usr.bin/netstat/ipsec.c

   1 /*      $KAME: ipsec.c,v 1.33 2003/07/25 09:54:32 itojun Exp $  */
   2
   3 /*-
   4  * SPDX-License-Identifier: BSD-3-Clause
   5  *
   6  * Copyright (c) 2005 NTT Multimedia Communications Laboratories, Inc.
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  21  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  28  * SUCH DAMAGE.
  29  */
  30 /*-
  31  * Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project.
  32  * All rights reserved.
  33  *
  34  * Redistribution and use in source and binary forms, with or without
  35  * modification, are permitted provided that the following conditions
  36  * are met:
  37  * 1. Redistributions of source code must retain the above copyright
  38  *    notice, this list of conditions and the following disclaimer.
  39  * 2. Redistributions in binary form must reproduce the above copyright
  40  *    notice, this list of conditions and the following disclaimer in the
  41  *    documentation and/or other materials provided with the distribution.
  42  * 3. Neither the name of the project nor the names of its contributors
  43  *    may be used to endorse or promote products derived from this software
  44  *    without specific prior written permission.
  45  *
  46  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  47  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  48  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  49  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  50  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  51  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  52  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  53  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  54  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  55  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  56  * SUCH DAMAGE.
  57  */
  58 /*-
  59  * Copyright (c) 1983, 1988, 1993
  60  *      The Regents of the University of California.  All rights reserved.
  61  *
  62  * Redistribution and use in source and binary forms, with or without
  63  * modification, are permitted provided that the following conditions
  64  * are met:
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  * 2. Redistributions in binary form must reproduce the above copyright
  68  *    notice, this list of conditions and the following disclaimer in the
  69  *    documentation and/or other materials provided with the distribution.
  70  * 3. Neither the name of the University nor the names of its contributors
  71  *    may be used to endorse or promote products derived from this software
  72  *    without specific prior written permission.
  73  *
  74  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  75  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  76  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  77  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  78  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  79  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  80  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  81  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  82  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  83  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  84  * SUCH DAMAGE.
  85  */
  86
  87 #if 0
  88 #ifndef lint
  89 static char sccsid[] = "@(#)inet.c      8.5 (Berkeley) 5/24/95";
  90 #endif /* not lint */
  91 #endif
  92
  93 #include <sys/cdefs.h>
  94 __FBSDID("$FreeBSD$");
  95
  96 #include <sys/param.h>
  97 #include <sys/queue.h>
  98 #include <sys/socket.h>
  99 #include <sys/socketvar.h>
 100
 101 #include <netinet/in.h>
 102
 103 #ifdef IPSEC
 104 #include <netipsec/ipsec.h>
 105 #include <netipsec/ah_var.h>
 106 #include <netipsec/esp_var.h>
 107 #include <netipsec/ipcomp_var.h>
 108 #endif
 109
 110 #include <stdint.h>
 111 #include <stdio.h>
 112 #include <stdbool.h>
 113 #include <string.h>
 114 #include <unistd.h>
 115 #include <libxo/xo.h>
 116 #include "netstat.h"
 117
 118 #ifdef IPSEC
 119 struct val2str {
 120         int val;
 121         const char *str;
 122 };
 123
 124 static struct val2str ipsec_ahnames[] = {
 125         { SADB_AALG_NONE, "none", },
 126         { SADB_AALG_SHA1HMAC, "hmac-sha1", },
 127         { SADB_X_AALG_NULL, "null", },
