key_debug.c revision 331722
1/* $FreeBSD: stable/11/sys/netipsec/key_debug.c 331722 2018-03-29 02:50:57Z eadler $ */ 2/* $KAME: key_debug.c,v 1.26 2001/06/27 10:46:50 sakane Exp $ */ 3 4/*- 5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the project nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 33#ifdef _KERNEL 34#include "opt_inet.h" 35#include "opt_inet6.h" 36#include "opt_ipsec.h" 37#endif 38 39#include <sys/param.h> 40#ifdef _KERNEL 41#include <sys/systm.h> 42#include <sys/lock.h> 43#include <sys/malloc.h> 44#include <sys/mbuf.h> 45#include <sys/mutex.h> 46#include <sys/queue.h> 47#endif 48#include <sys/socket.h> 49 50#include <net/vnet.h> 51 52#include <netipsec/key_var.h> 53#include <netipsec/key_debug.h> 54 55#include <netinet/in.h> 56#include <netipsec/ipsec.h> 57#ifdef _KERNEL 58#include <netipsec/keydb.h> 59#include <netipsec/xform.h> 60#endif 61 62#ifndef _KERNEL 63#include <ctype.h> 64#include <stdio.h> 65#include <stdlib.h> 66#include <arpa/inet.h> 67#endif /* !_KERNEL */ 68 69static void kdebug_sadb_prop(struct sadb_ext *); 70static void kdebug_sadb_identity(struct sadb_ext *); 71static void kdebug_sadb_supported(struct sadb_ext *); 72static void kdebug_sadb_lifetime(struct sadb_ext *); 73static void kdebug_sadb_sa(struct sadb_ext *); 74static void kdebug_sadb_address(struct sadb_ext *); 75static void kdebug_sadb_key(struct sadb_ext *); 76static void kdebug_sadb_x_sa2(struct sadb_ext *); 77static void kdebug_sadb_x_sa_replay(struct sadb_ext *); 78static void kdebug_sadb_x_natt(struct sadb_ext *); 79 80#ifndef _KERNEL 81#define panic(fmt, ...) { printf(fmt, ## __VA_ARGS__); exit(-1); } 82#endif 83 84/* NOTE: host byte order */ 85 86/* %%%: about struct sadb_msg */ 87void 88kdebug_sadb(struct sadb_msg *base) 89{ 90 struct sadb_ext *ext; 91 int tlen, extlen; 92 93 /* sanity check */ 94 if (base == NULL) 95 panic("%s: NULL pointer was passed.\n", __func__); 96 97 printf("sadb_msg{ version=%u type=%u errno=%u satype=%u\n", 98 base->sadb_msg_version, base->sadb_msg_type, 99 base->sadb_msg_errno, base->sadb_msg_satype); 100 printf(" len=%u reserved=%u seq=%u pid=%u\n", 101 base->sadb_msg_len, base->sadb_msg_reserved, 102 base->sadb_msg_seq, base->sadb_msg_pid); 103 104 tlen = PFKEY_UNUNIT64(base->sadb_msg_len) - sizeof(struct sadb_msg); 105 ext = (struct sadb_ext *)((caddr_t)base + sizeof(struct sadb_msg)); 106 107 while (tlen > 0) { 108 printf("sadb_ext{ len=%u type=%u }\n", 109 ext->sadb_ext_len, ext->sadb_ext_type); 110 111 if (ext->sadb_ext_len == 0) { 112 printf("%s: invalid ext_len=0 was passed.\n", __func__); 113 return; 114 } 115 if (ext->sadb_ext_len > tlen) { 116 printf("%s: ext_len too big (%u > %u).