usr.bin/netstat/ipsec.c

   1 /*      $KAME: ipsec.c,v 1.33 2003/07/25 09:54:32 itojun Exp $  */
   2
   3 /*-
   4  * Copyright (c) 2005 NTT Multimedia Communications Laboratories, Inc.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  *
  16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  17  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  19  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  20  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  26  * SUCH DAMAGE.
  27  */
  28 /*-
  29  * Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project.
  30  * All rights reserved.
  31  *
  32  * Redistribution and use in source and binary forms, with or without
  33  * modification, are permitted provided that the following conditions
  34  * are met:
  35  * 1. Redistributions of source code must retain the above copyright
  36  *    notice, this list of conditions and the following disclaimer.
  37  * 2. Redistributions in binary form must reproduce the above copyright
  38  *    notice, this list of conditions and the following disclaimer in the
  39  *    documentation and/or other materials provided with the distribution.
  40  * 3. Neither the name of the project nor the names of its contributors
  41  *    may be used to endorse or promote products derived from this software
  42  *    without specific prior written permission.
  43  *
  44  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  45  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  46  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  47  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  48  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  49  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  50  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  51  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  52  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  53  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  54  * SUCH DAMAGE.
  55  */
  56 /*-
  57  * Copyright (c) 1983, 1988, 1993
  58  *      The Regents of the University of California.  All rights reserved.
  59  *
  60  * Redistribution and use in source and binary forms, with or without
  61  * modification, are permitted provided that the following conditions
  62  * are met:
  63  * 1. Redistributions of source code must retain the above copyright
  64  *    notice, this list of conditions and the following disclaimer.
  65  * 2. Redistributions in binary form must reproduce the above copyright
  66  *    notice, this list of conditions and the following disclaimer in the
  67  *    documentation and/or other materials provided with the distribution.
  68  * 4. Neither the name of the University nor the names of its contributors
  69  *    may be used to endorse or promote products derived from this software
  70  *    without specific prior written permission.
  71  *
  72  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  73  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  74  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  75  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  76  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  77  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  78  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  79  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  80  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  81  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  82  * SUCH DAMAGE.
  83  */
  84
  85 #if 0
  86 #ifndef lint
  87 static char sccsid[] = "@(#)inet.c      8.5 (Berkeley) 5/24/95";
  88 #endif /* not lint */