 128         { SADB_X_AALG_SHA2_256, "hmac-sha2-256", },
 129         { SADB_X_AALG_SHA2_384, "hmac-sha2-384", },
 130         { SADB_X_AALG_SHA2_512, "hmac-sha2-512", },
 131         { SADB_X_AALG_AES_XCBC_MAC, "aes-xcbc-mac", },
 132         { SADB_X_AALG_TCP_MD5, "tcp-md5", },
 133         { SADB_X_AALG_AES128GMAC, "aes-gmac-128", },
 134         { SADB_X_AALG_AES192GMAC, "aes-gmac-192", },
 135         { SADB_X_AALG_AES256GMAC, "aes-gmac-256", },
 136         { -1, NULL },
 137 };
 138
 139 static struct val2str ipsec_espnames[] = {
 140         { SADB_EALG_NONE, "none", },
 141         { SADB_EALG_NULL, "null", },
 142         { SADB_X_EALG_AESCBC, "aes-cbc", },
 143         { SADB_X_EALG_AESCTR, "aes-ctr", },
 144         { SADB_X_EALG_AESGCM16, "aes-gcm-16", },
 145         { SADB_X_EALG_AESGMAC, "aes-gmac", },
 146         { -1, NULL },
 147 };
 148
 149 static struct val2str ipsec_compnames[] = {
 150         { SADB_X_CALG_NONE, "none", },
 151         { SADB_X_CALG_OUI, "oui", },
 152         { SADB_X_CALG_DEFLATE, "deflate", },
 153         { SADB_X_CALG_LZS, "lzs", },
 154         { -1, NULL },
 155 };
 156
 157 static void
 158 print_ipsecstats(const char *tag, const struct ipsecstat *ipsecstat)
 159 {
 160         xo_open_container(tag);
 161
 162 #define p(f, m) if (ipsecstat->f || sflag <= 1) \
 163         xo_emit(m, (uintmax_t)ipsecstat->f, plural(ipsecstat->f))
 164 #define p2(f, m) if (ipsecstat->f || sflag <= 1) \
 165         xo_emit(m, (uintmax_t)ipsecstat->f, plurales(ipsecstat->f))
 166
 167         p(ips_in_polvio, "\t{:dropped-policy-violation/%ju} "
 168             "{N:/inbound packet%s violated process security policy}\n");
 169         p(ips_in_nomem, "\t{:dropped-no-memory/%ju} "
 170             "{N:/inbound packet%s failed due to insufficient memory}\n");
 171         p(ips_in_inval, "\t{:dropped-invalid/%ju} "
 172             "{N:/invalid inbound packet%s}\n");
 173         p(ips_out_polvio, "\t{:discarded-policy-violation/%ju} "
 174             "{N:/outbound packet%s violated process security policy}\n");
 175         p(ips_out_nosa, "\t{:discarded-no-sa/%ju} "
 176             "{N:/outbound packet%s with no SA available}\n");
 177         p(ips_out_nomem, "\t{:discarded-no-memory/%ju} "
 178             "{N:/outbound packet%s failed due to insufficient memory}\n");
 179         p(ips_out_noroute, "\t{:discarded-no-route/%ju} "
 180             "{N:/outbound packet%s with no route available}\n");
 181         p(ips_out_inval, "\t{:discarded-invalid/%ju} "
 182             "{N:/invalid outbound packet%s}\n");
 183         p(ips_out_bundlesa, "\t{:send-bundled-sa/%ju} "
 184             "{N:/outbound packet%s with bundled SAs}\n");
 185         p(ips_spdcache_hits, "\t{:spdcache-hits/%ju} "
 186             "{N:/spd cache hit%s}\n");
 187         p2(ips_spdcache_misses, "\t{:spdcache-misses/%ju} "
 188             "{N:/spd cache miss%s}\n");
 189         p(ips_clcopied, "\t{:clusters-copied-during-clone/%ju} "
 190             "{N:/cluster%s copied during clone}\n");
 191         p(ips_mbinserted, "\t{:mbufs-inserted/%ju} "
 192             "{N:/mbuf%s inserted during makespace}\n");
 193 #undef p2
 194 #undef p
 195         xo_close_container(tag);
 196 }
 197
 198 void
 199 ipsec_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 200 {
 201         struct ipsecstat ipsecstat;
 202         const char *tag;
 203
 204         if (strcmp(name, "ipsec6") == 0) {
 205                 if (fetch_stats("net.inet6.ipsec6.ipsecstats", off,&ipsecstat,
 206                                 sizeof(ipsecstat), kread_counters) != 0)
 207                         return;
 208                 tag = "ipsec6-statistics";
 209         } else {
 210                 if (fetch_stats("net.inet.ipsec.ipsecstats", off, &ipsecstat,
 211                                 sizeof(ipsecstat), kread_counters) != 0)
 212                         return;
 213                 tag = "ipsec-statistics";
 214         }
 215
 216         xo_emit("{T:/%s}:\n", name);
 217
 218         print_ipsecstats(tag, &ipsecstat);
 219 }
 220
 221
 222 static void print_ahstats(const struct ahstat *ahstat);
 223 static void print_espstats(const struct espstat *espstat);
 224 static void print_ipcompstats(const struct ipcompstat *ipcompstat);
 225
 226 /*
 227  * Dump IPSEC statistics structure.
