sys/netipsec/key_debug.c

   1 /*      $FreeBSD$       */
   2 /*      $KAME: key_debug.c,v 1.26 2001/06/27 10:46:50 sakane Exp $      */
   3
   4 /*-
   5  * SPDX-License-Identifier: BSD-3-Clause
   6  *
   7  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
   8  * All rights reserved.
   9  *
  10  * Redistribution and use in source and binary forms, with or without
  11  * modification, are permitted provided that the following conditions
  12  * are met:
  13  * 1. Redistributions of source code must retain the above copyright
  14  *    notice, this list of conditions and the following disclaimer.
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  * 3. Neither the name of the project nor the names of its contributors
  19  *    may be used to endorse or promote products derived from this software
  20  *    without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  32  * SUCH DAMAGE.
  33  */
  34
  35 #ifdef _KERNEL
  36 #include "opt_inet.h"
  37 #include "opt_inet6.h"
  38 #include "opt_ipsec.h"
  39 #endif
  40
  41 #include <sys/param.h>
  42 #ifdef _KERNEL
  43 #include <sys/systm.h>
  44 #include <sys/lock.h>
  45 #include <sys/malloc.h>
  46 #include <sys/mbuf.h>
  47 #include <sys/mutex.h>
  48 #include <sys/queue.h>
  49 #endif
  50 #include <sys/socket.h>
  51
  52 #include <net/vnet.h>
  53
  54 #include <netipsec/key_var.h>
  55 #include <netipsec/key_debug.h>
  56
  57 #include <netinet/in.h>
  58 #include <netipsec/ipsec.h>
  59 #ifdef _KERNEL
  60 #include <netipsec/keydb.h>
  61 #include <netipsec/xform.h>
  62 #endif
  63
  64 #ifndef _KERNEL
  65 #include <ctype.h>
  66 #include <stdio.h>
  67 #include <stdlib.h>
  68 #include <arpa/inet.h>
  69 #endif /* !_KERNEL */
  70
  71 static void kdebug_sadb_prop(struct sadb_ext *);
  72 static void kdebug_sadb_identity(struct sadb_ext *);
  73 static void kdebug_sadb_supported(struct sadb_ext *);
  74 static void kdebug_sadb_lifetime(struct sadb_ext *);
  75 static void kdebug_sadb_sa(struct sadb_ext *);
  76 static void kdebug_sadb_address(struct sadb_ext *);
  77 static void kdebug_sadb_key(struct sadb_ext *);
  78 static void kdebug_sadb_x_sa2(struct sadb_ext *);
  79 static void kdebug_sadb_x_sa_replay(struct sadb_ext *);
  80 static void kdebug_sadb_x_natt(struct sadb_ext *);
  81
  82 #ifndef _KERNEL
  83 #define panic(fmt, ...) { printf(fmt, ## __VA_ARGS__); exit(-1); }
  84 #endif
  85
  86 /* NOTE: host byte order */
  87
  88 /* %%%: about struct sadb_msg */
  89 void
  90 kdebug_sadb(struct sadb_msg *base)
  91 {
  92         struct sadb_ext *ext;
  93         int tlen, extlen;
  94
  95         /* sanity check */
  96         if (base == NULL)
  97                 panic("%s: NULL pointer was passed.\n", __func__);
  98
  99         printf("sadb_msg{ version=%u type=%u errno=%u satype=%u\n",
 100             base->sadb_msg_version, base->sadb_msg_type,
 101             base->sadb_msg_errno, base->sadb_msg_satype);
 102         printf("  len=%u reserved=%u seq=%u pid=%u\n",
 103             base->sadb_msg_len, base->sadb_msg_reserved,
 104             base->sadb_msg_seq, base->sadb_msg_pid);
 105
 106         tlen = PFKEY_UNUNIT64(base->sadb_msg_len) - sizeof(struct sadb_msg);
 107         ext = (struct sadb_ext *)((caddr_t)base + sizeof(struct sadb_msg));
 108
 109         while (tlen > 0) {
 110                 printf("sadb_ext{ len=%u type=%u }\n",
 111                     ext->sadb_ext_len, ext->sadb_ext_type);
 112
 113                 if (ext->sadb_ext_len == 0) {
 114                         printf("%s: invalid ext_len=0 was passed.\n", __func__);
 115                         return;
 116                 }
 117                 if (ext->sadb_ext_len > tlen) {
 118                         printf("%s: ext_len too big (%u > %u).\n",
 119                                 __func__, ext->sadb_ext_len, tlen);
 120                         return;
 121                 }
 122
 123                 switch (ext->sadb_ext_type) {
 124                 case SADB_EXT_SA:
 125                         kdebug_sadb_sa(ext);
 126                         break;
 127                 case SADB_EXT_LIFETIME_CURRENT:
 128                 case SADB_EXT_LIFETIME_HARD:
 129                 case SADB_EXT_LIFETIME_SOFT:
 130                         kdebug_sadb_lifetime(ext);
 131                         break;
 132                 case SADB_EXT_ADDRESS_SRC:
 133                 case SADB_EXT_ADDRESS_DST:
 134                 case SADB_EXT_ADDRESS_PROXY:
 135                 case SADB_X_EXT_NAT_T_OAI:
 136                 case SADB_X_EXT_NAT_T_OAR:
 137                 case SADB_X_EXT_NEW_ADDRESS_SRC:
 138                 case SADB_X_EXT_NEW_ADDRESS_DST:
 139                         kdebug_sadb_address(ext);
 140                         break;
 141                 case SADB_EXT_KEY_AUTH:
 142                 case SADB_EXT_KEY_ENCRYPT:
 143                         kdebug_sadb_key(ext);
 144                         break;
 145                 case SADB_EXT_IDENTITY_SRC:
 146                 case SADB_EXT_IDENTITY_DST:
 147                         kdebug_sadb_identity(ext);
 148                         break;
 149                 case SADB_EXT_SENSITIVITY:
 150                         break;
 151                 case SADB_EXT_PROPOSAL:
 152                         kdebug_sadb_prop(ext);
 153                         break;
 154                 case SADB_EXT_SUPPORTED_AUTH:
 155                 case SADB_EXT_SUPPORTED_ENCRYPT:
 156                         kdebug_sadb_supported(ext);
 157                         break;
 158                 case SADB_EXT_SPIRANGE:
 159                 case SADB_X_EXT_KMPRIVATE:
 160                         break;
 161                 case SADB_X_EXT_POLICY:
 162                         kdebug_sadb_x_policy(ext);
 163                         break;
 164                 case SADB_X_EXT_SA2:
 165                         kdebug_sadb_x_sa2(ext);
 166                         break;
 167                 case SADB_X_EXT_SA_REPLAY:
 168                         kdebug_sadb_x_sa_replay(ext);
 169                         break;
 170                 case SADB_X_EXT_NAT_T_TYPE:
 171                 case SADB_X_EXT_NAT_T_SPORT:
 172                 case SADB_X_EXT_NAT_T_DPORT:
 173                         kdebug_sadb_x_natt(ext);
 174                         break;
 175                 default:
 176                         printf("%s: invalid ext_type %u\n", __func__,
 177                             ext->sadb_ext_type);
 178                         return;
 179                 }
 180
 181                 extlen = PFKEY_UNUNIT64(ext->sadb_ext_len);
 182                 tlen -= extlen;
 183                 ext = (struct sadb_ext *)((caddr_t)ext + extlen);
 184         }
 185
 186         return;
 187 }
 188
 189 static void
 190 kdebug_sadb_prop(struct sadb_ext *ext)
 191 {
 192         struct sadb_prop *prop = (struct sadb_prop *)ext;
 193         struct sadb_comb *comb;
 194         int len;
 195
 196         /* sanity check */
 197         if (ext == NULL)
 198                 panic("%s: NULL pointer was passed.\n", __func__);
 199
 200         len = (PFKEY_UNUNIT64(prop->sadb_prop_len) - sizeof(*prop))
 201                 / sizeof(*comb);
 202         comb = (struct sadb_comb *)(prop + 1);
 203         printf("sadb_prop{ replay=%u\n", prop->sadb_prop_replay);
 204
 205         while (len--) {
 206                 printf("sadb_comb{ auth=%u encrypt=%u "
 207                         "flags=0x%04x reserved=0x%08x\n",
 208                         comb->sadb_comb_auth, comb->sadb_comb_encrypt,
 209                         comb->sadb_comb_flags, comb->sadb_comb_reserved);
 210
 211                 printf("  auth_minbits=%u auth_maxbits=%u "
 212                         "encrypt_minbits=%u encrypt_maxbits=%u\n",
 213                         comb->sadb_comb_auth_minbits,
 214                         comb->sadb_comb_auth_maxbits,
 215                         comb->sadb_comb_encrypt_minbits,
 216                         comb->sadb_comb_encrypt_maxbits);
 217
 218                 printf("  soft_alloc=%u hard_alloc=%u "
 219                         "soft_bytes=%lu hard_bytes=%lu\n",
 220                         comb->sadb_comb_soft_allocations,
 221                         comb->sadb_comb_hard_allocations,
 222                         (unsigned long)comb->sadb_comb_soft_bytes,
 223                         (unsigned long)comb->sadb_comb_hard_bytes);
