_u64_fetch(
 858             sav->lft_c_allocations);
 859         lft_c.bytes = counter_u64_fetch(sav->lft_c_bytes);
 860         lft_c.usetime = sav->firstused;
 861         kdebug_sec_lifetime(&lft_c, "  c_");
 862         if (sav->lft_h != NULL)
 863                 kdebug_sec_lifetime(sav->lft_h, "  h_");
 864         if (sav->lft_s != NULL)
 865                 kdebug_sec_lifetime(sav->lft_s, "  s_");
 866
 867         if (sav->tdb_authalgxform != NULL)
 868                 printf("  alg_auth=%s\n", sav->tdb_authalgxform->name);
 869         if (sav->key_auth != NULL)
 870                 KEYDBG(DUMP,
 871                     kdebug_sadb_key((struct sadb_ext *)sav->key_auth));
 872         if (sav->tdb_encalgxform != NULL)
 873                 printf("  alg_enc=%s\n", sav->tdb_encalgxform->name);
 874         if (sav->key_enc != NULL)
 875                 KEYDBG(DUMP,
 876                     kdebug_sadb_key((struct sadb_ext *)sav->key_enc));
 877         if (sav->natt != NULL)
 878                 kdebug_secnatt(sav->natt);
 879         if (sav->replay != NULL) {
 880                 KEYDBG(DUMP,
 881                     SECASVAR_LOCK(sav);
 882                     kdebug_secreplay(sav->replay);
 883                     SECASVAR_UNLOCK(sav));
 884         }
 885         printf("}\n");
 886 }
 887
 888 void
 889 kdebug_mbufhdr(const struct mbuf *m)
 890 {
 891         /* sanity check */
 892         if (m == NULL)
 893                 return;
 894
 895         printf("mbuf(%p){ m_next:%p m_nextpkt:%p m_data:%p "
 896                "m_len:%d m_type:0x%02x m_flags:0x%02x }\n",
 897                 m, m->m_next, m->m_nextpkt, m->m_data,
 898                 m->m_len, m->m_type, m->m_flags);
 899
 900         if (m->m_flags & M_PKTHDR) {
 901                 printf("  m_pkthdr{ len:%d rcvif:%p }\n",
 902                     m->m_pkthdr.len, m->m_pkthdr.rcvif);
 903         }
 904
 905         if (m->m_flags & M_EXT) {
 906                 printf("  m_ext{ ext_buf:%p ext_free:%p "
 907                        "ext_size:%u ext_cnt:%p }\n",
 908                         m->m_ext.ext_buf, m->m_ext.ext_free,
 909                         m->m_ext.ext_size, m->m_ext.ext_cnt);
 910         }
 911
 912         return;
 913 }
 914
 915 void
 916 kdebug_mbuf(const struct mbuf *m0)
 917 {
 918         const struct mbuf *m = m0;
 919         int i, j;
 920
 921         for (j = 0; m; m = m->m_next) {
 922                 kdebug_mbufhdr(m);
 923                 printf("  m_data:\n");
 924                 for (i = 0; i < m->m_len; i++) {
 925                         if (i && i % 32 == 0)
 926                                 printf("\n");
 927                         if (i % 4 == 0)
 928                                 printf(" ");
 929                         printf("%02x", mtod(m, const u_char *)[i]);
 930                         j++;
 931                 }
 932                 printf("\n");
 933         }
 934
 935         return;
 936 }
 937
 938 /* Return a printable string for the address. */
 939 char *
 940 ipsec_address(const union sockaddr_union* sa, char *buf, socklen_t size)
 941 {
 942
 943         switch (sa->sa.sa_family) {
 944 #ifdef INET
 945         case AF_INET:
 946                 return (inet_ntop(AF_INET, &sa->sin.sin_addr, buf, size));
 947 #endif /* INET */
 948 #ifdef INET6
 949         case AF_INET6:
 950                 if (IN6_IS_SCOPE_LINKLOCAL(&sa->sin6.sin6_addr)) {
 951                         snprintf(buf, size, "%s%%%u", inet_ntop(AF_INET6,
 952                             &sa->sin6.sin6_addr, buf, size),
 953                             sa->sin6.sin6_scope_id);
 954                         return (buf);
 955                 } else
 956                         return (inet_ntop(AF_INET6, &sa->sin6.sin6_addr,
 957                             buf, size));
 958 #endif /* INET6 */
 959         case 0:
 960                 return ("*");
 961         default:
 962                 return ("(unknown address family)");
 963         }
 964 }
 965
 966 char *
 967 ipsec_sa2str(struct secasvar *sav, char *buf, size_t size)
 968 {
 969         char sbuf[IPSEC_ADDRSTRLEN], dbuf[IPSEC_ADDRSTRLEN];
 970
 971         snprintf(buf, size, "SA(SPI=%08lx src=%s dst=%s)",
 972             (u_long)ntohl(sav->spi),
 973             ipsec_address(&sav->sah->saidx.src, sbuf, sizeof(sbuf)),
 974             ipsec_address(&sav->sah->saidx.dst, dbuf, sizeof(dbuf)));
 975         return (buf);
 976 }
 977
 978 #endif /* _KERNEL */
 979
 980 void
 981 kdebug_sockaddr(struct sockaddr *addr)
 982 {
 983         char buf[IPSEC_ADDRSTRLEN];
 984
 985         /* sanity check */
 986         if (addr == NULL)
 987                 panic("%s: NULL pointer was passed.\n", __func__);
 988
 989         switch (addr->sa_family) {
 990 #ifdef INET
 991         case AF_INET: {
 992                 struct sockaddr_in *sin;
 993
 994                 sin = (struct sockaddr_in *)addr;
 995                 inet_ntop(AF_INET, &sin->sin_addr, buf, sizeof(buf));
 996                 break;
 997         }
 998 #endif
 999 #ifdef INET6
1000         case AF_INET6: {
1001                 struct sockaddr_in6 *sin6;
1002
1003                 sin6 = (struct sockaddr_in6 *)addr;
1004                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1005                         snprintf(buf, sizeof(buf), "%s%%%u",
1006                             inet_ntop(AF_INET6, &sin6->sin6_addr, buf,
1007                             sizeof(buf)), sin6->sin6_scope_id);
1008                 } else
1009                         inet_ntop(AF_INET6, &sin6->sin6_addr, buf,
1010                             sizeof(buf));
1011                 break;
1012         }
1013 #endif
1014         default:
1015                 sprintf(buf, "unknown");
1016         }
1017         printf("sockaddr{ len=%u family=%u addr=%s }\n", addr->sa_len,
1018             addr->sa_family, buf);
1019 }
1020
1021 void
1022 ipsec_bindump(caddr_t buf, int len)
1023 {
1024         int i;
1025
1026         for (i = 0; i < len; i++)
1027                 printf("%c", (unsigned char)buf[i]);
1028
1029         return;
1030 }
1031
1032 void
1033 ipsec_hexdump(caddr_t buf, int len)
1034 {
1035         int i;
1036
1037         for (i = 0; i < len; i++) {
1038                 if (i != 0 && i % 32 == 0) printf("\n");
1039                 if (i % 4 == 0) printf(" ");
1040                 printf("%02x", (unsigned char)buf[i]);
1041         }
1042 #if 0
1043         if (i % 32 != 0) printf("\n");
1044 #endif
1045
1046         return;
1047 }