\n", 117 __func__, ext->sadb_ext_len, tlen); 118 return; 119 } 120 121 switch (ext->sadb_ext_type) { 122 case SADB_EXT_SA: 123 kdebug_sadb_sa(ext); 124 break; 125 case SADB_EXT_LIFETIME_CURRENT: 126 case SADB_EXT_LIFETIME_HARD: 127 case SADB_EXT_LIFETIME_SOFT: 128 kdebug_sadb_lifetime(ext); 129 break; 130 case SADB_EXT_ADDRESS_SRC: 131 case SADB_EXT_ADDRESS_DST: 132 case SADB_EXT_ADDRESS_PROXY: 133 case SADB_X_EXT_NAT_T_OAI: 134 case SADB_X_EXT_NAT_T_OAR: 135 case SADB_X_EXT_NEW_ADDRESS_SRC: 136 case SADB_X_EXT_NEW_ADDRESS_DST: 137 kdebug_sadb_address(ext); 138 break; 139 case SADB_EXT_KEY_AUTH: 140 case SADB_EXT_KEY_ENCRYPT: 141 kdebug_sadb_key(ext); 142 break; 143 case SADB_EXT_IDENTITY_SRC: 144 case SADB_EXT_IDENTITY_DST: 145 kdebug_sadb_identity(ext); 146 break; 147 case SADB_EXT_SENSITIVITY: 148 break; 149 case SADB_EXT_PROPOSAL: 150 kdebug_sadb_prop(ext); 151 break; 152 case SADB_EXT_SUPPORTED_AUTH: 153 case SADB_EXT_SUPPORTED_ENCRYPT: 154 kdebug_sadb_supported(ext); 155 break; 156 case SADB_EXT_SPIRANGE: 157 case SADB_X_EXT_KMPRIVATE: 158 break; 159 case SADB_X_EXT_POLICY: 160 kdebug_sadb_x_policy(ext); 161 break; 162 case SADB_X_EXT_SA2: 163 kdebug_sadb_x_sa2(ext); 164 break; 165 case SADB_X_EXT_SA_REPLAY: 166 kdebug_sadb_x_sa_replay(ext); 167 break; 168 case SADB_X_EXT_NAT_T_TYPE: 169 case SADB_X_EXT_NAT_T_SPORT: 170 case SADB_X_EXT_NAT_T_DPORT: 171 kdebug_sadb_x_natt(ext); 172 break; 173 default: 174 printf("%s: invalid ext_type %u\n", __func__, 175 ext->sadb_ext_type); 176 return; 177 } 178 179 extlen = PFKEY_UNUNIT64(ext->sadb_ext_len); 180 tlen -= extlen; 181 ext = (struct sadb_ext *)((caddr_t)ext + extlen); 182 } 183 184 return; 185} 186 187static void 188kdebug_sadb_prop(struct sadb_ext *ext) 189{ 190 struct sadb_prop *prop = (struct sadb_prop *)ext; 191 struct sadb_comb *comb; 192 int len; 193 194 /* sanity check */ 195 if (ext == NULL) 196 panic("%s: NULL pointer was passed.\n", __func__); 197 198 len = (PFKEY_UNUNIT64(prop->sadb_prop_len) - sizeof(*prop)) 199 / sizeof(*comb); 200 comb = (struct sadb_comb *)(prop + 1); 201 printf("sadb_prop{ replay=%u\n", prop->sadb_prop_replay); 202 203 while (len--) { 204 printf("sadb_comb{ auth=%u encrypt=%u " 205 "flags=0x%04x reserved=0x%08x\n", 206 comb->sadb_comb_auth, comb->sadb_comb_encrypt, 207 comb->sadb_comb_flags, comb->sadb_comb_reserved); 208 209 printf(" auth_minbits=%u auth_maxbits=%u " 210 "encrypt_minbits=%u encrypt_maxbits=%u\n", 211 comb->sadb_comb_auth_minbits, 212 comb->sadb_comb_auth_maxbits, 213 comb->sadb_comb_encrypt_minbits, 214 comb->sadb_comb_encrypt_maxbits); 215 216 printf(" soft_alloc=%u hard_alloc=%u " 217 "soft_bytes=%lu hard_bytes=%lu\n", 218 comb->sadb_comb_soft_allocations, 219 comb->sadb_comb_hard_allocations, 220 (unsigned long)comb->sadb_comb_soft_bytes, 221 (unsigned long)comb->sadb_comb_hard_bytes); 222 223 printf(" soft_alloc=%lu hard_alloc=%lu " 224 "soft_bytes=%lu hard_bytes=%lu }\n", 225 (unsigned long)comb->sadb_comb_soft_addtime, 226 (unsigned long)comb->sadb_comb_hard_addtime, 227 (unsigned long)comb->sadb_comb_soft_usetime, 228 (unsigned long)comb->sadb_comb_hard_usetime); 229 comb++; 230 } 231 printf("}\n"); 232 233 return; 234} 235 236static void 237kdebug_sadb_identity(struct sadb_ext *ext) 238{ 239 struct sadb_ident *id = (struct sadb_ident *)ext; 240 int len; 241 242 /* sanity check */ 243 if (ext == NULL) 244 panic("%s: NULL pointer was passed.