 224
 225                 printf("  soft_alloc=%lu hard_alloc=%lu "
 226                         "soft_bytes=%lu hard_bytes=%lu }\n",
 227                         (unsigned long)comb->sadb_comb_soft_addtime,
 228                         (unsigned long)comb->sadb_comb_hard_addtime,
 229                         (unsigned long)comb->sadb_comb_soft_usetime,
 230                         (unsigned long)comb->sadb_comb_hard_usetime);
 231                 comb++;
 232         }
 233         printf("}\n");
 234
 235         return;
 236 }
 237
 238 static void
 239 kdebug_sadb_identity(struct sadb_ext *ext)
 240 {
 241         struct sadb_ident *id = (struct sadb_ident *)ext;
 242         int len;
 243
 244         /* sanity check */
 245         if (ext == NULL)
 246                 panic("%s: NULL pointer was passed.\n", __func__);
 247
 248         len = PFKEY_UNUNIT64(id->sadb_ident_len) - sizeof(*id);
 249         printf("sadb_ident_%s{",
 250             id->sadb_ident_exttype == SADB_EXT_IDENTITY_SRC ? "src" : "dst");
 251         switch (id->sadb_ident_type) {
 252         default:
 253                 printf(" type=%d id=%lu",
 254                         id->sadb_ident_type, (u_long)id->sadb_ident_id);
 255                 if (len) {
 256 #ifdef _KERNEL
 257                         ipsec_hexdump((caddr_t)(id + 1), len); /*XXX cast ?*/
 258 #else
 259                         char *p, *ep;
 260                         printf("\n  str=\"");
 261                         p = (char *)(id + 1);
 262                         ep = p + len;
 263                         for (/*nothing*/; *p && p < ep; p++) {
 264                                 if (isprint(*p))
 265                                         printf("%c", *p & 0xff);
 266                                 else
 267                                         printf("\\%03o", *p & 0xff);
 268                         }
 269 #endif
 270                         printf("\"");
 271                 }
 272                 break;
 273         }
 274
 275         printf(" }\n");
 276
 277         return;
 278 }
 279
 280 static void
 281 kdebug_sadb_supported(struct sadb_ext *ext)
 282 {
 283         struct sadb_supported *sup = (struct sadb_supported *)ext;
 284         struct sadb_alg *alg;
 285         int len;
 286
 287         /* sanity check */
 288         if (ext == NULL)
 289                 panic("%s: NULL pointer was passed.\n", __func__);
 290
 291         len = (PFKEY_UNUNIT64(sup->sadb_supported_len) - sizeof(*sup))
 292                 / sizeof(*alg);
 293         alg = (struct sadb_alg *)(sup + 1);
 294         printf("sadb_sup{\n");
 295         while (len--) {
 296                 printf("  { id=%d ivlen=%d min=%d max=%d }\n",
 297                         alg->sadb_alg_id, alg->sadb_alg_ivlen,
 298                         alg->sadb_alg_minbits, alg->sadb_alg_maxbits);
 299                 alg++;
 300         }
 301         printf("}\n");
 302
 303         return;
 304 }
 305
 306 static void
 307 kdebug_sadb_lifetime(struct sadb_ext *ext)
 308 {
 309         struct sadb_lifetime *lft = (struct sadb_lifetime *)ext;
 310
 311         /* sanity check */
 312         if (ext == NULL)
 313                 panic("%s: NULL pointer was passed.\n", __func__);
 314
 315         printf("sadb_lifetime{ alloc=%u, bytes=%u\n",
 316                 lft->sadb_lifetime_allocations,
 317                 (u_int32_t)lft->sadb_lifetime_bytes);
 318         printf("  addtime=%u, usetime=%u }\n",
 319                 (u_int32_t)lft->sadb_lifetime_addtime,
 320                 (u_int32_t)lft->sadb_lifetime_usetime);
 321
 322         return;
 323 }
 324
 325 static void
 326 kdebug_sadb_sa(struct sadb_ext *ext)
 327 {
 328         struct sadb_sa *sa = (struct sadb_sa *)ext;
 329
 330         /* sanity check */
 331         if (ext == NULL)
 332                 panic("%s: NULL pointer was passed.\n", __func__);
 333
 334         printf("sadb_sa{ spi=%u replay=%u state=%u\n",
 335             (u_int32_t)ntohl(sa->sadb_sa_spi), sa->sadb_sa_replay,
 336             sa->sadb_sa_state);
 337         printf("  auth=%u encrypt=%u flags=0x%08x }\n",
 338             sa->sadb_sa_auth, sa->sadb_sa_encrypt, sa->sadb_sa_flags);
