1 /* $NetBSD: inet.c,v 1.35.2.1 1999/04/29 14:57:08 perry Exp $ */
2 /* $KAME: ipsec.c,v 1.25 2001/03/12 09:04:39 itojun Exp $ */
5 * Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of the project nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 * Copyright (c) 1983, 1988, 1993
35 * The Regents of the University of California. All rights reserved.
37 * Redistribution and use in source and binary forms, with or without
38 * modification, are permitted provided that the following conditions
40 * 1. Redistributions of source code must retain the above copyright
41 * notice, this list of conditions and the following disclaimer.
42 * 2. Redistributions in binary form must reproduce the above copyright
43 * notice, this list of conditions and the following disclaimer in the
44 * documentation and/or other materials provided with the distribution.
45 * 3. All advertising materials mentioning features or use of this software
46 * must display the following acknowledgement:
47 * This product includes software developed by the University of
48 * California, Berkeley and its contributors.
49 * 4. Neither the name of the University nor the names of its contributors
50 * may be used to endorse or promote products derived from this software
51 * without specific prior written permission.
53 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
54 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
55 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
56 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
57 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
58 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
59 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
60 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
61 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
62 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
66 #include <sys/cdefs.h>
69 static char sccsid[] = "@(#)inet.c 8.5 (Berkeley) 5/24/95";
71 static const char rcsid[] =
75 #include <sys/param.h>
76 #include <sys/queue.h>
77 #include <sys/socket.h>
79 #include <netinet/in.h>
82 #include <netinet6/ipsec.h>
83 #include <netkey/keysock.h>
93 * - bsdi[34] uses PLURAL(), not plural().
94 * - freebsd2 can't print "unsigned long long" properly.
97 * XXX see PORTABILITY for the twist
100 #define CAST unsigned long long
108 static struct val2str ipsec_ahnames[] = {
109 { SADB_AALG_NONE, "none", },
110 { SADB_AALG_MD5HMAC, "hmac-md5", },
111 { SADB_AALG_SHA1HMAC, "hmac-sha1", },
112 { SADB_X_AALG_MD5, "md5", },
113 { SADB_X_AALG_SHA, "sha", },
114 { SADB_X_AALG_NULL, "null", },
115 #ifdef SADB_X_AALG_SHA2_256
116 { SADB_X_AALG_SHA2_256, "hmac-sha2-256", },
118 #ifdef SADB_X_AALG_SHA2_384
119 { SADB_X_AALG_SHA2_384, "hmac-sha2-384", },
121 #ifdef SADB_X_AALG_SHA2_512
122 { SADB_X_AALG_SHA2_512, "hmac-sha2-512", },
127 static struct val2str ipsec_espnames[] = {
128 { SADB_EALG_NONE, "none", },
129 { SADB_EALG_DESCBC, "des-cbc", },
130 { SADB_EALG_3DESCBC, "3des-cbc", },
131 { SADB_EALG_NULL, "null", },
132 #ifdef SADB_X_EALG_RC5CBC
133 { SADB_X_EALG_RC5CBC, "rc5-cbc", },
135 { SADB_X_EALG_CAST128CBC, "cast128-cbc", },
136 { SADB_X_EALG_BLOWFISHCBC, "blowfish-cbc", },
137 #ifdef SADB_X_EALG_RIJNDAELCBC
138 { SADB_X_EALG_RIJNDAELCBC, "rijndael-cbc", },
143 static struct val2str ipsec_compnames[] = {
144 { SADB_X_CALG_NONE, "none", },
145 { SADB_X_CALG_OUI, "oui", },
146 { SADB_X_CALG_DEFLATE, "deflate", },
147 { SADB_X_CALG_LZS, "lzs", },
151 static const char *pfkey_msgtypenames[] = {
152 "reserved", "getspi", "update", "add", "delete",
153 "get", "acquire", "register", "expire", "flush",
154 "dump", "x_promisc", "x_pchange", "x_spdupdate", "x_spdadd",
155 "x_spddelete", "x_spdget", "x_spdacquire", "x_spddump", "x_spdflush",
156 "x_spdsetidx", "x_spdexpire", "x_spddelete2"
159 static struct ipsecstat ipsecstat;
161 static void print_ipsecstats (void);
162 static const char *pfkey_msgtype_names (int);
163 static void ipsec_hist (const u_quad_t *, size_t, const struct val2str *,
167 * Dump IPSEC statistics structure.