\n", __func__); 245 246 len = PFKEY_UNUNIT64(id->sadb_ident_len) - sizeof(*id); 247 printf("sadb_ident_%s{", 248 id->sadb_ident_exttype == SADB_EXT_IDENTITY_SRC ? "src" : "dst"); 249 switch (id->sadb_ident_type) { 250 default: 251 printf(" type=%d id=%lu", 252 id->sadb_ident_type, (u_long)id->sadb_ident_id); 253 if (len) { 254#ifdef _KERNEL 255 ipsec_hexdump((caddr_t)(id + 1), len); /*XXX cast ?*/ 256#else 257 char *p, *ep; 258 printf("\n str=\""); 259 p = (char *)(id + 1); 260 ep = p + len; 261 for (/*nothing*/; *p && p < ep; p++) { 262 if (isprint(*p)) 263 printf("%c", *p & 0xff); 264 else 265 printf("\\%03o", *p & 0xff); 266 } 267#endif 268 printf("\""); 269 } 270 break; 271 } 272 273 printf(" }\n"); 274 275 return; 276} 277 278static void 279kdebug_sadb_supported(struct sadb_ext *ext) 280{ 281 struct sadb_supported *sup = (struct sadb_supported *)ext; 282 struct sadb_alg *alg; 283 int len; 284 285 /* sanity check */ 286 if (ext == NULL) 287 panic("%s: NULL pointer was passed.\n", __func__); 288 289 len = (PFKEY_UNUNIT64(sup->sadb_supported_len) - sizeof(*sup)) 290 / sizeof(*alg); 291 alg = (struct sadb_alg *)(sup + 1); 292 printf("sadb_sup{\n"); 293 while (len--) { 294 printf(" { id=%d ivlen=%d min=%d max=%d }\n", 295 alg->sadb_alg_id, alg->sadb_alg_ivlen, 296 alg->sadb_alg_minbits, alg->sadb_alg_maxbits); 297 alg++; 298 } 299 printf("}\n"); 300 301 return; 302} 303 304static void 305kdebug_sadb_lifetime(struct sadb_ext *ext) 306{ 307 struct sadb_lifetime *lft = (struct sadb_lifetime *)ext; 308 309 /* sanity check */ 310 if (ext == NULL) 311 panic("%s: NULL pointer was passed.\n", __func__); 312 313 printf("sadb_lifetime{ alloc=%u, bytes=%u\n", 314 lft->sadb_lifetime_allocations, 315 (u_int32_t)lft->sadb_lifetime_bytes); 316 printf(" addtime=%u, usetime=%u }\n", 317 (u_int32_t)lft->sadb_lifetime_addtime, 318 (u_int32_t)lft->sadb_lifetime_usetime); 319 320 return; 321} 322 323static void 324kdebug_sadb_sa(struct sadb_ext *ext) 325{ 326 struct sadb_sa *sa = (struct sadb_sa *)ext; 327 328 /* sanity check */ 329 if (ext == NULL) 330 panic("%s: NULL pointer was passed.\n", __func__); 331 332 printf("sadb_sa{ spi=%u replay=%u state=%u\n", 333 (u_int32_t)ntohl(sa->sadb_sa_spi), sa->sadb_sa_replay, 334 sa->sadb_sa_state); 335 printf(" auth=%u encrypt=%u flags=0x%08x }\n", 336 sa->sadb_sa_auth, sa->sadb_sa_encrypt, sa->sadb_sa_flags); 337 338 return; 339} 340 341static void 342kdebug_sadb_address(struct sadb_ext *ext) 343{ 344 struct sadb_address *addr = (struct sadb_address *)ext; 345 346 /* sanity check */ 347 if (ext == NULL) 348 panic("%s: NULL pointer was passed.\n", __func__); 349 350 printf("sadb_address{ proto=%u prefixlen=%u reserved=0x%02x%02x }\n", 351 addr->sadb_address_proto, addr->sadb_address_prefixlen, 352 ((u_char *)&addr->sadb_address_reserved)[0], 353 ((u_char *)&addr->sadb_address_reserved)[1]); 354 355 kdebug_sockaddr((struct sockaddr *)((caddr_t)ext + sizeof(*addr))); 356} 357 358static void 359kdebug_sadb_key(struct sadb_ext *ext) 360{ 361 struct sadb_key *key = (struct sadb_key *)ext; 362 363 /* sanity check */ 364 if (ext == NULL) 365 panic("%s: NULL pointer was passed.