 339
 340         return;
 341 }
 342
 343 static void
 344 kdebug_sadb_address(struct sadb_ext *ext)
 345 {
 346         struct sadb_address *addr = (struct sadb_address *)ext;
 347
 348         /* sanity check */
 349         if (ext == NULL)
 350                 panic("%s: NULL pointer was passed.\n", __func__);
 351
 352         printf("sadb_address{ proto=%u prefixlen=%u reserved=0x%02x%02x }\n",
 353             addr->sadb_address_proto, addr->sadb_address_prefixlen,
 354             ((u_char *)&addr->sadb_address_reserved)[0],
 355             ((u_char *)&addr->sadb_address_reserved)[1]);
 356
 357         kdebug_sockaddr((struct sockaddr *)((caddr_t)ext + sizeof(*addr)));
 358 }
 359
 360 static void
 361 kdebug_sadb_key(struct sadb_ext *ext)
 362 {
 363         struct sadb_key *key = (struct sadb_key *)ext;
 364
 365         /* sanity check */
 366         if (ext == NULL)
 367                 panic("%s: NULL pointer was passed.\n", __func__);
 368
 369         printf("sadb_key{ bits=%u reserved=%u\n",
 370             key->sadb_key_bits, key->sadb_key_reserved);
 371         printf("  key=");
 372
 373         /* sanity check 2 */
 374         if ((key->sadb_key_bits >> 3) >
 375                 (PFKEY_UNUNIT64(key->sadb_key_len) - sizeof(struct sadb_key))) {
 376                 printf("%s: key length mismatch, bit:%d len:%ld.\n",
 377                         __func__,
 378                         key->sadb_key_bits >> 3,
 379                         (long)PFKEY_UNUNIT64(key->sadb_key_len) - sizeof(struct sadb_key));
 380         }
 381
 382         ipsec_hexdump((caddr_t)key + sizeof(struct sadb_key),
 383                       key->sadb_key_bits >> 3);
 384         printf(" }\n");
 385         return;
 386 }
 387
 388 static void
 389 kdebug_sadb_x_sa2(struct sadb_ext *ext)
 390 {
 391         struct sadb_x_sa2 *sa2 = (struct sadb_x_sa2 *)ext;
 392
 393         /* sanity check */
 394         if (ext == NULL)
 395                 panic("%s: NULL pointer was passed.\n", __func__);
 396
 397         printf("sadb_x_sa2{ mode=%u reqid=%u\n",
 398             sa2->sadb_x_sa2_mode, sa2->sadb_x_sa2_reqid);
 399         printf("  reserved1=%u reserved2=%u sequence=%u }\n",
 400             sa2->sadb_x_sa2_reserved1, sa2->sadb_x_sa2_reserved2,
 401             sa2->sadb_x_sa2_sequence);
 402
 403         return;
 404 }
 405
 406 static void
 407 kdebug_sadb_x_sa_replay(struct sadb_ext *ext)
 408 {
 409         struct sadb_x_sa_replay *replay;
 410
 411         /* sanity check */
 412         if (ext == NULL)
 413                 panic("%s: NULL pointer was passed.\n", __func__);
 414
 415         replay = (struct sadb_x_sa_replay *)ext;
 416         printf("sadb_x_sa_replay{ replay=%u }\n",
 417             replay->sadb_x_sa_replay_replay);
 418 }
 419
 420 static void
 421 kdebug_sadb_x_natt(struct sadb_ext *ext)
 422 {
 423         struct sadb_x_nat_t_type *type;
 424         struct sadb_x_nat_t_port *port;
 425
 426         /* sanity check */
 427         if (ext == NULL)
 428                 panic("%s: NULL pointer was passed.\n", __func__);
 429
 430         if (ext->sadb_ext_type == SADB_X_EXT_NAT_T_TYPE) {
 431                 type = (struct sadb_x_nat_t_type *)ext;
 432                 printf("sadb_x_nat_t_type{ type=%u }\n",
 433                     type->sadb_x_nat_t_type_type);
 434         } else {
 435                 port = (struct sadb_x_nat_t_port *)ext;
 436                 printf("sadb_x_nat_t_port{ port=%u }\n",
 437                     ntohs(port->sadb_x_nat_t_port_port));
 438         }
 439 }
 440
 441 void
 442 kdebug_sadb_x_policy(struct sadb_ext *ext)
 443 {
 444         struct sadb_x_policy *xpl = (struct sadb_x_policy *)ext;
 445         struct sockaddr *addr;
 446
 447         /* sanity check */
 448         if (ext == NULL)
 449                 panic("%s: NULL pointer was passed.\n", __func__);
 450
 451         printf("sadb_x_policy{ type=%u dir=%u id=%x scope=%u %s=%u }\n",
 452                 xpl->sadb_x_policy_type, xpl->sadb_x_policy_dir,
 453                 xpl->sadb_x_policy_id, xpl->sadb_x_policy_scope,
 454                 xpl->sadb_x_policy_scope == IPSEC_POLICYSCOPE_IFNET ?
