1 /* $FreeBSD: src/usr.bin/netstat/ipsec.c,v 1.1.2.3 2001/08/10 09:07:09 ru Exp $ */
2 /* $NetBSD: inet.c,v 1.35.2.1 1999/04/29 14:57:08 perry Exp $ */
3 /* $KAME: ipsec.c,v 1.25 2001/03/12 09:04:39 itojun Exp $ */
6 * Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project.
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the project nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 * Copyright (c) 1983, 1988, 1993
36 * The Regents of the University of California. All rights reserved.
38 * Redistribution and use in source and binary forms, with or without
39 * modification, are permitted provided that the following conditions
41 * 1. Redistributions of source code must retain the above copyright
42 * notice, this list of conditions and the following disclaimer.
43 * 2. Redistributions in binary form must reproduce the above copyright
44 * notice, this list of conditions and the following disclaimer in the
45 * documentation and/or other materials provided with the distribution.
46 * 3. All advertising materials mentioning features or use of this software
47 * must display the following acknowledgement:
48 * This product includes software developed by the University of
49 * California, Berkeley and its contributors.
50 * 4. Neither the name of the University nor the names of its contributors
51 * may be used to endorse or promote products derived from this software
52 * without specific prior written permission.
54 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
55 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
56 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
57 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
58 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
59 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
60 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
61 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
62 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
63 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
67 #include <sys/cdefs.h>
70 static char sccsid[] = "@(#)inet.c 8.5 (Berkeley) 5/24/95";
72 static const char rcsid[] =
73 "$FreeBSD: src/usr.bin/netstat/ipsec.c,v 1.1.2.3 2001/08/10 09:07:09 ru Exp $";
76 #include <sys/param.h>
77 #include <sys/queue.h>
78 #include <sys/socket.h>
80 #include <netinet/in.h>
83 #include <netinet6/ipsec.h>
84 #include <netkey/keysock.h>
94 * - bsdi[34] uses PLURAL(), not plural().
95 * - freebsd2 can't print "unsigned long long" properly.
98 * XXX see PORTABILITY for the twist
101 #define CAST unsigned long long
109 static struct val2str ipsec_ahnames[] = {
110 { SADB_AALG_NONE, "none", },
111 { SADB_AALG_MD5HMAC, "hmac-md5", },
112 { SADB_AALG_SHA1HMAC, "hmac-sha1", },
113 { SADB_X_AALG_MD5, "md5", },
114 { SADB_X_AALG_SHA, "sha", },
115 { SADB_X_AALG_NULL, "null", },
116 #ifdef SADB_X_AALG_SHA2_256
117 { SADB_X_AALG_SHA2_256, "hmac-sha2-256", },
119 #ifdef SADB_X_AALG_SHA2_384
120 { SADB_X_AALG_SHA2_384, "hmac-sha2-384", },
122 #ifdef SADB_X_AALG_SHA2_512
123 { SADB_X_AALG_SHA2_512, "hmac-sha2-512", },
128 static struct val2str ipsec_espnames[] = {
129 { SADB_EALG_NONE, "none", },
130 { SADB_EALG_DESCBC, "des-cbc", },
131 { SADB_EALG_3DESCBC, "3des-cbc", },
132 { SADB_EALG_NULL, "null", },
133 #ifdef SADB_X_EALG_RC5CBC
134 { SADB_X_EALG_RC5CBC, "rc5-cbc", },
136 { SADB_X_EALG_CAST128CBC, "cast128-cbc", },
137 { SADB_X_EALG_BLOWFISHCBC, "blowfish-cbc", },
138 #ifdef SADB_X_EALG_RIJNDAELCBC
139 { SADB_X_EALG_RIJNDAELCBC, "rijndael-cbc", },
144 static struct val2str ipsec_compnames[] = {
145 { SADB_X_CALG_NONE, "none", },
146 { SADB_X_CALG_OUI, "oui", },
147 { SADB_X_CALG_DEFLATE, "deflate", },
148 { SADB_X_CALG_LZS, "lzs", },
152 static const char *pfkey_msgtypenames[] = {
153 "reserved", "getspi", "update", "add", "delete",
154 "get", "acquire", "register", "expire", "flush",
155 "dump", "x_promisc", "x_pchange", "x_spdupdate", "x_spdadd",
156 "x_spddelete", "x_spdget", "x_spdacquire", "x_spddump", "x_spdflush",
157 "x_spdsetidx", "x_spdexpire", "x_spddelete2"
160 static struct ipsecstat ipsecstat;
162 static void print_ipsecstats (void);
163 static const char *pfkey_msgtype_names (int);
164 static void ipsec_hist (const u_quad_t *, size_t, const struct val2str *,
168 * Dump IPSEC statistics structure.