 228  */
 229 static void
 230 ipsec_hist_new(const uint64_t *hist, size_t histmax,
 231     const struct val2str *name, const char *title, const char *cname)
 232 {
 233         int first;
 234         size_t proto;
 235         const struct val2str *p;
 236
 237         first = 1;
 238         for (proto = 0; proto < histmax; proto++) {
 239                 if (hist[proto] <= 0)
 240                         continue;
 241                 if (first) {
 242                         xo_open_list(cname);
 243                         xo_emit("\t{T:/%s histogram}:\n", title);
 244                         first = 0;
 245                 }
 246                 xo_open_instance(cname);
 247                 for (p = name; p && p->str; p++) {
 248                         if (p->val == (int)proto)
 249                                 break;
 250                 }
 251                 if (p && p->str) {
 252                         xo_emit("\t\t{k:name}: {:count/%ju}\n", p->str,
 253                             (uintmax_t)hist[proto]);
 254                 } else {
 255                         xo_emit("\t\t#{k:name/%lu}: {:count/%ju}\n",
 256                             (unsigned long)proto, (uintmax_t)hist[proto]);
 257                 }
 258                 xo_close_instance(cname);
 259         }
 260         if (!first)
 261                 xo_close_list(cname);
 262 }
 263
 264 static void
 265 print_ahstats(const struct ahstat *ahstat)
 266 {
 267         xo_open_container("ah-statictics");
 268
 269 #define p(f, n, m) if (ahstat->f || sflag <= 1) \
 270         xo_emit("\t{:" n "/%ju} {N:/" m "}\n",  \
 271             (uintmax_t)ahstat->f, plural(ahstat->f))
 272 #define hist(f, n, t, c) \
 273         ipsec_hist_new((f), sizeof(f)/sizeof(f[0]), (n), (t), (c))
 274
 275         p(ahs_hdrops, "dropped-short-header",
 276             "packet%s shorter than header shows");
 277         p(ahs_nopf, "dropped-bad-protocol",
 278             "packet%s dropped; protocol family not supported");
 279         p(ahs_notdb, "dropped-no-tdb", "packet%s dropped; no TDB");
 280         p(ahs_badkcr, "dropped-bad-kcr", "packet%s dropped; bad KCR");
 281         p(ahs_qfull, "dropped-queue-full", "packet%s dropped; queue full");
 282         p(ahs_noxform, "dropped-no-transform",
 283             "packet%s dropped; no transform");
 284         p(ahs_wrap, "replay-counter-wraps", "replay counter wrap%s");
 285         p(ahs_badauth, "dropped-bad-auth",
 286             "packet%s dropped; bad authentication detected");
 287         p(ahs_badauthl, "dropped-bad-auth-level",
 288             "packet%s dropped; bad authentication length");
 289         p(ahs_replay, "possile-replay-detected",
 290             "possible replay packet%s detected");
 291         p(ahs_input, "received-packets", "packet%s in");
 292         p(ahs_output, "send-packets", "packet%s out");
 293         p(ahs_invalid, "dropped-bad-tdb", "packet%s dropped; invalid TDB");
 294         p(ahs_ibytes, "received-bytes", "byte%s in");
 295         p(ahs_obytes, "send-bytes", "byte%s out");
 296         p(ahs_toobig, "dropped-too-large",
 297             "packet%s dropped; larger than IP_MAXPACKET");