170 ipsec_hist(const u_quad_t *hist,
172 const struct val2str *name,
177 const struct val2str *p;
180 for (proto = 0; proto < histmax; proto++) {
181 if (hist[proto] <= 0)
184 printf("\t%s histogram:\n", title);
187 for (p = name; p && p->str; p++) {
188 if (p->val == (int)proto)
192 printf("\t\t%s: " LLU "\n", p->str, (CAST)hist[proto]);
194 printf("\t\t#%ld: " LLU "\n", (long)proto,
201 print_ipsecstats(void)
203 #define p(f, m) if (ipsecstat.f || sflag <= 1) \
204 printf(m, (CAST)ipsecstat.f, plural(ipsecstat.f))
205 #define hist(f, n, t) \
206 ipsec_hist((f), sizeof(f)/sizeof(f[0]), (n), (t));
208 p(in_success, "\t" LLU " inbound packet%s processed successfully\n");
209 p(in_polvio, "\t" LLU " inbound packet%s violated process security "
211 p(in_nosa, "\t" LLU " inbound packet%s with no SA available\n");
212 p(in_inval, "\t" LLU " invalid inbound packet%s\n");
213 p(in_nomem, "\t" LLU " inbound packet%s failed due to insufficient memory\n");
214 p(in_badspi, "\t" LLU " inbound packet%s failed getting SPI\n");
215 p(in_ahreplay, "\t" LLU " inbound packet%s failed on AH replay check\n");
216 p(in_espreplay, "\t" LLU " inbound packet%s failed on ESP replay check\n");
217 p(in_ahauthsucc, "\t" LLU " inbound packet%s considered authentic\n");
218 p(in_ahauthfail, "\t" LLU " inbound packet%s failed on authentication\n");
219 hist(ipsecstat.in_ahhist, ipsec_ahnames, "AH input");
220 hist(ipsecstat.in_esphist, ipsec_espnames, "ESP input");
221 hist(ipsecstat.in_comphist, ipsec_compnames, "IPComp input");
223 p(out_success, "\t" LLU " outbound packet%s processed successfully\n");
224 p(out_polvio, "\t" LLU " outbound packet%s violated process security "
226 p(out_nosa, "\t" LLU " outbound packet%s with no SA available\n");
227 p(out_inval, "\t" LLU " invalid outbound packet%s\n");
228 p(out_nomem, "\t" LLU " outbound packet%s failed due to insufficient memory\n");
229 p(out_noroute, "\t" LLU " outbound packet%s with no route\n");
230 hist(ipsecstat.out_ahhist, ipsec_ahnames, "AH output");
231 hist(ipsecstat.out_esphist, ipsec_espnames, "ESP output");
232 hist(ipsecstat.out_comphist, ipsec_compnames, "IPComp output");
238 ipsec_stats(u_long off __unused, char *name, int af __unused)
242 printf ("%s:\n", name);
243 kread(off, (char *)&ipsecstat, sizeof (ipsecstat));
249 pfkey_msgtype_names(int x)
252 sizeof(pfkey_msgtypenames)/sizeof(pfkey_msgtypenames[0]);
255 if (x < max && pfkey_msgtypenames[x])
256 return pfkey_msgtypenames[x];
257 snprintf(buf, sizeof(buf), "#%d", x);
262 pfkey_stats(u_long off __unused, char *name, int af __unused)
264 struct pfkeystat pfkeystat;
265 unsigned first, type;
269 printf ("%s:\n", name);
270 kread(off, (char *)&pfkeystat, sizeof(pfkeystat));
272 #define p(f, m) if (pfkeystat.f || sflag <= 1) \
273 printf(m, (CAST)pfkeystat.f, plural(pfkeystat.f))
275 /* kernel -> userland */
276 p(out_total, "\t" LLU " request%s sent to userland\n");
277 p(out_bytes, "\t" LLU " byte%s sent to userland\n");
278 for (first = 1, type = 0;
279 type < sizeof(pfkeystat.out_msgtype)/sizeof(pfkeystat.out_msgtype[0]);
281 if (pfkeystat.out_msgtype[type] <= 0)
284 printf("\thistogram by message type:\n");
287 printf("\t\t%s: " LLU "\n", pfkey_msgtype_names(type),
288 (CAST)pfkeystat.out_msgtype[type]);
290 p(out_invlen, "\t" LLU " message%s with invalid length field\n");
291 p(out_invver, "\t" LLU " message%s with invalid version field\n");
292 p(out_invmsgtype, "\t" LLU " message%s with invalid message type field\n");
293 p(out_tooshort, "\t" LLU " message%s too short\n");
294 p(out_nomem, "\t" LLU " message%s with memory allocation failure\n");
295 p(out_dupext, "\t" LLU " message%s with duplicate extension\n");
296 p(out_invexttype, "\t" LLU " message%s with invalid extension type\n");
297 p(out_invsatype, "\t" LLU " message%s with invalid sa type\n");
298 p(out_invaddr, "\t" LLU " message%s with invalid address extension\n");
300 /* userland -> kernel */
301 p(in_total, "\t" LLU " request%s sent from userland\n");
302 p(in_bytes, "\t" LLU " byte%s sent from userland\n");
303 for (first = 1, type = 0;
304 type < sizeof(pfkeystat.in_msgtype)/sizeof(pfkeystat.in_msgtype[0]);
306 if (pfkeystat.in_msgtype[type] <= 0)
309 printf("\thistogram by message type:\n");
312 printf("\t\t%s: " LLU "\n", pfkey_msgtype_names(type),
313 (CAST)pfkeystat.in_msgtype[type]);
315 p(in_msgtarget[KEY_SENDUP_ONE],
316 "\t" LLU " message%s toward single socket\n");
317 p(in_msgtarget[KEY_SENDUP_ALL],
318 "\t" LLU " message%s toward all sockets\n");
319 p(in_msgtarget[KEY_SENDUP_REGISTERED],
320 "\t" LLU " message%s toward registered sockets\n");
321 p(in_nomem, "\t" LLU " message%s with memory allocation failure\n");