\n", __func__); 366 367 printf("sadb_key{ bits=%u reserved=%u\n", 368 key->sadb_key_bits, key->sadb_key_reserved); 369 printf(" key="); 370 371 /* sanity check 2 */ 372 if ((key->sadb_key_bits >> 3) > 373 (PFKEY_UNUNIT64(key->sadb_key_len) - sizeof(struct sadb_key))) { 374 printf("%s: key length mismatch, bit:%d len:%ld.\n", 375 __func__, 376 key->sadb_key_bits >> 3, 377 (long)PFKEY_UNUNIT64(key->sadb_key_len) - sizeof(struct sadb_key)); 378 } 379 380 ipsec_hexdump((caddr_t)key + sizeof(struct sadb_key), 381 key->sadb_key_bits >> 3); 382 printf(" }\n"); 383 return; 384} 385 386static void 387kdebug_sadb_x_sa2(struct sadb_ext *ext) 388{ 389 struct sadb_x_sa2 *sa2 = (struct sadb_x_sa2 *)ext; 390 391 /* sanity check */ 392 if (ext == NULL) 393 panic("%s: NULL pointer was passed.\n", __func__); 394 395 printf("sadb_x_sa2{ mode=%u reqid=%u\n", 396 sa2->sadb_x_sa2_mode, sa2->sadb_x_sa2_reqid); 397 printf(" reserved1=%u reserved2=%u sequence=%u }\n", 398 sa2->sadb_x_sa2_reserved1, sa2->sadb_x_sa2_reserved2, 399 sa2->sadb_x_sa2_sequence); 400 401 return; 402} 403 404static void 405kdebug_sadb_x_sa_replay(struct sadb_ext *ext) 406{ 407 struct sadb_x_sa_replay *replay; 408 409 /* sanity check */ 410 if (ext == NULL) 411 panic("%s: NULL pointer was passed.\n", __func__); 412 413 replay = (struct sadb_x_sa_replay *)ext; 414 printf("sadb_x_sa_replay{ replay=%u }\n", 415 replay->sadb_x_sa_replay_replay); 416} 417 418static void 419kdebug_sadb_x_natt(struct sadb_ext *ext) 420{ 421 struct sadb_x_nat_t_type *type; 422 struct sadb_x_nat_t_port *port; 423 424 /* sanity check */ 425 if (ext == NULL) 426 panic("%s: NULL pointer was passed.\n", __func__); 427 428 if (ext->sadb_ext_type == SADB_X_EXT_NAT_T_TYPE) { 429 type = (struct sadb_x_nat_t_type *)ext; 430 printf("sadb_x_nat_t_type{ type=%u }\n", 431 type->sadb_x_nat_t_type_type); 432 } else { 433 port = (struct sadb_x_nat_t_port *)ext; 434 printf("sadb_x_nat_t_port{ port=%u }\n", 435 ntohs(port->sadb_x_nat_t_port_port)); 436 } 437} 438 439void 440kdebug_sadb_x_policy(struct sadb_ext *ext) 441{ 442 struct sadb_x_policy *xpl = (struct sadb_x_policy *)ext; 443 struct sockaddr *addr; 444 445 /* sanity check */ 446 if (ext == NULL) 447 panic("%s: NULL pointer was passed.\n", __func__); 448 449 printf("sadb_x_policy{ type=%u dir=%u id=%x scope=%u %s=%u }\n", 450 xpl->sadb_x_policy_type, xpl->sadb_x_policy_dir, 451 xpl->sadb_x_policy_id, xpl->sadb_x_policy_scope, 452 xpl->sadb_x_policy_scope == IPSEC_POLICYSCOPE_IFNET ? 453 "ifindex": "priority", xpl->sadb_x_policy_priority); 454 455 if (xpl->sadb_x_policy_type == IPSEC_POLICY_IPSEC) { 456 int tlen; 457 struct sadb_x_ipsecrequest *xisr; 458 459 tlen = PFKEY_UNUNIT64(xpl->sadb_x_policy_len) - sizeof(*xpl); 460 xisr = (struct sadb_x_ipsecrequest *)(xpl + 1); 461 462 while (tlen > 0) { 463 printf(" { len=%u proto=%u mode=%u level=%u reqid=%u\n", 464 xisr->sadb_x_ipsecrequest_len, 465 xisr->sadb_x_ipsecrequest_proto, 466 xisr->sadb_x_ipsecrequest_mode, 467 xisr->sadb_x_ipsecrequest_level, 468 xisr->sadb_x_ipsecrequest_reqid); 469 470 if (xisr->sadb_x_ipsecrequest_len > sizeof(*xisr)) { 471 addr = (struct sockaddr *)(xisr + 1); 472 kdebug_sockaddr(addr); 473 addr = (struct sockaddr *)((caddr_t)addr 474 + addr->sa_len); 475 kdebug_sockaddr(addr); 476 } 477 478 printf(" }\n"); 479 480 /* prevent infinite loop */ 481 if (xisr->sadb_x_ipsecrequest_len <= 0) { 482 printf("%s: wrong policy struct.