  89 #endif
  90
  91 #include <sys/cdefs.h>
  92 __FBSDID("$FreeBSD$");
  93
  94 #include <sys/param.h>
  95 #include <sys/queue.h>
  96 #include <sys/socket.h>
  97 #include <sys/socketvar.h>
  98
  99 #include <netinet/in.h>
 100
 101 #ifdef IPSEC
 102 #include <netipsec/ipsec.h>
 103 #include <netipsec/ah_var.h>
 104 #include <netipsec/esp_var.h>
 105 #include <netipsec/ipcomp_var.h>
 106 #endif
 107
 108 #include <stdint.h>
 109 #include <stdio.h>
 110 #include <stdbool.h>
 111 #include <string.h>
 112 #include <unistd.h>
 113 #include <libxo/xo.h>
 114 #include "netstat.h"
 115
 116 #ifdef IPSEC
 117 struct val2str {
 118         int val;
 119         const char *str;
 120 };
 121
 122 static struct val2str ipsec_ahnames[] = {
 123         { SADB_AALG_NONE, "none", },
 124         { SADB_AALG_MD5HMAC, "hmac-md5", },
 125         { SADB_AALG_SHA1HMAC, "hmac-sha1", },
 126         { SADB_X_AALG_MD5, "md5", },
 127         { SADB_X_AALG_SHA, "sha", },
 128         { SADB_X_AALG_NULL, "null", },
 129 #ifdef SADB_X_AALG_SHA2_256
 130         { SADB_X_AALG_SHA2_256, "hmac-sha2-256", },
 131 #endif
 132 #ifdef SADB_X_AALG_SHA2_384
 133         { SADB_X_AALG_SHA2_384, "hmac-sha2-384", },
 134 #endif
 135 #ifdef SADB_X_AALG_SHA2_512
 136         { SADB_X_AALG_SHA2_512, "hmac-sha2-512", },
 137 #endif
 138 #ifdef SADB_X_AALG_RIPEMD160HMAC
 139         { SADB_X_AALG_RIPEMD160HMAC, "hmac-ripemd160", },
 140 #endif
 141 #ifdef SADB_X_AALG_AES_XCBC_MAC
 142         { SADB_X_AALG_AES_XCBC_MAC, "aes-xcbc-mac", },
 143 #endif
 144         { -1, NULL },
 145 };
 146
 147 static struct val2str ipsec_espnames[] = {
 148         { SADB_EALG_NONE, "none", },
 149         { SADB_EALG_DESCBC, "des-cbc", },
 150         { SADB_EALG_3DESCBC, "3des-cbc", },
 151         { SADB_EALG_NULL, "null", },
 152         { SADB_X_EALG_CAST128CBC, "cast128-cbc", },
 153         { SADB_X_EALG_BLOWFISHCBC, "blowfish-cbc", },
 154 #ifdef SADB_X_EALG_RIJNDAELCBC
 155         { SADB_X_EALG_RIJNDAELCBC, "rijndael-cbc", },
 156 #endif
 157 #ifdef SADB_X_EALG_AESCTR
 158         { SADB_X_EALG_AESCTR, "aes-ctr", },
 159 #endif
 160         { -1, NULL },
 161 };
 162
 163 static struct val2str ipsec_compnames[] = {
 164         { SADB_X_CALG_NONE, "none", },
 165         { SADB_X_CALG_OUI, "oui", },
 166         { SADB_X_CALG_DEFLATE, "deflate", },
 167         { SADB_X_CALG_LZS, "lzs", },
 168         { -1, NULL },
 169 };
 170
 171 static void print_ipsecstats(const struct ipsecstat *ipsecstat);
 172
 173 static void
 174 print_ipsecstats(const struct ipsecstat *ipsecstat)
 175 {
 176         xo_open_container("ipsec-statistics");
 177
 178 #define p(f, m) if (ipsecstat->f || sflag <= 1) \
 179         xo_emit(m, (uintmax_t)ipsecstat->f, plural(ipsecstat->f))
 180
 181         p(ips_in_polvio, "\t{:dropped-policy-violation/%ju} "
 182             "{N:/inbound packet%s violated process security policy}\n");
 183         p(ips_in_nomem, "\t{:dropped-no-memory/%ju} "
 184             "{N:/inbound packet%s failed due to insufficient memory}\n");
 185         p(ips_in_inval, "\t{:dropped-invalid/%ju} "
 186             "{N:/invalid inbound packet%s}\n");
 187         p(ips_out_polvio, "\t{:discarded-policy-violation/%ju} "
 188             "{N:/outbound packet%s violated process security policy}\n");
 189         p(ips_out_nosa, "\t{:discarded-no-sa/%ju} "
 190             "{N:/outbound packet%s with no SA available}\n");
 191         p(ips_out_nomem, "\t{:discarded-no-memory/%ju} "
 192             "{N:/outbound packet%s failed due to insufficient memory}\n");
 193         p(ips_out_noroute, "\t{:discarded-no-route/%ju} "