 298         p(ahs_pdrops, "dropped-policy-violation",
 299             "packet%s blocked due to policy");
 300         p(ahs_crypto, "crypto-failures", "crypto processing failure%s");
 301         p(ahs_tunnel, "tunnel-failures", "tunnel sanity check failure%s");
 302         hist(ahstat->ahs_hist, ipsec_ahnames,
 303             "AH output", "ah-output-histogram");
 304
 305 #undef p
 306 #undef hist
 307         xo_close_container("ah-statictics");
 308 }
 309
 310 void
 311 ah_stats(u_long off, const char *name, int family __unused, int proto __unused)
 312 {
 313         struct ahstat ahstat;
 314
 315         if (fetch_stats("net.inet.ah.stats", off, &ahstat,
 316             sizeof(ahstat), kread_counters) != 0)
 317                 return;
 318
 319         xo_emit("{T:/%s}:\n", name);
 320
 321         print_ahstats(&ahstat);
 322 }
 323
 324 static void
 325 print_espstats(const struct espstat *espstat)
 326 {
 327         xo_open_container("esp-statictics");
 328 #define p(f, n, m) if (espstat->f || sflag <= 1)        \
 329         xo_emit("\t{:" n "/%ju} {N:/" m "}\n",          \
 330             (uintmax_t)espstat->f, plural(espstat->f))
 331 #define hist(f, n, t, c) \
 332         ipsec_hist_new((f), sizeof(f)/sizeof(f[0]), (n), (t), (c));
 333
 334         p(esps_hdrops, "dropped-short-header",
 335             "packet%s shorter than header shows");
 336         p(esps_nopf, "dropped-bad-protocol",
 337             "packet%s dropped; protocol family not supported");
 338         p(esps_notdb, "dropped-no-tdb", "packet%s dropped; no TDB");
 339         p(esps_badkcr, "dropped-bad-kcr", "packet%s dropped; bad KCR");
 340         p(esps_qfull, "dropped-queue-full", "packet%s dropped; queue full");
 341         p(esps_noxform, "dropped-no-transform",
 342             "packet%s dropped; no transform");
 343         p(esps_badilen, "dropped-bad-length", "packet%s dropped; bad ilen");
 344         p(esps_wrap, "replay-counter-wraps", "replay counter wrap%s");
 345         p(esps_badenc, "dropped-bad-crypto",
 346             "packet%s dropped; bad encryption detected");
 347         p(esps_badauth, "dropped-bad-auth",
 348             "packet%s dropped; bad authentication detected");
 349         p(esps_replay, "possible-replay-detected",
 350             "possible replay packet%s detected");
 351         p(esps_input, "received-packets", "packet%s in");
 352         p(esps_output, "sent-packets", "packet%s out");
 353         p(esps_invalid, "dropped-bad-tdb", "packet%s dropped; invalid TDB");
 354         p(esps_ibytes, "receieve-bytes", "byte%s in");
 355         p(esps_obytes, "sent-bytes", "byte%s out");
 356         p(esps_toobig, "dropped-too-large",
 357             "packet%s dropped; larger than IP_MAXPACKET");
 358         p(esps_pdrops, "dropped-policy-violation",
 359             "packet%s blocked due to policy");
 360         p(esps_crypto, "crypto-failures", "crypto processing failure%s");
 361         p(esps_tunnel, "tunnel-failures", "tunnel sanity check failure%s");
 362         hist(espstat->esps_hist, ipsec_espnames,
 363             "ESP output", "esp-output-histogram");
 364
 365 #undef p