\n", __func__); 483 return; 484 } 485 /* prevent overflow */ 486 if (xisr->sadb_x_ipsecrequest_len > tlen) { 487 printf("%s: invalid ipsec policy length " 488 "(%u > %u)\n", __func__, 489 xisr->sadb_x_ipsecrequest_len, tlen); 490 return; 491 } 492 493 tlen -= xisr->sadb_x_ipsecrequest_len; 494 495 xisr = (struct sadb_x_ipsecrequest *)((caddr_t)xisr 496 + xisr->sadb_x_ipsecrequest_len); 497 } 498 499 if (tlen != 0) 500 panic("%s: wrong policy struct.\n", __func__); 501 } 502 503 return; 504} 505 506#ifdef _KERNEL 507/* %%%: about SPD and SAD */ 508const char* 509kdebug_secpolicy_state(u_int state) 510{ 511 512 switch (state) { 513 case IPSEC_SPSTATE_DEAD: 514 return ("dead"); 515 case IPSEC_SPSTATE_LARVAL: 516 return ("larval"); 517 case IPSEC_SPSTATE_ALIVE: 518 return ("alive"); 519 case IPSEC_SPSTATE_PCB: 520 return ("pcb"); 521 case IPSEC_SPSTATE_IFNET: 522 return ("ifnet"); 523 } 524 return ("unknown"); 525} 526 527const char* 528kdebug_secpolicy_policy(u_int policy) 529{ 530 531 switch (policy) { 532 case IPSEC_POLICY_DISCARD: 533 return ("discard"); 534 case IPSEC_POLICY_NONE: 535 return ("none"); 536 case IPSEC_POLICY_IPSEC: 537 return ("ipsec"); 538 case IPSEC_POLICY_ENTRUST: 539 return ("entrust"); 540 case IPSEC_POLICY_BYPASS: 541 return ("bypass"); 542 } 543 return ("unknown"); 544} 545 546const char* 547kdebug_secpolicyindex_dir(u_int dir) 548{ 549 550 switch (dir) { 551 case IPSEC_DIR_ANY: 552 return ("any"); 553 case IPSEC_DIR_INBOUND: 554 return ("in"); 555 case IPSEC_DIR_OUTBOUND: 556 return ("out"); 557 } 558 return ("unknown"); 559} 560 561const char* 562kdebug_ipsecrequest_level(u_int level) 563{ 564 565 switch (level) { 566 case IPSEC_LEVEL_DEFAULT: 567 return ("default"); 568 case IPSEC_LEVEL_USE: 569 return ("use"); 570 case IPSEC_LEVEL_REQUIRE: 571 return ("require"); 572 case IPSEC_LEVEL_UNIQUE: 573 return ("unique"); 574 } 575 return ("unknown"); 576} 577 578const char* 579kdebug_secasindex_mode(u_int mode) 580{ 581 582 switch (mode) { 583 case IPSEC_MODE_ANY: 584 return ("any"); 585 case IPSEC_MODE_TRANSPORT: 586 return ("transport"); 587 case IPSEC_MODE_TUNNEL: 588 return ("tunnel"); 589 case IPSEC_MODE_TCPMD5: 590 return ("tcp-md5"); 591 } 592 return ("unknown"); 593} 594 595const char* 596kdebug_secasv_state(u_int state) 597{ 598 599 switch (state) { 600 case SADB_SASTATE_LARVAL: 601 return ("larval"); 602 case SADB_SASTATE_MATURE: 603 return ("mature"); 604 case SADB_SASTATE_DYING: 605 return ("dying"); 606 case SADB_SASTATE_DEAD: 607 return ("dead"); 608 } 609 return ("unknown"); 610} 611 612static char* 613kdebug_port2str(const struct sockaddr *sa, char *buf, size_t