 455                 "ifindex": "priority", xpl->sadb_x_policy_priority);
 456
 457         if (xpl->sadb_x_policy_type == IPSEC_POLICY_IPSEC) {
 458                 int tlen;
 459                 struct sadb_x_ipsecrequest *xisr;
 460
 461                 tlen = PFKEY_UNUNIT64(xpl->sadb_x_policy_len) - sizeof(*xpl);
 462                 xisr = (struct sadb_x_ipsecrequest *)(xpl + 1);
 463
 464                 while (tlen > 0) {
 465                         printf(" { len=%u proto=%u mode=%u level=%u reqid=%u\n",
 466                                 xisr->sadb_x_ipsecrequest_len,
 467                                 xisr->sadb_x_ipsecrequest_proto,
 468                                 xisr->sadb_x_ipsecrequest_mode,
 469                                 xisr->sadb_x_ipsecrequest_level,
 470                                 xisr->sadb_x_ipsecrequest_reqid);
 471
 472                         if (xisr->sadb_x_ipsecrequest_len > sizeof(*xisr)) {
 473                                 addr = (struct sockaddr *)(xisr + 1);
 474                                 kdebug_sockaddr(addr);
 475                                 addr = (struct sockaddr *)((caddr_t)addr
 476                                                         + addr->sa_len);
 477                                 kdebug_sockaddr(addr);
 478                         }
 479
 480                         printf(" }\n");
 481
 482                         /* prevent infinite loop */
 483                         if (xisr->sadb_x_ipsecrequest_len <= 0) {
 484                                 printf("%s: wrong policy struct.\n", __func__);
 485                                 return;
 486                         }
 487                         /* prevent overflow */
 488                         if (xisr->sadb_x_ipsecrequest_len > tlen) {
 489                                 printf("%s: invalid ipsec policy length "
 490                                         "(%u > %u)\n", __func__,
 491                                         xisr->sadb_x_ipsecrequest_len, tlen);
 492                                 return;
 493                         }
 494
 495                         tlen -= xisr->sadb_x_ipsecrequest_len;
 496
 497                         xisr = (struct sadb_x_ipsecrequest *)((caddr_t)xisr
 498                                         + xisr->sadb_x_ipsecrequest_len);
 499                 }
 500
 501                 if (tlen != 0)
 502                         panic("%s: wrong policy struct.\n", __func__);
 503         }
 504
 505         return;
 506 }
 507
 508 #ifdef _KERNEL
 509 /* %%%: about SPD and SAD */
 510 const char*
 511 kdebug_secpolicy_state(u_int state)
 512 {
 513
 514         switch (state) {
 515         case IPSEC_SPSTATE_DEAD:
 516                 return ("dead");
 517         case IPSEC_SPSTATE_LARVAL:
 518                 return ("larval");
 519         case IPSEC_SPSTATE_ALIVE:
 520                 return ("alive");
 521         case IPSEC_SPSTATE_PCB:
 522                 return ("pcb");
 523         case IPSEC_SPSTATE_IFNET:
 524                 return ("ifnet");
 525         }
 526         return ("unknown");
 527 }
 528
 529 const char*
 530 kdebug_secpolicy_policy(u_int policy)
 531 {
 532
 533         switch (policy) {
 534         case IPSEC_POLICY_DISCARD:
 535                 return ("discard");
 536         case IPSEC_POLICY_NONE:
 537                 return ("none");
 538         case IPSEC_POLICY_IPSEC:
 539                 return ("ipsec");
 540         case IPSEC_POLICY_ENTRUST:
 541                 return ("entrust");
 542         case IPSEC_POLICY_BYPASS:
 543                 return ("bypass");
 544         }
 545         return ("unknown");
 546 }
 547
 548 const char*
 549 kdebug_secpolicyindex_dir(u_int dir)
 550 {
 551
 552         switch (dir) {
 553         case IPSEC_DIR_ANY:
 554                 return ("any");
 555         case IPSEC_DIR_INBOUND:
 556                 return ("in");
 557         case IPSEC_DIR_OUTBOUND:
 558                 return ("out");
 559         }
 560         return ("unknown");
 561 }
 562
 563 const char*
 564 kdebug_ipsecrequest_level(u_int level)
 565 {
 566
 567         switch (level) {
 568         case IPSEC_LEVEL_DEFAULT:
 569                 return ("default");
 570         case IPSEC_LEVEL_USE:
 571                 return ("use");
 572         case IPSEC_LEVEL_REQUIRE:
 573                 return ("require");
 574         case IPSEC_LEVEL_UNIQUE:
 575                 return ("unique");
 576         }
