1/* $FreeBSD$ */ 2/* $KAME: key_debug.c,v 1.26 2001/06/27 10:46:50 sakane Exp $ */ 3 4/*- 5 * SPDX-License-Identifier: BSD-3-Clause 6 * 7 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 8 * All rights reserved. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 3. Neither the name of the project nor the names of its contributors 19 * may be used to endorse or promote products derived from this software 20 * without specific prior written permission. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32 * SUCH DAMAGE. 33 */ 34 35#ifdef _KERNEL 36#include "opt_inet.h" 37#include "opt_inet6.h" 38#include "opt_ipsec.h" 39#endif 40 41#include <sys/param.h> 42#ifdef _KERNEL 43#include <sys/systm.h> 44#include <sys/lock.h> 45#include <sys/malloc.h> 46#include <sys/mbuf.h> 47#include <sys/mutex.h> 48#include <sys/queue.h> 49#endif 50#include <sys/socket.h> 51 52#include <net/vnet.h> 53 54#include <netipsec/key_var.h> 55#include <netipsec/key_debug.h> 56 57#include <netinet/in.h> 58#include <netipsec/ipsec.h> 59#ifdef _KERNEL 60#include <netipsec/keydb.h> 61#include <netipsec/xform.h> 62#endif 63 64#ifndef _KERNEL 65#include <ctype.h> 66#include <stdio.h> 67#include <stdlib.h> 68#include <arpa/inet.h> 69#endif /* !_KERNEL */ 70 71static void kdebug_sadb_prop(struct sadb_ext *); 72static void kdebug_sadb_identity(struct sadb_ext *); 73static void kdebug_sadb_supported(struct sadb_ext *); 74static void kdebug_sadb_lifetime(struct sadb_ext *); 75static void kdebug_sadb_sa(struct sadb_ext *); 76static void kdebug_sadb_address(struct sadb_ext *); 77static void kdebug_sadb_key(struct sadb_ext *); 78static void kdebug_sadb_x_sa2(struct sadb_ext *); 79static void kdebug_sadb_x_sa_replay(struct sadb_ext *); 80static void kdebug_sadb_x_natt(struct sadb_ext *); 81 82#ifndef _KERNEL 83#define panic(fmt, ...) { printf(fmt, ## __VA_ARGS__); exit(-1); } 84#endif 85 86/* NOTE: host byte order */ 87 88static const char* 89kdebug_sadb_type(uint8_t type) 90{ 91#define SADB_NAME(n) case SADB_ ## n: return (#n) 92 93 switch (type) { 94 SADB_NAME(RESERVED); 95 SADB_NAME(GETSPI); 96 SADB_NAME(UPDATE); 97 SADB_NAME(ADD); 98 SADB_NAME(DELETE); 99 SADB_NAME(GET); 100 SADB_NAME(ACQUIRE); 101 SADB_NAME(REGISTER); 102 SADB_NAME(EXPIRE); 103 SADB_NAME(FLUSH); 104 SADB_NAME(DUMP); 105 SADB_NAME(X_PROMISC); 106 SADB_NAME(X_PCHANGE); 107 SADB_NAME(X_SPDUPDATE); 108 SADB_NAME(X_SPDADD); 109 SADB_NAME(X_SPDDELETE); 110 SADB_NAME(X_SPDGET); 111 SADB_NAME(X_SPDACQUIRE); 112 SADB_NAME(X_SPDDUMP); 113 SADB_NAME(X_SPDFLUSH); 114 SADB_NAME(X_SPDSETIDX); 115 SADB_NAME(X_SPDEXPIRE); 116 SADB_NAME(X_SPDDELETE2); 117 default: 118 return ("UNKNOWN"); 119 } 120#undef SADB_NAME 121} 122 123static const char* 124kdebug_sadb_exttype(uint16_t type) 125{ 126#define EXT_NAME(n) case SADB_EXT_ ## n: return (#n) 127#define X_NAME(n) case SADB_X_EXT_ ## n: return (#n) 128 129 switch (type) { 130 EXT_NAME(RESERVED); 131 EXT_NAME(SA); 132 EXT_NAME(LIFETIME_CURRENT); 133 EXT_NAME(LIFETIME_HARD); 134 EXT_NAME(LIFETIME_SOFT); 135 EXT_NAME(ADDRESS_SRC); 136 EXT_NAME(ADDRESS_DST); 137 EXT_NAME(ADDRESS_PROXY); 138 EXT_NAME(KEY_AUTH); 139 EXT_NAME(KEY_ENCRYPT); 140 EXT_NAME(IDENTITY_SRC); 141 EXT_NAME(IDENTITY_DST); 142 EXT_NAME(SENSITIVITY); 143 EXT_NAME(PROPOSAL); 144 EXT_NAME(SUPPORTED_AUTH); 145 EXT_NAME(SUPPORTED_ENCRYPT); 146 