len) 614{ 615 uint16_t port; 616 617 IPSEC_ASSERT(sa != NULL, ("null sa")); 618 switch (sa->sa_family) { 619#ifdef INET 620 case AF_INET: 621 port = ntohs(((const struct sockaddr_in *)sa)->sin_port); 622 break; 623#endif 624#ifdef INET6 625 case AF_INET6: 626 port = ntohs(((const struct sockaddr_in6 *)sa)->sin6_port); 627 break; 628#endif 629 default: 630 port = 0; 631 } 632 if (port == 0) 633 return ("*"); 634 snprintf(buf, len, "%u", port); 635 return (buf); 636} 637 638void 639kdebug_secpolicy(struct secpolicy *sp) 640{ 641 u_int idx; 642 643 IPSEC_ASSERT(sp != NULL, ("null sp")); 644 printf("SP { refcnt=%u id=%u priority=%u state=%s policy=%s\n", 645 sp->refcnt, sp->id, sp->priority, 646 kdebug_secpolicy_state(sp->state), 647 kdebug_secpolicy_policy(sp->policy)); 648 kdebug_secpolicyindex(&sp->spidx, " "); 649 for (idx = 0; idx < sp->tcount; idx++) { 650 printf(" req[%u]{ level=%s ", idx, 651 kdebug_ipsecrequest_level(sp->req[idx]->level)); 652 kdebug_secasindex(&sp->req[idx]->saidx, NULL); 653 printf(" }\n"); 654 } 655 printf("}\n"); 656} 657 658void 659kdebug_secpolicyindex(struct secpolicyindex *spidx, const char *indent) 660{ 661 char buf[IPSEC_ADDRSTRLEN]; 662 663 IPSEC_ASSERT(spidx != NULL, ("null spidx")); 664 if (indent != NULL) 665 printf("%s", indent); 666 printf("spidx { dir=%s ul_proto=", 667 kdebug_secpolicyindex_dir(spidx->dir)); 668 if (spidx->ul_proto == IPSEC_ULPROTO_ANY) 669 printf("* "); 670 else 671 printf("%u ", spidx->ul_proto); 672 printf("%s/%u -> ", ipsec_address(&spidx->src, buf, sizeof(buf)), 673 spidx->prefs); 674 printf("%s/%u }\n", ipsec_address(&spidx->dst, buf, sizeof(buf)), 675 spidx->prefd); 676} 677 678void 679kdebug_secasindex(const struct secasindex *saidx, const char *indent) 680{ 681 char buf[IPSEC_ADDRSTRLEN], port[6]; 682 683 IPSEC_ASSERT(saidx != NULL, ("null saidx")); 684 if (indent != NULL) 685 printf("%s", indent); 686 printf("saidx { mode=%s proto=%u reqid=%u ", 687 kdebug_secasindex_mode(saidx->mode), saidx->proto, saidx->reqid); 688 printf("%s:%s -> ", ipsec_address(&saidx->src, buf, sizeof(buf)), 689 kdebug_port2str(&saidx->src.sa, port, sizeof(port))); 690 printf("%s:%s }\n", ipsec_address(&saidx->dst, buf, sizeof(buf)), 691 kdebug_port2str(&saidx->dst.sa, port, sizeof(port))); 692} 693 694static void 695kdebug_sec_lifetime(struct seclifetime *lft, const char *indent) 696{ 697 698 IPSEC_ASSERT(lft != NULL, ("null lft")); 699 if (indent != NULL) 700 printf("%s", indent); 701 printf("lifetime { alloc=%u, bytes=%ju addtime=%ju usetime=%ju }\n", 702 lft->allocations, (uintmax_t)lft->bytes, (uintmax_t)lft->addtime, 703 (uintmax_t)lft->usetime); 704} 705 706void 707kdebug_secash(struct secashead *sah, const char *indent) 708{ 709 710 IPSEC_ASSERT(sah != NULL, ("null sah")); 711 if (indent != NULL) 712 printf("%s", indent); 713 printf("SAH { refcnt=%u state=%s\n", sah->refcnt, 714 kdebug_secasv_state(sah->state)); 715 if (indent != NULL) 716 printf("%s", indent); 717 kdebug_secasindex(&sah->saidx, indent); 718 if (indent != NULL) 719 printf("%s", indent); 