 577         return ("unknown");
 578 }
 579
 580 const char*
 581 kdebug_secasindex_mode(u_int mode)
 582 {
 583
 584         switch (mode) {
 585         case IPSEC_MODE_ANY:
 586                 return ("any");
 587         case IPSEC_MODE_TRANSPORT:
 588                 return ("transport");
 589         case IPSEC_MODE_TUNNEL:
 590                 return ("tunnel");
 591         case IPSEC_MODE_TCPMD5:
 592                 return ("tcp-md5");
 593         }
 594         return ("unknown");
 595 }
 596
 597 const char*
 598 kdebug_secasv_state(u_int state)
 599 {
 600
 601         switch (state) {
 602         case SADB_SASTATE_LARVAL:
 603                 return ("larval");
 604         case SADB_SASTATE_MATURE:
 605                 return ("mature");
 606         case SADB_SASTATE_DYING:
 607                 return ("dying");
 608         case SADB_SASTATE_DEAD:
 609                 return ("dead");
 610         }
 611         return ("unknown");
 612 }
 613
 614 static char*
 615 kdebug_port2str(const struct sockaddr *sa, char *buf, size_t len)
 616 {
 617         uint16_t port;
 618
 619         IPSEC_ASSERT(sa != NULL, ("null sa"));
 620         switch (sa->sa_family) {
 621 #ifdef INET
 622         case AF_INET:
 623                 port = ntohs(((const struct sockaddr_in *)sa)->sin_port);
 624                 break;
 625 #endif
 626 #ifdef INET6
 627         case AF_INET6:
 628                 port = ntohs(((const struct sockaddr_in6 *)sa)->sin6_port);
 629                 break;
 630 #endif
 631         default:
 632                 port = 0;
 633         }
 634         if (port == 0)
 635                 return ("*");
 636         snprintf(buf, len, "%u", port);
 637         return (buf);
 638 }
 639
 640 void
 641 kdebug_secpolicy(struct secpolicy *sp)
 642 {
 643         u_int idx;
 644
 645         IPSEC_ASSERT(sp != NULL, ("null sp"));
 646         printf("SP { refcnt=%u id=%u priority=%u state=%s policy=%s\n",
 647             sp->refcnt, sp->id, sp->priority,
 648             kdebug_secpolicy_state(sp->state),
 649             kdebug_secpolicy_policy(sp->policy));
 650         kdebug_secpolicyindex(&sp->spidx, "  ");
 651         for (idx = 0; idx < sp->tcount; idx++) {
 652                 printf("  req[%u]{ level=%s ", idx,
 653                     kdebug_ipsecrequest_level(sp->req[idx]->level));
 654                 kdebug_secasindex(&sp->req[idx]->saidx, NULL);
 655                 printf("  }\n");
 656         }
 657         printf("}\n");
 658 }
 659
 660 void
 661 kdebug_secpolicyindex(struct secpolicyindex *spidx, const char *indent)
 662 {
 663         char buf[IPSEC_ADDRSTRLEN];
 664
 665         IPSEC_ASSERT(spidx != NULL, ("null spidx"));
 666         if (indent != NULL)
 667                 printf("%s", indent);
 668         printf("spidx { dir=%s ul_proto=",
 669             kdebug_secpolicyindex_dir(spidx->dir));
 670         if (spidx->ul_proto == IPSEC_ULPROTO_ANY)
 671                 printf("* ");
 672         else
 673                 printf("%u ", spidx->ul_proto);
 674         printf("%s/%u -> ", ipsec_address(&spidx->src, buf, sizeof(buf)),
 675             spidx->prefs);
 676         printf("%s/%u }\n", ipsec_address(&spidx->dst, buf, sizeof(buf)),
 677             spidx->prefd);
 678 }
 679
 680 void
 681 kdebug_secasindex(const struct secasindex *saidx, const char *indent)
 682 {
 683         char buf[IPSEC_ADDRSTRLEN], port[6];
 684
 685         IPSEC_ASSERT(saidx != NULL, ("null saidx"));
 686         if (indent != NULL)
 687                 printf("%s", indent);
 688         printf("saidx { mode=%s proto=%u reqid=%u ",
 689             kdebug_secasindex_mode(saidx->mode), saidx->proto, saidx->reqid);
 690         printf("%s:%s -> ", ipsec_address(&saidx->src, buf, sizeof(buf)),
 691             kdebug_port2str(&saidx->src.sa, port, sizeof(port)));
 692         printf("%s:%s }\n", ipsec_address(&saidx->dst, buf, sizeof(buf)),
 693             kdebug_port2str(&saidx->dst.sa, port, sizeof(port)));
 694 }
 695
 696 static void
 697 kdebug_sec_lifetime(struct seclifetime *lft, const char *indent)
 698 {
 699
 700         IPSEC_ASSERT(lft != NULL, ("null lft"));
 701         if (indent != NULL)
 702                 printf("%s", indent);
 703         printf("lifetime { alloc=%u, bytes=%ju addtime=%ju usetime=%ju }\n",
 704             lft->allocations, (uintmax_t)lft->bytes, (uintmax_t)lft->addtime,
 705             (uintmax_t)lft->usetime);
 706 }
 707
 708 void