EXT_NAME(SPIRANGE); 147 X_NAME(KMPRIVATE); 148 X_NAME(POLICY); 149 X_NAME(SA2); 150 X_NAME(NAT_T_TYPE); 151 X_NAME(NAT_T_SPORT); 152 X_NAME(NAT_T_DPORT); 153 X_NAME(NAT_T_OAI); 154 X_NAME(NAT_T_OAR); 155 X_NAME(NAT_T_FRAG); 156 X_NAME(SA_REPLAY); 157 X_NAME(NEW_ADDRESS_SRC); 158 X_NAME(NEW_ADDRESS_DST); 159 default: 160 return ("UNKNOWN"); 161 }; 162#undef EXT_NAME 163#undef X_NAME 164} 165 166 167/* %%%: about struct sadb_msg */ 168void 169kdebug_sadb(struct sadb_msg *base) 170{ 171 struct sadb_ext *ext; 172 int tlen, extlen; 173 174 /* sanity check */ 175 if (base == NULL) 176 panic("%s: NULL pointer was passed.\n", __func__); 177 178 printf("sadb_msg{ version=%u type=%u(%s) errno=%u satype=%u\n", 179 base->sadb_msg_version, base->sadb_msg_type, 180 kdebug_sadb_type(base->sadb_msg_type), 181 base->sadb_msg_errno, base->sadb_msg_satype); 182 printf(" len=%u reserved=%u seq=%u pid=%u\n", 183 base->sadb_msg_len, base->sadb_msg_reserved, 184 base->sadb_msg_seq, base->sadb_msg_pid); 185 186 tlen = PFKEY_UNUNIT64(base->sadb_msg_len) - sizeof(struct sadb_msg); 187 ext = (struct sadb_ext *)((caddr_t)base + sizeof(struct sadb_msg)); 188 189 while (tlen > 0) { 190 printf("sadb_ext{ len=%u type=%u(%s) }\n", 191 ext->sadb_ext_len, ext->sadb_ext_type, 192 kdebug_sadb_exttype(ext->sadb_ext_type)); 193 194 if (ext->sadb_ext_len == 0) { 195 printf("%s: invalid ext_len=0 was passed.\n", __func__); 196 return; 197 } 198 if (ext->sadb_ext_len > tlen) { 199 printf("%s: ext_len too big (%u > %u).\n", 200 __func__, ext->sadb_ext_len, tlen); 201 return; 202 } 203 204 switch (ext->sadb_ext_type) { 205 case SADB_EXT_SA: 206 kdebug_sadb_sa(ext); 207 break; 208 case SADB_EXT_LIFETIME_CURRENT: 209 case SADB_EXT_LIFETIME_HARD: 210 case SADB_EXT_LIFETIME_SOFT: 211 kdebug_sadb_lifetime(ext); 212 break; 213 case SADB_EXT_ADDRESS_SRC: 214 case SADB_EXT_ADDRESS_DST: 215 case SADB_EXT_ADDRESS_PROXY: 216 case SADB_X_EXT_NAT_T_OAI: 217 case SADB_X_EXT_NAT_T_OAR: 218 case SADB_X_EXT_NEW_ADDRESS_SRC: 219 case SADB_X_EXT_NEW_ADDRESS_DST: 220 kdebug_sadb_address(ext); 221 break; 222 case SADB_EXT_KEY_AUTH: 223 case SADB_EXT_KEY_ENCRYPT: 224 kdebug_sadb_key(ext); 225 break; 226 case SADB_EXT_IDENTITY_SRC: 227 case SADB_EXT_IDENTITY_DST: 228 kdebug_sadb_identity(ext); 229 break; 230 case SADB_EXT_SENSITIVITY: 231 break; 232 case SADB_EXT_PROPOSAL: 233 kdebug_sadb_prop(ext); 234 break; 235 case SADB_EXT_SUPPORTED_AUTH: 236 case SADB_EXT_SUPPORTED_ENCRYPT: 237 kdebug_sadb_supported(ext); 238 break; 239 case SADB_EXT_SPIRANGE: 240 case SADB_X_EXT_KMPRIVATE: 241 break; 242 case SADB_X_EXT_POLICY: 243 kdebug_sadb_x_policy(ext); 244 break; 245 case SADB_X_EXT_SA2: 246 kdebug_sadb_x_sa2(ext); 247 break; 248 case SADB_X_EXT_SA_REPLAY: 249 kdebug_sadb_x_sa_replay(ext); 250 break; 251 case SADB_X_EXT_NAT_T_TYPE: 252 case SADB_X_EXT_NAT_T_SPORT: 253 case SADB_X_EXT_NAT_T_DPORT: 254 kdebug_sadb_x_natt(ext); 255 break; 256 default: 257 printf("%s: invalid ext_type %u\n", __func__, 258 ext->sadb_ext_type); 259 return; 260 } 261 262 extlen = PFKEY_UNUNIT64(ext->sadb_ext_len); 263 tlen -= extlen; 264 ext = (struct sadb_ext *)((caddr_t)ext + extlen); 265 } 266 267 return; 268} 269 270static void 271kdebug_sadb_prop(struct sadb_ext *ext) 272{ 273 struct sadb_prop *prop = (struct sadb_prop *)ext; 274 struct sadb_comb *comb; 275 int len; 276 277 /* sanity check */ 278 if (ext == NULL) 279 panic("%s: NULL pointer was passed.