720 printf("}\n"); 721} 722 723#ifdef IPSEC_DEBUG 724static void 725kdebug_secreplay(struct secreplay *rpl) 726{ 727 int len, l; 728 729 IPSEC_ASSERT(rpl != NULL, ("null rpl")); 730 printf(" secreplay{ count=%u bitmap_size=%u wsize=%u seq=%u lastseq=%u", 731 rpl->count, rpl->bitmap_size, rpl->wsize, rpl->seq, rpl->lastseq); 732 733 if (rpl->bitmap == NULL) { 734 printf(" }\n"); 735 return; 736 } 737 738 printf("\n bitmap { "); 739 for (len = 0; len < rpl->bitmap_size*4; len++) { 740 for (l = 7; l >= 0; l--) 741 printf("%u", (((rpl->bitmap)[len] >> l) & 1) ? 1 : 0); 742 } 743 printf(" }\n"); 744} 745#endif /* IPSEC_DEBUG */ 746 747static void 748kdebug_secnatt(struct secnatt *natt) 749{ 750 char buf[IPSEC_ADDRSTRLEN]; 751 752 IPSEC_ASSERT(natt != NULL, ("null natt")); 753 printf(" natt{ sport=%u dport=%u ", ntohs(natt->sport), 754 ntohs(natt->dport)); 755 if (natt->flags & IPSEC_NATT_F_OAI) 756 printf("oai=%s ", ipsec_address(&natt->oai, buf, sizeof(buf))); 757 if (natt->flags & IPSEC_NATT_F_OAR) 758 printf("oar=%s ", ipsec_address(&natt->oar, buf, sizeof(buf))); 759 printf("}\n"); 760} 761 762void 763kdebug_secasv(struct secasvar *sav) 764{ 765 struct seclifetime lft_c; 766 767 IPSEC_ASSERT(sav != NULL, ("null sav")); 768 769 printf("SA { refcnt=%u spi=%u seq=%u pid=%u flags=0x%x state=%s\n", 770 sav->refcnt, ntohl(sav->spi), sav->seq, (uint32_t)sav->pid, 771 sav->flags, kdebug_secasv_state(sav->state)); 772 kdebug_secash(sav->sah, " "); 773 774 lft_c.addtime = sav->created; 775 lft_c.allocations = (uint32_t)counter_u64_fetch( 776 sav->lft_c_allocations); 777 lft_c.bytes = counter_u64_fetch(sav->lft_c_bytes); 778 lft_c.usetime = sav->firstused; 779 kdebug_sec_lifetime(&lft_c, " c_"); 780 if (sav->lft_h != NULL) 781 kdebug_sec_lifetime(sav->lft_h, " h_"); 782 if (sav->lft_s != NULL) 783 kdebug_sec_lifetime(sav->lft_s, " s_"); 784 785 if (sav->tdb_authalgxform != NULL) 786 printf(" alg_auth=%s\n", sav->tdb_authalgxform->name); 787 if (sav->key_auth != NULL) 788 KEYDBG(DUMP, 789 kdebug_sadb_key((struct sadb_ext *)sav->key_auth)); 790 if (sav->tdb_encalgxform != NULL) 791 printf(" alg_enc=%s\n", sav->tdb_encalgxform->name); 792 if (sav->key_enc != NULL) 793 KEYDBG(DUMP, 794 kdebug_sadb_key((struct sadb_ext *)sav->key_enc)); 795 if (sav->natt != NULL) 796 kdebug_secnatt(sav->natt); 797 if (sav->replay != NULL) { 798 KEYDBG(DUMP, 799 SECASVAR_LOCK(sav); 800 kdebug_secreplay(sav->replay); 801 SECASVAR_UNLOCK(sav)); 802 } 803 printf("}\n"); 804} 805 806void 807kdebug_mbufhdr(const struct mbuf *m) 808{ 809 /* sanity check */ 810 if (m == NULL) 811 return; 812 813 printf("mbuf(%p){ m_next:%p m_nextpkt:%p m_data:%p " 814 "m_len:%d m_type:0x%02x m_flags:0x%02x }\n", 815 m, m->m_next, m->m_nextpkt, m->m_data, 816 m->m_len, m->m_type, m->m_flags); 817 818 if (m->m_flags & M_PKTHDR) { 819 printf(" m_pkthdr{ len:%d rcvif:%p }\n", 820 m->m_pkthdr.len, m->m_pkthdr.rcvif); 821 } 822 823 if (m->m_flags & M_EXT) { 824 printf(" m_ext{ ext_buf:%p ext_free:%p " 825 "ext_size:%u ext_cnt:%p }\n", 826 m->m_ext.ext_buf, m->m_ext.ext_free, 