 194             "{N:/outbound packet%s with no route available}\n");
 195         p(ips_out_inval, "\t{:discarded-invalid/%ju} "
 196             "{N:/invalid outbound packet%s}\n");
 197         p(ips_out_bundlesa, "\t{:send-bundled-sa/%ju} "
 198             "{N:/outbound packet%s with bundled SAs}\n");
 199         p(ips_mbcoalesced, "\t{:mbufs-coalesced-during-clone/%ju} "
 200             "{N:/mbuf%s coalesced during clone}\n");
 201         p(ips_clcoalesced, "\t{:clusters-coalesced-during-clone/%ju} "
 202             "{N:/cluster%s coalesced during clone}\n");
 203         p(ips_clcopied, "\t{:clusters-copied-during-clone/%ju} "
 204             "{N:/cluster%s copied during clone}\n");
 205         p(ips_mbinserted, "\t{:mbufs-inserted/%ju} "
 206             "{N:/mbuf%s inserted during makespace}\n");
 207 #undef p
 208         xo_close_container("ipsec-statistics");
 209 }
 210
 211 void
 212 ipsec_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 213 {
 214         struct ipsecstat ipsecstat;
 215
 216         if (off == 0)
 217                 return;
 218         xo_emit("{T:/%s}:\n", name);
 219         kread_counters(off, (char *)&ipsecstat, sizeof(ipsecstat));
 220
 221         print_ipsecstats(&ipsecstat);
 222 }
 223
 224
 225 static void print_ahstats(const struct ahstat *ahstat);
 226 static void print_espstats(const struct espstat *espstat);
 227 static void print_ipcompstats(const struct ipcompstat *ipcompstat);
 228
 229 /*
 230  * Dump IPSEC statistics structure.
 231  */
 232 static void
 233 ipsec_hist_new(const uint64_t *hist, size_t histmax,
 234     const struct val2str *name, const char *title, const char *cname)
 235 {
 236         int first;
 237         size_t proto;
 238         const struct val2str *p;
 239
 240         first = 1;
 241         for (proto = 0; proto < histmax; proto++) {
 242                 if (hist[proto] <= 0)
 243                         continue;
 244                 if (first) {
 245                         xo_open_list(cname);
 246                         xo_emit("\t{T:/%s histogram}:\n", title);
 247                         first = 0;
 248                 }
 249                 xo_open_instance(cname);
 250                 for (p = name; p && p->str; p++) {
 251                         if (p->val == (int)proto)
 252                                 break;
 253                 }
 254                 if (p && p->str) {
 255                         xo_emit("\t\t{k:name}: {:count/%ju}\n", p->str,
 256                             (uintmax_t)hist[proto]);
 257                 } else {
 258                         xo_emit("\t\t#{k:name/%lu}: {:count/%ju}\n",
 259                             (unsigned long)proto, (uintmax_t)hist[proto]);
 260                 }
 261                 xo_close_instance(cname);
 262         }
 263         if (!first)
 264                 xo_close_list(cname);
 265 }
 266
 267 static void
 268 print_ahstats(const struct ahstat *ahstat)
 269 {
 270         xo_open_container("ah-statictics");
 271
 272 #define p(f, n, m) if (ahstat->f || sflag <= 1) \
 273         xo_emit("\t{:" n "/%ju} {N:/" m "}\n",  \
 274             (uintmax_t)ahstat->f, plural(ahstat->f))
 275 #define hist(f, n, t, c) \
 276         ipsec_hist_new((f), sizeof(f)/sizeof(f[0]), (n), (t), (c))
 277
 278         p(ahs_hdrops, "dropped-short-header",
 279             "packet%s shorter than header shows");
 280         p(ahs_nopf, "dropped-bad-protocol",
 281             "packet%s dropped; protocol family not supported");
 282         p(ahs_notdb, "dropped-no-tdb", "packet%s dropped; no TDB");
 283         p(ahs_badkcr, "dropped-bad-kcr", "packet%s dropped; bad KCR");