\n", __func__); 280 281 len = (PFKEY_UNUNIT64(prop->sadb_prop_len) - sizeof(*prop)) 282 / sizeof(*comb); 283 comb = (struct sadb_comb *)(prop + 1); 284 printf("sadb_prop{ replay=%u\n", prop->sadb_prop_replay); 285 286 while (len--) { 287 printf("sadb_comb{ auth=%u encrypt=%u " 288 "flags=0x%04x reserved=0x%08x\n", 289 comb->sadb_comb_auth, comb->sadb_comb_encrypt, 290 comb->sadb_comb_flags, comb->sadb_comb_reserved); 291 292 printf(" auth_minbits=%u auth_maxbits=%u " 293 "encrypt_minbits=%u encrypt_maxbits=%u\n", 294 comb->sadb_comb_auth_minbits, 295 comb->sadb_comb_auth_maxbits, 296 comb->sadb_comb_encrypt_minbits, 297 comb->sadb_comb_encrypt_maxbits); 298 299 printf(" soft_alloc=%u hard_alloc=%u " 300 "soft_bytes=%lu hard_bytes=%lu\n", 301 comb->sadb_comb_soft_allocations, 302 comb->sadb_comb_hard_allocations, 303 (unsigned long)comb->sadb_comb_soft_bytes, 304 (unsigned long)comb->sadb_comb_hard_bytes); 305 306 printf(" soft_alloc=%lu hard_alloc=%lu " 307 "soft_bytes=%lu hard_bytes=%lu }\n", 308 (unsigned long)comb->sadb_comb_soft_addtime, 309 (unsigned long)comb->sadb_comb_hard_addtime, 310 (unsigned long)comb->sadb_comb_soft_usetime, 311 (unsigned long)comb->sadb_comb_hard_usetime); 312 comb++; 313 } 314 printf("}\n"); 315 316 return; 317} 318 319static void 320kdebug_sadb_identity(struct sadb_ext *ext) 321{ 322 struct sadb_ident *id = (struct sadb_ident *)ext; 323 int len; 324 325 /* sanity check */ 326 if (ext == NULL) 327 panic("%s: NULL pointer was passed.\n", __func__); 328 329 len = PFKEY_UNUNIT64(id->sadb_ident_len) - sizeof(*id); 330 printf("sadb_ident_%s{", 331 id->sadb_ident_exttype == SADB_EXT_IDENTITY_SRC ? "src" : "dst"); 332 switch (id->sadb_ident_type) { 333 default: 334 printf(" type=%d id=%lu", 335 id->sadb_ident_type, (u_long)id->sadb_ident_id); 336 if (len) { 337#ifdef _KERNEL 338 ipsec_hexdump((caddr_t)(id + 1), len); /*XXX cast ?*/ 339#else 340 char *p, *ep; 341 printf("\n str=\""); 342 p = (char *)(id + 1); 343 ep = p + len; 344 for (/*nothing*/; *p && p < ep; p++) { 345 if (isprint(*p)) 346 printf("%c", *p & 0xff); 347 else 348 printf("\\%03o", *p & 0xff); 349 } 350#endif 351 printf("\""); 352 } 353 break; 354 } 355 356 printf(" }\n"); 357 358 return; 359} 360 361static void 362kdebug_sadb_supported(struct sadb_ext *ext) 363{ 364 struct sadb_supported *sup = (struct sadb_supported *)ext; 365 struct sadb_alg *alg; 366 int len; 367 368 /* sanity check */ 369 if (ext == NULL) 370 panic("%s: NULL pointer was passed.\n", __func__); 371 372 len = (PFKEY_UNUNIT64(sup->sadb_supported_len) - sizeof(*sup)) 373 / sizeof(*alg); 374 alg = (struct sadb_alg *)(sup + 1); 375 printf("sadb_sup{\n"); 376 while (len--) { 377 printf(" { id=%d ivlen=%d min=%d max=%d }\n", 378 alg->sadb_alg_id, alg->sadb_alg_ivlen, 379 alg->sadb_alg_minbits, alg->sadb_alg_maxbits); 380 alg++; 381 } 382 printf("}\n"); 383 384 return; 385} 386 387static void 388kdebug_sadb_lifetime(struct sadb_ext *ext) 389{ 390 struct sadb_lifetime *lft = (struct sadb_lifetime *)ext; 391 392 /* sanity check */ 393 if (ext == NULL) 394 panic("%s: NULL pointer was passed.