171 ipsec_hist(const u_quad_t *hist,
173 const struct val2str *name,
178 const struct val2str *p;
181 for (proto = 0; proto < histmax; proto++) {
182 if (hist[proto] <= 0)
185 printf("\t%s histogram:\n", title);
188 for (p = name; p && p->str; p++) {
189 if (p->val == (int)proto)
193 printf("\t\t%s: " LLU "\n", p->str, (CAST)hist[proto]);
195 printf("\t\t#%ld: " LLU "\n", (long)proto,
202 print_ipsecstats(void)
204 #define p(f, m) if (ipsecstat.f || sflag <= 1) \
205 printf(m, (CAST)ipsecstat.f, plural(ipsecstat.f))
206 #define hist(f, n, t) \
207 ipsec_hist((f), sizeof(f)/sizeof(f[0]), (n), (t));
209 p(in_success, "\t" LLU " inbound packet%s processed successfully\n");
210 p(in_polvio, "\t" LLU " inbound packet%s violated process security "
212 p(in_nosa, "\t" LLU " inbound packet%s with no SA available\n");
213 p(in_inval, "\t" LLU " invalid inbound packet%s\n");
214 p(in_nomem, "\t" LLU " inbound packet%s failed due to insufficient memory\n");
215 p(in_badspi, "\t" LLU " inbound packet%s failed getting SPI\n");
216 p(in_ahreplay, "\t" LLU " inbound packet%s failed on AH replay check\n");
217 p(in_espreplay, "\t" LLU " inbound packet%s failed on ESP replay check\n");
218 p(in_ahauthsucc, "\t" LLU " inbound packet%s considered authentic\n");
219 p(in_ahauthfail, "\t" LLU " inbound packet%s failed on authentication\n");
220 hist(ipsecstat.in_ahhist, ipsec_ahnames, "AH input");
221 hist(ipsecstat.in_esphist, ipsec_espnames, "ESP input");
222 hist(ipsecstat.in_comphist, ipsec_compnames, "IPComp input");
224 p(out_success, "\t" LLU " outbound packet%s processed successfully\n");
225 p(out_polvio, "\t" LLU " outbound packet%s violated process security "
227 p(out_nosa, "\t" LLU " outbound packet%s with no SA available\n");
228 p(out_inval, "\t" LLU " invalid outbound packet%s\n");
229 p(out_nomem, "\t" LLU " outbound packet%s failed due to insufficient memory\n");
230 p(out_noroute, "\t" LLU " outbound packet%s with no route\n");
231 hist(ipsecstat.out_ahhist, ipsec_ahnames, "AH output");
232 hist(ipsecstat.out_esphist, ipsec_espnames, "ESP output");
233 hist(ipsecstat.out_comphist, ipsec_compnames, "IPComp output");
239 ipsec_stats(u_long off __unused, char *name, int af __unused)
243 printf ("%s:\n", name);
244 kread(off, (char *)&ipsecstat, sizeof (ipsecstat));
250 pfkey_msgtype_names(int x)
253 sizeof(pfkey_msgtypenames)/sizeof(pfkey_msgtypenames[0]);
256 if (x < max && pfkey_msgtypenames[x])
257 return pfkey_msgtypenames[x];
258 snprintf(buf, sizeof(buf), "#%d", x);
263 pfkey_stats(u_long off __unused, char *name, int af __unused)
265 struct pfkeystat pfkeystat;
266 unsigned first, type;
270 printf ("%s:\n", name);
271 kread(off, (char *)&pfkeystat, sizeof(pfkeystat));
273 #define p(f, m) if (pfkeystat.f || sflag <= 1) \
274 printf(m, (CAST)pfkeystat.f, plural(pfkeystat.f))
276 /* kernel -> userland */
277 p(out_total, "\t" LLU " request%s sent to userland\n");
278 p(out_bytes, "\t" LLU " byte%s sent to userland\n");
279 for (first = 1, type = 0;
280 type < sizeof(pfkeystat.out_msgtype)/sizeof(pfkeystat.out_msgtype[0]);
282 if (pfkeystat.out_msgtype[type] <= 0)
285 printf("\thistogram by message type:\n");
288 printf("\t\t%s: " LLU "\n", pfkey_msgtype_names(type),
289 (CAST)pfkeystat.out_msgtype[type]);
291 p(out_invlen, "\t" LLU " message%s with invalid length field\n");
292 p(out_invver, "\t" LLU " message%s with invalid version field\n");
293 p(out_invmsgtype, "\t" LLU " message%s with invalid message type field\n");
294 p(out_tooshort, "\t" LLU " message%s too short\n");
295 p(out_nomem, "\t" LLU " message%s with memory allocation failure\n");
296 p(out_dupext, "\t" LLU " message%s with duplicate extension\n");
297 p(out_invexttype, "\t" LLU " message%s with invalid extension type\n");
298 p(out_invsatype, "\t" LLU " message%s with invalid sa type\n");
299 p(out_invaddr, "\t" LLU " message%s with invalid address extension\n");
301 /* userland -> kernel */
302 p(in_total, "\t" LLU " request%s sent from userland\n");
303 p(in_bytes, "\t" LLU " byte%s sent from userland\n");
304 for (first = 1, type = 0;
305 type < sizeof(pfkeystat.in_msgtype)/sizeof(pfkeystat.in_msgtype[0]);
307 if (pfkeystat.in_msgtype[type] <= 0)
310 printf("\thistogram by message type:\n");
313 printf("\t\t%s: " LLU "\n", pfkey_msgtype_names(type),
314 (CAST)pfkeystat.in_msgtype[type]);
316 p(in_msgtarget[KEY_SENDUP_ONE],
317 "\t" LLU " message%s toward single socket\n");
318 p(in_msgtarget[KEY_SENDUP_ALL],
319 "\t" LLU " message%s toward all sockets\n");
320 p(in_msgtarget[KEY_SENDUP_REGISTERED],
321 "\t" LLU " message%s toward registered sockets\n");
322 p(in_nomem, "\t" LLU " message%s with memory allocation failure\n");