 284         p(ahs_qfull, "dropped-queue-full", "packet%s dropped; queue full");
 285         p(ahs_noxform, "dropped-no-transform",
 286             "packet%s dropped; no transform");
 287         p(ahs_wrap, "replay-counter-wraps", "replay counter wrap%s");
 288         p(ahs_badauth, "dropped-bad-auth",
 289             "packet%s dropped; bad authentication detected");
 290         p(ahs_badauthl, "dropped-bad-auth-level",
 291             "packet%s dropped; bad authentication length");
 292         p(ahs_replay, "possile-replay-detected",
 293             "possible replay packet%s detected");
 294         p(ahs_input, "received-packets", "packet%s in");
 295         p(ahs_output, "send-packets", "packet%s out");
 296         p(ahs_invalid, "dropped-bad-tdb", "packet%s dropped; invalid TDB");
 297         p(ahs_ibytes, "received-bytes", "byte%s in");
 298         p(ahs_obytes, "send-bytes", "byte%s out");
 299         p(ahs_toobig, "dropped-too-large",
 300             "packet%s dropped; larger than IP_MAXPACKET");
 301         p(ahs_pdrops, "dropped-policy-violation",
 302             "packet%s blocked due to policy");
 303         p(ahs_crypto, "crypto-failures", "crypto processing failure%s");
 304         p(ahs_tunnel, "tunnel-failures", "tunnel sanity check failure%s");
 305         hist(ahstat->ahs_hist, ipsec_ahnames,
 306             "AH output", "ah-output-histogram");
 307
 308 #undef p
 309 #undef hist
 310         xo_close_container("ah-statictics");
 311 }
 312
 313 void
 314 ah_stats(u_long off, const char *name, int family __unused, int proto __unused)
 315 {
 316         struct ahstat ahstat;
 317
 318         if (off == 0)
 319                 return;
 320         xo_emit("{T:/%s}:\n", name);
 321         kread_counters(off, (char *)&ahstat, sizeof(ahstat));
 322
 323         print_ahstats(&ahstat);
 324 }
 325
 326 static void
 327 print_espstats(const struct espstat *espstat)
 328 {
 329         xo_open_container("esp-statictics");
 330 #define p(f, n, m) if (espstat->f || sflag <= 1)        \
 331         xo_emit("\t{:" n "/%ju} {N:/" m "}\n",          \
 332             (uintmax_t)espstat->f, plural(espstat->f))
 333 #define hist(f, n, t, c) \
 334         ipsec_hist_new((f), sizeof(f)/sizeof(f[0]), (n), (t), (c));
 335
 336         p(esps_hdrops, "dropped-short-header",
 337             "packet%s shorter than header shows");
 338         p(esps_nopf, "dropped-bad-protocol",
 339             "packet%s dropped; protocol family not supported");
 340         p(esps_notdb, "dropped-no-tdb", "packet%s dropped; no TDB");
 341         p(esps_badkcr, "dropped-bad-kcr", "packet%s dropped; bad KCR");
 342         p(esps_qfull, "dropped-queue-full", "packet%s dropped; queue full");
 343         p(esps_noxform, "dropped-no-transform",
 344             "packet%s dropped; no transform");
 345         p(esps_badilen, "dropped-bad-length", "packet%s dropped; bad ilen");
 346         p(esps_wrap, "replay-counter-wraps", "replay counter wrap%s");
 347         p(esps_badenc, "dropped-bad-crypto",
 348             "packet%s dropped; bad encryption detected");
 349         p(esps_badauth, "dropped-bad-auth",
 350             "packet%s dropped; bad authentication detected");
 351         p(esps_replay, "possible-replay-detected",
 352             "possible replay packet%s detected");
 353         p(esps_input, "received-packets", "packet%s in");
 354         p(esps_output, "sent-packets", "packet%s out");
 355         p(esps_invalid, "dropped-bad-tdb", "packet%s dropped; invalid TDB");
 356         p(esps_ibytes, "receieve-bytes", "byte%s in");
 357         p(esps_obytes, "sent-bytes", "byte%s out");