\n", __func__); 395 396 printf("sadb_lifetime{ alloc=%u, bytes=%u\n", 397 lft->sadb_lifetime_allocations, 398 (u_int32_t)lft->sadb_lifetime_bytes); 399 printf(" addtime=%u, usetime=%u }\n", 400 (u_int32_t)lft->sadb_lifetime_addtime, 401 (u_int32_t)lft->sadb_lifetime_usetime); 402 403 return; 404} 405 406static void 407kdebug_sadb_sa(struct sadb_ext *ext) 408{ 409 struct sadb_sa *sa = (struct sadb_sa *)ext; 410 411 /* sanity check */ 412 if (ext == NULL) 413 panic("%s: NULL pointer was passed.\n", __func__); 414 415 printf("sadb_sa{ spi=%u replay=%u state=%u\n", 416 (u_int32_t)ntohl(sa->sadb_sa_spi), sa->sadb_sa_replay, 417 sa->sadb_sa_state); 418 printf(" auth=%u encrypt=%u flags=0x%08x }\n", 419 sa->sadb_sa_auth, sa->sadb_sa_encrypt, sa->sadb_sa_flags); 420 421 return; 422} 423 424static void 425kdebug_sadb_address(struct sadb_ext *ext) 426{ 427 struct sadb_address *addr = (struct sadb_address *)ext; 428 429 /* sanity check */ 430 if (ext == NULL) 431 panic("%s: NULL pointer was passed.\n", __func__); 432 433 printf("sadb_address{ proto=%u prefixlen=%u reserved=0x%02x%02x }\n", 434 addr->sadb_address_proto, addr->sadb_address_prefixlen, 435 ((u_char *)&addr->sadb_address_reserved)[0], 436 ((u_char *)&addr->sadb_address_reserved)[1]); 437 438 kdebug_sockaddr((struct sockaddr *)((caddr_t)ext + sizeof(*addr))); 439} 440 441static void 442kdebug_sadb_key(struct sadb_ext *ext) 443{ 444 struct sadb_key *key = (struct sadb_key *)ext; 445 446 /* sanity check */ 447 if (ext == NULL) 448 panic("%s: NULL pointer was passed.\n", __func__); 449 450 printf("sadb_key{ bits=%u reserved=%u\n", 451 key->sadb_key_bits, key->sadb_key_reserved); 452 printf(" key="); 453 454 /* sanity check 2 */ 455 if ((key->sadb_key_bits >> 3) > 456 (PFKEY_UNUNIT64(key->sadb_key_len) - sizeof(struct sadb_key))) { 457 printf("%s: key length mismatch, bit:%d len:%ld.\n", 458 __func__, 459 key->sadb_key_bits >> 3, 460 (long)PFKEY_UNUNIT64(key->sadb_key_len) - sizeof(struct sadb_key)); 461 } 462 463 ipsec_hexdump((caddr_t)key + sizeof(struct sadb_key), 464 key->sadb_key_bits >> 3); 465 printf(" }\n"); 466 return; 467} 468 469static void 470kdebug_sadb_x_sa2(struct sadb_ext *ext) 471{ 472 struct sadb_x_sa2 *sa2 = (struct sadb_x_sa2 *)ext; 473 474 /* sanity check */ 475 if (ext == NULL) 476 panic("%s: NULL pointer was passed.\n", __func__); 477 478 printf("sadb_x_sa2{ mode=%u reqid=%u\n", 479 sa2->sadb_x_sa2_mode, sa2->sadb_x_sa2_reqid); 480 printf(" reserved1=%u reserved2=%u sequence=%u }\n", 481 sa2->sadb_x_sa2_reserved1, sa2->sadb_x_sa2_reserved2, 482 sa2->sadb_x_sa2_sequence); 483 484 return; 485} 486 487static void 488kdebug_sadb_x_sa_replay(struct sadb_ext *ext) 489{ 490 struct sadb_x_sa_replay *replay; 491 492 /* sanity check */ 493 if (ext == NULL) 494 panic("%s: NULL pointer was passed.\n", __func__); 495 496 replay = (struct sadb_x_sa_replay *)ext; 497 printf("sadb_x_sa_replay{ replay=%u }\n", 498 replay->sadb_x_sa_replay_replay); 499} 500 501static void 502kdebug_sadb_x_natt(struct sadb_ext *ext) 503{ 504 struct sadb_x_nat_t_type *type; 505 struct sadb_x_nat_t_port *port; 506 507 /* sanity check */ 508 if (ext == NULL) 509 panic("%s: NULL pointer was passed.\n", __func__); 510 511 if (ext->sadb_ext_type == SADB_X_EXT_NAT_T_TYPE) { 512 type = (struct sadb_x_nat_t_type *)ext; 513 printf("sadb_x_nat_t_type{ type=%u }\n", 514 type->sadb_x_nat_t_type_type); 515 } else { 516 port = (struct sadb_x_nat_t_port *)ext; 517 printf("sadb_x_nat_t_port{ port=%u }\n", 518 ntohs(port->sadb_x_nat_t_port_port)); 519 } 520} 521 522void 523kdebug_sadb_x_policy(struct sadb_ext *ext) 524{ 525 struct sadb_x_policy *xpl = (struct sadb_x_policy *)ext; 526 struct sockaddr *addr; 527 528 /* sanity check */ 529 if (ext == NULL) 530 panic("%s: NULL pointer was passed.