 709 kdebug_secash(struct secashead *sah, const char *indent)
 710 {
 711
 712         IPSEC_ASSERT(sah != NULL, ("null sah"));
 713         if (indent != NULL)
 714                 printf("%s", indent);
 715         printf("SAH { refcnt=%u state=%s\n", sah->refcnt,
 716             kdebug_secasv_state(sah->state));
 717         if (indent != NULL)
 718                 printf("%s", indent);
 719         kdebug_secasindex(&sah->saidx, indent);
 720         if (indent != NULL)
 721                 printf("%s", indent);
 722         printf("}\n");
 723 }
 724
 725 #ifdef IPSEC_DEBUG
 726 static void
 727 kdebug_secreplay(struct secreplay *rpl)
 728 {
 729         int len, l;
 730
 731         IPSEC_ASSERT(rpl != NULL, ("null rpl"));
 732         printf(" secreplay{ count=%u bitmap_size=%u wsize=%u seq=%u lastseq=%u",
 733             rpl->count, rpl->bitmap_size, rpl->wsize, rpl->seq, rpl->lastseq);
 734
 735         if (rpl->bitmap == NULL) {
 736                 printf("  }\n");
 737                 return;
 738         }
 739
 740         printf("\n    bitmap { ");
 741         for (len = 0; len < rpl->bitmap_size*4; len++) {
 742                 for (l = 7; l >= 0; l--)
 743                         printf("%u", (((rpl->bitmap)[len] >> l) & 1) ? 1 : 0);
 744         }
 745         printf("    }\n");
 746 }
 747 #endif /* IPSEC_DEBUG */
 748
 749 static void
 750 kdebug_secnatt(struct secnatt *natt)
 751 {
 752         char buf[IPSEC_ADDRSTRLEN];
 753
 754         IPSEC_ASSERT(natt != NULL, ("null natt"));
 755         printf("  natt{ sport=%u dport=%u ", ntohs(natt->sport),
 756             ntohs(natt->dport));
 757         if (natt->flags & IPSEC_NATT_F_OAI)
 758                 printf("oai=%s ", ipsec_address(&natt->oai, buf, sizeof(buf)));
 759         if (natt->flags & IPSEC_NATT_F_OAR)
 760                 printf("oar=%s ", ipsec_address(&natt->oar, buf, sizeof(buf)));
 761         printf("}\n");
 762 }
 763
 764 void
 765 kdebug_secasv(struct secasvar *sav)
 766 {
 767         struct seclifetime lft_c;
 768
 769         IPSEC_ASSERT(sav != NULL, ("null sav"));
 770
 771         printf("SA { refcnt=%u spi=%u seq=%u pid=%u flags=0x%x state=%s\n",
 772             sav->refcnt, ntohl(sav->spi), sav->seq, (uint32_t)sav->pid,
 773             sav->flags, kdebug_secasv_state(sav->state));
 774         kdebug_secash(sav->sah, "  ");
 775
 776         lft_c.addtime = sav->created;
 777         lft_c.allocations = (uint32_t)counter_u64_fetch(
 778             sav->lft_c_allocations);
 779         lft_c.bytes = counter_u64_fetch(sav->lft_c_bytes);
 780         lft_c.usetime = sav->firstused;
 781         kdebug_sec_lifetime(&lft_c, "  c_");
 782         if (sav->lft_h != NULL)
 783                 kdebug_sec_lifetime(sav->lft_h, "  h_");
 784         if (sav->lft_s != NULL)
 785                 kdebug_sec_lifetime(sav->lft_s, "  s_");
 786
 787         if (sav->tdb_authalgxform != NULL)
 788                 printf("  alg_auth=%s\n", sav->tdb_authalgxform->name);
 789         if (sav->key_auth != NULL)
 790                 KEYDBG(DUMP,
 791                     kdebug_sadb_key((struct sadb_ext *)sav->key_auth));
 792         if (sav->tdb_encalgxform != NULL)
 793                 printf("  alg_enc=%s\n", sav->tdb_encalgxform->name);
 794         if (sav->key_enc != NULL)
 795                 KEYDBG(DUMP,
 796                     kdebug_sadb_key((struct sadb_ext *)sav->key_enc));
 797         if (sav->natt != NULL)
 798                 kdebug_secnatt(sav->natt);
 799         if (sav->replay != NULL) {
 800                 KEYDBG(DUMP,
 801                     SECASVAR_LOCK(sav);
 802                     kdebug_secreplay(sav->replay);
 803                     SECASVAR_UNLOCK(sav));
 804         }
 805         printf("}\n");
 806 }
 807
 808 void
 809 kdebug_mbufhdr(const struct mbuf *m)
 810 {
 811         /* sanity check */
 812         if (m == NULL)
 813                 return;
 814
 815         printf("mbuf(%p){ m_next:%p m_nextpkt:%p m_data:%p "
 816                "m_len:%d m_type:0x%02x m_flags:0x%02x }\n",
 817                 m, m->m_next, m->m_nextpkt, m->m_data,
 818                 m->m_len, m->m_type, m->m_flags);
 819
 820         if (m->m_flags & M_PKTHDR) {
 821                 printf("  m_pkthdr{ len:%d rcvif:%p }\n",
 822                     m->m_pkthdr.len, m->m_pkthdr.rcvif);
 823         }
 824
 825         if (m->m_flags & M_EXT) {
 826                 printf("  m_ext{ ext_buf:%p ext_free:%p "
 827                        "ext_size:%u ext_cnt:%p }\n",