 366 #undef hist
 367         xo_close_container("esp-statictics");
 368 }
 369
 370 void
 371 esp_stats(u_long off, const char *name, int family __unused, int proto __unused)
 372 {
 373         struct espstat espstat;
 374
 375         if (fetch_stats("net.inet.esp.stats", off, &espstat,
 376             sizeof(espstat), kread_counters) != 0)
 377                 return;
 378
 379         xo_emit("{T:/%s}:\n", name);
 380
 381         print_espstats(&espstat);
 382 }
 383
 384 static void
 385 print_ipcompstats(const struct ipcompstat *ipcompstat)
 386 {
 387         xo_open_container("ipcomp-statictics");
 388
 389 #define p(f, n, m) if (ipcompstat->f || sflag <= 1)     \
 390         xo_emit("\t{:" n "/%ju} {N:/" m "}\n",          \
 391             (uintmax_t)ipcompstat->f, plural(ipcompstat->f))
 392 #define hist(f, n, t, c) \
 393         ipsec_hist_new((f), sizeof(f)/sizeof(f[0]), (n), (t), (c));
 394
 395         p(ipcomps_hdrops, "dropped-short-header",
 396             "packet%s shorter than header shows");
 397         p(ipcomps_nopf, "dropped-bad-protocol",
 398             "packet%s dropped; protocol family not supported");
 399         p(ipcomps_notdb, "dropped-no-tdb", "packet%s dropped; no TDB");
 400         p(ipcomps_badkcr, "dropped-bad-kcr", "packet%s dropped; bad KCR");
 401         p(ipcomps_qfull, "dropped-queue-full", "packet%s dropped; queue full");
 402         p(ipcomps_noxform, "dropped-no-transform",
 403             "packet%s dropped; no transform");
 404         p(ipcomps_wrap, "replay-counter-wraps", "replay counter wrap%s");
 405         p(ipcomps_input, "receieve-packets", "packet%s in");
 406         p(ipcomps_output, "sent-packets", "packet%s out");
 407         p(ipcomps_invalid, "dropped-bad-tdb", "packet%s dropped; invalid TDB");
 408         p(ipcomps_ibytes, "receieved-bytes", "byte%s in");
 409         p(ipcomps_obytes, "sent-bytes", "byte%s out");
 410         p(ipcomps_toobig, "dropped-too-large",
 411             "packet%s dropped; larger than IP_MAXPACKET");
 412         p(ipcomps_pdrops, "dropped-policy-violation",
 413             "packet%s blocked due to policy");
 414         p(ipcomps_crypto, "crypto-failure", "crypto processing failure%s");
 415         hist(ipcompstat->ipcomps_hist, ipsec_compnames,
 416             "COMP output", "comp-output-histogram");
 417         p(ipcomps_threshold, "sent-uncompressed-small-packets",
 418             "packet%s sent uncompressed; size < compr. algo. threshold");
 419         p(ipcomps_uncompr, "sent-uncompressed-useless-packets",
 420             "packet%s sent uncompressed; compression was useless");
 421
 422 #undef p
 423 #undef hist
 424         xo_close_container("ipcomp-statictics");
 425 }
 426
 427 void
 428 ipcomp_stats(u_long off, const char *name, int family __unused,
 429     int proto __unused)
 430 {
 431         struct ipcompstat ipcompstat;
 432
 433         if (fetch_stats("net.inet.ipcomp.stats", off, &ipcompstat,
 434             sizeof(ipcompstat), kread_counters) != 0)
 435                 return;
 436
 437         xo_emit("{T:/%s}:\n", name);
 438
 439         print_ipcompstats(&ipcompstat);
 440 }
 441
 442 #endif /*IPSEC*/