\n", __func__); 531 532 printf("sadb_x_policy{ type=%u dir=%u id=%x scope=%u %s=%u }\n", 533 xpl->sadb_x_policy_type, xpl->sadb_x_policy_dir, 534 xpl->sadb_x_policy_id, xpl->sadb_x_policy_scope, 535 xpl->sadb_x_policy_scope == IPSEC_POLICYSCOPE_IFNET ? 536 "ifindex": "priority", xpl->sadb_x_policy_priority); 537 538 if (xpl->sadb_x_policy_type == IPSEC_POLICY_IPSEC) { 539 int tlen; 540 struct sadb_x_ipsecrequest *xisr; 541 542 tlen = PFKEY_UNUNIT64(xpl->sadb_x_policy_len) - sizeof(*xpl); 543 xisr = (struct sadb_x_ipsecrequest *)(xpl + 1); 544 545 while (tlen > 0) { 546 printf(" { len=%u proto=%u mode=%u level=%u reqid=%u\n", 547 xisr->sadb_x_ipsecrequest_len, 548 xisr->sadb_x_ipsecrequest_proto, 549 xisr->sadb_x_ipsecrequest_mode, 550 xisr->sadb_x_ipsecrequest_level, 551 xisr->sadb_x_ipsecrequest_reqid); 552 553 if (xisr->sadb_x_ipsecrequest_len > sizeof(*xisr)) { 554 addr = (struct sockaddr *)(xisr + 1); 555 kdebug_sockaddr(addr); 556 addr = (struct sockaddr *)((caddr_t)addr 557 + addr->sa_len); 558 kdebug_sockaddr(addr); 559 } 560 561 printf(" }\n"); 562 563 /* prevent infinite loop */ 564 if (xisr->sadb_x_ipsecrequest_len <= 0) { 565 printf("%s: wrong policy struct.\n", __func__); 566 return; 567 } 568 /* prevent overflow */ 569 if (xisr->sadb_x_ipsecrequest_len > tlen) { 570 printf("%s: invalid ipsec policy length " 571 "(%u > %u)\n", __func__, 572 xisr->sadb_x_ipsecrequest_len, tlen); 573 return; 574 } 575 576 tlen -= xisr->sadb_x_ipsecrequest_len; 577 578 xisr = (struct sadb_x_ipsecrequest *)((caddr_t)xisr 579 + xisr->sadb_x_ipsecrequest_len); 580 } 581 582 if (tlen != 0) 583 panic("%s: wrong policy struct.\n", __func__); 584 } 585 586 return; 587} 588 589#ifdef _KERNEL 590/* %%%: about SPD and SAD */ 591const char* 592kdebug_secpolicy_state(u_int state) 593{ 594 595 switch (state) { 596 case IPSEC_SPSTATE_DEAD: 597 return ("dead"); 598 case IPSEC_SPSTATE_LARVAL: 599 return ("larval"); 600 case IPSEC_SPSTATE_ALIVE: 601 return ("alive"); 602 case IPSEC_SPSTATE_PCB: 603 return ("pcb"); 604 case IPSEC_SPSTATE_IFNET: 605 return ("ifnet"); 606 } 607 return ("unknown"); 608} 609 610const char* 611kdebug_secpolicy_policy(u_int policy) 612{ 613 614 switch (policy) { 615 case IPSEC_POLICY_DISCARD: 616 return ("discard"); 617 case IPSEC_POLICY_NONE: 618 return ("none"); 619 case IPSEC_POLICY_IPSEC: 620 return ("ipsec"); 621 case IPSEC_POLICY_ENTRUST: 622 return ("entrust"); 623 case IPSEC_POLICY_BYPASS: 624 return ("bypass"); 625 } 626 return ("unknown"); 627} 628 629const char* 630kdebug_secpolicyindex_dir(u_int dir) 631{ 632 633 switch (dir) { 634 case IPSEC_DIR_ANY: 635 return ("any"); 636 case IPSEC_DIR_INBOUND: 637 return ("in"); 638 case IPSEC_DIR_OUTBOUND: 639 return ("out"); 640 } 641 return ("unknown"); 642} 643 644const char* 645kdebug_ipsecrequest_level(u_int level) 646{ 647 648 switch (level) { 649 case IPSEC_LEVEL_DEFAULT: 650 return ("default"); 651 case IPSEC_LEVEL_USE: 652 return ("use"); 653 case IPSEC_LEVEL_REQUIRE: 654 return ("require"); 655 case IPSEC_LEVEL_UNIQUE: 656 return ("unique"); 