 828                         m->m_ext.ext_buf, m->m_ext.ext_free,
 829                         m->m_ext.ext_size, m->m_ext.ext_cnt);
 830         }
 831
 832         return;
 833 }
 834
 835 void
 836 kdebug_mbuf(const struct mbuf *m0)
 837 {
 838         const struct mbuf *m = m0;
 839         int i, j;
 840
 841         for (j = 0; m; m = m->m_next) {
 842                 kdebug_mbufhdr(m);
 843                 printf("  m_data:\n");
 844                 for (i = 0; i < m->m_len; i++) {
 845                         if (i && i % 32 == 0)
 846                                 printf("\n");
 847                         if (i % 4 == 0)
 848                                 printf(" ");
 849                         printf("%02x", mtod(m, const u_char *)[i]);
 850                         j++;
 851                 }
 852                 printf("\n");
 853         }
 854
 855         return;
 856 }
 857
 858 /* Return a printable string for the address. */
 859 char *
 860 ipsec_address(const union sockaddr_union* sa, char *buf, socklen_t size)
 861 {
 862
 863         switch (sa->sa.sa_family) {
 864 #ifdef INET
 865         case AF_INET:
 866                 return (inet_ntop(AF_INET, &sa->sin.sin_addr, buf, size));
 867 #endif /* INET */
 868 #ifdef INET6
 869         case AF_INET6:
 870                 if (IN6_IS_SCOPE_LINKLOCAL(&sa->sin6.sin6_addr)) {
 871                         snprintf(buf, size, "%s%%%u", inet_ntop(AF_INET6,
 872                             &sa->sin6.sin6_addr, buf, size),
 873                             sa->sin6.sin6_scope_id);
 874                         return (buf);
 875                 } else
 876                         return (inet_ntop(AF_INET6, &sa->sin6.sin6_addr,
 877                             buf, size));
 878 #endif /* INET6 */
 879         case 0:
 880                 return ("*");
 881         default:
 882                 return ("(unknown address family)");
 883         }
 884 }
 885
 886 char *
 887 ipsec_sa2str(struct secasvar *sav, char *buf, size_t size)
 888 {
 889         char sbuf[IPSEC_ADDRSTRLEN], dbuf[IPSEC_ADDRSTRLEN];
 890
 891         snprintf(buf, size, "SA(SPI=%08lx src=%s dst=%s)",
 892             (u_long)ntohl(sav->spi),
 893             ipsec_address(&sav->sah->saidx.src, sbuf, sizeof(sbuf)),
 894             ipsec_address(&sav->sah->saidx.dst, dbuf, sizeof(dbuf)));
 895         return (buf);
 896 }
 897
 898 #endif /* _KERNEL */
 899
 900 void
 901 kdebug_sockaddr(struct sockaddr *addr)
 902 {
 903         char buf[IPSEC_ADDRSTRLEN];
 904
 905         /* sanity check */
 906         if (addr == NULL)
 907                 panic("%s: NULL pointer was passed.\n", __func__);
 908
 909         switch (addr->sa_family) {
 910 #ifdef INET
 911         case AF_INET: {
 912                 struct sockaddr_in *sin;
 913
 914                 sin = (struct sockaddr_in *)addr;
 915                 inet_ntop(AF_INET, &sin->sin_addr, buf, sizeof(buf));
 916                 break;
 917         }
 918 #endif
 919 #ifdef INET6
 920         case AF_INET6: {
 921                 struct sockaddr_in6 *sin6;
 922
 923                 sin6 = (struct sockaddr_in6 *)addr;
 924                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
 925                         snprintf(buf, sizeof(buf), "%s%%%u",
 926                             inet_ntop(AF_INET6, &sin6->sin6_addr, buf,
 927                             sizeof(buf)), sin6->sin6_scope_id);
 928                 } else
 929                         inet_ntop(AF_INET6, &sin6->sin6_addr, buf,
 930                             sizeof(buf));
 931                 break;
 932         }
 933 #endif
 934         default:
 935                 sprintf(buf, "unknown");
 936         }
 937         printf("sockaddr{ len=%u family=%u addr=%s }\n", addr->sa_len,
 938             addr->sa_family, buf);
 939 }
 940
 941 void
 942 ipsec_bindump(caddr_t buf, int len)
 943 {
 944         int i;
 945
 946         for (i = 0; i < len; i++)
 947                 printf("%c", (unsigned char)buf[i]);
 948
 949         return;
 950 }
 951
 952
 953 void
 954 ipsec_hexdump(caddr_t buf, int len)
 955 {
 956         int i;
 957
 958         for (i = 0; i < len; i++) {
 959                 if (i != 0 && i % 32 == 0) printf("\n");
 960                 if (i % 4 == 0) printf(" ");
 961                 printf("%02x", (unsigned char)buf[i]);
 962         }
 963 #if 0
 964         if (i % 32 != 0) printf("\n");
 965 #endif
 966
 967         return;
 968 }