827 m->m_ext.ext_size, m->m_ext.ext_cnt); 828 } 829 830 return; 831} 832 833void 834kdebug_mbuf(const struct mbuf *m0) 835{ 836 const struct mbuf *m = m0; 837 int i, j; 838 839 for (j = 0; m; m = m->m_next) { 840 kdebug_mbufhdr(m); 841 printf(" m_data:\n"); 842 for (i = 0; i < m->m_len; i++) { 843 if (i && i % 32 == 0) 844 printf("\n"); 845 if (i % 4 == 0) 846 printf(" "); 847 printf("%02x", mtod(m, const u_char *)[i]); 848 j++; 849 } 850 printf("\n"); 851 } 852 853 return; 854} 855 856/* Return a printable string for the address. */ 857char * 858ipsec_address(const union sockaddr_union* sa, char *buf, socklen_t size) 859{ 860 861 switch (sa->sa.sa_family) { 862#ifdef INET 863 case AF_INET: 864 return (inet_ntop(AF_INET, &sa->sin.sin_addr, buf, size)); 865#endif /* INET */ 866#ifdef INET6 867 case AF_INET6: 868 if (IN6_IS_SCOPE_LINKLOCAL(&sa->sin6.sin6_addr)) { 869 snprintf(buf, size, "%s%%%u", inet_ntop(AF_INET6, 870 &sa->sin6.sin6_addr, buf, size), 871 sa->sin6.sin6_scope_id); 872 return (buf); 873 } else 874 return (inet_ntop(AF_INET6, &sa->sin6.sin6_addr, 875 buf, size)); 876#endif /* INET6 */ 877 case 0: 878 return ("*"); 879 default: 880 return ("(unknown address family)"); 881 } 882} 883 884char * 885ipsec_sa2str(struct secasvar *sav, char *buf, size_t size) 886{ 887 char sbuf[IPSEC_ADDRSTRLEN], dbuf[IPSEC_ADDRSTRLEN]; 888 889 snprintf(buf, size, "SA(SPI=%08lx src=%s dst=%s)", 890 (u_long)ntohl(sav->spi), 891 ipsec_address(&sav->sah->saidx.src, sbuf, sizeof(sbuf)), 892 ipsec_address(&sav->sah->saidx.dst, dbuf, sizeof(dbuf))); 893 return (buf); 894} 895 896#endif /* _KERNEL */ 897 898void 899kdebug_sockaddr(struct sockaddr *addr) 900{ 901 char buf[IPSEC_ADDRSTRLEN]; 902 903 /* sanity check */ 904 if (addr == NULL) 905 panic("%s: NULL pointer was passed.\n", __func__); 906 907 switch (addr->sa_family) { 908#ifdef INET 909 case AF_INET: { 910 struct sockaddr_in *sin; 911 912 sin = (struct sockaddr_in *)addr; 913 inet_ntop(AF_INET, &sin->sin_addr, buf, sizeof(buf)); 914 break; 915 } 916#endif 917#ifdef INET6 918 case AF_INET6: { 919 struct sockaddr_in6 *sin6; 920 921 sin6 = (struct sockaddr_in6 *)addr; 922 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) { 923 snprintf(buf, sizeof(buf), "%s%%%u", 924 inet_ntop(AF_INET6, &sin6->sin6_addr, buf, 925 sizeof(buf)), sin6->sin6_scope_id); 926 } else 927 inet_ntop(AF_INET6, &sin6->sin6_addr, buf, 928 sizeof(buf)); 929 break; 930 } 931#endif 932 default: 933 sprintf(buf, "unknown"); 934 } 935 printf("sockaddr{ len=%u family=%u addr=%s }\n", addr->sa_len, 936 addr->sa_family, buf); 937} 938 939void 940ipsec_bindump(caddr_t buf, int len) 941{ 942 int i; 943 944 for (i = 0; i < len; i++) 945 printf("%c", (unsigned char)buf[i]); 946 947 return; 948} 949 950 951void 952ipsec_hexdump(caddr_t buf, int len) 953{ 954 int i; 955 956 for (i = 0; i < len; i++) { 957 if (i != 0 && i % 32 == 0) printf("\n"); 958 if (i % 4 == 0) printf(" "); 959 printf("%02x", (unsigned char)buf[i]); 960 } 961#if 0 962 if (i % 32 != 0) printf("\n"); 963#endif 964 965 return; 966} 967