657 } 658 return ("unknown"); 659} 660 661const char* 662kdebug_secasindex_mode(u_int mode) 663{ 664 665 switch (mode) { 666 case IPSEC_MODE_ANY: 667 return ("any"); 668 case IPSEC_MODE_TRANSPORT: 669 return ("transport"); 670 case IPSEC_MODE_TUNNEL: 671 return ("tunnel"); 672 case IPSEC_MODE_TCPMD5: 673 return ("tcp-md5"); 674 } 675 return ("unknown"); 676} 677 678const char* 679kdebug_secasv_state(u_int state) 680{ 681 682 switch (state) { 683 case SADB_SASTATE_LARVAL: 684 return ("larval"); 685 case SADB_SASTATE_MATURE: 686 return ("mature"); 687 case SADB_SASTATE_DYING: 688 return ("dying"); 689 case SADB_SASTATE_DEAD: 690 return ("dead"); 691 } 692 return ("unknown"); 693} 694 695static char* 696kdebug_port2str(const struct sockaddr *sa, char *buf, size_t len) 697{ 698 uint16_t port; 699 700 IPSEC_ASSERT(sa != NULL, ("null sa")); 701 switch (sa->sa_family) { 702#ifdef INET 703 case AF_INET: 704 port = ntohs(((const struct sockaddr_in *)sa)->sin_port); 705 break; 706#endif 707#ifdef INET6 708 case AF_INET6: 709 port = ntohs(((const struct sockaddr_in6 *)sa)->sin6_port); 710 break; 711#endif 712 default: 713 port = 0; 714 } 715 if (port == 0) 716 return ("*"); 717 snprintf(buf, len, "%u", port); 718 return (buf); 719} 720 721void 722kdebug_secpolicy(struct secpolicy *sp) 723{ 724 u_int idx; 725 726 IPSEC_ASSERT(sp != NULL, ("null sp")); 727 printf("SP { refcnt=%u id=%u priority=%u state=%s policy=%s\n", 728 sp->refcnt, sp->id, sp->priority, 729 kdebug_secpolicy_state(sp->state), 730 kdebug_secpolicy_policy(sp->policy)); 731 kdebug_secpolicyindex(&sp->spidx, " "); 732 for (idx = 0; idx < sp->tcount; idx++) { 733 printf(" req[%u]{ level=%s ", idx, 734 kdebug_ipsecrequest_level(sp->req[idx]->level)); 735 kdebug_secasindex(&sp->req[idx]->saidx, NULL); 736 printf(" }\n"); 737 } 738 printf("}\n"); 739} 740 741void 742kdebug_secpolicyindex(struct secpolicyindex *spidx, const char *indent) 743{ 744 char buf[IPSEC_ADDRSTRLEN]; 745 746 IPSEC_ASSERT(spidx != NULL, ("null spidx")); 747 if (indent != NULL) 748 printf("%s", indent); 749 printf("spidx { dir=%s ul_proto=", 750 kdebug_secpolicyindex_dir(spidx->dir)); 751 if (spidx->ul_proto == IPSEC_ULPROTO_ANY) 752 printf("* "); 753 else 754 printf("%u ", spidx->ul_proto); 755 printf("%s/%u -> ", ipsec_address(&spidx->src, buf, sizeof(buf)), 756 spidx->prefs); 757 printf("%s/%u }\n", ipsec_address(&spidx->dst, buf, sizeof(buf)), 758 spidx->prefd); 759} 760 761void 762kdebug_secasindex(const struct secasindex *saidx, const char *indent) 763{ 764 char buf[IPSEC_ADDRSTRLEN], port[6]; 765 766 IPSEC_ASSERT(saidx != NULL, ("null saidx")); 767 if (indent != NULL) 768 printf("%s", indent); 769 printf("saidx { mode=%s proto=%u reqid=%u ", 770 kdebug_secasindex_mode(saidx->mode), saidx->proto, saidx->reqid); 771 printf("%s:%s -> ", ipsec_address(&saidx->src, buf, sizeof(buf)), 772 kdebug_port2str(&saidx->src.sa, port, sizeof(port))); 773 printf("%s:%s }\n", ipsec_address(&saidx->dst, buf, sizeof(buf)), 774 kdebug_port2str(&saidx->dst.sa, port, sizeof(port))); 775} 776 777static void 778kdebug_sec_lifetime(struct seclifetime *lft, const char *indent) 779{ 780 781 IPSEC_ASSERT(lft != NULL, ("null lft")); 782 if (indent != NULL) 783 printf("%s", indent); 784 printf("lifetime { alloc=%u, bytes=%ju addtime=%ju usetime=%ju }\n", 785 