 358         p(esps_toobig, "dropped-too-large",
 359             "packet%s dropped; larger than IP_MAXPACKET");
 360         p(esps_pdrops, "dropped-policy-violation",
 361             "packet%s blocked due to policy");
 362         p(esps_crypto, "crypto-failures", "crypto processing failure%s");
 363         p(esps_tunnel, "tunnel-failures", "tunnel sanity check failure%s");
 364         hist(espstat->esps_hist, ipsec_espnames,
 365             "ESP output", "esp-output-histogram");
 366
 367 #undef p
 368 #undef hist
 369         xo_close_container("esp-statictics");
 370 }
 371
 372 void
 373 esp_stats(u_long off, const char *name, int family __unused, int proto __unused)
 374 {
 375         struct espstat espstat;
 376
 377         if (off == 0)
 378                 return;
 379         xo_emit("{T:/%s}:\n", name);
 380         kread_counters(off, (char *)&espstat, sizeof(espstat));
 381
 382         print_espstats(&espstat);
 383 }
 384
 385 static void
 386 print_ipcompstats(const struct ipcompstat *ipcompstat)
 387 {
 388         xo_open_container("ipcomp-statictics");
 389
 390 #define p(f, n, m) if (ipcompstat->f || sflag <= 1)     \
 391         xo_emit("\t{:" n "/%ju} {N:/" m "}\n",          \
 392             (uintmax_t)ipcompstat->f, plural(ipcompstat->f))
 393 #define hist(f, n, t, c) \
 394         ipsec_hist_new((f), sizeof(f)/sizeof(f[0]), (n), (t), (c));
 395
 396         p(ipcomps_hdrops, "dropped-short-header",
 397             "packet%s shorter than header shows");
 398         p(ipcomps_nopf, "dropped-bad-protocol",
 399             "packet%s dropped; protocol family not supported");
 400         p(ipcomps_notdb, "dropped-no-tdb", "packet%s dropped; no TDB");
 401         p(ipcomps_badkcr, "dropped-bad-kcr", "packet%s dropped; bad KCR");
 402         p(ipcomps_qfull, "dropped-queue-full", "packet%s dropped; queue full");
 403         p(ipcomps_noxform, "dropped-no-transform",
 404             "packet%s dropped; no transform");
 405         p(ipcomps_wrap, "replay-counter-wraps", "replay counter wrap%s");
 406         p(ipcomps_input, "receieve-packets", "packet%s in");
 407         p(ipcomps_output, "sent-packets", "packet%s out");
 408         p(ipcomps_invalid, "dropped-bad-tdb", "packet%s dropped; invalid TDB");
 409         p(ipcomps_ibytes, "receieved-bytes", "byte%s in");
 410         p(ipcomps_obytes, "sent-bytes", "byte%s out");
 411         p(ipcomps_toobig, "dropped-too-large",
 412             "packet%s dropped; larger than IP_MAXPACKET");
 413         p(ipcomps_pdrops, "dropped-policy-violation",
 414             "packet%s blocked due to policy");
 415         p(ipcomps_crypto, "crypto-failure", "crypto processing failure%s");
 416         hist(ipcompstat->ipcomps_hist, ipsec_compnames,
 417             "COMP output", "comp-output-histogram");
 418         p(ipcomps_threshold, "sent-uncompressed-small-packets",
 419             "packet%s sent uncompressed; size < compr. algo. threshold");
 420         p(ipcomps_uncompr, "sent-uncompressed-useless-packets",
 421             "packet%s sent uncompressed; compression was useless");
 422
 423 #undef p
 424 #undef hist
 425         xo_close_container("ipcomp-statictics");
 426 }
 427
 428 void
 429 ipcomp_stats(u_long off, const char *name, int family __unused,
 430     int proto __unused)
 431 {
 432         struct ipcompstat ipcompstat;
 433
 434         if (off == 0)
 435                 return;
 436         xo_emit("{T:/%s}:\n", name);
 437         kread_counters(off, (char *)&ipcompstat, sizeof(ipcompstat));
 438
 439         print_ipcompstats(&ipcompstat);
 440 }
 441
 442 #endif /*IPSEC*/