lft->allocations, (uintmax_t)lft->bytes, (uintmax_t)lft->addtime, 786 (uintmax_t)lft->usetime); 787} 788 789void 790kdebug_secash(struct secashead *sah, const char *indent) 791{ 792 793 IPSEC_ASSERT(sah != NULL, ("null sah")); 794 if (indent != NULL) 795 printf("%s", indent); 796 printf("SAH { refcnt=%u state=%s\n", sah->refcnt, 797 kdebug_secasv_state(sah->state)); 798 if (indent != NULL) 799 printf("%s", indent); 800 kdebug_secasindex(&sah->saidx, indent); 801 if (indent != NULL) 802 printf("%s", indent); 803 printf("}\n"); 804} 805 806#ifdef IPSEC_DEBUG 807static void 808kdebug_secreplay(struct secreplay *rpl) 809{ 810 int len, l; 811 812 IPSEC_ASSERT(rpl != NULL, ("null rpl")); 813 printf(" secreplay{ count=%u bitmap_size=%u wsize=%u seq=%u lastseq=%u", 814 rpl->count, rpl->bitmap_size, rpl->wsize, rpl->seq, rpl->lastseq); 815 816 if (rpl->bitmap == NULL) { 817 printf(" }\n"); 818 return; 819 } 820 821 printf("\n bitmap { "); 822 for (len = 0; len < rpl->bitmap_size*4; len++) { 823 for (l = 7; l >= 0; l--) 824 printf("%u", (((rpl->bitmap)[len] >> l) & 1) ? 1 : 0); 825 } 826 printf(" }\n"); 827} 828#endif /* IPSEC_DEBUG */ 829 830static void 831kdebug_secnatt(struct secnatt *natt) 832{ 833 char buf[IPSEC_ADDRSTRLEN]; 834 835 IPSEC_ASSERT(natt != NULL, ("null natt")); 836 printf(" natt{ sport=%u dport=%u ", ntohs(natt->sport), 837 ntohs(natt->dport)); 838 if (natt->flags & IPSEC_NATT_F_OAI) 839 printf("oai=%s ", ipsec_address(&natt->oai, buf, sizeof(buf))); 840 if (natt->flags & IPSEC_NATT_F_OAR) 841 printf("oar=%s ", ipsec_address(&natt->oar, buf, sizeof(buf))); 842 printf("}\n"); 843} 844 845void 846kdebug_secasv(struct secasvar *sav) 847{ 848 struct seclifetime lft_c; 849 850 IPSEC_ASSERT(sav != NULL, ("null sav")); 851 852 printf("SA { refcnt=%u spi=%u seq=%u pid=%u flags=0x%x state=%s\n", 853 sav->refcnt, ntohl(sav->spi), sav->seq, (uint32_t)sav->pid, 854 sav->flags, kdebug_secasv_state(sav->state)); 855 kdebug_secash(sav->sah, " "); 856 857 lft_c.addtime = sav->created; 858 lft_c.allocations = (uint32_t)counter_u64_fetch( 859 sav->lft_c_allocations); 860 lft_c.bytes = counter_u64_fetch(sav->lft_c_bytes); 861 lft_c.usetime = sav->firstused; 862 kdebug_sec_lifetime(&lft_c, " c_"); 863 if (sav->lft_h != NULL) 864 kdebug_sec_lifetime(sav->lft_h, " h_"); 865 if (sav->lft_s != NULL) 866 kdebug_sec_lifetime(sav->lft_s, " s_"); 867 868 if (sav->tdb_authalgxform != NULL) 869 printf(" alg_auth=%s\n", sav->tdb_authalgxform->name); 870 if (sav->key_auth != NULL) 871 KEYDBG(DUMP, 872 kdebug_sadb_key((struct sadb_ext *)sav->key_auth)); 873 if (sav->tdb_encalgxform != NULL) 874 printf(" alg_enc=%s\n", sav->tdb_encalgxform->name); 875 if (sav->key_enc != NULL) 876 KEYDBG(DUMP, 877 kdebug_sadb_key((struct sadb_ext *)sav->key_enc)); 878 if (sav->natt != NULL) 879 kdebug_secnatt(sav->natt); 880 if (sav->replay != NULL) { 881 KEYDBG(DUMP, 882 SECASVAR_LOCK(sav); 883 kdebug_secreplay(sav->replay); 884 SECASVAR_UNLOCK(sav)); 885 } 886 printf("}\n"); 887} 888 889void 890kdebug_mbufhdr(const struct mbuf *m) 891{ 892 /* sanity check */ 893 if (m == NULL) 894 return; 895 896 printf("mbuf(%p){ m_next:%p m_nextpkt:%p m_data:%p " 897 "m_len:%d m_type:0x%02x m_flags:0x%02x }\n", 898 m, m->m_next, m->m_nextpkt, m->m_data, 899 m->m_len, m->m_type, m->m_flags); 900 901 if (m->m_flags & M_PKTHDR) { 902 printf(" m_pkthdr{ len:%d rcvif:%p }\n", 903 m->m_pkthdr.len, m->m_pkthdr.rcvif); 904 } 905 906 if (m->m_flags & M_EXT) { 907 printf(" m_ext{ ext_buf:%p ext_free:%p " 908 "ext_size:%u ext_cnt:%p }\n", 909 m->m_ext.ext_buf, m->m_ext.ext_free, 910 m->m_ext.ext_size, m->m_ext.ext_cnt); 911 } 912 913 return; 914} 915 916void 917kdebug_mbuf(const struct mbuf *m0) 918{ 919 const struct mbuf *m = m0; 920 int i, j; 921 922 for (j = 0; m; m = m->m_next) { 923 kdebug_mbufhdr(m); 924 printf(" m_data:\n"); 925 for (i = 0; i < m->m_len; i++) { 926 if (i && i % 32 == 0) 927 printf("\n"); 928 if (i % 4 == 0) 929 printf(" "); 930 printf("%02x", mtod(m, const u_char *)[i]); 931 j++; 932 } 933 printf("\n"); 934 } 935 936 return; 937} 938 939/* Return a printable string for the address. */ 940char * 941ipsec_address(const union sockaddr_union* sa, char *buf, socklen_t size) 942{ 943 944 switch (sa->sa.sa_family) { 945#ifdef INET 946 case AF_INET: 947 return (inet_ntop(AF_INET, &sa->sin.sin_addr, buf, size)); 948#endif /* INET */ 949#ifdef INET6 950 case AF_INET6: 951 if (IN6_IS_SCOPE_LINKLOCAL(&sa->sin6.sin6_addr)) { 952 snprintf(buf, size, "%s%%%u", inet_ntop(AF_INET6, 953 &sa->sin6.sin6_addr, buf, size), 954 sa->sin6.sin6_scope_id); 955 return (buf); 956 } else 957 return (inet_ntop(AF_INET6, &sa->sin6.sin6_addr, 958 buf, size)); 959#endif /* INET6 */ 960 case 0: 961 return ("*"); 962 default: 963 return ("(unknown address family)"); 964 } 965} 966 967char * 968ipsec_sa2str(struct secasvar *sav, char *buf, size_t size) 969{ 970 char sbuf[IPSEC_ADDRSTRLEN], dbuf[IPSEC_ADDRSTRLEN]; 971 972 snprintf(buf, size, "SA(SPI=%08lx src=%s dst=%s)", 973 (u_long)ntohl(sav->spi), 974 ipsec_address(&sav->sah->saidx.src, sbuf, sizeof(sbuf)), 975 ipsec_address(&sav->sah->saidx.dst, dbuf, sizeof(dbuf))); 976 return (buf); 977} 978 979#endif /* _KERNEL */ 980 981void 982kdebug_sockaddr(struct sockaddr *addr) 983{ 984 char buf[IPSEC_ADDRSTRLEN]; 985 986 /* sanity check */ 987 if (addr == NULL) 988 panic("%s: NULL pointer was passed.\n", __func__); 989 990 switch (addr->sa_family) { 991#ifdef INET 992 case AF_INET: { 993 struct sockaddr_in *sin; 994 995 sin = (struct sockaddr_in *)addr; 996 inet_ntop(AF_INET, &sin->sin_addr, buf, sizeof(buf)); 997 break; 998 } 999#endif 1000#ifdef INET6 1001 case AF_INET6: { 1002 struct sockaddr_in6 *sin6; 1003 1004 sin6 = (struct sockaddr_in6 *)addr; 1005 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) { 1006 snprintf(buf, sizeof(buf), "%s%%%u", 1007 inet_ntop(AF_INET6, &sin6->sin6_addr, buf, 1008 sizeof(buf)), sin6->sin6_scope_id); 1009 } else 1010 inet_ntop(AF_INET6, &sin6->sin6_addr, buf, 1011 sizeof(buf)); 1012 break; 1013 } 1014#endif 1015 default: 1016 sprintf(buf, "unknown"); 1017 } 1018 printf("sockaddr{ len=%u family=%u addr=%s }\n", addr->sa_len, 1019 addr->sa_family, buf); 1020} 1021 1022void 1023ipsec_bindump(caddr_t buf, int len) 1024{ 1025 int i; 1026 1027 for (i = 0; i < len; i++) 1028 printf("%c", (unsigned char)buf[i]); 1029 1030 return; 1031} 1032 1033 1034void 1035ipsec_hexdump(caddr_t buf, int len) 1036{ 1037 int i; 1038 1039 for (i = 0; i < len; i++) { 1040 if (i != 0 && i % 32 == 0) printf("\n"); 1041 if (i % 4 == 0) printf(" "); 1042 printf("%02x", (unsigned char)buf[i]); 1043 } 1044#if 0 1045 if (i % 32 != 0) printf("\n"); 1046#endif 1047 1048 return; 1049} 1050